The Radicle peer-to-peer code-collaboration project has disclosed two critical vulnerabilities in the network protocol used by Radicle nodes. The first flaw is that the network protocol used by Radicle "does not give the confidentiality it was expected to give", which allows anyone who can observe the network between two nodes to read the data exchanged. The second is that peer authentication is broken and allows impersonation, so an attacker can spoof their Node ID and read private repositories they should not be able to read.

In practice, the two flaws are most useful when they can be exploited together: an attacker on the path sees the Node IDs at both ends of a connection, and both are normally on the allow-list. That attacker can read whatever is exchanged while they watch, and can then use a Node ID they saw to fetch the whole repository on demand. The realistic threat is anyone on the path between your node and node it syncs with, and no setting or allow-list protects against them.

We are publishing this before the security update is available. You can act on it today, and no fix we release later can undo an exposure that has already happened.

See the post for workarounds that can be used today; a major update that will be backward-incompatible is underway.

Hacking on Raspberry Pi board internals is one of my favourite topics. I know a bunch of obscure things about these cute little boards. Three years ago, I covered a Raspberry Pi 4 RAM upgrade story. Getting a BGA RAM chip and swapping it in seemed like a no-brainer to me – apart from all the numerous uncertain parts about it, you know. It was a joy to see hackers pull it off, and for it to function as well as it did!

Things changed. You can’t really get RAM chips anymore. You also can’t get RAM sticks. You can’t get even SSDs with RAM chips on them. Even getting Raspberry Pi boards can be hard unless you know where to look. This is where a recent three-minute video by [Jeff Geerling] finds us.

Turns out, Raspberry Pi Foundation pushed binary-blob bootloader changes that limit your ability to upgrade RAM. I’ve known about it since last year through the grapevine, and somehow, as I read about it, this didn’t bother me at all. Not enough to write a Hackaday article about it, even, much less talk about it more widely. Why didn’t it bother me? Today, I sat down and pondered this for a bit.

Here’s my conclusion: I don’t think it’s a big deal at all, even if it seems that many people would disagree. Come in, as you are, and I hope you find my thoughts on the situation entertaining.

How It’s Made

First, some ground facts. This change restricts upgrading the RAM chip on your Pi 4 and Pi 5, as well as Compute Modules. By the looks of it, it does not restrict replacing the RAM chip with a chip of a similar size, quote, “locking devices to their original RAM size”. As such, this does not prevent repair of your Raspberry Pi board, but does somewhat limit your repair part choice, at most.

This restriction is easily bypassable. The bootloader is stored in the SPI flash chip, which can be reflashed using the built-in mask ROM over USB and rpiboot, and you are not prevented from flashing older versions of the bootloader, so far. This means even if you manually swap the RAM chip, all you need to do is to also downgrade the bootloader to the last known good release — 2024-09-10 — and then your Pi board or Compute Module will function with upgraded RAM. If you have the skills to upgrade your RAM, you most certainly have the skills to downgrade the Raspberry Pi bootloader.

For most regular use, having a two-year old bootloader version won’t really matter. There have been about 15 releases since the 2024-09-10 one, so I went and read through the patchnotes. Checking quickly, the important features like NVMe boot have been available for a fair bit before this release, maybe you will miss out on a few quality of life fixes or more obscure hardware configuration problems, but that’s it. Hopefully I’m not missing something, please point it out if I am. You know what is an issue, by the way? The patch notes for the 2024-09-23 release don’t mention the RAM size check addition at all, maybe they should fix that.

What’s funny is, I am checking reports and it seems that the board will boot and function well with newer bootloaders (mostly 2025 versions), and in other cases (mostly but not always 2026 bootloader versions) it will outright refuse to boot with a 8 or 9 flash failure code. I haven’t compared details on what exactly might be causing this yet, but it might be that you don’t even need to downgrade bootloader all that badly – though I’d definitely start with the oldest known-good release.

How It Happened

This is the first reason I can’t bring myself to care. If you can upgrade your RAM, you can downgrade the bootloader. However, here’s the point of contention – did this change really need to happen?

For the reference, this bootloader change happened almost exactly two years ago, at some point between September 10 and September 23, 2024. This was exactly a year and a half after we covered the first Raspberry Pi RAM upgrade. What changed?

The Raspberry Pi Foundation (RPF) justifies this as follows: they saw third-party resellers sourcing low-RAM Compute Modules, upgrading them with RAM from unknown source and unknown stability. My observation is that they’d also be reselling the modules at a markup for purely commercial gain, while undercutting RPF who would otherwise direct that money into RnD, something I much enjoy to see them do. This creates perverse incentives and risk for people buying Raspberry Pi boards online, and RPF decided to limit this primarily for their users’ benefit, plus, if you ask me, some of theirs.

Is this justification true? I can’t know, but I went to check for signs of this happening, and the non-consensual RAM switcheroos seems to be happening all over the place! The related GitHub issues have a fair few pingbacks, and exploring them makes the problem look grim to me.

Off the cuff, I spent 15-20 minutes checking, and I can easily find fifteen different people on GitHub alone complaining about this failure. [(1) (2) (3) (4) (5) (6) (7) (8) (9) (10) (11) (12) (13) (14) (15)] As far as failure modes in popular hardware go, this is a surprisingly large number that suggests at least hundreds of hackers and hobbyists affected, if not more. None of them appear to have performed the upgrade themselves, hot air and flux way, the Hackaday way – all of them seemingly simply bought a “8 GB” version from either Aliexpress or Amazon. In at least one case, the seller immediately lied to the buyer about the issue and did not at all admit that an upgrade took place, even though it clearly did.

How It Makes Sense

This seems to map exactly to what RPF says happened. I can very much see why they would be worried. For instance – at the time they made this change, if my memory isn’t failing me, CM5 or CM4 2 GB boards went for $30-$40, 8 GB boards went for $100ish, and 4 GB boards were somewhere inbetween. As far as the intersection of hacker gadgets and industrial-lite hardware goes, that price is more than fair.

At this point, we’re no longer talking about people upgrading RAM on their boards for fun, and remember, you can still do all of that. Instead, that’s a fair bit of margin for someone to grab for 20 minutes of hot air work, someone who hasn’t done any of the RnD that RPF has put in. I personally much rather would see that margin go to RPF, and I’d like to have them deal with none of the headache, too.

Creating incentives for this kind of switcheroo business, unimpeded, seems deeply corrosive to me. For one, there’s zero repercussions for someone equipping those boards with substandard and harvested chips. RPF, as any experienced hardware company, would know about sourcing harvested or otherwise shady-origin RAM and other chips. A third party on Amazon/Aliexpress passing on those chips undisclosed to unqualified end users, now that goes far beyond the usual harvested chip horror stories. It turns into a game of “will/won’t the user notice the weirdness and ask the seller for a refund on time”, and at $100-$200, together with the ship-item-back requirement these prices bring, the answer will generally be “no”. Now, the buyer finds out about the tampering almost immediately, since Raspberry Pi boards auto-update the firmware.

If you don’t agree that this alone is corrosive – notice how this kind of “upgraded” board clearly requires sellers to misrepresent what they’re selling? You’re not going to find about this “upgrade” in the listing, there won’t be a “8GB reworked” label, clearly that would require lowering the price and/or cutting into the margins. Just like there’s no incentive for using a fresh RAM chip instead of a harvested one, there’s also zero incentive to be open about the mod. That’s no way to sell a pen, much less a full computer.

How RPF Does Things

Here’s the most confusing part to me. I’m seeing [Jeff] and others say that this is out of character for RPF to do. This does not seem true to me, at all? I don’t recall a time when Raspberry Pi has put effort into giving users freedom to hack on the board itself as soon as any sort of legal or competition issue arose.

Raspberry Pi puts cryptographic EEPROMs on Pi Camera boards, v2 and beyond, to thwart clone cameras that became so prolific and cheap with v1, I own at least five of those clones in different form-factors. I don’t like it, but at least the authenticity checks are disabled for Compute Module versions, as far as I remember. They still don’t sell the MLX7704 PMIC that immediately dies if you accidentally short-circuit GPIO header 5 V to 3.3 V, two male pins that are right on the side of the board and exceptionally easy to short-circuit from three sides simultaneously.

Raspberry Pi only ever publishes “reduced” schematics, ever since 2013, and they haven’t even released those for Pi 5. Neither have they published Pi 4 USB-C issue fix schematics despite having promised to do so. Half of the chips on a modern Raspberry Pi board are single-source and board-specific, the aforementioned PMIC being a fun example. Raspberry Pi boards ship closed-source software, from the bootloader to the GPU code whipping the CPU, to all the onboard wireless chips they have used so far, and this brings real issues you’ll stumble upon as you push the limits. The JTAG port has always been locked down, and even the bootloader is cryptographically signed – no patching out the RAM check code, sorry to spoil it.

I’m far from done listing ways in which Raspberry Pi prevents or works against low-level board tinkering, there’s at least five more things I could list from memory if I were bothered to check them thoroughly enough right now. Point is, if anyone came to Raspberry Pi for the low-level hackability of the hardware, there was never a shortage of reasons to look elsewhere. That was never the upside.

I don’t think low-level board hackery is what people genuinely expect from Raspberry Pi at all, even if they might say that they do – because it was never really there. You can’t genuinely expect something that was barely ever present. In contrast, there’s plenty of competition that publishes full board schematics, sometimes even gerbers, uses as much open code as possible, doesn’t sign bootloaders, and so on. Raspberry Pi is not open or hackable hardware by those metrics, and it never was. It’s not hackable hardware anywhere as much as it’s hardware made for hackers to use, and there’s clearly a big difference.

How Did We Get Here?

In practice, people clearly come to Raspberry Pi because of their community in the millions, meticulously explored and documented hardware, unmatched availability of boards and software alike, having solutions for nigh every little niggle and nitpick, RPF’s ability to experiment and release new cool hardware year after year, and even new standards they create along the way. Most of low-level problems get papered over through sheer scale – say, last year [Jonathan Clark] reverse-engineered the Raspberry Pi Zero 2 W, and then [TubeTime] reverse-engineered the Compute Module 5, how cool is that?

I could agree with [Jeff Geerling] that it could instead benefit from a “warranty bit” type of mechanism, but really, the bootloader downgrade isn’t that hard of a penalty, and “board autoupdates firmware, fails on next boot” is a much stronger indicator that you should go get a refund at haste. A refund is also way easier to get if you say “hey, the board stopped working immediately”, and who knows, maybe you’ll get a refund and get to keep the board so that you can downgrade its firmware and still use it! Win-win, seller loses out on selling you a shady board, and you get a shady board that might just work, for free. Chances are, we wouldn’t even be talking about the RAM swap restrictions if it weren’t for the RAM shortage, and that is not RPF’s fault at all whatsoever.

My advice: don’t lament Raspberry Pi RAM upgrades, especially given they’re only slightly harder to perform now. Very few hackers ever performed them, the main audience for them turned out to be dodgy hardware resellers online, and in most cases, repair doesn’t seem to be impeded at all, either.

Think of the users that will no longer be fooled by a shady seller on Amazon, especially now that the perverse incentives for board mods and reusing harvested RAM chips are at their highest. RAM shortages might make any RAM topic hurt deeper than usual, which to me is the most likely reason we’re discussing this in 2026 instead of 2025, but this change is far more likely to help a hacker in practice, than it is to hurt.

2CA4  4B10 F666  LCB  1,0,-2458
2CA8  1310 2DC0  U    1,0,11712
2CAC  4B10 001E  LCB  1,0,30
2CB0  1310 2DC4  U    1,0,11716
2CB4  4B10 001B  LCB  1,0,27
2CB8  1310 2DC6  U    1,0,11718
2CBC  5901       PZW  0,1
2CBE  0000       0
2CC0  0010       16
2CC2  2DC6       11718
2CC4  0001       1
2CC6  4B10 EE66  LCB  1,0,-4506
2CCA  1310 2DBE  U    1,0,11710
2CCE  4B10 0050  LCB  1,0,80
2CD2  1310 2DC2  U    1,0,11714
2CD6  4BF0 2D24  F    15,0,11556
2CDA  1310 2DC6  U    1,0,11718
2CDE  5901       PZW  0,1
2CE0  0000       0
2CE2  0010       16
2CE4  2DC6       11718
2CE6  0001       1
2CE8  1B10 2DC2  B    1,0,11714
2CEC  2911       CS   1,1
2CEE  1310 2DC2  U    1,0,11714
2CF2  F310 2CD6  EU   1,0,11478
2CF6  4B10 0802  LCB  1,0,2050
2CFA  1310 2DC6  U    1,0,11718
2CFE  5901       PZW  0,1
2D00  0000       0
2D02  0010       16
2D04  2DC6       11718
2D06  0002       2
2D08  1B10 2DC0  B    1,0,11712
2D0C  0B10 2DBC  A    1,0,11708
2D10  1310 2DC0  U    1,0,11712
2D14  1B10 2DC4  B    1,0,11716
2D18  2911       CS   1,1
2D1A  1310 2DC4  U    1,0,11716
2D1E  F310 2CC6  EU   1,0,11462
2D22  597F       PZW  7,15
2D24  0000       0
2D26  1B60       7008
2D28  2DBE       11710
2D2A  1B70       7024
2D2C  2DC0       11712
2D2E  0B60 2DBA  A    6,0,11706
2D32  1360 2DBE  U    6,0,11710
2D36  2B60 2DBA  S    6,0,11706
2D3A  1940       CB   4,0
2D3C  1950       CB   5,0
2D3E  19A0       CB   10,0
2D40  4B20 1000  LCB  2,0,4096
2D44  4B30 F000  LCB  3,0,-4096
2D48  3842       SP   4,2
2D4A  1AFF       GB   15,15
2D4C  2DA2       11682
2D4E  3834       SP   3,4
2D50  1AFF       GB   15,15
2D52  2DA2       11682
2D54  3852       SP   5,2
2D56  1AFF       GB   15,15
2D58  2DA2       11682
2D5A  3835       SP   3,5
2D5C  1AFF       GB   15,15
2D5E  2DA2       11682
2D60  1884       B    8,4
2D62  A484       M    8,4
2D64  8D8B       CRR  8,11
2D66  18B8       B    11,8
2D68  1885       B    8,5
2D6A  A485       M    8,5
2D6C  8D8B       CRR  8,11
2D6E  18C8       B    12,8
2D70  181B       B    1,11
2D72  081C       A    1,12
2D74  4B20 2000  LCB  2,0,8192
2D78  3821       SP   2,1
2D7A  1AFF       GB   15,15
2D7C  2D82       11650
2D7E  1AFF       GB   15,15
2D80  2DA2       11682
2D82  1884       B    8,4
2D84  A485       M    8,5
2D86  8D8B       CRR  8,11
2D88  0888       A    8,8
2D8A  0887       A    8,7
2D8C  181B       B    1,11
2D8E  281C       S    1,12
2D90  0816       A    1,6
2D92  1841       B    4,1
2D94  1858       B    5,8
2D96  09A1       CA   10,1
2D98  39AF       CSP  10,15
2D9A  1AFF       GB   15,15
2D9C  2DA2       11682
2D9E  1AFF       GB   15,15
2DA0  2D40       11584
2DA2  89A1       CR   10,1
2DA4  08AA       A    10,10
2DA6  4B20 2DB2  LCB  2,0,11698
2DAA  082A       A    2,10
2DAC  1A12       GB   1,2
2DAE  1BF0 2D24  B    15,0,11556

2DB2  0004       4
2DB4  0007       7
2DB6  0018       24
2DB8  0005       5
2DBA  0053       83
2DBC  00A9       169
2DBE  0000       0
2DC0  0000       0
2DC2  0000       0
2DC4  0000       0
2DC6  0000       0

What does this assembly code do? What machine is it?

• If you have questions, hints or guesses, mark them as such in the comments, and encode the text after it using ROT13.
• As of this writing, both Claude and Gemini can answer this, so don’t let yourself be spoiled by LLMs.

Much of science is performed through inference, with the readings on instruments, a flash of light in heavy water, or the results of parsing through terabytes of sensor data after a particle accelerator collision either backing up a proposed scenario or weakening its foundations.

In the case of so-called dark matter, this is even more relevant, as we are talking about a proposed form of matter whose most pertinent feature is that it doesn’t interact with anything else except through gravity. This is where the wiggling of a levitating magnet may be the key to detecting it.

In this experimental setup by Rice University and Dutch researchers at the Leiden Institute, a tiny permanent magnet the size of a grain of sand is levitated above a superconductor, surrounded by highly sensitive detectors that should be able to spot even minuscule movements. So far, they have collected a month’s worth of data, with no conclusive results yet.

Even if they don’t detect any ‘knocks’ on this tiny levitating magnet, it will still help refine existing models of what dark matter’s properties might be. For the next phase of this research, they’ll add more of these sensors, which will also make it easier to distinguish background noise from any unusual readings.

We’ve previously talked about [Vera Ruben]’s contributions to the hunt for dark matter and the mysteries that prompted the idea that it might exist.

One of those niche curiosities, I tried to run down an old joke that’s variously attributed to Bob Newhardt, Tom Lehrer, and many others. I’ve seen a lot of variation in wording, but the core joke was always:

Well, aside from that, Mrs. Lincoln, how did you like the play?

The inestimable Barry Popik has the earliest citation to a famous midcentury political humor column:

22 May 1957, The Evening Star (Washington, DC), “Potomac Fever” by Fletcher Knebel, pg. A-23, col. 4:

What TV interviewing would have been at the time of the Civil War: “Well, aside from that, Mrs. Lincoln, what did you think of the play?”

By the time I found this I had gone through a fair amount of false leads and slop, so I wanted to confirm and provide a convenient copy for future citations. The Library of Congress has helpfully digitized this page:

And here’s the page pdf for convenience.