lightswitch05

작년discuss

I can +/-5ms jitter using a cheap GPS receiver with serial over USB.

Using the same receiver, but with a PPS wire to a GPIO pin on a raspberry pi, I get +/- 5µs jitter.

If you are interested, I have a write up with live graphs in the hamburger menu here: https://www.developerdan.com/ntp

lightswitch05

2년 전discuss

I’m not familiar with Chrony. With NTPsec, the PPS driver docs say [0]:

> While this driver can discipline the time and frequency relative to the PPS source, it cannot number the seconds. For this purpose an auxiliary source is required;

And so (with NTPsec), you need to define two sources even though it’s coming from the same device. One for the PPS signal for clock discipline, the other for the clock value.

> refclock pps ppspath /dev/gpspps0 prefer

> refclock nmea baud 57600 prefer

0: https://docs.ntpsec.org/latest/driver_pps.html

lightswitch05

2년 전discuss

> It’s unclear to me why there’s so much delay and jitter in the PPS timestamping.

I’ve messed around with this on a couple different GPS chips. I’ve found improvements can be made by increasing the baud rate to the maximum supported. 9600 tends to be the default, but 57600 works a lot better. Also, disable all NMEA sentences except the one you are using. Finally ramp up the update interval to be much more often. The default tends to be every 1000 milliseconds, but 100 milliseconds works better for less jitter. I’ve been using NTPsec, not Chrony, so maybe there are more nuances.

Im just a hobbyist, but I have a bit more details written up here, checkout the poorly designed hamburger menu for some charts and graphs: https://www.developerdan.com/ntp/

lightswitch05

2년 전discuss

I get weird looks when I speak with people about my GPS PPS NTP servers. This is website amazing. Most of it is way beyond my comprehension, but it’s given me a lot to read up on.

lightswitch05

2년 전discuss

This is off-topic, but I was looking at your sbts-aru project and remembered having read the hackaday post on it about fireworks. I'm curious if you've ever seen the RaspberryShake BOOM sensor? If so, any thoughts on how your project and it differ?

https://shop.raspberryshake.org/product/turnkey-iot-atmosphe...

lightswitch05

2년 전discuss

I must admit I've never used chrony, so I'm unfamiliar with how to configure it. I've read a lot say saying gpsmon's shared-memory-segment is a really great interface and to go with it instead of NTP's own GPS drivers, but I cannot say that lines up with my experience. I do have one computer setup this way, and it works, but I found on the PPS configurations, it seemed to me to have better accuracy and less jitter using NTP's own GPS drivers and taking gpsmon out of the equation. Its quite possible I just don't know the right configuration combination, but ntpsec's own GPS drivers work great for me.

lightswitch05

2년 전discuss

> While not intended to be a direct replacement, the application supports most of the UBX configuration functionality in u-blox's Windows-only u-center © tool (only public-domain features are supported).

I'm going to have to check this out! Thank you for sharing!

lightswitch05

2년 전discuss

You can see for yourself the level of accuracy in the ntpviz output. Notice the units of measurement on the graphs:

* Clayface: https://www.developerdan.com/ntp/#./clayface/7-days/

* Catwoman: https://www.developerdan.com/ntp/#./catwoman/7-days/

That Wikipedia quote should mention temperature! Temperature variations have a big impact at this level of accuracy. These really cheap GPS receivers do not have temperature adjusted clocks. Unfortunately my server closet (this is just a hobby) does not have well regulated temperature, so you can see the impact of temperature on the clock accuracy. Also, I found if I start running a bunch of stuff on these computers - that makes the CPU heat up, which also affects the jitter. If you really want high-precision, you'll have to shell out some extra cash then I did: https://www.sparkfun.com/products/18774

lightswitch05

2년 전discuss

Good question, it absolutely syncs without any network connectivity. For better or for worse, I have it setup NOT to sync to anything else- being a stratum 1 source is enough. Now… I will admit I’m just a hobbyist with this stuff. Anyways, the way I got around it trying to sync to another source when using the PPS was to define the GPS as two separate sources. One for the PPS signal and another for the NMEA sentences:

    refclock pps ppspath /dev/gpspps0 prefer time1 0.004 minpoll 3 maxpoll 4 iburst 
    refclock nmea baud 57600 time2 0.068 minpoll 3 maxpoll 4 prefer iburst

To get around issues with sync being slow, I have NTPD configured with some extra flags to allow large time jumps at startup:

    NTPD_OPTS="-ggg -N"

I have two raspberry pies setup this way- which I don’t use for much else. My primary computers have these two servers configured as time sources- but also have external sources- so as long as network connections are available, they can determine if they are providing a sane time or are false tickers. As for accuracy, you can view the ntpviz output for each setup in the hamburger menu. For catwoman, its regularly within 4 microseconds.

lightswitch05

2년 전discuss

I had this happen before. I used it as an excuse to learn how to setup NTP with a GPS receiver. I made a little blog on it if anyone is interested in the results. Be sure to click the sandwich menu for some real-time data: https://www.developerdan.com/ntp/

lightswitch05

3년 전discuss

This is the changelog for 20.8.1, but it’s important to point out that that 4 of the CVEs were also patched in 18.18.2.

Shameless promotion time, I have a little utility that can check a node version for CVEs or EOL:

    npx node-version-audit@latest --fail-security

Or with docker:

    docker run --rm -t lightswitch05/node-version-audit:latest --version=$(node -e "console.log(process.versions.node)")

Some highlights of the tool is zero dependencies and CVEs are sourced directly from NPM changelogs instead of waiting on slow CVE release processes. See the website for more details: https://www.github.developerdan.com/node-version-audit/

lightswitch05

3년 전discuss

The new feature for subscribed allowlists is going to pair really nicely with the existing support of ABP-style blocklists. I’m very excited for this release!

lightswitch05

4년 전discuss

Three years ago I released a tool called PHP Version Audit. The idea is that it parses the PHP changelog and notifies you if you are running a PHP version that has a CVE or has lost support.

Anyways, after running for three years, I thought it would be fun to put together some data. The most interesting one is that PHP Version Audit has a median CVE discovery of 5 hours after the PHP announcement. In contrast, the NVE CVE Database has a median of 260 hours - or almost 11 days. Of course the NVE CVE Database has all sorts of information like a vulnerability score, so maybe it’s an apples vs. oranges comparison. Anyways, I hope someone else finds this interesting :)

If you think PHP Version Audit is interesting, there is also Node Version Audit[0] that I released earlier this year.

0: https://www.github.developerdan.com/node-version-audit/

lightswitch05

4년 전discuss

To answer your question, the levels are important for both regular usage and debugging when something goes wrong. I create a number of debug/info/warning/error log messages throughout the tool and allow the desired level of logging to be set as a CLI argument - or even run in silent mode if desired.

lightswitch05

4년 전discuss

Yes, my library absolutely has to support the LTS version of Node, and I run the tests against all supported versions to ensure compatibility. So, one day I can use the nice things people are mentioning, but it will be years from now.

lightswitch05

4년 전discuss

I’ve written a library with zero production dependencies. Of course I have Jest as a development dependency which pulls in all sorts of stuff. It would be difficult to make a zero-dependency library. As for not having production libraries, this was my experience:

1. Using the https module directly was more work than I expected, especially with error handling. This made me really look forward to the new Fetch API coming out.

2. No CLI parser. Its not like parsing args is a LOT of work - but its also something that is already solved and having to write support for that directly was a bummer

3. No logging library. This one was pretty easy. Create a little class with logging levels. Again this is something that is very common that would have been nice to use a package for.

lightswitch05

4년 전discuss

It seems like the most reasonable choice. Incidentally, I have an open-source tool called Node Version Audit [0] which checks a given node version against known CVEs and end-of-life dates. It looks like the official change hasn’t been made yet [1].

[0] https://www.github.developerdan.com/node-version-audit/

[1] https://raw.githubusercontent.com/nodejs/Release/main/schedu...

lightswitch05

5년 전discuss

I didn’t realize there were so many CVE-based tools out there! I even have an ultra-specific one for PHP (with some extra logic for support timelines). PHP Version Audit: https://www.github.developerdan.com/php-version-audit/

One thing I’ve noticed with PHP at least, is that their release docs will regularly have the CVE listed with the details for many days before it shows up in the CVE feed- even as long as a week. Sourcing only from the feeds is a bit slow, but perhaps that is limited to the process that PHP uses?

lightswitch05

5년 전discuss

I run these: https://www.github.developerdan.com/hosts/

Of course the PiHole default ‘Steven Black’ list is also a combination of many well maintained lists and so even if you don’t add lists, his project is regularly adding new sources.

lightswitch05

6년 전discuss

> I can punch anyone I see on the street in the face.

Yes, and then you would be charged with assault. It is great that you work on a tool that respects peoples privacy. I suppose I failed to put an emphasis on trust. With server side logs, less trust is required because there is less that can be done. Paired with VPN, I can have reasonable belief that server side logging is not logging anything unreasonable and it does not require trust that they are not fingerprinting me. As you say, just because someone can do something doesn't mean they will - but trust is required, especially if there are no repercussions if that trust is violated.

lightswitch05

Submissions

PHP Version Audit: Three years and running

Show HN: Node Version Audit – Audit Your Node Version for Known CVEs and Patches

Show HN: PHP Version Audit – Audit Your PHP Version for Known CVEs and Patches

Show HN: Blocklist Tools – Search popular host or domain formatted block lists

Show HN: PHP Version Audit – Audit Your PHP Version for Known CVEs and Patches

Commit Cloud – generate a word-cloud from any public GitHub repo

Easily create word clouds from commit messages for any github repo

comments