unorde.red on unordered

Pihole and IPv6

Fri, 03 Apr 2026 00:00:00 +0000

I recently bought a cheap server to run at home, and set up pihole. I set up some local records, so my server is available via DNS locally. I also enabled DHCP, so I could give all of my devices fancy and organized local IP addresses.

Unfortunately my ISP, which is part of the Big Telecom oligopoly in Canada, gave me a very locked down router. Inexplicably this router allows you to configure v4 DNS servers or disable DHCP entirely, but it doesn’t allow you to do the equivalent for v6.

Mount MacPherson

Mon, 28 Aug 2023 00:00:00 +0000

2427m (427m prominence)
Monashee Mountains, Gold Range
Revelstoke, BC

In late August my brother and I were looking for a nice, accessible summit to do in the area, and settled on Mount MacPherson as a good candidate. The summit is quite close to and visible from Revelstoke, although not nearly as spectacular as some of the other visible summits such as Mount Begbie.

Access is via the Three Valley-Victor FSR, which is about a kilometer east of the Three Valley Lake Chateau on Highway 1, west of Revelstoke. The FSR is in decent condition, but deactivated past a certain point. This means gullies have been dug into the road every few hundred meters, requiring a high clearance vehicle. My Ford Escape handled it fine, although I may have scratched up my front bumper a bit on the way down. We stopped shortly before the actual trailhead, as the road seemed to worsen up the last steep hill to the trailhead.

Mount Carnarvon

Wed, 26 Jul 2023 00:00:00 +0000

3046m (406m prominence)
Canadian Rockies, Waputik Mountains
Yoho National Park, BC

I was camping in the beautiful Yoho National Park, so naturally it was time to climb a big mountain. I poked around the map for a bit and settled on Mount Carvarnon as a good candidate. Close to the campsite, lots of elevation, and reportedly good YDS class 3 scrambling. The most accessible route up is from Emerald Lake, which is a popular tourist destination. I drove up in the morning, getting there just after 8 AM. The parking lot wasn’t full, but there were definitely people. The weather was cloudy, and it seemed like it might be cold in the alpine.

Mount Fosthall

Sat, 22 Jul 2023 00:00:00 +0000

2686m (816m prominence)
Monashee Mountains, Gold Range
Monashee Provincial Park, BC

There are two standard ways to do Mount Fosthall, both gaining the south ridge from the south east.

The easiest is probably to start at the Sol Mountain Lodge from the east, taking the South Caribou Pass Trail to the Mount Fosthall route. This shouldn’t be much more than 1000m elevation gain, and is much shorter than the other route.
The other way is to start from the Spectrum Lake trailhead to the west, taking the long way around the mountain before meeting up with the Mount Fosthall route. Out and back, this is a 39km route with 2300m of elevation.

Because the Spectrum Lake trailhead was 2 hours closer by car and also offered more of a challenge, the choice was easy.

Trip report: Cape Wrath Trail

Thu, 05 Nov 2020 00:00:00 +0000

The Cape Wrath Trail is an approximately 350 km (220 mi) walk through the Scottish Highlands, stretching from Fort William to the northwesternmost point of mainland Britain, Cape Wrath. The route is unmarked and there is no official line. It has the reputation of being Britain’s toughest long distance walk.

In the fall of 2020 I hiked the Cape Wrath Trail solo in eleven days. This trail already has its share of uncertainty, but the global pandemic raging in the background brought a few more.

DamCTF: crypto/guess-secret

Mon, 12 Oct 2020 00:00:00 +0000

This challenge asks us to break a ‘super secure and efficient communication method’. It also gives us the server code, although this isn’t really necessary—the server itself tells us all we need to know.

The server explains in detail what it does. It accepts a string, and creates the plaintext by concatenating it to the flag. The plaintext is then compressed using the lossless deflate (zlib) algorithm. Lastly, the compressed data is encrypted using AES_CTR_128. The resulting ciphertext is returned to us.

Bazel, Go and Protobufs

Mon, 20 Apr 2020 00:00:00 +0000

Suppose you’re setting up your first project using Bazel, written in Go and using Protobufs as a data format.

It’s easy to make mistakes. I did, and ended up with the following build error:

compilepkg: error running subcommand: exit status 2
/***/file.go:xx:xx: cannot use o (type *protopb.Object) as type protoreflect.ProtoMessage in argument to "google.golang.org/protobuf/proto".Unmarshal:
	*protopb.Object does not implement protoreflect.ProtoMessage (missing ProtoReflect method)
/***/file.go:yy:yy: cannot use o (type *protopb.Object) as type protoreflect.ProtoMessage in argument to "google.golang.org/protobuf/proto".Marshal:
	*protopb.Object does not implement protoreflect.ProtoMessage (missing ProtoReflect method)

In particular, the phrase “missing ProtoReflect method” was unknown¹ to Google at time of writing!

Exploring Facebook's network

Fri, 28 Feb 2020 00:00:00 +0000

What does the (physical) network of a big internet company like Facebook look like? I’m going to try to find out. I’ll be making a lot of assumptions, loosely backed by informaton gathered from possibly out of date sources. I’ll try to be explicit when something is guesswork.

A good place to start is the traceroute tool. By default it performs reverse DNS lookups for each hop. This often reveals interesting information, and facebook.com is no exception.

Sanity checks

Sat, 14 Dec 2019 00:00:00 +0000

In my line of work I’ve dealt with a lot of automated data pipelines that feed into production systems.

Validating the output of these pipelines in an automated manner is frequently difficult. Suppose you had a different data source you could validate against. If you could reliably tell whether your pipeline was producing invalid data using this data source, why not directly incorporate this data into your pipeline? Alternatively, if the data source isn’t reliable enough to do so, chances are you’ll need a human to come look at the diffs either way.

RedpwnCTF: mallcop

Sat, 17 Aug 2019 00:00:00 +0000

Mallcop was the least-solved challenge in the Misc category. We were given a zipped file of 20 problem instances. The server gives us the following problem description:

Sick of Chick-fil-A, Daniel's son deserts him to make a break for the parking
lot. (Un?)fortunately, Max the Mall Cop is here to help!  The n stores in the
mall are connected by walkways such that none of them form a cycle; in other
words, there is exactly one path from one store to another. Daniel's son was
last seen at store k.  Stores connected to only one store lead to a parking lot.
Max the Mall Cop decides to station his miniature clones at some of these
parking lot stores.  Every minute, Daniel's son and the miniature Maxes can move
one meter towards an adjacent store or stay put. Daniel's son is caught when he
coincides with a miniature Max at a store or a walkway.  What is the minimum
number of miniature Maxes that Max the Mall Cop should station to ensure that
Daniel's son cannot reach a parking lot?

Input:
    First line: n, k
    Next n-1 lines: a, b, x indicating a walkway between stores a and b with
        length x meters

Output:
    One line with the minimum miniature Maxes needed.

Download the testcases from in.zip and enter your output here.

The server has us give the answer to each of the 20 instances one at a time, and then disconnects us without giving any information if we got it wrong.

RedpwnCTF: Alien Transmissions

Fri, 16 Aug 2019 00:00:00 +0000

This was one of the higher scoring challenges I completed. We’re given the following description:

Brownie plugged his USB stick in, ready to take a look at the alien
transmissions he had received. However, when he opened the document, he
discovered that it was all encrypted! Brownie remembered overhearing Tux
bragging about a 38 character xor key, and realized that he must have encrypted
his document. Help Brownie find the key to decrypt the transmissions!

The transmission list is formatted as a list of strings delimited by ։. Here's
an example list: /Z։Tk8V։gF։ue3T։dae9#

Note: ։ is not the regular English colon.

The description pretty much gives it away. We’re looking at a simple XOR cipher with a 38 character key. The key insight here is that every 38th character will be XORed with the same char. Combining all of these characters into a string allows you to do frequency analysis and hopefully recover the char. Rinse and repeat to get the whole key and decrypt the message.

Playing with ICMP and NAT

Mon, 18 Feb 2019 00:00:00 +0000

ICMP stands for Internet Control Message Protocol. It is used by network devices to send error messages and operational information. If you’ve ever used ping to poke a machine, you’ve used the ICMP protocol!

The ICMP protocol is very simple. It is considered a layer 3 protocol, and messages are wrapped by IP. The header consists of several fields. The first byte is a numeric type. For example, 8 is an IPv4 echo request, while 0 is an IPv4 echo reply. Next is a code that expands on the type, then a checksum and finally 4 bytes that depend on the type/code. For ping, these four bytes consist of an identifier and a sequence number. After the header there may be a payload.

uid

Sat, 17 Mar 2018 00:00:00 +0000

What happens when an unprivileged user runs the binary

-r-s---r-x  1 root root 1024 Mar 17 21:57 binary

which executes the following lines of code?

setreuid(geteuid(), geteuid());
system("/bin/sh");

Let’s find out. First, we need to understand what a uid is.

The POSIX standard defines three different user identifiers. These allow processes to dynamically take on different roles, providing they have the required privileges.

The real uid identifies the (real) owner of a process. The real uid can be manipulated with getuid() and setreuid(uid_t ruid, uid_t euid).
The effective uid of a process is used for access control. It is also used as the owner for files created by that process. See geteuid(void) and seteuid(uid_t euid) (note that confusingly, setuid also sets the effective uid).
The saved uid is used to store the effective user id when it is changed temporarily. For example, a privileged process may need do some unprivileged work. To do this, it would change its euid. But it would not be able to change back unless its original (privileged) euid was stored somewhere. That’s where the saved uid comes in: an unprivileged process may set its euid exclusively to one of uid, suid, or euid.

Processes are managed by the kernel using a process descriptor. In practice, this is a task_struct struct, containing all the process information that the kernel needs. This includes a pointer to a cred struct, which stores the different uids mentioned above. This is how the kernel determines whether or not a process has the privileges to do something.

Cryptobin

Thu, 04 Jan 2018 00:00:00 +0000

Over the holidays I spent some time on two different but related sets of challenges.

The first was the Krypton wargame at OverTheWire. This wargame goes over some basic classical cryptography. I was a bit disappointed in the last level, I don’t think the way I solved it was the intention of the author. It certainly didn’t match the level text.

The second was the AIVD kerstpuzzel, which is an annual Christmas puzzle produced by the Dutch equivalent of the CIA. This year’s edition was particularly difficult (at least, this is what I read online). There was some cryptography, word puzzles, number sequences, and a lot of pattern recognition. I didn’t get very far.

Internet 101: TCP

Sat, 04 Nov 2017 00:00:00 +0000

This article assumes the reader has basic knowledge of IP.

IP gives us addressing and the ability to send packets from one machine on the internet to another, assuming that routing is configured correctly at each hop. However, it provides little else.

Imagine trying to send a large file over IP. Due to the length restriction on IP packets, the file is broken up into chunks, and each chunk is sent in order as an IP packet. In this scenario, any number of things can go wrong. An unreliable link may corrupt a packet. A router may choose to route one or more packets differently from the others. Packets may be silently dropped or duplicated in misconfigured networking devices. Eventually, the destination machine receives the packets out of order, with some missing, corrupted or duplicated. Obviously, reliably reconstructing the file from these packets is impossible.

Internet 101: Autonomous systems

Tue, 10 Oct 2017 00:00:00 +0000

This article assumes basic knowledge of IP and CIDR.

The internet is made up of a huge number of networks. These networks are owned by many different entities in many different countries, who each control one or many IP prefixes. The IANA and the internet registries under it allocate the prefixes. But how are these networks identified, and how does traffic flow between them?

An autonomous system is collection of IP prefixes controlled by a single entity. This entity can be an ISP, large company, government or academic institution. The IANA, via the internet registries under it, allocates a unique number (32 bits, used to be 16) to every such entity. This is called an ASN, or autonomous system number.

Internet 101: CIDR

Mon, 09 Oct 2017 00:00:00 +0000

This article assumes the reader has basic knowledge of IP.

IP defines the IP address, and the packets that are sent across networks. However, it doesn’t state how the packets are routed. What happens when a packet arrives at a router? The only information the router has is the destination address. If it isn’t directly connected to the machine hosting this address, how will it know where to send the packet?

Internet 101: IP

Sun, 08 Oct 2017 00:00:00 +0000

The Internet Protocol is responsible for moving data across network boundaries. How does it do this?

Addressing

To route data on a multi node path from one machine to another, it is necessary to uniquely and deterministically identify the source and destination machine (it should be noted that this idea is abused a lot in the wild). IP does this by defining a numerical IP address.

For IPv4, this is a 32 bit number (e.g. 172.16.254.1). Since the number of possible IPv4 addresses is grossly insufficient, IPv6 defines a 128 bit number. IPv6 addresses are typically shown using eight four-digit hexadecimal numbers delimited by colons (e.g. 2001:db8:0:1234:0:567:8:1).

Hashwalk

Fri, 29 Sep 2017 00:00:00 +0000

Hashwalk is an exercise in futility. It attempts to mount a preimage attack on a cryptographic hash function by using local search. This is essentially a poor man’s differential cryptanalysis.

A good, general purpose cryptographic hash function should exhibit the avalanche effect. This means that a small change in the input (e.g. a single bit flip) results in a large change in the output (e.g. approximately half of the bits being flipped). In other words, the function should be psuedorandom. A hash function that isn’t psuedorandom is unsuitable for many cryptographic use cases, since it may leak information on the data being hashed.

OverTheWire: Bandit

Sat, 10 Jun 2017 00:00:00 +0000

Today I finished the Bandit wargame at OverTheWire. It was a lot of fun! It’s aimed at players looking to become familiar with the command line and basic linux tooling. I got to use a lot of utilities from coreutils that I didn’t even know existed.

I was familiar with nearly all of the concepts touched on in the levels. Despite this, I still managed to get stuck several times. Understanding the concepts on a higher level often isn’t enough – sometimes you really need to understand the utility intimately to get the job done. Reading man pages is good for you.

Character encoding refresher

Mon, 20 Mar 2017 00:00:00 +0000

Sometimes I forget the details on different character encodings. Maybe you do too.

Unicode

Unicode is a standard designed to facilitate consistent encoding and representation of text. Unicode encodes graphemes to code points, where a grapheme is the smallest unit of a writing system of a language. A code point is a number. So Unicode by itself is not enough to store text on a computer, since the way that the code points should be stored in memory is not defined.

Topological sorts

Sun, 12 Mar 2017 00:00:00 +0000

Detecting and finding cycles in directed graphs are common problems in graph theory. A while back I was looking for an algorithm to detect whether a graph had a cycle or not, and it turns out there are a lot of different ways to approach this. Ultimately, the best method to use will probably depend on why you’re looking for cycles, and what you want to do with them (or their absence).

Spring, @PathVariable, dots, and failed exception handling

Thu, 12 Jan 2017 00:00:00 +0000

If you use Spring Boot to set up an endpoint using @RequestMapping with a @PathVariable at the end of the request URI, you might run into several quirks if this path variable happens to include a dot. For example, consider the following mapping:

@RequestMapping(value = "/api/resource/{id}", method = RequestMethod.GET)
@ResponseBody
public Resource getResource(@PathVariable("id") final String id) {
  final Resource resource = resourceService.findById(id);
  if (resource == null) {
    throw new ResourceNotFoundException();
  }
  return resource;
}

This mapping returns a Resource object in the response body, which is serialized to JSON using Jackson2. Let’s also assume that we handle the ResourceNotFoundException using an @ExceptionHandler.

Lattices and sphere packings

Sun, 11 Dec 2016 00:00:00 +0000

This article assumes basic knowledge of linear algebra and group theory.

What is a lattice? Good question. First, we’ll need to define some concepts.

Definitions

When we think of the word lattice, we most likely envision some kind of spacial structure. The faces of a crystal, or the metal beams of a bridge that form a repeating pattern of shapes. Using mathematics, we can distill this structure down to a periodic arrangement of points in some \(n\)-dimensional space.

AVR programming with Arduino

Tue, 11 Oct 2016 00:00:00 +0000

Written by Victor van Poppelen.

The Arduino Nano

The Nano is a very simple board, essentially just an AVR MCU with an FTDI chip for communicating over USB. On the top left of the schematic¹ is the pinout of the board, and in the centre is the pinout of the AVR chip (an ATmega328 or ATmega328p)².

You can follow the pins to various components, and/or directly to the pins of the board itself. For example, the D0/TX and D1/RX pins on the board are connected to the PD0 and PD1 pins of the AVR, which are the UART TX and RX pins. The schematic is confusing at first but gets simpler once you see that every label is unique, and anywhere a label appears multiple times means they are connected at those points within the board. So, in the case of the D0 and D1 pins, they are connected to the AVR directly before the 1k resistors RP1B and RP1C, which are in turn connected to the TXD and RXD pins of the FT232RL (via the RX and TX labels, respectively). The FT232RL chip³ is a USB slave to UART converter that connects to the mini-USB connector (labelled USB-MINI-B%C).

What is Diffie-Hellman?

Tue, 15 Mar 2016 00:00:00 +0000

This article assumes knowledge of basic group theory, and basic asymptotic complexity (big O notation).

For efficiency reasons, most encryption used on the internet and elsewhere is done using symmetric-key algorithms. A symmetric key algorithm uses one key for both encryption and decryption. This requires the sender and receiver to share knowledge of a secret key. For two parties who have never communicated securely before, this is a non-trivial problem. How does one establish a shared secret using insecure channels? This is where a key exchange algorithm like Diffie-Hellman comes in.

Styling machine schedules in LaTeX

Sat, 23 Jan 2016 00:00:00 +0000

Recently I worked on a project about the Job Shop Problem, and came across the need to visualize the machine schedules that were being generated. A quick search revealed the type of diagram I was looking for to be the Gantt chart. There’s a lot of tools that can produce these kinds of charts from data, like this python script in combination with gnuplot. However, I wasn’t looking to make a chart from data, and preferred to do it inside LaTeX, without embedding any images (to be fair, gnuplot is capable of outputting latex markup – but it seemed quicker to do myself).

Microcorruption CTF: Hollywood

Sun, 20 Dec 2015 00:00:00 +0000

This is my writeup for “Hollywood”, the very last level on the Microcorruption CTF. Like usual, if you haven’t already solved it or given it your very best shot, you should stop reading and go do that now. This level doesn’t have any clever tricks, it just takes perseverance.

Intro

The introduction text reveals two things. One is randomization, and the second is that there are no hardware modules attached. If this lock is to open using a valid password, it means that the password is checked within the binary, and thus the password must also exist somewhere in the binary. All we have to do is reverse engineer until we find it. Of course, some previous locks lacked legitimate means of opening them, but given the obvious theme of this level, I figured it was probably safe to assume the password existed somewhere.

Microcorruption CTF: Chernobyl

Fri, 18 Dec 2015 00:00:00 +0000

This is my writeup for “Chernobyl”, the second to last level on the Microcorruption CTF. Like usual, if you haven’t already solved it or given it your very best shot, you should stop reading and go do that now.

The input

This binary is pretty big compared to previous levels. There’s a lot more functionality, and I spent a fair bit of time getting acquainted with the program.

I first stepped through some test inputs to see what was going on. The first character is tested against 0x61, or ‘a’, and then against ’n’. A bit more digging revealed the following information:

Microcorruption CTF: Lagos

Tue, 15 Dec 2015 00:00:00 +0000

This is my writeup for the “Lagos” level in the Microcorruption CTF. It goes through my (naive) thought process and my initial solution. If you haven’t already solved it or given it your best shot, you should probably stop reading and do that first.

The filter

This level takes your input from the heap, and filters out non-alphanumeric characters before copying them to the stack. As soon as a non-alphanumeric character is reached, the copying stops. There is a familiar conditional_unlock_door function that uses the INT 0x7E interrupt. It also uses memset to wipe the heap clean before testing the password copied to the stack. The overflow is potentially quite large, as up to 0x200 characters are taken as input.

Microcorruption CTF: Bangalore

Mon, 14 Dec 2015 00:00:00 +0000

This is my writeup for the “Bangalore” level on the Microcorruption CTF. If you haven’t already solved it or given it your best shot, you should probably stop reading and go do that first.

This level introduces the concept of DEP, or Data Execution Prevention. You can read a lot about DEP elsewhere, but the gist of it is in the name—it prevents instructions from being executed in certain areas of memory. So simply injecting and running your favorite shellcode will no longer work, if that area of memory is marked as non-executable. We will have to find a way around DEP. Let’s check the Lock Manual for the specifics.

Particle swarm optimization

Wed, 15 Jul 2015 00:00:00 +0000

Particle swarm optimization (PSO) is a local search metaheuristic. It was initially developed by Kennedy, Eberhart and Shi in the late 1990s, and was meant to simulate social behaviour such as birds flocking to a promising position in a multi-dimensional space. A simplified version of the algorithm was found to perform optimization, which led to its adoptation as a local search algorithm.

The algorithm is easy to implement, and makes very few assumptions about the problem. PSO can be applied to a wide range of optimization problems, as it does not use the objective function’s gradient and therefore does not require the objective function to be differentiable.

0

Sun, 21 Jun 2015 00:00:00 +0000

Hi, I’m Alex and I’ll be writing about stuff that I’m interested in. Right now that includes algorithm design, cryptography, infosec and data mining, but that may change in the future.

I’m not the best at keeping a blog going, but we’ll see how it goes this time.

About

Mon, 01 Jan 0001 00:00:00 +0000

Hi, my name is Alex van Poppelen. This is my digital space, where I write about things that interest me.

I’m a Senior Software Engineer at Google. I work on Google’s network infrastructure. I’ve worked as an SRE, on DNS, load balancing, traffic engineering, security and a lot of data and configuration pipelines.

Before Google, I completed an M.Sc. in Computer Science where I wrote my thesis on the intersection of coding theory and lattice cryptography, followed by a short stint in the security and identity management industry at a small scale-up.

Now