DC540 Defcon Group

We’ll be meeting up in the Discord voice channels on Monday evening @ 1830. We will likely break off into at least one non-public channel for badgedev discussion, but please feel free to join us in the main meeting channel anyway.

We’ll be in person at the Social House tonight. Social House is a restaurant — not my house, FYI. Will have the Malort if anyone’s feeling stupid. Will have last year’s badge to compare and discuss w/r/t planning and measuring for this year’s badge.

We’re linking up at Social House in South Riding this evening, 1830. Please let us know (preferably on the Discord) if you’re attending so we know how big a table we’ll need.

Oooh, that could be a stage name. HMO.

I wanted to take a moment to digress a bit and go into what makes modular synthesis so rewarding to folks with a hacker mindset.

I’m not a musician. I have dabbled in bass, guitar, keys and drums, but as for formal training, I’ve had guitar and djembe lessons, and not a whole lot of them. But the thing about music is, if you LOVE music, it will find a way to move you in one direction or another.

I’ve had many thousands of dollars worth of equipment over the years from Korg, Kawai, Yamaha, Casio, Nord, Alesis, Peavey, PRS, Epiphone, Tascam, Moog, Ableton and many more. And they’ve all been very rewarding in their own way. But none of them has given me the sustained high that exploring modular synthesis has given me. My first exploration was a Moog Subharmonicon, which quickly grew into the entire Moog semi-modular trio of Subharmonicon, DFAM and Mother32. I realized that being able to tweak and modulate sounds and sequences on the fly on an intuitive basis would more than make up for the fact, for me anyway, that I have limited musical playing ability.

And when I expanded that setup to include specialized Eurorack modules like Clank Chaos, Castor & Pollux, and utility modules like mults and LFOs, I realized this was the space I needed to be in. The limiting factor for making music, for me, was always that without musical skill, there was only so much variety I was able to create in realtime. Sure, I could layer multiple track and create sonically rewarding pieces, but look — I work in tech all day long, and I pursue tech hobbies on the side as well. The last damn thing I want to do when I make music is drill down into menus and learn advanced software tools. I wanted something far more tactile, and something closer to magic. Rather than directly crafting a particular sound, I find value in combining functionalities and making the different components “influence” each other in unique and interesting ways. I find that when I start a session with modular equipment, it never ends up in the same place twice. Sometimes I’ll start with a keyboard CV value to start, and route it into one or five places. Sometimes I’ll take the audio from one component and throw it into another for further manipulation. I’m particularly drawn to the modules with an element of randomness or surprise, like the Clank Chaos or the QuBit Bloom.

I credit another DC540 member for triggering me to make some changes and fall even deeper down the modular rabbit hole. Now the semi-modulars are on their way out, and I got a new case to replace the non-portable homemade Ikea rack I was using before. I find myself imagining how this configuration could be taken completely portable, and actually considering replacing the brand new 24-channel mixer I just bought a few months back with something similar that fits in the box.

For a while I had a friend’s Minimoog Voyager. I loved how it combined the best of both worlds. You could easily choose presets, but you could make vast modifications to those presets by twiddling knobs, and then save those changes to your presets. A bit out of my league pricewise, though, unless I sacrificed much of my other gear.

We’ll be meeting at Social House in South Riding tomorrow evening, starting at 1830 til whenever. A great opportunity for noobs and strangers to prove their worth for elevated Discord status and invites to the private meetups.

Bring badges, wear swag, show your defcon colors. We’ll be easy to spot. If the weather holds out as planned we’ll try to hang outdoors.

This week’s DC540 meetup will be HYBRID. In person for those who want to share a common space and a common table, and virtual for those who can’t make it out. Tune into the Discord for topics.

NEXT week, 3/7, will be virtual only due to stuff going on.

I do a lot of closed network design for projects. Island networks for developer teams, with no internet, but all the collaboration accoutrements a productive team might need. Authentication, repositories, build systems, file sharing, email, SSO, etc.

Yesterday one of them blew up. The collaboration suite stopped working. My first theory was that something ran out of space. And I was right, but not the collaboration suite itself. Turns out the LDAP server which handles authentication ran out of space, and the collaboration suite died because it couldn’t contact the LDAP server.

But wait, why did the LDAP server run out of space? All it’s doing is LDAP and DNS.

And the journey begins.

A while back, I had disabled recursive DNS queries because someone’s chatty MS product was spewing so many DNS lookups that would never resolve, and those queries were subject to a timeout, and those backed up queries created a logjam that prevented legitimate queries for local assets from getting through. Disabling/disallowing recursive queries seemed to shut everyone up, since the queries were immediately denied rather than waiting for the timeout, so I moved on.

Yesterday’s problem was a bit more intense. Someone had pulled an email from outside the system into Outlook on the closed system. Not a problem, right? Well, Outlook is downright screwy sometimes. Just the act of doing that caused that user’s Outlook to spew over 600 DNS queries per second, and since the DNS server had defaulted to query logging, it resulted in 20+ GB of query logs, to the tune of 46 million queries in less than 60 hours.

This seemed slightly excessive to me.

I know I could have just turned off query logging, but I thought of another approach that might stop the noise without sacrificing query logging, because, you never know how that information might help. Also, that doesn’t STOP the traffic, it only stops recording the traffic. So I took all the domains from the chattiest queries — by far the highest was from that clearly broken Outlook process, an infinitely-repeating query to an outlook mobile / O365 address on msedge.net — and created fake authoritative zones on my DNS server. I was almost surprised that that shut things up immediately. Because I left query logging on, I could see an immediate effect. I guess an authoritative no is enough to shut things up in cases where a denied query might not.

All this is to say, really, I think 99% of people really have no idea just how much communication goes on behind the scenes in their so-called private networks. This is a set of clients that have never touched the Internet. Fresh out of the box, with updates applied from WSUS offline bundles, and I’ve got hundreds of thousands of queries to Facebook, Twitter, Ebay, Amazon, Google, MS and more. None of it was initiated by the user. This is all of that “user as product” bullshit.