The Wiert Corner – irregular stream of stuff

Jeroen W. Pluimers on .NET, C#, Delphi, databases, and personal interests

  • My badges

  • Twitter Updates

  • My Flickr Stream

  • Pages

  • All categories

  • Enter your email address to subscribe to this blog and receive notifications of new posts by email.

    Join 1,854 other subscribers

Archive for the ‘Power User’ Category

Jesse J. Anderson on Twitter: “People with ADHD are often surrounded by piles of clutter…: things I don’t want to forget.”

Posted by jpluimers on 2023/07/27

Thread to remember that started with [Archive] Jesse J. Anderson • ADHD Creative on Twitter: “People with ADHD are often surrounded by piles of clutter. My desk is in a permanent state of chaos. Piles of books, papers, index cards, and random other things I don’t want to forget.” / Twitter

I bumped into it via [Archive] Ilse on Twitter: “Ja! Als ik het niet zie, denk ik er niet aan.” / Twitter (thanks!).

I saved the thread at [Wayback/Archive] Thread by @jessejanderson on Thread Reader App – Thread Reader App and I am quoting it in full as it is so much me, highlighting it the most important bits for me:

People with ADHD are often surrounded by piles of clutter.

My desk is in a permanent state of chaos.

Piles of books, papers, index cards, and random other things I don’t want to forget.
Other ADHDers might keep a clean desk, but use their car as an extra closet and storage facility.

Why is this so common for people with ADHD?

It’s actually a form of self-preservation.
We often forget things we can’t see.

Instinctively, we know this.

When things are truly put away—hidden in the depths of a box or drawer—we know they disappear from our brains entirely.
This is why planners rarely work for people with ADHD.

The second we close the cover, we forget everything inside.

Without a routine in place, we might never remember to open it again.
When I was younger, sometimes my mom would be so fed up with my room she would clean it herself.

I _hated_ when she did this!

“How will I ever find anything?!”
When things are “a mess”, they are out in the open and I can use them as a physical memory palace—the visual of their environmental placement reminds me where things are.

It may look like a mess, but I can find exactly what I’m looking for.
This extends beyond just knick-knacks on a desk.

Sometimes a work responsibility will fall out of your brain.

You were doing it consistently and one day—for some unknown reason—you forgot to do it.

It’s no longer part of your environment, your routine.
When this happens, you know you’ll _never_ remember this thing again until something specifically reminds you.

As if it’s fallen into one of those boxes or drawers you never remember to open.
This can happen with people too.

If you haven’t seen someone recently, you might forget they exist entirely.

This can add a lot of stress to personal and family relationships.

People are offended and fail to understand.
If you enjoyed this thread or found it helpful:

🔁 Share by retweeting the first tweet

📮 Grab my free weekly ADHD newsletter (extrafocus.io)

–jeroen

Posted in About, Autistic Spectrum/Autism, Awareness, LifeHacker, Personal, Power User | Leave a Comment »

5 days after the exploit publication of snowcra5h/CVE-2023-38408: Remote Code Execution in OpenSSH’s forwarded ssh-agent

Posted by jpluimers on 2023/07/26

TL;DR is at the bottom (;

5 days ago this exploit development got published: [Wayback/Archive] snowcra5h/CVE-2023-38408: CVE-2023-38408 Remote Code Execution in OpenSSH’s forwarded ssh-agent.

It is about [Wayback/Archive] NVD – CVE-2023-38408 which there at NIST isn’t rated (yet?), neither at [Wayback/Archive] CVE-2023-38408 : The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remot.

However at [Wayback/Archive] CVE-2023-38408- Red Hat Customer Portal it scores 7.3 and [Wayback/Archive] CVE-2023-38408 | SUSE it did get a rating of 7.5, so since I mainly use OpenSuSE I wondered what to do as the CVE is formulated densely at [Wayback/Archive] www.qualys.com/2023/07/19/cve-2023-38408/rce-openssh-forwarded-ssh-agent.txt: it mentions Alice, but no Bob or Mallory (see Alice and Bob – Wikipedia).

Luckily, others readly already did the fine reading and emphasised the important bits, especially at [Wayback/Archive] RCE Vulnerability in OpenSSH’s SSH-Agent Forwarding: CVE-2023-38408 (note that instead of Alex, they actually mean Alice)

“A system administrator (Alice) runs SSH-agent on her local workstation, connects to a remote server with ssh, and enables SSH-agent forwarding with the -A or ForwardAgent option, thus making her SSH-agent (which is running on her local workstation) reachable from the remote server.”

According to researchers from Qualys, a remote attacker who has control of the host, which Alex has connected to, can load (dlopen()) and immediately unload (dlclose()) any shared library in /usr/lib* on Alice’s workstation (via her forwarded SSH-agent if it is compiled with ENABLE_PKCS11, which is the default).

The vulnerability lies in how SSH-agent handles forwarded shared libraries. When SSH-agent is compiled with ENABLE_PKCS11 (the default configuration), it forwards shared libraries from the user’s local workstation to the remote server. These libraries are loaded (dlopen()) and immediately unloaded (dlclose()) on the user’s workstation. The problem arises because certain shared libraries have side effects when loaded and unloaded, which can be exploited by an attacker who gains access to the remote server where SSH-agent is forwarded to.

Mitigations for the SSH-Agent Forwarding RCE Vulnerability

Read the rest of this entry »

Posted in *nix, *nix-tools, bash, bash, Communications Development, Development, Internet protocol suite, OpenSSH, Power User, PowerShell, Scripting, Security, Software Development, SSH | Leave a Comment »

Online GIF rotator (uses image URL; also rotates JPEG images and caches the results online)

Posted by jpluimers on 2023/07/25

The [Wayback/Archive] Online GIF rotator does not justify the tool enough as it:

  • also rotates JPEG images
  • can rotate an image from an existing URL
  • presents the rotated images as a URL (probably temporarily, as I doubt it stores them permanently because of space issues and possible abuse)

I used it at C13/C14 wiring diagram live/neutral/earth, which originally [Wayback/Archive] had the image from IEC 60320 – Wikipedia: C13/C14_couplerFile:IEC60320 C13.jpg – Wikipedia in original upright position:

The online image editor with this image is at [Wayback/Archive] Online GIF rotator with C13 female cable end that has holes.

The rotated image is now at [Wayback/Archive] ezgif-7-8f95ded85c.jpg (340×600) – hopefully the last link now fails (:

–jeroen

Posted in Development, Image Editing, Power User, Software Development, Web Development | Leave a Comment »

New in box: Super Serial Card – Apple Computer

Posted by jpluimers on 2023/07/24

Still need to test this out, but I got a new in box “Super Serial Card – Apple Computer

Details: Apple II serial cards – Wikipedia

Apple Computer’s Super Serial Card, sometimes abbreviated as “SSC”, is the most well known communication card made for the Apple II. Apple called it “Super” because it was able to function as both of Apple’s previous cards, the Apple II Communications Card for modem use and the Apple II Serial Interface Card for printer use. A jumper block was used to configure the card for each of the two modes. The card has a maximum speed of 19,200 bit/s and is compatible with both ROM revisions of the Apple II Serial Interface Card. Reliable communications at 9600 bit/s and higher required disabling of interrupts. The card can actually run at 115,200 bit/s as well, using undocumented register settings; but speeds between 19,200 and 115,200 are not possible using this technique. The Super Serial Card was released in 1981 and utilizes the MOS Technology 6551 ACIA serial communications chip.

Manual: [Wayback] a2_Super_Serial_Card_user’s_manual.pdf via [Wayback/Archive.is] Apple II Super Serial Card – Google Search

Image:

Read the rest of this entry »

Posted in //e, Apple, Apple ][, History, Power User | Leave a Comment »

Some links for filing reports on address fraud in The Netherlands

Posted by jpluimers on 2023/07/21

Related to my earlier post  Finding a new energy supplier as the old one terminated our contract without notifying us:

The reason is that Liander confirmed to us that the energy contract on our address had been changed to be on someone else’s name, but refused to tell us any of this:

  • per which date the contract was switched
  • new supplier
  • new customer

We followed up via our legal insurance to get this solved, after instructed by them to file reports through the above channels.

Related:

–jeroen

Posted in About, LifeHacker, Personal, Power User | Leave a Comment »

Some JavaScript bookmarklets for WordPress published pages centered around navigation and IDs

Posted by jpluimers on 2023/07/20

Maintaining a blog takes considerable time, so I wrote a bit of JavaScript for the browser console and bookmarklets to help me navigate faster, especially from my published posts on wiert.me back to the WordPress editing environment.

I wrote this because a query like [Wayback/Archive] wordpress get id from post html – Google Search top hits only contain results that work within the WordPress environment itself, like for instance [Wayback/Archive] 14 Ways to Get Post ID in WordPress.

This blog post is long and contains a lot of information, so I have split it in quite a few sections.

Let’s get started:

Read the rest of this entry »

Posted in Bookmarklet, Classic editor, Development, Gutenberg editor, JavaScript/ECMAScript, Power User, Scripting, Software Development, Web Browsers, Web Development | Leave a Comment »

Buitenlandse trein/vlieg reizen vanuit Nederland zijn duurder dan via Nederland of geboekt via het buitenland

Posted by jpluimers on 2023/07/19

Eigen ervaringen om veel goedkoper uit te zijn:

  1. Boek je treinreis via een buitenlandse treinmaatschappij (www.bahn.de/angebot voor als je reis door Duitsland gaat) soms in twee delen (het land in en het land uit) die op elkaar aansluiten.
  2. Boek je vliegreis (met name KLM) vanaf het buitenland via Schiphol en maak voor de extra dag ervoor/erna een uitstapje.

[Wayback/Archive] Dezelfde rit, dezelfde trein naar het buitenland, maar bij de NS ben je duurder uit | RTL Nieuws

De nieuwe next.bahn.de site ondersteunt voorlopig alleen de Duitse taal, maar op de bestaande bahn.de site kun je daarnaast terecht in Tsjechisch, Deens, Engels, Spaans, Frans, Italiaans, Nederlands, of Pools.

Gerelateerd (later wanneer Archive Today weer Tweets kan archiveren komen de linkjes met archieven):

20230805 – twitter linkjes toegevoegd en deze gerelateerde tweet [Wayback/Archive] Andrea on Twitter: “@palpeet @DavidEerdmans @FemkevanH Je kunt je internationale treintickets(ook vanuit Nederland) in de meeste gevallen veel goedkoper vinden dan in Nederland als je dezelfde reis via Duitse, Oostenrijkse of Hongaarse spoorwegen boekt. Hier bijvoorbeeld. Even wat zoektijd investeren loont👉”

[Wayback/Archive] Super Sparpreis Europa: Günstige Bahntickets hier buchen – DB

20230919 – meer wees er bewust van dat de DB punctualiteit niet die van Zwitserland is en geregeld slechter (ja dat kan!) dan die van de NS is.

[Wayback/Archive] Kris: “Das alte Logo vom DB Navigator…” – chaos.social

Das alte Logo vom DB Navigator, aber es steht auf dem Kopf: Der ICE sieht nun aus wie ein schreiendes Legomännchen.

–jeroen

Read the rest of this entry »

Posted in LifeHacker, Power User | Leave a Comment »

APC SmartUPS Battery Float Voltage Calibration

Posted by jpluimers on 2023/07/19

For my link archive: [Wayback/Archive] APC SmartUPS Battery Float Voltage Calibration

It is my understanding that older BackUPS units could be adjusted with a potentiometer on the board. Calibration of newer models, and the SmartUPS line is factory set in the unit’s micro-controller. APC is of no assistance with units that are out of warranty. I’ve recently found information of how to recalibrate the battery float voltage through reprogramming the battery gain, and some information about modifying the UPS hardware, described below. I can’t take credit for discovering methods demonstrated, but hope it will be useful to another to have a coherent description.

Via:

Read the rest of this entry »

Posted in APC Smart-UPS, Development, Hardware Development, Power User, UPS | Leave a Comment »

@b0rk (Julia Evans): SPF & DKIM records

Posted by jpluimers on 2023/07/17

A nice zine by @b0rk (Julia Evans) [Wayback/Archive.is] SPF & DKIM records

And a few days later [Archive] 🔎Julia Evans🔍 on Twitter: “… looks like a really nice way to learn about SPF/DKIM (h/t @CubicleApril) you send it an email and it walks you through everything the receiver does to verify the email …” / Twitter which referred to

[Wayback/Archive] Learn and Test DMARC.

Related:

Via: [Archive] 🔎Julia Evans🔍 on Twitter: “SPF & DKIM records …” / Twitter (the original got deleted as it had a [Archive] typo)

–jeroen

Posted in DNS, eMail, Internet, Power User, SocialMedia | Leave a Comment »

On repeat: “ask information only once”;  Eenmalige uitvraag – NORA Online

Posted by jpluimers on 2023/07/13

Since the SVB PGB site keeps violating the [Wayback/Archive] AP12: Eenmalige uitvraag – NORA Online principle, some more emphasis on it as the usefulness of the “ask information only once” principle is not limited to government sites or commercial sites providing services for the government.

The principle “ask information only once” is valid for any site and needs to be present at all times, especially in these situations:

  1. when an authentication token is expired and re-authentication is needed
  2. when checking if authentication might have been expired and a page refresh is done during that check

I wrote about 1. in SVB PGB and DigiD security suddenly logged you out every 15 minutes despite the count down counter indicating otherwise ( wrote it in March 2021, published it in December 2021 when I thought it had been sort of solved).

That was obnoxious and took a very long time to fix (despite the mandatory aspect of the “ask information only once” principle and me pushing for a quick resolving in [Archive.isJeroen Wiert Pluimers on Twitter: “Omdat de @SVB_PGB site hiermee een noodzakelijk NORA archictectuur principe schendt (je raakt bij de logoff/logon de informatie die je op de pagina aan het invullen bent kwijt): kan dit een hoge prirotieit krijgen? Zie: – …”).

In February 2022, I had enough energy to submit the final PGB administration parts to the SVB PGB site. I didn’t get logged out every few minutes for the first hour or so (that only happened after being authenticated more than one hour, then repeating every 15 minutes), but I bumped into 2: loosing a lot of data in an at first unpredictable manner.

An underlying thing is that despite the NORA rules to be mandatory there is no sanction for the SVB (or any other government organisation) to fix this: users have to use the site and take the burden in order to get their payments. Ruurd Pels highlighted in these two answers to my tweets: harsh, but hitting the nail on the head:

The problem is that every each period of 15 minutes session activity , when you submit a form (the whole flow is form based, where the amount of data per form varies: sometimes just a confirmation button, sometimes a full month of data containing the hours worked) you get an intermediate quickly flashing “Redirecting…” on your screen, then loose the data entered in that form:

  1. [Archive] Jeroen Wiert Pluimers on Twitter: “Het NORA principe wat @StOnSoftware een jaar geleden noemde wordt weer door het @SVB_PGB geschonden. Het duurde even om te reproduceren, maar je verliest ongeveer elke 15 minuten je ingevoerde data. 1/” / Twitter
  2. [Archive] Jeroen Wiert Pluimers on Twitter: “Wat je dan ziet tijdens de submit (Verder, Opslaan) is een kort “Redirecting…” scherm op een willekeurige plek in de flow …, …, … In dit voorbeeld verlies je een maand aan invulwerk en is alles weer leeg. 2/ …” / Twitter
    Declaratie insturen - empty declaration showing you just lost a month of input

    Declaratie insturen – empty declaration showing you just lost a month of input

  3. [Archive] Jeroen Wiert Pluimers on Twitter: “Vorig jaar werd je nog elke 15 minuten uitgelogd en was het nog erger, zie … 3/” / Twitter
  4. [Archive] Jeroen Wiert Pluimers on Twitter: “en … Dat probleem zorgde er voor dat ik maar sporadisch declaraties instuurde, maar nu met een hele stapel declaraties is het probleem op een subtielere wijze nog steeds aanwezig. 4/” / Twitter
  5. [Archive] Jeroen Wiert Pluimers on Twitter: “Kunnen jullie dit laten fixen? Dank alvast. 5/5” / Twitter

After more than an hour, I bumped into 1 again:

  1. [Archive] Jeroen Wiert Pluimers on Twitter: “Oh @SVB_PGB: die bug van uitloggen na een kwartier bestaat nog steeds (zie …). Kreeg ik net in een uur tijd 3 keer. Na inloggen kom je wel weer in de flow, maar de data die je daar hebt ingevuld is dan verdwenen. A/ CC @EefvanKoos” / Twitter
  2. [Archive] Jeroen Wiert Pluimers on Twitter: “@SVB_PGB @EefvanKoos Ik vermoed dat beide te maken hebben met de sessie-duur van de active authenticatie van @DigiDwebcare omdat je in beide gevallen het “Redirecting…” stukje heel kort ziet verschijnen ofwel in het form of bij DigiD login beide met verlies aan data. B/B” / Twitter

[Archive] Stephan Eggermont (@StOnSoftware) / Twitter quote retweeted my initial message at [Archive] Stephan Eggermont on Twitter: “🧵 NORA heeft een aantal hele duidelijke principes om de burger niet te frustreren. Niet twee keer naar hetzelfde vragen geldt ook als je een sessie time-out. Dan moet je dus al ingevulde gegevens bewaren” / Twitter, which translated is

🧵 NORA has a number of very clear principles in order not to frustrate citizens. Not asking for the same thing twice also applies if you time out a session. Then you have to save already entered data

An introduction about NORA is at Nederlandse Overheid Referentie Architectuur – Wikipedia:

Nederlandse Overheid Referentie Architectuur of NORA is het interoperabiliteitsraamwerk voor de Nederlandse overheid en vertaalt daartoe wetgeving, beleid en standaarden naar architectuurprincipes, beschrijvingen en modellen. Het is een beschrijving van uitgangspunten voor het inrichten van de informatiehuishouding van de Nederlandse overheid. NORA is relevant voor de uitvoering van alle publieke taken door publieke en private organisaties.

[Wayback/Archive] NORA: Nederlandse Overheid Referentie Architectuur – Bluefrog has a way easier “table of contents” to the principles than the NORA online site (note that some document numbers are intentionally not used):

DE TIEN BASISPRINCIPES VAN NORA

  1. [Wayback/Archive] BP01: Afnemers krijgen de dienstverlening waar ze behoefte aan hebben.
  2. [Wayback/Archive] BP02: Afnemers kunnen de dienst eenvoudig vinden.
  3. [Wayback/Archive] BP03: Afnemers hebben eenvoudig toegang tot de dienst.
  4. [Wayback/Archive] BP04: Afnemers ervaren uniformiteit in de dienstverlening door het gebruik van standaardoplossingen.
  5. [Wayback/Archive] BP05: Afnemers krijgen gerelateerde diensten gebundeld aangeboden.
  6. [Wayback/Archive] BP06: Afnemers hebben inzage in voor hen relevante informatie.
  7. [Wayback/Archive] BP07: Afnemers worden niet geconfronteerd met overbodige vragen.
  8. [Wayback/Archive] BP08: Afnemers kunnen erop vertrouwen dat informatie niet wordt misbruikt.
  9. [Wayback/Archive] BP09: Afnemers kunnen erop vertrouwen dat de dienstverlenerzich aan afspraken houdt.
  10. [Wayback/Archive] BP10: Afnemers kunnen input leveren over de dienstverlening.

DE 38 AFGELEIDE PRINCIPES

  1. [Wayback/Archive] AP01: Diensten zijn herbruikbaar
  2. [Wayback/Archive] AP02: Ontkoppelen met diensten
  3. [Wayback/Archive] AP03: Diensten vullen elkaar aan
  4. [Wayback/Archive] AP04: Positioneer de dienst
  5. [Wayback/Archive] AP05: Nauwkeurige dienstbeschrijving
  6. [Wayback/Archive] AP06: Gebruik standaard oplossingen
  7. [Wayback/Archive] AP07: Gebruik de landelijke bouwstenen
  8. [Wayback/Archive] AP08: Gebruik open standaarden
  9. [Wayback/Archive] AP09: Voorkeurskanaal internet
  10. [Wayback/Archive] AP10: Aanvullend kanaal
  11. [Wayback/Archive] AP11: Gelijkwaardig resultaat ongeacht kanaal
  12. [Wayback/Archive] AP12: Eenmalige uitvraag
  13. [Wayback/Archive] AP13: Bronregistraties zijn leidend
  14. [Wayback/Archive] AP14: Terugmelden aan bronhouder
  15. [Wayback/Archive] AP15: Doelbinding (AP)
  16. (AP16 is intentionally missing: merged into AP17)
  17. [Wayback/Archive] AP17: Informatie-objecten systematisch beschreven
  18. [Wayback/Archive] AP18: Ruimtelijke informatie via locatie
  19. [Wayback/Archive] AP19: Perspectief gebruiker
  20. [Wayback/Archive] AP20: Persoonlijke benadering
  21. [Wayback/Archive] AP21: Bundeling van diensten
  22. [Wayback/Archive] AP22: No wrong door
  23. [Wayback/Archive] AP23: Automatische dienstverlening
  24. [Wayback/Archive] AP24: Proactief aanbieden
  25. [Wayback/Archive] AP25: Transparante dienstverlening
  26. [Wayback/Archive] AP26: Afnemer heeft inzage
  27. [Wayback/Archive] AP27: Een verantwoordelijke organisatie
  28. [Wayback/Archive] AP28: Afspraken vastgelegd
  29. [Wayback/Archive] AP29: De dienstverlener voldoet aan de norm
  30. [Wayback/Archive] AP30: Verantwoording dienstlevering mogelijk
  31. [Wayback/Archive] AP31: PDCA-cyclus in besturing kwaliteit
  32. [Wayback/Archive] AP32: Sturing kwaliteit op het hoogste niveau
  33. [Wayback/Archive] AP33: Baseline kwaliteit diensten
  34. [Wayback/Archive] AP34: Verantwoording besturing kwaliteit
  35. (AP35 is intentionally missing: superseded by AP41)
  36. (AP36 is intentionally missing: superseded by AP41)
  37. (AP37 is intentionally missing: superseded by AP43)
  38. (AP38 is intentionally missing: superseded by AP43 and AP42)
  39. (AP39 is intentionally missing: superseded by AP42)
  40. [Wayback/Archive] AP40: Onweerlegbaarheid (principe)
  41. [Wayback/Archive] AP41: Beschikbaarheid
  42. [Wayback/Archive] AP42: Integriteit
  43. [Wayback/Archive] AP43: Vertrouwelijkheid (principe)
  44. [Wayback/Archive] AP44: Controleerbaarheid

The missing numbers (see also [Wayback/Archive] Betrouwbaarheid – NORA Online, [Wayback/Archive] Vervangen of Vervallen elementen in NORA – NORA Online and [Wayback/Archive] Vervangen of Vervallen uitspraken in NORA – NORA Online):

For a management overview, see [Wayback/Archive] NORA (Nederlandse Overheid Referentie Architectuur) – Digitale Overheid.

–jeroen

Posted in Authentication, Development, DigiD, Power User, Security, Software Development, Web Development | Leave a Comment »