515: Script Boomers
Embedded
Nick Kartsioukas joined us to talk about security in embedded systems. Common Vulnerabilities and Exposures (CVE) is the primary database to check your software libraries, tools, and OSs: . Open Worldwide Application Security Project (OWASP, ) has information on how to improve security in all kinds of applications, including . There are also cheatsheets, Nick particularly recommends . Wait, what is supply chain security? Nick suggested a : it is about your code and tools including firmware update, a common weak point in embedded device security. Want to try out some security work?...
info_outline
514: Just Turn Off All the Computers
Embedded
Philip Koopman joined us to talk about embedded systems becoming embodied and intelligent. We focus on the safety considerations of making an intelligent and embodied device. Phil’s new book is . It uses robotaxis as an example as it discusses safety, security, human/computer interface, AI, and a bit of legal theory for tort negligence. If you’d like a taster, Phil gave a wonderful summary in his video: This new book is intended for a wider (less devotedly technical) audience than his book . Phil was last on the show in episode where we spoke about his book Thank you! ...
info_outline
513: I’m Sorry You Learned Something
Embedded
Jason Turner of C++ Weekly and Empty Crate spoke with us about the joy of puzzles, the changing directions of an interesting career, and the C++ programming language. I mean, of course we talked about C++. But only a little. Jason recently published , a book of puzzles for the logically minded. It teaches programming concepts as engaging puzzles: recursion, binary, assembly, Lisp, regular expressions. You may not know what you are learning but you’ll likely find you know a lot more about how computers work afterward. For the puzzles, paper is better than electronic. But you can...
info_outline
512: What if I Didn’t Stop?
Embedded
Katherine “Smalls” Connell spoke with us about making thin and flexible circuits, making stretchable electronics, and running a successful Kickstarter. Katherine’s Kickstarter: . Katherine shares her makes, describing her build process for companion robots and other projects. You can find her as The Small Wonder on and . She often goes by Smalls on other social media. We talked about a paper on making stretchable circuits: . If you’re interested in how 3D printing is changing design engineering, Mouser Electronics has some great resources to check out. Their Empowering...
info_outline
511: Forty Trillion Divides
Embedded
Chris and Elecia talk about the show overflowing to another bit, fight over vim vs nano, consider awards, discuss writing (and self-motivation), consider linear algebra on AI cores, encourage remote device quality assurance, describe design documentation, review timer multipliers, and consider changing chip vendors. Support the show and get goodies: and book (currently on chapter 8 and working through the ) Not mentioned but related to the Cozy Science announcement: Elecia found , a 10-episode podcast that is nicely soothing and science. If you’re interested in how 3D printing is...
info_outline
510: The Secret Chip
Embedded
Christina Cyr spoke with us about building cell phones, entrepreneurship, social purpose corporations, awards, lithium recycling, and her interesting career path. We talked about Christina’s , the related kit from dTOOR, and her . We also mentioned in the section about . There is a great paper from Nature about lithium-ion battery recycling: (formerly AngelList) is a startup focused job site that may lead to non-fulltime positions. may help you figure out is the startup has capital (also thought that generally has a cost). and the The quote was from and it was a...
info_outline
509: Swarmed by Engineers
Embedded
Steve Hinch wrote a book about engineering, innovation, and business. He shares decades of wisdom gleaned from his career at Hewlett-Packard and Agilent as an engineer, manager, marketing director, and general manager. Steve’s book is . While mostly retired, Steve is an executive consultant, see his website to get in touch: . We also touched on some of . While Elecia is reading , Steve suggested works by might be of interest. Elecia and Steve both received copies of Bill Packard’s while at HP. ...
info_outline
508: Descartes' Demon
Embedded
William Griffin spoke to us about hardware-in-the-loop testing, simulation, terminology, learning complex topics, and books. We don’t usually expand upon the show title but Wikipedia has a rabbit hole called so there you go. Books mentioned: (though we then talked about a different Jeffrey Pfeffer book: . William Griffin and Bailey Steinfadt () have started , an embedded software and simulation consultancy. Mouser Electronics has a dedicated Empowering Innovation Together hub that covers the latest breakthroughs in tech. Their new series explores how AI is...
info_outline
507: Turn Our Data Into Predators
Embedded
Chris and Elecia chat about books, courses, alternate podcasts, electronics, statistics, kidnapping Roo, and journaling failures. The Embedded Patreon book club is reading Data-Driven Science and Engineering: Machine Learning, Dynamical Systems, and Control by Steven L. Brunton, J. Nathan Kutz. PDF book and links to lectures are at . Some recent links of interest: : a collection of different small data sets that have the same summary statistics. You can . From . The YouTube video was really neat, which led to as well as making a $40 bird identifier with an RPi and some...
info_outline
506: How Do I Fit a Whale Into an Apartment Building?
Embedded
Dmitry Grinberg joined us to talk about running Linux on small microprocessors (physically small and/or 4-bit). Dmitry does this by emulating a MIPS processor. Boot times vary between minutes and days, depending on the processor. Dmitry’s projects are on his website () including: (Cortex-M0+!) Dmitry recommended , an online game about building up a processor. We mentioned Eric Schlaepfer of . He was on the show on , with EMSL’s Windell Oskay, talking about their book Open Circuits. Mouser Electronics has a dedicated Empowering Innovation Together hub that covers the...
info_outlineNick Kartsioukas joined us to talk about security in embedded systems.
Common Vulnerabilities and Exposures (CVE) is the primary database to check your software libraries, tools, and OSs: cve.org.
Open Worldwide Application Security Project (OWASP, owasp.org) has information on how to improve security in all kinds of applications, including embedded application security. There are also cheatsheets, Nick particularly recommends Software Supply Chain Security - OWASP Cheat Sheet.
Wait, what is supply chain security? Nick suggested a nice article on github.com: it is about your code and tools including firmware update, a common weak point in embedded device security.
Want to try out some security work? There are capture the flag (CTF) challenges including the Microcorruption CTF (microcorruption.com) which is embedded security related. We also talked about the SANS Holiday Hack Challenge (also see Prior SANS Holiday Hack Challenges).
This episode is brought to you by RunSafe Security.
Working with C or C++ in your embedded projects? RunSafe Security helps you build safer, more resilient devices with build-time SBOM generation, vulnerability identification, and patented code hardening. Their Load-time Function Randomization stops the exploit of memory-based attacks, something we all know is much needed. Learn more at RunSafeSecurity.com/embeddedfm.
Some other sites that have good information embedded security:
-
This World Of Ours by James Mickens is an easy read about threat modelling
-
Cybersecurity and Infrastructure Security Agency (CISA) is at cisa.gov and, among other things, they describe SBOMs in great detail
-
National Institute of Standards and Technology (NIST) also provides guidance:
-
NIST SP800-213 IoT Device Cybersecurity Guidance for the Federal Government: Establishing IoT Device Cybersecurity Requirements
-
There is a group of universities and organizations doing research into embedded security: National Science Foundation Center for Hardware and Embedded Systems Security and Trust (CHEST). Descriptive overview and the site is nsfchest.org
-
European Telecommunications Standards Institute (ETSI) - Consumer IoT Security
-
Camera Ubiquiti configuration issue (what not to do)
Finally, Nick mentioned Stop The Bleed which provides training on how you can control bleeding, a leading cause of death. They even have a podcast (and we know you like those). Elecia followed up with Community Emergency Response Teams (CERT). Call your local fire department and ask about training near you!
Transcript