So, before I get started, I just want to say, big thank you to Marcha, to the organizers,
to all the Boston people, to all of you wonderful people, let's give it up.
So, I am dead program, some people call me Ron, a couple of humans call me dad, but that's
not important right now.
I am a technologist for hire, that means you can cross my palm with fiat currency and
I will produce code.
I have a small consultant called the hybrid group, where we create the software that makes
your hard way of work, and we do work on a couple of open source projects, such
as Tiny Go, which you may have heard of.
So, at Boston, 2021, was my first go without wires talk, then, at Boston, 22, go further
without wires, Boston, 23, go even further without wires, Boston, 2024, go without wires,
strike, back, and that brings us to Boston, 2025, where we return to go without wires.
And by this, of course, I mean Bluetooth, naturally, we start where we begin, so go Bluetooth
as a package, that's part of the Tiny Go continuum, if you will, and it provides Bluetooth
capabilities for go programmers, quick version of how Bluetooth works, so we have Bluetooth
peripherals, which are devices like a heart rate monitor, watering system, for your home,
an air tag, and they advertise.
Then, we've got centrals, centrals are things that your notebook computer, a tablet, your
mobile phone, they scan, okay, that's all you need to know about Bluetooth for today.
Hello advertising, so for this, I'm going to show a Raspberry Pi Pico W, which is a small
microcontroller from Raspberry Pi, it's an RP-2040, that is a single-core RM Cortex M0 plus,
and it's got built-in and in finnion, CYW43439, separate co-processors for wireless communication.
Let's take a quick look at the hardware, but first, let's run, let's see, make show video.
Well, it works, looking good, so far, all right, so let's take a look at the hardware,
and it's here somewhere, oh, there's a hanging off of something, oh yeah, here it is.
So this is the RP-2040W, we can see that's the microcontroller, and that's the separate Wi-Fi
Bluetooth co-processor, okay, so far so good, so advertising code, well, when we're
advertising in tiny go, we use the tiny go Bluetooth package, so it's your basic, this code
is going to run on the microcontroller, but it looks very much like any of the regular
gardens are either go code that you may have ever used before in your life, we've got a package,
main, we import the time package, we import the tiny go Bluetooth package, we say Bluetooth
dot default adapter, since most devices only have a single Bluetooth adapter, and then
our main function, first we enable the adapter, we get the default advertisements, which
is the main advertisement, and then we configure it to say we're going to have an
advertising type that we cannot connect to, and it's just going to advertise this local
name of blue go Bluetooth, then we start that, it starts advertising, and it runs, all
right, so let's see the code, will it work, famous last words, so make advertising, so
we're going to flash that onto the tiny go processor, with the RP24DW, it's going to
put it on there, and we see it's actually a fairly large program in tiny go terms,
reasons that it actually has to flash the entire binary blob that's needed to get
that in finnion code processor to work, it's actually some closed source, which we normally
don't like, but what can we do about it, so now it's advertising, all right, so far
so good, let's just leave it working, first demo complete, all right, good to have this
applause is fine, or not, all right, so now we've seen the advertiser theoretically working,
what about the scanner, so the scanner code is very similar, we're going to use the go
Bluetooth package, here we go, so again package main, the Bluetooth package, the default
adapter, we enable it, this time we're going to start scanning, and when we scan, whenever
we find a device, we're just going to print out that information, all right, and so for
this I'm going to just run it on my own machine, so if I make scanner, and you see there's
a lot of Bluetooth devices, but one of them that's showing up, it says go HRS, because
this is Linux, and Blue Z does not want to acknowledge my new name, if to get that's
work I have to restart, but that's the same actual device, all right, so scanning, all
right, so we have the basic idea here, we have scanning, advertising, and we have scanning,
so the first thing you need to know about personal computers, according to Apple, is
naturally it's all about advertising, but you do this, I mean actually advertising is all
you need, if what you want to do is make beaconless, so advertising data is only 31 bytes
in size, 31 entire bytes, and the way it works is there's some standard advertising data
formats, they just sort of pack them in one right after another within this 31 byte packet,
and that's all you get, nothing else, there is nothing else in an advertising packet,
so when we have your basic, the simplest advertising data are the flags, those flags
basically communicate, can you scan and can you connect to this device, so the advertising
type of the flag is one, and the data is also one meaning that we can scan, so it's three
bytes, first one is the length, which is two bytes, not including the length byte, the
flags, and then the data of the flags themselves, all right, so now the local name that we
saw before, it's very similar, we have the length, which is the length of the string,
the type, which is 0 and 9, meaning the complete name, and then the actual data, so
when we want to pack these things in together into that 31 byte packet, we have to put
them one right after another, so first the flags, and then the local name, and then padding
if we don't have 31 bytes more, because it's never, you know, it could only be 31,
stop me if you heard this one, all right, so service data is the other type of advertising
data, which basically refers to specific kinds of services, and one of the ones that's
really popular is BT home, anyone here of BT home, anyone here ever heard of home assistant?
Yes, so you can make devices that use the open source BT home protocol so that you could
do cool things with your home automation and it could be completely open source, so I have
a package that I created called go BT home, which gives you some wrappers around this,
and this talk was going to be about that, but it's not, because there's this other thing
called manufacturer data, manufacturer data is the data that actually is only for one particular
manufacturer, it's sort of the closed source of the openness of Bluetooth, and there's
this company called Apple that you may have heard of, that makes this little thing called
the air tad that you also may have heard of, how interesting, so the manufacturer data for
the find my protocol has been sort of a deep black box for quite a while, the manufacturing
data for bytes, the type FF, meaning manufacturing data, X4C00, which is the Apple identifier,
actually that's in the little Indian order, and then manufacturing data of some mysterious
kind, well, closer as ten's not to stay that way, isn't that true, my dear friends, isn't
that true, well luckily there's some geniuses over CMU labs, which is the secure mobile networking
computer lab of the technical university of dumps not Germany, and they created this
amazing project called open haystack that you may have heard of a couple of years ago,
they reverse engineered the entire Apple find my protocol, and there was actually a really
cool talk recently at CCC, where they went all into this, unfortunately I was not there
because it's holiday time in Spain, I can't go anywhere except stay home and feed 28 people
at my house. So, how am I firing my works, because you may be wondering, wait, Apple,
and they like supposedly privacy friendly, and like they're loving everybody track everyone
else's devices, well basically when you want to find my iPhone, you pair through that
initial setup, and you create some keys, a private key and a public key, and then this
public key is being broadcast by your device so that everybody else's iPhone is picking
up the public key, and then using that public key encrypting enough loading that they
either to Apple, all right? Now quick refresher in how public key encryption works, so we
if Bob wants the send a message to Alice, if Bob has Alice's public key, that message
can be encrypted, and nobody else can decrypt it except for Alice, right? So all I need is the
public key, and I can encrypt a message that no one else can decrypt, even me is the sender,
all right? And this is how Apple is doing it, where Apple doesn't actually know, Apple knows
where your phone is, but Apple doesn't know that your phone is actually tracking their phone.
So it uses the NISTP244 curve, which is a 28 byte public key, it's pretty secure. It's only
been broken by the NSA in a couple of other organizations, but I don't know what I'm talking
about. So luckily, seemingly labs have reverse engineered the entire find my protocol,
so we have manufactured data from Apple. It's got the find my type, the payload length,
the status, which could mean like battery fully charged, or battery almost out, and then
the last 22 bytes of the advertising key. All right, but wait a minute, didn't I say that the key
is 28 bytes, and didn't I say there's a maximum limit of 31 bytes, and what where's the bytes,
man? You trying to short me the bytes? No, no, no, they're very clever, and they put those bytes
in the public key. So I got it into all of this, because I just wanted to make some trackers.
So I have these flight cases, one of them's over here, that I take all around the world, and my question
is always where is my year? Like I only have 24 more hours, and I'm supposed to do something,
and I'm just not that cool without hardware. And I'm cool, but not that cool. So I was going
my way to go for the consingapore a couple of weeks ago, and I thought I really, really want to
track my cases. What to do? So I discovered the open haystack and some other projects, and
naturally turns into an entire project. I couldn't just make trackers, I mean, I don't want to
hear else have that problem. You start just like a little weekend thing, and it just takes over
your whole life. This happens. So it's called Go Haystack. This is the URL, and it is Go Rappers
around all of this stuff that's been done by a lot of other brilliant people. Here's a quick look
at the Go Haystack architecture. So Go Haystack has a command line interface to help us generate
those public and private keys. And then we're using two Docker containers that are created by the
open haystack community. One is called Maclas Haystack. There's one thing about the C-moo labs is
you actually have to have Apple hardware, and I actually have no Apple hardware whatsoever. No Apple
hardware was used at any of this. Somebody wants to donate some, I'll take it, don't get me wrong.
So that is talking to a thing called the NSET server. NSET is a side loading project from some
geniuses who figured out how to side load apps onto iPhone, kind of a dev team, but some different
but similar. And so we put our public key on the beacon. It starts broadcasting the advertising data
and now we're going to use other people's iPhones in order to track this beacon that I made myself
by using Apple's public aid or private rather APIs. Nothing public about Apple and close source.
All right. So the Haystack keys to do this, we're going to actually generate the keys.
So we'll take a look at the command line interface here. So we're doing some cryptography stuff
by generating the key using the elliptic P224. We extract the private key bytes. We make sure it's
the correct length. Then we take that and we put it in day 64 encoding. That way we can out
put it to our file. One thing that's worth noting is we have to make sure there's no forward
slash because we're going to export this to a JSON file. And if we have some data that's got a forward
slash in there, it's going to think it's escaped. Invalid key wears my bad, man. All right.
So let's flash some code. We'll at work. All right. So we say Haystack and keys. And let's call it
it. All right. So now if I say, oops, if I say cats, oops, if I can type,
fast them. keys, there's the private key, public key, and the hash version of the key I just
generated. Obviously, this is now in the public internet. So I'm not planning on using this for anything
secure. I guess it's a little late for that. Here's the JSON file that's being generated because
this is the JSON file that we're going to use to upload to the Apple infrastructure so that we
can actually figure out where it's the device. So we generated the key so far so good. All right.
Now, a lot of this is using the find my package. Naturally, I wanted to do all of this and go
and since most of the code that's out there is written in Python, some of it is sort of random
Python's JavaScript, some, I don't know, some Swift, like it's kind of a pot peri of different codes.
So this is a very simple sum package that's part of GoHaseTac where we basically, all the stuff
I was showing you with the advertising data is all in there. So we can parse the data, which we're
going to use if we want to look to see is my device around me and then we can create this data
in order to then flash it onto the device because we have to put it on the hardware, right, or
else it's not going to work. So the firmware that we're going to run is going to run on initially
on an RP-2040W, which is that same little board that I used initially? That was supposed to be the
board. Let's take a look at the firmware code. So this is, now this will run on any one of the
tiny Go boards that has Bluetooth support. So it will work on an RP-2040W. It will work on
any of the boards from A to Fruits or from PyMoroni that have a built in U-Blocks hardware,
host controller interface. It will work on the north, except you conduct the boards. So it will work on
any of these. And basically this is what's running on the hardware itself and very similar to what we saw
before, right? We're going to get the key data and then we're going to advertise it. An advertisement
that cannot actually be connected to, it's just because we're not supposed to connect to some
of these missing phones. It won't let us, right? We're going to, it got the nice long interval,
and then we're going to put into that the manufacturing data that we created using that find my package.
All right? We enable it. We set a random address, random address meaning it's not the built in
that address of your Bluetooth. And here's the missing bytes of the key, right? The six bytes
that we were talking about earlier, like where are those bytes? Those bytes are actually part
the address contains the first bytes and the advertising data contains the rest. Boy,
my glad those German researchers figured this out. And so basically that's what we're looking at.
All right, let's flash the tracker. So now if I use the haystack command, and I say flash,
and let's see, is it the key? I believe it's the, what do they call it? Boston? And then
I guess we're going to put it on a pico w. And it should flash it onto this board if the demo
gods are kind, thinking, thinking, thinking hard. All right, the code is on there. That was it.
All right, how do you know it worked to program? How do we know it really worked? Come on,
how do we know it works? Well, let's scan. So the haystack has a scan command. So it's very similar
to the, well, what happened there? I know a time space continuum. This dimension is so confusing.
Whoops. Yeah, there we go. Haystack scan. How much you want the bet that I have multiple tabs
open? Yep, sure enough. It's probably did not actually put in the, but it looks exactly like the code
we saw before, right? Let's see. Go, haystack scan. It's under command. 11 minutes, we're fine.
We can do this. Grace, under pressure. Scan, oh yes. So we scan for others, meaning one thing about
Apple is they don't actually like doing normal Bluetooth stuff. They don't actually use a MAC address.
They use a magical Bluetooth ID that they made up themselves, and that the ID is different on
every single MAC computer for every single Bluetooth device. I guess they think security through
obscurity is a good thing and you can tell that's working out for them, right? So basically the scan
here is the same as the scan before, but we're going to look for manufacturing data that is from Apple
and then based on that, we're going to parse the data and display it. All right, let's see if this
actually works. So if I say haystack scan, it's scanning all of the devices that are find my
devices in this room. And the one that says full, I think the FD1 is actually the device I just flashed.
This way we can actually find our own stuff and a bunch of other people's.
So tiny scan is a scanner because I'm on the road. I've got this gigantic, you know,
and video equipped, where the brick is heavier than the computer. Also, fun fact, I can't
charge this on an airplane that uses all the power in the row. People are like, this is not working
and I'm like, you know, for me neither. So for this, I'm going to use a prime erroney
badge of 2040W because very, I'm in an airport and, you know, some mysterious country and I want to know
is my stuff around. It's actually working. So I have a conference badge similar to the one I'm
wearing here that I'm going to use for scanning. So let's take a look at this tiny scan code.
Yeah, see that link worked. And so if we take a look at tiny scan, it looks very similar to what we
saw before in Daniel's demo, right? We're using the tiny terminal, which is part of the tiny
go set of packages that lets us do terminal emulation. We're going to end it that and then we're
going to do the scanning and when we see the scanning, we're going to display that information
in the terminal. If we find the unregistered device, we'll display that. If we find our device
or any other devices, we'll display that. All right, let's see that actually work.
Flash, tiny scan. Let's look at the hardware though real quick.
And oh, I stopped the video. That makes it not work.
For this, by the way, I'm showing all of this video is running through web assembly. If you want
to find out about that, come to my talk in the web assembly room tomorrow.
All right, so this is the badge and we can see it here. I'm not going to flash it just because
we're running long time, so I'm just going to take an unplug the one device and plug in the other.
This will totally work, right? It just needs power. And I don't have any batteries.
They use them all up with our table today. All right, so now here it's booting up. And we can see
it's looking for devices starting a scan. We'll find any. It should. It's quite a few of them
around here. One in doubt reboot. I know I've got actual scanable scan and things here.
The video got bored. All right, while we wait for that,
so there I was packing for go for consing a poor. I put this thing on the internet. Next
you know, it's on hacker news, like top three links for like two days. So, I mean, all of my ideas,
I thought were important and I worked on so much and this little thing I did is something on hacker news.
I'm not why should I complain, right? So at this point, I'm like, all right, I've been to finish
that all the stuff I'm supposed to do for this upcoming conference. So I finished the go for tags.
I guess I should show you the go for tags. So the go for tags are my my custom air tags that I made.
This is, this is the one that goes in flight case one and I took apart the other, the second one,
so you can sort of see it because that's what actually goes inside of this 3d point printed
flexi item. This is a Nordic semiconductor NRF 528040, which, hello, we're not done. So this is an
NRF 528040 that I plugged into regular batteries because please do not check lithium batteries
in your check log to John any plane I am on. Thank you. So I have the tracking also to the
go for bots. You may have seen the go for bots here. The go for bots are have an NRF 528040 as part
of their controls because, you know, I mean when you're one of the go for bots, you need to know
where the other team members are, right? So I had to find my go for bot capabilities. Then I flew
to Singapore and it actually worked. I mean this is the first time I had a chance to test this.
So here is a screenshot of me leaving Spain taking the train the Madrid flying to Doha.
Then flying to Singapore. This is my route. If you ever follow me on social media, this is my
cipher. It means I took a train from Oviedo the Madrid and flew to Doha on Singapore.
So then we went around Singapore. The hosts were really amazing. It kept working.
Here this is the gray go for bot going between my hotel and the conference venue.
I don't know what I was. Then I flew back and even worked in mid flight.
So you might notice these little dots here in the middle of the ocean. So this is people
are connected with their iPhones to the in flight internet and within range of my cases,
which are down in the hole by the way, this is my check luggage. So we're 10,000 meters,
which is 36,000 feet for people who use the imperial system. And we're in the middle of the ocean.
And it's actually working. So I figured this was the only way I could top a balloon floating
over the land is actually showing it working at 10,000 meters. Incredible.
So let's take a look at some of it. Let's see if it actually is working. This is really brave,
but with a hay. So this is like case one at my hotel. Let's take a look at the history.
This is the web interface that's provided this part of Mclean's hay snack.
And yeah, you can see here I am leaving Spain flying to Doha. I don't know what that is.
I was asleep on the flight. I wasn't down asleep. I mean, I don't think.
I assume that somebody who's using one of those hinky sim cards that like, you know,
free data forever kind of thing, but it's on another planet.
All right. So what's next? We go haystack. So a key rotation,
not the way you can rotate the keys, the same way that actual air tides do. Support for Google
find my device because supposedly it works. Haven't tried it. I have an Android phone, but I haven't tried it.
More features for kong skin like solid detection, that way you know if they're following you.
Right? And then a surgery go to replace Mclean's haystack because that way we can just be
go all the way. And because that project is not as well maintained like no one's done anything
on it for six months. So connect all the things using go even at 10,000 meters as you cross
plan it earth without wires. Time to go down the org. Thank you.
I could not figure a way to fly a drone at 10,000 meters height in this room. So I'm sorry
if you were expecting an actual life. If you want to see a drone come to my talk tomorrow.
Wrong. I think we have one way to go for next year. We will launch a satellite using time to go.
Please do not tell anyone my talk topic for next year.
People, if you have a lightning storm that was accepted. So you got a message by me. Come to the
front and sit right.