Visit to Philadelphia to see Hive 76, one of Philly's hacker spaces

I might have one of the most awesome part-time jobs: I am setting up a 5,500 sq ft hacker space in Northern Virginia. I traveled to Philadelphia this weekend to talk with Far McKon, one of the founders of Hive 76. About a year ago, I met Far in the D.C. area and we talked about the idea hacker space. Of course, ideals are challenging to obtain, but some hacker spaces have come closer than others. Hive 76, profitable after only 8 months since it was started, is one of those.

I met Far and Maggie, from the Prometheus Radio Project, for lunch at the Reading Terminal Market. After living in the Seattle area for a year and enjoying Pike Place Market, I have pretty high standards when it comes to indoor public markets, but I thoroughly enjoyed the Reading market. If I lived in the Philly area, I would do most of my food shopping here. I was also interested to see that most of the shop vendors were Mennonites and Amish.

At lunch while I enjoyed crepes with Nutella and fruit (I have fond memories of Nutella from my days living in Oxford, England), we discussed ideas such as an international hacker space conference, an organization for helping new hacker spaces get started, and challenges with management, legal, and lobbying efforts with hackers spaces and those faced by The Prometheus Radio Project.

After lunch, Far and I went to Hive 76. It is situated in a large warehouse/loft space in Philly’s warehouse district, not far from Center City. Upon entering the building, I was delighted to find that access to the 5^th floor loft is via an old elevator that looks like it is straight out of the movie Blade Runner; for a moment, I envisioned Sebastian’s bio-engineering workshop apartment with his invented creatures--his hacker space. Entering the caged elevator room through two steel lattice doors and watching the old counter weights go by as we ascended, I was impressed with the engineering prowess of the well-oiled machines of the last century.

The space’s access is on the 5^th floor in a building occupied by artists. Upon entering the loft, the sparsely furnished entryway is accented with little more than a threadbare couch and a large steel frame cubical sculpture. Hive 76 is down the hall, and in contrast to the neighboring artists’ spaces with kilns and easels, this hacker space is comfortably full with tech equipment: laser cutter, cupcake CNC, server racks, a workspace area for computers, and tables for projects. Christmas lights strung from the high ceiling reminded me of the hacker’s workshop in the movie Sneakers. As I sit here writing this blog posting, I have a great view of Center City, Philadelphia.

Far and I discussed some models for hacker space physical and business organizations: this is why I came. With my huge hacker space (perhaps the biggest in the U.S.) being planned for a grand opening later spring/early summer of this year, I have a lot of work to do to learn from other hacker space organizers to share what works and what doesn’t. I’ve visited a handful of other spaces, and collectively, I have graciously been afforded the opportunity to talk one-on-one with the founders about their successes and failures. I hope to replicate the former, not the latter.

Some of the discourse we’ve shared: the hacker space size, equipment and memberships should be commensurate to community in which it is located to facilitate success; membership, ideally, should pay for most if not all of the space overhead costs; a national hacker space organization (with Founder conferences and a data base of shared technical, management, and legal resources) would be very helpful in helping manage existing hacker spaces and facilitate start-ups of new spaces; a hacker space in which co-working/hacker start-up companies can rent full-time locking office space that is physically connected to the hacker space. (Image is of an old typewriter being turned into a keyboard for a computer)

@h3inous, Leah Kubik

If you were on Hackers on a Plane and attended Hacking at Random in The Netherlands, you knew Leah Kubik, @h3inous. She had a tragic accident at the University of Toronto and will be missed in the hacker community.

Her funeral is Saturday, September 19, 2009 at Palmer Funeral Home-River Park in South Bend, IN. Flowers for the service have been sent from the Hackers on a Plane participants. The card with the flowers says:

FROM HOAP:MITCH,MATT,BERNIE,M,STERNN,ZIMMER,BERT,SHARDY,PHOSGENE,DAVID H.,DANIELLE,SIDNEY,VYRUS,NICKY,ERIC,MIKE,DUCK,STEVE,KRIS,DAN,JAMES,TRAVIS,FRIENDS,JOHL, DAVID B.,TIFFANY,OKKIE,CHRIS.J.,GUCKES,NIKITA,NICK.

OpenOtto Project at DEFCON 17 and Black Hat USA 2009

The OpenOtto Project is doing more presentations. We had/have a lot of conference presentations this summer. The photos (photos by Brian Turnbull) are from Intridea’s HackOn (un)conference that was held June 18-20^th in Portland, Maine. After co-working with Intridea on Friday, Nothingface and I did a presentation about the current state of the OpenOtto Project on Saturday.

We also just secured presentations at Black Hat USA 2009 and DEFCON 17 in Las Vegas. Our Black Hat talk will be with me and Travis Goodspeed. Travis is working on the layout so we can progress toward releasing the schematics, source code and producing the first demo. We're doing a presentation at Black Hat in the open source project break-out session on Wednesday, July 29, 10:00 AM, Genoa room, 3^rd floor at Caesar’s Palace.

The DEFCON talk will be on Saturday, August 1, with Skytalks, skybox 303 at 10 AM, The Riviera.

Please come see us and talk with us about hacking your car! We’re looking for funding and developers.

2600/HackME Meeting Tonight

After a few months of first fridays attendance at info sec and hacker conferences, I am going to be at this meeting tonight, 6 PM in the food court at the Maine Mall. The hacked car will be in mall's parking lot, but I don't know if Nothingface remembered to bring the hardware to do a demo. If you're in Portland, please join us for a recap about the Notacon hacker conference that was in Cleveland, Ohio a few weeks ago.

What should the OpenOtto demo car NOT be

Rob T Firefly suggested we get a DeLorean for the OpenOtto demo. Awesome idea! Love it. If we come across one, we'll make a go for it.

However, here are some suggestions of what the demo should NOT be. Although they might attract more girls to the computer hacker scene, these cars are not cool.

Even though the guy with the 89' Oldsmobile Cutlass Sierra Louis Vuitton Limited Edition looks pretty fly, this doesn't quite say, "Give us VC funding, please" but, instead, "I'm a bad knock-off."

The Ferrari...it's just so wrong. This doesn't say, "I'm so hot, give me a speeding ticket," as Ferrari's should, but, "This is my teenage daughter's car." Instead, this is the Ferrari OpenOtto would be willing accept as a donation to the open source project. If you've ever ridden in a Ferrari and driven so fast along winding mountaintop roads in Italy that there is FIRE coming out of the tailpipe and you're pinned into the racing seat, you'd understand why my vote is for a sports car. I like fast cars that go boom.

The last picture is one I took of a wimpy Jeep Liberty on my driveway during mud season. Indeed, it took TWO Land Rovers to tow out the Liberty. No wimpy SUVs--this is a going-to-the-mall car. Thank goodness it was a rental. It had mud coming in the doors by the time we got it out of there. I was told that, when it was returned to the Portland, Maine airport car rental office, the guys receiving the car stood in disbelief as they saw the mud on and in the car. Instead, we vote for an H1 as our off-roading vehicle demo car. If we can't have that, we'll stick with the 2003 Land Rover Discovery it's in now because it really can go anywhere. In fact, we've taken it there and back.

If OpenOtto could have a demo car, what should it be?

We’ve been watching Knight Rider. (Actually, we have been since the 80s, so that probably dates us.) We’ve recently been having some fun debates about a dream demo car for OpenOtto. Of course, we’re just scraping by now and absconding with junk parts from cast-offs and running OpenOtto on a 2003 Land Rover, but if a dream could come true, what would be the coolest car OpenOtto’s software and hardware could control? Would it be an off-roading SUV, a sports car, or a muscle car?

Because Knight Rider was an inspiration, one of the demos has to be an American muscle car. There will always be some who believe the original Knight Rider¸ a 1982 Pontiac Firebird Trans Am, will be the only true KITT. If you ever wondered if KITT really had a blood analyzer, Ski Mode, or an electromagnetic field generator, here are all of the technical specs for KITT from the 1980s series. We should have attended the Knight Rider Festival last week in Las Vegas. Both the new and old KITTs were demoed along with hobbyists displaying their tribute cars.

The new Knight Rider series features a Ford Shelby GT 500 KR Mustang. With Val Kilmer as the new KITT voice, the car sounds and looks HOT. If you want to keep watching the new Knight Rider TV series, you must be proactive and sign a petition to keep the show going. Why not? It’s cooler, hacker-ish, and more techie than the dozens of boring doctor and lawyer shows now on prime time TV.

But one thing is for sure, when we do professionally demo a car controlled by OpenOtto, the developers must wear their Michael Knight costumes. (Sorry, these hokie things are part of what start-ups make their employees do). But I think I’ll opt for Daisy Duke’s outfit even though the 1969 Dodge Charger General Lee always seemed to be broken down, didn’t it? KITT would leave General Lee in the dust and then go on to hack some wicked encrypted world computer networks any day! Hack on, KITT!

SOURCE Boston 2009 – Part Four

The second day started with getting up “early” so I could see Christofer Hoff discuss the vulnerabilities associated with outsourcing your prized possessions to cloud computing networks. It was definitely worth dragging myself out of bed. Chris is another AWESOME presenter. Peppered with a few early morning f-bombs (which, according to one of my students, is KEY to getting venture capital financing [?]), it was a riveting presentation and had visually appealing slides. I can take guidance from his method of presenting when he spoke to Twitterers in the crowd declaring that none of his 75 slides contained more than 160 characters per slide (and eerie, cool pictures of frogs). Most significantly, what I took from his presentation were some ideas about securely storing and accessing intellectual property from cloud computing networks. Some of those ideas I abstracted into search and seizure principles and incorporated some new research ideas into the CFP abstract for Brucon which, incidentally, was submitted at a witching hour Sunday night by me and my research partner, Myrcurial, in Toronto. Thanks for the inspiration, Chris!

Later that day, the disclosure panel was one of the talks I really wanted to see at Source. I have done research on this topic and was delighted to hear Ryan Laraine asking Dan Kaminsky, Ivan Arce, Dino Dai Zovi, Alexander Sotirov, and Katie Moussouris debatable topics such as:

· What’s enough time to give the vendor?

· Should there be a partial disclosure committee to prevent the purgatory Kaminsky endured with his DNS bug?

· Should there be civil liability for companies putting out insecure products?

· What about disclosing security vulnerabilities that effect devices where lives could be at stake?

· What if people discover vulnerabilities in safety-critical software such as in cars?

o What if someone reverse engineers the protocols in cars and hacks car computer networks? (gasp!)

These are all topics I have researched and debated with my colleagues. That’s another blog posting, but I was delighted to see some independent researchers debating this issues along side representatives from large companies. The resources and vulnerability response time small and large companies can respectively allocate toward patching a vulnerability is significantly different and was evident in the way the panelists answered these questions.

I left the panel after an hour into it so that I could show off OpenOtto’s hacked car computer that was in the garage of the Seaport. (I had to silently laugh and saw Dan steal a glance at me in the crowd during all of the hacked car computer discussion during the disclosure panel when, all along, there was one sitting in the hotel’s garage! The “what if” discussion is now moot.) I drove the hacked Land Rover to the Source conference to share this open source project with some like minded hackers like Joe Grand and Travis Goodspeed and demoed it before Joe left for the airport.

I showed Joe and Travis how the OpenOtto team reverse engineered the protocols in car computers allowing us to access any car’s computer. Automotive networks follow an OSI model, so OpenOtto was designed to be like an operating system for the car—all developers have to do is write high-level applications on top of the stack and they will operate with the car’s computer using OpenOtto hardware and software.

Source was the debut of OpenOtto’s prototype board which successfully outputted a handful of performance characteristics to a laptop connected, via the prototype board, to the OBD 2 port. This is more than a scan tool and can be used to tweak performance and output A LOT of real-time parameters about the performance and error codes for all cars. This particular prototype board could output 1 of 4 of the ISO 9141 physical layer. In a couple of weeks, a device will be complete that will run all 4 physical layers using an ARM processor. (Note: At the conference, it was MOST car computers except for GM, Ford, Chevy and cars newer than 2008, but soon it’s EVERY car. Only 1 of 4 physical layers were done at the conference, but all are being done now).

After the disclosure panel, I dumped my computer equipment in Dan Kaminsky’s room and went to join him, Travis, Ian Robertson and a co-worker from RIM for dinner at the Atlantic Beer Garden. I/O Active’s party with free drinks and food immediately followed, so we stayed there until almost closing time. From there, we went to Lucky’s Bar until that place closed. At that late hour and with the Rover on almost “Empty”, I doubted I could safely find a gas station open at that hour, so I decided to stay in Boston until dawn.

We didn’t get to see Dan Kaminsky, savior of the Internet…in his super hero tights, but we did finish the night by getting my computer equipment and busting in on Dan in his hotel room while he was dorking out on his computer just a few hours before he had to catch a flight somewhere. From there, I was happy to crash for an hour of sleep on a couch in a suite before I had to drive back to Maine at the ungodly hour of 5 am. (Thank you, suite host, for your hospitality, your pillows, and your duvet.)

Until next year, thanks SOURCE Boston organizers for making it such an interesting, informative, and fun conference!

(Picture, by Travis Goodspeed, is of OpenOtto's demo board on the upper left corner on console. Toy Story Alien is not part of OpenOtto)