Merging SELinux policies

Originally published 2016-08-01 on the UoB Unix blog

We make extensive use of SELinux on all our systems. We manage SELinux config and policy with the jfryman/selinux Puppet module, which means we store SELinux policies in plain text .te format – the same format that audit2allow generates them in.

One of our SELinux policies that covers permissions for NRPE is a large file. When we generate new rules (e.g. for new Nagios plugins) with audit2allow it’s a tedious process to merge the new rules in by hand and mistakes are easy to make.

So I wrote semerge – a tool to merge SELinux policy files with the ability to mix and match stdin/stdout and reading/writing files.

This example accepts input from audit2allow and merges the new rules into an existing policy:

cat /var/log/audit/audit.log | audit2allow | semerge -i existingpolicy.pp -o existingpolicy.pp

And this example deduplicates and alphabetises an existing policy:

semerge -i existingpolicy.pp -o existingpolicy.pp

There are probably bugs so please do let me know if you find it useful and log an issue if you run into problems.

Fronting legacy services with Kubernetes

There are many benefits to Kubernetes but what’s not discussed so often is how to migrate your services from their legacy hosting to their new home in Kubernetes. Specifically, I’m looking at the case where you have a single server or a single public IP address and you want to run your services on that server with a mixture of legacy hosting and Kubernetes – either permanently or as part of a migration process.

Let’s suppose you are running an application like ownCloud in a standard way, with Apache httpd bound to ports 80 and 443, with port 80 redirecting to port 443 to force HTTPS/SSL. This is how the simplified config might look:

# /etc/httpd/conf.d/owncloud.conf

<VirtualHost *:80>
  ServerName owncloud.example.com

  DocumentRoot "/var/www/html/owncloud"

  # Redirect non-SSL traffic to SSL site
  RewriteEngine On
  RewriteCond %{HTTPS} off
  RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}

</VirtualHost>

<VirtualHost *:443>
  ServerName owncloud.example.com

  DocumentRoot "/var/www/html/owncloud"

  ## SSL directives
  SSLEngine on
  SSLCertificateFile      /etc/letsencrypt/live/cert.pem
  SSLCertificateKeyFile   /etc/letsencrypt/live/privkey.pem
  SSLCertificateChainFile /etc/letsencrypt/live/chain.pem
  SSLCACertificatePath    /etc/pki/tls/certs

</VirtualHost>

Now suppose you want to add some new services in a one-node Kubernetes solution like MicroK8s. When you add your Ingress resource to start serving your applications, it will complain because it wants to bind to ports 80 and 443, but they are already reserved by your legacy Apache installation.

The neatest solution is to run your legacy application on a high port, without SSL, thus freeing up 80 and 443. Then set up your Kubernetes Ingress and let it bind to 80 and 443, terminate SSL for your legacy application, and proxy onwards to your application without SSL. You’ll be able to add other Kubernetes Service resources on the same Ingress on the same ports with ease – like Apache’s name-based virtual hosting.

Let’s have a look at the revised Apache config for ownCloud. Notice the Listen directive to bind to an arbitrary high port, and the lack of any SSL directives:

# /etc/httpd/conf.d/owncloud.conf

Listen 5678
<VirtualHost *:5678>
  ServerName owncloud.example.com

  DocumentRoot "/var/www/html/owncloud"

</VirtualHost>

Now we must consider how the Kubernetes infrastructure will look. The typical pattern is to use a Service resource to identify where the application is running, and an Ingress resource to expose the Service to the outside world.

Service resources are usually designed to point an applications running inside a Kubernetes cluster, but by setting the type to ExternalName, we can tell Kubernetes that our legacy service is running on localhost. You could consider an ExternalName type Service to be analogous to a DNS CNAME record.

Here’s how we configure it. Note that we don’t yet specify the port:

kind: Service
apiVersion: v1
metadata:
  name: owncloud
spec:
  type: ExternalName
  externalName: localhost

Now that Kubernetes knows it should look on localhost for your legacy ownCloud application, we need to configure the way it will be presented to the outside world. To begin with, we will set up a dumb proxy without SSL. All the relevant bits are in the spec section, which specifies the domain that the app should be served on, and then specifies the Service resource we created earlier, along with the port number.

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: owncloud
  annotations:
    kubernetes.io/ingress.class: "nginx"
spec:
  rules:
  - host: owncloud.example.com
    http:
      paths:
      - path: /
        backend:
          serviceName: owncloud
          servicePort: 5678

For bonus points, we can use cert-manager and Let’s Encrypt to add SSL, and fully automate the process of issuing SSL certificates. You will need to configure cert-manager in advance – this is beyond the scope of this blog post but there are good docs online. This revised Ingress config is the same as the one above, but with a few extra lines:

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: owncloud
  annotations:
    kubernetes.io/ingress.class: "nginx"
    cert-manager.io/issuer: "letsencrypt-prod"
spec:
  tls:
  - hosts:
    - owncloud.example.com
    secretName: owncloud-tls
  rules:
  - host: owncloud.example.com
    http:
      paths:
      - path: /
        backend:
          serviceName: owncloud
          servicePort: 5678

And that’s it! You can verify the config with the kubectl command:

[jonathan@zeus ~]$ kubectl get service
NAME                   TYPE           CLUSTER-IP      EXTERNAL-IP   PORT(S)   AGE
default-http-backend   ClusterIP      10.152.183.41   <none>        80/TCP    87d
kubernetes             ClusterIP      10.152.183.1    <none>        443/TCP   98d
owncloud               ExternalName   <none>          localhost     <none>    87d

[jonathan@zeus ~]$ kubectl get ingress
NAME       HOSTS                  ADDRESS     PORTS     AGE
owncloud   owncloud.example.com   127.0.0.1   80, 443   87d

Now your legacy ownCloud service is available at owncloud.example.com but fronted by Kubernetes, leaving you free to install as many other services in Kubernetes as you like without having to worry about port clashes.

M5 traffic incidents

The M5 motorway is notorious for accidents in the summer holidays as it is the major route for the rest of the UK to access the popular holiday regions of Devon and Cornwall, so traffic volume increases considerably when the schools close. On top of this, holidaymakers often tow caravans or trailers, or use roof racks with tents, canoes and other leisure equipment. This too can increase the risk of accidents.

Delays are common, especially around the two August bank holidays, but 2019 seems to be the worst year than anyone can remember – it seems like there is a crash on the M5 every other day. I’ve done a little light research to put some numbers to the congestion.

I gathered my data in a 100% scientific way, by searching on the Bristol Post for references to “M5 traffic” in the month of August 2019. This limits results to incidents that affected Bristol, or journeys to/from Bristol. It probably includes M5 incidents in Somerset, Bristol and Gloucestershire, and probably excludes incidents at the southern end in Devon and at the northern end in the Midlands.

In total, I found 23 incidents on the M5, of which there were 17 collisions. The remaining six incidents were three counts of congestion due to sheer volume of traffic, one severe weather incident, one breakdown, and one fire.

Looking just at the collisions, as we are not even out of August yet, that’s 17 collisions over just 27 days. The hunch that there had been an accident every couple of days turns out to be true – that’s an average one collision every 1.59 days.

Quite a few of the collisions occurred with more than one per day – in total there were 12 days with collisions. I don’t have any data on whether those accidents were related or just coincidental.

I haven’t done any research into the causes of these collisions, but it’s safe to say that human error played a role in these incidents. Even if human error did not cause the initial accident, there were several multi-car pileups where the most likely secondary cause is driving too close, or failing to react in time.

Autonomous cars are on the horizon, and in my opinion they can’t come soon enough – at least for motorway use. Motorways are the easiest type of driving to automate, as motorways are usually closed environments without pedestrians, animals, etc. They are also quite difficult for human drivers, who are easily bored and prone to distraction.

I’d be quite happy for motorways to be reserved for autonomous vehicles in the interests of safety – while still permitting human drivers in towns and on A-roads.

The mystery of the Canon A/L switch

Since the 1960s, Canon SLRs have had their power switch confusingly labelled as A and L. This has persisted through many different generations of camera and confused beginners through the ages. But what do the letters A and L stand for? Why not use On and Off, or a red dot and a white dot, or a tick and a cross?

First let’s have a look at the switches, starting off with the first ever Canon SLRs, the Canonflex series, which didn’t have any shutter lock at all. The photographer simply had to get into the habit of not winding on until they were ready to shoot, or keeping the camera in a case where the button couldn’t be accidentally pressed.

Canonflex RM, 1962

The first Canon SLRs with a power switch were the FL generation of cameras from the 1960s. These have a rotating collar around the shutter release button with two positions – A and L. This was a physical setting as these cameras had no active electronics in them.

Canon FT, 1966

This design was maintained with the introduction of the first generation of FD cameras, the F-series. Some of these cameras had a separate switch on the left hand side to control the light meter. These were labelled On and Off.

Canon FTb, 1973

Breaking with tradition, the next generation of FD cameras, the A-series in the mid 1970s came along with an unmarked switch close to the shutter release, displaying a red dot when switched off. It looks like an LED, but it’s just a red plastic knobble.

Canon AT-1, 1977

The later half of the A-series from the late 1970s started using a sliding lever near the shutter release, once again returning to the same two positions, A and L. On this AE-1 Program, you can see where the lever has scratched the body with use.

Canon AE-1 Program, 1981

The unashamedly electronic T-series (not a compliment) from the mid 1980s saw a change, and it seems Canon couldn’t decide what to do with the power switch. The consumer-level T70 and T80 used a sliding switch on the top of the camera, but let the secret slip by labelling the switch Lock instead of the usual L. The other settings are the self-timer, and two different metering modes.

Canon T70, 1984

The T80 and T90 put the power switch on the back of the camera, using the traditional A and L designations.

Canon T90, 1986

The T60 (which is not a true Canon, being made by Cosina) gave a hint of the future by doing away with a power switch entirely and having the A and L positions on the shutter speed dial.

Canon T60, 1990

The early EOS film cameras of the late 1980s had a rotating knob on the back with A and L modes, plus other modes on some models.

Canon EOS RT, 1989

Apparently the rotating knob idea didn’t work out, as the later EOS film camera series of the 1990s quickly returned to the trend set by the T60, by having an L position on the new command dial – but no A position.

Canon EOS 5, 1992

All EOS digital cameras were equipped with an On/Off switch from the very first model back in 2001. The switch varied in position from the back, to next to the shutter release – but never on the command dial.

Canon EOS 600D, 2011

After this journey spanning five decades of photographic history, are we any closer to knowing what these letters mean? Well, we saw from the T70 that L stands for Lock. But what about A?

Some Canon cameras of the 1970-80s also used A on lenses to designate “auto aperture”, but the Canonflex models of the late 1950s and early 1960s had nothing automatic about them so we can rule out A standing for Auto.

I haven’t been able to find anything online about this, but my theory is that A represents Active or Action, to mean that the camera is ready to shoot. If anyone knows better, please let me know!

Time lapse photography

It was recently announced that a new building is being constructed next to my office. It’s not any old building – it’s going to be a 26-storey tower, the tallest in Bristol! Working on the second-top floor of an adjacent office block, this is a great opportunity to get a birds’ eye view of the construction site.

Castle Park View
Castle Park View

This artist’s impression of the new tower, Castle Park View shows it looming over its surroundings. My office, One Castlepark, is circled in red – massively overshadowed! Clearly I am going to need a very wide angle lens to get it all in.

I’m on a very limited budget so I started off looking at wide angle webcams. This one was the cheapest one with a decent angle of view, but it quickly became obvious that at the close proximity, it couldn’t even fit the footprint of the construction site in – let alone the height of the tower.

Castle Park View construction site - wide angle view
Castle Park View construction site – wide angle view

So I decided to buy a USB camera with a fisheye lens. This one offered such a wide angle of view that it can see its own window frame – almost 180°! It easily encompasses the footprint of the construction site and hopefully will fit in most, if not all, of the height of the tower as it goes up.

Castle Park View construction site - fisheye view
Castle Park View construction site – fisheye view

I’m not fully happy with the image quality from the fisheye camera but it’s hard to judge when the weather is grey. It might benefit from a graduated ND filter to give extra exposure to the foreground.

The camera was supplied with a simple metal bracket so I knocked together a wooden stand for it, painted matt black to reduce reflections in the window. It has a heavy base and rubber feet to reduce vibrations, and a rubber washer at the “neck” joint so it can be set and will keep its position.

Wooden camera stand

I did a lot of thinking about the number of pictures to take, etc and eventually decided over the duration of the construction (about 2 years), taking a picture every 10 minutes during daylight hours and playing back at 30fps would yield a video that plays for about 16 minutes. Here are the calculations from my spreadsheet…

Frames taken every10minutes
from8AM
to18PM
That’s6frames per hour
Filming runs for10hours per day
Construction lasts24months
There are21work days per month
Filming lasts for504days
Total frames taken30240
Playback rate30frames per second
Video plays for1008seconds
that’s16.8minutes
Frame size330KB
Total data size9.5GB

I decided to run the capture from an old Linux laptop I had lying around, although a Raspberry Pi would be ideal.

There are various time lapse capture tools around but I decided to keep it simple and use a tiny utility called fswebcam. This can be invoked with the following command line:

#!/bin/bash
fswebcam -r 1920x1080 -D 3 -S 75 --no-banner --jpeg 85 /motion/$(date "+%FT%H.%M").jpg

Let me break this down a bit.

  • fswebcam the name of the program
  • -r 1920×1080 capture at full HD resolution
  • -D 3 delay for 3 seconds to allow the camera to “warm up”
  • -S 75 capture 75 frames before taking the real frame, to allow the autoexposure to stabilise
  • –no-banner don’t overlay a timestamp etc on the captured image
  • –jpeg 85 export the frame as JPG with 85% quality
  • /motion/$(date “+%FT%H.%M”).jpg save the frame with a filename like 2019-03-13T18.00.jpg

Tweak this to suit your needs, save it as a script, and then invoke it as a cron job by adding this line to /etc/crontab

*/10 8-17 * * 1-5 root /motion/take-snapshot.sh

Cron formatting is a bit weird, so here’s what it means:

  • */10 capture every 10 minutes
  • 8-17 capture between the hours of 8am and 5pm
  • 1-5 capture Monday-Friday

Note that due to the way cron interprets times, the first capture will be at 08:00 and the last will be at 17:50, not 17:00.

The frames will be stitched together into a video using the video editing Swiss army knife that is ffmpeg. There are many customisable options but here’s the gist of it:

ffmpeg -r 30 -pattern_type glob -i '/motion/*.jpg' -s hd1080 -vcodec libx264 timelapse.mp4

This hoovers up all of the JPGs that have been saved, mashes them together at a rate of 30fps and saves it as a full HD, 1080p, H.264-encoded video.

All I have to do now is wait for them to build the tower and hope the camera is pointing in the right direction! It’s a shame I’m so impatient…

Making simple lens display stands out of wood

For the last article I wrote, a comparison of Canon 50mm lenses, I needed some way of photographing and displaying these lenses so they wouldn’t roll away. I decided to make some very simple lens stands out of scrap wood. Here’s how.

Canon 50mm f/1.8: the evolution of an icon

Anyone interested in photography will surely have heard of the “nifty fifty” – the 50mm standard SLR lens. Almost every single SLR manufacturer had a 50mm lens with and f/1.7, f/1.8 or f/2.0 aperture that was sold as the “kit lens”, and Canon was no exception. These days, “kit lens” has become a dirty word for a cheap, flimsy and poor quality zoom lens, but in the heyday of manual focus photography 50mm kit lenses were among the sharpest, fastest, smallest and lightest lenses available in the whole range, only surpassed in quality by their faster and spendier 50mm f/1.2 and f/1.4 cousins.

Canon is no exception, and over the nearly-60 years since they introduced their first SLR I’d be willing to bet that that combined sales of their 50mm f/1.8 models outnumber every other SLR lens sold, ever. I decided to check out every model Canon has churned out and explore the technologies introduced with each revision. To date, Canon has released fourteen versions of its 50mm f/1.8 since 1959 and while some have been minor revisions, others have been leaps in technology – but all with a shared heritage.

Every single one of these 50mm lenses (except one) has the same optical formula of six elements in four groups – the classic double Gauss arrangement which was first invented in 1888 and is still used to this day.

Lenses

Some of these lenses are directly marked I, II, etc on the lens itself to denote the revision. However some are not marked with the revision, so in these cases the revision is in brackets.

R mount

R 50mm f/1.8 (I) (1959)

Canon launched its first SLR, the Canonflex, in 1959 with just two interchangeable lenses using a new mount, the R mount. Canon’s R lenses were the first to use a breech-lock mounting system – all their previous lenses were equipped with a screw mount for use on rangefinders. The breech mount was superior to the screw mount as no wear occurred on the distance-critical mounting surfaces. It was a bit slower to use though, and some photographers felt that it was difficult to change breech mount lenses with one hand. Nonetheless, the breech mount stayed with the R mount and its successors for two decades.

The R 50mm f/1.8 has two aperture rings which makes it looks like a preset lens, however it is actually an automatic lens. One aperture ring sets the desired aperture that will be used when the photo is taken (although the aperture stays wide open until that point) while the other ring is effectively a depth-of-field control. The lens mount has two levers lever which the camera activates when the photo is taken (to ensure the lens stops down to the desired aperture at that moment, before springing open again) and when the film is advanced. The camera has no way of knowing what aperture the lens is set to, nor does it need to – as the Canonflex cameras had no TTL metering.

The R mount 50mm lenses were officially known as R 50mm f/1.8 but they all carried the designation Super-Canomatic Lens which is probably the coolest name of any camera lens.

R 50mm f/1.8 (II) (1960)

A mark II and III quickly followed the first version with only cosmetic differences.I have the II in my collection.

 

 

It has a larger knurled focus ring but the two aperture rings are closer together. In my opinion this makes them a bit fiddly to use…

R 50mm f/1.8 (III) (1963)

…and apparently someone in 1960 agreed with me because the mark III moved them further apart again.

FL mount

FL 50mm f/1.8 I (1964)

The FL mount replaced the R mount when it was launched with the Canon FX camera in 1964. It shares the same physical lens mount but uses a simplified single-lever system. R and FL lenses and cameras are compatible with each other.

 

 

The design of the lenses was smartened up, too. FL lenses are smaller and lighter than their R-mount predecessors. They scrapped the second aperture ring and instead had a switch which could be set to A (auto) or M (manual). In A, the aperture always remained wide open until the moment of exposure, but in M the aperture stopped down to the value set on the ring.

FL series cameras allowed TTL metering for the first time with stop-down metering. The photographer would keep the aperture wide open for composing and focusing (A mode), but would stop the aperture down in order to get a light meter reading at the correct aperture (M mode, or by using the stop-down lever).

FL 50mm f/1.8 II (1968)

Unlike most mark II lenses from Canon which are minor revisions, the FL 50mm f/1.8 II was a complete optical redesign, and is one of the few that carries the II designation on the lens itself. It was still fundamentally based on the double Gauss formula but had various improvements, including the elimination of astigmatism, reduced aberration and a new magenta/purple lens coating.

FD mount

FD 50mm f/1.8 (I) (1971)

The introduction of the FD mount in 1971 was a gamechanger. It had extra levers and pins on the mount so the camera could tell what the maximum aperture of the lens was, and perform TTL metering with the aperture fully open. This paved the way for full automatic exposure, although the first generation of FD cameras didn’t support that, and were controlled effectively as fully manual cameras with match-needle metering.

 

 

The FD mount also did away with the concept of preset lenses and A/M switches by having an aperture that could be controlled by the body. Setting the aperture ring did not have any effect until the camera commanded the lens to stop down at the moment of exposure.

This generation of lenses (and the mark II that followed it) are known as “chrome nose” lenses, because the filter thread and lens hood bayonet at the front is made from chromed metal.

FD 50mm f/1.8 (II) (1971)

I’ll be honest, I can’t work out the difference between the mark I and the mark II, which was released in the same year. However it is clear that the two “chrome nose” models were only in production for a fairly short time before being replaced, which contributes to their relative scarcity today, compared with the later models.

FD 50mm f/1.8 S.C. (I) (1973)

This lens is the first one to carry the SC designation. SC stands for Spectra Coating which is Canon’s trademark for their multicoating process. Some previous lenses also had the same coating but this was the first version use it as a selling point. There was also a superior SSC (Super Spectra Coating) but this was not used on the lower-range lenses such as the 50mm f/1.8.

The first SC lens is somewhat smaller and lighter than its chrome nose predecessor but otherwise is styled pretty much identically, with the exception that the filter ring and lens bayonet are now made from black plastic.

FD 50mm f/1.8 S.C. (II) (1976)

The mark II is slightly smaller and lighter again than its predecessor, but the most notable difference is that the number of aperture blades has been reduced from six to five. This trend continued with the rest of Canon’s 50mm lenses.

 

 

New FD 50mm f/1.8 (1979)

After 20 years of breech-mount lenses, Canon redesigned the physical latching mechanism and replaced the breech mount with a rotating bayonet mount, known as New FD (sometimes written as FDn). It was fully compatible with the original FD mount.

 

 

At the same time, Canon gave all the New FD lenses a makeover, styling them in black, making them slimmer and using plastic instead of metal. Overall, this means the New FD version is much lighter.

The New FD lenses all have better Super Spectra Coatings (SSC) – except for the New FD 50mm f/1.8 which retains the Spectra Coatings (SC) of the original FD series. The SC and SSC designations were dropped. The optical formula also remains unchanged, however this is the first of Canon’s 50mm f/1.8 lenses to stop down to f/22 instead of f/16. This may be a reflection of the faster films that were becoming available throughout the 1970s.

AC 50mm f/1.8 (1985)

The uncommon AC 50mm f/1.8 was an attempt at retrofitting autofocus capability to the manual focus FD mount. It was only compatible with the Canon T80 camera (although the T80 could use any FD lens). The physical mount was unchanged but the lens also had some electrical contacts alongside the physical linkages to control the autofocus and aperture. It is still possible to focus manually with this lens, but it clearly isn’t what Canon had in mind as the manual focus ring is only accessible with the fingertips through two slots that have been cut on the sides of the lens barrel.

 

 

While this solution “worked”, it wasn’t very good. The autofocus was too slow and inaccurate to be useful, and ultimately Canon decided to throw it all out and start over with the incompatible but autofocus-from-the-ground-up EOS system, which used EF lenses. However the concept was proven and Canon’s engineers continued developing the technology.

This lens is based on the New FD 50mm f/1.8 but differs from it optically in that it can focus down to 50cm – the first of Canon’s 50mm f/1.8 lenses to focus closer than 60cm.

EF mount

EF 50mm f/1.8 (1987)

The EF mount was a radical departure from the R/FL/FD line, and wholly incompatible with it. EF lenses have a different physical mount and no physical linkages – all communication is done electronically. All EF lenses support autofocus and contain motors and circuitry, so they tend to be a bit bulkier than their FD counterparts, although often lighter too, through extensive use of plastics. However, the styling is unrecognisable. With autofocus replacing the prominent focus ring and electronic aperture control from the camera body removing the need for an aperture ring, EF lenses had a much smoother barrel and no need to touch any controls on it during normal use.

The EF 50mm f/1.8 shares the a related optical formula as the New FD 50mm f/1.8 with the same six elements, but splits them into 5 groups rather than 4. In reality this means a group which used to be two elements cemented together is now two elements with an air gap.

EF 50mm f/1.8 II (1990)

The later EF 50mm f/1.8 II is optically identical to the mark I but seems to be an exercise in cost and weight saving. The mount flange is plastic rather than metal (a first for Canon) and the focus ring (which isn’t supposed to be used much, as this is an autofocus lens) is small and fiddly to use.

 

 

The EF 50mm f/1.8 II is the longest-lived of all Canon’s 50mm f/1.8 lenses, making it a whopping 25 years before being replaced. During this time, digital cameras were introduced but in Canon’s case, they used the same EF mount so no modifications were necessary and the same lens continued to be sold.

EF 50mm f/1.8 STM (2015)

As the predecessor of the STM model lasted a quarter of a century, you might wonder what was wrong with it. The EF 50mm f/1.8 STM is optically identical to the I and II EF models, so what changed? In the 2010s, DSLRs with video became the norm, but lenses like the EF 50mm f/1.8 II suffered from noisy and jerky autofocusing which ruined the video. The more expensive lenses boasted a USM designation (ultrasonic motor) and were almost silent during focusing, but for the cheap end of the range, Canon came up with STM (stepper motor) technology for silent autofocusing when shooting video.

The EF 50mm f/1.8 STM also has 7 curved aperture blades – the first Canon 50mm f/1.8 to have more than 6, and presumably designed with video in mind.

Timeline

Some people find it easier to visualise information in graphical form, so I knocked up a timeline showing all the 50mm f/1.8 lenses. For those of you reading in the future, I have assumed that the production of the STM version ceased at the end of 2018 (it probably won’t/didn’t!)

Canon 50mm timeline
Canon 50mm timeline

Specifications

Lens Launched Groups / Elements Aperture blades Minimum aperture Closest focus distance (m) Maximum magnification (x) Filter diameter (mm) Max diameter × length (mm) Weight (g)
R 50mm f/1.8 (I) 1959 4/6 6 16 0.6 58 65×48 295
R 50mm f/1.8 (II) 1960 4/6 6 16 0.6 58 65×48 305
R 50mm f/1.8 (III) 1963 4/6 6 16 0.6 58 65×48 305
FL 50mm f/1.8 I 1964 4/6 6 16 0.6 0.104 48 61×40 228
FL 50mm f/1.8 II 1968 4/6 6 16 0.6 0.103 48 62×43 280
FD 50mm f/1.8 (I) 1971 4/6 6 16 0.6 0.103 55 65×45 305
FD 50mm f/1.8 (II) 1971 4/6 6 16 0.6 0.103 55 65×45 305
FD 50mm f/1.8 S.C. (I) 1973 4/6 6 16 0.6 0.103 55 64×45 255
FD 50mm f/1.8 S.C. (II) 1976 4/6 5 16 0.6 0.103 55 63×39 200
New FD 50mm f/1.8 1979 4/6 5 22 0.6 0.100 52 63×35 170
AC 50mm f/1.8 1985 4/6 5 22 0.5 0.150 52 74×48 210
EF 50mm f/1.8 1987 5/6 5 22 0.45 0.150 52 67×43 190
EF 50mm f/1.8 II 1990 5/6 5 22 0.45 0.150 52 68×41 130
EF 50mm f/1.8 STM 2015 5/6 7 22 0.35 0.21 49 69×39 160

Test pictures

Facts and figures only tell you so much, but some test pictures are worth a thousand rambling words. The only camera I have that can use all of these lenses without resorting to an adapter with corrective optics is my Canon EOS M mirrorless, which can take R/FL/FD lenses via a dumb adapter that is basically an extension tube, and EF lenses via an adapter with electronics (since the EF-M mount used on the EOS M series is electronically compatible with the “classic” EF mount). For R/FL/FD lenses, the EOS M can’t communicate with the lens so it effectively operates in aperture priority mode with stop-down metering. EF lenses work natively.

When I started setting up the test shots, I realised that the R and FL lenses wouldn’t mount on my adapter properly. I noticed that the lenses have a wedge-shaped lump around part of the rear element which fouls the stop-down signal pin of the adapter. As I planned to take all the test images at full aperture, f/1.8, it was easier to simply remove the signal pin, which is just a long screw which sticks in from the outside.

EOS M to FD adapter
EOS M to FD adapter

Now I have the ability to test all of my lenses, but annoyingly I found that my R 50mm f/1.8 II has got a stuck aperture and I wasn’t able to open it up to f/1.8. It’ll need servicing before I can test it, so I omitted it for now.

All of these test shots were taken with the EOS M in aperture priority at f/1.8, fixed white balance (cloudy), ISO 100. The only variable that the camera could change was the shutter speed. The shots were all taken from a tripod, although I do appear to have knocked the alignment a little when changing lenses repeatedly.

The first set of pictures I took was a straight shot of my back garden. In itself, it’s not particularly interesting, but it does give a feel for how each lens looks.

 

There isn’t much to choose between these lenses, so it’s a bit more interesting if we take a 100% crop of the centre, specifically looking at the sharpness. I used the screws in the hinge as a target for manual focus using 10× magnification on the EOS M, but there is still some scope for focus errors at f/1.8. Some evidence of varying colour rendition is also visible.

 

Even more telling, I took a 100% crop from the top-left corner where there was bright sky, which should be a challenge for any lens. I am expecting the older lenses to show flare or loss of contrast. It is worth noting that the EOS M is an APS-C crop-sensor camera, so the corner of the digital frame is not the corner of the frame as it would appear on a 35mm camera.

 

I tested for light fall-off in the corners by shooting an image of the rendered wall of my house. All of the lenses show some evidence of light fall-off but it is significantly better in the EF lens. Notably, this is the only lens in the test sample with the newer “6 elements in 5 groups” optical layout, as opposed to the “6 elements in 4 groups” layout seen in earlier lenses.

 

The centre crop of these thrilling wall pictures was not very interesting, but the corner crop shows up some aberrations. Once again, bear in mind that the EOS M is a crop-sensor camera and the “true” image goes beyond what the EOS M’s sensor can “see”.

 

The FL lens shows significant coma, which we expected, as the FL II’s selling point was better aberration control.

Summary

We’ve taken a look at Canon’s 50mm f/1.8 SLR lenses since 1959 and we’ve had the chance to test a representative selection of them. It is clear that the technology has improved with each generation, enabling new ways of using the lens and improving image quality.

There’s no point in saying which is the “best” but I will say that I have a soft spot for the FL lens. It has a characterful rendition and is small and light. It has nice controls and handles well on a 35mm SLR  and on a mirrorless digital.

Behringer B-1 vs B-2

These two large-diaphragm condenser microphones from Behringer are likely to be among the first condenser microphones that audio engineers on a budget lay their hands on. What’s the fuss about? Are these good microphones? And how do they differ?

behringerb1b2.resized

The Behringer B-1 and B-2 are Behringer’s top of the range microphones. As part of the B series, they are true condensers (unlike the C series). The B-2 comes in two generations – the original and the Pro. The B-2 and B-2 Pro are basically indistinguishable and the name seems to reflect a redesign of some of the internal components. Behringer receives a lot of criticism online but I think much of it is unjustified and people are just repeating myths. Some Behringer mics aren’t great but the B-1 in particular is one of the good ones and represents excellent value for money.

The key difference is that the B-1 has one diaphragm while the B-2 has two. This means the B-1 permanently has a cardioid pickup pattern, while the B-2 is switchable between three different polar patterns. This makes it a more versatile microphone, but the inevitable compromises in the switchable design mean it has slightly worse sensitivity and noise characteristics.

Behringer B-1 Behringer B-2
Condenser, 1″ single diaphragm Transducer type Condenser, 1″ dual diaphragm
Pressure gradient Operating principle Pressure gradient
Cardioid Polar pattern Cardioid, omnidirectional or figure-of-8
Gold-plated balanced XLR connector Connection Gold-plated balanced XLR connector
-34±2 dBV Open circuit voltage at 1kHz -36 dBV (cardioid)
-37 dBV (omnidirectional)
-35 dBV (figure-of-8)
20 mV/Pa Open circuit sensitivity 16 mV/Pa (cardioid)
14 mV/Pa (omnidirectional)
18mV/Pa (figure-of-8)
20 Hz – 20 kHz Frequency range 20 Hz – 20 kHz
-10dB (switchable) Level attenuation -10dB (switchable)
6dB/oct at 75Hz (switchable) Low-cut filter 6dB/oct at 150Hz (switchable)
138 dB Max SPL (1% THD @ 1kHz) 138 dB (cardioid)
139 dB (omnidirectional)
137 dB (figure-of-8)
13 dB Equivalent SPL 17 dB
18 dB
16 dB
81 dB Signal-to-noise ratio re 1 Pa 77 dB
76 dB
78 dB
50Ω Nominal impedance <100Ω
> 1kΩ Load impedance > 1kΩ
∅ head 58mm
Length 174mm
Dimensions ∅ head 56mm
∅ shaft 50mm
Length 210mm
0.45 kg Weight 0.55 kg

In practice, you are probably unlikely to hear these differences. Don’t be fooled into thinking the B-2 is “better” because it has Pro in the title, or costs more. These are two different microphones for different purposes. I would suggest buying the B-1 unless you have a specific need for omnidirectional or figure-of-8 pickup.

Omnidirectional close-miking of instruments and voices is useful to avoid the proximity effect, if you have a nice-sounding room. The figure-of-8 pattern makes this microphone useful in a mid-side setup or a Blumlein pair.

Of course with any microphone review, words are meaningless and it’s all about the sound. In my tests, I was generally unsatisfied with the quality of the B-2 as part of a mid-side setup. I later did a direct comparison by recording female vocals with the B-1 and B-2 in turn. I thought the B-2 sounded thin, metallic and harsh. The B-1 was smoother by comparison. In the end, I thought the B-2s were unsuitable for my work so I sold them and bought a Sontronics STC-3X instead. That is much smoother for use in a mid-side pair.

In summary, I think the Behringer B-1 is a keeper but the B-2 is one to skip. The B-1 is a better choice for cardioid pickup and for omni or figure-of-8, there are many choices.

Building a darkroom from scratch

I’ve moved house a few times over the last 10 years and at each place I’ve set up my own darkroom. I started with a rented flat, where I would develop film in the bathroom sink but there was no room for printing. At a later rented house, I made a makeshift darkroom in the loft, and then when we bought a house there was already a windowless utility room in the garage that was ideal. We’ve now moved again, and there is nowhere suitable. So I set out to build my own darkroom from scratch in the garage (which is just a junk store).

The garage
The garage

I took measurements and drew up a design. The darkroom is going to be at the opposite end of the garage from the large garage door, so I can still use most of the space for storage. The annoying constraint is the side door into the garden, which is just 1.6m from the end wall. The red lines show the proposed darkroom boundaries and layout of the workbench and sink.

The design
The design

I’ve never done anything like this before, but I wanted to learn all the skills needed and do everything myself. I spent a lot of time watching YouTube videos of garage conversions. The garage is built from single-thickness blocks and needs to be insulated. I was initially hesitant because adding insulation takes precious usable space away from the darkroom, but I didn’t really have a choice in the UK climate. So I added CLS timber framing (38x63mm) to the three masonry walls, and filled them out with 50mm Celotex foil-backed insulation panels. Any gaps were filled in with expanding foam to prevent air currents.

Starting to insulate the back wall
Starting to insulate the back wall

Wall insulation complete
Wall insulation complete

I started work on the partition wall, also built from CLS timber and insulated with Celotex.

Partition wall framework
Partition wall framework

I had planned for the workbench to be the same length as the longest wall, but I was also worried about manoeuvring the long piece of bench in the tight space, especially with the partition wall now up. I decided to attach the workbench to the studwork before putting the plasterboard up, and plaster round it afterwards, to cover any rough edges or gaps. This should also make it pretty strong.

Workbench support
Workbench support

IMG_7146b.resized

My darkroom sink is just a kitchen sink that I got from a clearance sale. I’ve never had a proper darkroom sink in the past and I didn’t feel the need to splash out on one this time (pun intended). I’ll use my trays on the workbench and wipe up any spills after. The sink itself is clamped into the hole with clips and sealed with silicone.

Sink fitted
Sink fitted

At this point I also placed electric cables in the walls for future lights, sockets, etc. The garage already had lights and several sockets, so I just needed to add a few. Then, I started work fixing plasterboard sheets to the timber. I used ordinary 12.5mm Gyproc WallBoard but if I did this again I would probably consider the special bathroom type which is supposed to be more resistant to moisture.

First sheet of plasterboard
First sheet of plasterboard

Boarding the outside of the darkroom
Boarding the outside of the darkroom

Wall boarding complete
Wall boarding complete

Wall boarding complete
Wall boarding complete

For electrical points, I used dry-lining boxes which attach to the plasterboard and clamp themselves in place – no need for any additional support from behind. These four sockets will be behind the enlarger.

Mains sockets
Mains sockets

With the walls ready, I turned my attention to the ceiling. It definitely needed insulating as the roof is made of a single sheet of OSB, coated with tar and roofing felt. It has basically no thermal insulation properties but also becomes very hot in summer with the sun shining on it.

OSB roof
OSB roof

I used thicker Celotex (100mm) to insulate the space between the rafters. I also realised that the rafters are too far apart and not close enough to the edge to properly support the ceiling plasterboard. So I used a load more CLS timber to create ceiling support beams at 90 degrees to the original rafters. It was then easy to attach the ceiling plasterboard to the beams in sections, as a single sheet was too big to get in the door.

Insulated roof with ceiling beams
Insulated roof with ceiling beams

With the room fully boarded, I filled in all the recessed screw heads, caulked up the edges where the walls and ceiling meet, and used plasterer’s jointing compound to cover over the joins. I didn’t skim the entire face of the plasterboard as the cosmetic appearance is not too important. However the joint seams do stand slightly proud, so I should have used tapered-edge plasterboard rather than square-edge.

Plastered joins
Plastered joins

Plastered joins
Plastered joins

With the seams sanded smooth and three coats of cheap white emulsion applied, I was able to install the light fittings and cord-pulls. I’m using a cheap kitchen light fitting and an old Paterson safelight. I wanted the whole room to be white so the safelight is reflected around and diffused as much as possible. This means you get maximum benefit from the safelight without needing to increase its brightness.

Main room lights working
Main room lights working

Safelight working
Safelight working

Now I’d finished bringing large materials into the room, it was safe to hang the door and complete the door frame.

IMG_E7649b.resized

It’s just an ordinary door with no special facilities for light-proofing, so I painted the edges of the door and the insides of the door frame flat back to improve the light seal. The bottom edge of the door has also been fitted with a brush strip.

IMG_7662b.resized

I also boarded up the windows with 5mm plywood panels to ensure a proper light seal. The panels are stuck onto the UPVC window frames with silicone sealant to ensure a light-tight seal, with a few screws to hold the panels tight. I boarded each window pane individually, so you can still open the window for ventilation if necessary. The plywood is also painted white on the outside to reflect back any sunlight and prevent it from getting hot in summer.

Window boarded up
Window boarded up

With the door now in place, I know exactly how far the flooring will need to extend. I put down some polystyrene insulation tiles that were left over from fitting laminate flooring in the house and then covered it over with textured polystyrene floor tiles. I’ve used these before and I found them very comfortable to stand on for prolonged periods of time, and they should help insulate the concrete floor. The edges of the floor were concealed with softwood skirting boards. This is probably a bit of an extravagance!

Flooring and skirting boards
Flooring and skirting boards

While I had wanted to install tall laboratory taps, they proved to be too expensive for my low-budget darkroom. In the end I decided on wall-mounted garden taps as they are very cheap, can be installed high up and can be fitted with removable hoses or connected to print washers, film washers, etc, using quick connect hose fittings.

Tap station
Tap station

I completed the sink with self-adhesive vinyl splashback tiles. The garage backs onto the kitchen, so it was easy to drill through the wall and get a cold water feed. The tricky bit was the waste. While the kitchen drain does actually go through the garage, the garden door is in the way and there isn’t enough room underneath it to run a drain pipe. In the end I decided to install a waste tank underneath the sink for it to drain into, and an inexpensive pump to pump the waste water over the door and down into the drain via a flexible hose dropped into a washing machine trap. The pump is activated by a switch on the wall.

Sink all ready
Sink all ready

Fresh water inlet (copper) and pumped waste outlet (blue hose)

Finally, let’s have a look at the finished darkroom, equipped with a De Vere 54 enlarger which can handle negatives up to 5×4″. I have enough space on the bench to process prints up to 16×12″ in trays and up to 24×20″ in troughs. The first picture also shows a wall-mounted rack to store enlarger lenses, a swivel work lamp, and a trolley of film processing tanks and reels under the bench.

Finished darkroom (right hand side)
Finished darkroom (right hand side)

Looking the other way you can see the sink, now equipped with removable hoses, and the third tap hooked up to a Paterson 16×12″ print washer. To the left of the sink there’s a rack of tongs and safety glasses for the nasty chemicals, above the sink there is a hanging rack for finished prints and on the right there is a glove dispenser.

IMG_0329b.resized

This central view from the door gives a more balanced idea of what the space is like.

IMG_0327b.resized

From start to finish, this build took about two and a half months, although I did most of the work on my own in my limited free time. In total I bought over 100m in length of timber, nearly 30m2 of plasterboard and goodness knows how many screws.

Huge thanks to everyone who helped out, including Vassili (carpentry), Hannah (plastering and overall permission), Oliver (plumbing/flooding), Stuart (workbench), Matt (ceiling plasterboard), Edmund (fetching building materials), Drew and Paul (donations of equipment) and of course, all the Kickstarter backers who pledged funds in return for a reward – including friends and strangers.

Now the room is ready, I can’t wait to get back into darkroom craft! I’ve been without a darkroom for 11 months, although I’ve still been shooting film during that time. I need to develop the backlog of film and get printing so I can deliver the rewards to the Kickstarter backers. It’s going to be fun!

Building a new darkroom

I’ve moved into a new house now and it doesn’t yet have a darkroom. I thought I’d try something a bit different and launch a Kickstarter appeal to fund the construction of a new darkroom so I can continue my photographic work.

In return for your backing, there are rewards such as silver-gelatin prints, film processing services, use of the darkroom and one-to-one tuition.

Pledge now!