Entries by Raymond P. Burkholder

Prelude To A 2008 Event: Paper Gold Manipulation Intensifies

And has anyone checked gold lease rates lately? Currently the lease rate curve for gold and silver in London is inverted. In fact, lease rates gold from 3 months to a year are negative. Negative lease rates mean the Central Banks will pay bullion banks to lease gold and silver. Long-timers like me know that this means there’s an immediate and anticipated shortage of physical gold and silver available for delivery, where “delivery” means the metal is removed from the London vaults and shipped to the entitled buyer.

Both gold and silver are backwardated. It took 11 iterations in the LBMA p.m. fix on Tuesday to balance out the heavy demand for physical gold from bidders. 11 iterations is rare occurrence. 5-6 iterations is rare. 1 or 2 is typical. Metal is tight in London.

If you are monitoring the Comex Hong Kong kilo bar vaults, you are aware that the movement in and out of the vaults there suggests that metal is also tight in Hong Kong, which means it is likely tight in Shanghai.

• PacketLife's Armory - encryption, exploitation, intrusion detection, forensics, vulnerability scanning, system monitoring, packet crafting, spoofing, ...
• IpCisco's Network Tools - packet analyzers, security audit, simulators, intrusion detection, ...

Here are some instructions I use to build a light weight gui in an LXC container. The window easily scales, and with Wine, Windows applications can be run without the Windows overhead.

Using X2Go Packages for Debian GNU/Linux as a reference, I created /etc/apt/sources.list.d/x2go.list with the following content:

# X2Go Repository (release builds)
deb http://packages.x2go.org/debian stretch extras main
# X2Go Repository (sources of release builds)
deb-src http://packages.x2go.org/debian stretch extras main

I have the following primary sources in /etc/apt/sources.list:

deb [arch=amd64] http://ftp.us.debian.org/debian          stable        main contrib
deb [arch=amd64] http://security.debian.org/debian-security stable/updates main contrib
deb [arch=i386] http://ftp.us.debian.org/debian          stable        main contrib
deb [arch=i386] http://security.debian.org/debian-security stable/updates main contrib

Then the following commands will add wine64, wine32, lxde, and x2go server:

vim.tiny /etc/apt/sources.list
apt update
dpkg --add-architecture i386 && apt-get update && apt-get install wine32 wine winetricks
apt update
apt install gnupg2
apt-key adv --recv-keys --keyserver keys.gnupg.net E1F958385BFE2B6E
vim.tiny  /etc/apt/sources.list.d/x2go.list
apt update
apt-get install x2go-keyring && apt-get update
apt install \
  --no-install-recommends \
    xserver-xorg-core \
    xserver-xorg-input-all \
    xserver-xorg-video-fbdev  \
    xserver-xorg-video-vesa \
    lxde \
    x2goserver-xsession \
    x2golxdebindings

VNC client is not used. An X2Go client is used instead. It seems to be fast and efficient. And works through ssh. It can even do a proxied hop through one ssh connection to a second ssh destination.

Q.  Which is the greater problem in the world today,
    ignorance or apathy?
A.  I don't know and I couldn't care less.

"If was one thing all people took for granted, was conviction that if you 
 feed honest figures into a computer, honest figures come out. Never doubted 
 it myself till I met a computer with a sense of humor."
                             Robert A. Heinlein, The Moon is a Harsh Mistress

hope for the best, plan for the worst

• rtl-sdr - an ultra cheap software defined radio based on DVB-T TV tuners with RTL2832U chips. The RTL-SDR can be used as a wide band radio scanner. It may interest ham radio enthusiasts, hardware hackers, tinkerers and anyone interested in RF.
• arch daily - to collect the most important information to - help architects create better architecture, became a fast growing technology company that delivers inspiration, tools and knowledge to the 10 million architects that visit and use ArchDaily each month.
• Migrating to open source software: Linux - Going Open Source: An Overview of Open Source Software and Linux Migration

On a Debian Stretch KDE system, some combination of the following was able to change the natural scrolling direction to match that of a MacOS computer.

apt install xinput
apt install xserver-xorg-input-synaptics
apt install xserver-xorg-input-evdev

Place the following (from /usr/share/X11/xorg.conf.d/70-synaptics.conf) in /etc/X11/xorg.conf.d/70-synaptics.conf:

# Example xorg.conf.d snippet that assigns the touchpad driver
# to all touchpads. See xorg.conf.d(5) for more information on
# InputClass.
# DO NOT EDIT THIS FILE, your distribution will likely overwrite
# it when updating. Copy (and rename) this file into
# /etc/X11/xorg.conf.d first.
# Additional options may be added in the form of
#   Option "OptionName" "value"
#
Section "InputClass"
        Identifier "touchpad catchall"
        Driver "synaptics"
        MatchIsTouchpad "on"
# This option is recommend on all Linux systems using evdev, but cannot be
# enabled by default. See the following link for details:
# http://who-t.blogspot.com/2010/11/how-to-ignore-configuration-errors.html
#       MatchDevicePath "/dev/input/event*"
        Option "NaturalScrolling" "true"
EndSection

Section "InputClass"
        Identifier "touchpad ignore duplicates"
        MatchIsTouchpad "on"
        MatchOS "Linux"
        MatchDevicePath "/dev/input/mouse*"
        Option "Ignore" "on"
EndSection

# This option enables the bottom right corner to be a right button on clickpads
# and the right and middle top areas to be right / middle buttons on clickpads
# with a top button area.
# This option is only interpreted by clickpads.
Section "InputClass"
        Identifier "Default clickpad buttons"
        MatchDriver "synaptics"
        Option "SoftButtonAreas" "50% 0 82% 0 0 0 0 0"
        Option "SecondarySoftButtonAreas" "58% 0 0 15% 42% 58% 0 15%"
EndSection

# This option disables software buttons on Apple touchpads.
# This option is only interpreted by clickpads.
Section "InputClass"
        Identifier "Disable clickpad buttons on Apple touchpads"
        MatchProduct "Apple|bcm5974"
        MatchDriver "synaptics"
        Option "SoftButtonAreas" "0 0 0 0 0 0 0 0"
EndSection

In 'System Settings' -> 'Input Devices' -> TouchPad -> Scrolling, I have 'Reverse Scrolling' -> Vertical enabled.

The last section of SynapticsTouchpad mentioned the driver to install, which contradicts the beginning of the page, but indicates that libinput lacks what synaptics provides, so the roles need to be reversed.

From [SOLVED] KDE reverse/natural scrolling not working, I added the Option "NaturalScrolling" "true" line in the above file.

Reverse two finger scroll direction (natural scrolling)? didn't help much, but did introduce the "xinput" command.

I rebooted to get everything functional.

A place to keep links for embedded systems components, parts, robotics, ...

• Olimex - European company with the OLinuXino brand, and can be found through various distribution channels.
• seeed studio - IoT hardware enabler
• AdaFruit - to create the best place online for learning electronics and making the best designed products for makers of all ages and skill levels
• Think Penguin - not necessarily embedded, but they do provide Linux based computers and laptops, linked from TCP small queues and WiFi aggregation — a war story.

On 06/14/2018 09:22 PM, someone wrote:
> So I have to ask, why is it advantageous to put this in a container 
> rather than just run it directly
> on the container's host? 

Most any host now-a-days has quite a bit of horse power to run services. All those services could be run natively all in one namespace on the same host, or ...

I tend to gravitate towards running services individually in LXC containers. This creates a bit more overhead than running chroot style environments, but less than running full fledged kvm style virtualization for each service.

I typically automate the provisioning and the spool up of the container and its service. This makes it easy to rebuild/update/upgrade/load-balance services individually and enmasse across hosts.

By running BGP within each container, BGP can be used to advertise the loopback address of the service. I go one step further: for certain services I will anycast some addresses into bgp. This provides an easy way to load balance and provide resiliency of like service instances across hosts,

Therefore, by running BGP within the container, and on the host, routes can be distributed across a network with all the policies available within the bgp protocol. I use Free Range Routing, which is a fork of Quagga, to do this. I use the eBGP variant (RFC 7938) for the hosts and containers , which allows for the elimination of the extra overhead of OSPF or similar internal gateway protocol.

Stepping away a bit, this means that BGP is used in a tiered scenario. There is the regular eBGP with the public ASN for handling DFZ-style public traffic. For internal traffic, private eBGP ASNs are used for routing traffic between and within hosts and containers.

With recent improvements to Free Range Routing and the Linux Kernel, various combinations of MPLS, VxLAN, EVPN, and VRF configurations can be used to further segment and compartmentalize traffic within a host, and between containers. It is now very easy to run vlan-less between hosts through various easy to configure encapsulation mechanisms. To be explicit, this relies on and contributes to a resilient layer 3 network between hosts, and eliminates the bothersome layer 2 redundancy headaches with spanning tree and such.

That was a very long winded way to say: keep a very basic host configuration running a minimal set of functional services, and re-factor the functionality and split it across multiple containers to provide easy access to and maintenance of individual services like dns, smtp, database, dashboards, public routing, private routing, firewalling, monitoring, management, ...

There is a higher up-front configuration cost, but over the longer term, if configured via automation tools like Salt or similar, maintenance and security is improved.

It does require a different level of sophistication with operational staff.

Other BGP routing Daemons:

• exabgp - python based
• gobgp - go based
• bird - c based
• bagpipe - python based, in openstack project

Other mailing list comments:

Our use case was both on exporting service IPs as well as receiving routes from ToRs. Exa is more geared towards the former than the latter. Rather then working on getting imports and route installation through Exa, we found it simpler with BIRD exporting the service IP from it bound to a loopback to run local healthchecks on the nodes and then have them yank the service IP from the loopback on failing healthchecks in order to stop exporting.

The intent of the original post was vague. Like a lot of people, I would not run a full BGP router in a container. Now, if the purpose is to inject or learn a handful of routes in order to do limited host routing, I can see the need. A route-server or a looking glass in a container would be fine, or something to perform analysis on the routing table, but not anything that has to route actual traffic.

I use ExaBGP to inject routes, perfect tool for that. If routes have to be received (not my use case) it makes more sense, as stated by previous posts, to use Quagga or BIRD. Which one is better : easy : if you like Cisco better, use Quagga. If you like Juniper better, use BIRD

BIRD looking glass looks very good

Using 5 Commands for Checking Memory Usage in Linux as a starting point, here is a summary of commands:

• top - use '<' and '>' to select different columns to sort
• free - to report in MB and to sum the columns: free -mt
• vmstat - 'vmstat -s' to provide labelled statistics, 'vmstat 2 5' - run five times at 2 second intervals, 'vmstat -d' for disk statistics
• dmidecode - 'dmidecode -t' to find types, 'dmidecode -t memory' shows memory modules, 'dmidecode -t memory|grep -i size' shows slots and how they are filled
• cat /proc/meminfo - 'egrep --color 'Mem|Cache|Swap' /proc/meminfo' to select and colorize entries

The reason to use these commands is my monitoring system says shared memory usage is increasing. The following command should show something, but doesn't:

# ipcs -m

------ Shared Memory Segments --------
key        shmid      owner      perms      bytes      nattch     status

# cat /proc/sysvipc/shm
       key      shmid perms                  size  cpid  lpid nattch   uid   gid  cuid  cgid      atime      dtime      ctime                   rss                  swap

# ipcs -a

------ Message Queues --------
key        msqid      owner      perms      used-bytes   messages

------ Shared Memory Segments --------
key        shmid      owner      perms      bytes      nattch     status

------ Semaphore Arrays --------
key        semid      owner      perms      nsems

# ipcs -lm

------ Shared Memory Limits --------
max number of segments = 4096
max seg size (kbytes) = 18014398509465599
max total shared memory (kbytes) = 18014398442373116
min seg size (bytes) = 1

Maybe it doesn't matter. From top:

The amount of shared memory used by a task. It simply reflects memory that could be potentially shared with other processes.

A look behind the scenes on high frequency trading data:

• From 2012: TradingPhysics Historical TotalView-ITCH Files - a one post blog with some examination of a post mortem order book.
• QuantInsti’s Blog on Algo Trading and Quantitative Finance
• No BS Day Trading - training materials
• Idiots Guide to High Frequency Trading - Mark Cuban, some philosophy

• Stripe - is the best software platform for running an internet business. We handle billions of dollars every year for forward-thinking businesses around the world.
• adyen - A single payments platform to accept payments anywhere, on any device
• wirize.com - is a ready-made checkout payment built on Stripe. Collect one-time payments and sell your digital services in minutes (no code or website required).
• ElioPay - By connecting to Stripe, PayPal and PayBear you can accept credit and debit cards in 135+ currencies, PayPal and 7 cryptocurrencies including Bitcoin, Litecoin and Ethereum (with more to come). [We don't actually process the payments as we connect to Stripe, PayPal and Paybear]
• How to Accept Payments Online If You Can’t Use Stripe? -- two payment systems that could solve this problem: Gumroad and Paddle.

Payment Gateway Comparison: Guide to Ecommerce Payments compares PayPal, Stripe, Square, BrainTree, WePay, Authorize.net, 2CheckOut, MangoPay, WorldPay, Dwolla.

I recently picked up and browsed through a book called "Quench" by Dana Cohen and Gina Bria. They discuss how the hydration role of water can be optimized. Bottom line, it isn't about consuming large amounts of water. Rather, it is about how best to deliver water to the body's cells, even if delivered in less quantity.

A long while ago, I had cut down on my intake of table salt during meals. Excess salt tended to change the taste of food, and I was interested in tasting food based upon the original preparation. Cutting back on table salt is considered a good thing. But the body still needs electrolytes. Instead of consuming table salt during meals (where table salt typically is processed), the book recommends using a pinch of natural salt in water in the morning.

Natural salt could be selected from:

• Sea Salt
• Celtic Sea Salt
• Rock Salt
• Himalyan Salt

A morning hydrating drink could be:

• 8 to 12 oz. of plain or coconut water
• ping of natural salt
• squirt (0.5 to 1.0 oz) of lemon or lime juice
• teaspoon of honey or maple syrup

In the book, they create a recipe called the Tara Fix:

• 12 oz water
• 1 or 2 teaspoons of ground chea seeds (omega-3s)
• 4 ox kombucha
• 1 pinch of sea or rock salt

The book is loaded with information and background on the how's and why's of how this works.

Common houseplants that do double-duty. A little potted greenery can do wonders to brighten up your living space. But as Arielle Ray’s animated video explains, houseplants can also clear the air of harmful chemicals. The top three plants for surface area to chemical removal, according to a 1989 NASA study? The Gerbera daisy, snake plant, and English ivy.

• Download Windows 7, 8.1 or 10 ISO Images Direct From Microsoft
• Go in a scratch VM: When a linux machine starts, first some low-level magic happens to mount the root file system, and load and run the kernel. Once the kernel is ready it hands control to user-space by running /sbin/init as process ID 1. So, what happens if we replace /sbin/init with a statically linked Go binary that just prints “Hello World!” and then sleeps a lot?
• Developing CoreDNS backends with gRPC: CoreDNS normally provides serving DNS zone data through files, however it also allows you to proxy to a backend endpoint via gRPC.
• Practical IoT Cryptography on the Espressif ESP8266: This article will focus on applying AES encryption and hash authorization functions to the MQTT protocol using the popular ESP8266 chip running NodeMCU firmware.
• General Data Protection Regulation - Here you can find the official PDF of the Regulation (EU) 2016/679 (General Data Protection Regulation) in the current version of the OJ L 119, 04.05.2016; cor. OJ L 127, 23.5.2018 as a neatly arranged website.
• Multi-tier load-balancing with Linux
• Lets Encrypt - a highly detailed mechanism for generating keys for and obtaining Let's Encrypt certificates is described using a minimal LE tooling set.
• APT for package self-builders
• BTRFS and SE Linux - problems with systems running SE Linux on BTRFS losing the XATTRs used for storing the SE Linux file labels after a power outage.
• What makes a great leader, explained in eight counterintuitive charts
• Historical inventory of collaborative editors

• rwestphal/frr-bgp-l3vpn.yml - example for buiding an MPLS/L3VPN based EVPN. Note that the 'sysctl net.mpls.conf.XXX.input' flags should be set.
• "you can refer to the original man page of the daemon (it was ported from OpenBSD): https://man.openbsd.org/ldpd.conf.5 FRR's ldpd supports all the same configuration options, the CLI commands are different only in format."
• Default ARP Settings in Cumulus Linux - detailed discussion of ARP settings in Debian, with reference to load balancing interactions.
• FRR Docs
• FRR Dev Docs