No ads? Contribute with BitCoins: 16hQid2ddoCwHDWN9NdSnARAfdXc2Shnoa
Jun 142018

Trump is outdoing himself in stupidity by starting a trade war with the strongest allies of the US. He imposed unilateral tariffs on steel and aluminium (supposedly to protect US workers although it won’t do that), and acts surprised when allies respond with tariffs of their own.

Which is a bit like a child being surprised when they throw a ball in the air and it falls back on their head.

So what effect will the tariffs on steel and aluminium have? For a start, the US producers of steel and aluminium are not going to suddenly pick up the slack – the US imports in the region of $2 billion worth of steel products per month, and whilst US steel manufacturers can increase production it won’t be able to increase it that quickly.

So the US will continue to import foreign steel, but importers will pay more for it. That means the goods produced by imported steel will cost more. Consumers will pay more for those goods or switch to foreign producers who produce it cheaper (the later will cost US jobs).

So Trump has chosen to implement tariffs that will harm the US.

And assumed that those countries Trump has imposed tariffs on will meekly accept their punishment; which obviously hasn’t happened..

The EU has imposed retaliatory tariffs on motorcycles, cranberry juice, denim, peanut butter, and cigarettes. Notice something interesting about those products? They are all finished products with easily sourced alternative suppliers, or luxury goods that aren’t necessary.

In other words the EU tariffs are going to have a minimal impact on the EU economy.

So Trump will blame the damage to the US economy on his own trade war, and point to the lack of damage to the EU’s economy as ‘evidence’.

Expect more temper tantrum Trump ‘policies’ shortly.


Jun 122018

This posting is about using the command-line ssh tool for relatively securely copying stuff around, and logging into devices. Many of the tips contained within are things I have had to pry out of the manual page for my own use and these notes are a way of keeping the information around without relying on my brain.

#1: It Comes With Windows

If you are running the latest version of Windows 10, you get the command-line versions of ssh and scp without dropping into the Linux shell :-

Of course you have been able to install ssh clients for Windows for years or even decades, but having it available by default is a big win. Particularly for Windows machines you don’t tweak with your favourite applications.

#2: Public/Private Key Authentication

This the first part of increasing security by only permitting key authentication so that password brute forcing attacks become impossible. With the assistance of an ssh agent (not covered here) or a passphrase-less key pair (not advisable), it is no longer necessary to enter a password.

Of course getting into this sort of thing can be very confusing especially as most instructions tend to get into far too much detail on the cryptography involved. To keep it simple, I shall avoid going on about the cryptography, and concentrate on how to get it to work.

The most important thing to remember about key authentication is that there are two keys – the private key (which should be kept as secure as possible on the client machine) and the public key (which is copied to the devices you want to connect to).

So to get started, you first need to generate a key pair, which can be done with ssh-keygen; this has lots of options, but at this point you can ignore them. After you enter the command, you can simply hit return at all the prompts to generate a key pair :-

Generating public/private rsa key pair.
Enter file in which to save the key (/home/mike/.ssh/id_rsa): 
Enter passphrase (empty for no passphrase): 
Enter same passphrase again: 
Your identification has been saved in /home/mike/.ssh/id_rsa.
Your public key has been saved in /home/mike/.ssh/
The key fingerprint is:
SHA256:REMOVED mike@Michelin
The key's randomart image is:
+---[RSA 2048]----+
|=*+o ..  .B*..=o |
|o+++.  . =+o. o+.|
|.BE.+   + .  =  .|
|o+=& . . .    o  |
|. o +   S    .   |
|     .           |
|    SS           |
|              .  |
|     --          |

Of course this is not ideal because there is no passphrase, but to get started with that’s fine. You can ignore most of this output (except for the first item in the following list) but just in case :-

  1. The key pair is saved in the files ~/.ssh/id_rsa (the private key) and ~/.ssh/ (the public key). The permissions are usually generated properly, but just to be safe you may want to reset the permissions anyway: chmod 0400 ~/.ssh ~/.ssh/id_rsa; chmod u+x ~/.ssh
  2. The key fingerprint can be used to check that when you are connecting that the keys haven’t changed unexpectedly.
  3. Alternatively (and slightly more of a reasonable check) you can check the fingerprint using the “randoart”.

Of course on its own, it doesn’t do much good. You have to copy it into place onto the machine you wish to authenticate to :-

$ ssh username@server mkdir .ssh
$ cat ~/.ssh/ | ssh username@server cat ">>" .ssh/authorized_keys

Note the quotes around the “>>”; these are significant because you do not want the local machine’s shell to interpret them – they need to be interpreted by the remote machine’s shell. Normally I would simply “scp” the file into place, but appending to a supposedly non-existent file is safer – just in case it does exist and does contain public keys that are currently in use.

There are a whole bunch of options to the command, but the two most important ones are :-

  1. The -t option which is used to specify the key type to generate (dsa, rsa, ecdsa, and ed25519). This is mostly unnecessary, but some older and limited devices do not understand certain key types. And as time goes on, more key types will be declared “insecure”. So you may sometimes find the need to generate more secure keys. The simplest (but not very efficient) process for dealing with such situations is to generate a key for each key type and try each one in turn.
  2. The -f option which is used to specify the output filenames – the private key is saved under the name ‘filename’ and the public key under the name ‘’.

#3: SSH Configuration File and Usernames

There are a ton of things that can be done with the ssh configuration file, but for this section I’ll stick with setting the username used to login to specific hosts – not because this is the most interesting thing that can be done, although it is quite useful.

The configuration file can be found (if it has been created) at ~/.ssh/config (with a system-wide version at /etc/ssh/ssh_config). Within that file, you can set global preferences, or host specific preferences :-

Username fred

Host router
  Username admin
Host dns*
  Username fxb
Host ds-* web-*
  Username baileyf
Host *
  Username fred

The first line (Username fred) instructs ssh to use the username ‘fred’ when no username is specified – ssh effectively becomes ssh fred@

If you specify the same username within a Host section, the specified username is used for any hosts that the specification following the Host word. In the first case (“Host router”) the username “admin” will be used for any host called “router” but not “router.some.domain”.

In the case of the second clause, a wildcard is used which is very useful for specifying a range of hosts – the example can match “dns01”, “dns01.some.domain”, or even “dns02”. In fact the first Host section is an example of what you should not do – put in a single hostname without a wildcard because it will only activate if the hostname is specified exactly as given. Put a wildcard in there, and it will work whether you use a single hostname or use the fully qualified domain name.

You can also have more than one host specification – as in the “ds-* web-*” list.

And lastly you can (if you choose) use the Host declaration to specify a set of default values – in much the same way that configuration settings in the global context specify default values. Use whatever method you choose.

#4: Cryptographic Incompatibility

I have commented elsewhere on this, but basically the ssh developers have chosen to disable weak encryption by default. Personally I would prefer that ssh throw up huge warnings about weak cryptography, but what is done is done.

If you need to connect to something with weak cryptography, there are three potential ‘fixes’ to allow connections. Each of these is a keyword to add to a specific host section, followed by a specification of what ‘algorithm’ to add.

In each case, a connection attempt will give an indication of what is wrong together with an indication of what algorithm to include :-

» ssh admin@${someswitch}
Unable to negotiate with ${ip} port 22: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1

In this case, we can see that it is the KexAlgorithms we need to adjust and the algorithm we need to add is “diffie-hellman-group1-sha1” :-

Host someswitch*
  KexAlgorithms +diffie-hellman-group1-sha1

This can be repeated for Ciphers and (rarely) MACs.

#5: X11 and Port Forwarding

Run X11 gooey programs over an ssh connection? Of course .. why not?

This can be enabled on a host-by-host basis (it is off by default because it can be insecure) using the configuration file :-

Host pica*
  ForwardX11 yes

This is just a special case of port forwarding where a network port is connected (via the ssh session) to a remote network port. Port forwarding can be very useful – for example to access an internal web site temporarily that isn’t (and probably shouldn’t be) exposed with a hole through the firewall.

Of course this can be done with a VPN, but ssh may be simpler :-

Host pica*
  LocalForward 8000 8000

When the connection is made, a local port is opened (tcp/8000) and connected to tcp/8000 on the machine you are logging into.

Jun 052018

As the subject says, this blog has been offline for just over a week because of a hardware failure. Just when I wanted to moan about all the GDPR hissy fits that people are throwing.

Noticed some websites are blocking you because of the GDPR?

That’s the hissy fit. Seems that some international web site operators who previously assumed that GDPR didn’t apply to them, are suddenly realising that it does. Which is an indication that they have been impersonating an ostrich for a couple of years now.

Smaller businesses get a free pass on that one, but any reasonably sized company should have been aware of GDPR by now. It was put in place and deliberately put on hold for two years to allow people to get started with complying with GDPR. Anyone involved in the security business has been hearing “GDPR” for over two years now.

So there are those who claim they’ve not heard of it, and are now panicking and trying to catch up, making a mountain out of a molehill, and claiming that it’s a dumb law. Technically it isn’t actually a law but an EU regulation that member states are required to make law.

Anyway onto some of the biggest arguments against the GDPR …

The Whois Question

This is a great example of what happens when you ignore a situation and then panic.

When you register a domain (such as or a netblock (a set of IP addresses), you are expected to provide contact details for the individual(s) involved in the registration process – to allow for billing, and contact to be made in the event of operational issues.

Storing that information is perfectly reasonable.

Publishing that information is perfectly reasonable given informed consent.

Ideally the domain registration would offer a choice to the registrant – public listing of personal details, public listing of role contact information, or public listing of indirect contacts (i.e. keeping the contact details private).

There is a German court case decision saying that it isn’t necessary to have contact information for registering a domain; all I can say is that the German court obviously didn’t have the full facts.

GDPR’s “Right To Be Forgotten”

One of the misconceptions is that the “right to be forgotten” is an absolute human right; for a start it’s not a a human right, but a right under the law. And it is not absolute; the text of the GDPR includes numerous exceptions to the right to be forgotten, such as :-

  • A legal or regulatory obligation to keep the personal information.
  • An overriding public interest.
  • Ongoing legitimate business processes still require that personal information.

The key is that if you are an ethical business (in particular don’t plan to sell personal information and/or keep spamming people) then the right to be forgotten isn’t anything to worry about.

GDPR: The Fines

The strange thing is that there is doubt over the level of fines that can be levied under the GDPR which is remarkable as the language is quite clear – the lower level of breach can be fine of up to either €10 million or 2% of annual turnover.

Or to put it another way, for the lower level of breach, the maximum fine is whichever is greater €10 million or 2% of annual turnover. The maximum.

Do you know how often the ICO has imposed the maximum level of fine under existing legislation? Never.

The Jurisdiction Issue

Now here there is some legitimate grounds for grievance; after all whenever the US starts imposing its laws outside of the US, people outside the US start jumping up and down. And yes, the EU does expect non-EU companies to obey the GDPR regulation if they store data on EU citizens.

In practice, the EU isn’t going to try going after small companies outside the EU; particularly not small companies that are just ordinary business and not engaged in Cambridge Analytica type business.

The other way of looking at the global reach of the GDPR is whether it would be a good idea for there to be a world-wide law in relation to the protection of personal information. The Internet means that world-wide laws are necessary in this area, or those abusing personal information will merely move to the jurisdiction with the weakest protection of personal information.

Rusty Handrail

May 242018

A day or two ago, I bumped into someone online that used the phrase “elitist expert” in a negative context; either a troll or a spectacularly dumb person. He isn’t the only one; there are plenty of people who show a similar attitude.

Hell, the whole Trump government is riddled with that attitude.

There are two parts to this attitude – the notion that “elitist” is wrong, and the notion that “expert” is wrong. And I will attack those attitudes in reverse order.

An expert is simply someone who knows what they’re doing in one particular area – not necessarily just one. That could be an expert in economics, coal mining, carpentry, plumbing, etc. There is no reason why ordinary working people cannot be experts in what they do; in fact many of them are.

Imagine if you will that a plumber inspecting your pipework suggests that some of the pipes need replacing. If you totally ignore him, there is a word to describe you: “idiot”. Sure if it costs lots of money, getting a second opinion from another plumber is a sensible precaution, but to totally ignore the advice of the expert? Surely that’s stupid.

So don’t ignore experts – by all means get advice from other experts too, but to ignore them is stupid. Of course if you consult 1,000 experts and 995 of them say the sky is blue and 5 say the sky is purple, you should probably side with the majority.

As to elitist, well it is usually a bad thing – treating one person better than another for whatever reason is almost always wrong. But in at least one case, elitism is just common sense – my opinion on a plumbing problem is worth less than any plumber much less a plumber that other plumber go to for advice (“Man, that’s a tricky one; you’d better ask Jo.”).

Why do I use a plumber as an example rather than say a climate scientist?

Because there are two other factors in play :-

  1. The notion that “book learning” is inherently wrong.
  2. The notion that practical skills are worth less than intellectual skills.

A plumbing expert is just as useful to society as a climate scientist, and visa-versa. Of course they are valuable at different time scales – if there is sewage spewing out of your toilet, you need a plumber right now, and the services of a climate scientist are rarely that urgent.

Follow The Path



May 042018

I had the pleasure of upgrading a server today which involved fixing a number of little niggles; one of which was that connecting to switches suddenly stopped working :-

✗ msm@${server}» ssh admin@${someswitch}
Unable to negotiate with ${ip} port 22: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1

This was relatively easily fixed :-

✗ msm@${server}» ssh -o KexAlgorithms=+diffie-hellman-group1-sha1 admin@${someswitch}

Of course doing this command-by-command is a little tedious, so a more permanent solution is to re-enable all the supported key exchange algorithms. The relevant algorithms can be listed with ssh -Q kex, and they can be listed in the server-wide client configuration in /etc/ssh/ssh_config :-

Host *
    KexAlgorithms ${comma-separated-list}

But Why?

According the OpenSSH developers, the latest version of ssh are refusing to use certain key exchange algorithms (and other cryptographic ‘functions’).

Their intention is perfectly reasonable – by default the software refuses to use known weak crypto. I’m fully behind the idea of discouraging the use of weak crypto.

But the effect of disabling weak crypto in the client is unfortunate – all of a sudden people are unable to connect to certain devices. The developers suggest that the best way of fixing the problem is to upgrade the server so that it supports strong cryptography.

I fully agree, but there are problems with that :-

  1. Some of the devices may very well be unsupported with no means to upgrade the ssh dæmon. Now in an ideal world, these devices wouldn’t be on the network, but in the real world there are such devices on the network.
  2. Some devices may not be capable of being upgraded because of processor or memory limitations. Network switches are notorious for having slow processors and tiny amounts of memory, and it is entirely possible that such a device would not be capable of running more exotic and modern crypto. Similarly lights out management processors are often severely limited.
  3. Even if a device is capable of being upgraded, there are the standard problems – the vendor may be slow at releasing updates, change control gets in the way, and lastly resourcing may be an issue – upgrading several hundred switches manually with just one or two people doing it is not going to be a quick job.

Lastly, whilst security is important, breaking things just to make a point is a little extreme. Whilst it is possible to fix the problem, it is something that isn’t immediately obvious to someone who doesn’t routinely configure ssh. And someone, somewhere has had this breakage occur just before they really need to fiddle with a switch Right Now.

There is a far better option available – leave the weak crypto enabled, but warn noisily about its use :-

WARNING!!!!! (2 second delay)
WARNING!!!!! (2 second delay)

The device you are connecting to only supports known weak crypto which means this connection
is subject to interception by an attacker.

You should look at upgrading the device as soon as possible.

Telling people what is wrong noisily and continuing to work is far better than simply breaking with a rather terse message.

Foggy Reflection


Apr 142018

In the USA, a considerable number of states (30 counting 16 years as “adult”) allow the marriage of underage children under certain constraints. And these marriages do happen; whilst proportionally they are a tiny minority, to those victims it is nothing less than state-sanctioned child sex abuse.

In terms of numbers, Unchained at Last (via Wikipedia) found that between 2000-2010 there were 167,000 children in marriages; 13% were boys (I mention boys because most articles start with the girls). But weren’t they all children marrying each other? Only in 14% of cases.

The USA government condones and supports child sex abuse.

The overwhelming majority of not just the rest of the world, but even third-world countries are better on the marriage loophole allowing child sex abuse. Trump: For the victims of those marriages, USA is the “shit-hole”.

The Bench

Apr 072018

Now don’t get me wrong – I think all forms of execution are inhumane, but I have just seen a US progressive video which made it plain that hanging is supposedly more inhumane than current US forms of execution. I would mention them by name, but I’ve heard this from other places too.

A properly carried out (variable drop) hanging should be relatively humane – it should be fast (less than 15s from being removed from the cell to the end), and causes immediate paralysis and unconsciousness before death.

An interesting story from Pierrepoint (Britain’s last executioner) about the execution of Nazi war-criminals was that the US executions were carried out by volunteers rather than qualified executioners, and the volunteers refused to listen to Pierrepoint’s advice. Many of the US hangings were botched causing either decapitation (which probably isn’t especially inhumane, but would be rather messy) or slow strangulation over 20 minutes.

Perhaps it is this that has led to the belief that hanging is more inhumane than other US forms of execution.

Misty Trees

Apr 062018

The phrase “Islam is a religion of peace” gets bandied about a great deal these days – either by those saying that it is a religion of peace and islamic terrorists are an aberration, or by those who question whether islam is a religion of peace at all.

To be honest though, the phrase is irrelevant. You can have the most peaceable religion in existence and yet fundamentalist followers of that religion will resort to violence, and yes you can have a religion that calls for the torture to death of all non-followers, yet if the followers of that religion are peaceable nobody is at risk.

Questioning the religion as a whole is all very well (and as someone who would prefer that all religions disappear in a puff of logic, usually to be encouraged), but it does tend to encourage the kind of idiot who normally goes in for racism into attacking all muslims (and often sikhs as well) because of the sins of a few.

Muslims are just people; people with the disadvantage that they have been indoctrinated into a faith – not much different to christians, sikhs, hindus, jews, or zorastrians (and if I’ve left out your religion, yes I mean you too). Some are good people; some are bad.

But in the words of Steven Weinberg: “but for good people to do evil—that takes religion”.

But truisms like that are overly simplistic; religious terrorists are people who are convinced that they are good – probably better than their coreligionists – and who want to enforce their beliefs and standards of behaviour on others. And are prepared to do so in ways that most of us would call psychotic.

These people – the religious terrorists – are in all likelihood only a tiny minority of all muslims (or christians, …), and in a surprising number of cases are not especially well educated in their religion. In fact many of them are petty crooks, with a burning desire to be more significant than they deserve.

In the end, debating whether islam really is a religion of peace or not is pretty much a waste of time because it is irrelevant – even the religions with the most peaceful reputations have terrorists (major religions only).

Old Metal 3

Apr 012018

This is a continuation of an earlier post regarding ECC memory under Linux, and is how I added a little widget to display the current ECC memory status. Because I don’t really know lua, most of the work is carried out with a shell script that is run via cron on a frequent basis.

The shell script simply runs edac-util to obtain the number of correctable errors and uncorrectable errors, and formats the numbers in a way suitable for setting the text of a widget :-

# Use edac-util to report some numbers to display ...

correctables=$(edac-util --report=ce | awk '{print $NF}')
uncorrectables=$(edac-util --report=ue | awk '{print $NF}')

if [[ "$correctables" != "0" ]]
if [[ "$uncorrectables" != "0" ]]

echo "ECC: $correctables/$uncorrectables "

This is run with a crontab entry :-

*/7 * * * * /site/scripts/gen-ecc-wtext > /home/mike/lib/awesome/widget-texts/ecc-status

Once the file is being generated, the Awesome configuration can take effect :-

-- The following function does what it says and is used in a number of dumb widgets
-- to gather strings from shell scripts
function readfiletostring (filename)
  file =, "r")
  s =
  return s

eccstatus = wibox.widget.textbox()
eccstatus:set_markup(readfiletostring(homedir .. "/lib/awesome/widget-texts/ecc-status"))
eccstatustimer = timer({ timeout = 60 })
      eccstatus:set_markup(readfiletostring(homedir .. "/lib/awesome/widget-texts/ecc-status"))
layout = wibox.layout.fixed.horizontal, ... eccstatus, ...

There plenty of ways this could be improved – there’s nothing really that requires a separate shell script, but this works which is good enough for now.

WP Facebook Auto Publish Powered By :