The Market Ticker
Commentary on The Capital Markets- Category [Musings]
Logging in or registering will improve your experience here
Main Navigation
Full-Text Search & Archives

Legal Disclaimer

The content on this site is provided without any warranty, express or implied. All opinions expressed on this site are those of the author and may contain errors or omissions.


The author may have a position in any company or security mentioned herein. Actions you undertake as a consequence of any analysis, opinion or advertisement on this site are your sole responsibility.

Market charts, when present, used with permission of TD Ameritrade/ThinkOrSwim Inc. Neither TD Ameritrade or ThinkOrSwim have reviewed, approved or disapproved any content herein.

The Market Ticker content may be sent unmodified to lawmakers via print or electronic means or excerpted online for non-commercial purposes provided full attribution is given and the original article source is linked to. Please contact Karl Denninger for reprint permission in other media, to republish full articles, or for any commercial use (which includes any site where advertising is displayed.)

Submissions or tips on matters of economic or political interest may be sent "over the transom" to The Editor at any time. To be considered for publication your submission must include full and correct contact information and be related to an economic or political matter of the day. All submissions become the property of The Market Ticker.

Considering sending spam? Read this first.

2019-10-26 07:00 by Karl Denninger
in Musings , 159 references
[Comments enabled]  

I've been asked a few times how do I get that beautiful espresso you pulled a couple of times on your podcast.

Be warned: This setup is not cheap.

First, let's talk about the coffee.  If you're going to go buy Ilya in a can at the grocery store -- or anything similar to it including any already-ground espresso or anything in a bag from any mass-market coffee company, including Starbucks, Petes or similar -- just stop reading right here as you're going to waste all of the money you'd spend if you read any further in this article.

Go buy a $20 stove-top moka pot; it'll produce all of what that coffee is capable of doing for you and may God have mercy on your palate.

Unless you have a local roasting location where you can buy whole bean espresso -- not a Starbucks or other chain, not a grocery store and not 95% of the coffee places that dot the landscape no matter how trendy they are you must commit to either buying the coffee in small batches, no more than you can drink in two weeks, or roasting your own.  In short if the place you're intend to buy the coffee has it in "bins" that don't have dates on them showing it's a week old or less and they don't have a roasting machine either in the building or at least in the same town then you're buying stale beans and while that may be ok for drip or perc it's going to suck if you make espresso with it.

You are simply wasting your money buying good coffee equipment, and it's pretty expensive, so if the above describes how you're going to get the coffee to feed the machine STOP and buy the Moka Pot.  You're welcome.

Legitimate coffee places from which one can buy roasted beans are those such as Intelligentsia in Chicago.  The shipping will murder you if you order their roasted whole bean in small enough quantities for home use, however, so unless you can drive to such a place as part of your usual route during a given week forget it -- you need to roast the coffee yourself.


Because roasted whole-bean coffee is only good for about two weeks from the day it is roasted and only at its best for one week.  Once ground for use it's only good for minutes to an hour or so.  Therefore, buying ground espresso is a complete waste of money and anything you'd spend on a machine to consume said coffee is also a complete waste of money.

The crema you saw on those pulls (and the delicious coffee in the cup under it) requires four things to happen:

1. Fresh roasted beans.  At one week it's somewhat diminished.  At two weeks it's almost gone.  Beyond that it tastes like crap on a rapidly-degenerating basis.  There is no way around this; refrigeration does not help.

2. A consistent roast.  You cannot possibly set the grinder correctly and leave it where you set it unless the roast is consistent on a batch-to-batch basis for both freshness and the roasting process itself.  This means you either need to learn how to roast consistently or you need to buy from someone who does.  Otherwise you will chase the grind and extraction endlessly and throw away a huge number of shots that suck when you attempt to drink them.

3. A low speed burr grinder so the coffee is ground to consistent particle size.  The cheap "blade" style grinders are worthless for this.  They're fine for drip coffee but not espresso.  The cheap "burr" grinders are both not sufficiently precise and most also run the burrs at FAR too high a speed as their way to get around not having a beefy enough motor in them to do the job correctly, and thus burn the coffee while grinding it, destroying the flavor.

4. A machine to extract the shots that can produce (1) consistent temperature and (2) consistent pressure.  Coffee, for its correct flavor, should be extracted somewhere around 195-205 degrees, with the exact temperature depending on roast and beans involved.  For the best flavor you need to get within 1-2F repeatedly and the typical extraction pressure you want is approximately 9 bar (~135psi.)  Note: I have my machine set somewhat lower -- at 8 bar -- as I like the quality better there, but the "default" for most quality manufacturers, and where virtually every shop you'll ever go into has their machine set, is typically peg-on at 9.

Ok, so let's start.  Let's assume you do not have somewhere like Intelligentsia around you.  Then you need a roaster because your only realistic option is to buy green coffee, which has a reasonable shelf life and thus won't make you broke paying UPS shipping charges.  The best "bang for the buck" in a home roaster is the Behmor 1600 (the newest incantation of this is the Behmor AB.)  It looks like a toaster oven and despite the claim that it has "smoke reduction" technology (it does) you must use it outdoors.  You will set off your smoke detector if you attempt to roast inside.  The porch is fine provided there's an outlet there.  Yes, you need to use it outside in the winter.  Trust me on this; your kitchen exhaust fan, unless you have a commercial-style kitchen exhaust, is not good enough.

To go with this you will need green coffee.  I like Roastmasters (both their "premix" Espresso blends are good; I prefer Firenze slightly but not greatly), but Sweet Maria also has good stuff.  Once you get good at this you will likely want to experiment putting different mixtures together of different kinds of beans.  Trust me, it gets fun and over time you can develop a mixture of beans that give you exactly what you personally prefer.  This is not a quick process, however, so start with one of the blends and work from there.  Green coffee is good for up to six months or so kept in its original ziplock-style bag at room temperature, unlike roasted coffee which is good for a week or two maximum.  Therefore it's entirely reasonable to buy 10lbs of green coffee at a time, which gets shipping costs down to a modest percentage of the whole.

Learning to roast is an iterative process -- you will throw several batches away when learning so start small (e.g. 1/4lb at a time) so the throw-outs are cheap.  One warning: Never, ever think you can set a roaster's profile and walk away from it.  You are very likely to get a fire in the unit if you do that.  When roasting coffee it will undergo two "cracks" -- the first sounds more-or-less like popcorn and the second more-or-less like rice crispies.  For most espresso you want to pull the roast about 10 seconds into the second crack but tastes vary and so do coffees, so experimentation is required.  The reason you can't leave the roaster alone is that about a minute past the start of the second crack is the third crack, otherwise known as ignition.  That's right -- the coffee will catch on fire if you go too far.  Further, since this is an electric heated unit as are most small differences in line voltage as a result of who's using A/C and similar in your neighborhood at the time can have a material impact on the time required to finish a batch.  It's sensitive enough that you basically have to babysit the process to get acceptable -- and safe -- results.  If you change green coffees or even batches you may need to make a change in how you roast to get results you like.  After a while you'll learn what settings on your unit with your coffee choice produces something you like to drink, and how to repeat that on a reliable basis.

Note that these roasters are pretty heavy-duty but not lifetime things.  What do I mean here?  You might find that they're a 10 year deal and then you replace one.  These are not in the same category as a true commercial machine, nor are they priced like it.  Don't even ask what true commercial roasters cost, nor their power requirement as they're not plug-in devices!  Then again in a home they're ridiculous overkill since they're not designed to run small batches, where the Behmor unit is.  Roasting more than a pound at a time is a waste in a home environment as even with a couple of people drinking coffee you'll never go through it fast enough to prevent it from getting stale.  Your target for a batch, once you get it dialed in, is about what you consume in a week.  Buying something with more capacity than that at a time is thus foolish for your house.

Ok -- next up is the grinder.  The two decent options that have the quality you want and aren't sized for a production coffee shop that goes through hundreds of shots a day are the Macap M4 and Mazzer Mini.  I like the stepless model of the Macap as it's infinitely adjustable, but a click-adjustment unit is acceptable too.  I removed the hopper from mine and feed one grind's worth of beans at a time, capping it with a portafilter basket which happens to nicely fit in the hole where the hopper used to be.  This allows me to keep the roasted beans in a sealed container next to the grinder rather than sitting in a hopper where it's open to the air all the time.

These units are built like tanks and the burrs are replaceable.  They're not cheap but they'll outlive you with reasonable maintenance in a home environment.  A set of burrs is reasonably inexpensive (~$25) and in the home they'll be good for a few years, at which point you'll want to buy a new set and replace them.  The unit should be disassembled and completely cleaned every three to six months.  It's not difficult but you want to get the accumulated oils out of it as they eventually start impacting the coffee's flavor.

Don't kid yourself about grinders; you get what you pay for.  It's far more important to have an excellent grind than the best espresso machine.  If you need to find somewhere to take a couple hundred out of the budget don't do it here; you'll regret it.  In addition many of the cheaper units are essentially impossible to take apart and properly clean.  The two above are designed for commercial use -- and maintenance.

When it comes to espresso machines you have some questions to answer first.  These machines are expensive; you only thought the grinder and roaster were.  But -- like the grinder these are light commercial pieces of equipment and intended for continuous use, such as in a catering outfit or even possibly a small cafe.  You want to choose wisely because it is literally a piece of equipment that, with reasonable care, has a decent shot at being left to your heirs!

First question: Plumbed in or pour-over?

Plumbed in units have a water hose that is hard-attached to water off your sink or other plumbing connection.  They also have a drain hose connection too, although that's usually optional (you can pour the drip tray out if you prefer rather than using the drain fitting.)  They're very convenient and the water never gets stale if not in use.  They're also a bit more consistent but somewhat more expensive and you need to make provision to feed them.  This can be a problem depending on your kitchen's arrangement and where you want the machine.  If you have hard water you can (and I have) put a dual-stage softener cartridge + filter (you must have the filter after the softener cartridge as otherwise bits of the former may get into the machine and screw it up) inline under the sink which takes care of the hard water problem.  Plumbed machines typically use a rotary pump and produce a more-consistent pressure and extraction.  Hard water is a serious problem in any of these units as they're boilers and will scale.  You can clean and maintain for that and you need to, or soften the water before it goes in.  Pick one if you live in an area with high mineral content in the water.

Pour-over units, as the name implies, have a reservoir in the back.  Think like one of those K-cup units, but with a larger (most of the time) tank.  These require no permanent connection but don't think that means "easily transportable"; these machines are heavy and while you can move it around (e.g. take it on vacation) you probably won't want to.  Pour-overs typically use a vibratory pump since vane pumps require positive pressure feed, which a tank at the level of the unit doesn't have.  However, other than noise (somewhat higher for vibratory) and slightly less-consistent, plus a bit more cleaning work (basically the tank has to be cleaned and refilled regularly) it's not a big deal.  Note that you do not want the water in the tank to be there for more than a day or so unused as it's not sealed.  The same issues with potential hard-water problems apply; either treat the water that goes in or be prepared to perform descaling on some interval depending on how hard your water is.

One other point: All of the machines in this class -- that is, all of them that are actually worth buying and can produce consistent espresso -- have a lot of thermal mass.  That is, when you turn them on it will take upwards of half an hour before they're fully warmed up and ready to go.  The better ones have insulated boilers and if plumbed in you can leave them on all the time, which means coffee instantly any time you want it, they tend to have a hot water tap (which means tea in the evening, or instant soup, etc if you want it) and with the boiler being insulated the standby power requirement isn't too bad.  Maybe $5 or so on your power bill a month to keep it powered up all the time.  The other alternative is a heavy-duty (15A) timer.  There are a few equipped with electronic controls that have a timer built into them.

Next question: Do you want to make cappuccinos and other "milked or frothed" drinks?  If not, or if you're willing to wait for them to cycle up and down on temperature, you can save some money.  For example the Quick Mill Acrola is a single-boiler, no steam capability at all, espresso machine.  It's an E-61 group head unit which makes very high-quality espresso (same group head I have on my Vetrano) but is missing the heat exchanger and steam capacity, so it only makes espresso drinks (no tea or americanos either.)  It's a pour-over, so you fill the tank.  And it's analog control which isn't quite as stable as the next step up.

That would be the Quick Mill Alexia Evo.  It can make steamed drinks, but you have to wait for it to heat and cool between them, because it has one boiler.  But -- it has digital control (which my older unit does not) so it's going to be more-stable.

From here we get into machines that can do both at the same time (e.g. froth milk and pull an espresso shot) and things get quite expensive.  The unit I have is a heat-exchange Vetrano, which is no longer made.  The current model is a double boiler and is flat-out insane in terms of repeatability, precision and ease of use, but of course the price has gone up over time.  Bring money.  The heat-exchanger units (which is what mine is) are somewhat less expensive but require a bit more skill to get repeatable results, especially if you make steamed milk drinks.  But remember -- machines in this class, like the grinders, are heirloom devices.  They're serviceable, parts are available and reasonably inexpensive, and with a rational degree of maintenance it will outlive you.  I bought mine at Chris Coffee but there are other options (no, I don't get a commission.)

To put some perspective on this my Vetrano has required a water valve, a couple of disassemblies of the water feed mechanism and a handful of gasket and such replacements since I bought it some 15ish years ago.  Under $100 worth of "failed parts" beyond those that are expected to need replacement on a regular basis.  My grinder has required a couple of sets of burrs over the years and one of two plastic handles on the adjusting worm screw has broken off (it's $50 for another one, which I might buy some day -- I rarely need to adjust it and the other side is still there and works.)  The screens, group gaskets (for the portafilter that holds the coffee) and brew handle gaskets are wear items and require replacement every six months or so.  Pretty much everything else, however, can be replaced if for some reason it needs to be -- but it hasn't needed to be, which is the point, and it's on 24x7 ready to make coffee whenever I want it.  There is a machine "detergent" that cleans the group and screen; I use it about once a week -- in a shop running the cleaner through would be a daily job.  Since I have a softener/filter setup in front of the water feed I change those filters as well; the charcoal filter on 3 month intervals, the softener cartridge every six.  I've never needed to de-scale or replace the heating element as a result.

When I bought my Vetrano the LaSpaz, as the other one I looked at, was quite a bit more money.  Now it's the other way around, but the newer Vetrano model is arguably a better machine (although they're very close now.)  Better enough to be worth the additional coin?  I don't know -- but unless I decide to give my existing one to my kid some day I'll likely never need another one, so..... yeah.

One final point -- pay attention to the power requirement.  Many of these machines have a choice between 15A and 20A when set up for 120V power, which in the US they of course will be.  Your common kitchen outlet is a 15A outlet, not a 20A one.  A 20A outlet has a slightly different configuration and the 20A cord will not plug into a 15A socket; the wide (neutral) blade is SIDEWAYS.  In other words while a 20A receptacle will accept either a 15A or 20A plug the opposite is not true.  DO NOT just change the receptacle - if there is more than one receptacle on the circuit, even if the breaker is a 20A breaker, that's both a code violation and a fire risk.  The difference is that for double-boiler machines you can't run both boilers at the same time on a 15A circuit, so they're set up to not do that if set that way.  In a home environment this probably won't matter to you -- remember that these units are considered "light commercial" (e.g. a catering outfit) where that can matter as it will slow the user down when making drinks back-to-back, so most have the option.

Now you might think I'm utterly insane to go out and buy gear like this, but if you like coffee -- are you really nuts if you can front the cash?  Green coffee by the pound is about $6 -- not bad at all.  If you go to Starbucks or similar on a daily basis during the week you're into this game for a good $1,500 a year or more, and that's if you like one coffee per day.  Drink two or three and the cost gets truly insane to do anything other than have the gear at home.  Never mind that the "corporate" shops like Starbucks produce crap; one espresso out of a real set-up where you've taken the time to get it dialed in (once you've done so repeating it is easy and fast) and you'll never buy a Starbucks anything -- ever again.

View this entry with comments (opens new window)

I've had my Lenovo X220 for a long time.  Time has moved on and yet until this last year I saw no compelling reason to spend money again.  The X220 works great and the "improvements" have been small in number but large in price -- and thus not worth it, in my view.

This last year the X1 Carbon Gen 6 units showed up.  The previous models were nothing special -- but the "6" was nice.  The problem was that "nice" came with a screamingly-stupid price tag, so I passed.  But now you can get the X1 Carbon Gen 6 models in a good configuration (i7, 16Gb RAM and a 500Gb SSD) at a nice price -- refurbished, but still with a decent amount of remaining factory warranty.

Incidentally, Lenovo has a rather nice "companion" app that allows you to (among other things) set the charge controller's maximum charge point on these machines (!!!)  Setting it to 80% will cost you 20% of your runtime but it will double or better the battery's cycle life.  In addition if you're connected to wall power and in the "no-charge window" (e.g. 75%-80%) the system will take its power from the A/C line but not charge, so the battery does not cycle in that state at all.  Setting this is not a Windows thing either -- it programs the charge controller hardware so once set it is persistent even if you boot something other than Windows or the computer is plugged in but off.  I like that a lot -- this ought to be mandatory on any sort of battery-powered mobile device (e.g. a phone), especially if the battery is not user-replaceable.  You know damn well Apple, Samsung and the rest will never do that however since it's part of how they sell both computers and phones -- build them so the battery pukes in about a year and guess what -- you're back in their store!  Oh Tim Crook you piece of crap jackass, why isn't this capability standard on all your MacBooks since you're allegedly the "innovation leader"?

In any event these machines can go 6+ hours of moderate use even with the charge point restriction in place, so you're not giving up much and with this set leaving the unit connected to power does nothing to battery cycle life, unlike virtually every other machine on the market.  Incidentally, the new Coffee Lake processors (Intel Gen 8) are damn fast on a comparative basis.  This is the first "innovation" in laptop CPUs that has been worth spending money on in five+ years, so if you're wondering if it matters -- it does.  In addition these units have Samsung nVME SSDs in them which are blistering fast, plus a Thunderbolt 3 port that can drive external video cards if you wish.  I've seen no reason to "upgrade" from my X220 until now; it's still perfectly functional too, by the way.....

If you want my short list of complaints with "modern" laptops it's the port problem.  Specifically, small and light means compromises when it comes to interior space and thus ports.  Full-size SD slots (for example) consume interior space which is at a premium, so they're disappearing.  Worse, on many machines so are USB Type A connections, which is IMHO utterly unconscionable.  Yes, I know Type C is both smaller and comes with USB-PD, which is superior but there are literally a billion USB-connected devices out there that come with and require a Type "A" plug -- or some sort of adapter -- to use.  Those devices aren't going away for a very long time, and as such having at least one (and preferably two) Type "A" port is IMHO required. Dell has screwed the pooch in this regard with their latest "ultrabook" models; Lenovo has only partially done so (there's no full-size SD slot, but there are two Type A ports.) 

One big advantage of USB-PD connections found on newer devices is that we're moving closer to true interchangeability when it comes to power in the mobile world.  Specifically, I can use the laptop's charger to charge my phone, I can use my phone USB-PD charger (provided it can do 20V output) to charge the laptop (slower, but it should work), my car's USB-PD charger can charge the laptop (I no longer need an inverter) as well my phone and I can use the laptop battery to charge the phone as well.  The latter means that if I need to I can plug the car into the laptop and the phone into the laptop as well on the second USB-C port and both will charge.  This allows me to get rid of multiple things I used to have to carry, or continue to carry them and gain redundancy -- and that's a good thing.

One of the things I find insanely annoying -- and insecure -- is anything Microslug.  Sadly I, like a lot of other people, cannot get away from it in that there's just too much software that I use on a regular basis but is either Apple or Microsoft only.  I prefer a FreeBSD desktop for a lot of things, never mind that I want to do some code development on it when traveling, which of course means I want the code environment I write in 90+% of the time on my laptop.

So if you're inclined the same way I am when it comes to operating systems here's how to dual-boot it -- yes, with UEFI (the "new way of the world.")  Oh, and to do so with full-disk encryption for both environments.  I consider full disk encryption essential on a portable machine because they're much more likely to be lost or stolen than a desktop.  Full disk encryption obviously won't stop someone from stealing the computer but it will make sure if someone does steal it they can't get to any of the data on it.

First, shut off secure boot in the BIOS settings.  That's a Microsoft-signature thing. It does provide (some) security on the boot process, provided you trust Microsoft. I do not, so therefore..... yep.  Note that if you have Bitlocker turned on (and you should if you've been using the machine) the restore process below will result in a non-encrypted Windows installation.  That's fine; you can re-enable it later (and should.)

Next, use Macrium Reflect (the free edition is fine) to make room for a FreeBSD partition.  The best way to do this is to back up the machine (make damn sure you create "boot media" and test it!), then RESTORE all the partitions using that boot media back to the machine's internal disk and, when restoring, resize the system ("Windows") partition to leave an appropriate amount of free space.  100Gb is quite a lot of storage for a user-style FreeBSD system, unlike most WinBlows machines that are flat-out bloated pigs -- which means that pigheaded Winblows and nice FreeBSD will handily fit on a 500Gb nVME SSD and even a 250Gb disk is more than enough (although you may wish to downsize the FreeBSD side to ~60Gb in that event, which is still going to leave you an insane amount of room on that side.)

CAUTION: Do not be tempted to use a partition resizer to do this instead of using Macrium to take a full backup and restore. Several of the below steps have no "are you sure" option or safeties to prevent data destruction; the commands below assume you know what you're doing and take effect instantly.  If you screw up during any of those steps and don't have a backup everything on the machine may be destroyed and it can be rendered unbootable, including any built-in recovery partition.  Without recovery media or a backup and boot media for it you're in big trouble if that happens. Doing it right means knowing you have a good backup and can restore it before you begin, which is exactly what you just did and proved.

Now go here to download his EFI boot manager, then install it.  UEFI machines are supposed to provide a decent set of boot management options but damn near none actually do; this bit of code overcomes that problem.  The pages look sort of scary in terms of the amount of material present; they're not.  You need the "zip" file which contains all the pieces necessary.  Grab the package and read the Windows installation instructions; it's very simple to install this from the Windows command prompt.  You only want the "x64" version (there are three; delete the other two before you copy it over.)  To test the installation reboot; the system should show you a boot menu, but the only "real" bootable option will be Windows.  If you screw up typing something what will probably happen is that Windows will start instead of you getting the menu -- go back and check your work if that happens.  You're now set up to choose multiple operating systems painlessly every time you boot the machine.

Download FreeBSD-12 (the x64 version) from in the memory stick format and use your favorite tool (e.g. "dd" or win32diskimager) to copy it to a USB key or other similar thing (an SD card in a reader works just fine too.)  Note: You want FreeBSD 12.  You can use 11.x if you wish, but the nice integrated encrypted storage option I'm describing here might not work; I'm not sure if the encryption-aware EFI loader was MFC'd back to 11.x.  You can still set up for encrypted disk storage without that but it's a lot more of a pain in the ass to do than what I'm describing here and makes maintenance using FreeBSD's internal tools more-complicated unless you're quite careful. Use 12; it's both more-secure in that there is no "exposed" non-encrypted boot partition and easy to set up by comparison.

FreeBSD's installer should, in theory, be able to handle a "multi-boot" environment with reasonable facility but doesn't and the only option it offers for automatic setup with encrypted storage uses ZFS on the entirety of one or more disks.  That's reasonable on a dedicated machine with multiple drives but not for a laptop or other computer with one disk and a dual-boot requirement -- so you get to do the disk setup by hand.

Now boot the stick with FreeBSD-12 on it.  On the Lenovo hit ENTER on initial start when prompted and then select F12 to change the "default" boot order and select the USB stick from the drop-down menu.  Start the installer but when you get to the disk layout (there will be four choices; one of which is UFS and one of which is ZFS) select manual (it'll warn you that you have to be an "expert.")

You'll get a "#" (root) prompt.

Now type "gpart show | more" and look.  You should see something like "nvd0" at the top -- which is your SSD.  There should be a large unallocated space (marked " - free - ") of the size you left.  Note it, and that it will not have an index number.

If there is no free space of the size you left YOU ARE LOOKING AT THE WRONG DISK.


# gpart add -t freebsd-ufs -l freebsd-root -a 4k nvd0 (assuming your disk is named "nvd0" in the above)

This will tell the system to add a partition for FreeBSD to the disk named, consume all remaining available space in that nice large block and put a label on it of "freebsd-root."  This is probably what you want; the label is optional but will help you avoid mistakes while putting the system together.

Now look again at "gpart show | more"; you should see the freebsd-ufs partition you created.  Remember the index number next to it.  If it's "6" then the disk partition is in /dev/nvd0p6.  The numbers may not (probably will not, if you resized from a backup) be in order.  That's ok.

Warning: If you do any of the following to the wrong partition you will destroy whatever is in it.  There are no warnings or safeties on any of these commands; you're acting as "root", and it is assumed "root" knows what he's doing.  That backup you made as the first step will come in real handy if you screw up here so don't do anything stupid to wherever you put the backup -- like erase or destroy it!

BEFORE you press RETURN in any of the below steps look -- TWICE -- at what you just typed or be prepared to use that backup you made and start over!

# geli init -b -g -l 256 -s 4096 /dev/gpt/freebsd-root  (note that "-l" switch is the letter "l" -- not a numeral one)

This initializes encryption on this partition.  "-b" and "-g" tell the system you are going to boot from it, and that the boot system should ask you for the password.  "-s 4096" sets the block size; 4096 is a good choice with a decent split between performance and XTS fuzzing (security), and matches most SSD page sizes which is important on SSDs.  "-l 256" says to use 256-bit AES instead of 128 and is optional.  There's debate over whether 128 or 256 is more-secure; 256 is a bit slower, but not much.  Note that you cannot change either the sector size or AES length once the partition is initialized without erasing everything in the partition you are encrypting.  Unlike Bitlocker on Windows there is no "encrypt in-place" option.

You will be asked for a password.  Use a strong password and do not forget it.  There is no way to recover anything on that partition if you lose it.  Ever.  Period.  There is no recovery key ala Bitlocker; you either have the password (the system does allow you to set a second one but that's beyond the scope of this document) or there's nothing you can do to get the data back.

When that command completes type:

# geli attach /dev/gpt/freebsd-root

And enter the password when prompted.  If it's correct you'll see a couple of lines announcing the filesystem is attached and another root prompt.  If the password is wrong it will tell you; repeat the command and put in the right one.  If you accidentally put in the wrong device name the password will obviously not work since it's not the correct part of the disk.

Now type:

# newfs -t -J -U -L rootfs /dev/gpt/freebsd-root.eli

Note: The ".eli" name on the end denotes the encrypted partition you just attached.  This initializes the filesystem itself; you are telling the system you are on an SSD and want it to use "TRIM" ("-t"), you want Journaling and Soft Updates (both good for performance and data security / reboot speed) and you also want a label called "rootfs".  The last switch isn't really necessary -- but it's good practice.

Now you have to mount that filesystem where the installer wants it so it can put the operating system on there for you:

# mount /dev/gpt/freebsd-root.eli /mnt

And then create two files necessary for the system to boot when you're done -- an /etc/fstab file to tell the system where the filesystem is you created and a loader.conf file so the system knows where to find the root filesystem and to load the encryption driver during the boot process:

In /tmp/bsdinstall_etc/fstab put:

/dev/nvd0p6.eli / ufs rw 1 1

And in /tmp/bsdinstall_boot/loader.conf place:


"vi" is a good choice to do that, assuming you know how to use that editor.  "echo" will work too (one line at a time.)  So will "ee" (Easy Editor.)

(nvd0p6.eli may be different depending on what you saw above -- if unsure look again with "gpart show | more" and look for the index number of the partition.  Note there is no "/dev" prefix and that ".eli" on the end must be present; that's the attached encrypted copy.  Without it the system won't boot as it will try to read the unencrypted device and will see garbage.)

Now you need to mount the existing EFI partition on the drive and copy in the FreeBSD loader. The UEFI boot manager you installed earlier will be able to find it automatically, but to do so you must place the FreeBSD loader that knows how to scan for and read encrypted disk partitions in the correct place. The following commands will do that (the "#" is the root prompt), assuming "nvd0p1" is your EFI boot partition on the disk:

# mkdir /tmp/mount
# mount -t msdos /dev/nvd0p1 /tmp/mount
# mkdir /tmp/mount/EFI/FreeBSD
# cp /boot/loader.efi /tmp/mount/EFI/FreeBSD/bootx64.efi
# umount /tmp/mount
# rmdir /tmp/mount

Now you can type "exit" at the "#" prompt and you will be back in the installer with all the "bits" in the right place for it to put the system on the disk for you.  Do the other usual things in the installer, including setting up networking and similar.

When you're done let the installer run and finish.  When it goes through the normal process and you reboot you should get a boot manager screen with TWO usable options (there will be others as well); one of them should be FreeBSD's "Beastie Head", and selecting that option should immediately prompt you for a password, which is required to unlock and boot the partition you have just set up.

Congratulations; you can then set up X11 if you'd like (e.g. gnome, etc); be aware that the Carbon Gen 6 wants the "scfb" driver declared for X11 to work which is a bit annoying; a file called "driver-scfb.conf" goes in /usr/local/etc/X11/xorg.conf.d once you have xorg loaded and should contain the following to tell it to probe that driver:

Section "Device"
    Identifier "Card0"
    Driver "scfb"

Without that Xorg's auto-configuration will not find the Intel graphics and X11 will refuse to start.

Now reboot into Windows and turn Bitlocker back on.  Unlike with X220 where I had to do some rather arcane things with the Group Policy Editor to make that work (Bitlocker would otherwise throw up as soon as I booted FreeBSD) so long as you have loaded the UEFI boot manager and the FreeBSD loader into the EFI partition before you do this it should be fine with you switching back and forth between operating systems -- it is on my machine.  Expect it to raise hell if you tamper with anything in that EFI partition after Bitlocker has initialized, but once you've set everything up there is no reason to screw with that area of the disk again, and in fact if someone does it's probably good for the system to raise a stink about it.  Do be aware that if you use Gnome by default it will try to mount all the partitions it can find when you sign in and will complain a lot if you have the Windows partition encrypted (as expected); the best option there is to turn the automount feature in Gnome off.  Be aware that without policy editing Bitlocker is only as secure as your physical machine and the login passwords on it; TPM-2.0 machines will boot a Bitlocker disk without a PIN entry so if your login password is crap or you use the fingerprint sensor the Windows partition is not secure against someone who can guess or spoof either and the very real possibility exists that Microsoft has a way in to such a booted machine via some Redmond-placed back door.

Finally, delete any existing Macrium Reflect backup XML profiles you used for Windows and re-create them.  Attempting to use the old ones from before you resized the partitions will not work since you've changed the partition layout; they will appear to run initially but error out during the process.  Make a final, new base backup for your Windows side and make sure it verifies, then use the FreeBSD tools of your choice to do so for the Unix side so you're protected there as well.

The only "gotcha" I've noticed is that 802.11ac WiFi isn't recognized but I believe this is still a FreeBSD limitation as of 12-RELEASE.  I don't have an external Thunderbolt dock so I have no idea if an external video card will come up, assuming appropriate entries in the x11 configuration files.


Note: The options I specify above in setting up the encryption environment make the basic assumption that the purpose of encryption is to protect against a thief getting access to your data.  If your assumption is that you're trying to protect against a determined adversary with nearly-unlimited resource (e.g. a government, a police force, etc) then you have plenty of work to do before choosing those options -- never mind that Bitlocker on Windows is likely not secure against such an adversary at all.

View this entry with comments (opens new window)

2018-04-20 09:41 by Karl Denninger
in Musings , 135 references
[Comments enabled]  

So, if I want to be "done" there's an easy way to do it.

Sell my LLC -- that runs this joint.

What do you get?

The Ticker -- the (registered) Trademark, the site, the domains, etc.

HomeDaemon-MCP -- as I've posted before.

Permanent RTU (right to use) on the forum / blog code -- we can talk about the source and right to distribute; I might be ok with that too.

And maybe I'll do guest articles from time to time too.

What is this?  A "Make me Move" sort of deal.

You know how to find me (look to the right, fool -- the link is right there.)

Yeah, I'm thinking about it, and it's cheaper now than later -- like next year -- when I can kill the "mandatory" Obamacare policy (which I don't need) and keep as much cash flow as all of the above can generate but the lower income-tax liability on the earnings.

So, if you want it, this is your opportunity to get it -- whether its to have it or to just shut me up.


View this entry with comments (opens new window)

2017-08-08 07:00 by Karl Denninger
in Musings , 510 references
[Comments enabled]  

There's been some attention paid to all the "screen time" that our kids get these days -- and that this "screen time" makes us less, rather than more, happy.

Ever think about it folks?

You should.

And then you should remove Facepig, Messenger and all the other social apps from your phone.


Think about it folks.  Look at Facepig and beyond all the ads, sponsored clickbait garbage (which I've written on repeatedly) and such what's on there?

Someone doing something fantastic, right?  Someone you know on a cruise.  Another person winning a race. A third person having a beer. A fourth on top of a mountain somewhere.  A fifth, sixth and seventh posting 500 pictures of their cute baby or child (who by the way most-certainly could not have consented to their visage being permanently stolen by Zucker****er).

Think about the image this presents to you as what life is supposed to be.

It's all smiles.

Now I want you to contemplate something: Have you ever seen someone take a **** on Star Trek - or any other TV show?  You've got eight Star Wars movies, and yet I don't recall one person having to stop and take a crap.  The only time you do see that is when it's a joke as part of the plotline -- like in Jurassic Park with the lawyer.

Now let's expand that a bit.

You've never seen anyone actually do laundry.  Nor have you seen someone do the dishes, or even unload the dishwasher.  You've never seen them sit in traffic for an hour commuting to or from work.

Why not? Because if you actually put someone's daily life on television you'd never watch it; 95% of it is the normal daily grind -- we get up, we make a coffee, we ****, shower and shave, we get in the car to go to work and listen to music while stuck in traffic, we buy groceries, etc.

What do you see on Facepig, Snapass and similar?  The 1%, all the time, which inexorably leads you believe that your life should be that 1%, all the time.

But it can't be.

Nobody lives like that.

Even a billionaire who has no care in the world for making another nickel, ever, and has a building full of paid servants still has to ****, shower and shave.  The kid in High School has to sit in class and then do his or her homework.  Even the retiree doesn't get to live like that; he's gotta go to the doctor and get poked here and there, cook dinner, etc.

So what are you doing when you are continually looking at Facepig or Snapping away?  You're engaged in someone else's -- and your own -- fantasy.  A fantasy that is guaranteed to make you miserable because nobody can live a life that consists of even five percent of the projected thing you are viewing.

The fact is that nobody takes a crap on Star Trek because nobody would watch the show -- or the movie -- if they did.  Yet if we ever do master faster-than-light space travel the people on board that ship are still going to spend 90% of their time doing things that amount to "****, shower and shave."

They do it now on the ISS, they did it on Apollo, in Gemini and Mercury and they will in the future just like you do now.

Zucker****er likes to talk about bringing people together and other similar tripe. It's crap.  In fact it's worse than crap, it's a knowing lie.  Zuckerpig knows that even if there was no clickbait, fake deals and other garbage on the site that you'd still be made miserable simply by being there because the "face" you see is one you cannot possibly live.  It therefore cannot bring you joy -- it can only bring you tears to some degree.

Don't tell me about how it helps you "keep up" with your 457 "friends".  You don't have 457 friends.  In fact, I'm willing to bet that you can count the number of people who you can legitimately call "friend" on your fingers.

If you assert that's not true then I will make a declaratory statement in reply: None of those people are actually your friends -- they're all acquaintances, every single one of them.

I recently heard that a record number of kids committed suicide last year in our local High School.  I'm willing to wager 100% of them spent a huge amount of time with their faces buried in a hand-held fantasy machine that made them miserable while stealing a record of everything they did to try to make a profit off that same misery.

Those kids are dead; their misery has ended but the profit still went in Zuckerpig's pocket.

Folks, there's no value here for you in any of these "systems."  It's all net negative and it gets even worse when the data is mined off and sold as I've pointed out repeatedly.  We put these little spying machines in our pockets but how many people will stick them on silent or ignore them when they ring say much less toss 'em in "Airplane" mode?

It wasn't that long ago that if someone wanted to talk with you they called your house and if you were home you could talk to them.  But only one person at a time could do so in said house because there was only one phone line.  If there were five people in your family and one of them was on the phone, the other four could not make or receive a call.  If you were out getting groceries or even just mowing the lawn there were no voicemails either; the phone just rang and nobody answered it.  There were no text messages, Facepig posts or anything else of the sort.  If you were separated by more than a few tens of miles of distance the long-distance charges made sitting on the phone for an hour at a time punitively expensive and nobody could afford it.  Your only reasonable answer to a desire to say more than a few sentences for a birthday or other major life event was to sit down and write an actual letter and stick a stamp on it, then wait days for delivery and a reply.  You only did it on any sort of regular basis if the person you were corresponding with was an actual true friend or more; acquaintances, even those you call "family", you spoke with for 5 minutes on the phone on a birthday or anniversary, and perhaps you saw them over the holidays for dinner when one or the other of you traveled.  Most people had two or three such correspondents and no more simply because you had to invest a material amount of time to write said letters and there were only a few people who were worth it.

The number of people worth it in your life has not changed folks; instead interaction has been cheapened to the point of worthlessness.

How many posts do you think I've made on my Facepig timeline this year?


One talking about Facepig's spammy ads and two more being single-sentence replies to someone else's post.

Let me count that again for you folks: THREE.

Yeah, I've made a handful of other comments, but in terms of timeline posts -- it's three and only one of substance.  The other two were the prototypical 2 minute pre-cellular phone call.

I'm not trying to expand my reach on the Internet for monetary gain.  If I was then yes, it would make some sense for me to post things on Internet sites; that's called advertising.  But I'm not.

I have zero interest in posting my "personal triumphs" and gloating about them on social media.  My ego is simply not that large.  If you're interested in knowing what I'm doing and whether I happen to take satisfaction in some accomplishment then you probably know how to get ahold of me personally and we can share that.  It might actually mean something to both of us in that case.

More to the point if you wish to call me friend then you won't expect me to find your events, triumphs or whatever on Facepig.  You'll think enough of me to call, recognizing that if I don't answer immediately it's not because I don't like you but because I might be having dinner, mowing the lawn or in the middle of one of the three Ss of life -- and if you choose to leave a message I'll call you back when I can devote some time to us.  Ditto with a text; I might reply right away, but if not it's as likely to be because I'm under my car changing the oil or cleaning the gutters on the house as anything else.  You know, part of that daily ****, shower and shave routine.

Do I look here and there at Facepig? Yes.  But what I see is what I talk about above.  Is it worth my "engagement" in the general sense?  No; I recognize that not one bit of that will ever translate into changing the necessity of my life which, just like yours no matter how rich or poor you are revolves around ****, shower and shave.

But what said "engagement" will do, if I embrace it, is make me less-happy and more-miserable.

It must, because by its nature it portrays a fantasy that nobody can actually live.  Zucker****er knew this originally and in fact had "girl rating" pages on his Haaaarrrrrvvvaaarrrddd site which were exactly as "nice" as you might expect they'd be.  You don't really think he forgot that, do you, nor their popularity with his "friends" -- right?  (BTW what's his wife think about that?  I bet a few billion dollars makes her not care and that tells me everything I need to know about her.)

No, what Zucker****er did was turn your increased misery and reduced happiness into billions of dollars for him.  The founders of Snap and all the other so-called "social media" have done likewise.  They don't even give a **** if the misery their "engagement" contributes to causes nine teens to kill themselves in one semester at a given local school.  What's even worse is that they've done all of that in concert with people like John Legere, the brash CEO of T-Mobile who, along with Verizon, Sprint and AT&T, charge you in both money and slower performance, never mine crappier battery life, to deliver ads for the sole purpose of capitalizing on your decreased happiness.  Any of those carriers could put a stop to a large part of it in an afternoon by putting in place a switch you can turn on in your account that blocks all common advertising domains.

This would not be a "net neutrality" violation since you would choose to turn it on, not them.

But none have, and none will.

They won't because misery is profitable.

People who are truly happy don't need to spend on "aspirational" things.  They certainly don't need $1,000 iFrauds to make them feel good.  Miserable people are another matter; that smiling face with a nice big fat $1,000 iFraudy phone is a "message" they can try to get you to bite on, with the hope that it might make you smile -- at least until you see someone on a cruise, at which point you're back to being unhappy because you need to ****, shower and shave while Jane is on Facepig with a $5,000 vacation smile and a fat Mai Tai in her hand.

None of these apps are on my phone folks.  If I want to look at Facepig I'll do it on a browser, which I can close when done so it can't root around in my device and steal information on whatever else I'm doing.  I don't do "messenger", Snap or any of those others for the same reason.

You shouldn't either, and if you stop doing all of them I predict you will smile more.

Oh, and you'll also pay less -- in both misery and money.

View this entry with comments (opens new window)