The adventures of Mango no. 99

TLDR: When riding any form for bike, including a velomobile, wear your helmet, but don't crash on a busy road during rush hours, at least not if you expect any great deal of assistance.

About a year ago, I bought a used Sinner Bikes, Mango velomobile, it haven't seen much use since then, I think around 1200km, but it's a fun ride, and a nice way to get some excersise. So last Thursday the 22'nd of September I took it for a spin commuting to work.

Unfortunately, on my way home in the crossing between Ballerup Byvej and Knardrupvej https://goo.gl/T8OI2F the trip ended rather dramatically.
Those who have been there before will know that going out of town towards the crossing, is a nice long downhill ride, and those who have done it on a bicycle will know, that the window of oppotunity for bicycles to time the green light, is rather slim, but today it seemed like the timing was right, so I stomped some extra joules into the pedals, and went for it. In the post mortem analysis of the event, the maximum speed on the computer showed 63km/h, which I know for sure, was reached on that exact slope.

Towards the crossing I was slowly overtaken by a group of 4-6 motorcycles, of which apparantly none of them had noticed my presense on the bike path just next to the road on which they were driving. Or maybe they were just being rude, when all of them turned right in the crossing, right in front of me. Well, actually it loked like one of them had seen me, as it looked like he was stopping up, but when the rest of the group showed no intend of doing the same, he continued anyway.

Braking was no option, and braking and steering at the same time, is a sure recipee for disaster, but magically I managed to steer just behind the last ones of them, and I even managed to show them my right middle finger, while swearing at them.

Unfortunately some office warrier had decided to place a traffic island in my path, which I hit with my left front wheel, sending it into the air, leving me driving on the right front wheel and the rear wheel.
The Mango velemobile isn't constructed for two wheel drive, so after a few meters, the momentum from when I hit the curb, had spun the velemobile all the way onto it's right side, and I was now sliding on the asphalt in the velomobile at considerable speed.
Needless to say, everything went rather fast, but I did remember to appriciate sliding next to, and not into the signs showing the direction and distance of nearby cities. I reckon that a close encounter with a 40mm galvanized steel tube, solid founded in the ground, would probably had been a grim exierence for both me and my ride.

At some point in the slide, I had transisioned from asphalt to grass as the sliding surface, which provides a bit more traction, thus bumping me a bit more around inside the velomobile, and my head into the ground a couple of times.

After having slid approximately 15 meters the velomobile finally came to a stop, using the last of the kinetic energy I had managed to put into it on the downhill slope, to pop back up on all three wheels, with the nose pointing 180 degrees relational to my original travelling direction.

I sat there in the velomobile a few seconds, before checking that I was still alive, which fortunately seemed to be the case. Next thing was my hand which I had used as a signalling tool to the motorcyclists, to make them aware that I was not impressed with their style of driving. This hand had a strange sensation, a bit like when everything is just covered in blood. Luckily this wasn't the case, it had just been smashed into something sometime during the accident .

So I climbed out, and did a quick system check of myself, which apart from two sore shoulders, an sore arm and a sore hand, seemed to be in one piece. The right side of the velomobile was badly scratched, and the left front wheel, though still turning around, wasn't round anymore.
The motorcyclists were all gone, and not a single soul cared to stop and ask if I was ok after having crashed my velomobile at 60km/h.

I figured that if I wanted to have a just a tiny chance of getting the damagages done to me and my ride covered, I would have to call the police, which I did. When I came through, the lady in the other end was less than impressed with me, because i hadn't just dialed 112 (the equvivalent to 911) in the first place, then she couldn't find the roadname that I spelled to her from the sign hust next to where I was standing, but in the end she sent a police car and an ambulance.

Finally 5 minutes after the crash while waiting for the police, the first person, a guy on a bicycle,  cared to stop an check if I was ok. We talked a bit, and he went on with he's buisiness, in retospect it might had been a better idea if I had asked him to stay and wait for the ambulance, which he did offer, since I at this point had sligthly started to feel the impact to my head, and was thus looking forward to the ambulance arraiving.

The police and the ambulance arrived at the same time, so we had a bit of conflicting interests, as the police wanted to know what had happened, and paramedics wanted to to check that I was ok. But we managed to sort things out, and the paramedics really wanted to invite me on a ride to the hospital, an invitation I accepted. So the police locked the velomobile to the sign I had just slid past, and I went off to the hospital in the ambulance.

At the hospital I made a deal with the paramedics, that if I promised not to pass out on the way in, I could walk in, instead of being brought in on a stretcher. After a nurse had done a quick check on me, and offered me some pain killers, I was left to wait a total of 4 hours, before the doctor had time to check up on me.

When I was not just waiting, I used the waiting time to arrange transport home for both me and my velomobile, I did try to use my PC, which fortunately had survived the crash, but not knowing if I had got a concussion I figured that that might not be the best idea of the day, so it was quickly packed away. Also I was unfortunately enough to arrive just after dinner time, so I had to surrive on juice and coffee. About an hour before the doctor had time, I got a bed so that I could lay down and relax.

Finally when it was my time, it took 10 minutes, and the doctor was unable to find anything wrong with me, he asked me serval times "60 km/h?" and concluded that I might had been just a tiny bit lucky, which probably isn't all wrong.

At ~23:00 I was picked up, THANKS for doing this, you know who you are. We drove past the crash site, to pick up the velomobile, which fortunately was still there, and around midnight I was finally home, 6 hours late.

Before I went to bed, I took some painkillers, just to give myself a chance of falling asleep. At this point I was really starting to feel the events of the evening, I couldn't lift my right arm above my head without it hurting like hell, and my neck was stiff like if I had got a crick.

I didn't managed to sleep much, and when I got up, my upper body was trashed, my neck shoulders and arms was hurting, and my left shoulder had red stripes from knocking against the inside of the manhole in the velomobile. I think what best described how I felt was "how you feel the day after you had a lucly escape from a 60km/h crash in a velomobile".
It did help easing the pain, to get up and move around, but not a lot happened today, I did however managed to pick up a new rim from the local bike shop, when I was out shopping for lunch. And inspect the damage to the velomobile, which seemed to be, a lot of sctarches to the right side, a trashed left front wheel, structual damage to the rear, which I have no idea of how had happened, and two missing side mirrors, on the right mirror the holder was torn out of the glass fiber, I found one of the mirrors in the bottom of the velomobile. Impressively enough the front suspension hadn't suffered any damage.

The day after I started rebuilding the velomobile, switching out the rim was relatively simple, though it took some time to true it up, but the end result wasn't too bad at all. After having replaced the rim, I noticed that the rear wheel was tilted to the left, and upon closer inspection I found that the 12mm axle holding it had suffered a bend, and it needed to be replaced.

Getting the axle out proved to be quite a challenge, and I had to disassemble the whole rear suspension, since the bend prevented removal of the rear wheel, the way it was supposed to be removed, but eventually I got it out, and could confirm with a ruler that the axle was in fact bent.

I made a new axle on the lathe, and assembled everything again, just to find out that the rear wheel was still tilting to the left, though not as much, still clearly visible.  This could only mean that the rear suspension arm was twisted, and sure enough when I had once again disassembled everything the twist was obvius.

Using some of the larger tools in my collection, and a purpose made mandrel, I managed to untwist the suspension arm, and when I got things back together, it finally looked right.

The structual damage to the rear was fixed with a couple layers of glass fiber and some epoxy, of course I forgot to fix the hole left by the right mirror, so this will have to be be fixed another day. When the epoxy has cured, the velomobile will be rideable again, and then I can fix the cosmetics during the winter.

The HotTub part 1

Disclaimer:
This and the following writeups isn't an attempt to miscredit the company that delivered the hottub or any of it's employees. I am sure that they have a lot of satsified customers around Europe, I really hope so.. But for me bying a tub, hasn't been the unbox and enjoy expeirience I had hoped for, there has simply been too many annoying details in the way for this to happen.

The new tub installed

It all started mid 2014, my old hottub had succumbed to fungi and rot, and could no longer hold any water, so I started searching the market for alternatives.  I really liked having a wood fired hottub, as it could be heated up in a few hours, but keeping it clean, and the need to always have some water in it, was a bit tidious, so I was looking for something inbetween a eletcric jet-set square tub, and a all wooden tub like the old one.

After a good deal of mail exchange, I ended up buying a tub from a company in Lithuania. From their multiple homepages in multiple languages it looked like it was a good product, and I couldn't find any negative about the quality of their products. I must admit that I couldn't find any positive either, apart from what could be found on their own homapages.
The tub was made out of polypropelene, isolated, with oak trim, an inside stainless oven like the old tub, and a lid to keep cats and dirt out.

 

 Some of the things I wrote with the factory about, was some minor customizations of the tub, for example I wanted the lights to be installed below the benches, and I had specified where I wanted the studs for connection to the sand filter, I also wanted the fence in front of the oven to completely cover the oven, and not stop level with the benches, like I had seen on some pictures of their tubs.

Delivery was on time, but on a huge truck with no lift, which was a bit of a challenge, though I own a lot of wierd stuff, a forklift isn't in my portfolio. Luckily I had some pallets and a trailer, and with the help of some neighbours we got the tub off the truck, so the trucker could get on with he's program. Now we just needed to get the tub off the trailer, and into it's dedicated spot.



Offloading challenges

After thinking a bit, calling a freind, drinking a beer, thinking a bit more, we managed to get the tub relocated to the right spot in one piece, without getting crushed.

When the plastic came off, the tub looked really nice, the oven had been glass blasted and had a silky appearence. The edge around the top was nicely fitted with tight joints, I did however notice that they had choosen to use glue and dowels to join the top edge, a bit strange I thought, the tub is after all going to be placed outside year round with rain, sun, frost and heat. But I thought that it wasn't the first tub that came out of that factory, so it would probably be fine. Unfortunately it wasn't, after one year the edge had disjoined 3 places.

Another detail was that the tub came with a stainless plate to cover the hole around the oven, this hadn't been trimmed tight enough from the factory, so it had rubbed against the light button, resulting in damage to the button, but it did still work. Also it was almost impossible to remove the plate, due to bad fitting.

 

Button damaged by the steel plate

 



Fence not covering the oven

The very first evening I had unpacked the tub I filled it up and heated it up, and it was fantastic, I couldn't however advoid to notice that the fence didn't completely cover the oven, but stopped level with the benches, just as I had requested it not to do, but hey, if that was the only thing, it would'nt be too hard to fix.

 Another annoying detail, is the wood below the benches...

Why isnt all of the trim oak?

 



Leaks

After my bath, when I wanted to chlorinate the water I noticed some wet spots next to the tub, but I figured that it must had been splashes from when I filled it up. But the next morning they were still there, and the next evening, and the next morning, and.. It soon became clear that the tub was leaking, not a lot, but enough to wet the wooden trim and the tiles. There was a few potiential sources for the leak, either it could be the lights or it could be the connections for the filter, the strange thing was that it leaked in both sides. 

After a few days, the water had turned red, like the ogger red you see in some swedish lakes, it turned out that the oven hadn't been rinsed after it was glass blasted, so it was still covered in metal dust, when I filled the tub. Couldn't they had told me that? grhmm..

When one of the lights started to fail after 2 weeks, I thought that I had found the source of the leak, in the meanwhile I had communicated with the factory via mail, and a bit on the phone. At some point they mentioned that they maybe wanted to have the tub back, to fix the problems that had arisen so far, but after talking to them we agreed that I removed the wooden trim, and had a look at the things, and then we took it from there.

At this point, also the lid for the tub had shown signs of problems, the bracing was made of sapwood with the result that it had wraped, the first time it ever got wet, also the screws that was holding the plastic backing in place, was sticking through. Later some the screws was pulled out, becaus of the wood expanding and contracting against the non flexible backing.

Screws sticking through

Too eager with the countersinker

 

When I got the trim off, the leak was quickly identified. The bottom of the tub was made out of 2 pieces of polypropelene, but this was only welded from the bottom, and not all the way through, and because the weld for the walls did not penetrate deep enough into the bottom, water could seep out between the 2 bottom pieces. Apart from that the rest of the weldings was really nice.

 

Only welded from one side.

 

Communication with the factory was at times a bit slow, but in the end we agreed that I found someone locally that could weld the tub , and the factory would cover the expenses.

 

The reason that the lights had stopped working, was because of moisture, the installation, was a really a strange comtraption. The light controller itself was a sealed plastic box with rubber sealed wire traps, so far so good, but outside the box the lamps was connected with ordinary molex connectors, that you would normally find inside a computer. I gave the connectors some tectyl and the problem was solved.

 

Behind the trim I also found this!

Aber nein!

 

Why on earth did they save those last few cents, and use normal nuts and washers, instead of stainless?!? And wouldn't a backplate to clamp things together, had been the correct way to do it? I mean.. polypropelene is flexible, and silicone does not adhere to it.. so too much movement, and we hava a leak.

 

Then after a couple of months, I noticed yet another problem, the legs for the oven had started to rust, the factory told me to jyst remove the rust with a wirebrush, and that it would not rust again, because it was stinless..?!?

Rusty legs

The oven in the tub is rather large, and has a volume of approx 120 liters, this volume is converted to 120kg of upward force when the tub is filled. The legs serves two purposes, they support the oven when it is not filled with water, and they makes sure that the oven doesn't pops out and hangs in the wall, when the tub is filled with water, this is the reason for the plastic weld bead around the leg. Unfortunetely this engeneering feat didn't work out very well, after 6 months the feets managed to pop themself out of the weld beads, tilting the oven outwards from the wall of the tub. This hadn't been too bad, had it not been for the chimney sticking up, which now led your thoughts towards a tower in the town of Pisa in Italy.

 

Winter was coming, and welding plastic when it is too cold, isnt optimal, and despite the slight leaking, the tub was useable after all. So I repressed all the problems, and just enjoyed taking warm soothing baths. but then.. If only the legs had been the only thing to rust...

 

Late this summer, I was hosting a party, and just in case we should end up in the tub, I decided to clean it up. It had been sitting idle for a couple of months with water in it, so it needed qiote a bit of love to be useable again, chlorine and filtering usually does the trick.

But once again the water had turned red! Very strange I tought, dust from the glass blasting should have dissapeared long ago. I ended up dumping the water, and the gates to hell opened up.

 

The legs was once again rusted, and the mounts was badly rusted. When I dumped the mounts into Oxalic Acid to clear some of the rust, some of the mounts turned grey:

WTF!

Not all of the stainless steel was of the same grade!?!

 

Long story short, most of the oven is made from 430 stainless, which isn't resistant to chlorine, the legs, tubes and one out of four mounts is made from 316 stainless.

One of the things that can happen when you expose 430 stainless to chlorine is pitting colosion, where the corosion creates a pit below the surface of the plate, a serverly example can be seen on the uppor mount in the above picture, and in the picture below, where the location of the pit is more of a problem, since it is located in the bottom of the oven.

The hole is approx 1mm across and 1mm deep

The oven wasn't yet leaking, but it would only be a matter of time, before it would rust through.

 

So far communication with the factory has been futile, they do not agree that this is a warranty issue, despite nothing was stated on either their page, or any of the documentation that followed the tub, that it was incompatable with chlorine.

The manager down there wrote to me, "The heater is suitable for the Tub, just we never know what people decide to do with the Tub." So apparently it come as a suprise to them that people uses chlorine in a hottub.

They have later added the option of ordering the oven in 316 stainless, but at the time I ordered the tub, this option didn't existe. And who would have imagined that a hottub would be delivered with anything else than a chlorine resistant oven, unless it would be clearly stated?

 

So currently I am discussing with the factory whether or not this is a warrnty issue, and the case will most likely end up at the european consumer organization, for them to decide. In my opinion I am entitled to a partial refound of the price, because of all the issues with the tub.

 

Such a case typically takes around 5 months, but fortunately I still have the the oven from the old tub, so stay tuned for part 2, which will cover rebuild of the tub.

 

The IPCC H03 "security" camera

 
One of my Foscam cameras has recently started to act up, so I decided that it was time for some new security cameras, so I went on eBay and ordered a pair of IPCC H03 HD Megapixel 720P IP Cloud Cameras ;)

These should be capable of streaming HD 720P h264 in 30 frames per second, plus has a lot of features build in, like motion detection, audio, onvif and whatnot, which I'm probably isn't going to be using. And.. btw.. this audio feature requires that you to connect a microphone, that you have to buy separate. But no big deal, I won't be using audio anyway.

Unboxing and installation went flawless, they were so kind to put the IP address, default username and password on a label on the box. The build quality of both the camera and especially the attached mount, was above what I had expected.

Also the web interface is both quite nice looking, and responsive, the first thing I did was to find the user setup, to change the default passwords.

 Getting a picture out of the thing was a bit more tricky, the camera want you to download a plugin for the browser, but since I will be looking at the camera via ZoneMinder, I fired up VLC and tried out different url's.
Eventually and with a bit of help from Google, I found out that the following url did the trick:
rtsp://user:password@ipaddress:554/11

And I was pleased with a decent quality picture, all in all a success.

I have later on encountered issues with ZoneMinder giving me a blue screen instead of a picture, after some hours streaming. I haven't had time to figure out why, and this might as well be a problem with ffmpeg.

So now for the security part...
Dodumentation for the camera is very sparse, but the manufacture did provide a CD with some basic well illustrated guides for setting up the camera and features. What stuck me, was that the url for the rtsp stream, didn't include username and password. A quick test confirmed that this could be accessed unauthenticated. But but I guessed that it was because it has cached my IP, stored a cookie or something similar, to keep keep track on who has access, and who has not..
But no.. this wasn't the case, the stream could be accessed unauthenticated from anywhere.. hmmm..


So what else is there I thought?

Curl'ing the front page unauthenticated reveals the whole IU script, containing links to a few CGI scripts.
[ralf@bistromath ~]$ curl -s http://172.22.22.55/web/index.html | grep cgi
<script language="JavaScript1.2" src="/cgi-bin/getwifiattr.cgi" type="text/javascript"></script>
<script language="JavaScript1.2" src="/cgi-bin/p2p.cgi?cmd=p2p.cgi&-action=get" type="text/javascript"></script>
<SCRIPT LANGUAGE="JavaScript1.2" SRC="/cgi-bin/hi3510/bconf.cgi" TYPE="text/javascript"></SCRIPT>

So why not try calling some of them, still unauthenticated..
[ralf@bistromath ~]$ curl -s http://172.22.22.55/cgi-bin/getwifiattr.cgi
var wifissid = "ErikSpandMand";
var wifikeytype = "3";
var wifiwhichkey = "0";
var wifikey="sm0keit";
var wifienable="1";
var wifimac="DE:AD:BE:EF:00:00"
var linkstatus="1";
var linkssid="ErikSpandMand"
var wifimode="STA";

Hey wait aminute.. this is my wifi settings.. well... it's not entirely true.. I changed some things, but.. i mean.. it was..

My first plan was actually to just download the firmware and explorer it, but I haven't been able to find it. The manufactures homepage is here, http://www.ipccam.com/ecp_view.asp?id=379 and I'll buy a beer to the first person that can post a link to the firmware, possible even a security updated version..

The camera has a telnet server enabled, but the passwords in the web UI isn't linked to the passwords in /etc/passwd. The only user on the camera is root, and the password isn't readily available on Google. So the next part will break the warranty.. ;)

Unscrewing the lid and removing the diode board, reveals a serial port, this is TTL levels, so they has to be converted to normal RS232, to do this I used part of an old project with a MAX233, baud rate is 115200.
 


From here it is is pretty straightforward, actually easier than I thought. The camera runs u-boot, and getting root access, is as simple as breaking the boot sequence, adding init=/bin/sh to the kernel parameters and boot it up. The flash is just mounted as jffs2 and a simple passwd did the trick. And after a reboot I was able to log into the camera as root.

From looking at the bootlog, there is some services logging on to the camera as root, but they failed with wrong password, even before I changed it, and the camera is still able to stream with a changed root password.

There is a good chance that there is another way to root the camera via the web UI, a lot of the cgi scripts is simple shell scripts, and the http server build into the camera is also flawed, but breaking out the soldering iron did the trick in less than 30 minutes. The camera isn't vulnerable to shellshock so that it at least one thing that is secure.. ;)

Now with the camera rooted I could explore the filesystem live. A lot of the magic happens in a big ugly binary called vs_server in the web root, you can download it with:
wget http://172.22.22.55/vs_server

Run a strings on it and explore... A lot of the camera functions is compiled into this file, and they are called from /web/cgi-bin/hi3510/some.cgi among some of the useful functions, you can call  is /cgi-bin/hi3510/getuser.cgi if you have forgotten your username or password. This script simply returns all users on the camera and their passwords.

/cgi-bin/hi3510/snap.cgi takes s snapshot which is stored on a temporary mount, and returns a link to the image, so if the camera you are exploring is behind a firewall, that isn't forwarding port 554, this is a way to get pictures out of the camera.

Oh.. btw, the camera supports UPNP. I haven't tested how well this works, and which ports actually gets forwarded.