NAT, Inection, IPv6, Ubuntu, Trading, Lidl, gdm3, Storage

1. NAT splistreaming (@ samy.pl). No surprises there. This is one of the reasons why I've been disabling ALG everywhere for a decade at least. It's worth of noting that the IPv6 solves all of the ALG problems.

2. One friend wrote IRC script in 2020. It reminded me about the fact that it was probably in early 90's we were using shell command injection and reverse shell via IRC bot and lack of proper string sanitization before it was passed to shell for execution. So, injection issues are much older than HTML. Probably just as old as the ways of mixing data and commands with separators in general. And I'm sure SQL injections were common already in 1989 when the standard were published, those just weren't widely exploited.

3. One morning I were reading some IPv6 related discussion and there was a huge rant discussion about how impossible the IPv6 addresses are. Ok fine. Next morning I woke up and were a bit bored, so I decided that maybe I can do something about. - End result? - Say-IPv6 (@ s.sami-lehtinen.net) service. Which is actually just is a simple mapping process. It translates IPv6 addresses into English words and DNS names based on English-words and of course back. Sure it's open source, anyone can get the source and use it, with the pre-provided word list or their own word list.

4. Configured new DNS services for experimental domain & platform deployment using CloudDNS.net services.

5. Scrolling speed problems with Logitech mouses and Ubuntu are ridiculous. I guess there are some over lapping layers messing it up... You don't ever know if you're going to end up with ultra slow scroll or absolute hyper speed scroll. I guess the speed change is around order of magnitude at least to both directions, maybe even 16x. Sometimes you'll need to spin the scroll wheel like crazy and sometimes even slightly touch it will send you up or down by several screens. Is that the most complex technical system ever designed by the man kind? And this problem has persisted for quite a while. It even changes randomly during runtime, everything starts fine, and then it might switch to turbo or slow suddenly. - Are they serious, or just trolling?

6. Helped a friend to setup secure and high performance cloud environment for online trading. It was fun and interesting task. Unfortunately I can't say anything more about it. Lot's of security hardening, access control, network latency optimization, and all the "basic stuff", selecting best provider for the locations. No, I didn't store any credentials, nor those are valid anymore which I had.

7. Got so annoyed about slow bloated and hard to access "loyalty apps", that I decided to screenshot the app QR code and printed it for my wallet. Now I don't need to deal with the mobile app, I just can show the sticker at checkout. - Win! - Greetings go to Lidl Plus program, your app is bleeped! Especially when it randomly asks for credentials which I don't obviously carry with me or have access to.

8. Daily fun. One developer was totally surprised with 20 years of experience, that IP port number can be higher than 9999. Yep, it really happened. It's interesting to see how bad some implementations can be, but also it's almost even more interesting to see that it has taken several years for anyone to figure out that there's such a limit. Nice combination. ;) Solution? Well, change the port number to smaller than 9999 and now the issue is "fixed". Oh, what a joy.

9. After Ubuntu 20.04 update, system sometimes boots really extremely slowly and is very lagged after the boot for quite a while. I started to suspect discard, because it did look just like running discard. Then iostat showed discarding lot of data. Ok. Now I knew it was discard. But what's starting it? Couldn't find any anacron entries. But after some investigation I found service 'fstrim.timer' and that's the reason for ultra lag. -> Disabled it, issue fixed. Done! Seems that I'm not the only one annoyed by this. If the fstab already got discard in place, this trimming shouldn't be required. Of course you can run manual trim at some rare interval if you feel so, like after doing distribution upgrade, but running it weekly and starting with boot, seems way way excessive.

10. Excellent post: How to get root on Ubuntu 20.04 by pretending nobody’s /home (@ securitylab.github.com). I really  loved that post. Yep, do strange things, observer results. Sometimes something unexpected happens. That's pretty much how I found the 0-day DoS exploit which could potentially lead to RCE but I haven't explored it further. Things went awry a few times, and I thought that I want to repeat that. I started fuzzing around at different stages of the process with slight modifications to the payload and it didn't take too much time to find a repeatable pattern to crash key service(s) of the platform. Sorry, can't provide no more details yet. Yet I've reported the issue responsibly and respectfully.

11. Oh no. I simply loved the unlimited free cloud blob storage provided by Google.  "Google Photos to end its unlimited free photo storage". It's great for eternal backups and data copies of everything. Maybe that's exactly why they ended it.

2022-01-23