A banned book library hidden inside a Wi-Fi smart light bulb

A Wi-Fi smart light bulb that broadcasts an open network and serves banned books to anyone nearby: that is the Banned Book Library, a hardware project published this week by Rick Osgood. He describes it as a "cyberpunk digital dead drop" — a cheap device that looks like an ordinary bulb but hosts a small web server loaded with books restricted somewhere.

The idea came after reading Ben Brown's short story "Library", in which characters maintain a digital archive of creative works, owners' manuals and 3D models,. The bulbs are inexpensive and hard to notice, which makes leaving them around town affordable.

Tasmota, ESP32 and a destructive teardown

Osgood raised the idea with his local DEFCON meetup, where someone with home-automation experience pointed him to Tasmota, an open-source firmware that untethers smart devices from cloud services and gives local control. He found a vendor selling bulbs with Tasmota pre-installed: an ESP32C3 chip with 4 MB of flash.

Opening the first bulb revealed a motherboard held in place by a rubbery potting compound. Digging it out was a huge pain and effectively destroys the device, so the plan to solder on a microSD reader was dropped — the project was meant to need minimal tools. He soldered serial programming wires instead, dumped the original firmware with esptool, and then abandoned modifying Tasmota as too complex and feature-heavy, writing his own firmware with Arduino instead.

The storage problem: 320 KB for books

With 4 MB of flash in total, space is scarce. Reading the partition table showed that only the SPIFFS partition — 320 KB — was available for files, roughly one ebook. Osgood rewrote the partition table, shrinking the main firmware partition and growing storage to 2 MB. Editing it is risky, so he moved to the ESP-IDF framework with dangerous flash writes explicitly enabled.

Security raised another issue: the nvs partition stores the Wi-Fi SSID and password in plaintext, so his firmware erases it — which broke Tasmota's own recovery firmware, designed to read those credentials. He therefore built a minimal custom safeboot image of his own.

The site, the admin panel and a captive portal

The web interface is hand-coded. The index page shows a yellow shipping container, a nod to Ben Brown's story, and the library lists each book with title, author and the reason it was challenged or banned. A password-protected /admin page controls the LED colour temperature, so a drop can be matched to whatever bulb it replaced.

To get visitors to the server at all, the project implements a captive portal: a DNS server answers every request with its own IP address, and the probe requests Windows, Android, iOS and Firefox use to test connectivity are redirected to the library.

A limitation he came to like

4 MB of total storage fits only a few books — the epubs he checked were around 350 KB each. That was disappointing at first, but he now likes that a drop's contents reflect the person who built it, and that several bulbs in one city could each hold something different to discover.