Matthew Ernisse

November 25, 2018 @23:40

I know it's not particularly uncommon for web sites these days to drastically change things and in fact most people consider this a feature. The fail fast mentality is great and all except that it means you are often failing more than not and the general consensus seems to be that it's perfectly acceptable to do it in public to the detriment of your users.

More (17%) …

November 07, 2018 @23:30

A little over six and a half years ago I left the Linux as a desktop community for the Mac community. I replaced a Lenovo Thinkpad T500 for an Apple refurbished late 2011 MacBook Pro and honestly have not regretted it.

More (5%) …

November 06, 2018 @13:40

It's probably too late to change anyone's mind, but I saw a particularly salient Twitter come across this morning.

More (12%) …

Edited: August 15, 2019 @21:00

Getting Started

Tor in Containers

I have been looking for reasons to try Docker on one of the random stack of un-used Raspberry Pis that I have laying around and thought it might be fun to build a little travel router. Somehow that morphed into lets get Tor working on here and then well if I can get a client, and a relay, why not an onion service?

More (4%) …

September 27, 2018 @11:30

I was making some firewall changes last weekend and while watching the logs I discovered that every now and then some host would try to connect to on port 80. This was peculiar since I don't use the IPv4 link local addresses anywhere in my network. It seemed to be happening randomly from all of my Linux hosts, both physical and virtual.

More (9%) …

September 16, 2018 @15:00

I installed one of the Mojave public betas last week on the Mac Mini I have in the office. I used it as an excuse to finally tweak a script I wrote for customizing macOS out of the box.

More (10%) …

September 15, 2018 @16:40

For a while now I've used a Yubikey Neo as a PIV card to authenticate to my public facing hosts. This is fairly straightforward but requires a host with OpenSC on it. In my .profile I have a function called add_smartcard which will add the PIV driver to the ssh-agent. This means I actually authenticate with the key that was generated in the Yubikey and not my password.

More (11%) …

Edited: September 04, 2018 @23:30

So, I mentioned a while back that I watch Acquisitions Inc on the yubtubs. Well through there I also started watching Dice, Camera, Action. During the Stream of Many Eyes event there was a DCA episode featuring Travis McElroy and that reminded me of the fact that I have had The Adventure Zone languishing away on my iPhone for a while now, un-listened to. Now I'm pretty terrible about keeping up with podcasts (there is so much good stuff out there to listen to and watch these days) so I just wanted to toss out a few words about what happened next.

More (27%) …

September 02, 2018 @12:45

Recently I had a rental VW with the fancy new radio in it and I figured I'd give CarPlay a shot.


More (66%) …

August 29, 2018 @09:20

I've been stewing about this for a while and have not yet found an alternative so this is part rant part dear lazyweb plea.

More (7%) …

August 27, 2018 @17:10

For a long time now the core of my ad blocking strategy has been squid and privoxy running on my OpenBSD routers. Mobile devices VPN into the network and receive a proxy.pac which routes all traffic to these proxies which reject connections to known ad hosts. With the growing adoption of HTTPS (thankfully) privoxy is becoming less and less useful so I have been trying to find better ways to block ads at the networking level.

More (11%) …

August 26, 2018 @11:30

iPictureFrame and XCode

I know I'm not 'average' when it comes to my opinions about technology. I imagine this has to do with growing up with technology that was much more simplistic than it is today. Compared to modern software and hardware the NEC PowerMate 286 running DOS 6.0 that I learned to program on was extremely simple. Not that it wasn't powerful, but it didn't have any designs to hide things from you. You had access to the hardware directly, and all the memory, and all the peripheral I/O space. You were able to completely control the system, and even understand exactly what was going on.

More (16%) …

August 25, 2018 @12:00

UniFi Switches in the NMS

Since I installed the first bits of the Ubiquiti UniFi family of products in my network I have been impressed. They have never failed to meet my expectations. I have written several articles about some rather advanced configuration and implementation details:

More (10%) …

July 25, 2018 @20:00

UniFi Security Gateway in the NMS

A couple days ago I wrote a bit about setting up a new Ubiquiti UniFi Security Gateway, and after living with it for a bit I have a few additional notes.

More (14%) …

July 20, 2018 @16:45


I have several physical locations linked together with VPN tunnels. The central VPN server runs OpenBSD with iked(8). I also have several roaming clients (iOS and macOS) that terminate client access tunnels to this system so I am loathe to make breaking changes to it. The site to site tunnels run a gif(8) tunnel in IP-over-IP mode to provide a layer 3 routable interface on top of the IKEv2 tunnel. My internal tunnels run ospfd(8) and ospf6d(8) to exchange routes and my external site to site tunnels run bgpd(8). Most of my internal sites use OpenBSD as endpoints so configuration is painfully simple, however in my office at work I have been using a MikroTik RouterBoard RB951-2HnD. This has worked well enough but lately it has been showing its age, randomly requiring manual intervention to re-establish tunnels and flirting with periods of unexplainable high latency.

More (18%) …

Subscribe via RSS. Send me a comment.