Raymond P. Burkholder - Things I Do

• Frisky Radio
• HearMe.FM - similar to di.fm, but may have more material
• DI.FM - melodic side of progressive house, packed with driving rhythms and forward thinking sounds - needs more material
• Online Radio Box - need to follow up

The article LWN: Plasma X11 session removal surprises some Fedora users reminded me to take a look at my installation.

Since almost time began, I've been able to log into my Debian session and have my windows startup and be placed back to where they were when I had exited. In many cases, they would even get placed back on the proper virtual desktop.

During a re-install, some time ago with Debian Trixie, I gave KDE Wayland a full-on try. Trixie, as of this moment, has KDE Plasma 6.3.6, and does not support window placement. I used Workaround 4: Use the X11 session - choose X11 lower in the login screen - to restore that functionality. That page has other workarounds which might work in a not so elegant manner:

• Workaround 1: Stop windows piling up
• Workaround 2: Window Rules (send a program to its own desktop and position)
• Workaround 3: Start with an empty desktop and autostart your programs
• Workaround 4: Use the X11 session

It looks like Plasma 6.8, the XWayland/X11 interface layer will go away completely.

kwayland tracks Debian's progress on Plasma versions. So far, they have only 6.7.4 in unstable. So there is more time.

I think window saving started in 6.4 (version after my troublesome version 6.3). Major work started in 6.7, I think:

Wayland compositors, including KDE Plasma, are gradually implementing features to save and restore window positions. The latest updates indicate that this functionality is being rolled out in stages.

Upcoming Features

• Plasma 6.7 Release: Scheduled for June 16, 2026, this version will introduce support for saving window sizes and positions. However, this feature will only work for applications that opt in to use it.
• KDE Plasma 6.7 adds initial support for the Wayland session restore protocol, allowing apps to remember window sizes, positions, and virtual desktop placement after restarting. However, it does not yet restore window contents or open documents, as that requires application-level support.

Future Developments

• Full Session Management: While Plasma 6.7 will support basic window positioning, complete session management, including saving the internal content of windows, is still in development. This means that while window positions can be remembered, the content within those windows may not be saved yet.

Resources:

• 2026/10/14 - Plasma 6.8 - 30th Anniversary Edition - notification - but little to no mention of window location save/restore
• 2026/10/22 - KDE Plasma 6.8 Drops X11: Switch to Wayland and Keep X11 Apps - many details on migrating from XWayland to native Wayland in Arch Linux
• 2026/10/28 - X11 vs Wayland in 2026: The Linux Display Protocol Shift Explained
• 2026/10/23 - KDE Plasma 6.8 Retires X11 Sessions While Keeping Older Applications Working - KDE Plasma 6.8 removes the Plasma X11 desktop session, but it does not remove support for running X11 applications.
• 2026/06/07 - XWayland: A Survival Guide

Notes:

• The small number of individual apps that still require X11 will continue to work via the “XWayland” compatibility layer. KDE applications will continue to support X11 for the foreseeable future.
• Bug 436318 - Support for real session save/restore for window content and state on Wayland works as of Plasma 6.7 - after all the above, I found this, which indicates most/all of the save/restore is in place - after some number of years of work and many comments

Meshlib: In-Process Policy Enforcement for Sidecar-less Service Meshes

Service meshes facilitate service-to-service communication and enforce security policies in microservice architectures. However, they often depend on per-pod sidecar proxies, which introduce significant latency and resource overhead due to redundant application-layer parsing on every request. Eliminating sidecars without compromising security guarantees remains a central challenge. To address this, we introduce Meshlib, a sidecar-less service mesh extension built on Cilium as a control-plane extension. Meshlib incorporates a non-intrusive application-bound library that enforces Layer-7 policies within the application process, while delegating transport-level identity and routing to Cilium's eBPF-based data plane. This separation of responsibilities removes sidecar-induced latency and maintains the security semantics of the service mesh. The architecture remains fully interoperable with unmodified services, enabling incremental adoption within existing deployments. We evaluate Meshlib against Istio, Linkerd, and unmodified Cilium on the TrainTicket benchmark, enforcing 126 security policies across 37 services and show that it achieves the lowest end-to-end latency of all evaluated configurations with comparable resource overhead.

I've been hearing more and more about the SONiC Virtual Switch. It has come a long way since it's debut at an Open Compute conference some number of years ago.

To give it a try on non-ONIE hardware (nothing handy at the moment), this is what I did to get the .vs image working on my local Proxmox box:

• Download recent sonic-vs.img.gz version from Sonic Software
• scp the image over onto my Proxmox box
• gunzip the image

  gunzip sonic-vs.img.gz

• construct a virtual machine with: 4 cpu, 4G memory, q35, SeaBIOS, no-cd, no drive
• assign an interface which supplies DHCP
• import the disk into the vm (this one has vmid of 116)

  qm disk import 116 sonic-vs.img local-btrfs --target-disk ide0

• in options, set boot order to ide0, disable pxe and cd
• start it up, and log in with the credentials supplied at the download site
• once I confirmed it had an address, I was able to ssh with:

  ssh admin@<ipaddr> -o PreferredAuthentications=password

Add additional instances to build infrastructure. Add interfaces to build a network.

I did some experimenting with drogon to port over a web site I had implemented in Wt webtoolkit web tool.

The views, controls, and static presentations performed well for building a web site in a traditional way.

However, when it came time to assign a domain name and run an SSL certificate based website, it started failing/crashing when certain SSL incompatible web queries were generated. It didn't have a recoverable failure mode. It simply raised an exception and crashed. I looked at the crash locations, and it seems that some clean up operations are mis-ordered, plus there were other problems. Then reading the issues list, the author even acknowledges that the whole SSL thing was a bolt-on after-thought and requires significant re-write.

Sigh. Drogon is out the window.

On to giving Boost Beast a try. This will require some work to add cookies and other refinements, but at least it is well integrated with SSL.

drogon is a fast C++ web framework.

Some build notes:

sudo apt install git cmake build-essential
sudo apt install libjsoncpp-dev uuid-dev zlib1g-dev libsqlite3-dev  \
  libc-ares-dev dia libyaml-cpp-dev libssl-dev libbrotli-dev
git clone https://github.com/drogonframework/drogon
cd drogon
git submodule update --init
mkdir build
cd build
cmake ..
make
sudo make install

Create a project:

drogon_ctl create project project_name
cd project_name/build
cmake ..
make
cd ..
# run project, default port is 5555
build/project_name

Fast and Accurate Anomaly Detection in Time Series - is this the cat's meow?

The fundamental challenge in real-world anomaly detection scenarios is related to the inherent class imbalance (anomalies are typically rare) and, for supervised methods, to the scarcity of labelled anomalous data. Indeed, labelling is both expensive and time-consuming. Conversely unsupervised methods do not require labelling, but may suffer from high false positive rates when deployed in safety-critical applications.

In this work we introduce a novel unsupervised algorithm for anomaly detection in time series based on the Haar discrete wavelet and a suitably designed $t$-test. We establish the theoretical foundation of the proposed $t$-test and, through extensive experimentation across 343 datasets, demonstrate that our algorithm outperforms state-of-the-art unsupervised and self-supervised benchmarks.

• Agentic coding and Free Software - getting started with LLMs with WindSurf
• systemd for Linux SysAdmins - there is a book out about systemd - history and usage
• vmsync - released vmsync. A small golang utility that implements a simple replication tool using the NBD protocol to sync virtual machines to other hosts.

I have an APC Smart UPS 1500 connected via USB cable to a BeagleBone Green running NUT 2.8.1-5 on Linux 6.18.36-bone40. Even on earlier Linux kernels and versions of NUT, during some sort of UPS transition, I would start to get a log full of the these error messages:

usbhid-ups: nut_libusb_get_report: No such device (it may have been disconnected)

In detail:

kernel: musb-hdrc musb-hdrc.1: Babble
kernel: usb 1-1: USB disconnect, device number 15
kernel: usb 1-1.4: USB disconnect, device number 16
kernel: usb 1-1: new high-speed USB device number 17 using musb-hdrc
kernel: usb 1-1: New USB device found, idVendor=1a40, idProduct=0201, bcdDevice= 1.00
kernel: usb 1-1: New USB device strings: Mfr=0, Product=1, SerialNumber=0
kernel: usb 1-1: Product: USB 2.0 Hub [MTT]
kernel: hub 1-1:1.0: USB hub found
kernel: hub 1-1:1.0: 7 ports detected
kernel: usb 1-1.4: new full-speed USB device number 18 using musb-hdrc
kernel: usb 1-1.4: New USB device found, idVendor=051d, idProduct=0003, bcdDevice= 0.01
kernel: usb 1-1.4: New USB device strings: Mfr=1, Product=2, SerialNumber=3
kernel: usb 1-1.4: Product: Smart-UPS_1500 FW:UPS 06.0 / ID=1028
kernel: usb 1-1.4: Manufacturer: American Power Conversion
kernel: usb 1-1.4: SerialNumber: unique_number
kernel: hid-generic 0003:051D:0003.0008: hiddev0,hidraw0: USB HID v1.11 Device [American Power Conversion  Smart-UPS_1500 FW:UPS 06.0 / ID=1028] on usb-musb-hdrc.1-1.4/input0
usbhid-ups[31894]: nut_libusb_get_report: No such device (it may have been disconnected)
usbhid-ups[31894]: nut_libusb_get_report: No such device (it may have been disconnected)

For some reason, USB devices 'disconnect' and reconnect. When the device reconnects, a new DeviceID is assigned to the USB device. This breaks the usbhid-ups drivers supplied by NUT the packages. That is, usbhid-ups no longer sees the APC USB device.

One forum article suggested that there is not enough power in the BeagleBone system to propery power a USB connection. The suggested solution is to add a powered USB hub. I gave that a try with no success in eliminating the problem.

To resolve this, I'm not sure if recent versions of the driver fix this, but I used Debian's udev system to sense the device id change and to restart the NUT USB driver.

In /home/debian, which is the default home directory, I created two files and ran 'chmod +x' on each to make them executable. When a USB 'ADD' state is detected, nut.target is restarted to initiate the detection and connection process. When a removal is detected, the service is stopped. The stop does not seem to be reliable, but the restart appears to be reliable enough to get things started again.

$ cat usb_add.sh
#!/usr/bin/env bash

logger "USB state change detected: $1 $2 $3"
echo "$(date) USB state change detected: $1 $2 $3" >> /home/debian/usb-log.txt
systemctl restart nut.target
exit 0

$ cat usb_remove.sh
#!/usr/bin/env bash

logger "USB state change detected: $1 $2"
echo "$(date) USB state change detected: $1 $2" >> /home/debian/usb-log.txt
#systemctl stop nut.target
exit 0

To determine useful attributes I used the following (the first is a shorter result than the second):

udevadm info --name=/dev/bus/usb/001/017 
udevadm info --name=/dev/bus/usb/001/017 --attribute-walk

The rule which invokes these scripts is:

# cat  /etc/udev/rules.d/89-usb-ups-change.rules
SUBSYSTEM=="usb", MODE="0660", ACTION=="add",    ENV{ID_VENDOR_ID}=="051d", ENV{ID_MODEL_ID}=="0003", RUN+="/home/debian/usb_add.sh add '$env{DEVNAME}' '$env{ID_USB_SERIAL}'"
SUBSYSTEM=="usb", MODE="0660", ACTION=="remove", RUN+="/home/debian/usb_remove.sh remove $env{DEVNAME}"

These command variations were suggested to simulate a cable re-connect but did not reliably work. I resorted to physically disconnecting and reconnecting the cable to perform a proper test for tuning and production (using the major:minor usb device manufacturer code):

# major:minor usb device manufacturer code
usbreset 051d:0003
# dev bus id
udevadm test /dev/bus/usb/001/007

Each rule change test required the following to reload the udev rules:

udevadm control --reload-rules

To see what Nut sees:

# nut-scanner -U
Scanning USB bus.
[nutdev1]
        driver = "apc_modbus"
        port = "auto"
        vendorid = "051D"
        productid = "0003"
        product = "Smart-UPS_1500 FW:UPS 06.0 / ID=1028"
        serial = "unique id"
        vendor = "American Power Conversion"
        bus = "001"
        device = "017"
        busport = "002"
        ###NOTMATCHED-YET###bcdDevice = "0001"

A linux command provides a concise device and manufacturer id:

# lsusb
Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 001 Device 016: ID 050d:0234 Belkin Components F5U234 USB 2.0 4-Port Hub
Bus 001 Device 017: ID 051d:0003 American Power Conversion UPS

Other troubleshooting commands include:

udevadm monitor

This solution for those who might encounter Update 2.7.4 to 2.8.4 CP UPS driver disconnect (nut_libusb_get_report: No such device)

• Scaling Akvorado BMP RIB with sharding
• Command line Norse God of Wind Hræsvelg move the clouds
• Fabric is an open-source framework for augmenting humans using AI. It provides a modular system for solving specific problems using a crowdsourced set of AI prompts that can be used anywhere.
• Secure Boot and Microsoft CA Rollover - a heads-up for distributions
• Containers Are a Security Boundary (some assembly required)
• Armadillo - C++ library for linear algebra & scientific computing

Install tool:

sudo apt install xclip

Perform the copy:

cat filename.base64 | xclip -rmlastnl -selection clipboard

I had someone Create an offline installation of SQL Server Management Studio for me. It was a fun install. Sarcasm intended. The installer could be so much smaller I think if it didn't have so many language packs in one bundle. Why not, if building an offline installer, why not allow a language selection right there.

The first step was to learn to start the installer from the command line with:

SSMS_22.2.1\vs_SSMS_22.2.1.exe --noWeb

At this point, it would unpack files and then silently quit. No messages at the command line.

The logs indicate an invalid certificate:

Certificate is invalid: C:\temp\SSMS_22.2.1\vs_installer.opc
Error 0x80131509: Signature verification failed. 
Error: Unable to verify the integrity of the installation files: the certificate could not be verified.

Three of the certificates can be installed with:

certutil.exe -addstore -f "Root" "SSMS_22.2.1\certificates\manifestCounterSignRootCertificate.cer"
certutil.exe -addstore -f "Root" "SSMS_22.2.1\certificates\manifestRootCertificate.cer.cer"
certutil.exe -addstore -f "Root" "SSMS_22.2.1\certificates\vs_installer_opc.RootCertificate.cer"

By looking at the logs, there is a fourth certificate, but missing, so needs to be copied and installed in a similar manner from Microsoft Windows Code Signing PCA 2024.crt (github) or Microsoft Windows Code Signing PCA 2024.crt (microsoft.com)

The final hurdle has to Microsoft ODBC Driver installation. It installs Microsoft ODBC Driver 18 for SQL Server ok. But it fails while installing Microsoft OLEDB Driver 19 for SQL Server with a message along the lines of:

This application requires 
Microsoft Visual C++ Redistributable for Visual Studio 2022 
(x64/x86, version 14.38 at minimum)

It fails even when installing Latest supported redistributable version x64.

The secret here is that the x86 version also has to be downloaded and installed. So you should have both installers:

VC_redist.x64.exe
VC_redist.x86.exe

As a final note, the installer logs are in C:\Users\<UserName>\AppData\Local\Temp and are named dd_setup_yyyymmddhhmm_errors.log.

On installation, the Citrix Workspace installer will ask for libwebkit2gtk-4.0-37. However, in the latest Debian, libwebkit2gtk-4.1-0 is installed. That package brings in many other packages so there is no practical way to install an earlier version.

The solution to this give the older Debian Bookworm a try where the package is available for installation.

> apt-cache search libwebkit2gtk
libwebkit2gtk-4.0-37 - Web content engine library for GTK
libwebkit2gtk-4.0-dev - Web content engine library for GTK - development files
libwebkit2gtk-4.0-doc - Web content engine library for GTK - documentation
libwebkit2gtk-4.1-0 - Web content engine library for GTK
libwebkit2gtk-4.1-dev - Web content engine library for GTK - development files

To prep for Citrix installation, install the following:

# apt install libwebkit2gtk-4.0-37 libcurl4 libspeexdsp1

Once all the GPU and Docker prerequisites are in place, installing frigate-nve is easy: a) build a yaml file, b) docker compose the file.

In the LXC container, create a frigate directory and move into it:

mkdir frigate
cd frigate

In that directory, here is the content of my docker-compose-yaml file:

services:
  frigate:
    container_name: frigate
    #privileged: true # this may not be necessary for all setups
    restart: unless-stopped
    stop_grace_period: 30s # allow enough time to shut down the various services
    image: ghcr.io/blakeblackshear/frigate:stable
    shm_size: "1512mb" # updated for my camera list based upon error messages in the log
#    devices:
#      - /dev/dri/renderD128:/dev/dri/renderD128 # AMD / Intel GPU, needs to be updated for your hardware
    deploy:
      resources:
        reservations:
          devices:
            - driver: nvidia
              #device_ids: ['0'] # this is only needed when using multiple GPUs
              count: 1 # number of GPUs
              capabilities: [gpu]
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - /root/frigate/config:/config
      - /root/frigate/storage:/media/frigate
      - type: tmpfs # 1GB In-memory filesystem for recording segment storage
        target: /tmp/cache
        tmpfs:
          size: 1000000000
    ports:
      - "8971:8971"
      # - "5000:5000" # Internal unauthenticated access. Expose carefully.
      - "8554:8554" # RTSP feeds
      - "8555:8555/tcp" # WebRTC over tcp
      - "8555:8555/udp" # WebRTC over udp
    environment:
      FRIGATE_RTSP_PASSWORD: "xxxxxxx"

Get it started:

# in a foreground process:
docker compose up
# or, as a background process:
docker compose up -d frigate

The login should be seen at something like (or your container's address):

https://127.0.0.1:8971/

Official installation documentation:

• Frigage NVR Installation

From Plex GPU transcoding in Docker on LXC on Proxmox v2:

# make sure that all nvidia devices are loaded upon boot
cat >/etc/systemd/system/nvidia-pre-lxc-init.service <<'EOF'
[Unit]
Description=Initialize NVIDIA devices early (before Proxmox guests)
After=systemd-modules-load.service
Before=pve-guests.service
Wants=pve-guests.service

[Service]
Type=oneshot
RemainAfterExit=yes

ExecStartPre=-/sbin/modprobe nvidia
ExecStartPre=-/sbin/modprobe nvidia_uvm
ExecStart=-/usr/bin/nvidia-smi -L
ExecStart=-/usr/bin/nvidia-modprobe -u -c=0

[Install]
WantedBy=multi-user.target
EOF

systemctl daemon-reload
systemctl enable nvidia-pre-lxc-init.service

reboot then try nvidia-smi to confirm function.