News archive 2015 - Koos van den Hout

The flood keeps coming, this time with an interesting error:

Dear Customer,

Our records show that your account has a debt of $295.{rand(10,99)}}. Previous a
ttempts of collecting this sum have failed.

Down below you can find an attached file with the information on your case.

[-- Attachment #2: SCAN_INVOICE_99193061.zip --]

I guess the spammer had a bit of a problem with the spamming macro language!

The .zip file contains

  Length      Date    Time    Name
---------  ---------- -----   ----
    22333  2015-12-16 20:27   invoice_GeL0XY.js
---------                     -------
    22333                     1 file

Which is a really obfuscated javascript.

It is a whole flood of suspect mails this week, mostly trying to be an invoice or sometimes order confirmation. Containing .xls files, .doc files, or javascript or java applet.

I don't have the environment to research these completely but I expect them all to contain some form of malware aimed at the Windows operating system.

Bij het invullen van de meterstand op de website van Vitens, onze waterleverancier:

Wilt u de nieuwsbrief met interessante ontwikkelingen binnen Vitens en van onze nieuwe producten en diensten per e-mail ontvangen?

Nee, jullie zijn een nutsbedrijf, een waterleverancier. Ik wil dat jullie je aan de waterleidingwet houden en vooral geen rare commerciële avonturen beginnen. Ik vond het ook al verdacht dat de incassovoorwaarden het hadden over 'geleverde producten en diensten van Vitens' in plaats van 'levering van water'.

And the next flood of suspect e-mail messages:

This message contains 2 pages in PDF format.

[-- Attachment #2: fax00163721.xls --]
[-- Type: application/vnd.ms-excel, Encoding: base64, Size: 105K --]

[-- application/vnd.ms-excel is unsupported (use 'v' to view this part) --]

Probably more malware droppers. It seems some botnets are in great need for new systems to abuse.

Multiple e-mail messages the last hour or so with:

-----Original Message-----

Please open the attached document. It was scanned and sent to you using a
Samsung MFP. For more information on Samsung products and solutions, please
visit http://www.samsungprinter.com.


This message has been scanned for malware by Websense. www.websense.com

[-- Attachment #2: Untitled_14102015_154510.doc --]
[-- Type: application/msword, Encoding: base64, Size: 123K --]

[-- application/msword is unsupported (use 'v' to view this part) --]

I don't have the means to research the .doc file completely but when I get unsollicited office files it can only be malware.

Update: I'm not the first to notice this: New Word malware: FW: Scan from a Samsung MFP - mxlab who researched the file and indeed found malware.

This weekend I wanted to play some radio but it was hard to find time and cooperating propagation. At the moment propagation seems very limited and it only happens during the hours the sun is up for the amateur bands I am active in (20 meter and 10 meter).

On Saturday it was rainy most of the day which ment the roof was wet and my signals weren't getting out when I got around to trying. I had enough incoming signals and had nice overviews on PSK reporter but nobody heard me when I had time to call/answer.

On Sunday it was dry and I made five PSK31 contacts, and one SSB contact. After sunset the 20 meter band dried up quickly for me so I hung out the endfed to try my luck on 40 meter. Calling CQ in RTTY mode on 7051 MHz got spotted on the reverse beacon network but nobody answered. What frequency on 40 meter is good for PSK31 varies, but the only frequency where I hear/see it active is 7.040 MHz which is currently outside the frequency range I'm allowed to use.

So I tried something else: JT-65 since I did hear the JT-65 tones above 7.076 MHz. The software was readily available via the Ubuntu ham radio software repository: wsjtx. It took me a bit of work to configure it to use hamlib via localhost: I can select the right rig type (NET rigctl 2) but I can't select a network host. Entering 'localhost' gave me a 'connection refused' error which I did not expect. I used strace to find out and the connection was only attempted to ::1, the IPv6 localhost where rigctld does not listen. I entered 127.0.0.1 as port and CAT control (controlling and monitoring my radio) started working. I saw some activity, and even tried answering a CQ call, but my answer was not received.

JT-65 takes time: transmitting a message of maximum 13 characters takes around 50 seconds(!). A full QSO including signal reports takes at least 6 minutes, it's really not a mode for chatting or for fast contacts. On the other hand: it is a weak-signal mode, JT-65 can dig up signals deep from the noise!

Lately I have been annoyed a few times by the selection of news that makes the headlines on television and in the newspaper. This may be due to the selection I follow (NOS journaal and de Volkskrant) and my issues with current politics (how their actions will be framed in the news seems to be much more important than the long term effects).

Two recent news stories where I wanted a lot more information than my news sources wanted to give me were the damaged bridge in Weener and the flooding in parts of northern England.

The world wide web to the rescue, where I can find other news sources and a lot more information about things happening around the world.

Damaged bridge in Weener (Germany):

• Binnenvaart kan weer onder vernielde brug bij Weener door - rtvnoord
• Videoflug über zerstörte Friesenbrücke - ndr.de
• Schip ramt spoorbrug bij Weener - rtvnoord

Flooding in northern England. Noticeable to me was that visiting the BBC website at www.bbc.co.uk gave me a redirect to www.bbc.com which seems to stay away from news about England. Using news.bbc.co.uk gives a better result.

• Cumbria and Lancashire Floods - legionseagle with links to video and pictures
• Storm Desmond: Schools, hospitals and transport disrupted by flooding - bbc news
• Storm Desmond: Engineers battle to restore power to 43,000 homes - bbc news Updates about the aftermath. This article also has something clearly for 'web news consumers': video without audio, most likely the extra video collected in the area but not used for news reports: the "Aerial footage filmed on Monday morning shows the flood levels in Carlisle" video.

In general it seems when some foreign news attracts my attention it is better to find web sources than to wait for the Dutch news to get a hint.

Ik heb een apart overzicht gemaakt van mijn ervaringen met de PA0FBK coax antenne. Aangezien ik over die antenne begonnen ben in het nederlands dat maar volgehouden. Andere dingen over amateur radio schrijf ik meestal in het engels.

Ineens een opvallende stijger in de spam die me opvalt: geluksrelatie.nl die spam stuurt alsof je op een andere manier contact had gezocht met een vrijgezelle dame en het handig is als je verder contact zoekt via die site. De logica dat die dame dan wel de ontvanger kan benaderen maar toch via die site zou moeten werken ontgaat me een beetje. Voorbeeld:

Bedankt voor je reactie ik ben wel wat laat met reageren maar dat komt omdat ik het erg druk had de afgelopen tijd. Ik probeer je daarom nu nog even te bereiken via dit mailtje. Aangezien ik enorm veel reacties had gekregen op mijn oproep heb ik besloten om mezelf [1]hier in te schrijven. Buiten het feit om dat je met mij in contact kan komen zijn er nog [2]veel meer mensen die op zoek zijn naar een serieuze relatie want we willen toch allemaal gewoon gelukkig zijn? Ik kan wel een heel verhaal op gaan hangen maar als je echt serieus bent en je wil contact dan weet je hoe je mij kunt bereiken.

Opvallend is dat hier weinig klachten over terug te vinden zijn, eentje maar via trustpilot als negatieve review van netground.nl.

It must take a special kind of evil to try to spread malware under the guise of information about the recent Brussels lockdown. From the e-mail message:

Federale Politie
Commissariat de Police
Directorate of the special units (DSU)
Sir,
We kregen een terreuralarm met betrekking tot uw zakelijke omgeving.
Worden geadviseerd om de beschermende maatregelen (SECURITY TIPS) als gehecht aan jezelf, je bedrijf volgen en uw gezin beveiligd
.................................................................................................................
Monsieur,
Nous avons eu une alerte terroriste concernant votre secteur d'activité.
Être conseillé de suivre les mesures de protection (Conseils de sécurité) tels qu'ils sont joints pour vous garder, votre entreprise et votre famille fixée
Best regards,
Catherine De Bolle,
General Commissioner
Commissariat de Police
Rue du College 1,
1050 Brussel, Belgium
P: 032 2 515 71 86
E: commisioner(a)polfed-fedpol.be

With some shady files attached. Scanning them with virustotal gives that the .zip file contains the Java/Adwind malware.

About a year ago the UBA PSK63 prefix contest 2015 was my first experience with an amateur radio contest. Since that contest I participated in a few other digimode contests and had fun. So for the next edition in January 2016 I decided to prepare and raise my score. The date is marked in the calendar!

Unless the propagation conditions improve a lot from what they are now I will mostly concentrate on the 20 meter band. After sunset the only usable band for me will be the limited part of the 40 meter band my novice license allows me. The decision whether to enter as 'single operator all band' or 'single operator 20 meter' will depend on my score on the 10 and 40 meter bands.

Before the contest I will do some preparations:

• Improve and test the digimode contest macro definitions.
• Solder connectors on a better coax cable (Aircell 7) to connect the outside endfed antenna to the radio. The Aircell 7 should improve signals somewhat compared to the current RG-58.

Na de recente experimenten met SSTV ging ineens de PA0FBK antenne die ik in 2013 heb gebouwd problemen geven: slechte ontvangst en hele slechte SWR bij zenden.

Ik vermoedde een los contactje of een sluiting, en de enige oplossing om dat te repareren was de krimpkous afscherming er af slopen en de 'voet' openmaken. Daar bleek dat inderdaad de soldeerverbindingen het begeven hadden door de bewegingen. Het kostte wat werk om het geheel weer te repareren maar het is gelukt.

Earlier today I had an opportunity to listen to the FOX-1A amateur satellite. Due to the pass not being very high (a maximum of 61 degrees elevation) and not much time to 'play' I took the Wouxun radio and the arrow antenna out so I would not be busy with unmounting and mounting the FT-857 radio in the 'home shack'. The upside of the downlink signals (from the satellite to the earth) being in the 2 meter amateur band is that the absolute dopplershift isn't as high, so my radio tuned to 145.975 MHz was able to receive some signals.

I mainly heard OM3WAN active, calling CQ for new contacts and making a few. Reception was spotty, so to try anything I will concentrate on higher passes (which have to match my schedule) and use the FT-857 radio.

Some more time to play with the radio this evening, and I made a full QSO in slowscan TV. Which takes time!

The first image includes the image I originally used in the call. PD0JRN was kind enough to share his version of the received second image. The signal strength was not very high, probably due to my inside antenna.

Amateur radio is a hobby with many sides, and I stumbled into a new one this evening. When I had time to try some radio propagation on HF bands I have access to was gone (ionospheric propagation on the 10 and 20 meter amateur bands usually drops as the sun goes down, more information at Radio Propagation article on Wikipedia).

So, I had to try something else. I had a look at the 2 meter websdr available via repeater PI2NOS. I saw an interesting data mode on 144.500 MHz. Hearing it made me recognize it instantly from earlier experiments: slow-scan tv, which means sending images in small bandwidth (using audio encoding). I started qsstv which can decode these images. I used that software before to receive slow scan tv images from the international space station. Using pulseaudio I routed received audio from the websdr to qsstv.

I wanted to play along (encouraged a bit by some fellow Veron A08 club members) so I tried sending images. It took a few tries to understand the template and macro use in qsstv. First the template did not expand so it was a 'CQ SSTV de %m' in the resulting image. Eventually I managed to send out a CQ and I tried to respond to someone. Who did not answer me, so no full QSO yet.

The qsstv software uses templates to create an overlay over an image. The idea is to use text with macros in the template and select an image right before you start transmitting. I had a hard time finding some images to use so I ended up with some of my PD4KH images.

The nice thing is that there is someone nearby always receiving SSTV images on 144.500 MHz: PD2PW has a website with the latest images. So I grabbed the results from that site to see how I did.

Reception is very noisy: My 2 meter antenna is under the roof and I'm only transmitting at 10 watts.

It's possible to get your 'most recent QSOs' (radio contacts) on a website using iframes/scripts from sites like www.qrz.com or www.hrdlog.net.

I had to do my own thing and get the data from my logging application CQRLOG which has all my radio contacts logged. In a MySQL database. Which is not my preferred database, but it works with CQRLOG and I don't touch it otherwise.

A bit of searching found me Accessing the MySQL server spawned by CQRlog - N0NB which had the right incantations. I used this to build a perl script which does an SQL query to extract the latest QSOs, like:

        SELECT callsign,band,mode,loc,rst_s,rst_r,qsodate
        FROM cqrlog_main
        ORDER BY qsodate DESC LIMIT 10

Followed by some work to export the data to a format the webserver for my website can pick up even when the 'radio' desktop is not running. And the result is now visible at the top right of PD4KH Amateur radio - Koos van den Hout.

Having the script really shut up when MySQL isn't running was a bit of work, but in the end this works in my crontab:

./logtosite.pl 2>/dev/null

Searching for my own callsign I found this video:

At 4:42 you will hear me attempt answering someone. Since it's not clear who I am answering it failed as a radio contact (QSO). But it's nice to find a recording of my satellite QSO attempt!

Vanwege drukte en andere plannen voor het weekend ben ik niet naar de Dag van de Radioamateur in Apeldoorn gegaan maar het is toch wel grappig om dan vanaf thuis te kijken wat er aan zendamateurs actief is rond Apeldoorn met APRS. Inspiratie hiervoor van Dag van de radioamateur en APRS - PA4TW door Remco PA4TW.

Uiteindelijk ging de planningsdatum voor de verhoging naar vectored VDSL voorbij zonder dat er iets gebeurde. Daarna waren er wel regelmatig mensen van diverse telecom onderaannemers actief in de kast achter ons huis.

Er kwam geen nieuwe aankondiging van onderhoud, maar afgelopen nacht is er wel iets gebeurd! De haalbare snelheid is naar 51477 kilobit down en 27812 kilobit up. Alleen is de VDSL snelheid ingeregeld op 51937 kilobit down en 5221 kilobit up.

 		Receive Direction 	Send Direction
Max. DSLAM throughput	kbit/s	52000	5224
Min. DSLAM throughput	kbit/s	3488	64
Attainable data rate	kbit/s	51462	27812
Current throughput	kbit/s	51937	5221
Seamless rate adaptation		off	off
 
Latency		4 ms	4 ms
Impulse Noise Protection		44	2
G.inp		on	off
 
Signal-to-noise ratio	dB	8	22
Bitswap		off	off
Line attenuation	dB	10	3

Profile	17a		
G.Vector		off	off

Carrier record		A43	A43

Effectief komt de Internet snelheid neer op ergens 23 a 24 megabit downstream en 5 megabit upstream. Vectoring staat nog niet aan, dus wie weet komt daar nog een verandering. Het liefst heb ik natuurlijk iets symmetrischer snelheden: 20 megabit downstream en 20 megabit upstream zou ideaal zijn.

I had some time (not a lot) this weekend to participate in the Russian WW MultiMode Contest 2015.

I updated my fldigi macros to work better for a contest as I planned when I participated in the CQWW RTTY contest and that improved my speed in making contacts a bit. I think I now have a reasonable setup for the 'search and pounce' side of things (looking for calling stations and answering them). I want to do some more improvements on those macros and then I will do a separate posting about my contest macros and how I use them.

I participated in a few timeslots between other things:

Saturday afternoon 20 meters was wide open and I made a number of contacts (while still improving those contest macros). Things improved when I started using the outdoor endfed antenna.

Saturday evening 20 meters was dead and I was left with the (small) part of the 40 meters band I can use. I managed some contacts on 40 meters RTTY.

Sunday morning 20 meters was wide open again and I made a number of contacts.

Total number of QSO in your log is 55, Including 0 QSO with errors, Valid QSO - 55
Band  QSOs Dupes Points Mults
160      0     0      0     0
80       0     0      0     0
40       6     0     36     7
20      49     2    145    29
15       0     0      0     0
10       0     0      0     0
======================================
Total   55     2    181    36
Claimed score is 6516 points

I had to fix some errors in my log and looking back I may have scored some duplicate contacts, so I'm not sure how high the score in the end will be.

I got reminded I participated in some radio contests the past time, and it would be interesting to get an idea of the scores! Some contests take quite some time to publish...

• Russian WW PSK contest 2015, Результаты - Final results RUS-WW-PSK 2015 : SOAB-Countries Netherlands rank 21, 32 QSO's confirmed, 94 points, multiplier 21, 1974 points. Global rank 433.
• EU-PSK-DX contest 2015 Final EU PSK DX 2015 scores 37 QSO's confirmed, 76 points * 46 multipliers = 3496 points, ranked 16 single operator high power Europe
• Ukranian DX Digi contest 2015 Results 28 QSOs confirmed, 58 points * 17 multiplier = 986 points, ranked 38
• Russian "Radio" WW RTTY Contest, ua9qcq contest results Russian "Radio" WW RTTY contest 2015 position 49 in the claimed scores in the single operator 20 meter category
• Russian world wide digi contest 2015, Результаты RUS-WW-DIGI 2015 : CheckLog checklog accepted with 17 QSOs.

I got locked out of my own server due to fail2ban triggering on:

sshd[12449]: Address aaa.bbb.ccc.ddd maps to something.example.com, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT!
sshd[12723]: Address aaa.bbb.ccc.ddd maps to something.example.com, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT!
sshd[12916]: Address aaa.bbb.ccc.ddd maps to something.example.com, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT!

That was just a few scp actions in short succession, and no reason to lock me out!

Interesting information in the message of the day:

*** /dev/sda1 will be checked for errors at next reboot ***
*** /dev/mapper/vgsw-camera will be checked for errors at next reboot ***
*** /dev/mapper/vgsw-scratch will be checked for errors at next reboot ***
*** /dev/sdc1 will be checked for errors at next reboot ***
*** /dev/sdc2 will be checked for errors at next reboot ***
*** /dev/sda6 will be checked for errors at next reboot ***

Which translates to 'your next system startup will take up to an hour' for me.

This explains why logging in sometimes takes a while: this check probably wakes the disks from sleep some of the time.

I'll go do some of those filesystem checks by hand: I don't want to be offline for up to an hour when I reboot.

Ik heb het cursusboek voor het F-examen al een tijd in huis maar nu ben ik sinds begin september ook bezig met de cursus bij de Veron afdeling Utrecht om zo per de eerstvolgende gelegenheid (Maart 2016) het F-examen te gaan doen.

Ik had het gevoel dat het allemaal 'redelijk' ging maar dat ik om het echt goed te snappen en de proefexamens makkelijk te halen wat meer structuur nodig had. De ervaring tot op heden is dat het binnen de cursus goed gaat, en dat het me gaat lukken.

De reden om nu toch actief achter het behalen van de full license aan te gaan is dat met de vakantie in Engeland ik niet mocht zenden (maar wel leuk aprs heb geluisterd) en dat ik soms dingen op andere banden zou willen. En bij contesten of zeldzame nieuwe landen is wat meer vermogen soms ook handig!

Another long expected amateur satellite has been launched and is available to amateurs, the Amsat-NA Fox-1A satellite, which gained amsat identifier AO-85.

Since it was launched as part of a militairy mission it's a bit harder to find the right keplerian elements (the numbers describing the orbit). The official Norad catalog number is 40967, but the standard sources for keplerian elements won't have this listed. Other sources have keplerian elements, but use different temporary object numbers. Since gpredict links everything together using the object number, this can get a bit confusing. I found usable keplerian elements at http://mstl.atl.calpoly.edu/~ops/grace_tle/grace_jspoc.txt which has Fox-1A as object 90747 named GRACE_47. So I created a preliminary transponder file ~/.config/Gpredict/trsp/90747.trsp with:

[Fox-1A FM trsp 67 Hz PL]
UP_LOW=435170000
DOWN_LOW=145978000

Frequencies adjusted based on research by Jan PE0SAT and Tom Worthington NH6Y

Now to find time to actually hear this satellite and attempt to work it.

With the USB Killer 2.0 and the USB Rubber Ducky it's not a good idea to put any random USB device into your system.

The USB Killer is quite simple: it charges up via the USB power leads and when the voltage is high enough (220 V) it will drop that back into the computer via the USB data leads.

The USB Rubber Ducky looks like a simple USB thumbdrive but it will actually mimic a USB keyboard and do interesting things with a computer, up to Exporting the wifi setup including passwords.

Do you dare to put any random USB device into your computer? Something you found in the parking lot?

Someone entered an e-mail address that ends up with me in the spamlist of The GAP. The GAP sends out one or two marketing spam mails per day so this gets irritating quite fast. No verification whether the e-mail address was the right one or interested in these messages.

It seems The GAP does this via exacttarget, where the Exacttarget anti-spam policy says:

You should only receive email from our system from some client of ours that you recognize signing up to receive email from. Our clients certify that all email addresses used in our system are opt-in names that have given permission to the client to send them email.

So I also notified exacttarget.

For a while I've been seeing output like this from the spamcop parser:

Resolving link obfuscation
https://www.google.com/url?q=http://strong.kindatodad.com&sa=D&usg=AFQjCNGsbJ19ztGW0DPjE3HCshzN0jWOdg
Removing google re-director: http://strong.kindatodad.com&sa=D&usg=AFQjCNGsbJ19ztGW0DPjE3HCshzN0jWOdg
chopping username "strong.kindatodad.com&sa=D&" from URL: http://usg=AFQjCNGsbJ19ztGW0DPjE3HCshzN0jWOdg
Tracking link: http://usg/=AFQjCNGsbJ19ztGW0DPjE3HCshzN0jWOdg
No recent reports, no history available
usg is not a hostname
usg is not a routeable IP address
Cannot resolve http://usg/=AFQjCNGsbJ19ztGW0DPjE3HCshzN0jWOdg

There is an obvious error in the parsing, and this has been going on for a while. With a browser I do get redirected to http://strong.kindatodad.com as expected. The domain registration kindatodad.com was updated today (always a bad sign) but it does not seem to be working at the moment.

Recently nine (!!) small satellites were launched from China with one rocket. Six of these have each digital telemetry, CW beacon and a linear transponder in the amateur bands (I really should make some time to practise making contacts on SSB), two only have telemetry downlinks and one has a beacon, APRS transponder and an FM transponder, which should be easy to work.

The one with the FM transponder is LilacSat-2 (or CAS-3H, 2015-049K). I created a preliminary transponder file 40908.trsp for gpredict with:

[FM V/U]
UP_LOW=145350000
DOWN_LOW=437225000
MODE=FM

At this time untested.

The satellite has a schedule for operating the FM transponder (which probably has to do with power budget and other experiments on board):

LilacSat-2 is scheduled to switch on the FM transponder for 24 hours at about 2200 UT each Monday, Wednesday and Friday.

Now to find time to try this satellite transponder at the available times.

Links for more information:

• LilacSat-2 - Amsat-UK
• LilacSat-2 FM Transponder Schedule - Amsat-UK
• LilacSat-2 radio info page

For a few hours I participated in the Russian world wide digi contest and it was near-impossible to get through to others, unlike the previous CQ worldwide RTTY contest. I only tried PSK63 mode. I did have a look at my contest macros and I will reshuffle them and improve them. I did notice the FLDIGI Contest - How To handles 'Search & Pounce' mode as something that 'also happens', but the 'Run' mode is thought out better. In 'Search & Pounce' mode you search other calling stations and try to answer them, in 'Run' mode you do the calling.

With my modest station I'm almost all the time in 'Search & Pounce' mode so I need to optimize my macros for that mode first.

Results were awful: I made a total of 17 contacts in about 1.5 hours of trying. I'll enter it as a checklog: verifying the contacts others made with me but not entering the scoreboard. It seemed almost nobody was hearing me, especially not in Russia, where the points can be scored.

Preliminary score:

Total number of QSO in your log is 17, Including 0 QSO with errors, Valid QSO - 17
Band  QSOs Dupes Points Mults
160      0     0      0     0
80       0     0      0     0
40       0     0      0     0
20      17     0     51    12
15       0     0      0     0
10       0     0      0     0
======================================
Total   17     0     51    12
Claimed score is 612 points

I noticed a sharp rise in the firewall log entries for telnet attempts:

dmesg | grep -c 'DPT=23 '
176

From all over the world. I was wondering until I read Is there an Internet-of-Things vigilante out there? - Symantec official blog.

From the article:

During our analysis we began to unveil some of Wifatch’s secrets. Most of Wifatch’s code is written in the Perl programming language and it targets several architectures and ships its own static Perl interpreter for each of them. Once a device is infected with the Wifatch, it connects to a peer-to-peer network that is used to distribute threat updates.

The further we dug into Wifatch’s code the more we had the feeling that there was something unusual about this threat. For all intents and purposes it appeared like the author was trying to secure infected devices instead of using them for malicious activities.

Entering some of the 'attacking' IP addresses into shodan.io gives me a report they are running vulnerable routersoftware such as 'Allegro RomPager'.

Right from the inbox, two mails with:

The e-mail address (koos .....nl) was recently registered for a WiFi Plus account at Tim Hortons. In order to complete the registration process and fully activate your account, please click the link below: Activate my account. Account verification is mandatory. Completing the registration will also remove the restriction on your account. If you are unable to click the above link, copy and paste the following link into your web browser address bar:

I'm not going to visit the verification link, that will probably get me some spam. As it is, this is reasonable: nothing unless I verify that the e-mail address is valid for this purpose.

Much of this weekend was filled up but I noticed really heavy RTTY activity on the radio bands Saturday evening. Looking at the PG7V contestcalendar showed me the CQ World Wide RTTY Contest 2015 was busy in full force.

I participated for about two and a half hours on Sunday between other things and managed a nice 54 contacts. It is a quite busy contest with lots of stations participating. There are probably 'contest stations' that participate for the full 48 hours and make thousands and thousands of contacts. For me only 'search and pounce' mode worked, nobody came back to my calling attempts. This is probably related to my modest output power and antenna setup.

Getting the log accepted was a whole different problem and in hindsight it was the wrong decision to try to get that done late Sunday evening. The logging format for this contest is quite strict (and somewhat US-centric) and it took me a few iterations to get the log right to have it accepted for processing. According to the documentation fldigi does the cabrillo export right for the various contests but I noticed some problems with it. On further reading I notice I have to set up the contest macros before I start logging for a contest. Which means I have to prepare a bit more for a contest than the usual "Something is going on, let's jump in". The fldigi site has a document FLDIGI Contest - How To which I should read and use for the next contest!

Update 2016-07-17: From time to time I checked the CQ World Wide RTTY contest results but it took a while. The results were published in May 2016. In total 52 contacts accepted, 6 zones, 22 countries, 4 contacts in USA/Canada.

This evening I hung the endfed antenna outside, in the hopes of being able to make a contact with a station in Algeria I saw calling. But the station went away, or the signal doesn't make it to my endfed while being ok on my attic antenna.

But I received a very interesting reply when I called CQ for new contacts: YB6HAI from Indonesia. New distance record: 9923 kilometer. And a new country.

The contact is already confirmed.

I got annoyed with the PC powersupply I used for the amateur radio setup, output power was dropping below reasonable values at any load. The PC power supply was supposed to be able to give me 40 Ampere at 12 Volts but I saw the 12 volts drop easily to below 10 Volts at a load of less than 10 Ampere. So, time for a better power supply. I kept an eye on any nice secondhand offers and found an Alan K205 powersupply for sale which would give me 13.8 Volts at a sustained maximum of 20 Ampere (22 Ampere peak). I made a reasonable offer which was accepted immediately and went to pick it up.

It's an old-fashioned transformer and regulator powersupply (not a switching mode powersupply), it's big and it weighs a lot. And it works like I want it, with voltage never dropping below 13 Volts even under heavy load.

Radio with new Alan K205 power supply

This also makes the Yaesu FT-857 radio work better: under 12.5 volt it will lower the output power. I notice it now runs the output fan for longer periods after transmitting.

Radio amateurs exchange QSL cards to confirm contacts. Recently I received a whole batch of new ones. I usually look at the 'backside' first since that has the details about the QSO, but some cards have really nice fronts too!

Incoming QSL cards

Incoming QSL card fronts

I mentioned serious radiocontesting before where people invest serious time and money into getting the best scores. There is also a more laid-back approach of participating for a few hours in a radiocontest and just going for the fun. And maybe having a contact with a new country.

The Essex Hams did just that: they participated in the RSGB SSB Field Day and enjoyed themselves without breaking any records in scores, read the full report at RSGB SSB Field Day – Shoebury 2015 - Essex Ham. A nice article, and the main conclusion is that they had fun with amateur radio.

Found via Essex Hams try Contesting - Southgate Amateur Radio News.

Today I took the APRS setup with me. During the day by car (it was raining) and in the evening by recumbent bicycle to the radio club (it wasn't raining that hard in the evening). Both times I had APRSDroid, the Mobilinkd and the radio running for APRS (Automatic Packet Reporting System).

With the car the antenna was sticking up from the left rear window. Most beacons were received by a nearby APRS digipeater and made it into the APRS network.

With the bicycle the antenna was sticking up from the bag on the back. No beacons were received by an APRS digipeater. And I'm not too happy about a 5W transmitter right behind my head. Time to look at the setup.

In mijn 1-wire projecten was ook nog het plan om de watt-uur pulsen van de electricteitsmeter te gaan tellen. Met een schakeling met lichtgevoelige leds en een teller is het me nooit gelukt de pulsen betrouwbaar te tellen.

Ik ontdekte de YouLess die het tellen van zo'n ledje of van een draaischijfmeter terdege opgelost heeft en die niet begint met de data naar een externe dienst te sturen voor ik er naar kan kijken. Er is gewoon een simpele interface waarmee de tellingen van de YouLess via het netwerk uit te lezen zijn en die gebruik ik natuurlijk en maak er interne statistieken van.

Gemeten electriciteitsgebruik per kwartier

Van die statistieken maak ik ook een grafiek met een nauwkeurigheid per kwartier. Die keuze is omdat de 'slimme meter' per kwartier uitgelezen kan worden en ik wil wel eens weten wat je er dan uit kan halen. Heel veel dus! Uit de kwartierwaarden is een hoop te halen over onze dagelijkse gewoonten, zeker als je ze over een lange termijn beschikbaar hebt. Voor de meeste pieken kan ik een verklaring bedenken en als eenmaal bekend is welke actie welke hoeveelheid energie gebruikt kan je daarna andere pieken ook weer uitleggen. Opvallend is dat zelfs bij de resolutie van 15 minuten een kort maar duidelijk gebruik zoals de waterkoker of een lange termijn wijziging zoals het licht aan of uit schakelen prima te zien is.

Today a missed call from +99994723523. There is no country code +999 so this is as fake as it can be for a caller-id.

And still caller-id is treated as very valuable evidence by the police, but that is a different rant.

A google search for the number suggests this is a number used by the Microsoft support scam. Nobody was available to be scammed.

Ruim 3 jaar later is er de laatste weken weer een opmerkelijke stijging van spam die denkt dat ik een bedrijf in België ben. Dezelfde bedrijfsnaam en e-mail adres die ik eerder zag in spam die veroorzaakt werd door adreslijsten van Email-Packs.

Recente bedrijven die de fout maken deze frauduleuze en waardeloze lijsten aan te schaffen en te gebruiken voor het illegaal benaderen van mensen:

• Woningtechieken.be
• DeBesteLeverancier in meerdere campagnes
• BizzBooster in meerdere campagnes

On Saturday I participated in the Russian "Radio" WW RTTY Contest. I used the end-fed antenna outside to give me somewhat better reception. The contest is the whole of Saturday (UTC) but I only participated in the local evening time due to other things that happen on a Saturday.

The preliminary results:

Total number of QSO in your log is 41, Including 0 QSO with errors, Valid QSO - 41
Band  QSOs Dupes Points Mults
160      0     0      0     0
80       0     0      0     0
40       0     0      0     0
20      41     0    220    31
15       0     0      0     0
10       0     0      0     0
======================================
Total   41     0    220    31
Claimed score is 6820 points

This puts me at a rank of 49 in the 'SINGLE-OP 20M' category in the claimed scores.

Na alle recente wijzigingen tijd voor een nieuwe scan. Geen van de regionale multiplexen is sterk genoeg om op deze setup met laptop en Noxon DAB+ stick door te komen.

Opmerkelijk: MTVNL heeft een DAB+ audio service toegevoegd, GrootNieuwsRadio. En de MTVNL op 12B wordt wel gezien als DAB dienst van MTVNL maar zonder geldige diensten.

Net een scan gedaan met de Pure DAB+ radio op zolder. Opmerkelijk is dat wel de regionale multiplex Zuid op 7A goed doorkomt, waardoor ik nu L1 radio (Limburg) en Omroep Brabant kan ontvangen, maar niet de regionale multiplex West op 8A krijg waar 'onze' regionale zender RTV Utrecht in zit. Soms ontvang ik regionale multiplex Oost op 6B waar wel RTV Utrecht in zit voor de oostelijke helft van de provincie Utrecht. Maar dat is dan marginaal en vandaag dus niet.

De opbouw van regionale multiplex west op 8A gaat langzamer dan de andere regionale multiplexen vanwege de kosten volgens Radio Royaal binnenkort via DAB+ in de Randstad - radio.nl

Dat het DAB+net voor de Randstad slechts matige dekking krijgt, heeft alles te maken met de kosten. Op dit net dienen namelijk 18 verschillende partijen, zowel publiek als commercieel, te gaan uitzenden. Sommige partijen willen helemaal niet uitzenden via DAB+, maar zijn het wel verplicht, terwijl anderen weinig financiële middelen hebben. Daarom is gekozen voor een netwerk met een minimale dekking, waardoor net aan aan de licentievoorwaarden wordt voldaan.

We finally had a serious thunderstorm last night, making us almost jump from the bed at one moment. And the lighting strike counter saw that thunderstorm nicely.

It's quite clear the counts are lower now the sensor is closer to the ground. I'm not sure what to do to get a "good" count again. Last week I placed the 10/20/40m endfed antenna outside for part of the day and noticed that setup also influences the lightning detector in the shed. Raising the end of the antenna helped a bit, I noticed I can use the back gate of our house as the low end of the antenna.

This weekend I participated in the SCC RTTY championship. I did nothing special to my setup other than sitting down behind the computer and running fldigi in contest mode. Claimed scores: 33 contacts, multiplier 28 (claimed score 1876 points) in the single-operator 20 meter category.

I updated the Veron afdelingscompetitie with the latest results.

Over the last two weeks I received an enormous amount of spam advertising Best Movers Toronto. Hundreds of messages. Absolutely no use to me and a really bad way of advertising.

Some searching gave me the idea someone else is trying to destroy the reputation of Best Movers Toronto. Reports about the moving market around Toronto suggest scams happen regular and competition is strong, so maybe some of the scammers got annoyed.

From earlier targeted spam it is clear one of my mail addresses is flagged as 'will report spam' with some spammers, so I get targeted in these attempts to destroy the reputation of others.

I tried APRS (automated packet reporting service) before and wasn't convinced I was going to use it much. A later attempt in tracking my location on an amateur-related trip from Apeldoorn was also not much of a success.

But, on our recent holiday in the southern part of England I also tried recieving what was available on the 2 meter and 70 centimeter amateur bands and I noticed at a campsite in the New Forest that there was a lot of traffic. I decoded this by putting the android tablet with APRSdroid close to the radio. Part of the traffic was decoded and this gave interesting things such as announcements of local repeaters. I also heard a lot of packets that weren't decoded by the setup with the microphone of the tablet.

Display on aprs.fi of my trip today

So my interest in APRS was revived. And I knew of a much nicer solution for APRS with Android devices: the Mobilinkd bluetooth APRS interface. So I bought one and 'connected' it to my Android tablet. It recieves a lot more local packet activity than my first attempts, I see digipeated packets from as far as northern France. And today I tried transmitting my location on a short trip. The results weren't ideal since the trip was a lot further than the logged points, time to look at the audio settings for transmit.

After taking the course in April and doing the exam in June I am now a Certified Information Systems Security Professional. As part of my job in computer security it is good to have this knowledge, it really helps me understand things.

After sending out another batch of QSL cards via the bureau earlier this week I started thinking seriously about ordering them and not printing and cutting them myself. I'm reasonably happy with my design at the moment. And I do like sending and receiving them, so I want more.

There is one thing: I do hope to pass the Full license exam some day. This does mean I will get a different callsign (PD calls are reserved for novice, PA/PB/PC/PE/PF/PG/PH for full licensees) so cards I order now will become invalid at that time.

So I was looking for a QSL printing service that could do not too many cards in black and white for a nice price. LZ3HI offers QSL printing for a reasonable price. And a good thing (for me) is that I can pay him via a bank transfer in Euro's which means there is no extra cost involved.

I noticed one of the harddisks in the home server greenblatt wasn't in standby mode when idle for a long time. This was noticeable since the UPS load value was a bit higher than I expect for a complete idle machine.

A few years ago I set up spindown to set the disks to standby on inactivity and this wasn't happening. A peek at the internal statistics turned out that since the two ubuntu upgrades in april this disk wasn't going into standby mode. It turned out that since the kernel upgrades it doesn't listen to sg_start --stop anymore so I had to change the relevant part of /etc/spindown.conf to:

[Disk 0]
id = ata-WDC_WD15EADS-...
spindown = 1
command = hdparm -y

And a few watts are saved again. The interesting part is that the sg_start --stop command still works fine for the WDC_WD10EADS disk.

Lightning strikes counted today

Finally a thunderstorm passed our house today, and it got counted on the lightning strike detector!

The downside is that switching the light on in the shed a few times causes more 'hits'.

eQsl card from A45XR Oman

I added a new country in amateur radio contacts: Oman.

In a lot of the amateur radio contacts I have location information is exchanged. This is done in the Maidenhead Locator System which uses letters and digits to pinpoint locations with an increasing precision. I give out my home location as JO22NC.

In the contacts I make I also log all those locators and using the Linux version of gcmwin I plot these on great circle maps. The results:

• Digimode contacts on HF by PD4KH from locator JO22NC
• Satellite contacts by PD4KH from locator JO22NC

The difference in scale of the maps is because the digimode on HF map is scaled to my furthest contacts (Puerto Rico), the satellite map is scaled towards the theoretical maximum distance I can reach via the SO-50 satellite.

The difference in numbers is because it's a lot more work to make satellite contacts!

I like to sometimes add audio to items here on my homepage. In a format accessible for anyone with both download and play in browser options. Until now this was done using a flash-based player but lately flash has not been the secure option.

With the latest browsers it is quite possible to have an html5 audio player, but to keep it accessible for every visitor I also want to keep the flash audio player available. So I looked up how to do that and found Using HTML5 audio and video.

The linked audio is also available as attachments to the homepage RSS feed which is the standard for podcast feeds but since the recordings of satellite passes don't have an audio explanation or introduction they are not very usable as a podcast feed.

I had a nice high pass of the SO-50 amateur satellite but no luck on making a contact. I heard several other active amateurs and noted their callsigns and locators: HB9OAB in JN46ME, MW0URC in IO82JB, DL3XAC in JO53GN and 9A5YY in JN75DH.

Silence in the recording is when I transmit. I still trip over new (to me) callsigns when trying to reproduce them, so I need the recording to get all the details right.

This evening there was another interesting pass of the SO-50 radio amateur satellite. The maximum elevation was only 68 degrees so there would not be too much time with the satellite high enough above the horizon to make contacts.

I heard the pass clearly but it was busy with other (very structured) contacts and some regulars helping a newcomer, so I decided to just listen.

This weekend gave me another chance to receive slow-scan TV (SSTV) images from the International Space Station. These images were transmitted to commemorate the 40th anniversary of the Apollo-Soyuz Mission.

The usable passes from my home location were at a bit early times: 05:30, 07:10 and 08:43. And I really like to sleep out on Sunday, especially since I'm currently quite tired. So I opted to only go for the 08:43 pass and see what I could get. Timing of images was also bad: when I started to hear the ISS I heard the tones of the end of an image. But later a new image started and I managed to receive the whole image although some noise in the middle (some building in the way probably) made qsstv break the image in two parts, which I fixed using the gimp.

Used equipment: laptop with gpredict for calculating azimuth/elevation and frequency correction, a tripod, the Arrow antenna, the FT-857 radio. I recorded the audio on the laptop with audacity and did the decoding with qsstv later, which gave me the opportunity to try it a few times to get the best decode.

In checking the satellite predictions for usable ISS passes this weekend I noticed a nice pass of SO-50 this evening (high enough and at a time not clashing with other things). So I decided to give it a try with the FT-857 radio and dragged everything out: radio, cat cable, audio cable, laptop, satellite antenna, headphones, power supply. And looked up how it all should work together. My last successfull satellite QSO was almost a year ago in august 2014 so the skills were a bit rusty. It was good to have an idea of the data exchanged in a typical amateur radio satellite contact.

I listened, I answered a CQ from MW0HCC and he acknowledged me on the second try and we had a full valid QSO.

Right after that happened I felt some rain so I started to stop early.. and later in the recording I heard that DL3XAC also came back to me but I missed that. Better luck next time on getting back to that callsign!

It's clear 10 watts from the FT-857 works a lot better than 5 watts from the Wouxun, and someone told me the CTCSS from the Wouxun isn't as strong as it should be either.

Ruim een jaar na de eerste plannen voor een nieuwe KPN kast achter ons huis lijkt het er toch op dat er een snelheidsverhoging aan zit te komen via vvdsl (Vectored VDSL).

Een planning site beweert dat er een snelheidsverhoging naar 100 mbit downstream inzit in het 4e kwartaal van 2015. Ik ga het zien... de Fritz!Box 7360 kan het aan. Misschien moet ik de firmware op de Fritz!Box upgraden voor maximale snelheid en stabiliteit. Waarbij dan bij 6.20 firmware de aanpak uit FritzBox 7390 - FW 6.20 - debug.cfg zurück bringen nodig heb om weer mijn setup met routing op de server werkend te krijgen.

Wat ik eigenlijk vooral hoop is dat er ook meer upstream snelheid komt. De downstream is al beperkt tot wat mijn abonnement aankan: 20 megabit. Maar als de upstream ook naar 20 megabit kan is het een serieuze vooruitgang.

The last year in counted lightning strikes, showing clearly that I got active on 20meter psk31 in October 2014. The 'blips' before that are real thunderstorms.

I thought of this ages ago: Moving the lightning strike detector to the shed but only today got around to it because we had some serious chances of a thunderstorm earlier today which showed up on the lightning strike detector but the graph was completely screwed up again after I tried some psk31 digital mode transmissions on the 20 meter amateur band (14.000 to 14.250 MHz for me).

So now it is in the shed. Moving it to a lower position does mean I will not get readings for thunderstorms as far away as I used to but I'd rather have usable readings at this moment. First tests with transmitting psk31/psk63 on 20 the meter amateur band after I changed it look like it doesn't count the transmissions anymore. Now to wait for the next good thunderstorm to see how that gets counted. Some blips are showing up.

Update 2015-07-14: The first result seems to be that using the lights in the shed (tubelights with starters) shows up clearly. Using the radio still has no effect. I now await the first thunderstorm for more results.

Update 2015-07-28: No thunderstorm has been reported by the KNMI weather institute thunderstorm archive within a short distance of my sensor. I guess the maximum range is quite limited now.

The world did not fall apart at the leap second...

Jul  1 01:59:59 greenblatt kernel: [5562265.176016] Clock: inserting leap second 23:59:60 UTC

Jul  1 01:37:53 ritchie ntpd[14950]: local_clock: ntp_loopfilter.c line 688: kernel reports positive leap second warning state
Jul  1 01:59:59 ritchie kernel: [5807507.207473] Clock: inserting leap second 23:59:60 UTC
Jul  1 02:13:11 ritchie ntpd[14950]: local_clock: ntp_loopfilter.c line 688: kernel reports leap second has occured

I thought I heard short exchanges with locators and callsigns when I made the last recording of an SO-50 pass. But since this is all NATO spelling and without any indication which part was what it wasn't completely clear to me what I was hearing. So I asked on the Amsat-bb mailing list about the typical SO-50 exchange and got an elaborate explanation:

• Europe: callsign / signal report (normally 59) / 6-character grid locator.
• In other parts of the world like North America and Australia, signal reports are not normally given.
• The 6-character grid locator is useful in Europe, where we in North America usually just go with 4-character grid locators.
• In Australia, call signs and general descriptions of your signals (loud/clear, for example) are all that they exchanged. No 59, no grid locator.

So I would answer with: callsign de Pappa Delta Four Kilo Hotel, Five Nine in Juliet Oscar Two Two November Charlie, QSL? With: Pappa Delta Four Kilo Hotel PD4KH my callsign, Five Nine the signal report (audio quality 5 and signal level 9), Juliet Oscar Two Two November Charlie the Maidenhead Locator for where I usually operate and QSL? the Q code for Can you acknowledge receipt?.

Previous there was just an announcement:

associd=0 status=0119 leap_none, sync_pps, 1 event, leap_armed

But the current state is that it's less than 24 hours until the leap second:

ntpq -nc readvar
associd=0 status=4619 leap_add_sec, sync_ntp, 1 event, leap_armed,
version="ntpd 4.2.6p3@1.2290-o Mon Apr 13 13:41:30 UTC 2015 (1)",
processor="x86_64", system="Linux/3.2.0-80-generic", leap=01, stratum=2,
precision=-20, rootdelay=21.302, rootdisp=962.377, refid=131.211.8.244,
reftime=d93ccb6a.5bf9c564  Tue, Jun 30 2015 10:01:46.359,
clock=d93ccb70.10208b70  Tue, Jun 30 2015 10:01:52.062, peer=21283, tc=6,
mintc=3, offset=-23.354, frequency=7.280, sys_jitter=0.205,
clk_jitter=8.257, clk_wander=0.087, tai=35, leapsec=201507010000,

Uit recente e-mail van de bibliotheek utrecht:

de Bibliotheek Utrecht heeft u een e-mail gestuurd met als onderwerp ‘Goed nieuws: Bibliotheek op de Neude’.
Dat u de inhoud van deze e-mail niet direct kunt lezen komt wellicht door de instellingen van uw browser.

Nee hoor, ik lees mijn e-mail niet met een browser, die zijn daar niet voor.

Dat ik de tekstversie zie komt door

alternative_order text/plain text/html

in mijn .muttrc.

This evening I had a nice pass of SO-50, maximum elevation 83 degrees, southwest to northeast so I decided to give it a try. I heard two callsigns distinctly and tried replying to them but they didn't hear me or didn't reply.

I recorded the pass again with the line-in on my mp3 player. Using the simple earphones from my mp3 player gave me reasonable audio. The cable between the radio and the splitter was giving some issues again: I still had intermittent audio levels when the cable moved.

Update: And I edited the audio file I recorded: took of the first noise until the first voices showed up in the audio. I may have cut off too much as I can't find the German callsign anymore that I was quite sure I heard.

This weekend there was another digimode contest active in the digital mode part of the 20 meter amateur band. So I decided to play along for a bit when I had time. The main results are that I made contacts with a new country (Estonia) and a new US state (Florida). I entered the log just now and the result page says:

Your log is ACCEPTED with the following data:

Callsign: PD4KH
Category: SINGLE_OP 20M LP
Number of QSOs: 29

The weather is finally getting better and some people really would like me to demonstrate satellite QSO's. So I need to get active again and make those contacts. One thing I wanted to improve was the recording of contacts. When I use the FT-857 radio with computer control I can record everything but I need lots of wires and equipment. I also want to record in a more 'lightweight' setup, with a handheld radio (or two for full duplex).

So I dug up an older 3.5mm headphone splitter and used my iRiver ifp-795 in line-in recording mode to record the incoming audio while hearing it at the same time via headphones.

Today I tested recording the audio from the Wouxun KG-UVD1P. Someone on repeater PI3UTR was nice enough to keep it busy. I had a reasonable recording, it had distortion. Next test is on a pass of the SO-50 satellite.

Update: I had a low pass (about 30 degrees elevation maximum) and I noticed the cable between the radio (2.5mm mono) and the splitter (3.5mm stereo) was giving an intermittant contact so I resoldered it. Understandig the callsigns in the audio was still a problem, I had to turn up the volume quite high which led to a distorted recording.

And when I leave the iRiver ifp-795 in line-in recording mode it does not shut down after some minutes of inactivity. I have to shut it down by hand or switch to mp3 player mode.

At work I reviewed something about TLS security I wrote in May 2014 and noticed I had to make some serious adjustments for the May 2015 state. SSLv3 is no longer accepted, SHA1 is no longer an accepted hashing algorithm and other changes.

This week on the home server greenblatt I had two different impacts from the latest OpenSSL update: SSL communications with the Fritz!Box was failing and SSL in sendmail was failing, both due to the latest insights into the security of the Diffie-Hellman key exchange.

These insights are very very new: in April I did a course in the Certified Information Systems Security Professional (CISSP) common body of knowledge and I learned the default Diffie-Hellman parameters were safe. Now we learn to generate them for each individual system at the same strength as the private key. Knowledge of cryptographic quality ages fast at the moment.

I'm not sure it is related to the recent OpenSSL upgrades but yesterday outgoing mail was suddenly all stuck with the error message:

Jun 19 16:02:30 ritchie sendmail[6381]: STARTTLS=client: 6381:error:14082174:SSL routines:SSL3_CHECK_CERT_AND_ALGORITHM:dh key too small:s3_clnt.c:3449:        
Jun 19 16:02:30 ritchie sendmail[6381]: ruleset=tls_server, arg1=SOFTWARE, relay=postbox.idefix.net, reject=403 4.7.0 TLS handshake.                            

I couldn't find a definitive reason, but I did notice these in the logs of sendmail on the home server:

Jun 19 20:59:27 greenblatt sendmail[4747]: STARTTLS=client: 4747:error:14082174:SSL routines:SSL3_CHECK_CERT_AND_ALGORITHM:dh key too small:s3_clnt.c:3338:
Jun 19 23:09:24 greenblatt sm-mta[20569]: STARTTLS=server, error: cannot read DH parameters(/etc/mail/tls/sendmail-common.prm): error:0906D06C:PEM routines:PEM_read_bio:no start line

I did notice /etc/mail/tls/sendmail-common.prm was 0 bytes large on the server which could be a source of the problem. This is the Diffie-Hellman parameter file used by the submission client. I regenerated this file to a 2048 bit Diffie-Hellman dhparam file. Mail is flowing again, but I'm not sure this was the cause of the problem.

The first errors were from:

Jun 15 13:00:52 greenblatt sendmail[26472]: STARTTLS=client: 26472:error:14082174:SSL routines:SSL3_CHECK_CERT_AND_ALGORITHM:dh key too small:s3_clnt.c:3338:
Jun 15 13:00:52 greenblatt sendmail[26472]: ruleset=tls_server, arg1=SOFTWARE, relay=[127.0.0.1], reject=403 4.7.0 TLS handshake.

And that was right after an openssl update. Why it took until 19 June for the mailflow to stop completely is strange to me.

Update: The only thing I can think of is that sendmail wasn't restarted after OpenSSL was updated. I checked the same update today on another system and the update of OpenSSL does not set triggers to restart ssl-using daemons.

The latest OpenSSL updates cause me a new problem:

Connecting to fritz.koos.koffie.dot (fritz.koos.koffie.dot)|192.168.178.1|:49443... connected.
OpenSSL: error:14082174:SSL routines:SSL3_CHECK_CERT_AND_ALGORITHM:dh key too small
Unable to establish SSL connection.

Which means the script to fetch the dsl status from the fritzbox can't connect until I find out how to convince wget how to negotiate a non-standard cipher set. Or switch to curl.

Getting the right answers with curl isn't working out either. I can get the SSL working and do a POST to the right URL but the 'best' thing I get back is:

<errorCode>502</errorCode>
<errorDescription>XML error</errorDescription>

Update: The solution was to keep using wget but disable(!) SSL, using the non-SSL port for upnp. The command now is:

wget --user=$FRITZUSER --password=$FRITZPASS --post-file=linkstatusrequest.xml \
--header="Content-Type: text/xml" \
--header="SOAPAction: \"urn:dslforum-org:service:WANCommonInterfaceConfig:1#GetCommonLinkProperties\"" \
http://192.168.178.1:49000/upnp/control/wancommonifconfig1 -O linkstatusanswer.xml

And now the data is available again and the graph is updated.

So the recent upgrade in OpenSSL which disabled less secure Diffie-Hellman key negotiation results in having to disable all encryption on the connection with the fritzbox. A security update on the fritzbox may solve this.

Reading the changelogs for Ubuntu upgrades is good, since I noticed:

Get:1 Changelog for apache2.2-bin (http://changelogs.ubuntu.com/changelogs/pool/
main/a/apache2/apache2_2.2.22-1ubuntu1.9/changelog) [152 kB]
apache2 (2.2.22-1ubuntu1.9) precise-security; urgency=medium

  * SECURITY IMPROVEMENT: add support for ECC keys and ECDH ciphers
    (LP: #1197884)
    - debian/patches/ecc_support.patch: add support to
      modules/ssl/mod_ssl.c, modules/ssl/ssl_engine_init.c,
      modules/ssl/ssl_engine_kernel.c, modules/ssl/ssl_private.h,
      modules/ssl/ssl_toolkit_compat.h, modules/ssl/ssl_util.c,
  * SECURITY IMPROVEMENT: add TLSv1.x options to SSLProtocol (LP: #1400473)
    - debian/patches/tls_options.patch: allow specifying later TLSv1.x
      options in modules/ssl/mod_ssl.c, modules/ssl/ssl_engine_config.c,
      modules/ssl/ssl_engine_init.c, modules/ssl/ssl_engine_kernel.c,
      modules/ssl/ssl_private.h.
  * SECURITY IMPROVEMENT: improve ephemeral key handling, including
    allowing DH parameters to be loaded from SSLCertificateFile and
    disabling EXPORT ciphers.
    - debian/patches/ephemeral_key_handling.patch: numerous improvements to
      modules/ssl/mod_ssl.c, modules/ssl/ssl_engine_config.c,
      modules/ssl/ssl_engine_dh.c, modules/ssl/ssl_engine_init.c,
      modules/ssl/ssl_engine_kernel.c, modules/ssl/ssl_private.h,
      modules/ssl/ssl_util_ssl.c, modules/ssl/ssl_util_ssl.h.

It took a bit of digging in Bug #1197884 “apache2.2 SSL has no forward-secrecy: need ECDHE k...” : Bugs : apache2 package : Ubuntu but the decision was made to backport ECDHE handling to mod_ssl in the Apache 2.2.22 package in Ubuntu 12.04 LTS. To be able to use this all you need to generate your own dhparams with:

# openssl dhparam -out dhparam.pem 2048

Where the keysize here (2048 bits) needs to be the same as for the private key. The resulting dhparams in PEM format need to be pasted to the SSLCertificateFile so it ends up looking like:

-----BEGIN CERTIFICATE-----
..
-----END CERTIFICATE-----
-----BEGIN DH PARAMETERS-----
..
-----END DH PARAMETERS-----

This is actually an upgrade and not an update, but as the discussion in the bugreport shows the choice was made to improve overal security in light of recent revelations about the probable capabilities of NSA/GCHQ, better explained in The Logjam (and Another) Vulnerability against Diffie-Hellman Key Exchange - Schneier on Security.

Slight adjustment of my highest distance in a PSK31 contact: 7179 kilometer to KP4DQC in Puerto Rico.

Bericht van de ING:

In Mijn ING bent u gebruiker (geweest) van FiNBOX voor uw financiële post en betalingen. Omdat steeds minder ING-klanten gebruikmaken van FiNBOX, hebben wij besloten om per 1 januari 2016 te stoppen met deze dienst. Natuurlijk vinden wij dit erg jammer. Dit betekent dat u vanaf deze datum geen FiNBOX-documenten meer kunt ontvangen, betalen of inzien.

Alternatieve mogelijkheden

Steeds meer bedrijven bieden u mogelijkheden om financiële post digitaal te ontvangen, zoals in "Mijn-omgevingen" of via e-mail. Ook rekeningen kunnen vaak steeds makkelijker worden betaald met bijvoorbeeld iDEAL of per incasso.

Bedrijven informeren u verder

U hoeft bedrijven niet zelf op de hoogte te brengen. Dat hebben wij al voor u gedaan. De bedrijven waar u FiNBOX-documenten van krijgt, informeren u in de loop van dit jaar verder over hoe u voortaan uw financiële post ontvangt.

Uw FiNBOX-documenten bewaren

Wilt u FiNBOX-documenten bewaren voor uw eigen administratie? Geen probleem. Tot 1 januari 2016 kunt u uw documenten gewoon nog uitprinten of opslaan op uw computer, usb-stick of Cloud-opslagdienst.

Wat begon als 'digitale nota' was een goed systeem om nog wat controle te houden op hoeveel geld er naar wie de deur uit ging (wat niet kan met incasso) en ook wanneer dat zou gaan gebeuren (wat niet kan met ideal betaling).

Tegelijkertijd kwamen de bijbehorende documenten ook goed beschikbaar (al maakte digitale nota / finbox daar te weinig reclame voor). De laatste jaren had ik de beschikking gemeentebelastingen keurig als PDF in finbox nadat de gemeente Utrecht was gestart met digitale nota voor de gemeentebelastingen.

Alleen leken banken en bedrijven het niet echt te willen, er werd nooit reclame voor gemaakt. Toen we nog kabeltelevisie hadden van Ziggo moesten we daar met veel moeite uittrekken dat het ook via digitale nota betaald kon worden, en duurde het nog wat maanden voordat de toeslag voor het betalen met acceptgiro verdween van de digitale nota. En vervolgens beweerde Ziggo begin dit jaar dat de aanmelding bij FinBOX niet helemaal correct was en dat ze er dus helaas mee moesten stoppen maar toen waren we toch al bezig Ziggo op te zeggen dus dat was gewoon een extra reden.

For the joint experiment in amateur satellites last Saturday I added a second monitor to the PC so I could watch the gqrx waterfall and the fldigi waterfall at the same time. And on Sunday I noticed some weird new interference around 14.070 MHz which made decoding the PSK31 signals a lot harder. The new VGA cable near the radio was a suspect and indeed after removing it completely the problem went away again.

So if I want a working dual-screen setup, I'll have to find better video cables. Maybe DVI gives less interference. It was nice to have fldigi running PSK31 on one screen and do other things on the other screen.

The upside was that with the current versions of Linux video driver I had to do zero fiddling to make the setup work dual-screen.

December last year I noticed IPv6 at the Surfnet office breaking in interesting ways. Recently I was invited to come over and test it again, news was that the problem I was seeing should be fixed now. I accepted that invitation and Yesterday I was at the new office and tested it. And indeed it now works good, I received a stable IPv6 assignment and I was able to keep long-running IPv6 sessions to multiple systems at home. The technical reasons behind it are 'interesting' but the good news is that the eduroamers network now has stable IPv6.

I recently built and tested a new lightweight HF antenna. It's an endfed for the 10, 20 and 40 meters amateur bands (28 MHz, 14 MHz and 7 MHz). With my current Novice license I don't have a lot of access to the 40 meter amateur band, only 7.050 MHz to 7.100 MHz. But during testing station DL65DARC was active and heard my reply and confirmed it via eQSL.

I had earlier contacts on 40 meter (while testing the same antenna) but this is the first confirmed one.

Recently a number of satellites was launched including some cubesats with amateur radio functions. One of the interesting ones is ParkinsonSat named after Bradkin Parkinson who is famous for his contributions to the GPS system.

PSAT has a very interesting transponder: uplink at 28.120 USB psk31 and downlink at 435.350 MHz FM with telemetry in PSK31 included. PSK31 has a very narrow bandwith at 31 Hz, so the entire downlink signal can include 30 distinct PSK31 signals.

With my setup I can transmit to the satellite on HF or try to recieve it with the arrow antenna, but actually making a QSO through it without a rotor to aim the antenna sounds impossible to me. But, there is enough to experiment with.

Sending outgoing QSL cards also results in incoming cards:

I also received nice QSL cards

Finally some time to write outgoing QSL cards. 32 of them. Maybe I need to start ordering them, this was after I printed and cut a 'large' batch. Already all filled in and ready to get to the QSL bureau.

Outgoing QSL cards

The downside of ordering printed QSL cards is that custom starts at 1000 cards. And I know I want to start working on getting my full license (which will change my callsign) later this year so I don't think I will have 1000 QSOs that will result in cards (most don't, it's when the person at the other side requests one or I would appreciate one in return).

I saw the EU-PSK-DX contest coming up in the PG7V contest calendar and decided to try. My results are nice for a beginning novice with background noise:

Total number of QSOs in your log is 41, Including 0 QSO with errors, Valid QSOs 41

Band  QSOs Dupes Points Mults
160      0     0      0     0
80       0     0      0     0
40       0     0      0     0
20      41     0     84    50
15       0     0      0     0
10       0     0      0     0
======================================
Total   41     0     84    50

Claimed score is 4200 points. I selected the SINGLE-OP 20M HIGH category. When I look at the EU-PSK-DX contest 2014 results I didn't do too bad for 25 watt power, in a noisy (residential) area and with only about 6 hours of actual 'radio' time.

I just received a PayPal phish on an account I generated to access www.409shop.com but never managed to order something, so I guess they had a databreach.

Recently I noticed serious interference very visible on 14.070 MHz. Where it annoyed me a lot since that is the regular frequency for 20 meter PSK31 where I make most of my contacts at the moment. I also saw some interference at 28.120 MHz, the PSK31 frequency in the 10 meter band.

The noise in the fldigi waterfall, click for the full fldigi screen.

The interference showed as steady carriers about 58 Hz apart and sounded like a serious buzzing noise. The first conclusion was that one of the over the horizon radars decided to drop on that part of the 20 meter band.

But later on the interference stayed at exact the same frequency. And active over the horizon radar is also quite visible on the Utwente websdr as I noted before when I noticed interesting interference in the 10 meter amateur band. This specific interference wasn't visible there.

So I kept searching locally for the source. I was afraid a nearby neighbour was using a new interfering CFL or power supply which would make it hard to diagnose and fix.

My own equipment was also a serious suspect. One piece of hardware that recently changed near the antenna was the monitor for the server. The monitor changed from an old CRT to a less-old LCD screen. The power supply wasn't the culprit, but searching further it turned out the video signal to the monitor was! And then I saw what else changed: after upgrading the homeserver to Ubuntu 10.04 and upgrading the homeserver to Ubuntu 12.04 it started coming up in framebuffer mode. Which has a different video frequency from the 80x50 textmode I used earlier.

The problem goes away completely when I unplug the video cable from the computer. I had an extension cable without ferrite cores because an earlier monitor needed the extra length. Removing the extension cable makes the level of interference drop a lot but it's not away completely. So the solution is to unplug the monitor cable from the computer.

Then things are back to the 'normal' noise level on 20 meters and 10 meters. It's still a city environment.

Op sommige repeaters hoor ik mensen wel eens roepen dat ze "'m aan het haakje gaan hangen" als ze willen stoppen met meepraten. Dat verwijst naar het haakje of clipje waaraan de handmicrofoon opgehangen kan worden.

Ik had van een stukje koperdraad een simpel haakje gebogen maar dat was niet echt handig en viel wel eens van de plank af. Dus toch maar eens uitgekeken naar een echt goed beugeltje. Op de beurs in Rosmalen kon ik geen aanbieder vinden. On-line even gekeken en terecht gekomen bij Microphone Hang Up Clip for KMC-30,KMC-32,KMC-35,KMC-36 en nu kan ik 'm dus ook aan het haakje hangen!

Het is een hele nette microfoonhouder, die ook in een auto of boot zou werken, er zit een veer achter die de microfoon vasthoudt.

Sinds begin februari zit er een neergaande lijn in de VDSL downstream snelheid. Nu de haalbare snelheid gelijk is geworden aan de ingeregelde snelheid (23008 kbits) is de daling gestopt, maar ik denk eerder dat dan vanaf nu het aantal fouten kan toenemen tot er een langzamer profiel gekozen wordt. Of er moet weer verbetering komen.

I noticed the recent upgrades left some PHP scripts non-working. The default is now to disable PHP in userdirs, via:

    # To re-enable php in user directories comment the following lines
    # (from  to .) Do NOT set it to On as it
    # prevents .htaccess files from disabling it.
    <IfModule mod_userdir.c>
        <Directory /home/*/public_html>
            php_admin_value engine Off
        </Directory>
    </IfModule>

I decided I want some PHP in userdirs, but while I was working on this configuration I want to turn the default around: disable the PHP engine in the global configuration and only enable it on those sites where I need it for the site. So now /etc/php5/apache2/php.ini has:

; Enable the PHP scripting language engine under Apache.
engine = Off

And some sites that need it have in the VirtualHost config:

# enable php
    php_flag engine 1
    <FilesMatch "\.ph(p3?|tml)$">
        SetHandler application/x-httpd-php
    </FilesMatch>

Volgens Radio en TV zenders Nederland zijn de regionale DAB+ multiplexen gestart op 6B Oost/Noord Nederland, 7A Zuid Nederland, 9D Noordwest Nederland en 9D Zuidwest Nederland. De multiplex op 8A Zuid-Holland, westelijk deel Utrecht en zuidelijk deel Noord-Holland zal starten per 1 september.

Ik was natuurlijk benieuwd of Oost/Noord Nederland het tot bij mij in Utrecht zou halen dus ik heb een volle scan gedaan met de Pure One Mini radio. Die kreeg ik niet, maar wel 7A Zuid Nederland met een zwak maar werkend signaal, met als eerste service die ik zag L1 Radio, de regionale omroep voor Limburg. Daarnaast ook Omroep Brabant, Omroep Gelderland en Puur NL die nog stilte geeft. Maar dus nog geen Radio M Utrecht via DAB+ hier.

De Noxon DAB USB stick had weer wat meer moeite met ontvangen en kreeg deze multiplex niet mee. Dus in de verwerkte scanlijst nog niet zichtbaar.

And to get to a version of Ubuntu with support available I kept doing and did 'do-release-upgrade' again today on the homeserver greenblatt.

Again the upgrade was running for a while. A big improvement is that the process now uses screen so I was able to attach to that running console from other sessions and answer questions.

After the upgrade the reboot came, and after the reboot I noticed resolving was broken. This was traced back to the ppp0 interface for the connection to the outside world and the internal interface for services having started completely without IPv6 support. Doing an ifdown and ifup helped, but this should all start correct automatically.

I noticed the new Postgresql 9.1 is already installed, but Postgresql 8.4 is the default version available over port 5432, so I can do the pg_upgradecluster when I have time for that.

Later I noticed some packages were held back. I traced this back to /etc/apt/preferences still being optimized for Ubuntu 8.04 hardy and hardy-backports. I emptied the preferences file and it all sorted itself out and now everything is up to date.

This was probably the reason Postgresql 8.4 was left installed and active. After the updates above apt-get autoremove was going to delete Postgresql 8.4.

This weekend was about the last weekend that I could have access to Ubuntu 10.04 LTS for upgrading my homeserver greenblatt from Ubuntu 8.04 to Ubuntu 10.04 which will run out of support this month, making it unavailable as an upgrade path. I postponed this for way too long because I expected a lot of work fixing things, especially asterisk which runs our home phone system.

The solution to asterisk was simple: I disabled it and reprogrammed a Gigaset C450IP base to deal with our VoIP provider directly. After all the upgrading is done I'll go fix things with the OpenVox ISDN card in a test machine and when all is stable again I will move things to production.

For the rest it was a matter of typing 'do-release-upgrade' and hope for the best. Reconfiguring packages took the longest and the biggest issue was that the upgrade from Postgres 8.3 to Postgres 8.4 wasn't done automatically but I had to do this myself using the hints from How tu [sic] upgrade Postgresql 8.3 database file to 8.4 - stackoverflow.

The documentation says to do this beforehand but Postgresql 8.4 isn't available before the upgrade and it took a bit of fiddling to have Postgresql 8.3 available after the upgrade. But then pg_upgradecluster ran. It complained about a few tables and the end result I noticed was that those tables were dropped out of the upgrade completely. I re-enabled Postgresql 8.3 and migrated those databases or tables using pg_dump. Not a complete smooth upgrade but I think it went ok.

After I visited the Interessedag Amateursatellieten 2015 in Apeldoorn I decided to give APRS a try again.

All received APRS data from PD4KH-7 on the way back from Apeldoorn

I tried APRS over a year ago and it works with APRSdroid on my tablet and the vox function of my radio.

On my drive back I wanted to try this again. Outside antenna on the window of the car, radio and tablet in a bag so the vox would work. I heard the familiair buzzsaw noises from the bag from time to time during the drive but the end result is one whole position report seen on the APRS network.

From the last pass of the ISS with SSTV active over my location some partial decodes, this is where qsstv has some problems. That's why the above are posted screengrabs, qsstv decided not to want to save the partial images.

This pass started at 21:15 UTC, slowscan TV was scheduled to end at 21:30 UTC.

From the pass over my location (16:27 UTC) I decoded this partial image. I also heard speaking what sounded like Russian, with for me clear "Romeo Sierra .. India Sierra Sierra" so I guess there is one lucky russian radio amateur with a confirmed contact with RS0ISS.

Recording added to this post. I am looking for a transcription and translation.

---

This evening pass (19:39 UTC) had a less good timing for me, but almost a full image decode. On the start of the pass a previous image was running but I can't make qsstv pick that up.

Image 8 of the RS0ISS series.

Another chance this weekend for receiving images from the russians aboard the International Space Station (callsign RS0ISS). I had luck again with this pass and one image came through near-perfect.

Image 2 of the RS0ISS series.

Equipment: video tripod, Arrow dual-band antenna with just the 2 meter antenna connected to the radio, FT-857 radio. Laptop controlling the radio with gpredict and recording the audio with audacity. Decoding the recorded audio with qsstv.

I am used to seeing ftp scans (single packet) or real connect attempts (three packets) in the firewall logs from time to time. But this is new, the last few days there have been repeated connection attempts (3 packets for each source port) from several different IPv4 addresses.

Apr  9 09:45:07 greenblatt kernel: [9368095.406323] FW reject: IN=ppp0 OUT= MAC= SRC=46.119.76.40 DST=xx.xx.xx.xx LEN=48 TOS=0x00 PREC=0x00 TTL=111 ID=54188 DF PROTO=TCP SPT=42284 DPT=21 WINDOW=64380 RES=0x00 SYN URGP=0
Apr  9 09:45:07 greenblatt kernel: [9368095.406636] FW reject: IN=ppp0 OUT= MAC= SRC=46.119.76.40 DST=xx.xx.xx.xx LEN=48 TOS=0x00 PREC=0x00 TTL=111 ID=54189 DF PROTO=TCP SPT=42285 DPT=21 WINDOW=64380 RES=0x00 SYN URGP=0
Apr  9 09:45:08 greenblatt kernel: [9368095.600015] FW reject: IN=ppp0 OUT= MAC= SRC=46.119.76.40 DST=xx.xx.xx.xx LEN=48 TOS=0x00 PREC=0x00 TTL=111 ID=54206 DF PROTO=TCP SPT=42284 DPT=21 WINDOW=64380 RES=0x00 SYN URGP=0
Apr  9 09:45:08 greenblatt kernel: [9368095.600329] FW reject: IN=ppp0 OUT= MAC= SRC=46.119.76.40 DST=xx.xx.xx.xx LEN=48 TOS=0x00 PREC=0x00 TTL=111 ID=54207 DF PROTO=TCP SPT=42285 DPT=21 WINDOW=64380 RES=0x00 SYN URGP=0
Apr  9 09:45:08 greenblatt kernel: [9368095.800311] FW reject: IN=ppp0 OUT= MAC= SRC=46.119.76.40 DST=xx.xx.xx.xx LEN=48 TOS=0x00 PREC=0x00 TTL=111 ID=54209 DF PROTO=TCP SPT=42284 DPT=21 WINDOW=64380 RES=0x00 SYN URGP=0
Apr  9 09:45:08 greenblatt kernel: [9368095.834389] FW reject: IN=ppp0 OUT= MAC= SRC=46.119.76.40 DST=xx.xx.xx.xx LEN=48 TOS=0x00 PREC=0x00 TTL=111 ID=54216 DF PROTO=TCP SPT=42298 DPT=21 WINDOW=64380 RES=0x00 SYN URGP=0

Apr  9 15:19:31 greenblatt kernel: [9376229.358588] FW dropped: IN=ppp0 OUT= MAC= SRC=46.119.76.40 DST=xx.xx.xx.xx LEN=48 TOS=0x00 PREC=0x00 TTL=111 ID=21161 DF PROTO=TCP SPT=13089 DPT=21 WINDOW=64380 RES=0x00 SYN URGP=0
Apr  9 15:19:34 greenblatt kernel: [9376230.559851] FW dropped: IN=ppp0 OUT= MAC= SRC=46.119.76.40 DST=xx.xx.xx.xx LEN=48 TOS=0x00 PREC=0x00 TTL=111 ID=21180 DF PROTO=TCP SPT=13089 DPT=21 WINDOW=64380 RES=0x00 SYN URGP=0
Apr  9 15:19:40 greenblatt kernel: [9376232.980904] FW dropped: IN=ppp0 OUT= MAC= SRC=46.119.76.40 DST=xx.xx.xx.xx LEN=48 TOS=0x00 PREC=0x00 TTL=111 ID=21224 DF PROTO=TCP SPT=13089 DPT=21 WINDOW=64380 RES=0x00 SYN URGP=0

Apr 10 08:21:04 greenblatt kernel: [9402534.350429] FW reject: IN=ppp0 OUT= MAC= SRC=117.204.35.104 DST=xx.xx.xx.xx LEN=52 TOS=0x00 PREC=0x00 TTL=112 ID=9124 DF PROTO=TCP SPT=10002 DPT=21 WINDOW=65535 RES=0x00 SYN URGP=0
Apr 10 08:21:04 greenblatt kernel: [9402534.653582] FW reject: IN=ppp0 OUT= MAC= SRC=117.204.35.104 DST=xx.xx.xx.xx LEN=52 TOS=0x00 PREC=0x00 TTL=112 ID=9273 DF PROTO=TCP SPT=10002 DPT=21 WINDOW=65535 RES=0x00 SYN URGP=0
Apr 10 08:21:05 greenblatt kernel: [9402535.002381] FW reject: IN=ppp0 OUT= MAC= SRC=117.204.35.104 DST=xx.xx.xx.xx LEN=52 TOS=0x00 PREC=0x00 TTL=112 ID=9320 DF PROTO=TCP SPT=10002 DPT=21 WINDOW=65535 RES=0x00 SYN URGP=0
Apr 10 08:22:25 greenblatt kernel: [9402566.855279] FW reject: IN=ppp0 OUT= MAC= SRC=117.204.35.104 DST=xx.xx.xx.xx LEN=52 TOS=0x00 PREC=0x00 TTL=112 ID=12941 DF PROTO=TCP SPT=10436 DPT=21 WINDOW=65535 RES=0x00 SYN URGP=0
Apr 10 08:24:00 greenblatt kernel: [9402604.705345] FW reject: IN=ppp0 OUT= MAC= SRC=117.204.35.104 DST=xx.xx.xx.xx LEN=52 TOS=0x00 PREC=0x00 TTL=112 ID=16545 DF PROTO=TCP SPT=10882 DPT=21 WINDOW=65535 RES=0x00 SYN URGP=0
Apr 10 08:25:45 greenblatt kernel: [9402646.825970] FW reject: IN=ppp0 OUT= MAC= SRC=117.204.35.104 DST=xx.xx.xx.xx LEN=52 TOS=0x00 PREC=0x00 TTL=112 ID=21008 DF PROTO=TCP SPT=11378 DPT=21 WINDOW=65535 RES=0x00 SYN URGP=0

Apr 10 09:35:50 greenblatt kernel: [9404337.065473] FW reject: IN=ppp0 OUT= MAC= SRC=117.204.35.104 DST=xx.xx.xx.xx LEN=52 TOS=0x00 PREC=0x00 TTL=112 ID=1738 DF PROTO=TCP SPT=11259 DPT=21 WINDOW=65535 RES=0x00 SYN URGP=0
Apr 10 09:35:51 greenblatt kernel: [9404337.387287] FW reject: IN=ppp0 OUT= MAC= SRC=117.204.35.104 DST=xx.xx.xx.xx LEN=52 TOS=0x00 PREC=0x00 TTL=112 ID=1859 DF PROTO=TCP SPT=11262 DPT=21 WINDOW=65535 RES=0x00 SYN URGP=0
Apr 10 09:35:52 greenblatt kernel: [9404337.748446] FW reject: IN=ppp0 OUT= MAC= SRC=117.204.35.104 DST=xx.xx.xx.xx LEN=52 TOS=0x00 PREC=0x00 TTL=112 ID=1964 DF PROTO=TCP SPT=11267 DPT=21 WINDOW=65535 RES=0x00 SYN URGP=0

All firewalled safely, there is no ftp service configured.

A new attack?

I noticed some of the websdr online receivers were only offering html5 audio and html5 waterfall display. The waterfall display started working ok in recent firefox for linux but the audio always remained silent. Until I checked and checked again and the solution seemed to be 'check audio settings'. And I found the 'AudioCallbackDriver' from application 'CubebUtils' with a firefox icon in pavucontrol (PulseAudio volume control) which was set to output level 0 (silence). Changing that to a more reasonable volume helped a lot!

Now I don't need java applets in my browser to use the different websdr servers.

I had this Friday al to myself and decided to try some amateur radio out in the field using the new longwire antenna I recently bought.

I was pondering taking the recumbent bicycle first but the outside temperature in the morning of 5 ⁰C made me chose the car which would give me a warmer shelter to sit in. I drove to a nearby outside recreation area (De Leyen near Groenekan) and there I was shielded from the wind so I could sit outside. I decided to set up the radio on a park bench near a tree.

During the setup someone did ask me what I was doing and I explained about amateur radio. That person asked whether that wasn't normally done from a room in the attic and I explained that being away from radio noise source would be an interesting experiment. This explanation seemed to answer that person's interest.

I used some nylon rope to hang one end of my longwire antenna up in a tree and anchor the other end at the base of another tree. A filled plastic water bottle makes a nice smooth weight to throw a rope over a high branch of a tree. The antenna was sloped downwards in southern direction.

I saw T6T active on 10 meter PSK31 this afternoon, fading in and out. And quite popular with other stations, Afghanistan is a rare country to see active on amateur radio. But one go he saw my reply and we managed to have a short contact. Right after the contact he faded away completely again!

A growing part of the 'Internet background noise' that my server is receiving seems to be tcp syn packets from faked source addresses. I mentioned this before in Am I part of an interesting attack?. Looking at the traffic with p0f shows that the source addresses (and ports!) are constant but the operating system and the time to live changes so these probably come from multiple hijacked systems:

174.128.225.126:57282 - Windows XP/2000 (RFC1323+, w+, tstamp-) [GENERIC]
  Signature: [8192:93:1:52:M1460,N,W8,N,N,S:.:Windows:?]
  -> xx.xx.xx.xx:80 (distance 35, link: ethernet/modem)
174.128.225.126:57282 - UNKNOWN [8192:87:1:52:M1460,N,W8,N,N,S:.:?:?]
  -> xx.xx.xx.xx:80 (link: ethernet/modem)
174.128.225.126:57282 - UNKNOWN [8192:85:1:52:M1460,N,W8,N,N,S:.:?:?]
  -> xx.xx.xx.xx:80 (link: ethernet/modem)
174.128.225.126:57282 - Windows XP/2000 (RFC1323+, w+, tstamp-) [GENERIC]
  Signature: [8192:98:1:52:M1460,N,W8,N,N,S:.:Windows:?]
  -> xx.xx.xx.xx:80 (distance 30, link: ethernet/modem)
174.128.225.126:57282 - UNKNOWN [8192:81:1:52:M1460,N,W8,N,N,S:.:?:?]
  -> xx.xx.xx.xx:80 (link: ethernet/modem)
174.128.225.126:57282 - Windows XP/2000 (RFC1323+, w+, tstamp-) [GENERIC]
  Signature: [8192:116:1:52:M1460,N,W8,N,N,S:.:Windows:?]
  -> xx.xx.xx.xx:80 (distance 12, link: ethernet/modem)
174.128.225.126:57282 - Windows XP/2000 (RFC1323+, w+, tstamp-) [GENERIC]
  Signature: [8192:102:1:52:M1460,N,W8,N,N,S:.:Windows:?]
  -> xx.xx.xx.xx:80 (distance 26, link: ethernet/modem)

I recently had the main PC that is connected to the amateur radio crash regularly when I was active on the 20 meter amateur band (14.000 - 14.250 MHz) which is at the moment the most interesting band for me. This PC is thompson, a Dell OptiPlex 745. This led to serious annoyances as cqrlog, the logging program I use depends on MySQL which handles crashes badly. I got very good at recovering the database and reinstalling cqrlog.

I thought it was time for a new PC but in the mean time I was dismantling some other old PC's and found an Intel E-1000 gigabit network card. Since the network switch thompson is connected to always showed strange activity after the PC had crashed I wondered if the on-board network card of the PC was the main cause. So I disabled the on-board network interface and installed the Intel E-1000 card.

So far the PC hasn't crashed since installing the card. I have been active on the radio two evenings since the installation.

Update 2015-04-06: A few crashes have happened since but not as many as happened when I got really annoyed.

I was reading the Electron magazine of the Veron radio club and it had a mention of rising costs of QSL forwarding. The article asked radio amateurs to clearly publish their QSL policy so other amateurs don't send cards when they don't want them.

My own policy is that I like receiving QSL cards so I'll send them out myself to amateurs that appreciate them. But a confirmation via eQSL is also good. In digimodes eQSL is quite popular so I already gathered a collection of incoming eQSL cards.

So I updated the PD4KH amateur radio and PD4KH profile on qrz.com with my QSL policy. I suggest others do this too.

On Camp Wireless and The Virtual Bookcase I see the following pattern in the access logs:

2620:108:700f::36bc:aade - - [27/Mar/2015:13:27:11 +0100] "GET / HTTP/1.1" 302 298 "-" "curl/7.36.0"
2406:da00:ff00::36e2:d963 - - [27/Mar/2015:13:27:38 +0100] "GET / HTTP/1.1" 302 298 "-" "curl/7.36.0"

Constant requests, 2 or 3 per minute from Amazon EC2 IPv6 addresses just requesting the / using curl. Over the day I now see 1334 unique addresses with at most 5 requests from one url.

The same pattern as described in Stange stream of HTTP GET requests in apache logs, from amazon ec2 instances - Server Fault with no real answer to the why.

It's not a problematic amount of traffic, I'd just like to understand what is happenning!

Confirmation of contact with A71AE

Last evening I saw A71AE active on 20 meter PSK63. After he worked a number of other station I answered his CQ and we had a short but good contact. And I already have it confirmed via eQSL.

The main thing I shopped for when I visited the Landelijke Radio Vlooienmarkt was a simple antenna for 10/20/40 to use while camping. To get the most out of not too much space I decided to mainly look for an endfed antenna. This is a simple wire with a transformer at the end. Not the perfect antenna, but a compromise between size, performance and ease of deployment.

Browsing the offerings I found an LW-10 antenna which covers 40 to 6 meter (7 to 50 MHz) and was sold to me by the nice people of www.cbradio.co.uk. I wanted to test it at home and last evening I had the chance.

From the spambox:

How are you doing today, I am miracle 24 yearls old girl, i saw your profile today at googlesearch cpan.cse.msu.edu - i like it, then i decided to contact you for going into deep rellastionship between me and you

I know CPAN is a lot, but I never saw it as a dating site.

Recent gaf google me allemaal meldingen dat mijn websites niet goed zouden werken op mobiele apparaten (telefoons, tablets). Het gevolg is dan dat google bij zoeken vanaf mobiele apparaten de sites ook minder aantrekkelijk zou vinden.

Mijn eerste gedachte was dat dat me niet zoveel uitmaakt omdat de gemiddelde bezoeker van mijn sites wel vanaf een desktop of laptop PC komt. Maar aan de andere kant doe ik simpele dingen ook vaker vanaf een tablet tegenwoordig en zag in ieder geval mijn homepage er daarop niet uit. En sites als Camp Wireless hebben zeker een mobiel publiek.

Alleen liep mijn kennis wat achter. De laatste keer dat ik serieus keek naar sites voor mobiele devices was toen WAP de oplossing was. Dus maar eens de informatiepagina's gelezen die google aangaf, over viewport gebruik en media queries voor CSS.

Voor de meeste sites is het een simpele CSS aanpassing om een en ander mogelijk te maken. Onder een bepaalde breedte hebben de 2 kolommen die ik vaak gebruik niet zoveel zin. Dus met de media query dit opgelost. Nu langzaam maar zeker sites aanpassen. En van sommige sites moeten echt dingen aangepast worden (juist camp-wireless..) omdat daar nog deels verouderde technieken gebruikt worden die aanpassingen voor mobiel moeilijk maken.

First I have to describe to 'other' visitors of my pages what a DXpedition is: operating radio from a remote location which is on the wish-list of many radio amateurs who want to make contacts with as much countries/locations as possible. Radio amateurs will visit such a place and set up antennas and radios to make those contacts possible.

I just finished reading the VK0IR DXpedition book. It's a great description of the Heard Island DXpedition in 1997. Just 18 years ago, but a lot has changed. Supporting a major amateur radio event via the Internet/World wide web was a new thing back then. Nowadays, not doing that would be unthinkable.

And, the Heard Island 2015 DXpedition is being planned! I usually avoid making contact with DXpeditions because it's just trying to get through a wall of radio amateurs trying to make that contact (what radio amateurs call a "pile-up") but it can be done, so I may try to get this one.

Morgen is het tijd voor de 40e Landelijke Radio Vlooienmarkt in het Autotron in Rosmalen. Ik ga er weer van harte heen!

A new distance record in HF for me this evening: I had a PSK31 contact with someone 5 kilometers away!

My other current distance record is an RTTY contact to the island of Aruba at a distance of 7908 kilometers.

Noticable traffic:

13:06:15.787470 IP (tos 0x0, ttl 110, id 27178, offset 0, flags [DF], proto TCP (6), length 52) 148.251.47.107.80 > xx.xx.xx.xx.53: S, cksum 0x48c7 (correct), 2310054019:2310054019(0) win 8192 <mss 1460,nop,wscale 8,nop,nop,sackOK>
13:06:16.188187 IP (tos 0x0, ttl 92, id 14152, offset 0, flags [DF], proto TCP (6), length 52) 148.251.47.107.80 > xx.xx.xx.xx.53: S, cksum 0x2c3a (correct), 1627317698:1627317698(0) win 8192 <mss 1460,nop,wscale 8,nop,nop,sackOK>
13:06:16.588698 IP (tos 0x0, ttl 96, id 64188, offset 0, flags [DF], proto TCP (6), length 52) 148.251.47.107.80 > xx.xx.xx.xx.53: S, cksum 0x6e9f (correct), 249296256:249296256(0) win 8192 <mss 1460,nop,wscale 8,nop,nop,sackOK>
13:06:16.989469 IP (tos 0x0, ttl 97, id 54770, offset 0, flags [DF], proto TCP (6), length 52) 148.251.47.107.80 > xx.xx.xx.xx.53: S, cksum 0xa3fc (correct), 3532061815:3532061815(0) win 8192 <mss 1460,nop,wscale 8,nop,nop,sackOK>
13:06:17.390192 IP (tos 0x0, ttl 92, id 5400, offset 0, flags [DF], proto TCP (6), length 52) 148.251.47.107.80 > xx.xx.xx.xx.53: S, cksum 0xaae9 (correct), 1786797457:1786797457(0) win 8192 <mss 1460,nop,wscale 8,nop,nop,sackOK>
13:06:17.792734 IP (tos 0x0, ttl 81, id 42621, offset 0, flags [DF], proto TCP (6), length 52) 148.251.47.107.80 > xx.xx.xx.xx.53: S, cksum 0x925d (correct), 3619031271:3619031271(0) win 8192 <mss 1460,nop,wscale 8,nop,nop,sackOK>
13:06:18.193910 IP (tos 0x0, ttl 81, id 6384, offset 0, flags [DF], proto TCP (6), length 52) 148.251.47.107.80 > xx.xx.xx.xx.53: S, cksum 0x5712 (correct), 841083335:841083335(0) win 8192 <mss 1460,nop,wscale 8,nop,nop,sackOK>

The variation in ttl values suggests a distributed denial of service attack trying to make me part of it.

I still had a clothesline with metal core cut in four pieces tuned for 10 and 20 meters laying ready to put in the attic, to replace the UTP network wire.

New dipole antenna from clothesline, tuned for 10 and 20 meter bands

This evening I found some time to replace the wires and test the results. In the 10 and 20 meter PSK31 frequencies the SWR is now good (if I remember correctly from the antenna analyzer it's around 1:1.2), the SWR meter on the radio doesn't leave the corner anymore. This also means the voice frequencies on 20 meter are now available for me!

Nieuws over de aanbestedingen voor de regionale DAB+ netten in Nederland: gunning regionaal netwerk Kop van Noord-Holland en Friesland aan Broadcast Partners, gunning regionaal netwerk Noord en Oost Nederland aan Broadcast Partners, gunning regionaal netwerk Randstad aan Broadcast Partners.

Minstens 2 van deze 3 moeten hier straks prima te ontvangen zijn. Opvallend is dat in zowel Noord en Oost Nederland (straks op VHF III kanaal 6B) als in Randstad (straks op VHF III kanaal 8A) Radio M Utrecht komt. Ik neem aan dat mijn radio de duplicaat zal herkennen en maar een keer Radio M Utrecht in de lijst services zal opnemen.

Gevonden via radio/tv Nederland

Where the Real Skyscrapers Are (Hint: North Dakota) - medium.com
A general article about tall (larger than 2000 feet or 609 meter) TV towers in the USA with a mention of their history and future. A mix of very flat countryside with relatively low population densities makes these very high towers interesting in some areas.

Ik had de verwachting dat het eindresultaat van de kast die in de buurt geplaatst is voor KPN Telecom zou zijn dat er sneller VDSL mogelijk zou zijn voor ons. Maar op diverse plekken bleef de maximaal haalbare snelheid voor ons adres steeds hetzelfde. Dus toch maar eens met xs4all gebeld, en ook die geven geen mogelijke vooruitgang aan voor onze VDSL snelheid. Jammer!

Currently our Samsung 'smart' TV is convinced the Internet is broken and refuses to start any of the applications. According to some network protocol sniffing the TV decides this purely based on a DNS query for www.samsung.com which takes an interesting CNAME tour. According to what I can find this hasn't changed when the smart TV stopped working so this must be something in the software in the TV itself.

; <<>> DiG 9.4.2-P2.1 <<>> www.samsung.com a
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 39167
;; flags: qr rd ra; QUERY: 1, ANSWER: 6, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;www.samsung.com.               IN      A

;; ANSWER SECTION:
www.samsung.com.        253     IN      CNAME   www.samsung.com.edgekey.net.
www.samsung.com.edgekey.net. 3171 IN    CNAME   www.samsung.com.akadns.net.
www.samsung.com.akadns.net. 253 IN      CNAME   china-www.samsung.com.edgekey.net.
china-www.samsung.com.edgekey.net. 2765 IN CNAME china-www.samsung.com.edgekey.net.globalredir.akadns.net.
china-www.samsung.com.edgekey.net.globalredir.akadns.net. 853 IN CNAME e1722.g.akamaiedge.net.
e1722.g.akamaiedge.net. 14      IN      A       23.206.87.52

;; Query time: 0 msec
;; SERVER: 2001:980:14ca:42::18#53(2001:980:14ca:42::18)
;; WHEN: Wed Feb 25 20:20:34 2015
;; MSG SIZE  rcvd: 244

Online there are some similar messages: Smart TV mayhem for Sony and Samsung users after central servers go down, Internet-Ausfall bei Samsung Smart-TV

Update:
According to some reports the fix is simple: Users fix Samsung Smart TV down time themselves – Two workarounds known which both hardcode an Akamai IP for www.samsung.com and skip the CNAME chain. Remember when DNS manuals told you CNAME chains were a bad idea? They still are, I guess. I implemented the fix locally with pdns-recursor and the export-etc-hosts option which allows me to serve an A record for www.samsung.com (the IP I get from the CNAME chain). And indeed, the smart TV applications work again.

I dug up all the tools needed to test the isdn setup in the test server: an old sitecom ISDN card with HFC-S chipset, an ISDN cross cable, a fritzbox with external S0 bus and an analog phone set.

It took me a while to get all 3 channels in the ISDN card active in Asterisk, I 'missed' the fact that the oslec echo canceller wasn't loaded due to a module versioning problem. At first it showed:

root@metcalfe:~# lsdahdi
### Span  1: DAHDI_DUMMY/1 "DAHDI_DUMMY/1 (source: HRtimer) 1" (MASTER)
### Span  2: ZTHFC1 "HFC-S PCI A ISDN card 0 [NT] " AMI/CCS
  1 BRI        Clear       (In use)
  2 BRI
  3 BRI

The switch from oslec to mg2 fixed things:

root@metcalfe:~# lsdahdi
### Span  1: ZTHFC1 "HFC-S PCI A ISDN card 0 [NT] " AMI/CCS
  1 BRI        Clear       (In use) (EC: MG2 - INACTIVE)
  2 BRI        Clear       (In use) (EC: MG2 - INACTIVE)
  3 BRI        Hardware-assisted HDLC  (In use)
### Span  2: DAHDI_DUMMY/1 "DAHDI_DUMMY/1 (source: HRtimer) 1" (MASTER)

But whatever I tried: no dialtone. Time to also hook up a SIP phone to initiate calls the other way.

As part of a needed upgrade on my homeserver I will also have to deal with Apache 2.4 and the changes needed there. Because some other things will change completely like asterisk I used an old server with comparable packages to do the same upgrades and test the results.

As keen visitors to my page may have noticed I am interested in the performance. This test-setup also gives me room to experiment with some possible new methods. I have to establish a baseline on that server first since it has different hardware.

Some radio amateurs complain that there seems to be a contest every weekend. And they may have a point: yesterday I found the digimode users 'all' busy with the Russian WW PSK contest so I checked the website, adjusted the macros and joined the fun. Other activities at home also had to be done but I managed to make a total of 38 contacts on the 10 and 20 meter bands during this contest. Given the fact that I made a number of contacts on both bands I entered my log in the single-operator multi-band category.

I saw nobody from the US in this contest, mostly Russian, Eastern European and a few Dutch callsigns. Given the high serial numbers I saw fly by I will not be a winner of anything, but it was nice to participate.

My claimed score is 2398 points with 37 QSO's, 109 points and a multiplier of 22. Check the Russian WW PSK contest site for the explanation of all those.

Somebody dug up some 'hacking VMS' howto files I guess:

Feb 17 21:53:25 greenblatt sshd[8483]: Invalid user OPERATOR from 201.48.89.105
Feb 17 22:00:43 greenblatt sshd[9138]: Invalid user RSBCMON from 117.239.42.90
Feb 17 22:09:54 greenblatt sshd[9962]: Invalid user FIELD from 189.56.109.19
Feb 17 22:18:39 greenblatt sshd[10837]: Invalid user MANAGER from 203.76.136.147
Feb 17 22:35:21 greenblatt sshd[12290]: Invalid user SYSDBA from 117.253.182.184

Some of the old 'default accounts' from way back! HACKING VAX'S VMS. at textfiles.com

I had to have a look at Receiving RDS with the RTL-SDR - Absorptions and indeed it works. Tuning to NPO 3FM:

8203  0A TP:0 PTY:10 TA:1 MS:M AF:89.9MHz AF:90.9MHz PS:'NPO 3FM '
8203  0A TP:0 PTY:10 TA:1 MS:M AF:96.2MHz AF:96.5MHz PS:'NPO 3FM '
8203  2A TP:0 PTY:10 RT:'BNN: Dit is Domien↵                                             ' RT_OK
8203 14A TP:0 PTY:10 ON:8204[TP:0 PS:'NPO     ']
8203 14A TP:0 PTY:10 ON:8204[TP:0 PS:'NPO     ']

Found via Receiving RDS with RTL-SDR - Software radio on Google+

I recently learned that more than one Android mobile phone with NFC support has the same Unique ID: 01020304 (hex). If you want to use RFID tokens for authentication for certain tasks and let users bring their own tokens you need to block this specific not so unique ID.

Together with the fact that there are cards on the market where you can change the UID this means depending on an RFID UID only for authentication needs a serious risk assessment. But gaining access to more information on an ISO/IEC 14443 RFID device means that you either have to set the rules for the card (and probably pay for it) or make a rule for every type of card you find and still have issues.

Sunday I noticed a distinct lack of replies to my calls in PSK31 mode on the standard places in the 10 and 20 meter amateur bands. So I spun the dial and noticed a lot of RTTY traffic. This turned out to be the CQ WPX RTTY contest. So I answered a number of CQ TEST calls and exchanged the stunning number of 13 QSOs.

The fun part is that this is a way to make contacts in new places. Normally I don't get through to the US or Canada easily but now I made several contacts there. And I had contacts in Cyprus and Aruba. Now to see which ones I can get confirmed.

One new and puzzling thing to me was receiving EYR as a serial. This confused me but the other side was quite convinced it was a valid serial. But the logrobot for the contest did not accept it so I googled and found out in RTTY numbers can be written as letters. The simple way is to look at a US keyboard for transposing: 1=Q, 2=W, 3=E, 4=R, 5=T, 6=Y, 7=U, 8=I, 9=O, 0=P. So EYR translates to 364.

Another chance to receive slow-scan TV images from the Russian crew on board of the ISS (callsign RS0ISS): they will transmit SSTV images in the weekend of 21-23 february. According to the announcement More ISS Slow Scan TV Activity - Amsat-UK the images will be from the set of 12 pictures celebrating space pioneer Yuri Gagarin.

Update 2015-02-20: It seems this event may be postponed: extra vehicular activities (spacewalks) have been scheduled for this weekend and amateur radio transmissions are completely shutdown when persons are outside.

We realiseerden ons al een tijdje dat we tegenwoordig op de TV voornamenlijk uitzending gemist, Netflix, mediaspeler en NPO 1/2/3 kijken. Toen Ziggo dan ook recent kwam met een kleine prijsverhoging met de mogelijkheid om direct op te zeggen was de keuze wel duidelijk. Deze week moest ook nog eens het hele aanbod op de DVB-C ontvanger opnieuw ingeladen worden vanwege de veranderingen in het Ziggo netwerk dus we hebben dat moment gepakt om een simpel UHF sprietje in de TV te steken en die een DVB-T service scan te laten doen. Prima ontvangst van NPO 1/2/3. Dat is een voordeel van zo dicht bij diverse DVB-T zenders wonen.

Opzeggen bij Ziggo kan alleen telefonisch maar de wachttijd viel enorm mee en de prijsverhoging noemen gaf vlotte afhandeling van de opzegging.

Image received from ISS slow scan tv at location JO22NC 2015-01-31 starting 20:47

This chance of receiving images from ISS I took it and tried to recieve one. Not everything worked as planned: recording the audio while receiving the image with qsstv failed, someone tried to transmit on the downlink frequency to contact the ISS and the image is slanted which probably means I need to calibrate qsstv and/or the soundcard.

But, it worked! An image from the international space station!

And sometimes world news gets into my amateur radio contacts, even when both sides don't really want that:

Pse QSL via LoTW,eQSLc .. please no bureau now. War here

This was in a contact with a radio amateur operator in the Donetsk region in Ukraine.

I had the radio and computer running checking for PSK31 signals at 28.120 MHz, the standard frequency for PSK31 in the 10 meter band. Suddenly I saw lots of carriers 5 Hz apart and very precise. I checked the websdr in twente and saw the same signal.

So I tried to make a screengrab of it and it went away. To show up at 27.120 MHz exactly the same and annoying some 27 MHz CB users.

I'm not sure what it was, my first guess was over the horizon radar which is 'famous' for interfering on HF amateur bands. Moving 1 MHz down when the HF propagation maximum frequency is dropping is also a sign of something like over the horizon radar.

I updated my PGP key and the page describing my use of PGP so it is easier to find the right key when e-mailing me feedback about any page on my site.

It is clear PGP is needed for any serious on-line private communications. Please use it as much as possible.

Recently I found out I wanted the latest and greatest in some amateur radio software used on the desktop system thompson at home. So I upgraded ubuntu again. This system has run Ubuntu versions 8.04, 10.04 and 12.04, so it does show all those upgrades work!

This evening when I had time to play with the radio the HF bands I can use were already going 'silent'. But I left the setup running om 14.070 MHz in fldigi in PSK31 mode. This is the recommended standard frequency for PSK31 in the 20 meter band, so a lot of people will try there first. I saw a CQ call from EA9BO and fldigi filled in the country as Ceuta & Melilla which I did not recognize.

Map of Ceuta and Melilla, from Ceuta-melilla.png, Wikimedia Commons, Anarkangel

Which means one thing: a contact with a new country! I was able to answer his call after he had contacts with a few other stations and he got my signals and we had a short QSO. Afterwards I looked up Ceuta & Melilla which are the two autonomous Spanish cities that are within Morocco.

Again amateur radio learns me new things about geography! I already have looked up a number of interesting city names in eastern parts of Europe because of what I received as the cities of radio amateurs I had contacts with.

Oh and this is the first contact on the African continent.

I like using the Wide-band WebSDR in JO32KF to check the actual conditions on the HF bands and to see if there are interesting voice contacts possible. Today I had a look at the 10 meter amateur band but it has no propagation at the moment. But the 20 meter band is doing fine and as visible in the waterfall display it is busy. A look at the HF contestkalender van PG7V op de Veron site (Dutch) confirms this: the HA-DX contest International Radioamateur Short Wave Contest organized by the Hungarian Radioamateur Society is active this weekend.

I decided not to participate on 20m voice: the SWR of my attic dipole gets to high in the voice part, triggering the SWR warning on my transciever.

Yesterday I switched on the radio for a bit and when I responded to a PSK63 CQ I received a four-digit serial number. I assumed some contest was going on and responded with serial 1001 because some contests require 4 digit serials starting at 1001. After that I found out I was right, the UBA PSK63 Prefix Contest was going on. But we had other plans, so that was just one QSO.

Today I had some more time before 12:00 UTC to play with the radio, changed the contest macros a bit for this contest and tried making more contacts. In total I made 10 contacts so it's just a checklog for the others. But I entered it 'for real' in the 10 meter single operator category.

Contesting is more fun than I expected when I first heard about it. And contesting in digimodes has its interesting things. I made all contacts in the 10 meter band, this is becoming my favourite HF band at the moment.

Als ouder van een kind wat ondertussen op de basisschool zit krijg ik ook te maken met een aanwas van nieuwe plekken waar gegevens over dat kind opgeslagen worden. Tegelijkertijd ben in mijn werk uiterst kritisch over contracten die afgesloten worden met bedrijven die gegevens van mijn werkgever verwerken. De recente privacy-rel rond basispoort geeft ook aan dat dit nieuw terrein is waar nog grote fouten gemaakt kunnen worden.

Recent kreeg ik een uitnodiging om een account aan te maken op digiDUIF met als omschrijving van de school

Communicatie tussen u en ons vinden wij belangrijk. Daarbij is ons doel u zo goed mogelijk te informeren over de verschillende activiteiten van onze organisatie. Om dit te realiseren, maken wij gebruik van digiDUIF waarmee wij u via e-mail, SMS en pushberichten (via de youConnect apps) snel, direct en betrouwbaar kunnen bereiken.

En daarbij een uitleg hoe aan te melden bij digiDUIF.

I wanted to track a ride I made on my recumbent bicycle, but without uploading the track details to some cloud service. The trackdata does include where I was at what time and that's not something I want to share.

The solution is available and simple: use a local GPS tracker which saves a GPX file. I found one for android: Open GPS Tracker which gives me a file in the end which I can process myself. This application can also display the track on a google map/openstreetmap/opencyclemap (when available).

The colour scale is the speed, you can see the influence of the heavy wind last Friday. Cycling on my recumbent on the dike of the Lek river is great.

A problem I did not expect to see: a harddisk getting close to being too cold. This disk in the weather station computer in the shed is a laptop harddisk and according to the specs the minimum operating temperature is 5 degrees Celcius, which was reached last week when the shed dropped just below 2 degrees Celcius.

Promptly after fixing the previus leapsecond file I get the IERS Bulletin C number 49 today which states:

                                   UTC TIME STEP
                            on the 1st of July 2015


 A positive leap second will be introduced at the end of June 2015.
 The sequence of dates of the UTC second markers will be:

                          2015 June 30,     23h 59m 59s
                          2015 June 30,     23h 59m 60s
                          2015 July  1,      0h  0m  0s

And I notice the IETF seems to update the canonical leap-seconds file about two months after the decision is made by the IERS.

It's a good thing ntpd starts complaining when the file is about to expire.

Update 2015-01-06: An update was available from ftp://time.nist.gov/ but only when I connected over IPv6. An interesting form of IPv6 promotion. Notice the difference in messages between the old file and the new file loading:

Jan  5 13:54:33 ritchie ntpd[13710]: leapsecond file ('/etc/ntp/leap-seconds.3644438400'): good hash signature
Jan  5 13:54:33 ritchie ntpd[13710]: leapsecond file ('/etc/ntp/leap-seconds.3644438400'): loaded, expire=2015-06-28T00:00Z ofs=35 (no entries after build date)

Jan  6 10:14:17 ritchie ntpd[26348]: leapsecond file ('/etc/ntp/leap-seconds.3629404800'): good hash signature
Jan  6 10:14:17 ritchie ntpd[26348]: leapsecond file ('/etc/ntp/leap-seconds.3629404800'): loaded, expire=2015-12-28T00:00Z last=2015-07-01T00:00Z ofs=36

The current numbers from the third battery in my Dell Latitude D630 laptop:

koos@machiavelli:~$ acpi -V
Battery 0: Discharging, 100%, 04:21:53 remaining
Battery 0: design capacity 7800 mAh, last full capacity 4544 mAh = 58%

A laptop battery is a part which wears out, so this is not unexpected after a few years.