gdt: Kangaroo road sign (Default)

For a long time computer manufacturers have tried to differentiate themselves and their products from their competitors with fancy names with odd capitalisation and spelling. But as an author, using these names does a disservice to the reader: how are they to know that DEC is pronounced as if it was written Dec ("deck").

It's time we pushed back, and wrote for our readers, not for corporations.

It's time to use standard English rules for these Corporate Fancy Names. Proper names begin with a capital, unlike "ciscoSystems®" (so bad that Cisco itself moved away from it). Words are separated by spaces, so "Cisco Systems". Abbreviations and acronyms are written in lower case if they are pronounced as a word, in upper case if each letter is pronounced: so "ram" and "IBM®".

So from here on in I'll be using the following:

  • Face Book. Formerly, "Facebook®".
  • Junos. Formerly JUNOS®.
  • ram. Formerly RAM.
  • Pan OS. Formerly PAN-OS®.
  • Unix. Formerly UNIX®.

I'd encourage you to try this in your own writing. It does look odd for the first time, but the result is undeniably more readable. If we are not writing to be understood by our audience then we are nothing more than an unpaid member of some corporation's marketing team.

gdt: Kangaroo road sign (Default)

The uBITX uses an Arduino internally. This article describes how to update its software.

Required hardware

The connector on the back is a Mini-B USB connector, so you'll need a "Mini-B to A" USB cable. This is not the same cable as used with older Android smartphones. The Mini-B connector was used with a lot of cameras a decade ago.

You'll also need a computer. I use a laptop with Fedora Linux installed.

Required software for software development

In Fedora all the required software is installed with sudo dnf install arduino git. Add yourself to the users and lock groups with sudo usermod -a -G users,lock $USER (on Debian-style systems use sudo usermod -a -G dialout,lock $USER). You'll need to log out and log in again for that to have an effect (if you want to see which groups you are already in, then use the id command).

Run arduino as your ordinary non-root user to create the directories used by the Arduino IDE. You can quit the IDE once it starts.

Obtain the uBITX software

$ cd ~/Arduino
$ git clone https://github.com/afarhan/ubitxv6.git ubitx_v6.1_code

Connect the uBITX to your computer

Plug in the USB cable and turn on the radio. Running dmesg will show the Arduino appearing as a "USB serial" device:

usb 1-1: new full-speed USB device number 6 using xhci_hcd
usb 1-1: New USB device found, idVendor=1a86, idProduct=7523, bcdDevice= 2.64
usb 1-1: New USB device strings: Mfr=0, Product=2, SerialNumber=0
usb 1-1: Product: USB Serial
usbcore: registered new interface driver ch341
usbserial: USB Serial support registered for ch341-uart
ch341 1-1:1.0: ch341-uart converter detected
usb 1-1: ch341-uart converter now attached to ttyUSB1

If you want more information about the USB device then use:

$ lsusb -d 1a86:7523
Bus 001 Device 006: ID 1a86:7523 QinHeng Electronics CH340 serial converter
gdt: Kangaroo road sign (Default)

udev can be used to block a USB device (or even an entire class of devices, such as USB storage). Add a file /etc/udev/rules.d/99-local-blacklist.rules containing:

SUBSYSTEM=="usb", ATTRS{idVendor}=="0123", ATTRS{idProduct}=="4567", ATTR{authorized}="0"
gdt: Kangaroo road sign (Default)

Digital TV uses MPEG Transport Stream, which is a container for video designed for lossy transmission, such as radio. To save CPU cycles, Personal Video Records often save the MPEG-TS stream directly to disk. The more usual MPEG is technically MPEG Program Stream, which is designed for lossless transmission, such as storage on a disk.

Since these are a container formats, it should be possible to losslessly and quickly re-code from MPEG-TS to MPEG-PS.

ffmpeg -ss "${STARTTIME}" -to "${DURATION}" -i "${FILENAME}" -ignore_unknown -map 0 -map -0:2 -c copy "${FILENAME}.mpeg"
gdt: Kangaroo road sign (Default)

This has become substantially simpler in Fedora 29:

sudo dnf install notebook R-IRKernel R-IRdisplay
gdt: Kangaroo road sign (Default)

It might be tempting to use MP3's variable bit rate for encoding ripped foreign languages CDs. With the large periods of silence that would seem to make a lot of sense. But you lose the ability to rewind to an exact millisecond, which turns out to be essential as you want to hear a particular phrase a handful of times. So use CBR -- constant bit rate -- encoding, and at a high bit rate like 160kbps.

gdt: Kangaroo road sign (Default)

In case you want to choose a different security compromise, the update has a nice summary:

wpasupplicant (2:2.6-19) unstable; urgency=medium

  With this release, wpasupplicant no longer respects the system
  default minimum TLS version, defaulting to TLSv1.0, not TLSv1.2. If
  you're sure you will never connect to EAP networks requiring anything less
  than 1.2, add this to your wpasupplicant configuration:

    tls_disable_tlsv1_0=1
    tls_disable_tlsv1_1=1

  wpasupplicant also defaults to a security level 1, instead of the system
  default 2. Should you need to change that, change this setting in your
  wpasupplicant configuration:

    openssl_ciphers=DEFAULT@SECLEVEL=2

  Unlike wpasupplicant, hostapd still respects system defaults.

 -- Andrej Shadura <…@debian.org>  Sat, 15 Dec 2018 14:22:18 +0100
gdt: Kangaroo road sign (Default)

To find passwords in libsecret you need to know what attributes to search for. These are often set by some shim but not documented. The attributes tend to vary by shim.

For git's libsecret shim the attributes are: protocol, server, user.

A worked example, the account gdt on git.example.org:

$ secret-tool search --all 'protocol' 'https' 'server' 'git.example.org' 'user' 'gdt'
[/org/freedesktop/secrets/collection/login/123]
label = Git: https://git.example.org/
secret = CvKxlezMsSDuR7piMBTzREJ7l8WL1T
created = 2019-02-01 10:20:34
modified = 2019-02-01 10:20:34
schema = org.gnome.keyring.NetworkPassword
attribute.protocol = https
attribute.server = git.example.org
attribute.user = gdt

Note that the "label" is mere documentation, it's the "attribute" entries which matter.

gdt: Kangaroo road sign (Default)

It's pretty common to add a udev rule in /etc/udev/rules.d/ for new hardware.

There are two ways of granting access, using groups and permissions, and using systemd's uaccess tag.

Here's an example showing groups and permissions. Anyone in the "users" group can access the switch, but only those in the "eng" (engineering) group can flash the switch. This is a pretty common arrangement for hardware development teams:

# /etc/udev/rules.d/77-northbound-networks.rules
# Northbound Networks
#  Zodiac FX OpenFlow switch
ATTRS{idVendor}=="03eb", ATTRS{idProduct}=="2404", ENV{ID_MM_DEVICE_IGNORE}="1", GROUP="users", MODE="0660", SYMLINK+="ttyzodiacfx"
#  Zodiac FX OpenFlow switch after flash "erase"
#  The Atmel SAM4E Cortex-M4F CPU is running a bootloader waiting for software
#  download via USB and the SAM-BA tool (the CPU is Atmel part ATSAM4E8C-AU,
#  use board description "at91sam4e8-ek").
ATTRS{idVendor}=="03eb", ATTRS{idProduct}=="6124", ENV{ID_MM_DEVICE_IGNORE}="1", GROUP="eng", MODE="0660", SYMLINK+="ttyat91sam4e8-ek"
# Atmel-ICE Basic JTAG
ATTRS{idVendor}=="03eb", ATTRS{idProduct}=="2141", MODE="664", GROUP="eng"

Here's an example for a Yubikey, Any seated user can access the Ybukey:

# /etc/udev/rules.d/69-u2f.rules
# Yubico YubiKey
KERNEL=="hidraw*", SUBSYSTEM=="hidraw", ATTRS{idVendor}=="1050", ATTRS{idProduct}=="0113|0114|0115|0116|0120|0200|0402|0403|0406|0407|0410", TAG+="uaccess"

Note that this file must run before /usr/lib/udev/rules.d/73-seat-late.rules.

Also, the systemd developers have tried to abstract the rules a little, making them more declarative and less procedural (alawys a good design rule). Of course, they haven't documented this (never a good design practice). See the file /lib/udev/rules.d/70-uaccess.rules and look for the ID_ variables. So the Yubikey example could have been:

# /etc/udev/rules.d/69-u2f.rules
# Yubico YubiKey
KERNEL=="hidraw*", SUBSYSTEM=="hidraw", ATTRS{idVendor}=="1050", ATTRS{idProduct}=="0113|0114|0115|0116|0120|0200|0402|0403|0406|0407|0410", ENV{ID_SECURITY_TOKEN}="1"

If you want only seated users accessing the device then use the uaccess tag. If you want users remotely accessing the machine to use the device, then you use a group and permissions.

gdt: Kangaroo road sign (Default)
  • In a recent version of Firefox, open the developer toolbar (shift + f2).
  • Enter screenshot filename.png -fullpage
  • Filename.png will be saved to your downloads folder.
gdt: Kangaroo road sign (Default)

The save people the trouble, if you decide you need a serious password store for Linux here is what you need.

KeePassXC — a password database. Install keepassxc on Linux, create a database, import keys, use a keyfile on the local disk. Copy the password file to Google Drive.

KeePassXC-Browser — a Firefox, Chromium and Chrome add on. Start KeePassXC, install plugin, link browser and database.

KeePassDroid — a version of keepass on Android. Open Google drive. Click on Passwords.kdbx, select "make available offline", select "open with... keypassdroid". Put a copy of the keyfile on your mobile.

andOTP — a TOTP and HOTP generator for Android. (Don't bother with FreeOTP, it's essentially unmaintained. The sole maintainer's security model isn't a good fit for non-enterprise use, a point he's unwilling to accept despite issues with the security model being repeatedly raised. This is most apparent around backups of the database.)

Fdroid — a non-Google app store. Use this as the source for KeePassDroid and andOTP if you are worried about Google Play Store.

Gimp — a graphics editor. When you enable one-time passwords for a site use Gimp to grab a copy of the QR code containing the OTP key. This is the surest backup to the OTP database and prevents being locked into one OTP app.

As you load passwords into the database it is a good moment to go and change shared or non-complex passwords. As a result loading the database can take about a week. But the payoff in security is huge.

As you encounter sites which support one-time passwords also set up OTP for those sites. Some samples are: Amazon, Evernote, Facebook, Firefox, GitHub, GitLab, Kickstarter, Microsoft Live, Tumblr.

gdt: Kangaroo road sign (Default)

The screen brightness is held in a EFI variable.

hexdump /sys/firmware/efi/efivars/backlight-level-7c436110-ab2a-4bbb-a880-fe41995c9f82 
0000000 0007 0000 0101
gdt: Kangaroo road sign (Default)

Uploading files to CloudStor is conveniently done through the CloudStor web page. Files can also be uploaded through GNOME's inbuilt WebDav client, see the Places | Browse networks | Other locations... dialogue.

When uploading many large files using the command line can be more straightforward then a graphical interface, as the transfer can be set running and forgot until it completes.

Install cURL. On Fedora this is:

$ sudo dnf install curl

Create a CloudStor app password. Go to cloudstor.aarnet.edu.au, log in, Select your username | Settings | Security | Create new app password. Give the app a name, like "webdavs", the name has no meaning. Copy the username and password from the displayed text boxes:

Username: fred.bloggs@example.edu.au
Password: JQRKN-EEMDI-NSPOB-ABKIE

You can use this password for all future webdav uploads.

Upload files. We'll upload example.dat to our CloudStor home folder:

$ curl -T example.dat https://cloudstor.aarnet.edu.au/plus/remote.php/webdav/

When prompted provide your username -- complete with the @example.edu.au -- and the app password, not your real password which you logged into Shibbloeth with when connecting to the CloudStor web site.

The -o option gives upload progress:

$ curl -T example.dat -o /dev/stdout https://cloudstor.aarnet.edu.au/plus/remote.php/webdav/

To upload to a folder: create the folder from the CloudStor webpage, then append the folder name and a trailing slash to the upload URL. Here's an example for a folder called "experiment51":

$ curl -T example.dat https://cloudstor.aarnet.edu.au/plus/remote.php/webdav/experiment51/

Uploading a lot of files. Curl allows the username and password to be supplied on the command line. This password is the app password, not your real password:

$ curl -T example.dat -u 'fred.bloggs@example.edu.au:JQRKN-EEMDI-NSPOB-ABKIE' https://cloudstor.aarnet.edu.au/plus/remote.php/webdav/experiment51/

We can combine that with the usual UNIX shell facilities. Here we upload every .dat file in our computer's working directory to the "experiment51" folder on our CloudStor:

$ for f in *.dat
do curl -T "$f" -u 'fred.bloggs@example.edu.au:JQRKN-EEMDI-NSPOB-ABKIE' https://cloudstor.aarnet.edu.au/plus/remote.php/webdav/experiment51/
done

It's going to take a really long time. UNIX's nohup program allows you to log out but leaves the program running. Put your commands between nohup and a &:

$ nohup for f in *.dat
do curl -T "$f" -u 'fred.bloggs@example.edu.au:JQRKN-EEMDI-NSPOB-ABKIE' https://cloudstor.aarnet.edu.au/plus/remote.php/webdav/experiment51/
done &

If it goes wrong. Any errors are printed in their raw XML form. Just ignore the XML tags and read the text between them. Here uploading a file hasn't gone well as the uploaded size doesn't match the size on disk of the original file:

<?xml version="1.0" encoding="utf-8"?>
<d:error xmlns:d="DAV:" xmlns:s="http://sabredav.org/ns">
  <s:exception>Sabre\DAV\Exception\BadRequest</s:exception>
  <s:message>expected filesize 127076912 got 127074304</s:message>
</d:error>

When you are done. You can return your CloudStor account's Security | Settings and delete the "webdavs" app you created from the list of apps and their passwords.

gdt: Kangaroo road sign (Default)
$ sudo install netcdf-devel
$ R --no-restore --no-save
> install.packages('ncdf4')
> q()

There's a good summary of using NetCDF here.

gdt: Kangaroo road sign (Default)

Jupyter with Python

Fedora loves Python has the good oil:

$ sudo dnf install notebook
$ jupyter notebook

Jupyter with R

Firstly, install Jupyter with Python, as above.

IRkernel has the good oil. I've modified their advice to install RPM packages where they are available:

$ sudo dnf install czmq-devel libcurl-devel openssl-devel
$ sudo dnf install R-crayon R-pbdZMQ R-repr
$ R --no-restore --no-save
> install.packages('devtools')
> devtools::install_github(paste0('IRkernel/', c('IRdisplay', 'IRkernel')))
> IRkernel::installspec()
> q()

If you want to do a system-wide installation then run R as root, proceed as above, but the last step is:

> IRkernel::installspec(user = FALSE)

gdt: Kangaroo road sign (Default)

The Linux kernel has fixes for Meltdown, Spectre v1 and Spectre v2. Check the status with:

$ cat /sys/devices/system/cpu/vulnerabilities/meltdown
Mitigation: PTI
$ cat /sys/devices/system/cpu/vulnerabilities/spectre_v1
Mitigation: __user pointer sanitization
$ cat /sys/devices/system/cpu/vulnerabilities/spectre_v2
Mitigation: Full generic retpoline

You'd think that would be enough. But Linux has fucked it up. Here's the output from a Raspberry Pi 3 running 4.9.80. That ARM CPU doesn't have instruction speculation and this isn't vulnerable to Meltdown or Spectre-style bugs.

$ ls /sys/devices/system/cpu/vulnerabilities
ls: cannot access '/sys/devices/system/cpu/vulnerabilities': No such file or directory

That's right. We can't tell if the CPU is immune to the issue or if the Linux kernel is too old to have a fix for the issue. A program wanting to check this is going to have to carry around a table of CPU architectures and Linux versions. Which is likely going to be wrong, because who's going to know the data a fix for Spectre made it into a MIPS build. Classic. All Linux needed to do was to create /sys/devices/system/cpu/vulnerabilities for all architectures. Sigh.

gdt: Kangaroo road sign (Default)
$ wget --output-document=/dev/null --server-response --max-redirect=0 --header 'Host:www.example.com' http://192.0.2.1/
--2017-08-28 11:50:11--  http://192.0.2.1/
Connecting to 192.0.2.1:80... connected.
HTTP request sent, awaiting response... 
  HTTP/1.1 301 Moved Permanently
  Content-Length: 0
  Location: https://www.example.com/
  Date: Mon, 28 Aug 2017 02:20:11 GMT
  Connection: keep-alive
  X-Content-Type-Options: nosniff
  Strict-Transport-Security: max-age=31536000; includeSubDomains
  X-XSS-Protection: 1; mode=block
Location: https://www.example.com/ [following]
0 redirections exceeded.

Now let's pull the redirected URL, but from the IP address we want to use rather than letting the resolver choose:

$ wget --output-document=/dev/null --server-response --max-redirect=0 --header 'Host:www.example.com' --no-check-certificate https://192.0.2.1/
--2017-08-28 11:53:50--  https://192.0.2.1/
Connecting to 192.0.2.1:443... connected.
The certificate's owner does not match hostname ‘192.0.2.1’
HTTP request sent, awaiting response... 
  HTTP/1.1 200 OK
  Content-Type: text/html; charset=utf-8
  X-Frame-Options: SAMEORIGIN
  X-UA-Compatible: IE=edge
  Content-Length: 248263
  Cache-Control: private, no-cache
  Expires: Mon, 28 Aug 2017 02:23:50 GMT
  Date: Mon, 28 Aug 2017 02:23:50 GMT
  Connection: keep-alive
  X-Content-Type-Options: nosniff
  Strict-Transport-Security: max-age=31536000; includeSubDomains
  X-XSS-Protection: 1; mode=block
Length: 248263 (242K) [text/html]
Saving to: ‘/dev/null’
/dev/null           100%[===================>] 242.44K  --.-KB/s    in 0.03s   
2017-08-28 11:53:50 (7.77 MB/s) - ‘/dev/null’ saved [248263/248263]

A similar thing can be done with OpenSSL's client:

$ openssl s_client -connect 192.0.2.1:443 -tls1_2
gdt: Kangaroo road sign (Default)

From NANOG list:

dig o-o.myaddr.l.google.com -t txt +short @8.8.8.8
gdt: Kangaroo road sign (Default)

On the Cisco switch:

Switch# verify /md5 flash:/filename.bin
..........................................................................................
....................................................Done!
verify /md5 (flash:/filename.bin) = 512564b05cecc2041d00890caa18224c

On the POSIX-like operating system the file was copied from using TFTP:

$ md5sum /var/lib/tftpboot/filename.bin
512564b05cecc2041d00890caa18224c  filename.bin

dd

2017-04-01 09:38
gdt: Kangaroo road sign (Default)
The reason for using dd to write to USB flash sticks is historical.

On some other UNIX-like operating systems only "raw" block devices present the partition table, boot sector and unpartitioned space. Specifically, whereas Linux presents a /dev/sda block device containing all the bytes of a disk, in those other operating systems the equivalent would be a /dev/rsda raw block device.

In those other UNIX-like operating systems you must write to raw block devices in multiples of the sector size of the device. dd can do this, cp and cat cannot. How you discover a device's sector size was left as an exercise for the reader, it is traditionally 0.5KB, more recently 4KB, and three orders of magnitude larger again for flash devices.

Linux doesn't have raw devices, so using dd isn't needed to write an image to a disk. You can wget -O /dev/sd𝐱 … a Fedora .iso file directly onto the USB flash drive.

Note that some devices perform better when handed data is particular block sizes. Most USB sticks perform best if handed data in 4MB chunks. dd is useful if you want that optimisation: wget -O - … | dd of=/dev/sd𝐱 bs=4M status=progress. Note that if you do not set the bs blocksize then the default of 0.5KB is going to make writing a USB flash stick very slow.
Page generated 2026-09-23 23:46
Powered by Dreamwidth Studios