EAP-TSL

Extensible Authentication Protocol (EAP) is an authentication framework for network and internet connections. Providing the transport and usage of material and parameters generated by EAP methods, it only defines the information from the interface and the formats. Each protocol that uses EAP defines a way to encapsulate by the user EAP messages within that protocol's messages. Examples of standards that use EAP include WPA and WPA2.

EAP Transport Layer Security (EAP-TLS), defined in RFC 5216, is an IETF open standard that uses the Transport Layer Security (TLS) protocol, and is well-supported among wireless vendors. EAP-TLS is the original, standard wireless LAN EAP authentication protocol, which calls for both a client's and a server's certificate. Therefore it requires mutual authentication using client-side X.509 certificates without giving the option to disable the requirement.

The requirement for a client-side certificate, however unpopular it may be, is what gives EAP-TLS its authentication strength and illustrates the classic convenience vs. security trade-off. With a client-side certificate, a compromised password is not enough to break into EAP-TLS enabled systems because the intruder still needs to have the client-side certificate; indeed, a password is not even needed, as it is only used to encrypt the client-side certificate for storage. The highest security available is when the "private keys" of client-side certificate are housed in smart cards. This is because there is no way to steal a client-side certificate's corresponding private key from a smart card without stealing the card itself. It is more likely that the physical theft of a smart card would be noticed (and the smart card immediately revoked) than a (typical) password theft would be noticed. In addition, the private key on a smart card is typically encrypted using a PIN that only the owner of the smart card knows, minimizing its utility for a thief even before the card has been reported stolen and revoked.

Native Command Queuing

In computing, Native Command Queuing (NCQ) is a technique supported by the Serial ATA protocol, which lets hard disk drives decide the sequence in which read and write commands are executed, thus reducing the amount of unnecessary drive head movement. Use of this resource results in less wear of the drive for workloads comprised of several simultaneous read/write requests. By using detailed knowledge of time to search for requests and rotation position, the drive can calculate a better order to perform the required operations. This results in a decrease in the amount of useless request retrievals in the drive head and better performance overall for reduced disk use.

A note on what the left considers "privilege"

I've come to the realisation that the word "privilege" has undergone a severe process of bastardisation over the past decades. At least the way its usage is currently applied in the west.

Taking into account the Christian perspective, there is no such thing as privilege (as in the way it's worded nowadays); rather, the plenty with which a person or family has is a blessing. All that we are, all that we have achieved and all that we possess is granted from the Holy Father. It's tantamount to when Jesus told Pilate: you would have no power if not granted from above. This was lost on Pilate who was too sidled up in his comfy  luxurious stance in life; too attached to the material and his own indulgences.

Even in want, the gift of salvation, the very promise of a saviour to redeem humanity is more than we deserve and our worth. The secular world calls this privilege, but the pious and the devoted know it is a blessing granted from God. Now and then John 3:16 is said in unsuitable or rather, cliched moments, but that's nevertheless what John was driving at - despite our inherent leaning towards evil, God still saw enough in humanity and the world and decided it was worth saving.

On potato peeling

Some of the potatoes I grew this year were Adirondack Reds. This sort constitutes a red purple type of potato that is really appealing to my tasting senses; medium yields and their skins were pretty blighted and splotchy. They also have to be entirely peeled, rather than some of the others which are are required. If given the choice, it's far preferable to not need peel your potatos because it means both less work and more food. but at times peeling the rind is unavoidable.

By chance encounter, I've recently come across an old acquaintance of mine and the potato talk came up. He told me that he prefers to peel his potatos Russian style, which means using a knife. He also went on to expound on how it's the only way to do it, if your priority is to get the most out of the potato in exchange for the time and energy undertaken for growing them. And how peeling them in such a manner is a practiced skill. And once peeled, they go into a container with cold water, kept in the fridge for a couple days.

I'd never guess that there were named methods of peeling potatos, as I've only ever relied on the usual potato peeler. Granted, i'd make use of a standard kitchen knife now and then, but my go-to-option had always been the potato peeler. It's also come in handy for peeling any thin-skinned vegetable. I'd even use it on garlic for a thin slice.

When I give myself the luxury of a steak, I prefer a baked potato -soaked in butter and spice. On the other hand, I have found out that mashed potatoes go great with chicken. I can take or leave wth gravy- usually doing without the gravy, but with butter. I have on occasion been lazy and have used the prepacked mashed taters. I'd only resort to them when making my homemade version of KFC's chicken bowl, which usually consists of a layer of mashers, corn, chicken and cheese.

IKEV1

 In computing, Internet Key Exchange (IKEv1 or IKEv2, depending on version) is the protocol used to set up a security association (SA) in the IPsec protocol suite. It's based on the Oakley protocol and ISAKMP. Using X.509 certificates for authentication (either pre-shared or distributed using DNS and a Diffie-Hellman key exchange), it sets up a shared session secret from which cryptographic keys are derived. MOreover, a security policy for every peer which will connect must be manually maintained.

Architecture

Most IPsec implementations consist of an IKE daemon that runs in user space and an IPsec stack in the kernel that processes the actual IP packets.

User-space daemons have easy access to mass storage containing configuration information, such as the IPsec endpoint addresses, keys and certificates, as required. Kernel modules, on the other hand, can process packets efficiently and with minimum overhead—which is important for performance reasons.

The IKE protocol uses UDP packets, usually on port 500, and generally requires 4–6 packets with 2–3 round trips to create an SA (security association) on both sides. The negotiated key is then given to the IPsec stack. For instance, this could be an AES key, information identifying the IP endpoints and ports that are to be protected, as well as what type of IPsec tunnel has been created. The IPsec stack, in turn, intercepts the relevant IP packets if and where appropriate and performs encryption/decryption as required. Implementations vary on how the interception of the packets is done—for example, some use virtual devices, others take a slice out of the firewall, etc.

Sliding window protocol

A sliding window protocol is a feature of packet-based data transmission protocols, used where reliable in-order delivery of packets is required, such as in the data link layer (OSI layer 2) as well as in the Transmission Control Protocol (TCP).

Sending a batch of data, it's necessary that the receiver ensures it was received correctly. When the receiver checks the data, it sends an acknowledgment signal ("ACK") back to the sender to indicate it can send the next packet. In a simple automatic repeat request protocol (ARQ), the sender stops after every packet and waits for the receiver to ACK. This ensures packets arrive in the correct order, as only one may be sent at a time.

The time to receive the ACK signal may represent a significant amount of time compared to the time needed to send the packet. In this case, the overall throughput may be much lower than theoretically possible. To address this, sliding window protocols allow a selected number of packets, referred to as the window, to be sent without having to wait for an ACK. Each packet receives a sequence number, and the ACKs send back that number. The protocol keeps track of which packets have been ACKed, and when they are received, sends more packets. In this way, the window slides along the stream of packets making up the transfer.

The sliding window method prevents the issue of traffic congestion on the network. The application layer will still be offering data for transmission to TCP without worrying about network traffic congestion as the TCP on sender and receiver side implement sliding windows of packet buffer. The window size may vary dynamically depending on network traffic.

For the highest possible throughput, it is important that the transmitter is not forced to stop sending by the sliding window protocol earlier than one round-trip delay time (RTT). The limit on the amount of data that it can send before stopping to wait for an acknowledgment should be larger than the bandwidth-delay product of the communications link. If it is not, the protocol will limit the effective bandwidth of the link.

Garden posting

Today I got my apple trees planted. Four of them in total. They are doing well but there is some blight on the leaves and they do attract the scourge of Japanese beetles. Which is not an unmanageable thing, but those ugly metallic brown and green flying insect things are not for the faint of heart. I literally have beetle juice stained fingers, often more than i'm comfortable with. There is an effective management strategy: go through your garden and pick them off the hotspots where they congregate, once or twice per day, in the cool of the day when they are slow and easy to get. Better pro tip: knock them into a light container of water and save yourself the guilt of crushing them; but then you'll have to wait as long as two days for them to most likely expire, which is also sort of troublesome.
I've also recently bought two blue spruce for which to plant as a screen in the front yard to provide some psychological protection off from the mean streets, which had led to an annoying retail experience while buying them and having to fend off an aggressive Karen clerk. I decided to not plant those two trees because they would grow too big. And so I returned them, and they told me that they weren’t doing returns because corporate policy and due to Covid! After a minor spat and some back-and-forth bickering, i ended up showing them that it said right on the receipt that returns were “within four days” and he had to take them back; and which he did, apparently at his discretion. If you have never worked retail, on the other side of the counter as it were, you may not know this: as a rule they hate you.