Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Pwning a Brother labelmaker, for fun and interop

sdomi.pl

Post reply on HN
Print view View original

21–30 of 50 posts

Re: Pwning a Brother labelmaker, for fun and interop

#21

Post by makmanalp »

brudgers wrote: post #15
parl_match wrote: post #11

Earlier quoted context omitted.

> Like who fucking cares how old the CPU in a label printer is? I don't (usually) care about the CPU, but I do care about the update story. If they are shipping a very outdated cpu design, it likely runs a kernel that no longer gets security patches.

If plausibly your label printer is an attack surface of significant consequence, a Dymo is the simplest thing that might work. https://www.staples.com/dymo-organizer-express-pro-industria...

I feel a bit silly being excited about this, but of course there's a circa 50s office solution that requires no batteries and electronics. I don't know what I was thinking!

Re: Pwning a Brother labelmaker, for fun and interop

#23

Post by Lammy »

brudgers wrote: post #15
parl_match wrote: post #11

Earlier quoted context omitted.

> Like who fucking cares how old the CPU in a label printer is? I don't (usually) care about the CPU, but I do care about the update story. If they are shipping a very outdated cpu design, it likely runs a kernel that no longer gets security patches.

If plausibly your label printer is an attack surface of significant consequence, a Dymo is the simplest thing that might work. https://www.staples.com/dymo-organizer-express-pro-industria...

I especially love the aesthetic of the industrial ones that emboss steel or aluminum tape: https://makezine.com/article/science/tool-review-dymo-metal-...

“If you’ve ever used one of Dymo’s small 1/4″ or 3/8″ plastic-embossing labelmakers (and who hasn’t?) you already understand how this tool works, and how to operate it. But in terms of construction quality and durability, the Tapewriter is as far removed from those cheap plastic embossers as a Mercedes is from a Kia. It’s 10″ long, weighs almost two pounds, and is made almost entirely from cast aluminum, with steel fittings here and there, and all held together with machine screws. The only polymer in the thing, as far as I can tell, is a rubber friction coating on the internal tape drive wheels.”

Re: Pwning a Brother labelmaker, for fun and interop

#24

Post by jasonjayr »

metadat wrote: post #22

I love the old-school font on this page. Reminds me of Word Perfect on the old Macintosh computers. > pxplus_ibm_vga8regular https://www.bing.com/search?q=%22pxplus_ibm_vga8regular%22+f... Why is it only available from seedy foreign font sites?

Get it and more from the source:

https://int10h.org/oldschool-pc-fonts/

That happens to be my favorite programming font. I cut my teeth on qbasic/DOS, so in 2024 I still use that font in my linux terminals + VSCode :)

Re: Pwning a Brother labelmaker, for fun and interop

#25

Post by metadat »

jasonjayr wrote: post #24
metadat wrote: post #22

I love the old-school font on this page. Reminds me of Word Perfect on the old Macintosh computers. > pxplus_ibm_vga8regular https://www.bing.com/search?q=%22pxplus_ibm_vga8regular%22+f... Why is it only available from seedy foreign font sites?

Get it and more from the source: https://int10h.org/oldschool-pc-fonts/ That happens to be my favorite programming font. I cut my teeth on qbasic/DOS, so in 2024 I still use that font in my linux terminals + VSCode :)

Wow, thank you so much for the reference! I must transition from a substack to a proper statically generated site so I can use this font, haha. Cheers!

Re: Pwning a Brother labelmaker, for fun and interop

#26

Post by Nectar0516 »

> # sorry for this being so long, i have no way to format it sanely x.x

Here ya go, I fixed it (or just see the pastebin link if you're curious what it says):

    wget -O conffile https://pastebin.com/raw/eGfKdvh8
    curl ... \
      --data-urlencode 'org.cups.sid=1862ff74a0c01dd0fb444934e7e67e05' \
      --data-urlencode 'OP=config-server' \
      --data-urlencode "CUPSDCONF@conffile" \
      --data-urlencode 'SAVECHANGES=Save+Changes' >/dev/null

Re: Pwning a Brother labelmaker, for fun and interop

#27

Post by ryandrake »

parl_match wrote: post #11
Lammy wrote: post #9

Fun read and great debugging but I'm honestly really sick of this kind of attitude since it's essentially arguing for more churn and for more e-waste: > There's a CUPS version that's 10+ years old, Linux kernel almost old enough to drink, all of that r̶u̶n̶n̶i̶n̶g̶ crawling on an ARMv5. > but it seems that they have one specific design and they're happy to milk it for as long and as cheap as possible Like who fucking…

> Like who fucking cares how old the CPU in a label printer is? I don't (usually) care about the CPU, but I do care about the update story. If they are shipping a very outdated cpu design, it likely runs a kernel that no longer gets security patches.

Not only this, but just how, during the hacking, the author noted how slipshod everything is:

> Perhaps the most eyebrow-raising part of this whole adventure was seeing how messy and cluttered the base image was. Constructs like /etc/www, messy symlinks interconnecting different directories for seemingly no reason, things thrown around with zero understanding of how everything works, etc.

Ancient kernel, ancient busybox, ancient vulnerable CUPS build, an authentication system that didn't really authenticate anything, vulnerabilities everywhere, and the base system just thrown together like amateur hour.

I've always wanted to sit down with a Tech Lead of a product like this over coffee, and just pick his brain to understand how he considered any of this to be acceptable. I mean, do you just barely get it working one day with everything just hanging together in whatever way the last engineer left it? Then the next day the product ships, and you go home satisfied with how you did your job?

Re: Pwning a Brother labelmaker, for fun and interop

#28

Post by gumby »

ryandrake wrote: post #27
parl_match wrote: post #11

Earlier quoted context omitted.

> Like who fucking cares how old the CPU in a label printer is? I don't (usually) care about the CPU, but I do care about the update story. If they are shipping a very outdated cpu design, it likely runs a kernel that no longer gets security patches.

Not only this, but just how, during the hacking, the author noted how slipshod everything is: > Perhaps the most eyebrow-raising part of this whole adventure was seeing how messy and cluttered the base image was. Constructs like /etc/www, messy symlinks interconnecting different directories for seemingly no reason, things thrown around with zero understanding of how everything works, etc. Ancient kernel, ancient busy…

> Then the next day the product ships, and you go home satisfied with how you did your job?

Yes.

Programming is typically a blue collar job in Japan. Making a device means design it, build it, validate it, and ship it. The factory doesn’t change anything. You don’t revisit it; if the company wants a new version you design the new device and yes, in the process grab some stuff from prior versions if you want.

Obviously not every company works this way (e.g. programmers have more status at places like SCEI or Nintendo; some car companies do step parts of their designs) but if you look at most industry you’ll find it’s pretty much as I describe.

Re: Pwning a Brother labelmaker, for fun and interop

#29

Post by 037 »

moogly wrote: post #16

I'd like to hack my P-Touch to not waste 1" of tape every goddamn print for no discernible reason. I've read Brother's reason and I don't see it.

I have the Brother P-Touch CUBE PT-P300BT and “pwned” it (not really) some time ago. Using this code as a starting point [1], I set it up with a FastAPI backend serving an HTML+JS frontend on a Raspberry Pi Zero 2 W. I connect to it using a browser, design the label, and it prints via Bluetooth. One of the first options I added to the interface is the “no feed” checkbox, which I use when I know I’ll print more than one label in sequence before cutting.

My idea is to add another endpoint to the API so that using Whisper or Siri, I can say, “Print Eggs and today’s date” or “Print Coffee in medium size.” I use something similar with an Alfred workflow, but voice commands would be nice in the kitchen.

I hate when someone talks about a project I’m interested in but doesn’t share any code. However, the entire thing is so ugly that I’ll never permit any other human being to see it. I’ll incorporate a Dead Man’s switch to delete everything or burn the Raspberry Pi, if needed.

Anyway, it’s all very simple once you realize that Fabric.js [2] handles 80% of the interface and functionalities on the frontend. Probably with Aider [3] and Claude Sonnet 3.5, you can make it during breakfast (or 7 years: I’m a dev, so I’m VERY bad at time estimations).

[1] https://gist.github.com/vsigler/98eafaf8cdf2374669e590328164...

[2] https://github.com/fabricjs/fabric.js/

[3] https://github.com/paul-gauthier/aider

Re: Pwning a Brother labelmaker, for fun and interop

#30

Post by 037 »

liminalsunset wrote: post #17
moogly wrote: post #16

I'd like to hack my P-Touch to not waste 1" of tape every goddamn print for no discernible reason. I've read Brother's reason and I don't see it.

Well fortunately, there is a setting that you can use to do "chain printing" where if you have a number of labels to print, it simply won't cut the last one it prints, and then you can send another job to the printer and it'll cut that one out and print the next (leaving the last thing it printed uncut, if you still have the box checked). I don't particularly doubt the waste of tape is somewhat necessary. The way TZe…

I studied the mechanism, and while it’s true that some tape must be wasted, I think there is room for improvement (with a different idea or even small changes, given that I have a Dymo that uses the same mechanism but wastes much less tape). I simply believe there aren’t enough incentives to research something that saves tape.
Post reply on HN