Soon after I was up and about, I turned my attention back to my ESP8266 Remote Control project, which continues to be the focus of much of my idle thoughts. I had the overall concept of rapid zero-latency communication between a controlling web page and a remote device worked out. Today I wanted to secure it all with some sort of security model, as the kind of control I was providing was complete, allowing anyone with the ability to use it to reflash the firmware to do anything they wanted. It also gave them access to configuration parameters in plaintext, which would open up other exploitation avenues. This woudn't give much access to the backend, but it could compromise every ESP8266 microcontroller (and any AVR slaves) in the "swarm." This, in turn, would allow real mischief with anything those devices control, particularly the cabin's solar inverter, the Generac generator, the boiler, and the hot water system. So, over a series of experiments and tentative implementations, I built a security model for not only all aspects of the websocket connection system, but also the file upload functionality, which had been completely unsecure for weeks. (That was less of a risk, since the worst a malicious actor could do was to place an arbitrary file deep in a nested set of subdirectories within the web root of my virtual Linux server.) After some false starts, I managed to derive my security from the existing system of sending specially-hashed versions of a secret (based on a configurable examination of transmitted data) that are sent with every poll. These hashes make it so they can only authorize a particular set of data and cannot be used to transmit any other data. Not only that, but they take into account time and generally expire within 100 seconds, meaning the data they are keyed for can only be sent for a finite amount of time and then the hashed keys become completely useless. Today's innovation was to store the specific hashed key that is sent with the first successful obtainment of "device information" from the backend as a column in the device table. That key, which changes every time the ESP8266 reboots, then becomes the key used to authenticate not only every form of connection to the backend's websocket server, but also file uploads. Some of those connections take place over unsecured connections, but they are infrequent, so I've decided not to worry about them. This socket-based connection system is really mostly just for remote debugging, since it provides something similar to a serial connection that operates across the internet.
Since I wasn't going to the Adirondack cabin this weekend (mostly because Gretchen wanted to drive the Bolt to the City and I didn't want to drive a gas-guzzling Subaru to the Adirondacks), Gretchen suggested we watch the Woodstock School of Rock kids do one of their public performances, this time of David Bowie songs at Woodstock Playhouse. We drove to Woodstock a little early so we could first get some delicious rosemary fries and beverages at Cucina next door. We sat at the bar and not only got the fries (a pretty good deal at $10), but also the asparagus with some sort of dark sauce (it was very tasty, but the portion was small and, at $13, it was not nearly as good of a deal). I also opted for the microbrew stout, partly because I'm a bit weary of IPAs and it was the most alcoholic beer they had. For her part, Gretchen actually drank a generously-poured glass of fully-alcohlic lambrusco.
On the walk over to the playhouse, we were behind another couple who looked like they were taking the shortcut across a cute little bridge, through a narrow strip of forest, and then across a grassy field. But they quickly thought better of it, and, on seeing us, wished us luck. I thought at first there might be a raging river blocking the path, but it turned out that they were freaked out by the possibility of ticks. An huge number of people in the Hudson Valley live in terror of ticks, and it causes them to huddle indoors and never cross land in its natural state. Neither Gretchen nor I can imagine living that way, but there's no arguing with neuroses.
At the Woodstock Playhouse, the first thing I did was go to buy a little can of blush wine. (That turned out to be the best of their canned wines, which I learned later when I got their other one, a Chardonay.) The rule was that we had to drink our alcoholic beverages before going into the actual performance space (perhaps because there were so many children present), but I found it easiest enough to slip the can in my pocket and take it to my seat, where I could easily consume it with reasonable privacy once the house lights went down.
As for the show, it was the usual mix of strong and weak performances, some from unexpected places. One young man was clearly really into Bowie and had his hair permed into some sort of proto-80s monstrocity while wearing a floor-length metallic jacket that might've worked as a Faraday cage. But he only had about a half octave of vocal range, and it was a crime he was allowed to sing at all. Meanwhile some of the smallest performers (kids we referred to as "tinies") belted out melodies with nearly perfect pitch fidelity. It turns out that a lot of Bowie is perfect for prepubescent male and female voices. One of the teenage boys had a near-perfect Bowie voice, but he couldn't be used for everything. I thought they did an especially good job with "We Can Be Heroes," and I also was exposed to Bowie songs I'd never heard before. Overall, as these things always are, it was a good experience. Best of all, it really felt like a community event, with a mix of parents, kids, and onlookers like us all celebrating talent both old and brand new.
Once we got home, my plan was to take some SporTea and mix with gin and disappear into the laboratory, but Gretchen was on to me and asked I was about to go off to the laboratory to get drunk. I denied that I was and then basically agreed to do whatever she wanted me to, protesting that often when we get home, it's she who has things to do. We ended up watching Stephen Colbert's final episode of The Late Show until I'd seen enough awkwardly-placed celebrities (the straw-on-the-back-of-a-camel was Billy Crystal). And then we watched an episode of Jeopardy!. After that we just kind of snuggled on the couch until we fell asleep. Eventually we woke up long enough to relocate to the bedroom and immediate fall back to sleep.
Part of "We Can Be Heroes" performed this evening. Note the two women dancing on the left.
