Planet Debian

This post is a review for Computing Reviews for 50 years of queries , a article published in Communications of the ACM

The relational model is probably the one innovation that brought computers to the mainstream for business users. This article by Donald Chamberlin, creator of one of the first query languages (that evolved into the ubiquitous SQL), presents its history as a commemoration of the 50th anniversary of his publication of said query language.

The article begins by giving background on information processing before the advent of today’s database management systems: with systems storing and processing information based on sequential-only magnetic tapes in the 1950s, adopting a record-based, fixed-format filing system was far from natural. The late 1960s and early 1970s saw many fundamental advances, among which one of the best known is E. F. Codd’s relational model. The first five pages (out of 12) present the evolution of the data management community up to the 1974 SIGFIDET conference. This conference was so important in the eyes of the author that, in his words, it is the event that “starts the clock” on 50 years of relational databases.

The second part of the article tells about the growth of the structured English query language (SEQUEL)– eventually renamed SQL–including the importance of its standardization and its presence in commercial products as the dominant database language since the late 1970s. Chamberlin presents short histories of the various implementations, many of which remain dominant names today, that is, Oracle, Informix, and DB2. Entering the 1990s, open-source communities introduced MySQL, PostgreSQL, and SQLite.

The final part of the article presents controversies and criticisms related to SQL and the relational database model as a whole. Chamberlin presents the main points of controversy throughout the years: 1) the SQL language lacks orthogonality; 2) SQL tables, unlike formal relations, might contain null values; and 3) SQL tables, unlike formal relations, may contain duplicate rows. He explains the issues and tradeoffs that guided the language design as it unfolded. Finally, a section presents several points that explain how SQL and the relational model have remained, for 50 years, a “winning concept,” as well as some thoughts regarding the NoSQL movement that gained traction in the 2010s.

This article is written with clear language and structure, making it easy and pleasant to read. It does not drive a technical point, but instead is a recap on half a century of developments in one of the fields most important to the commercial development of computing, written by one of the greatest authorities on the topic.

Another one of the ASN list. This turned out longer than I expected (which is good). If you want to briefly understand what is an ASN, my Personal ASNs From India post carries an introduction to it.

Now, here’re the Educational and Research Institutions with their own ASN in India, which I could find:

• AS2697 Education and Research Network
• AS9885 NKN Internet Gateway
• AS23770 Tata Institute of Fundamental Research (used as National Centre for Biological Sciences network)
• AS38021 Network of Indian Institute of Foreign Trade
• AS38620 National Knowledge Network
• AS38872 Indian School of Business
• AS45340 B.M.S College of Engineering
• AS55296 National Institute of Public Finance and Policy
• AS55479 Indian Institute of Technology, Kanpur
• AS55566 Inter University Centre for Astronomy and Astrophysics
• AS55824 NKN Core Network
• AS56056 AMITY-IN
• AS55847 NKN Edge Network
• AS58703 Amrita Vishwa Vidyapeetham
• AS58758 Tata Institute of Fundamental Research (used as Homi Bhabha Centre for Science Education (HBCSE) network)
• AS59163 GLA University
• AS59193 Indian Institute of Technology, Hyderabad
• AS131226 Indian Institute of Technology, Roorkee
• AS131473 SRM University
• AS132423 Indian Institute of Technology, Bombay
• AS132524 Tata Institute of Fundamental Research (used as main campus network)
• AS132749 Indraprastha Institute of Information Technology, Delhi
• AS132780 Indian Institute of Technology, Delhi
• AS132984 Uka Tarsadia University
• AS132785 Shiv Nadar Institution of Eminence Deemed to be University
• AS132995 South Asian University
• AS133002 Indian Institute of Tropical Meteorology
• AS133233 S.N. Bose National Centre for Basic Sciences
• AS133273 Tata Institute of Social Sciences
• AS133308 Indira Gandhi Centre For Atomic Research
• AS133313 Saha Institute of Nuclear Physics
• AS133552 B.M.S. College of Engineering
• AS133723 Institute for Plasma Research
• AS134003 Centre For Cellular And Molecular Platforms
• AS134023 Aligarh Muslim University
• AS134322 Tata Institute of Fundamental Research (used as International Centre for Theoretical Sciences (ICTS) network)
• AS134901 Indian Institute of Science Education And Research
• AS134934 Institute For Stem Cell Biology And Regenerative Medicine
• AS135730 Datta Meghe Institute Of Medical Sciences
• AS135734 Birla Institute of Technology And Science
• AS135835 Sardar Vallabhbhai Patel National Police Academy
• AS136005 Raman Research Institute
• AS136304 Institute of Physics, Bhubaneswar
• AS136470 B.M.S. College of Engineering
• AS136702 Physical Research Laboratory
• AS137136 Indian Agricultural Statistics Research Institute
• AS137282 Kalinga Institute of Industrial Technology
• AS137617 Indian Institute of Management, Ahmedabad
• AS137956 Indian Institute of Technology, Ropar
• AS138155 Jawaharlal Nehru University
• AS138231 Indian Institute of Information Technology, Allahabad
• AS140033 Indian Institute of Technology, Bhilai
• AS140118 Indian Institute of Technology Banaras Hindu University
• AS140192 Indian Institute of Information Technology and Management, Kerala
• AS140200 Panjab University
• AS141270 Indian Institute Of Technology, Indore
• AS141340 Indian Institute Of Technology, Madras
• AS141477 Indira Gandhi National Open University
• AS141478 Director National Institute Of Technology, Calicut
• AS141288 National Institute of Science Education And Research Bhubaneswar
• AS141507 National Institute of Mental Health And Neurosciences
• AS142493 Sri Ramachandra Institute Of Higher Education And Research
• AS147239 Lal Bahadur Shastri National Academy of Administration (LBSNAA)
• AS147258 Dayalbagh Educational Institute
• AS149607 National Forensic Sciences University
• AS151086 Amrita Vishwa Vidyapeetham
• AS152533 National Institute of Technology, Karnataka

Special Mentions

• AS132926 Allen Career Institute
• AS141841 Indian Institute of Hardware Technology Limited

Some observations:

• Only 14 (out of 67) networks have/announce IPv6 prefixes.
• Two networks have IX presence; AS132785 Shiv Nadar at Extreme IX Delhi and AS56056 Amity at DE-CIX Delhi.
• TIFR as an organization has 4 ASNs (AS23770, AS58758, AS132524 and AS134322), BMS College of Engineering has 3 (AS45340, AS133552 and AS136470) and Amrita Vishwa Vidyapeetham has 2 (AS58703 and AS151086).
• AS2697, AS9885, AS38620, AS55824 and AS55847 ie Education and Research Network (ERNET) and National Knowledge Network (NKN) form the Indian NREN.
• 43 network have NKN as their upstream, while BSNL comes second as upstream for 21.

Let me know if I’m missing someone.

Note

These steps may not work on your system if you are using the default Debian installation. This guide assumes that your system is using systemd-boot as the bootloader, which is explained in the post linked below.

• Install Debian from grml-liveboot

A unified kernel image (UKI) is a single executable that can be booted directly from UEFI firmware or automatically sourced by bootloaders with little or no configuration. It combines a UEFI boot stub program like systemd-stub(7), a Linux kernel image, an initrd, and additional resources into a single UEFI PE file.

systemd-boot already provides a hook for kernel installation via /etc/kernel/postinst.d/zz-systemd-boot. We just need a couple of additional configurations to generate the UKI image.

Installation and Configuration

1. Install the systemd-ukify package:

   sudo apt-get install systemd-ukify

2. Create the following configuration in /etc/kernel/install.conf:

   layout=uki initrd_generator=dracut uki_generator=ukify

   This configuration specifies how to generate the UKI image for the installed kernel and which generator to use.

3. Define the kernel command line for the UKI image. Create /etc/kernel/uki.conf with the following content:

   [UKI] Cmdline=@/etc/kernel/cmdline

Generating the UKI Image

To apply these changes, regenerate the UKI image for the currently running kernel:

sudo dpkg-reconfigure linux-image-$(uname -r) Verification

Use the bootctl list command to verify the presence of a "Type #2" entry for the current kernel. The output should look similar to this:

bootctl list type: Boot Loader Specification Type #2 (.efi) title: Debian GNU/Linux trixie/sid (2d0080583f1a4127ac0b073b1a9d3e61-6.10.9-amd64.efi) (default) (selected) id: 2d0080583f1a4127ac0b073b1a9d3e61-6.10.9-amd64.efi source: /boot/efi/EFI/Linux/2d0080583f1a4127ac0b073b1a9d3e61-6.10.9-amd64.efi sort-key: debian linux: /boot/efi/EFI/Linux/2d0080583f1a4127ac0b073b1a9d3e61-6.10.9-amd64.efi options: systemd.gpt_auto=no quiet root=LABEL=root_disk ro systemd.machine_id=2d0080583f1a4127ac0b073b1a9d3e61 type: Boot Loader Specification Type #2 (.efi) title: Debian GNU/Linux trixie/sid (2d0080583f1a4127ac0b073b1a9d3e61-6.10.7-amd64.efi) id: 2d0080583f1a4127ac0b073b1a9d3e61-6.10.7-amd64.efi source: /boot/efi/EFI/Linux/2d0080583f1a4127ac0b073b1a9d3e61-6.10.7-amd64.efi sort-key: debian linux: /boot/efi/EFI/Linux/2d0080583f1a4127ac0b073b1a9d3e61-6.10.7-amd64.efi options: systemd.gpt_auto=no quiet root=LABEL=root_disk ro systemd.machine_id=2d0080583f1a4127ac0b073b1a9d3e61 type: Automatic title: Reboot Into Firmware Interface id: auto-reboot-to-firmware-setup source: /sys/firmware/efi/efivars/LoaderEntries-4a67b082-0a4c-41cf-b6c7-440b29bb8c4f Cleanup and Reboot

Once the "Type #2" entries are generated, remove any "Type #1" entries using the bootctl unlink command. After this, reboot your system to boot from the UKI-based image.

Future Considerations

The primary use case for a UKI image is secure boot. Signing the UKI image can also be configured in the settings above, but this guide does not cover that process as it requires setting up secure boot on your system.

Version 0.3.15 of the Rblpapi package arrived on CRAN today. Rblpapi provides a direct interface between R and the Bloomberg Terminal via the C++ API provided by Bloomberg (but note that a valid Bloomberg license and installation is required).

This is the fifteenth release since the package first appeared on CRAN in 2016. This release updates to the current version 3.24.6 of the Bloomberg API, and rounds out a few corners in the packaging from continuous integration to the vignette.

The detailed list of changes follow below.

Changes in Rblpapi version 0.3.15 (2024-09-18)

• A warning is now issued if more than 1000 results are returned (John in #377 addressing #375)

• A few typos in the rblpapi-intro vignette were corrected (Michael Streatfield in #378)

• The continuous integration setup was updated (Dirk in #388)

• Deprecation warnings over char* where C++ class Name is now preferred have been addressed (Dirk in #391)

• Several package files have been updated (Dirk in #392)

• The request formation has been corrected, and an example was added (Dirk and John in #394 and #396)

• The Bloomberg API has been upgraded to release 3.24.6.1 (Dirk in #397)

Courtesy of my CRANberries, there is also a diffstat report for the this release. As always, more detailed information is at the Rblpapi repo or the Rblpapi page. Questions, comments etc should go to the issue tickets system at the GitHub repo.

If you like this or other open-source work I do, you can sponsor me at GitHub.

This post by Dirk Eddelbuettel originated on his Thinking inside the box blog. Please report excessive re-aggregation in third-party for-profit settings.

A legit email went to spam. Here are the redacted, relevant headers:

[redacted] X-Spam-Flag: YES X-Spam-Level: ****** X-Spam-Status: Yes, score=6.3 required=5.0 tests=DKIM_SIGNED,DKIM_VALID, [redacted] * 1.0 RCVD_IN_XBL RBL: Received via a relay in Spamhaus XBL * [185.220.101.64 listed in xxxxxxxxxxxxx.zen.dq.spamhaus.net] * 3.0 RCVD_IN_SBL_CSS Received via a relay in Spamhaus SBL-CSS * 2.5 RCVD_IN_AUTHBL Received via a relay in Spamhaus AuthBL * 0.0 RCVD_IN_PBL Received via a relay in Spamhaus PBL [redacted] [very first received line follows...] Received: from [10.137.0.13] ([185.220.101.64]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-378956d2ee6sm12487760f8f.83.2024.09.11.15.05.52 for <xxxxx@mayfirst.org> (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Wed, 11 Sep 2024 15:05:53 -0700 (PDT)

At first I though a Gmail IP address was listed in spamhaus - I even opened a ticket. But then I realized it wasn’t the last hop that Spamaus is complaining about, it’s the first hop, specifically the ip 185.220.101.64 which appears to be a Tor exit node.

The sender is using their own client to relay email directly to Gmail. Like any sane person, they don’t trust Gmail to protect their privacy, so they are sending via Tor. But WTF, Gmail is not stripping the sending IP address from the header.

I’m a big fan of harm reduction and have always considered using your own client to relay email with Gmail as a nice way to avoid some of the surveillance tax Google imposes.

However, it seems that if you pursue this option you have two unpleasant choices:

• Embed your IP address in every email message or
• Use Tor and have your email messages go to spam

I supposed you could also use a VPN, but I doubt the IP reputation of most VPN exit nodes are going to be more reliable than Tor.

I realize that because I have several chairs, the phrase “my chair” is ambiguous. To reduce confusion, I will refer to the head of my academic department as “my office chair” going forward.

The debridement operation was a success: nothing bad grew afterwards. I was discharged after a couple of nights with crutches, instructions not to weight-bear, a remarkable, portable negative-pressure "Vac" pump that lived by my side, and some strong painkillers.

About two weeks later, I had a skin graft. The surgeon took some skin from my thigh and stitched it over the debridement wound. I was discharged same-day, again with the Vac pump, and again with instructions not to weight-bear, at least for a few days.

This time I only kept the Vac pump for a week, and after a dressing change (the first time I saw the graft), I was allowed to walk again. Doing so is strangely awkward, and sometimes a little painful. I have physio exercises to help me regain strength and understanding about what I can do.

The donor site remained bandaged for another week before I saw it. I was expecting a stitched cut, but the surgeons have removed the top few layers only, leaving what looks more like a graze or sun-burn. There are four smaller, tentative-looking marks adjacent, suggesting they got it right on the fifth attempt. I'm not sure but I think these will all fade away to near-invisibility with time, and they don't hurt at all.

I've now been off work for roughly 12 weeks, but I think I am returning very soon. I am looking forward to returning to some sense of normality. It's been an interesting experience. I thought about writing more about what I've gone through, in particular my experiences in Hospital, dealing with the bureaucracy and things falling "between the gaps". Hanif Kureishi has done a better job than I could. It's clear that the NHS is staffed by incredibly passionate people, but there are a lot of structural problems that interfere with care.

Review: The Book That Broke the World, by Mark Lawrence

Series: Library Trilogy #2 Publisher: Ace Copyright: 2024 ISBN: 0-593-43796-9 Format: Kindle Pages: 366

The Book That Broke the World is high fantasy and a direct sequel to The Book That Wouldn't Burn. You should not start here. In a delightful break from normal practice, the author provides a useful summary of the previous volume at the start of this book to jog your memory.

At the end of The Book That Wouldn't Burn, the characters were scattered and in various states of corporeality after some major revelations about the nature of the Library and the first appearance of the insectile Skeer. The Book That Wouldn't Burn picks up where it left off, and there is a lot more contact with the Skeer, but my guess that they would be the next viewpoint characters does not pan out. Instead, we get a new group and a new protagonist: Celcha, whose sees angels who come to visit her brother.

I have complaints, but before I launch into those, I should say that I liked this book apart from the totally unnecessary cannibalism. (I'll get to that.) Livira is a bit sidelined, which is regrettable, but Celcha and her brother are interesting new characters, and both Arpix and Clovis, supporting characters in the first book, get some excellent character development. Similar to the first book, this is a puzzle box story full of world-building tidbits with intellectually-satisfying interactions. Lawrence elaborates and complicates his setting in ways that don't contradict earlier parts of the story but create more room and depth for the characters to be creative. I came away still invested in this world and eager to find out how Lawrence pulls the world-building and narrative threads together.

The biggest drawback of this book is that it's not new. My thought after finishing the first book of the series was that if Lawrence had enough world-building ideas to fill three books to that same level of density, this had the potential of being one of my favorite fantasy series of all time. By the end of the second book, I concluded that this is not the case. Instead of showing us new twists and complications the way the first book did throughout, The Book That Broke the World mostly covers the same thematic ground from some new angles. It felt like Lawrence was worried the reader of the first book may not have understood the theme or the world-building, so he spent most of the second book nailing down anything that moved.

I found that frustrating. One of the best parts of The Book That Wouldn't Burn was that Lawrence trusted the reader to keep up, which for me hit the glorious but rare sweet spot of pacing where I was figuring out the world at roughly the same pace as the characters. It surprised me in some very enjoyable ways. The Book That Broke the World did not surprise me. There are a few new things, which I enjoyed, and a few elaborations and developments of ideas, which I mostly enjoyed, but I saw the big plot twist coming at least fifty pages before it happened and found the aftermath more annoying than revelatory. It doesn't help that the plot rests on character misunderstandings, one of my least favorite tropes.

One of the other disappointments of this book is that the characters stop using the Library as a library. The Library at the center of this series is a truly marvelous piece of world-building with numerous fascinating features that are unrelated to its contents, but Livira used it first and foremost as a repository of books. The first book was full of characters solving problems by finding a relevant book and reading it.

In The Book That Broke the World, sadly, this is mostly gone. The Library is mostly reduced to a complicated Big Dumb Object setting. It's still a delightful bit of world-building, and we learn about a few new features, but I only remember two places where the actual books are important to the story. Even the book referenced in the title is mostly important as an artifact with properties unrelated to the words that it contains or to the act of reading it. I think this is a huge lost opportunity and something I hope Lawrence fixes in the last book of the trilogy.

This book instead focuses on the politics around the existence of the Library itself. Here I'm cautiously optimistic, although a lot is going to depend on the third book. Lawrence has set up a three-sided argument between groups that I will uncharitably describe as the libertarian techbros, the "burn it all down" reactionaries, and the neoliberal centrist technocrats. All three of those positions suck, and Lawrence had better be setting the stage for Livira to find a different path. Her unwillingness to commit to any of those sides gives me hope, but bringing this plot to a satisfying conclusion is going to be tricky. I hope I like what Lawrence comes up with, but it feels far from certain.

It doesn't help that he's started delivering some points with a sledgehammer, and that's where we get to the unnecessary cannibalism. Thankfully this is a fairly small part of the tail end of the book, but it was an unpleasant surprise that I did not want in this novel and that I don't think made the story any better.

It's tempting to call the cannibalism gratuitous, but it does fit one of the main themes of this story, namely that humans are depressingly good at using any rule-based object in unexpected and nasty ways that are contrary to the best intentions of the designer. This is the fundamental challenge of the Library as a whole and the question that I suspect the third book will be devoted to addressing, so I understand why Lawrence wanted to emphasize his point. The reason why there is cannibalism here is directly related to a profound misunderstanding of the properties of the library, and I detected an echo of one of C.S. Lewis's arguments in The Last Battle about the nature of Hell.

The problem, though, is that this is Satanic baby-killerism, to borrow a term from Fred Clark. There are numerous ways to show this type of perversion of well-intended systems, which I know because Lawrence used other ones in the first book that were more subtle but equally effective. One of the best parts of The Book That Wouldn't Burn is that there were few real villains. The conflict was structural, all sides had valid perspectives, and the ethical points of that story were made with some care and nuance.

The problem with cannibalism as it's used here is not merely that it's gross and disgusting and off-putting to the reader, although it is all of those things. If I wanted to read horror, I would read horror novels. I don't appreciate surprise horror used for shock value in regular fantasy. But worse, it's an abandonment of moral nuance. The function of cannibalism in this story is like the function of Satanic baby-killers: it's to signal that these people are wholly and irredeemably evil. They are the Villains, they are Wrong, and they cease to be characters and become symbols of what the protagonists are fighting. This is destructive to the story because it's designed to provoke a visceral short-circuit in the reader and let the author get away with sloppy story-telling. If the author needs to use tactics like this to point out who is the villain, they have failed to set up their moral quandary properly.

The worst part is that this was entirely unnecessary because Lawrence's story-telling wasn't sloppy and he set up his moral quandary just fine. No one was confused about the ethical point here. I as the reader was following without difficulty, and had appreciated the subtlety with which Lawrence posed the question. But apparently he thought he was too subtle and decided to come back to the point with a pile-driver. I think that seriously injured the story. The ethical argument here is much more engaging and thought-provoking when it's more finely balanced.

That's a lot of complaints, mostly because this is a good book that I badly wanted to be a great book but which kept tripping over its own feet. A lot of trilogies have weak second books. Hopefully this is another example of the mid-story sag, and the finale will be worthy of the start of the story. But I have to admit the moral short-circuiting and the de-emphasis of the actual books in the library has me a bit nervous. I want a lot out of the third book, and I hope I'm not asking this author for too much.

If you liked the first book, I think you'll like this one too, with the caveat that it's quite a bit darker and more violent in places, even apart from the surprise cannibalism. But if you've not started this series, you may want to wait for the third book to see if Lawrence can pull off the ending.

Followed by The Book That Held Her Heart, currently scheduled for publication in April of 2025.

Rating: 7 out of 10

A minor update 0.3.10 for our nanotime package is now on CRAN. nanotime relies on the RcppCCTZ package (as well as the RcppDate package for additional C++ operations) and offers efficient high(er) resolution time parsing and formatting up to nanosecond resolution, using the bit64 package for the actual integer64 arithmetic. Initially implemented using the S3 system, it has benefitted greatly from a rigorous refactoring by Leonardo who not only rejigged nanotime internals in S4 but also added new S4 types for periods, intervals and durations.

This release updates one S4 methods to very recent changes in r-devel for which CRAN had reached out. This concerns the setdiff() method when applied to two nanotime objects. As it only affected R 4.5.0, due next April, if rebuilt in the last two or so weeks it will not have been visible to that many users, if any. In any event, it now works again for that setup too, and should be going forward.

We also retired one demo function from the very early days, apparently it relied on ggplot2 features that have since moved on. If someone would like to help out and resurrect the demo, please get in touch. We also cleaned out some no longer used tests, and updated DESCRIPTION to what is required now. The NEWS snippet below has the full details.

Changes in version 0.3.10 (2024-09-16)

• Retire several checks for Solaris in test suite (Dirk in #130)

• Switch to Authors@R in DESCRIPTION as now required by CRAN

• Accommodate R-devel change for setdiff (Dirk in #133 fixing #132)

• No longer ship defunction ggplot2 demo (Dirk fixing #131)

Thanks to my CRANberries, there is a diffstat report for this release. More details and examples are at the nanotime page; code, issue tickets etc at the GitHub repository – and all documentation is provided at the nanotime documentation site.

If you like this or other open-source work I do, you can sponsor me at GitHub.

This post by Dirk Eddelbuettel originated on his Thinking inside the box blog. Please report excessive re-aggregation in third-party for-profit settings.

Review: The Wings Upon Her Back, by Samantha Mills

Publisher: Tachyon Copyright: 2024 ISBN: 1-61696-415-4 Format: Kindle Pages: 394

The Wings Upon Her Back is a political steampunk science fantasy novel. If the author's name sounds familiar, it may be because Samantha Mills's short story "Rabbit Test" won Nebula, Locus, Hugo, and Sturgeon awards. This is her first novel.

Winged Zemolai is a soldier of the mecha god and the protege of Mecha Vodaya, the Voice. She has served the city-state of Radezhda by defending it against all enemies, foreign and domestic, for twenty-six years. Despite that, it takes only a moment of errant mercy for her entire life to come crashing down. On a whim, she spares a kitchen worker who was concealing a statue of the scholar god, meaning that he was only pretending to worship the worker god like all workers should. Vodaya is unforgiving and uncompromising, as is the sleeping mecha god. Zemolai's wings are ripped from her back and crushed in the hand of the god, and she's left on the ground to die of mechalin withdrawal.

The Wings Upon Her Back is told in two alternating timelines. The main one follows Zemolai after her exile as she is rescued by a young group of revolutionaries who think she may be useful in their plans. The other thread starts with Zemolai's childhood and shows the reader how she became Winged Zemolai: her scholar family, her obsession with flying, her true devotion to the mecha god, and the critical early years when she became Vodaya's protege. Mills maintains the separate timelines through the book and wraps them up in a rather neat piece of symbolic parallelism in the epilogue.

I picked up this book on a recommendation from C.L. Clark, and yes, indeed, I can see why she liked this book. It's a story about a political awakening, in which Zemolai slowly realizes that she has been manipulated and lied to and that she may, in fact, be one of the baddies. The Wings Upon Her Back is more personal than some other books with that theme, since Zemolai was specifically (and abusively) groomed for her role by Vodaya. Much of the book is Zemolai trying to pull out the hooks that Vodaya put in her or, in the flashback timeline, the reader watching Vodaya install those hooks.

The flashback timeline is difficult reading. I don't think Mills could have left it out, but she says in the afterword that it was the hardest part of the book to write and it was also the hardest part of the book to read. It fills in some interesting bits of world-building and backstory, and Mills does a great job pacing the story revelations so that both threads contribute equally, but mostly it's a story of manipulative abuse. We know from the main storyline that Vodaya's tactics work, which gives those scenes the feel of a slow-motion train wreck. You know what's going to happen, you know it will be bad, and yet you can't look away.

It occurred to me while reading this that Emily Tesh's Some Desperate Glory told a similar type of story without the flashback structure, which eliminates the stifling feeling of inevitability. I don't think that would not have worked for this story. If you simply rearranged the chapters of The Wings Upon Her Back into a linear narrative, I would have bailed on the book. Watching Zemolai being manipulated would have been too depressing and awful for me to make it to the payoff without the forward-looking hope of the main timeline. It gave me new appreciation for the difficulty of what Tesh pulled off.

Mills uses this interwoven structure well, though. At about 90% through this book I had no idea how it could end in the space remaining, but it reaches a surprising and satisfying conclusion. Mills uses a type of ending that normally bothers me, but she does it by handling the psychological impact so well that I couldn't help but admire it. I'm avoiding specifics because I think it worked better when I wasn't expecting it, but it ties beautifully into the thematic point of the book.

I do have one structural objection, though. It's one of those problems I didn't notice while reading, but that started bothering me when I thought back through the story from a political lens. The Wings Upon Her Back is Zemolai's story, her redemption arc, and that means she drives the plot. The band of revolutionaries are great characters (particularly Galiana), but they're supporting characters. Zemolai is older, more experienced, and knows critical information they don't have, and she uses it to effectively take over. As setup for her character arc, I see why Mills did this. As political praxis, I have issues.

There is a tendency in politics to believe that political skill is portable and repurposable. Converting opposing operatives to the cause is welcomed not only because they indicate added support, but also because they can use their political skill to help you win instead. To an extent this is not wrong, and is probably the most true of combat skills (which Zemolai has in abundance). But there's an underlying assumption that politics is symmetric, and a critical reason why I hold many of the political positions that I do hold is that I don't think politics is symmetric.

If someone has been successfully stoking resentment and xenophobia in support of authoritarians, converts to an anti-authoritarian cause, and then produces propaganda stoking resentment and xenophobia against authoritarians, this is in some sense an improvement. But if one believes that resentment and xenophobia are inherently wrong, if one's politics are aimed at reducing the resentment and xenophobia in the world, then in a way this person has not truly converted. Worse, because this is an effective manipulation tactic, there is a strong tendency to put this type of political convert into a leadership position, where they will, intentionally or not, start turning the anti-authoritarian movement into a copy of the authoritarian movement they left. They haven't actually changed their politics because they haven't understood (or simply don't believe in) the fundamental asymmetry in the positions. It's the same criticism that I have of realpolitik: the ends do not justify the means because the means corrupt the ends.

Nothing that happens in this book is as egregious as my example, but the more I thought about the plot structure, the more it bothered me that Zemolai never listens to the revolutionaries she joins long enough to wrestle with why she became an agent of an authoritarian state and they didn't. They got something fundamentally right that she got wrong, and perhaps that should have been reflected in who got to make future decisions. Zemolai made very poor choices and yet continues to be the sole main character of the story, the one whose decisions and actions truly matter. Maybe being wrong about everything should be disqualifying for being the main character, at least for a while, even if you think you've understood why you were wrong.

That problem aside, I enjoyed this. Both timelines were compelling and quite difficult to put down, even when they got rather dark. I could have done with less body horror and a few fewer fight scenes, but I'm glad I read it.

Science fiction readers should be warned that the world-building, despite having an intricate and fascinating surface, is mostly vibes. I started the book wondering how people with giant metal wings on their back can literally fly, and thought the mentions of neural ports, high-tech materials, and immune-suppressing drugs might mean that we'd get some sort of explanation. We do not: heavier-than-air flight works because it looks really cool and serves some thematic purposes. There are enough hints of technology indistinguishable from magic that you could make up your own explanations if you wanted to, but that's not something this book is interested in. There's not a thing wrong with that, but don't get caught by surprise if you were in the mood for a neat scientific explanation of apparent magic.

Recommended if you like somewhat-harrowing character development with a heavy political lens and steampunk vibes, although it's not the sort of book that I'd press into the hands of everyone I know. The Wings Upon Her Back is a complete story in a single novel.

Content warning: the main character is a victim of physical and emotional abuse, so some of that is a lot. Also surgical gore, some torture, and genocide.

Rating: 7 out of 10

A new release 0.0.3 of the RcppFastAD package by James Yang and myself is now on CRAN.

RcppFastAD wraps the FastAD header-only C++ library by James which provides a C++ implementation of both forward and reverse mode of automatic differentiation. It offers an easy-to-use header library (which we wrapped here) that is both lightweight and performant. With a little of bit of Rcpp glue, it is also easy to use from R in simple C++ applications. This release turns compilation to the C++20 standard as newer clang++ versions complained about a particular statement (it took to be C++20) when compiled under C++17. So we obliged.

The NEWS file for these two initial releases follows.

Changes in version 0.0.3 (2024-09-15)

• The package now compiles under the C++20 standard to avoid a warning under clang++-18 (Dirk addressing #9)

• Minor updates to continuous integration and badges have been made as well

Courtesy of my CRANberries, there is also a diffstat report for the most recent release. More information is available at the repository or the package page.

If you like this or other open-source work I do, you can sponsor me at GitHub.

This post by Dirk Eddelbuettel originated on his Thinking inside the box blog. Please report excessive re-aggregation in third-party for-profit settings.

~$ mkdir moin-test ~$ cd moin-test ~/d/moin-test►python3 -m venv . 00:04 ~/d/moin-test►ls 2.119s 00:04 bin/ include/ lib/ lib64@ pyvenv.cfg ~/d/moin-test►source bin/activate.fish 00:04 ~/d/moin-test►pip install --pre moin moin-test 00:04 Collecting moin Using cached moin-2.0.0b1-py3-none-any.whl.metadata (4.7 kB) Collecting Babel>=2.10.0 (from moin) Using cached babel-2.16.0-py3-none-any.whl.metadata (1.5 kB) Collecting blinker>=1.6.2 (from moin) Using cached blinker-1.8.2-py3-none-any.whl.metadata (1.6 kB) Collecting docutils>=0.18.1 (from moin) Using cached docutils-0.21.2-py3-none-any.whl.metadata (2.8 kB) Collecting Markdown>=3.4.1 (from moin) Using cached Markdown-3.7-py3-none-any.whl.metadata (7.0 kB) Collecting mdx-wikilink-plus>=1.4.1 (from moin) Using cached mdx_wikilink_plus-1.4.1-py3-none-any.whl.metadata (6.6 kB) Collecting Flask>=3.0.0 (from moin) Using cached flask-3.0.3-py3-none-any.whl.metadata (3.2 kB) Collecting Flask-Babel>=3.0.0 (from moin) Using cached flask_babel-4.0.0-py3-none-any.whl.metadata (1.9 kB) Collecting Flask-Caching>=1.2.0 (from moin) Using cached Flask_Caching-2.3.0-py3-none-any.whl.metadata (2.2 kB) Collecting Flask-Theme>=0.3.6 (from moin) Using cached flask_theme-0.3.6-py3-none-any.whl Collecting emeraldtree>=0.10.0 (from moin) Using cached emeraldtree-0.11.0-py3-none-any.whl Collecting feedgen>=0.9.0 (from moin) Using cached feedgen-1.0.0-py2.py3-none-any.whl Collecting flatland>=0.8 (from moin) Using cached flatland-0.9.1-py3-none-any.whl Collecting Jinja2>=3.1.0 (from moin) Using cached jinja2-3.1.4-py3-none-any.whl.metadata (2.6 kB) Collecting markupsafe<=2.2.0 (from moin) Using cached MarkupSafe-2.1.5-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl.metadata (3.0 kB) Collecting pygments>=1.4 (from moin) Using cached pygments-2.18.0-py3-none-any.whl.metadata (2.5 kB) Collecting Werkzeug>=3.0.0 (from moin) Using cached werkzeug-3.0.4-py3-none-any.whl.metadata (3.7 kB) Collecting whoosh>=2.7.0 (from moin) Using cached Whoosh-2.7.4-py2.py3-none-any.whl.metadata (3.1 kB) Collecting pdfminer.six (from moin) Using cached pdfminer.six-20240706-py3-none-any.whl.metadata (4.1 kB) Collecting passlib>=1.6.0 (from moin) Using cached passlib-1.7.4-py2.py3-none-any.whl.metadata (1.7 kB) Collecting sqlalchemy>=2.0 (from moin) Using cached SQLAlchemy-2.0.34-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl.metadata (9.6 kB) Collecting XStatic>=0.0.2 (from moin) Using cached XStatic-1.0.3-py3-none-any.whl.metadata (1.4 kB) Collecting XStatic-Bootstrap==3.1.1.2 (from moin) Using cached XStatic_Bootstrap-3.1.1.2-py3-none-any.whl Collecting XStatic-Font-Awesome>=6.2.1.0 (from moin) Using cached XStatic_Font_Awesome-6.2.1.1-py3-none-any.whl.metadata (851 bytes) Collecting XStatic-CKEditor>=3.6.1.2 (from moin) Using cached XStatic_CKEditor-3.6.4.0-py3-none-any.whl Collecting XStatic-autosize (from moin) Using cached XStatic_autosize-1.17.2.1-py3-none-any.whl Collecting XStatic-jQuery>=1.8.2 (from moin) Using cached XStatic_jQuery-3.5.1.1-py3-none-any.whl Collecting XStatic-jQuery-File-Upload>=10.31.0 (from moin) Using cached XStatic_jQuery_File_Upload-10.31.0.1-py3-none-any.whl Collecting XStatic-svg-edit-moin>=2012.11.15.1 (from moin) Using cached XStatic_svg_edit_moin-2012.11.27.1-py3-none-any.whl Collecting XStatic-JQuery.TableSorter>=2.14.5.1 (from moin) Using cached XStatic_JQuery.TableSorter-2.14.5.2-py3-none-any.whl.metadata (846 bytes) Collecting XStatic-Pygments>=1.6.0.1 (from moin) Using cached XStatic_Pygments-2.9.0.1-py3-none-any.whl Collecting lxml (from feedgen>=0.9.0->moin) Using cached lxml-5.3.0-cp312-cp312-manylinux_2_28_x86_64.whl.metadata (3.8 kB) Collecting python-dateutil (from feedgen>=0.9.0->moin) Using cached python_dateutil-2.9.0.post0-py2.py3-none-any.whl.metadata (8.4 kB) Collecting itsdangerous>=2.1.2 (from Flask>=3.0.0->moin) Using cached itsdangerous-2.2.0-py3-none-any.whl.metadata (1.9 kB) Collecting click>=8.1.3 (from Flask>=3.0.0->moin) Using cached click-8.1.7-py3-none-any.whl.metadata (3.0 kB) Collecting pytz>=2022.7 (from Flask-Babel>=3.0.0->moin) Using cached pytz-2024.2-py2.py3-none-any.whl.metadata (22 kB) Collecting cachelib<0.10.0,>=0.9.0 (from Flask-Caching>=1.2.0->moin) Using cached cachelib-0.9.0-py3-none-any.whl.metadata (1.9 kB) Collecting typing-extensions>=4.6.0 (from sqlalchemy>=2.0->moin) Using cached typing_extensions-4.12.2-py3-none-any.whl.metadata (3.0 kB) Collecting greenlet!=0.4.17 (from sqlalchemy>=2.0->moin) Using cached greenlet-3.1.0-cp312-cp312-manylinux_2_24_x86_64.manylinux_2_28_x86_64.whl.metadata (3.8 kB) Collecting charset-normalizer>=2.0.0 (from pdfminer.six->moin) Using cached charset_normalizer-3.3.2-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl.metadata (33 kB) Collecting cryptography>=36.0.0 (from pdfminer.six->moin) Using cached cryptography-43.0.1-cp39-abi3-manylinux_2_28_x86_64.whl.metadata (5.4 kB) Collecting cffi>=1.12 (from cryptography>=36.0.0->pdfminer.six->moin) Using cached cffi-1.17.1-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl.metadata (1.5 kB) Collecting six>=1.5 (from python-dateutil->feedgen>=0.9.0->moin) Using cached six-1.16.0-py2.py3-none-any.whl.metadata (1.8 kB) Collecting pycparser (from cffi>=1.12->cryptography>=36.0.0->pdfminer.six->moin) Using cached pycparser-2.22-py3-none-any.whl.metadata (943 bytes) Using cached moin-2.0.0b1-py3-none-any.whl (1.7 MB) Using cached babel-2.16.0-py3-none-any.whl (9.6 MB) Using cached blinker-1.8.2-py3-none-any.whl (9.5 kB) Using cached docutils-0.21.2-py3-none-any.whl (587 kB) Using cached flask-3.0.3-py3-none-any.whl (101 kB) Using cached flask_babel-4.0.0-py3-none-any.whl (9.6 kB) Using cached Flask_Caching-2.3.0-py3-none-any.whl (28 kB) Using cached jinja2-3.1.4-py3-none-any.whl (133 kB) Using cached Markdown-3.7-py3-none-any.whl (106 kB) Using cached MarkupSafe-2.1.5-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl (28 kB) Using cached mdx_wikilink_plus-1.4.1-py3-none-any.whl (8.9 kB) Using cached passlib-1.7.4-py2.py3-none-any.whl (525 kB) Using cached pygments-2.18.0-py3-none-any.whl (1.2 MB) Using cached SQLAlchemy-2.0.34-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl (3.2 MB) Using cached werkzeug-3.0.4-py3-none-any.whl (227 kB) Using cached Whoosh-2.7.4-py2.py3-none-any.whl (468 kB) Using cached XStatic-1.0.3-py3-none-any.whl (4.4 kB) Using cached XStatic_Font_Awesome-6.2.1.1-py3-none-any.whl (6.5 MB) Using cached XStatic_JQuery.TableSorter-2.14.5.2-py3-none-any.whl (20 kB) Using cached pdfminer.six-20240706-py3-none-any.whl (5.6 MB) Using cached cachelib-0.9.0-py3-none-any.whl (15 kB) Using cached charset_normalizer-3.3.2-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl (141 kB) Using cached click-8.1.7-py3-none-any.whl (97 kB) Using cached cryptography-43.0.1-cp39-abi3-manylinux_2_28_x86_64.whl (4.0 MB) Using cached greenlet-3.1.0-cp312-cp312-manylinux_2_24_x86_64.manylinux_2_28_x86_64.whl (626 kB) Using cached itsdangerous-2.2.0-py3-none-any.whl (16 kB) Using cached pytz-2024.2-py2.py3-none-any.whl (508 kB) Using cached typing_extensions-4.12.2-py3-none-any.whl (37 kB) Using cached lxml-5.3.0-cp312-cp312-manylinux_2_28_x86_64.whl (4.9 MB) Using cached python_dateutil-2.9.0.post0-py2.py3-none-any.whl (229 kB) Using cached cffi-1.17.1-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl (479 kB) Using cached six-1.16.0-py2.py3-none-any.whl (11 kB) Using cached pycparser-2.22-py3-none-any.whl (117 kB) Installing collected packages: XStatic-svg-edit-moin, XStatic-Pygments, XStatic-JQuery.TableSorter, XStatic-jQuery-File-Upload, XStatic-jQuery, XStatic-Font-Awesome, XStatic-CKEditor, XStatic-Bootstrap, XStatic-autosize, XStatic, whoosh, pytz, passlib, typing-extensions, six, pygments, pycparser, markupsafe, Markdown, lxml, itsdangerous, greenlet, emeraldtree, docutils, click, charset-normalizer, cachelib, blinker, Babel, Werkzeug, sqlalchemy, python-dateutil, mdx-wikilink-plus, Jinja2, flatland, cffi, Flask, feedgen, cryptography, pdfminer.six, Flask-Theme, Flask-Caching, Flask-Babel, moin Successfully installed Babel-2.16.0 Flask-3.0.3 Flask-Babel-4.0.0 Flask-Caching-2.3.0 Flask-Theme-0.3.6 Jinja2-3.1.4 Markdown-3.7 Werkzeug-3.0.4 XStatic-1.0.3 XStatic-Bootstrap-3.1.1.2 XStatic-CKEditor-3.6.4.0 XStatic-Font-Awesome-6.2.1.1 XStatic-JQuery.TableSorter-2.14.5.2 XStatic-Pygments-2.9.0.1 XStatic-autosize-1.17.2.1 XStatic-jQuery-3.5.1.1 XStatic-jQuery-File-Upload-10.31.0.1 XStatic-svg-edit-moin-2012.11.27.1 blinker-1.8.2 cachelib-0.9.0 cffi-1.17.1 charset-normalizer-3.3.2 click-8.1.7 cryptography-43.0.1 docutils-0.21.2 emeraldtree-0.11.0 feedgen-1.0.0 flatland-0.9.1 greenlet-3.1.0 itsdangerous-2.2.0 lxml-5.3.0 markupsafe-2.1.5 mdx-wikilink-plus-1.4.1 moin-2.0.0b1 passlib-1.7.4 pdfminer.six-20240706 pycparser-2.22 pygments-2.18.0 python-dateutil-2.9.0.post0 pytz-2024.2 six-1.16.0 sqlalchemy-2.0.34 typing-extensions-4.12.2 whoosh-2.7.4 ~/d/moin-test[1]►pip install setuptools moin-test 0.241s 00:06 Collecting setuptools Using cached setuptools-75.0.0-py3-none-any.whl.metadata (6.9 kB) Using cached setuptools-75.0.0-py3-none-any.whl (1.2 MB) Installing collected packages: setuptools Successfully installed setuptools-75.0.0 ~/d/moin-test►moin create-instance --full moin-test 1.457s 00:06 2024-09-16 00:06:36,812 INFO moin.cli.maint.create_instance:76 Directory /home/raj/dev/moin-test already exists, using as wikiconfig dir. 2024-09-16 00:06:36,813 INFO moin.cli.maint.create_instance:93 Instance creation finished. 2024-09-16 00:06:37,303 INFO moin.cli.maint.create_instance:107 Build Instance started. 2024-09-16 00:06:37,304 INFO moin.cli.maint.index:51 Index creation started 2024-09-16 00:06:37,308 INFO moin.cli.maint.index:55 Index creation finished 2024-09-16 00:06:37,308 INFO moin.cli.maint.modify_item:166 Load help started Item loaded: Home Item loaded: docbook Item loaded: mediawiki Item loaded: OtherTextItems/Diff Item loaded: WikiDict Item loaded: moin Item loaded: moin/subitem Item loaded: html/SubItem Item loaded: moin/HighlighterList Item loaded: MoinWikiMacros/Icons Item loaded: InclusionForMoinWikiMacros Item loaded: TemplateSample Item loaded: MoinWikiMacros Item loaded: rst/subitem Item loaded: OtherTextItems/IRC Item loaded: rst Item loaded: creole/subitem Item loaded: Home/subitem Item loaded: OtherTextItems/CSV Item loaded: images Item loaded: Sibling Item loaded: html Item loaded: markdown Item loaded: creole Item loaded: OtherTextItems Item loaded: OtherTextItems/Python Item loaded: docbook/SubItem Item loaded: OtherTextItems/PlainText Item loaded: MoinWikiMacros/MonthCalendar Item loaded: markdown/Subitem Success: help namespace help-en loaded successfully with 30 items 2024-09-16 00:06:46,258 INFO moin.cli.maint.modify_item:166 Load help started Item loaded: video.mp4 Item loaded: archive.tar.gz Item loaded: audio.mp3 Item loaded: archive.zip Item loaded: logo.png Item loaded: cat.jpg Item loaded: logo.svg Success: help namespace help-common loaded successfully with 7 items 2024-09-16 00:06:49,685 INFO moin.cli.maint.modify_item:338 Load welcome page started 2024-09-16 00:06:49,801 INFO moin.cli.maint.modify_item:347 Load welcome finished 2024-09-16 00:06:49,801 INFO moin.cli.maint.index:124 Index optimization started 2024-09-16 00:06:51,383 INFO moin.cli.maint.index:126 Index optimization finished 2024-09-16 00:06:51,383 INFO moin.cli.maint.create_instance:114 Full instance setup finished. 2024-09-16 00:06:51,383 INFO moin.cli.maint.create_instance:115 You can now use "moin run" to start the builtin server. ~/d/moin-test►ls moin-test 15.295s 00:06 bin/ intermap.txt lib64@ wiki/ wikiconfig.py include/ lib/ pyvenv.cfg wiki_local/ ~/d/moin-test►MOINCFG=wikiconfig.py moin-test 00:07 fish: Unsupported use of &apos=&apos. In fish, please use &aposset MOINCFG wikiconfig.py&apos. ~/d/moin-test[123]►set MOINCFG wikiconfig.py moin-test 00:07 ~/d/moin-test[123]►moin account-create --name test --email test@test.tld --password test123 Password not acceptable: For a password a minimum length of 8 characters is required. 2024-09-16 00:08:19,106 WARNING moin.utils.clock:53 These timers have not been stopped: total ~/d/moin-test►moin account-create --name test --email test@test.tld --password this-is-a-password 2024-09-16 00:08:43,798 INFO moin.cli.account.create:49 User c3608cafec184bd6a7a1d69d83109ad0 [&apostest&apos] test@test.tld - created. 2024-09-16 00:08:43,798 WARNING moin.utils.clock:53 These timers have not been stopped: total ~/d/moin-test►moin run --host 0.0.0.0 --port 5000 --no-debugger --no-reload * Debug mode: off 2024-09-16 00:09:26,146 INFO werkzeug:97 WARNING: This is a development server. Do not use it in a production deployment. Use a production WSGI server instead. * Running on all addresses (0.0.0.0) * Running on http://127.0.0.1:5000 * Running on http://192.168.1.2:5000 2024-09-16 00:09:26,146 INFO werkzeug:97 Press CTRL+C to quit

I previously blogged about the difficulties in getting a good Wifi mesh network setup [1].

I bought the Kogan AX1800 Wifi6 Mesh with 3 nodes for $140, the price has now dropped to $130. It’s only Wifi 6 (not 6E which has the extra 6GHz frequency) because all the 6E ones were more expensive than I felt like paying.

I’ve got it running and it’s working really well. One of my laptops has a damaged wire connecting to it’s Wifi device which decreased the signal to a degree that I could usually only connect to wifi when in the computer room (and then walk with it to another room once connected). Now I can connect that laptop to wifi in any part of my home. I can now get decent wifi access in my car in front of my home which covers the important corner case of walking to my car and then immediately asking Google maps for directions. Previously my phone would be deciding whether to switch away from wifi due to poor signal and that would delay getting directions, now I get directions quickly on Google Maps.

I’ve done tests with the Speedtest.net Android app and now get speeds of about 52Mbit/17Mbit in all parts of my home which is limited only by the speed of my NBN connection (one of the many reasons for hating conservatives is giving us expensive slow Internet). As my main reason for buying the devices is for Internet access they have clearly met my reason for purchase and probably meet the requirements for most people as well. Getting that speed is not trivial, my neighbours have lots of Wifi APs and bandwidth is congested. My Kogan 4K Android TV now plays 4K Netflix without pausing even though it only supports 2.4GHz wifi, so having a wifi mesh node next to the TV seems to help it.

I did some tests with the Olive Tree FTP server on a Galaxy Note 9 phone running the stock Samsung Android and got over 10MByte (80Mbit) upload and 8Mbyte (64Mbit) download speeds. This might be limited by the Android app or might be limited by the older version of Android. But it still gives higher speeds than my home Internet connection and much higher speeds than I need from an Android device.

Running iperf on Linux laptops talking to a Linux workstation that’s wired to the main mesh node I get speeds of 27.5Mbit from an old laptop on 2.4GHz wifi, 398Mbit from a new Wifi5 laptop when near the main mesh node, and 91Mbit from the same laptop when at the far end of my home. So not as fast as I’d like but still acceptable speeds.

The claims about Wifi 6 vs Wifi 5 speeds are that 6 will be about 3* faster. That would be 20% faster than the Gigabit ethernet ports on the wifi nodes. So while 2.5Gbit ethernet on Wifi 6 APs would be a good feature to have it seems that it might provide a 20% benefit at some future time when I have laptops with Wifi 6. At this time all the devices with 2.5Gbit ethernet cost more than I wanted to pay so I’m happy with this. It will probably be quite a while before laptops with Wifi 6 are in the price range I feel like paying.

For Wifi 6E it seems that anything less than 2.5Gbit ethernet will be a significant bottleneck. But I expect that by the time I buy a Wifi 6E mesh they will all have 2.5Gbit ethernet as standard.

The configuration of this device was quite easy via the built in web pages, everything worked pretty much as I expected and I hardly had to look at the manual. The mesh nodes are supposed to connect to each other when you press hardware buttons but that didn’t work for me so I used the web admin page to tell them to connect which worked perfectly. The admin of this seemed to be about as good as it gets.

Conclusion

The performance of this mesh hardware is quite decent. I can’t know for sure if it’s good or bad because performance really depends on what interference there is. But using this means that for me the Internet connection is now the main bottleneck for all parts of my home and I think it’s quite likely that most people in Australia who buy it will find the same result.

So for everyone in Australia who doesn’t have fiber to their home this seems like an ideal set of mesh hardware. It’s cheap, easy to setup, has no cloud stuff to break your configuration, gives quite adequate speed, and generally just does the job.

• [1] https://etbe.coker.com.au/2024/08/24/wifi-6e-mesh/

Related posts:

1. Wifi 6E Mesh I am looking into getting a Wifi mesh network. The...
2. 2.5Gbit Ethernet I just decided to upgrade the core of my home...
3. USB-A vs USB-C USB-A is the original socket for USB at the PC...

I've a set of Alesis M1Active 330 USB on my desk to listen to music. They were relatively inexpensive (~100€), have USB and sound pretty good for their size/price.

They were also sitting on my desk unused for a while, because the left speaker didn't produce any sound. Well, almost any. If you'd move the volume knob long enough you might have found a position where the left speaker would work a bit, but it'd be quieter than the right one and stop working again after some time. Pretty unacceptable when you want to listen to music.

Given the right speaker was working just fine and the left would work a bit when the volume knob is moved, I was quite certain which part was to blame: the potentiometer.

So just open the right speaker (it contains all the logic boards, power supply, etc), take out the broken potentiometer, buy a new one, replace, done. Sounds easy?

Well, to open the speaker you gotta loosen 8 (!) screws on the back. At least it's not glued, right? Once the screws are removed you can pull out the back plate, which will bring the power supply, USB controller, sound amplifier and cables, lots of cables: two pairs of thick cables, one to each driver, one thin pair for the power switch and two sets of "WTF is this, I am not going to trace pinouts today", one with a 6 pin plug, one with a 5 pin one.

Unplug all of these! Yes, they are plugged, nice. Nope, still no friggin' idea how to get to the potentiometer. If you trace the "thin pair" and "WTF1" cables, you see they go inside a small wooden box structure. So we have to pull the thing from the front?

Okay, let's remove the plastic part of the knob Right, this looks like a potentiometer. Unscrew it. No, no need for a Makita wrench, I just didn't have anything else in the right size (10mm).

Still, no movement. Let's look again from the inside! Oh ffs, there are six more screws inside, holding the front. Away with them! Just need a very long PH1 screwdriver.

Now you can slowly remove the part of the front where the potentiometer is. Be careful, the top tweeter is mounted to the front, not the main case and so is the headphone jack, without an obvious way to detach it. But you can move away the front far enough to remove the small PCB with the potentiometer and the LED.

Great, this was the easy part!

The only thing printed on the potentiometer is "A10K". 10K is easy -- 10kOhm. A?! Wikipedia says "A" means "logarithmic", but only if made in the US or Asia. In Europe that'd be "linear". "B" in US/Asia means "linear", in Europe "logarithmic". Do I need to tap the sign again? (The sign is a print of XKCD#927.) My multimeter says in this case it's something like logarithmic. On the right channel anyway, the left one is more like a chopping board. And what's this green box at the end? Oh right, this thing also turns the power on and off. So it's a power switch.

Where the fuck do I get a logarithmic 10kOhm stereo potentiometer with a power switch? And then in the exact right size too?!

Of course not at any of the big German electronics pharmacies. But AliExpress saves the day, again. It's even the same color!

Soldering without pulling out the cable out of the case was a bit challenging, but I've managed it and now have stereo sound again. Yay!

PS: Don't operate this thing open to try it out. 230V are dangerous!

Armadillo is a powerful and expressive C++ template library for linear algebra and scientific computing. It aims towards a good balance between speed and ease of use, has a syntax deliberately close to Matlab, and is useful for algorithm development directly in C++, or quick conversion of research code into production environments. RcppArmadillo integrates this library with the R environment and language–and is widely used by (currently) 1164 other packages on CRAN, downloaded 36.1 million times (per the partial logs from the cloud mirrors of CRAN), and the CSDA paper (preprint / vignette) by Conrad and myself has been cited 595 times according to Google Scholar.

Conrad released two small incremental releases to version 14.0.0. We did not immediately bring these to CRAN as we have to be mindful of the desired upload cadence of ‘once every one or two months’. But as 14.0.2 has been stable for a few weeks, we now decided to bring it to CRAN. Changes since the last CRAN release are summarised below, and overall fairly minimal. On the package side, we reorder what citation() returns, and now follow CRAN requirements via Authors@R.

Changes in RcppArmadillo version 14.0.2-1 (2024-09-11)

• Upgraded to Armadillo release 14.0.2 (Stochastic Parrot)

  • Optionally use C++20 memory alignment

  • Minor corrections for several corner-cases

• The order of items displayed by citation() is reversed (Conrad in #449)

• The DESCRIPTION file now uses an Authors@R field with ORCID IDs

Courtesy of my CRANberries, there is a diffstat report relative to previous release. More detailed information is on the RcppArmadillo page. Questions, comments etc should go to the rcpp-devel mailing list off the Rcpp R-Forge page.

If you like this or other open-source work I do, you can sponsor me at GitHub.

This post by Dirk Eddelbuettel originated on his Thinking inside the box blog. Please report excessive re-aggregation in third-party for-profit settings.

I keep getting an error in our backup logs:

Sep 11 05:08:03 Warning: mysqldump: Error 2013: Lost connection to server during query when dumping table `1C4Uonkwhe_options` at row: 1402 Sep 11 05:08:03 Warning: Failed to dump mysql databases ic_wp

It’s a WordPress database having trouble dumping the options table.

The error log has a corresponding message:

Sep 11 13:50:11 mysql007 mariadbd[580]: 2024-09-11 13:50:11 69577 [Warning] Aborted connection 69577 to db: 'ic_wp' user: 'root' host: 'localhost' (Got an error writing communication packets)

The Internet is full of suggestions, almost all of which either focus on the network connection between the client and the server or the FEDERATED plugin. We aren’t using the federated plugin and this error happens when conneting via the socket.

Check it out - what is better than a consistently reproducible problem!

It happens if I try to select all the values in the table:

root@mysql007:~# mysql --protocol=socket -e 'select * from 1C4Uonkwhe_options' ic_wp > /dev/null ERROR 2013 (HY000) at line 1: Lost connection to server during query root@mysql007:~#

It happens when I specifiy one specific offset:

root@mysql007:~# mysql --protocol=socket -e 'select * from 1C4Uonkwhe_options limit 1 offset 1402' ic_wp ERROR 2013 (HY000) at line 1: Lost connection to server during query root@mysql007:~#

It happens if I specify the field name explicitly:

root@mysql007:~# mysql --protocol=socket -e 'select option_id,option_name,option_value,autoload from 1C4Uonkwhe_options limit 1 offset 1402' ic_wp ERROR 2013 (HY000) at line 1: Lost connection to server during query root@mysql007:~#

It doesn’t happen if I specify the key field:

root@mysql007:~# mysql --protocol=socket -e 'select option_id from 1C4Uonkwhe_options limit 1 offset 1402' ic_wp +-----------+ | option_id | +-----------+ | 16296351 | +-----------+ root@mysql007:~#

It does happen if I specify the value field:

root@mysql007:~# mysql --protocol=socket -e 'select option_value from 1C4Uonkwhe_options limit 1 offset 1402' ic_wp ERROR 2013 (HY000) at line 1: Lost connection to server during query root@mysql007:~#

It doesn’t happen if I query the specific row by key field:

root@mysql007:~# mysql --protocol=socket -e 'select * from 1C4Uonkwhe_options where option_id = 16296351' ic_wp +-----------+----------------------+--------------+----------+ | option_id | option_name | option_value | autoload | +-----------+----------------------+--------------+----------+ | 16296351 | z_taxonomy_image8905 | | yes | +-----------+----------------------+--------------+----------+ root@mysql007:~#

Hm. Surely there is some funky non-printing character in that option_value right?

root@mysql007:~# mysql --protocol=socket -e 'select CHAR_LENGTH(option_value) from 1C4Uonkwhe_options where option_id = 16296351' ic_wp +---------------------------+ | CHAR_LENGTH(option_value) | +---------------------------+ | 0 | +---------------------------+ root@mysql007:~# mysql --protocol=socket -e 'select HEX(option_value) from 1C4Uonkwhe_options where option_id = 16296351' ic_wp +-------------------+ | HEX(option_value) | +-------------------+ | | +-------------------+ root@mysql007:~#

Resetting the value to an empty value doesn’t make a difference:

root@mysql007:~# mysql --protocol=socket -e 'update 1C4Uonkwhe_options set option_value = "" where option_id = 16296351' ic_wp root@mysql007:~# mysql --protocol=socket -e 'select * from 1C4Uonkwhe_options' ic_wp > /dev/null ERROR 2013 (HY000) at line 1: Lost connection to server during query root@mysql007:~#

Deleting the row in question causes the error to specify a new offset:

root@mysql007:~# mysql --protocol=socket -e 'delete from 1C4Uonkwhe_options where option_id = 16296351' ic_wp root@mysql007:~# mysql --protocol=socket -e 'select * from 1C4Uonkwhe_options' ic_wp > /dev/null ERROR 2013 (HY000) at line 1: Lost connection to server during query root@mysql007:~# mysqldump ic_wp > /dev/null mysqldump: Error 2013: Lost connection to server during query when dumping table `1C4Uonkwhe_options` at row: 1401 root@mysql007:~#

If I put the record I deleted back in, we return to the old offset:

root@mysql007:~# mysql --protocol=socket -e 'insert into 1C4Uonkwhe_options VALUES(16296351,"z_taxonomy_image8905","","yes");' ic_wp root@mysql007:~# mysqldump ic_wp > /dev/null mysqldump: Error 2013: Lost connection to server during query when dumping table `1C4Uonkwhe_options` at row: 1402 root@mysql007:~#

I’m losing my little mind. Let’s get drastic and create a whole new table, copy over the data delicately working around the deadly offset:

oot@mysql007:~# mysql --protocol=socket -e 'create table 1C4Uonkwhe_new_options like 1C4Uonkwhe_options;' ic_wp root@mysql007:~# mysql --protocol=socket -e 'insert into 1C4Uonkwhe_new_options select * from 1C4Uonkwhe_options limit 1402 offset 0;' ic_wp --- There is only 33 more records, not sure how to specify unlimited limit but 100 does the trick. root@mysql007:~# mysql --protocol=socket -e 'insert into 1C4Uonkwhe_new_options select * from 1C4Uonkwhe_options limit 100 offset 1403;' ic_wp

Now let’s make sure all is working properly:

root@mysql007:~# mysql --protocol=socket -e 'select * from 1C4Uonkwhe_new_options' ic_wp >/dev/null;

Now let’s examine which row we are missing:

root@mysql007:~# mysql --protocol=socket -e 'select option_id from 1C4Uonkwhe_options where option_id not in (select option_id from 1C4Uonkwhe_new_options) ;' ic_wp +-----------+ | option_id | +-----------+ | 18405297 | +-----------+ root@mysql007:~#

Wait, what? I was expecting option_id 16296351.

Oh, now we are getting somewhere. And I see my mistake: when using offsets, you need to use ORDER BY or you won’t get consistent results.

root@mysql007:~# mysql --protocol=socket -e 'select option_id from 1C4Uonkwhe_options order by option_id limit 1 offset 1402' ic_wp ; +-----------+ | option_id | +-----------+ | 18405297 | +-----------+ root@mysql007:~#

Now that I have the correct row… what is in it:

root@mysql007:~# mysql --protocol=socket -e 'select * from 1C4Uonkwhe_options where option_id = 18405297' ic_wp ; ERROR 2013 (HY000) at line 1: Lost connection to server during query root@mysql007:~#

Well, that makes a lot more sense. Let’s start over with examining the value:

root@mysql007:~# mysql --protocol=socket -e 'select CHAR_LENGTH(option_value) from 1C4Uonkwhe_options where option_id = 18405297' ic_wp ; +---------------------------+ | CHAR_LENGTH(option_value) | +---------------------------+ | 50814767 | +---------------------------+ root@mysql007:~#

Wow, that’s a lot of characters. If it were a book, it would be 35,000 pages long (I just discovered this site). It’s a LONGTEXT field so it should be able to handle it. But now I have a better idea of what could be going wrong. The name of the option is “rewrite_rules” so it seems like something is going wrong with the generation of that option.

I imagine there is some tweak I can make to allow MariaDB to cough up the value (read_buffer_size? tmp_table_size?). But I’ll start with checking in with the database owner because I don’t think 35,000 pages of rewrite rules is appropriate for any site.

Version 0.0.18 of RcppSpdlog arrived on CRAN today and has been uploaded to Debian. RcppSpdlog bundles spdlog, a wonderful header-only C++ logging library with all the bells and whistles you would want that was written by Gabi Melman, and also includes fmt by Victor Zverovich. You can learn more at the nice package documention site.

This releases updates the code to the version 1.14.1 of spdlog which was released as an incremental fix to 1.14.0, and adds the ability to set log levels via the environment variable SPDLOG_LEVEL.

The NEWS entry for this release follows.

Changes in RcppSpdlog version 0.0.18 (2024-09-10)

• Upgraded to upstream release spdlog 1.14.1

• Minor packaging upgrades

• Allow logging levels to be set via environment variable SPDLOG_LEVEL

Courtesy of my CRANberries, there is also a diffstat report. More detailed information is on the RcppSpdlog page, or the package documention site. If you like this or other open-source work I do, you can sponsor me at GitHub.

This post by Dirk Eddelbuettel originated on his Thinking inside the box blog. Please report excessive re-aggregation in third-party for-profit settings.

Like each month, have a look at the work funded by Freexian’s Debian LTS offering.

Debian LTS contributors

In August, 16 contributors have been paid to work on Debian LTS, their reports are available:

• Adrian Bunk did 44.5h (out of 46.5h assigned and 53.5h from previous period), thus carrying over 55.5h to the next month.
• Bastien Roucariès did 20.0h (out of 20.0h assigned).
• Ben Hutchings did 9.0h (out of 0.0h assigned and 21.0h from previous period), thus carrying over 12.0h to the next month.
• Chris Lamb did 18.0h (out of 18.0h assigned).
• Daniel Leidert did 12.0h (out of 7.0h assigned and 5.0h from previous period).
• Emilio Pozuelo Monfort did 22.25h (out of 6.5h assigned and 53.5h from previous period), thus carrying over 37.75h to the next month.
• Guilhem Moulin did 17.5h (out of 8.75h assigned and 11.25h from previous period), thus carrying over 2.5h to the next month.
• Lee Garrett did 11.5h (out of 58.0h assigned and 2.0h from previous period), thus carrying over 48.5h to the next month.
• Markus Koschany did 40.0h (out of 40.0h assigned).
• Ola Lundqvist did 14.5h (out of 4.0h assigned and 20.0h from previous period), thus carrying over 9.5h to the next month.
• Roberto C. Sánchez did 8.25h (out of 5.0h assigned and 7.0h from previous period), thus carrying over 3.75h to the next month.
• Santiago Ruano Rincón did 21.5h (out of 11.5h assigned and 10.0h from previous period).
• Sean Whitton did 4.0h (out of 2.25h assigned and 3.75h from previous period), thus carrying over 2.0h to the next month.
• Sylvain Beucler did 42.0h (out of 46.0h assigned and 14.0h from previous period), thus carrying over 18.0h to the next month.
• Thorsten Alteholz did 11.0h (out of 11.0h assigned).
• Tobias Frost did 2.5h (out of 7.75h assigned and 4.25h from previous period), thus carrying over 9.5h to the next month.

Evolution of the situation

In August, we have released 1 DLAs.

During the month of August Debian 11 "bullseye" officially transitioned to the responsibility of the LTS team (on 2024-08-15). However, because the final point release (11.11) was not made until 2024-08-31, LTS contributors were prevented from uploading packages to bullseye until after the point release had been made. That said, the team was not at all idle, and was busy at work on a variety of tasks which impacted both LTS and the broader Debian community, as well as preparing uploads which will be released during the month of September.

Of particular note, LTS contributor Bastien Roucariès prepared updates of the putty and cacti packages for bookworm (1 2) and bullseye (1 2), which were accepted by the old-stable release managers for the August point releases. He also analysed several security regressions in the apache2 package. LTS contributor Emilio Pozuelo Monfort worked on the Rust toolchain in bookworm and bullseye, which will be needed to support the upcoming Firefox ESR and Thunderbird ESR releases from the Mozilla project. Additionally, LTS contributor Thorsten Alteholz prepared bookworm and bullseye updates of the cups package (1 2), which were accepted by the old-stable release managers for the August point releases.

LTS contributor Markus Koschany collaborated with Emmanuel Bourg, co-maintainer of the tomcat packages in Debian. Regressions in a proposed security fix necessitated the updating of the tomcat10 package in Debian to the latest upstream release.

LTS contributors Bastien and Santiago Ruano Rincón collaborated with the upstream developers and the Debian maintainer (Bernhard Schmidt) of the FreeRADIUS project towards addressing the BlastRADIUS vulnerability in the bookworm and bullseye versions of the freeradius package. If you use FreeRADIUS in Debian bookworm or bullseye, we encourage you to test the packages following the instructions found in the call for testers to help identifying any possible regression that could be introduced with these updates.

Testing is an important part of the work the LTS Team does, and in that vein LTS contributor Sean Whitton worked on improving the documentation and tooling around creating test filesystems which can be used for testing a variety of package update scenarios.

Thanks to our sponsors

Sponsors that joined recently are in bold.

• Platinum sponsors:
  • TOSHIBA (for 107 months)
  • Civil Infrastructure Platform (CIP) (for 75 months)
  • VyOS Inc (for 39 months)
• Gold sponsors:
  • Roche Diagnostics International AG (for 117 months)
  • Akamai - Linode (for 111 months)
  • Babiel GmbH (for 101 months)
  • Plat’Home (for 100 months)
  • CINECA (for 75 months)
  • University of Oxford (for 57 months)
  • Deveryware (for 44 months)
  • EDF SA (for 29 months)
  • Dataport AöR (for 4 months)
• Silver sponsors:
  • Domeneshop AS (for 122 months)
  • Nantes Métropole (for 116 months)
  • Univention GmbH (for 108 months)
  • Université Jean Monnet de St Etienne (for 108 months)
  • Ribbon Communications, Inc. (for 102 months)
  • Exonet B.V. (for 91 months)
  • Leibniz Rechenzentrum (for 86 months)
  • Ministère de l’Europe et des Affaires Étrangères (for 69 months)
  • Cloudways by DigitalOcean (for 59 months)
  • Dinahosting SL (for 57 months)
  • Bauer Xcel Media Deutschland KG (for 51 months)
  • Platform.sh SAS (for 51 months)
  • Moxa Inc. (for 45 months)
  • sipgate GmbH (for 43 months)
  • OVH US LLC (for 41 months)
  • Tilburg University (for 41 months)
  • GSI Helmholtzzentrum für Schwerionenforschung GmbH (for 32 months)
  • Soliton Systems K.K. (for 29 months)
  • THINline s.r.o. (for 5 months)
  • Copenhagen Airports A/S
  • Protegrity USA, Inc.
• Bronze sponsors:
  • Evolix (for 122 months)
  • Seznam.cz, a.s. (for 122 months)
  • Intevation GmbH (for 119 months)
  • Linuxhotel GmbH (for 119 months)
  • Daevel SARL (for 118 months)
  • Bitfolk LTD (for 117 months)
  • Megaspace Internet Services GmbH (for 117 months)
  • Greenbone AG (for 116 months)
  • NUMLOG (for 116 months)
  • WinGo AG (for 115 months)
  • Entr’ouvert (for 106 months)
  • Adfinis AG (for 104 months)
  • Tesorion (for 99 months)
  • GNI MEDIA (for 98 months)
  • Laboratoire LEGI - UMR 5519 / CNRS (for 98 months)
  • Bearstech (for 90 months)
  • LiHAS (for 90 months)
  • Catalyst IT Ltd (for 85 months)
  • Supagro (for 80 months)
  • Demarcq SAS (for 79 months)
  • Université Grenoble Alpes (for 65 months)
  • TouchWeb SAS (for 57 months)
  • SPiN AG (for 54 months)
  • CoreFiling (for 50 months)
  • Institut des sciences cognitives Marc Jeannerod (for 45 months)
  • Observatoire des Sciences de l’Univers de Grenoble (for 41 months)
  • Tem Innovations GmbH (for 36 months)
  • WordFinder.pro (for 35 months)
  • CNRS DT INSU Résif (for 34 months)
  • Alter Way (for 27 months)
  • Institut Camille Jordan (for 17 months)
  • SOBIS Software GmbH

Posted on September 11, 2024
Tags: madeof:atoms, craft:sewing, FreeSoftWear

I’ve been influenced again into feeling the need for a garment.

It was again a case of multiple sources conspiring in the same direction for unrelated reasons, but I decided I absolutely needed a linen hood, made from the heavy white linen I knew I had in my stash.

Why? I don’t know. I do like the feeling of wearing a hood, and the white linen should give a decent protection from the sun, but I don’t know how often I’m going to wear these instead of just a hat. On the other hand the linen was already there and I needed something small to sew.

My first idea was to make a square hood: some time ago I had already made one out of some leftovers of duvet cover, vaguely inspired by the S , because I have a long-term plan of making one a bit more from scratch1.

I like the fact that this pattern is completely made out of squares and rectangles, and while the flannel one is quite fitting, as suitable for a warm garment, I felt that by making it just a cm or two wider it would have worked nicely for a warm weather one, and indeed it did.

Except, before I even started on the square hood, I started to think that the same square top would also be good for a hood-scarf, one of those long flowy garments that sit on the head, wrap around the neck and fall down, moving with the wind and the movements of the person.

Because, let’s be honest. worn in a way that look like a veil they feel nice, it’s true. But with the help of a couple of pins then you can do this.

And no, I’ve never played that game2, and I’m not even 100% sure what it is about, other than killing people, climbing buildings and petting cats3, but that’s not really an issue when making a bit of casual cosplay of something, right?

Anyway, should anybody feel the need to make themselves a hood or ten, the patterns have been released as usual as #FreeSoftWear: square hood and hood scarf.

1. I’m not going to raise the sheep :D I’m actually not even going to wash and comb the wool, I’ll start from the step just after those :D↩︎

2. because proprietary software, because somewhat underpowered computers and other related reasons that are somewhat incidental to the game itself.↩︎

3. at least two out of three things that make it look like a perfectly enjoyable activity.↩︎

While fiddling around, I found a (fairly serious) vulnerability in Zyxel's GS1900-10HP and related switches; today Zyxel released an advisory with updated firmware, so I can publish my side of it as well. (Unfortunately there's no Zyxel bounty program, but Zyxel PSIRT has been forthcoming all along, which I guess is all you can hope for.)

The CVE (CVE-2024-38270) is sparse on details, so I'll simply paste my original message to Zyxel below:

Hi, GS1900-10HP (probably also many other switches in the same series), firmware V2.80(AAZI.0) (also older ones) generate web authentication tokens in an unsafe way. This makes it possible for an attacker to guess them and hijack the session. web_util_randStr_generate() contains code that is functionally the same as this: char token[17]; struct timeval now; gettimeofday(&now, NULL); srandom(now.tv_sec + now.tv_usec); for (int i = 0; i < 16; ++i) { long r = random() % 62; char c; if (r < 10) { c = r + '0'; // 0..9 } else if (r < 36) { c = r + ('A' - 10); // A..Z } else { c = r + ('a' - 36); // a..z } token[i] = c; } token[16] = 0; (random() comes from uclibc, but it has the same generator as glibc, so the code runs just as well on desktop Linux) This token is generated on initial login, and stored in a cookie on the client. This has multiple problems: First, the clock is a known quantity; even if the switch is not on SNTP, it is trivial to get its idea of time-of-day by just doing a HTTP request and looking at the Date header. This means that if an attacker knows precisely when the administrator logged in (for instance, by observing a HTTPS login on the network), they will have a very limited range of possible tokens to check. Second, tv_sec and tv_usec are combined in an improper way, canceling out much of the intended entropy. As long as one assumes that the administrator logged in less than a day ago, the entire range of possible seeds it contained within the range [now - 86400, now + 999999], i.e. only about 1.1M possible cookies, which can simply be tried serially even if one did not observe the original login. There is no brute-force protection on the web interface. I have verified that this attack is practical, by simply generating all the tokens and asking for the status page repeatedly (it is trivial to see whether it returns an authentication success or failure). The switch can sustain about one try every 96 ms on average against an attacker on a local LAN (there is no keepalive or multithreading, so the most trivial code is seemingly also the best one), which means that an attack will succeed on average after about 15 hours; my test run succeeded after a bit under three hours. If there are multiple administrator sessions active, the expected time to success is of course lower, although the tries are also somewhat slower because the switch has to deal with the keepalive traffic from the admins. This is a straightforward case of CWE-330 (Use of Insufficiently Random Values), with subcategories CWE-331, CWE-334, CWE-335, CWE-337, CWE-339, CWE-340, CWE-341 and probably others. The suggested fix is simple: Read entropy from /dev/urandom or another good source, instead of using random(). (Make sure that you don't get bias issues due to the use of modulo; you can use e.g. rejection sampling.) Session timeout does help against this attack (by default, it is 3 minutes), but only as long as the administrator has not kept a tab open. If the tab is left open, that keeps on making background requests that refreshes the token every five seconds, guaranteeing a 100% success rate if given a day or two. There is also _tons_ of outdated software on the switch (kernel from 2008, OpenSSH from 2013, netkit-telnetd which is no longer maintained, a fork of a very old NET-SNMP, etc.), but I did not check whether there are any relevant security holes or whether you have actually backported patches.

I haven't verified what their fix looks like, but it's probably somewhere there in the GPL dump. :-)