A Banned Book Library. Inside a Wi-Fi Light Bulb.

On June 15, 2026, security engineer Rick Osgood published a full build-log for a Tasmota-flashed Wi-Fi smart light bulb that hosts a local web server of banned books on an open access point. The Doctorow "Unauthorized Bread" line is now a buildable project. The same device class that the surveillance beat treats as a tracking vector becomes a censorship-resistance vector if you own the firmware. Open source. Reproducible. A hardware-shaped argument against cloud-locked IoT.

State of Surveillance Editorial Team

A close-up of a printed circuit board with an ESP-class microcontroller module, the kind of board that powers the Tasmota-flashed bulb hosting the Banned Book Library
Photo via Unsplash

TL;DR: Rick Osgood (handle rickoooooo) published a complete open-source build-log on June 15, 2026 for the "Banned Book Library": a $20 Tasmota-flashed Wi-Fi smart light bulb that runs an open access point and a local web server of banned books, served from a captive portal that any Wi-Fi device in range can read.[1][2] The firmware is open source on Codeberg.[3] The hardware is an off-the-shelf ESP32C3 bulb with a Tasmota pre-flash and a 4MB flash that Osgood repartitioned from the default 320KB of file-system space to 2MB. The author cites Cory Doctorow's Unauthorized Bread and Ben Brown's Library as the direct inspiration. The build is the same device class the morning cycle treated as a surveillance vector. Inverted, with the firmware under your control, it is a censorship-resistance vector you can hand to a friend.

What He Built

The build is a Wi-Fi light bulb. The bulb runs an open access point. The access point serves a captive portal. The captive portal is a web page that lists banned books. Anyone who connects to the bulb's Wi-Fi network sees the page. The page lists each book with its title, author, and the reason it was challenged or banned. The books themselves are downloadable. The bulb looks like a bulb. The books travel by Wi-Fi signal.[1]

Osgood described the threat model plainly. "If you lived somewhere that banned books you thought were important, you could theoretically stick a digital copy of the book on one of these light bulbs. Then you could go install it somewhere in your community. As long as the light bulb is switched on, then anyone in the vicinity can still access the banned material assuming they have an electronic device with Wi-Fi."[1]

The hardware is not exotic. The bulb is an ESP32C3-based Wi-Fi smart bulb that ships with Tasmota pre-flashed, sold for around $20 on AliExpress.[1] Tasmota is the open-source firmware that exists for exactly this reason: to give users local control over smart devices that would otherwise rely on the manufacturer's cloud service, a cloud that changes over time and sometimes disappears entirely, leaving the device unusable.[4] The whole project starts from a Tasmota install, then replaces Tasmota's own firmware with a custom build that serves the books.

It is a dead drop that fits in a light socket. Osgood called it a "cyberpunk digital dead drop." The HN thread picked the framing up. "Fahrenheit 451 anyone?" the top comment asked.[2]

The Build, In One Sitting

Osgood's first two ID uploads of the firmware to the bulb failed for unstated reasons. The third worked. The build, summarized from his write-up:

  1. Buy a Tasmota-pre-flashed ESP32C3 Wi-Fi bulb. The 4MB flash chip and exposed GPIO pins (R on GPIO6, G on GPIO7, B on GPIO5, CW on GPIO3, WW on GPIO4) are the pre-conditions for the rest of the project.[1]
  2. Replace Tasmota with a custom Arduino + ESP-IDF build. The custom firmware uses "Arduino as a Component" inside ESP-IDF, which gives Osgood the Arduino niceties (AsyncWebServer, ElegantOTA) plus direct control over the IDF-level configuration that Arduino hides by default.[1]
  3. Repartition the flash from 320KB to 2MB for LittleFS. The default Tasmota partition table leaves 320KB for the spiffs/LittleFS filesystem. Osgood edited the partition table (with the required MD5-checksum update) to grow the filesystem partition to 2MB. The edit is dangerous: a corrupted partition table bricks the device, recoverable only via serial programming. He did it anyway. "This is not ideal, but the whole project is a hack so I guess what the hell?"[1]
  4. Implement a captive portal. The bulb's DNS server responds to every request with its own IP. Specific platform captive-portal probes (Android's /generate_204, Apple's /hotspot-detect.html, Windows's /connecttest.txt and /ncsi.txt, Firefox's /canonical.html) all redirect to the library page. Anyone who connects gets the books.[1]
  5. Replace Tasmota's safeboot partition with a custom one. This was the OPSEC fix. Tasmota's safeboot reads the Wi-Fi SSID and password from the nvs partition in plaintext, which would leave anyone's home network credentials in the bulb's flash the moment a dead drop is installed. Osgood wrote his own minimal safeboot firmware from a GitHub example and disabled Wi-Fi config in NVS. The credentials no longer persist.[1]
  6. Add an admin panel for color matching. The admin page lets the deployer set the LED color and color temperature so the bulb visually matches whatever was in the socket before. Match the wall sconce, and the dead drop looks like the wall sconce.[1]
  7. Publish the firmware, the partition tables, the build script, and the LittleFS web app on Codeberg. The build script (build.sh) automates the "Arduino as a Component" setup and the library cloning that the project requires.[3]

The whole write-up is on his blog.[1] The HN thread surfaced the parallel to PirateBox, the same idea in 2012: a flashed Wi-Fi access point that served a local forum and file host on open Wi-Fi. PirateBox's website is dead, but the lineage is direct.[2]

Why the Surveillance Beat Should Care

The smart-device surveillance story of the last few years has been a steady drumbeat of "the device is watching you." Smart TVs report what is on the screen back to the manufacturer. Smart speakers ship with always-on microphones. Smart bulbs ping a cloud service the moment they are powered, and the cloud service knows the room's power-on schedule. The light bulb, the speaker, the TV: every one of them is a sensor that someone else controls.

The Banned Book Library is the same hardware running different firmware. The surveillance story is a story about who controls the device. The censorship-resistance story is the same story, told from the other side of the same line.

Osgood's choice of Tasmota was not arbitrary. Tasmota's reason for existing is the cloud-disappearance problem. The smart bulb you bought three years ago is now a brick because the manufacturer shut down the cloud service it depended on. Tasmota gives you local control. Once the device is locally controlled, the cloud can disappear, the manufacturer can disappear, and the device still works. That is the same property a censorship-resistance dead drop needs: no third party in the loop, no third party who can be leaned on to take the device down.[4]

He cited Cory Doctorow's Unauthorized Bread by name. The novella is set in a near-future California where jailbroken IoT appliances are the only escape from a sealed, app-store-mediated economy. The heroine reflashes her toaster, her dishwasher, her whole apartment, and the act of owning the firmware on her own hardware is the act of staying free. Osgood's build is that thesis in hardware, for $20, with a captive portal.[5]

He also cited Ben Brown's Library, a short story about a community that maintains a digital archive of creative works, owner's manuals, and 3D models, "things that others might find useful or interesting that you wouldn't want to lose should they be somehow wiped from the Internet."[6] The story is the design constraint: pick the books that matter, host them on a device that looks like nothing, leave the device where the books are needed.

The Detection Problem (and the Practical Limits of Detection)

An HN commenter with enterprise Wi-Fi experience pointed out the obvious countermeasure. "Just walk around with a Wi-Fi analyzer on your phone, playing hotter/colder until you find it. Modern enterprise access points even have built-in functionality to physically locate devices, and automatic warnings for rogue access points."[2] Another countered: "I think it's extremely unlikely to be suspicious of a light bulb. Especially if it doesn't seem out of place, like if it's on a light socket why think that it's a Wi-Fi access point?"[2]

A third suggested a "clamp" upgrade: a battery-backed device where the bulb still appears to operate from external power, so the Wi-Fi stays up even when the switch is off.[2] A fourth pointed to Wi-Fi Pineapple, the existing penetration-testing hardware that already does captive-portal redirection. The Pineapple is a known quantity. A light bulb is not.[2]

Osgood addressed the size limit directly in his closing notes. "The few epub books I looked at were around 350KB each. So the light bulb can host a few of these. I had originally imagined a web server with tons of banned books available." He reframed the limit as a feature. "Each dead drop will be representative of the person who created it. They have to pick and choose specific books that are important to them or that they feel are important for others to have access too. I like that idea."[1] The size constraint becomes the curation constraint becomes the human-stakes constraint.

What This Means for the Surveillance Beat

The smart-device surveillance beat has been a story about consumers losing control of their hardware. The Tasmota project, the right-to-repair movement, the Doctorow Unauthorized Bread line, and now the Banned Book Library are the same story told from the consumer's side: the people who own the device own the firmware, and owning the firmware is the prerequisite for owning the device.

The censorship-resistance application is the one that headlines. The day-to-day application is the smaller one. A bulb that survives its manufacturer going out of business is a bulb that does not become e-waste. A bulb you can reflash is a bulb you can repurpose when the cloud service you no longer want to support disappears. The same line of code that hosts a banned-book library is the line of code that turns a $20 smart bulb into a 20-year appliance. The privacy and the sustainability are the same fix.

Three steps for anyone who wants to make the Banned Book Library, or a less ambitious local-control IoT project of their own:

  • Start with Tasmota. A $20 ESP32C3 Wi-Fi bulb, pre-flashed, removes the soldering iron from the equation. Tasmota's own firmware is enough for most local-control needs (Home Assistant, MQTT, no cloud).[4]
  • Read the limitedresults Tuya teardown before you flash anything else. The Tuya platform is the backend for a large fraction of the cheap smart-bulb market. The teardown is the canonical reference for the firmware on the bulb, the cloud-service handoff, and the over-the-air update path.[7]
  • Branch from Osgood's Codeberg repo if you want the full build. The build script handles the "Arduino as a Component" + ESP-IDF setup, the partition tables are pre-edited, and the captive-portal code is ready to adapt.[3]

The smart-device surveillance story and the Banned Book Library story are the same story, told from opposite sides of the firmware line. The line is yours to draw. Osgood drew it on a light bulb.

References

  1. Rick Osgood: Banned Book Library (June 15, 2026)
  2. Hacker News: Banned Book Library in a Wi-Fi Smart Light Bulb (338 points, 172 comments, June 15, 2026)
  3. Codeberg: rickoooooo/BannedBookLibrary (open-source firmware and build)
  4. Tasmota Documentation: Open Source Smart Home Firmware (tasmota.github.io/docs/)
  5. Cory Doctorow: Unauthorized Bread (Ars Technica serialization, January 2020)
  6. Ben Brown: Library (short story, benbrown.com)
  7. limitedresults: Pwn the Tuya Lightbulbs (Tuya platform teardown and security analysis)