Hacker News: lightswitch05

New comment by lightswitch05 in "DIY PTP Grandmaster Clock with a Raspberry Pi"

lightswitch05 — Sat, 29 Mar 2025 01:57:23 +0000

I can +/-5ms jitter using a cheap GPS receiver with serial over USB.

Using the same receiver, but with a PPS wire to a GPIO pin on a raspberry pi, I get +/- 5µs jitter.

If you are interested, I have a write up with live graphs in the hamburger menu here: https://www.developerdan.com/ntp

New comment by lightswitch05 in "FriendlyElec NanoPi R5S as PTP Grandmaster Clock with GNSS/GPS Discipline (2022)"

lightswitch05 — Mon, 14 Oct 2024 02:15:54 +0000

I’m not familiar with Chrony. With NTPsec, the PPS driver docs say [0]:

> While this driver can discipline the time and frequency relative to the PPS source, it cannot number the seconds. For this purpose an auxiliary source is required;

And so (with NTPsec), you need to define two sources even though it’s coming from the same device. One for the PPS signal for clock discipline, the other for the clock value.

> refclock pps ppspath /dev/gpspps0 prefer

> refclock nmea baud 57600 prefer

0: https://docs.ntpsec.org/latest/driver_pps.html

New comment by lightswitch05 in "FriendlyElec NanoPi R5S as PTP Grandmaster Clock with GNSS/GPS Discipline (2022)"

lightswitch05 — Mon, 14 Oct 2024 02:00:04 +0000

> It’s unclear to me why there’s so much delay and jitter in the PPS timestamping.

I’ve messed around with this on a couple different GPS chips. I’ve found improvements can be made by increasing the baud rate to the maximum supported. 9600 tends to be the default, but 57600 works a lot better. Also, disable all NMEA sentences except the one you are using. Finally ramp up the update interval to be much more often. The default tends to be every 1000 milliseconds, but 100 milliseconds works better for less jitter. I’ve been using NTPsec, not Chrony, so maybe there are more nuances.

Im just a hobbyist, but I have a bit more details written up here, checkout the poorly designed hamburger menu for some charts and graphs: https://www.developerdan.com/ntp/

New comment by lightswitch05 in "A web site dedicated to precise Time and Frequency"

lightswitch05 — Sat, 21 Sep 2024 00:21:40 +0000

I get weird looks when I speak with people about my GPS PPS NTP servers. This is website amazing. Most of it is way beyond my comprehension, but it’s given me a lot to read up on.

New comment by lightswitch05 in "Going in circles without a real-time clock"

lightswitch05 — Thu, 11 Apr 2024 14:51:22 +0000

This is off-topic, but I was looking at your sbts-aru project and remembered having read the hackaday post on it about fireworks. I'm curious if you've ever seen the RaspberryShake BOOM sensor? If so, any thoughts on how your project and it differ?

https://shop.raspberryshake.org/product/turnkey-iot-atmosphe...

New comment by lightswitch05 in "Going in circles without a real-time clock"

lightswitch05 — Thu, 11 Apr 2024 13:42:47 +0000

I must admit I've never used chrony, so I'm unfamiliar with how to configure it. I've read a lot say saying gpsmon's shared-memory-segment is a really great interface and to go with it instead of NTP's own GPS drivers, but I cannot say that lines up with my experience. I do have one computer setup this way, and it works, but I found on the PPS configurations, it seemed to me to have better accuracy and less jitter using NTP's own GPS drivers and taking gpsmon out of the equation. Its quite possible I just don't know the right configuration combination, but ntpsec's own GPS drivers work great for me.

New comment by lightswitch05 in "Going in circles without a real-time clock"

lightswitch05 — Thu, 11 Apr 2024 13:37:20 +0000

> While not intended to be a direct replacement, the application supports most of the UBX configuration functionality in u-blox's Windows-only u-center © tool (only public-domain features are supported).

I'm going to have to check this out! Thank you for sharing!

New comment by lightswitch05 in "Going in circles without a real-time clock"

lightswitch05 — Thu, 11 Apr 2024 13:34:27 +0000

You can see for yourself the level of accuracy in the ntpviz output. Notice the units of measurement on the graphs:

* Clayface: https://www.developerdan.com/ntp/#./clayface/7-days/

* Catwoman: https://www.developerdan.com/ntp/#./catwoman/7-days/

That Wikipedia quote should mention temperature! Temperature variations have a big impact at this level of accuracy. These really cheap GPS receivers do not have temperature adjusted clocks. Unfortunately my server closet (this is just a hobby) does not have well regulated temperature, so you can see the impact of temperature on the clock accuracy. Also, I found if I start running a bunch of stuff on these computers - that makes the CPU heat up, which also affects the jitter. If you really want high-precision, you'll have to shell out some extra cash then I did: https://www.sparkfun.com/products/18774

New comment by lightswitch05 in "Going in circles without a real-time clock"

lightswitch05 — Thu, 11 Apr 2024 13:04:11 +0000

Good question, it absolutely syncs without any network connectivity. For better or for worse, I have it setup NOT to sync to anything else- being a stratum 1 source is enough. Now… I will admit I’m just a hobbyist with this stuff. Anyways, the way I got around it trying to sync to another source when using the PPS was to define the GPS as two separate sources. One for the PPS signal and another for the NMEA sentences:

    refclock pps ppspath /dev/gpspps0 prefer time1 0.004 minpoll 3 maxpoll 4 iburst 
    refclock nmea baud 57600 time2 0.068 minpoll 3 maxpoll 4 prefer iburst

To get around issues with sync being slow, I have NTPD configured with some extra flags to allow large time jumps at startup:

    NTPD_OPTS="-ggg -N"

I have two raspberry pies setup this way- which I don’t use for much else. My primary computers have these two servers configured as time sources- but also have external sources- so as long as network connections are available, they can determine if they are providing a sane time or are false tickers. As for accuracy, you can view the ntpviz output for each setup in the hamburger menu. For catwoman, its regularly within 4 microseconds.

New comment by lightswitch05 in "Going in circles without a real-time clock"

lightswitch05 — Thu, 11 Apr 2024 10:50:12 +0000

I had this happen before. I used it as an excuse to learn how to setup NTP with a GPS receiver. I made a little blog on it if anyone is interested in the results. Be sure to click the sandwich menu for some real-time data: https://www.developerdan.com/ntp/

New comment by lightswitch05 in "Node.js – v20.8.1"

lightswitch05 — Sun, 15 Oct 2023 14:55:17 +0000

This is the changelog for 20.8.1, but it’s important to point out that that 4 of the CVEs were also patched in 18.18.2.

Shameless promotion time, I have a little utility that can check a node version for CVEs or EOL:

    npx node-version-audit@latest --fail-security

Or with docker:

    docker run --rm -t lightswitch05/node-version-audit:latest --version=$(node -e "console.log(process.versions.node)")

Some highlights of the tool is zero dependencies and CVEs are sourced directly from NPM changelogs instead of waiting on slow CVE release processes. See the website for more details: https://www.github.developerdan.com/node-version-audit/

New comment by lightswitch05 in "Pi-Hole V6 Beta Testing"

lightswitch05 — Tue, 10 Oct 2023 16:05:35 +0000

The new feature for subscribed allowlists is going to pair really nicely with the existing support of ABP-style blocklists. I’m very excited for this release!

New comment by lightswitch05 in "PHP Version Audit: Three years and running"

lightswitch05 — Tue, 13 Dec 2022 16:03:46 +0000

Three years ago I released a tool called PHP Version Audit. The idea is that it parses the PHP changelog and notifies you if you are running a PHP version that has a CVE or has lost support.

Anyways, after running for three years, I thought it would be fun to put together some data. The most interesting one is that PHP Version Audit has a median CVE discovery of 5 hours after the PHP announcement. In contrast, the NVE CVE Database has a median of 260 hours - or almost 11 days. Of course the NVE CVE Database has all sorts of information like a vulnerability score, so maybe it’s an apples vs. oranges comparison. Anyways, I hope someone else finds this interesting :)

If you think PHP Version Audit is interesting, there is also Node Version Audit[0] that I released earlier this year.

0: https://www.github.developerdan.com/node-version-audit/

PHP Version Audit: Three years and running

lightswitch05 — Tue, 13 Dec 2022 16:03:46 +0000

Article URL: https://www.github.developerdan.com/php-version-audit/stats

Comments URL: https://news.ycombinator.com/item?id=33970659

Points: 1

# Comments: 1

New comment by lightswitch05 in "Curl doesn't add libproxy due to its quality issues"

lightswitch05 — Mon, 24 Oct 2022 04:26:39 +0000

To answer your question, the levels are important for both regular usage and debugging when something goes wrong. I create a number of debug/info/warning/error log messages throughout the tool and allow the desired level of logging to be set as a CLI argument - or even run in silent mode if desired.

New comment by lightswitch05 in "Curl doesn't add libproxy due to its quality issues"

lightswitch05 — Sun, 23 Oct 2022 14:33:25 +0000

Yes, my library absolutely has to support the LTS version of Node, and I run the tests against all supported versions to ensure compatibility. So, one day I can use the nice things people are mentioning, but it will be years from now.

New comment by lightswitch05 in "Curl doesn't add libproxy due to its quality issues"

lightswitch05 — Sun, 23 Oct 2022 12:57:13 +0000

I’ve written a library with zero production dependencies. Of course I have Jest as a development dependency which pulls in all sorts of stuff. It would be difficult to make a zero-dependency library. As for not having production libraries, this was my experience:

1. Using the https module directly was more work than I expected, especially with error handling. This made me really look forward to the new Fetch API coming out.

2. No CLI parser. Its not like parsing args is a LOT of work - but its also something that is already solved and having to write support for that directly was a bummer

3. No logging library. This one was pretty easy. Create a little class with logging levels. Again this is something that is very common that would have been nice to use a package for.

Show HN: Node Version Audit – Audit Your Node Version for Known CVEs and Patches

lightswitch05 — Wed, 31 Aug 2022 00:45:14 +0000

I wrote Node Version Audit to automatically keep track of Node patches, particularly for releases that fix CVEs. While it can be ran directly, it is designed to run as part of a pipeline to produce warnings if the runtime version of Node has CVEs, or is no longer supported.

The cool part (IMO), is that Node Version Audit automatically keeps track of node releases and CVEs by parsing the change log, and so there is no curation needed to maintain it.

I would love any thoughts!

Comments URL: https://news.ycombinator.com/item?id=32657014

Points: 3

# Comments: 0

New comment by lightswitch05 in "Bringing Forward the End-of-Life Date for Node.js 16"

lightswitch05 — Sat, 11 Jun 2022 14:18:29 +0000

It seems like the most reasonable choice. Incidentally, I have an open-source tool called Node Version Audit [0] which checks a given node version against known CVEs and end-of-life dates. It looks like the official change hasn’t been made yet [1].

[0] https://www.github.developerdan.com/node-version-audit/

[1] https://raw.githubusercontent.com/nodejs/Release/main/schedu...

Show HN: PHP Version Audit – Audit Your PHP Version for Known CVEs and Patches