<?xml version="1.0" encoding="UTF-8"?>
<feed xmlns="http://www.w3.org/2005/Atom" xml:lang="en-us">
  <title type="text">Blogs on Alexander Bochmann&amp;#039;s TikiWiki</title>
  <subtitle type="text">Last posts to weblogs.</subtitle>
  <updated>2026-04-26T14:57:15+00:00</updated>
  <generator uri="https://getlaminas.org" version="2">Laminas_Feed_Writer</generator>
  <link rel="alternate" type="text/html" href="https://web.gxis.de/tiki/"/>
  <link rel="self" type="application/atom+xml" href="https://web.gxis.de/tiki/tiki-blogs_rss.php"/>
  <id>https://web.gxis.de/tiki/</id>
  <author>
    <name>Alexander Bochmann</name>
    <email>ab+atom@st.gxis.de</email>
  </author>
  <entry>
    <title type="html"><![CDATA[Apple Magic Mouse (A3204) on Windows, 2026 edition]]></title>
    <summary type="html"><![CDATA[Apple's Magic Mouse line uses a touch surface instead of a scroll wheel, which isn't directly supported by the standard MS Windows mouse driver.<br />
<br />
Apple provided Windows drivers for these mice as part of their Bootcamp package, last published around 2016. There's tons of articles out there on how to retrieve these drivers with <a class="wiki external"  title="External link" href="https://github.com/timsutton/brigadier" rel="external nofollow">Brigadier (Github Repo)</a>, but they won't work with the latest Magic Mouse that has an USB-C charge port.<br />
<br />
Apparently this is due to newer Magic Mouse models having a different Bluetooth PID that's not listed in the .inf for Bootcamp drivers.<br />
<br />
Luckily, someone went to dig through all this and created an installer that beats AppleWirelessMouse.sys into a shape that's both acceptable by Windows 10 and 11, and solves the BT PID issue:<br />
<a class="wiki external"  title="External link" href="https://github.com/sbagirici/apple-magic-mouse-scroll-fix-windows" rel="external nofollow">Apple Magic Mouse Scroll Fix for Windows 11 (Github)</a> <a class="wikicache" target="_blank" href="tiki-view_cache.php?url=https%3A%2F%2Fgithub.com%2Fsbagirici%2Fapple-magic-mouse-scroll-fix-windows">(cache)</a><br />
<br />
As of now, the <code>install.ps1</code> powershell script from that repo looks ok to me, though I didn't use their mouse driver rebuild (the affected machine here is on Win 10), and instead went for BootCamp-041-88430 drivers (use <code>-m iMac17,1</code> with Brigadier, extract driver from <code>AppleWirelessMouse64.exe</code> in the Apple drivers directory with something like 7zip, copy file to a <code>drivers/</code> directory next to the script).<br />
<br />
It took about 15 seconds after the script was completed for my mouse to come back online, but then its touch scroll function was immediately usable, without a reboot.<br />
<br />]]></summary>
    <published>2026-04-03T12:42:00+00:00</published>
    <updated>2026-04-03T12:42:00+00:00</updated>
    <link rel="alternate" type="text/html" href="https://web.gxis.de/tiki/tiki-view_blog_post.php%3FpostId%3D350"/>
    <id>https://web.gxis.de/tiki/tiki-view_blog_post.php%3FpostId%3D350</id>
    <author>
      <name>Alexander Bochmann</name>
      <email>&lt;a class="convert-mailto" href="mailto:nospam@example.com" data-encode-name="ab+wiki" data-encode-domain="st.gxis.de"&gt;ab+wiki at st.gxis.de&lt;/a&gt;</email>
    </author>
  </entry>
  <entry>
    <title type="html"><![CDATA[upgraded to Tiki 27]]></title>
    <summary type="html"><![CDATA[I've been pushing back an upgrade for quite some time now, but running on php 7.4 for the old Tiki version as grown unsustainable.<br />
<br />
Up to now, I've not seen any major problems after doing the default upgrade steps - theming is off, as always, and I'll probably have to find a new default theme.<br />
<br />
Not sure if there's any problems hidden in features I haven't used for ages, but the blogs (and images) seem to be ok, at least for recent posts.<br />
<br />
The only actual error was that I wasn't able to update the search index. Even after switching my search provider in Tiki's web interface, I got:<br />
<br />
<pre>
error: Unsupported index type "lucene". Needs to be one of "mysql", "elastic" or "manticore". Try resaving the Search Control Panel
error: Contact the site administrator. The index needs rebuilding.

Search index rebuild failed. Last messages shown above.
</pre><br />
Turns out the <code>unified_engine</code> in setting in the <code>tiki_preferences</code> table was not updated, so I did that manually in the DB shell with a<br />
<code>update tiki_preferences set value='mysql' where name='unified_engine';</code><br />
<br />
For some reason this didn't seem activate until I also cleaned up all the orphan preferences from the web admin menu, but now the search index has rebuilt.<br />
<br />
Oh, and the editor's preview tab produces a 400 error (but using the Preview button still works).<br />
<br />]]></summary>
    <published>2025-02-09T21:34:00+00:00</published>
    <updated>2025-02-09T21:34:00+00:00</updated>
    <link rel="alternate" type="text/html" href="https://web.gxis.de/tiki/tiki-view_blog_post.php%3FpostId%3D348"/>
    <id>https://web.gxis.de/tiki/tiki-view_blog_post.php%3FpostId%3D348</id>
    <author>
      <name>Alexander Bochmann</name>
      <email>&lt;a class="convert-mailto" href="mailto:nospam@example.com" data-encode-name="ab+wiki" data-encode-domain="st.gxis.de"&gt;ab+wiki at st.gxis.de&lt;/a&gt;</email>
    </author>
  </entry>
  <entry>
    <title type="html"><![CDATA[vSphere host profiles, "A specified parameter was not correct: portgroupName"]]></title>
    <summary type="html"><![CDATA[It's not often you run into a VMware error message that has almost no search engine hits, which we managed to do recently...<br />
<br />
When trying to apply an existing host profile to a new host added to a cluster, vSphere errored out:<br />
<br />
<tt> A general system error occurred: Batch host remediation failed.</tt><br />
<tt> A specified parameter was not correct: portgroupName</tt><br />
<br />
We later learned that the same error would appear when trying to reapply the host profile to a machine that had been in the cluster for quite some time...<br />
<br />
I'll spare you the details, but as it turns out this happened ... because we were configuring vmkernel ports on dvSwitch portgroups in the host profile, and I had changed one of those port group names.<br />
<br />
Knowing that, the error message suddenly makes sense 🙄<br />
<br />
So instead of changing back the names, we went forward and updated all our host profiles with the new designations, which also meant reacknowledging host profile customizations that were referencing these port groups.<br />]]></summary>
    <published>2024-08-30T19:48:00+00:00</published>
    <updated>2024-08-30T19:48:00+00:00</updated>
    <link rel="alternate" type="text/html" href="https://web.gxis.de/tiki/tiki-view_blog_post.php%3FpostId%3D347"/>
    <id>https://web.gxis.de/tiki/tiki-view_blog_post.php%3FpostId%3D347</id>
    <author>
      <name>Alexander Bochmann</name>
      <email>&lt;a class="convert-mailto" href="mailto:nospam@example.com" data-encode-name="ab+wiki" data-encode-domain="st.gxis.de"&gt;ab+wiki at st.gxis.de&lt;/a&gt;</email>
    </author>
  </entry>
  <entry>
    <title type="html"><![CDATA[neuer Monitor: LG 38WR85QC-W (38" UltraWide 3840x1600)]]></title>
    <summary type="html"><![CDATA[Nach <a class="wiki external"  title="External link" href="https://mastodon.infra.de/@galaxis/112815860550499863" rel="external nofollow">längerem Hin und Her</a> habe ich mir einen neuen Monitor gekauft, hauptsächlich als Arbeitsgerät für's Homeoffice, nämlich den hier: <a class="wiki external"  title="External link" href="https://www.lg.com/de/monitore/ultrawide/38wr85qc-w/" rel="external nofollow">LG 38" Ultrawide QHD+ (3840x1600) Curved</a> <a class="wikicache" target="_blank" href="tiki-view_cache.php?url=https%3A%2F%2Fwww.lg.com%2Fde%2Fmonitore%2Fultrawide%2F38wr85qc-w%2F">(cache)</a><br />
<br />
Ich bin eigentlich ganz zufrieden, nachdem ich rund drei Wochen mehr oder weniger täglich dabei gearbeitet habe, obwohl es an ein paar Kleinigkeiten hakelt, die ich mal zusammensammeln wollte:<br />
<br />
<ul><li> Der Monitorfuß ist tatsächlich nach hinten relativ ausladend, und auf einem 80cm tiefen Tisch sitzt man leicht zu nahe am Monitor. Das ist besonders zu merken, wenn man Bildelemente am äußersten Bildschirmrand hat - aus zu geringer Entfernung werdem die äußersten paar Pixel unsichtbar. So 70cm weg vom Monitor sollten die Augen wohl schon sein.
</li><li> Auf meinem höhenverstellbaren (Ikea-)Schreibtisch wackelt der Monitor beim tippen zum Teil merklich. Inzwischen fällt mir das praktisch nicht mehr auf, aber anfangs war es ziemlich störend.
</li><li> Die Scaling-Einstellungen sind ... unterentwickelt. Der Monitor lässt sich nur global auf das native Format, 16:9, und 4:3 einstellen. Die Option wird auf alle Auflösungen angewendet, und nicht nur auf solche, bei denen tatsächlich eine Skalierung notwendig ist - also in der 16:9 - Einstellung wird auch die native 21:9 - Auflösung zusammengestaucht. Speziell für Spiele, die kein 21:9 können, ist das ein ziemlicher Nerv - für den Desktop braucht man die Einstellung eigentlich nie zu ändern.
</li><li> Anfangs hatte ich ziemliche Probleme mit der KVM-Funktion. Mein alter Desktop-PC hat den USB-Hub im Monitor nicht wiedererkannt, nachdem der Monitor im Standby war. Das funktioniert jetzt aber, nachdem ich den "Deep Sleep Mode" deaktiviert habe.
</li><li> Ich habe deutliche Helligkeitsschwankungen bemerkt, die allerdings weitgehend verschwunden sind, nachdem ich die "Smart Energy Saving" - Funktion auf "Low" gestellt habe.
</li><li> Es gibt eine "Automatic Standby" - Funktion, die den Monitor auch bei aktivem Bildsignal nach einer Weile abschaltet, "wenn keine Bewegung auf dem Bildschirm erkennbar ist". Das ist allerdings nicht wirklich zuverlässig, und schlägt bei normaler Arbeit auf dem Desktop gerne mal zu. Muss dann über Betätigung des OSD-Joysticks an der Unterseite unterbrochen werden.

</li></ul><br />Das war's aber auch im großen und ganzen schon an Negativem, am ehesten ein Dealbreaker davon ist noch das mit dem Scaling, zumal ich gerade nicht einen Spiele-PC habe, der die native Auflösung mit brauchbarer Framerate bedienen könnte...<br />
<br />
Auf der positiven Seite sind mir aufgefallen:<br />
<br />
<ul><li> Der Stromverbrauch im Standby ist erfreulich niedrig (&lt; 1W laut einem Shelly-Zwischenstecker).
</li><li> Das Bild ist klasse. Kein Problem, den ganzen Tag (Arbeit + Freizeit) draufzuschauen. Natürlich handelt es sich gerade nicht um ein HiDPI-Display (110ppi), dafür kann ich Desktop-Applikationen problemlos ohne Skalierung durch das Betriebssystem verwenden. Im Terminalfenster und Webbrowser verwende ich der Bequemlichkeit halber eine etwas größere Default-Schriftart.
</li><li> KVM funktioniert zum Umschalten zwischen zwei PCs einwandfrei. Es gibt USB-B und USB-C - Inputs zum integrierten (Realtek) USB-Hub, und für jeden Monitor-Input kann einer davon zugeordnet werden. Die Split-Screen und Picture-in-Picture - Optionen habe ich noch nicht verwendet.
</li><li> Bloss eine Kleinigkeit, aber die Power-LED leuchtet nach unten und ist im Betrieb absolut unauffällig. Im aktiven Standby blinkt sie, was dann doch auf Dauer etwas nervig sein kann. Die LED lässt sich aber auch komplett abschalten.
</li><li> Der Bildrand ist breit genug, damit die Halterung einer normalen Webcam nicht in das Bild hineinreicht. Da ich jetzt sonst keinen weiteren Monitor mehr auf dem Tisch habe, stört mich der Rand ansonsten nicht.

</li></ul><br />Im großen und ganzen nutze ich den Monitor wie zwei normale nebeneinander, nur eben ohne einen Rahmen in der Mitte. Allein dadurch wird Platz gewonnen für Fenster, die halt gerade mal nicht genau die Hälfte des Bildschirms belegen und ohne Einschränkung irgendwo positioniert sein können.<br />
<br />
Wenn LG noch ein Update für die Skalierungsoptionen nachliefern würde, könnte ich den Monitor uneingeschränkt empfehlen. Ich kann mir allerdings durchaus vorstellen, dass die Auflösung grundsätzlich so ein Zwischending ist, das nicht zu jedem Geschmack und Anwendungsfall passt.<br />]]></summary>
    <published>2024-08-19T20:04:00+00:00</published>
    <updated>2024-08-19T20:04:00+00:00</updated>
    <link rel="alternate" type="text/html" href="https://web.gxis.de/tiki/tiki-view_blog_post.php%3FpostId%3D346"/>
    <id>https://web.gxis.de/tiki/tiki-view_blog_post.php%3FpostId%3D346</id>
    <author>
      <name>Alexander Bochmann</name>
      <email>&lt;a class="convert-mailto" href="mailto:nospam@example.com" data-encode-name="ab+wiki" data-encode-domain="st.gxis.de"&gt;ab+wiki at st.gxis.de&lt;/a&gt;</email>
    </author>
  </entry>
  <entry>
    <title type="html"><![CDATA[force serial console on an HP apollo 715/50 workstation]]></title>
    <summary type="html"><![CDATA[I made the error of setting the console path to graphics in the BOOT_ADMIN console of an old HP apollo 715/50 workstation with no monitor connected (or at least none that is able to detect the system's VGA signal).<br />
<br />
On more recent HP 9000 hardware, it seems to be possible to reset the console path to serial by pressing the TOC button after powering on with no keyboard and monitor connected, but as the <a class="wiki external"  title="External link" href="https://wiki.netbsd.org/ports/hppafaq/#index1h1" rel="external nofollow">NetBSD/hppa FAQ</a> <a class="wikicache" target="_blank" href="tiki-view_cache.php?url=https%3A%2F%2Fwiki.netbsd.org%2Fports%2Fhppafaq%2F%23index1h1">(cache)</a> sais, this has no effect on a 715.<br />
<br />
As it turns out, there is another way though, and I haven't seen it documented anywhere: The 715/50 has a monitor selection switch for its onboard graphics adapter. It has one setting (both switches on SW1 down) that is labeled as <em>15" Color (Model 715/33 only)</em> in the service manual.<br />
<br />
With this setting, the system comes up with serial A as default with 9600/8/n/1, and it's possible to interrupt the boot process with &lt;ESC&gt;, select &lt;a&gt; to get into boot administration mode, and then change the console path back to serial from the BOOT_ADMIN&gt; prompt:<br />
<br />
<tt> PATH console rs232_a.9600.8.none</tt><br />
<tt> RESET</tt><br />
<br />
	<a href="tiki-download_file.php?fileId=16&display" class="internal"  data-box="box">		<img src="tiki-download_file.php?fileId=16&display"  width="300px" height="818" alt="Screenshot from the HP 715 service manual showing options for the SW1 DIP switch" class="regImage pluginImg16 img-fluid" />	</a><br />]]></summary>
    <published>2024-05-05T13:22:00+00:00</published>
    <updated>2024-05-05T13:22:00+00:00</updated>
    <link rel="alternate" type="text/html" href="https://web.gxis.de/tiki/tiki-view_blog_post.php%3FpostId%3D345"/>
    <id>https://web.gxis.de/tiki/tiki-view_blog_post.php%3FpostId%3D345</id>
    <author>
      <name>Alexander Bochmann</name>
      <email>&lt;a class="convert-mailto" href="mailto:nospam@example.com" data-encode-name="ab+wiki" data-encode-domain="st.gxis.de"&gt;ab+wiki at st.gxis.de&lt;/a&gt;</email>
    </author>
  </entry>
  <entry>
    <title type="html"><![CDATA[Windows 10 and WSL: Thousands of "HNS Container Networking" firewall rules]]></title>
    <summary type="html"><![CDATA[My main Windows 10 PC, originally installed in 2018, recently has been having strange networking problems after powering on. For example, WSL would not start for minutes, and Wireguard took ages to activate.<br />
<br />
I happened to find <a class="wiki external"  title="External link" href="https://learn.microsoft.com/en-us/windows/wsl/troubleshooting" rel="external nofollow">this general WSL troubleshooting article</a> <a class="wikicache" target="_blank" href="tiki-view_cache.php?url=https%3A%2F%2Flearn.microsoft.com%2Fen-us%2Fwindows%2Fwsl%2Ftroubleshooting">(cache)</a> on the Microsoft knowledgebase, which, about half way down, mentions possible problems with "HNS Firewall rules" and has a Powershell oneliner to remove some of those rules.<br />
<br />
No idea why this was the first thing I tried out of the many options on that page, but as it turns out, my system had over 12.000 HNS Container Networking rules:<br />
<br />
<tt> PS C:\Users\bochmann&gt; Get-NetFirewallRule -name "HNS Container Networking*" | measure | select Count</tt><br />
<tt> Count</tt><br />
<tt> -----</tt><br />
<tt> 12580</tt><br />
<br />
This seemed like a problem since there's only about 300 other firewall rules, not to mention the command took quite some time to complete.<br />
<br />
After testing on my notebook, which has a much more recent Windows install, it turns out that each reboot adds six of these rules, provided I shut down the system with a <code>shutdown /s /t 0</code> instead of using the Windows menu? Which I usually do to force a "real" shutdown and thwart fast startup...<br />
<br />
On the notebook, I just nuked all HNS firewall rules (not just those for UDP/53), to no apparent ill effect (needs to be run as Administrator):<br />
<br />
<tt> wsl --shutdown</tt><br />
<tt> Get-NetFirewallRule -Name "HNS Container Networking*" | Remove-NetFirewallRule</tt><br />
<tt> hnsdiag delete all</tt><br />
<tt> Restart-Service -Force hns</tt><br />
<br />
...on the other PC, Powershell tells me that the command will be running for another four hours.<br />
<br />
Now I only need to find out why this happens in the first place.<br />]]></summary>
    <published>2024-05-02T12:40:00+00:00</published>
    <updated>2024-05-02T12:40:00+00:00</updated>
    <link rel="alternate" type="text/html" href="https://web.gxis.de/tiki/tiki-view_blog_post.php%3FpostId%3D344"/>
    <id>https://web.gxis.de/tiki/tiki-view_blog_post.php%3FpostId%3D344</id>
    <author>
      <name>Alexander Bochmann</name>
      <email>&lt;a class="convert-mailto" href="mailto:nospam@example.com" data-encode-name="ab+wiki" data-encode-domain="st.gxis.de"&gt;ab+wiki at st.gxis.de&lt;/a&gt;</email>
    </author>
  </entry>
  <entry>
    <title type="html"><![CDATA[fun with Intel Bluetooth driver updates on Windows 10]]></title>
    <summary type="html"><![CDATA[I recently tried to upgrade the Windows 10 Bluetooth drivers on an ThinkPad T490 with an Intel Wireless-AC 9560 chipset from the version supplied by Lenovo (22) to the latest Intel drivers (23 - <code>BT-23.10.0-64UWD-Win10-Win11.exe</code> at this time).<br />
<br />
After installing the driver package, existing Bluetooth devices were inaccessible, and deletion from the Bluetooth settings panel was blocked ("remove failed"), even after removing corresponding devices from Device Manager. Looking at the Registry, it turned out that it was also not possible to manually delete associated registry entries, which now belonged to an unknown SID. (Maybe I could have replaced ownership on those entries, but they have a bunch of subdirectories, each of which would have had to be reclaimed individually...)<br />
<br />
My solution was to uninstall the new Intel Bluetooth drivers: Windows then reinstalled the old version, and with those active, it was possible to properly delete all existing BT devices. With those cleaned away, I ran the new driver package installer another time, and re-paired all devices from scratch.<br />]]></summary>
    <published>2023-12-24T16:28:00+00:00</published>
    <updated>2023-12-24T16:28:00+00:00</updated>
    <link rel="alternate" type="text/html" href="https://web.gxis.de/tiki/tiki-view_blog_post.php%3FpostId%3D343"/>
    <id>https://web.gxis.de/tiki/tiki-view_blog_post.php%3FpostId%3D343</id>
    <author>
      <name>Alexander Bochmann</name>
      <email>&lt;a class="convert-mailto" href="mailto:nospam@example.com" data-encode-name="ab+wiki" data-encode-domain="st.gxis.de"&gt;ab+wiki at st.gxis.de&lt;/a&gt;</email>
    </author>
  </entry>
  <entry>
    <title type="html"><![CDATA[manually applying patches from GitHub]]></title>
    <summary type="html"><![CDATA[I wasn't previously aware that you can take any commit ID on the GitHub web interface and just add <code>.diff</code> to the URL to get a plain context diff that can then be applied to code existing elsewhere with good old <code>patch</code>.<br />
<br />
So it's not required to fiddle with git repos and forks and whatever to quickly apply a patch out of band (and then return to the upstream state later on with something like a <code>git checkout --force ...</code> that squashes all the local changes).<br />
<br />
Case in point: It was not initially clear when the recent Mastodon patches would be applied to the Hometown fork, but .diffs from relevant commits on the Mastodon repo applied to the code on my disk with minimal fuzz. So it was possible to quickly get into a state where my version had the most important patches without breaking the connection to Hometown upstream, and after the security fixes had landed there, I just checked that version out over my local changes.<br />]]></summary>
    <published>2023-07-09T21:35:00+00:00</published>
    <updated>2023-07-09T21:35:00+00:00</updated>
    <link rel="alternate" type="text/html" href="https://web.gxis.de/tiki/tiki-view_blog_post.php%3FpostId%3D342"/>
    <id>https://web.gxis.de/tiki/tiki-view_blog_post.php%3FpostId%3D342</id>
    <author>
      <name>Alexander Bochmann</name>
      <email>&lt;a class="convert-mailto" href="mailto:nospam@example.com" data-encode-name="ab+wiki" data-encode-domain="st.gxis.de"&gt;ab+wiki at st.gxis.de&lt;/a&gt;</email>
    </author>
  </entry>
  <entry>
    <title type="html"><![CDATA[quick notes from installing OS/2 Warp 4 way too often]]></title>
    <summary type="html"><![CDATA[I own an old Via EPIA board with a C3 CPU, and for some reason I thought casually installing OS/2 would be a good idea.<br />
<br />
<ul><li> I used install media copies from <a class="wiki external"  title="External link" href="https://winworldpc.com/product/os-2-warp-4/os-2-warp-40" rel="external nofollow">WinWorld</a>
<ul><li> I have German language install media in original packaging, but turning up all the patch sets in German was too much effort, and a mixed-language OS is annoying
</li><li> for some reason, the updated partitioning tool from the OS/2 Warp 4.52 installer failed on the IDE-to-SDcard adapter I was using
</li><li> (after lots of tries I ditched that storage solution and used an actual IDE disk - somehow boot sector and partition table kept getting lost when using the SD adapter?)
</li><li> fdisk from OS/2 Warp 4 worked without problems?
</li></ul></li><li> in BIOS setup, configure "LBA" addressing scheme for the HDD
</li><li> OS/2 Warp 4 install CD is not bootable, you need install floppies (and a floppy drive)
<ul><li> the installer has no USB support, and USB floppy drives are not an option (even though elstel.org, linked below, claims that booting from an USB floppy should work)
</li><li> (maybe some Via BIOS bug or something?)
</li><li> downloaded patched install disks from <a class="wiki external"  title="External link" href="https://www.elstel.org/OS2Warp/InstallUpdate.html#Introduction" rel="external nofollow">elstel.org</a> <a class="wikicache" target="_blank" href="tiki-view_cache.php?url=https%3A%2F%2Fwww.elstel.org%2FOS2Warp%2FInstallUpdate.html%23Introduction">(cache)</a> (those with Dani's IDE driver, last option in the list)
</li><li> note these are the install disks, you also need a boot disk (I, uh, don't remember which one I used?)
</li><li> also note that elstel.org links to patched bootable OS/2 Warp 4 install CDs (didn't try those)
</li></ul></li><li> since the CDROM isn't bootable, I ended up using an SCSI drive behind a LSI/NCR/Symbios Logic 53C810 PCI SCSI card
<ul><li> there are many releases of the 53C810 driver, but <a class="wiki external"  title="External link" href="https://www.os2site.com/sw/drivers/scsi/index.html" rel="external nofollow">symbios406.zip from os2site.com</a> was the newest one that worked for me with the Warp 4 install disks (versions newer than 4.0.x will hang, older versions may report unknown firmware)
</li><li> the 53C810 driver doesn't fit on the first install disk
</li><li> do not delete unneeded driver files from the install disk, instead truncate them (also mentioned on elstel.org)
</li><li> copying additional drivers from the install disks will fail when files are missing (will updating snoop.lst help?)
</li></ul></li><li> do not use quick install, it will create a FAT partition (instead of HPFS)
</li><li> 2GB HPFS install partition is fine
</li><li> the EPIA C3 board has a 10/100 Via Rhine II, <a class="wiki external"  title="External link" href="https://www.os2site.com/sw/drivers/network/via/index.html" rel="external nofollow">drivers on os2site</a>, copy to an empty disk to install when enabling the TCP/IP stack
</li><li> Via Soundblaster emulation (when enabled in the BIOS) is a Soundblaster Pro
</li><li> after installation, I used <a class="wiki external"  title="External link" href="https://archive.org/details/warp-4-fixpacks" rel="external nofollow">this patchset from archive.org</a> (note installation order mentioned in the TEXT file that's an additional download)
<ul><li> has FP17, TCPIP 4.3 and the MPTS updates, Java runtime (not JDK), Netscape Navigator, Scitech SNAP with the "free" code
</li></ul></li></ul><br />]]></summary>
    <published>2023-06-18T19:27:00+00:00</published>
    <updated>2023-06-18T19:27:00+00:00</updated>
    <link rel="alternate" type="text/html" href="https://web.gxis.de/tiki/tiki-view_blog_post.php%3FpostId%3D341"/>
    <id>https://web.gxis.de/tiki/tiki-view_blog_post.php%3FpostId%3D341</id>
    <author>
      <name>Alexander Bochmann</name>
      <email>&lt;a class="convert-mailto" href="mailto:nospam@example.com" data-encode-name="ab+wiki" data-encode-domain="st.gxis.de"&gt;ab+wiki at st.gxis.de&lt;/a&gt;</email>
    </author>
  </entry>
  <entry>
    <title type="html"><![CDATA[Home Assistant Energy dashboard corruption]]></title>
    <summary type="html"><![CDATA[I use a sensor running Tasmota that reads data from my utility meter to graph the energy consumption in Home Assistant. This has been working mostly fine until I experimentally added a solar panel recently: It now has happened twice that the Energy dashboard in Home Assistant has shown an absurd value that's near or around the total consumption, instead of the difference to the previous measurement.<br />
<br />
After finding <a class="wiki external"  title="External link" href="https://github.com/home-assistant/core/issues/54946#issuecomment-987985543" rel="external nofollow">this post on the issue tracker</a> <a class="wikicache" target="_blank" href="tiki-view_cache.php?url=https%3A%2F%2Fgithub.com%2Fhome-assistant%2Fcore%2Fissues%2F54946%23issuecomment-987985543">(cache)</a>, I'm moderately certain the underlying issue is that my sensor definition is using <code>state_class: total_increasing</code>, which gets reset if the measurement value is ever decreasing. Now in theory the utility meter counter shouldn't allowed to be decreasing, but it's not impossible it has the wrong configuration. I have now changed the setting to <code>state_class: total</code> (which will also make it possible to track if that's actually the problem I'm having).<br />
<br />
After the first time this error showed up, I found a <a class="wiki external"  title="External link" href="https://community.home-assistant.io/t/how-to-fix-statistics-data-e-g-energy-data/360966" rel="external nofollow">post that tells how to fix wrong values in the Home Assistant sqlite database</a> <a class="wikicache" target="_blank" href="tiki-view_cache.php?url=https%3A%2F%2Fcommunity.home-assistant.io%2Ft%2Fhow-to-fix-statistics-data-e-g-energy-data%2F360966">(cache)</a>:<br />
<ul><li> retrieve database ID of the sensor from the <code>statistics_meta</code> table
</li><li> look at data for that ID in the <code>statistics</code> table
</li><li> update <code>statistics</code> and <code>statistics_short_term</code> with correct data

</li></ul><br />In my case, I only have one Tasmota sensor, so using the sqlite3 shell a<br />
<tt> select * from statistics_meta where statistic_id like '&#037;tasmota&#037;';</tt><br />
gave me the id of the sensor (9).<br />
<br />
Then I just ran<br />
<tt> select id,state,sum from statistics where metadata_id = 9;</tt><br />
and paged back through the returned values to find any irregularities. Since the error had occurred recently, it was easy to visually identify the point where the sum value jumped up.<br />
<br />
After calculating the offset to get the next increment from the correct sum, I updated the sum data for all rows that had the wrong value:<br />
<tt> update statistics set sum = sum - 8654.0847 where metadata_id == 9 and id &gt;= 143546;</tt><br />
<br />
...and then I applied the same offset to the values in statistics_short_term, which were all wrong:<br />
<tt>  update statistics_short_term set sum = sum - 8654.0847 where metadata_id == 9;</tt><br />
<br />
This still leaves me with the same corruption in the cost data that's calculated from the energy usage, but since I don't use that information, I just ignored this detail.<br />]]></summary>
    <published>2023-06-17T16:33:00+00:00</published>
    <updated>2023-06-17T16:33:00+00:00</updated>
    <link rel="alternate" type="text/html" href="https://web.gxis.de/tiki/tiki-view_blog_post.php%3FpostId%3D340"/>
    <id>https://web.gxis.de/tiki/tiki-view_blog_post.php%3FpostId%3D340</id>
    <author>
      <name>Alexander Bochmann</name>
      <email>&lt;a class="convert-mailto" href="mailto:nospam@example.com" data-encode-name="ab+wiki" data-encode-domain="st.gxis.de"&gt;ab+wiki at st.gxis.de&lt;/a&gt;</email>
    </author>
  </entry>
  <entry>
    <title type="html"><![CDATA[H.264/AAC in Vivaldi on arm64 Raspberry Pi OS]]></title>
    <summary type="html"><![CDATA[The <a class="wiki external"  title="External link" href="https://vivaldi.com/" rel="external nofollow">Vivaldi</a> web browser has <a class="wiki external"  title="External link" href="https://downloads.vivaldi.com/stable/vivaldi-stable_5.3.2679.61-1_arm64.deb" rel="external nofollow">an arm64 version</a> that runs on the recently released <a class="wiki external"  title="External link" href="https://www.raspberrypi.com/software/operating-systems/#raspberry-pi-os-64-bit" rel="external nofollow">arm64 port of Raspberry Pi OS</a>. Unfortunately, out of the box, this version doesn't support a lot of media formats, and relies - same as Chromium, which Vivaldi is built on - on an external decoder library for some of them.<br />
<br />
Now the Vivaldi distribution comes with a downloader script for that shared library at <code>/opt/vivaldi/update-ffmpeg</code>. As of right now, the script doesn't find a valid file for arm64 though. Looking at the code, it fetches a custom version of a Debian/Ubuntu package for <code>chromium-codecs-ffmpeg-extra</code> from Launchpad. As it turns out, Raspberry Pi OS ships an own version of exactly that deb, which installs a version of the required library to <code>/usr/lib/chromium-browser/libffmpeg.so</code>. This is great, except that it's not a place where Vivaldi looks for the file.<br />
<br />
Vivaldi itself is started through an own wrapper script that's installed to <code>/usr/bin/vivaldi</code>. The wrapper has a few places where it tries to LD_PRELOAD a matching libffmpeg.so from, one of which is a custom location below the current user's ~/.local/ directory, involving the checksum of the expected library version. Luckily, the checksum is not actually checked - it's just used as part of the directory name.<br />
<br />
So I came up with the following one-liner to create that directory for the current user and drop a symlink to Raspbian's chromium codec file:<br />
<br />
<tt> grep -A1 arm64 /usr/bin/vivaldi | awk -F'=' '/FFMPEG_SUM_DEB/ { cmd="mkdir -p ~/.local/lib/vivaldi/media-codecs-"$2" ; ln -s /usr/lib/chromium-browser/libffmpeg.so ~/.local/lib/vivaldi/media-codecs-"$2"/libffmpeg.so" ; system(cmd) }'</tt><br />
<br />
This fetches a few candidate lines from the Vivaldi startup wrapper, finds the one that has the required checksum, and runs it through awk to create directory and symlink.<br />
<br />
I have not yet tried to find out if the expected checksum changes between Vivaldi versions, but unless there's a major change in <code>/usr/bin/vivaldi</code>, I can just run the command again to create a new directory in the required location.<br />
<br />
Note this doesn't provide Widevine or other DRM codecs, but at least I can now play back videos that have been reencoded to H.264/AAC by Mastodon.<br />
<br />
(I have pretty much the same information over <a class="wiki external"  title="External link" href="https://mastodon.infra.de/@galaxis/108568316483657562" rel="external nofollow">in a Fediverse thread</a>, including a reply from Vivaldi that said the libffmeg download link is usually updated by them in time, and my hack shouldn't be required.)<br />]]></summary>
    <published>2022-07-01T21:51:00+00:00</published>
    <updated>2022-07-01T21:51:00+00:00</updated>
    <link rel="alternate" type="text/html" href="https://web.gxis.de/tiki/tiki-view_blog_post.php%3FpostId%3D339"/>
    <id>https://web.gxis.de/tiki/tiki-view_blog_post.php%3FpostId%3D339</id>
    <author>
      <name>Alexander Bochmann</name>
      <email>&lt;a class="convert-mailto" href="mailto:nospam@example.com" data-encode-name="ab+wiki" data-encode-domain="st.gxis.de"&gt;ab+wiki at st.gxis.de&lt;/a&gt;</email>
    </author>
  </entry>
  <entry>
    <title type="html"><![CDATA[Debian bullseyse / Devuan chimaera openssl minimum TLS version]]></title>
    <summary type="html"><![CDATA[I recently spent way too much time trying to find out why my mail server wasn't able to send mail to a system that apparently only supported TLSv1. None of the TLS options in the sendmail configuration made any difference.<br />
<br />
Things started to click only after I noticed that connecting to the system in question via openssl s_client produced the same error message:<br />
<br />
<pre>
&gt; openssl s_client -connect mail.some.domain:25 -starttls smtp
CONNECTED(00000003)
139770261177664:error:1425F102:SSL routines:ssl_choose_client_version:unsupported 
protocol:../ssl/statem/statem_lib.c:1957:
</pre><br />
As it turns out, <code>/etc/ssl/openssl.cnf</code> in current Debian / Devuan has the following global configuration settings:<br />
<br />
<pre>
[system_default_sect]
MinProtocol = TLSv1.2
CipherString = DEFAULT@SECLEVEL=2
</pre><br />
So yeah, anything using openssl that doesn't explicitly override that configuration will not be able to make TLS connections to systems that don't support TLSv1.2...<br />
<br />
Changing the settings to <code>MinProtocol = TLSv1</code> made it possible to deliver my mail.<br />
<br />]]></summary>
    <published>2022-04-23T13:29:00+00:00</published>
    <updated>2022-04-23T13:29:00+00:00</updated>
    <link rel="alternate" type="text/html" href="https://web.gxis.de/tiki/tiki-view_blog_post.php%3FpostId%3D338"/>
    <id>https://web.gxis.de/tiki/tiki-view_blog_post.php%3FpostId%3D338</id>
    <author>
      <name>Alexander Bochmann</name>
      <email>&lt;a class="convert-mailto" href="mailto:nospam@example.com" data-encode-name="ab+wiki" data-encode-domain="st.gxis.de"&gt;ab+wiki at st.gxis.de&lt;/a&gt;</email>
    </author>
  </entry>
  <entry>
    <title type="html"><![CDATA[network interfaces renamed following Proxmox 7 upgrade]]></title>
    <summary type="html"><![CDATA[After upgrading my standalone Proxmox host from PVE 6 to 7, the interface names were suddenly changed back from "predictable" to the old ethX names. The setup is Proxmox on Debian, so when I initially set up the system, I manually installed Debian 10 first and then added the Proxmox 6 repositories and packages.<br />
<br />
After some debugging it turned out there was an old systemd network configuration file that prevented systemd-udevd from starting up correctly:<br />
<br />
<pre>
systemd-udevd[xxxx]: /etc/systemd/network/99-default.link: No valid settings found in the [Match] section, ignoring file. To match all interfaces, add OriginalName=* in the [Match] section.
</pre><br />
I currently have no idea where the file <em>/etc/systemd/network/99-default.link</em> originated from (it doesn't have a package owner after the upgrade), but apparently it contains an invalid syntax for the systemd-udevd in Debian Bullseye. Removing the file solved the problem, and I'm now back to the interface names in the ifupdown2 configuration used by Proxmox (I rebooted the system to be sure it comes up in the right way now).<br />]]></summary>
    <published>2021-11-24T21:32:00+00:00</published>
    <updated>2021-11-24T21:32:00+00:00</updated>
    <link rel="alternate" type="text/html" href="https://web.gxis.de/tiki/tiki-view_blog_post.php%3FpostId%3D337"/>
    <id>https://web.gxis.de/tiki/tiki-view_blog_post.php%3FpostId%3D337</id>
    <author>
      <name>Alexander Bochmann</name>
      <email>&lt;a class="convert-mailto" href="mailto:nospam@example.com" data-encode-name="ab+wiki" data-encode-domain="st.gxis.de"&gt;ab+wiki at st.gxis.de&lt;/a&gt;</email>
    </author>
  </entry>
  <entry>
    <title type="html"><![CDATA[Mac Mini early 2009 temperature sensor placement]]></title>
    <summary type="html"><![CDATA[I noticed that the old Mac Mini I reinstalled with Linux (a longer story involving the <a class="wiki external"  title="External link" href="http://www.rodsbooks.com/refind/" rel="external nofollow">rEFInd Boot Manger</a>) was running quite hot as soon as it got a bit busy. After installing and (auto-)configuring lm-sensors it turned out the fan was running at low speed despite the high temperatures.<br />
<br />
I had at some point replaced the SSD I had in there (instead of the original SATA disk) with a different model. There's a temperature sensor glued to the front of the disk, which is a feed to the automatic fan speed management. The original disk (and the older SSD) had a metal casing, which acted as a heat transport to the sensor. The new SSD is enclosed in plastic instead, and while I put the sensor to the same position, it never measured the temperatures required to spin up the system fan.<br />
<br />
For now, I ended up placing the sensor to the rear on top of the shielding of the Wifi module instead (the chipset heat sink didn't seem like a good idea). This seems to work well enough, and the fan now actually turns up when required:<br />
<br />
<pre>
$ sensors
applesmc-isa-0300
Adapter: ISA adapter
Master :     2424 RPM  (min = 1500 RPM, max = 5500 RPM)
TC0D:         +46.2°C  
TC0H:         +45.8°C  
TC0P:         +47.0°C  
TH0P:         +59.5°C  
TN0D:         +68.8°C  
TN0P:         +57.5°C  
TW0P:         +56.5°C  
Tm0P:        -128.0°C  

nouveau-pci-0200
Adapter: PCI adapter
temp1:        +68.0°C  (high = +95.0°C, hyst =  +3.0°C)
                       (crit = +100.0°C, hyst =  +2.0°C)
                       (emerg = +135.0°C, hyst =  +5.0°C)

coretemp-isa-0000
Adapter: ISA adapter
Core 0:       +44.0°C  (high = +105.0°C, crit = +105.0°C)
Core 1:       +46.0°C  (high = +105.0°C, crit = +105.0°C)
</pre><br />
<br />]]></summary>
    <published>2021-08-11T19:12:00+00:00</published>
    <updated>2021-08-11T19:12:00+00:00</updated>
    <link rel="alternate" type="text/html" href="https://web.gxis.de/tiki/tiki-view_blog_post.php%3FpostId%3D336"/>
    <id>https://web.gxis.de/tiki/tiki-view_blog_post.php%3FpostId%3D336</id>
    <author>
      <name>Alexander Bochmann</name>
      <email>&lt;a class="convert-mailto" href="mailto:nospam@example.com" data-encode-name="ab+wiki" data-encode-domain="st.gxis.de"&gt;ab+wiki at st.gxis.de&lt;/a&gt;</email>
    </author>
  </entry>
  <entry>
    <title type="html"><![CDATA[42!]]></title>
    <summary type="html"><![CDATA[Heute bei <a class="wiki external"  title="External link" href="http://mm-leckerbar.de/" rel="external nofollow">mm! in der Nussmanstraße</a>: Die Antwort auf die Frage nach dem Leben, dem Universum, und dem ganzen Rest. Leider auch ohne die Frage. Aber mit hervorragender Waffel und gutem Kaffee.<br />
<br />
<div style="display: inline-block; float:left; margin-right:5px; max-width: 100%; width:802px; height:602px">	<a href="tiki-download_file.php?fileId=17&display" class="internal"  data-box="box">		<img src="tiki-download_file.php?fileId=17&display"  width="800" height="600" alt="Normal P1010428 Small" class="regImage pluginImg17 img-fluid" />	</a></div><br />]]></summary>
    <published>2021-05-08T15:38:00+00:00</published>
    <updated>2021-05-08T15:38:00+00:00</updated>
    <link rel="alternate" type="text/html" href="https://web.gxis.de/tiki/tiki-view_blog_post.php%3FpostId%3D131"/>
    <id>https://web.gxis.de/tiki/tiki-view_blog_post.php%3FpostId%3D131</id>
    <author>
      <name>Alexander Bochmann</name>
      <email>&lt;a class="convert-mailto" href="mailto:nospam@example.com" data-encode-name="ab+wiki" data-encode-domain="st.gxis.de"&gt;ab+wiki at st.gxis.de&lt;/a&gt;</email>
    </author>
  </entry>
  <entry>
    <title type="html"><![CDATA[WireGuard on the OpenPandora]]></title>
    <summary type="html"><![CDATA[<h3 class="showhide_heading" id="introduction"> introduction</h3>
<a class="wiki external"  title="External link" href="https://www.wireguard.com" rel="external nofollow">WireGuard</a> is a VPN system built on modern cryptography that provides for a comparatively simple setup and uses UDP as a transport, with moderate overhead. It "just works" for road warrior setups where one end doesn't have a stable address.<br />
<br />
The <a class="wiki external"  title="External link" href="https://www.openpandora.org" rel="external nofollow">OpenPandora</a> <a class="wikicache" target="_blank" href="tiki-view_cache.php?url=https%3A%2F%2Fwww.openpandora.org">(cache)</a> is an ARM Linux pocket computer, first released around 2010, that uses an ancient <a class="wiki external"  title="External link" href="https://en.wikipedia.org/wiki/%C3%85ngstr%C3%B6m_distribution" rel="external nofollow">OpenEmbedded Ångström</a> as base OS, with an Linux 3.2 kernel that has quite a few device-specific modules that never were upstreamed.<br />
<br />
A couple of weeks ago, I decided to try to combine the two, provided I wouldn't turn out as too much of an effort. With that in mind, I looked at the <a class="wiki external"  title="External link" href="https://git.zx2c4.com/wireguard-go/about/" rel="external nofollow">wireguard-go</a> userspace implementation instead of attempting the make the WireGuard linux-compat kernel module build against the outdated OpenPandora kernel.<br />
<br />
Setting up a tunnel requires two WireGuard components:<br />
<br />
<ol><li> a WireGuard protocol implementation (like the kernel module or wireguard-go)
</li><li> a version of <a class="wiki external"  title="External link" href="https://git.zx2c4.com/wireguard-tools/about/" rel="external nofollow">wireguard-tools</a> that is used to provide a configuration to WireGuard

</li></ol><br />As for wireguard-go, I made a short attempt at trying to build golang on the Pandora itself, but hit the "too much effort" barrier pretty quickly. Fortunately, golang now provides for cross-compiling to supported platforms - but the Pandora is not one of those: The Pandora OS (SuperZaxxon) is built with the outdated "softfp" ARM binary ABI, which is backwards-compatible with ARM CPUs that don't have floating-point hardware, but actually is capable to use vfp and NEON in the backend, if supported by the compiler. The workaround here is to crosscompile with ARMv5 as target architecture, which produces a pure software floating point executable (that also works on softfp by design).<br />
<br />
<h3 class="showhide_heading" id="cross-building_wireguard-go"> cross-building wireguard-go</h3>
I built wireguard-go on a Debian Buster host, and since buster-backports only provides go1.14, I couldn't use the most recent version (which currently requires go1.16): Went with <a class="wiki external"  title="External link" href="https://git.zx2c4.com/wireguard-go/tag/?h=0.0.20210212" rel="external nofollow">wireguard-go 0.0.20210212</a> instead.<br />
<br />
After checking out or unpacking the sources, building a binary is a simple matter of running make with the appropriate environment parameters:<br />
<br />
<pre>env GOOS=linux GOARCH=arm GOARM=5 make</pre><br />
Just copy the resulting <em>wireguard-go</em> over to <em>/usr/local/bin</em> on your Pandora and make it executable.<br />
<br />
<h3 class="showhide_heading" id="compiling_wireguard-tools"> compiling wireguard-tools</h3>
wireguard-tools has only a small set of build dependencies, the most important of which unfortunately isn't even mentioned: On Linux, you need a copy of the kernel headers that roughly matches the destination kernel.<br />
<br />
Turns out that SuperZaxxon only ships the include files for the initial kernel (2.6), but not those for the last available kernel build. Also Linux 2.6 apparently doesn't provide some required functions, so my first attempt failed.<br />
<br />
I ended up downloading the <a class="wiki external"  title="External link" href="http://git.openpandora.org/cgi-bin/gitweb.cgi?p=pandora-kernel.git;a=tree;h=refs/heads/pandora-3.2;hb=refs/heads/pandora-3.2" rel="external nofollow">latest 3.2 kernel sources</a> from the OpenPandora git.<br />
<br />
When I compile software on the Pandora, I usually first try to use the <a class="wiki external"  title="External link" href="http://repo.openpandora.org/?page=detail&amp;app=cdevtools.freamon.40n8e" rel="external nofollow">cdevtools PND</a> - it has an older gcc, but is generally more leightweight than the other option (<a class="wiki external"  title="External link" href="http://repo.openpandora.org/?page=detail&amp;app=codeblocks6022" rel="external nofollow">Code::Blocks</a>). So I start cdevtools, make a <em>src/wireguard</em> directory, and then download and unpack both wireguard-tools and the Pandora kernel sources in there.<br />
<br />
In the wireguard-tools directory, go to <em>src/</em> and run something like this:<br />
<pre>env CFLAGS="-I`pwd`/../../pandora-kernel-pandora-3.2-c4c68a4/include -Os -mtune=cortex-a8 -mcpu=cortex-a8 -mfpu=neon -mfloat-abi=softfp -pipe" make</pre><br />
...and then, to install the resulting programs below /usr/local:<br />
<pre>sudo env PREFIX=/usr/local WITH_WGQUICK=yes WITH_SYSTEMDUNITS=no make install</pre><br />
<h3 class="showhide_heading" id="Pandora_caveats"> Pandora caveats</h3>
<ul><li> SuperZaxxon does not autoload the <em>tun</em> module, so <em>/dev/net/tun</em> doesn't exist. (Ironically, it would be loaded if /dev/net/tun did exist and then something tried to access the device...)
</li><li> wg-quick uses some fancy bash i/o redirection which requires <em>/dev/fd</em>. Which is not there on the Pandora either, but it's easy to create, since it's just a symlink to <em>/proc/self/fd</em>.
</li><li> <strong>Do not use a VPN interface name that starts with "w"</strong> (like the default of wg0)! It triggers bugs in other scripts on the OpenPandora, for example loading of the WiFi firmware will fail after a resume from sleep.
</li><li> Add <em>/usr/local/bin</em> to the PATH of root so the binaries are found in their directory.
</li><li> A couple of the advanced wg-quick functions fail, mostly due to missing or outdated tools. One that I encountered was changing nameservers, but I assume anything the makes changes to the firewall configuration will be broken too. I did not try calling external commands from the wg-quick config file yet (which might serve as a workaround for some uses).
</li><li> Basic setup of a v4 tunnel with several routes has been tested successfully.
</li><li> IPv6 is completely untested.

</li></ul><br />I wrote a small wrapper script that creates a suitable environment for wg-quick invocation that's included as <em>/usr/local/bin/wg-pandora</em> in the tar file below:<br />
<pre>
#!/bin/sh

if [ `id -u` -ne "0" ]; then
  echo "[!] script needs to be run as root, use su oder sudo"
  exit 1
fi

if [ "$1" == "" ]; then
  echo "[!] please use the VPN interface name as parameter"
  echo "NOTE: do not use any device names starting with \"w...\" -"
  echo "      it will prevent Wifi reconfiguration on SuperZaxxon."
  exit 1
fi

if [ ! -f /etc/wireguard/$1.conf ]; then
  echo "[!] please create /etc/wireguard/$1.conf with a valid wg-quick configuration"
  exit 1
fi

if [ ! -e /dev/net/tun ]; then
  echo "[+] load tun kernel module"
  modprobe tun
fi

if [ ! -e /dev/fd ]; then
  echo "[+] create missing /dev/fd symlink"
  ln -s /proc/self/fd /dev/fd
fi

echo "[+] launching wg-quick"
/usr/local/bin/wg-quick up "$1"

exit 0
</pre><br />
<h3 class="showhide_heading" id="installation"> installation</h3>
<ul><li> Download <a class="wiki external"  title="External link" href="https://web.gxis.de/files/wireguard-pandora-20210502.tar.gz" rel="external nofollow">wireguard-pandora-20210502.tar.gz</a> and unpack to the root directory: <pre>tar -C/ -xpf wireguard-pandora-20210502.tar.gz</pre>
</li><li> Create a <a class="wiki external"  title="External link" href="https://git.zx2c4.com/wireguard-tools/about/src/man/wg-quick.8" rel="external nofollow">wg-quick</a> <a class="wikicache" target="_blank" href="tiki-view_cache.php?url=https%3A%2F%2Fgit.zx2c4.com%2Fwireguard-tools%2Fabout%2Fsrc%2Fman%2Fwg-quick.8">(cache)</a> configuration in <em>/etc/wireguard</em> (man pages are included in the download, but <em>man</em> is not installed on the Pandora by default).
</li><li> Run <em>/usr/local/bin/wg-pandora &lt;if-name&gt;</em>. (Remember the note about interface names.)
</li><li> You will need an existing WireGuard endpoint to connect to ;)
</li><li> Manual setup using <em>wg</em> (see <a class="wiki external"  title="External link" href="https://www.wireguard.com/quickstart/" rel="external nofollow">WireGuard quickstart</a>) is also possible, as soon as the <em>tun</em> module has been loaded and wireguard-go is running.
</li><li> There's a <a class="wiki external"  title="External link" href="https://pyra-handheld.com/boards/threads/wireguard-vpn-wip.99422/" rel="external nofollow">discussion thread over on the OpenPandora forums</a>.

</li></ul><br />]]></summary>
    <published>2021-05-02T19:30:00+00:00</published>
    <updated>2021-05-02T19:30:00+00:00</updated>
    <link rel="alternate" type="text/html" href="https://web.gxis.de/tiki/tiki-view_blog_post.php%3FpostId%3D335"/>
    <id>https://web.gxis.de/tiki/tiki-view_blog_post.php%3FpostId%3D335</id>
    <author>
      <name>Alexander Bochmann</name>
      <email>&lt;a class="convert-mailto" href="mailto:nospam@example.com" data-encode-name="ab+wiki" data-encode-domain="st.gxis.de"&gt;ab+wiki at st.gxis.de&lt;/a&gt;</email>
    </author>
  </entry>
  <entry>
    <title type="html"><![CDATA[hiding device type from the user agent in Vivaldi on Android]]></title>
    <summary type="html"><![CDATA[I recently noticed that the <a class="wiki external"  title="External link" href="https://vivaldi.com/android/" rel="external nofollow">Vivaldi browser for Android</a> adds the OS version and the type of the device being used to the user agent string sent to web servers.<br />
<br />
It is possible to disable this behaviour in one of the advanced flags though, by opening <strong>vivaldi://flags</strong> from the address bar, and searching for the <strong>freeze-user-agent</strong> flag. When this setting is enabled, Vivaldi will always use "<em>Android 9; Unspecified Device</em>" in the browser user agent.<br />
<br />
	<a href="tiki-download_file.php?fileId=15&display" class="internal"  data-box="box">		<img src="tiki-download_file.php?fileId=15&display"  width="500" height="301" alt="11af2a2dc3b503db" class="regImage pluginImg15 img-fluid" />	</a><br />]]></summary>
    <published>2021-05-02T13:03:00+00:00</published>
    <updated>2021-05-02T13:03:00+00:00</updated>
    <link rel="alternate" type="text/html" href="https://web.gxis.de/tiki/tiki-view_blog_post.php%3FpostId%3D334"/>
    <id>https://web.gxis.de/tiki/tiki-view_blog_post.php%3FpostId%3D334</id>
    <author>
      <name>Alexander Bochmann</name>
      <email>&lt;a class="convert-mailto" href="mailto:nospam@example.com" data-encode-name="ab+wiki" data-encode-domain="st.gxis.de"&gt;ab+wiki at st.gxis.de&lt;/a&gt;</email>
    </author>
  </entry>
  <entry>
    <title type="html"><![CDATA[kurzer Blick auf den Raspberry Pi 400]]></title>
    <summary type="html"><![CDATA[Vor zwei Wochen habe ich mir einen <a class="wiki external"  title="External link" href="https://www.raspberrypi.org/products/raspberry-pi-400/" rel="external nofollow">Raspberry Pi 400</a> <a class="wikicache" target="_blank" href="tiki-view_cache.php?url=https%3A%2F%2Fwww.raspberrypi.org%2Fproducts%2Fraspberry-pi-400%2F">(cache)</a> bestellt, um mir anzuschauen, ob das System als einfacher Desktop PC - Ersatz brauchbar ist.<br />
<br />
	<a href="tiki-download_file.php?fileId=14&display" class="internal"  data-box="box">		<img src="tiki-download_file.php?fileId=14&display"  width="400" height="400" alt="30b2e2077c16b8c5" class="regImage pluginImg14 img-fluid" />	</a><br />
<br />
Viel Zeit habe ich damit bisher nicht zugebracht, aber die ersten Eindrücke sind nicht sehr positiv. Hier meine aktuellen Notizen dazu:<br />
<br />
<ul><li> Hardware
<ul><li> Die mitgelieferte SD-Karte ist langsam. Ich habe das Raspberry OS zum Vergleich auf einem kleinen USB3-Stick installiert - dort sind Schreibzugriffe geringfügig schneller, und Lesezugriffe mehr als doppelt so schnell. Boot und Installation von einem USB-Gerät funktioniert mit Raspberry OS immerhin problemlos (mit alternativen Installern wie NOOBS allerdings nicht).
</li><li> WLAN ist fast unbrauchbar. Auf meinem Arbeitstisch, ein paar Meter (und zwei Wände) vom nächsten Repeater entfernt, bekommt der Pi 400 keine 5GHz Verbindung, und 2.4GHz ist absolut an der Grenze. Beim Download der Updates beim Abschluss des Installers ist die Verbindung mehrfach abgebrochen. Die Fritzbox auf der anderen Seite meldet Verbindungen vom Pi mit maximal 26mbit/s, meistens darunter.Ich habe kein anderes Gerät mit derart schwachem Wifi - selbst meine alte OpenPandora-Console ist da noch besser. Der Pi 400 muss praktisch direkt neben einem Access Point oder Repeater verwendet werden.
</li><li> Tastatur prellt manchmal, aber vielleicht gibt sich das nach längerem Gebrauch.
</li><li> Die Tasten der mitgelieferten Maus sind am Anfang etwas schwergängig, aber das wird schnell besser (oder ich habe mich schon dran gewöhnt).

</li></ul></li><li> Software
<ul><li> Es ist sehr einfach, sich direkt beim Setup zu verheddern: Wenn Deutsch als Default-Sprache und Systemumgebung eingestellt ist, aber darunter die Option "use English language" ausgewählt wird, wird auch die Tastaturbelegung ohne Warnung auf Englisch zurückgesetzt. Eine Kombination aus englischer Systemsprache und deutscher Tastaturbelegung lässt sich erst nach Abschluss des Setups einstellen.
</li><li> Die deutsche Lokalisierung ist eher unvollständig - auch mit deutscher Spracheinstellung bleibt der Raspberry OS - Installer komplett auf englisch. Die anderen Konfigurationsprogramme sind ebenfalls nur teilweise übersetzt (Anwendungen habe ich nicht weiter ausprobiert.
</li><li> Es werden keine Tools installiert, die bei der Erstellung zusätzlicher Benutzeraccounts unterstützen. Per Default wird der Standardbenutzer "pi" automatisch angemeldet. Das ist für andere Raspberries, die als Experimentier- und Lernplattform genutzt werden, erstmal ok - aber bei einem Desktop-PC, der unter Umständen von mehreren Leuten im Haushalt genutzt werden soll, nicht mehr.
</li></ul></li></ul><br />]]></summary>
    <published>2021-01-24T15:38:00+00:00</published>
    <updated>2021-01-24T15:38:00+00:00</updated>
    <link rel="alternate" type="text/html" href="https://web.gxis.de/tiki/tiki-view_blog_post.php%3FpostId%3D333"/>
    <id>https://web.gxis.de/tiki/tiki-view_blog_post.php%3FpostId%3D333</id>
    <author>
      <name>Alexander Bochmann</name>
      <email>&lt;a class="convert-mailto" href="mailto:nospam@example.com" data-encode-name="ab+wiki" data-encode-domain="st.gxis.de"&gt;ab+wiki at st.gxis.de&lt;/a&gt;</email>
    </author>
  </entry>
  <entry>
    <title type="html"><![CDATA[Apache httpd, reverse proxy, and caching]]></title>
    <summary type="html"><![CDATA[There's tons of guides out there on either how to set up Apache httpd as a <a class="wiki external"  title="External link" href="https://httpd.apache.org/docs/2.4/mod/mod_proxy.html" rel="external nofollow">reverse proxy</a>, or how to enable <a class="wiki external"  title="External link" href="https://httpd.apache.org/docs/2.4/mod/mod_cache.html" rel="external nofollow">(disk) caching</a> for content being served.<br />
<br />
The web has surprisingly little information on how to combine both in a working manner, and to have Apache cache content that's being retrieved from a proxied backend.<br />
<br />
Just using the default configuration and then dropping something like a <code>CacheEnable disk</code> into the <code>&lt;Location ...&gt;</code> that holds your proxy rules will not work: Nothing ever is written to the cache directory.<br />
<br />
With debug logging you see either nothing at all or maybe a quick succession of <code> AH00750: Adding CACHE_SAVE filter ..</code> and  <code>AH00751: Adding CACHE_REMOVE_URL filter ...</code> messages in the error.log<br />
<br />
So what's up? Likely your configuration is entirely correct, but you're missing one statement:<br />
<br />
<pre>CacheQuickHandler off</pre><br />
It seems that with the default of <a class="wiki external"  title="External link" href="https://httpd.apache.org/docs/2.4/mod/mod_cache.html#cachequickhandler" rel="external nofollow">CacheQuickHandler</a> being enabled, proxied content never hits the <em>quick handler phase</em> that allows it to be processed for caching.<br />
<br />
When CacheQuickHandler is disabled, everything just drops into place, though some fine tuning might be required.<br />
<br />
The current configuration for my use case of caching media for my Mastodon instance that's being retrieved from a horribly sluggish Minio backend looks like this:<br />
<br />
<pre>&lt;IfModule mod_cache_disk.c&gt;
        CacheQuickHandler off
        CacheRoot /var/cache/apache2/mod_cache_disk
        CacheMaxFileSize 10000000
        CacheDirLevels 2
        CacheDirLength 1
        CacheLock off
        CacheIgnoreCacheControl On
        CacheIgnoreQueryString On
        CacheStoreNoStore On
        CacheIgnoreHeaders Set-Cookie X-Amz-Request-Id
&lt;/IfModule&gt;</pre><br />
...and then:<br />
<br />
<pre>&lt;Location "/"&gt;
        Require all granted
        ProxyPass http://&lt;backend-address&gt;:9000/
        ProxyPassReverse http://&lt;backend-address&gt;:9000/
        &lt;IfModule mod_cache_disk.c&gt;
               CacheEnable disk
        &lt;/IfModule&gt;
&lt;/Location&gt;</pre><br />
<br />]]></summary>
    <published>2020-11-24T21:24:00+00:00</published>
    <updated>2020-11-24T21:24:00+00:00</updated>
    <link rel="alternate" type="text/html" href="https://web.gxis.de/tiki/tiki-view_blog_post.php%3FpostId%3D332"/>
    <id>https://web.gxis.de/tiki/tiki-view_blog_post.php%3FpostId%3D332</id>
    <author>
      <name>Alexander Bochmann</name>
      <email>&lt;a class="convert-mailto" href="mailto:nospam@example.com" data-encode-name="ab+wiki" data-encode-domain="st.gxis.de"&gt;ab+wiki at st.gxis.de&lt;/a&gt;</email>
    </author>
  </entry>
  <entry>
    <title type="html"><![CDATA[Shaarli]]></title>
    <summary type="html"><![CDATA[A few years ago, I set up a copy of  <a class="wiki external"  title="External link" href="https://shaarli.readthedocs.io/en/master/#shaarli" rel="external nofollow">Shaarli</a>, but ended up never using it. My initial idea was to have it as a central repository for bookmarks, but then <a class="wiki external"  title="External link" href="https://floccus.org/" rel="external nofollow">Floccus</a> showed up as a way more convenient solution for bookmark sync. I also thought about using it for sharing links with short summaries (similar to the posts on here, or on G+ before), but then the Fediverse came along and soaked up most up my online activity.<br />
<br />
I didn't really pick up the link sharing habit over there - wasn't shure about how to blend it in with my other posts. I thought about creating a second account just for that, but keeping multiple accounts is too much of a hassle for me (which also sunk the idea to use language-specific alts or fan out by general topics). Didn't go back up using Tiki either, as I do much of my reading on mobile devices nowadays, and writing Tiki posts from there is kind of annoying. With Shaarli, I can use the <a class="wiki external"  title="External link" href="https://f-droid.org/en/packages/com.dimtion.shaarlier/" rel="external nofollow">Shaarlier app</a> to quickly drop links and a short description.<br />
<br />
Not sure how this will end up in the longer run, but it's a try.<br />
<br />
<a class="wiki external"  title="External link" href="https://web.gxis.de/links/" rel="external nofollow">My Shaarli is over here</a>, and also has an own separate <a class="wiki external"  title="External link" href="https://web.gxis.de/links/?do=atom" rel="external nofollow">RSS feed</a>.<br />]]></summary>
    <published>2020-09-14T13:58:00+00:00</published>
    <updated>2020-09-14T13:58:00+00:00</updated>
    <link rel="alternate" type="text/html" href="https://web.gxis.de/tiki/tiki-view_blog_post.php%3FpostId%3D331"/>
    <id>https://web.gxis.de/tiki/tiki-view_blog_post.php%3FpostId%3D331</id>
    <author>
      <name>Alexander Bochmann</name>
      <email>&lt;a class="convert-mailto" href="mailto:nospam@example.com" data-encode-name="ab+wiki" data-encode-domain="st.gxis.de"&gt;ab+wiki at st.gxis.de&lt;/a&gt;</email>
    </author>
  </entry>
  <entry>
    <title type="html"><![CDATA[ETL2PCAPNG - convert Windows netsh trace files to PCAP]]></title>
    <summary type="html"><![CDATA[After Microsoft had deprecated the <a class="wiki external"  title="External link" href="https://docs.microsoft.com/en-us/message-analyzer/microsoft-message-analyzer-operating-guide" rel="external nofollow">Microsoft Message Analyzer</a> <a class="wikicache" target="_blank" href="tiki-view_cache.php?url=https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fmessage-analyzer%2Fmicrosoft-message-analyzer-operating-guide">(cache)</a> tool last year, there was no good way to work with network traces generated on Windows systems with the <em>netsh trace ...</em> command.<br />
<br />
Microsoft has now released <a class="wiki external"  title="External link" href="https://github.com/microsoft/etl2pcapng/" rel="external nofollow">ETL2PCAPNG</a> <a class="wikicache" target="_blank" href="tiki-view_cache.php?url=https%3A%2F%2Fgithub.com%2Fmicrosoft%2Fetl2pcapng%2F">(cache)</a>, a small program that converts ETL files to PCAPNG, see <a class="wiki external"  title="External link" href="https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/converting-etl-files-to-pcap-files/ba-p/1133297" rel="external nofollow">this announcement on the Microsoft Core Infrastructure and Security blog</a> <a class="wikicache" target="_blank" href="tiki-view_cache.php?url=https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fcore-infrastructure-and-security%2Fconverting-etl-files-to-pcap-files%2Fba-p%2F1133297">(cache)</a>, so trace files can now be processed with standard utilities like Wireshark.<br />]]></summary>
    <published>2020-02-29T11:24:00+00:00</published>
    <updated>2020-02-29T11:24:00+00:00</updated>
    <link rel="alternate" type="text/html" href="https://web.gxis.de/tiki/tiki-view_blog_post.php%3FpostId%3D330"/>
    <id>https://web.gxis.de/tiki/tiki-view_blog_post.php%3FpostId%3D330</id>
    <author>
      <name>Alexander Bochmann</name>
      <email>&lt;a class="convert-mailto" href="mailto:nospam@example.com" data-encode-name="ab+wiki" data-encode-domain="st.gxis.de"&gt;ab+wiki at st.gxis.de&lt;/a&gt;</email>
    </author>
  </entry>
  <entry>
    <title type="html"><![CDATA[25Gbit ethernet is complicated...]]></title>
    <summary type="html"><![CDATA[We just spent about a week trying to put a bunch of systems into production that had been ordered with 25Gbit fiber interfaces. We had planned to collect those on two of our Arista 7050CX3, using 100GBit QSFP28 in 4 * 25GBit mode and MPO breakout cables to 4 * LC for the 25Gbit SFP28 end. So we cable everything up, configure our LACP channels on both ends, and ... nothing. All of the links stay down.<br />
<br />
They do show a signal on the transciever though (at least on the switch side where we can look at optics information). An <em>show interfaces et10/1-4 status</em> says "notconnect" for all four subinterfaces. An <em>show interfaces et10/1-4 phy</em> displays an "errDisabled" on the phy layer. We are stumped.<br />
<br />
Over the course of the next few days, we try several changes, to no avail. Directly connecting two Arista switches works though, as does a direct connection between two end hosts. We even swap everything down to 40G on the Arista side and 10G SFP+ in the end hosts, which turns out perfectly fine (so at least our cabling is correct).<br />
<br />
At this point, support for the appliances we're trying to connect gives us credentials for shell access. It's a non-root user on what turns out as a normal Linux system, but at least I can see that it comes with QLogic Corp. FastLinQ QL45000 Series 25GbE controllers (for a short moment we had suspected we had the wrong controllers), and I can get some information by using <em>ethtool</em>. One of those is that ethtool reports the host interfaces as "25GBASE-KR", which tells me nothing. Someone on IRC mentions that "-KR" denotes an "electrical backplane" connection. Armed with those two small bits of information, I hit the search engines, and find this useful table in a <a class="wiki external"  title="External link" href="https://www.marvell.com/documents/quqedaawpjlt0en3e5zn/" rel="external nofollow">document on the Marvell web site</a>:<br />
<img src="tiki-download_file.php?fileId=13&display"  width="457" height="207" alt="D4cbaae36bf038ba" class="regImage pluginImg13 img-fluid" /><br />
It's accompanied by the following text:<br />
<br />
<div class="card bg-light"><div class="card-body">The –S short reach interfaces aim to support high-quality cables without<br />
ForwardError Correction (FEC) to minimize latency. Full reach interfaces<br />
aim to support the lowest possible cable or backplane cost and the longest<br />
possible reach, which do require the use of FEC. FEC options include<br />
BASE-R FEC (also referred to as Fire Code) and RS-FEC (also referred to<br />
as Reed-Solomon).</div></div><br />
<strong>There's two different, incompatible, error correction mechanisms on the bitstream layer of 25Gbit interfaces!?</strong> I didn't know that.<br />
<br />
Since the default on Arista switches seems to be Reed-Solomon, and I don't have any way to configure a detail like that on the end host, we change the configuration on the Arista side:<br />
<br />
<tt> interface et10/1-4</tt><br />
<tt>  error-correction encoding fire-code</tt><br />
<br />
That's all. We do the same for three other interface groups, and all links work just excpected (except for one that apparently has a bad transciever in the end host). I call off the screen-sharing session with Arista support planned for five minutes later.<br />
<br />]]></summary>
    <published>2020-02-10T22:47:00+00:00</published>
    <updated>2020-02-10T22:47:00+00:00</updated>
    <link rel="alternate" type="text/html" href="https://web.gxis.de/tiki/tiki-view_blog_post.php%3FpostId%3D329"/>
    <id>https://web.gxis.de/tiki/tiki-view_blog_post.php%3FpostId%3D329</id>
    <author>
      <name>Alexander Bochmann</name>
      <email>&lt;a class="convert-mailto" href="mailto:nospam@example.com" data-encode-name="ab+wiki" data-encode-domain="st.gxis.de"&gt;ab+wiki at st.gxis.de&lt;/a&gt;</email>
    </author>
  </entry>
  <entry>
    <title type="html"><![CDATA[backing up lxc container snapshots, Amanda style]]></title>
    <summary type="html"><![CDATA[I'm probably about the only person in the world using that kind of setup, but here we go:<br />
<br />
<ul><li> I have an active <a class="wiki external"  title="External link" href="http://amanda.org/" rel="external nofollow">Amanda</a> <a class="wikicache" target="_blank" href="tiki-view_cache.php?url=http%3A%2F%2Famanda.org%2F">(cache)</a> installation that I use to back up various UNIX systems (to disk, with a weekly flush out to a tape rotation)
</li><li> I run a system with lxc containers, using <a class="wiki external"  title="External link" href="https://btrfs.wiki.kernel.org/" rel="external nofollow">btrfs</a> as storage backend

</li></ul><br />On btrfs, lxc containers are just subvolumes mounted into the host filesystem, and container snapshots are btrfs snapshots attached to the <em>snapshots/</em> subdirectory of the container host volume.<br />
<br />
So I'm running a simple script on the lxc host each night that cycles through all the containers and creates a snapshot named "amanda" for each of them - deleting the previous version if present. The main loop of the bash script looks more or less like this:<br />
<br />
<pre>if [ -d /${lxdpool}/snapshots/${container}/amanda ]; then
 lxc delete ${container}/amanda
 sleep 2
fi
lxc snapshot ${container} amanda
</pre><br />
Amanda can do incremental backups using GNU tar (in addition to a host of other options). One of the less obvious stumbling blocks with this is that GNU tar takes the <em>device ID</em> into account when calculating incrementals - and as each btrfs snapshot is a new device, the default configuration will back up all of the files in the snapshot every day, even if the file metadata is unchanged. So to make this setup work, Amanda needs a new dumptype with a tar configuration that ignores the device ID (tar option <em>--no-check-device</em>). The <strong>amanda.conf</strong> on my backup server now defines this in addition to the pre-existing defaults:<br />
<br />
<pre>
 define application-tool app_amgtar_snap { #
    comment "amgtar for btrfs snapshots"
    plugin "amgtar"
    property "ONE-FILE-SYSTEM" "yes"  #use '--one-file-system' option
    property "ATIME-PRESERVE" "yes"   #use '--atime-preserve=system' option
    property "CHECK-DEVICE" "no"      #use '--no-check-device' if set to "no"
    property "IGNORE" ": socket ignored$"  # remove some log clutter
    property append "IGNORE" "directory is on a different filesystem"
}

define dumptype dt_amgtar_snap { #
    comment "new dump type that uses the above application definition"
    program "APPLICATION"
    application "app_amgtar_snap"
}

 define dumptype comp-user-ssh-tar-lxd-snap { #
    global-ssh   # use global ssh transport configuration
    client_username "backup"
    program "GNUTAR"
    dt_amgtar_snap    # that's my new dumptype
    comment "partitions dumped with tar as lxd snapshot, using gnutar --no-device option"
    index
    priority low
    compress client fast
    exclude list "./rootfs/.amandaexclude"  # each container can have individual exclude lists in /.amandaexclude
}
</pre><br />
All that's left now is to add entries to the Amanda <strong>disklist</strong> that are using my new dump type:<br />
<br />
<pre>
host.example.com        /lxdpool/snapshots/container1/amanda     comp-user-ssh-tar-lxd-snap
host.example.com        /lxdpool/snapshots/container2/amanda     comp-user-ssh-tar-lxd-snap
</pre><br />
<br />
<br />]]></summary>
    <published>2019-11-10T15:29:00+00:00</published>
    <updated>2019-11-10T15:29:00+00:00</updated>
    <link rel="alternate" type="text/html" href="https://web.gxis.de/tiki/tiki-view_blog_post.php%3FpostId%3D328"/>
    <id>https://web.gxis.de/tiki/tiki-view_blog_post.php%3FpostId%3D328</id>
    <author>
      <name>Alexander Bochmann</name>
      <email>&lt;a class="convert-mailto" href="mailto:nospam@example.com" data-encode-name="ab+wiki" data-encode-domain="st.gxis.de"&gt;ab+wiki at st.gxis.de&lt;/a&gt;</email>
    </author>
  </entry>
  <entry>
    <title type="html"><![CDATA[things that can go wrong when installing Smokeping]]></title>
    <summary type="html"><![CDATA[Yeah, haven't done that in a long time:<br />
<br />
<iframe src="https://mastodon.infra.de/@galaxis/103104946365972858/embed" class="mastodon-embed" style="max-width: 100%; border: 1" width="400" height="580"></iframe><script src="https://mastodon.infra.de/embed.js" async="async"></script><br />
(from <a class="wiki external"  title="External link" href="https://mastodon.infra.de/@galaxis/103104946365972858" rel="external nofollow">https://mastodon.infra.de/@galaxis/103104946365972858</a> <a class="wikicache" target="_blank" href="tiki-view_cache.php?url=https%3A%2F%2Fmastodon.infra.de%2F%40galaxis%2F103104946365972858">(cache)</a>)<br />]]></summary>
    <published>2019-11-08T23:46:00+00:00</published>
    <updated>2019-11-08T23:46:00+00:00</updated>
    <link rel="alternate" type="text/html" href="https://web.gxis.de/tiki/tiki-view_blog_post.php%3FpostId%3D327"/>
    <id>https://web.gxis.de/tiki/tiki-view_blog_post.php%3FpostId%3D327</id>
    <author>
      <name>Alexander Bochmann</name>
      <email>&lt;a class="convert-mailto" href="mailto:nospam@example.com" data-encode-name="ab+wiki" data-encode-domain="st.gxis.de"&gt;ab+wiki at st.gxis.de&lt;/a&gt;</email>
    </author>
  </entry>
  <entry>
    <title type="html"><![CDATA[adding a current FreeMiNT release into an existing EasyMiNT install on the Atari TT]]></title>
    <summary type="html"><![CDATA[I spent this weekend installing <a class="wiki external"  title="External link" href="https://atari.grossmaggul.de/home.php?lang=ge&amp;headline=EasyMiNT&amp;texte=easymint" rel="external nofollow">EasyMiNT</a> <a class="wikicache" target="_blank" href="tiki-view_cache.php?url=https%3A%2F%2Fatari.grossmaggul.de%2Fhome.php%3Flang%3Dge%26amp%3Bheadline%3DEasyMiNT%26amp%3Btexte%3Deasymint">(cache)</a> on my Atari TT, and then making it work with the <a class="wiki external"  title="External link" href="http://wiki.newtosworld.de/index.php?title=Lightning_VME_En" rel="external nofollow">Lightning VME USB board</a> <a class="wikicache" target="_blank" href="tiki-view_cache.php?url=http%3A%2F%2Fwiki.newtosworld.de%2Findex.php%3Ftitle%3DLightning_VME_En">(cache)</a>.<br />
<br />
Some more on the journey in getting there can be seen in these Fediverse threads:<br />
<ul><li> <a class="wiki external"  title="External link" href="https://mastodon.infra.de/@galaxis/103064551234920394" rel="external nofollow">https://mastodon.infra.de/@galaxis/103064551234920394</a>
</li><li> <a class="wiki external"  title="External link" href="https://mastodon.infra.de/@galaxis/103068427533675815" rel="external nofollow">https://mastodon.infra.de/@galaxis/103068427533675815</a>
</li><li> <a class="wiki external"  title="External link" href="https://mastodon.infra.de/@galaxis/103070354567250488" rel="external nofollow">https://mastodon.infra.de/@galaxis/103070354567250488</a>

</li></ul><br />Notes:<br />
<ul><li> I haven't had much luck in installing EasyMiNT to anything other than the <strong>C:</strong> drive
</li><li> The MiNT kernel provided with EasyMiNT is too old to be able to load the Lightning drivers, but since I had successfully installed the EasyMiNT distribution already, I wanted to upgrade it with a current <a class="wiki external"  title="External link" href="https://freemint.github.io/" rel="external nofollow">FreeMiNT</a> <a class="wikicache" target="_blank" href="tiki-view_cache.php?url=https%3A%2F%2Ffreemint.github.io%2F">(cache)</a> release.
</li><li> Booting the current MiNT kernel (as of 1-19-73f)  hangs after the "Installing BIOS keyboard" message. <a class="wiki external"  title="External link" href="http://atari-forum.com/viewtopic.php?t=34224#p377824" rel="external nofollow">This thread</a> <a class="wikicache" target="_blank" href="tiki-view_cache.php?url=http%3A%2F%2Fatari-forum.com%2Fviewtopic.php%3Ft%3D34224%23p377824">(cache)</a> on atari-forum.com recommends removing BIGDOS.PRG from the AUTO folder. Apparently BIGDOS is not required when using recent MiNT kernels anyway (I also got rid of WDIALOG.PRG while I was at it).

</li></ul><br />EasyMiNT installed on C: boots the kernel from <strong>C:\MINT\1-19-CUR</strong>. I didn't want to touch that working part of the setup, so I downloaded a full snapshot from <a class="wiki external"  title="External link" href="https://bintray.com/freemint/freemint/snapshots/" rel="external nofollow">https://bintray.com/freemint/freemint/snapshots/</a> that uses the snapshot version as MiNT SYSDIR (<strong>C:\MINT\1-19-73f</strong> for my build). Changing from the EasyMiNT kernel to the current <strong>MINT030.PRG</strong> in <strong>C:\AUTO\</strong> then implicitly executes everything else from the corresponding SYSDIR.<br />
<br />
As it turns out, the USB drivers included with the current FreeMiNT distribution are incompatible with those from the <a class="wiki external"  title="External link" href="https://www.newtosworld.de/viewforum.php?f=6&amp;sid=d47d0e2fd49e7d9426c7dc6919f26d65" rel="external nofollow">Lighting VME driver disk</a>. The easiest way is to rename <strong>$SYSDIR\USB</strong> to something else and replace the directory with the files from the <strong>TT\MINT</strong> directory in the Lightning distribution - and then add a missing file (<strong>ETH.UDD</strong>) <a class="wiki external"  title="External link" href="https://forum.atari-home.de/index.php/topic,14000.540.html" rel="external nofollow">attached to this forum post</a> <a class="wikicache" target="_blank" href="tiki-view_cache.php?url=https%3A%2F%2Fforum.atari-home.de%2Findex.php%2Ftopic%2C14000.540.html">(cache)</a>. Using the <strong>ETH.UDD</strong> provided with FreeMiNT does not work and leads to an "API Mismatch" message.<br />
<br />
To keep using most of the EasyMiNT setup, I adapted the boot sequence and MINT.CNF (some hints on the general boot layout can be found in <a href="tiki-index.php?page=MiNTBootSequence" title="MiNTBootSequence" class="wiki wiki_page">MiNTBootSequence</a>) by replacing some of the <strong>sln</strong> links. The relevant sections of my current configuration looks like this (<strong>E:</strong> is my EasyMiNT ext2 filesystem):<br />
<br />
<pre># add some binaries provided by FreeMiNT, later referenced in PATH
sln c:/mint/1-19-73f/sys-root/bin              u:/sysbin
# GEM programs included in the FreeMiNT distribution
sln c:/mint/1-19-73f/sys-root/opt              u:/opt
sln c:/mint/1-19-73f/sys-root/share            u:/share
# EasyMINT links
sln e:/etc     u:/etc
sln e:/bin     u:/bin
sln e:/sbin    u:/sbin
sln e:/home    u:/home
sln e:/usr     u:/usr
sln e:/mnt     u:/mnt
sln e:/root    u:/root
sln e:/tmp     u:/tmp
# this line only works after removing the /usr/bin/xaaes symlink in EasyMiNT!
# with this, the EasyMiNT/SpareMiNT init script keeps starting XaAES without any further changes
sln c:/mint/1-19-73f/xaaes/xaloader.prg    u:/usr/bin/xaaes

# I've found that using TOS paths in MINT.CNF works better?
setenv PATH u:\sysbin,u:\bin,u:\usr\bin,u:\usr\sbin,u:\sbin,u:\c\mint\1-19-73f\xaaes

setenv TMPDIR u:\tmp

# provided by EasyMiNT, only works when the appropriate direcories on E: are linked in
exec u:\c\mint\bin\sh u:\c\mint\bin\fscheck.sh

setenv TZ 'Europe/Berlin'
exec u:\sbin\tzinit -l

# load Lightning USB drivers
exec u:\c\mint\1-19-73f\usb\loader.prg

# use SpareMiNT init system, as installed by EasyMiNT
INIT=u:\sbin\init
</pre><br />
Linking in XALOADER.PRG via an sln link makes it easy to adapt the configuration to new releases. Most of the rest of the sln link tree comes from the MINT.CNF created by the EasyMiNT installer.<br />
<br />]]></summary>
    <published>2019-11-03T12:02:00+00:00</published>
    <updated>2019-11-03T12:02:00+00:00</updated>
    <link rel="alternate" type="text/html" href="https://web.gxis.de/tiki/tiki-view_blog_post.php%3FpostId%3D326"/>
    <id>https://web.gxis.de/tiki/tiki-view_blog_post.php%3FpostId%3D326</id>
    <author>
      <name>Alexander Bochmann</name>
      <email>&lt;a class="convert-mailto" href="mailto:nospam@example.com" data-encode-name="ab+wiki" data-encode-domain="st.gxis.de"&gt;ab+wiki at st.gxis.de&lt;/a&gt;</email>
    </author>
  </entry>
  <entry>
    <title type="html"><![CDATA[deleting stale VMware NSX controller instances]]></title>
    <summary type="html"><![CDATA[When the installation of an VMware NSX controller fails and it's locked in the UI, you can just delete it from the API:<br />
<br />
<iframe src="https://mastodon.infra.de/@galaxis/102376746230112269/embed" class="mastodon-embed" style="max-width: 100%; border: 1" width="400" height="400"></iframe><script src="https://mastodon.infra.de/embed.js" async="async"></script><br />
<br />
(from <a class="wiki external"  title="External link" href="https://mastodon.infra.de/@galaxis/102376746230112269" rel="external nofollow">https://mastodon.infra.de/@galaxis/102376746230112269</a> <a class="wikicache" target="_blank" href="tiki-view_cache.php?url=https%3A%2F%2Fmastodon.infra.de%2F%40galaxis%2F102376746230112269">(cache)</a>)<br />
<br />]]></summary>
    <published>2019-07-06T17:07:00+00:00</published>
    <updated>2019-07-06T17:07:00+00:00</updated>
    <link rel="alternate" type="text/html" href="https://web.gxis.de/tiki/tiki-view_blog_post.php%3FpostId%3D325"/>
    <id>https://web.gxis.de/tiki/tiki-view_blog_post.php%3FpostId%3D325</id>
    <author>
      <name>Alexander Bochmann</name>
      <email>&lt;a class="convert-mailto" href="mailto:nospam@example.com" data-encode-name="ab+wiki" data-encode-domain="st.gxis.de"&gt;ab+wiki at st.gxis.de&lt;/a&gt;</email>
    </author>
  </entry>
  <entry>
    <title type="html"><![CDATA[Apache 2.4 as a reverse proxy for Mastodon]]></title>
    <summary type="html"><![CDATA[The standard setup for <a class="wiki external"  title="External link" href="https://joinmastodon.org/" rel="external nofollow">Mastodon</a> is to use nginx as a reverse proxy. After one too many missing features I recently switched my installation over to using good old Apache.<br />
<br />
There's <a class="wiki external"  title="External link" href="https://github.com/tootsuite/documentation/blob/master/Running-Mastodon/Alternatives.md#apache" rel="external nofollow">an example Apache config</a> <a class="wikicache" target="_blank" href="tiki-view_cache.php?url=https%3A%2F%2Fgithub.com%2Ftootsuite%2Fdocumentation%2Fblob%2Fmaster%2FRunning-Mastodon%2FAlternatives.md%23apache">(cache)</a> in the unmaintained old documentation archive for Mastodon, and since I assume it's useless to try to update that, I'll quickly dump my current config here. There's no guarantee for correctness, but it currently seems to work for me. Note that this configuration does not do any caching for requests to static content retrieved through the reverse proxy.<br />
<br />
The following Apache modules are used:<br />
<br />
<ul><li> proxy
</li><li> proxy_http
</li><li> http2
</li><li> proxy_http2
</li><li> proxy_wstunnel
</li><li> headers
</li><li> socache_shmcb
</li><li> ssl

</li></ul><br />General SSL configuration (personal preference, CipherSuite selection is probably going to age badly). TLS v1.3 is disabled since Ubuntu bionic ships an Apache version that's too old for that:<br />
<br />
<pre>&lt;IfModule mod_ssl.c&gt;

        SSLCertificateFile     &lt;path to combined public key / certificate chain file&gt;
        SSLCertificateKeyFile  &lt;path to private key&gt;
        #   the referenced file can be the same as SSLCertificateFile
        #   when the CA certificates are directly appended to the server
        #   certificate for convinience.
        SSLCertificateChainFile &lt;path to combined public key / certificate chain file&gt;

        # SSLProtocol -all +TLSv1.2 +TLSv1.3
        SSLProtocol -all +TLSv1.2 +TLSv1.1
        SSLHonorCipherOrder on
        SSLCipherSuite ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:EECDH+AESGCM:AES256+EECDH:AES128+EECDH
        SSLCompression off
        SSLSessionTickets off
        SSLSessionCache "shmcb:logs/session-cache(512000)"
        SSLStaplingResponderTimeout 5
        SSLStaplingReturnResponderErrors off
        SSLUseStapling on
        SSLStaplingCache "shmcb:logs/stapling-cache(150000)"

        # needs to be generated first, see https://weakdh.org/sysadmin.html
        SSLOpenSSLConfCmd DHParameters /etc/ssl/dhparam.pem

&lt;/IfModule&gt;
</pre><br />
<br />
Mastodon vhost configuration:<br />
<br />
<pre>
&lt;VirtualHost *:443&gt;
        ServerAdmin webmaster@example.com
        ServerName mastodon.example.com

        SSLEngine on

        Protocols h2 http/1.1

        # fetch static files directly from local file system (adapt to installation path)
        DocumentRoot /home/mastodon/live/public

        Header always set Strict-Transport-Security "max-age=31536000"

        &lt;LocationMatch "^/(assets|avatars|emoji|headers|packs|sounds|system)"&gt;
                Header always set Cache-Control "public, max-age=31536000, immutable"
                Require all granted
        &lt;/LocationMatch&gt;

        &lt;Location "/"&gt;
                Require all granted
        &lt;/Location&gt;

        ProxyPreserveHost On
        RequestHeader set X-Forwarded-Proto "https"
        ProxyAddHeaders On

        # these files / pathes don't get proxied and are retrieved from DocumentRoot
        ProxyPass /500.html !
        ProxyPass /sw.js !
        ProxyPass /robots.txt !
        ProxyPass /manifest.json !
        ProxyPass /browserconfig.xml !
        ProxyPass /mask-icon.svg !
        ProxyPassMatch ^(/.*\.(png|ico)$) !
        ProxyPassMatch ^/(assets|avatars|emoji|headers|packs|sounds|system) !
        # everything else is either going to the streaming API or the web workers
        ProxyPass /api/v1/streaming ws://localhost:4000
        ProxyPassReverse /api/v1/streaming ws://localhost:4000
        ProxyPass / http://localhost:3000/
        ProxyPassReverse / http://localhost:3000/

        ErrorDocument 500 /500.html
        ErrorDocument 501 /500.html
        ErrorDocument 502 /500.html
        ErrorDocument 503 /500.html
        ErrorDocument 504 /500.html

&lt;/VirtualHost&gt;
</pre><br />
The trailing / on the websocket ProxyPass directive is missing by design (it's there in the old example config): Some API requests seen in the wild will not match <em>/api/v1/streaming/</em> and will get lost.<br />]]></summary>
    <published>2019-05-31T19:45:00+00:00</published>
    <updated>2019-05-31T19:45:00+00:00</updated>
    <link rel="alternate" type="text/html" href="https://web.gxis.de/tiki/tiki-view_blog_post.php%3FpostId%3D323"/>
    <id>https://web.gxis.de/tiki/tiki-view_blog_post.php%3FpostId%3D323</id>
    <author>
      <name>Alexander Bochmann</name>
      <email>&lt;a class="convert-mailto" href="mailto:nospam@example.com" data-encode-name="ab+wiki" data-encode-domain="st.gxis.de"&gt;ab+wiki at st.gxis.de&lt;/a&gt;</email>
    </author>
  </entry>
  <entry>
    <title type="html"><![CDATA[Android: Qualcomm® aptX™ bluetooth notification]]></title>
    <summary type="html"><![CDATA[On my new Blackberry Key2 LE, I have run into a system notification when certain bluetooth headphones are connected:<br />
<br />
<div style="display: inline-block;  max-width: 100%; width: 602px;"><img src="tiki-download_file.php?fileId=12&display"  width="600" height="107" alt="using  Qualcomm® aptX™" class="regImage pluginImg12 img-fluid" title="using  Qualcomm® aptX™" />	<div class="mini" style="max-width: 100%; width:600px;">		<div class="thumbcaption">using  Qualcomm® aptX™		</div>	</div></div><br />
<br />
Great. What do I care? Let's disable this notification.<br />
<br />
<div style="display: inline-block;  max-width: 100%; width: 602px;"><img src="tiki-download_file.php?fileId=11&display"  width="600" height="250" alt="Notifications from this app can't be turned off" class="regImage pluginImg11 img-fluid" title="Notifications from this app can't be turned off" />	<div class="mini" style="max-width: 100%; width:600px;">		<div class="thumbcaption">Notifications from this app can't be turned off		</div>	</div></div><br />
<br />
Helpfully, the message shows the name of the Android component, <em>com.qualcomm.qtil.aptxui</em><br />
<br />
So I enabled developer mode on the phone, connected from the PC via <em>adb shell</em>, and killed off the whole thing:<br />
<br />
<tt> bbe100:/ $ pm disable-user --user 0 com.qualcomm.qtil.aptxui</tt><br />
<tt> Package com.qualcomm.qtil.aptxui new state: disabled-user</tt><br />
<br />
I have not noticed any negative consequences.<br />
<br />
But, really, what is this idiocy with hardware vendors injecting ads into the system? Qualcomm has 37 packages on the system, according to a <em>pm list packages | grep qualcomm</em>. I'm not inclined to trust them very much, but unfortunately there's little to no documentation on this kind of vendor crap on Android.<br />
<br />
I took the opportunity to disable another obvious one, ''com.qualcomm.qti.haven.telemetry.service".<br />
<br />
<br />]]></summary>
    <published>2019-02-01T19:44:00+00:00</published>
    <updated>2019-02-01T19:44:00+00:00</updated>
    <link rel="alternate" type="text/html" href="https://web.gxis.de/tiki/tiki-view_blog_post.php%3FpostId%3D322"/>
    <id>https://web.gxis.de/tiki/tiki-view_blog_post.php%3FpostId%3D322</id>
    <author>
      <name>Alexander Bochmann</name>
      <email>&lt;a class="convert-mailto" href="mailto:nospam@example.com" data-encode-name="ab+wiki" data-encode-domain="st.gxis.de"&gt;ab+wiki at st.gxis.de&lt;/a&gt;</email>
    </author>
  </entry>
  <entry>
    <title type="html"><![CDATA[Blackberry Key2 LE vs. FRITZ!WLAN Repeater 310 with FritzOS 7.01]]></title>
    <summary type="html"><![CDATA[Last night, my 2.4GHz <a class="wiki external"  title="External link" href="https://en.avm.de/products/fritzwlan/fritzwlan-repeater-310/" rel="external nofollow">FRITZ!WLAN Repeater 310</a> upgraded to the new FritzOS release 7.01. The repeater is configured as FRITZ Mesh device (connected to a FRITZ!Box 7490 as mesh master). I'm currently tinkering with a <a class="wiki external"  title="External link" href="https://blackberrymobile.com/emea/product/blackberry-key2-le/" rel="external nofollow">Blackberry Key2 LE</a> that I bought to replace the aging S4 mini that I used up to now (more on that later, maybe). After upgrading the repeater, the Key2 LE couldn't connect to the wifi network anymore. In an area only covered by the repeater, it didn't even see the SSID anymore. It was still possible to connect directly to the base station though, when moving into range. All the other devices I had available had no problems connecting through the repeater either.<br />
<br />
As AVM doesn't currently provide downgrade images for the Repeater 310, I tried a factory reset and re-establishing the mesh connection, to no avail.<br />
<br />
I then started playing with wifi network settings, and as it turns out, there's a simple fix: <strong>Don't use channel 13 on the repeater.</strong><br />
<br />
After excluding channels 12 and 13 from the wifi channel selection on the FRITZ!Box, the system switched down to channel 11, and suddenly the network appeard back in view on the Blackberry device. Also tried manually setting channel 6, which worked too.<br />
<br />
Not sure what to make of that. Channel 13 was fine with this device before the FritzOS upgrade (yes, I know using it is not recommended, but this is the first time that created a problem for me).<br />]]></summary>
    <published>2019-01-25T12:32:00+00:00</published>
    <updated>2019-01-25T12:32:00+00:00</updated>
    <link rel="alternate" type="text/html" href="https://web.gxis.de/tiki/tiki-view_blog_post.php%3FpostId%3D321"/>
    <id>https://web.gxis.de/tiki/tiki-view_blog_post.php%3FpostId%3D321</id>
    <author>
      <name>Alexander Bochmann</name>
      <email>&lt;a class="convert-mailto" href="mailto:nospam@example.com" data-encode-name="ab+wiki" data-encode-domain="st.gxis.de"&gt;ab+wiki at st.gxis.de&lt;/a&gt;</email>
    </author>
  </entry>
  <entry>
    <title type="html"><![CDATA[RFC 6762 reserved the .local TLD in 2013 for Multicast DNS!]]></title>
    <summary type="html"><![CDATA[I was not aware that <a class="wiki external"  title="External link" href="https://tools.ietf.org/html/rfc6762" rel="external nofollow">RFC6762</a> <a class="wikicache" target="_blank" href="tiki-view_cache.php?url=https%3A%2F%2Ftools.ietf.org%2Fhtml%2Frfc6762">(cache)</a> reserves the ".local" TLD for exclusive use for Link-Local addresses with Multicast DNS:<br />
<br />
<div class='quote'>
    <div class='quoteheader'>
                    <cite>RFC6762</cite> wrote:
            </div>
    <div class='quotebody'>
        This document specifies that the DNS top-level domain ".local." is a special domain with special semantics, namely that any fully qualified name ending in ".local." is link-local, and names within this domain are meaningful only on the link where they originate.<br />
            </div>
</div>
<br />
<br />
Lutz Donnerhacke points to this in a German language article that explains how this <a class="wiki external"  title="External link" href="https://lutz.donnerhacke.de/Blog/Kein-CIFS-Mount-mit-kurzem-Namen" rel="external nofollow">leads to problems accessing a CIFS mount in a Windows domain that uses the .local TLD</a>.<br />]]></summary>
    <published>2018-08-06T13:19:00+00:00</published>
    <updated>2018-08-06T13:19:00+00:00</updated>
    <link rel="alternate" type="text/html" href="https://web.gxis.de/tiki/tiki-view_blog_post.php%3FpostId%3D320"/>
    <id>https://web.gxis.de/tiki/tiki-view_blog_post.php%3FpostId%3D320</id>
    <author>
      <name>Alexander Bochmann</name>
      <email>&lt;a class="convert-mailto" href="mailto:nospam@example.com" data-encode-name="ab+wiki" data-encode-domain="st.gxis.de"&gt;ab+wiki at st.gxis.de&lt;/a&gt;</email>
    </author>
  </entry>
  <entry>
    <title type="html"><![CDATA[OpenSSH uses MD5 with salt to encrypt the passphrase for RSA keys by default]]></title>
    <summary type="html"><![CDATA[Details here: <a class="wiki external"  title="External link" href="https://latacora.singles/2018/08/03/the-default-openssh.html" rel="external nofollow">The default OpenSSH key encryption is worse than plaintext</a> <a class="wikicache" target="_blank" href="tiki-view_cache.php?url=https%3A%2F%2Flatacora.singles%2F2018%2F08%2F03%2Fthe-default-openssh.html">(cache)</a><br />
<br />
<div class='quote'>
    <div class='quoteheader'>
                    <cite>@latacora</cite> wrote:
            </div>
    <div class='quotebody'>
        The punchline is that the AES key is just MD5(password || IV[:8]). [..] MD5 is very cheap to compute. The only thing this design has going for it is that the salt goes after the password, so you can’t just compute the intermediate state of MD5(IV[8:]) and try passwords from there. That’s faint praise, especially in a world where I can rent a machine that tries billions of MD5 calls per second.<br />
            </div>
</div>
<br />
<br />
Ssh keypairs for Ed25519 use a new format to encrypt the passphrase. Since 2013, it's been possible to create RSA keys with new-format passphrase encryption using <em>ssh_keygen -o</em>, but since that's not been the default, I don't assume anyone has ever used that (I haven't).<br />
<br />
Might be worth replacing all RSA keypairs for pubkey authentication (and remove the corresponding public key from any <em>authorized_keys</em> files on all destination systems) - and all Ed25519 keys that use the same passphrase. Unless you're absolutely certain no one ever had access to the private key, in which case just upgrading the passphrase encryption using <em>ssh-keygen -p -o -f &lt;PRIVATEKEY&gt;</em> might be good enough.<br />
<br />]]></summary>
    <published>2018-08-04T10:24:00+00:00</published>
    <updated>2018-08-04T10:24:00+00:00</updated>
    <link rel="alternate" type="text/html" href="https://web.gxis.de/tiki/tiki-view_blog_post.php%3FpostId%3D319"/>
    <id>https://web.gxis.de/tiki/tiki-view_blog_post.php%3FpostId%3D319</id>
    <author>
      <name>Alexander Bochmann</name>
      <email>&lt;a class="convert-mailto" href="mailto:nospam@example.com" data-encode-name="ab+wiki" data-encode-domain="st.gxis.de"&gt;ab+wiki at st.gxis.de&lt;/a&gt;</email>
    </author>
  </entry>
  <entry>
    <title type="html"><![CDATA[Mastodon embeds on the blog...]]></title>
    <summary type="html"><![CDATA[I've been pulling in some posts from my <a class="wiki external"  title="External link" href="https://mastodon.infra.de/@galaxis" rel="external nofollow">Mastodon instance</a> to the blog, using iframes to directly show the embed view provided my Mastodon.<br />
<br />
There's two problems with that:<br />
<br />
One is, that someone who is using a content blocker like uBlock Origin or uMatrix likely won't see anything in these posts when they're blocking third party content by default. The other is - what happens when my Mastodon instance is down?<br />
<br />
So I've now added direct links to each of the embedded posts, serving a dual purpose: There's first party content (the link), and also the Tiki engine creates a cache entry that can be accessed when the Mastodon server is unreachable.<br />
<br />
I've also tagged all affected posts as <a class="wiki external"  title="External link" href="https://web.gxis.de/tiki/tiki-browse_freetags.php?tag=%22mastodon%20embed%22" rel="external nofollow">mastodon embed</a>, so I can easily find them and replace the content should I ever plan to shut down my Mastodon system.<br />]]></summary>
    <published>2018-07-14T14:30:00+00:00</published>
    <updated>2018-07-14T14:30:00+00:00</updated>
    <link rel="alternate" type="text/html" href="https://web.gxis.de/tiki/tiki-view_blog_post.php%3FpostId%3D318"/>
    <id>https://web.gxis.de/tiki/tiki-view_blog_post.php%3FpostId%3D318</id>
    <author>
      <name>Alexander Bochmann</name>
      <email>&lt;a class="convert-mailto" href="mailto:nospam@example.com" data-encode-name="ab+wiki" data-encode-domain="st.gxis.de"&gt;ab+wiki at st.gxis.de&lt;/a&gt;</email>
    </author>
  </entry>
  <entry>
    <title type="html"><![CDATA[LineageOS Gallery app not showing any pictures]]></title>
    <summary type="html"><![CDATA[...just delete all files from DCIM/.thumbnails/ :<br />
<br />
<iframe src="https://mastodon.infra.de/@galaxis/100335009279539395/embed" class="mastodon-embed" style="max-width: 100%; border: 1" width="400"></iframe><script src="https://mastodon.infra.de/embed.js" async="async"></script><br />
(from <a class="wiki external"  title="External link" href="https://mastodon.infra.de/@galaxis/100335009279539395" rel="external nofollow">https://mastodon.infra.de/@galaxis/100335009279539395</a> <a class="wikicache" target="_blank" href="tiki-view_cache.php?url=https%3A%2F%2Fmastodon.infra.de%2F%40galaxis%2F100335009279539395">(cache)</a>)<br />]]></summary>
    <published>2018-07-07T19:13:00+00:00</published>
    <updated>2018-07-07T19:13:00+00:00</updated>
    <link rel="alternate" type="text/html" href="https://web.gxis.de/tiki/tiki-view_blog_post.php%3FpostId%3D317"/>
    <id>https://web.gxis.de/tiki/tiki-view_blog_post.php%3FpostId%3D317</id>
    <author>
      <name>Alexander Bochmann</name>
      <email>&lt;a class="convert-mailto" href="mailto:nospam@example.com" data-encode-name="ab+wiki" data-encode-domain="st.gxis.de"&gt;ab+wiki at st.gxis.de&lt;/a&gt;</email>
    </author>
  </entry>
  <entry>
    <title type="html"><![CDATA[tcp transport for RTSP streams in VLC media player]]></title>
    <summary type="html"><![CDATA[<iframe src="https://mastodon.infra.de/@galaxis/100323013414993622/embed" class="mastodon-embed" style="max-width: 100%; border: 1" width="400"></iframe><script src="https://mastodon.infra.de/embed.js" async="async"></script><br />
(from <a class="wiki external"  title="External link" href="https://mastodon.infra.de/@galaxis/100323013414993622" rel="external nofollow">https://mastodon.infra.de/@galaxis/100323013414993622</a> <a class="wikicache" target="_blank" href="tiki-view_cache.php?url=https%3A%2F%2Fmastodon.infra.de%2F%40galaxis%2F100323013414993622">(cache)</a>)<br />]]></summary>
    <published>2018-07-07T11:12:00+00:00</published>
    <updated>2018-07-07T11:12:00+00:00</updated>
    <link rel="alternate" type="text/html" href="https://web.gxis.de/tiki/tiki-view_blog_post.php%3FpostId%3D316"/>
    <id>https://web.gxis.de/tiki/tiki-view_blog_post.php%3FpostId%3D316</id>
    <author>
      <name>Alexander Bochmann</name>
      <email>&lt;a class="convert-mailto" href="mailto:nospam@example.com" data-encode-name="ab+wiki" data-encode-domain="st.gxis.de"&gt;ab+wiki at st.gxis.de&lt;/a&gt;</email>
    </author>
  </entry>
  <entry>
    <title type="html"><![CDATA[creating an iPXE boot floppy]]></title>
    <summary type="html"><![CDATA[The <a class="wiki external"  title="External link" href="http://ipxe.org/" rel="external nofollow">iPXE open source boot firmware project</a> provides an <a class="wiki external"  title="External link" href="http://ipxe.org/download" rel="external nofollow">CD image</a> that boots the iPXE binary using isolinux.<br />
<br />
Over on the Fediverse, the topic of bootstraping a system from a floppy disk came up, and with the iPXE binary being a mere 330KB, there's really no reason why it shouldn't be possible to boot that from a floppy disk. And it actually does work, with a few simple steps (on a Debian-ish Linux):<br />
<br />
<ul><li> format floppy disk and create FAT filesystem <pre>fdformat /dev/fd0
mkfs -t fat /dev/fd0</pre>
</li><li> get syslinux and install to floppy <pre>apt install syslinux syslinux-utils
syslinux --install /dev/fd0</pre>
</li><li> get iPXE ISO <pre>curl -O http://boot.ipxe.org/ipxe.iso</pre>
</li><li> mount both iPXE ISO and floppy, copy over required files, rename isolinux.cfg to syslinux.cfg <pre>mkdir fd iso
mount /dev/fd0 fd
mount -o ro ipxe.iso iso
cp iso/ipxe.krn fd/
cp iso/boot.cat fd/
cp iso/isolinux.cfg fd/syslinux.cfg
umount fd
umount iso
rmdir fd iso
</pre>

</li></ul><br />That's all! Take your floppy and boot a system<br />
<br />
Once iPXE has been started, hit <em>Ctrl-B</em> to call the shell. If you have a DHCP server on your network and a web server with a bootable ISO image, it's just two iPXE commands:<br />
<br />
<pre>dhcp
sanboot http://&lt;webserver&gt;/&lt;filename&gt;.iso</pre><br />
<br />]]></summary>
    <published>2018-06-30T22:20:00+00:00</published>
    <updated>2018-06-30T22:20:00+00:00</updated>
    <link rel="alternate" type="text/html" href="https://web.gxis.de/tiki/tiki-view_blog_post.php%3FpostId%3D315"/>
    <id>https://web.gxis.de/tiki/tiki-view_blog_post.php%3FpostId%3D315</id>
    <author>
      <name>Alexander Bochmann</name>
      <email>&lt;a class="convert-mailto" href="mailto:nospam@example.com" data-encode-name="ab+wiki" data-encode-domain="st.gxis.de"&gt;ab+wiki at st.gxis.de&lt;/a&gt;</email>
    </author>
  </entry>
  <entry>
    <title type="html"><![CDATA[Windows 10 1803 annoyances]]></title>
    <summary type="html"><![CDATA[So far, I've run into two major annoyances with Windows 10 1803...<br />
<br />
First is that the mobile hotspot function (sharing a cellular data connection to other devices via Wifi) has been gimped, and trying to activate it just results in an "<em>To share your connection, you need to add this feature to your cellular data plan first.</em>" - message:<br />
<br />
<img src="tiki-download_file.php?fileId=9&display"  width="454" height="209" alt="688e5c02bff7c78f" class="regImage pluginImg9 img-fluid" /><br />
Information around this is very scarce at this time - just a handful of search engine hits. From a post on the italian Microsoft forums, it seems you now need a Store app published by your mobile phone provider to use this feature. WTF, really? I've been tinkering for quite some time to find out where Windows looks up if using the hotspot is allowed or not, to no avail. Also see <a class="wiki external"  title="External link" href="https://mastodon.infra.de/@galaxis/100128847256854464" rel="external nofollow">over here on Mastodon</a>.<br />
<br />
The other problem is that powersaving for the first gen switchable graphics in my old notebook doesn't seem to work anymore. In previous versions of W10, the integrated Intel graphics would be used on battery, using a lot less power than the AMD graphics chip.<br />
<br />
As for minor niggles, it's not possible anymore to unconditionally set a network connection as "metered" to restrict Windows updates and background data - you'll have to set a daily or monthly data limit for the network, and then tell the system to always restrict background data (instead of within 10% of reaching the limit).<br />
<br />
<img src="tiki-download_file.php?fileId=10&display"  width="794" height="219" alt="Capture" class="regImage pluginImg10 img-fluid" /><br />
It really seems that W10 1709 was the sweet spot for this old notebook, but after I didn't see any immediate problems with the new version in the week directly after upgrading, I already deleted to rollback version...<br />
<br />
<br />]]></summary>
    <published>2018-06-06T12:22:00+00:00</published>
    <updated>2018-06-06T12:22:00+00:00</updated>
    <link rel="alternate" type="text/html" href="https://web.gxis.de/tiki/tiki-view_blog_post.php%3FpostId%3D314"/>
    <id>https://web.gxis.de/tiki/tiki-view_blog_post.php%3FpostId%3D314</id>
    <author>
      <name>Alexander Bochmann</name>
      <email>&lt;a class="convert-mailto" href="mailto:nospam@example.com" data-encode-name="ab+wiki" data-encode-domain="st.gxis.de"&gt;ab+wiki at st.gxis.de&lt;/a&gt;</email>
    </author>
  </entry>
  <entry>
    <title type="html"><![CDATA[IKEA woes]]></title>
    <summary type="html"><![CDATA[...we haven't been able to sleep in the bedroom with a new PAX wardrobe for a week.<br />
<br />
<iframe src="https://mastodon.infra.de/@galaxis/99633409151790924/embed" class="mastodon-embed" style="max-width: 100%; border: 1" width="400"></iframe><script src="https://mastodon.infra.de/embed.js" async="async"></script><br />
(from <a class="wiki external"  title="External link" href="https://mastodon.infra.de/@galaxis/99633409151790924" rel="external nofollow">https://mastodon.infra.de/@galaxis/99633409151790924</a> <a class="wikicache" target="_blank" href="tiki-view_cache.php?url=https%3A%2F%2Fmastodon.infra.de%2F%40galaxis%2F99633409151790924">(cache)</a>)<br />]]></summary>
    <published>2018-03-16T08:08:00+00:00</published>
    <updated>2018-03-16T08:08:00+00:00</updated>
    <link rel="alternate" type="text/html" href="https://web.gxis.de/tiki/tiki-view_blog_post.php%3FpostId%3D313"/>
    <id>https://web.gxis.de/tiki/tiki-view_blog_post.php%3FpostId%3D313</id>
    <author>
      <name>Alexander Bochmann</name>
      <email>&lt;a class="convert-mailto" href="mailto:nospam@example.com" data-encode-name="ab+wiki" data-encode-domain="st.gxis.de"&gt;ab+wiki at st.gxis.de&lt;/a&gt;</email>
    </author>
  </entry>
  <entry>
    <title type="html"><![CDATA[USRobotics modems]]></title>
    <summary type="html"><![CDATA[Today I <a class="wiki external"  title="External link" href="https://octodon.social/@starbreaker/99383431555903302" rel="external nofollow">learned</a> <a class="wikicache" target="_blank" href="tiki-view_cache.php?url=https%3A%2F%2Foctodon.social%2F%40starbreaker%2F99383431555903302">(cache)</a> that <a class="wiki external"  title="External link" href="http://www.usr.com/home/" rel="external nofollow">USRobotics</a> <a class="wikicache" target="_blank" href="tiki-view_cache.php?url=http%3A%2F%2Fwww.usr.com%2Fhome%2F">(cache)</a> still exists (as a division of another company), and they still make a version of the classic <a class="wiki external"  title="External link" href="http://www.usr.com/products/56k-dialup-modem/usr3453c/" rel="external nofollow">Courier 56k modem</a> <a class="wikicache" target="_blank" href="tiki-view_cache.php?url=http%3A%2F%2Fwww.usr.com%2Fproducts%2F56k-dialup-modem%2Fusr3453c%2F">(cache)</a>. Not that I need one of those. But I'm surprised it's still possible to buy them (and they look just the same as 20 years ago).<br />]]></summary>
    <published>2018-01-20T22:31:00+00:00</published>
    <updated>2018-01-20T22:31:00+00:00</updated>
    <link rel="alternate" type="text/html" href="https://web.gxis.de/tiki/tiki-view_blog_post.php%3FpostId%3D312"/>
    <id>https://web.gxis.de/tiki/tiki-view_blog_post.php%3FpostId%3D312</id>
    <author>
      <name>Alexander Bochmann</name>
      <email>&lt;a class="convert-mailto" href="mailto:nospam@example.com" data-encode-name="ab+wiki" data-encode-domain="st.gxis.de"&gt;ab+wiki at st.gxis.de&lt;/a&gt;</email>
    </author>
  </entry>
  <entry>
    <title type="html"><![CDATA[SolidFire FDVA software repository downgrade]]></title>
    <summary type="html"><![CDATA[We've been playing with a <a class="wiki external"  title="External link" href="http://www.netapp.com/us/products/storage-systems/all-flash-array/solidfire-web-scale.aspx" rel="external nofollow">SolidFire flash storage cluster</a> for some time, and recently wanted to update the nodes to the current ElementOS 10.1 release.<br />
<br />
Unfortunately, our FDVA management node installation was borked, so we decided to just roll a new one from the current VM appliance template - easy.<br />
As it turns out though, the FDVA appliance only ships with the latest software release files, and the individual SolidFire nodes check back for a repository with their current version before starting the update, which consequently fails (it's all very Ubuntu-ish):<br />
<br />
<pre>
admin@SF-7323:~$ sudo sfinstall 192.168.10.21 -u admin -p password -l
2017-12-20 17:27:52: sfinstall Release Version: 10.1.0.83 Revision:  Build date: 2017-11-23 01:27
2017-12-20 17:27:52: Checking connectivity to MVIP 192.168.10.21
2017-12-20 17:27:52: Successfully connected to cluster MVIP
2017-12-20 17:27:53: PrintRepositoryPackages failed: SolidFireApiError server=[192.168.10.10] method=[AptUpdate], params=[{'quiet': 2}] - error name=[xCheckFailure], 
message=[cmdResult={ rc=255 stdout="W: Failed to fetch http://192.168.10.10/fluorine-updates/ubuntu/dists/precise/main/binary-amd64/Packages  404  Not Found
[..]
W: Failed to fetch http://192.168.10.10/fluorine-updates/security-ubuntu/dists/precise-security/universe/binary-amd64/Packages  404  Not Found
</pre><br />
The SolidFire docs don't really mention what to do from there, so we tinkered around for some time and found this:<br />
<br />
Any older version of the repository can be fetched using the <em>update-fdva</em> tool with the currently used ElementOS release version as command line (version number can be seen on the cluster web UI or when asking the cluster nodes for their mnode repository using sfinstall). In our case, the active version was 9.2.0.43 -<br />
<br />
<pre>
admin@SF-7323:~$ sudo update-fdva 9.2.0.43
Get: 1 http://localhost precise Release.gpg [490 B]
Get: 2 http://localhost precise-updates Release.gpg [490 B]
[..]
</pre><br />
This will fetch the 9.2.0.43 version of the SolidFire repository, but will also downgrade to the matching (old) versions of solidfire-fdva-tools and solidfire-python-framework...<br />
<br />
<pre>
admin@SF-7323:~$ dpkg -l | grep fdva
ii  solidfire-fdva-tools-fluorine-patch2-9.2.0.43               9.2.0.43                          SolidFire FDVA Tools 9 [fluorine-patch2]
</pre><br />
...so we immediately reinstalled the current versions, using <em>update-fdva</em> again, this time with the current release version number:<br />
<br />
<pre>
admin@SF-7323:~$ sudo update-fdva 10.1.0.83
</pre><br />
With all that in place, we could just run the update routine using the usual <em>sfinstall</em> command.<br />
<br />]]></summary>
    <published>2017-12-21T15:11:00+00:00</published>
    <updated>2017-12-21T15:11:00+00:00</updated>
    <link rel="alternate" type="text/html" href="https://web.gxis.de/tiki/tiki-view_blog_post.php%3FpostId%3D311"/>
    <id>https://web.gxis.de/tiki/tiki-view_blog_post.php%3FpostId%3D311</id>
    <author>
      <name>Alexander Bochmann</name>
      <email>&lt;a class="convert-mailto" href="mailto:nospam@example.com" data-encode-name="ab+wiki" data-encode-domain="st.gxis.de"&gt;ab+wiki at st.gxis.de&lt;/a&gt;</email>
    </author>
  </entry>
  <entry>
    <title type="html"><![CDATA[converting animated GIFs to video...]]></title>
    <summary type="html"><![CDATA[...is a major pain, since animated GIFs don't have a fixed frame rate: The animation can define a variable pause after each individual frame.<br />
<br />
<a class="wiki external"  title="External link" href="https://www.jwz.org/blog/2017/10/gifs-as-mp4s/" rel="external nofollow">jzw has updated his resize.pl script</a> <a class="wikicache" target="_blank" href="tiki-view_cache.php?url=https%3A%2F%2Fwww.jwz.org%2Fblog%2F2017%2F10%2Fgifs-as-mp4s%2F">(cache)</a> with a new function to get around that limitation:<br />
<br />
<div class='quote'>
    <div class='quoteheader'>
                    <cite>jwz</cite> wrote:
            </div>
    <div class='quotebody'>
        I'm converting them using the all-singing all-dancing image-and-video resizer that I wrote, resize.pl, which uses ImageMagick to extract each frame as a PNG then constructs an incredibly hairy ffmpeg command to put it all back together with the proper frame timing.<br />
            </div>
</div>
<br />
<br />
(via tedu)<br />]]></summary>
    <published>2017-10-15T13:03:00+00:00</published>
    <updated>2017-10-15T13:03:00+00:00</updated>
    <link rel="alternate" type="text/html" href="https://web.gxis.de/tiki/tiki-view_blog_post.php%3FpostId%3D310"/>
    <id>https://web.gxis.de/tiki/tiki-view_blog_post.php%3FpostId%3D310</id>
    <author>
      <name>Alexander Bochmann</name>
      <email>&lt;a class="convert-mailto" href="mailto:nospam@example.com" data-encode-name="ab+wiki" data-encode-domain="st.gxis.de"&gt;ab+wiki at st.gxis.de&lt;/a&gt;</email>
    </author>
  </entry>
  <entry>
    <title type="html"><![CDATA[mastodon embeds]]></title>
    <summary type="html"><![CDATA[...cleaning up those when the referenced Mastodon instanced go offline one day will be a major pain... Maybe I should just use screenshots instead?<br />]]></summary>
    <published>2017-10-15T12:50:00+00:00</published>
    <updated>2017-10-15T12:50:00+00:00</updated>
    <link rel="alternate" type="text/html" href="https://web.gxis.de/tiki/tiki-view_blog_post.php%3FpostId%3D309"/>
    <id>https://web.gxis.de/tiki/tiki-view_blog_post.php%3FpostId%3D309</id>
    <author>
      <name>Alexander Bochmann</name>
      <email>&lt;a class="convert-mailto" href="mailto:nospam@example.com" data-encode-name="ab+wiki" data-encode-domain="st.gxis.de"&gt;ab+wiki at st.gxis.de&lt;/a&gt;</email>
    </author>
  </entry>
  <entry>
    <title type="html"><![CDATA[Updated to OpenBSD 6.2]]></title>
    <summary type="html"><![CDATA[(A couple of days ago.)<br />
<br />
Was completely painless again - I'll still need to change my rspamd configuration to not use the external rmilter anymore, and there's a minor problem with syspatch:<br />
<br />
<iframe src="https://mastodon.infra.de/@galaxis/98810053668102425/embed" class="mastodon-embed" style="max-width: 100%; border: 1" width="400"></iframe><script src="https://mastodon.infra.de/embed.js" async="async"></script><br />
(from <a class="wiki external"  title="External link" href="https://mastodon.infra.de/@galaxis/98810053668102425" rel="external nofollow">https://mastodon.infra.de/@galaxis/98810053668102425</a> <a class="wikicache" target="_blank" href="tiki-view_cache.php?url=https%3A%2F%2Fmastodon.infra.de%2F%40galaxis%2F98810053668102425">(cache)</a>)<br />
<br />
<iframe src="https://mastodon.social/@phessler/98821962569631460/embed" class="mastodon-embed" style="max-width: 100%; border: 1" width="400"></iframe><script src="https://mastodon.social/embed.js" async="async"></script><br />
(from <a class="wiki external"  title="External link" href="https://mastodon.social/@phessler/98821962569631460" rel="external nofollow">https://mastodon.social/@phessler/98821962569631460</a> <a class="wikicache" target="_blank" href="tiki-view_cache.php?url=https%3A%2F%2Fmastodon.social%2F%40phessler%2F98821962569631460">(cache)</a>)<br />
<br />]]></summary>
    <published>2017-10-15T12:40:00+00:00</published>
    <updated>2017-10-15T12:40:00+00:00</updated>
    <link rel="alternate" type="text/html" href="https://web.gxis.de/tiki/tiki-view_blog_post.php%3FpostId%3D308"/>
    <id>https://web.gxis.de/tiki/tiki-view_blog_post.php%3FpostId%3D308</id>
    <author>
      <name>Alexander Bochmann</name>
      <email>&lt;a class="convert-mailto" href="mailto:nospam@example.com" data-encode-name="ab+wiki" data-encode-domain="st.gxis.de"&gt;ab+wiki at st.gxis.de&lt;/a&gt;</email>
    </author>
  </entry>
  <entry>
    <title type="html"><![CDATA[DMARC ARC]]></title>
    <summary type="html"><![CDATA[<iframe src="https://mastodon.infra.de/@galaxis/346946/embed" class="mastodon-embed" style="max-width: 100%; border: 1" width="400"></iframe><script src="https://mastodon.infra.de/embed.js" async="async"></script><br />
(from <a class="wiki external"  title="External link" href="https://mastodon.infra.de/@galaxis/346946" rel="external nofollow">https://mastodon.infra.de/@galaxis/346946</a> <a class="wikicache" target="_blank" href="tiki-view_cache.php?url=https%3A%2F%2Fmastodon.infra.de%2F%40galaxis%2F346946">(cache)</a>)<br />]]></summary>
    <published>2017-10-04T11:10:00+00:00</published>
    <updated>2017-10-04T11:10:00+00:00</updated>
    <link rel="alternate" type="text/html" href="https://web.gxis.de/tiki/tiki-view_blog_post.php%3FpostId%3D307"/>
    <id>https://web.gxis.de/tiki/tiki-view_blog_post.php%3FpostId%3D307</id>
    <author>
      <name>Alexander Bochmann</name>
      <email>&lt;a class="convert-mailto" href="mailto:nospam@example.com" data-encode-name="ab+wiki" data-encode-domain="st.gxis.de"&gt;ab+wiki at st.gxis.de&lt;/a&gt;</email>
    </author>
  </entry>
  <entry>
    <title type="html"><![CDATA[old Acer Launch Manager on Windows 10]]></title>
    <summary type="html"><![CDATA[I'm still using the same Acer Aspire 3820G laptop that I bought over six years ago, though I've switched to Windows 10 during the "free upgrade" time. Mostly everything works, despite missing vendor drivers. The function keys (sleep, sound volume, etc.) have basic support, but I recently noticed that the wireless switch only toggles through a handful of states, none of which have both Wifi and Cellular modem enabled.<br />
<br />
For Windows 7, Acer provided Dritek Launch Manager to enable or disable wireless functions (Wifi, Bluetooth, Cellular), but version 4.0.5 doesn't install successfully on Windows 10 - and newer releases don't support the 3820G hardware.<br />
<br />
After some experimentation it turns out that just starting the Launch Manager <em>Setup.exe</em> in compatibility mode for Windows 7 (right-click, select "Troubleshoot compatibility") surprisingly does the trick - installer completes, and after a reboot the wireless function key actually starts Launch Manager instead of driving the Win10 builtin toggle.<br />
<br />
<img src="tiki-download_file.php?fileId=8&display"  width="287" height="210" alt="Acer Launch Manager Win10" class="img-responsive regImage pluginImg8 img-fluid" /><br />
...so now I can use the Cellular modem and provide a Wifi hotspot at the same time.<br />]]></summary>
    <published>2017-09-22T17:11:00+00:00</published>
    <updated>2017-09-22T17:11:00+00:00</updated>
    <link rel="alternate" type="text/html" href="https://web.gxis.de/tiki/tiki-view_blog_post.php%3FpostId%3D306"/>
    <id>https://web.gxis.de/tiki/tiki-view_blog_post.php%3FpostId%3D306</id>
    <author>
      <name>Alexander Bochmann</name>
      <email>&lt;a class="convert-mailto" href="mailto:nospam@example.com" data-encode-name="ab+wiki" data-encode-domain="st.gxis.de"&gt;ab+wiki at st.gxis.de&lt;/a&gt;</email>
    </author>
  </entry>
  <entry>
    <title type="html"><![CDATA[a general purpose CPU in Conway's Game of Life]]></title>
    <summary type="html"><![CDATA[...originating from a <a class="wiki external"  title="External link" href="https://codegolf.stackexchange.com/questions/11880/build-a-working-game-of-tetris-in-conways-game-of-life" rel="external nofollow">challenge to build a working game of Tetris in Conway's Game of Life</a> <a class="wikicache" target="_blank" href="tiki-view_cache.php?url=https%3A%2F%2Fcodegolf.stackexchange.com%2Fquestions%2F11880%2Fbuild-a-working-game-of-tetris-in-conways-game-of-life">(cache)</a> on the Code Golf stackexchange. Somewhat similar to all the Minecraft CPUs I guess?<br />
<br />
<iframe src="https://mastodon.xyz/@garrett/8374324/embed" class="mastodon-embed" style="max-width: 100%; border: 1" width="600"></iframe><script src="https://mastodon.xyz/embed.js" async="async"></script><br />
(from <a class="wiki external"  title="External link" href="https://mastodon.xyz/@garrett/8374324" rel="external nofollow">https://mastodon.xyz/@garrett/8374324</a> <a class="wikicache" target="_blank" href="tiki-view_cache.php?url=https%3A%2F%2Fmastodon.xyz%2F%40garrett%2F8374324">(cache)</a>)<br />]]></summary>
    <published>2017-09-14T21:28:00+00:00</published>
    <updated>2017-09-14T21:28:00+00:00</updated>
    <link rel="alternate" type="text/html" href="https://web.gxis.de/tiki/tiki-view_blog_post.php%3FpostId%3D305"/>
    <id>https://web.gxis.de/tiki/tiki-view_blog_post.php%3FpostId%3D305</id>
    <author>
      <name>Alexander Bochmann</name>
      <email>&lt;a class="convert-mailto" href="mailto:nospam@example.com" data-encode-name="ab+wiki" data-encode-domain="st.gxis.de"&gt;ab+wiki at st.gxis.de&lt;/a&gt;</email>
    </author>
  </entry>
  <entry>
    <title type="html"><![CDATA[over 800 posts on Mastodon...]]></title>
    <summary type="html"><![CDATA[...yeah, most of the activity is currently over there.<br />
<br />
I've been trying to interface between there and here, but things are somewhat difficult. TikiWiki isn't the most modern thing there is, either...<br />
<br />
<iframe src="https://mastodon.infra.de/@galaxis/258007/embed" class="mastodon-embed" style="max-width: 100%; border: 1" width="100%"></iframe><script src="https://mastodon.infra.de/embed.js" async="async"></script><br />
(from <a class="wiki external"  title="External link" href="https://mastodon.infra.de/@galaxis/258007" rel="external nofollow">https://mastodon.infra.de/@galaxis/258007</a> <a class="wikicache" target="_blank" href="tiki-view_cache.php?url=https%3A%2F%2Fmastodon.infra.de%2F%40galaxis%2F258007">(cache)</a>)<br />]]></summary>
    <published>2017-09-10T20:58:00+00:00</published>
    <updated>2017-09-10T20:58:00+00:00</updated>
    <link rel="alternate" type="text/html" href="https://web.gxis.de/tiki/tiki-view_blog_post.php%3FpostId%3D304"/>
    <id>https://web.gxis.de/tiki/tiki-view_blog_post.php%3FpostId%3D304</id>
    <author>
      <name>Alexander Bochmann</name>
      <email>&lt;a class="convert-mailto" href="mailto:nospam@example.com" data-encode-name="ab+wiki" data-encode-domain="st.gxis.de"&gt;ab+wiki at st.gxis.de&lt;/a&gt;</email>
    </author>
  </entry>
  <entry>
    <title type="html"><![CDATA[disabling Intel Management Engine via "High Assurance Platform" mode]]></title>
    <summary type="html"><![CDATA[Positive Technologies <a class="wiki external"  title="External link" href="http://blog.ptsecurity.com/2017/08/disabling-intel-me.html" rel="external nofollow">have analyzed current Intel ME 11 code</a>, and found out about the HAP mode that seems to disable the Management Engine, suppsedly to be compliant to government requirements.<br />]]></summary>
    <published>2017-08-28T22:49:00+00:00</published>
    <updated>2017-08-28T22:49:00+00:00</updated>
    <link rel="alternate" type="text/html" href="https://web.gxis.de/tiki/tiki-view_blog_post.php%3FpostId%3D303"/>
    <id>https://web.gxis.de/tiki/tiki-view_blog_post.php%3FpostId%3D303</id>
    <author>
      <name>Alexander Bochmann</name>
      <email>&lt;a class="convert-mailto" href="mailto:nospam@example.com" data-encode-name="ab+wiki" data-encode-domain="st.gxis.de"&gt;ab+wiki at st.gxis.de&lt;/a&gt;</email>
    </author>
  </entry>
  <entry>
    <title type="html"><![CDATA[more downtimes]]></title>
    <summary type="html"><![CDATA[Ever since upgrading to OpenBSD 6.1 (and newer ports of everything), the web server seems to run out of file descriptors after some time, even though I have moved some of the older PHP applications over to a web hosting service.<br />
<br />
Couldn't find out what that is caused by, up to now.<br />]]></summary>
    <published>2017-08-20T14:44:00+00:00</published>
    <updated>2017-08-20T14:44:00+00:00</updated>
    <link rel="alternate" type="text/html" href="https://web.gxis.de/tiki/tiki-view_blog_post.php%3FpostId%3D302"/>
    <id>https://web.gxis.de/tiki/tiki-view_blog_post.php%3FpostId%3D302</id>
    <author>
      <name>Alexander Bochmann</name>
      <email>&lt;a class="convert-mailto" href="mailto:nospam@example.com" data-encode-name="ab+wiki" data-encode-domain="st.gxis.de"&gt;ab+wiki at st.gxis.de&lt;/a&gt;</email>
    </author>
  </entry>
  <entry>
    <title type="html"><![CDATA[site's been down for over a week...]]></title>
    <summary type="html"><![CDATA[...and I didn't even notice since I spent most of my online time <a class="wiki external"  title="External link" href="https://mastodon.infra.de/@galaxis" rel="external nofollow">on my Mastodon instance</a>.<br />
<br />
Somehow I managed to lose the <code>p5-Time-TimeDate</code> package on the OpenBSD web server, which in turn made vlogger fail to start up, and that resulted in all kinds of followup problems for the web service.<br />
<br />
Unfortunately I have no memory of removing the package, so I'm not quite sure what happened there (but the date matches a day where I started moving some web sites off this server, so maybe I did some misguided cleanup)...<br />]]></summary>
    <published>2017-07-15T13:21:00+00:00</published>
    <updated>2017-07-15T13:21:00+00:00</updated>
    <link rel="alternate" type="text/html" href="https://web.gxis.de/tiki/tiki-view_blog_post.php%3FpostId%3D301"/>
    <id>https://web.gxis.de/tiki/tiki-view_blog_post.php%3FpostId%3D301</id>
    <author>
      <name>Alexander Bochmann</name>
      <email>&lt;a class="convert-mailto" href="mailto:nospam@example.com" data-encode-name="ab+wiki" data-encode-domain="st.gxis.de"&gt;ab+wiki at st.gxis.de&lt;/a&gt;</email>
    </author>
  </entry>
  <entry>
    <title type="html"><![CDATA[find obsolete packages on a Debian system]]></title>
    <summary type="html"><![CDATA[After dist-upgrading a Debian system recently, I wondered which packages might have been left over from previous releases (the system in question has been through several dist-upgrades over its lifetime), even after running <code>apt-get autoremove</code> and <code>deborphan</code>. After <a class="wiki external"  title="External link" href="https://mastodon.infra.de/@galaxis/95461" rel="external nofollow">dropping that question on Mastodon</a> <a class="wikicache" target="_blank" href="tiki-view_cache.php?url=https%3A%2F%2Fmastodon.infra.de%2F%40galaxis%2F95461">(cache)</a>, I got an answer pointing to <code>apt-show-versions</code>, which I didn't know of up to now.<br />
<br />
This totally does what I've been looking for. From the man page:<br />
<br />
<pre>NAME
       apt-show-versions - Lists available package versions with distribution

DESCRIPTION
       apt-show-versions parses the dpkg status file and the APT lists for the installed and available package
       versions and distribution and shows upgrade options within the specific distribution of the selected package.

       This is really useful if you have a mixed stable/testing environment and want to list all packages which are
       from testing and can be upgraded in testing.
</pre><br />
<br />
Since I didn't have a package cache for apt-show-versions from the older release, all old packages are currently just shown with a <em>No available version in archive</em> comment. But since current packages are being tagged with the release, I can just exclude those with a simble grep:<br />
<br />
<tt> # apt-show-versions | egrep -vc jessie</tt><br />
<tt> 58</tt><br />
<br />
<br />]]></summary>
    <published>2017-07-08T08:40:00+00:00</published>
    <updated>2017-07-08T08:40:00+00:00</updated>
    <link rel="alternate" type="text/html" href="https://web.gxis.de/tiki/tiki-view_blog_post.php%3FpostId%3D300"/>
    <id>https://web.gxis.de/tiki/tiki-view_blog_post.php%3FpostId%3D300</id>
    <author>
      <name>Alexander Bochmann</name>
      <email>&lt;a class="convert-mailto" href="mailto:nospam@example.com" data-encode-name="ab+wiki" data-encode-domain="st.gxis.de"&gt;ab+wiki at st.gxis.de&lt;/a&gt;</email>
    </author>
  </entry>
</feed>
