Today's links
- bunnie's piggyback hack: An actual "one weird trick" that's pretty fucking spectacular.
- Object permanence: "Keyboard Practice"; Sam Bulte says she's no dirtier than other MPs; Gene Luen Yang's Amabassador for Young People's Literature speech; Menstruation innovation.
- Latest books: You keep readin' em, I'll keep writin' 'em.
A slide from bunnie Huang's 39C3 talk.
bunnie's piggyback hack (permalink)
If Andrew "bunnie" Huang didn't actually exist, I'd swear he was a character out of a(n extraordinarily technologically well-informed) cyberpunk novel. Every time I interact with this legendary hardware hacker, he blows my mind with some incredible project or insight that permanently alters how I think about technology.
I first met bunnie when he came to EFF for help with the threats he'd received from Microsoft. At the time, bunnie was an electrical engineering grad student at MIT, and he'd taken the bootloader locks on the new Xbox platform as a personal affront and challenge. He applied his prodigious skill and talent to these digital handcuffs, and in short order, he had broken the Xbox and installed Linux on it. MIT's general counsel immediately washed its hands of any responsibility to defend this young grad student from bullying by a corporate monopolist, hanging him out to dry. So he turned to us – and we got his back. You can read all about it in Hacking the Xbox, his canonical work about hardware hacking and technological freedom (it's free!):
https://bunniefoo.com/nostarch/HackingTheXbox_Free.pdf
In the many years since, I've been lucky enough to count bunnie as a friend, colleague and comrade, albeit one I only physically run into every year or so, usually at some tech event or on the playa at Burning Man, where he still camps with the MIT crew at The Institute.
I just got to see bunnie in person again, over Christmas week at the Chaos Communications Congress in Hamburg. He gave a late-night presentation with his collaborator Sean "xobs" Cross, entitled "Xous: A Pure-Rust Rethink of the Embedded Operating System":
https://www.youtube.com/watch?v=BbWWGkyIBGM
Don't let the technical-sounding title intimidate you! This was a banger of a talk, and as with every bunnie Huang production, it left a pleasant and persistent aftertaste.
The background for this talk is bunnie's obsession with building a trustworthy computer. For decades, bunnie has been chasing the dream of a computer whose every component – operating system, drivers, firmware, and hardware designs – are open to inspection. Bunnie's reasoning here is that anything that can't be inspected (and, by extension, modified) by its users is a spot where bad guys can hide bad stuff, and where lurking bugs can fester until they are exploited by bad guys. Remember the spectacular (and still mysterious) claims that Apple's servers had all been compromised with minuscule hardware bugs? The single best explanation of that you will find comes from bunnie:
https://www.youtube.com/watch?v=RqQhWitJ1As
Bunnie was doing all this before there was an "open source hardware" movement, and he remains at its vanguard. His "Precursor" project is a reference hardware platform where every component is open to inspection and modification, from the chassis to the random number generator:
https://www.bunniestudios.com/blog/category/betrusted/precursor/
One area of especial concern and interest for bunnie is the promise and peril of the "system-on-a-chip" (SoC). This is exactly what it sounds like: a cheap chip that incorporates everything you need to do full-fledged computing, including interfaces and drivers for networks, screens, peripherals, etc. SoCs are ubiquitous. You find them in things like individual car engine components and inkjet printer cartridges, and each one is a whole-ass computer, capable of running some really ugly malware.
As bunnie explained back in 2020, there are two problems with SoCs: first, they are packaged such that the silicon traces inside of them can't be readily inspected, and second, they are so expensive to fabricate that someone like bunnie can't possibly come up with the millions needed to make an open, trustworthy, inspectable alternative:
https://pluralistic.net/2020/11/10/dark-matter/#precursor
That's where bunnie's CCC talk comes in. The chips that SoCs are etched upon have lots of space (relatively speaking – we're talking about nanometer-scale circuits, after all). Even after an SoC designer packs in a ton of extra traces to handle oddball applications, the chip is still mostly "dark matter" – blank silicon.
The first half of bunnie and xobs's talk concerns itself with "Xous," a secure operating system for an SoC, written in Rust. But the second half of the talk tackles the problem of procuring an SoC that you can trust to run Xous on. That's where this dark matter comes in.
Bunnie's day-job is consulting on extremely gnarly, high-stakes, high-value hardware design and manufacturing, so naturally, he's got lots of clients and contacts in the SoC manufacturing world. He approached one of these companies with a proposal: let me tape out a whole separate chip that fits in the dark matter for one of your upcoming chips. Adding these traces adds virtually no cost to the production, and adding bunnie's chips to the production run actually saves the manufacturer money, because the prices drop when the quantities increase.
The idea is to put two chips on the chip, and badge most of them with the OEM's branding, while a small rump of the chips will have bunnie's branding (he calls it the Baochip). On bunnie's chips, the traces to the OEM chip will be physically cut, meaning that the Baochips will just be Baochips – the original chip will be inaccessible and unusable.
What's more, bunnie didn't just fit one chip into the OEM's "dark matter" – he fit five separate, specialized SoCs into the unused space. Remember, the beauty of SoCs is that once they're taped out and sent to production, the cost of an actual chip is peanuts, meaning that these Baochips are cheap as hell.
Even better: the traces on these chips are scaled to be readily inspected using relatively low-cost equipment, meaning that many parties around the world can grab one of these chips, stick it in a machine, and compare the traces on the chip to the free, open sourcefile that was used to produce it, confirming that there are no nasty surprises lurking inside.
This was such an exciting talk, and as I sat through it, I had this nagging feeling that it reminded me of something else I'd learned about years before, though I couldn't quite place it. Finally, as bunnie and xobs were stepping off the stage, I had it – it reminded me of another bunnie talk I'd seen – this one at The Institute, the MIT Burning Man camp, more than a decade prior.
Back in 2015, bunnie designed and built a set of really cool, wearable radio-linked badges for his campmates, which would help them locate one another on the playa at night. These badges were really cool – they used a genetic algorithm to "have sex" with one another and mutate their color patterns. Bunnie even worked in a "consent" mechanism!
https://www.bunniestudios.com/blog/2015/sex-circuits-deep-house/
But the really cool part that stuck with me was the manufacturing story. Bunnie wanted to fabricate custom injection-molded plastic enclosures for these pendants, but injection molding – like chip design – is a mass production phenomenon, with sky-high setup costs and incredibly cheap per-unit costs thereafter.
So (and this might sound familiar) bunnie reached out to a die-maker that he worked with in China and said, "Hey, the next time you're contracted to mill out a die for a client, let me know if there's any extra space on the face of the die, and I'll provide you with a shapefile you can carve out of this 'dark matter.'" This doesn't add any cost to the die setup, and it means that bunnie can run just a couple dozen injection-molded, custom cases at a cost of pennies per unit.
I grabbed bunnie later that night and mentioned this old Burning Man project to him and he said, "You know, I haven't ever thought of it, but you're right, there's definitely a throughline between the two projects."
I asked him what he called this technique and he shrugged and said he didn't really have a name for it, but he thought of it as "piggybacking," which seems like a good name to me.
It seems to me that these two kinds of manufacturing can't be the only ones that can be "piggybacked" onto. That's what motivated me to write this post – to get people thinking about these high-setup/low-unit cost production types that might be piggybacked for small batch, delightful projects like bunnie's.
Well, that, and just to do one of my periodic bunnie Huang appreciation posts. If there's one person that I'd recommend people pay more attention to, it's him. He's also a terrific communicator, and an indecently great writer. My readers might be familiar with him thanks to the afterword he contributed to Little Brother:
https://craphound.com/littlebrother/download/
More recently, he wrote a fantastic intro for last year's Science Comics Computers: How Digital Computers Work, a brilliant middle-grades graphic novel that uses steampunk dinosaurs to explain digital logic and the building blocks of computation:
https://pluralistic.net/2025/11/05/xor-xand-xnor-nand-nor/#brawniac
He also co-authored a fascinating research paper with Edward Snowden, after the two of them collaborated on a daughter-board that spots otherwise untraceable malware:
https://assets.pubpub.org/aacpjrja/AgainstTheLaw-CounteringLawfulAbusesofDigitalSurveillance.pdf
Again, my readers will recognize this as a gimmick from my 2020 novel Attack Surface (a Little Brother novel for adults):
https://us.macmillan.com/books/9781250757517/attacksurface/
That's not bunnie's only sweet hardware hack, of course. Check out the insanely clever design for a contact-tracing dongle he prototyped for the EU in 2020:
https://pluralistic.net/2020/06/23/cryptocidal-maniacs/#trace-together
But really, you owe it to yourself to read bunnie at book length, and his best book is 2016's The Hardware Hacker, a tour-de-force, lay-friendly exegesis on the theory and practice of hardware hacking:
- Logical steps and “eldering” https://bookmaniac.org/2026/01/07/logical-steps-and-eldering/
A shelf of leatherbound history books with a gilt-stamped series title, 'The World's Famous Events.'
Object permanence (permalink)
#20yrsago John McDaid’s brilliant sf story Keyboard Practice free online https://web.archive.org/web/20060112044109/https://www.sfsite.com/fsf/fiction/jm01.htm
#20yrsago Pledge to boycott DRM CDs https://web.archive.org/web/20060112061657/http://www.pledgebank.com/boycottdrm
#20yrsago Hollywood’s Canadian MP claims she’s no dirtier than the rest https://memex.craphound.com/2006/01/08/hollywoods-canadian-mp-claims-shes-no-dirtier-than-the-rest/
#10yrsago Gene Luen Yang’s inaugural speech as National Ambassador for Young People’s Literature https://memex.craphound.com/2016/01/08/gene-luen-yangs-inaugural-speech-as-national-ambassador-for-young-peoples-literature/
#10yrsago Menstruation is the mother of invention https://lastwordonnothing.com/2016/01/07/the-wonderful-world-of-period-patents/
#10yrsago Juniper’s products are still insecure; more evidence that the company was complicit https://www.wired.com/2016/01/new-discovery-around-juniper-backdoor-raises-more-questions-about-the-company/
#10yrsago Red-baiting water speculator plans to drain the Mojave of its ancient water https://www.wired.com/2016/01/the-2-4-billion-plan-to-water-la-by-draining-the-mojave/?mbid=social_alleniverson
A photo of me onstage, giving a speech, pounding the podium.
- Denver: Enshittification at Tattered Cover Colfax, Jan 22 https://www.eventbrite.com/e/cory-doctorow-live-at-tattered-cover-colfax-tickets-1976644174937
Colorado Springs: Guest of Honor at COSine, Jan 23-25
https://www.firstfridayfandom.org/cosine/
Ottawa: Enshittification at Perfect Books, Jan 28
https://www.instagram.com/p/DS2nGiHiNUh/
Toronto: Enshittification and the Age of Extraction with Tim Wu, Jan 30
https://nowtoronto.com/event/cory-doctorow-and-tim-wu-enshittification-and-extraction/
Victoria: 28th Annual Victoria International Privacy & Security Summit, Mar 3-5
https://www.rebootcommunications.com/event/vipss2026/
Berlin: Re:publical, May 18-20
https://re-publica.com/de/news/rp26-sprecher-cory-doctorow
Hay-on-Wye: HowTheLightGetsIn, May 22-25
A screenshot of me at my desk, doing a livecast.
Recent appearances (permalink)
- A post-American, enshittification-resistant internet (39c3) https://media.ccc.de/v/39c3-a-post-american-enshittification-resistant-internet
Enshittification with Plutopia
https://plutopia.io/cory-doctorow-enshittification/
"can't make Big Tech better; make them less powerful" (Get Subversive)
https://www.youtube.com/watch?v=X1EzM9_6eLE
The Enshitification Life Cycle with David Dayen (Organized Money)
https://www.buzzsprout.com/2412334/episodes/18399894
Enshittificaition on The Last Show With David Cooper:
A grid of my books with Will Stahle covers..
- "Canny Valley": A limited edition collection of the collages I create for Pluralistic, self-published, September 2025
"Enshittification: Why Everything Suddenly Got Worse and What to Do About It," Farrar, Straus, Giroux, October 7 2025
https://us.macmillan.com/books/9780374619329/enshittification/
"Picks and Shovels": a sequel to "Red Team Blues," about the heroic era of the PC, Tor Books (US), Head of Zeus (UK), February 2025 (https://us.macmillan.com/books/9781250865908/picksandshovels).
"The Bezzle": a sequel to "Red Team Blues," about prison-tech and other grifts, Tor Books (US), Head of Zeus (UK), February 2024 (thebezzle.org).
"The Lost Cause:" a solarpunk novel of hope in the climate emergency, Tor Books (US), Head of Zeus (UK), November 2023 (http://lost-cause.org).
"The Internet Con": A nonfiction book about interoperability and Big Tech (Verso) September 2023 (http://seizethemeansofcomputation.org). Signed copies at Book Soup (https://www.booksoup.com/book/9781804291245).
"Red Team Blues": "A grabby, compulsive thriller that will leave you knowing more about how the world works than you did before." Tor Books http://redteamblues.com.
"Chokepoint Capitalism: How to Beat Big Tech, Tame Big Content, and Get Artists Paid, with Rebecca Giblin", on how to unrig the markets for creative labor, Beacon Press/Scribe 2022 https://chokepointcapitalism.com
A cardboard book box with the Macmillan logo.
Upcoming books (permalink)
- "Unauthorized Bread": a middle-grades graphic novel adapted from my novella about refugees, toasters and DRM, FirstSecond, 2026
"Enshittification, Why Everything Suddenly Got Worse and What to Do About It" (the graphic novel), Firstsecond, 2026
"The Memex Method," Farrar, Straus, Giroux, 2026
"The Reverse-Centaur's Guide to AI," a short book about being a better AI critic, Farrar, Straus and Giroux, June 2026
Colophon (permalink)
Today's top sources:
Currently writing: "The Post-American Internet," a sequel to "Enshittification," about the better world the rest of us get to have now that Trump has torched America ( words today, total)
- "The Reverse Centaur's Guide to AI," a short book for Farrar, Straus and Giroux about being an effective AI critic. LEGAL REVIEW AND COPYEDIT COMPLETE.
"The Post-American Internet," a short book about internet policy in the age of Trumpism. PLANNING.
A Little Brother short story about DIY insulin PLANNING
This work – excluding any serialized fiction – is licensed under a Creative Commons Attribution 4.0 license. That means you can use it any way you like, including commercially, provided that you attribute it to me, Cory Doctorow, and include a link to pluralistic.net.
https://creativecommons.org/licenses/by/4.0/
Quotations and images are not included in this license; they are included either under a limitation or exception to copyright, or on the basis of a separate license. Please exercise caution.
How to get Pluralistic:
Blog (no ads, tracking, or data-collection):
Newsletter (no ads, tracking, or data-collection):
https://pluralistic.net/plura-list
Mastodon (no ads, tracking, or data-collection):
Medium (no ads, paywalled):
Twitter (mass-scale, unrestricted, third-party surveillance and advertising):
Tumblr (mass-scale, unrestricted, third-party surveillance and advertising):
https://mostlysignssomeportents.tumblr.com/tagged/pluralistic
"When life gives you SARS, you make sarsaparilla" -Joey "Accordion Guy" DeVilla
READ CAREFULLY: By reading this, you agree, on behalf of your employer, to release me from all obligations and waivers arising from any and all NON-NEGOTIATED agreements, licenses, terms-of-service, shrinkwrap, clickwrap, browsewrap, confidentiality, non-disclosure, non-compete and acceptable use policies ("BOGUS AGREEMENTS") that I have entered into with your employer, its partners, licensors, agents and assigns, in perpetuity, without prejudice to my ongoing rights and privileges. You further represent that you have the authority to release me from any BOGUS AGREEMENTS on behalf of your employer.
ISSN: 3066-764X
