Jon's Notes

noreply@blogger.com (Jonathan Auer) — Tue, 10 Apr 2007 20:35:00 +0000

From xkcd:

noreply@blogger.com (Jonathan Auer) — Tue, 10 Apr 2007 06:10:00 +0000

On a Netscreen 5 using the Home–Work port mode, Home cannot talk to Work.
You cannot change or remove the rule that denies traffic from Home to Work. You cannot add a exception that allows some traffic from Home to Work. If you try to change the rule, you get a less than helpful error:

set policy from "Home" to "Work" "Any" "Any" "ANY" permit
unknown keyword Any

I'm aiming for a setup where I have separate networks for public services (Web, Email, DNS) and management/private services(SSH, LDAP, Syslog) with a firewall in the middle arbitrating access.
The general public should only be able to access public services on public service machines.
Public service machines should only be able to access services that they need on private service machines.
Private machines need full access to public machines for service monitoring (Nagios and Cacti/SNMP.)
So it turns out that I cannot use the Home–Work port mode because in some cases the public network needs access to the private network and the private network needs full access to the public network.

Tomorrow I'm going to try Trust–Untrust port mode with a secondary IP on the Trust interface for the private subnet and Intra–zone policies to control communication between the two subnets.

noreply@blogger.com (Jonathan Auer) — Thu, 08 Mar 2007 23:46:00 +0000

My iBook took a tumble off of a stack of Total Control 1000s yesterday and cracked the screen frame.
My previous iBook fell off my dorm bed and cracked in the same place. I was able to replace the frame and it eventually died of the G3 logic board bug. I think the screen frames are the same, so I'm going to try replacing the frame with one from my G3.

While it may be asking too much for a consumer notebook to survive falling three feet onto the steel plate at the base of a telco rack, all my non-iBook laptops have survived much worse.
I suspect the magnesium frame used in the iBook is too brittle and can't handle the sheer stress next to the hinge.

Prior to the iBooks, I had a Sony VAIO with a 17 inch screen. It survived falling five feet off a ironing board. My brother is using it now, six years later. Its hard drive died and was replaced a few months ago.
The Toshiba 486 laptop that I used in my early teens survived even worse handling.

If I can repair it, my iBook will stay safely at home. I'll try to find a used Panasonic CF-28 for field work. I doubt I can break one of those. I don't need a gaming powerhouse, just something that is compatible with Ubuntu and will run Firefox with decent performance.

I know how to do that

noreply@blogger.com (Jonathan Auer) — Thu, 08 Mar 2007 05:38:00 +0000

noreply@blogger.com (Jonathan Auer) — Sun, 21 Jan 2007 07:26:00 +0000

So, I recently acquired a Netscreen 5XT—the smallest firewall available from Juniper.
Since I purchased it through eBay, Juniper will not let me purchase a support contract for it unless I first pay a warranty reinstatement fee. This reinstatement fee is equal to one year of support.

It turns out that the 5XT, one year of support, and the support reinstatement fee combined still costs less than a PIX 506e without support.

Now if I can just figure out why my VPN is not working…

I love my keyboard

noreply@blogger.com (Jonathan Auer) — Sat, 13 Jan 2007 07:25:00 +0000

I love my keyboard. It is sturdy, clicky, and full of history.

Sometimes when I really get into coding, my roommate asks what I'm doing. He can hear my keyboard through the door.

Once upon a time it was the keyboard on a SP in a Hitachi Trinium Mainframe. A one inch grey square covers up the IBM logo.

My keyboard is a IBM 42H1292 from Greenock Scotland.

This Christmas Eve morn

noreply@blogger.com (Jonathan Auer) — Sun, 24 Dec 2006 10:44:00 +0000

Here I sit writing. What do I hear? The dryer, dishwasher, and bathroom fan each buzz in a slightly different manner. My roommates' alarm clock is buzzing. Nightwish is playing in iTunes.

It is the holiday. I have a to-do list. I'm on-call, but my parents are close enough that I could probably go visit them. Unfortunately my younger siblings have a cold. My brother and several friends are in Denver. I don't think I can stretch my on-call response time that far.

So, here I am. It is Christmas Eve and I have a to-do list. I have the kitchen and bathroom partially cleaned. I've turned one broken low-quality futon into a low table. I'm rearranging my bedroom and the living room. I'm a few sections into The Nicomachean Ethics. Later I'm reading The Histories. Hooray for time to read.

It is interesting to see which kinds of untidiness people are willing to tolerate.
I am usually surrounded by piles of books, papers, and parts. My roommate keeps his desk clear and books on the shelf.
I notice dust bunnies on the kitchen floor. He goes on vacation and leaves this sink full of dishes.

I wonder which is the more sanitary method of storing eating utensils, in a drawer or on a counter top rack? I should find a microscope and count germs.

The system disk in my e420r died the other day. From now on, said system volume is going on mirrored drives. I wanted to fix it early last week, but work was really busy. I have it plugged into a console server, so I can work on it from home, I just need to setup JumpStart on my X1.

I was running syslog-ng and Splunk in a zone on the 420r. In hindsight, I should have used the X1 for infrastructury things and the 420r for projects and hosting.
I installed the X1 first, so I've been using it to host my home page, wiki, and simple projects. I think I'll repurpose it as a JumpStart/Nagios/syslog-ng box. I'd like to run Cacti on it as well, but then I need to add MySQL to the mix.

Holiday in Denver

noreply@blogger.com (Jonathan Auer) — Sat, 25 Nov 2006 03:13:00 +0000

Wee! I’m back in Denver over Thanksgiving break. My brother is going to school in Denver and my mother has this thing about eating together as a family. Put those two together and you get a family road trip. Family -brother and me drove up to Wisconsin to pick me up and then we drove to Denver where my brother lives. We brought turkey, cookies, etc. We has a nice meal in his apartment on the day in question

Watch Those Ads

noreply@blogger.com (Jonathan Auer) — Sat, 18 Nov 2006 17:52:00 +0000

Here is an example of why you should not run external advertisements on web pages for ideologically sensitive organizations. Yes, that picture does show a church web site with a link to Jesus Camp: The Movie.

I came across that image on the demo page for Connecting Members
while looking at various services for creating and hosting church web sites.

noreply@blogger.com (Jonathan Auer) — Tue, 17 Oct 2006 16:05:00 +0000

So, I just got my Organization & Archetecture midterm back. My mind was not working in binary on the day of the test, so I missed a bunch of questions. For some reason I didn't have a problem with hex. That's a caffeine withdrawal headache for you. I would have an A if I'd answered those questions. Rats. I guess I'd better make sure I can do binary in my sleep before the final.

noreply@blogger.com (Jonathan Auer) — Thu, 12 Oct 2006 06:28:00 +0000

I went outside to take out the trash. There was snow on the ground. I hadn't noticed that it was snowing.
The presence of snow explains why I was feeling cold earlier. The temperature must have dropped sometime yesterday. I didn't notice. I was inside working from home today.
I never looked or went outside. How did I become so detached from the world?

noreply@blogger.com (Jonathan Auer) — Mon, 14 Aug 2006 00:20:00 +0000

“Suicide has never been dealt with except as a social phenomenon. On the contrary, we are concerned here, at the outset, with the relationship between individual thought and suicide. An act like this is prepared within the silence of the heart, as is a great work of art. The man himself is ignorant of it. One evening he pulls the trigger or jumps. Of an apartment–building manager who has killed himself I was told he had changed greatly since, and that that ‘undermined’ him. A more exact word cannot be imagined. Beginning to think is beginning to be undermined. Society has but little connection with such beginnings. The worm is in man's heart. That is where it must be sought. One must follow and understand this fatal game that leads from lucidity in the face of existence to flight from light.

There are many causes for a suicide, and generally the most obvious ones were not the most powerful. Rarely is a suicide committed (yet the hypothesis is not excluded) through reflection. What sets off the crisis is almost always unverifiable. Newspapers often speak of ‘personal sorrows’ or of ‘incurable illness.’ These explanations are plausible. But one would have to know whether a friend of the desperate man had not that very day addressed him indifferently. He is the guilty one. For that is enough to precipitate all the rancors and all the boredom still in suspension.

But if it is hard to fix the precise instant, the subtle step when the mind opted for death, it is easier to deduce from the act itself the consequences it implies. In a sense, and as in melodrama, killing yourself amounts to confessing. It is confessing that life is too much for you or that you do not understand it. Let's not go too far in such analogies, however, but rather return to everyday words. It is merely confessing that that ‘is not worth the trouble.’ Living, naturally, is never easy. You continue making the gestures commanded by existence for many reasons, the first of which is habit. Dying voluntarily implies that you have recognized, even instinctively, the ridiculous character of that habit, the absence of that daily agitation, and the uselessness of suffering.” –Albert Camus, The Myth of Sisyphus. Page 4-5.

We shall see if it is useful to post interesting excerpts of books that I'm reading. I hope that it makes citing things easier.

noreply@blogger.com (Jonathan Auer) — Sat, 22 Jul 2006 01:46:00 +0000

“Your brain does not use RPC to talk to your pancreas.” –Werner Vogels, E-Commerce at Interplanetary Scale.

A day in the life of Jon

noreply@blogger.com (Jonathan Auer) — Wed, 19 Jul 2006 20:51:00 +0000

Yesterday 1:00 pm: Take care of some domain trouble tickets that can't wait for me to get to work.
Yesterday 2:30 pm: Arrive at work in Hartford.
Yesterday at 6:30 pm: Grab sub from Cousins
Yesterday 11:30 pm: Arrive at Whitewater PoP to do hardware maintenance on a Windows 2003 Domain Controller.
Today at 4:?? am: Get gas for car and a beefstick and energy drink for me. Loudly play The White Stripes to stay awake on the drive back.
Today at 5:00 am: Watch sunrise while driving.
Today 5:30 am: Arrive at home (promptly take nap.)
Today 11:15 am: Arrive at work in Hartford.
Today 12:45 am: Arrive at PoP in Jefferson to fix branch VoIP phones (Cisco CM.)
Today 2:30 pm: Arrive at Madison PoP to install 3Com TC (modem bank.)
Today 3:57 pm: Writing this and drinking Dr. Pepper while waiting for TDS to show up and finish installing the T1s (3 of them) that feed the TC.

This sort of day happens once every two-three weeks. Is it any wonder that I can't wait for school to start?

noreply@blogger.com (Jonathan Auer) — Mon, 17 Jul 2006 12:34:00 +0000

My new cell phone is costing more than my old one. I think that is because Nextel charges more than T-Mobile for data. Anyway, I needed a way to talk with my parents and brother that did not chew through my cell phone minutes. Enter Asterisk.
I compiled and installed Asterisk on my local file server, a Celeron 400 system running Ubuntu. After much research and poking, I was able to talk with my brother for a few hours without draining my cellphone account or battery.

The Celeron is too slow to reliably transcode MP3s for music on hold, so I manually converted some songs to µlaw. That helped performance a bit, but I can still hear a stutter every time Asterisk writes debug info to the screen.

Current setup:
X-Lite for softphone
TRX Telecom for inbound calls
TelaSIP for outbound calls
Inbound calls go into a queue (just for fun) and ring the softphone when it is not on DnD.
Inbound calls work fairly well. I still need to tweak preferred codecs and QoS on my router.
Outbound calls don't work so well. I must not have NAT traversal working properly in my softphone.

From what I've done so far, I much prefer Asterisk to the CallManager 3.2 install that I babysit at work. Asterisk is easier to configure and more flexible.

noreply@blogger.com (Jonathan Auer) — Sun, 16 Jul 2006 03:34:00 +0000

Last.fm updated released a new site design the other day, and I'm still not sure what to make of it.
I like the new layout and the album photos to go with the recent track list. Unfortunately, I can feel a speed difference in the site. Pages seem to take longer to download and render.

The new player for windows is most excellent.

noreply@blogger.com (Jonathan Auer) — Sat, 01 Jul 2006 23:12:00 +0000

Well, that was a interesting D&D session.
Our gaming group has been having scheduling difficulties this summer, so we have been working on individual quests and such. My turn came this morning. Well, yesterday really, but my character sheet went missing.

Nathan wrote a nice mission for my character. I'm playing a Ranger, so naturally the mission involved scouting and some military work. It went roughly as follows:
First I sought out a large Orc army that was camping in the forrest. Then I followed part of the army to a town. The army surrounded the town. So I snuck into the town to warn the populace. The populace goes, woe is us, you have experience, here, you are in charge of defending the town. Now the town only had 100 or so trained fighters to go against a 2000-strong Orc army, so naturally I didn't want a fair fight.
The town was surrounded by fields of grain. The village had plenty of oil. So I do the obvious thing, wait until the army attacks and burn the fields. Mass roast Orc anyone?

Now Paul is calling me Josef because I used a defensive scorched earth strategy. I think technically it was Alexander who started that policy, but Josef is far more infamous.

And now, I leave to drive four hours south to visit my parents. One of my brothers has a birthday party this weekend. Plus there is plenty of room to work at my parents house. I still have a CompSci project to finish and a server to configure for a church forum.

noreply@blogger.com (Jonathan Auer) — Wed, 07 Jun 2006 03:10:00 +0000

So, here I am stuck at work installing Debian on a old PC. The PC is from a small ISP, a client of $WORK. It is going to run a bandwidth test web site and a caching DNS server.
I figured, hey, I have not posted anything for a while, and Debian will take a few minutes to install, so I really should write something here.

Apparently my license plate sticker and car insurance card both expired on the first. My parents discovered this yesterday (it is their car.) So my Dad and youngest brother drove up this evening to deliver them. We went out to eat and talk. They had to leave right after dinner because Dad had to work in the morning, but it was good to see them, if only for a few brief hours.

I had planned to get a new driver license today as I thought it would be funny to have one with a issue date of 6/06/06. I decided against it as visiting the DMV with expired license plates and no insurance would have been unwise.

In other trivia, the nerve linking my brain to the left two fingers and palm of my left hand has stopped working. This is mildly disconcerting. Also, using emacs has become quite interesting, since my Crtl finger is not working properly.

noreply@blogger.com (Jonathan Auer) — Thu, 18 May 2006 15:06:00 +0000

Why is parallel computing harder than using a web service?
Why isn't there a library that lets me call a map function and split the workload across 2, 10, or more computers?

Hmm, how to properly say "in soviet Russia, web service calls you?"

With a web service, the client calls a function on the server, and gets some data in return.
Now, have a pool of clients connect to the server. Then, when the server needs a lot of data processed it sends a subset to the data to each client. It then sends the processing function and dependencies to the clients. The clients process the data and return it to the server.

I'm aiming for something like Google's MapReduce, just more accessible for programmers without Google-scale resources.

Now, for a twist, what if the server could send the function in bytecode form to the clients along with a wrapper specifying how to run the function (what interpreter, parameters, etc.)?

I know that this has about as much to do with web services as a cow does with the moon, but if you invert the web service model, I think you get close. There is a better way to explain this, but I'm stuck for now. I've started writing a test implementation in Python. Hopefully I'll have something to show this weekend.

noreply@blogger.com (Jonathan Auer) — Tue, 16 May 2006 20:42:00 +0000

I was trying to install CentOS under a Debian 3.1 Xen dom0 by following these instructions.

I ran into a bit of trouble at one of the earlier steps:

lime:~# rpmdb --initdb
rpmdb: unable to initialize mutex: Function not implemented
rpmdb: /var/lib/rpm/__db.001: unable to initialize environment lock: Function not implemented
error: db4 error(38) from dbenv->open: Function not implemented
rpm: To install rpm packages on Debian systems, use alien. See README.Debian.
error: cannot open Packages index using db3 - Function not implemented (38)

Searching Google revealed other people having the same problem but not finding a solution.
I finally got it to work by upgrading some packages and installing others. I'm not sure exactly which one fixed it.

Here is what I did:
Installed the following packages from Debian Unstable:

libc6_2.3.6-7_i386.deb       libselinux1_1.30-1_i386.deb    locales_2.3.6-7_all.deb
libc6-dev_2.3.6-7_i386.deb   libsepol1_1.12-1_i386.deb      rpm_4.4.1-8_i386.deb
libc6-i686_2.3.6-7_i386.deb  libssl0.9.8_0.9.8b-1_i386.deb  tzdata_2006c-2_all.deb

Installed the following packages from Debian Stable along with their automatic dependencies:

alien lsb-rpm lintian dh-make cvs gettext-doc build-essential binutils-multiarch

noreply@blogger.com (Jonathan Auer) — Sun, 26 Feb 2006 06:02:00 +0000

As a followup to my previous post, I now have my database server running on Solaris Express svn_28. It has been running for a little over a week now.

I was not able to use my original disk partitioning scheme. One of the 18GB drives would not disklabel. I suspect that it has odd firmware since it originally came from an HP disk array. The other, otherwise identical, 18GB drive labeled without any trouble.

I decided to just pull the 18GB drives and use them on a OpenBSD system since they have worked under OpenBSD in the past.

I ended up installing the OS on a 8GB slice on one of the 73GB drives. The rest of drive 0 and drives 1 through 3 are part of a ZFS pool running RAID-Z. Unfortunately, that leaves my OS volume rather exposed.

Yes, I have a ZFS pool made up of a partition on one drive and 3 whole drives. I assume that I'm incurring a performance penalty for mixing it up, but it hasn't caused any problems yet. I cannot recall reading that you are allowed to create uneven RAID-Z pools, so I was pleasantly surprised.

Postgres is currently running in a zone. It (postgres) is being managed by SMF. No problems with Postgres yet, but I'm going to be throwing 2GB of data into it later tonight. I'm looking forward to seeing what that does to the system. Postgres is using a filesystem on the uneven RAID-Z pool for storage.

I finally plugged in and reset the RSC card. Also, I'm using IPF on the global zone to filter traffic for all the zones.

And that is all that is going on with my experimental database server.

noreply@blogger.com (Jonathan Auer) — Sun, 19 Feb 2006 10:07:00 +0000

Rad Decision tells the story of a nuclear power plant and associated workers from construction through disaster. I discovered and read it early this morning.
It provides a good look at the benefits and risks of a nuclear power.
Unfortunatly, it does not seem to be getting much publicity.

noreply@blogger.com (Jonathan Auer) — Fri, 10 Feb 2006 05:39:00 +0000

Off to bed now. I have to be at work early for a Motorola marketing (bleh) presentation. My guess is that they are introducing a mesh version of the Canopy system.

Mini rant:
Motorola has a nice low-chipcount board that they use in all their Canopy products (except for their 45Mb backhaul, IIRC that came from Orthogon.) So far, they have been using it for point to multipoint TDD networking. Apart from the size of the integrated antenna, all their radios are identical.

I'd love to see them make better use of their fixed-wireless software radio platform, so hopefully any mesh system will use their existing hardware design.

They recently introduced Canopy Lite subscriber modules which are identical to their normal SMs with the exception that they are speed restricted in software. This introduces a fascinating possibility. Why can't they sell bare hardware and let us buy feature (SM, AP, BH, Speed) licenses over the web as needed?

We have already determined that the software loads and hardware is identical across all those favors. You can get keys to increase bandwidth on the access points. Virtually everything is in place except for the online store.

noreply@blogger.com (Jonathan Auer) — Fri, 10 Feb 2006 04:03:00 +0000

It looks like I will be rebuilding my database server sometime this weekend. The drives that I ordered off eBay came in today. It will now have 18GB for the OS and 200GB for the database. It will also have an additional ~180GB from a HDS 5800 if I can find a FC HBA that actually works.

I've been very pleased with Solaris 10. That said, I don't want to deal with SVM RAID5 (4xST173404LC) when ZFS is around the corner. I just don't have enough disk space to use for temp storage if I need to restructure my filesystem.
I'm going to try the latest Solaris Express since it has ZFS. Hopefully the next stable release of Solaris 10 (06/06?) will come with ZFS. If it does, I'll happily use it for the next several years.

Here's to Postgresql + Solaris 10. It rocks.

noreply@blogger.com (Jonathan Auer) — Sat, 04 Feb 2006 01:37:00 +0000

So far, the year has gotten off to a slow start for me. I am taking the semester off from school as I need to pay up before I can take more classes. Well, that and I don't need to take any of the classes that CS is offering this semester.

Work is progressing slowly, as usual. I nearly have a fee-based hotspot system built using m0n0wall and RADIUS. Other than that, I have been improving our monitoring and management systems.

I baked O'Reilly scones last night. They turned out to be delicious, which surprised me since they were my first try at baking.

You could be reading this page over IPv6 thanks to HE.net's tunnel broker and a unused Cisco 3640 at work. Yes, I'm playing around with IPv6 again. I am using Freenet6 at home. It is too slow to do much, but I can SSH to my home systems without having to deal with NAT and port forwarding.