lightswitch05

I can +/-5ms jitter using a cheap GPS receiver with serial over USB.

Using the same receiver, but with a PPS wire to a GPIO pin on a raspberry pi, I get +/- 5µs jitter.

If you are interested, I have a write up with live graphs in the hamburger menu here: https://www.developerdan.com/ntp

I’m not familiar with Chrony. With NTPsec, the PPS driver docs say [0]:

> While this driver can discipline the time and frequency relative to the PPS source, it cannot number the seconds. For this purpose an auxiliary source is required;

And so (with NTPsec), you need to define two sources even though it’s coming from the same device. One for the PPS signal for clock discipline, the other for the clock value.

> refclock pps ppspath /dev/gpspps0 prefer

> refclock nmea baud 57600 prefer

0: https://docs.ntpsec.org/latest/driver_pps.html

> It’s unclear to me why there’s so much delay and jitter in the PPS timestamping.

I’ve messed around with this on a couple different GPS chips. I’ve found improvements can be made by increasing the baud rate to the maximum supported. 9600 tends to be the default, but 57600 works a lot better. Also, disable all NMEA sentences except the one you are using. Finally ramp up the update interval to be much more often. The default tends to be every 1000 milliseconds, but 100 milliseconds works better for less jitter. I’ve been using NTPsec, not Chrony, so maybe there are more nuances.

Im just a hobbyist, but I have a bit more details written up here, checkout the poorly designed hamburger menu for some charts and graphs: https://www.developerdan.com/ntp/

I get weird looks when I speak with people about my GPS PPS NTP servers. This is website amazing. Most of it is way beyond my comprehension, but it’s given me a lot to read up on.

This is off-topic, but I was looking at your sbts-aru project and remembered having read the hackaday post on it about fireworks. I'm curious if you've ever seen the RaspberryShake BOOM sensor? If so, any thoughts on how your project and it differ?

https://shop.raspberryshake.org/product/turnkey-iot-atmosphe...

I must admit I've never used chrony, so I'm unfamiliar with how to configure it. I've read a lot say saying gpsmon's shared-memory-segment is a really great interface and to go with it instead of NTP's own GPS drivers, but I cannot say that lines up with my experience. I do have one computer setup this way, and it works, but I found on the PPS configurations, it seemed to me to have better accuracy and less jitter using NTP's own GPS drivers and taking gpsmon out of the equation. Its quite possible I just don't know the right configuration combination, but ntpsec's own GPS drivers work great for me.

> While not intended to be a direct replacement, the application supports most of the UBX configuration functionality in u-blox's Windows-only u-center © tool (only public-domain features are supported).

I'm going to have to check this out! Thank you for sharing!

You can see for yourself the level of accuracy in the ntpviz output. Notice the units of measurement on the graphs:

* Clayface: https://www.developerdan.com/ntp/#./clayface/7-days/

* Catwoman: https://www.developerdan.com/ntp/#./catwoman/7-days/

That Wikipedia quote should mention temperature! Temperature variations have a big impact at this level of accuracy. These really cheap GPS receivers do not have temperature adjusted clocks. Unfortunately my server closet (this is just a hobby) does not have well regulated temperature, so you can see the impact of temperature on the clock accuracy. Also, I found if I start running a bunch of stuff on these computers - that makes the CPU heat up, which also affects the jitter. If you really want high-precision, you'll have to shell out some extra cash then I did: https://www.sparkfun.com/products/18774

Good question, it absolutely syncs without any network connectivity. For better or for worse, I have it setup NOT to sync to anything else- being a stratum 1 source is enough. Now… I will admit I’m just a hobbyist with this stuff. Anyways, the way I got around it trying to sync to another source when using the PPS was to define the GPS as two separate sources. One for the PPS signal and another for the NMEA sentences:

    refclock pps ppspath /dev/gpspps0 prefer time1 0.004 minpoll 3 maxpoll 4 iburst 
    refclock nmea baud 57600 time2 0.068 minpoll 3 maxpoll 4 prefer iburst

To get around issues with sync being slow, I have NTPD configured with some extra flags to allow large time jumps at startup:

    NTPD_OPTS="-ggg -N"

I have two raspberry pies setup this way- which I don’t use for much else. My primary computers have these two servers configured as time sources- but also have external sources- so as long as network connections are available, they can determine if they are providing a sane time or are false tickers. As for accuracy, you can view the ntpviz output for each setup in the hamburger menu. For catwoman, its regularly within 4 microseconds.

I had this happen before. I used it as an excuse to learn how to setup NTP with a GPS receiver. I made a little blog on it if anyone is interested in the results. Be sure to click the sandwich menu for some real-time data: https://www.developerdan.com/ntp/

This is the changelog for 20.8.1, but it’s important to point out that that 4 of the CVEs were also patched in 18.18.2.

Shameless promotion time, I have a little utility that can check a node version for CVEs or EOL:

    npx node-version-audit@latest --fail-security

Or with docker:

    docker run --rm -t lightswitch05/node-version-audit:latest --version=$(node -e "console.log(process.versions.node)")

Some highlights of the tool is zero dependencies and CVEs are sourced directly from NPM changelogs instead of waiting on slow CVE release processes. See the website for more details: https://www.github.developerdan.com/node-version-audit/

The new feature for subscribed allowlists is going to pair really nicely with the existing support of ABP-style blocklists. I’m very excited for this release!

Three years ago I released a tool called PHP Version Audit. The idea is that it parses the PHP changelog and notifies you if you are running a PHP version that has a CVE or has lost support.

Anyways, after running for three years, I thought it would be fun to put together some data. The most interesting one is that PHP Version Audit has a median CVE discovery of 5 hours after the PHP announcement. In contrast, the NVE CVE Database has a median of 260 hours - or almost 11 days. Of course the NVE CVE Database has all sorts of information like a vulnerability score, so maybe it’s an apples vs. oranges comparison. Anyways, I hope someone else finds this interesting :)

If you think PHP Version Audit is interesting, there is also Node Version Audit[0] that I released earlier this year.

0: https://www.github.developerdan.com/node-version-audit/

To answer your question, the levels are important for both regular usage and debugging when something goes wrong. I create a number of debug/info/warning/error log messages throughout the tool and allow the desired level of logging to be set as a CLI argument - or even run in silent mode if desired.

Yes, my library absolutely has to support the LTS version of Node, and I run the tests against all supported versions to ensure compatibility. So, one day I can use the nice things people are mentioning, but it will be years from now.

I’ve written a library with zero production dependencies. Of course I have Jest as a development dependency which pulls in all sorts of stuff. It would be difficult to make a zero-dependency library. As for not having production libraries, this was my experience:

1. Using the https module directly was more work than I expected, especially with error handling. This made me really look forward to the new Fetch API coming out.

2. No CLI parser. Its not like parsing args is a LOT of work - but its also something that is already solved and having to write support for that directly was a bummer

3. No logging library. This one was pretty easy. Create a little class with logging levels. Again this is something that is very common that would have been nice to use a package for.

It seems like the most reasonable choice. Incidentally, I have an open-source tool called Node Version Audit [0] which checks a given node version against known CVEs and end-of-life dates. It looks like the official change hasn’t been made yet [1].

[0] https://www.github.developerdan.com/node-version-audit/

[1] https://raw.githubusercontent.com/nodejs/Release/main/schedu...

I didn’t realize there were so many CVE-based tools out there! I even have an ultra-specific one for PHP (with some extra logic for support timelines). PHP Version Audit: https://www.github.developerdan.com/php-version-audit/

One thing I’ve noticed with PHP at least, is that their release docs will regularly have the CVE listed with the details for many days before it shows up in the CVE feed- even as long as a week. Sourcing only from the feeds is a bit slow, but perhaps that is limited to the process that PHP uses?

I run these: https://www.github.developerdan.com/hosts/

Of course the PiHole default ‘Steven Black’ list is also a combination of many well maintained lists and so even if you don’t add lists, his project is regularly adding new sources.

> I can punch anyone I see on the street in the face.

Yes, and then you would be charged with assault. It is great that you work on a tool that respects peoples privacy. I suppose I failed to put an emphasis on trust. With server side logs, less trust is required because there is less that can be done. Paired with VPN, I can have reasonable belief that server side logging is not logging anything unreasonable and it does not require trust that they are not fingerprinting me. As you say, just because someone can do something doesn't mean they will - but trust is required, especially if there are no repercussions if that trust is violated.

I think grouping server-side tracking with JavaScript based tracking is an oversimplification. JavaScript tracking is much more invasive and can access significantly more data. From something as straightforward as fingerprinting to potentially even more invasive data such as geo-location, battery status, webcam, microphone - you name it. Server access logs aren't going to track my eyes.

I think we can all agree there are different levels of acceptable tracking and use of that data- but the degrees of acceptance are going to be different depending on the user and service. I don't consider bypassing my restrictions to run unauthorized code to be an acceptable tracking method and raises serious concerns about how the data will then be used.

While I agree that is the proper solution, most analytics do not respect the Do Not Track header. Beyond it being mostly ignored, Safari (which currently has 20% global browser share) removed support for Do Not Track in 12.1. So even though Matomo might respect the header request, there is no way for me to send that header on many of my devices. Blocking is the only solution left to me to 'opt out' of tracking regardless of the good intentions of Matomo.

Its pretty disgusting to track people against their consent, even more so to circumvent their protections against tracking. I added your domain to my blocklist: https://github.com/lightswitch05/hosts/commit/bb2cd77c9ec028...

I agree. I think its very likely 'import a ton of other block lists and then apply some sort of logic to whitelist potential problem domains', but I would love to be wrong.

I been maintaining a little hosts project for blocking ads and trackers [0]. I've casually noticed over the years that a lot of the lists out there combine other people's lists - some are more upfront about it then others. That got me thinking, who was the first list to block domain X? That is where this website comes in.

A lot of popular block lists are hosted on GitHub, so that made it really easy to clone the repo and do a full history import of the project. I made a little script that could walk the git history and generate a JSON file containing all the unique versions to import [1]. The oldest lists from Steven Black's popular hosts project: April 2012 [2]. Other lists are harder to find history on, so they just go back as far as this project does.

As a test to watch domains from one list get consumed by other lists, I added a fake domain to my list 'developer-dan-list.clksite.com'. This root domain is particularly useful since it is a wildcard and will have a valid DNS response to any subdomain. As expected, I saw it get added to multiple lists in the following days.

[0] https://www.github.developerdan.com/hosts/

[1] https://github.com/blocklist-tools/github-history-generator

[2] https://github.com/StevenBlack/hosts

I maintain a small hosts file project for blocking ads and tracking. I get so many complaints about blocking google fonts that I had to add a section to my README specifically for it [0]. I don't block google fonts, but I do block gstaticadssl.l.google.com and most blockers will block based on CNAME values now. Oh well.

[0] https://github.com/lightswitch05/hosts#google-fonts