Q is for Quarry#

Sat 15 Mar 2025 08:35:06 PM UTC

Q is for Quarry. This was once a chalk pit, is now a grassy space behind a small housing development just north of Saffron Walden.

The trip there was supposed to be along "everyone's favourite route from London to Finchingfield", aka the A113/B184, but Kurviger really really doesn't want to route along it - I don't know why - so a couple of impromptu stops in the wrong Roding and again in Dunmow to curse it. Lots of very pretty villages with thatched houses that I really wasn't paying a lot of attention to. Next time I will know where I'm going. Maybe ...

I was running out of afternoon by the time I got there, so the journey back was "get petrol and then shortest path to the motorway". Which was a fair bit of riding onto the sun along minor roads, which was quite uncomfortable even with the drop-down visor in my helmet, then joining the M11 near Stansted - which I'm finding less scary than it once was but still no more interesting.

Speed limits on UK roads are weird. The default "national speed limit", outside of villages and town, is 60 mph on single-carriageway roads and 70 on dual-carriageway roads (those which have a physical divider between traffic in one direction and traffic in the other). Sometimes a 40 or a 50 limit is set where the road is considered not safe for 60, but it has to be important enough for someone to have considered it. So you find narrow gravelly NSL roads that one would have to be much braver than me to ride at anywhere near 60, and wide gentle well-maintained roads with good surface that are for some reason (no doubt a good reason, I am not disputing that the reason is valid) 40

I went back through my dashcam footage to find this shot with the half-timbered house on the corner that has each storey larger than the one it's above. Unfortunately although I have a timestamp I don't have any easy way of correlating it to where on earth I was at that time. Somewhere in a village in Essex.

(It's not that wavey-looking in real life, but my dashcam mount vibrates with the engine noise. I would move it somewhere else if I could only figure out where)

Aha, it was Thaxted Guildhall

https://historicengland.org.uk/listing/the-list/list-entry/1112905

R is for Radio Direction Finding#

Sat 22 Mar 2025 07:19:05 PM UTC

R is for Radio Direction Finding, or "radar" as we call it today. This is the last remaining complete mast from the "Chain Home" coastal defence system that operated in WW2 to warn of incoming German aircraft. It's not actually at the coast any more, it was moved to near Chelmsford in the 1950s.

The tower is over the road from a cemetery with some parking adjacent. There is a sign in the car park saying its for use by cemetery visitors only, so I stood in the cemetery to take this photo.

Trip out was via Sportsbikeshop because when I looked before setting out for my air pressure gauge it was nowhere to be seen: not under the bike seat where I keep it nor on any of the shelves, tables or pockets I might have left it in. So I bought a miniature battery-powered air compressor with a gauge, because I can keep that under the seat and if I ever puncture while on a ride it can do a better job of getting the tyre back up to pressure than the gas cylinders in the bacon strip patch kit that came with the bike.

I had to take it all out of its packaging to make it fit under the seat. When I got home I was missing a bit: couldn't find the adaptor/tube that screws onto the tyre valve. In the course of looking for it I found my missing air pressure gauge, fallen down the side of the rear fairing. (The adaptor had, it turned out, suffered a similar fate and fallen down the other side)

The best news of the day is that the bike started first time with very little encouragement, so it looks like the problem was the air filter. Fingers crossed this continues

TfL 1:1 training session#

Tue 25 Mar 2025 08:42:08 PM UTC

Well. tl;dr my standard of riding today would have been a mod 2 fail - first because I wasn't doing shoulder checks that I should have been, and then second because I missed road signs and lane markings (imo because I was concentrating too much on the shoulder checks because I don't do them by habit)

So, I guess actionable feedback is the best kind of feedback. He did say my checks on lane changes/joining roads were fine, I guess the pattern is I'm only looking for vehicles bigger than me but not for the cyclist/scooterist who's going to cut me up on the left.

A little more info, then: it's a 1:1 session run by Universal MCT (there is another school who also do it but they're based further south). We covered

• some tips for U-turns because I'd said I was weak there,
• riding round some slow residential roads turning left and right, where I was pulled up on lack of shoulder checks (and compensated by doing the wrong shoulder checks) and for cutting the corners on right turns
• some 30mph roads with speed humps and mini roundabouts
• some 30/40 multilane roads with full size roundabouts

We stopped after the first bit to chat at the roadside, and then at the end for a full debrief. Instructor was cheerful, friendly, and communicated clearly. Would recommend to anyone else who left it two years between passing their test and getting on a bike again and wants an objective assessment of what they're doing right/wrong. You need to live, work, or study in one of London's 33 boroughs to be eligible, it's two hours, it's free, and it's open to CBT riders as well as full licence holders.

Most Common Mod 2 Mistakes 15. Shoulder checks & Lifesavers - seems this is what they want to see. Looks like I'm turning my head too far, as well

The pen (test) is mightier than the sword#

Thu 27 Mar 2025 08:26:52 PM UTC

The NGI0 Entrust Fund, of which Liminix is a beneficiary, also offers technical services and expertise, and one of the services on offer is a security audit.

Between October 7, 2024 and November 7, 2024, Radically Open Security B.V. carried out a penetration test for Liminix, and they've also kindly agreed to remove the "Confidential" label from the report so I can share it.

The "Findings" were two cases of path traversal vulns, both caused by string concatenation. One was in the TFTP service, the other in watch-ssh-keys.fnl, and both were fixed back in November.

The "Non-findings", though, included a review of the default firewall rules and some very useful advice on how to tighten them up. This has led to some extended comments in the code :-) and also some improvements in how it actually works.

Zones in firewall rules

Technically not a RoS finding at all, but I realised while looking at the firewall rules that the network interface names I'd originally hardcoded as int and ppp0, intending to go back and fix them later, were still hardcoded as int and ppp0.

For the particular config in modules/profiles/gateway.nix that's not so bad as they are most of the time the correct network interface names, but even in that context not always. Sometimes when PPP wedges itself in weird ways and the service restarts you end up talking to ppp1 instead of ppp0. Or even ppp27 if that kind of thing goes on for a while. And for other more complicated configs with pluggable devices, this simply wasn't going to help at all.

What we've done is to extend the firewall module with a zones parameter, which maps zone names to interface services

  services.firewall = svc.firewall.build {
    zones = {
      wan = [ services.pppoe ];
      lan = [ services.lan4 ];
    };
  };

For each zone we create an nftables set with the zone name, allowing us to write the firewall rules referencing sets instead of hardcoding interfaces

-      (accept "oifname \"int\" iifname \"ppp0\" meta l4proto udp ct state established,related")
-      (accept "iifname \"int\" oifname \"ppp0\" meta l4proto udp")
+      (accept "oifname @lan iifname @wan meta l4proto udp ct state established,related")
+      (accept "iifname @lan oifname @wan meta l4proto udp")

and then we use the secrets subscriber service (which turns out to be good for more than just secrets, and so could use a better name) to watch for interfaces appearing/disappearing and add them to the appropriate set.

DNS rule tightening

We no longer allow incoming packets on port 53 unless part of an established connection. This rule was added to enable DNS replies but it was never needed as conntrack already takes care of those.

ICMP rate limiting

ICMP is important to the correct functioning of a network (and in IPv6, even more so) so one does not simply turn it off. But that doesn't mean we have to leave ourselves open to being ping flooded.

In theory it should have been easy to add rate limits for ICMP, but in practice, to calculate the cap at 5% of available bandwidth you need to know what the available bandwidth is - and the only person who knows that is the site administrator. We can't identify the speed limit of the upstream just by looking at whether it's DSL or fibre or ethernet or carrier pigeon, nor can we query the limit except by testing it, which would be somewhat invasive.

What we've come up with, which may with hindsight now I try to explain it be over-engineered, is a new concept of "service properties", which can be added to any longrun service. Properties are similar to outputs except that they're static: a service property is set at configuration time and exists whether the service is up or down. So we now have a bandwidth property on interface services, and the firewall service checks it whenever it gets notified of an interface change and uses it to write a new rule:

# modules/ppp/common.nix
  service = longrun {
    inherit name;
    run = ''
      # ...
    notification-fd = 10;
    properties.bandwidth = bandwidth;

What's next?

Liminix 1.0 is next! I've been dogfooding Liminix for a year or more, and it's been reliable for all but the first three weeks of that, so it's time to say "good enough that you can use it" - and also, just as importantly, "we'll tell you first if we're going to radically break things".

On my pre-release task list:

• update the device documentation so that the reader knows which devices are usable and which are experimental

• impose a consistent look and feel across the web site, so that the docs match the rest of it

• make another video

Not on my pre-release task list, despite that I am sorely tempted to: completely redesigning the firewall config. I will resist. That can be in 1.1.

S is for Stocks#

Sat 29 Mar 2025 07:28:02 PM UTC

S is for Stocks. Although there have been stocks in Roydon since "date uncertain", they have been substantially rebuilt since that time and perhaps even more than once. "Most recently in 2016" according to the Parish Council web site.

I'm assuming they don't still see use, but that does make one wonder why they keep rebuilding them. Maybe it's to attract motorcyclists to the village to take pictures. Anyway I was careful to stick to the speed limit lest I end up in them

Next to the stocks is the village lockup, which looks like a small wooden shed. Apparently this is where in former times criminals were held until they could be brought before the magistrate.

It looks very low to the ground. Perhaps they expected to lock up only short people, or just didn't see why the detainee should be able to stand up.

I did try for a photo of the inside, but I don't really know what I'm looking at here. Its possible that the low height is because it was partly set into the ground, but its equally as possible that the floor has rotted away and been removed

Who needs a satnav anyway?#

Sat 29 Mar 2025 08:03:55 PM UTC

I am experimenting with running Kurviger on one of my (several) old Android phones as a dedicated "satnav" for the bike, but tbh am not sure it's worth it.

• the phone mount blocks the ignition keyhole, so I have to remove the phone to put the key in
• if I disconnect the phone from its usb cable when I stop, so it doesn't drain the bike battery, next time I ride then I've drained the phone battery. Or I have to disconnect and remove it and take it inside to charge. [ Later note: not any more ]
• if I'm in the house plotting routes for my next ride, there's now an extra step to copy the route to my on-bike device
• and I need to enable the wifi hotspot on my actual phone so the on-bike device has internet. I suppose I could put a SIM in it
• on the plus side, my bluetooth headset can connect simultaneously to my bike phone and to my real phone, so no problem there
• and if, perish the thought, I were to crash and become separated from the bike, this would mean that my phone would go with me to hospital and not with the bike to whatever storage facility the police recover it to. If they even do that and don't just leave it at the side of the road.

Minerva/Specsavers custom-moulded earplugs#

Tue 01 Apr 2025 08:14:00 PM UTC

"What big ears you have"

My custom-moulded earplugs are here! I was not allowed to simply go and collect them, I had to make an appointment with the audiologist to have them handed over. (The appointment consisted of them being handed over, and me putting them in my ears: presumably it would have been more involved if I hadn't succeeded in that act)

Red is right ear, blue is left ear and you can see they're both a lot fatter than the off-the-shelf Pinlock earplug I put in there for comparison - which might explain why I was not getting a whole lot of volume reduction from the Pinlocks. Texture is "slightly squishy", I guess they're made of some kind of silicone compound.

They came with a soft case and the hard case pictured. Both cases are far too large for the purpose, but the plugs are a little too girthy to fit in the small metal keyring tube that I've been keeping the Pinlocks in. Not that I'm complaining about the size when it's a consequence of them being big enough to fit my ears, you understand.

I put them in for ten minutes to ride home and they do noticeably attenuate the sound, but I didn't get to more than about 45mph so I don't yet know how good they are at motorway speed.

The visible branding is Specsavers, but they're actually made by Minerva