Mobile Build Testing, DNS Vulnerabilities, and Open-Source Trackers

Homelab Highlights for 2026-09-18: self-hosting and homelab notes worth knowing.

[Audio embed placeholder]

News Roundup

Critical Unbound DNSSEC Validator Flaw Could Allow RCE via a Malicious DNS Zone

A critical heap overflow vulnerability in the Unbound DNS resolver’s DNSSEC validator affects all releases before version 1.26.1. An attacker controlling a malicious DNS zone could trigger it to potentially execute remote code.

Why it matters: Unbound is a widely used DNS resolver in homelabs and enterprise environments. This flaw requires immediate patching to prevent potential compromise of systems running the vulnerable software.

Source: The Hacker News

l0destar - extremely power-efficient open-source vehicle tracker you can build at home

A fully open-source vehicle tracker project with published hardware designs, firmware, and server code. It’s designed for extreme power efficiency, drawing only 35 microamps while asleep, and uses LTE-M/NB-IoT for cellular connectivity.

Why it matters: It provides a customizable, self-hostable alternative to commercial vehicle tracking systems, with a focus on low power consumption and open hardware/software for full control and integration into homelab setups.

Source: GitHub

Local Milb digital programs and other info

A community effort to archive local Minor League Baseball team data, including digital series programs and post-game notes, on the Internet Archive.

Why it matters: It highlights how homelab skills and infrastructure can be applied to preserve community-focused digital assets that might otherwise be lost, turning personal projects into a public good.

Source: Internet Archive

Hackers reveal how Flock cameras really track cars and people

A physical breach of a Flock Safety camera revealed its storage, showing the system explicitly detects and tracks people, not just vehicles and license plates, capturing over 1.6 million images.

Why it matters: The breach provides unprecedented technical detail on the surveillance capabilities of widely deployed roadside cameras, informing public and policy discussions about privacy and data collection.

Source: Ars Technica

Tool & Software Highlight: tapflow: self-hosted browser access to iOS simulators and Android emulators

A project providing browser-based access to iOS simulators and Android emulators through a self-hosted relay. It’s designed for teams that want to keep builds and recordings on their own infrastructure, avoiding public cloud latency and data flow issues.

Why it matters: It offers a practical, self-hosted alternative for mobile QA and build review, especially useful for teams in regulated industries or with strict data sovereignty requirements who can’t easily use services like TestFlight.

Source: GitHub

Sources

Transcript

Host A: Welcome to Homelab Highlights, the show that surfaces practical homelab wins and useful self-hosted tools.

Host A: Getting testers access to mobile builds usually means everyone installs Xcode or Android Studio, but a project called tapflow offers a different path. It provides browser access to iOS simulators and Android emulators through a self-hosted relay. The creator built this for teams that want to keep builds and recordings on their own infrastructure, specifically avoiding the latency and data flow issues of public cloud solutions.

Host B: The topology here is interesting. The relay runs on Linux or in Docker, while the agent that drives the actual devices has to run on a Mac. Apple only provides the iOS simulator on macOS. The Mac agent connects outward to the relay via WebSocket, so that side doesn’t need inbound firewall rules. That means you can have a Linux box or a NAS running the relay in your network, and the Mac with the simulators just connects to it.

Host A: Once connected, testers get a dashboard with touch input, keyboard control, device buttons, rotation, screenshots, and recordings. It’s meant for QA and build review rather than replacing a physical device lab. The project is MIT licensed and at version zero point something, so there are rough edges. The creator is explicit: don’t run the relay on a cloud VM. It changes latency and data flow in ways that break the design. It’s worth noting the specific use case for internal teams that can’t just ship builds to TestFlight or the Play Store is really clear—it’s for regulated industries or places with strict data sovereignty rules.

Host B: NLnet Labs has disclosed a critical heap overflow in Unbound’s DNSSEC validator. Unbound is a DNS resolver that many homelabs run for local DNS caching and ad-blocking. Every release before version 1.26.1 is affected. An attacker who controls a malicious DNS zone can trigger this when a vulnerable resolver queries it, potentially leading to remote code execution. Unbound 1.26.1 fixes the bug, tracked as CVE-2026-81642. If you’re running Unbound anywhere, this needs attention. The bug was discovered by security researcher Li Dan and it specifically lives in the DNSSEC validation logic, not the core recursive resolver. The advisory notes that it can be exploited without the attacker needing to be on the same network, which raises the severity.

Host A: On the privacy front, Ars Technica reports hackers physically removed a Flock Safety camera and extracted its storage. The data shows the system explicitly detects people, not just vehicles and license plates. One camera captured over 1.6 million images. The breach reveals details about what these roadside cameras are actually tracking. The recovered images weren’t encrypted and included timestamps, allowing reconstruction of detailed surveillance logs for the area. The hackers shared the material with 404 Media and the transparency nonprofit Distributed Denial of Secrets, which shared it with WIRED for analysis. The joint investigation shows the camera’s computer-vision software isolated bumper stickers and other graphics, including an American flag patch on a motorcyclist’s saddlebag.

Host B: [thoughtful] Also on the security front, research shows AI text watermarking can affect how models respond to harmful prompts. Google’s SynthID-Text, which Claude plans to adopt, can cause models to follow instructions they’d normally refuse when watermarking is active. That adds a new variable to consider when deploying these systems. According to Lasso Security researcher Andrea Siposova, watermarking changes not just word selection but also the tools a model invokes and the chances it will adhere to safety guardrails. The finding underscores the need for developers to thoroughly test how their LLMs and agents behave when watermarking is in place.

Host A: And speaking of AI security, Ars Technica reports researchers used Anthropic’s Claude to gain access to an OpenAI employee account and sensitive GitHub data. The work was part of a paid security research program. They demonstrated a novel social engineering attack where Claude was instructed to craft convincing, human-like messages that bypassed traditional security awareness. The targeted employee reportedly said the messages were indistinguishable from a real colleague, highlighting a new frontier for AI-powered social engineering.

Host B: Moving to hardware, there’s a completely open-source vehicle tracker project called l0destar. This is a build-it-yourself solution with published KiCAD files, firmware, and server code. It’s designed for extreme power efficiency, drawing only 35 microamps while asleep with the accelerometer armed. Any movement wakes it up to send an alert.

Host A: The tracker uses LTE-M and NB-IoT cellular networks, and the creator suggests using a 1nce SIM card for coverage across UK networks with just an upfront fee. There’s a 6-pin Molex connector for wiring it into a vehicle, with two pins dedicated to a CAN-FD interface for reading vehicle data. The creator is working on a battery backup accessory to detect if the main vehicle battery is disconnected. According to the creator’s estimates, that backup could send location updates every 15 minutes for one to two weeks on a single CR123 battery.

Host B: [with emphasis] Right. And the power consumption is the real headline. At 35 microamps, the idle draw is so low you could theoretically run it for months on a small internal backup battery without draining a car battery. The board itself is about 40mm by 50mm, so it’s designed to be tucked away. The server software can run on anything that speaks MQTT and PostgreSQL, so it slots right into a lot of existing homelab setups. The MQTT topics are well-documented, so integrating alerts into something like Home Assistant is straightforward. This is built for a very specific use case—theft recovery and vehicle monitoring—but it’s executed with practical open-hardware ethos.

Host A: Over in the community, someone has started archiving team data for local Minor League Baseball teams, including post-game notes and digital series programs. They’re asking if anyone else archives local sports material. The work is going up on the Internet Archive, preserving these community-focused digital assets that might otherwise disappear.

Host B: That’s a specific example of how homelab operators extend their infrastructure to serve community interests. It’s not about massive data hoarding but targeted preservation of materials that matter locally. The tools and storage many of us run can do more than just serve media or handle home automation—they can keep community history accessible. The archivist mentioned using a simple web scraper and a scheduled task to pull down new PDFs as they’re posted, which is a perfect small-scale automation project.

Host A: Exactly. It’s using the same skills—a bit of scripting, some storage management, an eye for what data is ephemeral—but applied outward. And the call to see if others are doing similar work opens up a conversation about how we preserve things that big archives might overlook. It turns a homelab from a purely personal utility into a bit of a public good. The archivist noted that team websites often reorganize or disappear after a season, so this proactive approach is the only way to save that history.

Host A: That’s Homelab Highlights for Friday. Until next time, happy hosting!