It’s white. It’s got steel rims. It looks like a utility locator company truck. And I love it. Here’s a running list of upgrades I’ve added or rejected from my base model Ford Maverick XL Hybrid:
Mabett Bed Storage Cubbies. The biggest upgrade was filling the spots in the bed with these two plastic cubbies. They fit just enough bungee and tie downs to do “truck stuff”. They come with 4 screws each, so be sure to get some M6 screws to fill all the holes.
Jump Starter. Hasn’t arrived yet, but the USB-C plug I installed kept draining the battery to nothing. Had to jump it. Humiliating. Get one of these instead.
Mabett cup holders and trash can. Tiny but mighty, this center console fills the gap below the charger block. The can stays centered in the Flexbed bracket, and I have an extra spot for empties on a road trip.
Mabett Mud Flaps. I had zero road grime after a trip to Seattle and back in the rain. Couldn’t have a better endorsement. Install by removing and replacing the stock clips.
Mabett Under Front Seat Storage. Just a bit of extra room for a first aid kit and other stuff I want but won’t need all the time. Keeps me from having to fill up the backseat storage so much.
12V bed plug; particularly useful for running pumps for the stand up paddle boards. Just pop off the electrical cover and connect it up. You will need the key on to run the hybrid motor, most likely.
Mobile antenna for my Baofeng. Helped me get mobile and use my Ham license.
Tailgate Molding Rivets, Plastic. The ones on the tailgate keep breaking. I keep the pack in the truck. These are much sturdier.
Tailgate hole cover; mostly for paranoia factor of getting sand or rocks stuck inside the tailgate.
Hitch Hole Cover. Just plain vanity. The tail end looks chopped up without it.
Adeptus Mechanicus sticker. Heralding its arrival as a hybrid being, my steel steed gets an emblem of the machine god. Some day, when my flesh disgusts me enough (or my knees give out), I will join her in communion with the Omnissiah.
Snarky Plate Surround — BOUGHT A TRUCK — FOR THE GAS MILEAGE. My family is going to disown me when they see it, but I bet I’ll get fist bumps in the Fred Meyer parking lot.
It’s not all Xibit-style customization up in here. The Flexbed stuff is nice, but it needs to go further. The attachment bracket used for the trash can was supposed to be a Ford thing used across their line. Not sure it took off. I want it on the dash for a phone holder. I want it on the bumper for tailgating, add more cup holders or something. Make it sturdier. Make it universal.
Rejected Upgrades — these ones failed due to practicality, functionality, or budget reality:
Rough Country Tonneau Cover. As a former Ranger owner that had a fiberglass flat top installed, I love the idea of the latest covers, but I don’t find myself using the bed for anything but hauling right now. Since the bed is so small, removing it every time to store it in the garage seems like a pain. Check Reddit for the best recommendations. People really like the 3-piece ones. Hard Cover is better if you get snow.
USB-C in the bed. I couldn’t find one that didn’t stay active all the time and drain my battery. When I left town, I had to jump it when I got back. Since I uninstalled it, no issues.
Inverter in the bed. A 12v inverter is going to last longer inside the truck than wired into an open bed. Just plug it in when you need it into the 12v outlet. Get one near the tailgate with the 12V connectors..
Wired motion detecting lights. Just get a few magnetized LED handhelds from Harbor Freight and attach them in the cubbies. Mischief managed.
Under seat storage dividers. I’ve got the hybrid, so space is at a premium here. Just put a blanket under there to stop your secret stash from rolling around.
Rain guards for the window. Almost pulled the trigger on these after one too many drips in the drive thru. The in-channel ones were recommended. Instead, I keep a cloth in the door now. Helps wipe the dust from the Fischer Price interior too, lol.
I bought a HP LaserJet Pro M405dn via surplus from a previous company, and it has become the most reliable printer I've ever owned. It’s compact, quiet, and the refills are cheap to this day. The only problem was it didn’t come with a wireless card.
When we had a reclaimed desktop as a Plex server, I plugged it in there on USB and shared it on the network. Windows 10 made that doable, but not easy. WSD issues, permissions for Work and surplused laptops running business versions of Windows. The problems piled up, and I got fed up. I went searching for a print server.
If this were 2010, I’d buy a raspberry pi and be done. But the tariffs and RAM crisis have made even the stock models as rare, and I was fed up. Enter the Wyse 3040, a refurbished line of thin clients from Dell. Small but mighty, this thin client was an Intel Atom SBC with soldered ram coming in at 2GB and 8GB storage.
For an OS, I tried a few distros, including the Dell but could never get them to be compact enough. Debian 13 was my savior. A headless, compact build out of the box took up less than 4GB on install, and the installer boot disk came with non-free drivers that saved the day:
Plug in a mouse and keyboard and DisplayPort monitor.
Unlock UEFI
Unlock the BIOS with the default password, Fireport, if needed (mine came unlocked from the reseller linked above)
Plug in your boot disk to USB. There’s a USB 3.0 blue port on the front which felt faster on the third install. Grumble grumble…
You want the advanced install options so you can survival select a pared down set of options and install the non-free drivers.
During install, be sure to select xfce for your GUI instead of the heavier Gnome ones. You can even go headless, but I did not.
I had a memory of printers with expansion slots for WiFi back in the dark days of the 2000s, so I googled my printer. It turns out the dn in the model number means direct networking. Under a panel, I found an Ethernet port. An office move meant the router was sitting right next to the printer, and I could have just plugged it directly in all along. Oh well. What’s a bit of trouble in GRUB for old times sake?
Above is Dan Kaminsky's keynote at the inaugural DEF CON China. It was nominally about Spectre and Meltdown, and I thought it was immediately applicable to testing at all levels. Here are some moments that jumped out at me:
On Context:
"There's a problem where we talk about hacking in terms of only software...What does hacking look like when it has nothing to do with software." 1:55
"But let's keep digging." Throughout, but especially 5:40
"Actual physics encourages 60 frames per second. I did not expect to find anything close to this when I started digging into the number 60...This might be correct, this might not be. And that is a part of hacking too." 6:10
"Stay intellectually honest as go through these deep dives. Understand really you are operating from ignorance. That's actually your strong point. You don't know why the thing is doing what it is doing...Have some humility as you explore, but also explore." 7:40
"We really really do not like having microprocessor flaws...and so we make sure where the right bits come in, the right bits come out. Time has not been part of the equation...Security [re: Specter/Meltdown] has been made to depend on an undefined element. Context matters." 15:00
"Are two computers doing the same thing?...There is not a right answer to that. There is no one context. A huge amount of what we do in hacking...is we play contexts of one another." 17:50
[Re: Spectre and Meltdown] "These attackers changed time which in this context is not defined to exist...Fast and slow...means nothing to the chip but it means everything to the users, to the administrators, to the security models..." 21:00
"Look for things people think don't matter. Look for the flawed assumptions...between how people think the system works and how it actually does." 35:00
"People think bug finding is purely a technical task. It is not because you are playing with people's assumptions...Understand the source and you'll find the destination." 37:05
"Our hardest problems in Security require alignment between how we build systems, and how we verify them. And our best solutions in technology require understanding the past, how we got here." 59:50
On Faulty Assumptions:
"[Example of clocks running slow because power was not 60Hz] You could get cheap, and just use whatever is coming out of the wall, and assume it will never change. Just because you can doesn't mean you should...We'll just get it from the upstream." 4:15
"[Re: Spectre and Meltdown] We turned a stability boundary into a security boundary and hoped it would work. Spoiler alert: it did not work." 18:40
"We hope the design of our interesting architectures mean when we switch from one context to another, nothing is left over...[but] if you want two security domains, get two computers. You can do that. Computers are small now. [Extensive geeking out about tiny computers]" 23:10
"[RIM] made a really compelling argument that the iPhone was totally impossible, and their argument was incredibly compelling until the moment that Steve Jobs dropped an iPhone on the table..." 25:50
"If you don't care if your work affects the [other people working on the system], you're going to crash." 37:30
"What happens when you define your constraints incorrectly?... Vulnerabilities. ...At best, you get the wrong answer. Most commonly, you get undefined behavior which in the presence of hacking becomes redefinable behavior." 41:35
"It's important to realize that we are loosening the assumption that the developer knows what the system is supposed to do...Everyone who touches the computer is a little bit ignorant." 45:20
On Heuristics
"When you say the same thing, but you say it in a different time, sometimes you're not saying the same thing." 9:10
"Hackers are actually pretty well-behaved. When hackers crash code...it does really controlled things...changing smaller things from the computer's perspective that are bigger things from a human's perspective." 20:25
"Bugs aren't random because their sources aren't random." 35:25
"Hackers aren't modeling code...hackers are modeling the developers and thinking, 'What did [they] screw up?' [I would ask a team to] tell me how you think your system works...I would listen to what they didn't talk about. That was always where my first bugs came from." 35:45
On Bug Advocacy
"In twenty years...I have never seen stupid moralization fix anything...We're engineers. Sometimes things are going to fail." 10:30
"We have patched everything in case there's a security boundary. That doesn't actually mean there's a security boundary." 28:10
"Build your boundaries to what the actual security model is...Security that doesn't care about the rest of IT, is security that grows increasingly irrelevant." 33:20
"We're not, as hackers, able to break things. We're able to redefine them so they can't be broken in the first place." 59:25
On Automation
"The theorem provers didn't fail when they showed no leakage of information between contexts because the right bits went to the right places They just weren't being asked to prove these particular elements." 18:25
"All of our tools are incomplete. All of our tools are blind" 46:20
"Having kind of a fakey root environment seems weird, but it's kind of what we're doing with VMs, it's what we're doing with containers." 53:20
On Testing in the SDLC
"We do have cultural elements that block the integration of forward and reverse [engineering], and the primary thing we seem to do wrong is that we have aggressively separated development and testing, and it's biting us." 38:20
"[Re Penetration Testing]: Testing is the important part of that phrase. We are a specific branch of testers that gets on cooler stages...Testing shouldn't be split off, but it kinda has been." 38:50
Ctd. "Testing shouldn't be split off, but it kinda has to have been because people, when they write code, tend to see that code for what it's supposed to be. And as a tester, you're trying to see it for what it really is. These are two different things." 39:05
"[D]evelopers, who already have a problem psychologically of only seeing what their code is supposed do, are also isolated from all the software that would tell them [otherwise]. Anything that's too testy goes to the test people." 39:30
"[Re: PyAnnotate by @Dropbox] 'This is the thing you don't do. Only the developer is allowed to touch the code.' That is an unnecessary constraint." 43:25
"If I'm using an open source platform, why can't I see the source every time something crashes? ...show me the source code that's crashing...It's lovely." 47:20
"We should not be separating Development and Testing... Computers are capable of magic, and we're just trying to make them our magic..." 59:35
Misc
"Branch Prediction: because we didn't have the words Machine Learning yet. Prediction and learning, of course they're linked. Kind of obvious in retrospect." 27:55
"Usually when you give people who are just learning computing root access, the first thing they do is totally destroy their computer." 53:40 #DontHaveKids
"You can have a talent bar for users (N.B.: sliding scale of computer capability) or you can make it really easy to fix stuff." 55:10 #HelpDesk
"[Re: Ransomware] Why is it possible to have all our data deleted all at once? Who is this a feature for?!... We have too many people able to break stuff." 58:25
I use Behat to create some ham-handed load scenarios fairly regularly. PhpStorm can help me spin up to get concurrency if I want a crushing load. But PhpStorm on Mac seems to disconnect from these running tests if I lock my computer or leave them to run too long. Killing them is a pain. I have to run `ps`, find the pid, then kill it.
When the list gets too long, I like to use awk to comb through the list and kill anything that is found. It's easy to search and parse out the tokens like so:
ps -ef | awk '/behat/ {system("kill -9 " $2)}'
ps -ef delivers a verbose list of processes. This is piped to awk where I can specify a command using awk's scripting language. In this command, I first search for 'behat'. Then I run a command pulls the second token, the process ID from each line of the result and inserts it into the `kill` command.
Had a #meltdown upgrade to Fedora 27 stymied by a package conflict:
Error: Transaction check error:
file /usr/bin/debuginfo-install conflicts between attempted installs of yum-utils-1.1.31-513.fc27.noarch and dnf-utils-2.1.5-1.fc27.noarch
...
I got around this by removing yum-utils. It then allowed me to move on to the upgrade. Got this idea from similarthreads online. Hoping anyone that runs into this after me will find this useful.
Here's to hoping the jump from 23 to 25 will be as significant as the one from 25 to 27.