G Suite legacy free edition retirement - What to do

I've had a few of my domains pointed to G Suite since its inception.  During that beta period, it was free to try out and anyone who got in then has been able to stay free all this time.

Months ago I started getting notifications that looked like they were saying it would no longer be free and that I'd have to sign up and start being billed.  I didn't really want to pay for this for three domains since they're basically just toy domains, not really doing anything interesting or worthwhile.

I finally started researching my options and found this little tidbit buried in one of the G Suite legacy free edition support pages...

I used my account for personal use

...this handy little button.

For non-commercial use, you can still continue for free. You don't have access to any of the premium services, but all the core services (Gmail, Calendar, Drive, Meet, Sites, etc) remain free.

Now I'm curious as to whether a regular account, not "legacy", could use this option to declare their account is just for personal use as well.  🤔

Putty and double bastion host tunneling

I've always found complex ssh tunneling to be a pain in Windows.  Unfortunately, I'm stuck with it due to company mandate.  This post is as much about sharing the info as it is about documenting it so that I can come back and refer to it when I forget everything here.

So, the use case is this.  You have a host that you have to hop through in order to get to other hosts, but there may be more hosts that you can't get to unless you hop through yet another host.

For example, if I want to access my Linux workstation at the office, I have to hop through two hosts, my ssh bastion host and from there to another host that also has an IP on the office network, and from there to my desktop.

Even to experienced tunnelers, that's daunting, especially from Windows.

So, here goes.  Here's what the values in my example mean:

My workstation: 172.16.0.99
The public facing bastion host: bastion.example.com
The internal server: server1.example.com
My username on my workstation: myusername
My username when accessing company servers: companyusername
My WSL username: myWSLusername

Putty Configuration

1. Create a new session in Putty.
2. Hostname: 172.16.0.99
3. Port: 22
4. Category → Connection → Data
• Auto-login username: myusername
5. Category → Connection → Proxy
• Proxy type: Local
• Telnet command, or local proxy command:
  c:\progra~1\putty\plink.exe -ssh -agent -A -l companyusername server1.example.com -nc %host:%port -proxycmd "c:\progra~1\putty\plink.exe companyusername@bastion.example.com -l companyusername -agent -A -nc server1.example.com:22"
6. Category → Connection → SSH
• Enable compression
• Notice that I didn't use the compression option -C in my plink commands in the previous step.  When tunneling ssh traffic, you should only enable compression in one place so that you're not compressing traffic only to have other segments attempting to compress the already compressed data.
7. Category → Connection → SSH → Auth
• Attempt authentication using Pageant
• Allow agent forwarding
8. Category → Connection → SSH → X11
• With WSL and VcXsrv X Server installed, you can run gui apps
• X11 Forwarding: Enable X11 forwarding
• X display location: 127.0.0.1:0.0 (Look in VcXsrv server's log to confirm this value.)
• Remote X11 authentication protocol: MIT-Magic-Cookie-1
• X authority file for local display:
  %LOCALAPPDATA%\Packages\CanonicalGroupLimited.Ubuntu18.04onWindows_79rhkp1fndgsc\LocalState\rootfs\home\myWSLusername\.Xauthority
• (You might to run from WSL bash shell xauth generate $DISPLAY initially to get the x authority file seeded.)
9. Save new Putty session
10. Launch new Putty session

There are certainly other ways of doing this that can be a little bit simpler.  One of the reasons I used this method is because my bastion host strips X11 traffic.  It's not configured for it and doesn't have any of the required x related dependencies needed (xorg-x11-server-utils et. al.).  Doing it the way I have creates a tunnel that simply passes all traffic through to the next host keeping me well below the application layer from the perspective of the bastion host.

Workstation File Access

The other advantage to this method is that I can use this same Putty session to make additional ssh tunnels that go right to my workstation.  So, in my Putty config detailed above, I also have a local tunnel 20202:172.16.0.99:22 that gives me direct ssh access to my workstation by ssh'ing to 127.0.0.1:20202 here on my laptop.

So, software like WinSCP can now access my workstation over this tunnel and behaves as if it were direct access.  I use Mountain Duck, which is not free software. The end result is that it allows me to map a drive right to my Linux workstation at the office from my Windows 10 laptop at home.

(Additionally, I use the RDP tunneling method described in my previous post to make it so that RDP sessions end up originating from my workstation.)

Limitations

While drive/file access works quite well, this is not fast enough to do X11 well at all.  So as much as I'd like to run gvim directly from my workstation over the tunnel, it's just not fast enough.  

But, having the option to do it was helpful for me.  There were a couple apps that I really just needed some of the settings out of so that I could set up the Windows versions of those apps to work the same way.

OpenSSH

I haven't actually explored the capabilities of the OpenSSH that's now included with Windows 10, but regardless, for non-Windows users, note that there is a newer ProxyJump directive.  This let's you chain together any number of bastion hosts.  So, following my earlier example, you can do something like in an .ssh/config file entry:

Host workstation-tunnel
    ProxyJump companyusername@bastion.example.com,companyusername@server1.example.com
    Hostname 172.16.0.99
    User myusername
    ForwardAgent yes
    ForwardX11 yes
    ForwardX11Trusted yes
    Compress yes
    PubkeyAuthentication yes

Then you just ssh workstation-tunnel and you're good!

SSH SOCKS Proxying with Putty

I'm writing this during the COVID-19 lockdown.  My company's VPN is getting hit really hard since everyone is working from home.  Anything we can do to stay off of it is helpful.

We also keep a host available with SSH exposed publicly (public key auth only).  So, I use that host as an SSH SOCKS proxy and it works great for keeping me off the VPN.

So, if you're in a similar position or simply would like to use SSH as a sort of pseudo-VPN, these instructions might be helpful.

Non-Windows users can do the same thing, you just need to use the ssh command to connect to the remote host and use the -D parameter.  Something like: ssh -D 1337 yourhost

Putty Configuration

1. Create a new session in Putty
2. Hostname: yourhost
3. Port: 22
4. Go under Category → Connection → Data
• Auto-login username: <your username>
5. Category → Connection → Proxy
• Leave this off
6. Category → Connection → SSH
• Enable compression
7. Category → Connection → SSH → Auth
• Attempt to authenticate using Pageant
• Allow agent forwarding
8. Category → Connection → SSH → Tunnels
• Source port: 1337
• Destination: yourhost
• Radio button: Dynamic
• Click Add
• (Just shows D1337, this ok)
9. Save the new Putty session
10. Launch the new Putty session

Proxy Configuration

Now, to actually use the proxy, you can go a couple ways.  Originally, I was doing it the manual way, but I found the Chrome extension SOCKS proxy which works great.  It's hassle free and even make it so that DNS requests go over the proxy.  The source code is very small and easily reviewed so you can see it's not doing anything nefarious.

If you can't or won't install an extension, here's the manual method.

1. Run the inetcpl.cpl control panel. (NOT the new Windows 10 Proxy Settings page.)
2. Go under the Connections tab
3. LAN settings button
4. Uncheck automatic detection
5. Check Use a proxy server for your LAN
6. Advanced button.
7. Fill in ONLY the SOCKS information (not http, secure, or ftp. Uncheck Use the same proxy for all protocols)
• Socks: 127.0.0.1
• Port: 1337

DNS Considerations

Now, if you don't have to worry about resolving any private DNS records, you're good to go.  My company has whole zones that aren't resolvable from the public internet.  For these, DNS queries have to originate from the company network.  Chrome, by default, will not send DNS requests over the SOCKS proxy, so there's an additional step required.

I suggest copying your existing Chrome icon and giving it a different name.  Edit this icon and append to the end of the Target: field, after the final quote (not inside the quotes) the following:

--proxy-server="socks5://127.0.0.1:1337" --host-resolver-rules="MAP * ~NOTFOUND , EXCLUDE 127.0.0.1"

I haven't test it myself, but I've heard that Firefox automatically pushes DNS requests over the proxy.

Limitations

So one of the big limitations of this is that it doesn't really help in a heavy Active Directory environment where your PC has to communicate with things over a domain, such as shared drives.

RDP

However, you can tunnel RDP through your SSH host as well.  Configure additional tunnels, one per RDP destination. Back in your new Putty session:

• Category → Connection → SSH → Tunnels
• Source port: 38001
• (This is a made up value of no significance. You'll have to make one up for each RDP destination.)
• Destination: rdphost:3389
• Relaunch your Putty session
• Open RDP
• Use the destination address: 127.0.0.1:38001
• Repeat the port forwards with different port numbers for each RDP host you to access.

Using Wireshark on a remote host

In a large environment, troubleshooting problems with network packet traces usually means you're logged into a remote host running tcpdump.  Even after you develop some skill with pcap-filter syntax, wielding tcpdump is clunky and it usually looks like you're trying to view The Matrix encoded.

There are other console based tools like tshark, but few of them are as useful and as user-friendly as Wireshark which can render and parse network packets in an extremely readable and comprehensive fashion.

The problem is that Wireshark is a graphical interface.  Running it on a remote host means you'll have to install it and all supporting dependencies and libraries on the remote host and then ssh X tunneling it back to your desktop.  For many reasons, this may not work well.  Or, you may not even be able to install Wireshark on the remote host for any number of reasons.

One workaround used by a lot of people is to capture some network output with tcpdump writing to a file, then fetch that capture file to your desktop and open it up in Wireshark.  It's definitely handy that pcap is so portable that this is possible, but this method lacks the ability to watch network traffic in real-time.

So how can you achieve the holy grail and use Wireshark locally on your desktop to watch live traffic on a remote host?

Enter socat - Multipurpose relay.

The socat utility is a swiss army knife of basically all possible types if input/ouput.  One of its supported i/o types is named pipes.

In short, we can use socat as the middleman to read from a remote named pipe to a local named pipe. Then, we take advantage of Wireshark's ability to read right from a named pipe and read that local named file.

Here's the steps using the example username jsmith, example remote host name srv1, and example network interface name eth0.

On the remote host:

1. Create a temp dir for your named pipe file.
• sudo mkdir /tmp/fifo
• sudo chown jsmith /tmp/fifo
• sudo chmod 700 /tmp/fifo
2. Create the named pipe
• sudo mkfifo /tmp/fifo/pcappipe
3. Kick off tcpdump, writing to that pipe.
• sudo tcpdump -i eth0 -s 0 -U -w /tmp/fifo/pcappipe not port 22

Notice the temp dir permissions.  You need to be able to read the named pipe as the non-root user with which you're going to use to log in.

Also notice the pcap filter 'not port 22'.  You can alter this of course, but if you don't specifically exclude your ssh traffic, tcpdump is going to pick up all of the traffic from you being logged in as well as the part where we remotely read from the named pipe which takes place over ssh.

Next, on your local desktop, run socat like so:

socat -b 67108864 \
    EXEC:"stdbuf -i0 -o0 -e0 ssh -x -C -t srv1 cat /tmp/fifo/pcappipe",pty,raw \
    PIPE:/home/jsmith/localpcappipe,wronly=1,noatime

This tells socat to ssh into the remote host and cat the named pipe (sending the data to STDOUT).  It reads from that and writes it to the named pipe file in your home directory.

The buffer tuning was important to making it as live as possible as well as more stable.  Plus, this can be somewhat of a brittle process and socat can end up crashing easily.  The buffer tuning helps make things much more stable and reliable.

Next, run wireshark, as root.

sudo wireshark -s 0 -k -i /home/jsmith/localpcappipe

Profit!


Normal ssh rules apply.  So, if you can't ssh directly to your remote host, configure your .ssh/config file accordingly.

I need to tunnel through an intermediary jump host as well, so this is what I do in my .ssh/config file:

Host srv1
    ProxyCommand           ssh jumpsrv1 /usr/bin/nc %h 22
    User                   jsmith
    IdentityFile           ~/.ssh/id_rsa
    Compression            yes
    PubkeyAuthentication   yes
    Port                   22
    Protocol               2
    EscapeChar             none
    ServerAliveInterval    30

(I know I know, there's a new ProxyJump directive...  I don't change my .ssh/config that often.)

Amazon AWS free tier: Converting from a t1.micro to t2.micro

Just finished "converting" my t1.micro instance where I run my TT-RSS server to a t2.micro. Recently, I discovered that it was $5 cheaper per month. Doing it was almost not worth the trouble, however. Hopefully this can save you some time.

I quickly discovered that I couldn't even think about spinning up a t2.micro without having a "default vpc" it told me. What I discovered was that I was one of these weird accounts documented here "Your Default VPC and Subnet" where I fell in the 3rd mentioned date range.

Since it was so ambiguous, I wasted quite a bit of time trying to convert my old instance to a t2 using the old volume or at least an image from it.  I seemed to have a default VPC, but it wasn't a real one apparently. Poking at it with the aws cli tools indeed showed me that I couldn't affect the underlying "IsDefault" attribute of the VPC. It was false, and there was no way I was getting it flipped to true. Nor was there any way I could apparently strip the support for "EC2 Classic" mode as they called it.  I fell into that window of time where they were trying to please everyone and it end up being a royal pain.

I ended up following a suggestion in one of the Amazon or Bitnami documentation where I would need to fully deleted my AWS account and everything inside it and started over with a fresh account.

Having finally accepted this inevitability, the process became quite simple.

First, I updated TT-RSS to the latest version and made sure it was working to reduce the possibility of any issues related to my being two version behind.  Then I dumped the database to a local directory on my laptop.  Then I made a backup of the entire htdocs directory where TT-RSS lived, just in case.  Then, I completely burned down my Amazon AWS account and created a new account, including new MFA and API token credentials.

Headed back over to Bitnami, plugged in the new Amazon account details, and told it to create a new TT-RSS instance using a t2.micro instance.  After a few minutes, it was up and running.  So I took a backup of the stock bitnami tt-rss database from mysql, then dropped it.  From my previous TT-RSS dump, the database was actually named differently, so I renamed it in the config.php file for TT-RSS and pointed it to the new db name.  Restarted everything.  Voila.  Logged in with my old creds.  All feeds and settings were in perfect condition.

It's actually noticeably faster as well.  The new SSD volume type definitely makes a difference, not that I was frustrated by its performance beforehand.

Since my initial goal in this was simply to reduce monthly payment from $15 to $10 per month, I was surprised to see that, having created a brand new AWS account (and even though I didn't fudge any of my account details, same address, same cc#, everything), I'm once again eligible for the free tier for the next year.

TLS: warning: cacertdir not implemented for gnutls

I got this error recently while trying to use ldap utilities and libraries. In the debug output from an ldapsearch, I noticed the distinct error:

TLS: warning: cacertdir not implemented for gnutls

This error comes up when you try and use the TLS_CACERTDIR directive in your ldap configuration. Googling for answers was somewhat fruitless, the first complaints of the problem started many years ago. People said it happened when the openldap packages were compiled against gnutls instead of openssl, which apparently does not support the tls_cacertdir option. The general consensus was therefor to not use that directive.

I didn't turn up anything about a fix. The current versions of the openldap packages are still broken all these years later. Although I expected to fail (there had to be reason no one did this before, right??) I tried the obvious solution and it worked.

$ mkdir /tmp/openldap
$ cd !$
$ sudo apt-get source openldap
$ sudo apt-get build-dep openldap
$ sudo apt-get install libssl-dev
$ sudo vim openldap-2.4.31/debian/configure.options

Change --with-tls=gnutls to --with-tls=openssl

$ sudo apt-get -b --no-download source openldap

Go have some lunch, mow the lawn, maybe a pub crawl. The amount incredible amount of hardcore testing that's been integrated into the build process is amazing, but it takes a while.

$ sudo dpkg --install ldap-utils_2.4.31-1ubuntu2.1_amd64.deb \
    libldap-2.4-2_2.4.31-1ubuntu2.1_amd64.deb \
    libldap2-dev_2.4.31-1ubuntu2.1_amd64.deb
$ ldapsearch -LLL -h ldap-server.example.com -D uid=andy,ou=foo,dc=example,dc=com -b dc=example,dc=com -ZZ -W uid=andy cn
Enter LDAP Password:
dn: uid=andy,ou=foo,dc=example,dc=com
cn: Andy Harrison

The other applications I was using that relied on the ldap libraries started working immediately as well.

Linux Mint Olivia - 1 week later...

A follow up to my last post Linux Mint 15 Olivia - Observations...

The Good

Xorg/KDE

Xorg has been working beautifully. No memory leaks. No squirrelly issues in performance or attitude. I haven't even had to blow away my $HOME/.kde/share/config/plasma* files even once!

Packaging

I think I finally started to make friends with the packaging system. The stock 'screen' package is left hamstrung with a MAXWIN value of 40. I can't live within the confines of only 40 so this was my catalyst for making this a priority and figuring out. I finally found some decent docs so that I could download the src-deb, extract, fix, compile, repackage, install. Not only that, but there was another package I needed to tweak and it was super easy to download the binary deb file, extract, fix, repackage, install.

The Bad

Seriously?

Also thanks to the Mint teams priorities, I quickly noticed that after fixing your default search engine in Firefox, the search autocomplete is broken.
If Aerobie Inc. paid Tesla Motors to replace the steering wheel in their vehicles with an Aerobie, do you think they should do it? After all, Tesla needs the money, so shouldn't they do it? Because it's such a great idea to have the primary means in which you steer your vehicle be a product that people used to have a little fun with a long time ago. Not only that, but let's make sure if people try to fix the mistake and switch to a real steering wheel, that it won't turn all the way.
#FAIL

Other missing package nits...

The curl package isn't installed by default. Seriously. No, I'm not kidding.
Less ridiculous exclusions that you can find in every other distro, no 'lynx' (which only old farts like me use anyway), 'pcregrep' and friends, 'mc' (again, an old fart utility) and 'whois' (ok, I work at an isp, obviously that would only be important to me).

Linux Mint 15 Olivia - Observations

I've been an opensuse user for the last several years and usually really enjoy running it as my workstation's desktop operating system. But, as the 12.1 repos have started to unceremoniously vanish from existence, I've finally decided that enough is enough. I had been thinking about possibly another rpm based distro or even going in a completely different direction (like Arch) while avoiding any Debian based distro, but Mint has held such a commanding lead on distrowatch.com for such a long time, I thought it might be worth taking a look.

Here's some observations from the first few days.

The Good

Xorg

My Xorg memory leaks aren't present in this version. This represents about 1/3rd of the reason I started looking outside my normal opensuse comfort zone.

KDE

Mint's KDE 4.10 environment is fast. So far I haven't even gone in and shut off all the silly animations and junk. Normally, however slight the amount, these things interfere enough so that it's obvious I'm spending time waiting for animations to draw when I could be already clicked onto the next step. The animations on Mint seems so well tuned that there's actually some benefit to having the animations enabled. Otherwise, the transitions are so fast you have to almost stop and evaluate whether you clicked something and an action actually took place.

VMware

VMware Workstation 9.02 installed and ran perfectly right out of the gate. Stock install, didn't have to go and fetch linux kernel header packages or anything.

aptitude

I missed aptitude. I gave Ubuntu (kubuntu, specifically) a try many years ago and generally didn't like it. Traditionally I'm a Red Hat derivative guy, and moving to a Debian derivative was a little shocking. But aptitude was such nice piece of curses based package management. I found myself opening a shell window to install packages instead of using the gui package managers and I may continue this with Mint.

repos

Speaking of aptitude, the stock set of repos with Mint are fairly well rounded.
When I go into the main Mint repo in a browser, I see the last 11 versions of Mint. This represents the other 2/3rds of the reason I'm giving up on opensuse. I'm incredibly sick and tired of having my repos dry up and vanish on me every couple of point revs. I'm done being forced to do a full OS upgrade of a perfectly working desktop just because someone's OCD is preventing intelligent repo management. The 'zypper dup' upgrades may work for some folks, but they never, ever, ever work as expected for me. Doing a 'zypper dup' is always an 8 or more hour ordeal for me.

Java

Java works a bit better. I work on a large amount of HP enterprise class hardware. Unfortunately, doing away with Java is not an option for me because of the iLO management interface. While not perfect, the Java support is definitely better and I can reasonably expect it to work when I open up a remote console window.

The Bad

Seriously?

Firefox default search engine is Yahoo. Google isn't even present as an option in the drop-down choices. This says a lot about Mint's priorities. Spoiler alert: it isn't you.

Let's all pretend VLAN's don't exist.

If your only network connection requires VLAN tagging, you will have *no* internet access during the installation.

The Network Settings panel hasn't the faintest hint of VLAN support (before or after installation). If your installation is already underway, maybe you can use your mobile phone to Google how to set up VLAN tagging. Otherwise, hopefully you looked up how to configure VLAN tagging before starting to install Mint. The process of configuring VLAN's is obscure and stupid, similar to an enterprise Linux distro, definitely not what you'd expect from a premiere desktop Linux distribution. And since VLAN's don't exist in Mint's world and consequently do not appear in documentation, you'll have to take an educated guess on how to add them to the /etc/network/interfaces file. After you've finally figured out that the appropriate file to edit is /etc/network interfaces, that is.

I tried setting my physical ethernet interface to "link-local" just to get it out of the way of my VLAN interfaces while keeping it active. This vaporizes the ability to configure your dns servers. Even if you had used the Network Settings panel to configure dns servers previously, it quietly deletes them and replaces them with opendns. On the plus side, the Network Settings panel doesn't complain if you set your ethernet interface to "manual" and then leave everything blank except the dns servers.

VLAN network interfaces *never* show up in the Network Settings panel. You're 100% command line and text file editing to manage your VLAN interfaces.

EFI (and GPT)

EFI support is terrible. Almost everyone's is, Mint's is just worse.

With EFI present, it is not possible to complete the installation without an internet connection. Period. Even if you open a shell and manually preinstall the necessary packages (which *are* present on the live iso), the installer is hard coded to download the EFI related packages from the online public repos. It never even bothers to check if those packages are already installed, nor does it try to install them from the iso. Since VLAN's don't exist in Mint's world, if your only network connection requires VLAN tagging, you're completely out of luck. For that matter, if for any other reason you don't have internet access during the install, you're completely out of luck if you booted from the EFI loader.

Also absent are GPT partition management utilities. In general, it seems like it would be best if you just didn't start the Mint install until you'd already burned a bootable image of Parted Magic in preparation for having to do any partition editing.

tail

During install, the tail command does not work at all. Nor tailf. It shows you the last few lines of the file and just sits there with its thumb up its ass. I found a forum post where someone mentioned this issue a year (and a few Mint versions) or so ago with no response. I don't really like using less and its "F" function to follow files, but at least it works.

ssh

sshd host keys don't get generated. If you're expecting to immediately be able to ssh into your newly installed Mint host, forget it. There may be an official and proper way of doing this, but fortunately I had saved my host keys from my last Linux desktop distro so I just restored those right into place with no fuss.

Minor missing package nits:

gnu screen
socat
kgpg

Some popular but missing packages...

Try installing taskjuggler. Go ahead. With no ruby knowledge. Just try it.
Despite the well rounded stock repos, once going outside their scope, I feel like I'm really up the creek. Being an rpm guy, though familiar with package management in general, normally I know exactly what to do in any situation. Everything from how to find the difficult-to-find packages, to porting source rpm files from other distros, to building my own packages from the spec up I have no problem handling. I've even automated building Solaris packages on my own. I'm no stranger to this. Yet every time I go looking for HOWTO docs on deb packages, I feel like I'm looking at VCR schematics when generally all I want to do is stop the time from flashing 12:00.

Google Reader to TT-RSS - coping with 3rd party apps and services

Here's a guide to replacing Google Reader with Tiny Tiny RSS, but with more detail on the greater tragedy (travesty?) of Google's continued bulldozing of open internet standards with the termination of Reader, the interaction with other services and software on which we used to depend.  I'm starting with a couple of simple but important services, though I'd like to flesh this out over time.

Infrastructure

The problem we all face isn't installing the software (granted, TT-RSS is a non-trivial install, but I consider that to be outside the scope of this guide). The problem we face is the need for hosting. And most of the hosting solutions that will meet our needs require us to configure a hosted server of some kind.

My solution was to start with a Bitnami stack.  Specifically, I started with the LAMP stack.  However, the Bitnami portion of this process will soon become very simple. Tiny Tiny RSS won the regular contest Bitnami holds to decide on new stacks and is expected to be released soon.  Keep an eye on it here: http://bitnami.com/product/tiny-tiny-rss

Next, I signed up a free "developer" class account with Bitnami Cloud Hosting.

Bitnami will allow you to deploy your stack to the Amazon EC2 service automatically and provides documentation for getting your Amazon account set up and ready:  http://wiki.bitnami.com/Amazon_cloud/prepare_aws_account

If this is your first foray into AWS, the first year of your EC2 micro-instance is free.

Software

Now, onto the part where you actually use TT-RSS.

There's plenty of howto links around for installing TT-RSS itself, so I keep the redundancy to a minimum.  The official guide is over here: http://tt-rss.org/redmine/projects/tt-rss/wiki/InstallationNotes

The guide for how to set up automatic updating of your feeds: http://tt-rss.org/redmine/projects/tt-rss/wiki/UpdatingFeeds

I'm not going to bother with details on how I rigged this up in my Bitnami stack as most of it will be soon be moot with the introduction of the TT-RSS stack. If you're a good Linux user and you do want to wait for the bitnami release, here's the summary with no training wheels.

• Run gnu screen.
• I used /opt/bitnami/mysql/bin/mysql_setpermission to set up the tt-rss db and configure a user to be able to access it.
• Extract the tt-rss source tarball into /opt/bitnami/apache2/html/ and rename directory to tt-rss.
• Slurp in the mysql schema.
• Configure tt-rss according to the install guide.
• Because the update_daemon2.php script needs to be run as the daemon user, I added a minimal ~daemon/.bashrc (just the path from ~bitnami/.bashrc):
• PATH="/opt/bitnami/memcached/bin:/opt/bitnami/varnish/bin:/opt/bitnami/redis/bin:/opt/bitnami/nodejs/bin:/opt/bitnami/mercurial/bin:/opt/bitnami/perl/bin:/opt/bitnami/git/bin:/opt/bitnami/nginx/sbin:/opt/bitnami/frameworks/laravel/app/Console:/opt/bitnami/frameworks/cakephp/app/Console:/opt/bitnami/frameworks/codeigniter/bin:/opt/bitnami/frameworks/symfony/bin:/opt/bitnami/frameworks/zendframework/app/Console:/opt/bitnami/sphinx/bin:/opt/bitnami/sqlite/bin:/opt/bitnami/apps/django/bin:/opt/bitnami/php/bin::/opt/bitnami/java/bin:/opt/bitnami/mysql/bin:/opt/bitnami/postgresql/bin:/opt/bitnami/apache2/bin:/opt/bitnami/python/bin:/opt/bitnami/subversion/bin:/opt/bitnami/ruby/bin:/opt/bitnami/common/bin:$PATH"
  export PATH
• In another screen window, become the daemon user
• sudo su - daemon -c bash
• Run the update script.
• cd /opt/bitnami/apache2/html/tt-rss/
• ./update_daemon2.php

That's pretty much it.  Filling in the blanks is left to the more experienced user.

On to the more important pieces...

Exporting from Google Reader

Here is an excellent guide for how to export your Google Reader data:
How to painlessly export your Google Reader feeds

Importing your rss subscriptions to TT-RSS

Extract the file you downloaded from Google Takeout.  Inside, the important item is the subscriptions.xml file.  Log into your TT-RSS instance and go into Preferences, then click into your Feeds tab. Expand OPML, the 2nd accordion item. Click the Import my OPML button and select the subscriptions.xml file you extracted. If you're interested in preserving your starred items from Reader, expand Import starred or shared items from Google Reader, the last accordion item. Select the starred.json file you extracted and click the Import my Starred Items button.

Android

App

The official TT-RSS App has been under very active development and is maturing very quickly.  It's been perfectly stable and usable for me. The only downside is the lack of a launcher widget allow you to read feed article titles right on your homescreen.

Widget

My solution for the lack of a widget is a little complicated, but it's working great. It's made possible because TT-RSS is not just a feed reader, it is also a feed publisher. In your TT-RSS instance, put the feeds you want to appear in your widget into a category.  I used the Favorites for my category name. After you create and populate your new category, click on it.  Positioned underneath the Preferences link, you'll see Favorites and the RSS icon. Click directly on the RSS icon and it will pop up a long link.  Copy down this url, you'll need it later.

Next, install Simple RSS Widget.

Yahoo Pipes

You'll be feeding Simple RSS Widget from Yahoo Pipes.  Log into your Yahoo Pipes account and create a new pipe.

Since I have several feeds under my Favorites category in TT-RSS, I wanted to give each item title a little visual distinction so I would know from which feed the individual article came.  This made the Yahoo Pipe I created a bit more complicated than it needed to be, but the end result is exactly what I wanted.

From the Sources section, Drag out an Item Builder object.

I populated mine with the following attributes:

title = Favorites
description = Items from my Favorites category
link = http://pipes.yahoo.com/<username>/<placeholder>?_render=rss (replace this with the link to your resulting yahoo pipe when you're done.
author = aharrison

From the Operators section, drag out a Loop object. Back under Sources, drag out a Fetch Data object and drop it in the middle of the Loop object you just dragged out. For the url, you're going to drop in the long url you copied earlier. However, you're going to modify the url. Your url will look something like:


http://my-ttrss-instance.bitnamiapp.com/tt-rss/public.php?op=rss&id=26&is_cat=1&key=abcdef1234568901234567890123456789012345

Modify it slightly:

http://my-ttrss-instance.bitnamiapp.com/tt-rss/public.php?op=rss&id=26&is_cat=1&format=json&view-mode=adaptive&key=abcdef1234568901234567890123456789012345

Add the item I put in bold and leave everything else the same.  In the Path to item list field, type: articles

Also worth noting, if you're using https:// for your TT-RSS instance, you need to drop the s to allow Yahoo Pipes to hit your feed without ssl. Likely this is simply because the default ssl certficates in your bitnami stack are just self-signed examples. If you want Yahoo Pipes to be able to use ssl, you're probably going to have to buy your own ssl certificate and rig it up inside your Bitnami stack. (If you really want to do this, here's an old guide that will help you get there: How to activate ssl / Security

Inside your Loop object, choose the radio button emit and the all dropdown choice.

Click and drag the botton of your Item Builder object to the top of your Loop object to connect them together.

If you don't want to bother altering the item titles to reflect the feed, you can now connect the bottom of this Loop object to the top of the Pipe Output object and you're done.  If you also want the indication of which feed the item is from, proceed.

Drag out a Rename object.  Connect the Loop object to this new Rename object.

For the mapping, choose item.link from the field choices, then Copy As from the drop down, and type in the last field: titleprefix

Drag out a Regex object.  It should read:

In item.titleprefix replace ^http[:][/][/](.*?)[.](com|net|org).*$ with [$1]

Connect the Rename object to this new Regex object.

Drag out another Loop object. Connect the Regex object to this new Loop object.

Grab another String Builder object and drop it in the middle of the new Loop object. Populate it like so:

• item.titleprefix
• <blank spot>
• item.title

Grab another String Builder object, but this time, drop it outside the Loop object, not inside.
Inside the new String Builder object, just enter ' - ' (without the quotes).  That's a space, a dash, and another space.

From the bottom of this new String Builder object, click and drag to connect it to the little bubble to the right of your empty field inside your Loop object's String Builder object. Now in your inner String Builder object, instead of the empty field, it should turn gray and read 'text [wired]' because the empty field will now pull from the outer String Builder object sitting off to the side.

To finish with our Loop object, instead of the emit results radio button, choose the assign result to radio button and select item.title from the choices.

Click and drag from the bottom of this Loop object and connect it to the top of the Pipe Output object.

You're done creating your Pipe, so click Save and then go back to your pipes page.

Click on your new pipe.  Inside, you'll see a link Get as RSS. Right click it and copy it.

Edit the pipe you just created.  Remember back up in the Item Builder object where I said you'd replace the url?  Paste the url there.

Also, send this link to your Android device so that you'll be able to configure it there as well.

Take that link, and configure it inside the Simple RSS Widget you installed. Now when you drop the widget onto your homescreen, you'll see all of your favorite items.

I made an example of this pipe available for reference:
http://pipes.yahoo.com/ahinmaine/examplettrssfavorites

ifttt.com

Another frustration of the Reader retirement is all the awesome things you can do with your feeds at ifttt.com.  Fortunately, all is not lost. For example, I had an ifttt trigger to push any of my starred items to Pocket automatically. Instead, you can use the simple version of the above Yahoo Pipe example to accomplish the same thing. For your Fetch Data object, use this example url instead.

http://my-ttrss-instance.bitnamiapp.com/tt-rss/public.php?op=rss&id=-1&format=json&view-mode=adaptive&is_cat=&key=abcdef1234568901234567890123456789012345

Notice the id is -1, this automatically chooses your starred items feed. And instead of is_cat being 1, leave it blank.

Why the Pipes?

You may have already wondered, why would I use Yahoo Pipes to access feeds I've published in my TT-RSS instance rather than accessing them by my TT-RSS url directly?  Simple, if you have multiple apps and services polling your TT-RSS instance, this is going to greatly increase the amount of traffic to your EC2 instance. There are usage limits to these micro-instances and you'll hit them a lot faster if you let it get hit from lots of different sources. Yahoo Pipes is an effective way of keeping your costs down. For example, if your Simple RSS Widget is set to poll every 5 minutes, Yahoo Pipes is NOT going to hit your TT-RSS instance every time, it's just going to serve up the results since Pipes last polled it.

The Pipes Regex object

Yes, I know the regular expression I used for an article title prefix isn't very robust.  I'm lazily grabbing the hostname from the domain of the url of the feed. Improving the appearance of your feeds by having fun with Pipes is left as an exercise for the reader.

Vim slick trick of the day...

I've always wanted to know how to do this and happened to stumbled across it in a forum.
Here's how you take the piped output from two commands and vimdiff them together.

vimdiff <(cat filename1) <(cat filename2)

Ridiculous, I know.  But the point is the commands can be anything allowed by the shell.

vimdiff <(grep foo filename1 | grep -v bar | sort -u) <(grep foo filename2 | grep -v bar | sort -u)

Google Groups Advanced Search

It seems I'm not the only one who finds the removal of the google groups advanced search extremely annoying. Threads such as here abound...

The support page is broken and useless because Google's been rolling out interfaces faster than they can write documentation:  http://support.google.com/groups/bin/answer.py?hl=en&answer=46036

Googling for the groups advanced search page turns up a lot of broken search pages (for example: http://groups.google.com/a/webmproject.org/) which have the search form, but yield no results of any kind for any searches.

So, in hopes of helping anyone else out who is looking for this feature, I found this working link buried in the cached version of one of the google groups pages:

http://groups.google.com/advanced_search?q=&

 

When Google took over Deja many years back, they took on the responsibility of maintaining an archive of internet historical significance. It may not seem like much to some, but I love that you can go back and see the first emoticon discussion, or see some of the earliest successful open source, or early posts and discussions from true icons of technology.

Who knows how long that link will keep working before some UX "engineer" will see fit to burn it down completely.  After all, if we're too stupid to handle advanced searching, we're too stupid to care about some old boring old "forum" posts.

The Complete Idiots Guide to Correctly Validating Your Customer's Email Addresses

Update August 2020:  

I have turned this blog post into a site of its own.  Please visit guide.mlz.me for a more updated version of this post.

_____________

TCSH isn't dead...

My tcsh configs have been growing for years.  There's probably still a few lines in there from my first .tcshrc config 15+ years ago.  It's an amalgamation of years of collecting little snippets from here there and everywhere, as well as plenty of my own additions.

I cleaned it up a bit and made it somewhat presentable sharing with others.  It's a modular configuration that allows dropping in chunks of config very easily as well as a crude distribution mechanism to copy it to lots of destinations.

Despite how modular it is and the fact that it's sourcing lots of files, it's actually quite fast so there's no delay opening a shell using this config.

 

tcshrc.d on github

Whack whacking and IPv6...

I saw this in a forum and had to look it up. As hard as it is to believe, the following is true.

Quote: IPv6 Address Nomenclature Used for a UNC Path

Follow these steps when specifying a literal IPv6 address in a UNC path:

Replace any colon ":" characters with a dash "-" character.

Append the text ".ipv6-literal.net" to the IP address.

For example, the nomenclature for a URI that points to a file share on a computer with the IPv6 address 2001:DB8:2a:1005:230:48ff:fe73:989d would be:

\\2001-DB8-2a-1005-230-48ff-fe73-989d.ipv6-literal.net\<sharename> Where <sharename> is the name of the file share on the target computer.

"IPv6 no cause for alarm" - Melvyn Wray, 2011

My response to this article by idiot Melvyn Wray.

 

---

 

I hope you aren't paid to write for this website.  If so, you need to be fired immediately.

2000 wasn't a meltdown because corporations the world over spent BILLIONS on their software and infrastructure.  The company for which I was working at the time started hiring contract programmers in 1994 and still crossed their fingers hoping it would be enough time to audit and rewrite millions of lines of code.

My current company has allocated around $10 million dollars in infrastructure over the next couple of years.  As an ISP, you'd think we'd be able to find SOMEONE with a turnkey solution to give us a smooth ipv6 migration path.  Instead, despite the imminence of ipv6, we're starting to feel like pioneers in the industry, a position that we do not desire in the least.  For example, there are currently NO vendors offering a full-featured large scale nat solution to buy us some time to get fully underway with ipv6.  When you ask any of them about PCP, you're met with blank stares or "why would anyone want to do that?"  Granted, the initial draft of the IETF document was written only a month or so ago, ( https://datatracker.ietf.org/doc/draft-ietf-pcp-base/ ) but it should not be the burden of us as the customer to explain why this is critical to a vendor who is boasting that they have the best LSN solution.

The burden is on us to come up with a solution that allows our customers to access both ipv6 addresses as well as ipv4 addresses for at least the next decade.  I'd ask you to think of the ramifications of that task, but you're not capable.  Suffice it to say, for the forseeable future, access to both ipv4 and ipv6 is mission critical.

Every single piece of hardware serving customers is affected.  Every cable modem earlier than docsis 3.0 needs to eventually be replaced. Every cable tv set top box will eventually need to be replaced.  Not only does the cable modem need to be replaced, we're discussing the very real possibility of having to put a nat/fw at each customer premises.  The reason for this?  If, today, you walk into your local Staples, Best Buy, Dixon's, or Curry's, *almost none* of their devices are fully ipv6 capable.  Are you the one who is willing to tell the customer that, sure, your Roku, Tivo, Slingbox, Kindle, iPod, wifi Galaxy Tab, Xbox, Wii, Airport Extreme, and Magic Jack will all definitely work with ipv6?  You'd bet your paycheck on it?

Every one of our servers needs some attention because even the most recent 5.x version, Red Hat Enterprise and their glorious patch hostage business model is *STILL* based on linux kernel 2.6.18, which has some ipv6 related weaknesses.  Every piece of software that serves our customers needs at least some rewriting, especially with regards to anti-spam.  There is very little in the way of good, solid support for ipv6 blacklists.  The author of rbldnsd, for example, just committed some early support for ipv6 in his code a little over a week ago.  It's just enough to get us some working blacklist functionality.

Many of the most expensive pieces of our core networking infrastructure needs to be replaced.  While Cisco may have stamped "ipv6 ready" on the side of much of their gear, the act of turning on ipv6 support nearly brings the box to its knees.  The reason is because instead of having each line card being capable of hardware flows that require very little interaction with the supervisor engine, ipv6 is implemented in software-only, so suddenly every single packet needs to be sent to the supervisor card for handling.  This alone may cost us millions.  We're by no means a Cisco-only shop, so we're hoping that our testing doesn't reveal too many more surprises like this.

And you've obviously been reading nothing but puff pieces regarding ipv6 and security.  While it has a small number of nice features, it offers not one single bit of increased security that should cause ANYONE to breathe easier.  If anything, it should stress people out even more.  We're going to be finding fundamental flaws in the handling of ipv6 for years to come.  As recently as a couple of years ago, I discovered a critical flaw with the version of glibc that openSUSE was using at the time and it's handling of AF_INET, AF_INET6, and AF_UNSPEC.  It was easily missed because this flaw only surfaced when interacting with oddly behaving DNS servers and so only affected, at best, 1% of their userbase.  To my knowledge, no one ever figured out the entire cause in any sort of forensic detail, and was eventually fixed. 

This also glosses over a very serious shortcoming in ipv6 to which none of the original designers are willing to admit.  The problem is that ipv6 was designed in the early to mid 90's, when nat didn't even exist.  While the designers lauded themselves for guaranteeing that everything could have a public, internet facing ip address, they forgot to take into consideration whether or not everything *should* have a public, internet facing ip address.  Do you think the hacker's at the recent Pwn2Own conference were balked in any way by ipv6?  Do you think the recent, critical icon vulnerability in Windows is in any way stopped by ipv6?  Does the display of a favicon.ico file that exploits this vulnerability somehow become subverted because it was loaded from an ipv6 website?  Using nat provides a fundamental level of security that truly makes the internet a safer place.  Insisting, even despite proof to the contrary, that every device should be accessible via the internet is just plain wrong, no matter how many phd's can't get their own heads out of their asses.

All you're aware of is the little bit of a golf ball sized chunk of ice that you've been able to perceive.  The reality of the iceberg underneath is absolutely cause for alarm.  Keep your finger pointing and chicken little accusations to yourself and let the big boys who do the real work take care of business.

Here's to your writing success in a field other than technology.

#EPIC #FAIL

Anyone used mysql with 128-bit binary strings? Riddle me this...

I was doing a little experimentation wielding ipv6 with perl and mysql:

So, given this table schema:

 

 

mysql> desc binary_i;

+-------+------------------+------+-----+---------+----------------+

| Field | Type             | Null | Key | Default | Extra          |

+-------+------------------+------+-----+---------+----------------+

| id    | int(10) unsigned | NO   | PRI | NULL    | auto_increment |

| ip    | binary(255)      | NO   |     | NULL    |                |

| mask  | binary(255)      | NO   |     | NULL    |                |

+-------+------------------+------+-----+---------+----------------+

3 rows in set (0.00 sec)

 

 

 

 

Can anyone explain this??

 

Show a row:

 

mysql> select * from binary_i limit 1\G

*************************** 1. row ***************************

  id: 1

  ip: 00100110000001101111010000000000000010000000000100100000000000000000000101110010000000000010010000000000000000010000000001010101

mask: 11111111111111111111111111111111111111111111111111111111111111110000000000000000000000000000000000000000000000000000000000000000

1 row in set (0.00 sec)

 

 

 

 

Copy the ip value from that into a select statement:

 

 

mysql> select * from binary_i where ip = '00100110000001101111010000000000000010000000000100100000000000000000000101110010000000000010010000000000000000010000000001010101';

Empty set (0.01 sec)

 

 

 

Empty??

Try again with double quotes:

 

mysql> select * from binary_i where ip = "00100110000001101111010000000000000010000000000100100000000000000000000101110010000000000010010000000000000000010000000001010101";

Empty set (0.01 sec)

 

 

Still Empty??

Try it as a like statement with preceding and succeeding % symbols:

 

mysql> select * from binary_i where ip like '100110000001101111010000000000000010000000000100100000000000000000000101110010000000000010010000000000000000010000000001010101%' limit 1;

+----+----------------------------------------------------------------------------------------------------------------------------------------

| id | ip

+----+----------------------------------------------------------------------------------------------------------------------------------------

|  1 | 00100110000001101111010000000000000010000000000100100000000000000000000101110010000000000010010000000000000000010000000001010101

+----+----------------------------------------------------------------------------------------------------------------------------------------

1 row in set (0.00 sec)

 

 

 

Success.  Using the same string as I did in the previous WHERE clauses. I'd be a lot less baffled if I weren't COPY and PASTING the binary string directly from an existing entry in the db.

Microsoft Math #FAIL

$319.99 - $299.99 = $129.95????

Today has been one of those days...

It's been one of those days where it just feels as if there's been...  a disturbance in the force.  Not the extinguishing of millions of outcrying voices, more the subtle murmur of apology from the pickpocket who just accidentally bumped into you.

It started this morning.  My BlackBerry notifies me that it can no longer access my gmail account.  I log in from my laptop and it claims there has been suspicous activity with my account and I must enter my cell phone number to proceed with account revalidation.  I do, change my password, and successfully access my gmail account.  I hit the page where Google logs ip addresses used for accessing my gmail account and see nothing untoward.  My laptop from home and work, my BlackBerry, and nothing more.  When my wife's gmail account was hacked last month, it clearly showed an ip address from China, so the event was fresh in my mind and I knew exactly what the suspicious activity would look like.  (Unfortunate that Google didn't disable her account in a similar fashion to how mine was disabled before her account was used to send messages to her entire addressbook containing a malicious link.)  Presumably, Google has just today tightened security up a bit more. Since my BlackBerry uses BIS to hit gmail, it appears as if the connection is coming from a Canadian ip address, thousands of miles from my current location.  This seems the likely culprit of the suspicious activity.  I was due for a password change anyway and LastPass generates beautiful ones.  No harm, no foul.

Next, a message from my wife.  She asks about a small charge appearing on our account from a bookstore in Colorado.  Mental red flag is on its way back up even before it's come all the way back down from the last incident.  Start investigating, turns out it was just a book my wife ordered through the local school book fair, which is operated by a company in CO.  No harm, no foul.

Enter Twitter.  LastPass, which normally does a fine job of handling Twitter logins automatically, balks.  Invalid password.  W. T. F.  The red flag goes up like it was tied to the camel of a radical middle eastern zealot running late for a good stoning.  I log in and start analyzing my account for wrongdoing.  I notice the password it attempted to use was the wrong one.  My wonton use of LastPass anywhere and everywhere across all my operating systems, (Linux, Win7, WinXP, BlackBerry) and all the browsers I use regularly, (Chrome dev, Chrome canary, Firefox 4, Safari, Opera 10, Opera 11, occasionally IE9), caused a little bit of a sync problem when last I changed my twitter password.  No harm no foul.

Just for the sake of giving my red flag a rest, I went and changed several of my important passwords and wanted to take the time to encourage you to do the same.  Lifehacker has posted this handy guide in response to the Gawker hack that occurred recently.  Take a moment to read through it and give your passwords and accounts a good once-over.  Lifehacker: How to Audit and Update Your Passwords

Quick tip for openSUSE users of App::perlbrew...

Ever since I installed 11.2 on my ultra40 a few months ago, perlbrew has been busted for me.  After failing, the build log always ended with:

ODBM_File.xs:124: error: too few arguments to function ‘dbmclose’

I finally took the trouble to fix it.  After some googling, I saw that others on opensuse had seen this while compiling on their own, but didn't readily see any search results for how to easily fix it with an automated builder like perlbrew.  Turns out the secret sauce isn't that difficult since perlbrew with happily pass through any perl building arguments:

perlbrew install perl-5.12.2 -D noextensions=ODBM_File

Teh maths is fun... (ipv6 rant)

My company just got it's ipv6 allocation.  They gave us a /32.  Let's walk through this math for those of you watching from home.

/32 is the number of bits.  The full length of an ipv6 address is 128 bits.  Represented in binary, this means that the highest possible number is all 1's, for a total of 128 of them:

 

11111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111

 

To convert this number into decimal, you start way over at the right, and continuously increment by the powers of 2.  The first position is 1, the second is 2, the third is four, the fifth is 8, the sixth is 16, the seventh is 32, and so on and so forth.  If you bother to follow those powers of two all the way out to 128 bits, you end up with a really big number.  170,141,183,460,469,000,000,000,000,000,000,000,000 to be exact.  This is the maximum number of ip addresses able to be assigned out of the ipv6 pool.

Our allocation of a /32 means that, starting from the left, you count out 32 binary bit positions and flip them to a 1, and the remaining 96 binary positions are all 0.  This gives us a total allocation of 79,228,162,514,264,300,000,000,000,000 ip address.  If you were to write me a check giving me a dollar for every one of our ip addresses, you'd need a check that was about 3 feet wide so that you could write out the number in english.  You'd be writing me a check for seventy-nine octillion, two hundred twenty-eight septillion, one hundred sixty-two sextillion, five hundred fourteen quintillion, two hundred sixty-four quadrillion, three hundred trillion dollars.

So, my company has personally been given enough ipv6 addresses to assign every single cell in your body well over 1 quadrillion ip addresses.  Every. Single. Cell.

From what I've been hearing, this is the norm.  They gave one guy a /48 for his websites, of which he has a small handful.  One septillion ip addresses.  For a few websites.

Let's extrapolate that our /32 is the norm for anyone needing more than a handful of ip addresses.  Divide the biggest possible 128 bit number by our /32 allocation.

 

170,141,183,460,469,000,000,000,000,000,000,000,000
÷ 79,228,162,514,264,300,000,000,000,000

---

2,147,483,648

 

That's the kind of number you don't need any help spelling out.  A little better than 2 billion.  How many ipv4 addresses are there?  Double that.  4 billion, though the way ipv4 has been carved up means that substantially less than that is usable.

It took us 30 years to approach exhaustion of the ipv4 space, though the last 15 years has seen such an exponential increase, the first 15 years is nothing but a drop in a bit-bucket in comparison.

I've argued repeatedly that there's so much ipv4 space that is absolutely WASTED that there really isn't that much of a crunch if they started enforcing utilization standards.  MIT, for example, has 16 million public ipv4 addresses of their very own.  Why?  Because, when it was allocated to them so many years ago, they could get away with it.  16 million.  For a college.  Do they need 16 million publicly facing ip addresses?  NO.

And, of course, there's no place like 127.0.0.1 is there?  Another 16 MILLION ip addresses wasted on localhost.  Why?  Because back when it was assigned, they could.  Who cares, right?  When there's 4 billion addresses, what's 16 million here or there, just between friends?

Xerox, 16 million.  HP, 16 million.  Ford, 16 million.  Halliburton, 16 million.  Prudential, 16 million.  Merck, 16 million.

Do any of these companies need 16 million publicly facing ipv4 addresses?   NO.  That's over 83 million ip addresses wasted right there.  Yes, HP recently purchased a company that produced cell phones.  Do those cell phones need PUBLIC ipv4 addresses?  NO.  The specifics of the wastefulness of the ipv4 space are a separate rant, though.

My point is that this pattern of wastefulness is not only continuing with ipv6, it's getting much, much WORSE.  Insanely sized allocations to anyone who asks for a few ips?  Really?  What good is having this seemingly vast amount of address space, if (going back to the handful of websites example) the wastefulness of this space increases by not 1 or 2 or 10, but TWENTY-FIVE orders of magnitude?

The view from this boat looks a lot like it did 30 years ago.