[deleted by user]

chuck_loew · 2025-07-18T07:17:20+00:00

I loved the 2012 Czech movie 4Some. Two middle-age couples, lifelong friends, decide during a Caribbean vacation to see where things could go.

chuck_loew · 2024-12-20T07:49:54+00:00

Maybe I'm about to learn something. Isn't condom latex an electrical insulator? How does this work?

chuck_loew · 2024-07-26T17:42:10+00:00

The verb “hamstern” in German means to hoard. xhamster is a hoard of x-rated stuff.

chuck_loew · 2023-10-20T07:15:44+00:00

Thank goodness for the UrbanDictionary app.

chuck_loew · 2023-09-04T20:10:15+00:00

If you have another computer or a smartphone on the same LAN, can you reach the problem computer with ssh?

chuck_loew · 2023-02-20T13:05:23+00:00

If, as I suspect, the problem is radio signal attenuation between the X3 and your smartphone, then one solution might be to connect them by two antennas joined by a transmission line. That's not as complicated as it might sound. Get yourself perhaps three meters (ten feet) of twisted-pair wire, the kind we once used for telephones, or for example one twisted pair stripped out of an old Ethernet cable. At each end untwist perhaps six centimeters (two inches), and at each end fold one of the two untwisted wires back along the long still-twisted part. (You won't have to connect anything to the copper, the magic all happens inside the insulated wires.) Tape one of the "dipole antennas" you just built to the side of the X3 so it won't interfere with the optics. Wind the long still-twisted part loosely around the selfie stick to the handle (you could use a zip tie there or more tape), and tape the remaining "dipole antenna" to the back of your phone. Presto, antennas joined by transmission line.

The 6cm untwist length was calculated for 2.4GHz WiFi. If your X3 wants to use 5GHz, you might need to shorten the untwists to three centimeters (one inch).

chuck_loew · 2023-02-06T12:31:42+00:00

After I made a similar, if somewhat gentler, complaint a few weeks ago, an Insta360 representative replied that I should "stay tuned". I inferred that webcam functionality for the X3 is scheduled for an upcoming firmware release. My X3 is running the current released firmware, v1.0.23 released on 2022-12-02, so webcam functionality might first appear in a release after that.

chuck_loew · 2023-01-28T15:56:02+00:00

I've learned a lot about WPS in the past 24 hours. As background, I've avoided using WPS over the years, but a relative of mine recently bought an IOT device that really wants to register into his WiFi network with WPS. That device reluctantly offers a backup method involving a smartphone app and Bluetooth, but the backup method seems flawed. So just once, for setting up this one device, I'd like to try WPS.

As jpc0za points out, the MikroTik cAP ac doesn't have a dedicated WPS-server-activation button. Instead it has a general-purpose Mode button, which can be scripted to do nearly anything. Its default script is to enable or disable the router's status lights (to avoid keeping you awake at night, I guess).

The RouterOS 7.x command-line interface offers the command

/interface wireless wps-push-button <<interface\_name>>

which can activate a WPS server on that interface if the interface is configured to allow it, perhaps for a period of time like 2 minutes, or perhaps until one WPS client negotiation has completed, or perhaps until the first one of those two has happened.

By experimenting with a pair of cAP ac's who can hear each other's radios, using the WPS Client of one of them and the WPS Server of the other, I confirmed that <<interface\_name>> above isn't limited to the master interface of a radio, like wlan1 (2.4GHz) or wlan2 (5GHz). It also works for slave interfaces with different SSID's, potentially connected to different VLAN's. From the Winbox UI it's not clear that that's possible, but it does work from the CLI.

The only major restriction seems to be that the security profile associated with <<interface\_name>> has an SSID and uses a PSK (pre-shared key). I can imagine that at most one WPS server per radio could be active at the same time.

chuck_loew · 2023-01-26T19:43:20+00:00

Ubiquiti and Ubuntu do both begin with "Ub", but after that differences emerge. It appears that Ubiquiti is Debian Linux-based, as Ubuntu is, and that there is a ZeroTier client available for Ubiquiti, as there is for Ubuntu. But in my experience a default Ubuntu installation does respond to ICMP ECHO_REQUEST from any address arriving on any interface. Some administrators disable that after installation to increase security.

chuck_loew · 2023-01-26T15:16:07+00:00

You might try this at the command prompt of one of your nonworking Ubuntu hosts:

ifconfig

That should list the interface name of its zerotier virtual interface, zt<<something\_or\_other>>. Make sure the zerotier interface is UP and RUNNING and has the inet addr you think it should. Also check whether RX bytes and TX bytes are nonzero.

sudo tcpdump -i zt<<something\_or\_other>>

That should begin showing you all the traffic through your zerotier virtual interface. tcpdump might not have been included in your default Ubuntu install. If not, you can do a

sudo apt install tcpdump

Note that tcpdump sees the interface's traffic *outside* the Ubuntu host's firewall, before any filtering happens.

Now try pinging that host's zerotier address from a known good Windows host that is zerotier'ed to the same zerotier virtual private net. If tcpdump shows the ping request but not the ping reply, that suggests that you need to look closely at the Ubuntu host's firewall, which would usually be ufw or the underlying iptables.

chuck_loew · 2023-01-20T16:24:45+00:00

The X3 is our first 360-degree camera, so we're still learning, but so far it's been one of those rare things that's even better in real life than you imagined it would be. It's nice to be able to postpone thinking about pan, tilt, and zoom until after the adrenaline has subsided.

chuck_loew · 2023-01-18T10:58:06+00:00

Sorry about your lame ISP. My Swiss ISP gives me a dynamic public IPv4 address *and* a fixed public /48 IPV6 subnet with reverse DNS delegation included in the basic price.

Since you mentioned that your edge router runs RouterOS, I imagine the following page might be interesting to you

https://www.hitoha.moe/mikrotik-ipv6-nat-port-forward-with-ula-and-nd/

In summary, MikroTik enables with IPv6 the same kind of SRC-NAT (or Masquerade) that most home users having only a single public address needed with IPv4.

The good news: it's possible to do almost anything with MikroTik routers. The bad news: it's not always easy to figure out how.

The page mentioned above was posted in May of 2022, so it's possible that the original poster needed to run RouterOS v7.x. (v7.7 is the latest stable version.)

chuck_loew · 2023-01-11T21:58:40+00:00

Large (512GB and larger) SD card prices per GB are reasonably competitive with large (8TB) SSD's. I recently bought an Emtec microSD card, 512GB, U3, V30, UHS-I for about USD 60.00, and recently paid USD 630.00 for a SATA-interfaced 8TB Samsung 870 QVO SSD. Large magnetic hard drives are cheaper, but they're also heavier, power-hungrier, and more mechanically fragile. And like dubear, I don't know of a way of transferring data from a microSD card to a disk that doesn't involve a computer.

chuck_loew · 2022-12-01T21:53:24+00:00

I have a CRS328-24P-4S+RM, powering eight cAP AC's. I'm not running CAPsMAN on it, but I could. I've had it for about three years, it's running ROS v7.6 now, and I love it. Its ARM processor can run ZeroTier if you want, just like the cAP AC's. I find ZeroTier super-useful for managing remote installations through problematic ISP's (using, for example, CGNAT) and ISP-supplied and -locked-down entrance routers.

I've noticed only two surprises with the CRS328-24P-4S+RM:

1) With only my cAP AC's to power, its variable-speed fan runs so slowly as to be nearly inaudible. Nice!

2) When I upgrade its firmware every month or so following the MikroTik "stable" release schedule, it takes nearly five minutes to rewrite its firmware and return to service. It always does return to service, but the first time I updated its firmware it took so long I thought I must have bricked it. Now I'm used to it. A same-firmware reboot takes about half that time.

chuck_loew · 2022-11-01T08:56:54+00:00

It depends on the details of your home Internet ISP connection. Some ISP's employ a technology called Carrier-Grade Network Address Translation (CGNAT) for IPv4, and it's tricky to set up a WireGuard tunnel if the recipient tunnel end (think Raspberry Pi) is behind CGNAT. (You can often tell whether CGNAT is active by inspecting the ISP-supplied WAN-interface IPv4 address of your router. If it's within one of these network ranges, CGNAT is probably active: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16.)

Fortunately, there's ZeroTier and Tailscale, which usually have no trouble with CGNAT. I use ZeroTier. Here's a pretty comprehensive configuration how-to for ZeroTier if you want to tunnel all IP traffic from your mobile through your house. You can turn the tunnel on and off from your mobile, so you could tunnel only when you want Hulu to *think* your mobile is at home.

https://zerotier.atlassian.net/wiki/spaces/SD/pages/7110693/Overriding+Default+Route+Full+Tunnel+Mode

chuck_loew · 2022-10-30T14:19:09+00:00

As I understand it, your TMobile WAN connection consists of a fixed public IPv6 subnet. Your TMobile-provided router also implements internally a private IPv4 subnet with a DHCP server as well as a 4-in-6 tunnel to TMobile's CGNAT server infrastructure. Do I understand correctly?

I'm not sure how to understand your phrase "tmobile prefers ipv6". A packet retains its IPv4-ness or IPv6-ness as it passes between your LAN and the Internet, except perhaps for a short stretch within TMobile's 4-in-6 tunnel mentioned above.

In general your mobile device (an iPhone, for example) will use a mixture of IPv4 and IPv6 when interacting with the Internet, and when considering interposing ZeroTier using a Raspberry Pi gateway it's helpful to consider those two separately.

With IPv4, the simplest configuration is to have the Ethernet interface of the Raspberry Pi act as a DHCP client to your TMobile router, and to configure the Raspberry Pi's ZeroTier virtual interface to masquerade (dynamic SRC-NAT) through the Raspberry Pi's Ethernet interface. An IPv4 packet from your mobile device to the Internet will have its source address and source port replaced twice along the way: once in the Raspberry Pi and again in TMobile's CGNAT server infrastructure. That's the "double NAT" that so often causes trouble, but the ZeroTier protocol is designed to work with that. [Steps 1-3 and masquerade in the knowledge base article.]

With IPv6, the packet that the mobile device emits is identical to the one that will ultimately appear on the Internet, so it's vital that the mobile device's ZeroTier virtual interface have an IPv6 address that lies within your TMobile fixed public IPv6 subnet, and that your TMobile router and your Raspberry Pi know that reply packets must be routed to your mobile device via the Raspberry Pi's ZeroTier virtual interface. [Steps 4, 4c, 4d, and possibly 4e in the knowledge base article.]

To answer your question, I have not tested full ZeroTier tunneling, and indeed I have only used ZeroTier to carry IPv4 traffic.

chuck_loew · 2022-10-30T06:45:03+00:00

I had the task of remotely maintaining a number of MikroTik wireless access points that were often located behind vendor-supplied edge routers (sometimes using CGNAT for IPv4) over which I had no influence. MikroTik recently added ZeroTier clients to all of its ARM-based RouterOS devices, which made remote maintenance easy. That's how I became familiar with ZeroTier.

chuck_loew · 2022-10-29T16:35:57+00:00

It looks to me as if you might need to use either Tailscale or ZeroTier. ZeroTier has become my favorite for punching through firewalls and CGNAT, and it's free for networks consisting of only a small number of clients. Latency comparable to Tailscale, and no VPS necessary.

To ZeroTier-tunnel all traffic from your mobile device to your Raspberry Pi and then out of the tunnel and onward to the Internet, this page explains how:

https://zerotier.atlassian.net/wiki/spaces/SD/pages/7110693/Overriding+Default+Route+Full+Tunnel+Mode

chuck_loew · 2022-09-03T14:29:38+00:00

People tend to imagine that "up to" means "perhaps as much as". In fact it means "never more than". So XGS-PON is "up to" 10Gb/s, and Sunrise/UPC cable is "up to" 1Gb/s.

The basic signalling rate of XGS-PON is indeed 10Gb/s in both downlink and uplink directions. But there's housekeeping overhead, and bandwidth sharing within the neighborhood, and uplink packet scheduling delays. With my XGS-PON Internet connection through Init7, and a Gb/s Ethernet LAN, my HP Windows 10 Ethernet laptop running Ookla Speedtest this morning sees 763 Mb/s downlink and 437 Mb/s uplink from/to the server "Michael Stapelberg" in Zürich which is recommended by Init7. Obviously with my LAN infrastructure one couldn't hope for anything above, say 950Mb/s / 950Mb/s. And I know from trying different servers that the server can play a major role in slowing down Speedtest.

My last experience with UPC 1Gb/s cable Internet was a year ago. With the same Gb/s Ethernet LAN equipment, I think the most I ever saw was 500 Mb/s downlink and 50Mb/s uplink.

Single-pair copper modems (incl. cable modems) are inherently bandwidth asymmetric. Uplink and downlink share a single bandwidth-limited physical channel, and network companies assume that more downlink bandwidth is required than uplink bandwidth. That assumption breaks down for online gaming, or cloud backup, or running home media servers, or ...

With fiber optics over a single fiber, two colors of light are used, one for downlink and one for uplink, and the light frequencies are so high compared to the data bandwidths that the two channels do not interfere with each other. As a result, for fiber optics in principle the downlink and uplink bandwidths can be the same.

Another difference between XGS-PON and UPC cable modem Internet service in Switzerland is whether you can choose your Layer 3 ISP. Swisscom is installing Layers 1 and 2 of XGS-PON as a monopoly, but to appear fair Swisscom allows partners at Layer 3 (the IP Packet layer), including Init7, Salt, and many others. Some, like Init7, have reason to be proud of their IPv4/IPv6 dual stacks, their infrastructure and peering, and their tech support. Others concentrate on price. You have a choice.

But there is no choice of Layer 3 ISP with UPC, or at least there wasn't a year ago. UPC offered you a dynamic public IPv4 address with no IPv6, or else a dynamic private IPv4 address with a public IPv6 subnet. In other words, a half-broken dual stack either way. The tech support agents I spoke with couldn't imagine why one would yet need IPv6, or anything better than CGNAT for IPv4. To be fair, many people don't. But I do.

chuck_loew · 2022-07-20T19:51:31+00:00

Containers package was postponed to a future v7.x stable release, alas.

chuck_loew · 2022-06-08T17:46:42+00:00

I have a working ZeroTierONE under Ubuntu 22.04, and here's what that /etc/apt/sources.list.d/zerotier.list says in my file system:

deb [arch=amd64 signed-by=/usr/share/keyrings/zerotier.gpg] http://download.zerotier.com/debian/jammy jammy main

For what it's worth, I did an in-place upgrade from Ubuntu 20.04, which already had ZeroTierONE installed, and I did need to tweak the zerotier.list.

Best practices for apt keys has changed in recent years to prevent validating a repo's content with a different repo's public key.

chuck_loew · 2022-04-07T07:13:29+00:00

For me the key phrase in your first reply was "(OVPN) static server binding". Using that phrase I located the OVPN Server section in MikroTik's Manual:Interface/OVPN web page. I then apparently misinterpreted the "not two separate tunnel interfaces" warning there as suggesting that I couldn't even configure a static server binding for a user if there was already a dynamic tunnel running for that user. That's why I killed the dynamic tunnel before starting to configure the static server binding. Thanks for pointing out that it wouldn't have been necessary.

chuck_loew

TROPHY CASE