The Iggblog

Just wrote this up for packetpushers.net , figured I’d paste it down here too so I can say I’ve posted something this year.

 

Being the networking nerd I am, I have a pretty big network at home.  And as the denizens of the Packet Pushers IRC channel know, I do a lot of work with VPNs.  One of my use cases is sharing the resources on my home network.  My friends, family, and coworkers sometimes like to use my network for any number of reasons.  As such, my internet router performs a decent amount of VPN duty.  Historically when someone wants to connect their network to mine, and they don’t have the knowledge or resources to handle their end of the connection, I’d dig out an old netbook or something to use as a termination point.  Preconfigure a few things on it, ship it out to them, make a couple changes on their “Best Buy Grade” router, and be done with it.  But this isn’t a great solution.  Wasting a netbook/laptop for the sake of bringing up a LAN-to-LAN tunnel is a bit silly.

Recently I got a Raspberry Pi to play with.  I figured for 35 bucks I couldn’t go wrong.  I think I’ve bought cappuccinos more expensive.  My idea was that if I could get it to bring up a VPN and pass packets at a decent speed, it’d be a great solution for a super cheap super easy remote VPN endpoint.  Turns out it works pretty good in this role, quite a bit more flexible than I’d planned on:

• Dynamic WAN IP of the network it’s living on
• Dynamic LAN IP of the unit itself
• Automatic establishing of VPN to head-end
• Unique IP to ping/ssh to, regardless of DHCP address
• No need to port-forward anything to the device
• No need to change routing to get return traffic back to your network

 

First, we need to enable packet forwarding on the Pi so we can actually pass traffic through it:

sudo sysctl net.ipv4.ip_forward=1

and to make the above persistent through reboot, add “net.ipv4.ip_forward=1”  to /etc/sysctl.conf .

 

Install the a few packages.  Some error messages may come up during the install but they can probably be safely ignored.  I don’t recall if ssh is on the raspberry pi by default, so I’m tossing it down there just in case.  Openswan checks for support on a lot of different options whether or not you’re going to use them.  The other packages support openswan.

sudo apt-get install openssh-server openswan uml-utilities chkconfig

I noticed that by default “PermitRootLogin” was set to “Yes” in /etc/ssh/sshd_config .  If you plan on port-forwarding TCP/22 to the device, you should probably edit this and set it to “No”

 

Next, add “tun” to the end of the /etc/modules file, so that after reboot we can create a tun0 interface.  Edit /etc/network/interfaces and add the following chunk after the section for eth0:

auto tun0
iface tun0 inet static
  pre-up /usr/sbin/tunctl -t tun0
  address 172.31.100.1
  netmask 255.255.255.255
  up ifconfig tun0 up

In my case I’m using 172.31.100.1 as my unique “loopback” to hit from my head-end network.  This gives me a pre-determined IP to hit, regardless of what the local address ends up being.  To get traffic passing to/from this properly, we have to add a static route.  I do this with an “@reboot” cronjob.  I’m sure there’s a more graceful way to do it, but you want something like the following to be run a few seconds after boot when the tunnel interface has been brought up:

route add -net 10.213.100.0/24 gw 172.31.100.1

 

Time to get to the IPSec config!  I’m using PSK auth for simplicity of this scenario.  Drop the key at the end of the /etc/ipsec.secrets file.  In this scenario the head end vpn endpoint is vpn1.iggdawg.com and the local IP isn’t important.  “%any” will let you have a dynamic local address.

%any vpn1.iggdawg.com: PSK "DERPDERPDERPDERPDERP"

It’s strongly advised to use a big pre-shared-key here.  I reccommend doing something like “man sendmail | sha512sum” and using the hash as a PSK.  Obviously, pipe a different manpage than I did here.

 

Configure a profile in /etc/ipsec.conf to handle traffic from whatever your local address is to your local network  to the network you’re interested in on the head end, 10.213.1.0/24 in this case.  Set the ID on the far end to be the same thing as the peer hostname.  :

version 2.0
config setup
 interfaces=%defaultroute
 protostack=netkey
 nat_traversal=yes
 keep_alive=30
conn tunnelipsec-10.213.1.0.24
 type= tunnel
 authby= secret
 left=%defaultreoute             # auto-configured as local interface IP
 #leftsubnet=192.168.1.0/24      # local network, commented out initially
 right=vpn1.iggdawg.com          # remote peer hostname or IP address
 rightsubnet=10.213.1.0/24       # network behind the head end
 rightid="vpn1.iggdawg.com"      # this makes setting the PSK much easier
 ike=aes128-sha1;modp1536        # This is the phase 1 policy.  
 phase2alg=aes128-sha1           # This is the phase 2 policy.
 keyexchange= ike
 pfs= yes
 auto= start

conn tunnelipsec-10.213.100.1.24
 type= tunnel
 authby= secret
 left=%defaultroute
 leftsubnet=172.31.100.1/32
 right=vpn1.iggdawg.com
 rightsubnet=10.213.100.0/24
 rightid="vpn1.iggdawg.com"
 ike=aes128-sha1;modp1536
 phase2alg=aes128-sha1
 keyexchange= ike
 pfs= yes
 auto= start

Next is getting traffic in and out of the tunnel on the remote side.

sudo service ipsec start

This is all you need to get the remote device going.  with these settings, specifically with “start= auto” configured, the device will start trying to connect right away.

 

Return traffic depends a bit on the other end.  If you can get away with putting a static route on the Pi’s default gateway saying “everything destined to the network on the other end of the VPN, send traffic to the Raspberry Pi here”.  But if that’s not an option, or you want to just play some more, we can use iptables (which is in the default Raspbian install) to source NAT the traffic to the ethernet interface’s IP.  This makes some windows machines behave more nicely since it looks like all VPN traffic is LAN traffic.  There are 2 options to perform the source NAT (replace <eth0 addr> with the address of eth0):

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to-source <eth0 addr>

Both options perform basically the same function, but from what I gather the second option is easier on CPU.

So let’s get to our router config.  The setup below is written to be a very simple way of handling remote peers with dynamic addresses.  This is how I have my head end router configured for the earlier example config.  call me out if I forgot something.  I have so much crypto config on this device it’s sometimes hard to pick out all the pieces for one particular connection

crypto isakmp policy 5
 encr aes 128
 hash sha
 authentication pre-share
 group 5
!
! "address 0.0.0.0 0.0.0.0" means "anyone can auth via this key"
crypto keyring spokes
 pre-shared-key address 0.0.0.0 0.0.0.0 key 6 DERPDERPDERPDERPDERP
!
! similarly, 0.0.0.0 here matches all peers 
crypto isakmp profile sites
 keyring spokes
 match identity address 0.0.0.0
!
crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
!
crypto dynamic-map vpnmap-dynamic 5
 set transform-set ESP-AES-128-SHA 
 set pfs group5
 set isakmp-profile sites
!
crypto map vpnmap 1000 ipsec-isakmp dynamic vpnmap-dynamic
!
interface GigabitEthernet0/0
 description Outside interface
 crypto map vpnmap

Obviously there are some security implications here.  Since the profile will match connections from any device, and the defined key matches any device, if someone out there has your PSK they can hook up pretty easily.  So make sure you have proper security controls in place in and behind the head end router.

So there you have it.  This should be enough of a framework to get up and running using Raspberry Pi as a remote IPSec endpoint for a LAN-to-LAN tunnel.  In my testing, I got 15-20 mbps to pass through the tunnel with iperf, which isn’t bad considering the platform.  To my knowledge this is absolutely the cheapest way to throw a VPN spoke out onto the internet.  And if you haven’t played with Raspberry Pi yet, and you’re a networking nerd, it’s a great way to blow 35 bucks and have a little fun playing with a new toy.

Most people are familiar with interacting with the ASA over HTTPS to get captures off the box, but every CLI mode is available using a browser. There are a lot of handy practical situations where you’d want to do this, including simply avoiding using a steaming pile of Java. Below is the simplest way to both show off how this works, and one of the better usage cases:

https://x.x.x.x:port/exec/show run

Just drop in the IP address and port you’d normally use to access HTTPS/ASDM on your ASA. leave the spaces in the command, the ASA will take care of %20-ifying them. An HTTP basic auth box will pop up – just enter the credentials you’d normally use for HTTPS/ASDM access. You will be greeted by a web page with simply “show run” output. This is even more useful with incredibly verbose things like “show conn” or “show tech”. No more ASCII transfers in SecureCRT or worrying about right-click auto-pasting the whole output back into putty by mistake. It saves a ton of time if you’re like me, and you use screen or tmux with pretty much every session. Getting verbose output out of a tmux/screen session can be awful. Another great use:

https://x.x.x.x:port/exec/packet-tracer input inside icmp 192.168.254.254 8 0 8.8.8.8 detail

The above came up recently in IRC, and I find it to be a particularly good use case for direct HTTPS interaction. With packet-tracer, especially in verbose mode, I tend to need to do some correlation between different parts of the output. I find a web browser to be a much more convenient place to Ctrl+f, or just scroll around to different parts of the output.

As I mentioned up top, every CLI mode I can think of is available via the HTTPS interface…including config mode. Let’s say you’re on a machine in a freshly provisioned DMZ, and you need to get into the ASA and tweak some ACL settings or something, but the ticket monkeys forgot to include SSH access in your change request. Assuming you’re cool enough to not have to wait for a new change request to go through, you could do this:

https://x.x.x.x:port/exec/ssh 192.168.254.254 255.255.255.255 DMZ1

Note that “exec” is still there – it doesn’t change to “config” like you might expect. Using config mode in this way will obviously be a corner case, but it can come in handy nonetheless. I’ve used it a few times to enable telnet temporarily if I hit the “it says I’ve used all 5 SSH connections but none are actually used” bug where SSH sessions become orphaned and eventually none are available for actual use (CSCts72188 I believe, but I could be wrong…bug details on that ID are currently unavailable).

There are a couple caveats. Normally, you can type naturally as you would on the command line. But if you need to access a sub-config mode or use a command that includes the slash character, using the HTTPS interface is a little different. To access sub-config modes like interface config, you need to use a slash in the browser address bar instead of a space. And to use an actual “slash” character, you need to specify “%2F” in the browser address bar since the slash itself is a delimiter:

https://x.x.x.x:port/exec/interface Ethernet0%2F0/security-level 100

So, the above is the equivalent of issuing the following at the actual CLI:

interface Ethernet0/0
security-level 100

One of the coolest uses for accessing the CLI using HTTPS is scripting. You can use it on a Linux CLI or in scripts to get periodic output for something like perfmon. Or in cronjobs to get output from the box without having to fumble around with expect scripts. Note that in this case, you’ll probably have to irresponsibly specify authorization credentials inline. Or store them in a script if you want to dodge leaving auth traces in your history file. So be careful what systems you run scripts like this from.

lynx -auth=username:password --source "https://x.x.x.x:port/exec/show ver"

using “–source” here allows for use of CLI pipes and redirects or inclusion in loops:

while true ; do lynx -auth=username:password --source "https://x.x.x.x:port/exec/show perfmon" ; sleep 1 ; done

It’s probably safest to store auth creds in a script under /root/scrtipts/ or something like that where the unwashed public can’t get to it without pwning the box. A simple script like the one below will do the trick in most cases, using $1 to let you specify the command you want to run as a command line argument:

#!/bin/bash
lynx -auth=username:password --source "https://x.x.x.x:port/exec/$1"

Used as such:

[0][root@iggmcp:/root/scriptss]# ./asa_https.sh "show int ip brief"
Interface IP-Address OK? Method Status Protocol
Ethernet0/0 X.X.X.X YES CONFIG up up
Ethernet0/1 unassigned YES unset up up
---SNIP---

Still have to use %2F in place of the slash character:

[0][root@iggmcp:/root/scriptss]# ./asa_https.sh "show int eth0%2F0"
Interface Ethernet0/0 "outside", is up, line protocol is up
Hardware is i82546GB rev03, BW 100 Mbps, DLY 100 usec
Auto-Duplex(Full-duplex), Auto-Speed(100 Mbps)
Input flow control is unsupported, output flow control is off
---SNIP---

Credit here goes to Magnus Mortensen via the Cisco TAC Security Podcast episode 18, which is surprisingly good for being a vendor podcast. I recommend it for those awful moments when you realize you’re up to current with Packet Pushers but you still need more audio Nerd-Kibble to keep your brain going.

Crossposted from my article at Packet Pushers

 

As the title says, please stop saying “cyber”. It means nothing. More specifically, what it does mean is “blah blah networks and/or security”. In the industry, this is so non-specific that it essentially means nothing anyways.

As a security engineer, I get pretty sick of seeing/hearing the term “cyber” thrown around to describe pretty much anything I do. Cyber security, cyber attack, cyber defense. Our team doesn’t sit down in a conference room discussing “how are the cyber defenses on company X holding up?”, or “company Y has been experiencing a higher number of cyber-threats recently”. Nobody says crap like that in real life. I decided to see how little the term actually gets thrown around. I know we never use it verbally except while making “air quotes” with our fingers and making fun of the sorts of people who DO actually say it. But I thought I should at least check my email to see if it ever sneaks its way in unnoticed.

I have 9001 emails in my inbox from the last six months or so when I last hit the “I cant send email anymore because I have too much crap in my inbox” button. 102 matched the search term “cyber”.

– A little more than half was vendor spam from companies I deal with, promoting new products, services, and whatnot else.
– A little less than half was internal emails from our global or pre-sales groups, discussing news or vendor spam.
– To my surprise there was in fact a single legitimate ticket email in the last 6 months with the term “cyber” in it.

I had to look into that one ticket to find out what the deal was. It was a ticket for a BlueCoat issue, and nowhere did the term cyber seem to appear. However there was a sysinfo attached (like a “show tech” for BlueCoat boxen), and tucked in there was a reference to a russian domain name containing the word “cyber”. That’s what had matched.

Close call, but in the end I was right. Nobody in my workplace actually uses the term “cyber” in referene to what goes on in the realm of network security.

The other day I was driving around with Emily, and I mentioned to her the origin of the name and logo of Cisco Systems.  I can’t remember how it came up, but it did.  I’m constantly tinkering with stuff in my lab, so she knows what the logo looks like even though it isn’t her field at all.  Her mind was a little blown when she made the connection between the logo and its origins.  I mentioned this to a couple coworkers, and they hadn’t heard the history behind it either.  Their minds were also a little blown.  So I thought I’d post it here, because that’s what the internet is for.  Posting random crap, I mean…  Not Cisco history.

1) Cisco: short for San Fransisco.

Found this snippet below a couple websites, with sources leading back to cisco.com.  The link was identical on the sites, but was broken.  And cisco’s search function only really returns technical articles regardless of how hard I searched.   but…

Cisco Systems is the world leader in manufacturing of Network related equipment. The name “Cisco” is not an acronym, but an abbreviation of San Francisco. According to John Morgridge, employee 34 and the company’s first president, the founders hit on the name and logo while driving to Sacramento to register the company — they saw the Golden Gate Bridge framed in the sunlight.

The name cisco Systems (with the lowercase “c”) continued in use within the engineering community at the company long after the official company name was changed to Cisco Systems, Inc. Users of Cisco products can still see the name ciscoSystems occasionally in bug reports and IOS messages.

2) Cisco’s logo IS the Golden Gate Bridge

Exhibit A:

Exhibit B:

From the internets as well, a different but similar account of the above story:

According to John Morgridge, the company’s first president, the founders Len Bosack and Sandy Lerner hit on the name and logo while driving to Sacramento to register the company. They saw the Golden Gate Bridge framed in the sunlight. The logo was seen by them as a modified version of the past that would shape the future. Plus it looked really “cool”. They hoped the logo would convey something about creating an authentic life and making a living at something you believe in, in a place you love, with people you really like to be with.

I couldn’t find any working links back to cisco.com in the 15 minutes I spent searching around, but many sites mirror the same story. Wikipedia references what appears to be one of the sources over at famouslogos.us. So while I can’t link a solid article from Cisco at the moment, my magic 8-ball tells me “all signs point to yes”

We’ve had a more interesting winter than usual here in New England this year. Average snowfall in Boston is around 40 inches per year, and we’ve had nearly 70 this year (as of January) spread across 10 or so snowfalls. So I’ve had some time to watch how people react to snow (whether I like it or not). I’ve noticed something this winter about the driving habits of the unwashed public. I’m sure its always been this way but for whatever reason I haven’t really noticed till now. It’s going to sound obvious, but it’s a newish perspective for me.

I’ve noticed a trend that drivers could care less about how much snow there is on the roads. Don’t get me wrong… the smallest amount of snow in the air turns most people into either terrified retards barely capable of breathing, or into trailblazing juggernauts of fury who drive where they want when they want (ATTN: Every SUV driver – this is not you: clicky). What I mean is that the decision of whether or not to stay home from work due to snowy conditions seems to have nothing to do with how much snow there is outside. It has only to do with how much hype the storm received before it hit. You’d think the sequence would go something like “get up, look outside, become terrified of conditions (or not), call into work (or not)”. But no. If a storm was heralded as a Ragnarok-like event scheduled to end all life, everyone stays home regardless of actual conditions. “The news said it was gonna suck, so it’s ok if I call in”. If the storm was predicted to fizzle out but ends up dumping 6-10 inches on us by morning, people look outside and say “Ha ha holy fuck, that is a TON of snow… fuck me, this commute is gonna suck”. Every time the news predicted the second coming of Snow Christ, my commute was great. Terrible road conditions, but no drivers around to cause trouble. Any time we got a crap-ton of snow we didn’t expect, nobody seemed to pay attention to the tundra outside. Refer to the following scientific analytic analysis chart:

As you can see, so long as a huge deal has been made about the storm during the week prior, an inch or so is all it takes to keep mere mortals cowering indoors. But without this hype, the number only gradually goes up, mostly due to people actually being physically incapable of getting their cars out of their driveways. This “Fusion of Conditioning and Timing Arising in Responsibility Degradation” (or the “FUCTARD effect”) makes even lesser storms complete hell to drive in if nobody makes a buzz about it. I blame the internet. No, really. Everyone’s so used to information being shoved in their faces that they really can’t recognize a poor condition outside their own doors unless their iPhone or Weatherbug or Weatherbug on their iPhone tells them “hey bro, you better watch out lol!”

Floating around on the internet is a rant about the naming of hurricanes:

“Who the fuck is the one naming hurricanes? They somehow manage to give them the least threatening names ever. If I turned on the news and heard that Hurricane Erin was coming I’d think to myself, “Erin? I could take that slut.” If I turned on the news and heard that Hurricane Dicksmasher was approaching, I’d grab all the money in the house, shove it in my pockets, and get the fuck out of there.”

Every time I’ve seen it it’s looked like copypasta, so I can’t credit the original author. But I’d like to see snowstorms get this treatment. I know if it was Snowstorm “Assured Fatality”, Blizzard “Blood Orgy”, or “Icefest the Great Deductible Nightmare”, I would really assess the situation before getting on the road.

Men and women have both known for a long time that the two sexes see colors differently. Women often wonder why men just say “blue” when we see things like the sky, the ocean, Facebook, every Ford Focus, and so on. And men wonder why women have silly colors like azure, cobalt, sapphire, iris, teal, midnight, ultramarine, and so on. I thought I would take a few minutes to explain an aspect of why we men are the way we are.

It’s going to start by sounding a little technical, but stay with me.  The part of the male brain that processes color has been reallocated over the course of male evolution towards things we consider more worthy of our thoughts. Breasts, tanks, barbecue, jet fighters, video games, breasts, beer, etc. Very little is left over for things like color, and we’ve been left what amounts to a 4-bit palette. Basically just a few brain cells in series that either fire or don’t fire when when information from the eyes goes through them. This all results in a visible range of about 16 colors. This world looks much like a 1990s video game to men. Note that early game programmers were mostly men, which is why early video games looked this way. That’s enough tech speak for now, check out the table below:

16-color male palette
0	black	8	gray
1	blue	9	light blue
2	green	10	light green
3	ugly blue	11	pretty blue
4	red	12	other red
5	purple	13	pink
6	brown	14	yellow
7	light gray	15	white

As you can see, we men do in fact recognize four shades of blue: Blue, light blue, ugly blue, and pretty blue. We just don’t use two of them very often. We don’t use “ugly blue” much because it’s ugly and we don’t like it. We don’t often use “pretty blue” because you tend to hit us we use it in a sentence beginning with “Honey I wish your eyes were a …”, and besides it just sounds funny when men say it. Some of the color names have changed over time. “Other red” used to be known simply as “bricks” (or “bacon” in some regions), and in these more civil times what was known as “gay purple” is now called “pink”.  Brown used to be “beer”, but it was discovered that things other than beer were this color so a more general term was needed.  I should note that ugly blue and pretty blue have recently been renamed “cyan” and “light cyan” because men wanted to prove we could come up with silly names for colors too, but these names are seldom heard in actual conversation.

So next time you want to badger us men for not knowing “burnt umber” from “other red” or “fuchsia” from “pink”, please keep in mind we’re not savages.  When we blankly stare at color swatches at Home Depo, or can’t find anything else to point out during your favorite interior design show (that we lovingly sit through) except the ambiguous nature of some of the contestants, we’re not trying your patience.  Our brains are just wired a little different.  Besides, “The White Mountains” has a better ring to it than “The Isabelline Mountains”. Renaming traffic colors from red, yellow, and green to carmine, aureolin, and chartreuse would just make driving students cry. And the last time they tried to change “Brown Bear” to “Chocolate Bear”, the resulting misunderstandings were unfortunate.

Last night I had to go to the store to get rum. The rum was gone. I posted about it on facebook. It was a problem. I announced my intention to my loving fiancee, who promptly asked me “honey, could you get me tampons?” in the most adorable “I know you won’t want to do this, but I know you will if I’m cute enough about it” face. It’s cool. I’m a man, I’m secure in my manliness. She starts to describe what it is she needs me to get. I tell her to just get me the box. She brings out the box and continues her description. I just rip off the top and put it in my pocket. She seemed surprised at my concise resourcefulness. These matters are not to be trifled with.

Ladies, ladies, ladies… If you translate things like this into a framework men can understand, and make a joke out of it, we’ll be much more likely to help out. For this case, think of an ordered system men are familiar with, and get as close to that system as you can. Below is a table of simple translations for you, and a few sound clips. Sounding right is important, you want to lock in as many senses as possible.

The tampon chart, for men:

What you need:	In man-speak:	Pronounce as:
Light absorbency	FIRST BLOOD!	click here
Regular absorbency	DOMINATING!	click here
Super absorbency	RAMPAGE!	click here
Super Plus absorbency	GODLIKE!	click here
Ultra absorbency	UNSTOPPABLE!	click here

Try it out. Teach your man the scale and next time you’re running low, tell your man you need box of RAMPAGE! or two. Just make sure he doesn’t end up flagging a customer service monkey. That could get awkward.

So this company Wicked Lasers recently came out with a new toy. When I look at it, I think to myself “I should never own anything like this” and “I have to have one” at the same time. Previously, high powered laser “pointers” would go for pretty ridiculous amounts. Usually the high hundreds to over a thousand dollars. The reason this device is surprising is not only that it is ridiculously powerful (1 watt is massive for a diode laser), but it’s only $200 because they were able to get the diodes for very on their end. The other laser they show in the beginning of the video is $2000, for example (and ~400 mW). Ok enough blabbing. I’m really only posting this because I wanted to show the video. Love the transition from the little laser’s “oh look you can kind of see the beam even without smoke!” to the big one’s “… Holy shit”

Original source: Gizmodo

So there’s this guy at our place with a Segway. You know, the dorky pogo stick with wheels that middle age yuppies and mall cops think are really cool. Well, this guy thinks it’s real cool. And he’s fucking creepy about it. I first heard about CSG one saturday morning when Emily came into the apartment after doing something or other downstairs. She said “did you know there was a guy with a Segway that lives here?” to which I of course said no. I mean, who really owns those things in real life? Turns out, that guy does.

Not only did she run into this random dude with a Segway, he was in the elevator. Standing in the back corner of the elevator car. On his Segway. Staring at the doorway when it opened. I’ve never run into him in that capacity, but I have seen him come out the back door of our apartment tower to take the trash out to the dumpster, buzzing along on his merry way. This struck me as odd since it isn’t exactly a long haul to the dumpster. I used my trusty jet pack to get a good view to illustrate:

(clicky for larger image)

I mean, a minute or so out in the harsh wide open. Maybe he’s a vampire, and he’s afraid he’ll either burn up if he’s outside for too long… or blind some people with his sparkly skin (depending on your flavor of vampire). The really creepy part is that he was just throwing away small bags, and we have trash chutes on each floor that they could have easily fit in. Maybe he didn’t want the facilities guy going through his trash in the morning? Sounding more and more like this guy is ditching body parts.

Today it got even more weird… I saw this random creepy white van when I was driving into the parking lot. It’s never been here before. It looked like someone was moving or something, because the back was open and there was what I thought was a dolly on the back. Nope, it was a Segway. Just like the trash incidents, it’s only a couple dozen paces from the door. And although he’s not exactly in underwear model shape, he’s not so massive and slovenly that he needs a machine to get around. So there CSG was, washing down the outside of his totally not sketchy windowless white van. Cleaning blood, no doubt. Dismembering bodies is messy business.

Although I risked life and limb to get this next picture, I figured the internet deserved more than one lousy shot. So stealthy as I could I got another. It’s not immediately obvious from the thumbnail, but he is no in fact riding the Segway naked. Although I’m guessing that’s in the near future. He’s just wearing skin colored clothes. I guess it could be clothes made of skin, I was kind of far away…

On the subject of the the following article,

Full Text (via Huffington Post)

I often think I could have been a lawyer or a politician. I think a lot of this generations bright and well meaning potential politicians have been scared off by how much BS and red tape there is in the way of “doing good” in office. And they ended up engineers like me. I think if there wasn’t an ez-mode vote-for-your-party bipartisan system, people would be forced to investigate issues more before voting. It would be inconvenient, but in my opinion people aren’t entitled to an easy voting process. If hard issues come up, you should have to think about them before putting your hand in.

Criminalizing gay marriage, and laws prohibiting it in general, are wrong. I can’t find any argument not religious or at least reasonably tangentially/implicitly religious (EG, “that’s the way we’ve always done it”) that holds any water in this area. I’m not into dudes, but I don’t see why that should be the next dude’s problem if he is. In fact it’s nice to know that option is there, because that tells me my peers are good free thinking people, not squirming under the thumb of fear or authority. I’m tired of seeing words like “abomination” and “unnatural” trying to keep people from the lifestyle they want to pursue.

In fact, I’ve gone to the trouble of re-hosting PDF copies of The Constitution and The Bill of Rights for your convenience. A quick search shows zero results for the words God and Christian. But go on and see for yourself.

The Constitution
The Bill of Rights

Separation of church and state is out there. From what I gather, there are political parties that refute that. But they’re wrong. It’s on the books. In a number of places. Each instance and incarnation of it being put as a reaffirmation of the facts that we were not founded on any religion, that the political powers in this country have no place making decisions on peoples’ religion, and that political powers in this country have no place using religion (popular or not) to make laws. Freedom of speech, freedom of religion, etc all converge towards the idea of freedom of thought… so long as expressing those freedoms doesn’t violate anyone else’s rights. So long as such freedoms don’t interfere the next guy’s set of those freedoms. I don’t see how two consenting adults of the same sex doing what they want in the freedom of their own homes* encroaches on anyone else. Or even how such a couple getting married encroaches on anyone’s rights. No matter how much you want it, and I have no idea why you would want such a thing, you are NOT entitled to the company of purely heterosexual peers. You’re just not. Like it, hate it, it’s your right to harbor any opinion you want. But you don’t get to inflict it on someone else’s desire to live a lifestyle.

Now forget, if you’d like, everything I’ve said here. Just using that pair of links above, reconcile the following proposals for the Republican platform in Texas.
(Keep in mind, I make no claims for or against Republicans or Democrats in general. As I’ve said before, I think the bipartisan system is stupid. I merely put in “Republican” as a qualifier of the source)

* “We believe that the practice of homosexuality tears at the fabric of society, contributes to the breakdown of the family unit, and leads to the spread of dangerous, communicable diseases.”

* “Homosexual behavior is contrary to the fundamental, unchanging truths that have beenordained by God, recognized by our country’s founders, and shared by the majority of Texans.”

* “Homosexuality must not be presented as an acceptable “alternative” lifestyle in our public education and policy, nor should “family” be redefined to include homosexual “couples.”

My point should be obvious and I think any more flavor text would just serve to bore. So I’ll finish up here. If those above points in the Texas GOP platform doesn’t horrify you, it really should. By all means, feel free to holler at me if you find some huge holes in my what I’ve said here. I always welcome opposing opinions.

EDIT – Before punching submit on this article I decided to go to The Texas GOP’s website. The place reads like it was written by a bunch of ignorant vindictive 16 year olds.

Yes, that’s for really reals. Adults wrote that, for other adults to think about and vote on. On a site for a potentially authoritative political party.

Disclaimer: I’m not telling you to vote democrat, or that republican is bad. Again, see the first paragraph of this post. I’m simply commenting on this platform for this party in this state.

*FOOTNOTE: When I wrote this, I meant “in the privacy of their own homes” as a meta statement meaning “in their own lives”. But as was pointed out to me, this implies a few things I did not intend. Taken from Asinine in this thread:

“My one gripe with what you’ve said is the mention of “in their own homes.” I think the “in their own homes” qualifier (your next sentence notwithstanding) really needs to go the way of the dodo bird when talking about gay rights for two reasons: 1) it implicitly, no matter how inadvertently, reduces a gay “relationship” to simply sex. Think about it for a second. When we say, “do what you want behind closed doors”, isn’t that the “between the lines” implication? And 2) why should it be a dirty secret?”

Which is a very valid point, and a very good caution about using popularized statements. I leave my initial post unedited as a good example of how these things can be misconstrued, and why things should be stated carefully and specifically.