I am no longer using Ziply Fiber for now due to the price increase and running out of the promotion period. I am currently using Xfinity.It currently offers $50 for 1Gbps with 5 years price guarantee at my address for now. Use My Link if you are interested.

Key Takeaways

• Use the FCC broadband map to see all available ISPs at your address.
• Always check the broadband facts labels for real plan details (upload speed, after-promotion pricing, data cap).
• Fiber > Cable > DSL for speed, reliability, and latency.
• Xfinity is widely available but has customer service and pricing issues.
• Ziply Fiber offers symmetric speeds and no data cap, but installation can be slow and communication is lacking.

How to find out a good ISP for my home?

As I work in the tech field, a lot of my friends ask me what my ISP is and how to deal with Xfinity. I’d like to discuss this topic here today.

First, all the residential ISPs some time ago were highly subsidized by the FCC and federal funds. A lot of times, it is not economical for the ISPs to build out new networks. See the comments of u/jwvo on this post.

The easiest way to find out who serves you is to use the FCC broadband map, see here. Just enter your address and see all the providers. Fiber is better than cable, and cable is better than anything else. If you can get fiber, get it. If you can get cable, get it. If you can only get DSL, well, you have no choice. Below I will discuss my past experience with ISPs in the Seattle area.

How to find a good plan for a given ISP?

Read the broadband facts labels! A lot of times, the ISP hides it at the bottom of the page. Please, please check it.

Here is an example of a hidden broadband facts label provided by Xfinity:

Click the expand label, and read them line by line:

Here you can find the upload speed, after-promotion pricing, and the data cap, which is typically buried in the fine print. ISPs only show you the download speed in their advertisement. Take a screenshot of it and save it before ordering. In case of a dispute, you can use it as evidence.

ISP Comparison Table

Xfinity

Xfinity is notorious for their bad customer service and bait-and-switch promotion pricing. If you want to cancel, you have to call in and wait forever; there is a lot of friction to deal with them. Previously, they had a 1.2TB data cap until they just removed it a couple days ago. I personally never went over the cap, but it made me pretty nervous.

They use cable technology, so the latency is higher than fiber, and the speed is asymmetric. The upload speed is lower. If your Xfinity upload speed is >= 50Mbps, you are in an Enhanced Speed Market, which means you not only need to get a DOCSIS 3.1 modem, but one that is specifically certified by Xfinity to offer higher upload speed. I uploaded a PDF here, but it may not be the latest one. As of the time I wrote this in 2025, the URL is here.

The good thing about Xfinity is that their service is widely available and decently reliable (although when the power is out, they are out too) where I live near Seattle. They offer a /60 IPv6 prefix, which works pretty well (compared with Quantum Fiber, Ziply Fiber, and WaveG).

Previously, I’ve used the trick that at the end of the promotion period, I canceled the service and let my roommate sign up a new account with the same address and activate it immediately. No service disruption at all. As long as the new account is established, the old account will be canceled automatically. Nowadays, this trick is not needed since they have the 5-year price guarantee now. So, at most, you only need to do it once every 5 years.

This is the ISP I am currently using. The signup and installation process is a pain in the butt; it took me half a year and endless follow-ups to get the service installed. When I moved into where I live now, the previous owner did not use Ziply Fiber and there was no fiber buried.

After calling them, they needed a couple weeks to a month to bury the cable from the handhole in front of my neighbor’s house to the sidewall of my garage. After that, the technician from Ziply Fiber came to my place to do the indoor installation, only to find out that there was no spare fiber from their hub/splitter to the handhole in front of my neighbor’s house, so they just left. A couple months later, I scheduled another appointment, and the result was the same: technician came, no fiber, and left. This repeated a couple times, until I escalated this issue multiple times. They finally applied for a permit from the city (took several weeks for them to prepare, and took another month for the city to issue the permit). Then it was the forever wait for their contractor to pull the cables and close the permit. Then, wait for another couple weeks for them to update the system, activate the port, and finally another technician came and installed the ONT. The technician who worked for Ziply Fiber was very nice and the ONT installation was a breeze (see below).

However, the whole installation process was very painful, and I had to push the project till the end (I felt I was working to get this done). To be honest, if all processes were smooth, the installation should have worked out easily. However, in the case of any difficulties, there is absolutely a lack of communication between their back office, the different contractors (who installed the fiber from handhole to the sidewall of my garage, permit and pull fiber, etc.), and their technicians. I felt like I was working as a project manager to get this done. 😂 Ziply Fiber really should pay someone to do this job.

While I was painfully pushing the project, I ran my own fiber/Ethernet wiring around my place to make sure they were terminated and ONTs could be installed in a central location that I preferred. I also installed cameras and access points, etc. It cost me a lower couple thousand.

Till now, they have no IPv6 at all, but the symmetric speed, no data cap, lower latency, and more reliability buy me in. I am currently on their 1Gbps plan for $60/month for the first year, and after that it will be $90/month. Honestly, it is not cheap. I haven’t decided what to do after the first year, but I will probably stay with them for a while.

After the installation, the service works great and has never let me down. One bonus point is that their VP u/jwvo is very active on Reddit, and he is very responsive. If there are any issues general customer care cannot resolve, he is pretty good at it.

The speed looks like this:

ctyi@cuiDesktop:~/software/ookla-speedtest-1.2.0-linux-x86_64$ ./speedtest -s 51693 

   Speedtest by Ookla

      Server: Ziply Fiber - Bothell, WA (id: 51693)
         ISP: Ziply Fiber
Idle Latency:     2.66 ms   (jitter: 0.21ms, low: 2.42ms, high: 2.80ms)
    Download:   926.47 Mbps (data used: 418.6 MB)                                                   
                  8.05 ms   (jitter: 0.62ms, low: 2.07ms, high: 10.60ms)
      Upload:   940.79 Mbps (data used: 423.3 MB)                                                   
                  4.83 ms   (jitter: 0.71ms, low: 2.43ms, high: 6.58ms)
 Packet Loss:     0.0%
  Result URL: https://www.speedtest.net/result/c/3ce33b02-6706-42ce-9b67-7715fd5b5e1a

Recently, I learned that systemd-measure is introduced in systemd from version 252. In short, it provides the ability to measure the PCR of a unified kernel image (UKI) before they are actually booted. I played around with it, and below is my config. Hopefully it works for you if you are using Archlinux.

Environment before the setup

• An LUKS2 encrypted root partition with sd-encrpyt hook, see here
• A properly configured secureboot PKI system. I personally use sbctl

How it works

The systemd-cryptenroll allows to config a keyslot, which, ANY PCR values signed by a specific pubkey can unlock the volume. The systemd-measure can measure the PCR values of a UKI, and the measurement is signed by the keypair and inserted into the UKI. Thus, the initrd can unlock the volume since a signature of the current PCR measurements is provided to the TPM to release the master key to the volume.

Steps

1. Generate a keypair to sign the PCR measurement.

   openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out /etc/systemd/tpm2-pcr-private-key.pem
   openssl rsa -pubout -in /etc/systemd/tpm2-pcr-private-key.pem -out /etc/systemd/tpm2-pcr-public-key.pem
   

   The path here /etc/systemd/tpm2-pcr-private-key.pem has specific meaning documented in the man page

   If this option is not specified but it is attempted to unlock a LUKS2 volume with a signed TPM2 PCR enrollment a suitable signature file tpm2-pcr-signature.json is searched for in /etc/systemd/, /run/systemd/, /usr/lib/systemd/ (in this order).

2. Install systemd-ukify

   pacman -S systemd-ukify
   

3. Draft a config file per the man page

   [UKI]
   Linux=/boot/vmlinuz-linux
   Initrd=/boot/intel-ucode.img /boot/initramfs-linux.img
   Cmdline=@/etc/kernel/cmdline
   OSRelease=@/etc/os-release
   PCRBanks=sha256
   SecureBootSigningTool=sbsign
   SecureBootPrivateKey=/usr/share/secureboot/keys/db/db.key
   SecureBootCertificate=/usr/share/secureboot/keys/db/db.pem
   [PCRSignature:default]
   PCRPrivateKey=/etc/systemd/tpm2-pcr-private-key.pem
   PCRPublicKey=/etc/systemd/tpm2-pcr-public-key.pem
   

   Please note that, I used sbctl’s db key for secureboot signature. I used the previously generated keypair for PCR measurement signature.

4. Run ukify to generate the UKI

   ukify -c /etc/ukify.conf build --output /boot/EFI/Linux/ukify-linux.efi
   

   Per man page of ukify, it will call the systemd-measure, precalculate the PCR values, and sign the measurement with the keypair. The signature is stored in .pcrsig. According to the man page of the systemd-stub:

   A “.pcrsig” section with a set of cryptographic signatures for the expected TPM2 PCR values after the kernel has been booted, in JSON format. This is useful for implementing TPM2 policies that bind disk encryption and similar to kernels that are signed by a specific key.
   The output file /boot/EFI/Linux/ukify-linux.efi is also deliberately chosen so that systemd-boot can automatically pick it up.

5. Create a new LUKS2 slot with the pubkey of the keypair

   systemd-cryptenroll --tpm2-device=auto --tpm2-public-key=/etc/systemd/tpm2-pcr-public-key.pem \
   /dev/disk/by-uuid/$DISKUUID
   

   Now that the LUKS2 volume can be unlocked by any PCR measurement signed by the keypair. We already got the PCR measurement signed by the keypair in the UKI. Thus, the initrd can unlock the volume.

Please note, I did not create pacman hooks to recreate the UKI after Linux kernel or ucode updated, please do it yourself.

Conclusion

In conclusion, implementing seamless Linux disk encryption with systemd-measure and related tools offers a robust solution for protecting your data. While the setup process involves several steps, the resulting configuration provides a secure and user-friendly experience.

By leveraging systemd-cryptenroll and ukify, we’ve established a system where the Unified Kernel Image’s measurements, signed by a secure keypair, enable automatic unlocking of the LUKS2-encrypted volume. This approach reduces the need for manual intervention during kernel updates, enhancing the overall convenience of disk encryption on Arch Linux.

Remember to adapt the configurations to your specific environment and consider additional security measures, such as updating the UKI after kernel or microcode updates.

With these steps, you can enjoy the benefits of seamless Linux disk encryption, bringing us closer to the ease of use provided by similar solutions on other operating systems.

Happy encrypting!

This is the tax season again. I hate go to the post office to just get a certified label to make sure my tax return is delivered. I also hate to pay $4.15 for a certified mail. I know there is a way to track a plain mail with a barcode See my other post here, but it is not easy to use. Thus, I made a tool.

How to use it

1. Visit https://envelopetracker.com
2. Type in the recipient address and your return address, click generate
3. Remember your serial number and the recipient zipcode
4. Print the address and the barcode (The most important) on to the envelope
5. Tracking using the bottom part of the website
6. Star the Github project if you like it
7. In case of the website down, you can go to Github repo to deploy your own.

Above is a sample tracking record that can be obtained from the website.

Why it works

As a lot of people know, USPS has a handy tool called informed delivery. How it works is basically USPS scans the barcode on the mail, which can uniquely identify an address.

It turns out that you can generate your own barcode and put it on the mail, and USPS can help you track it! This functionality is called Informed Visibility, which uses the same barcode.

I create this tool with Informed Visibility, basically generate a barcode for you to track.

Limitations

USPS doesn’t scan the barcode during every hop of the mail. Thus, the tracking information is not as detail as a certified mail. Specifically, for a first class letter, the carrier didn’t scan individually of them during delivery. As a result, the last hop (i.e. delivery) is not reliable. Sometimes, my tool can capture a logical delivery event, which means the postman entered the zipcode of the recipient, but not always. However, the tracking information can give me enough confidence that the mail is delivered.

邮局和平信作为一种在中国已经消声觅迹淘汰多年的产物，在美国不但普遍却还历久弥新。在美国的大家一定对USPS非常熟悉，每天一打开信箱里面就充满了各种各样花花绿绿的广告信件，甚至还有麦当劳的优惠券。同时，我们时不时的总是无法逃离USPS的股掌——时不时的我们需要用邮局向外寄一些信，比如给IRS的退税。甚至可能有时还需要寄表格，SSN复印件等内容。

对于这类文件，之前每次小崔我搞起来都十分头大：需要跑一趟邮局买信封邮票。我还不太敢放到信封里，像IRS这种机构很容易石沉大海，根本不知道是不是路上寄丢了。为此，还得在邮局排队买一个叫Certifed Mail的额外服务（截至2021年6月3日，收费3.6美元）。后来，因为COVID-19在家工作，先添置了打印机，接着我又屯了些邮票和信封，鼓捣了一下如何用打印机打印信封。这下我终于可以在家打印好材料贴好邮票直接塞到邮筒里了，但邮件可能石沉大海无法追踪的问题并没有解决。最近我摸鱼时鼓捣了一下，终于做到了可以让直接丢进邮筒贴1oz邮资的普通信封可以追踪了。终于做到了足不出楼用一张邮票钱搞定可追踪平信。

前提条件

• 打印机一台（可以打印信封）
• 信封（可以被打印）
• 邮票
• Office全家桶

工作原理

上图是一个我从网上找到的信封示例图。不知大家仔细观察过收到的信没有，每封信右下角或者收件人地址区域里面都有一个这样奇形怪状的条码。USPS在处理信件的时候，每一封信都会通过各式各样的机器，每一台机器通过扫描这个条码来判断出这封信的目的地在哪里并进行自动分拣。我们在邮局寄的信第一次过的机器就是把邮票上盖邮戳(postage cancellation)和打印条码了。当然，这个条码也可以用来追踪信件，只要条码在45天内在系统里唯一。

不过需要注意的是，因为USPS贴邮票的平信并不是每一条都会过机器扫描的（运输时成盒(Container)的直接送到目的地），同时最后邮差送信时也是不扫描的，所以一般能拿到的tracking只有刚刚进入系统和接近投递前的最后一次分拣，详细程度远远比不上Certified Mail。

此外，不知道大家有没有用过USPS的Informed Delivery功能，它就是利用条形码确定哪封信是寄给你家的，然后每天发邮件给你。

我们需要做的事情就是自己把条形码（这个条码称之为IMb (Intelligent Mail Barcode)）打印到信封上，然后用某种方式追踪到就可以了。

TL;DR

偷懒的同学建议使用我做的工具Envelope Tracker

完整版教程

下载安装条形码对应的字体以及Word信封模板

所有的文件都在USPS IMb Fonts and Encoders Download能够下载到。其中我们最需要的是uspsEncoderMsOffice64-1.3.1.zip和uspsFontsNonAFP-1.4.0.zip。第一个是office的模板，第二个是字体，在fonts\scalable\trueType有TrueType字体可以使用。

接着大家到安装目录下找到Excel\IM Barcode Envelope Size 10.doc打开使用就好啦，具体使用自己看教程即可。

注册并使用tracking服务

这个追踪IMb平信的服务叫做Informed Visibility，虽然只面向商业用户开放，但注册起来其实并没什么问题，个人完全可以注册。注册入口不是很好找，分为以下几步：

1. 在USPS Business Customer Gateway根据提示注册一个账户，注册好之后不要被眼花撩乱的东西吓到，接着往下看。
2. 按如图点击。
3. 点击Get Access，然后等一会等USPS审核。
4. 接下来Informed Visibility应该就可以可以进去了

打印信件，寄信

使用上面下载的excel和word模板文件即可。zipcode可以5位，9位，11位都可以，但要填对。Zipcode可以用USPS Lookup a ZIP Code查到。11位的最后两位是delivery point。

Barcode identifier参考这个文档，Service Type identifier (STID)参考这个文档。截至2021年6月3日，我自己Barcode identifer填写00, STID填写040可以让信被追踪到。

Intelligent Mail® Barcode Technical Resource Guide里详细讲了条码的每一个字段怎么填。我序列号(Serial Number)从000001开始进行的编号。

Mailer ID (MID)在这里可以查询到。

最后使用一下Office Word的邮件合并和信封打印功能，再折腾一下打印机即可把发件人和收件人以及条码打印到信封上了。USPS提供了一个条码编解码工具(encoder decoder), 不会使用Word的同学也可以用这个工具按上文所述把字段填好，然后把条码画到信封上。注意，对画在哪里有位置要求:dog:

最后，把信封贴上邮票，把内容放进去，丢到楼下的垃圾桶邮筒里即可。

查看追踪信息

进入Informed Visibility，创建一个query，注意Step 2要选Download而非Online View, Step 3Object Type选择Piece.

铛铛铛，我们得到了如下结果。

至于每个字段是什么含义，请参考IV®-MTR Operation Codes List和IV-MTR Data Directory。

然后装中文输入法fcitx, fcitx-pinyin, fcitx-googlepinyin。

然后打开.bashrc或者.zshrc,在其中加入

export LC_ALL="zh_CN.UTF-8"
export DISPLAY=:0
export QT_IM_MODULE=fcitx
export GTK_IM_MODULE=fcitx
export XMODIFIERS=@im=fcitx

然后启动fcitx，运行fcitx-config-gtk3把Google Pinyin添加进输入法列表就好啦~

http://portal.12306wifi.cn/cms/app/requestInternet?ip=192.168.xx.xxx&mac=FFFFebf2FFFF&phone=13xxxxxxxxx

只要把里面的ip,mac,phone换成自己的就可以啦。

事情起源于翻腾天津联通给的光猫，了解了下它的工作原理:我们可以认为光猫上有2种类型的逻辑网口：

一类逻辑网口通过光纤连到局端，在光纤上二层协议为以太网，通过VLAN Tag划分流进光猫不同的逻辑网卡里。光猫不同的逻辑上VLAN Tag被去除，可以为之配置不同的3层协议类型(IP或者PPP)，可以配置ip地址的获取方式，和路由表，还可以配置数据包从此端口发出是否需要NAT。

另一类逻辑网卡连接到了光猫的物理接口上。比如LAN口，WLAN等。在这些逻辑网卡上，光猫可以进行DHCP分发（所以把网线插到光猫上可以拿到一个内网IP），配置IP地址等。

光猫在这两类网卡间转发数据包有两种方式：第一种是走普通的Linux的包转发的流程。(在路由表上routing到对应的出口网卡上，在iptables上匹配对应的规则)。比如，配置好IPTV的上行网卡和互联网的上行网卡(PPPoE)拨号，再配好路由表，客户端就可以直接上网，IPTV可以直接播放了。另一种简单粗暴的方法是把两块网卡桥接在一次（例如把上行的上网的网卡和下行的LAN桥接，那么就可以从LAN上PPPoE拨号上网了）。

聪明的你可能想到，天津联通为了实现IPTV，就在光猫里为IPTV配置了一个单独的逻辑网卡，并配置了一些路由表，这样，当IPTV机顶盒向光猫发送IPTV的请求时，数据就会被发到正确的VLAN里了，而不是连接互联网的VLAN或者电话的VLAN里。因此，如果想要让连上家用WLAN的设备也能访问IPTV，在我们的家用路由器上除了PPPoE拨号所产生的虚拟接口外，还要有一个从和光猫直接连通的IP网接口。并在路由器上配置到IPTV的数据要走和光猫连接的IP网接口，而不是PPPoE接口。

Tricky的事情是，IPTV的直播数据实际上是通过IGMP和多播技术实现的。多播需要让IGMP的加入请求能够发送到光猫的上行逻辑接口，而我们的路由器和光猫的NAT三层转发挡住了这一功能。为了在路由器上实现这一功能，我们需要使用igmproxy添加多播数据包从WAN区域转发到LAN区域的规则。我们同时还可以使用udpxy来在路由器上把多播UDP数据包转换为HTTP数据包以方便网内使用。

坑：不知道为什么，OpenWRT的固件不太能正确处理IGMP的query，导致IGMP report上端收不到。解决方法是在光猫上把IGMP的代理模式由snooping改成proxy，不然就会发生5分钟断流一次的问题。此外，udpxy这个程序的openwrt的配置文件有bug，verbose是-v不是-V

我依稀记得第一次到达学校边的四牌楼是去向保卫处申请横幅时偶然路过的，却还记得那天第一次路过，心想“这楼颇有一种历史的沧桑感”，再经过四牌楼时，同行的同学说到“你知道中科大四教在哪吗？”我一脸茫然，那同学却说道“就在前面那栋楼里，某个门牌号挂的是4xxx”呢。此后，除去参加iGEM前给家里寄回我的课本外，与那几栋楼便再无交集。只记得那几栋楼除了青青的藤曼爬在墙上外，便是无尽的衰败与没落。

第一次知道四牌楼这个名称是在波士顿参加校友聚会时，仍然记得那时的场景。大家围坐在一起闲聊，突然，一个七几年的校友问我道“四牌楼现在怎么样了？”我却不知“四牌楼”为何物。在他的比划下，方才知道那几栋早已破烂不堪的楼便是“4牌楼”了。从那校友的口中，我才了解到四牌楼是他们的宿舍楼，他们之于四牌楼，如少年班学院的学生之于221楼。从他们的言语中，透露出无尽的温情与留恋。

今日中午，从西区归寝，见前方路已被封锁，颇觉疑惑。回寝后，打开社交软件，才发现上面赫然写着《关于封闭东校区部分道路的公告》，又从好友动态中看到四牌楼拆除时的动静之大，才恍然大悟。四牌楼就这样将离我们而去。然而，我心里却想“四牌楼又与我何干？倒不如拆了盖个新楼”，或许，拆楼的人心态和我类似吧。我却又隐隐为校友们感到了一丝丝的悲哀，毕竟，回到母校，却再不是母校，无一物熟悉，无一物知晓，满眼现代化的高楼大厦，却也是心底一片悲凉。毕竟，在高中已经历过一次类似的经历，不想让之重演于我的大学。

天津一中，自我毕业以后，改校服，改文化，改校花。曾经的紫丁香再也不会出现，甚至，“紫丁香”，已经成为了校内的禁词。回访母校，满眼望去，只有金黄的校舍与金黄的同学们了。却也再也见不到那昨日的一抹优雅的紫色。天津一中高楼依旧，却不见了那花圃中的紫丁香；老师依旧，却不见了当年的淡然与雅致。物不再是，人亦非。

却又想起曾读过的一篇文章，描述美国大学为何捐款极多，唯记得校舍近百年未变了。然而，这是不是也就意味着，发展的速度减缓了呢?近年来，中国的发展速度有目共睹，然而，一栋栋承载着无数人记忆的老楼也成为了历史的匆匆过客。却也希望，在这“中国速度”之中，能够保留下哪怕一丁点的历史的痕迹。

这次我去台湾的目的是参加iGEM Asia Conference，也即NCTU(国立交通大学)举办的iGEM meetup。刚刚期末考完试，我、Ziyu Wu、Nancy、Xiaofan Yuan四人便开赴合肥新桥国际机场。我们的飞机是7月19日从合肥机场起飞的。合肥机场小到海关专门为我们这架航班办公。航班不值机时，国际出发都没有开门。

<figcaption class="wp-caption-text">空无一人的机场</figcaption></figure>

刚上飞机，便感受到了台湾人民的热情好客。坐在我们旁边的便是一个从台湾来大陆游玩+探亲的台湾人。一上飞机，了解到我们几个此行是到台湾开会。便向我们介绍起了台湾当地的风景名胜和美食，直到下飞机前，我们还在谈天。

一下飞机，我们在机场吃了个牛油果。

鉴于接下来几天的会议以及我们的失误繁多，便不在此处描述了。主要描述我们开会后的玩玩玩及一些基本的在大陆罕见的现象。

• 行人遵守红绿灯
• 坐扶梯时一律靠右，将左侧空出，留给忙于赶路的人
• 车辆停下来等行人
• 很少嗯喇叭
• 垃圾进行分类
• 宁肯站着也不坐博爱座

接下来的几天，我游玩的景点有日月潭、安平古堡、赤崁楼、台北故宫、台北101、台北植物园、总统府、西门红楼、宫原眼科、鼎泰丰、阿宗面线、西门汀、龙山寺、中正纪念堂、台湾大学等。

值得注意的是，Ziyu Wu在台中勾搭到一个叫吴斌的妹子，广西民族大学，大四。嘘。。。

<figcaption class="wp-caption-text">日月潭</figcaption></figure>

<figcaption class="wp-caption-text">总统府</figcaption>

<figcaption class="wp-caption-text">台湾大学</figcaption>

<figcaption class="wp-caption-text">中正纪念堂</figcaption>

<figcaption class="wp-caption-text">鼎泰丰</figcaption>

<figcaption class="wp-caption-text">台北101</figcaption>