Under the current climate of lock-ins, self-isolation, shelter-in-place policies, and quarantine, it is becoming evident to more people the integral role computers play in our lives. Students are learning entirely online, those who can are working from home, and our personal relationships are being carried largely by technology like video chats, online games, and group messages. When these things have become our only means of socializing with those outside our homes, we begin to realize how important they are and the inequity inherent to many technologies. Someone was telling me how a neighbor doesn t have a printer, so they are printing off school assignments for their neighbor. People I know are sharing internet connections with people in their buildings, when possible, to help save on costs with people losing jobs. I worry now even more about people who have limited access to home devices or poor internet connections. As we are forced into our homes and are increasingly limited in the resources we have available, we find ourselves potentially unable to easily fill material needs and desires. In my neighborhood, it s hard to find flour. A friend cannot find yeast. A coworker couldn t find eggs. Someone else is without dish soap. Supply chains are not designed to meet with the demand currently being exerted on the system. This problem is mimicked in technology. If your computer breaks, it is much harder to fix it, and you lose a lot more than just a machine you lose your source of connection with the world. If you run out of toner cartridges for your printer and only one particular brand works the risk of losing your printer, and your access to school work, becomes a bigger deal. As an increasing number of things in our homes are wired, networked, and only able to function with a prescribed set of proprietary parts, gaps in supply chains become an even bigger issue. When you cannot use whatever is available, and instead need to wait for the particular thing, you find yourself either hoarding or going without. What happens when you can t get the toothbrush heads for your smart toothbrush due to prioritization and scarcity with online ordering when it s not so easy to just go to the pharmacy and get a regular toothbrush? In response to COVID-19 Adobe is offering no-cost access to some of their services. If people allow themselves to rely on these free services, they end up in a bad situation when a cost is re-attached. Lock-in is always a risk, but when people are desperate, unemployed, and lacking the resources they need to survive, the implications of being trapped in these proprietary systems are much more painful. What worries me even more than this is the reliance on insecure communication apps. Zoom, which is becoming the default service in many fields right now, offers anti-features like attendee attention tracking and user reporting. We are now being required to use technologies designed to maximize opportunities for surveillance to learn, work, and socialize. This is worrisome to me for two main reasons: the violation of privacy and the normalization of a surveillance state. It is a violation of privacy, to have our actions tracked. It also gets us used to being watched, which is dangerous as we look towards the future.

Disclaimer: I'm neither an experienced programmer nor proficient in reverse engineering, but I like at least to try to figure out how things work. Sometimes the solution is so easy, that even I manage to find it, still take this with a grain of salt. I lately witnessed the setup of an Envertech EnverBridge ENB-202 which is kind of a classic Chinese IoT device. Buy it, plug it in, use some strange setup software, and it will report your PV statistics to a web portal. The setup involved downloading a PE32 Windows executable, with an UI that basically has two input boxes and a sent button. You've to input the serial number(s) of your inverter boxes and the ID of your EnverBridge. That made me interested in what this setup process really looks like. The EnverBridge device itself has on one end a power plug, which is also used to communicate with the inverter via some Powerline protocol, and a network plug with a classic RJ45 end you plug into your network. If you power it up it will request an IPv4 address via DHCP. That brings us to the first oddity, the MAC address is in the BC:20:90 prefix which I could not find in the IEEE lists. Setting Up the SetID Software You can download the Windows software in a Zipfile, once you unpack it you end up with a Nullsoft installer .exe. Since this is a PE32 executable we've to add i386 as foreign architecture to install the wine32 package.

dpkg --add-architecture i386
apt update
apt install wine32:i386
wget http://www.envertec.com/uploads/bigfiles/Set%20ID.zip
unzip Set\ ID.zip
wine Set\ ID.exe

The end result is an installation in ~/.wine/drive_c/Program Files/SetID which reveals that this software is build with Qt5 according to the shipped dll's. The tool itself is in udpCilentNow.exe, and looks like this: The Network Communication To my own surprise, the communication is straight forward. A single UDP paket is sent to the broadcast address (255.255.255.255) on port 8765. I expected some strange binary protocol, but the payload is just simple numbers. They're a combination of the serial numbers of the inverter and the ID of the Enverbridge device. One thing I'm not 100% sure about are the inverter serial numbers, there are two of them, but on the inverter I've seen the serial numbers are always the same. So the payload is assembled like this:

• ID of the EnverBridge
• char 9 to 16 of the inverter serial 1
• char 9 to 16 of the inverter serial 2

If you've more inverter the serials are just appended in the same way. Another strange thing is that the software does close to no input validation, they only check that the inverter serials start with CN and then just extract char 9 to 16. The response from the EnverBridge is also a single UDP paket to the broadcast address on port 8764, with exactly the same content we've sent. Writing a Replacement My result is probably an insult for all proficient Python coders, but based on a bit of research and some cut&paste programming I could assemble a small script to replicate the function of the Windows binary. I guess the usefulness of this exercise was mostly my personal entertainment, though it might help some none Windows users to setup this device. Usage is also very simple:

./enverbridge.py -h
Usage: enverbridge.py [options] MIIDs
Options:
  -h, --help         show this help message and exit
  -b BID, --bid=BID  Serial Number of your EnverBridge
./enverbridge.py -b 90087654 CN19100912345678 CN19100912345679

This is basically 1:1 the behaviour of the Windows binary, though I tried to add a bit more validation then the original binary and some more error messages. I also assume the serial numbers are also always the same so I take only one as the input, and duplicate it for the paket data.

My free software activities in february 2020 March is ending but I finally wrote my monthly report about activities in Debian and Free Software in general for February. As I already wrote here, I attended to FOSDEM 2020 on February 1st and 2nd in Brussels. It was a amazing experience. After my return to Curitiba, I felt my energies renewed to start new challenges.

MiniDebConf Macei 2020 I continued helping to organize MiniDebConf and I got positive answers from 4Linux and Globo.com and they are sponsorsing the event.

FLISOL 2020 I started to talk with Maristela from IEP - Instituto de Engenharia do Paran and after some messages and I joined a meeting with her and other members of C mara T cnica de Eletr nica, Computa o e Ci ncias de Dados. I explained about FLISOL in Curitiba to them and they agreed to host the event at IEP. I asked to use three spaces: Auditorium for FLISOL talks, Sal o Nobre for meetups from WordPress and PostgreSQL Communities, and the hall for Install Fest. Besides FLISOL, they would like to host other events and meetups from Communities in Curitiba as Python, PHP, and so on. At least one per month. I helped to schedule a PHP Paran Community meetup on March.

New job Since 17th I started to work at Rentcars as Infrastructure Analyst. I m very happy to work there because we use a lot of FLOSS and with nice people. Ubuntu LTS is the approved OS for desktops but I could install Debian on my laptop :-)

Misc I signed pgp keys from friends I met in Brussels and I had my pgp key signed by them. Finally my MR to the DebConf20 website fixing some texts was accepted. I have watched v deos from FOSDEM

1. Until now, I saw these great talks:

• Growing Sustainable Contributions Through Ambassador Networks
• Building Ethical Software Under Capitalism
• Cognitive biases, blindspots and inclusion
• Building a thriving community in company-led open source projects
• Building Community for your Company s OSS Projects
• The Ethics of Open Source
• Be The Leader You Need in Open Source
• The next generation of contributors is not on IRC
• Open Source Won, but Software Freedom Hasn t Yet
• Open Source Under Attack
• Lessons Learned from Cultivating Open Source Projects and Communities

That s all folks!

WebRTC is a standard real-time communication protocol built directly into modern web browsers. It enables the creation of video conferencing services which do not require participants to download additional software. Many services make use of it and it almost always works out of the box. The reason it just works is that it uses a protocol called ICE to establish a connection regardless of the network environment. What that means however is that in some cases, your video/audio connection will need to be relayed (using end-to-end encryption) to the other person via third-party TURN server. In addition to adding extra network latency to your call that relay server might overloaded at some point and drop or delay packets coming through. Here's how to tell whether or not your WebRTC calls are being relayed, and how to ensure you get a direct connection to the other host.

Testing basic WebRTC functionality Before you place a real call, I suggest using the official test page which will test your camera, microphone and network connectivity. Note that this test page makes use of a Google TURN server which is locked to particular HTTP referrers and so you'll need to disable privacy features that might interfere with this:

• Brave: Disable Shields entirely for that page (Simple view) or allow all cookies for that page (Advanced view).

• Firefox: Ensure that http.network.referer.spoofSource is set to false in about:config, which it is by default.
• uMatrix: The "Spoof Referer header" option needs to be turned off for that site.

Checking the type of peer connection you have Once you know that WebRTC is working in your browser, it's time to establish a connection and look at the network configuration that the two peers agreed on. My favorite service at the moment is Whereby (formerly Appear.in), so I'm going to use that to connect from two different computers:

• canada is a laptop behind a regular home router without any port forwarding.
• siberia is a desktop computer in a remote location that is also behind a home router, but in this case its internal IP address (192.168.1.2) is set as the DMZ host.

Chromium For all Chromium-based browsers, such as Brave, Chrome, Edge, Opera and Vivaldi, the debugging page you'll need to open is called chrome://webrtc-internals. Look for RTCIceCandidatePair lines and expand them one at a time until you find the one which says:

• state: succeeded (or state: in-progress)
• nominated: true
• writable: true

Then from the name of that pair (N6cxxnrr_OEpeash in the above example) find the two matching RTCIceCandidate lines (one local-candidate and one remote-candidate) and expand them. In the case of a direct connection, I saw the following on the remote-candidate:

• ip shows the external IP address of siberia
• port shows a random number between 1024 and 65535
• candidateType: srflx

and the following on local-candidate:

• ip shows the external IP address of canada
• port shows a random number between 1024 and 65535
• candidateType: prflx

These candidate types indicate that a STUN server was used to determine the public-facing IP address and port for each computer, but the actual connection between the peers is direct. On the other hand, for a relayed/proxied connection, I saw the following on the remote-candidate side:

• ip shows an IP address belonging to the TURN server
• candidateType: relay

and the same information as before on the local-candidate.

Firefox If you are using Firefox, the debugging page you want to look at is about:webrtc. Expand the top entry under "Session Statistics" and look for the line (should be the first one) which says the following in green:

• ICE State: succeeded
• Nominated: true
• Selected: true

then look in the "Local Candidate" and "Remote Candidate" sections to find the candidate type in brackets.

Firewall ports to open to avoid using a relay In order to get a direct connection to the other WebRTC peer, one of the two computers (in my case, siberia) needs to open all inbound UDP ports since there doesn't appear to be a way to restrict Chromium or Firefox to a smaller port range for incoming WebRTC connections. This isn't great and so I decided to tighten that up in two ways by:

• restricting incoming UDP traffic to the IP range of siberia's ISP, and
• explicitly denying incoming to the UDP ports I know are open on siberia.

To get the IP range, start with the external IP address of the machine (I'll use the IP address of my blog in this example: 66.228.46.55) and pass it to the whois command:

$ whois 66.228.46.55   grep CIDR
CIDR:           66.228.32.0/19

To get the list of open UDP ports on siberia, I sshed into it and ran nmap:

$ sudo nmap -sU localhost
Starting Nmap 7.60 ( https://nmap.org ) at 2020-03-28 15:55 PDT
Nmap scan report for localhost (127.0.0.1)
Host is up (0.000015s latency).
Not shown: 994 closed ports
PORT      STATE         SERVICE
631/udp   open filtered ipp
5060/udp  open filtered sip
5353/udp  open          zeroconf
Nmap done: 1 IP address (1 host up) scanned in 190.25 seconds

I ended up with the following in my /etc/network/iptables.up.rules (ports below 1024 are denied by the default rule and don't need to be included here):

# Deny all known-open high UDP ports before enabling WebRTC for canada
-A INPUT -p udp --dport 5060 -j DROP
-A INPUT -p udp --dport 5353 -j DROP
-A INPUT -s 66.228.32.0/19 -p udp --dport 1024:65535 -j ACCEPT

I don't play many video games any more, and I certainly don't consider myself a gamer. If I have time and brain power, I like to write code or work on my PhD; if I don't have brain power I read, watch movies or TV. However last Summer, lured by the launch titles Super Mario Odyssey and The Legend of Zelda: Breath of the Wild, I bought a Nintendo Switch. I've actually played some games on it now, although I surprised myself by playing lesser-known and indie titles rather than the AAA names. My favourite games are ones I can pick up and play for 5-10 minutes at a time without losing time to tutorials, introductory videos, and other such nonsense. I thought I'd recommend some games. First up, Virtua Racing. I actually bought this for the office Switch before I had my own. It's re-release of the 1992 arcade racer. I have fond memories of Arcades in the 90s (although I don't think I played this game). It's conceptually simple: three tracks, few options (you can choose manual or automatic transmission). But there's some hidden depth in there: it models slipstream, tyre wear and other effects. The fun of it for me is trying to beat my personal best and that of my colleagues. But I haven't actually placed above 3^rd on the intermediate course or even finished the advanced one, so despite its simplicity, there's plenty of mileage in it for me. It also looks great, rending at a smooth 60fps. The large untextured polygons were once a design decision due to the limitations of the hardware in 1992 and are now an in-fashion aesthetic.

A new release 0.4.17 of RProtoBuf is now on CRAN. RProtoBuf provides R with bindings for the Google Protocol Buffers ( ProtoBuf ) data encoding and serialization library used and released by Google, and deployed very widely in numerous projects as a language and operating-system agnostic protocol. This release contains small polishes related to the release 0.4.16 which added JSON support for messages, and switched to ByteSizeLong. This release now makes sure JSON functionality is only tested where available (on version 3 of the Protocol Buffers library), and that ByteSizeLong is only called where available (version 3.6.0 or later). Of course, older versions build as before and remain fully supported.

Changes in RProtoBuf version 0.4.17 (2020-03-xx)

• Condition use of ByteSizeLong() on building with ProtoBuf 3.6.0 or later (Dirk in #71 fixing #70).
• The JSON unit tests are skipped if ProtoBuf 2.* is used (Dirk, also #71).
• The configure script now extracts the version from the DESCRIPTION file ( (Dirk, also #71).

CRANberries provides the usual diff to the previous release. The RProtoBuf page has copies of the (older) package vignette, the quick overview vignette, and the pre-print of our JSS paper. Questions, comments etc should go to the GitHub issue tracker off the GitHub repo. If you like this or other open-source work I do, you can now sponsor me at GitHub. For the first year, GitHub will match your contributions.

This post by Dirk Eddelbuettel originated on his Thinking inside the box blog. Please report excessive re-aggregation in third-party for-profit settings.

Assume for a minute that that best way to take notes is on paper with pens, pencils etc., and not in a digital device. (I might return to this later). I'm torn between two extremes for note-taking. One one hand, I find it useful in the short-term to make scrappy, ephemeral notes: ad-hoc daily TODO lists; mind maps and experiments, that I intend to throw away. There are lots of styles of stationary to support this: ring-bound notebooks that are easy to tear leaves from; or literally the back of envelopes. The other extreme is the "preserve everything" mentality. For my PhD, I have a single, hard-backed notebook that I try to do all my PhD note taking in. I date each entry. There's a history I can refer to, no matter whether what I'm writing is seemingly ephemeral or not. So I do both. Sometimes I want to refer back to something I did which was ephemeral and I've lost it or thrown it away. And having lots of mis-matched stationary for ephemeral storage is a bit messy, and works against the other extreme to a certain extent. I've started to wonder whether strictly doing one or the other (and most likely, the "preserve everything" approach) might be a good idea. In practise that would mean settling on a particular notebook format, and disposing of anything else; having separate notebooks by topics (PhD, work, ) with a "catch-all" for the rest. Does anyone have any advice or useful resources to read on this topic?

I just took my dog for a nice long walk. It s the last walk we ll be taking for the next 3 weeks, he already starts moping around if we just skip one day of walking, so I m going to have to get creative keeping him entertained. My entire country is going on lockdown starting at midnight. People won t be allowed to leave their homes unless it s for medical emergencies, to buy food or if their work has been deemed essential.

• 

• 

• 

Due to the Covid-19 epidemic nearing half a million confirmed infections, this has become quite common in the world right now, with about a quarter of the world s population currently under lockdown and confined to their homes. Some people may have noticed I ve been a bit absent recently, I ve been going through some really rough personal stuff. I m dealing with it and I ll be ok, but please practice some patience with me in the immediate future if you re waiting on anything. I have a lot of things going on in Debian right now. It helps keeping me busy through all the turmoil and gives me something positive to focus on. I m running for Debian Project Leader (DPL), I haven t been able to put in quite the energy into my campaign that I would have liked, but I think it s going ok under the circumstances. I think because of everything happening in the world it s been more difficult for other Debianites to participate in debian-vote discussions as well. Recently we also announced Debian Social, a project that s still in its early phases, but we ve been trying to get it going for about 2 years, so it s nice to finally see it shaping up. There s also plans to put Debian Social and some additional tooling to the test, with the idea to host a MiniDebConf entirely online. No dates have been confirmed yet, we still have a lot of crucial bits to figure out, but you can subscribe to debian-devel-announce and Debian micronews for updates as soon as more information is available. To everyone out there, stay safe, keep your physical distance for now and don t lose hope, things will get better again.

I recently stumbled upon chafa, a tool to display pictures, especially color pictures on your ANSI text terminal, e.g. inside an xterm. And I occasionally use aha, the Ansi HTML Adapter to convert a colorful terminal content into HTML to show off terminal screenshots without the requirement of a picture so that it also works in e.g. text browsers or for blinds. Combining chafa and aha: Examples A moment ago I had the thought what would happen if I feed the output of chafa into aha and expected nothing really usable. But I was surprised by the quality of the outcome. looks like this after chafa -w 9 -c full -s 160x50 DSCN4692.jpg aha -n:

Checking the Look in Text Browsers It even looks not that bad in elinks as far as I know the only text browser which supports CSS and styles: In Lynx and Links 2, the text composing the image is displayed only in black and white, but you at least can recognise the edges in the picture: Same Functionality in One Tool? I knew there was a tool which did this in one step. Seems to have been png2html. Tried to play around with it, too, but neither really understood how to use it (seems to require a text file for the characters to be used why?) nor did I really got it working. It always ran until I aborted it and it never filled the target file with any content. Additionally, png2html insists on one character per pixel, requiring to first properly resize the image before converting to HTML. The Keyboard in the Pictures Oh, and btw., the displayed keyboard is my Zlant. The Zlant is a 40% uniform staggered mechanical keyboard. Currently, only Zlant PCBs are available at 1UP Keyboards (USA), i.e. no complete kits. It is shown with the SA Vilebloom key cap set, currently available at MechSupply (UK).