"Let me be very clear: there is not a single piece of evidence that Trezor devices have been compromised."
Are you sure?
zetter-zeroday.com/trezor-wa…
Replying to @Dustin_Schimp
Could also be a “oops, our AI did a crime because we basically told it to and our lab containment was the intern’s hackathon project. Uhhh give the victim access to our fancy tool that everyone wants. And uhhhh have marketing get ahead of this by trying to flip the narrative”
But who knows. The doomer hype has destroyed trust. They will need to earn it back.
MG retweeted
For anyone who's actively / considering building something in the hardware space... absolute gem of a post right here
xitter.cf/i/status/2070189699185…
When you make a hardware product, you also make a bunch of hardware that nobody will ever see.
This is all custom hardware I’ve built to make the OMG Cable what it is today. And there’s plenty not pictured too!
Automated firmware loading, QA testing, calibration, stress testing, destructive testing, lab certification, performance profiling, etc.
Some of these are very simple devices. But some communicate together, auto-scale, create process audit chains, & ensure no mfg/QA steps can be skipped. If a single cable has issues, I can often look back at the entire manufacturing process to see why.
This is how I reduced my failure rate about 1000x from my first batch. If a single component is outside of margins, I’ll be able to see it… even when the PCBs are completely embedded inside of protective material.
It’s kind of fun designing these. Most everything is inverted from product design. A typical hardware product will be in the hands of thousands of people across thousands of environments and be supported for many years. With factory tooling, it’s a very small set of users & environments. If you want everyone to upgrade to the latest version, you just replace everything!
The “foreign routers ban” is being enforced at the FCC certification stage. If you don’t know what that means, here’s a quick explainer:
Once you (the manufacturer) have FINALIZED your new hardware design, you produce a few units and send them off to a specialized lab to test the radio emissions from your device. If everything goes perfectly (no test failures), 2-3 months later you will have a FCC certification. Then you have to apply the FCC label to your product.
Without the completed FCC cert, you cannot legally market, import, or sell in the USA. So, mass production typically doesn’t start until after the cert happens, unless you are very confident that you will one-shot the lab tests without any hardware revisions. Else, you’d be stuck with tons of hardware you can’t sell.
This FCC change will be especially painful to anyone who was about to get their new device certified. The requirement to have an on-shoring plan is probably going to be the most significant hurdle for manufacturers.
If this ban included all current routers (it doesn’t), it would have been way more painful. Not just from the consumer side with supply impact. But imagine every existing router having to go through a 3+ month process with labs that would be instantly booked with backlog for years. Sure, some sort of leaned down re-cert process would have been more probable, but you get the point.
MG retweeted
Let’s play another round of “your assumptions about USB C are wrong!”
Here is a board I got on Amazon. It claims to be made by @lilygo9. The USB C port is improperly designed and it results in the odd behavior seen in the video.
Guess what the problem is!
Thread 1/n
I got $500 worth of Arduino Nano’s from AliExpress from 4 different sources.
50% of them don’t even power on. Want to guess why? You can tell by careful examination of the boards.
Hint: they are all USB-C
MG retweeted
New jig works perfectly! So much faster than the old way.
I might add a toggle clamp to hold the panel down for me, but a full flash & test cycle is only 12 seconds.
MG retweeted
It’s wild that the OMG Cable is now framed & displayed in @ShawnRyan762’s museum next to things like golden AK mags from Saddam’s palace.
MG retweeted
I gambled a year’s salary and lost.
This is what building a hardware product can look like, especially if it pushes limits.
The OMG Cable has evolved a lot since this story, but it wouldn’t be what it is today without this gamble AND failure. The factory tooling I have built today is something I designed over the years to prevent and identify so many possible failures.
MG retweeted
I’ve never mentioned it, but all of this is made in USA
OMG Cable finished in USA
Envelope printed in USA
Envelope made in USA
Envelope paper made in USA
Stickers made in USA
Insert card made in USA
Cable clip made in USA
And of course all of it was designed in USA
I’m not sure I’ll ever be able to achieve 100% of the supply chain in USA. Ex: Certain chips just aren’t made here. But it’s kind of cool to reflect on the current state of the product.
MG retweeted
Replying to @sysadafterdark
They will have a job posting up before the obituary is posted.
The only people who will remember in 20 years all the extra hours you worked are your kids/family.
MG retweeted
If someone from amzn wants to provide a little clarity on what was ACTUALLY measured here, I’ll gladly share a whole bunch of detection tricks that are probably much higher signal & more simple, than what I mentioned above.
I promise I have a… special understanding of keyboards:
MG retweeted
Holy shit. They cleaned up the kerning.
You uhhhh watching my twitter @DeptofWar ? 👀
MG retweeted
The math is unbelievable to most people. So here is an example breakdown of individual vs bulk import.
$50 on an individual import could be:
- $30 DHL brokerage fee
- $10 disbursement fee
- $10 customs/VAT
It’s 80% paperwork & processing fees!
Whereas a bulk import sends through hundreds of parcels all together and is counted as a single import event.
- That means a $30 brokerage fee on 500 packages would effectively be $0.06 per.
- No disbursement fee because the courier isn’t pre-paying on behalf of the receiver.
- And then finally, a bulk import that pays an averaged customs across all packages. Bulk importers have a stronger relationship with customs entities to pull this off.
It’s really just economies of scale.
Historically, most people have been shielded from this reality due to De Minimis exemptions. (No customs or processing for packages below a specific value) But a lot of countries are ending this due to the abuse of places like AliExpress, SHEIN, etc. So now everyone gets to pay customs, which means all the paperwork & payment process required. And the various “Duties Paid” providers are able to step in and make it more efficient.
This Post is from a suspended account. Learn more
MG retweeted
Replying to @ImposeCost
“and your freedom is gone” would be a great way to destroy defcon’s brand and comes off as extreme punishment for a kid throwing sand in a sandbox. However your post does exhibit a commonality with why we have this issue: lack of contextual nuance.
We have far too few people in the space willing to culturally guide people towards nuance that’s appropriate for the context of the situation/environment/audience. There are appropriate times for attention grabbing stunts. And its almost always targeting an audience of defenders & resource allocators. And beforehand there should be a deliberate process of understanding how the intended audience will receive it, what they can meaningfully do in response, dynamics of consent, laws, etc etc.
People who are new to the space often miss all of that and try to repeat stuff without this nuance. Quick thrills in a world increasingly focused on attention. Even though the action has the tactical equivalent of throwing a brick through a window. Yea… glass can shatter. We all know! Outside of a longer attack chain (and all the other nuance mentioned) it means nothing.
Buuuut… new people to the space aren’t often to detailed nuance. Few will read all this. So, for those people, i will just leave a picture of this sticker that someone gave me at defcon:

























