resc1440

Dogs in Elk: binding and source

2025-01-31T13:30:00-05:00

I found the original post of Dogs in Elk, and formatted and bound it as a book!¹

At Christmas I gave this book to my parents, who must have shown me the original sometime when I was in high school. We passed it around the room after everyone opened presents. Each family member opened the book with a mild level of interest, then slowly escalated to cry-laughing while murmuring things like “oh noooo” and “what!!”: A real pleasure. An improvement on texting everyone the link.

Dogs in Elk is a 25-year-old viral dog story. It was very widely forwarded by email, which was the style at the time. There are a few sources that come up when you search for it. The version on web.mit.edu² claims it was a rec.pets newsgroup post, but others accurately note that it comes from the Salon.com Tabletalk forum. That forum existed for 16 years, but it was taken offline with little notice in 2011. So the Dogs in Elk original disappeared from the web.

I found it again! Archive Team scraped all the public threads from Tabletalk once the shutdown announcement was made,³ so I downloaded the archive and found the thread, deep in the corpus.

Here is the section of the forum thread between the start and the end of the saga (A more focused PDF is later in this post). To find it yourself, you can download the Table Talk dump from its page on archive.org. Unzip the file, then traverse the folders Table Talk / Private Life / Private Life Attic. Open the Canine Conundrums file, and search for #1318. There are MANY more dog stories there for those who are patient.⁴

Occasional posts seem to be missing from that scrape. I noticed that #1333 was plot-relevant and missing, and copied it into my book files (and the HTML version above) from the web.mit.edu source.

Finding the original thread allowed me to choose additional posts that the copypasters of old left out. I chose to add a little more context, and prolong the suspense of the Rosh Hashanah weekend a bit. Also, with the original in hand, I could copy its formatting. I decided I wanted to give my book the feeling of a copy that someone printed out at work and brought home. Probably how I first saw it. So I kept the first page of the forum thread pretty much intact, log-in link and all.

For the endpapers I chose a commercial marbled paper that felt 90% decorative and 10% intestinal:

Here is a PDF of my formatted version, laid out for 3.75 x 5.5 inch pages.⁵ I took a lot of care in paginating it so that most questions and replies were fully visible on facing pages. I made the title pages with figlet. One who’s inclined could take this PDF over to Bookbinder JS and arrange it into signatures for binding.

There were several details of the book that I could improve. The most obvious is that the cover boards warped—I think it’s probably because the lovely endpapers don’t have as much strength as the bookcloth.⁶ A couple things are crooked. Also, I decided that since each post was numbered, there was no need for page numbers. This basically worked, but did cause me mild grief and light lamentations while I was sorting out the signatures into their right order. But overall I’m extremely happy with it as my first case-bound book! I’m grateful that I got to take a bookbinding class, and I’m looking forward to many more projects. Here’s this one with a couple others:

If you finish this post and wish to read another dog story, I recommend this one. If you are still unsatisfied, click the “family lore” tag at the bottom of that text.

This led to a lot of conversations last fall that started “So what are you up to?” — “Do you remember Dogs in Elk?”⁷ ↩
By the way, is it just me or does MIT have so much swagger for sticking with “web.mit.edu” for all these years? None of this www tridubs stuff. It’s so old-timey and pure. ↩
I ran across a former denizen of Tabletalk, who said that many of them had migrated to a specific other forum. I asked, and she was generally aware that a scrape was available on archive.org. So that’s good. ↩
I learned just now that Gus Pong was a New Guinea Singing Dog. I had glossed over when Anne V mentioned the dogs singing from inside the carcass, but it’s actually very specific. Also, Anne has such a compelling narrative voice! Amazing every time. ↩
This book ended up printed much larger than that—maybe I’ll make a smaller copy on nicer paper sometime. ↩
There are apparently a lot of details in getting book covers not to warp - the papers that wrap the front and back both expand with the wet glue or paste. Then you stick them on, and they contract as they dry. The tension has to match (including what direction it’s pulling). I’m still working on absorbing the fine points from a Keith Smith book. ↩
My wife relishes it when I have to take that sort of hard conversational left turn to answer a seemingly innocuous question. This is why she made me tee shirts emblazoned “Nautical Deborah,” “Astral Deborah,” and “Terrestrial Deborah.”⁸ ↩
So, you know the Suez Canal? Remember when the Evergiven got wedged across it a few years ago? Well I remember looking at Marine Traffic while that was on, and idly clicking on a few ships that were anchored, waiting to pass through. One of them was named Nautical Deborah, which I thought was great. As I was relaying this important information to someone, we realized that if there’s a Nautical Deborah, then there should really be Deborahs of all these other domains. My wife adores followthrough as a form of humor, and as I mentioned, loves it when I have to explain things. Accordingly, there are tee shirts. ↩

One hundred million maps

2025-01-30T13:50:00-05:00

I took an intro cog sci class in school, and during a philosophy section, we got into some verbal conundrums. If you sit on a table every day for a year, is it a CHAIR? If you shoot at a window, and there’s a moment where the bullet has gone through but the cracks have barely started to form, is the window BROKEN?

I don’t even remember what conclusions they wanted us to draw, but my takeaway was that there is no gotcha here, it’s just that the map is not the territory. Our words are great and convey a lot, but they’re orders of magnitude less complex than the physical reality we exist in. Clearly there will be some points where they don’t match perfectly.

Large language models are shaped from a hundred million maps, but have never been in a single territory.

Computers in/as art, Seeing as a Singularity - Links, May and June 2023

2023-07-05T20:25:00-04:00

We made it up to three non-working lamps in the house, and re-wiring them can’t be that hard, right? I have had a lot of trouble finding the supplies online, though - Amazon must have them but the search terms eluded me. Anyway I found Grand Brass Lamp Parts which was perfect, and the search terms are set wire with molded polarized plug and lamp holders. They have a knowledge base/faq section that tells you the names of the parts you need and other good details. Despite the items being reliable, UL-listed stuff, their prices are lower than amazon. Overall great, except that they don’t own a world-eating order fulfillment empire, so their fast shipping is expensive.

Here is A Tapestry of Time and Terrain - a really beautiful geological map of the USA (a North America version is also available with different colors). The colors in this map were chosen in a rainbow order of time, which is unusual as far as I know. Except for the Pennsylvanian brown in the USA version, maybe to mark the period of coal deposition? You can see the “vast depression in the earth’s crust, centered under the state of Michigan” (which remains a sick burn).

Speaking of pretty things, I ran across a couple of lovely articles on the history of computers in art and design. The first one, by Amy Goodchild, is a review of early techniques of computer-assisted art, starting with cool patterns people made on oscilloscope screens, and touching on computer-randomized dance, computer automation of physical sculpture, and many more concepts. It’s great to see how early some ideas were tried. Looking forward to the followups that will go into the 70s and beyond.

The second article, by Docubyte, shows dozens of early computers in really glorious detail, an ecstasy of industrial design with knobs and panels and blinkenlights.

Semi-relatedly, apparently you can absolutely pimp out your old iPod with better battery, storage, connectivity, case, operating system, all kinds of stuff - found via a helpful MeFi thread on how to consume music in a way that doesn’t suck

We had computer-assisted art, so continuing on that theme of greater possibilities of humans + tools or humans + humans, here’s a nice statement of a hunch that I had as a teenager:

The joke version goes thus: I believe in a supreme being, in that I think beinghood is closed under union, thus the set of all beings has a superema (a maximal element).

–Larger Selves by D. R. MacIver

As a teenager I thought about this kind of thing a lot for a while, for instance I rephrased renowned deity Jesus’s “where two or three are gathered in my name, I am there among them” as “God is what happens when two or three are gathered together.” That seemed a little glib, but I went with it for a while. I was reading Hofstadter and relishing the word “emergent.” I remember explaining it to some adult, and they rephrased it as “oh, it’s like all of creation singing together” and at that point, the glibness level overwhelmed me and I abandoned the thought. But I’m glad to know that someone is having interesting, related ideas, and developing them farther than I ever did!

When you’ve got structures of information flow that are much larger than small friend groups, for instance churches or corporations or governments, they are hard to comprehend or hold to account. So much so that some people date the putative Singularity not to some moment in a decade or two when Artificial Intelligence closes a loop, but back to the start of the Industrial Revolution. Here is a great article by Henry Farrell that argues this point and also touches on Large Language Models and oppression. (When you look at the header image, RLHF is Reinforcement Learning with Human Feedback, a fine-tuning step they do to large language models).

The article also mentions Seeing Like a State, so Farrell joins MacIver in the club of people who have read that book and then written articles that I really appreciate. The book is rumored to be a slog, but maybe I have to read it sometime.

OK, I’m done with segues, here’s what else has been on my mind:

Take a look at your smoke detectors. Do they look yellowed? They are too old. They stop working as well after ten years, even if you keep replacing the battery. Also, you can now get detectors that detect smoldering fires WAY better than traditional ones. I realized that the previous occupants of my house didn’t replace the detectors at their 10 year mark, so most of mine are 20 years old! I’ve started replacing them with dual-detector (photo & ion) models.

Let’s Learn Everything is a podcast I just discovered that’s been a delight. I consume a lot of nonfiction-as-entertainment, and this is fresh and nice! (via)

I don’t know enough on Physics to know if this is actually a big new idea or not, but it does seem very correct to me - Assembly Theory, about path-dependency in the history of phenomena

I read Robin Hobb’s Farseer trilogy and found it to be a little on the intense side of what I normally like, but still worthwhile.

I also read Light from Uncommon Stars by Ryka Aoki and found it really moving. Would recommend it, although look up its trigger warnings.

It’s hurricane season, so Tropical Tidbits has started releasing videos again - if you’re vaguely curious about meteorology, they’re very watchable and you can glean things.

My computer’s wifi broke out of the blue, didn’t work after rebooting and powering off. Taking my laptop apart, removing and reinstalling the wifi card did the trick though! There’s no trick like an old trick.

Dwarf Metal music exists and is worth experiencing once!

Links, April 2023

2023-05-02T15:14:00-04:00

During the powerful winter storm in the Midwest late last December, apparently it was too cold to operate a lot of natural gas power plants! We avoided more blackouts because wind energy really came through (it was awfully windy). There’s a system in place to reward resilient generation capacity, and penalize if you say your capacity is resilient but it isn’t. The link is an interesting Union of Concerned Scientists blog post about the whole thing, and the natural gas power plants’ attempts to evade the consequences.

Another interesting thing from the Union of Concerned Scientists’ blog was a few years ago - Dave Lochbaum wrote a series of articles about harrowing near-miss problems at nuclear power plants.

For instance, here is a post about arcing in electrical equipment in power plants, which includes this video of a controlled test:

A lot of the failures Lochbaum highlighted over the series felt like pretty normal industrial facility problems that could be controlled by good management, but weren’t. IIRC the UCS’s position is that nuclear plants can be run safely, but that some are clearly run more safely than others, and that the regulators are way too lax with the low performing operators.

On a tangent, strange guy / chemistry youtuber CodysLab refined Uranium metal from a rock a few years ago.

This is a nice one-hour summary of the geology of Indiana. And here’s a delightful and earnest geologist getting excited about the Great Unconformity, which yeah, I find spooky.

Jonathan Frakes asks you things: guaranteed to make you feel a feeling in 48 seconds

A powerful takedown of the panic about trans athletes, via a MetaFilter post with a few more links

I’m not a MeFite myself, but they have RSS feeds of best and popular posts that are consistently interesting to me.

Speaking of RSS, I am still leading that Google Reader lifestyle, with Feedbin and the Reeder app. Updates from sources I choose, in beautiful reverse chronological order. It’s very nice and I recommend it!

Cory Doctorow wrote a scathing article about how “gig work” companies twiddle the amount they pay workers on each job: they lure workers in with high payouts and then taper their pay down to the lowest amount each worker will tolerate. Algorithmic wage discrimination - really sickening.

Kottke had a special day of being blown away by an incredible drummer, Larnell Lewis: Drummer Plays Metallica’s Enter Sandman After Hearing It Only Once, followed by An Epic Improvisation - I’ve watched that video about 15 times and it was stuck in my head for a week.

Cool Tools featured a usable telescope for $48 which sounds amazing

Had to explain about light switch raves

A gardening song more fun and honest than Inch by Inch, Row by Row (but less depressed than Slug by Slug, Weed by Weed)

Two nice interviews about Aardman’s stop motion productions (e.g. Wallace and Gromit) - Adam Savage and Wired

Safety sign generator. I don’t understand why people aren’t more excited about this. My wife and I used it to make safety signs of like a dozen in-jokes, an hour well spent.

Personal Preference is getting an update - the original was a favorite

I tried ChatGPT and didn’t find it very fun, although maybe I just didn’t find a good interaction pattern?

MicroPython, a stripped-down version of Python for microcontrollers, celebrated ten years of existence! I’ve gotten a lot of use out of the Adafruit fork, CircuitPython, for instance using it to control the e-ink display of the MagTag.

I re-read five of the six main Queen’s Thief novels - it turns out that blasting through the audiobooks almost one a day is a little too fast, and the sixth one was a bridge too far. But the series is still great, I’ll get back to the last one soon. Audiobooks are nice when gardening.

as soft as the first, sweet like an apple (apologize)

Links, March 2023

2023-03-31T10:28:00-04:00

I got on a little kick for old-time telephone switching systems. I started with the Connections Museum playlist about how telephone calls used to work, where Sarah’s excitement about the whole thing was totally infectious. In one of her videos, she linked to Evan Doorbell, who talks about phone phreaking with the most delicious radio voice.

The story of the invention of automatic telephone switching is truly wild, starting with a business dispute between an undertaker and his local telephone company. And it happened in 1891 - just one year after Hollerith first used automatic tabulation and punch cards in the US Census. I’m blown away by the complexity of these information systems, starting roughly 60 years before the first modern, stored-program computer.

Tim Hunkin, of Secret Life of Machines fame, has been making a lovely series of videos about different components DIYers can use, based on his decades of experience making one-off satirical arcade machines and other magnificent gadgets.

Inside a megawatt radio transmitter, and part two

This is the month I became aware of Mr. Blobby - wow

I’ve been watching through Ben Eater’s series on building a 6502 CPU into a minimal computer. 6502 assembly language is gloriously easy to understand, and he does a great job of going from simple to complex one step at a time. His series on USB and on the “world’s worst video card” are also nice.

Cookie Monster makes John Oliver totally crack up

Music from the Demoscene - click Listen in the upper right. There are so many bad tracks in the world, it’s nice to have a streaming station of 90% good ones.

Why Clip Art Was Everywhere… Until it Wasn’t

Different types of panning demo - Increase stereo image - Dave Rat, a sound guy from huge acts like RHCP, has a youtube channel. I’ve been watching his videos about making live sound work better - maybe someday I’ll run sound for contra dances again, and it would be fun to try his tips like these, or double mic’ing, etc.

Quick documentary about how the FDIC takes over a failed bank - or the audio version from This American Life. Kind of fascinating, and relevant again. Calculated Risk has links to further info about how banks are evaluated.

Wildly compelling hambone performance

Making a production run of resin-cast figures - we used his cut-mold process to copy some chess pieces and make soap in their shape, and it worked really well!

This might be my year of 3D modelling, and if so, I plan to use Michal Zalewski’s Guerilla guide to CNC and resin casting

Spending the night in a Titan II Missile Silo

See, him face?

Tax Heaven 3000, a dating sim that does your taxes (my taxes are done in a much more sedate way but this is pretty funny)

Cheating and going back to earlier this year -

A Marxist View of Tolkein’s Middle Earth (via metafilter) - “J. R. R. Tolkien’s fantasy world is a medieval utopia with poverty and oppression airbrushed out of the picture. But Tolkien’s work also contains a romantic critique of industrial capitalism that is an important part of its vast popular appeal.” Wouldn’t call myself a Marxist but this was very interesting

TikTok’s enshittification - this seems to have a lot of explanatory power for how online spaces grow and die

A low-tech way to see the TOTP secret exported from Google Authenticator

2023-02-01T12:34:00-05:00

Google Authenticator’s Export functionality produces a QR code. You can scan the QR code with another copy of Google Authenticator, to transfer the Time-based One-Time Password secret to a new phone for example. But if you want to use it in another context, it’s annoying and tricky. For example, if you need to authenticate in order to run automated tests, you can’t be getting your phone out each time your CI job runs.

These instructions are for a Debian-based Linux machine.

sudo apt-get install zbarcam-gtk oathtool protobuf-compiler
Click the three dots menu in Authenticator, choose Export, and select the accounts you want to export
Run zbarcam-gtk and point your computer’s camera at the QR code displayed on your phone
Copy the URL at the bottom of the window
Paste it somewhere and delete the prefix, QR-Code:otpauth-migration://offline?data=

Open Python3 and run:

from urllib.parse import unquote
import base64
with open("secret.proto") as out:
 out.write(unquote("the rest of the decoded QR"))

Back in the terminal, run protoc --decode_raw < secret.proto
rm secret.proto
Copy the thing that looks like \123WE\012 etc – the binary representation of the TOTP secret – not including its quotation marks.
Back in Python, type
```
base64.b32encode(b"PASTE HERE")
```
You should get back a bytes object that’s all letters and numbers. That’s the TOTP secret, encoded in base32.
Now, any time you need a one-time password, you can run
```
oathtool -b --totp the_base32_secret
```

This is less secure than your phone, e.g. your secret will be visible in your shell history file. But it can be worthwhile in certain cases.

I did it this way because I didn’t know what TOTP desktop apps were trustworthy or would send your passwords to Nocturnal Aviation Associates. I figured these tools were low-level enough that they wouldn’t be scams?

Barometz (The Vegetable Lamb)

2022-12-15T17:51:00-05:00

When cotton was first introduced to Europeans in medieval times, they were mystified. What was the source of this marvelous material? Theories abounded. For a time, the source was thought to be ‘the Vegetable Lamb of Tartary’—a plant with tiny sheep on stems bowing down and grazing the undergrowth. One can only imagine how they thought all those tiny sheep were shorn.

From The Practical Spinner’s Guide: Cotton, Flax, Hemp, Stephenie Gaustad, 2014

My wife Jessica showed me this passage, and we obviously had to know more. The creature’s wikipedia page quoted some extraordinary verse by Dr. Erasmus Darwin (one of those Darwins):

E’en round the Pole the flames of love aspire,
And icy bosoms feel the secret fire,
Cradled in snow, and fanned by Arctic air,
Shines, gentle borametz,¹ thy golden hair
Rooted in earth, each cloven foot descends,
And round and round her flexile neck she bends,
Crops the grey coral moss, and hoary thyme,
Or laps with rosy tongue the melting rime;
Eyes with mute tenderness her distant dam,
And seems to bleat – a vegetable lamb

(Listen, because I am telling you that there is a two-volume book of rapturous poetry about botany, by Darwin’s grandpa, available for free on Project Gutenberg: The Economy of Vegetation and The Loves of the Plants.)

I decided that this lovely misconception needed to be set to music. It’s in iambic pentameter, so I looked through Hymnary by meter and found Magda by Ralph Vaughan Williams to be suitably tender.

So! Here is the sheet music (revision 5) if you would like to sing about this earthy plant-beast. Maybe you can use it in a concert about… misconceptions? Exoticism? Evolution? Fabric? Sheep?

The sheet music is licensed CC-BY 4.0; I would love to know if you use the music, my email address is in the footer. Error reports also welcome.

Engraving by Sir John Mandeville, 14th century

Borametz, Barometz, and Borometz all seem to be valid names. Also Scythian Lamb. ↩

Dissecting an asthma inhaler with a dose counter

2020-12-19T23:27:00-05:00

Back in the 90s, before Le Chiffre made asthma inhalers cool,¹ my mother taught me how to tell if my Proventil canister was empty. If there was any of that sweet sweet albuterol left, it would float vertically in water, but if it went horizontal it was empty.

Apparently, in the years since I was a wheezyboy, inhaler technology has advanced a bit. Modern ones have clockwork contrivances to tell you how much is left, which I have to admit is convenient.

I got curious about its inner workings, so I pried the whole thing apart and took pictures.

Here’s the canister that holds the medicine and a propellant.² The left part of the canister in this picture contains a valve that dispenses a consistent amount of medication each time the white stem is pushed into the body of the canister.

Figure copyright Federico Lavorini, CC BY 3.0, from The Challenge of Delivering Therapeutic Aerosols to Asthma Patients

The other essential mechanical component of the device is the mouthpiece with its nozzle, which expands the squirt of medication into an aerosol so that it can make it all the way into your lungs. In this photo we’re looking straight down the nozzle.

Again back in the 90s, when my inhaler was tumbling around my green and purple nylon fanny pack, it would probably actuate uselessly sometimes. These days, the mouthpiece cover prevents the actuation from happening by blocking it:

Since they’re using the mouthpiece cover for that, it has to latch on so it doesn’t just fall off. They include unlatching instructions:

Hah. Okay, so now let’s look at the dose counter.

It’s normally jammed onto the medication container:

How does it know when you’ve done a puff? The red body of the inhaler has a tab that sticks out, and it pushes a lever inside the grey cap.

Pushing the lever turns this worm gear a partial turn.

That’s the underside, here’s the top:

The dial has rack-style teeth around its edge, which are moved by the worm gear. The black gunk is graphite, I was trying to turn it with a pencil.

How exactly does pushing in the red tab turn the worm gear? The tab pushes a pin, which turns this ratchet wheel:

Here I’ve taken out that pin, the spring that holds it down, and the ratchet - worm gear spindle.

The pin has a dangly bit, does it count as a flexture? Anyway it looks like a devil’s tail.

Here are all the parts laid out:

Finally, here are some close up details of random parts.

Life is good with asthma inhalers! Better living through chemistry! Thanks for playing, thanks for breathing, thanks for reading!

Did he make inhalers cool, or did he make them sinister? Also, his technique was bad:

Le Chiffre is seen to be using his [metered dose inhaler] device too fast for good lung deposition and does not often shake the inhaler before use. This will only result in deterioration of his symptoms and poor asthma control during stressful situations.

-Medicines Academy ↩
The propellants of these metered-dose inhalers are often potent greenhouse gases! Inhalers accounted for 4% of the greenhouse gas emissions of the entire UK National Health Service in a recent year. My doctor recently switched me to a different control inhaler, which uses powders - there’s more plastic waste, but it must be better for climate. ↩

System76 Darter Pro 6: power supply, case screws

2020-11-20T23:15:00-05:00

I like this laptop a lot! It comes with a Chicony power supply, 19V 3.42A 65W. Those are easy to find, but you have to get the right barrel connector. The nominal outer diameter of the barrel is 5.5mm, the nominal inside is 2.5mm. The tip is positive. I ordered this power adapter from amazon, and the brick part is exactly what I got from System76. The barrel fits correctly except it’s a couple mm too long, which I don’t mind. If that link is dead, try searching for “chicony toshiba satellite 19v 65w.” I like supporting System76, but not quite enough to buy replacement AC adaptors from them.

My case screws keep slowly working out somehow, which is annoying. The screws are M2 by 5 mm long if you need to order them. This screw assortment included them.

Delights of a Minnesotan Gigabit Switch (part 3, good hax!)

2020-10-27T22:02:00-04:00

Welcome back! I’m rehabilitating and taking control of a Waters Network Systems GSM-2112-POE 12-port managed Ethernet switch. You can check out part 1 or part 2 if you feel like it.

In case you don’t feel like it, I’ll sum up where we are in the story: my current Ethernet switch has no character and isn’t rack-mounted so much as rack-zip-tied:

I expect to need more than its four power-over-ethernet ports. I’ve bought a high-quality but decade-old switch from eBay for pretty cheap. The people who sold me the switch did not do a factory reset, and I don’t have the admin password. My attempts to hack the thing over the network have failed up to this point. They could possibly be successful eventually, but they seem like an annoying amount of work. I have bought the cable to go from my USB port to this Serial console on the back of the box:

Okay, I hook the new cable up between the Serial port and my laptop. How do I actually talk to it?

In my youth, my daddy taught me to use a program called Kermit to dial into some computer at his work so that I could read rec.pets. Fond memories, and Kermit is furthermore a great name for a program, but alas: I now find it 100% incomprehensible. GNU Screen seems to be the actual thing to use.¹

The baud² rate 57600 comes from the manual. Here’s the command line to connect and start interacting:

sudo screen /dev/ttyUSB0 57600

And rebooting the switch gives:

Read system parameters from IIC EEPROM...Done!

BIOS v1.07 

BIOS(0)> ................................................
.........................................................
............Now booting image...

Followed by the normal login prompt - the login isn’t any different from what I see on telnet. But hey, the BIOS(0)>. The > looks like a command prompt? Yes actually! Apparently you have to be quite speedy, there’s only a few seconds grace period, but after a few tries:

BIOS(0)> help
 ===========================================================
        BIOS Command line interface HELP     
 ===========================================================
 help       :  Help for bios command. 
 ls         :  Display the bios command list. 
 sysconf    :  System parameter configuration. 
 flash      :  Flash Device Utility. 
 load(r)    :  Excutable image download[load] & run[loadr] at free memory area. 
 boot       :  vLinux Boot Loader can be selected. 
 dump       :  Memory Dump Command. 
 sys        :  Usage : sys {model|mac{0|1}|prod|ser|hard|mech|ram|flash|show} value . 
 look       :  look ext 0 , 1 ,2 . 
 fill       :  fill memory (4 byte) . 
 sdram      :  SDRAM test . 
 p1         :  p1 {0|1} GBIO Port 1. 
 rd         :  rd block sublock reg 
 ===========================================================

BIOS(1)> 

Huh, sysconf looks vaguely interesting, let’s look:

BIOS(1)> sysconf view

Read system parameters from IIC EEPROM...Done!

+==================================================+
|           System Configuration Table             |
+==================================================+
|  Configuration Parameter valid !!!               |
|               Boot Configuration                 |
+--------------------------------------------------+
|  BOOT Method : manual                            |
|  Boot File Name :                                |
|  TFTP Server IP Address : 192.168.1.176          |
+--------------------------------------------------+
|             Ethernet Configuration               |
+--------------------------------------------------+
|  Host Name : RubyTech                            |
|  Ethernet IP Address : 192.168.1.1               |
|  Ethernet Default Gateway : 192.168.1.254        |
|  Ethernet Default Subnet Mask : 255.255.255.0    |
|  Ethernet H/W Address : 00:40:c7:d0:00:00        |
+==================================================+

Cool! You love to see the text-based tables, for one thing. But more pertinently, it looks like if I created a bootable firmware image, the BIOS would let me load it onto the switch using TFTP and boot into it! So how do I do that?! Actually, it’s not super easy.³ So I put this possibility in my back pocket for now. Another interesting thing we can see here is the name RubyTech. I asked Jeeves, and RubyTech is apparently a Taiwanese supplier of private label network equipment. Presumably it’s where Waters bought the hardware?

I poked around the menu a while longer, which I’ll spare you. The most useful thing turned out to be the memory dump command:

BIOS(4)> dump 0x0
00000000:0000000f   18 f0 9f e5 18 f0 9f e5  -  18 f0 9f e5 18 f0 9f e5 
00000010:0000001f   18 f0 9f e5 18 f0 9f e5  -  18 f0 9f e5 18 f0 9f e5 
00000020:0000002f   01 18 a0 e3 01 24 a0 e3  -  04 30 90 e4 04 30 82 e4 
00000030:0000003f   04 10 51 e2 fb ff ff 1a  -  58 23 5e 00 ff 10 a0 e3 
00000040:0000004f   00 10 80 e5 14 01 9f e5  -  20 10 a0 e3 00 10 80 e5 
00000050:0000005f   f8 00 9f e5 f8 10 9f e5  -  00 10 80 e5 5c 00 8f e2 
00000060:0000006f   fe 1f 90 e8 ec 00 9f e5  -  fe 1f 80 e8 f0 00 9f e5 
00000070:0000007f   01 18 a0 e3 5e 28 a0 e3  -  04 30 90 e4 04 30 82 e4 
00000080:0000008f   04 10 51 e2 fb ff ff 1a  -  5e f8 a0 e3 00 00 00 00 
00000090:0000009f   f8 3f 50 05 60 00 00 04  -  50 00 08 24 4c 00 09 25 
000000a0:000000af   00 00 00 00 00 00 00 00  -  00 00 00 00 80 03 04 20 
000000b0:000000bf   00 00 00 00 00 00 00 00  -  00 00 00 00 60 83 21 9c 
000000c0:000000cf   f8 3f 50 05 60 00 04 14  -  50 00 08 24 4c 00 09 25 
000000d0:000000df   00 00 00 00 00 00 00 00  -  00 00 00 00 80 03 00 10 
000000e0:000000ef   00 00 00 00 00 00 00 00  -  00 00 00 00 60 83 21 9c 
000000f0:000000ff   f8 3f 50 05 60 00 00 04  -  50 00 08 24 4c 00 09 25 

===========================================
=   1. Next Memory Address View![Any Key] =
=   2. New Address Input![N]              =
=   3. Exit [Q]                           =
===========================================

Well, cool - we can see the memory in hexadecimal format. That page doesn’t actually mean anything to me yet, but there’s got to be good stuff in there if we look through everything! At last, a clear direction - time to start hackin’, baby! That’s what real hackers say, right?

Here’s a script using pexpect to start the serial communication and interact with the BIOS menu to record everything to a file, memory_dump.txt.

Assuming you’ve got a Python 3 virtualenv env with pexpect installed, and the script is dump_memory.py, you’d invoke it as sudo env/bin/python dump_memory.py. Once the script is started, you would Reset the switch.

import pexpect
import time


# Start communicating with the switch
child = pexpect.spawn('screen /dev/ttyUSB0 57600')
# Tell pexpect to record one side of the conversation -
# everything the switch sends to the laptop - to a file
child.logfile_read = open('memory_dump.txt', 'wb')

# This means to ignore everything the switch sends to us,
# UNTIL we get the '> ' - the BIOS command prompt.
child.expect('> ')
time.sleep(0.1)
# Start the memory dump at address 0
child.send('dump 0\r\n')

# Keep sending Space every time it's done printing
# a block of memory
while True:
    child.expect('Next Memory Address View')
    time.sleep(0.1)
    child.send(' ')

I run it for a while - maybe an hourish? At some point, I notice that it only seems to be reading f8 3f 50 05 over and over and over again. This pattern seems to start at the 20 megabyte boundary (0140 0000 hex). There are a few other bytes thrown in, but this seems boring, so I stop the process.

I don’t want to deal with this as hex, I want to make it a binary file so that I can unzip it if it’s zipped, search for strings, and so on. So I write another small python3 script, to separate the lines with hex data from the lines with BIOS(0), the instructions, and so on, and then convert the hex to the binary characters it represents:

out = open('memory_dump.bin', 'wb')

# Example lines this will deal with:
"""
000000e0:000000ef   00 00 00 00 00 00 00 00  -  00 00 00 00 60 83 21 9c
000000f0:000000ff   f8 3f 50 05 60 00 00 04  -  50 00 08 24 4c 00 09 25

===========================================
=   1. Next Memory Address View![Any Key] =
=   2. New Address Input![N]              =
=   3. Exit [Q]                           =
===========================================
00000100:0000010f   00 00 00 00 00 00 00 00  -  00 00 00 00 13 02 04 a0
00000110:0000011f   00 00 00 00 00 00 00 00  -  00 00 00 00 60 83 21 9c
"""
for line in open('memory_dump.txt', 'r'):
    # Exclude lines with only instructions & stuff.
    # There's also all kinds of control codes and junk
    # in there, but I ignored it and it didn't
    # seem to matter?
    if line and line[0] in '01234567890abcdef':
        line = line.strip()
        # The sections of the line are separated by double spaces.
        # We don't care about the address or the dash, just the
        # first and second sections of data.
        addr, first, dash, second = line.split('  ')
        out.write(bytes.fromhex(first))
        out.write(bytes.fromhex(second))

out.flush()
out.close()

So I’ve got a 20+ megabyte binary file - what is in there? I have seen people do pretty wild stuff to firmware images with a program called binwalk, so I install that and set it loose. Unfortunately, it misidentifies basically everything. Nope, that’s not a stuffit file, and that other thing isn’t 7zip. I don’t know. It doesn’t do it for me.

Presumably there must be a kernel in there, and possibly file data, but I don’t get as far as figuring that out, because strings turns out to be the only analysis tool I need. strings is a basic Unix tool that looks inside a binary file for parts that look like text. I spend a bit of time paging through the results, but eventually I get bored, and search for admin, the administrator username from the documentation. Boom!

admin
adminpass
guest
guest
0.0.0.0
0.0.0.0
public
private

There it is! Very likely the password!⁴

I had been expecting a normal Linux /etc/passwd or shadow file entry like admin:$1$YjOzcqrf$Zqx4sx5CQRuEIFCdOLAJV0:0:0:admin:... but no, it seems to be sitting there in plain text, no password cracking required! Sure enough:

L2 Managed Switch - GEPoEL2-SW12

Login: admin
Password: 

waters2# 

If you’re doing this on your system and the memory layout is identical, then you should just have to dump one block, starting at 0x011b0400. This switch has the concept of two independent configurations, one that’s used when rebooting and another that can be made active by a command. So that you can really screw up the temporary config, and when everything goes to hell, reboot the switch and everything should be peachy again. Anyway, I did see another copy of the user/pass data at 0x013b0400, two megabytes after the first copy, so maybe that’s how this double config thing works.

Anyhow! Yay! The switch is mine now! My naming scheme for computers is names of fictional musicians (e.g. Jake and Elwood Blues), plus fanciful stage names of real musicians (e.g. Tank Slagknuckle and Stellar Tellar).⁵ So, I’m pleased to introduce Mr. Fabulous:

Mr. Fabulous been doing strong work for a month or two now, and I’m very pleased. I set up a VLAN for some of my Internet of Shit devices, and the switch’s port mirroring capability made that very easy to debug. The switch’s extremely beefy-looking internal power supply has had zero trouble taking care of the four powered devices on my network - I’ve never noticed the switch get perceptibly warmer than ambient temperature.

Given the one to two decade old network security of the switch’s web interface, I’ve placed that off in an inaccessible subnet, and I do all my admin through the serial console. Just because I’m too lazy and simpleminded to hack this thing over the network, that doesn’t mean everyone is.

Thanks for reading!

Why is Screen a serial communication console as well as a window manager and a bad process supervisor? IDK, I slightly resent Screen. Give me Tilix any day! Except the day I need to talk to a crusty ol’ serial console. Humph. ↩
Re: data transmission, check these videos out if you want to be fascinated, or this paper if you want to be both fascinated and bored! ↩
According to an article from hackaday,

There is no uniform way that ARM processors are booted and there’s no uniform or even standardized boot software for ARM-based chips.

↩
It’s not the real one, since I told you too much about the institution the box came from. The real password had an air of sadness though. ↩
I made an exception for this switch’s predecessor. I thought that since it was a Power over Ethernet (PoE) switch, it should be called Edgar Allan. But I bet everyone with a PoE switch thinks the same thing :-/ ↩