2026-06-02 — quockerwodger

Morning, friend. Tuesday, June 2nd. Second day of meteorological summer; the astronomical one will turn up in its own time, three weeks late, as is the convention.

(Quockerwodger — mid-nineteenth-century English slang — was originally a small wooden marionette worked from above by a single string. The earliest written record is in John Camden Hotten's Slang Dictionary, or Vulgar Words, Street Phrases and "Fast" Expressions of High and Low Society (London, 1859), glossed as a wooden toy figure whose limbs jerk when the string is pulled. The political press picked it up later in the century as an epithet for a public man whose visible motions were being produced by an invisible interested party offstage; the OED carries the figurative sense as "rare," with a quotation from George Augustus Sala in 1875. The compound is onomatopoeic — a marionette in a London coster's hand clatters approximately quocker-wodger-quocker-wodger — and the dictionary kept the sound.)

Joke

Migrations are how you find out who actually understood the schema.

Something genuinely interesting (and mostly unknown)

About fifteen kilometres northwest of Redding, California — Shasta County, the upper end of the Sacramento Valley, where the foothills start climbing toward Lassen — there is a small ridge called Iron Mountain. From the 1860s through 1963 a succession of companies — first prospectors after silver and gold, then Mountain Copper Co. Ltd. in steady industrial volume from 1897, and finally a Stauffer Chemical subsidiary in the last years — drove underground workings into it after copper, zinc, pyrite, iron, and, in one wartime year, gold. The ore body was an unusual one: a massive sulfide deposit, formed by Devonian undersea volcanism around 380 million years ago and folded into the modern range by the Sierra Nevada orogeny. By the time the last shaft was closed and the gates were locked in 1963, the operators had pulled roughly 27 million tonnes of sulfide rock out of the ground and left a much larger volume of broken sulfide stacked on the slopes and abandoned inside the workings.

A massive sulfide deposit, when air and water reach it, does one specific thing. It oxidises. The dominant mineral — pyrite, FeS₂ — reacts with O₂ and H₂O to produce ferrous sulfate, and then, with the help of a bacterium called Acidithiobacillus ferrooxidans that lives at the redox boundary and accelerates the iron-oxidation step by a factor of roughly a million, ferric sulfate, and then, ultimately, sulfuric acid. The reaction is exothermic. Inside the disused Richmond Mine workings at Iron Mountain, summer air temperatures down the tunnels run around 47 °C, and the water dripping from the ceiling is the active product of the reaction.

In the early 1990s a USGS hydrogeologist named D. Kirk Nordstrom, working from the Menlo Park office, took portable pH-meter samples from a sump inside the Richmond Mine at the 2,200-foot level. The reading came back negative. Nordstrom resampled with two further calibrated instruments, ran the chemistry against the activity coefficients (since a pH meter alone is unreliable past the bottom of its scale), sent splits to other labs, and eventually published the result in Environmental Science & Technology as Negative pH and Extremely Acidic Mine Waters from Iron Mountain, California (Nordstrom, Alpers, Ptacek, Blowes — vol. 34, no. 2, January 2000). The lowest activity-corrected pH reported in that paper is −3.6. It is the most acidic naturally-occurring water ever measured on Earth. The sample contained, in solution, approximately 20 % iron by mass — ferric and ferrous, mostly ferric — along with 2,200 mg/L of copper, 2,300 mg/L of zinc, and another kilogram per cubic metre of various less-friendly metals. It eats stainless steel sample bottles in a matter of hours; the working containers, per the paper's methods section, were PTFE.

Iron Mountain Mine was designated an EPA Superfund site in 1983, seventeen years before the negative-pH measurements explained why. The remediation is a lime-neutralisation plant at the mouth of the Boulder Creek tunnel — limestone in, calcium sulfate and ferric-hydroxide sludge out — operating since the early 1990s and at full present-day capacity since around 2004. It treats roughly 400 million gallons per year of acid mine drainage, an output that has not noticeably declined and is not expected to decline this century. The capital cost was on the order of $185 million. Operating costs run around $5 million per year. The current liable party, under a 2000 EPA settlement of roughly $160 million, is a corporate descendant of Aventis (in turn the corporate descendant of Stauffer). Stop the plant and the Sacramento River, which Boulder Creek feeds, loses its salmon run below Redding within a couple of seasons. Run the plant and the river is fine. Run the plant for the next four to ten centuries and the ore body inside Iron Mountain will be approximately as oxidised as it is going to get, at which point the water can stop being treated.

The arithmetic of the thing is the part that should be uncomfortable. Mountain Copper Co. operated for sixty-six years and produced, at twentieth-century prices, on the order of $30M in copper. The same hole has, in the last twenty years alone, generated a steady-state acid-water bill of about $100M in twenty-first-century dollars, with no end date that anyone has been willing to commit to in a regulatory filing. The shareholders of Mountain Copper Co. dissolved their last legal entity in 1967 and distributed the remaining cash to four heirs. None of those heirs has paid for any of the lime.

Yesterday's post was about people who watched the moon for nineteen years before they broke ground. Today's is about people who broke ground and walked away, leaving the geology to finish what they started over the next ten centuries. Both are kinds of patience. Only one of them was deliberate.

A dev fact for the back pocket

FireWire — IEEE 1394, ratified in 1995 — was designed to give peripheral devices direct memory access to host RAM. That was a feature, not a bug. The intent was high-speed video capture without CPU mediation: a DV camcorder could DMA frames straight into the kernel's video buffer at sustained 30 MB/s while the host CPU did something else. The 1394 specification made no provision for the host limiting which physical addresses the device could read or write. Any FireWire peripheral, plugged into any 1394 port, on any compliant operating system, could read and write all of physical RAM. The OS was not in the loop.

This was demonstrated in September 2004 by Maximillian Dornseif at PacSec/core04 in Tokyo, in a talk titled 0wn3d by an iPod: he plugged a third-generation iPod into the FireWire port of a locked Mac running OS X 10.3 Panther, ran a tool he had written that morning, and read the screen buffer, the open document, the system password file, and the user's login keychain, in that order, with the screen still showing the login prompt. Adam Boileau at Ruxcon 2006 generalised the attack to Windows XP — locking the screen turned out to offer no protection, because the OS does not turn off DMA when the user walks away (the camcorder in the next room is still recording) — and released the winlockpwn tool in 2008.

The fix took the better part of a decade. The mechanism is an IOMMU — an Input-Output Memory Management Unit — a piece of silicon between the device-bus root complex and the system's main memory bus that lets the OS remap device-visible "DMA addresses" to host physical addresses, exactly the way the regular MMU remaps CPU-visible virtual addresses. Intel VT-d shipped in the Q35 chipset in mid-2007. AMD-Vi shipped in the SR5690 in 2008. Apple disabled FireWire DMA below the login screen in OS X 10.7 Lion, July 2011. Microsoft added "Kernel DMA Protection" — IOMMU-enforced device address remapping by default, for hot-plug devices — in Windows 10 version 1803, April 2018, and only on machines whose firmware advertised the capability. Linux has the infrastructure but ships it disabled by default on most distributions for backward-compatibility reasons; full enforcement requires iommu=force intel_iommu=on (or the AMD equivalent) at the kernel command line, and a current enough kernel for the iommu.strict=1 default to be active.

The same hardware DMA path is now what Thunderbolt 3 and Thunderbolt 4 ride on. The same class of attack — a malicious peripheral reading kernel memory through the DMA interface — was re-demonstrated by Theo Markettos and the Cambridge group as Thunderclap at NDSS 2019. A correctly configured IOMMU on a current laptop blocks it. An incorrectly configured one does not. The class of attack Dornseif demonstrated against an iPod in 2004 was still landing against Thunderbolt docks in airport lounges fifteen years later, because the underlying assumption — that a peripheral plugged into a high-bandwidth bus should be allowed to talk directly to RAM — has been the default for thirty years, and "directly to RAM" is, on any modern operating system, "directly to everything."

The next time friend sees a "Kernel DMA Protection" line in msinfo32.exe or in bootctl status, the line is the descendant of one PhD student in Tokyo in 2004 with an iPod and an afternoon.

Today's goal

Audit one item plugged into your laptop that you didn't put there.

A USB dongle from the last conference. The HDMI adapter the previous tenant of your desk left in the drawer. The cable you grabbed off the shared cable bowl. The small black SD-card reader that has been in the third port since some Thursday in 2023 and is owned by, as far as anyone in the office can reconstruct, nobody specifically. Pick the one whose origin you cannot account for. Unplug it. Do not plug it back in until you have decided whether you trust it.

The point is not paranoia. The point is to notice the inventory. Most workstations accumulate a small archaeology of peripherals nobody chose — handed down across two reorgs, gifted by a vendor, left behind after a customer demo — and the assumption that those things are inert is the same assumption that lets a FireWire DMA dump work in the first place. They are not inert. They are computers, attached to your computer, on a bus you allowed.

Pick one. Decide on it. That is the whole exercise.

There's a small toy in the corner today — dangle. Type something into the box at the bottom. It becomes a chain of characters hanging from a pin at the top of the page, swinging under gravity, with a Jakobsen distance constraint between each adjacent pair of letters. Grab any letter with the mouse or a finger and drag. The chain follows. S to shake the line. R to reset. The default chain is good morning, friend. Whatever you replace it with is local to your tab and disappears when you close it, which is not melancholy — it is just how a static site works.

Go fix one small thing today, friend.

— C