Sign in

Justin Schuh

@justinschuh.com
3.4K followers 487 following 2.1K posts

Back in Chicago as a stay-at-home dad and small business owner. Expect some infosec/privacy/safety, 3D printing, and politics. infosec.exchange/@jschuh Defunct: twitter.com/justinschuh

PostsRepliesMedia
Justin Schuh @justinschuh.com · 30/09/2026
This is a good book to understand just how systemic and far reaching his damage has been.
history.yale.edu
Public Citizens: The Attack on Big Government and the Remaking of American Liberalism | Department of History
The story of the dramatic postwar struggle over the proper role of citizens and government in American society.
010
Justin Schuh @justinschuh.com · 30/09/2026
I decided not to repost exactly the same gif in reply... but I really wanted to.
120
Justin Schuh @justinschuh.com · 30/09/2026
static.klipy.com
Tim Gunn Says 'Oh, Tell Me More' on Making The Cut
Alt: Tim Gunn Says 'Oh, Tell Me More'
120
Justin Schuh @justinschuh.com · 29/09/2026
I totally remember this: The end of Chris Claremont's era and the rise of Jim Lee (although Lee was gone in a year). I still have all the issues in a long box in storage. I started reading around Mutant Massacre and collected religiously up through Onslaught.
010
Justin Schuh @justinschuh.com · 29/09/2026
I suppose that's a matter of opinion. Either way, I imagine it could fail open or closed given the kind of relay and supporting components. And it failed hard. First the relay and power monitoring died, and then the matter/thread bits started failing. I can't even hard reset it at this point.
000
Justin Schuh @justinschuh.com · 29/09/2026
It failed "open" as in "open-circuit," so no power was flowing. That's why the sewage ejector didn't run when it was supposed to.
100
Justin Schuh @justinschuh.com · 29/09/2026
The great irony here is that I added a power-monitoring smart plug to the sewage ejector only because I want to detect if it's failing to run when it should—so I can prevent flooding. And I used the pricier Eve plug because I naively assumed it would be more reliable than a cheap one.
001
Justin Schuh @justinschuh.com · 29/09/2026
The Eve Energy plug died after a week of use—it failed open with a sewage ejector plugged in. Fortunately, it's for a laundry room, so I was just mopping up soapy water. There's zero chance of a refund. It had been sitting unopened since I bought it for $30 a year ago. Maybe Eve will replace it. 🤷‍♂️
200
Justin Schuh @justinschuh.com · 27/09/2026
Interesting read. Though, seems like several constraints added up against e-ink—particularly update frequency. Whereas I want a thermostat that just displays static temperature, humidity, and nothing else when someone isn't actively operating the device. And I'd rather operate it over Matter anyway.
000
Justin Schuh @justinschuh.com · 27/09/2026
Hard no. If you want something cloud backed or have an OpenADR deal with your utility, then sure. But there is literally no reason to require cloud access for basic functional control over the local network.
100
Justin Schuh @justinschuh.com · 27/09/2026
I just want a connected thermostat that's reliable, integrates with my smart home, and fades into the background. But everyone wants to sell me some obnoxious thing with a touchscreen and overwrought industrial design that demands attention and maintenance. It's an endemic problem with modern tech.
240
Justin Schuh @justinschuh.com · 27/09/2026
Thermostats also seem like the perfect candidate for an e-ink display with manual backlight. The thing would sip so little electricity that even without a C-wire you could safely power-steal enough during on-cycles to keep a LiPo charged within its ideal range pretty much indefinitely.
110
Justin Schuh @justinschuh.com · 27/09/2026
It'd just be an esp32-c6, temperature/humidity sensor, and some relays. The ULP core can handle all the schedule and climate logic, only waking the big core for the UI. Hell, if you had a C-wire and wifi connection it could just let the main core run as a background border router.
100
Justin Schuh @justinschuh.com · 27/09/2026
I'm very close to deciding to just build my own ESPHome thread thermostat. I thought matter-over-thread thermostats would be a no-brainer (it's about the only viable wireless protocol for a battery powered smart thermostat). But no one seems to make them for central HVAC systems.
240
Justin Schuh @justinschuh.com · 26/09/2026
It's not that sandboxing is very hard in the abstract, but it does require consistent engineering processes that are hard to maintain in practice. And when I read about what AI companies are doing, I get the impression that robust sandboxing wouldn't really mesh with their engineering cultures.
0161
Justin Schuh @justinschuh.com · 26/09/2026
Coincidentally, my son asked about this knife earlier today. I had these made for the Site Isolation Team, for accelerating the launch due to Spectre/Meltdown. I do kinda miss sandboxing, though. It's security engineering that just really clicked with me, which is probably why I did it for so long.
A Leatherman engraved with a Google Chrome logo, the words "Chrome Site Isolation", and the Spectre vulnerability ghost logo.
190
Justin Schuh @justinschuh.com · 26/09/2026
static.klipy.com
Rerez's Surprised 'Who Knew' Reaction
Alt: Rerez's Surprised 'Who Knew' Reaction
000
Justin Schuh @justinschuh.com · 26/09/2026
To think that we spent over a decade of work on process isolation, privilege reduction, IPC hardening—the herculean effort of site isolation! All together it had to have been at least an engineering millennia of work that went into that thing. Dammit Chris, could we have just written a prompt?
340
Justin Schuh @justinschuh.com · 26/09/2026
Oooooh, that's totally what we should have called it.
020
Justin Schuh @justinschuh.com · 26/09/2026
Speaking as a retired sandbox guy, I'm beginning to question how good these AI companies are at sandboxing. 🤔
3415
Justin Schuh @justinschuh.com · 25/09/2026
A prediction: Jake Tapper stays at CNN and gets elevated to a larger role because he signalled early that he's Bari Weiss friendly. I also think both Rob Bonta and Gavin Newsom will suffer some political fallout, but it's unclear how much that matters.
nbcnews.com
‘We all got played’: Hollywood torn over Paramount settlement with AGs
The deal announced this week resolved the last remaining major obstacle standing in the way of the merger. But it didn’t put an end to the drama in the entertainment industry.
000
Justin Schuh @justinschuh.com · 25/09/2026
Eve's packaging also bugs me. Take smart plugs: The Eve box is 6x the volume of IKEA's. It's the wasteful legacy of the luxury packaging craze that Apple popularized. Relatedly, at 5x the price of IKEA, Eve does have some nice extra features. But IKEA can add all of that in future software updates.
Boxes for an Eve Energy matter over-thread smart plug next to an IKEA Grillplats matter-over-thread smart plug. The Eve box is clearly much larger than the IKEA box, even though the devices pictured on the front are clearly comparable in size.
110
Justin Schuh @justinschuh.com · 25/09/2026
Manufacturers need to learn that capacitive inputs are simply a non-starter whenever you need to operate a device: - Without looking at it (operating by feel) - Exposed to the elements (gloved hands, wet, etc.) - Where it's likely to be brushed against it A wall switch runs afoul of all three.
061
Justin Schuh @justinschuh.com · 25/09/2026
The IKEA Matter devices are great overall, and crazy cheap. You do need to OTA them immediately, because the factory firmware is flaky. And they still have some bugs to work out (e.g. plugs mis-report power use, bulbs drop their labels on restart). Still, I wish they made wall switches and outlets.
010
Justin Schuh @justinschuh.com · 25/09/2026
The Eve Matter switches could be perfect: one big button plus up/down side control for dimmers; every possible state/control; great thread performance. But for some damn reason the main button is capacitive. So many potentially great products get ruined by capacitive inputs where they don't belong.
220
Justin Schuh @justinschuh.com · 25/09/2026
Yeah, I can always use ESPHome or whatever, but my point is that device makers are just dropping the ball when they don't provide these features. It's not like power monitoring, where the hardware is added BOM cost. It's just a very straightforward bit of software that's mostly already stubbed out.
000
Justin Schuh @justinschuh.com · 25/09/2026
There's no good reason why every smart switch/outlet/plug doesn't have a child lock mode and full control of indicator LEDs. It's all software that can be trivially wired up. At least I can emulate the lock in Home Assistant, or pop out the physical buttons and replace them with 3D printed stubs.
130
Justin Schuh @justinschuh.com · 24/09/2026
Every year the kids go back to school and we all spend a few weeks passing around colds. It does at least get better as they get older. The teen and tween do seem less inclined to put random objects in their mouths than they did as toddlers.
220
Justin Schuh @justinschuh.com · 22/09/2026
The funniest part is it requires a special charger, but not for the usual chemistry reasons—after all, it has a built-in battery management system. It's because it takes 5V (normal USB voltage, plus the Li-ion cell is 3.7V anyway) and no standard charger would ever feed 5V to a nominal 1.5V AA cell.
budgetlightforum.com
[Review] XTAR 1.5V AA CLR 4300
They can be found in remote controls, radios, game controllers and watches: devices with AA batteries are everywhere. It is just as common to find leaking batteries or devices that do not work properl...
000
Justin Schuh @justinschuh.com · 22/09/2026
It's wild that it even makes sense to do this. We're using a modern, high-density battery chemistry plus a tiny battery-brain to emulate a weird quirk of a century old chemistry and cell combination that's been a de facto standard for 60+ years. It works. I'm buying them. But it's crazy.
Close up of the XTAR 1.5V AA CLR 4300 2700mAh Rechargeable Li-Ion Battery control board, measuring under 14.5mm in diameter.The XTAR 1.5V AA CLR 4300 2700mAh Rechargeable Li-Ion Battery on its side with the label removed, showing that the entire control electronics package is less than 5mm thick at the very top of the AA cell form factor.
110
Justin Schuh @justinschuh.com · 22/09/2026
Alkaline batteries have a smooth discharge curve that makes it easy to detect a low battery early. That doesn't work for lithium, which has a steep discharge cliff. Now there are rechargeable AA lithium batteries with an integrated MCU-controlled voltage regulator to fake a discharge curve. 🤯
goughlui.com
Review, Teardown: XTAR 1.5V AA CLR 4300 2700mAh Rechargeable Li-Ion Battery
It would seem the market for lithium-ion-based rechargeable 1.5V AA cells is heating up, as Ni-MH rechargeables don’t always provide optimum performance due to their lower voltage and disposa…
171
Justin Schuh @justinschuh.com · 22/09/2026
It's interesting watching my thread mesh self-optimize over time. I have a handful of cheap Onvis T20 smart outlets that were gradually promoted to be my core backbone routers. It makes sense given their location, but there are similarly placed REEDs. I guess the T20s just have better link quality.
000
Justin Schuh @justinschuh.com · 21/09/2026
Hey, whatever gets the job done. 😉 I was just trying to answer the question about managing the wires. The few times I soldered a breadboard I used the style in this pic (note the bus lines on the bottom side). It worked well enough to connect multiple modules without a tangle of jumpers.
Multiple pictures of solderable breadboards showing the top side and the bus lines on the bottom.
100
Justin Schuh @justinschuh.com · 21/09/2026
Ah, nice. A load cell and rfid. You could reduce the tangle with a solderable breadboard: solder on sockets for your modules and solder the jumpers between the bus lines. Still kinda bulky, but much cleaner. Or you do a custom carrier board via PCBWay, etc. (never tried that myself, though).
100
Justin Schuh @justinschuh.com · 21/09/2026
For the ESP32 stuff? If so, I'm currently just using it for a few immediate needs (BT proxies and sensors). Haven't done a custom board yet; just 3D printing enclosures with space for tangles of jumper wires. I am playing with a design for a connected security light, but that's still early.
100
Justin Schuh @justinschuh.com · 21/09/2026
But the worst stuff comes from device maker decisions. Some of it is half assed implementations, like not just telling you in the UI that a newly added device can take 20ish minutes to run updates and stabilize on the mesh. But there's also a lot of vendor dirty tricks to enforce ecosystem lock-in.
010
Justin Schuh @justinschuh.com · 21/09/2026
I wouldn't say it's inherently too complicated to be a consumer technology, but the typical setup experience exposes far more sharp edges than it should. Some of them are gaps in the standard—e.g. border router auto-config should be in the spec and not a proprietary moat used by the big vendors.
110
Justin Schuh @justinschuh.com · 21/09/2026
13. Thread is self- healing/optimizing, but it may recover slowly from big mesh disruptions. If you install or physically relocate multiple FTDs at once you may see devices drop offline. If they don't come back in 20 minutes or so you can typically fix it by power cycling a few nearby FTDs/routers.
100
Justin Schuh @justinschuh.com · 21/09/2026
Fiction is clearly his forte.
010
Justin Schuh @justinschuh.com · 20/09/2026
I've never understood the appeal of Cory Doctorow. Yes, he's a quippy writer/interviewee, and he demonstrates the trappings of expertise. But his arguments always seem to fall apart when you dig even a millimeter deep. And yet he's very popular with so many technical people who should know better.
230
Justin Schuh @justinschuh.com · 19/09/2026
So, it's no different from how LLMs are broadly useful at hunting down bugs and writing code—security vulnerabilities are just a subcategory of "bug" and exploits just are a subcategory of "code". It'd be far more surprising if LLMs were uniquely bad in this area, while being so good at the rest.
000
Justin Schuh @justinschuh.com · 19/09/2026
I co-authored arguably the most popular reference book on finding security vulnerabilities through code review (oddly still in use 20 years later). The way I'd put it is that being good at reading and understanding code is all this really comes down to (for some definition of "understanding").
oreilly.com
110
Justin Schuh @justinschuh.com · 19/09/2026
According to the letters I keep getting for the Anthropic copyright settlement negotiations, TAoSSA was included in their training set. We clearly gave them the tools of our demise while also antagonizing them with our wit. I publicly apologize to our future robot masters for this gross insult.
Snippet from The Art of Software Security Assessment:

4.1 Preface
"If popular culture has taught us anything, it is that someday mankind must face and
destroy the growing robot menace."
Daniel H. Wilson, How to Survive a Robot Uprising
031
Justin Schuh @justinschuh.com · 17/09/2026
The greatest irony is that I filed my taxes that year with Intuit Turbotax, which is the GOP aligned company arguably most responsible for ensuring US tax filing is awful. But of course their EULA is structured such that they have no liability for this particular data processing error.
propublica.org
How the Maker of TurboTax Fought Free, Simple Tax Filing
Intuit, producer of the top-selling tax software, has opposed letting the government do your taxes for free – even though it could save time and headaches for millions of filers.
020
Justin Schuh @justinschuh.com · 17/09/2026
And it's not that the Dems are perfect here, but they do have a history of tax filing reforms/improvements. Biden did IRS Free File, and the people who qualified loved it because it worked like tax filing in the rest of the world. Of course Trump killed it. It's been like that going back decades
131
Justin Schuh @justinschuh.com · 17/09/2026
But the GOP and aligned groups want taxes to be painful and byzantine, because that fits their ideological goal of cutting taxes and creates opportunities for big money that drives the party to avoid paying taxes entirely. It's one of the more pervasive forms of institutionalized corruption.
132
Justin Schuh @justinschuh.com · 17/09/2026
There is no reason for tax filing to be as painful as it is in the US. Financial institutions are required to send the IRS everything they need to process taxes for the vast majority of people. In my case they could have easily identified the error and suspended the refund so I could correct it.
182
Justin Schuh @justinschuh.com · 17/09/2026
Just learned I owe a large bill for underreported taxes from a few years ago due to a data processing error. The part that bothers me is being assessed a penalty when the IRS had this data the whole time and even refunded taxes I'd prepaid to cover the amount owed. Honestly, fuck the GOP.
151
Justin Schuh @justinschuh.com · 15/09/2026
There's Home Assistant and the OSS/OSH platforms that let you copy and paste the TLV everywhere, but that's way too clunky for most people. And once again you need a device specific app on iOS/Android to get their TLV. The big players like connected Thread devices, but they demand to run the show.
000
Justin Schuh @justinschuh.com · 15/09/2026
It certainly would, and could be done for pennies added to the BOM, but I think the real issue is UX. Apple and Google won't join an existing mesh, so the device maker needs to provide an iOS/Android app to import the TLV. That means you need another app and Thread setup confusingly goes after wifi.
110