Readiness: Pat Winlink Radio Email Station

Verdict: Ready with caveats · 2026-09-02 · est. parts cost $290–$1,570 for the core station (add $450–$2,000 only if PACTOR mode is required) Cybersecurity — software & network: Review before networking

This is the cold check for this lab — there is no previous readiness report, so the prices, sellers and availability recorded below establish the baseline that future checks will measure drift against. Five of the six items on the bill of materials are commodity computing and amateur-radio equipment, currently listed for sale by multiple named sellers, and the lab's own snapshot grants wide substitution latitude on every one of them. The station can be built and taught today. The single troubled item is the SCS PTC series PACTOR controller: no unit in that series is in current production, leaving only a used market, and the current-production successor is not on the tested-hardware list of the driver this project pins. That is a caveat rather than a blocker because the lab itself scopes the PACTOR controller to one optional operating mode — Pat's telnet, AX.25, ARDOP and VARA transports need no PACTOR hardware at all, and the readily available soundcard interface below carries them.

Action required

Cybersecurity — software & network

Review before networking — Thirty-five pinned dependencies were checked and three carry advisories at their exact pinned versions, the required Go toolchain line is past end of life, and the peer-to-peer listener ships with an empty password — all fixable, but each needs attention before the station goes on a shared network.

What this means for your lab

Every one of the 35 software libraries this project pins was checked against the public vulnerability database this run, and 32 came back clean. Three did not, and one of them matters most: the networking library that handles HTML and DNS has ten known problems at the exact version pinned here, any of which could crash the station rather than let someone take it over. The bigger practical risk is how the station is placed on a network. Out of the box Pat's web mailbox is reachable only from the machine it runs on, which is the safe default and worth keeping. But the peer-to-peer listener that the lab's own example switches on listens on every network interface with a blank password, and there is no login on the web mailbox at all if you move it off localhost so students can reach it from another machine. Anyone else on the same network could then read, send and delete mail as the station's callsign, which on an amateur licence is the operator's personal responsibility. Finally, the Go toolchain version the project asks for stopped receiving security updates in February 2026. Practical steps: keep the web interface bound to localhost and reach it over an SSH tunnel, set a real telnet password before enabling the peer-to-peer listener, put the station on its own isolated network segment rather than the campus network, update the three flagged libraries, and build with a current Go release. Talk to campus IT before connecting this to a shared network.

Not checked

• Pat (Winlink client application): The lab's materials pin no Pat release version, so no advisory lookup against a specific version was possible.
• Hamlib (rigctl): Version not stated in the lab's materials; without a concrete version neither an advisory lookup nor a support-status lookup can return a meaningful answer.
• Host operating system (Linux, macOS, Windows or Android): The lab names four possible operating systems and pins no version or distribution, so no end-of-life or advisory lookup was possible.
• VARA HF/FM and ARDOP software TNC engines: External closed-source software modems with no version stated and no vulnerability database covering them; absence of advisories here is not evidence of safety.

Parts

Stock levels are not reported for any row: every item on this bill of materials is a retail product priced through shopping listings rather than an authorized-distributor catalogue part, and those listings publish price and seller but not inventory. "Readily available" here means currently listed for sale by the named sellers.

Substitutes

Verify any substitute against its datasheet — and, for these modems, against the ptc-go driver's own supported-hardware notes — before ordering.

Other dependencies

• Board fabrication — not applicable. The lab ships no PCB design files, Gerber archives or layer stackups; the station is off-the-shelf equipment joined by cables. There is nothing to fabricate and no fab-house risk.
• Project homepage http://getpat.io — live (fetched this run).
• Winlink 2000 system overview http://winlink.org — live (fetched this run).
• Project repository https://github.com/la5nta/pat — live (the project manifest was fetched from its master branch this run).
• PACTOR driver documentation https://github.com/harenber/ptc-go — live, but relocated. The repository README now says only that documentation has moved to the wiki; the substantive setup and supported-hardware notes are at the repository wiki, which was fetched this run.
• Protocol stack repository https://github.com/la5nta/wl2k-go — not checked directly. It reaches this lab as a pinned dependency rather than a separate download.

Watch list

• SCS PTC series PACTOR controller — the one item with no new-production source. Used supply on eBay and marine resale sites is thin and priced by condition; expect the $449.96–$639.20 band to move and listings to disappear between checks. Re-check whether the ptc-go project has added the DR-9400 to its tested list, which would open a current-production path.
• P4dragon DR-7400 / DR-7800 — driver-supported but marked "no longer available" by the manufacturer this run. If either returns to stock anywhere it becomes the best answer for this line; worth a look each check.
• Amateur radio transceiver — no obsolescence risk, but the HF models that make this lab interesting sit at $595–$1,100 and are the largest single line in the budget. Watch for price movement and for the chosen model's Hamlib support status.
• Raspberry Pi 4 Model B — an older board still widely listed at a wide spread ($55–$189 for different RAM tiers). If supply thins, any PC or newer Pi satisfies the snapshot's requirement, so this is a price watch rather than an availability risk.
• Tigertronics SignaLink USB — sold in radio-specific connector variants; the variant needed depends on the transceiver chosen. A radio change mid-course silently invalidates the interface already bought.