Author: admin

Sean Munger argues that Lee Harvey Oswald was the sole gunman killing John F Kennedy and there was no conspiracy. It argues well for Oswald being a gunman but stumbles somewhat in convincing the viewer that there was no conspiracy.

We agree on some points:

Oswald was seemingly a complete screwup who couldn’t do anything right

The idea that he succeeded in killing John F Kennedy seems like an unfortunate accident to mr Munger but it can also cast doubt on Oswald being a complete screwup. I would have liked a more thorough investigation into his history. How come he left the Marine Corps? How come he was so warmly received on his defection to the Soviet Union? How come he married the daughter of a Soviet military officer? How come he defected back to the US and was interviewed for 90 minutes before being let go? How come Oswald’s wife was allowed to join him in the US?

Oswald was a gunman directly involved in the assassination of John F Kennedy

Yes, that seems pretty well established. Even if we disregard his fingerprints and palmprints on the gun the fact that he wasn’t seen by anyone else at the time of the murder is a big red flag. If he truly wasn’t involved in the shooting, how was he kept in the right location(away from witnesses) at the right time?

The Secret Service didn’t do it

Well, obviously not… They could have made it look like a heart attack that killed him in his sleep. Why the hell would they jump through hoops to shoot him? I like the theory that they shot him by accident as it reduces things to slapstick and is clearly disproven by the Zapruder film.

We disagree on some points:

It’s important that Oswald’s gun can be shot three times in the allotted time

I argue that the proper question is if a shooter of his skill can shoot a moving target the size of a head twice in the allotted time.

Handwriting analysis is presented as reliable

I argue that it is not. I don’t doubt that Oswald’s signature in any of the presented evidence is the work of Oswald himself, but handwriting analysis is still very hit-and-miss.

Oswald’s refusal to indicate any co-conspirators while in police custody shows the absence of such co-conspirators

I argue that the Dallas Police showed themselves incompetent in how they interrogated him, how they paraded him in front of cameras for two days and how he was killed while in their custody. One should not rely on any written document from them. We have no audio-recording of Oswald nor did he make any statements with a lawyer present. What Oswald did or did not say between his arrest and his untimely demise is unknown.

The Warren commission is exhaustive

They relied heavily on existing investigations, some of them from the Dallas Police Department, the FBI and the CIA. They weren’t expected to find anything. It would be madness to set up a commission that started rummaging through US agencies, even if they didn’t find anything.

John F Kennedy was not opposed to the Vietnam war

His brother asked the Rand corporation to figure out how to win the Vietnam war. They went to Vietnam and on their return said effectively “The proper question is ‘CAN we win the Vietnam war’ and the answer is that we can’t”. JFK accepted this conclusion and was intending to wind down US involvement in Vietnam. As a side-note: this was the right decision, the US had no hope of winning the Vietnam war. Other countries in that part of the world could stop the steam-roller of communism but not Vietnam.

Some stuff that I can’t disprove due to a lack of evidence:

The CIA didn’t do it

Entirely possible. No one put any effort into investigating that(for good reason) so the absence of evidence isn’t exactly evidence of absence.

The FBI didn’t do it

Entirely possible. No one put any effort into investigating that(for good reason) so the absence of evidence isn’t exactly evidence of absence.

The military didn’t do it

Entirely possible. No one put any effort into investigating that(for good reason) so the absence of evidence isn’t exactly evidence of absence.

The mafia didn’t do it

They probably didn’t. It’s difficult to see how they would stand to gain anything from that or how they would pull strings necessary to stitch things together. Still, I doubt the FBI would have been keen to stand up after the assassination and say “Oh, the mob did it. We have them on tape. Should we have told someone?” So the argument “the FBI says no” isn’t very convincing here. It’s more convincing that the mob made money from gambling and drugs and risked complete annhilation if they were caught doing this.

Conclusions

Mr Munger relies heavily on the facts established by the US government. But when people argue that there was a conspiracy behind the assassination they typically go on to hypothesize that the parts of the US government were involved in the conspiracy, which makes the statements of the US government along the lines of “there was no conspiracy” less weight.

I don’t think any branch of the US government was involved in this crime. But independently of that it would have been hugely disruptive for different branches of the US government investigating one another for involvement in Kennedy’s murder.

And you can’t investigate a conspiracy and a priori exclude all branches of the government yet still have the investigation taken seriously. So you have to conclude at the earliest opportunity that there was no conspiracy. How fortunate *cough-cough* then that the gunman made only a few independently verifiable statements before being shot dead while in police custody.

Zapruder film:

https://www.youtube.com/watch?v=_zwG3QdPLfw

Sean Munger’s documentaries on the subject:

https://www.youtube.com/watch?v=DC8tO16xdrY
https://www.youtube.com/watch?v=Ptt1ti63IiE

Apparently Wendy’s is trying to do this and I’ve heard of stores here in Sweden being on the same wavelength. I see the merits of surge-pricing for grocery stores, fast food restaurants and taxi-like(apparently Über has been doing this for some time) but why would you use AI?

I think you – as a matter of practice – need to be able to explain why your prices are what they are. Saying “It’s arbitrary” isn’t going to cut it and saying “The AI says so” is pretty much equivalent. I don’t think surge-pricing is hard to do. You know when you have peaks in load over the day and you can set prices accordingly. “The price of milk is $3 because between 16:00 and 19:00 we see the majority of people in the store which necessitates the highest staffing.” <- That seems like a reasonable rationale.

I’m curious though, what happens when you put a carton of milk in your cart at 15:58 when the listed price is $2 and go to the checkout at 16:02 and get charged $3? That’s not great legally and even from a PR-perspective it won’t go over well. You could say that prices change ever whole hour which might be reasonable with respect to PR but that still leaves the law and I’m not so sure we pass that hurdle this way.

You also need to avoid maximizing algorithms even if they are deterministic. They are better than AI because you can follow the rationale but it’s not going to look great to charge old people more because they are slow(for instance). Just because it yields more money doesn’t mean it’s going to work in the long run or… be legal.

AI is fine for generating images or text where a human can say “Yeah, that’s fine” but prices for stores? No, not a good idea. Similarly I’m quite perplexed by the use of machine learning in self-driving cars. Surely when people are injured because the car drove itself into a wall or a crowd you will want to establish why. But that’s no something you can get from machine learning. It’s an opaque process that yields something that provides opaque solutions. Why would you want that somewhere safety-critical? Even if it turns out machine learning yields results that are five times better than any human driver, the question why is still going to pop up when mistakes are made.

Two unrelated things have been bugging me lately.

1

People use the term “literally” to mean “to a great extent” even if it is meant metaphorically. What then is the term for saying that something is literal? We need to be able to distinguish between something being metaphorical and being literal. If “literal” is not reserved for things that are literal, what replaces it with another term that truly does indicate that?

2

Two people who orchestrated shady schemes were arrested after they collapsed: Alex Mashinsky after Celsius collapsed and Sam Bankman-Fried after FTX collapsed. A long time passed between the respective collapses and the arrests. My question is this: why didn’t these individuals flee to a country that does not extradite people to the US?

I think it is relevant that Celsius and FTX didn’t just incidentally violate the law a little bit. In the first case it was a Ponzi-scheme where new depositors’ money went to pay old depositors’ rewards. Numerous public statements were evidently false. In the second case depositors’ money were used by an independent but related entity(Alameda Research) to make various crypto-investments that largely failed. These two cases involve massive violations of law.

So again: why didn’t these individuals flee to a country that does not extradite people to the US? Surely they saw that their actions were illegal? Just losing investors billions of dollars doesn’t go down well even if law hadn’t been violated. So why stay in the US and the Bahamas respectively? I’m not arguing that they didn’t break the law, ample evidence proves otherwise. I am genuinely asking why they didn’t go to Belarus or Cape Verde or something.

I consider myself something of a connoisseur of the Chernobyl accident. I recommend:

Surviving Disaster: Chernobyl
Seconds from Disaster: Meltdown in Chernobyl
Zero Hour: Disaster at Chernobyl
The HBO series
Chernobyl: History of a Tragedy
Midnight in Chernobyl

Note that INSAG-1 and INSAG-7 are considered authoritative investigations but the information comes primarily from USSR authorities and the deputy chief engineer who are quite intent on blaming each other for the accident. The conclusion I think has to be that the reactor was very poorly designed, documentation intentionally incomplete and previous accidents covered up in addition to the deputy chief engineer violating prudent reactor operations. ECCS turned off for 11 hours in anticipation of the test? Sure. The reactor grinds to a halt? Withdraw more control rods! Run the test at 200MW(thermal) instead of 700MW(thermal)? That’ll be fine. Explain the testing protocol to people running the reactor? No need for that. Before the test event began the reactor was in such a bad state that they basically had no chance of avoiding the whole thing blowing up even if they decided to call it a day.

It should also be noted that you can’t claim to uphold rules regarding anything if you only bust people for breaking the rules and bad things happening. The Soviet authorities smiled upon violating any set of rules to get things done and only busted people for breaking rules when things went wrong. We have seen this in many places since and it is clear to deduce that breaking rules is expected in these organizations.

Anyway, I think the Chernobyl accident could have been avoided if people running the damn things were actually told what they were running. Telling someone that a loaded gun is not loaded is begging for someone to end up getting shot. It never occurred to anyone else to actively lie to nuclear reactors engineers about what they were running because that’s an absolutely idiotic idea. If someone had suggested this when rolling out some nuclear power plant in the US they would probably have been sent for psychiatric diagnosis because no sane person thinks that might be on the table. In the Soviet Union not only was no one sent for a psych-exam, but the idea actually became policy. In their defense I don’t think the decision actually boiled down to one person weighing “tell operators what they are working on” and “don’t tell operators what they are working on” against one another. It was probably a decision made by a variety of people over time and at no point did it seem like a very dangerous idea. But I argue that it would have been a simple matter to tell engineers what they needed to know and make sure they kept their mouths shut.

---

All operational staff at Chernobyl Unit 4 is asked to attend a meeting in a large onsite hall before going on-stream.

• All right. Everyone here? … Anyone know if anyone’s missing? … No? Good. Uhm, you there! The guy who closed to the door. Lock the doors! … Locked? Good. Okey, I’m Davidoff and I’m with… the Security Services. Does anyone know what happens if someone talks about state secrets outside of approved situations? Like if someone tells his wife that our air-to-air missiles don’t work or something like that. … I don’t know anything about our fighter capacity but it’s the kind of thing that you really shouldn’t tell your wife. You there!

Davidoff points to a random engineer in the audience.

• What happens if you blab about state secrets?
• You… get sent to a prison camp?
• Yes, or you get executed. That has also happened. So I don’t think I need to tell you that state secrets are not to be shared with people who are not “in the know”. Fair enough?

There are no objections from the audience.

• Good! Now, you may not understand this introduction but I will share with you things that are considered state secrets. They are considered essential for you to know when running these reactors but you are not to talk about this with people who aren’t directly involved with running these reactors. Let’s start from the beginning.

Davidoff shows an overhead projection of his first point.

• Item 1. We tell the general public that RBMK reactors are entirely safe. Otherwise they might cause trouble when we build them all over the place. Even people in charge of entire nuclear power plants say that these reactors are so safe you could put one in Red Square. This is not true. RBMK reactors have a set of dangerous properties that are to be presented here today. It is entirely ruled out that RBMK reactors be put in Red Square or any densely populated area. This entire nuclear power plant was initially meant to be built closer to Kyiv but… Well… Obviously that didn’t happen.
• Item 2. RBMK reactors are unstable at low power levels. This is not a secret really but it’s worth considering. If you try to run these reactors at low power levels they might shut themselves down – this is relatively good outcome – or they might unexpectedly power UP – this is not a good outcome. So don’t try to run these reactors at low power levels. If all that happens is that the reactors power down unexpectedly you are in luck, it could be considerably worse.
• Item 3. RBMK reactors have a huge positive void coefficient. For those of you in the audience who is not a nuclear engineer that means that steam in the reactor contributes to the reactor’s reactivity. You actually want that to be a negative feedback loop for stability. So water boiling to steam to a greater extent than anticipated makes the reactor split more atoms generating more heat and that boils more water to steam and makes even more atoms split producing even more steam and so on. You probably get the gist… Now, if we use water as a moderator – to slow down neutrons to where they actually split atoms – and as a coolant we are typically in the clear. Our VVER reactors operate on this principle. Since water is a moderator, boiling it to steam makes the reactor power down. But in RBMK’s we use graphite as a moderator and water is only there as a coolant. Water actually steals neutrons from the chain reaction so boiling it to steam gives us more free neutrons and therefore we have to huge positive void coefficient. This void coefficient is not balanced out by the temperature coefficient at all power levels, as in the Canadian CANDU reactor. Specifically at low power the temperature coefficient does not compensate for the large void coefficient. As a sidenote: the Americans have a reactor which produces both plutonium and electricity at Hanford which is channel-based, uses graphite as a moderator and light water for cooling. It has a positive void coefficient but not as big as we have with the RBMK. So we have to be very careful with RBMK’s because they’re less stable than what the Americans have in one of they military facilities.
• Oh, by the way! The Americans think we are using RBMK’s to produce plutonium. That was the idea back in the day but the design would have been even more dangerous in that configuration so it’s been reduced to just producing electricity. The Americans still think RBMK’s are producing plutonium though and we haven’t been able to convince them that RBMK’s are only about producing electricity.
• Item 4. The control rods have graphite displacers under them. This is for efficiency as the control rods are mostly drawn out of the core during operation and normally neutron-absorbing water would take their place. But with graphite displacing the water we lose fewer neutrons. Thus the difference between control rods being inserted and being extracted is greater and we get better efficiency during normal operations. However… This means that pulling out most control rods and them jamming them back in can actually create a boost to the reactor’s power, not the anticipated decrease. The decrease would eventually be present but you have to be careful or inserting a bunch of control rods creates such a spike in power that you never get to that stage because the fuel channels break and jam the rods. They had this happen at Ignalina and narrowly averted disaster.

A man in the audience carefully raises his hand.

• Yes, you have a question?
• Yes… We never heard anything about an accident at Ignalina.
• Uhm… No. The whole thing was classified as a state secret. Why would you be told about that incident?
• Oh… Uhm. I see. Never mind then…

The man sits down again.

• Item 5: Sensors are not great… Under normal operating conditions sensors will be fairly helpful but during startup and shutdown they are insufficient. You will need to guess the state of certain parts of the reactor which isn’t ideal. No plan exists to put more sensors into the reactor. So… Be careful.
• So in summary: RBMK reactors are unstable and way more dangerous than the general public knows. There are a variety of properties than make these reactors so dangerous and the manual – without mentioning those dangers – has to be followed to the letter! When it says “don’t run the reactor at less than 700 MW” it does not say “because otherwise bad things can happen” but now you know that bad things can happen if you do that. Do not pull out all the control rods and then jam them back in because very bad things can happen. The reactivity margin for these reactors must be respected to steer clear of dangers. Follow the manual exactly and you should be fine. Any questions?

A man in the audience raises his hand.

• Yes?
• Why do we build RBMK reactors if they are dangerous?
• A sensible question! I assume that you consider VVER to be the main competitor to RBMK. Well, imagine if you will that you are a politician. You can choose to roll out just a handful of VVER reactors because most of the Soviet Union’s capacity for producing such reactors is taken up by the navy. Or you can choose to roll out RBMK’s which can be built by ordinary craftsmen. In the first case you take the heat because you have locked the Soviet Union into using a technology which can’t meet the needs of its growing industry, but the people running those reactors basically can’t screw things up no matter how hard they try. In the second case you don’t catch any flak for your decision but the operators of reactors will sweat bullets every minute they are working at the controls of an RBMK. Which do you choose? … That’s rhetorical, you’re not expected to provide an answer. Of course we have to tell the general public that RBMK’s are safe but it’s not like they have a keen understanding of how nuclear reactors work so it’s not all that difficult.

---

Something I don’t understand: Power plant blackouts. This could happen due to a war or something simple like a lighting strike disconnecting the plant from the grid. It takes more time to get the backup generators up to 100% power than the reactor can really handle so the thought was that power would be produced by a “rundown unit”(one of the generators) during this gap. This had not been tested on unit 4 before it was put into production and this shutdown presented an opportunity to do that test. But I don’t understand why you would need electricity to keep the reactor safe in the gap between blackout and the generators reaching maximum output. The emergency core cooling system(ECCS) was pressurized with nitrogen gas, so shouldn’t that be sufficient to cool the reactor before the generators are working at full power? Insag-7 mentions that the ECCS had three sub-systems and that one of them required electricty(DBA = Design Basic Accident):

“According to the design requirements for total loss of power in the event of
a DBA, electric power supply to the feedwater pumps of the third subsystem of the
emergency core cooling system (ECCS) had to be provided by the mechanical energy
of the rundown mode of the turbogenerator.”

So it might have been this aspect that they were thinking of. And making the ECCS robust seems sensible.

---

Addendum

There is an attempt to rehabilitate Anatoly Dyatlov and painting him as the scapegoat on whom the Soviet authorities blamed everything. Well, the Soviet authorities did try to blame him and the control room staff for things going wrong and this sometimes involved them inventing rules after the fact that did not apply at the time of the accident. I find this somewhat beside the point from an external perspective because the whole system relied on people breaking whatever rules were in place. Everyone knew that rules were hypothetical, just like quotas and deadlines. So the Soviet authorities trying to blame “the rule-breakers” is quite disingenuous but that seems like an internal matter of diverting blame. The Soviet system handled nuclear power incredibly poorly generally, so if the higher-ups try to blame the control room staff, does that make them seem innocent? No, that isn’t viable for us on the outside. I’m sure it was quite effective internally to blame the staff and draw attention to them breaking rules(existing ones and made up ones) as if though rules weren’t routinely violated everywhere as a matter of course. But an outside observer isn’t convinced by this poor attempt at subterfuge.

I think at it’s core we have to acknowledge that mr Dyatlov was a terrible boss. The word “terrible” in this context doesn’t equate to “very mean”. I’m sure he was, but I’m saying that he was very bad at being a boss. He discouraged reports of mistakes, was uninclined to inform people of ongoing plans and trusted no one else to know their job. In pretty much any other country he would at most be asked to clean the floors at a nuclear power plant. But he was almost the perfect boss from a Soviet perspective. He was entirely in line with the Stalin-approach of shouting at people until they agreed to whatever he said and had people sent off to Siberia if they didn’t. He got things done which meant that any rules that may have to be broken were mere suggestions.

So did he cause the accident? Sort of, yes. But the hierarchy above him bears the responsibility. They put a bad boss in charge precisely because he broke rules and shouted at people. So Dyatlov was an important part of the chain that caused the accident but he can’t really be blamed for the consequences when he did what was expected of him. Should we then rehabilitate him in the eyes of the world? Well, I think it’s fair to say that he wasn’t to blame for the accident. But we still have to recognize that his way of running things would be entirely unacceptable selling shoes to random people on the street and the fact that he had any say whatsoever about a nuclear power plant is the root of the problem, not what decisions he made along the way.

God I love Yahtzee’s game reviews. Especially for choice games like Ride to Hell Retribution 1%, Alien: Colonial Marines and Amy.

• I got shit to doooo! Ride to Hell Retribution
• The entire QA team simultaneously resigned to start a shotgun-tasting business. Ride to Hell Retribution
• Because: fuck you! Ride to Hell Retribution
• If a game is bad it’s usually because not enough people cared; not because development was forming a murder-suicide. Best and worst of 2012
• In one of its many dalliances with total fucking pointlessness. Soul Calibur IV
• A few seconds earlier would have been expedient deary! Siren Blood Curse
• It’s all right, you can swear on the internet. Your mum probably isn’t going to read it. I know because she’s too busy being fucked by me. Mailbag Showdown
• The play time is shorter than a documentary about French war heroes. Tomb Raider: Underworld
• A lesson who could well have been learnt by those people who lived next door to Auschwitz and thought all that smoke came from an unusally screamy pie-factory. Lego Indiana Jones
• Random documents and audio logs! Song
• Knifing people with sideburns. That’s ‘Knifing people who have got sideburns’ rather, the alternative would be absurd. E3 2012
• More shaky-cam footage than a Paul Greensgrass film being projected onto a fat jogger’s tits. FFXIII
• Badger watcher with anger-management issues. Sniper Elite V2
• I remember it being in God of War III, Shattered Dimensions, The Force Unleashed Two, Wet, Wolverine… That’s the game Wet and the game Wolverine, not a game about a wet wolverine, no such thing exists. Dead Space 2

Other carefully crafted burns from Youtube-celebs:

• Vinny didn’t entirely enjoy No Man’s Sky. It’s creator got that slightly wrong but Vinny was kind enough to clarify, which made it into his 2019 retrospective.
• It’s good to know that Civvie11 wants to be one of my people. Otherwise his Quake 4 review was kind of… Quake 4.
• Rifftrax comment on seeing Lycan colony: I saw Manos the Hands of Fate and thought, how could it get any worse? Then I saw Birdemic and thought, how could it get any worse? Then I saw Feeders and thought, how could it get any worse? Then I saw Suburban Sasquatch and thought, how could it get any worse? Then I saw Lycan Colony and thought, oh. That’s how.
• Arin has plans for Sonic ’06: Well then… I’ll better pack my suitcase… ’cause we’re going straight to hell!
• Somewhere , if you reach deep into Mike Matei, you will find a smidgeon of humanity! But for now we can only see the Beast! Sonic ’06 part 25
• What can we say that’s PC here? … Because I don’t think ‘Retard-child’ will go over well. Sonic ’06 part 26
• These two girls they make quite a pair. They both come from your worst nightmare. They will haunt your soul forever, and now every time you see pink you’re gonna think: we’re doomed. They are agents of Satan… MST3K 0421 – Monster A Go-Go
• Uh-oh, I think we’ have’re looking at a Pinky Promise Protocol here fellas… I uncovered a billion dollar fraud
• Trees! The Horrible World of Kinect Games – Caddicarus

Notes:

“Beautiful ladies who want to meet me don’t need an appointment.”
Scrooge McDuck – E049 – Raiders of the Lost Harp – 12:45

Like Wet, Wolverine… That’s the game Wet and the game Wolverine, not a game about a Wet Wolverine, no such thing exists.

For Brain Rose. Coffezilla

“Let’s say good-bye to the bullshit van! ‘Good-bye bullshit van!’ [ He waves theatrically to a spot in the middle distance ] Now, it’s gone! Now I won’t bullshit you and you don’t get to bullshit me.”
Sean Anderson – Differently Morphous – Chapter seventeen – 01:28

Bahnhof needs to do some service so we’re running internet via Telia 4G for a few hours. I took the opportunity to get Galera on galera02 going again after I used that node for VPN experiments. It took some time since I confused backend0X with galera0X. I couldn’t quite figure out why mariadbgalera was down on all nodes… My monitoring system explained the discrepancy…

Turns out zabbix has a bunch of stuck queries in Galera so I guess the max_user_connection warning makes sense. I used for PD in $(mysqladmin processlist | awk ‘{print $2}’); do mysqladmin kill $PD; done to kill ongoing queries quickly and now it works.

I got a Ubuntu VPN up and running with my Android phone before but I wanted it to work with my Rocky 9.2 install and now it works. Server conf:

conn roadwarriors
    ikev2=insist
    fragmentation=yes
    left=%any
    leftsubnet=192.168.0.0/21
    leftcert="IPsec client cjp"
    leftid=%fromcert
    right=192.168.2.72
    # trust our own Certificate Agency
    rightca=%same
    # pick an IP address pool to assign to remote users
    rightaddresspool=192.168.4.1-192.168.4.20
    # if you want remote clients to use some local DNS zones and servers
    modecfgdns="192.168.0.220, 192.168.0.1"
    modecfgdomains="incandescent.tech"
    rightcert="IPsec server cert"
    authby=rsasig
    auto=add
    # kill vanished roadwarriors
    dpddelay=1m
    dpdtimeout=5m
    dpdaction=clear

I’ve imported the CA, the server cert and the client cert:

ipsec import dualca.p12
ipsec import ipsecserver.p12
ipsec import cjpipsec.p12

[root@runner02 ~]# ipsec trafficstatus
006 #3: “roadwarriors”[2] 83.191.105.10, type=ESP, add_time=1698601747, inBytes=0, outBytes=0, maxBytes=2^63B, id=’CN=cjp’, lease=192.168.4.1/32

I can’t get forwarding to work on the server end though like I could with Ubuntu. I tried debugging it with my Ubuntu-machine on Vultr but the two just would not communicate and my Ubuntu host gave no response to ipsec listcerts. Anyway, this seems to work with RHEL now:

conn roadwarriors
    ikev2=insist
    # support (roaming) MOBIKE clients (RFC 4555)
    #mobike=yes
    fragmentation=yes
    left=%any
    # if access to the LAN is given, enable this, otherwise use 0.0.0.0/0
    leftsubnet=192.168.0.0/21
    leftcert="IPsec client cjp"
    #leftcert="IPsec server cert"
    leftid=%fromcert
    #leftxauthserver=yes
    #leftmodecfgserver=yes
    right=192.168.2.72
    # trust our own Certificate Agency
    rightca=%same
    # pick an IP address pool to assign to remote users
    rightaddresspool=192.168.9.1-192.168.9.20
    # if you want remote clients to use some local DNS zones and servers
    modecfgdns="192.168.0.220, 192.168.0.1"
    modecfgdomains="incandescent.tech"
    #rightxauthclient=yes
    #rightmodecfgclient=yes
    rightcert="IPsec server cert"
    rightsubnet=192.168.0.0/21
    authby=rsasig
    # optionally, run the client X.509 ID through pam to allow or deny client
    # pam-authorize=yes
    # load connection, do not initiate
    auto=add
    # kill vanished roadwarriors
    dpddelay=1m
    dpdtimeout=5m
    dpdaction=clear

So we have to set rightsubnet for some reason. I intend to look into that tomorrow because I don’t understand that configuration name. BTW, my Android won’t accept redirected routes if they contain a slash. Uhm… You own example 10.0.0/8 contains a slash and without it it isn’t a proper subnet so… How that supposed to work? Thankfully rightsubnet does the work for me it seems. Oh, my firewall rules I’ve added:

*filter
:INPUT ACCEPT [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
-I FORWARD --match policy --pol ipsec --dir in --proto esp -s 192.168.9.0/26 -j ACCEPT
-I FORWARD --match policy --pol ipsec --dir out --proto esp -d 192.168.9.0/26 -j ACCEPT
COMMIT

*nat
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-I POSTROUTING -s 192.168.9.0/26 -o ens18 -m policy --pol ipsec --dir out -j ACCEPT
-I POSTROUTING -s 192.168.9.0/26 -o ens18 -j MASQUERADE
COMMIT

*mangle
-I FORWARD --match policy --pol ipsec --dir in -s 192.168.9.0/26 -o ens18 -p tcp -m tcp --tcp-flags SYN,RST SYN -m tcpmss --mss 1361:1536 -j TCPMSS --set-mss 1360
COMMIT

Note that we do NOT want -A because that adds the rules to the end of the existing sets. I use iptables-restore -n FILENAME to read these rules in. I better check tomorrow that I can read these extra rules in on boot. Then I can keep Ubuntu for Galera only.

So Britain went ahead with their Online Safety Bill… I’m not entirely sure they understand how the internet works. It’s not national, it’s one giant set covering the world. You’ll easily wind up with Facebook being required by Indian law to take down a post while British law states that it can’t be taken down. So Meta would have to choose which law to break.

The most contentious part of the bill is that requirement to install government-sponsored scanning software on devices to get around end-to-end-encryption. If we assume for the time being that every phone in the UK has such scanning software, communication with anyone in the UK will have three parties, the interlocutors and the British government.

I’m not sure how to make all UK phones carry scanning software either. If a frenchman enters the UK, will scanning software be installed on his phone then? Normally people have control over what is installed on their phones so that seems unrealistic. This extends to British people as well. Is Google required to force government scanning software onto anyone running Android and connecting to a British telecommunications tower? Similarly Apple with iPhones? That seems like it leaves them open to law suits in other jurisdictions as they have installed software on someone else’s phone.

By and large I don’t think tech giants will impair their product to accomodate one country of 75 million people. It will be interesting to see what Britain does in response. Blocking Google, Facebook and so on seems like a reasonable response but that will cause their islands to catch fire very soon(metaphorically speaking).

Then there’s the PR issue. The bill might have done better before Snowden but I don’t think people are very inclined to trust governments generally. Giving people end-to-end-encryption means not even the service provider can access the contents, let alone the governments. People are not keen on what amounts to government-sponsored spyware forcibly installed to get around end-to-end-encryption.

It should be noted of course that end-to-end-encryption doesn’t require Signal or WhatsApp. It can be arranged easily with gpg. Using a Yubikey is very secure but gpg with something like Qubes OS is pretty darn good as well.

The EU’s DSA is less intrusive thus far. It represents the entire block of 600-something million people and based on the GDPR there is likely to be wide adoption there. I’m no fan of the “right to be forgotten”(Google shouldn’t be required to eliminate search results if the original content is still there, it’s a half-measure to force them to hide it in search results) but tech giants have chosen to comply.

I’ve tried out Galera on my workstation with a few VMs on VirtualBox and it has worked okey now that I overwrite the wsrep_sst_rsync to keep lsof from running and by extension using 100% of CPU capacity and not completing. I tried the latest version of MariaDB 11.0.3 to see if that removed the need to skip lsof but no, the behavior is still there. I tried Bitnami’s compilation of MariaDB but the docker but there were more than the acceptable level of error/warning messages when I started it up.

Below is an example of me turning off galera03, galera02 and galera01 in sequence. galera03 does an IST synchronization whereas galera02 and galera01 removed the local directory for MariaDB to force SST with rsync. In reality my MariaDB storage is more like 9GB and not 600MB like this toy setup but I think it will work.

The bottom three graph indicate that status of MySQL on the three VMs and you can see from the top graph that writes are made uninterrupted. The second graph indicates that number of bytes sent from each node. You only see a difference when galera03 is down and galera02 takes over thanks to keepalived.

I’m going try to let Zabbix use ProxySQL next because as it stands I rely on Keepalived to move an IP around as mariadbgalera does up and down. Then my plan is to set up new backend nodes – now with MariaDB Galera – and no virtual IP. The new Galera cluster will replicate from the current MariaDB master and then I will do a switchover. Maybe I should keep keepalived and the VIP so Grafana can access it easily. (thinking)

Well anyway, I’ll include the log of galera02 doing SST for general edification.

Oct 21 14:23:26 galera02.incandescent.tech docker[1565]: 2023-10-21 12:23:26 0 [Note] WSREP: Joiner monitor thread started to monitor
Oct 21 14:23:26 galera02.incandescent.tech docker[1565]: WSREP_SST: [INFO] rsync SST started on joiner (20231021 12:23:26.298)
Oct 21 14:23:26 galera02.incandescent.tech docker[1565]: 2023-10-21 12:23:26 1 [Note] WSREP: ####### IST uuid:00000000-0000-0000-0000-000000000000 f: 0, l: 113995, STRv: 3
Oct 21 14:23:26 galera02.incandescent.tech docker[1565]: 2023-10-21 12:23:26 1 [Note] WSREP: IST receiver addr using tcp://192.168.2.162:4568
Oct 21 14:23:26 galera02.incandescent.tech docker[1565]: 2023-10-21 12:23:26 1 [Note] WSREP: IST receiver bind using tcp://0.0.0.0:4568
Oct 21 14:23:26 galera02.incandescent.tech docker[1565]: 2023-10-21 12:23:26 1 [Note] WSREP: Prepared IST receiver for 0-113995, listening at: tcp://0.0.0.0:4568
Oct 21 14:23:26 galera02.incandescent.tech docker[1565]: 2023-10-21 12:23:26 0 [Note] WSREP: Member 2.0 (11a0c1b70499) requested state transfer from 'any'. Selected 0.0 (e541a05fe7a3)(SYNCED) as donor.
Oct 21 14:23:26 galera02.incandescent.tech docker[1565]: 2023-10-21 12:23:26 0 [Note] WSREP: Shifting PRIMARY -> JOINER (TO: 113996)
Oct 21 14:23:26 galera02.incandescent.tech docker[1565]: 2023-10-21 12:23:26 1 [Note] WSREP: Requesting state transfer: success, donor: 0
Oct 21 14:23:26 galera02.incandescent.tech docker[1565]: 2023-10-21 12:23:26 1 [Note] WSREP: Resetting GCache seqno map due to different histories.
Oct 21 14:23:26 galera02.incandescent.tech docker[1565]: 2023-10-21 12:23:26 1 [Note] WSREP: GCache history reset: 00000000-0000-0000-0000-000000000000:0 -> 16442fed-6f68-11ee-ae8d-9b68eafda4eb:113995
Oct 21 14:23:28 galera02.incandescent.tech docker[1565]: 2023-10-21 12:23:28 0 [Note] WSREP: (a1d6cfa1-90b2, 'tcp://0.0.0.0:4567') turning message relay requesting off
Oct 21 14:23:47 galera02.incandescent.tech docker[1565]: 2023-10-21 12:23:47 0 [Note] WSREP: 0.0 (e541a05fe7a3): State transfer to 2.0 (11a0c1b70499) complete.
Oct 21 14:23:47 galera02.incandescent.tech docker[1565]: 2023-10-21 12:23:47 0 [Note] WSREP: Member 0.0 (e541a05fe7a3) synced with group.
Oct 21 14:23:47 galera02.incandescent.tech docker[1565]: WSREP_SST: [INFO] Extracting binlog files: (20231021 12:23:47.818)
Oct 21 14:23:47 galera02.incandescent.tech docker[1565]: galera03-bin.000004
Oct 21 14:23:47 galera02.incandescent.tech docker[1565]: WSREP_SST: [INFO] Galera co-ords from recovery: 16442fed-6f68-11ee-ae8d-9b68eafda4eb:113997 0 (20231021 12:23:47.848)
Oct 21 14:23:47 galera02.incandescent.tech docker[1565]: WSREP_SST: [INFO] rsync SST completed on joiner (20231021 12:23:47.850)
Oct 21 14:23:47 galera02.incandescent.tech docker[1565]: WSREP_SST: [INFO] Joiner cleanup: rsync PID=255, stunnel PID=0 (20231021 12:23:47.852)
Oct 21 14:23:48 galera02.incandescent.tech docker[1565]: WSREP_SST: [INFO] Joiner cleanup done. (20231021 12:23:48.360)
Oct 21 14:23:48 galera02.incandescent.tech docker[1565]: 2023-10-21 12:23:48 3 [Note] WSREP: SST received
Oct 21 14:23:48 galera02.incandescent.tech docker[1565]: 2023-10-21 12:23:48 3 [Note] WSREP: Server status change joiner -> initializing
Oct 21 14:23:48 galera02.incandescent.tech docker[1565]: 2023-10-21 12:23:48 3 [Note] WSREP: wsrep_notify_cmd is not defined, skipping notification.
Oct 21 14:23:48 galera02.incandescent.tech docker[1565]: 2023-10-21 12:23:48 0 [Note] InnoDB: Compressed tables use zlib 1.2.11
Oct 21 14:23:48 galera02.incandescent.tech docker[1565]: 2023-10-21 12:23:48 0 [Note] InnoDB: Number of transaction pools: 1
Oct 21 14:23:48 galera02.incandescent.tech docker[1565]: 2023-10-21 12:23:48 0 [Note] InnoDB: Using crc32 + pclmulqdq instructions
Oct 21 14:23:48 galera02.incandescent.tech docker[1565]: 2023-10-21 12:23:48 0 [Note] InnoDB: Initializing buffer pool, total size = 1.000GiB, chunk size = 16.000MiB
Oct 21 14:23:48 galera02.incandescent.tech docker[1565]: 2023-10-21 12:23:48 0 [Note] InnoDB: Completed initialization of buffer pool
Oct 21 14:23:48 galera02.incandescent.tech docker[1565]: 2023-10-21 12:23:48 0 [Note] InnoDB: File system buffers for log disabled (block size=512 bytes)
Oct 21 14:23:48 galera02.incandescent.tech docker[1565]: 2023-10-21 12:23:48 0 [Note] InnoDB: End of log at LSN=306743910
Oct 21 14:23:49 galera02.incandescent.tech docker[1565]: 2023-10-21 12:23:49 0 [Note] InnoDB: Opened 3 undo tablespaces
Oct 21 14:23:49 galera02.incandescent.tech docker[1565]: 2023-10-21 12:23:49 0 [Note] InnoDB: 128 rollback segments in 3 undo tablespaces are active.
Oct 21 14:23:49 galera02.incandescent.tech docker[1565]: 2023-10-21 12:23:49 0 [Note] InnoDB: Setting file './ibtmp1' size to 12.000MiB. Physically writing the file full; Please wait …
Oct 21 14:23:49 galera02.incandescent.tech docker[1565]: 2023-10-21 12:23:49 0 [Note] InnoDB: File './ibtmp1' size is now 12.000MiB.
Oct 21 14:23:49 galera02.incandescent.tech docker[1565]: 2023-10-21 12:23:49 0 [Note] InnoDB: log sequence number 306743910; transaction id 305297
Oct 21 14:23:49 galera02.incandescent.tech docker[1565]: 2023-10-21 12:23:49 0 [Note] Plugin 'FEEDBACK' is disabled.
Oct 21 14:23:49 galera02.incandescent.tech docker[1565]: 2023-10-21 12:23:49 0 [Note] InnoDB: Loading buffer pool(s) from /var/lib/mysql/ib_buffer_pool
Oct 21 14:23:49 galera02.incandescent.tech docker[1565]: 2023-10-21 12:23:49 0 [Note] Recovering after a crash using galera02-bin
Oct 21 14:23:49 galera02.incandescent.tech docker[1565]: 2023-10-21 12:23:49 0 [Note] Starting table crash recovery…
Oct 21 14:23:49 galera02.incandescent.tech docker[1565]: 2023-10-21 12:23:49 0 [Note] Crash table recovery finished.
Oct 21 14:23:49 galera02.incandescent.tech docker[1565]: 2023-10-21 12:23:49 0 [Note] InnoDB: Buffer pool(s) load completed at 231021 12:23:49
Oct 21 14:23:49 galera02.incandescent.tech docker[1565]: 2023-10-21 12:23:49 0 [Note] Server socket created on IP: '0.0.0.0'.
Oct 21 14:23:49 galera02.incandescent.tech docker[1565]: 2023-10-21 12:23:49 0 [Note] WSREP: wsrep_init_schema_and_SR (nil)
Oct 21 14:23:50 galera02.incandescent.tech docker[1565]: 2023-10-21 12:23:50 0 [Note] WSREP: Server initialized
Oct 21 14:23:50 galera02.incandescent.tech docker[1565]: 2023-10-21 12:23:50 0 [Note] WSREP: Server status change initializing -> initialized
Oct 21 14:23:50 galera02.incandescent.tech docker[1565]: 2023-10-21 12:23:50 0 [Note] WSREP: wsrep_notify_cmd is not defined, skipping notification.
Oct 21 14:23:50 galera02.incandescent.tech docker[1565]: 2023-10-21 12:23:50 3 [Note] WSREP: Recovered position from storage: 16442fed-6f68-11ee-ae8d-9b68eafda4eb:113997
Oct 21 14:23:50 galera02.incandescent.tech docker[1565]: 2023-10-21 12:23:50 3 [Note] WSREP: Server status change initialized -> joined
Oct 21 14:23:50 galera02.incandescent.tech docker[1565]: 2023-10-21 12:23:50 3 [Note] WSREP: wsrep_notify_cmd is not defined, skipping notification.
Oct 21 14:23:50 galera02.incandescent.tech docker[1565]: 2023-10-21 12:23:50 3 [Note] WSREP: Recovered view from SST:
Oct 21 14:23:50 galera02.incandescent.tech docker[1565]: id: 16442fed-6f68-11ee-ae8d-9b68eafda4eb:113995
Oct 21 14:23:50 galera02.incandescent.tech docker[1565]: status: primary
Oct 21 14:23:50 galera02.incandescent.tech docker[1565]: protocol_version: 4
Oct 21 14:23:50 galera02.incandescent.tech docker[1565]: capabilities: MULTI-MASTER, CERTIFICATION, PARALLEL_APPLYING, REPLAY, ISOLATION, PAUSE, CAUSAL_READ, INCREMENTAL_WS, UNORDERED, PREORDERED, STREAMING, NBO
Oct 21 14:23:50 galera02.incandescent.tech docker[1565]: final: no
Oct 21 14:23:50 galera02.incandescent.tech docker[1565]: own_index: 2
Oct 21 14:23:50 galera02.incandescent.tech docker[1565]: members(3):
Oct 21 14:23:50 galera02.incandescent.tech docker[1565]: 0: 27fcd22a-7009-11ee-9a2b-5647f27ea5ae, e541a05fe7a3
Oct 21 14:23:50 galera02.incandescent.tech docker[1565]: 1: 860d53c3-6f83-11ee-88b1-1309baa24770, 780dc59b17db
Oct 21 14:23:50 galera02.incandescent.tech docker[1565]: 2: a1d6cfa1-700c-11ee-90b2-176fa6c70192, 11a0c1b70499
Oct 21 14:23:50 galera02.incandescent.tech docker[1565]: 2023-10-21 12:23:50 3 [Note] WSREP: wsrep_notify_cmd is not defined, skipping notification.
Oct 21 14:23:50 galera02.incandescent.tech docker[1565]: 2023-10-21 12:23:50 6 [Note] WSREP: Recovered cluster id 16442fed-6f68-11ee-ae8d-9b68eafda4eb
Oct 21 14:23:50 galera02.incandescent.tech docker[1565]: 2023-10-21 12:23:50 3 [Note] WSREP: SST received: 16442fed-6f68-11ee-ae8d-9b68eafda4eb:113997
Oct 21 14:23:50 galera02.incandescent.tech docker[1565]: 2023-10-21 12:23:50 3 [Note] WSREP: SST succeeded for position 16442fed-6f68-11ee-ae8d-9b68eafda4eb:113997
Oct 21 14:23:50 galera02.incandescent.tech docker[1565]: 2023-10-21 12:23:50 0 [Note] WSREP: Joiner monitor thread ended with total time 24 sec
Oct 21 14:23:50 galera02.incandescent.tech docker[1565]: 2023-10-21 12:23:50 1 [Note] WSREP: Installed new state from SST: 16442fed-6f68-11ee-ae8d-9b68eafda4eb:113997
Oct 21 14:23:50 galera02.incandescent.tech docker[1565]: 2023-10-21 12:23:50 0 [Note] mariadbd: ready for connections.
Oct 21 14:23:50 galera02.incandescent.tech docker[1565]: Version: '11.0.3-MariaDB-1:11.0.3+maria~ubu2204-log' socket: '/run/mysqld/mysqld.sock' port: 3306 mariadb.org binary distribution
Oct 21 14:23:50 galera02.incandescent.tech docker[1565]: 2023-10-21 12:23:50 1 [Note] WSREP: Cert. index preload up to 113997
Oct 21 14:23:50 galera02.incandescent.tech docker[1565]: 2023-10-21 12:23:50 0 [Note] WSREP: ####### IST applying starts with 113998
Oct 21 14:23:50 galera02.incandescent.tech docker[1565]: 2023-10-21 12:23:50 0 [Note] WSREP: ####### IST current seqno initialized to 112986
Oct 21 14:23:50 galera02.incandescent.tech docker[1565]: 2023-10-21 12:23:50 0 [Note] WSREP: Receiving IST… 0.0% ( 0/1010 events) complete.
Oct 21 14:23:50 galera02.incandescent.tech docker[1565]: 2023-10-21 12:23:50 0 [Note] WSREP: IST preload starting at 112986
Oct 21 14:23:50 galera02.incandescent.tech docker[1565]: 2023-10-21 12:23:50 0 [Note] WSREP: Service thread queue flushed.
Oct 21 14:23:50 galera02.incandescent.tech docker[1565]: 2023-10-21 12:23:50 0 [Note] WSREP: ####### Assign initial position for certification: 00000000-0000-0000-0000-000000000000:112985, protocol version: 5
Oct 21 14:23:50 galera02.incandescent.tech docker[1565]: 2023-10-21 12:23:50 0 [Note] WSREP: REPL Protocols: 10 (5)
Oct 21 14:23:50 galera02.incandescent.tech docker[1565]: 2023-10-21 12:23:50 0 [Note] WSREP: ####### Adjusting cert position: 113015 -> 113016
Oct 21 14:23:50 galera02.incandescent.tech docker[1565]: 2023-10-21 12:23:50 0 [Note] WSREP: Service thread queue flushed.
Oct 21 14:23:50 galera02.incandescent.tech docker[1565]: 2023-10-21 12:23:50 0 [Note] WSREP: Lowest cert index boundary for CC from preload: 112986
Oct 21 14:23:50 galera02.incandescent.tech docker[1565]: 2023-10-21 12:23:50 0 [Note] WSREP: Min available from gcache for CC from preload: 112986
Oct 21 14:23:50 galera02.incandescent.tech docker[1565]: 2023-10-21 12:23:50 0 [Note] WSREP: REPL Protocols: 10 (5)
Oct 21 14:23:50 galera02.incandescent.tech docker[1565]: 2023-10-21 12:23:50 0 [Note] WSREP: ####### Adjusting cert position: 113994 -> 113995
Oct 21 14:23:50 galera02.incandescent.tech docker[1565]: 2023-10-21 12:23:50 0 [Note] WSREP: Service thread queue flushed.
Oct 21 14:23:50 galera02.incandescent.tech docker[1565]: 2023-10-21 12:23:50 0 [Note] WSREP: Lowest cert index boundary for CC from preload: 112986
Oct 21 14:23:50 galera02.incandescent.tech docker[1565]: 2023-10-21 12:23:50 0 [Note] WSREP: Min available from gcache for CC from preload: 112986
Oct 21 14:23:50 galera02.incandescent.tech docker[1565]: 2023-10-21 12:23:50 0 [Note] WSREP: Receiving IST…100.0% (1010/1010 events) complete.
Oct 21 14:23:50 galera02.incandescent.tech docker[1565]: 2023-10-21 12:23:50 1 [Note] WSREP: Cert. index preloaded up to 113995
Oct 21 14:23:50 galera02.incandescent.tech docker[1565]: 2023-10-21 12:23:50 1 [Note] WSREP: Lowest cert index boundary for CC from sst: 112986
Oct 21 14:23:50 galera02.incandescent.tech docker[1565]: 2023-10-21 12:23:50 1 [Note] WSREP: Min available from gcache for CC from sst: 112986
Oct 21 14:23:50 galera02.incandescent.tech docker[1565]: 2023-10-21 12:23:50 0 [Note] WSREP: 2.0 (11a0c1b70499): State transfer from 0.0 (e541a05fe7a3) complete.
Oct 21 14:23:50 galera02.incandescent.tech docker[1565]: 2023-10-21 12:23:50 0 [Note] WSREP: Shifting JOINER -> JOINED (TO: 114023)
Oct 21 14:23:50 galera02.incandescent.tech docker[1565]: 2023-10-21 12:23:50 0 [Note] WSREP: Processing event queue:… 0.0% ( 0/25 events) complete.
Oct 21 14:23:50 galera02.incandescent.tech docker[1565]: 2023-10-21 12:23:50 0 [Note] WSREP: Member 2.0 (11a0c1b70499) synced with group.
Oct 21 14:23:50 galera02.incandescent.tech docker[1565]: 2023-10-21 12:23:50 0 [Note] WSREP: Processing event queue:…100.0% (26/26 events) complete.
Oct 21 14:23:50 galera02.incandescent.tech docker[1565]: 2023-10-21 12:23:50 0 [Note] WSREP: Shifting JOINED -> SYNCED (TO: 114023)
Oct 21 14:23:52 galera02.incandescent.tech docker[1565]: 2023-10-21 12:23:52 1 [Note] WSREP: Server 11a0c1b70499 synced with group
Oct 21 14:23:52 galera02.incandescent.tech docker[1565]: 2023-10-21 12:23:52 1 [Note] WSREP: Server status change joined -> synced
Oct 21 14:23:52 galera02.incandescent.tech docker[1565]: 2023-10-21 12:23:52 1 [Note] WSREP: Synchronized with group, ready for connections
Oct 21 14:23:52 galera02.incandescent.tech docker[1565]: 2023-10-21 12:23:52 1 [Note] WSREP: wsrep_notify_cmd is not defined, skipping notification.

Cool visualization of how PiHole 02 went down for some reason and PiHole 03 took over. PiHole 02:

PiHole 03:

As you can see these are the nodes runner02 and runner03 respectively. I’m adding this to my docker commands because there is some issue with shm, even though it might not be what happened PiHole in this case:

docker run –shm-size=256m –name pihole –network host

The error message in question:

RAM shortage (/dev/shm) ahead: 99% used/dev/shm: 67.1MB used, 67.1MB total, FTL uses 67.1MB