After a long day on Tatooine fighting off Sandpeople and haggling over the price of power converters, Obi-Wan and Luke Skywalker walk into a droid...

BaR2D2 is a radio-controlled, mobile bar that features a motorized beer elevator, motorized ice/mixer drawer, six-bottle shot dispenser, and sound activated neon lighting. The robot is driveable so you can take the party on the road! It was created in my garage using standard hand/power tools and readily available parts and materials.

BaR2D2's creator, Jamie Price, sent us a link that includes all the construction details, as well as a few photos of the droid with C3PO, R2, Vader, and some Stormtroopers at the Dragon*con convention.

Build A Mobile Bar - BaR2D2

I had written some code to take wikipedia articles and summarise them. I wanted to offer this for use in various places, now the obvious way to offer it is just a web service (via REST, SOAP, etc), but that's boring and I had a cunning plan. Why not offer it over DNS - it is basically a huge associative array and DNS is designed for this stuff.

So I wrote a little nameserver which returns the results as TXT records. There are some obvious limitations for example responses are limited to around 430 bytes (it only does UDP). It has advantages too, it gets cached at your nameserver and it is also faster than HTTP (no need to setup a TCP session).

Here's an example command line entry that will pull a summary of the Hack article in Wikipedia:

host -t txt hack.wp.dg.cx

hack.wp.dg.cx descriptive text "Hack may refer to: Hack (technology), a term used in the technology and computer science fields, Hack (masonry), a row of stacked unfired bricks protected from the rain, Hack writer, a writer who is paid to write low-quality, quickly put-together articles" " or books, Hack and slash, a genre of video game or a type of gameplay, Life hack, productivity techniques used by... http://a.vu/w:Hack"

Impressive, rolling out a completely distributed, cached utility on existing infrastructure, requiring no end-user software to be installed. It's a testament to versatility and genius of DNS that one of the Internet's original protocols still exists, is as essential as ever, and still has a few tricks up its old sleeves.

Wikipedia over DNS
Slideshow from David's presentation at the London Perl Workshop 2008

A group of researchers were recently able to subvert the public key infrastructure used by common web browsers using an MD5 hash collision. The MD5 hash algorithm was proven vulnerable to collisions some time ago, but this is a huge real-world example of the problem being exploited with serious potential consequences.

The best part of this whole story is that the bulk of the work was done over a weekend using a supercomputer made out of 200 PS3s.

The team was able to create a rogue certificate authority certificate that had the same MD5 signature as a legitimately signed certificate. This would allow an attacker to create any number of fake SSL certificates and perform a man in the middle attack on any HTTPS site.

As a result of this successfull attack, we are currently in possession of a rogue Certification Authority certificate. This certificate will be accepted as valid and trusted by all common browsers, because it appears to be signed by one of the root CAs that browsers trust by default. In turn, any website certificate signed by our rogue CA will be trusted as well. If an unsuspecting user is a victim of a man-in-the-middle attack using such a certificate, they will be assured that the connection is secure through all common security indicators: a "https://" url in the address bar, a closed padlock and messages such as "This certificate is OK" if they chose to inspect the certificate.

This successful proof of concept shows that the certificate validation performed by browsers can be subverted and malicious attackers might be able to monitor or tamper with data sent to secure websites. Banking and e-commerce sites are particularly at risk because of the high value of the information secured with HTTPS on those sites. With a rogue CA certificate, attackers would be able to execute practically undetectable phishing attacks against such sites.

It appears that with the announcement of the vulnerability, the problem is quickly being dealt with. Verisign has discontinued using MD5-hashed certificates and will replace any MD5 signed certs for free. Even the US Department of Homeland Security's Computer Emergency Readiness Team chimed in:

Do not use the MD5 algorithm

Software developers, Certification Authorities, website owners, and users should avoid using the MD5 algorithm in any capacity. As previous research has demonstrated, it should be considered cryptographically broken and unsuitable for further use.

Call me paranoid, but this makes me wonder who else may have had their hands on this exploit and for how long.

Creating a Rogue CA Certificate

Bob Hickman, Minty Amp maker, sent us a howto on making a jig for small form factor soldering projects.

I often have to solder up a bunch of PCBs that are the same size, but have a bunch of fiddly components on them.

To save time and frustration, I decided to re-purpose a used chewing gum tin to make a jig so I could solder multiple boards at once and keep my components from moving about.

His hack allows you to place all of the components and then solder them all at once, which is pretty handy even if you're not soldering a bunch of boards at the same time. The trick is to cram a bunch of flame retardant foam inside and close the top cover, sandwiching the components onto the PCB. You can then move things around as you please and your hands are free to work the solder and iron.

Simple Soldering Jig

Occasionally, one wants to execute a query and have the rows in the results set numbered. This could be done using a variable. For example:

SELECT @row := @row + 1 as row, t.*
FROM some_table t, (SELECT @row := 0) r

I haven't used this feature of MySQL before, but it looks like it could be pretty useful. The user defined variables are scoped to a connection but persist between statements, so you can use them to store intermediate state information between queries or even perform iterative calculation within a single query, as was done in the example above.

MySQL User-Defined Variables

The friendly iPhone Dev Team hackers have been hard at work over the holidays and have promised to release the iPhone 3G software unlocking utility, called yellowsn0w, sometime tomorrow for New Year's Eve.

A few details from the iPhone Dev Team blog:

We have been working hard on a few other things. The main one being the 3G unlock codenamed "yellowsn0w". This is now completed and is currently being packaged into a user-friendly application with the simplicity that you see in QuickPwn or BootNeuter.

• The target release date for the unlock is New Year's Eve 2008.
• This unlock method is available to iPhone 3Gs that have 2.11.07 baseband or earlier, we did warn you.
• You can tell what version baseband you have by going to Settings->General->About->Modem Firmware
• The unlock requires a jailbroken 3G iPhone. It'll be installable via Cydia and so it doesn't matter if you have a Mac or PC.
• Please refrain from updating your baseband, regardless of what version you're at.
• We'll have complete directions on New Year's Eve.
• We'll stream a live demo of the unlock before Christmas (see the update at the end of this post)

The software exists, as you can see from the video above, which was released last week, so I'm pretty confident we'll see the release as promised. From what I understand, the software is non-invasive and needs to be run every time the phone is booted, which will be executed during boot and invisible to the end user.

You do need an un-upgraded <2.11.07 version of the baseband, and for the near future you'll have to be careful not to upgrade it if you want to keep your phone unlockable. If you want to upgrade your phone but not kill the possibility of unlocking it, the team has some information on using PwnageTool to upgrade the iPhone firmware while keeping the baseband firmware intact. If you've already updated your baseband, consider yourself stuck with AT&Tuntil a new hack comes along.

Dev Team Blog (watch here for updates)
Original yellowsn0w Announcement
yellowsn0w Preview Demo

If you have the Google Phone and prefer hacking Python over Java, this is just what you've been waiting for:

Here's an early Christmas present for all those Python fanatics (self included) out there! With a lot of help from my friends (thanks Manuel and Thomas!) I managed to install Python 2.4.5 on my G1. It's still rough around the edges, but I think it's a good start. Klaus Reimer has a nice overview of how to cross-compile Python. My instructions borrow a lot from his.

You'll need to do a bit of patching and cross compilation, but Damon's instructions are thorough enough to get you through it.

Python on Android

If you're an Arduino fan, you can easily create your own custom devices that can interact with your camcorder using the LANC protocol, allowing you to control zoom and record functions from your own programs. Goose wrote about his own project and example Arduino source:

I found source code to do LANC control with the Arduino board. It was written quite well - it worked the first time out. I made a few changes though, specifically changing it from being controlled by a serial port to being controlled by a potentiometer. I plan to build my own zoom controller with it, using an Arduino Mini.

The original code comes from Brady Marks. Make sure to check out the README and other documentation inside the source zip file. Along with the Arduino source, there's a bunch of LANC protocol documentation as well as some collected emails and mailing list discussion on the topic.

Zoomduino - Arduino Zoom Controller
SONY LANC Protocol Details
Brady Marks' Arduino LANC Source

Using a 1px gradient PNG image and a solid background, you can create a snazzy gradient text effect. It looks pretty, but the real beauty is that you don't need to cut custom titles, and the markup is simple and search friendly. The trick isn't limited to just gradients, but can be used for a number of different patterns. As long as you have a solid background, you can overlay the text with any semi-transparent image pattern that matches the background.

CSS Gradient Text Effect

The holiday break is a good time for 30/40/50/etc.-somethings to take trips down memory lane and dig up games from their childhood. For those of us who either don't have old systems in their attics/basements or who have grown bored with their contents, there are always emulators.

The hassle with emulators is finding games to play on them: if you have the original disks, you can, with some effort, transfer them to your computer. There's also the path of least resistance, downloading ROMs, but that opens up complicated set of legal and ethical issues. Another option is to find emulators that include the ROMs--legally. Here are a couple I've found:

Miner 2049er and Bounty Bob Strikes Back
Big Five Software, makers of two of the best old-school platform games, released a dedicated emulator that plays the 8-bit Atari computer versions of both.

Classic99
Harmless Lion obtained permission to include the TI-99/4a system ROMs and many TI classics, including Hunt the Wumpus, Parsec, and Tunnels of Do... (OK, I just lost about half the readers of the blog here. Oh, back so soon? I know you are just looking for info on how to play Tunnels of Doom).

(These two bundles are Windows-only, but they played fine for me under VMware Fusion.)

Parabellum's Java Vectrex Emulator
The Vectrex Game ROMs are available for free, which makes it possible for Vectrex emulator developers to include the games along with their emulators. This emulator is cross-platform; you can download versions for Windows, Linux, and Mac OS X.

PDRoms
Be sure to check out the wealth of homebrew ROMs available. These are created by the community, and although they aren't the games you remember from your youth, they have an old-school feel and many are as good as the best from the old days.

Know of any other legal emulator/ROM combos out there? I'm sure there are more; post them up in the comments, please! My wish? Shamus.

Gaming Hacks
It doesn't take long for an avid or just wickedly clever gamer to be chafed by the limitations of videogame software or hardware. If you want to go far beyond the obvious, there's an awful lot of free fun you can have, using the creative exploits of the gaming gurus. Gaming Hacks is the indispensable guide to cool things gamers can do to create, modify, and hack videogame hardware and software.

Retro Gaming Hacks
Whether you're just discovering Tetris or you've been a Pong junkie since puberty, Chris Kohler's Retro Gaming Hacks is your indispensable new guide to classic games. Kohler has compiled the how-to information that used to take weeks of web surfing to find and presents it in highly readable Hacks style.

They usually work so well, it's easy to forget about all the electronics crammed inside a compact fluorescent light bulb. MAKE reader Ollie AJ1O sent us a link to ham Michael J. Rainey's (AA1TJ) "Das DereLicht" radio, a transmitter made almost completely from the parts of a defective CFL bulb.

This electronic puzzle was a result of my changing a defective compact fluorescent lamp (CFL) in my kitchen. For some reason, I began to wonder if it would be possible to build a QRP CW transmitter using the electronic components salvaged from this derelict lamp.

Indeed, I'm pleased to report that a perfectly serviceable transmitter may be constructed! The only additional components required were the quartz crystal, and four of the five components needed for the output lowpass filter. The resulting transmitter produces up to 1.5 watts on 80m.

For all the hams out there: what's the coolest radio hack you've created or heard of? Send us a shout in the comments.

Das DereLicht - Ham Radio From A CFL Bulb

A content delivery network, or CDN, is a system of servers spread around the world, serving files from the nearest physical location. Instead of waiting for a file to find its way from a server farm in Silicon Valley 8,000 kilometres away, I can receive it from London, Dublin, or Paris, cutting down the time I wait. The big names -- Google, Yahoo, Amazon, et al -- use CDNs for their sites, but they've always been far too expensive for us mere mortals. Until now.

There's a service out there ready for you to use as your very own CDN. You have the company's blessing, you won't need to write a line of code, and -- best of all -- it's free.

There are limitations to the service, of course. You can't host any files larger than 1MB, and you're limited to 650,000 requests a day and 10GB of downloads. That said, there are a lot of sites that fit within these parameters and could offload the static portion of their content to see a large reduction in bandwidth and provide faster load times to end users.

Using Google App Engine as Your Own Content Delivery Network
Google App Engine

Route-me is an Open Source (BSD license) mapping library for the iPhone. It's written in native Objective C and can use the OpenStreetMap data layer, among others. If you're an iPhone developer, this gives you an easy way to add high-quality mapping functionality, similar to that of the built in Google Maps client, to your own applications. There's a discussion over on Slashdot of one such application, GPS Mission, which uses the route-me library to create a multiplayer location-based scavenger hunt.

This is pretty exciting—hopefully it will help enable a whole new class of location-aware apps. If you know of any other apps based on the route-me library, or if you have a good idea you'd like to share for a map based application, send us a line in the comments.

Route-me - Open Source iPhone-native Slippy Map
How To Make an App Using the Route-me Library

Marcus wrote in to tell us about his latest ping pong ball electronics project, the Gravitron. In half of a ping pong ball, he's crammed 12 LEDs, an accelerometer, and an ATmega168 for a brain. If you pick it up and tilt it, it will light the highest LED. It's sort of poetic.

If you're as impressed as I am with his efficiency of space, check out Marcus' other ping pong ball experiments on his blog.

Gravitron - Playing around with gravity

PIxastic is a Javascript library that provides low level image processing capabilities to your web applications. Jacob Seidelin has been working on this as part of an all-Javascript image editor, and he decided to release the library under the MIT license earlier this month:

Pixastic works by utilizing the HTML5 Canvas element which provides access to raw pixel data, thereby opening up for more advanced image effects. This is where the "experimental" part comes into play. Canvas is only supported by some browsers and unfortunately Internet Explorer is not one of them. It is however well supported in both Firefox and Opera and proper support is hopefully coming for Safari soon (Safari currently only works with the WebKit nightly builds). A few of the effects have been simulated in IE using the age old proprietary filters. While these filters are much faster than their Canvas friends, they are few and limited. Hopefully we will one day have real Canvas on IE as well.

The ability to manipulate image data directly is one of the more compelling features of the next generation of web browsers. I'm looking forward to the day when I can cut and paste an image directly into a blog post, adjust its color and crop it, all without jumping back and forth to an image editor.

Check the Pixastic site for more details on the supported browsers and available filters. There's also a small snippet of code that shows you how to use Pixastic with jQuery.

Pixastic Image Processing Library
Picastic Documentation