Notes
Short notes on building products that need both hardware and software. Each is written around something that just happened.
-
How an old network stopped every US airport
Every US airport held departures for more than four hours on 13 November. The Transportation Secretary's account, how a flight is handed on, and what is not known.
-
Every US airport was told: no takeoffs. What the sky did.
The FAA ordered a nationwide ground stop on 13 November. A sky drawn from public flight data, what it shows, and what it does not.
-
Why a helicopter does not simply drop when its engine stops, and the Bayonne landing
A helicopter landed on a road in Bayonne after the pilot reported an engine out. Why the rotor keeps turning without the engine, and what is not known yet.
-
How the SS United States was sunk on purpose, and why it ran into the night
A 990-foot liner, longer than the Titanic, was sunk on purpose off Florida. No explosives, an organizers' best case of an hour, and a day that ran into the night.
-
Supermarket freezers across Europe reported heating up, and where a safety limit should live
Shops in at least ten European countries reported freezers heating up from 2 November. What the reports say was done, what is not known, and where a safety limit belongs.
-
Why the crashing Learjet shows up in only two frames of the dashcam video
A comment asked if planes just disappear when they crash. In the dashcam video the Learjet is clearly visible in two frames. Why, from the flight data, and what the NTSB found.
-
The Learjet dive in its own data, and the field that ran out of numbers
On 1 November a Learjet 60 fell five miles in about a minute. Its ADS-B data shows the climb, the dive and a vertical-rate field pinned at its top code.
-
What investigators are checking in the Learjet crash, and what they do not know yet
The NTSB has named no cause for the 1 November Learjet crash. The storm, the ice, the tail and a recorder not yet known to be aboard: what it is checking, and what it cannot confirm.
-
Fifty signatures, one wallet: what the Binance theft says about signing
Fifty signatures reached one Binance wallet. Forty-nine did nothing, one let $2.5B out. What that says about checking a request before anything is signed.
-
The Bugatti that was stolen with its key inside, and what a key actually proves
Bugatti's chief executive left the key in his Chiron and a man drove it to Austria. The car's data showed where it was. Who was driving is another question.
-
The touchscreen MacBook Pro, and Apple's two answers to a screen you poke
Apple's new MacBook Pro has Touch. Apple names a new hinge and camera-feed stabilization. What those two sentences say, what they do not, and how we would test them.
-
The iPhone Duo display issue, and what two teardowns actually found
One owner reports a cracked iPhone Duo after about six hours. Apple acknowledges an inner-display issue in a small number of units. What two teardowns suggest, what remains unproven, and what owners should do.
-
ClickFix, and why a real CAPTCHA never asks for keyboard shortcuts
A fake “I’m not a robot” check talks people into pressing Windows+R, Ctrl+V and Enter, which runs a command the page already copied. How it works, how to tell, and why no product should ask a user to paste a command.
-
PHP2Shell, and why being able to patch in an hour is the real fix
On 21 October 2026 PHP fixed two critical flaws, one at least 14 years old, and governments switched off their own websites on purpose. What happened, and what we would build so a fix ships in an hour.
-
The first public Switch 2 jailbreak: every app a device still runs is part of its security
The first public Switch 2 jailbreak came in through SmileBASIC 4, a $25 app made for the first Switch, and within a day the app was gone from Nintendo's store. What happened, the 2016 precedent, and what we would build into any device that runs older software.
-
The AirTag Silencer: safety features protect people who never bought your product
Elevation Lab sold a $9.99 pin that silences an AirTag for good, tracking intact, and pulled it after 13 days. What the beep is for, and what that means for anyone who designs a safety feature.
-
Ford's speedometer recall, and why a gauge should know where its needle is
Ford is recalling 102,159 F-Series trucks whose analog speedometer and tachometer needles can stick or move erratically. What the recall covers, how to check a truck, and what we would build into a gauge.
-
Private is not the same as asked
Home Assistant has checked app passwords against a database of leaked ones since 2021, privately and on by default, and a user objected. Four questions for a device that talks to someone on its own.
-
Your device will outlive your support
A cyberattack hit the refrigeration of hundreds of French supermarkets; Danfoss told AFP most of its affected units no longer get updates. Four questions for the years after support ends.
-
Your device is not a browser
Google says attackers obtained HTTPS certificates for domains they did not own, and Chrome blocked the ones it found. Four questions about what a connected device would do.
-
A software update should not be able to stop the fridge
An update still in testing reached refrigerators in customers' homes, and owners say theirs stopped cooling. Four things an update path should guard against, and a drill for the bench.
-
Cyber Resilience Act: what your devices should be able to tell you
Since 11 September 2026 a manufacturer has 24 hours to warn of an exploited flaw. Four things a connected device should be able to tell its maker when the clock starts.