the stream

Links to articles, short comments on various topics - basically the sort of posts I would have put out on Google+ in previous years.

acmetool - yet another Let's Encrypt automation tool

Alexander Bochmann Sunday 12 of March, 2017
acmetool (GitHub: hlandau/acme) seems to bring a couple of interesting options for serving acme http challenges, and a hook for external programs to handle the DNS challenge method. Configuration through simple files in a predefined directory structure. Looks like a workable compromise between the rather heavyweight official client and the various shell scripts.

Regina Spektor on KEXP

Alexander Bochmann Friday 10 of March, 2017
That was a most welcome surprise for tonight... Five songs from the new album and a half-hour interview in this "full performance" video on the KEXP channel on YouTube.

The interview part is just as excellent as the music, and starts at 18:18 in the video. Lots of information about her life and her songwriting. Just listen to the three minutes from 47:37 for a strong reminder that these are not the times to stay depressed over.

The Trapper and the Furrier nicely shows off some of the flexibility of her voice.

android backup file header

Alexander Bochmann Wednesday 08 of March, 2017
I'll spoil the fun from Florian Haas' question on G+ right away - the resulting info seems useful:

Florian Haas wrote:
OK people, try to guess (without googling) what this does:

( printf "\x1f\x8b\x08\x00\x00\x00\x00\x00" ; tail -c +25 oldfile ) > newfile

Clue: head→desk, seriously.

Obviously, this replaces the header of a file. But why?

Florian Haas wrote:
This is how you "transform" an Android backup file into a regular gzipped tarball.

packagecloud blog debian-howto category

Alexander Bochmann Tuesday 07 of March, 2017
The packagecloud people (which I didn't know about until Ted Unangst linked to one of their recent sycall performance blog posts) have a debian-howto category on their blog with some posts that seem rather useful.

Nothing that can't be found elsewhere (like the official Debian documentation), but the descriptions of package creation workflows, for example, are condensed down to the essentials quite well:

reverse engineering the Newton MessagePad ROM card

Alexander Bochmann Tuesday 07 of March, 2017
Here, with Eagle schematics.

Matthias Melcher wrote:
Anyway, wouldn't it be fantastic to create a souped-up ROM board? 8MB Flash and 8MB NewtonOS, also in Flash, being able to patch it, fix it, extend it, have fun. Maybe have even more that 16MB if that is possible. Is it possible? How can we find out?

An early draft of the licensee information for this ROM card exists, but it is not detailed enough to build such a card. Before starting a patch wire solution, I wanted to know how the original board worked, and then fill in the missing information in that draft.

Well, I went all the way and reverse engineered the entire ROM board. Here are my findings.

The article also reminded me of this old post by Landon Dyer, which explains how they came up with the ROM-patching idea...

(Via tedu's inks.)

WikiLeaks just announced another fun few weeks of emergency patching...

Alexander Bochmann Tuesday 07 of March, 2017

Wikileaks wrote:
The first full part of the series, "Year Zero", comprises 8,761 documents and files from an isolated, high-security network situated inside the CIA's Center for Cyber Intelligence in Langley, Virgina. [..]
Recently, the CIA lost control of the majority of its hacking arsenal including malware, viruses, trojans, weaponized "zero day" exploits, malware remote control systems and associated documentation. This extraordinary collection, which amounts to more than several hundred million lines of code, gives its possessor the entire hacking capacity of the CIA. The archive appears to have been circulated among former U.S. government hackers and contractors in an unauthorized manner, one of whom has provided WikiLeaks with portions of the archive.

OpenBSD malloc.conf(5)

Alexander Bochmann Tuesday 07 of March, 2017
Yikes. I've been using OpenBSD on and off since release 2.3, but I wasn't aware of malloc.conf(5) (which seems to have been introduced with OpenBSD 2.5, back in 1999, and allows control over several features of the memory allocator):

Upon the first call to the malloc(3) family of functions, an initialization sequence inspects the symbolic link /etc/malloc.conf, next checks the environment for a variable called MALLOC_OPTIONS, and finally looks at the global variable malloc_options in the program. Each is scanned for the following flags. [..]

SHA1-collisions applied to Bittorrent

Alexander Bochmann Monday 06 of March, 2017
Unless more generic SHA1 collisions turn up, this looks like a somewhat forced scenario (that doesn't really warrant an own name and web site, but hey) - someone has thought up a way to apply the SHAttered attack to Bittorrent:

As far as I understand from the BitErrant web site, they're proposing to use the two colliding data blocks from SHAttered to create two torrents that contain one differing chunk (with the same SHA1 hash nevertheless), and then look at the contents of that chunk as a trigger to decide whether to execute a "hidden" malicious payload that's contained elsewhere in both versions of the torrent. (Bittorrent uses a SHA1 hash to identify each 32k chunk in the torrent.)

Yeah, ok. I don't think I'm particularly scared now...

(Via Isotopp.)

Red Hat website: Information? Subscription-only...

Alexander Bochmann Monday 06 of March, 2017
Not that I mind - if people absolutely want to use Red Hat, they should be paying for it...

Case in point: An article about recommendations for configuring swap on modern linux systems, which contains no useful information about why an admin should select 20% of the available memory as swap size - for that part, it links to a "solution document", which in turn requires a subscription...

Since "modern Linux" doesn't use swap as backing for crash dumps, there never was a reason to tie swap size to real mem in the first place. (And I don't think I've used - or even set up - kdump on any system in the past 10 years...)

(Via Scot Stevenson on G+.)

ISC Kea dhcp server

Alexander Bochmann Saturday 04 of March, 2017
I wasn't aware that the ISC is working on a new high-performance DHCP server, Kea. (Let's hope it'll meet a better fate than the BIND 10 effort. )

ISC wrote:
Kea is designed to be easily extensible through an applications API. This API can be called at multiple places during the DHCP processing, to consult or update enterprise provisioning systems, for example. Kea DHCP leases may be stored in a memory file database, or in a MySQL or Postgres database.

The Kea web page also has a short table with a comparison to the classic ISC dhcpd.

"oldssh" alias

Alexander Bochmann Friday 03 of March, 2017
Similar to "secure" (SSL) web admin interfaces on various systems, which are by now so outdated that modern browsers refuse to talk to them, it now gets increasingly difficult to get OpenSSH to connect to old ssh servers... For the web stuff, it's useful to keep an old version of Portable Firefox available...

For ssh, I've seen this hint on IRC today:

alias oldssh='ssh -o '\''HostKeyAlgorithms=+ssh-dss'\'' -o '\''KexAlgorithms=+diffie-hellman-group1-sha1'\'''

That should work with everything, unless you're trying to connect to a server that only supports ssh1 - which is usually disabled in current OpenSSH builds, and will go away completely later this year: "In approximately August 2017, removing remaining support for the SSH v.1 protocol (client-only and currently compile-time disabled)." (From the OpenSSH 7.4 release notes).

Well, I guess PuTTY can still do that.

selling your weapons to all sides

Alexander Bochmann Thursday 02 of March, 2017
Ok, so not really weapons, more like an online outrage generator: BuzzFeed News traced a group of liberal and conservative websites back to the same company. “The product they’re pitching is outrage,” said one liberal writer.

buzzfeed wrote:
It’s unclear if the people running American News LLC use the same writers for their conservative and liberal websites, or if they have separate teams. What is clear is at least one of their sites is using fake author photos. The author page for God Today lists two writers, Henry Freeman and John Sullivan. The photos for these writers are taken from stock video footage.

(Via netzpolitik.org (german).)

ipspace: Leaf-and-spine fabrics versus fabric extenders

Alexander Bochmann Monday 27 of February, 2017

Ivan Pepelnjak wrote:
It’s obvious that a bunch of fabric extenders (leafs) connected to a pair of Nexus switches (spines) form a leaf-and-spine fabric.
However, there are several important differences between a fabric extender-based fabric and a leaf-and-spine fabric built with standard data center switches:
* In a well-designed leaf-and-spine fabric the spine nodes are completely independent – they share no configuration, state or risk. Nexus switches configured as a vPC pair share a lot of configuration and state (and risk).
* Leaf nodes in a traditional leaf-and-spine fabric are independent devices, whereas fabric extenders act as linecards of the spine switches. The blast radius (how many things can go wrong based on a single failure) on a fabric extender-based architecture is much larger than in a fabric built with independent switches.
* Independent leaf nodes can do local packet switching whereas in a fabric extender environment all traffic has to traverse the spine layer.

We don't use Nexus fabrics in our datacenter, but the "blast radius" of a Juniper EX or QFX Virtual Chassis (Fabric) control plane failure isn't much different (though they can do local packet switching on linecards, unlike the FEXen). Our next DC design will probably go towards a routed fabric - though we'll have to build up all the automation infrastructure and skills that comes with that. The Virtual Chassis black box, for all it's downsides, removes a lot of the configuration complexity.

Ted Unangst: (l)inks

Alexander Bochmann Monday 27 of February, 2017
I wasn't aware (should probably think up a tag for posts that begin with those or similar words) that tedu had started a link collection fed from things he was reading a while ago - somewhat similar to what I'm trying to do here (and now another input for my RSS reader).

Today, he reflected on 1000 links having been posted to that collection. I can relate to a lot of what he wrote.

tedu wrote:
There was also the question of whether to post popular links seen elsewhere or focus on hidden gems. ICYMI YOLO FOMO. A curated best of list is good for people who want to replace social aggregators, but redundant for those who don’t. Focusing on the underserved link market means the site is less useful as an archive. It feels weird to exclude a link because other people liked it, and being able to flip back and find a link a week later has actually been immensely helpful.

His format is somewhat more terse than mine, usually with a one-line quote and a few words of comment. Okay, mabe it just seems more terse because the site is using a very simple layout.

tedu wrote:
There’s always some proposal or another about how to fix or replace sites like Twitter and HN. One possibility is for everybody to run a little site where they post their favorite links. Subscribe to the people who post good stuff, and boom, all those complaints about clickbait rising to the top disappear.

Hey, a distributed social network ;)