petermolnar.net

I've done this a little while ago as well. Most new Pi projects are scaled for Pi 4 or 5, my old 3Bs were struggling a lot.

I built a streamer at one point with PiDAC and all, only to realise that using NFS on a Pi over WiFi is bad and the web UI of eg. Volumio is unusable on a local display.

I had stability issues when I tried to use it for home automation because the zigbee USB stick ate enough power to crash it multiple times.

The one thing it was fine for, back a decade ago, is an infrared streaming camera, but that since have been long superseeded by better options.

On the other hand, my Lenovo M600 Tiny boxes are tanks, and while I wore an SSD out in one of them, there's absolutely no stability, heat, etc issue with any of them.

I turned 41 in March, and for my birthday, I got a fantastic gift: to go to Gran Canaria for 5 days, and have a rest in April. It’s interesting how, among many other things, the definition of "rest" morphs as our life progresses, as our situation evolves. Nowadays my main enemy is the need for constant focus and context switching, so the idea of rest is quite simple: I don't have to pay attention unless I want to. This is exactly what I got from this trip - that, and that sometimes there's less need for planning ahead.

Day 1 : arriving

Upon browsing for a place to stay at, my wife spotted something in the mountains: a literal cave house, Cueva las Nubes¹. At first I thought it's a novelty, but once I was there it turned out it's the indigenous way of living².

This one I stayed in was extended, as many others - added roofs and frontal space. It's nice from the perspective of a house, it's much less nice from the perspective of relentless condensation. It turns out the caves needed a certain way of ventilation to prevent this, and this house doesn't have the natural flow any more. Modern solutions, such as dehumidifiers, should be added, otherwise the caves tend to get musty and mouldy in absolutely no time. If the owner is reading this: please consider a smart dehumidifier that runs when needed, because it does smell a bit moldy and musty in there. Not unlike some British houses though.

Apart from this, the place is fantastic. The view is insane; what the clouds cover is the airport itself, meaning the cueva can be seen from the runway.

The surprise cat

We have 2 cats at home, neutered males both, one silent killer, one retarted loudmouth, and we love them both. So when a skinny, seemingly feral cat showed up at the cave demanding it's share I realised the place had cat food and pet feeding pots. Apparently there are more cats around, I got to meet 4 of them in the end, and they supposedly belong to the shepherd on the other side of the hill. They don't want to be petted at all.

Day 2

The plan: go to see the pine forest close to me, then to go to Teror, see the town, and buy food. The first part went well, the second taught me lessons.

Pico de las Nieves

The Canary Islands host pine forests, with pines native and unique to these islands. What's incredible about them is how wonderful they smell when the sun hits them and they get warm. It's like the nicest smelling sauna, a forest of aromatherapy. I fell in love with this and the feeling it generates the moment I first experienced it, and I wished to experience it again, so my first trip was towards where the pines are.

On Gran Canaria there are two main areas of this: the forests around Pico de las Nieves and around Tamabada. My cave was closer to the first, so that's where I headed. I wasn't expecting the military complex on the top of the mountain, but that didn't prevent me from having a nice hike after parking in the completely empty parking spot.

Except...

I took a wrong turn, and moved away from the restaurant I was trying to head for - which brings me to the problem of food. I keep forgetting that there are still places in the world where most stores close for Sunday, and where there isn't some kind of takeaway or restaurant open at basically any time of the day, meaning I came a bit underprepared with food.

When I got back to the parking spot it was swarming with people and cars, including a food van - foolishly I decided I'd rather get back in the car, go to see Teror, a village famous for it's beauty, and eat something there.

To Teror or not to Teror

On my way I went through a village called Lanzarote - yes, the same name as one of the other islands, one that I like a lot, so I stopped to eat at the local restaurant. I went for fish, so you don't have to. Fresh fish around the docks is great; not completely fresh fish in the mountains is not. I made this mistake one more time, believing it was the place, but no; it's truly not worth it.

I continued to Teror.

Except...

The next part of the road didn't go as planned: a few kilometers from Teror the only road going there had a police closure. A half-size car and two plastic barriers, blocking the road. After spending some time, looking for options, I gave up, decided to turn around, and head to Maspalomas.

I stopped in Tejeda, given how the tour books rave about it. It's pretty, but I didn't feel anything special, and continued.

Except...

The rest of the trip didn't happen. The last 4 kms (sic) to Maspalomas from the mountains was stuck in a traffic jam.

I ended up turning around, slightly panicking on food for that night and the day after as started the drive back. Eventually I spotted another food van - in a parking lot that is closed to cars... At that point I gave up, put the indicators in blinking, and left the car on the road, and got some oranges and a bocadillo.

I drove 6-7 hours and getting nowhere. I should have headed back to my pine forest when the road to Teror was closed. The lesson of the day was to stop forcing things: sometimes the solution will present itself. This theme kept resonating, so maybe it's what I have to take away.

Day 3

About a decade ago my sister and her spouse went to Grand Canaria and I told them to go to the coffee plantation. Sadly they couldn't, and by the time I was preparing for my trip, I completely forgot about them myself. And then suddenly the memory came back from nowhere, so I had a very clear plan that I want to go to the coffee plantations.

The plan: going to Agaete and swimming in the ocean. This quickly went up in petrol fumes: both roads leading not into the mountains from of my place were closed till mid afternoon due rally.

Barranco de Guayadeque

So far my trip didn't look relaxing, but some days before my wife spotted a crafts shop not far from me - not far in direct line. Google, which has streetview on the very track itself doesn't recommend the short one for hiking, but openstreetmaps does:

Being "trapped" on the mountain turned out to be great. The trail is part road, part dirt, and is not hard to walk. I left rather early, meaning I didn't meet anyone for a while, only to be surrounded by the loud buzzing of bees and other insects.

The valley is serene, and it"s one of the main areas for cave houses.

I tried to capture the insect buzzing that surrounded me, probably without luck:

Dunes de Maspalomas

After getting back from the small hike I realised there was plenty of time left from the day, so I attempted Máspalomás again. Well...

The dunes are beautiful. That is if you're able to spot any piece without an asshole tourist playing the center of the universe, ignoring all signs, and walking into them. This is especially true for entitled Asian wannabe influencers.

What sort of destroyed it all was that to access the dunes I had to go through a hotel complex that is practically the entrance to the view. I understand it's a tourist attraction but it's a bleak, stark contrast compared with the seclusion and serenity of the mountains.

Day 4

This day went as planned - with the plan I had for the day before. And it was a bit chilly for swimming, but it didn't stop me.

Agaete Valley

I entered Agaete with no expectations. If it really was just a coffee plantation, and I had a good coffee, I would have been happy. And it turned out for the best: this place is incredible. It has a ringing serenity to it, one that I so rarely found anywhere. With the grey clouds sitting right on top of the surrounding mountains it was even more peaceful.

I spent most of the day just wandering around after the morning coffee taste. I didn't book anything, so when they asked if I want the tour or just the taster, I went for the taster - only to change my mind when more people arrived, and they were so nice about it all, no fuss, no nothing. Shout out to Ruben and James, given your coffee interest; Finca los Castaños³ has absolutely marvellous, kind coffee, in case you find yourself on Gran Canaria. There are many other tiny coffee plantations, but I didn't have the chance to taste those yet.

Agaete Piscina Natural

I wanted to swim somewhere, but in April, it's not that trivial (or safe, see below), but natural/semi natural pools can always help. It was certainly a new experience to swim while the locals and the Spanish were standing next to me in jackets and coats.

Day 5

Before the flight home I first visited a local arboretum, but it wasn't really worth it, as the more interesting parts were closed up. I also went into the old town of Las Palmas. It's pretty and it has some very nice little shops, but finding a parking spot was challenging.

Lastly I went out to the shores to say bye to the ocean.

Summary

Go to Agaete and the mountains.

Skip the tourist zone.

The universe will provide if you're willing to be flexible.

And if you keep to yourself for a few days the brainfog will finally lift.

I wasn't able to get to the source of the waterfall, so I was left with enjoying watching it fading in/out of the mist.

I was quite lucky with the weather in Agaete: while a bit wet, but this kind of weather, somehow, helps with staying calm and relaxed when you're surrounded with lush greens and cloud-covered mountains.

tl;dr: https://code.petermolnar.net/ngx-http-blocklistd

I wrote about having fun with bots and scapers before that I brought upon myself by having nepenthes added to my server¹. As things currently stand, unless you want to or can afford A LOT OF traffic, you shouldn't do what I did.

Anyhow, now that all the links are removed from everywhere it means that there's a certain path prefix that I know 100% sure it's nasty bot traffic and I'd be happy to block the IP immediately if it ends up there.

The last time I tried fail2ban, my CPU got overloaded. I then tried blocking at ASN level², but I regularly ended up blocking M$, Google Cloud, and other things, eventually blocking some of the indieweb tooling³ from accessing my site with that blast radius.

I have turned to blocklistd⁴ (formerly called blacklistd) for blocking SSH and Postfix attempts, because it has it built in. It's a (Net)BSD security tool that listens on a socket for messages with IPs to be blocked by your firewall. In a sense it does the same job as fail2ban, but with much less overhead: it doesn't need logs to be writter, logs to be read and parsed, and it's written in C.

The nginx module that communicates to blocklistd didn't exist, so I decided to write it. The end results looks way simpler, than finding the resources were, but these were quite helpful:

• Emiller’s Guide To Nginx Module Development https://www.evanmiller.org/nginx-modules-guide.html
• Learning a new codebase: hacking on nginx https://notes.eatonphil.com/learning-a-new-codebase-hacking-nginx.html
• nginx Development guide https://nginx.org/en/docs/dev/development_guide.html
• A Guide to: NGINX Error Logs https://trunc.org/learning/everything-you-dont-need-to-know-about-nginx-error-logs
• nginx-dev-examples https://github.com/nginx/nginx-dev-examples/tree/main/hello_world_1
• ssh diff in blacklistd source https://github.com/paul-chambers/blacklistd/blob/trunk/diff/ssh.diff

It is now working and I'm testing how far I can take it. For what it's worth, I'm not going back to the endless AI poison maze experiment, because I can't afford to jeopardise that level of traffic on my home connection, but I will most likely put honeypot links back soon.

Somewhere in '98 or '99 I fired up ICQ for the first time. Take it into account that I was living in Hungary, a 14 years old boy, and while I was learning English since I was 6, the teaching methods in Hungary focus on grammar and not real life skills, meaning I was lagging 5-10 years behind American and British trends. By the way, this is still the case with a lot of Hungarians. It was incredible. I was able to search for people based on interest keywords, age, and so on. Back then not everybody lied all the time and practically everyone was allowed on everything. This meant both wonderful and atrocious websites, but that is for another day. You were able to message everyone out of the blue without worrying about spam filters or friend requests.

The internet, at that point, felt like another world, a place where you were able to surround yourself with the people you longed for, not with the ones fate threw at you in school. A place to retreat to.

It took me 20 more years to even learn about BBS systems, those never reached Hungary. It must have been incredible to live through the BBS era. "BBS: The Documentary"¹ is a fantastic watch.

Soon I made a website, and it felt like a significant achievement: it was mine, I actually crafted it, it looked the way I wanted it to look, and so on.

It looked like we were going towards a world with a fantastic, useful internet.

In the beginning of 2012 we made a trip to Ireland and England, and many of the amazing places we visited we found using Panoramio² on Google Maps. The Dark Hedges³, for example, much before it got featured on Game of Thrones. Without Panoramio I never could have discovered those locations, and since it's shutdown, it became quite hard again.

In the same year, the promised land of useful technology still existed. Gtalk talked XMPP, Facebook talked XMPP; everyone talked XMPP. RSS and Google Reader was big, and Google still had "don't be evil" in it's manifest. Augmented reality was on it's way. The relevant Wikipedia article⁴ shows a photo of a HTC Desire, a 2009 phone, displaying AR navigation⁵.

But a few months later the only community website I ever really loved and belonged to⁶ shut down. I wrote about it a while ago that maybe the reason for that site and it's community to work as well as it did that it was it's mixed reality roots⁷: a community with an entry point from the web, and with entry points from parties and events organised. You could start in one and continue in the other.

And then Google Glass debuted. It became of the most hated gadgets ever created, and with that, the dreams of a usefully connected world seem to have died. Meanwhile the clouds of endless consumption of worthless goods were gathering.

In 2007 the iPhone was presented and brought upon the insanity of being constantly distracted by notifications. In 2009 I had a company Nokia E52⁸. It was tiny, loud, the battery lasted a week easily, and it even had a surprisingly decent Nokia Maps navigation with Hungarian TTS. It was internet capable: with Opera Mini, I could read the news, it had an email client, and so on. For a company phone, it was perfect; a far cry from the glue-and-glass attention seeking monstrosities everyone carries now.

Seven years later, in 2014, something happened that killed any remaining promise of the mixed reality that would have served the people. Maybe a CEO conference, maybe just death by a thousand papercuts. The article "Get your loved ones off Facebook⁹ was triggered by the 2014 changes in Facebook's policies. Google Talk was discontinued in early 2015, Facebook also dropped XMPP by then.

In 2015, Pokémon Go debuted. The FOMO of "Gotta catch them all!" has been making people drop serious money on "collectables" probably since the dawn of time, but this one was new. You'd have to walk or go to physical places to interact with them or with others at the same location. And it was even teaching about local curiosities that were marked for those special spots.

But this wasn't really that useful AR that I longed for. It wasn't a simple, configurable heads up display that would, say, show my friends on a map, show events that might be are happening around me and would be open for me, or one that could be the local guide of curiosities and history. One that tells me the story of a building just by being there and looking at it, that would give me augmented navigation, that would allow me to connect with people in both worlds easily. It was a gacha game during a time when it wasn't yet clear how many, many things are, quietly, also made to track your behaviour, your location, your habits. The notion that the internet became, or was becoming, an enshittified cesspit didn't sink in just yet.

It's 2026 now and I see Ray-Ban Meta glass commercials everywhere. It's an even creepier device¹⁰ - it's made by Meta after all -, than the Google Glass was, yet somehow, it's ... OK now?! People live stream jackass moments with it, and we're cheering. Everyone got used to record anything they see, all the time, and being recorded, all the time.

Walking up to random strangers with weird questions, live streaming it all. Your car is will be mandated to record you in the EU from mid 2026¹¹. Instead of stopping a fight and pulling people apart, just record it and upload it. I get that in some cases, the recording is useful, even needed, but it can't be a priority over de-escalating a situation, and that's just one example.

How did we get here? Why did that useful internet promise die? Is it all just human greed, is it negligence, is it entertaining ourselves to death? The reference above is to Amusing Ourselves to Death¹² but there's also an amazing comic strip about it, which has an interesting background: the creator was asked to redact it, essentially because it summarised the whole book in one go¹³. If you look around, you can still find it on various pages¹⁴. https://biblioklept.org/2013/06/08/huxley-vs-orwell-the-webcomic-2/ still presents it.

One explanation I've heard is that in the early days the internet was less accessible and so it contained like-minded people. But it's hard to understand how we got from the collaborative internet of SOPA/PIPA internet blackouts¹⁵ in 2011/12, when the internet was already quite accessible to most, to being OK with AI generated posters for your kid's birthday party, willingly uploading the photos of involved kid into the machine that'll most likely store it forever for facial recognition.

Here we are, in the now: an insane amount of streamed, recorded video, using absurdly powerful machines that shamelessly trying to spy and gather as much information on us as possible, willingly in our pockets, and virtually not a single option to publish my live location to a select few friends in case we're about to bump into each other, without something selling me out, exploiting me, tracking me.

That is unless you are a wizard of words and your friends are listening to you, and you manage to self-host a server for them. Which I do, an XMPP server for friends & family, but not many others do, even though they should. It lives on a former thin client in my home, under a chest of drawers.

It could be me though. Maybe my definition of useful is a far cry from the averaged definition of useful. Maybe some people are looking forward to on-the-fly AI generated targeted video ads and streams with zero collective experience, and a reality fragmented into bubbles and oblivion.

Pár hete kijött egy törvény Angliában: 2008 után születettek soha sem vásárolhatnak legálisan cigarettát¹. Ahelyett, hogy örültem volna, hogy végre történik valami, az agyam feldobta, hogy dehát mégiscsak el kellene hogy dönthesse a felnőtt ember, hogy mit csinál magával. Egész életemben utáltam a bagószagot: hogy egy alapvetően nagyon jó illatú növényből hogyan lesz bűz, maj csilliárd eldobott cigarettavég, amit a Föld IQ haranggörbe bal oldalán elhelyezkedő agyúak nem képesek legalább a szemetesbe bedobni. Erre ez első gondolatom nem az, hogy "végre". Honnan buggyant ez elő?

Mióta nem Magyarországon élek egy sokkal tágabb világgal vagyok körülvéve. Van kollégám, akiről nemrég tudtam meg, hogy 17 évesen menekült 2003-ban az iraki háborúból, és többet látott, mint egy ezüsthátú new yorki rendőr. Ennek egyenes következménye, hogy ahogy teltek itt az évek egyre több oldalt próbálok megnézni, minden szögből felmérni és megérteni álláspontokat.

Ez önmagában jó és helyes, azonban nehéz véleményt megtartani, valamilyen oldalon állni, ha mindenkinek igaza van - a saját igaza, persze. Mikor kell a másik bőrébe, fejébe bújni, és mikor nem? Arra jutottam, hogy ha valami vagy objektíven és mérhetően rossz - lásd bagó -, van számomra morálisan és/vagy etikusan visszatetsző, akkor nincs helye más véleményének, és bele kell állni a sajátomban.

Ahhoz viszont, hogy eljussak egy ilyen rendkívül egyszerű következtetésig több napnyi üres fej kellett.

A 41. születésnapomra kaptam 5 nap szünetet, hogy egy kicsit kikapcsolhassam a gondolataimat, hogy a saját tempómban haladjak. Cél, illetve jobban mondva “indok” nélkül - konferencia, edzőtábor, munka, stb -, egyedül, eddig szinte sosem mentem egyedül egy napnál többet valahova, pláne nem messze, úgyhogy ez mindenképpen új élmény.

Ami ide vezetett az már bonyolultabb. Merlin születése óta az élet folyamatosan, szörnyű sebességgel dobálja az állandó figyelmet igénylő mindennapokat. Egy irodai munkahely ma elvárja, hogy perceken belül válaszolj az 50 csoportbeszélgetés bármelyikében, miközben a két kezeddel az eredeti feladatkörödet teljesíted, a füleddel az értekezletet² hallgatod, az agyad pedig táncoló elefántokon tányérokat pörgető bohócként próbál mindent egyben tartani.

Válts témát, feladatot, bármikor, ritmustalanul, váratlanul, napi nyolc órában - vagyishát napi 14 órában, hiszen otthonról dolgozol, és amikor kilépsz az munkázást (4 évesen így kell mondani) jelző szoba ajtaján, a 4 éves boldogan és örömmel jön, hogy végre vele foglalkozok. Teljesen igaza van, és szörnyű lenne, ha nem jönne, de attól még megpróbáltatás.

Amikor nem otthon vagyok, akkor órákat tartok. Egyfajta tai chi-t, íjászatot, visszafogott soft-contact harcművészetet. Ott arra figyelek, hogy ne legyen senkinek baja: miközben a mellettem levőnek magyarázok a hátsó szemeimmel a termet pásztázom. Részben kikapcsol, de attól még minden héten van, és hiába lenne éppen aznap máshoz kedve az embernek, számítanak rá. Fizetnek érte, így jogos az elvárás, bár amit fizetnek az a termet és a felszerelést fedezi. Nagyjából. Sosem volt célom tanítani ezt, viszont nem volt más, aki megtette volna. Ha 5 évvel ezelőtt nem ugrok bele, akkor lehet, hogy nincs több íjászat az élemben, és ezt nem akartam.

Valahogy így telt az elmúlt 4 év. Azon kaptam magam, hogy egyszerre vagyok képtelen megállni és nem csinálni, nem fogyasztani, nem nézni, nem hallgatni valamit. Ugyanakkor tisztán gondolkozni, ködös gondolatfoszlányok helyett egybefüggő mondatokkal és célokkal alig vagyok voltam képes már egy jó ideje.

A semmittevésre, unalomra óriási szükség van, a gond az, hogy undorítóan könnyű lett megkerülni, megszüntetni.

Évekkel ezelőtt valahol olvastam, hogy milyen fantasztikus dolog, hogy a “holt” időt végre ki tudjuk használni az okostelefonokkal. Azokat a rövid időszakokat, amikor várunk a buszra, amikor utazunk a metrón. Tíz Húsz³ harminc, ötven, száz évvel ezelőtt is volt “megoldás”: könyv, újság, később walkman. Viszont az iphone, és leginkább az instagram óta az a normális, hogy végtelen és végtelenül üres vizuális orkánt nyelünk a szemeinkkel minden “holt” percben. Meg nem holt percben. Minden percben. És nincs vége, mint egy könyvnek, nem kell kicserélni a kazettát, vagy előre tekerni, megy tovább a végtelen tartalom, magától. Mint ahogyan a mai játékoknak sincs vége, open world, ahelyett, hogy odavágnád a kontrollert, miután mindhárom életednek annyi az Aladdinban⁴, és kimennél biciklizni.

Gyerekkoromból dereng egy sorozat, amiben a gyerekek valami kütyüvel videótelefonálni tudtak egymással, bármikor, bárhonnan. Hogy mennyire lehetetlenül fantasztikusnak tartottam, és mennyire szerettem volna egy olyat. Ma van egy ilyenem, és sosem gondoltam volna, hogy az lesz nehéz, hogy erre a célra használjam.

A lényeg, hogy végre tartottam egy szünetet. Ültem és órákig néztem egy szubtrópusi völgyet Agaete mellett, ahol az egyik legészakibb, és egyben Európa egyetlen (kis csalással) kávéültetvényei vannak. Sétáltam és szagoltam a Kanári-fenyők illatát, ami, ha kisüt a nap, vetekszik bármilyen aromaterápiás kezeléssel. Feladtam terveket, mert lezárták a hegyről kivezető utat rally miatt, és átsétáltam egy mesebeli völgybe, barlangokba épített lakások között, hogy utána órákig élvezzem a kiltást egy völgyből az óceán felé, körülölelve sziklákkal és hegyekkel, aminek a méreteit Norvégia fjodrjaihoz tudom hasonlítani. Visszamentem egy barlanglakásba megszállni, lehetetlen kilátással, hogy a szelet hallgassam.

Segített. 3 nap múlva elkezdtem végre ráeszmélni, szavakba önteni, hogy a bajom ott kezdődik, hogy nem ülök le egy órára a tüzet nézni anélkül, hogy ennék, vagy hogy legalább zene is menne. Az egész fájdalmasan egybevág egy könyvvel⁵, amit teljesen véletlenül találtam egy antikváriumban. Ellentétben a legtöbb spirituális megközelítéssel a könyv a görög pantheonnal közelíti meg a problémát: Hermésszel, a nyüzsgés urával valamint Hesztiával, a ház tüzének istennőjével. A mondanivaló egyszerű: nem szabad a nyugit elhanyagolni, sem abból a szempontból, hogy állj meg, sem abból, hogy a kuckód legyen megnyugtató, és amikor hazatérsz, segítsen megnyugodni.

Vannak mesék és történetek, amik, attól függően, hogy életed melyik szakaszában olvasodt, mást és mást jelentenek. A legismertebb ilyen a Kis Herceg, de néha akad egy-egy rejtett pillanat másban is. Meglepetésemre még az a 1977-es Disney-féle Micimackóban filmben is:

Róbert Gida: Én legjobban azt szeretem, ha nem csinálok semmit.

Micimackó: Semmit? Hogy csinálsz semmit?

Róber Gida: Úgy, hogy amikor a felnőttek rámszólnak, "Most mit csinálsz?", én azt felelem: "Semmit...". És odébbmegyek.

Micimackó: De jó, csináljuk mindig ezt!

Róber Gida: Tudod Mackó, semmit már soha többé nem csinálunk.

Micimackó: Azt mondod, soha többé?

Róber Gida: Hát, sokkal ritkábban.

Talán itt az idejen megint többet csinálni azt a semmit, bármilyen nehéz is az elején, bármilyen lehetetlennek is tűnik kiszakadni a tévesen tevékenynek tűnő tevésből.

Initially, it was a syn flood. I don't know why I believed that the FreeBSD and pf defaults are protected against syn flood, so there was a bit of tweaking needed in `/etc/sysctl.conf. Many thanks for the internet sources¹².

# drop tcp packets destined for closed ports (default 0)
net.inet.tcp.blackhole=2
# SYN/FIN packets get dropped on initial connection (default 0)
net.inet.tcp.drop_synfin=1
# recycle FIN/WAIT states quickly, helps against DoS, but may cause false RST (default 0)
net.inet.tcp.fast_finwait2_recycle=1
# disable TCP Fast Open client side, enforce three way TCP handshake (default 1, enabled)
net.inet.tcp.fastopen.client_enable=0
# disable TCP Fast Open server side, enforce three way TCP handshake (default 0)
net.inet.tcp.fastopen.server_enable=0
# TCP FIN_WAIT_2 timeout waiting for client FIN packet before state close (default 60000, 60 sec)
net.inet.tcp.finwait2_timeout=1000
# icmp may not send RST to avoid spoofed icmp/udp floods (default 1)
net.inet.tcp.icmp_may_rst=0
# amount of tcp keep alive probe failures before socket is forced closed (default 8)
net.inet.tcp.keepcnt=2
# time before starting tcp keep alive probes on an idle, TCP connection (default 7200000, 7200 secs)
net.inet.tcp.keepidle=62000
# tcp keep alive client reply timeout (default 75000, 75 secs)
net.inet.tcp.keepinit=5000
# Maximum Segment Lifetime, time the connection spends in TIME_WAIT state (default 30000, 2*MSL = 60 sec)
net.inet.tcp.msl=2500
# disable for mtu=1500 as most paths drop ICMP type 3 packets, but keep enabled for mtu=9000 (default 1)
net.inet.tcp.path_mtu_discovery=0

But it just kept going, and nepenthes³ got overwhelmed.

At first, I turned off nepenthes, and returned a mere HTTP 410 from nginx directly.

And it kept going, because now the logging was so high traffic that fail2ban was consuming enough CPU that everything else was starting to have problem. I didn't think this was possible, but yes: apparently fail2ban can use quite a lot of resources when it gets combined with high volume logging.

At one point I added a tarpit directly inside nginx, using the echo module⁴ and it's delay feature.

    echo '    <!DOCTYPE html>';
    echo_sleep 2;
    echo '    <html lang=en>';
    echo_sleep 4;
    echo '        <head>';
    echo_sleep 8;
    echo '            <meta charset=utf-8>';
    echo_sleep 16;
    echo '            <title></title>';
    echo_sleep 32;
    echo '        </head>';
    echo_sleep 64;
    echo '        <body>';
    echo_sleep 128;
    echo '            <blockquote>';
    echo_sleep 256;
    echo '                <p>';
    echo_sleep 512;
    echo '                    I must not fear. ';
    echo_sleep 1024;
    echo '                    Fear is the mind-killer. ';
    echo_sleep 2048;
    echo '                    Fear is the little-death that brings total obliteration. ';
    echo_sleep 4096;
    echo '                    I will face my fear. ';
    echo_sleep 8192;
    echo '                    I will permit it to pass over me and through me. ';
    echo_sleep 16384;
    echo '                    And when it has gone past I will turn the inner eye to see its path. ';
    echo_sleep 32768;
    echo '                    Where the fear has gone there will be nothing. ';
    echo_sleep 65535;
    echo '                    Only I will remain.';
    echo_sleep 131072;
    echo '                </p>';
    echo_sleep 262144;
    echo '                <p>—Frank Herbert, <cite>Dune</cite></p>';
    echo_sleep 524288;
    echo '            </blockquote>';
    echo_sleep 1048576;
    echo '        </body>';
    echo_sleep 2097152;
    echo '    </html>';

I ended up with 130k open connection.

The current solution, which I'm hoping to work for a while, was to add ASN data into my blocked logs, devise a cron job that gets the list of ASN entries, and block them if they go above X per hour - X is currently 100. So far, this is working.

Step 0: get ASN data

/usr/local/etc/cron.d/root

• root, because I need to reload nginx
• yes, I use wget
• yes, my crons have bash as shell

@daily root wget -q -O/var/db/ip-location-db/geolite2-asn.mmdb https://github.com/sapics/ip-location-db/releases/download/latest/geolite2-asn.mmdb >/dev/null && /usr/sbin/service nginx reload

@daily root cd /var/db/ip-location-db && wget -O/var/db/ip-location-db/asn_full.json.zip https://geoip.oxl.app/file/asn_full.json.zip && unzip -d /var/db/ip-location-db -f /var/db/ip-location-db/asn_full.json.zip && rm /var/db/ip-location-db/asn_full.json.zip && /usr/sbin/service nginx reload

Step 2: mount a tmpfs, so I don't wear out my SSD

While tmpfs is linuxism, but in this case, it's useful. There's a log rotation set up for 200MB max size + daily, keeping only 1 additional, so it can't eat my memory, but I have little desire to wear out my SSD with these logs.

/etc/fstab

tmpfs /shm tmpfs rw,mode=1777 0 0

/boot/loader.conf

tmpfs_load="YES"

If you don't want to reboot:

kldload tmpfs

Step 3: get ANS data into nginx logs⁵

Install the nginx geoip2 module - I leave it to you if you compile nginx from ports with the relevant flags or install nginx-full, both are OK. I went with the first.

nginx.conf

load_module /usr/local/libexec/nginx/ngx_http_geoip2_module.so;

http {
        [...]

    geoip2 /var/db/ip-location-db/geolite2-asn.mmdb {
        $geoip2_asn autonomous_system_number;
        $geoip2_asname autonomous_system_organization;
    }

    log_format minimal '$time_iso8601 $remote_addr $geoip2_asn "$geoip2_asname" $server_name "$request" $status $request_time';

    [...]

    server {
      [...]
      location /nope {
          access_log /shm/blocked.log minimal;
          return 401;
      }
    }
}

Step 4: block all the things

/usr/local/bin/block-asn-pf.py

#!/usr/local/bin/python3.11

import argparse
import json
import syslog
import os

parser = argparse.ArgumentParser()
parser.add_argument('asn')
args = parser.parse_args()

with open('/var/db/ip-location-db/asn_full.json') as f:
    asninfo = json.load(f)

for cidr in asninfo.get(args.asn, {}).get('ipv4', []):
    cmd=f"pfctl -t badips -T add {cidr}"
    os.system(cmd)

/usr/local/etc/cron.d/root

• root, because it pipes into pf
• there's most likely an elegant way to do it in awk only, but there's a reason why it's called awkward

@hourly root for asn in $(cat /shm/blocked.log| awk '{print $3}' | sort | uniq -cd | awk -v limit=100 '$1 > limit{print $2}'); do /usr/local/bin/block-asn-pf.py $asn >/dev/null 2>&1; done;

# clean IPs up after a day
@hourly root pfctl -t badips -T expire 86400 >/dev/null 2>&1

/usr/local/etc/pf.conf

table <badips> persist
block drop in quick from <badips> to any
block in from <badips>

Extra: block Spamhaus DROP

Spamhaus provides a "Don't Route Or Peer Lists (DROP)" ⁶ list for IP addresses that are really not nice, so it's worth adding them to the same blocked table

/usr/local/etc/cron.d/root

• root, it pipes into pf

@hourly root curl -s https://www.spamhaus.org/drop/drop_v4.json | jq -r '.cidr' | grep -E '^[0-9]' |  sed -r 's/(.*)/pfctl -t badips -T add \1/' | bash >/dev/null 2>&1

Due to some road closures I moved my openstreetmaps planned journey through the mountains to more cave houses up one day, and it was definitely worth it. The view is magnificent - squint, the ocean is right at the end -, if you leave early enough in April, like I did, beyond the buzzing and humming of bees, there's only peace around.

My first destination on Gran Canaria was the pine forest close to me. I've been to southern pine forests at other locations, but that wonderful, serene scent that a canary pine forest disperses when the full sun warms them up is second to none.

It really is the stupid phone ruining everything isn’t it? The stupid screens of doom and the stupidity of the world isn’t it?

Yes.

However, it's not the device itself, and not the base functionalities of the device. I remember a series from my youth - "Den korsikanske biskopen"¹ - where the kids had these fantastic gadgets with video calls and other features, and I always marvelled at it.

I think the major difference was that those gizmos were something of a closed circuit, an semi-offline-ish thing: knowledge in your pocket, communication with friends. The utopistic gadgets never have the option to browse the news - an important feature to use them only when needed.

What they also didn't do is broadcasting.

The "free" broadcasting the wider internet brought is dismal. Most can't make sense of it, and it turns into vanity, into narcissism. Blogs were open diaries, were a way to, with an alter ego, share what we may not have been brave enough, or didn't have the stage to share within out normie life. Instagram, TikTok, and the rest, on the other hand, are bringing the worst out of people: not for the sake of being themselves, but to be something people can follow.

Some of the modern internet is incredible, but look at the times from before the iphone: there was less vanity, no instagram and tiktok brainrot - albeit Ren and Stimpy and Happy Tree Friends were hardcore.

These should not be in our pockets; it's a weigh that is dragging everyone down into a swamp.