Extra Pepperoni

Almost immediately after I announced Markdown.cgi, Adam pointed out that it was now impossible to get the source of a Markdown file, since the CGI was automatically rendering the files to XHTML.

To fix this, I have renamed my Markdown source files from .text to .markdown, and made the CGI look for .markdown files, instead of using the .text filename supplied in the URL. This minor change means the source is now available as .markdown, while the HTML version is available as .text. The Apache configuration does not have to change at all.

Additionally, I updated the comments to mention that Markdown.pl requires blank lines between block elements, so one should follow the initial title line.

The new version of Markdown.cgi is v1.2. You can download and rename Markdown.txt, but here it is for reference:

#!/bin/sh
# Markdown v1.2 2007/05/28
# Build an HTML page (with headers) from Markdown.pl output.

# v1.2: Source is .markdown, available without modification.
# Access as .text to get HTML version.

INCLUDES=/home/web/www.reppep.com/include
REALFILE=`dirname $PATH_TRANSLATED`/`basename $PATH_TRANSLATED .text`.markdown
TITLE=`head -1 $REALFILE | cut -f2`


echo "Content-type: text/html"
echo

cat $INCLUDES/head1.incl
echo $TITLE
cat $INCLUDES/head2.incl

# If we already have an H1, don't insert one.
if ! grep --silent '^# ' $REALFILE
 then
  echo -n '<h1>'
  echo -n $TITLE
  echo '</h1>'
  echo
fi

/usr/local/bin/Markdown.pl < $REALFILE

cat $INCLUDES/foot.incl

exit 0

# http://www.extrapepperoni.com/category/computers/markdown/
# http://daringfireball.net/projects/markdown/

# To use, copy Markdown.cgi (this wrapper, which you may have to rename
# from Markdown.txt) and Markdown.pl (from Daring Fireball) into your
# cgi-bin/ and make them executable
# ("chmod +x Markdown.cgi Markdown.pl"), set the correct path for
# INCLUDES below, and install head1.incl (HTML header up to <title>),
# head2.incl (HTML header starting with </title>), and foot.incl in
# that directory.

# Markdown.cgi reads the page's title from the first line, starting
# after the first tab and ending before the second.
# Your document's title should be inside an HTML comment, set off by tabs.
# Follow the title line with a blank line (Markdown.pl requires blank
# lines between block elements).
# The title line contains 5 parts:
# 1) the HTML comment open delimiter (less-bang-dash-dash)
# 2) a tab
# 3) the title text
# 4) a tab
# 5) the HTML comment close delimiter (dash-dash-greater)
# For example (not counting the # on the next line):
#<!--   Markdown.cgi: A Simple Wrapper for Markdown.pl  -->

# Add the following to your Apache httpd configuration
# (likely httpd.conf or a virtual host .conf file):
#   AddHandler markdown .text
#   Action markdown /cgi-bin/Markdown.cgi
#   AddType text/html .text
#   ScriptAlias /cgi-bin/ /home/web/www.reppep.com/cgi-bin/
#   AddType text/html .pl

I’ve written a couple articles for TidBITS since they started using John Gruber’s Markdown format, and despite actually liking HTML as a writing format, I was impressed with Markdown’s simplicity and efficiency (no <p>s are a big time savings!).

So I installed PHP Markdown Extra here on Extra Pepperoni, and got hooked on writing in Markdown. Unfortunately, there’s no Markdown plug-in for plain Apache — lots of ways to parse Markdown in your blogging software or wiki or CMS, but I want to be able to write a .text file and serve it up ‘directly’ from Apache on www.reppep.com.

Update: Markdown.cgi has been updated. Check my Markdown category for the latest.

Markdown is designed to run as a simple filter, so it’s well suited to drop-in installation in a lot of places, without having to build customized versions for a particular application’s APIs. There are several implementations — the original Perl script, as well as versions in PHP (which I use in WordPress, slightly hacked), Python, Ruby, JavaScript, etc. http://markdown.infogami.com/ keeps a list.

Since I couldn’t find an Apache handler (plug-in) or a CGI for Markdown, I wrote a very simple wrapper for Gruber’s Markdown.pl. Conceptually, my wrapper spits out an HTML header, uses Markdown.pl to render the requested page as (X)HTML, and then appends an (X)HTML footer. The reality is slightly more complicated, due to the vagaries of figuring out the document’s title, and conditionally inserting it back into the output as an <H1> tag. Even so, the whole thing is under 60 lines, mostly whitespace and comments.

Markdown.cgi also solves a problem which has wasted a significant amount of my time. BBEdit’s built-in Preview tool can use Markdown.pl to generate HTML, which it then passes to WebKit for previewing in a formatted window. But if you put the pages on a real active website, BBEdit has another feature I really like, whereby it will actually calculate a live URL for the page to be previewed, request that URL from the web server, and preview that instead.

This is great, but if you’re writing Markdown, BBEdit shows you the unrendered Markdown code (as served up by the web server), instead of rendering the Markdown file from disk. To make matters worse, BBEdit’s Preview is live in real time, but continuously re-rendering a Markdown document as you type makes BBEdit stall badly on my 1.5GHz PBG4, so I’ve stopped using it as a live preview. I instead trained myself to use Markdown.pl as a UNIX script, which I manually trigger to generate a temporary HTML document. I then view this document in BBEdit’s live Preview. Among other things, I frequently found myself editing the scratch HTML document, and having to copy my changes back to the Markdown source. Yuck.

Now that my web servers can serve up Markdown .text documents in HTML format, I can skip that whole mess, and go back to previewing .text documents (using Safari or BBEdit’s live Preview) with server-side HTML conversion, seeing exactly what surfers see, as Siegel intended.

Tip: If you’re reading about or trying out Markdown, don’t read the syntax page — skip to the simple crib sheet on the Dingus page. It’s much simpler (and shorter!).

To implement this, I added some lines to my Apache httpd (1.3) configuration, inside the main vhost block:

Action markdown /cgi-bin/Markdown.cgi
AddHandler markdown .text
AddType text/html .text
ScriptAlias /cgi-bin/ /home/web/www.reppep.com/cgi-bin/
AddType text/html .pl

Here is Markdown.cgi, although I had to rename this copy Markdown.txt so you can download it:

#!/bin/sh
# Markdown v1.1.1 2007/05/24
# Build an HTML page (with headers) from Markdown.pl output.

INCLUDES=/home/web/www.reppep.com/include
TITLE=`head -1 $PATH_TRANSLATED | cut -f2`
echo "Content-type: text/html"
echo

cat $INCLUDES/head1.incl
echo $TITLE
cat $INCLUDES/head2.incl

# If we already have an H1, don't insert one.
if ! grep --silent '^# ' $PATH_TRANSLATED
 then
  echo -n '<h1>'
  echo -n $TITLE
  echo '</h1>'
  echo
fi

/usr/local/bin/Markdown.pl < $PATH_TRANSLATED

cat $INCLUDES/foot.incl

exit 0

# http://www.extrapepperoni.com/2007/05/24/markdowncgi-using-markdown-in-apache-httpd/
# http://daringfireball.net/projects/markdown/

# To use, copy Markdown.cgi (this wrapper, which you may have to rename
# from Markdown.txt) and Markdown.pl (from Daring Fireball) into your
# cgi-bin/ and make them executable
# ("chmod +x Markdown.cgi Markdown.pl"), set the correct path for
# INCLUDES below, and install head1.incl (HTML header up to <title>),
# head2.incl (HTML header starting with </title>), and foot.incl in
# that directory.

# Markdown.cgi reads the page's title from the first line, starting
# after the first tab and ending before the second.
# Your document's title should be inside an HTML comment, set off by tabs.
# The title line contains 5 parts:
# 1) the HTML comment open delimiter (less-bang-dash-dash)
# 2) a tab
# 3) the title text
# 4) a tab
# 5) the HTML comment close delimiter (dash-dash-greater)
# For example (not counting the # on the next line):
#<!--   Markdown.cgi: A Simple Wrapper for Markdown.pl  -->

# Add the following to your Apache httpd configuration
# (likely httpd.conf or a virtual host .conf file):
#   AddHandler markdown .text
#   Action markdown /cgi-bin/Markdown.cgi
#   AddType text/html .text
#   ScriptAlias /cgi-bin/ /home/web/www.reppep.com/cgi-bin/
#   AddType text/html .pl

My header and footer are dead simple, but easy to replace with something more sophisticated.

head1.incl:

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
    "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
    <title>

head2.incl:

    </title>
    <meta http-equiv="content-type" content="text/html; charset=utf-8" />
</head>
<body>

foot.incl:

<hr />

<p align="center"><small><a href="./">home</a></small></p>

</body>
</html>

Adobe just posted a workaround for a security bug in their installer: Security bulletin: Workaround available for security vulnerability caused by installing Adobe Version Cue CS3 Server on some Mac systems.

Thanks to Daring Fireball for the heads-up.

In the Details section of the advisory, Adobe says:

To be granted access to these ports, the installer must first turn off the personal firewall. Currently, it is not automatically re-activating the firewall once it sets up Version Cue CS3 Server, creating a potential security vulnerability.

This is a lie. There is no need to turn off the firewall to add rules. I just discovered that Apple’s System Preferences appears to flip the firewall off and on to pick up new rules. This makes things simpler, as Apple can just use existing code to a) edit the configuration file, b) turn the firewall off, and c) turn the firewall on, rather than doing “live insertion” of rules. The truth is, though, that there are two different ways to add rules such as Adobe requires. Both are described in Apple’s ipfw manual page.

Adobe’s Details tells you what they require:

On Mac OS X, customers can turn on a personal firewall to control how Internet services communicate with their systems. During the installation of Adobe Creative Suite 3, the installer sets TCP ports 3703, 3704, 50900, and 50901, in accordance with Apple’s specification, to allow controlled access to Adobe Version Cue CS3 Server through the Mac OS X firewall service.

One way is to simply add rules individually, such as:

ipfw add 8001 allow tcp from any to any dst-port  3703 in
ipfw add 8002 allow tcp from any to any dst-port  3704 in
ipfw add 8003 allow tcp from any to any dst-port 50900 in
ipfw add 8004 allow tcp from any to any dst-port 50901 in

This is tricky, since Adobe doesn’t know what rules their users have, and it’s important to insert them into the right place in the sequence.

Another way is to update the rules file and then reload it, as described in the manual page:

 To ease configuration, rules can be put into a file which is processed
 using ipfw as shown in the last synopsis line.  An absolute pathname must
 be used.  The file will be read line by line and applied as arguments to
 the ipfw utility.

In Tiger, Apple’s dispensed with the BSD-style rules file, and replaced it with an XML document. I don’t know how Apple manages the XML configuration, and perhaps they don’t provide a hook to update the live ruleset. Apple’s tools should be doing this, but don’t. At a guess, someone at Adobe decided to follow Apple’s (bad) example and stop & start the firewall, rather than updating the XML configuration file (as they already do), figuring out where the new rules would show up, and then live inserting them (see “ipfw add“, above).

Stopping the firewall temporarily is opening customers to unnecessary risk. It’s bad, but Adobe’s in good company here. On the other hand, saying this is necessary is either a lie about security (never a good idea) or gross technical incompetence (not a real improvement).

If they didn’t have the unfortunate bug, whereby the installer neglects to restart the firewall after it’s disabled it, we might never have noticed.

I spent a few minutes scratching my head over this one today, so here is a donation to the Googleverse.

When you first log into a Solaris 10 system via a graphical terminal, it prompts you to select the Java Desktop System or Common Desktop Environment. It stores your preference in your home directory for future reference.

The bug is that if this fails for some reason, no error is presented, but instead the login screen comes back up.

I had created ~pepper as root and not set ownership, but ssh was working fine. When I tried logging into my Solaris 10 VM, I thought it was curdled because login could not complete. Now I think creating ~/.dt/sessions/lastsession is a hard requirement, which it should not be. There are lots of reasons one’s home directory might not be writable. None of these need to prevent login, and the lack of an error message or explanation aggravates the problem.

We had a couple Time Warner DVRs. One Scientific Atlanta 8000 (non-HD) DVR upstairs on a Sony CRT (mostly watched by Julia these days), and an Scientific Atlanta 8300 HD DVR on our (lemon) Sceptre 23″ 720p LCD TV.

They crash periodically, and Time Warner tells us just to reboot them and not worry about it. They are both inferior in numerous ways to our TiVo Series 1 (which is TiVo’s original model — so much for learning from the competition!). In early April, they both started failing to tune channels, and crashing a lot. We called Time Warner, they sent someone out, he “replaced a splitter” and left. A few days later we had more problems, so a second tech came out, “replaced a splitter” and yelled at Amy about a cabling problem to the TV (nothing to do with the issue, but it apparently caused him to waste some time). He left, but the problems stayed. In particular, a couple days later we got channel 1, but not 2-9 or 81 — I didn’t check beyond that.

Last week, I called Time Warner. The nice lady on the phone told me about channel 996, which provides status info on the DVR (including MAC, IP, and signal strength). She explained that my 33 “Reverse RF” (upstream?) dBmV (signal:noise) value was out of tolerance (35-65), and this was definitely the problem. So she sent someone on Tuesday to fix it. She also said “I’ll put that number in the case notes, so they won’t have any choice but to fix it.” Foreshadowing! She also mentioned that since this was the third call they were supposed to send a foreman, but they did not.

Tired of not being able to get video onto my TiVo, I also asked to have our non-HD DVR replaced with a plain (digital) cable box, so I could reinstall our old TiVo S1. The TiVo has an upgraded hard drive, 10/100 Ethernet, and web server; so I can extract TV shows, convert to MPEG, and watch them on my Treo (it makes my 2-hour-daily subway commute go much faster). Unfortunately, this wasn’t something that could be scheduled with the repair, so it was set for Thursday, at a $30 charge (it would have cost me $10 each way to get a cab to their storefront). Weak!

Tuesday, the repair tech came, disconnected a splitter (the same one that had been replaced by each of the previous techs, I presume, but he wouldn’t say), and (with me) climbed up to the roof tracing out the cable. We then went into Song next door (the cable comes up from their yard, but it’s behind a fence — awkward! He re-crimped a few cable ends.

I asked about the signal strength (now up to 37 instead of 33, but still obviously not very good on either TV). The HD DVR crashed “tuning” to channel 7 (the 5th time Tuesday), so he replaced it (which I was expecting). He insisted that the signal:noise number was meaningless (several times), and we got all the channels, so he left. A half-hour later, Amy was tuning through the channels, and some weren’t coming in again. At least the new DVR didn’t crash on bad channels, just showed black. Talk about lowered expectations!

Oh, and the phone rep (when I scheduled the appointments) had promised me a credit for a month of interrupted service, but instead we got a bill for the full monthly rate. Amy called and the rep mumbled something about billing cycles, but the bill was dated several days after I was told the credit had been applied. Something to worry about next month…

Tuesday night we got a call from a Time Warner, asking if we were satisfied. NO Could they send a tech during the Thursday window, when I would be home? No. The TWC rep would call back, because he couldn’t get a foreman that soon. We’ll see how (if) they handle it. We currently have some channels, but not others.

It’s enough to make us want to switch to RCN or DirecTV.

The pathetic irony here is that our problems have been a walk in the park compared to Alex’s tale of woe. He spent months helping TWC figure out why their CableCards didn’t work, but they didn’t have any good ones to give him, so left him with incompatible CableCards. Last we heard, he thought they might have been fixed remotely, but wasn’t willing to reboot to test this theory.

PS-An oddity is that downloding tystreams from the TiVo is slower than it used to be — long pauses when nothing downloads, and generally just slower than it should be. I thought it was due to being uplinked through an AirPort Extreme via WDS, but connecting my PBG4 directly to the TiVo via an old 100mbps hub didn’t help; something with the ancient TiVo, I guess.

Update: Our phone service was screwed up Wednesday. After several calls with Verizon (where they told us it was an inside problem, and that we should get a new phone, and that they would come Monday to fix it, but expected to charge us $90 to fix an inside wiring problem), someone showed up unexpected Friday morning and replaced an outside cable. Aside from the unpleasant similarities between Verizon and Time Warner, I’m convinced that the TWC repair tech caused the phone problem when he was tracing the coax up and down the outside of our building.

I was deleting some unneeded Samba RPMs today, since they’re vulnerable to a security bug, and hit a snag on a 64-bit machine, where rpm was too stupid to handle the presence of both 32-bit and 64-bit RPMs. The error was ‘error: “samba-common” specifies multiple packages’. The solution is simple but obscure: Add “--allmatches“, as in “rpm -e --allmatches“.

As it turns out, I can’t really remove samba-common anyway, because it’s required for kdebase, which is required for half the RPMs on the system, but now at least I know the trick for next time. RPM really needs to deal with multi-flavored packages better.

I took a bunch of pictures at RU today, including some of our DR site being expanded to become our primary machine room. Lots of AC & UPSes going in. I even got my father and Stu (Data Center Manager — he gets an office outside the Super-Tent!) in a couple.

I’m testing Apple’s Certificate Assistant, and when I generate a CSR, I get a Conclusion dialog that tells me my CSR has been emailed to my CSR for action.

Unfortunately, I never get the CSR (I’m the CA in this case). I have confirmed no mail was ever actually sent (see http://www.extrapepperoni.com/2007/05/09/restarting-syslogd/), and I even fired up Mail.app to make sure there was nothing waiting in my Drafts there — no dice.

So as far as I can tell the CSR functionality is completely useless, because I’m completely unable to lay my virtual hands on the CSR CA claims to generate.

Does anyone know better? Do you use CA and get the emails? Do you know where I can find the CSR files, at least?

Thanks for any pointers.

PS-Yes, I filed a bug.

PPS-I have confirmed, using 6 shell accounts across 4 machines, 2 email accounts on different servers, mail.log, & tcpdump, that no mail is ever sent. Apparently it works for other people, though, so I’m at a loss.

I’ve noticed that syslogd falls over a lot on my Mac OS X 10.4 Server (”mostly dead”, as opposed to all dead — some logs still accumulate). I normally notice when I need to check the mail logs because of a problem. The discovery that my mail logs are empty greatly aggravates the original problem (and me!).

syslogd is supposed to reload on “killall -HUP syslogd“, but that never works for me. The functional solution is “sudo launchctl stop com.apple.syslogd; sudo launchctl start com.apple.syslogd“, which gets the logs logging properly again.

Apple just updated a long list of Mac OS X keyboard shortcuts. I found several I didn’t know (and will not remember).

http://docs.info.apple.com/article.html?artnum=75459

I have a lot of trouble with iSync (to my Treo) and .Mac sync. A few weeks ago, it was generating bogus complaints and bloating ~/Library/Application Support/SyncServices (up to 9gb in a single HotSync, which ran the PowerBook’s hard disk out of space). I eventually cleared that one.

I had to abort a HotSync a couple days ago. Yesterday, Palm syncs (which I do twice per day or more, to get fresh plucker content) stopped updating my calendar. I cleared iSync’s state, cleared .Mac’s state, completely erased my Treo (scary, when the master data on the PowerBook might have been [and in the end actually was] corrupt), yada yada yada. I got different (related) errors, but nothing actually did the trick, until I backed up my data from iCal and reloaded it (luckily, this apparently blew away the corruption). Even this was fraught. I tested by loading it on another system — trying to make sure the export was good, as I didn’t trust the source. But when I attempted to open the iCal backup on the other system, iCal just spun and spun but never seemed to get anywhere. Eventually I realized it was calculating the disk size on the iCal backup. iCal backups are actually packages (folders), and it was taking much longer than it should have to total up the size of the folder, during which iCal was unresponsive (I actually force quit it a few times before I figured out what was going on).

Lesson for Apple is (aside from please fix synching in Leopard!!!): when complaining about a database synchronization error, identify the database you’re complaining about! The iSync conduit was spewing errors about updating a specific record number. Of course, I have no reference for what that record number means. Had it mentioned that this was a problem in the iCal database, not the Palm DB or the “Truth database” (on iDisk), I could have saved hours and skipped erasing the Treo.

Another bug, just confirmed and reported. In the .Mac sync reconciliation dialog, I can’t activate the “default” (blue throbbing) button with Return/Enter; it gets passed through to the window behind the dialog, although I can change the dialog’s pop-up menu from the keyboard.

As it turned out, i started this posting prematurely last month. iSync was still corrupted. I had to wipe my Palm a couple more times, delete all my .Mac sync clients a couple more times, and even enable synching from iCal’s & Address Book’s preferences because System Preferences:.Mac:Sync wasn’t usable — it would just spin forever, never letting me actually click on the check-boxes to enable synching or specific types of data.

A week later, that part of System Preferences works again, and I have no idea why.

I also don’t know how much longer it will continue to work. I was very intrigued by SyncTogether, until I discovered it just uses the same Sync Services infrastructure that keeps breaking so badly on me. I basically pay $100/year for .Mac sync, since I don’t use their promo software and I run a more reliable mail server myself (on Apple hardware and software, no less!), so I’d love to find a cheaper alternative, but it’s not clear if SyncTogether would really be cheaper (depends on upgrade schedule and pricing, and how many machines, and would require me to poke additional holes in my firewall). Unless and until Apple’s syching gets stable, it doesn’t make sense to invest more in it than I already am. Additionally, I don’t know how soon Mark/Space will have Leopard support.

We just got a Canon imageRUNNER 2880i copier in the Super-Tent (the old copier died, and this one’s smarter). It has an Ethernet connection and a phone line, so can be used as a smart fax machine & scanner, and accessed via email.

Sounds great! I’d love to be able to send & receive faxes from my desk, and it’s half as far from my desk as our primary printer (oscar, as in “The Grouch”). Amy had desktop faxing with RightFAX at Debevoise, and it was quite convenient.

I tried to print, using the generic PS driver. Instead of a 2-page document, I got 34 pages of PostScript code — this is what happens when the printer treats a PostScript job as an ASCII lpd job, but it’s annoying and wasteful.

So I went to Canon’s download page http://www.usa.canon.com/html/download/irc2880.htm; spent 10 minutes figuring out which versions were current and which were old; and then grabbed their current PPD, Mac PS driver, Mac UFR II driver, and Mac Fax driver (in BinHex format — how quaint!). I have no idea what “UFR II” is, and their documentation provides no clues, but I guess it’s their private page rendering language, since it appears to be a peer of their PS driver).

I installed all four drivers (they wanted me to reboot 2-3 times during the process — I declined), and tried to print. Bang! Application quits. I tried again. Bang! I could kill any application (including Safari, BBEdit, TextEdit, and Console) by simply attempting to print — instead of a print dialog, the application vanished in a puff of invisible smoke.

So I uninstalled all 4 drivers (they did provide an uninstaller). I rebooted. I tried again, still no joy. I sent a bug report to Apple, but I assume this is Canon’s fault. Apple should program defensively — counting on printer drivers to behave properly is just begging for trouble — but really, this looks like Canon’s problem.

I deleted all the printing prefs I could find, and even moved aside the Canon drivers & PPDs (presumably from the Tiger installation, since Apple provides a set of Canon drivers on the DVD), but no joy.

I sent a note to Canon’s tech support department, and got back a response saying “We value you as a Canon customer and appreciate the opportunity to assist you.” It also said “You will want to contact your dealer/reseller for any technical or hardware support on this unit.”

Well, no. If I wanted to contact our reseller, I would have done so. I want to contact Canon, whose name is on the stupid thing, and whose driver is crashing my Mac — I can’t even print to the HP any more. But despite claiming they want to help me, they refused, point blank. Feh!

The only bright spot is that after an Archive & Install and large raft of patches from Apple (since the Mac Pro came with 10.4.8), I can print again — at least to the HP LaserJet. I was afraid whatever was causing the crashes would be carried along with the Archive & Install, but fortunately it wasn’t. In an hour I was back in business, and I was able to do other work while the computer crunched on the reinstall.

The fly in Apple’s A&I ointment is that it disabled sshd! Remote Desktop & Personal File Sharing were still active, but I had to manually re-enable the “Remote Login” service. Predictably, I discovered this when I was elsewhere and needed access to my Mac.

The USPS is doing Star Wars stamps, and they’ve decorated some mailboxes. I’d link to the Star Wars web page at the post office, but it’s unimpressive & loud. But I did get some good pics of an R2D2 mailbox.

We’re all in here. When I got in we sat on our desks, waiting for computers and chairs to arrive; now most things are unpacked and stowed. Storage is about the same as the old space. Temp is fine. Noise is definitely worse, but it wasn’t great on the old space either. We’ll see.

One nice thing about the Super-Tent: I got 3 gigabit Ethernet jacks. Copying a 4gb Parallels VM from Mac Pro to a first-gen MacBook Pro took 2:42 (using cp over an AppleShare mount), at 206mbit/s. The same copy to a Samba/Linux share failed (likely due to an invalid filename), but cp of the equivalent tarchive took 4:42, at 118mbit/s (apparently the tent’s uplink is busy).