Well, it is appropriate as a business card for an embedded systems engineers, not so much for a system security one!

More seriously, I never managed to understand the "obsession" with ROHS (this here is just an example):

>I made sure to have a lead-free process—the boards, parts, and solder paste are all RoHS—so that I wouldn't feel bad about giving them to people.

I mean, you are creating something that (besides being very nice) is not needed, that very likely will end soon in the trash (and that contains anyway a few grams of "far from clean" materials) and you worry about the tiny amount of lead in the solder tin?

Industry wide, it's about sanitizing a highly toxic substance from the supply chain. I've met a child whose father worked with lead, and would hug him after coming home. The child ended up with permanent brain damage from ingesting traces of leaded dust on the father's clothing. In this case, it's more likely about keeping lead out of something likely to get crunched up in a parent's wallet and then shown to their child.

Lead causes permanent brain damage in children. There is no detectable amount of lead in the blood of children which is considered safe. While an adult body absorbs roughly 95% of lead into its bones, children's bodies end up storing lead in blood and soft tissue where it causes damage. When untreated, it can take months for lead to exit a child's bloodstream.

I would never consider reducing the lead used in something I've built to be wasted time.

Until what age?

Is it safe for children to solder with leaded tin? (Many people here did so as a child, I suppose)

I have no idea. I'm not a doctor, I just read a lot.

I used lead based solder as a child, and I turned out okay. That said, people used to use pewter plates and got sick from lead poisoning after eating tomatoes (the acid leached the lead from the plate); Roman soldiers would keep their wine in a lead container to sweeten it; pretty sure I've heard something about people painting their houses with leaded paint as well. On the one hand, society survived all that. On the other hand, if I have the opportunity to not risk poisoning a child by spending a couple extra dollars buying solder, that seems like a pretty easy decision to make.

I don't get this lead-free hatred on internet forums. People say they can't solder with lead-free, and that it is terrible, and that joints look dull. So much hatred that I actually tried it out. And I found the process is basically just the same and there is nothing to be afraid of. Just set the solder iron temperature a bit higher and that's it. Works like a charm.

My note was not at all about lead-free hate, actually, since several years, everyone in EU (and I believe in US as well) has been using lead-free solder (ROHS is 2003, if I recall correctly).

As you say it is just a matter of slightly increasing the soldering iron temperature, but it doesn't end there and there may be issues further on (JFYI):

https://en.wikipedia.org/wiki/Whisker_(metallurgy)

It seems like lead-free alloys tend to be more problematic in these - fortunately rare - cases.

But because it is more than 15 years that ROHS came in force, I read in 2019 "and I made it lead-free" like I would read "and I buckled my safety belt" or "I put my helmet on", etc. I see it as "the normal" way, nothing worth a mention (nowadays).

I took a quick look at a rework station in an aeronautic company in France, all leaded solder.

>I took a quick look at a rework station in an aeronautic company in France, all leaded solder.

Very possible, there are a number of (pretty much wide) exemptions even in the last version:

https://www.gov.uk/guidance/rohs-compliance-and-guidance#wha...

I've heard about whiskers, but isn't it a mostly solved problem now with low Ag alloys like SAC0307?

Bismuth is used as a replacement for lead, if you want lower temperature solder. 58Bi/42Sn alloy is cheap and about as good as Pb/Sn, but is more susceptible to thermal fatigue. I used 57Bi/42Sn/1Ag to solder heatpipes. Works great!

I think it's very considerate to not add lead to a business card people may put in their pockets.

Lead is restricted because of what happens to it when PCBs are landfilled, not because it is harmful to touch.

Washing your hands after handling solder seems to be a fairly universal recommendation. It's not a concern for normal products because the users do not touch the bare PCB.

Lead is harmful to touch and absorb into your skin, so unless you're counting the PPMs coming off into your skin, you're wrong.

You misread. I didn't say it isn't harmful to touch. I said that isn't the reason it was restricted.

In any case it is safe to touch, despite the people downvoting me:

https://www.quora.com/How-dangerous-is-it-to-hold-a-block-of...

Sure, the lead may cross one or two layers of cloth and migrate from the pocket to your skin and bite you.

More considerate would be to provide the card in a protecting sleeve (that would protect from all the bad, bad substances it may contain) or just use a good, ol' plain paper business card, posibly printed with "bioetical" ink.

>Sure, the lead may cross one or two layers of cloth and migrate from the pocket to your skin and bite you.

You get it on your hands and then ingest it when you eat. (People don't usually wash their hands after touching a business card.)

>You get it on your hands and then ingest it when you eat. (People don't usually wash their hands after touching a business card.)

I was referring to the parent poster that talked of people putting them in their pockets.

Anyway, ROHS (or lead-free) is a good thing, but it is not like you get lead poisoning (or saturnism) because of the once in your lifetime you touched sometthing contained lead and then - if you eat with your hands - you managed to ingest it:

https://en.wikipedia.org/wiki/Lead_poisoning

You need to drink from lead or lead soldered tap water or water contaminated by lead to become poisoned by lead.

In the case of the Linux business card the exposed surface that would eventually contain a minimum amount of lead - pre-ROHS soldering tin contained in the common eutectic Sn-Pb alloy 37% lead - is in the below 1 square mm range.

You would nead to actually lick hundreds or thousands of such cards to ingest any meaningful amount of lead.

And lead free soldering tin may contain (in minimal amounts):

https://en.wikipedia.org/wiki/Solder

bismuth and antimony.

I wish I could find a source on this, but when my 12mo got his routine lead test, his lead levels were elevated. It was then that I learned that even "safe" levels of lead can (it appears, inconclusively) result in long term permanent changes: reduced IQ, increased aggression.

I will forever feel guilt about letting him play in the yard as a baby (my best guess as to where it came from) and take other efforts to reduce the lead in his environment.

Depending on your life situation, it may be impractical if not impossible to reduce the lead in your environment. I am open to being further educated on this subject, but it seems like reducing lead in all products that will be handled by people is a net benefit for getting to home environments that will not cause brain damage to the infants that live in them.

> I was referring to the parent poster that talked of people putting them in their pockets.

Right, but how are you going to put it in your pocket without touching it with your hands?!

>You would nead to actually lick hundreds or thousands of such cards to ingest any meaningful amount of lead.

Lead poisoning is cumulative, so you want to avoid ingesting even very small amounts. I doubt that good data is available regarding the amount of lead that would be ingested in this scenario or its potential effects. Best to be cautious. Lead free solder is not expensive.

Avoiding leaded solder is trivial, and it is something that's hopefully handled a bunch, so why not avoid lead? I didn't know "following best practices you have to follow in your daily work anyhow" is "obsessing".

It’s actually probably harder these days to build something that isn’t RoHS compliant as a hobbyist than one that is. The vast majority of what you can buy from Digikey and Mouser and whatnot will be compliant, PCB shops will mostly do lead-free HASL (though you’d want ENIG anyway if you’re going to use a stencil), and lead-free solder pastes are more common than leaded ones. Basically you’ll probably have to either use old stock parts or pull some really old solder out of the fridge as a hobbyist to end up with lead.

Most of the Chinese board fabs will sell you prototype-quality boards for a lower price if you use a leaded HASL finish (e.g. https://jlcpcb.com/quote#/?orderType=1&stencilWidth=100&sten...)

HASL is perfectly usable with stencils, in my experience.

Were I a system security engineer, I should think I'd have a sanitized way to plug in a USB device.

How else would one do forensics?

I meant - jokingly - the opposite, i.e. you call for a consultancy a security engineer as you are interested in increasing/bettering the digital security level of your business and he produces to you the Linux USB business card, you proceed to insert it in your computer and he says:

"Ah-ha!"

Reference:

https://www.imdb.com/title/tt0094898/quotes/qt1099763

In fact, a USB condom would be a nice variant of this project for a security engineer's business card, although the female USB portion might be a bit bulky for practical use.

This is true, but given that I'm creating it, why _not_ use a lead-free process, especially given that lead is known to be very soft and toxic?

Hey you are the one that made that nice card!

Good to see you here, congratulations for your idea and creation.

I replied to that in another post, ROHS is 15 years old or more and most available parts and solders are ROHS compliant, I believe you would have had a tough time to intentionally make something that was entirely non-ROHS compliant.

I spent a month visiting a PCB factory in China. I met the people working with lead soldering.

Seriously, please choose lead-free.

Pregnant women weren't allowed to eat in the cafeteria due to the high number of miscarriages. The people inhaling the stuff all day... let's just say that had a reputation among the other factory workers for being a bit mentally challenged.

It would be pretty sweet if it was Bluetooth instead. A Bluetooth serial console would be pretty kickass.

If their business card hires them, they’re hired!

Is that really the responsibility of the person making the card?

This is the responsibility of the creators of the USB hardware, firmware, motherboard firmware, electrical design, OS developers / driver developers.

It should be safe to plug in a USB device by default

The whole beauty of USB ports is that we have one unified interface for practically everything. It can't be safe without giving that up, adding some friction to user interaction, or doing some dark art involving centrally signed devices that we expect won't be broken. If anybody can produce storage and input devices that plug into a universal port and just work, malicious input devices can be made to physically look like storage devices in the eyes of the user. I'm not saying we shouldn't make more security conscious tradeoffs, I'm just saying that there are tradeoffs to be made, and most users probably won't appreciate the added friction.

should be safe, in theory, sure. But in practice?

Then we should stop any form of communication.

In practice it can be safe on multiple levels. He could’ve also just put some malware I. A pdf or word document, as word is what recruiters want.

OTOH, a security conscious engineer could exploit this to have the business card call home and automatically block communications from the company so one does not waste time with them ;)

I'd say that's a business opportunity lost.

It would be funny to have the business card list known exploits on their system -- whether this would taken lightly by the hiring manager is another question.

Pentest-by-business-card-as-a-service. Awkward acronym, probably not going to be a commercial success.

And just like that, you committed a felony.

Probably your second today, to be fair.

Wrong. Second this minute. (420 my man - fuck da US Gov in this respect - they do not have sovereignty over your body or mine)

Not a felony if it transmits over a cell network that the usb interface was activated.

Sorry, but unless you provide other data I still believe this would run afoul of the computer fraud and abuse act (CFAA - 1986).

That’s if you even have a USB A socket anymore!

I don't see why you were downvoted. I fully get why the blog writer didn't include USB-C with this awesome project. But there's now a growing group of people who simply can't use USB-A anymore with their laptops. Most will have an adapter, but not all.

I've played around putting USB connectors directly on PCBs, and USB-A is way more lenient than USB-C. With USB-A, you can use basically any PCB thickness between the standard 1.6mm and 2.2mm, and it'll work well enough.

USB-C's midplate is specified at 0.7mm, and all of the cheap chinese PCB manufacturers only offer 0.6mm and 0.8mm. 0.6mm is too thin to make reliable contact with most of the cables I've tried: I haven't gotten around to ordering another batch at 0.8mm, but plugging the corner of a 0.8mm M.2 SSD into a USB-C cable, it's pretty (i.e. probably slightly too) snug. Thin PCBs are also extremely flexible, which isn't great for brittle solder joints, ceramic capacitors, etc.

While this is generally true, I think it’s less true for embedded systems. All of the tools I use at work for embedded systems engineering (JLink, serial adapter, oscilloscope, logic analyzer, nearly all MCU dev boards and FPGAs) are USB-A. I use a MBP and simply could do any work whatsoever without a USB hub. I think it’s fair to assume anyone in the industry can use USB-A.

In the industry, yes, I agree. Except for maybe managers but even they probably have a dock on their desk that includes USB-A.

Edit: I remember something, having done work related to embedded stuff. About 6 years ago, we still had 3.5" floppy drives in a couple of scopes in the lab. We replaced those with a device that internally had the interface of a 3.5" floppy drive, but on the outer faceplate it had a USB-A connector for thumb drives.

I would assume someone doing embedded work would not only have to have USB, but serial. Is that incorrect? It seemed like that was even included in your list?

I usually have two or three USB to serial converters plugged into my computer at work at any time. I expect most embedded people would do similar (or use serial console servers over a network).

A female to C male adapters exist, but C female to A male adapters are forbidden by the spec.

That means you need to create A peripherals if you want the largest audience.

Are you sure this is the case? I bought a couple of these to have newer peripherals work on my older laptop.

Yeah, they sell them but they're not supposed to. It's because putting an A on each end of a C cable and connecting two A hosts together can destroy the two A hosts.

Practically, since you can find them as you say, is that as a peripheral vendor in the west, you can't ship a C device with a C to A plug because you'll lose your license.

What an absurd tragedy. Everyone was just fine with usb-A and ethernet ports and hdmi but no, now these laptops need dongles for literally everything.

USB-A is not 'just fine'. It's uni-directional. Which is an insane design for something being constantly plugged in and out. It's also low-bandwidth and low-power. Most devices these days have bluetooth, so it isn't really needed except for power and monitors. USB-C is a step-up in everything and I'm happy with only USB-C.

Not everything needs to be constantly plugged. My desktop doesn't even have Bluetooth in it. I'm quite happy with the USB A ports on my PC when it comes to plugging in mice, keyboards, USB storage, etc. If you use USB devices on a regular basis, you'll remember which way USB ports are oriented, and you can just look at the end of the USB cable to see which way it needs to go in.

Having said that, I will say the USB C connector on my phone is far superior, as I plug/unplug it daily.

Power and bandwidth aren't even related to connector type.

> If you use USB devices on a regular basis, you'll remember which way USB ports are oriented, and you can just look at the end of the USB cable to see which way it needs to go in.

You shouldn't need to remember orientation or look at it! You're apologising for a bad design.

> Power and bandwidth aren't even related to connector type.

Not true! For example the max bandwidth you can currently put through USB-A is 10 Gbps with USB 3.1. Through USB-C it's up to 50 Gbps with Thunderbolt 3.

The asymmetry of the USB-A connector is at worst a minor inconvenience. Definitely not in itself a good reason to break compatibility. And most USB devices are not frequently plugged in and out (indeed, for those that are, Bluetooth is a better choice!)

Growing pains, we'll get over it. USB-C fixes the problem everyone complained about forever of turning the plug over three times before getting it to be rightside up, and gives us enough contact points for modern video streams. I feel like making it compatible with the older USB standards by just connecting a subset of pins is super useful, and it's about as much backwards compatibility as we can expect with major sacrifices in other regards. I've got a phone with two USB-C ports, a hub that gives me two USB-A ports, an ethernet, and another USB-C, and a separate USB-C to HDMI adapter. I wouldn't trade either of my USB-C ports for a dedicated USB-A.

Absurd tragedy? Maybe for you. For me, it's been a good life since the 2016 MacBook Pro. I got a decent dock, and connect everything with a single cable.

I would assume you paid a good $150 for one, given that the others either don’t supply enough power or can’t do 4K@60.

More. I paid 250 euros for a CalDigit TS3 Plus. Thing is amazing.

When I first got my MacBook Pro, I just got USB-C cables for my external monitor and my (USB-A) hub. That was very cheap, but I love the convenience of Thunderbolt and shelled out the cash.

I am struggling to find good info - does usb-c support more than one display on one cable at 4k@60?

Yup, all Thunderbolt 3 docks support two 4K displays @ 60 Hz.

Then build an embedded system to plug it into ...

That was my first thought. If someone gave me this at defcon I would not use it.

Would you use anything given to you from a random individual at defcon?

Haha very good point! I would barely feel comfortable about a regular business card.

In an airgapped VM, on someone else's hardware? Probably not even then!

ethernet on a business card is just not as viable.

Perhaps you could do something like this, incorporating the jack into the PCB instead of an elevated component? https://upload.wikimedia.org/wikipedia/commons/d/df/XJACK_ne...

I never understood why Apple and other thin laptop manufacturers didn't do this? I remember X-Jacks fondly, and would love to have a super-thin laptop with ethernet.

Some ultrabooks have ethernet sockets that fold out. In my experience the reliability is ... mixed.

From the project webpage:

> It has a USB port in the corner. If you plug it into a computer, it boots in about 6 seconds and shows up over USB as a flash drive and a virtual serial port that you can use to log into the card's shell.

The parent of this thread has a valid point here and the insecurity implications of this is nefarious if one isn't careful.

While it is a technically cool fun project, I can imagine a bad actor taking this to DEFCON/CCC or even a tech-centric concert and mass producing this to emulate a USB drive, but is also a keylogger or a remote access tool of some sort which reminds me of the nightmares of BadUSB.

You and your parent clearly shows the current boring, uninspiring state of HN community. Well done.

Now, where is the predictible sandboxing guy to counter your predictible "security implications" argument?

Sort of agree, but the "well done" part in your reply also represent a sad aspect of HN, in my view

Yes, you're right. Can't edit it out, sorry.

I'm worried that the potential employer infects the card, uses it to take over their competitor personal computer network and appends: "Don't forget! The S in IoT stands for Security!" to all of their documents and audio files. Then the traffic lights after we colonize mars will be like "It is safe to cross. Don't forget!..." and some ATM on the moon will be like "Thanks for using the bank of the moon. Don't forget!..."