Thinking Tools: September 2016

Gordon does them every now and then, so I’m going to start doing them too:

  • This site, which I am meaning to most more often to (and not just pictures like I did before).
  • I guess proof is what looks to become a series of posts on my laptop being my router. I’ve posted about how I feel, so it’s progress.

  • Twitter, via Hotot+ on Chrome for the desktop, and Fenix on Android.
  • The problem is that with Twitter Co. being assholes to their devs, Hotot+ has had its API key suspended a few times and Fenix is not really in active development any more after running out of app tokens. Given the current news about Twitter Co. looking to sell itself I wonder what will replace it for me. It’s basically become my social life on the internet, since I’m not really active on IRC anymore. I am on facebook mostly for family.

  • Notepad++
  • Jot down pretty much anything that pops into my mind. Sometimes I do use it to edit blog posts for usually the text mode WordPress editor suffices. I’ve tried to do a diary of sorts in it but it’s harder than I thought it’d be.

  • Franz
  • I was using the Common Hangouts Chrome extension but Google went and fucked around with Hangouts again, so it stopped working. Pidgin is basically AWOL. Trillian is crap. So after much consideration I gave in and installed it. It looks like crap on my 4k display and Hangouts still has the stupid new interface, but at least it lets me have a single window for what little messaging I do these days.

  • KeePass
  • Been using it for years now. Probably won’t stop ever. Everything wants/needs its own password now.

    The most pressing need that I have for myself is a replacement for Tiddlywiki that I can run from this server; it’d probably require me to configure HTTPS but that’s another project worth learning. The main issue then becomes choosing an appropriate wiki that is about as flexible as tiddlywiki *without* requiring the use of any extensions on the browser. Running this from the server would also allow me to update it from any mobile devices. Tiddlywiki is decidedly desktop software; the clients available for on Android all suck.

    This is why it’s so pressing for me. I need something that lets me document my life so I can offload stuff from wetware onto software. I’ll keep trying using simple text for now… but I think my mind simply works better using a wiki paradigm.

    I really do wonder what Twitter will turn into once it doesn’t belong to itself, though.

A Debian Wifi Router: Kernel tuning

So it turns out that if you go with the default kernel parameters on the device you won’t get much throughput. I’m currently paying my ISP for a 25Mbit/s pipe both ways, which is bloody awesome.

I was having problems with throughput and network jitter, though. I was able to have a fast connection from my devices to the router and the router had the full connection available to itself; problems were the router was not able to make the full connection bandwidth available to its clients and the bandwidth would go from 25Mbit/s all the way down to 5Mbit/s all the time.

This is really damn annoying when you’re putting in a good match on Unreal Tournament, let me tell you.

Thinking it could be something related to hostapd I played around with a few more settings but nothing really made a difference. I’m having problems with reception and throughput in my bedroom but that’s for another post, I guess. Suffice to say that with a direct line of sight to the router everything works about as expected.

So it wasn’t hostapd. Played around with iwconfig and iw but neither made much of a difference. That left the network interfaces themselves and the kernel.

Dug around and found plenty of links and articles on what settings to adjust and how to adjust them but all of them are geared towards servers of some sort. There isn’t much information that a home/office IT guy would be able to use for tuning the kernel for bandwidths of less than 100Mbit/s, which is what I’m attempting to do here. The most popular post (which I basically copied into my configuration) is using settings for 1Gbit/s connections that I then changed with the one entry that matched from the Ars Technica post.

Here’s sysctl.conf as I have it right now:

# /etc/sysctl.conf - Configuration file for setting system variables
# See /etc/sysctl.d/ for additional system variables.
# See sysctl.conf (5) for information.
#

#kernel.domainname = example.com

# Uncomment the following to stop low-level messages on console
#kernel.printk = 3 4 1 3

##############################################################3
# Functions previously found in netbase
#

# Uncomment the next two lines to enable Spoof protection (reverse-path filter)
# Turn on Source Address Verification in all interfaces to
# prevent some spoofing attacks
#net.ipv4.conf.default.rp_filter=1
#net.ipv4.conf.all.rp_filter=1

# Uncomment the next line to enable TCP/IP SYN cookies
# See http://lwn.net/Articles/277146/
# Note: This may impact IPv6 TCP sessions too
#net.ipv4.tcp_syncookies=1

# Uncomment the next line to enable packet forwarding for IPv4
net.ipv4.ip_forward=1

# Uncomment the next line to enable packet forwarding for IPv6
#  Enabling this option disables Stateless Address Autoconfiguration
#  based on Router Advertisements for this host
#net.ipv6.conf.all.forwarding=1


###################################################################
# Additional settings - these settings can improve the network
# security of the host and prevent against some network attacks
# including spoofing attacks and man in the middle attacks through
# redirection. Some network environments, however, require that these
# settings are disabled so review and enable them as needed.
#
# Do not accept ICMP redirects (prevent MITM attacks)
#net.ipv4.conf.all.accept_redirects = 0
#net.ipv6.conf.all.accept_redirects = 0
# _or_
# Accept ICMP redirects only for gateways listed in our default
# gateway list (enabled by default)
# net.ipv4.conf.all.secure_redirects = 1
#
# Do not send ICMP redirects (we are not a router)
#net.ipv4.conf.all.send_redirects = 0
#
# Do not accept IP source route packets (we are not a router)
#net.ipv4.conf.all.accept_source_route = 0
#net.ipv6.conf.all.accept_source_route = 0
#
# Log Martian Packets
#net.ipv4.conf.all.log_martians = 1
#
# Kernel parameter adjustments
# 2016/09/12 02:59:32: http://www.nateware.com/linux-network-tuning-for-2013.html
# http://arstechnica.com/gadgets/2016/04/the-ars-guide-to-building-a-linux-router-from-scratch/
#
kernel.sem = 250 256000 100 1024

# Increase system file descriptor limit
 fs.file-max = 100000
#
# # Discourage Linux from swapping idle processes to disk (default = 60)
 vm.swappiness = 10
#
# # Increase ephermeral IP ports
 net.ipv4.ip_local_port_range = 10000 65000
#
# Increase Linux autotuning TCP buffer limits
# Set max to 16MB for 1GE and 32M (33554432) or 54M (56623104) for 10GE
# Don't set tcp_mem itself! Let the kernel scale it based on RAM.
net.core.rmem_default = 4194304
net.core.rmem_max = 4194304
net.core.wmem_max = 4194304
net.core.rmem_default = 4194304
net.core.wmem_default = 4194304
net.core.optmem_max = 40960
net.ipv4.tcp_rmem = 4096 87380 4194304
net.ipv4.tcp_wmem = 4096 65536 4194304

# Make room for more TIME_WAIT sockets due to more clients,
# and allow them to be reused if we run out of sockets
# Also increase the max packet backlog
net.core.netdev_max_backlog = 25000
net.ipv4.tcp_max_syn_backlog = 4096
net.ipv4.tcp_max_tw_buckets = 200000
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_fin_timeout = 10

# Disable TCP slow start on idle connections
net.ipv4.tcp_slow_start_after_idle = 0

# If your servers talk UDP, also up these limits
net.ipv4.udp_rmem_min = 8192
net.ipv4.udp_wmem_min = 8192

# Disable source routing and redirects
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.accept_source_route = 0

# Log packets with impossible addresses for security
net.ipv4.conf.all.log_martians = 1

Everything in here I’m sure can be tuned further and the file itself is so damn ugly to look at but for now at least I have a starting point I can use.

All this tomfoolery is turning me into a network wonk.

I really don’t want to be writing this. Well no, that’s not true. I don’t want to have to write this, but sex education is lacking as it is and far too many people are being rather lackadaisical about the whole thing. Because I can’t in good conscience let condoms which can’t reliably condom be on the market […]

Source: A Pox On Your Box: The Problem of LELO Hex – Lorax Of Sex

It’s makes all the difference whether something fails silently or something fails and explodes in your face.

For most programming code written out there, you want some indication that it failed (that is, it sets off a small explosion or it sets off a big explosion) so you can know something is wrong and can fix it. When something fails silently you don’t even know there’s a problem until something happens that you literally cannot fix. Like your backups silently failing until you need to recover something… to find the information has been lost. Forever.

In the case of this condom design, the consequences of it failing silently are literally of life and death important:

  • You could get an STI and not know.
  • You would then become one of those asshole people that don’t even bother to get tested for STIs because “it could never happen” to them.

  • You could get pregnant, or get someone pregnant.
  • When a regular condom fails you know it failed and you can take measures. In this case the only alternative will be to have the baby, or have an abortion.

These things are important and fact people are falling for the hype means sex education is simply not keeping up with the reality of the world.

A Debian wifi router

The search of a living space has been over for over a month now and I’m more or less settled in. I had a bad experience with my previous landlord keeping my wireless router (an Asus AC-RT68U) cos he’s a fucking asshole so I decided to give this a shot. I’m actively trying to solve money now so it really wasn’t an option to just buy another one as my living costs are now much, much higher.

I’ve hoarded a bit of equipment so I did have a couple of computers available to me. With a bit of looking I found about hostapd and I got it to work more or less reliably on a Thinkpad X220 with an Intel Centrino chipset using the iwlwifi driver. The real problem started when I tried using my older Thinkpad T60 laptop for the same task. Mine has an Intel PRO/Wireless 3945ABG [Golan] chipset also using the iwlwifi driver but the crucial difference was that this chipset doesn’t support Master mode, so you can’t use it with hostapd to enable an AP. Looked around for a bit and tried using this Archer T2UH from Amazon but the support on Linux is a fucking joke, basically; they actually want you to compile the drivers from scratch to get everything going. Ended up with an Ubiquiti Networks SR71-C card using the ath9k chipset. I tried setting it up using the already-installed environment but I couldn’t get it work so I basically reinstalled everything from scratch to start fresh.

I pieced this together from instructions found on the Debian Wiki, this guide from Ars Technica on building your own router, hostapd documentation, and a whole host of blog posts detailing how to pull this off, most of them with information easy to mess up.

As it is right now I’m typing this up on a Windows 10 system connected to the laptop and the signal and throughput are good enough for extended sessions playing Unreal Tournament pre-alpha.

Install Operating System

Installed Debian Stable fresh on the system with no desktop environment. This computer will now be a router so we don’t need any kind of desktop environment. Most desktop environments now require NetworkManager or wicd to manage network connectivity and I wanted to avoid all that crap. It just makes things more complicated for something that will be complicated enough already. I used the netinst install media with the laptop connected to ISP through Ethernet and getting an IP address through DHCP, so I didn’t have to fiddle with any PPPoE clients to get online and install the stuff required.

# aptitude update
# aptitude install hostapd bridge-utils isc-dhcp-server bind9 rfkill vbetool vim-runtime vim-goodies tmux

Enable Wifi Adapter

For some weird and lame reason Debian didn’t enable the adapter after installation, so it has to be setup manually. These instructions are based on the Debian Wiki. Atheros card is wlan0 while built-in Intel adapter is wlan1.

# ip a
# rfkill unblock all
# iwconfig
# ip link set wlan0 up
# iwlist scan

The card scanned for networks around so it was working.

Edit /etc/network/interfaces so the WLAN interface doesn’t wait for an IP address. If you don’t do this it turns out the OS stops booting until it gets bored of waiting for an IP address.

auto wlan0
iface wlan0 inet static
    wireless-mode Master
    address 192.168.1.1
    netmask 255.255.255.0

You can use whatever IP address (like 10.0.0.1) but make sure the same subnet is used throughout the entire configuration. I went with 192.168.1.1 cos that’s what I like my networks to be on.

Configure iptables

Edit /etc/sysctl.conf and uncomment the line for IPV4 packet forwarding:

net.ipv4.ip_forward=1

Create /etc/network/if-pre-up.d/iptables with the following contents

#!/bin/sh
/sbin/iptables-restore < /etc/network/iptables

Then

# sudo chown root /etc/network/if-pre-up.d/iptables ; chmod 755 /etc/network/if-pre-up.d/iptables

Create /etc/network/iptables and put the following in it:

*nat
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
# eth0 is WAN interface
-A POSTROUTING -o eth0 -j MASQUERADE

COMMIT

*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]

# Forward traffic from wlan0 (LAN) to eth0(WAN)
-A FORWARD -i wlan0 -o eth0 -j ACCEPT

# Service rules
-A INPUT -j ACCEPT

# Forwarding rules
-A FORWARD -j ACCEPT

COMMIT

At this point iptables will simply pass along all the traffic that his the computer. I’ve since changed my configuration but this is a starting point as I just wanted to get online at this point. iptables rules are a pain in the ass to type.

Configure DHCP

Edit /etc/dhcp/dhcpd.conf and add the following at the end of the file:

subnet 192.168.1.1 netmask 255.255.255.0 {
range 192.168.1.100 192.168.99.199;
option routers 192.168.1.1;
option domain-name-servers 192.168.1.1;
option broadcast-address 192.168.1.255;
}

Configure DNS

BIND works out of the box, thankfully enough.

Configure hostapd

Create and edit /etc/hostapd/hostapd.conf and put the following in it:

interface=wlan0
driver=nl80211
# SSID on 5GHz band
ssid="MY WIFI NETWORK"
hw_mode=a
channel=44

# Radar an' stuff
country_pre=US
ieee80211d=1
ieee80211h=0

# 802.11n goodness
wmm_enabled=1
ieee80211n=1

# wpa
auth_algs=1
wpa=3
wpa_passphrase=MyWifiPassword
wpa_key_mgmt=WPA-PSK
wpa_pairwise=TKIP
rsn_pairwise=CCMP

ht_capab=[HT20][HT40+][SHORT-GI-40][TX-STBC][RX-STBC1][DSSS_CCK-40]

The ht_capab are the ones I’ve found work with the SR71-C card. I’ll keep playing with them.

At this point everything looked good and rebooted. I actually rebooted a whole bunch of times as I kept prodding and poking stuff every step of the way but I guess it all could be done in one go and just reboot at the end.

Actually be a Wifi Router

After rebooting do

$ sudo hostapd /etc/hostapd/hostapd.conf

Runs with the SSID, picks a channel, and starts the laptop as an AP. iptables is routing traffic from one interface to another, ISC DHCP gives out IP addresses and BIND does DNS. I did run into an issue where wlan0 kept sending out DHCP requests to which dhcpd would successfully assign a new IP address for wlan0. I got lazy and just set a static IP for the mac address of the interface on dhcp.conf. I’ll fix it… eventually.

There’s also the issue of tuning the kernel, firewall and a lot of other stuff since the computer is a single-purpose device rather than a multi-user computer. Most of the documentation I can find is for systems handling traffic at internet scale that would be overkill, so a lot of documentation will be read and a ton of adjustments made.

There will be also a lot of adjustments to hostapd itself to maximize throughput and signal stability. The SRC71C card only does 802.11n but the bitrate on this standard maxes out depending on the blue of the sky, the stage of the moon, how hot the dumpster fires are on twitter and how pissed off the boss is at work.

From what I’m getting this is relatively new stuff when it comes to DIY. People were doing this in the past but was way more costly (like this sweet setup right here). I’m doing this on the cheap and it seems to be working well enough.

Hold strong against the waves

Shifts on the phone just… wear you down, humans. They wear you down, hard, no matter how fit you think you can take the damage.

You never see the person. You usually never even know what they look like (we have social media for that nowadays) but they sure wear you down, call after call.

Doesn’t matter if you’re apologizing to someone or if you’re apologizing for someone. The mere fact that you have to talk to someone is enough to grate on you.

This is why there is so much turnover at call centers. Talking to other humans is just hard. Because no matter what you’re calling about or why you’re calling about, they usually resent it.

The internet has not made this better. It has made this worse.

Unhappiness on the twitter dot com

I got into an argument with someone, but the very end of it came down to this:

August 27, 2016 31057 AM CDT

This person actually said that I do not deserve a happy relationship.

So… does he wish for me to be in an abusive relationship? No relationships at all for the rest of my life? No friendships (since you can be happy with friends) then?

Still. It all arose from something that he was offended by. We argued a bit but once we saw we couldn’t make up for the differences we parted ways. And then he said that.

You do do, my good sir. I *hope* you don’t get your businesses bankrupted, that your significant others don’t do you wrong, that your children (if you have any, that is) don’t regret having you as their parent.

I don’t believe I’ll have a relationship that I will be feel happy and content with. But that’s for me to find out and to strive the opposite. It is not for you to declare.

I wish you the best in life simply because you wished me the worst. I have seen some of the worst and I would not wish that upon you.

How Things Work

One of Gawker’s most cherished tags was “How Things Work,” a rubric that applied to posts revealing the sausage-making, the secret ways that power manifests itself. The phrase has a children’s book feel to it, bringing to mind colorful illustrations of animals in human work clothes building houses or delivering mail. Of course it also carries the morbid sense of innocence lost, and the distance between the stories we tell ourselves about the world and the way it actually works. Collapsing that distance is, in many ways, what Gawker has always been about.

And so Gawker’s demise turns out to be the ultimate Gawker story. It shows how things work.

Source: How Things Work

Much lauded, much hated. So long.

Finances

I seriously need to change my habits. I’m spending too much money and my cost of living went up %250.

I thought it’d be easy — doesn’t one always think so? — but it’s not. For starters I need to stop buying other people food just because I can.

Need to be much more careful with these sort of expenses. They really creep up on you.

This month will be more or less okay, but I really need to pay attention during September.