ropbear

In my experience, students were actually pretty good about understanding this for themselves, at least in a security course I ran a survey in[0]. Unfortunately I didn’t get a statistically significant sample size (10/~60).

Another caveat is this was a graduate course, so I would expect more maturity and integrity on average than an undergrad course. But anecdotally I thought it was an interesting result.

[0] https://exploiting.systems/posts/2026-05-17-learning-focused...

And this reasoning is exactly how we got here in the first place.

“It’s not that bad, just a little bad, so it’s okay”

We’re talking about air pollution and death rates, not financial risk.

> The seller agreed to put an Apple AirTag provided by 404 Media in one of the books included in this order so we could see where the book was going. And by extension, which company, AI or otherwise, was behind this massive order.

It would seem the redaction of the rare titles is a way to avoid de-anonymization and subsequent harm to the business of the seller who agreed to place a tracker in one of the books. That being said, maybe they could have chosen a better methodology which would have allowed the disclosure of the title, although ultimately I’m not sure the title matters too much outside of their claim they were “rare”.

Made a comment up above, but that's tdpServer and tmpServer (sometimes tdpd and tmpd) and it's what I use in my python implementation of tmpcli, the (somewhat broken) client binary on some TP-Link devices.

You're correct, it gives you access to everything the Tether app can do.

https://github.com/ropbear/tmpcli

Of course! Happy to contribute. As is the case with your device, there's a lot of weird TP-Link firmware variants (even an RTOS called TPOS based on VxWorks), so no guarantee it'll work all the time. Glad there's more research being done in the space!

Many eons ago I wrote a Python version of tmpcli for this exact reason. Made some minor improvements a few years ago but haven’t touched it since. Curious what methodology Codex came up with, I haven’t revisited it since models got really good.

The idea is that tmpServer listens on localhost, but dropbear allows port forwarding with admin creds (you’ll need to specify -N). That program has full device access and is the API the Tether app primarily uses to interact with the device.

https://github.com/ropbear/tmpcli