Andrew Meredith

447 Followers
548 Following
1,037 Posts

Data engineer @ Parsyl.
Anglican parishioner who loves runnin' up that via media.

Posts may contain tacos, databases, theology, and a bunch of stuff that I am probably not qualified to speak about.

Websitehttps://kendru.github.io

I finally had a little while today to start working on a prototype of this tool. Trying to use Zig has been a bit challenging because:

1. The API keeps changing with every release. I last used Zig 0.13, and I've been trying to use Zig 0.15 for this project, and SO MANY THINGS have changed.
2. This app relies on some Linux-specific syscalls, which are not all wrapped in library functions. In fact, the `clone` function does not work correctly, so I needed to use some syscalls directly.

As of now, I have a program that starts up, clones into a new process that starts in a new user namespace and creates new PID and mount namespaces. It bind mounts a fake /etc/hosts file that says google.com should resolve to 127.0.0.1. I'm then spawning a child process that runs curl against google.com, and if I run a server on my local machine, curl is seeing the response from my local server.

This is very much in a prototype state, but I think I've figured out how to do all the things that I've never done before, and I don't anticipate any huge snags from this point.

I'm looking for a new fulltime job!

I'm a UI designer with 20 years experience, more recently a design engineer writing a lot of Swift and SwiftUI, and some React Native for good measure.

I'm usually at early stage startups or consulting (I'm in San Francisco), but amenable to corporate. #getfedihired

My dear Wormwood,

It is imperative that you keep the patient away from doing anything to improving the material conditions of his neighbors, by any means necessary.

Call it socialism, call it woke, call it politics, whatever is needful. Whisper in his ear that it is the role of the church to do such things, and not the state.

And do not concern yourself with whether the church will do them, either; we have spent centuries teaching the churches to be concerned with their own survival above all else and to do such things as would oppose the projects of Our Father Below only as they have time and money.

In your letter you mentioned that you had shown the patient the fictitious quotation from me that our colleague Thistlefoot has succeeded in popularising, recommending that you keep the patient fixated on politics. This is very good.

Whenever he begins to feel concern for anyone we have entrapped in suffering, or is tempted to involve himself in the improvement of material conditions of others whom we have spent centuries building systems to make miserable, simply remind him of this quotation, and whisper in his ear that politics are Messy Business and Divisive.

Your affectionate uncle,

Screwtape

---

The above is my original content, not C.S. Lewis's, though I suspect Screwtape, were he a real entity, would agree.

I've done a bit of research on network namespaces in Linux, and I think that as long as I don't try to create something cross-platform, it'll be doable.
I would *love* for this tool to be run without root, but unfortunately, Linux doesn't let you create veth devices without root. The alternative seems to set up TUN/TAP and manage your own network stack, which seems like complete overkill. I found the passt project and its pasta library (https://passt.top/passt/about/#pasta), which seem to do just this. This library is used by Podman and other rootless container projects, so it seems like it's mature enough for my purposes.
I'm planning to run a very simple DNS server and a TLS-terminating reverse proxy that intercepts requests and forwards them to stubbed services that the user controls. I need to figure out if I can "inject" the CA that I use to generate certificates so that the certs are automatically trusted by the system under test. I've never looked into how Linux handles certificate trust, but I imagine/hope this is as simple as putting my CA's certificate in some standard directory using an overlay mount.
passt - Plug A Simple Socket Transport

passt and pasta unprivileged (rootless) user-mode networking for VMs and containers, replacement for slirp, slirp4netns, libslirp, integrates with qemu, libvirt, Podman, Kata Containers

📣 IF YOU HAVE A LITTLE FREE LIBRARY TURN IT INTO A COMMUNITY PANTRY ASAP IF YOU ARE ABLE

I was inspired by a project at work where I need to do side-by-side testing of two versions of a system. It's a data integration tool, and I need to verify that a new port has identical behavior to the reference implementation. I wanted to intercept the external API calls made by each system and compare them.

The original system doesn't support an HTTP proxy configuration, so I was going to create a tool that configures a network sandbox where I can provide fake DNS resolution and TLS certificates that allow a mock web server to handle the requests transparently.

I haven't done much coding or system administration for a while, so I think this will be a fun project. I'm going to write it in Zig and host it on sourcehut. If anyone is interested in this project, I'll try to post updates threaded under this post.

Christians against Christian Nationalism 😤✊🏻
Decided to become a financial contributor to my #mastodon server (@deacon.social #DeaconSocial ) today. I have remained on Twitter/X since coming over to Mastodon, but seeing what that platform has become over these years I am convinced all the more that what is happening over here on Mastodon is incredibly important. Mastodon has become in my opinion what Twitter once was. And I want to support the work that deacon.social's admin is doing. Thanks @ameredith for the good work you are doing!
I have not listened to podcasts since Google discontinued their podcast app, but I'd like to get back into it. Is there an Android podcast app you'd recommend?
I'm reading The wheel of Time books, and it's starting to feel like there are entirely too many blade masters. It's like the Oprah meme with "YOU get a heron-marked blade and YOU get a heron-marked blade!"