Markus Weimer

Simple identity theft - the perfect crime?

Fri, 22 Nov 2024 00:00:00 +0000

Today, I learned a lesson about how crime does in fact pay and how ill-equipped we are to stop it.

Someone spammed me and bought an iPad with my credit card

This morning, I woke up to more than 200 emails from various websites either confirming my sign-up or requesting my confirmation to do so. I also got an iMessage about picking up an iPad today I had not ordered. And Chase helpfully listed the $2,200 for my on my credit card bill as a pending transaction.

I knew when and where the fraudster would be

At this point, I knew that someone tried to steal the iPad and when and where they would need to be to pick it up. I knew this 3h before the pickup would happen. In fact, I am writing this 20 minutes before that pickup. Alas, I was unable to stop it:

Limiting further damage to myself

My first move was to lock my credit card. I also learned that one cannot mark pending charges as fraudulent, only posted ones.

I also checked all my major accounts for suspcious logins. Thankfully, I could quickly rule out a sophisticated attack which circumvented my many layers of password managers and hardware tokens.

Contacting the Apple Store in question did not work at this time, as they were not open yet.

Reporting the crime that is about to happen

I then proceeded to file a report with the Bellevue Police online. I have reason to believe that that is where my credit card information, phone number and email address where stolen: I dined at a restaurant there last night. I booked the table via OpenTable, which shared my email address and phone number with the restaurant. I paid with the card later used to pay for the iPad. That order contained my email address and phone number.

I then called the Bellevue Police to follow up and let them know when & where the fraudster would be to pickup the iPad. Turns out it is not their jurisdiction because identity theft happens where you live from a legal standpoint regardless of where it happens in the real world. They connected me with the King County Sheriff who after verifying my address promised to send someone to my house. Not the Apple Store where the pickup is about to happen, to my house. Needless to say, they never showed.

Apple’s reaction

Past 10AM, I was able to contact the Apple Store, and they were happy enough to cancel the order. Whether or not they would want to do something about the fraudster walking into their store soon is “up to the store”. Sure enough, they connected me with the store which told me that they can’t do anything without law enforcement and then put me on hold longer than I could wait.

The perfect crime?

This particular fraud did not succeed, thankfully: The order is cancelled and the credit card used is deactivated and will be replaced. I will have to deal with the spam from the many websites in the next few months.

However, the fraudster is going to be undiscovered and unpunished and can just try again. This is despite knowing when and where the fraudster would be 3h in advance of the crime. I am sure this play works for many people with less ~~anal~~ prudent and entirely appropriate cyber security processes in place.

Stay vigilant!

Setting up OpenSpeedTest on a Synology NAS with docker compose

Sat, 26 Oct 2024 00:00:00 +0000

OpenSpeedTest is handy to measure the performance of the local (W)LAN: It is like any other speed test service, but it runs locally. Setting it up on a Synology NAS is easy.

Create a new Project in Container Manager as usual. Use this docker-compose.yml to set it up.

version: '3.3'
services:
    speedtest:
       environment:
           - DOMAIN_NAME=ssyn2.markusweimer.com
       restart: unless-stopped
       container_name: openspeedtest
       network_mode: "host"
       ports:
            - '80:3000'
            - '443:3001'
       image: openspeedtest/latest

This makes it so that OpenSpeedTest is available on port 3000 of your NAS.

Escaping email overload

Fri, 07 Apr 2023 00:00:00 +0000

I recently welcomed a group of new team members who were not used to the email centric culture. This can be overwhelming: We have dozens of email lists and automated systems sending status updates and alerts that everyone receives email from. Many of us who have lived this way for a long time have coping mechanisms. These are mine.

Filters to the rescue

Just about every email system supports email rules or filters. We use Outlook (naturally), but other systems have equivalent functionality. These are the rules I find most helpful, in the order in which Outlook processes them for every email:

Mark emails from: me as read: This may seem odd. But I often get email from “myself”: Some mailing lists send me a copy of my own email, I sometimes mail myself a note, … . In those cases, I can (still) confidently assert that I have read the email.
Put emails to: me into the Inbox and stop processing: Messages that directly address me require my attention, one way or the other. They should stay in the Inbox and not be affected by any of the following rules.
Put emails cc: to me into the CC folder and stop processing: Messages that CC me explicitly are sent with the assumption that I will (eventually) be aware of their contents. The CC folder is my way of making sure of that. I read emails in the folder less often than in the Inbox, but I still at least skim them.
This is where all the custom email filters go: filter mailing lists into folders, delete emails from lists I somehow am unable to leave, … . This is an ever growing (and rarely shrinking) list of horrors.
Put the remaining emails into a “Not to me” folder: these are the emails that have me neither in the to: nor cc: field, nor do I have a specific filter for them. In other words: this folder is my reminder to create more filters.

With these filters in place, I can confidently read and act upon the email in my Inbox, skim the ones in my CC folder and know which new filters I need based on the “Not to me” folder.

Archive is your friend

I treat the Inbox, CC and “Not to me” folders as todo lists: Email that is still there (read or not) requires an action from me: Respond, do some work, unsubscribe, you name it. Once that action is done, I move the email to the Archive folder. This is conveniently done via the single-key shortcut “e” in Outlook for the web. I try to, and usually do, get to an empty Inbox once a week.

Summary

This simple system of filters and ruthless archiving has so far allowed me to avoid email bankcuptcy. Maybe it helps you, too.

Home Assistant: Housing the Raspberry Pi in an Argon One M.2 case

Fri, 11 Feb 2022 00:00:00 +0000

I am a fan of the Argon One M.2 case raspberry Pi case. I finally got my hands on one for the Raspberry Pi which runs my Home Assistant. The transfer wasn’t entirely straight forward. The notes below might help the next person doing this.

Create a backup

The first step is to create a backup of your Home Assistant. You will need this later after the new install.

Enable USB boot

The SSD in the Argon One case is connected via USB. Since recently, the Raspberry Pi can boot off of USB devices. You might have to update the eeprom of your Pi to make this work. Mine already had the newest version. You will have to change the settings of the Pi to boot from USB. I used a MicroSD card with Raspberry Pi OS on it for this. The tool raspi-config can do this.

Install Home Assistant

I used a USB A - USB A cable to connect the SSD portion of the case to my PC. The Raspberry Pi images can be used to install Home Assistant as if it was a MicroSD card. So far so easy.

Restore the backup

When booting this new Home Assistant installation for the first time from the SSD, do not create a username and password. Instead, use the link at the bottom to upload the backup created in step one. I had no feedback whether this worked or not. But when I opened the Home Assistant UI after a few minutes, everything was like it was at the time of the backup.

Quiet the fan

The Argon One case has a fan. That is great, but noisy. On Raspbian OS, you can just install the software for the case to regulate it. On Home Assistant, I found this more challenging. Here is what worked for me:

Install the HassOS I2C Configurator. I gave it root rights by disabling “protection mode”. I marked it to start at boot.
Reboot the Pi.
Reboot the Pi. (Yes, twice. The logs of the add-on said so)
Install the Fan hat add-on. I configured it to start at boot.
Reboot the Pi.
Reboot the Pi. (This time, I did it just for good measure.)

Home Assistant: Water leak detection and notification with the Aqara Water Leak Sensor

Sat, 05 Feb 2022 00:00:00 +0000

This week, I added a bunch of Aqara Water Leak Sensors to my home assistant setup.

Pairing the Aqara Water Leak Sensor with Home Assistant

The first hurdle was how to trigger pairing mode of the Aqara Water Leak Sensor. The manual only describes this process for their own hub / app combination. I run Home Assistant with a ZigBee stick and would rather not add a hub for each device maker. Turns our the solution is simple: Press on the top of the sensor till a blue light just below the water drop starts flashing. This switches the device into pairing mode. I was able to pair the sensor as usual in the Zigbee panel of Home Assistant.

Rename the Sensors

The names chosen for the actual sensor entities were a bit random and hard to parse for me. Hence, I renamed the sensor entities to something like binary_sensor.water_leak_detector_kitchen_sink in the Home Assistant UI. This makes subsequent references to them from YAML code a lot easier.

Test the sensor

When initially testing the sensor, they failed to detect water even when submerged for a few minutes. When I repeated the same test a few minutes later, they detected water in much smaller volume instantly. Not sure why this is. Could be that the sensor calibrates itself after startup and needs some time to do so.

Group the sensors

When thinking about water leak notification, I don’t actually care which sensor is detecting a leak. I can look that up in the Home Assistant UI whenever I want. Hence, I grouped the devices into one meta sensor using the Binary Sensor Group platform like so in my configuration.xml:

binary_sensor:
  - platform: group
    name: Water Leak
    device_class: moisture
    entities:
      - binary_sensor.water_leak_detector_kitchen_sink
      - binary_sensor.water_leak_detector_main_bath_sink_right
      - binary_sensor.water_leak_detector_main_bath_sink_left
      - binary_sensor.water_leak_detector_main_bath_toilet
      - binary_sensor.water_leak_detector_utility_room
      - binary_sensor.water_leak_detector_washing_machine

This creates a new sensor named Water Leak with the entity id binary_sensor.water_leak. This sensor will detect a leak whenever any one of the grouped sensors does so.

Setup an Alert

This new group then allows me to send alerts to my phone using the Alert platform like so:

alert:
  water_leak:
    name: Water leak detected
    message: Water leak detected
    done_message: Water leak no longer detected
    entity_id: binary_sensor.water_leak
    state: "on"
    repeat: 1
    notifiers:
      - mobile_app_pixel_4_xl

This will send a notification to my phone (entity mobile_app_pixel_4_xl) once a minute while a leak is detected. It will send the “all clear” notification when the leak is no longer detected. This might be a bit excessive, but better safe than sorry :-).

Home Assistant: Detect whether the TV is on based on power measure of a smart plug

Sun, 30 Jan 2022 00:00:00 +0000

I plugged my TV into a smart plug which conveniently also measures power flow through it. I wanted to use this to detect whether the TV was on.

The bad way: Initially, I fumbled my way with an input_boolean and two automations: One triggered when more than 10W were flowing to set the input_boolean to true. And another one to set it to false when power flow was below 10W.

The better way: Turns out there is a much easier way to do this with the template platform. Here is what I arrived at:

template:
  - binary_sensor:
    - name: "TV is on"
      state: "{{states('sensor.tv_power_switch_smartenergy_metering')|float >10}}"
      icon: mdi:television

This creates a new binary_sensor in the system with name TV is on and entity ID binary_sensor.tv_is_on that tracks whether or not the power flow through the sensor sensor.tv_power_switch_smartenergy_metering is greater than 10. The unit of measure for the smart plug I have is W.

Next up is to give the same treatment to the washing machine.

Connecting a Webcam to a Hyper-V VM via RDP

Sun, 30 Jan 2022 00:00:00 +0000

As mentioned before, I run work on a VM on my personal machine. I use Hyper-V as the hypervisor. For a while, struggled how to get the webcam to be available in the VM. Turns out you can just use the Remote Desktop Protocol (RDP) for this.

It isn’t quite as simple, however. When you enable “Enhanced Session” mode in Hyper-V, you are in fact using RDP. But that path doesn’t allow for the webcam forwarding for some reason (Microsoft friends: please enlighten me). Instead, you have to use RDP over the network:

Step 1: Enable Remote desktop in the VM

Step 2: Determine the IP address the VM has on the local network

Your rooter will be able to tell you. Or use the hostname. For me, it is mweimer-homevm

Step 3: Connect via Remote Desktop Client and forward the webcam

Step 4 (maybe): Make sure that you can in fact log in

The above did not work for me. That is because I wasn’t able to log in to the VM using any credentials I could provide to the Remote Desktop Client. However, I was able to circumvent this my disabling logging in via the Remote Desktop Client. Instead, I now log in within the RDP session. To do so, open the .rdp file with a text editor and add the following lines:

enablecredsspsupport:i:0
authentication level:i:2

Note: I don’t have this sort of knowledge at my disposal. A kind coworker found my other post and shared these two magic lines with me.

Home Automation: What works for me

Tue, 11 Jan 2022 00:00:00 +0000

Home automation has been an interest of mine for a while. Here, I collect notes on what worked for me. Both as a reminder for myself and in the hopes that it is useful to others dabbling in the space. This is not a tutorial for any of the devices mentioned. There are plenty of those available on the internet.

The core: Home Assistant on a RaspBerry Pi

Home Assistant is a piece of software which serves as the controller of my home. There are many reasons why it is great (OSS, easy to use, supports anything under the sun, …), but one blew me away as soon as I started using it: Home Assistant bridges the various IoT ecosystems. Within minutes of installing it, I had my Hue light switch switch of the lights (duh!) but also switch off the music on my Sonos players. That is the sort of thing we expect home automation to do. But without a connector between the various vendor ecosystems, it is plain impossible.

I run Home Assistant on a Raspberry Pi 4 (8 GB). This is way too much hardware for my use case. But for others, it may be way too little as Home Assistant can also integrate surveillance cameras and do computer vision on those feeds. My RaspBerry Pi is in a flirc case and boots off of a MicroSD card. For larger installations, it is probably better to use a USB SSD in e.g. the Argone 40 One case. I use that case for another Pi and can recommend it. It is powered by the USB port of a APC backup battery and connected via ethernet to my home network to maximize reliability.

Stuff I already had

Home Assistant found a bunch of devices and Services in my home that it automatically integrated with:

Hue Lights
Sonos Speakers
Xbox
Synology NAS
pfSense router

The magic: Zigbee or Z-Wave devices

Home assistant can not only control devices on the local network, but also via the common home automation mesh networks Zigbee and Z-Wave. I picked Zigbee, mostly because I have the Hue bulbs already. They are Zigbee devices and provide a strong backbone for the mesh network. Starting fresh, there are good reasons for Z-Wave as well.

To connect to these mesh networks, I use the well named GoControl CECOMINOD016164 HUSBZB-1 USB Hub. I found this product mentioned in one of the Home Assistant forums. It supports both Zigbee and Z-Wave. I use only the Zigbee part of it. I haven’t done enough research to judge whether this is the best or even good device. But it works for me.

With this device setup, I can connect sensors directly to Home Assistant without using the vendor gateway. While this should work with the Hue lights, I have yet to try it. Here are devices I was able to just use:

(This list was last updated on 2022-01-11)

PerfGuard: deploying ML-for-systems without performance regressions, almost!

Wed, 15 Sep 2021 00:00:00 +0000

Remmelt Ammerlaan, Gilbert Antonius, Marc Friedman, H M Sajjad Hossain, Alekh Jindal, Peter Orenberg, Hiren Patel, Shi Qiao, Vijay Ramani, Lucas Rosenblatt, Abhishek Roy, Irene Shaffer, Soundarajan Srinivasan, Markus Weimer

Abstract

Modern data processing systems require optimization at massive scale, and using machine learning to optimize these systems (ML-for-systems) has shown promising results. Unfortunately, ML-for-systems is subject to over generalizations that do not capture the large variety of workload patterns, and tend to augment the performance of certain subsets in the workload while regressing performance for others. In this paper, we introduce a performance safeguard system, called PerfGuard, that designs pre-production experiments for deploying ML-for-systems. Instead of searching the entire space of query plans (a well-known, intractable problem), we focus on query plan deltas (a significantly smaller space). PerfGuard formalizes these differences, and correlates plan deltas to important feedback signals, like execution cost. We describe the deep learning architecture and the end-to-end pipeline in PerfGuard that could be used with general relational databases. We show that this architecture improves on baseline models, and that our pipeline identifies key query plan components as major contributors to plan disparity. Offline experimentation shows PerfGuard as a promising approach, with many opportunities for future improvement.

Download PDF, ACM

BibTeX

@article{10.14778/3484224.3484233,
  author = {Ammerlaan, Remmelt and Antonius, Gilbert and Friedman, Marc and Hossain, H M   Sajjad and Jindal, Alekh and Orenberg, Peter and Patel, Hiren and Qiao, Shi and Ramani,   Vijay and Rosenblatt, Lucas and Roy, Abhishek and Shaffer, Irene and Srinivasan,   Soundarajan and Weimer, Markus},
  title = {PerfGuard: Deploying ML-for-Systems without Performance Regressions, Almost!},
  year = {2021},
  issue_date = {September 2021},
  publisher = {VLDB Endowment},
  volume = {14},
  number = {13},
  issn = {2150-8097},
  url = {https://doi.org/10.14778/3484224.3484233},
  doi = {10.14778/3484224.3484233},
  abstract = {Modern data processing systems require optimization at massive scale, and using   machine learning to optimize these systems (ML-for-systems) has shown promising results.   Unfortunately, ML-for-systems is subject to over generalizations that do not capture the   large variety of workload patterns, and tend to augment the performance of certain subsets   in the workload while regressing performance for others. In this paper, we introduce a   performance safeguard system, called PerfGuard, that designs pre-production experiments for   deploying ML-for-systems. Instead of searching the entire space of query plans (a   well-known, intractable problem), we focus on query plan deltas (a significantly smaller   space). PerfGuard formalizes these differences, and correlates plan deltas to important   feedback signals, like execution cost. We describe the deep learning architecture and the   end-to-end pipeline in PerfGuard that could be used with general relational databases. We   show that this architecture improves on baseline models, and that our pipeline identifies   key query plan components as major contributors to plan disparity. Offline experimentation   shows PerfGuard as a promising approach, with many opportunities for future improvement.},
  journal = {Proc. VLDB Endow.},
  month = {sep},
  pages = {3362–3375},
  numpages = {14}
}

FLAML: A Fast and Lightweight AutoML Library

Thu, 15 Apr 2021 00:00:00 +0000

Chi Wang, Qingyun Wu, Markus Weimer, Erkang Zhu

Abstract

We study the problem of using low computational cost to automate the choices of learners and hyperparameters for an ad-hoc training dataset and error metric, by conducting trials of different configurations on the given training data. We investigate the joint impact of multiple factors on both trial cost and model error, and propose several design guidelines. Following them, we build a fast and lightweight library FLAML which optimizes for low computational resource in finding accurate models. FLAML integrates several simple but effective search strategies into an adaptive system. It significantly outperforms top-ranked AutoML libraries on a large open source AutoML benchmark under equal, or sometimes orders of magnitude smaller budget constraints.

Download PDF, MLSYS

BibTeX

@inproceedings{MLSYS2021_92cc2275,
 author = {Wang, Chi and Wu, Qingyun and Weimer, Markus and Zhu, Erkang},
 booktitle = {Proceedings of Machine Learning and Systems},
 editor = {A. Smola and A. Dimakis and I. Stoica},
 pages = {434--447},
 title = {FLAML: A Fast and Lightweight AutoML Library},
 url = {https://proceedings.mlsys.org/paper/2021/file/92cc227532d17e56e07902b254dfad10-Paper.pdf},
 volume = {3},
 year = {2021}
}