this desktop is 436 KB and lies to you

Everything you are looking at is one HTML file, one stylesheet, a 20 KB script, and a bitmap font from 1987.

The window chrome is XP.css. The rest — the boot sequence, the ridge wallpaper, the taskbar, the shell you are probably typing in — is hand written, because a desktop metaphor is mostly a z-index problem with good manners.

Two things turned out to matter more than the rest.

The first:

  [hidden] { display: none !important }

An id selector beats any [hidden] rule you can write, and every overlay here is id-scoped with a display value. Without that line the boot screen, the BSOD and the shutdown screen were all visible at once, stacked on top of each other. It looked like a crash. It was a specificity bug.

The second: the keypress that opens a "press any key" screen is still bubbling when the screen appears, so the screen dismisses itself instantly. Every wait-for-a-key here arms its listener 350 ms late.

No trackers, no analytics, no cookies, no fonts from anyone else’s CDN. The hit counter counts your visits, in your browser, and tells nobody.

the kettle that spoke SMTP

The Cauldron Mk II boils water in four minutes and, it turns out, also speaks SMTP. Nobody asked it to.

Getting in was embarrassing: four unlabelled pads under the base, 3.3V UART at 115200, and a bootloader that drops to a shell if you hold a key during POST.

  [    0.000] cauldron-fw 2.1.4 (build 8813)
  [    0.412] wifi: assoc ok, rssi -54
  [    1.038] smtpd: init
  [    1.041] smtpd: relay=mail.[redacted]:587 user=kettle

That last line is the whole writeup, really.

Dumping the SPI flash and running strings over it turned up a credential pair sitting in the clear at offset 0x3A100:

  0003a100  6b 65 74 74 6c 65 40 63  61 75 6c 64 72 6f 6e 2e  |kettle@cauldron.|
  0003a110  6e 65 74 00 68 75 6e 74  65 72 32 00 00 00 00 00  |net.hunter2.....|

The firmware mails a "boil complete" event home. Every boil. Since 2019. There are people in that mailbox who have made nine thousand cups of tea and were never told that anyone was counting.

I have since replaced the firmware with forty lines that do exactly one thing: boil water.

a synth that lies about its own firmware version

Every device with a version field will eventually lie to you about it. This one managed to lie in two directions at once.

The identity reply is documented, sort of:

  -> F0 7E 00 06 01 F7                     ; identity request
  <- F0 7E 00 06 02 41 12 00 00 00 01 2A F7
                                    ^^ ^^
                                    major / minor, allegedly

That says 1.42. The bootloader banner on the serial header says 1.39. The checksum of the image on flash matches neither.

What actually happens: the version bytes live in a string table that nobody updates, while the real version sits in a struct at the tail of the image that only the updater ever reads. Two sources of truth, one decorative.

The interesting part is outside the documented command range. Command byte 0x7D returns the entire parameter RAM in a single blob, which is a great deal nicer than the four hundred individual requests the official editor makes on every connect:

  -> F0 41 12 7D 00 00 F7
  <- F0 41 12 7D 00 00 [1024 bytes] [chk] F7

I have no idea whether that was left in deliberately. I have decided to believe it was a gift.

1997 arcade cabinet, 2026 problems

The cabinet came out of a bar that closed, which is how most cabinets come to anybody. It boots to attract mode and ignores the coin door entirely.

Four 27C010s, a 68000, and a sound board that hums in the key of B. Pulled the ROMs, dumped them, byte-interleaved the pairs, and got something that disassembled cleanly on the first attempt, which never happens.

  00004a12  4e b9 00 01 2c 40    jsr     $12c40      ; read coin mech
  00004a18  0c 40 00 07          cmpi.w  #7,d0
  00004a1c  66 f4                bne.s   $4a12       ; spin forever
  00004a1e  4e 75                rts

That loop waits for the mech to report 7 and will not continue until it does. The mech in this cabinet reports 3. Somebody swapped the part decades ago and never touched the ROM. Two bytes fixed it.

The service menu turned out to be behind a button combination held during boot — P1 start, P2 start and the test switch — which appears in no manual, because there is no manual.

It plays. The high scores from 1998 are still in the battery-backed RAM, and I am not going to be the one who clears them.

the badge that phoned home in DNS

Conference badges are small computers handed to you by strangers. This one had wifi, which is already a decision somebody made.

Pointed it at a network I control and watched. It associates, resolves the usual handful of names, and then starts asking for these:

  a1f4c2e9.d.badge-telemetry.invalid.  IN TXT
  b7710033.d.badge-telemetry.invalid.  IN TXT
  c0de4d41.d.badge-telemetry.invalid.  IN TXT

That is not name resolution. That is a covert channel wearing a hat.

Each label is hex, four bytes at a time. The stream decodes to the badge serial, every SSID it has seen, and a rolling count of the other badges it has been near — the social graph of an entire conference, leaving over port 53, because port 53 is always open.

Sinkholed it. The badge still works perfectly. Everything it wanted the network for, it did not need the network for.