• Dec 17, 2016

    Navigation or No Navigation

    Back in July, I stumbled upon the Subaru Impreza as possibly my next car. With the release pegged at the end of the year, a few weeks ago, I started looking at the dealer sites to see when they'd get the car so I could test drive it. I picked the trim level I wanted (that was easy) and was looking at the option packages. There were only 2 choices and trying to figure out which one I wanted was quite difficult.

    Subaru's website shows the following image:

    Screen Shot 2016 12 18 at 6 52 52 AM

    If you look closely, the differences are that the more expensive package has better audio and the Multimedia Navigation. It implies that only it has the 8" display and the less expensive option doesn't. I definitely wanted the 8" display, but finding that option package on the cars coming to the dealers proved more difficult. After more research, I found another link that described the different multimedia systems.

    SUBARU STARLINK™ 8.0" Multimedia Plus with Apple CarPlay™, Android Auto™, Pandora® and Aha™ smartphone app integration5, STARLINK™ cloud-based applications, including Yelp®, iHeart® Radio, Magellan® navigation7, SiriusXM® All Access Satellite Radio8 and Travel Link®8, high-resolution LCD touchscreen display, 6 speakers, AM/FM/CD player, HD Radio®, USB port/iPod® control, Bluetooth® audio streaming and hands-free phone and text messaging connectivity, and 3.5-mm auxiliary jack

    And...

    SUBARU STARLINK™ 8.0" Multimedia Navigation System: Voice-activated 8.0-inch multi-touch gesture high-resolution GPS navigation system with Apple CarPlay™, Android-Auto™, Pandora®, Aha™ and smartphone app integration5, STARLINK™ cloud-based applications, including Yelp®, iHeart® Radio, Magellan® navigation7, SiriusXM® All Access Satellite Radio8, Traffic®16 and Travel Link®16, high-resolution LCD touchscreen display, AM/FM/CD player, HD Radio®, dual USB port/iPod® control, Bluetooth® audio streaming and hands-free phone and text messaging connectivity, and 3.5-mm auxiliary jack

    Spotting the differences between the two became even harder. Both had the 8" display (great), but what were the other differences? The only difference that matters is that the second one has "GPS navigation". Now I was getting somewhere. This means that there are maps loaded into a navigation system and there is a GPS antenna. However, with CarPlay and Maps on my phone, why would I want this?

    Pros of GPS Navigation

    • Doesn't use smartphone data
    • External GPS antenna provides faster acquisition and potentially better accuracy
    • Potentially faster recalculating as it doesn't have to goto the cloud
    • Works when there are no cell towers

    Cons

    • Separate interface to Maps on iPhone
    • No integration with contacts on phone

    Now I was getting somewhere. Given that Maps on my phone has worked well with my phone in my pocket (connecting over Bluetooth) and the number of times I haven't had cell coverage in the last 5 years I can count on one hand, the decision was easy; forget the GPS navigation. Too bad the choices weren't clearer.

    (An interesting note is that while NAVIGON and other iPhone mapping apps can store maps locally and not use GPS data, Apple hasn't given them the ability to use CarPlay.)

  • Nov 15, 2016

    Working From Home, the final chapter?

    Up until 5 months ago, I worked from home for 17 years. For a number of reasons, I took a job working in an office and tried to make the best of it. Going into an office everyday was quite tough for me; even though the commute was an easy 30 minute drive each way, that was still an hour out of my day. In order to avoid traffic, I had to wake up at 6 am and got to the office no later than 7:30. I hadn't used an alarm clock regularly in years, so waking up with an alarm was not pleasant. I've written about working from home and 8 years ago, I wrote that I couldn't work in an office full time!

    Some may think that working from home is a luxury or that they couldn't do it because of all the distractions. For me, it isn't a luxury, but the only way I can work. I'm more focused at home and more relaxed. There is a sense of freedom for me not being confined to an office. I'm sure working from home causes me to work more, but I'll take that in exchange for flexibility.

    Article after article I read, including this one talks about letting people work from wherever they work best. Unfortuantely not all companies are on board with this. I'm now back in a position that affords me this opportunity and with all the collaboration tools available today such as Slack and Google Hangouts, I can still feel like part of a team.

  • Oct 23, 2016

    Blocking IP Cameras from Talking to the Internet

    The recent distributed denial of service attack is said to have been caused by the Mirai botnet which basically turns IoT devices in attackers. One of the devices that is vulnerable is an IP camera that has a default username and password. While I don't have that brand of camera, my cameras have accounts that I can't remove and apparently one ONVIF account with a username/password that can't be changed. I'm pretty good at securing my network from people coming in, but what about things going out? A lot of these IoT devices talk to a server for firmware updates or whatever. Since my IP cameras only need to talk to my server that is recording video, there is absolutely no need for them to connect to the Internet. I decided to see what I could do to isolate the traffic; this is something I've wanted to do for 3.5 years ever since I got a Cisco router that did VLANs, but couldn't figure out a reason and didn't have the knowledge to do it. However, times have changed.

    In my case, I now have managed switches UniFi Switch 8 and the 16 port version as well as an EdgeRouter Lite. Using this equipment, I was easily able to separate out the camera traffic on a VLAN that has no access to the Internet. Here's what I did:

    1. On the EdgeRouter Lite, setup a new VLAN. From the Dashboard, click on Add Interface and then Add VLAN.

      Screen Shot 2016 10 23 at 1 17 50 PM
    2. Setup the VLAN similar to the picture. The 1002 is the VLAN ID. Select the Interface for your LAN port. Enter the IP address for this subnet.
      Screen Shot 2016 10 23 at 1 20 31 PM
    3. Click Save.
    4. Switch to the Firewall/NAT tab. Select Firewall Policies.

      Screen Shot 2016 10 23 at 1 22 08 PM
    5. Click Add Ruleset.
    6. Set it up similar to this picture.
      Screen Shot 2016 10 23 at 1 22 54 PM. Repeat for CAMERAS_OUT and CAMERAS_LOCAL (in is for data coming from the camera subnet, out is for data going to the camera subnet, and local is data to and from the router.
    7. After the rules are saved, select Actions to the right of the IN rule. Choose Interfaces.
      Screen Shot 2016 10 23 at 1 25 40 PM
    8. Select the VLAN (ethernet port + VLAN ID) and the direction. Click on Save Ruleset. Then close the dialog.

      Screen Shot 2016 10 23 at 1 26 20 PM
    9. Repeat the above steps for the OUT and LOCAL rulesets.
    10. IN and OUT are now complete; basically we have just made all traffic from this new VLAN never goto the Internet or receive data from the Internet.
    11. To the right of the LOCAL ruleset, click on Actions and select Edit Ruleset.
    12. Click Add New Rule.
    13. Enter NTP for the description and select Accept. Select UDP for the Protocol.

      Screen Shot 2016 10 23 at 1 33 02 PM
    14. Click on Destination. Enter 123 for the port.
      Screen Shot 2016 10 23 at 1 33 12 PM
    15. Click Save.
    16. Create a new rule for DNS using UDP port 53.
    17. Create a new rule for DHCP using UDP port 67.
    18. Click Services at the top of the Edge Router interface.
    19. Click Add DHCP Server.
      Screen Shot 2016 10 23 at 1 42 13 PM1.
    20. Set it up like in this picture.

      Screen Shot 2016 10 23 at 1 43 24 PM
    21. After setting up the DHCP server, you may want to Configure Static Map to assign specific IP addresses for each MAC address.
    22. Before leaving this area, click on DNS and add the VLAN as a Listen Interface and click Save.
    23. Now move over the UniFi Controller.
    24. Goto Settings and choose Networks.
      Screen Shot 2016 10 23 at 1 31 23 PM
    25. Click Create New Network. Set it up similar to this picture.

      Screen Shot 2016 10 23 at 1 32 00 PM
    26. Click save.
    27. Goto Devices and select the UniFi Switch. Click Ports and locate a port with a camera. Click the Pencil.
    28. Change the VLAN to the Cameras VLAN. Click save.
      Screen Shot 2016 10 23 at 1 40 39 PM
    29. Power cycle that port and the device will come up on the new VLAN.
    30. On my Mac (the machine recording video), go into Network settings, click the gear and select Manage Virtual Interfaces.
      Screen Shot 2016 10 23 at 1 45 26 PM
    31. Click the + button and select New VLAN.
      Screen Shot 2016 10 23 at 1 46 12 PM
    32. Enter the VLAN ID for the Tag and give it a name.
      Screen Shot 2016 10 23 at 1 47 16 PM
    33. Click Create and then click Done.
    34. Select the new interface, select Configure IPv4 Manually. Alternatively you can use DHCP.
      Screen Shot 2016 10 23 at 1 48 58 PM
    35. Re-configure your security software (in my case SecuritySpy) with the new IP addresses.
    36. I also changed the NTP address in the cameras to be 10.0.2.1 as the router will now block all traffic trying to go outside. The EdgeRouter Lite happens to be running an NTP server which is quite convenient.

    Yes, there are a lot of steps here, but this makes me feel a bit safer. Without a managed switch and a router that can handle VLANs, this would be difficult, if not impossible. Unfortunately most people won't be able to do this and their IoT devices will be targets. I have no idea how we're going to solve the problem of IoT devices getting hacked, used to launch hacks, or generally cause havoc on the Internet.

    Please let me know if I missed anything or there are any mistakes.

  • Oct 14, 2016

    Native vs Web App for IoT Devices

    Recently I was chatting with a friend about a new WiFi router. I hadn't heard of it and he sent me a link to it. The first thing I noticed about it was that the configuration was done via an iOS or Android app. As an iOS developer, I know that a native app is going to generally provide a better user experience than a web app. However, as a consumer, I shy away from devices that only have a native app interface. If the app stops working, isn't updated quickly when an OS gets updated, or the company stops supporting the app, I'd be out of luck. In addition, I like being able to configure devices using my desktop machine and most devices don't have a Mac app for configuration.

    The native apps are great, but they have to be secondary to a web interface for any IoT device. I mentioned this to my friend and he understood right away my point. I look at the serial to Ethernet gateway I have that I bought used 3.5 years ago and is likely not made any more and am glad that it has a web interface. Granted it is a very specialized device on my network, but the web interface is the only reason that I'm still able to use it. If it were a device that I wanted to look at more often, like a router that I needed to control various aspects of it, the lack of a web interface makes the device a no go in my opinion.

    I wish that more companies would implement web interfaces first for their IoT devices and have native apps as secondary interfaces. I'm not saying that all apps should be web apps; in fact, I believe that native apps provide a better user experience. I am saying that web apps should always be a backup option in case the native app isn't available or doesn't work.