Posts and comments

Publishing content is very easy - github, blogger, personal pages, countless social sites and fancy P2P networks. 

Reading content is harder - Reddit, Twitter, Feedly and few others are attempting to identify 'interesting' content and organize it. There is too much content published, and too little diversity if you stick with a list of subscriptions (old style blog readers) and too much garbage and propaganda if you want broader sources. 

Comments are the third problem - they usually are more interesting than the original post, and are valuable both to the reader and to the original poster.  Just posting some content on a page with no way to get any feedback is a waste of time.

I've started to look for an alternative to Twitter for reading - and while doing so I also started for a place to start posting/blogging/ranting. I rarely post on Twitter - but I keep a lot of notes on various projects and experiments - just too lazy to publish them except in comments and 'readme' in git repos I work on.

The options so far:

• blogger - I've been using it for a very long time, easy - but very unfriendly to code and markdown.
• reddit - for posting in specific topics. Great comments and community associated with the topic. I've seen many posting a 'blog' or page on github and linking it to reddit for discussions/comments.
• https://github.com/utterance/utterances - comments become github issues. Interesting idea - using search in the issue tracker to hold the post comments. Best associated with blogs hosted on github.
• disqus - adds on the free edition, $11 for add free. Work to set it up.
• cusdis - open source, selfhosted option - supports sqlite.
• ...

For now I'm (re)starting to use blogger - it is by far the least effort, since my goal is to publish my tech notes and rants and maybe get a bit of feedback if anyone stumbles on them - but also checking Reddit. I wouldn't spam Reddit with my rants - but most communities seem high quality and the moderation on each community seems like a far better way to keep the noise out than even old Twitter (very low bar, but that's what I used to use to read, when I somehow trusted they have a team fighting against garbage content and disinformation). 

If I get bored - I would try 'utterances' with github and cusdis.

Egress capture using TPROXY

Very low level notes on intercepting traffic for Istio and similar apps. IPtables provide 2 mechanisms to capture, REDIRECT and TPROXY. The first is buggy and not recommended by the kernel docs. TPROXY unfortunately requires NET_ADMIN (or root) and is only available in the `PREROUTING` chain, i.e. can only be used for packets received on an interface - not on packets sent by local apps ( OUTPUT ).

I've been playing with this for some time, and this is what I've found:

1. Use an OUTPUT chain to mark packets - just like we do for REDIRECT interception
2. Use a routing table with 'dev lo' to route all marked packets to loopback. 
3. Apply TPROXY capture on the loopback PREROUTING - if the dest IP is not 127.0.0.0/8

It looks like this: 

  # Anything with the mark 15001 will be sent to loopback
  ip -4 rule add fwmark 15001 lookup 15001
  ip -4 route add local default dev lo table 15001

  # Calling this chain will set the mark resulting in route to lo
  iptables -t mangle -N ZT_CAPTURE_EGRESS
  iptables -t mangle -A ZT_CAPTURE_EGRESS -j MARK --set-mark 15001

  # PREROUTING on loopback - anything routed by the route table 15001, based on OUTPUT mark
  # Ignore local source or dst - it's not egress
  iptables -t mangle -N ZT_TPROXY
  iptables -t mangle -A ZT_TPROXY -d 127.0.0.0/8 -j RETURN
  iptables -t mangle -A ZT_TPROXY -d 127.0.0.0/8 -j RETURN
  iptables -t mangle -A ZT_TPROXY --match mark --mark 15001 -p tcp  -j TPROXY --tproxy-mark 15001/0xffffffff --on-port 15001
  iptables -t mangle -A PREROUTING -i lo -j ZT_TPROXY

  # Table that determines who gets redirected
  iptables -t mangle -N ZT_EGRESS
  iptables -t mangle -A OUTPUT  -j ZT_EGRESS

The OUTPUT table is similar to regular Istio:

  # Exclude few ports that should not be captured
  iptables -t mangle -A ZT_EGRESS  -p tcp --dport 15001 -j RETURN
  iptables -t mangle -A ZT_EGRESS  -p tcp --dport 15009 -j RETURN
  iptables -t mangle -A ZT_EGRESS  -p tcp --dport 15008 -j RETURN

  # UID or GID of the app capturing - so it can originate egress without 
  # getting captured again.
  # Best is to use GID - so root user is also captured. However when debuggin
  # in an IDE like CLion/Golang it is very easy to set 'run as root' but not
  # 'using group id' - so using uid-owner.
  iptables -t mangle -A ZT_EGRESS -m owner --uid-owner 0 -j RETURN

  # For now capture only 10.0.0.0, private range, can be changed to 0.0.0.0/0
  # to capture everything.
  iptables -t mangle -A ZT_EGRESS -d 10.0.0.0/8 -j ZT_CAPTURE_EGRESS

This works for sidecars - and avoids the problems with REDIRECT, however it does require the sidecar to run with NET_ADMIN cap, which is not always possible. For Ambient Istio (ZTunnel) it may not be needed since eBPF or veth can be used instead.

The other major benefit of TPproxy is that it also allows UDP capture - REDIRECT 'original DST' does not work for UDP. I did a bit of testing with UDP and IPv6 - all seems to be working.

K8S TokenRequest and TokenReview

Links to various docs on using K8S as an identity provider for JWT tokens - TokenReview and TokenRequest APIs.

https://jpweber.io/blog/a-look-at-tokenrequest-api/

https://github.com/mikedanese/community/blob/2bf41bd80a9a50b544731c74c7d956c041ec71eb/contributors/design-proposals/storage/svcacct-token-volume-source.md

https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.18/#tokenreview-v1-authentication-k8s-io 

https://github.com/kubernetes/community/blob/master/contributors/design-proposals/auth/bound-service-account-tokens.md

Istiod CRDs in IntelliJ

Quick post to remember the link:

https://raw.githubusercontent.com/istio/api/master/kubernetes/customresourcedefinitions.gen.yaml

This needs to be added to Languages&Frameworks / Kubernetes, and refresh when the API changes.

Istio injection

https://jimmysong.io/en/blog/sidecar-injection-iptables-and-traffic-routing/

Recovering .ecryptfs files

I have some old backups, including the .ecryptfs directories.

After several searches, what worked is:

1.  Check the key signatures: cat .ecryptfs/Private.sig 
2. Try to remember the password, and

   ecryptfs-unwrap-passphrase .ecryptfs/wrapped-passphrase

3. With the result, do

   echo $UNWRAPPED |ecryptfs-add-passphrase --fnek - 

If the result of ecryptfs-add matches the Private.sig, mount the disk with the magic command:

mount -i -t ecryptfs   -o ecryptfs_sig=$FIRST_ID,ecryptfs_fnek_sig=$SECOND_ID,ecryptfs_cipher=aes,ecryptfs_key_bytes=16   .Private/ $DEST

Read: low level kernel networking

In particular the UDP sections are very useful.

'via Blog this'

docs/manifest-format.txt - git-repo - Git at Google

Reference for Android repo format.


docs/manifest-format.txt - git-repo - Git at Google:

'via Blog this'

KSubedi/gomove: gomove is a utility to help you move golang packages by automatically changing the import paths from the old one to new one.

KSubedi/gomove: gomove is a utility to help you move golang packages by automatically changing the import paths from the old one to new one.:

'via Blog this'