/dev/urandom
type: channel
description: Random ramblings from a pseudorandom human
date: 2025-05-10T12:11:06Z
update period: hourly
update frequency: 1
update base: 2000-01-01T12:00+00:00
generator agent: https://wordpress.org/
items: Kodachi – revisited
items: HP bricked my printer.
items: Kodachi Linux: A brief Security Review
items: A fake USB3 hub
items: Install Apache2 on Ubuntu 16.04
items: COAP endpoints on IKEA Trådfri
items: Ikea Trådfri zigbee lights
items: Installing Debian on x86 readyNAS.
items: AIS reception with RTL-SDR
items: Raspberry Pi as cheap media player.

Kodachi – revisited
type: item
creator: vidarlo
date: 2025-05-10T12:11:06Z
subject: english
subject: security
description: I’ve previously written about Kodachi. The author is now working on a new version, and it doesn’t look any better. Let’s have a look for instance on the proposed authentication protocol. It’s unclear where it will be used. It’s unclear what it protects. It’s unclear whom it authenticates. Authentication Flow: When a client attempts to […]
encoded: I’ve previously written about Kodachi. The author is now working on a new version, and it doesn’t look any better. Let’s have a look for instance on the proposed authentication protocol. It’s unclear where it will be used. It’s unclear what it protects. It’s unclear whom it authenticates. Authentication Flow: When a client attempts to authenticate, it contacts the server. The server generates a cryptographically secure 256-bit (32-byte) random value using random_bytes(). This value is encoded as a 64-character hexadecimal string for transmission. A unique CSRF token is attached with the challenge to prevent replay attacks. Client-Side Processing: The client reverses the string and applies a SHA-256 hash to solve the challenge. Server-Side Verification: The server validates the solution and, upon success, issues a session token. Security Benefit: No passwords are ever transmitted or stored, significantly reducing risk. Good luck in making sense of this. And in addition, there’s a lot of unanswered questions: How does the client authenticate the server? What is the purpose of the random 32-byte nonce? Why is a separate CSRF token needed in addition to the nonce? How does applying a hash to a nonce solve a challenge? What challenge? What solution does the server validate? In short, I don’t see any authentication happening as part of this protocol, and I don’t see how it can be secure either. And why not transmit passwords? TLS solved this problem, and if the server is untrusted to handle a password, it’s untrusted to handle other secrets as well. And why re-invent the wheel? There’s multiple protocols for authentication that doesn’t reveal a client side secret to the server, but proves client knowledge of the secret. TLS and SSH authentication are two such mechanisms. Schneier’s law is ever relevant: Anyone, from the most clueless amateur to the best cryptographer, can create an algorithm that he himself can’t break. It’s not even hard. What is hard is creating an algo…

HP bricked my printer.
type: item
creator: vidarlo
date: 2022-03-01T20:15:26Z
subject: english
subject: hardware
subject: rants
description: Some years back I bought a Samsung CLX-3300 printer. It worksworked great. Most of the time it was plugged into a RPi that was handling the spooling with cups, and I used third party toner without any issues. Recently the SD card of the RPi died, so that option was not available to me any […]
encoded: Some years back I bought a Samsung CLX-3300 printer. It works worked great. Most of the time it was plugged into a RPi that was handling the spooling with cups, and I used third party toner without any issues. <img fetchpriority="high" decoding="async" src="https://bitsex.net/wp-content/uploads/2022/03/hp_briked-720x515.jpg" alt="" width="720" height="515" class="alignnone size-large wp-image-683" srcset="https://bitsex.net/wp-content/uploads/2022/03/hp_briked-720x515.jpg 720w, https://bitsex.net/wp-content/uploads/2022/03/hp_briked-300x215.jpg 300w, https://bitsex.net/wp-content/uploads/2022/03/hp_briked-200x143.jpg 200w, https://bitsex.net/wp-content/uploads/2022/03/hp_briked-768x549.jpg 768w, https://bitsex.net/wp-content/uploads/2022/03/hp_briked-1536x1099.jpg 1536w, https://bitsex.net/wp-content/uploads/2022/03/hp_briked.jpg 1992w" sizes="(max-width: 720px) 100vw, 720px" /> Recently the SD card of the RPi died, so that option was not available to me any more. Yesterday, my wife had to print something, so she plugged her Windows 10 computer into the USB port of the printer. And presto – the display shows Incompatible toner – for all toner. There’s no technical reason for this. The printer worked fine with exactly the same toner the day before. However, HP has obviously decided that this should not be allowed. It’s not a original move in the printer business. It’s hardly original; printer manufacturers have been at this for years. The new thing here is that they modified the printer after it was purchased, without informing me. They didn’t provide any information that the firmware would be updated, and essentially lead to a Denial of Service. HP did the same thing in 2016, for which they was chastised by EFF and Cory Doctorow. That’s why I bought a Samsung printer, not a HP printer. Sadly, HP purchased Samsung some time after I purchased my printer…

Kodachi Linux: A brief Security Review
type: item
creator: vidarlo
date: 2021-10-24T10:32:43Z
subject: english
subject: Linux
subject: privacy
subject: security
subject: kodachi
description: I was recently made aware of Kodachi Linux, which according to it’s website has gotten critical acclaim. This is a superficial attemt to look at the distribution – if it’s even fair to call it that. Off the bat, it doesn’t start well: Confusing documentation For best security results (Email – Banking – Cryptocurrency): ISP […]
encoded: I was recently made aware of Kodachi Linux, which according to it’s website has gotten critical acclaim. This is a superficial attemt to look at the distribution – if it’s even fair to call it that. Off the bat, it doesn’t start well: Confusing documentation For best security results (Email – Banking – Cryptocurrency): ISP > Host machine (XMR anonymous VPN) > Linux Kodachi VPN (Virtual machine – Vmware) with firewall forced VPN Traffic > Kodachi browser > Dnscrypt (Best model) ISP > Linux Kodachi VPN with firewall forced VPN Traffic > Kodachi loaded browser > Dnscrypt ISP > Linux Kodachi VPN with firewall forced VPN Traffic > Kodachi loaded browser > TOR DNS ISP > Linux Kodachi VPN with firewall forced VPN Traffic > Kodachi lite browser > TOR DNS (Fast) ISP > Linux Kodachi VPN with firewall forced VPN Traffic > TOR browser > Dnscrypt ISP > Linux Kodachi VPN with firewall forced VPN Traffic > TOR browser > TOR DNS This confuses security and anonymity. While the majority of such sites today employ TLS (https), sending traffic through unknown VPN’s and Tor may potentially send your traffic to an attacker. You have no knowledge of the motivations of people running tor exit relays, and while they may provide anonymity, they are not meant to provide security. Furthermore, Warith Al Maawali, the author of Kodachi, openly admits to transferring a hardware hash by default, upon boot: I pay monthly rent to run the VPS nodes and utilize them for VPN which is provided to you, I do not collect ANY data or store ANY information (Logs) that belongs to the user except the hardware ID (hash) and connected IP address (VPN IP) that has to be sent automatically when your PC establishes a connection to the VPN How on earth did he conclude that it was a good idea to transmit a hardware hash on boot, for a security and anonymity focused distribution? I could accept it, if it only occurred after the user choosing to use his VPN. As it is, it automatically transmits it upon boot. What is Ko…

A fake USB3 hub
type: item
creator: vidarlo
date: 2021-02-17T15:07:56Z
subject: english
subject: hardware
subject: rants
description: I recently bought a 7-port USB3 hub from eBay. That’s a somewhat interesting experience. It turns out that’s it’s not a 7-port USB3 hub. It’s a four port USB3 hub, and a three port USB2-hub, which happens to be mounted on the same board. Inside, it contains two major IC’s: One of them, the VL815, […]
encoded: I recently bought a 7-port USB3 hub from eBay. That’s a somewhat interesting experience. It turns out that’s it’s not a 7-port USB3 hub. It’s a four port USB3 hub, and a three port USB2-hub, which happens to be mounted on the same board. Inside, it contains two major IC’s: <img loading="lazy" decoding="async" src="https://bitsex.net/wp-content/uploads/2021/02/VL815.png" alt="" width="640" height="480" class="size-full wp-image-618" srcset="https://bitsex.net/wp-content/uploads/2021/02/VL815.png 640w, https://bitsex.net/wp-content/uploads/2021/02/VL815-300x225.png 300w, https://bitsex.net/wp-content/uploads/2021/02/VL815-200x150.png 200w" sizes="auto, (max-width: 640px) 100vw, 640px" /> VLI VL815 Chip <img loading="lazy" decoding="async" src="https://bitsex.net/wp-content/uploads/2021/02/SL21.png" alt="" width="640" height="480" class="size-full wp-image-619" srcset="https://bitsex.net/wp-content/uploads/2021/02/SL21.png 640w, https://bitsex.net/wp-content/uploads/2021/02/SL21-300x225.png 300w, https://bitsex.net/wp-content/uploads/2021/02/SL21-200x150.png 200w" sizes="auto, (max-width: 640px) 100vw, 640px" /> SL2.1 USB2 HUB One of them, the VL815, appears to be a USB3 hub chip, from VIA. The other chip, SL2.1 is a obscure USB2 hub chip, with a datasheet only in chinese – but at least clearly marked as USB2, both on the chip, and in the datasheet. This is clearly not some accident in manufacturing; they’re making a fraudulent product, with some USB3 ports, and some USB2 ports – and hope that their customers won’t be able to tell the difference. The physical ports are all USB3, with the five extra contacts – just not connected to anything… <img loading="lazy" decoding="async" src="https://bitsex.net/wp-content/uploads/2021/02/20210217_141547-720x134.jpg" alt="" width="720" height="134" class="aligncenter size-large wp-image-621" srcset="https://bitsex.net/wp-content/uploads/2021/02/20210217_141547-720x134.jpg 720w, https://bitsex.net/wp-content/uploads/2021/02/2021021…

Install Apache2 on Ubuntu 16.04
type: item
creator: vidarlo
date: 2018-02-26T19:42:54Z
subject: english
subject: Linux
subject: software
subject: tutorials
description: I assume that you have a running Ubuntu installation. This is written with 16.04 in mind but should work with some adaptions on other versions as well. example.org is used as an example (D’oh) in this post, and should be changed to suit your installation. Installing Apache2, PHP, MariaDB and so forth $ sudo apt […]
encoded: I assume that you have a running Ubuntu installation. This is written with 16.04 in mind but should work with some adaptions on other versions as well. example.org is used as an example (D’oh) in this post, and should be changed to suit your installation. Installing Apache2, PHP, MariaDB and so forth $ sudo apt install apache2 libapache2-mod-php mariadb-server php-mysql This will install Apache2, PHP, MariaDB, and some dependencies, in addition to PHP bindings for accessing mysql. At this stage, you should be able to access http://example.org, and see a default page: Setting up a vhost Vhosts are virtual hosts, which is used to serve different content for different domain names. Start editing a new file called /etc/apache2/sites-available/01-example.org.conf in your favorite editor: $ sudo editor /etc/apache2/sites-available/01-example.org.conf Enter the following configuration: <VirtualHost *:80> ServerName example.org ServerAlias www.example.org ServerAdmin webmaster@example.org DocumentRoot /var/www/html/example.org/ ErrorLog ${APACHE_LOG_DIR}/example.org.error.log CustomLog ${APACHE_LOG_DIR}/example.org.access.log combined </VirtualHost> First, we define the primary ServerName. This is the domain used to access the site. Only one can be defined per vhost. In addition, we define a ServerAlias, in case someone enters www.example.org in their browser. This ensures that Apache replies to both names. Both names has to point to your server, either in DNS, or in /etc/hosts for local testing. Any number of server aliases can be specified, and they do not have to contain parts of the ServerName. Thus, ServerAlias example.com would be valid. Create the new DocumentRoot I’ve placed the new documentroot in /var/www/html/example.org. This is a location that is allowed to be served by Apache in Ubuntu. If I, for instance, placed it in /srv/, I would have to include a Directory stanza for it. For now, create the webroot, fill it with some content, and activate the new config: …

COAP endpoints on IKEA Trådfri
type: item
creator: vidarlo
date: 2017-04-01T14:53:30Z
subject: english
subject: hardware
subject: software
subject: Linux
subject: nettverk
subject: trådfri
description: So, I’m talking to the Trådfri GW. It turns out that my initial research was correct. It is talking coaps. I used californium.tools/ to talk to it, requesting coaps://10.0.3.25/.well-known/core. It actually seems to implement the standard rather well 🙂 I had to use -psk and enter the security key, printed on a label under the […]
encoded: So, I’m talking to the Trådfri GW. It turns out that my initial research was correct. It is talking coaps. I used californium.tools/ to talk to it, requesting coaps://10.0.3.25/.well-known/core. It actually seems to implement the standard rather well I had to use -psk and enter the security key, printed on a label under the gw itself. UPDATE: Leave PSK identity blank. ==[ CoAP Response ]============================================ MID : 115 Token : 170a801bb0362002 Type : ACK Status : 2.05 Options: {"Content-Format":"application/link-format"} Payload: 560 Bytes --------------------------------------------------------------- <//15001/65536>;ct=0;obs,<//15001/65538>;ct=0;obs,<//15001/65537>;ct=0;obs,<//15004/139121>;ct=0;obs,<//15005/139121>;ct=0;obs,<//15005/139121/203361>;ct=0;obs,<//15005/139121/221937>;ct=0;obs,<//15005/139121/217246>;ct=0;obs,<//15005/139121/202872>;ct=0;obs,<//15001>;ct=0;obs,<//15001/reset>;ct=0,<//status>;ct=0;obs,<//15005>;ct=0;obs,<//15004>;ct=0;obs,<//15004/add>;ct=0,<//15004/remove>;ct=0,<//15006>;ct=0;obs,<//15011/15012>;ct=0;obs,<//15011/9034>;ct=0,<//15011/9030>;ct=0,<//15011/9031>;ct=0,<//15011/9063>;ct=0,<//15011/9033>;ct=0,<//15010>;ct=0;obs =============================================================== Time elapsed (ms): 1251 Querying each of the endpoints yielded the following: /15001/65536 {"9054":0,"9001":"Remote","5750":0,"9002":1490983329,"9020":1490985746,"9003":65536,"15009":[{"9003":0}],"9019":0,"3":{"1":"TRADFRI remote control","0":"IKEA of Sweden","2":"","3":"1.1.1.1-5.7.2.0","6":3,"9":100}} This is obviously the remote control unit. /15001/65538 {"9054":0,"9001":"K","5750":2,"9002":1490992930,"9020":1491052948,"9003":65538,"9019":0,"3":{"1":"TRADFRI bulb E27 WS opal 980lm","0":"IKEA of Sweden","2":"","3":"1.1.1.1-5.7.2.0","6":1},"3311":[{"9003":0}]} This is one of the bulbs. I believe it is the one named “K” in the IKEA app… /15001/65537 {"9054":0,"9001":"LR","5750":2,"9002":1490983446,"9020":1491055861,"9003":65537,"901…

Ikea Trådfri zigbee lights
type: item
creator: vidarlo
date: 2017-03-31T22:21:52Z
subject: english
subject: hardware
subject: software
subject: coap
subject: ikea
subject: led
subject: nettverk
subject: sikkerhet
subject: utilities
subject: zigbee
description: So, Ikea has released Trådfri seemingly worldwide. This is a series of Zigbee enabled lights, which looks quite neat. I bought the starter kit, with a gateway, two bulbs, and a remote control. First a couple of sentences about the remote control. It has on/off, dim up and down, and change color temperature. Nothing too […]
encoded: <img loading="lazy" decoding="async" class="size-medium wp-image-558" src="https://bitsex.net/wp-content/uploads/2017/03/DSC_0583.JPG-172x300.jpg" alt="Ikea Trådfri gateway" width="172" height="300" srcset="https://bitsex.net/wp-content/uploads/2017/03/DSC_0583.JPG-172x300.jpg 172w, https://bitsex.net/wp-content/uploads/2017/03/DSC_0583.JPG-114x200.jpg 114w, https://bitsex.net/wp-content/uploads/2017/03/DSC_0583.JPG-768x1342.jpg 768w, https://bitsex.net/wp-content/uploads/2017/03/DSC_0583.JPG-412x720.jpg 412w, https://bitsex.net/wp-content/uploads/2017/03/DSC_0583.JPG.jpg 1023w" sizes="auto, (max-width: 172px) 100vw, 172px" /> Ikea Trådfri gateway So, Ikea has released Trådfri seemingly worldwide. This is a series of Zigbee enabled lights, which looks quite neat. I bought the starter kit, with a gateway, two bulbs, and a remote control. First a couple of sentences about the remote control. It has on/off, dim up and down, and change color temperature. Nothing too exciting. If it is paired with two bulbs, and one is on and other is off, they will swap when on/off is pressed… It appears to have the advertised range of 10m, and certainly is a neat addition. The bulbs gives the amount of light I expect – and they’re quite cheap. But the gateway is the most interesting thing. It’s a cylinder, containing ~95% air. The circuit board is imaged at left. The biggest comonent is the ethernet jack, mounted on the other side of the board: <img loading="lazy" decoding="async" class="size-medium wp-image-559" src="https://bitsex.net/wp-content/uploads/2017/03/DSC_0584.JPG-300x157.jpg" alt="Ethernet jack side of board" width="300" height="157" srcset="https://bitsex.net/wp-content/uploads/2017/03/DSC_0584.JPG-300x157.jpg 300w, https://bitsex.net/wp-content/uploads/2017/03/DSC_0584.JPG-200x105.jpg 200w, https://bitsex.net/wp-content/uploads/2017/03/DSC_0584.JPG-768x401.jpg 768w, https://bitsex.net/wp-content/uploads/2017/03/DSC_0584.JPG-720x376.jpg 720w, https://bitsex.net/wp-conte…

Installing Debian on x86 readyNAS.
type: item
creator: vidarlo
date: 2016-03-07T19:41:23Z
subject: english
subject: hardware
subject: Linux
subject: software
subject: Uncategorized
description: The Netgear readynas is essentially a x86 computer, with a handy Serial TTL interface at the back. However, it’s not entirely straight forward. Unetbootin-created usb-media did not boot, but the debian netboot iso appears to boot. However, it doesn’t support serial console out of the box. After remastering the netboot image with settings for console, […]
encoded: The Netgear readynas is essentially a x86 computer, with a handy Serial TTL interface at the back. However, it’s not entirely straight forward. Unetbootin-created usb-media did not boot, but the debian netboot iso appears to boot. However, it doesn’t support serial console out of the box. After remastering the netboot image with settings for console, I was ready to try again – holding the ‘backup’ button on front while powering up. And presto – a debian boot menu appeared. From thereon it was pretty straight forward. If you want, you can grab the image here – debian-8.2-serial.iso. It can we written to CD with your favourite recording software, or written to a usb stick with dd. For the Netgear, use a usb stick. The performance went from 450Mbps to 950Mbps, so clearly the way outdated software that Netgear shipped it with was inadequate for the hardware. So now I have a Debian computer, which can do anyting – not limited to what Netgear wanted me to do. And as a bonus it even performs better!

AIS reception with RTL-SDR
type: item
creator: vidarlo
date: 2015-07-14T04:18:12Z
subject: sdr
description: Some of you may have heard about rtl-sdr, which is basically a software defined radio framework, for cheap USB sticks. The USB sticks can be picked up for 10-20$. They’re not excellent. They have limited bandwith (~2MHz), they have noticeable noise, and they don’t have that good sensitivity. But for the price? It’s a extremely […]
encoded: Some of you may have heard about rtl-sdr, which is basically a software defined radio framework, for cheap USB sticks. The USB sticks can be picked up for 10-20$. They’re not excellent. They have limited bandwith (~2MHz), they have noticeable noise, and they don’t have that good sensitivity. But for the price? It’s a extremely good offer. AIS reception has been covered by the guys at rtl-sdr.com. I found this quite lacking, and it didn’t explain some of the stuff, like why resample the audio to 12kHz. After fiddling around for some days, I found rtl-ais which is a modified version of rtl-sdr, with direct support for AIS decoding. It worked! Just specifying the tuner error, and it was outputting AIS messages. However, the decoder was not that elegant, and GNUAIS had interesting features, like the ability to feed data directly to mysql. AIS is transmitted at 161.975 and 162.025MHz, which is within the 2MHz bandwidth of the RTL-SDR sticks, so both channels can be received at once. The rtl_ais software is a modified version of rtl_fm, which can do exactly this. Feeding the output audio to a named pipe, and setting gnuais up to read from that named pipe, instead of audio card, worked just perfectly!

Raspberry Pi as cheap media player.
type: item
creator: vidarlo
date: 2014-01-08T20:02:37Z
subject: english
subject: hardware
subject: Linux
subject: software
subject: network
subject: utilities
description: As you may’ve guessed from some previous blog posts, I have been expirementing with Raspberry Pi as media player. The setup was not entirely straight forward, as it was to be located at my girlfriends place, with access to the media I have at home. I was looking at OpenVPN as solution, tying the networks […]
encoded: <img loading="lazy" decoding="async" class="size-thumbnail wp-image-512 " alt="CC-BY-SA 3.0 - by Jwrodgers" src="https://bitsex.net/wp-content/uploads/2014/01/RaspberryPi-200x133.jpg" width="200" height="133" align="right" srcset="https://bitsex.net/wp-content/uploads/2014/01/RaspberryPi-200x133.jpg 200w, https://bitsex.net/wp-content/uploads/2014/01/RaspberryPi-300x199.jpg 300w, https://bitsex.net/wp-content/uploads/2014/01/RaspberryPi-720x479.jpg 720w" sizes="auto, (max-width: 200px) 100vw, 200px" /> CC-BY-SA 3.0 – by Jwrodgers As you may’ve guessed from some previous blog posts, I have been expirementing with Raspberry Pi as media player. The setup was not entirely straight forward, as it was to be located at my girlfriends place, with access to the media I have at home. I was looking at OpenVPN as solution, tying the networks together. She has ample down link (16Mb/s), and I have ample uplink (12Mb/s) to make this viable. I started testing with my laptop as media player, and 720p played just fine from a NFS volume mounted over OpenVPN. A few glitches during playback if the connection was used for anything else whilst playing, but quite smooth and usable. 1080p, however, was no go. Low BW 1080p might work, but probably not. The solution for this was Plex, with a suitable plugin in XBMC. Plex handles on-the-fly transcoding to a more suitable bandwidth profile. After testing a bit, my conclusion was that the solution was not performing well enough. Throughput was 2-3Mb/s over the OpenVPN-link. Originally I believed this was due to the limited CPU power of the Pi, but it turned out that the Edimax Wireless USB adapter was the culprit. When testing at home, it was placed 50cm from the antennas of my access point; not the setup at my girlfriends place. There it was 5 meters… Changing to cabled gave a throughput of roughly what the link should be able to carry (11.5Mb/s according to Samknows), minus overhead. So actual throughput was 10.5-11Mb/s downstream, and 4.5-5M…