Like many classic board games, Ludo offers its players numerous opportunities to inflict frustration on other players. Despite this, [Viktor Takacs] apparently enjoys it, which motivated him to build a thoroughly modernized, LED-based, WiFi-enabled game board for it (GitHub repository).

The new game board is built inside a stylish 3D-printed enclosure with a thin white front face, under which the 115 LEDs sit. Seven LEDs in the center represent a die, and the rest mark out the track around the board and each user’s home row. Up to six people can play on the board, and different colors of the LEDs along the track represent their tokens’ positions. To prevent light leaks, a black plastic barrier surrounds each LED. Each player has one button to control their pieces, with a combination of long and short presses serving to select one of the possible actions.

The electronics themselves are mounted on seven circuit boards, which were divided into sections to reduce their size and therefore their manufacturing cost. For component placement reasons, [Viktor] used a barrel connector instead of USB, but for more general compatibility also created an adapter from USB-C to a barrel plug. The board is controlled by an ESP32-S3, which hosts a server that can be used to set game rules, configure player colors, save and load games, and view statistics for the game (who rolled the most sixes, who sent other players home most often, etc.).

If you prefer your games a bit more complex, we’ve also seen electronics added to Settlers of Catan. On a rather larger scale, there is also this LED-based board game which invites humans onto the board itself.

youtube.com/embed/l1b1UZjEF5Y?…

Thanks to [Victoria Bei] for the tip!

hackaday.com/2025/12/05/adding…

One of the most influential inventions of the 20th century was Big Mouth Billy Bass. A celebrity bigger than the biggest politicians or richest movie stars, there’s almost nothing that could beat Billy. That is, until [Kiara] from Kiara’s Workshop built a Magikarp version of Big Mouth Billy Bass.

Sizing in at over 2 entire feet, the orange k-carp is able to dance, it is able to sing, and it is able to stun the crowd. Magikarp functions the same way as its predecessor; a small button underneath allows the show to commence. Of course, this did not come without its challenges.

Starting the project was easy, just a model found online and some Blender fun to create a basic mold. Dissecting Big Mouth Billy Bass gave direct inspiration for how to construct the new idol in terms of servos and joints. Programming wasn’t even all that much with the use of Bottango for animations. Filling the mold with the silicone filling proved to be a bit more of a challenge.

After multiple attempts with some minor variations in procedure, [Kirara] got the fish star’s skin just right. All it took was a paint job and some foam filling to get the final touches. While this wasn’t the most mechanically challenging animatronic project, we have seen our fair share of more advanced mechanics. For example, check out this animatronic that sees through its own eyes!

youtube.com/embed/spsPT778ws0?…

hackaday.com/2025/12/05/magic-…

[Rick] had a problem. His garage refrigerator was tasked with a critical duty—keeping refreshing beverages at low temperature. Unfortunately, it had failed—the condenser was forever running, or not running at all. The beverages were either frozen, or lukewarm, regardless of the thermostat setting. There was nothing for it—the controller had to be rebuilt from scratch.

Thankfully, [Rick]’s junk drawer was obliging. He was able to find an Arduino Uno R4, complete with WiFi connectivity courtesy of the ESP32 microcontroller onboard. This was paired with a DHT11 sensor, which provided temperature and humidity measurements. [Rick] began testing the hardware by spitting out temperature readings on the Uno’s LED matrix.

Once that was working, the microcontroller had to be given control over the fridge itself. This was achieved by programming it to activate a Kasa brand smart plug, which could switch mains power to the fridge as needed. The Uno simply emulated the action of the Kasa phone app to switch the smart plug on and off to control the fridge’s temperature, with the fridge essentially running flat out whenever it was switched on. The Uno also logs temperature to a server so [Rick] can make sure temperatures remain in the proper range.

We’ve seen some great beverage-cooling hacks over the years. If you’ve mastered your own hacky methods of keeping the colas chilled, don’t hesitate to let us know on the tipsline.

hackaday.com/2025/12/05/garage…

We have probably all been there: digging through boxes full of old boards for projects and related parts. Often it’s not because we’re interested in the contents of said box, but because we found ourselves wondering why in the name of project management we have so many boxes of various descriptions kicking about. This is the topic of [Joe Barnard]’s recent video on his BPS.shorts YouTube channel, as he goes through box after box of stuff.

For some of the ‘trash’ the answer is pretty simple; such as the old rocket that’s not too complex and can have its electronics removed and the basic tube tossed, which at least will reduce the volume of ‘stuff’. Then there are the boxes with old projects, each of which are tangible reminders of milestones, setbacks, friendships, and so on. Sentimental stuff, basically.

Some rules exist for safety that make at least one part obvious, and that is that every single Li-ion battery gets removed when it’s not in use, with said battery stored in its own fire-resistant box. That then still leaves box after box full of parts and components that were ordered for projects once, but not fully used up. Do you keep all of it, just in case it will be needed again Some Day? The same issue with boxes full of expensive cut-off cable, rare and less rare connectors, etc.

One escape clause is of course that you can always sell things rather than just tossing it, assuming it’s valuable enough. In the case of [Joe] many have watched his videos and would love to own a piece of said history, but this is not an option open to most. Leaving the question of whether gritting one’s teeth and simply tossing the ‘value-less’ sentimental stuff and cheap components is the way to go.

Although there is always the option of renting storage somewhere, this feels like a cheat, and will likely only result in the volume of ‘stuff’ expanding to fill the void. Ultimately [Joe] is basically begging his viewers to help him to solve this conundrum, even as many of them and our own captive audience are likely struggling with a similar problem. Where is the path to enlightenment here?

youtube.com/embed/IPXQ_6CMm28?…

hackaday.com/2025/12/05/reason…

Join Hackaday Editors Elliot Williams and Tom Nardi as they go over their picks for the best stories and hacks from the previous week. Things start off with a warning about the long-term viability of SSD backups, after which the discussion moves onto the limits of 3D printed PLA, the return of the Pebble smart watch, some unconventional aircraft, and an online KiCad schematic repository that has plenty of potential. You’ll also hear about a remarkable conference badge made from e-waste electronic shelf labels, filling 3D prints with foam, and a tiny TV powered by the ESP32. The episode wraps up with our wish for hacker-friendly repair manuals, and an interesting tale of underwater engineering from D-Day.

Check out the links below if you want to follow along, and as always, tell us what you think about this episode in the comments!

html5-player.libsyn.com/embed/…

As always, this episode is available in DRM-free MP3.

Where to Follow Hackaday Podcast

Places to follow Hackaday podcasts:

• iTunes
• Spotify
• Stitcher
• RSS
• YouTube
• Check out our Libsyn landing page

Episode 348 Show Notes:

News:

• A Friendly Reminder That Your Unpowered SSDs Are Probably Losing Data

What’s that Sound?

• Congratulations to [for_want_of_a_better_handle] for guessing the data center ambiance!

Interesting Hacks of the Week:

• Designing PLA To Hold Over A Metric Ton
• The New Pebble: Now 100% Open Source
• Magnus Effect Drone Flies, Looks Impossible
  
  • Your Quadcopter Has Three Propellers Too Many
  • KFC Winged Aircraft Actually Flies

  
  

• An Online Repository For KiCad Schematics
• Shelf Life Extended: Hacking E-Waste Tags Into Conference Badges
• On The Benefits Of Filling 3D Prints With Spray Foam

Quick Hacks:

• Elliot’s Picks:
  
  • Get To The Games On Time With This Ancient-Style Waterclock
  • How To Design 3D Printed Pins That Won’t Break
  • Necroprinting Isn’t As Bad As It Sounds
  • Tiny Little TV Runs On ESP32

  
  

• Tom’s Picks:
  
  • Little Lie Detector Is Probably No Worse Than The Big Ones
  • Build Your Own Glasshole Detector
  • Portable Plasma Cutter Removes Rust, Packs A (Reasonable) Punch

  
  

Can’t-Miss Articles:

• Give Us One Manual For Normies, Another For Hackers
• How Cross-Channel Plumbing Fuelled The Allied March On Berlin

hackaday.com/2025/12/05/hackad…

Over the many years Apple Computer have been in operation, they have made a success of nearly-seamlessly transitioning multiple times between both operating systems and their underlying architecture. There have been many overlapping versions, but there’s always a point at which a certain OS won’t run on newer hardware. Now [Jubadub] has pushed one of those a little further than Apple intended, by persuading classic Mac System 7 to run on a G4.

System 7 was the OS your Mac would have run some time in the mid ’90s, whether it was a later 68000 machine or a first-gen PowerMac. In its day it gave Windows 3.x and even 95 a run for their money, but it relied on an older Mac ROM architecture than the one found on a G4. The hack here lies in leaked ROMS, hidden backwards compatibility, and an unreleased but preserved System 7 version originally designed for the ’90s Mac clone programme axed by Steve Jobs. It’s not perfect, but they achieved the impossible.

As to why, it seems there’s a significant amount of software that needs 7 to run, something mirrored in the non-Mac retrocomputing world. Even this hack isn’t the most surprising System 7 one we’ve seen recently, as an example someone even made a version for x86 machines.

Thumbnail Image Art: Apple PowerMac G4 by baku13, CC BY-SA 3.0

hackaday.com/2025/12/05/mac-sy…

After a week away recovering from too much turkey and sweet potato casserole, we’re back for more security news! And if you need something to shake you out of that turkey-induced coma, React Server has a single request Remote Code Execution flaw in versions 19.0.1, 19.1.2, and 19.2.1.

The issue is insecure deserialization in the Flight protocol, as implemented right in React Server, and notably also used in Next.js. Those two organizations have both issued Security Advisories for CVSS 10.0 CVEs.

There are reports of a public Proof of Concept (PoC), but the repository that has been linked explicitly calls out that it is not a true PoC, but merely research into how the vulnerability might work. As far as I can tell, there is not yet a public PoC, but reputable researchers have been able to reverse engineer the problem. This implies that mass exploitation attempts are not far off, if they haven’t already started.

Legal AI Breaks Attorney-Client Privilege

We often cover security flaws that are discovered by merely poking around the source of a web interface. [Alex Schapiro] went above and beyond the call of duty, manually looking through minified JS, to discover a major data leak in the Filevine legal AI. And the best part, the problem isn’t even in the AI agent this time.

The story starts with subdomain enumeration — the process of searching DNS records, Google results, and other sources for valid subdomains. That resulted in a valid subdomain and a not-quite-valid web endpoint. This is where [Alex] started digging though Javascript, and found an Amazon AWS endpoint, and a reference to BOX_SERVICE. Making requests against the listed endpoint resulted in both boxFolders and a boxToken in the response. What are those, and what is Box?

Box is a file sharing system, similar to a Google Drive or even Microsoft Sharepoint. And that boxToken was a valid admin-level token for a real law firm, containing plenty of confidential records. It was at this point that [Alex] stopped interacting with the Filevine endpoints, and contacted their security team. There was a reasonably quick turnaround, and when [Alex] re-tested the flaw a month later, it had been fixed.

JSON Formatting As A Service

The web is full of useful tools, and I’m sure we all use them from time to time. Or maybe I’m the only lazy one that types a math problem into Google instead of opening a dedicated calculator program. I’m also guilty of pasting base64 data into a conversion web site instead of just piping it through base64 and xxd in the terminal. Watchtowr researchers are apparently familiar with such laziness efficiency, in the form of JSONformatter and CodeBeautify. Those two tools have an interesting feature: an online save function.

You may see where this is going. Many of us use Github Gists, which supports secret gists protected by long, random URLs. JSONformatter and CodeBeautify don’t. Those URLs are short enough to enumerate — not to mention there is a Recent Links page on both sites. Between the two sites, there are over 80,000 saved JSON snippets. What could possibly go wrong? Not all of that JSON was intended to be public. It’s not hard to predict that JSON containing secrets were leaked through these sites.

And then on to the big question: Is anybody watching? Watchtowr researchers beautified a JSON containing a Canarytoken in the form of AWS credentials. The JSON was saved with the 24 hour timeout, and 48 hours later, the Canarytoken was triggered. That means that someone is watching and collecting those JSON snippets, and looking for secrets. The moral? Don’t upload your passwords to public sites.

Shai Hulud Rises Again

NPM continues to be a bit of a security train wreck, with the Shai Hulud worm making another appearance, with some upgraded smarts. This time around, the automated worm managed to infect 754 packages. It comes with a new trick: pushing the pilfered secrets directly to GitHub repositories, to overcome the rate limiting that effected this worm the first time around. There were over 33,000 unique credentials captured in this wave. When researchers at GitGuardian tested that list a couple days later, about 10% were still valid.

This wave was launched by a PostHog credential that allowed a malicious update to the PostHog NPM package. The nature of Node.js means that this worm was able to very quickly spread through packages where maintainers were using that package. Version 2.0 of Shai Hulud also includes another nasty surprise, in the form of a remote control mechanism stealthily installed on compromised machines. It implies that this is not the last time we’ll see Shai Hulud causing problems.

Bits and Bytes

[Vortex] at ByteRay took a look at an industrial cellular router, and found a couple major issues. This ALLNET router has an RCE, due to CGI handling of unauthenticated HTTP requests. It’s literally just /cgi-bin/popen.cgi?command=whoami to run code as root. That’s not the only issue here, as there’s also a hardcoded username and password. [Vortex] was able to derive that backdoor account information and use hashcat to crack the password. I was unable to confirm whether patched firmware is available.

Google is tired of their users getting scammed by spam phone calls and texts. Their latest salvo in trying to defeat such scams is in-call scam protection. This essentially detects a banking app that is opened as a result of a phone call. When this scenario is detected, a warning dialogue is presented, that suggests the user hangs up the call, and forces a 30 second waiting period. While this may sound terrible for sophisticated users, it is likely to help prevent fraud against our collective parents and grandparents.

What seemed to be just an illegal gambling ring of web sites, now seems to be the front for an Advanced Persistent Threat (APT). That term, btw, usually refers to a government-sponsored hacking effort. In this case, instead of a gambling fraud targeting Indonesians, it appears to be targeting Western infrastructure. One of the strongest arguments for this claim is the fact that this network has been operating for over 14 years, and includes a mind-boggling 328,000 domains. Quite the odd one.

hackaday.com/2025/12/05/this-w…

Dal 1° luglio, Cloudflare ha bloccato 416 miliardi di richieste da parte di bot di intelligenza artificialeche tentavano di estrarre contenuti dai siti web dei suoi clienti. Secondo Matthew Prince, co-fondatore e CEO di Cloudflare, gli sforzi per proteggere le risorse da crawling indesiderati stanno già avendo un effetto evidente e potrebbero cambiare l’economia tradizionale di Internet.

L’impulso per queste misure è stato dato dall’iniziativa Content Independence Day, lanciata da Cloudflare quest’estate in collaborazione con importanti editori e aziende di intelligenza artificiale. La sua essenza è bloccare di default l’accesso dei crawler di intelligenza artificiale ai contenuti, a meno che gli sviluppatori del modello non abbiano stipulato un accordo a pagamento separato.

Da luglio 2024, Cloudflare offre ai clienti strumenti pronti all’uso per filtrare automaticamente il traffico proveniente dai bot che raccolgono dati per l’addestramento dell’intelligenza artificiale. Secondo l’azienda, dal 1° luglio 2025 sono già state bloccate 416 miliardi di richieste di questo tipo.

Prince afferma che per decenni il modello di business di Internet si è basato su una logica chiara: i creatori pubblicano contenuti, generano traffico e poi lo monetizzano attraverso pubblicità, vendite o abbonamenti. L’avvento dell’intelligenza artificiale generativa, afferma, ha rivoluzionato la piattaforma: i modelli ora raccolgono ed elaborano i contenuti di altre persone e gli utenti ricevono sempre più risposte direttamente in chat o widget, senza dover visitare il sito web originale. Questo è dannoso per i creatori, che stanno perdendo una parte del loro pubblico e, con esso, i loro ricavi.

Ecco perché Cloudflare sta ora cercando di sfruttare la sua posizione di attore infrastrutturale per impedire che il mercato scivoli completamente verso poche piattaforme dominanti. L’azienda si è tradizionalmente concentrata sull’accelerazione e la protezione del traffico web, ma nel contesto della crescita esponenziale dell’intelligenza artificiale generativa, Prince si sta concentrando sempre di più su come preservare Internet come uno spazio in cui progetti di ogni dimensione, dai media locali alle piccole comunità e ai creatori, possano sopravvivere e crescere.

Ha anche criticato le politiche di Google relative ai suoi crawler di ricerca e di intelligenza artificiale. Nel tentativo di raggiungere la leadership nell’intelligenza artificiale, Google ha combinato il crawler che indicizza i siti web per la ricerca con il crawler che raccoglie i dati per l’intelligenza artificiale. Di conseguenza, se un sito blocca il bot di intelligenza artificiale di Google, viene automaticamente rimosso dall’indicizzazione di ricerca. Questo crea una trappola per editori e sviluppatori: non vogliono che i loro contenuti vengano inclusi in modo incontrollato nei set di addestramento, ma non possono permettersi di perdere il loro posizionamento nei risultati di ricerca di Google, che rappresenta una parte significativa del loro traffico.

Secondo Prince, non si può sfruttare la posizione di monopolio del mercato di “ieri” per affermarsi in quello di “domani”. Identifica direttamente Google come il principale freno allo sviluppo di Internet e ritiene che l’azienda dovrebbe separare i suoi crawler di ricerca e di intelligenza artificiale, in modo che i siti web possano gestire l’accesso in modo indipendente.

Cloudflare ha anche rivelato statistiche inedite sull’accesso privilegiato di Google al web rispetto ad altri attori dell’intelligenza artificiale. L’azienda stima che Google attualmente veda 3,2 volte più pagine di OpenAI , 4,6 volte di Microsoft e 4,8 volte di Anthropic o Meta. In sostanza, Google ha una visione unica di Internet, che rafforza la sua posizione sia nella ricerca che nell’intelligenza artificiale.

Allo stesso tempo, afferma Prince, i primi risultati del blocco dei crawler AI per editori e altri proprietari di contenuti sembrano promettenti. I contenuti umani unici – dalle redazioni locali sensibili alle tendenze regionali agli utenti di Reddit che condividono i loro pensieri più strani o profondi – rimangono una materia prima estremamente preziosa per i modelli di intelligenza artificiale. Ciò significa che i creatori hanno l’opportunità di creare nuovi modelli a pagamento, dalle licenze alle partnership specializzate con aziende di intelligenza artificiale.

In futuro, riconosce Prince, la regolamentazione dell’intelligenza artificiale e dell’accesso ai contenuti potrebbe richiedere un intervento legislativo. Per ora, Cloudflare sta cercando di esercitare una pressione sul mercato attraverso le sue decisioni e i suoi accordi per garantire che i nuovi modelli di business dell’intelligenza artificiale siano più pluralistici, espandano il mercato e non concentrino il potere nelle mani di uno o due attori. Non c’è nulla di romantico in questo, afferma: significa semplicemente maggiori opportunità di crescita per tutti, il che significa che Cloudflare stessa avrà più clienti e una rete Internet più ampia da proteggere.

Prince ha paragonato la situazione a un franchise di supereroi: l’eroe dell’ultimo film diventa il cattivo del successivo. Nella sua interpretazione, Google è diventato il “cattivo” che frena Internet. E finché l’azienda non accetterà di giocare secondo le stesse regole di tutti gli altri – principalmente separando il suo motore di ricerca dal suo crawler AI – sarà estremamente difficile bloccare completamente i contenuti da contenuti indesiderati.

L'articolo Cloudflare dichiara guerra a Google e alle AI. 416 miliardi di richieste di bot bloccate proviene da Red Hot Cyber.