NCSC’s passphrase advice

Software

Kate R summarised the UK National Cyber Security Centre’s longstanding advice for using a string of words over gibberish:

Whilst not a password panacea, using ’three random words’ is still better than enforcing arbitrary complexity requirements. […] Our minds struggle to remember random character strings, so we use predictable patterns (such as replacing the letter ‘o’ with a zero) to meet the required ‘complexity’ criteria.

She writes that the uptake of password managers remains “low”, so this is the best practical defence. I find it hard to fault this.

I’d also prefer password managers (such as the excellent open source KeePassXC) be used. But they also come with their own problems in general, namely that you risk exposing your entire existence with a weak master password, or if the binary blob storing your credentials is compromised or stored incorrectly. I think it’s fantastic that their use is being encouraged, but let’s not treat them as a panacea, either.

(There’s also the bigger question about whether they’re a crutch, and that passphrases for auth are an idea who’s time has passed. We’ve kicked the can down the road somewhat by allowing people to log in with their Facebook account et.al., but the chain of trust is still anchored with a passphrase at the other end. Two-factor authentication is being more widely used, but certain implementations aren’t perfect either).

I’d also prefer to see wiser use of the term passphrase in lieu of password to encourage people to rethink how they use them, as I’ve done here. My experience has been that subtle rebranding like this does affect behavior, like calling myself a super genius. Wait, I forgot the “not a” before that.


Troubleshooting netatalk3 in a FreeBSD jail

Software

Netatalk3 is a file server for exporting storage to Macs. Samba has long been considered its replacement, but to this day Netatalk still handles file labels and other Mac-specific metadata more reliably and with greater performance. One day I’ll properly try replicating this in Samba.

I installed it in a new FreeBSD jail:

# pkg install net/netatalk3

Then configured it largely the same as I did on FreeBSD in 2014, and on NetBSD last year. Only this time, all the Macs in the house refused to talk to it.

I tail’d /var/log/daemon.log in the jail and was inundated with afpd(8) spam:

netatalk[34758]: Restarting 'afpd' (restarts: 7)
afpd[42393]: dsi_tcp_init(*): getaddrinfo: Name does not resolve
afpd[42393]: No suitable network config for TCP socket
afpd[42393]: no suitable network address found, use "afp listen" or "afp interfaces"
afpd[42393]: main: no servers configured

I followed the error’s advice and added the IP address of the jail to the [Global] section of my /usr/local/etc/afp.conf file:

afp listen = <IP Address>

It worked, and I was able to log in, as shown in the logs:

afpd[88524]: Netatalk AFP/TCP listening on <IP Address>:548

I don’t recall ever having to add a specific interface or IP address to an afp.conf file before on a FreeBSD or NetBSD host. My hunch is it has something to do with the jail environment, and dsi_tcp_init not being able to autodetect or initialise the jail’s virtual network interface. Please correct me if you have more details!


Mobile phones, and always being available

Thoughts

One of the more recent Business Blazes dropped this truth bomb at the start:

I sometimes feel the invention of the mobile phone was a bad move for society, as we now seem to think everyone in our contacts list should really be readily accessible around the clock. And we get irritated if they don’t respond to our messages in a timely fashion.

I’m sure mobile phones have been a net positive for the world, at least on balance. There are people for whom their smartphone is their computer, their primary business tool, and their only way to keep in contact with people. The alternative for so many, especially in the developing world, would be… nothing.

I watched a great documentary a few years ago about an entrepreneur in Indonesia who’d collect everyone’s mobile phone in his town, then for a small fee ride them on his motorbike for a few hours to the nearest phone tower. All the cached messages would be sent and received, and he’d deliver them back. It put a lot of my whinging into stark contrast.

Now, having said all that, even the most optimistic technologist would (or should!) readily admit that mobile phones have been a mixed blessing. Populations in the developed world treat them as disposable accessories to be refreshed annually with ever-diminishing returns and functional justification, generating millions of tons of e-waste laced with rare earths and other non-recyclable materials.

Sociologically there’s still the open question about mobile addiction, online bulling, extortionate mobile applications store practices, and what Cory Wong and Cody Fry so eloquently put in their song Golden:

Looking all around at the people I see;
Everybody’s living the dream.
Starring in the show that we film on our phones;
Taking pictures for pretend magazines.

You could write entire books just on each of these points.

But back to Simon’s point in Business Blaze, via his illustrious writer Danny (AM I RIGHT, PETER!?). Mobile phones didn’t just make it easier for us to reach out to other people, it made it easier for others to always access us. I don’t think we’ve fully come to terms with the implications.

I’m part of the last generation (yay, millennials!) ever in human history that can remember a time before ubiquitous access was normalised. I had to arrange meetups with friends in advance as a kid, with set times and locations. I got a phone by the time I was 13, but it was unusual enough that MSN Messenger, ICQ, and email were still the only reliable ways to reach out to someone. I’m sure some of the Gen-X and Baby Boomers among you would even consider those luxurious. Early Seinfeld episodes literally used inaccessibility as a plot device and joke punchline… they would make no sense now.

Which comes back to the point about expectations. You’re required to have one of these infernal devices on you at all times to participate in the modern world, and our society has codified a set of norms and expected behaviour around them. I don’t think many of them are healthy.

Phone callers demand you drop everything you’re doing and focus on them, which is incredibly invasive for a device that’s on your person 24/7. Some of those calls may be required in emergency situations, but it’s seeped out into every interaction. We’re trained to let the phone keep ringing, because immediately rejecting the call is considered rude and a snub. But really, who are we kidding? And the only acceptable excuse for not answering a call, beyond bathroom activities or maybe even being asleep? I was on another call. At least with a landline you could claim you were elsewhere when a caller got your entertaining voicemail message.

Text messages, private DMs, and public social media mentions don’t carry the same level of urgency, but the expectations remain. We’ve associated how much we value someone on how studious they are with their replies on these silly, artificial slabs. This disproportionately affects introverts for whom excessive social interactions are a drain and source of anxiety, but I’m sure its not healthy for anyone. Our social circles have become ever wider, but are they any deeper?

If there’s any hope here, it’s that introverts are a resourceful bunch, and will continue to find new and innovative ways to obfuscate and pretend communications are interrupted for reasons beyond their control… something we can all benefit from. I’m sorry, my latest vaccine didn’t have enough 5G antigens!


Soundtrax: No music download for you

Internet

A vinyl record I bought this year included a card for a digital download version of the songs. I figured why not give it a try:

DIGITAL DOWNLOAD. Go to www.soundtrax.com. Enter the 8 digit case sensitive code printed below. Click “GET YOUR MUSIC”

I went to Soundtrax:

After millions of successful downloads, it’s time to say goodbye. In January 2021, Adobe ceased to support Flash, the platform on which the Soundtrax engine was built and on which it operated since 2008, thus ending our ability to support downloads. We apologize for any inconvenience.

The album came out after January 2021. Sometimes I feel like I’m living in a parallel universe; lots of synchronised bits, and no destination.


My sleeper PC... curse!

Hardware

The best thing about having a job in your thirties is having the privilege and means to buy things you always wanted as a kid. Okay it’s not the best thing, but it has to rank up there. In the words of my old man, what’s the point of working your brains out at a job if you can’t grant yourself permission to be a little silly sometimes?

The dream for me has been to collect the computers I wanted as a kid. I’ve now spent more money and time refurbishing my childhood Pentium 1 tower than when I got it new! I’ve got a beautiful little Toshiba Libretto laptop that was literally advertised as being “smaller than a VHS tape” when it came out. Josh Nunn of The Geekorium generously gave me his Commodore 128 which I use to play the games I missed out on growing up, and even some CP/M stuff which filled in a missing piece of the puzzle in my understanding of 1980s DOS.

This desire for pointless nostalgic revelry also extends to contemporary machines. I’ve been obsessed with the idea of sleeper PCs that, like their automotive cousins, are modern computers inside old cases. To that end I’ve had saved searches for specific computer towers on eBay that are listed as being in good cosmetic condition, but “for parts only” or are otherwise non-functional. The plan was to buy them, carefully remove their internal parts, then shoehorn a new motherboard, power supply, a couple of SSDs, and a blu-ray burner into them. I’d probably stick with integrated graphics for my needs, but I’d also explore perhaps using a drive bay or other case intake to get better air circulation and eventually put a discrete GPU in.

Emphasis on the plan was. The problem is, I keep buying dead machines and fixing them. The first was a Gateway 2000 full-height AT tower from 1992 that I was originally going to turn into a vertical NAS with drive sleds, but the only reason it wasn’t functional was a loose power connector and RAM that needed re-seating. I couldn’t bare to rip it apart, so I sold it to a Korean gentleman in Brisbane who, like me, wanted the PC from his childhood.

The second was an IBM Aptiva tower from the mid-1990s. It was also listed as DOA, only this time it just needed some contact cleaner on the mechanical power switch and a hard drive. I ended up giving it to a friend who’d been after an IBM tower to put OS/2 on.

Which leads us to the Compaq Presario tower I blogged about a fortnight ago. Yes, once again, I got it working! The specs of this machine are very close to my Pentium 1 tower already, so I feel fewer reservations about removing the parts, but I’ll still be keeping them in anti-static bags in case I want to restore it in the future.

I’m not an electrical engineer. I know enough about how to use oscilloscopes and LCR metres to be dangerous, and can follow the most basic of service manuals to troubleshoot problems, but I’m by no means an expert. But this got me thinking how many other childhood gems are out there for other people, just waiting for a bit of TLC.


The Men’s 50 Kilometre Race Walk

Thoughts

Hey everyone. I’m dealing with a difficult situation right now, so my posts for the coming week will be brief or dusted off from my exhaustive drafts folder. There’s some fun and interesting stuff in there, weirdly.

But I did need to jump on to correct the record before I semi-log off. I completely forgot about the Men’s Race Walk in my list of the best Olympic events! I’ve been following The Guardian’s Olympic page about the event in progress. I love how diverse a group of people it attracts, from all walks (hah!) of life and age groups. I liken it to one of the great equaliser events.

It probably doesn’t stand today, but I set a record during a charity walkathon at my primary school back in the day. Each lap around our school’s oval was a dollar or two towards a charity; I volunteered mine to MS Australia. I kept going until a teacher came to pat me on the shoulder and say the event was over, and that I was the only one left. I felt like my little legs could have gone for another dozen laps at least!

I was never an especially athletic person, but I have all the time in the world for walking and power walking. A brisk morning stroll is about the only thing that wakes me up in the morning; another reason lockdowns have been tough.


Our carpet rainbow

Thoughts

View of a small rainbow streaking across our carpets

She’s visited for a few minutes every morning this winter. It’s been much appreciated.


Micah R Ledbetter’s ErgoDox feedback

Hardware

Last month I wrote about getting a new Microsoft Ergonomic Keyboard 2019 keyboard that’s a keyboard Microsoft released in 2019… keyboard. I got a flurry of comments which I summarised in a feedback post the next day.

Michah R Ledbetter wrote in to let me know about the Ergodox for those in a market for split keyboards:

I recommend an ErgoDox, IF you have typing pain that was like mine.

The thing is, assembled ErgoDox boards are really expensive! I agonized over it for a long time before deciding to pull the trigger. It turned out to be worth it, though - it was instrumental in making my typing pain-free again. I know different people’s RSI is different; for me, typing with pinkies had become extremely painful, and moving keys like enter, control, and shift to under the thumbs was a huge relief.

I’m relieved to hear! Most of my pain was in my wrists, so having the split in this Microsoft unit already feels so much better. But I know people who deal with joint pain in their fingers; it sounds like as much fun as living with someone who types on an IBM Model M (I say this as someone who used to, but lives in much closer quarters with a significant other than he did before)!

But I digress. Ruben, getting distracted? NEVER.

I took a look at the ErgoDox EZ keyboard Micah recommended, and it’s on a whole other level. The configuration screen reminded me of the CODE keyboard; it was fun window shopping a white board, no lights, printed keycaps, black wristpads, and Kailh Brown switches I’ve always wanted to try as an MX Brown afficionado:

The Rubenerd ErgoDox keyboard!

(For those interested in the middle wing keys, Micah also wrote a great visual tool to demonstrate how customisable they and the rest of the board are. I already have a few ideas about what I’d map them to too. To two? Two tutu? Too to… English is weird).

The same team also sell a Moonlander keyboard that I only found about today. It looks like an evolution of the ErgoDox, with a more refined design. It shares the same ortholinear key laoyout as the ErgoDox, which reduces the contortions and stretching each finger needs to perform when typing.

But here’s where my primary reservation comes in. Both devices have two physically-seperated pieces, one for each hand. This is great for getting the initial positioning right, but they’re prone to shifting around if you’re as animated a typist as I am. It was among the reasons I returned my Kinesis board a few years ago; it drove me batty constantly having to shift and rearrange each piece. Maybe I could sketch and 3D print a board that each side would slot into, or take a piece of wood and make a few indentations for the feet of each board piece. But then, that’s a lot of extra work to accomodate a device that’s already pricier than some of my laptops.

Realistically, is a word with fourteen letters. I’m just fine with my Microsoft split keyboard for now, but it’s good to know that there’s an avenue to mechanical joy if I ever want or need to tread that path again. “Mechanical joy” was not something I ever thought I’d write, and it sounds mildly terrifying.


Aiyo in the Oxford English Dictionary

Travel

The Sun Daily in Malaysia reported the news back in 2016, but I only just found out about this from friends:

KUALA LUMPUR: The word ‘Aiyo’ is now an accepted English word. The Oxford English dictionary has included the popular south India slang and the news is trending on social media. The definition given for Aiyo is – to denote distress, regret, or grief; ‘Oh no!’, ‘Oh dear!" in south India and Sri Lanka. Variations accepted includes ‘aiyoh’ and ‘aiyah’.

Aiyo is an indelible part of Singlish too, though I didn’t know it was Tamil slang. Along with shiok, it’s such a versatile exclamation.

I remember one cab ride with an uncle years ago when we just missed a red light on account of someone cutting us off, and I let out an aiyo. We ended up having a fifteen minute chat about the horrible caucasian tourists he’d driven before me, and that I’d reminded him that some angmohs okay, lah. He was such a sweet old man, I couldn’t imagine what would posess someone to laud over him like that. Tourists… wah lao eh.

I think my friends and I used “aiyaaaaaah” the most growing up, because it was easier to draw out. Just like this post!

The html language attributes on all my sites is still set as en-SG, in part because they use 24-hour time, and the correct leading zeroes on dates. It’s also where I grew up and learned computers, so I think it’s a nice tip of the hat. Maybe I need to start reintroducing more of their words, too.


Why do you timezone, Ruben?

Internet

A gentleman by the name of Eric emailed this comment:

Why do you always write your articles in the future?

I take it he’s in the Western Hemisphere. It’s not the future where I am, except when I steal Amelia Watson’s time-travelling watch. But I take the point; timezones are hard.

My blog here briefly showed both my localtime and UTC under each post. I got rid of the latter because I thought it made things more confusing. Maybe I need to go back to calling out my timezone to each post.

While I’m talking about these spherical anomalies of time and space, handing timezones was one of the last nails in the coffin of WordPress for me back in the day. I used to write from multiple places in The Before Times™ and when I was studying overseas. To this day, most of my posts from 2005-12 were filed with +08:00 for Singapore and KL, even though half the posts were from Adelaide or Sydney. That might not sound like much, but I also used to write late into the night. That discrepancy of a couple of hours was enough to push hundreds of posts into the wrong day. The horror!

It’s probably not worth sweating over having the exact time on a blog like this. But as my dad always said, a task worth doing is a task worth doing right. Then he hit his head on a kitchen cabinet.