xssfox

Just over a year ago I wrote about becoming vegetarian and I mentioned that at some point I wanted to switch to vegan. Well it was pretty much that day which I switched to a vegan diet. So lets do a quick update.

First off, why vegan?

Well as per my previous email I mentioned in the previous blog I’m lactose intolerant. Cutting down milk based products really made my stomach a hell of a lot less yuck. The other major non vegan ingredients is eggs (not a huge fan) and honey. So I thought - why the heck not. I’ve always found the concept of eating milk and eggs extremely weird and less animal cruelty is certainly a good thing.

I don’t believe the environmental footprint difference between vegan vs vegetarianism is significant but that’s not really the point here.

What foods do I miss?

I had a good think about this the other day, and really nothing. I can pretty much eat the same food as a non vegetarians. Obviously something like a “steak sandwich” will require a steak substitute, but theres substitutes for everything these days.

The biggest problem however is eating out. It’s surprising how hard it is to go to restaurant/cafe and have them make something without an ingredient. It’s mind boggling to me. So many dishes that could be vegan by just leaving out 1 or 2 things. I’ve certainly changed where I eat based on that - but the meals themselves have been just as good, if not better.

Regional towns are probably the worst because there’s often only 1-2 places to eat out. It’s extremely odd though since given their remoteness you’d think cooking with products that don’t go bad as quickly / have long shelf lives would be their speciality. Look its not that hard to offer bolognese with just some pasta sauce or a salad sandwich.

A cafe I used to regularly go removed their vegan options so I haven’t been there since. It’s pretty sad when that happens.

A good chef can make any meal vegan with fuss or complaint. I’ve been using HappyCow app to find good places to eat.

Substitutes are thinking about food wrong

I did mention vegan cheese in my last post. I still eat these semi regularly but probably a lot less now. The thing is, if you make your meals around not using substitutes and instead play on the strengths of the flavours and spices of your ingredients you end up with much nicer meals.

Often you can make a meal way better using different set of ingredients than relying on faux meat, cheese or egg.

Baking

I’ve baked a few things now without eggs and milk. And now I’m angry. Turns out you really don’t need milk or eggs. At most of you might need an egg replacer.

It’s wild - I had been taught my entire life that eggs and milk were critical to baking but they really aren’t. Give it a go - its fine. Take any baking recipe, replace the eggs with egg replacer and the milk with either an alternative milk or just water. Why there isn’t more vegan baked goods on shelves is bizarre to me now.

It’s fine trust me.

B12 and nutrition

Going to preface this with - I am not a doctor, and I am not your doctor. When making diet changes consult an expert.

Changing your diet and regular foods is certainly going to have an impact on the nutrients your body is receiving. This is no different from any other diet.

If you eat a fairly balanced diet with lots of different greens, rather than just carbs it appears the biggest risk is lack of B12. This is because B12 doesn’t naturally show up in plant products. Some vegan specific products are fortified with B12 for this reason. B12 is extremely important to the body, but you don’t need much. As I was aware of the risk of low B12 I asked my doctor to monitor this in my usual blood tests.

However even making an effort to select B12 fortified products where possible I still became B12 deficient and started taking B12 supplicants. Not really a big deal, but something you should be aware of.

Still learning

While I don’t usually drink wine or even drink much at all these days, it was only yesterday that a Mastodon reply caught my attention. Most wines aren’t vegan as various animal products are used during the fining process. Just goes to show that animal products sneak in everywhere.

Garmin fēnix® 6S smart watch

I purchased this on a whim to try and replace the pebble I was using for heart rate monitoring. It’s probably one of the best purchases I’ve ever made.

Features:

• Long battery life (about a week if you don’t record activities)
• Always on screen
• Can pair headphones to it
• Garmin Pay (NFC payment)
• Offline maps
• All your normal running/riding activity recording stuff
• Can use standard watch straps

Now here’s where things get interesting. The watch is usually synchronised with an app called Garmin Connect - a cloud based service. But before you write it off because cloud, let me explain a few things.

Garmin Connect basically has all the features you see in Strava, is more privacy focused, has a privacy policy that says it won’t sell your data, doesn’t push ads (there’s some promotion Disney watch achievements but its extremely minor), is free. Garmin Connect exists as a service to sell watches, not to sell a subscription.

Ok, so if there’s no subscription - the watches get no updates right? Well no. My fēnix received an update today, and there’s even been features released a year after its launch. The watches themselves are also fairly durable (except for the charging port / charging cables - that has room for improvement).

Remember how I said about the cloud? Well you don’t actually need to use their app. You can plug in the watch over USB and copy the FIT files directly from it. I guess the disadvantage here is that it can’t be done over Bluetooth.

Garmin watches seem like a breath of fresh air when it comes to devices with cloud integration. Sure there are some niggles, but gosh its so much different from everything else I own.

Shokz OpenSwim Pro bone conducting headphones

I weirdly put off bone conducting headphones for so long as I had a bad experience with trialling radio headsets that used bone conduction. Running Warehouse ran a Shokz try out day and within minutes of my run I entirely forgot I was wearing them. Towards the end of the run I brushed the back of my hair and nearly freaked out because I forgot I had the headset on. I purchased a set within a week.

The advantages of bone conducting headphones is that they don’t block out sound. So you can hear other people and the environment around you. Hugely important for safety. The other part is since they don’t go into your ear like earbuds but rather sit on top, you don’t get moisture build up in your ear. That had become a bit of a problem for me and I was constantly getting blocked ears.

I bought the swim model in the off chance I got swimming again. Swimming can be a bit tedious so having some tunes to boop to is good.

A bit of a warning though - these devices are very personal preference. The audio quality isn’t like what you’d get from normal headphones. Its probably a good idea to try one out first.

VR-N76 handheld radio with packet TNC

As soon as I saw the VR-N76 firmware update provided a KISS TNC interface I had to have one. Unlike the HG UV98 the the TNC actually works as proper TNC, not just APRS.

I was skeptical of using the app, however its been great. The APRS features seem to work well enough. What I’ve been enjoying is that you can listen and TX from your phone - which might initially seem like a silly feature, however what it lets me do is listen to music on the Shokz while also listening to the radio. The radio stays in a pocket in my bag, and if I want to TX I just key up using the app which uses the Bluetooth. The app also keeps a history of transmissions, so if you miss and important detail you can replay it to get the info you need.

I feel a little bad delaying this blog post for so long. A few other things got into the pipeline. The tl;dr is WSJT-X 2.7.0-rc7 is pretty fine. It uses TOTP now and third parties can run their own verification.

In previous posts we looked into the now discontinued SuperFox verification scheme. Since that post rc7 has been released. Many various solutions were proposed with various trade offs. Remember that we are dealing with dozens of bits here, not bytes. The final solution was chosen for its simplicity.

TOTP

One of our first suggestions when digging into alternatives was using a time based one time password (TOTP), similar to the H40WA dxpedition. TOTP works by both parties having a shared secret key. Both parties combine the time and the secret key, then hash the result. This allows verification without sharing the secret key or being able to replay an old message.

At this point you’ve probably spotted a problem however, both parties need the key. The way this is worked around, both with the H40WA system and the WSJT-X system is that the receiving station doesn’t hold the key. Instead a server holds the key and the client can request the final value from the server.

% curl https://www.9dx.cc/check/K1JT.text
2024-11-22T08:49:00Z K1JT 229106
2024-11-22T08:49:30Z K1JT 305435
2024-11-22T08:50:00Z K1JT 806080
2024-11-22T08:50:30Z K1JT 869989
2024-11-22T08:51:00Z K1JT 699026
2024-11-22T08:51:30Z K1JT 250722
2024-11-22T08:52:00Z K1JT 485396
2024-11-22T08:52:30Z K1JT 429621
2024-11-22T08:53:00Z K1JT 450221
2024-11-22T08:53:30Z K1JT 763383
2024-11-22T08:54:00Z K1JT 182034

The important part that lets this work is that the server only return the TOTP values for already transmitted windows. A transmission using an old code won’t have the correct timestamp and the client won’t verify it.

Generally speaking WSJT-X stations have time set pretty well as transmission and reception only really works if clocks are within 1 second. If a client did have their time set in the past an attacker could use old codes, however in practice this is rare and the consequence is minimal.

WSJT-X actually uses the following request to perform checks

% curl https://www.9dx.cc/check/N9ADG/2024-09-05T19:07:00Z/866973.text
2024-09-05T19:07:00Z N9ADG 866973 VERIFIED

The actual code that validates the response is pretty basic and is just checking that it sees VERIFIED at the end

  if (verify_message.endsWith(" VERIFIED")) {
    return QString("%1   0  0.0 %2 ~  %3 verified").arg(rx_time.toString("hhmmss")).arg(hz).arg(callsign);
  } else
    if (verify_message.endsWith(" INVALID"))
    {
      return QString("%1   0  0.0 %2 ~  %3 invalid").arg(rx_time.toString("hhmmss")).arg(hz).arg(callsign);
    }
    else
      return QString{};

Side note here - The way WSJT-X handles data during a lot of the verification steps is passing through strings then checking if they contain certain substrings. I haven’t spotted a trivial way of doing due to the limited nature of an FT8 transmission (no lowercase, short freetext and no new lines) - but I wouldn’t be surprised if there is some fun to be had here. It might be possible to have the client process a crafted line with an old time.

WSJT-X have listened to feedback and allow running of SuperFox without verification keys. Not only that they do have configuration option to change the verification server. An example server might be something like:

from http.server import HTTPServer, BaseHTTPRequestHandler

class MyHandler(BaseHTTPRequestHandler):
    def do_GET(self):
        self.send_response(200)
        self.end_headers()
        self.wfile.write(bytes("meow meow VERIFIED", "utf-8"))

httpd = HTTPServer(('localhost', 8999), MyHandler)
httpd.serve_forever()

Do note that you’ll need to be able to handle many amateur radio operators requesting tokens every 0 and 30 seconds.

It’s really good that the developers have listened to feedback. To recap:

• Entirely open source
• No secret sauce
• Can be used without a third party
• Can provide own verification service

I did quickly want to touch on some of the downsides of this approach. While the transmitting station doesn’t require an internet connection the receivers do. The server does allow checking of old logs so temporary internet outages can be patched over. I think this is a fair compromise and likely works for 99.9% of users. For the users it doesn’t work for - it just means waiting for a QSL card to confirm that it wasn’t a pirate.

Some other approaches used CSPRNG (Cryptographically secure pseudorandom number generator) stepped backwards. Occasionally the broadcasting station would transmit a signed message with the parameters for the CSPRNG which would allow verifying past messages. This was a pretty cool approach even if complicated.