474 lines
462 KiB
XML
474 lines
462 KiB
XML
|
<?xml version="1.0" encoding="UTF-8"?>
|
|||
|
|
<feed xmlns="http://www.w3.org/2005/Atom">
|
|||
|
|
<title>icyphox</title>
|
|||
|
|
<subtitle></subtitle>
|
|||
|
|
<id>https://icyphox.sh/</id>
|
|||
|
|
<updated>2023-03-21T22:11:58+02:00</updated>
|
|||
|
|
<link href="https://icyphox.sh/"></link>
|
|||
|
|
<author>
|
|||
|
|
<name>Anirudh Oppiliappan</name>
|
|||
|
|
<email>x@icyphox.sh</email>
|
|||
|
|
</author>
|
|||
|
|
<entry>
|
|||
|
|
<title>I am moving to Finland</title>
|
|||
|
|
<updated>2023-01-18T00:00:00Z</updated>
|
|||
|
|
<id>tag:icyphox.sh/,2023-01-18:blog/finland</id>
|
|||
|
|
<link href="https://icyphox.sh/blog/finland"></link>
|
|||
|
|
<summary type="html"><h2>This is what I was packing for</h2>
<p>The past two weeks or so have felt like a fever dream. It&rsquo;s been a
blurry daze ever since I received my passport from the Finnish Embassy
in New Delhi. I still can&rsquo;t believe everything has finally materialized
and this move is actually happening. In about 10 hours from now, I will
be boarding my flight from Bangalore, transiting via Doha, to Helsinki.</p>

<p>So, how did this come about? I got employed there&mdash;I&rsquo;m joining
<a href="https://upcloud.com" rel="nofollow">UpCloud</a> as an SRE in their Orchestration team,
and will be working out of Helsinki. They helped with the immigration
process and will also be helping out with certain initial local affairs
and apartment hunting.</p>

<p>The biggest, most obvious change for me will be the weather. Going from
around 25°C to near-zero temps will need some acclimatization. I bought
the thickest, heaviest, water &amp; snow-proof parka that Decathlon had to
offer, along with some monstrous snow boots&mdash;I hope it&rsquo;ll suffice for
the first few days.</p>

<p>I&rsquo;m very much looking forward to life there&mdash;low pollution, clean water,
fresh produce (berries!), excellent public transport. Oh and of course,
the <em>slightly</em> less population density. Fun fact: the total population
of the entirety of Finland (5.6 million) is less than half of
Bangalore&rsquo;s (13 something million).</p>

<p>Suffice to say, I&rsquo;m beyond stoked for this new beginning both in
Helsinki and at UpCloud. I&rsquo;ll post an update once I&rsquo;ve settled down. In
the meanwhile, my <a href="https://h.icyphox.sh/@icy" rel="nofollow">fedi</a> will have more
frequent updates.</p>

<p>Moikka!</p>
</summary>
|
|||
|
|
</entry>
|
|||
|
|
<entry>
|
|||
|
|
<title>2022 in review</title>
|
|||
|
|
<updated>2023-01-14T00:00:00Z</updated>
|
|||
|
|
<id>tag:icyphox.sh/,2023-01-14:blog/2022-in-review</id>
|
|||
|
|
<link href="https://icyphox.sh/blog/2022-in-review"></link>
|
|||
|
|
<summary type="html"><h2>Late again because I was busy packing</h2>
<p>Quite possibly the &ldquo;fastest&rdquo; year I&rsquo;ve experienced&mdash;it feels like
yesterday when 2022 began. I think I <em>did</em> a lot last year, contrary to
previous years where I felt I&rsquo;d just squandered my time away. Which is
partly great because more content! But also not great, because I have to
write it. It&rsquo;s not that I don&rsquo;t enjoy writing anymore (despite what the
number of posts in 2022 might lead you to believe), I just find it
harder to sit and do the thing&mdash;perhaps something to think about and
investigate in 2023. But I digress&mdash;as I said, I did get a lot done
last year, so let&rsquo;s get right into it.</p>

<h2 id="projects-hacks">projects &amp; hacks</h2>

<p>I&rsquo;m only talking about software projects here, since this time around,
we&rsquo;ve got some hardware hacks (ooh!).</p>

<p>First on the list is <a href="https://git.icyphox.sh/legit" rel="nofollow">legit</a>, a web
frontend for git. A very important characteristic of legit that <em>needs</em>
mention is the fact that it&rsquo;s written in Go&mdash;it&rsquo;s even the name of the
first major release (<a href="https://git.icyphox.sh/legit/refs" rel="nofollow">v0.2.0</a>).<sup class="footnote-ref" id="fnref:1"><a href="#fn:1">1</a></sup>
On a more serious note, it&rsquo;s probably the nicest thing I&rsquo;ve built from
scratch and it&rsquo;s very cool to see legit instances in the wild. I
consider it <em>mostly</em> feature complete, barring a couple of outstanding
PRs that I have yet to get to.</p>

<p>Next up is <a href="https://git.icyphox.sh/honk" rel="nofollow">honk</a>. Not really my <em>own</em>
project, but something I spent a non-negligible amount of time hacking
on. The honk lives in my head, rent-free. A few changes in my honk fork
are:</p>

<ul>
<li>user profile pictures</li>
<li>color scheme and UI</li>
<li>pretty @ URLs (like <a href="https://h.icyphox.sh/@icy" rel="nofollow">https://h.icyphox.sh/@icy</a>)</li>
<li>bunch of other miscellaneous thingamajigs</li>
</ul>

<p>Lastly, I <a href="/blog/openbsd-oci/">installed OpenBSD</a> on my Oracle VM and
now everything runs off it, this site included.</p>

<p>Probably not a &ldquo;project&rdquo;, but I&rsquo;ll include it here anyway: I switched my
entire <a href="https://git.icyphox.sh/dotfiles" rel="nofollow">dotfiles</a> setup to Nix and
home-manager and rest of that shit I used to filter on Lobste.rs. While
I like the declarativeness, I won&rsquo;t pretend I understand the half of it.
Believe me, I&rsquo;ve tried. But it mostly just works the way I have it, so
I&rsquo;ll leave it at that.</p>

<h2 id="keyboards-my-first-new-expensive-hobby">keyboards: my (first) new expensive hobby</h2>

<p>Normal 60% keyboards are out&mdash;ergonomic split ortho keyboards are in.
I built three keyboards this year: the Lotus58, and two semi-custom
34-key wireless splits: the
<a href="https://github.com/icyphox/ferricy" rel="nofollow">Ferricy</a>, and the Ferricy Choc.</p>

<div class="row">
<img src="https://cdn.icyphox.sh/F9YxI.jpeg" style="width: 500px"/>
<img src="https://cdn.icyphox.sh/rgVrx.jpeg" />
<img src="https://cdn.icyphox.sh/LU
|
|||
|
|
</entry>
|
|||
|
|
<entry>
|
|||
|
|
<title>Installing OpenBSD on Oracle Cloud</title>
|
|||
|
|
<updated>2022-11-24T00:00:00Z</updated>
|
|||
|
|
<id>tag:icyphox.sh/,2022-11-24:blog/openbsd-oci</id>
|
|||
|
|
<link href="https://icyphox.sh/blog/openbsd-oci"></link>
|
|||
|
|
<summary type="html"><h2>It finally works in 7.2!</h2>
<p>I&rsquo;ve been trying to get OpenBSD to install on OCI since <a href="https://marc.info/?l=openbsd-misc&amp;m=162962869305286&amp;w=2" rel="nofollow">early last
year</a>. As
described in my email to misc@, my intial method of installation was
rather unconventional:</p>

<ul>
<li>Download the install image to tmpfs</li>
<li>dd it onto the host boot device (/dev/sda)</li>
<li>Reboot</li>
</ul>

<p>This works perfectly for Alpine, I&rsquo;ll have you know but not so much for
OpenBSD. I don&rsquo;t know why. Anyway, with that rather useless preface
aside, <a href="https://openbsd.org/72.html" rel="nofollow">OpenBSD now supports</a> booting on
amd64 OCI instances:</p>

<blockquote>
<p>Allowed bsd.rd and bsd/bsd.mp to boot on Oracle Cloud amd64 instances.</p>
</blockquote>

<p>This time around, I decided to try a somewhat less nuclear approach to
booting it. The steps I followed were from a kind <a href="https://blinken.life/oci-obsd/" rel="nofollow">internet stranger&rsquo;s
article</a>, coincedentally ranting about
how they <em>failed</em> to boot OpenBSD on OCI.<sup class="footnote-ref" id="fnref:1"><a href="#fn:1">1</a></sup></p>

<p>It&rsquo;s fairly straight forward, and you&rsquo;ll be fine simply following the
steps in the article I linked above; but since you&rsquo;re here, let&rsquo;s run
through them real quick:</p>

<ol>
<li><p>Download the <code>install72.img</code> onto an OpenBSD machine. Trust me,
dealing with loopback mounts is not fun on Linux.</p></li>

<li><p>&ldquo;Mount&rdquo; the install image using <a href="https://man.openbsd.org/vnconfig" rel="nofollow">vnconfig(8)</a>:</p>

<pre><code>vnconfig vnd0 install72.img
mount /dev/vnd0a /mnt
</code></pre></li>

<li><p>Configure booting over serial:</p>

<pre><code>echo 'set tty com0' &gt; /mnt/etc/boot.conf
</code></pre></li>

<li><p>Convert the modified <code>install72.img</code> to qcow2 using <code>qemu-img</code>. We
will be uploading this to OCI as a custom image.</p>

<pre><code>qemu-img convert -O qcow2 install72.img install.qcow2
</code></pre></li>

<li><p>Uploading the image requires creating an object storage bucket first.
Navigate to Storage → Buckets and create one. Call it whatever.</p></li>

<li><p>Upload the qcow2 from step 4.</p></li>

<li><p>Head to Compute → Custom Images and click Import Image. Choose your
bucket and qcow2 and select image type as QCOW2. We&rsquo;ll stick to
Paravirtualized mode. Give it a bit.</p></li>

<li><p>Once it&rsquo;s done importing, create a new amd64 instance like you
normally would, and choose your newly created custom image. Don&rsquo;t
bother with SSH keys.</p></li>

<li><p>Launch a console connection to access the serial boot. You should
hopefully see the OpenBSD installer. You might have to hit Enter
once. Hit &lsquo;I&rsquo; and start the install.</p></li>

<li><p>There should only be one disk available. Choose that. Everything
else should just work like in any other OpenBSD install.</p></li>
</ol>

<p>That&rsquo;s abo
|
|||
|
|
</entry>
|
|||
|
|
<entry>
|
|||
|
|
<title>Unicode text input in ZMK</title>
|
|||
|
|
<updated>2022-10-18T00:00:00Z</updated>
|
|||
|
|
<id>tag:icyphox.sh/,2022-10-18:blog/zmk-unicode</id>
|
|||
|
|
<link href="https://icyphox.sh/blog/zmk-unicode"></link>
|
|||
|
|
<summary type="html"><h2>A hacky interim solution using macros</h2>
<p>As a highly cultured em-dash (over-)user, being able to type &lsquo;—&rsquo; easily
is very important to me. While waiting for
<a href="https://github.com/zmkfirmware/zmk/issues/232" rel="nofollow">zmkfirmware/zmk#232</a> to
get merged, I&rsquo;ve discovered a rather nifty workaround for inputting
Unicode text. This method makes use of
<a href="https://github.com/ibus/ibus" rel="nofollow">IBus</a> and a ZMK macro.</p>

<p>Unicode input in IBus is done by typing <code>Ctrl</code> + <code>Shift</code> + <code>U</code> followed
by the Unicode codepoint and then a <code>Space</code> or <code>Return</code>. Writing this
as a ZMK macro, we get something like:</p>

<pre><code class="language-dts">macros {
 uc_dash: uc_dash {
 label = &quot;UNICODE_DASH&quot;;
 compatible = &quot;zmk,behavior-macro&quot;;
 #binding-cells = &lt;0&gt;;
 tap-ms = &lt;0&gt;;
 wait-ms = &lt;0&gt;;
 bindings
 = &lt;&amp;macro_press &amp;kp LCTRL &amp;kp LSHFT&gt;
 , &lt;&amp;macro_tap &amp;kp U&gt;
 , &lt;&amp;macro_release &amp;kp LCTRL &amp;kp LSHFT&gt;
 , &lt;&amp;macro_tap &amp;kp N2 &amp;kp N0 &amp;kp N1 &amp;kp N4 &amp;kp SPC&gt;
 ;
 }; 
};
</code></pre>

<p>Where the numbers <code>2014</code> denote the codepoint for an em-dash. Set the
<code>wait-ms</code> and the <code>tap-ms</code> to <code>0</code> to make it instantaneous&mdash;your
keyboard will essentially type out the entire key combo really fast. The
resulting keycode <code>uc_dash</code> can be used in any <code>bindings</code> field. I have
it on a separate Unicode layer.</p>

<p>The unfortunate caveat is it only works where IBus works, and it doesn&rsquo;t
seem to work in Qt applications. Granted, I only really need it in my
browser and Signal/Slack Desktop (Electron) so that isn&rsquo;t a dealbreaker.</p>

<p>My ZMK config is <a href="https://github.com/icyphox/ferricy-zmk" rel="nofollow">here</a>.</p>
</summary>
|
|||
|
|
</entry>
|
|||
|
|
<entry>
|
|||
|
|
<title>The Logitech Ergo M575 trackball</title>
|
|||
|
|
<updated>2022-07-01T00:00:00Z</updated>
|
|||
|
|
<id>tag:icyphox.sh/,2022-07-01:blog/m575</id>
|
|||
|
|
<link href="https://icyphox.sh/blog/m575"></link>
|
|||
|
|
<summary type="html"><h2>A short review of my first ever trackball</h2>
<p>Ever since switching to a split keyboard, using a mouse has been rather
awkward. Do I put it in between the two halves? Not enough space. Do I
put it to the right? Again, not enough space since that&rsquo;s where my
notebook sits. And then there was the pain. I had to take routine breaks
from using the mouse due to pain on the bottom-left side of my palm.</p>

<p>Enter, the trackball. Trackballs are pointing devices much like the
slightly more popular rodent. They&rsquo;re super old&mdash;dating right back to
the post-World War II era.<sup class="footnote-ref" id="fnref:1"><a href="#fn:1">1</a></sup> Largely speaking, there are two kinds of
trackballs: thumbballs and fingerballs. A thumbball, like the name
suggests, is operated using the thumb. A fingerball (also called as
ambidextrous trackballs) has the ball in the center, with buttons on
either side. They behave quite like a laptop&rsquo;s touchpad.</p>

<p>Trackballs take up very little space (check!), and are known to help with
RSI (also check!). So I got one.</p>

<p><img src="https://cdn.icyphox.sh/KPMds.jpg" alt="logitech ergo m575" /></p>

<p>I got the <a href="https://www.logitech.com/en-in/products/mice/m575-ergo-wireless-trackball.910-005873.html" rel="nofollow">Logitech Ergo
M575</a>.
This is the cheapest Bluetooth trackball available in India. I bought it
for around INR 3500 (≈45 USD). It sits comfortably and stably in between
the two halves of my keyboard; it is so much easier on my hand&mdash;it has
greatly alleviated my pain. Pictured below is my actual desk right
now<sup class="footnote-ref" id="fnref:2"><a href="#fn:2">2</a></sup>.</p>

<p><img src="https://cdn.icyphox.sh/O97-8.jpg" alt="my messy table" /></p>

<p>The M575 is larger than your typical mouse but that&rsquo;s fine since it
doesn&rsquo;t move. Its curved shape is very satisfying to hold&mdash;it fills
your entire palm. The build quality is pretty solid. It&rsquo;s all plastic,
but that&rsquo;s a good thing. Rubberized finishes are harder to clean and start
getting gooey and icky after a while.</p>

<div class="row">
<img src="https://cdn.icyphox.sh/PeP0g.jpg" style="width:300px" />
<img src="https://cdn.icyphox.sh/gR2La.jpg" style="width:300px" />
<img src="https://cdn.icyphox.sh/Hdw-p.jpg" style="width:300px" />
</div>

<p>There are a total of 5 buttons: the left and right, scroll wheel and the
forward/backward buttons, which sit to the top left. I&rsquo;m not sure I like
their positioning however&mdash;I prefer them by the thumb. I suppose the
ball takes up that space. Speaking of the ball: it&rsquo;s a sparkly
plastic-ish (not sure really) material and it&rsquo;s pretty light. It can
(and needs to be) popped off now and then for cleaning. The ball sits on
three ceramic bearings which are very smooth.</p>

<p>It ships with a single AA battery with an advertised runtime of 24
months. Connectivity is either via Bluetooth or a USB-A dongle found in
the battery compartment.</p>

<p>As for software, <a href="https://github.com/pwr-Solaar/Solaar" rel="nofollow">Solaar</a> is a GUI
(and a CLI) for various Logitech devices, the M575 included. I couldn&rsquo;t
get much use out of it aside from tweaking DPI settings.</p>

<p><img src="https://cdn.icyphox.sh/2d09m.png" alt="solaar screenshot" /><
|
|||
|
|
</entry>
|
|||
|
|
<entry>
|
|||
|
|
<title>Honkin' on the Fly</title>
|
|||
|
|
<updated>2022-05-25T00:00:00Z</updated>
|
|||
|
|
<id>tag:icyphox.sh/,2022-05-25:blog/honk-fly</id>
|
|||
|
|
<link href="https://icyphox.sh/blog/honk-fly"></link>
|
|||
|
|
<summary type="html"><h2>Running honk on fly.io</h2>
<p><strong>Update 2022&ndash;08&ndash;11</strong>: As with literally every update of mine, I&rsquo;m no
longer running honk on Fly. It&rsquo;s way easier to simply run it on a server
myself, behind nginx. Huh&mdash;who knew?</p>

<p>For those unaware&mdash;first of all, how? it&rsquo;s literally everywhere&mdash;<a href="https://fly.io" rel="nofollow">fly.io</a> is the new platform-as-a-service du jour. The
idea is to give them a Dockerfile (or a pre-built image, or just generic
applications in <a href="https://fly.io/docs/getting-started/#language-guides" rel="nofollow">a bunch of
languages</a>), and
they run it for you on servers across the globe. Firecracker microVMs,
WireGuard, and some other neat tech. Understandably, this gets the
average Hacker News-type (me), excited. And I&rsquo;d been meaning to switch
my fediverse instance over to
<a href="https://humungus.tedunangst.com/r/honk" rel="nofollow">honk</a>&mdash;a stateful Go
application using sqlite<sup class="footnote-ref" id="fnref:1"><a href="#fn:1">1</a></sup>. And the fly.io folks <a href="https://fly.io/blog/all-in-on-sqlite-litestream/" rel="nofollow">really like
sqlite</a>. The stars
have aligned.</p>

<p>I trust that you can figure out the initial setup bits like logging in
to the dashboard and giving them your credit card info and praying that
they don&rsquo;t run you a bill of $5000 because you somehow blew through
their free allowance resources. As I understand it, Fly &ldquo;auto-scales&rdquo;,
so this scenario isn&rsquo;t unlikely&mdash;however, <a href="https://news.ycombinator.com/item?id=31392497" rel="nofollow">they do offer some
leniency</a>. Luckily, the
chances of me turning into a fedi-influencer (<em>fedifluencer</em>?) overnight
are rather slim.</p>

<h2 id="setup">setup</h2>

<p>They want a Dockerfile, so let&rsquo;s give them one.</p>

<pre><code class="language-dockerfile">FROM golang:1.18-alpine AS builder
RUN apk add sqlite-dev build-base mercurial

WORKDIR /tmp/src
RUN hg clone https://humungus.tedunangst.com/r/honk 
RUN cd honk &amp;&amp; make

FROM alpine:latest
RUN apk add sqlite sqlite-dev

COPY local /tmp/local
COPY memes /tmp/memes
COPY emus /tmp/emus

WORKDIR /opt
COPY --from=builder /tmp/src/honk/honk /bin/
COPY --from=builder /tmp/src/honk/views views/
COPY start /bin

ENV HONK_DATA_DIR &quot;/opt/data&quot;
ENV HONK_VIEWS_DIR &quot;/opt/&quot;

CMD [&quot;/bin/start&quot;]
</code></pre>

<p>Not too much going on here&mdash;we pull latest tip, build honk, copy the
<code>local</code> directory containing our <code>local.css</code> (custom styles); the
<code>memes</code> directory containing, well, memes (PNGs and GIFs); and the
<code>emus</code> directory containing emoji (used as <code>:filename:</code>). These will
then be copied into the Fly volume later on by the <code>start</code> script. Kinda
gross, but whatever.</p>

<p>And the <code>start</code> script:</p>

<pre><code class="language-sh">#!/bin/sh

run() {
 cp -R /tmp/memes/* &quot;$HONK_DATA_DIR&quot;/memes/
 cp -R /tmp/memes/* &quot;$HONK_DATA_DIR&quot;/emus/
 cp -R /tmp/local/* &quot;$HONK_DATA_DIR&quot;/views/

 honk -datadir &quot;$HONK_DATA_
|
|||
|
|
</entry>
|
|||
|
|
<entry>
|
|||
|
|
<title>The Asus ROG Flow X13</title>
|
|||
|
|
<updated>2022-05-02T00:00:00Z</updated>
|
|||
|
|
<id>tag:icyphox.sh/,2022-05-02:blog/flow-x13</id>
|
|||
|
|
<link href="https://icyphox.sh/blog/flow-x13"></link>
|
|||
|
|
<summary type="html"><h2>My hunt for a new laptop has finally concluded</h2>
<p><img src="https://cdn.icyphox.sh/3NZ1u.jpg" alt="" /></p>

<p>I&rsquo;ve been on the lookout for a new laptop for a while now. While the HP
Envy was good&mdash;is good&mdash;the measly 8 gigs of RAM was struggling to
hold in all the beefy stuff that I run these days (skaffold, k3s, etc.).
And it being a &ldquo;budget&rdquo; laptop of its time didn&rsquo;t do its chassis any
favors&mdash;the bottom was very scratched because the rubber bumpons
came off; the keyboard deck had some rather mysterious scuff marks.
Anyway, off I went looking for a replacement.</p>

<p>My requirements for a laptop are somewhat specific. From the title it&rsquo;s
obvious that I&rsquo;d like to have good Linux support; here&rsquo;s a list of
other things that I expect to see:</p>

<ul>
<li>HiDPI: Any resolution above 1080p (or 1200p). I look at text all day,
and I&rsquo;d like it to be <em>crispy</em>.</li>
<li>13&rdquo; - 14&rdquo;: I don&rsquo;t like overly large or heavy laptops. I think 13.3
inches is the perfect screen size; 14 is a compromise.</li>
<li>A decent CPU: I don&rsquo;t really do anything very compute intensive, but
an i7 or a Ryzen 7 should be ideal.</li>
<li>32 GB RAM: Having struggled with 8 gigs for so long made this a hard
requirement. Never again will I have to <code>pkill gopls</code>.</li>
</ul>

<p>I can&rsquo;t say I had a specific budget in mind, but anything more than 140k
INR (1.4L, ≈1800 USD) is somewhat hard to justify. Listed below were the
contenders for the prestegious position of being my laptop of choice:</p>

<ul>
<li><strong>Tuxedo InfinityBook Pro 14</strong>: While this ticks all the boxes, the
cost including shipping (as of this writing) is about 1700 EUR. And
that&rsquo;s without opening the massive, stinky can of worms called Indian
Customs. Expecting a very lenient 40% duty, it&rsquo;s safe to say it&rsquo;s
<em>batshit expensive</em>.</li>
<li><strong>ThinkPad X13</strong>: Lenovo&rsquo;s site allows you to customize orders for
certain models, and these will be custom built and shipped from China.
The nice thing is Lenovo takes care of the customs and shipping and
other logistics. The not-nice thing is it takes a minimum of <em>12
weeks</em>&mdash;at least for the X13. That&rsquo;s 4 whole months. I think I&rsquo;ll
pass.</li>
</ul>

<p>With that preface out of the way, the machine I finally settled on was
(as the title reads) the <strong>Asus ROG Flow X13</strong>. My model set me back by
about 130,000 INR (1.3L, ≈1700 USD). The trick was to look in the
&ldquo;gaming laptops&rdquo; section, because this model didn&rsquo;t show up anywhere in
the thin-and-light/productivity/ultrabook searches. And it doesn&rsquo;t look
gamery at all. Here&rsquo;s what my Dad had to say, as a serial ThinkPad user:</p>

<blockquote>
<p>&ldquo;It looks like a ThinkPad.&rdquo;</p>
</blockquote>

<h2 id="hardware">hardware</h2>

<p>I opted to buy the 2021 model because, really, the only difference in
the 2022 model is the marginally better CPU and a MUX switch. I don&rsquo;t
care much for either. The octa-core Ryzen 9 5900HS has more compute
power than I could ever need.</p>

<p>The chassis is made of a &ldquo;magnesium alloy&rdquo;, with a grooved finish that
feels very nice to touch. There&rsquo;s very minimal branding&md
|
|||
|
|
</entry>
|
|||
|
|
<entry>
|
|||
|
|
<title>Cloud (F)OSS is a good model</title>
|
|||
|
|
<updated>2022-02-07T00:00:00Z</updated>
|
|||
|
|
<id>tag:icyphox.sh/,2022-02-07:blog/cloud-foss</id>
|
|||
|
|
<link href="https://icyphox.sh/blog/cloud-foss"></link>
|
|||
|
|
<summary type="html"><h2>On building (mostly) open source startups</h2>
<p>Of late, I&rsquo;ve been thinking a lot about what makes a startup work, and I
think open sourcing your product&mdash;or a good portion of it&mdash;is a
great approach. To be clear, I&rsquo;m only talking about SaaS platforms, and
not any other kind of product. Hence, I&rsquo;m dubbing this as &ldquo;Cloud FOSS&rdquo;.</p>

<p>The title of this post was initially &ldquo;Cloud FOSS is the way&rdquo;, but I
quickly realised that I know next to nothing about actually building
companies and I&rsquo;m really just talking out of my rear end. Nevertheless
it&rsquo;s still pretty fun to try and reason about why the open source model
is great for startups, so reason we shall.</p>

<p>Broadly speaking, there are two kinds of &ldquo;Cloud FOSS&rdquo; companies:</p>

<ul>
<li>the open source and cloud versions are identical, entirely free software (à la
<a href="https://sourcehut.org" rel="nofollow">sourcehut</a>)</li>
<li>the cloud version has exclusive &ldquo;premium&rdquo; features that aren&rsquo;t present
in the open source version&mdash;a.k.a the open core model; it seems to
be gaining a lot of popularity in recent times with the likes of
Gitlab etc.</li>
</ul>

<p>Let&rsquo;s dissect each approach and see what drives them.</p>

<h2 id="the-all-foss-absolutist-model">the all-FOSS absolutist model</h2>

<p>As mentioned above, sourcehut is a great&mdash;if not the only&mdash;example
of a company built this way. Unless of course, I&rsquo;m gravely mistaken
(wouldn&rsquo;t be the first time!), and you know of another, or are building
one yourself&mdash;please <a href="mailto:x@icyphox.sh" rel="nofollow">email me</a>; I&rsquo;ll be happy to
mention it here.</p>

<p><strong>Update</strong>: I was indeed mistaken. Here are a few companies built
similarly:</p>

<ul>
<li><a href="https://jmp.chat/" rel="nofollow">jmp.chat</a>&mdash;free-as-in-freedom US/Canadian phone
numbers</li>
<li><a href="https://frappe.io/" rel="nofollow">Frappe</a>&mdash;Indian company building a suite of
free software products</li>
<li><a href="https://plausible.io" rel="nofollow">Plausible Analytics</a>&mdash;free software analytics
platform. The self-hosted version has a less frequent (LTS) release
schedule.</li>
</ul>

<p>For those unaware, sourcehut is an entirely free software
company/startup that&rsquo;s building a software development platform; a suite
of tools and services like git/hg hosting, CI, mailing lists, issue
tracking etc. All of these can be self-hosted, with <a href="https://man.sr.ht/installation.md" rel="nofollow">plenty of
docs</a> to get started doing so. Or,
you can of course, pay for the hosted service at <a href="https://sr.ht" rel="nofollow">sr.ht</a>,
their flagship instance.</p>

<p>Granted, this one&rsquo;s probably quite hard to pull off, especially if you&rsquo;re VC
backed or have investors of any kind. When your product is free
software, you can&rsquo;t really bake in analytics and other creepy
user-tracking shit that&rsquo;s common these days; what pages perform better,
what buttons do users click more often, the likes. And naturally, you
don&rsquo;t really have metrics to show your investors that your latest
feature du jour is doing great (or not).</p>

<p>
|
|||
|
|
</entry>
|
|||
|
|
<entry>
|
|||
|
|
<title>2021 in review</title>
|
|||
|
|
<updated>2022-01-10T00:00:00Z</updated>
|
|||
|
|
<id>tag:icyphox.sh/,2022-01-10:blog/2021-in-review</id>
|
|||
|
|
<link href="https://icyphox.sh/blog/2021-in-review"></link>
|
|||
|
|
<summary type="html"><h2>The post-year ramble is here, slightly late this time</h2>
<p>The last year was quite eventful to say the least, and I&rsquo;d been putting
off on writing this retrospective simply because of the sheer number of
things that happened/I did, of varying levels of importance&mdash;both to
you as a reader, and me as&hellip; well, the one who experienced them.</p>

<p>I&rsquo;ll try to highlight the major ones here&mdash;they&rsquo;re also the ones I&rsquo;m
okay to discuss publicly, so there&rsquo;s that. As for the rest: they&rsquo;ll
serve as conversation fuel for 2022.</p>

<h2 id="i-graduated-barely">I graduated&hellip; barely</h2>

<p>After 4 long years, mostly &ldquo;learning&rdquo; about things that haven&rsquo;t been
used since like, my mom was born (I&rsquo;m looking at you Intel 8086), I am
now a Bachelor of Technology in Computer Science and Engineering. I say
barely because I actually did pretty terribly. I&rsquo;m still mildly
surprised that given my GPA, the degree certificate classifies it as a
&ldquo;First Class&rdquo;. I think they just felt sorry for us lot.</p>

<p>Was it a waste of time? A lot of the coursework, sadly, was. But my time
in college&mdash;however little&mdash;was actually quite fun. One thing&rsquo;s for
sure: I can&rsquo;t rewind time to see what would&rsquo;ve happened had I <em>not</em> done
the degree; but now I&rsquo;ve done it, and here we are. Wherever that is.
Maybe it helped, maybe it didn&rsquo;t. Oh well.</p>

<h2 id="my-time-at-deepsource">my time at DeepSource</h2>

<p>This time last year (January 2021), I joined
<a href="https://deepsource.io" rel="nofollow">DeepSource</a> as a Security Engineer (SRE on
paper). Suffice to say, I had an excellent time there, working with some
equally excellent people. I got to touch a whole bunch of systems:
ranging from observability pipelines, mesh networks in Kubernetes,
cloud-native security, and some more Kubernetes.</p>

<p>Oh, and here are a few pictures from our trip to the Maldives.<sup class="footnote-ref" id="fnref:1"><a href="#fn:1">1</a></sup></p>

<p><img src="https://cdn.icyphox.sh/FX~bI.jpg" alt="maldives 1" />
<img src="https://cdn.icyphox.sh/DMHDG.jpg" alt="maldives 2" /></p>

<p>In December 2021, I decided to leave DeepSource in favor of other
opportunities. I must say, I will deeply miss my equity when DeepSource
eventually becomes a unicorn&mdash;and I&rsquo;m confident they will! As for the
other opportunities, I will write about that in a future post. This is a
<em>retrospective</em> after all.<sup class="footnote-ref" id="fnref:2"><a href="#fn:2">2</a></sup></p>

<h2 id="projects-and-hacks">projects and hacks</h2>

<p>Probably my biggest and most fun project this year was
<a href="https://forlater.email" rel="nofollow">forlater.email</a>. Both the site, and its
<a href="/blog/building-forlater">technical breakdown</a> frontpaged on Hacker News
and was pretty well received. In hindsight, I should&rsquo;ve included some
kind of payment model, but at the same time, being flexible enough to
accomodate those that can&rsquo;t afford to pay. And the code is shit. I&rsquo;ll
probably rewrite it. Eventually.<sup class="footnote-ref" id="fnref:3"><a href="#fn:3">3</a></sup></p>

<p>My attempt at running <a
|
|||
|
|
</entry>
|
|||
|
|
<entry>
|
|||
|
|
<title>Signal Desktop on OpenBSD via vmm(4)</title>
|
|||
|
|
<updated>2021-12-26T00:00:00Z</updated>
|
|||
|
|
<id>tag:icyphox.sh/,2021-12-26:blog/signal-vmm</id>
|
|||
|
|
<link href="https://icyphox.sh/blog/signal-vmm"></link>
|
|||
|
|
<summary type="html"><h2>X11 forwarding to the rescue</h2>
<p>Early this year, I completely switched over to Signal and I&rsquo;m fortunate enough
to have everyone that I talk to switch over as well. I know I wrote what some
might view as a <a href="/blog/signal">hit piece on Signal</a>, but I have immense respect
for the project and will continue to use it until an actually viable
alternative comes along.</p>

<p>Unfortunately, their desktop application isn&rsquo;t natively available for OpenBSD.
A solution that&rsquo;s worked decently enough for me is to run it via X11 forwarding
on a Ubuntu VM running on <a href="https://man.openbsd.org/vmm" rel="nofollow">vmm(4)</a>&mdash;OpenBSD&rsquo;s
built-in hypervisor.</p>

<h2 id="setting-up-the-vm">setting up the VM</h2>

<p>I recommend reading the <a href="https://www.openbsd.org/faq/faq16.html" rel="nofollow">FAQ on
Virtualization</a> first, but here&rsquo;s a
quick overview. Note that I&rsquo;ll be skipping the networking bits so I highly
recommend reading the FAQ to get your VM connected to the internet.</p>

<p>Create a disk image for the VM to install onto.</p>

<pre><code class="language-sh">$ vmctl create -s 30G ubuntu.img
</code></pre>

<p>I&rsquo;m using the Ubuntu 18.04 LTS
<a href="archive.ubuntu.com/ubuntu/dists/bionic/main/installer-amd64/current/images/netboot/mini.iso" rel="nofollow">mini.iso</a>.
I ran into issues with the 20.04 LTS ISO, but I think you should be able to
<code>dist-upgrade</code> from 18.04 without much trouble. Once you have the ISO
downloaded somewhere, edit <code>/etc/vm.conf</code>:</p>

<pre><code class="language-conf">vm &quot;ubuntu&quot; {
 memory 2G 
 cdrom &quot;/path/to/mini.iso&quot;
 disk &quot;/path/to/ubuntu.img&quot;
 interfaces 1
 local interface tap
 owner icy # this is your user
 disable
}
</code></pre>

<p>Start and (optionally) enable <a href="https://man.openbsd.org/vmd" rel="nofollow">vmd(8)</a>.</p>

<pre><code class="language-sh">$ doas rcctl -f start vmd
$ doas rcctl enable vmd
</code></pre>

<p>We can now boot into the VM, and interface via the serial console. This can be
done using <a href="https://man.openbsd.org/vmctl" rel="nofollow">vmctl(8)</a>.</p>

<pre><code class="language-sh">$ vmctl start -c ubuntu # note -c for console
</code></pre>

<p>Hit Tab on the bootloader screen to edit the kernel parameters. We want to
force it to use the serial console for installation. This is done by adding
<code>console=ttyS0,115200</code> on the line shown. If there&rsquo;s a <code>quiet</code>, delete that and
add the above. You can then continue on with the installation&mdash;install
OpenSSH, add your keys etc.</p>

<p>Once installed, remove the <code>cdrom</code> line from your <code>vm.conf</code> and start the VM
without the serial console.</p>

<pre><code>$ vmctl start ubuntu
</code></pre>

<h2 id="installing-and-running-signal-desktop">installing and running Signal Desktop</h2>

<p>SSH into the VM with X11 forwarding enabled:</p>

<pre><code class="language-sh">$ ssh -Y myvmhost
</code></pre>

<p>Install <code>signal-desktop</code>, following the inst
|
|||
|
|
</entry>
|
|||
|
|
<entry>
|
|||
|
|
<title>The quest to optimize productivity</title>
|
|||
|
|
<updated>2021-11-04T00:00:00Z</updated>
|
|||
|
|
<id>tag:icyphox.sh/,2021-11-04:blog/bujo</id>
|
|||
|
|
<link href="https://icyphox.sh/blog/bujo"></link>
|
|||
|
|
<summary type="html"><h2>This blog is devolving into a techbro cliché</h2>
<p>Us folks in tech have this general obsession with productivity. It&rsquo;s all
about getting the workflow <em>just right</em>. Or at least, that&rsquo;s the goal.
Heck, there are entire companies built around optimizing productivity in
specific workflows&mdash;email, notes, tasks, etc. Suffice to say, there&rsquo;s
a lot of activity in this space.</p>

<p>I&rsquo;ve heard reports of varying degrees of success with these tools, from
&ldquo;OMG it like, totally changed how I take notes!&rdquo;, to &ldquo;I&rsquo;m not sure it&rsquo;s
worth paying $30 per month for a mail client&rdquo; (yeah, you know the
one)<sup class="footnote-ref" id="fnref:1"><a href="#fn:1">1</a></sup>. However, I will never use these tools. Primarily because I
don&rsquo;t trust them&mdash;I don&rsquo;t trust them with my data; more importantly, I
don&rsquo;t trust them to exist long enough before they decide to thank me for
their incredible journey and &ldquo;sunset&rdquo; their product.</p>

<p>That said, I wasn&rsquo;t entirely opposed to digital solutions. I tried
a method called the OBTF, or the One Big Text File. It&rsquo;s what it says on
the tin: a single text file to manage everything&mdash;tasks, email,
meetings, notes, habit tracking, etc. Its effectiveness relies on your
text editor&rsquo;s ability to search for things. I even came up with my own
&ldquo;syntax&rdquo; to help accelerate finding relevant bits. It looked like so:</p>

<pre><code>wed, 03 nov

some task here // DONE
another task here
a note here
meet foo @ 12:30 // CANCELLED
</code></pre>

<p>I don&rsquo;t exactly recall why I stopped doing it, but I did. Maybe because
I tried to do way too many things all at once. It also meant I needed to
be at my computer to update tasks&mdash;some of which were offline/IRL.
Yeah, you can see where this is going. You probably guessed it from the
post slug. That&rsquo;s right&mdash;bullet journaling. Well, sort of&mdash;let me
explain.</p>

<p>The <a href="https://youtu.be/fm15cmYU0IM" rel="nofollow">bullet journal method</a> is a somewhat
involved process. I recommend watching the video since I&rsquo;m going to skip
explaining how bullet journaling works. The method I use draws
inspiration from bullet journaling&mdash;but just mostly the task symbols
and daily/weekly logs. These are the symbols I use:</p>

<ul>
<li><code>•</code> is a new task</li>
<li><code>×</code> is a completed task</li>
<li><code>&gt;</code> is a task that&rsquo;s been carried forward</li>
<li><code>~strikethrough~</code> is a cancelled task</li>
<li><code>-</code> represents a note</li>
</ul>

<p>And somewhat less commonly, <code>⊙</code> (a circled dot) to scribble a small note
pertaining to that task, i.e. reason for cancellation, delegation, etc.
Tasks are sometimes broken down into further subtasks represented as a
checkbox <code>□</code>. Ticking off a checkbox feels great.</p>

<p>Tasks are grouped under a weekly list, running from Monday to Sunday. I
had previously done daily lists, but that&hellip; didn&rsquo;t really work out.
Here&rsquo;s what happened:</p>

<pre><code>mon, 01 nov
&gt; long task here
× something else

tue, 02 nov
&gt; long task here

wed, 03 nov
&gt; long task here&#
|
|||
|
|
</entry>
|
|||
|
|
<entry>
|
|||
|
|
<title>How I built forlater.email</title>
|
|||
|
|
<updated>2021-09-25T00:00:00Z</updated>
|
|||
|
|
<id>tag:icyphox.sh/,2021-09-25:blog/building-forlater</id>
|
|||
|
|
<link href="https://icyphox.sh/blog/building-forlater"></link>
|
|||
|
|
<summary type="html"><h2>A technical breakdown of my first big side-project</h2>
<p>Ever since I began browsing sites like Hacker News and Lobsters, coming
across new and exciting links to check out every day, I found it hard to
keep up. On most days, I just didn&rsquo;t. And that&rsquo;s fine&mdash;<a href="/blog/dont-news">good,
even</a>. But oftentimes, I&rsquo;d come across a genuinely
interesting link but no time to actually read it.</p>

<p>I began using Pocket. It was alright&mdash;the article view was very good;
but it stopped there. I didn&rsquo;t like nor use the other junk baked into
the app: discover, following/friends thing, etc. It&rsquo;s also proprietary,
and that irked me&mdash;more so than the other &ldquo;features&rdquo;.</p>

<p>Thus, somewhat inspired by rss2email, I began building
<a href="https://forlater.email" rel="nofollow">forlater.email</a>&mdash;a bookmarking/read-later
service that works via email. Email is the perfect tool for this
use-case: works offline; you can organize it however you like; you own
your data.</p>

<p><img src="https://cdn.icyphox.sh/JNAn4.png" alt="forlater arch" /></p>

<p>Pictured above is how forlater works. Each component is explained below.</p>

<h2 id="opensmtpd">OpenSMTPD</h2>

<p>Mail containing links to be saved arrive here. OpenSMTPD is beautiful
software, and its configuration is stupid simple
(<a href="https://man.openbsd.org/smtpd.conf" rel="nofollow">smtpd.conf(5)</a>):</p>

<pre><code class="language-conf">table blocklist file:/etc/smtpd/blocklist

action webhook mda &quot;/home/icy/forlater/mdawh/mdawh&quot;
match mail-from &lt;blocklist&gt; for any reject
match from any for rcpt-to &quot;save@forlater.email&quot; action webhook
</code></pre>

<p>The <code>filter</code> and <code>listen</code> directives have been snipped for brevity. The
rest, in essence, simply sends all mail to <code>save@forlater.email</code> to an
MDA program, via stdin. Any mail from an address in the blocklist file
get rejected.</p>

<p><a href="https://rspamd.com" rel="nofollow">rspamd</a> is used to prevent spam.</p>

<h2 id="mdawh">mdawh</h2>

<p><a href="https://git.icyphox.sh/forlater/mdawh" rel="nofollow">mdawh</a>, or the MDA webhook tool.
A small Go program that processes mail coming from stdin and generates a
JSON payload that looks like so:</p>

<pre><code class="language-json">{
 &quot;from&quot;: &quot;foo@bar.com&quot;,
 &quot;date&quot;: &quot;Fri, 1 Jan 2010 00:00:00 UTC&quot;,
 &quot;replyto&quot;: &quot;...&quot;,
 &quot;body&quot;: &quot;...&quot;,
 &quot;parts&quot;: {
 &quot;text/plain&quot;: &quot;...&quot;,
 &quot;text/html&quot;: &quot;...&quot;,
 }
}
</code></pre>

<p>This is POSTed to a configured HTTP endpoint&mdash;which in this case, is
navani.</p>

<h2 id="navani">navani</h2>

<p><a href="https://git.icyphox.sh/forlater/navani" rel="nofollow">navani</a> is forlater&rsquo;s primary
mail processing service<sup class="footnote-ref" id="fnref:1"><a href="#fn:1">1</a></sup>. Listens for webhooks from mdawh, processes
them, and sends mail using a configured SMTP server. URLs are cached
|
|||
|
|
</entry>
|
|||
|
|
<entry>
|
|||
|
|
<title>Launching forlater.email</title>
|
|||
|
|
<updated>2021-09-17T00:00:00Z</updated>
|
|||
|
|
<id>tag:icyphox.sh/,2021-09-17:blog/forlater</id>
|
|||
|
|
<link href="https://icyphox.sh/blog/forlater"></link>
|
|||
|
|
<summary type="html"><h2>An email-based bookmarking service</h2>
<p>This is a shill post. I&rsquo;m launching my new side-project:
<a href="https://forlater.email" rel="nofollow">https://forlater.email</a>. It&rsquo;s an email-based bookmarking service&mdash;you
send an email to <code>save@forlater.email</code>, get a readable, clutter-free
version of it back.</p>

<p>I&rsquo;ll write a more technical post on how I built it; this weekend
perhaps. Until then, go try it!</p>
</summary>
|
|||
|
|
</entry>
|
|||
|
|
<entry>
|
|||
|
|
<title>I can't take Formula E seriously</title>
|
|||
|
|
<updated>2021-08-16T00:00:00Z</updated>
|
|||
|
|
<id>tag:icyphox.sh/,2021-08-16:blog/formula-e</id>
|
|||
|
|
<link href="https://icyphox.sh/blog/formula-e"></link>
|
|||
|
|
<summary type="html"><h2>Toy cars racing in parking lots</h2>
<p>For those unaware, <a href="https://en.wikipedia.org/wiki/Formula_E" rel="nofollow">Formula E</a>,
or rather, the ABB FIA Formula E World Championship<sup class="footnote-ref" id="fnref:1"><a href="#fn:1">1</a></sup> is the only
fully electric open-wheel racing sanctioned by the FIA. The first season
was in 2014 - 2015. 7 years later, it&rsquo;s just as bad as before.</p>

<p>Formula E was supposed to be this new, revolutionary motorsport set to
eventually replace Formula 1&mdash;or at the very least, compete alongside.
It was supposed to be where teams could experiment; build better, more
eco-friendly tech that can eventually find its way into road cars.
Except&hellip;the FIA made it a spec series.</p>

<p>This means all cars are basically identical&mdash;conforming to a
predefined spec. While there&rsquo;s nothing wrong with spec series racing&mdash;Formula 2, IndyCar, etc. are still incredibly exciting&mdash;it&rsquo;s just not
something you want in something like Formula E, where technical
development is key. Further, the whole emphasis on &ldquo;road relevancy&rdquo; is
kind of a meme when there&rsquo;s no engineering freedom given to
constructors.</p>

<p>No bother, at least the racing should be fun, right? They travel to cool
cities and race on streets! Yeah&hellip;not really. Thing is, FE cars are
slow. And to compensate this, they made tracks really narrow, with
stupidly high barriers. There&rsquo;s no point in going to cool cities when
you can&rsquo;t really see much of it. All tracks look the same: utterly
soulless.</p>

<p>And it doesn&rsquo;t end there. Formula E is gimmicky as hell. Like F1&rsquo;s
DRS<sup class="footnote-ref" id="fnref:2"><a href="#fn:2">2</a></sup>, FE&rsquo;s got &ldquo;Attack mode&rdquo;. Essentially, drivers recieve extra
power by driving through a part of the track that&rsquo;s off the racing line.
This is like, some NFS tier shit. But OK, I&rsquo;ll give it a pass&mdash;it&rsquo;s
cringe, but it does allow for some good overtaking.</p>

<p>&ldquo;Fanboost&rdquo;, however&hellip;Hoo boy. Basically, fans get to vote for their
favourite drivers via social media, and the five drivers that win the
vote each recieve extra power during the race. Yup. You read that right.
They made a World Championship racing series a social media popularity
contest.</p>

<p><img src="https://cdn.icyphox.sh/VOodw.png" alt="formula e broadcast" /></p>

<p>My last gripe is with the broadcast. It&rsquo;s so bad! They really should
lose the gamer graphics. The driver list on the left is not color coded
making it really hard to read. You have no idea who&rsquo;s who if you&rsquo;re new.
And try and make the circuits look a little more interesting! I honestly
couldn&rsquo;t tell you the difference between, say, the London and Berlin
circuits.</p>

<p>All things said, I will still watch Formula E&mdash;at least, the
highlights. Watching bumper cars is somewhat fun when there&rsquo;s no F1
going on.</p>

<div class="footnotes">

<hr />

<ol>
<li id="fn:1"><p>Which just ended, as of August 2021. It was also the first World
Championship; the ones before weren&rsquo;t.</p> <a class="footnote-return" href="#fnref:1"><span aria-label='Return'>↩︎</span></a></li>

<li id="fn:2"><a href="https://en.wikiped
|
|||
|
|
</entry>
|
|||
|
|
<entry>
|
|||
|
|
<title>Writing a shell prompt in Go</title>
|
|||
|
|
<updated>2021-08-12T00:00:00Z</updated>
|
|||
|
|
<id>tag:icyphox.sh/,2021-08-12:blog/go-shell-prompt</id>
|
|||
|
|
<link href="https://icyphox.sh/blog/go-shell-prompt"></link>
|
|||
|
|
<summary type="html"><h2>Kinda faster than bash</h2>
<p>For context, my bash prompt was previously <a href="https://git.icyphox.sh/dotfiles/tree/bash/.bashrc.d/99-prompt.bash?id=d7b391845abc7e97f2b1b96c34b4b1789b2ab541" rel="nofollow">written in, well,
bash</a>.
It used to call out to <code>git</code> for getting the branch and worktree status
info. Parsing the output of <code>git status</code> and all that. It was ok, but I
wanted something &hellip; cleaner.</p>

<p>I chose Go, despite having written
<a href="https://github.com/icyphox/nicy" rel="nofollow">nicy</a> in Nim<sup class="footnote-ref" id="fnref:1"><a href="#fn:1">1</a></sup>; I&rsquo;m in a Go-phase right
now, just like I was in a Nim-phase back in 2018. Anyway, let&rsquo;s cut to
the chase.</p>

<h2 id="the-basics">the basics</h2>

<p>The current working directory is the bare minimum in a prompt. I prefer
having it shortened; for example: <code>/home/icy/docs/books/foo.epub</code> →
<code>~/d/b/foo.epub</code>. Let&rsquo;s write a function <code>trimPath</code> to do this for us:</p>

<pre><code class="language-go">// Truncates the current working directory:
// /home/icy/foo/bar -&gt; ~/f/bar
func trimPath(cwd, home string) string {
	var path string
	if strings.HasPrefix(cwd, home) {
		path = &quot;~&quot; + strings.TrimPrefix(cwd, home)
	} else {
		// If path doesn't contain $HOME, return the
		// entire path as is.
		path = cwd
		return path
	}
	items := strings.Split(path, &quot;/&quot;)
	truncItems := []string{}
	for i, item := range items {
		if i == (len(items) - 1) {
			truncItems = append(truncItems, item)
			break
		}
		truncItems = append(truncItems, item[:1])
	}
	return filepath.Join(truncItems...)
}
</code></pre>

<p><code>trimPath</code> takes two args: the current working directory <code>cwd</code>, and the
home directory <code>home</code>. We first check if <code>cwd</code> starts with <code>home</code>, i.e.
we&rsquo;re in a subdirectory of <code>home</code>; if yes, trim <code>home</code> from <code>cwd</code>, and
replace it with a tilde <code>~</code>. We now have <code>~/docs/books/foo.epub</code>.</p>

<p>Also note that we return the path as-is if we&rsquo;re not in a subdir of
<code>home</code>&mdash;i.e. paths under <code>/</code>, like <code>/usr</code>, etc. I like to see these
completely, just to be sure.</p>

<p>We then split the path at <code>/</code><sup class="footnote-ref" id="fnref:2"><a href="#fn:2">2</a></sup>, and truncate each item in the
resulting list&mdash;except for the last&mdash;down to the first character.
Join it all together and return the resulting string&mdash;we have
<code>~/d/b/foo.epub</code>.</p>

<p>Next up: color.</p>

<pre><code class="language-go">var (
	red = color(&quot;\033[31m%s\033[0m&quot;)
	green = color(&quot;\033[32m%s\033[0m&quot;)
	cyan = color(&quot;\033[36m%s\033[0m&quot;)
)

func color(s string) func(...interface{}) string {
	return func(args ...interface{}) string {
		return fmt.Sprintf(s, fmt.Sprint(args...))
	}
}
<
|
|||
|
|
</entry>
|
|||
|
|
<entry>
|
|||
|
|
<title>Make cgit go gettable</title>
|
|||
|
|
<updated>2021-07-14T00:00:00Z</updated>
|
|||
|
|
<id>tag:icyphox.sh/,2021-07-14:blog/go-get-cgit</id>
|
|||
|
|
<link href="https://icyphox.sh/blog/go-get-cgit"></link>
|
|||
|
|
<summary type="html"><h2>go get git.icyphox.sh/* works!</h2>
<p><code>go get</code> requires the presence of the <code>go-import</code> meta tag<sup class="footnote-ref" id="fnref:1"><a href="#fn:1">1</a></sup> on the
repository&rsquo;s web page. cgit doesn&rsquo;t support it out of the box; instead,
we can make nginx inject it into every page. Enter: <code>sub_filter</code>.<sup class="footnote-ref" id="fnref:2"><a href="#fn:2">2</a></sup></p>

<p><code>sub_filter</code> is a function that simply performs a string replace. For
example:</p>

<pre><code class="language-nginx">location / {
 sub_filter '&lt;img src=dog.png&gt;' '&lt;img src=cat.png&gt;';
 sub_filter_once on;
}
</code></pre>

<p>In our case, we want to have the meta tag injected inside <code>&lt;head&gt;</code>.</p>

<pre><code class="language-nginx">server {
 listen 443 ssl;
 server_name git.icyphox.sh;

 location / {
 ...

 sub_filter '&lt;/head&gt;'
 '&lt;meta name=&quot;go-import&quot; content=&quot;$host$uri git https://$host$uri&quot;&gt;&lt;/head&gt;';
 sub_filter_once on;
 }
}
</code></pre>

<p>The closing <code>&lt;/head&gt;</code> tag gets replaced&mdash;injecting the meta tag inside
<code>&lt;head&gt;</code>. This can also be extended to add the <code>go-source</code> meta tag as
well.</p>

<div class="footnotes">

<hr />

<ol>
<li id="fn:1"><a href="https://godocs.io/cmd/go#hdr-Remote_import_paths" rel="nofollow">https://godocs.io/cmd/go#hdr-Remote_import_paths</a> <a class="footnote-return" href="#fnref:1"><span aria-label='Return'>↩︎</span></a></li>

<li id="fn:2"><a href="http://nginx.org/en/docs/http/ngx_http_sub_module.html" rel="nofollow">http://nginx.org/en/docs/http/ngx_http_sub_module.html</a> <a class="footnote-return" href="#fnref:2"><span aria-label='Return'>↩︎</span></a></li>
</ol>

</div>
</summary>
|
|||
|
|
</entry>
|
|||
|
|
<entry>
|
|||
|
|
<title>Setting up a multi-arch Kubernetes cluster at home</title>
|
|||
|
|
<updated>2021-06-19T00:00:00Z</updated>
|
|||
|
|
<id>tag:icyphox.sh/,2021-06-19:blog/k8s-at-home</id>
|
|||
|
|
<link href="https://icyphox.sh/blog/k8s-at-home"></link>
|
|||
|
|
<summary type="html"><h2>My self-hosted infra, given the cloud native™ treatment</h2>
<p><strong>Update 2021&ndash;07&ndash;11</strong>: It was fun while it lasted. I took down the
cluster today and probably won&rsquo;t go back to using it. It was way too
much maintenance, and Kubernetes really struggles with just 1GB of RAM
on a node. Constant outages, volumes getting corrupted (had to <code>fsck</code>),
etc. Not worth the headache.</p>

<p>I still remember my
<a href="https://lobste.rs/s/kqucr4/unironically_using_kubernetes_for_my#c_kfldyw" rel="nofollow">Lobste.rs</a>
comment, mocking some guy for running Kubernetes for his static blog&mdash;it <em>is</em> my highest voted comment after all. But to be fair, I&rsquo;m not
running mine for a static blog. In fact, I&rsquo;m not even hosting my blog on
the cluster; but I digress. Why did I do this anyway? Simply put: I was
bored. I had a 4 day weekend at work and with nothing better to do to
other than play Valorant, and risk losing my hard earned Bronze 2&mdash;I
decided to setup a K8s cluster. These are the nodes in use:</p>

<ul>
<li><code>fern</code>: Raspberry Pi 4B (armhf, 4GB, 4 cores)</li>
<li><code>jade</code>: Oracle VM (amd64, 1GB, 1 core)</li>
<li><code>leaf</code>: Oracle VM (amd64, 1GB, 1 core)</li>
</ul>

<p>The Oracle machines are the free tier ones. It&rsquo;s great&mdash;two static
public IPs, 50 gigs of boot volume storage on each + up to 100 gigs of
block volume storage. All for free.<sup class="footnote-ref" id="fnref:1"><a href="#fn:1">1</a></sup> Great for messing around.</p>

<p>Since my RPi is behind a CG-NAT, I&rsquo;m running a Wireguard mesh that looks
something like this:</p>

<p><img src="https://cdn.icyphox.sh/1Xkvh.png" alt="wireguard mesh" /></p>

<p>Wireguard is fairly trivial to set up, and there are tons of guides
online, so I&rsquo;ll skip that bit.</p>

<h2 id="setting-up-the-cluster">setting up the cluster</h2>

<p>I went with plain containerd as the CRI. Built v1.5.7 from source on all
nodes.</p>

<p>I considered running K3s, because it&rsquo;s supposedly &ldquo;lightweight&rdquo;. Except
it&rsquo;s not really vanilla Kubernetes&mdash;it&rsquo;s more of a distribution. It
ships with a bunch of things that I don&rsquo;t really want to use, like
Traefik as the default ingress controller, etc. I know components can be
disabled, but I couldn&rsquo;t be arsed. So, <code>kubeadm</code> it is.</p>

<pre><code>kubeadm init --pod-network-cidr=10.244.0.0/16 --apiserver-advertise-address=192.168.4.2
</code></pre>

<p>Since I&rsquo;m going to be using Flannel as the CNI provider, I set the pod
network CIDR to Flannel&rsquo;s default. We also want the Kube API server to
listen on the Wireguard interface IP, so specify that as well.</p>

<p>Now, the <code>kubelet</code> needs to be configured to use the Wireguard IP, along
with the correct <code>resolv.conf</code> on Ubuntu hosts (managed by
<code>systemd-resolvd</code>)<sup class="footnote-ref" id="fnref:2"><a href="#fn:2">2</a></sup>. This can be set via the <code>KUBELET_EXTRA_ARGS</code>
environment variable, in <code>/etc/default/kubelet</code>, for each node:</p>

<pre><code class="language-shell"># /etc/default/kubelet

KUBELET_EXTRA_ARGS=--node
|
|||
|
|
</entry>
|
|||
|
|
<entry>
|
|||
|
|
<title>Status update</title>
|
|||
|
|
<updated>2021-05-10T00:00:00Z</updated>
|
|||
|
|
<id>tag:icyphox.sh/,2021-05-10:blog/2021-05-10</id>
|
|||
|
|
<link href="https://icyphox.sh/blog/2021-05-10"></link>
|
|||
|
|
<summary type="html"><h2>A review of Q1 2021</h2>
<p>I realize I haven&rsquo;t done one of these in a while, a few &hellip;
status-update-worthy things have piled up. Bangalore is currently in a
lockdown after ranking in the top 3 worst COVID-hit cities, in India. As
such, I&rsquo;m sitting at home, in my home-office thing which now has an
extra monitor, writing this. We&rsquo;ve got a lot to talk about&mdash;let&rsquo;s get
to it!</p>

<h2 id="working-at-deepsource">working at DeepSource</h2>

<p>Starting January of this year, I&rsquo;ve been working as a Site Reliability
Engineer at <a href="https://deepsource.io" rel="nofollow">DeepSource</a>. As a Kubernetes shop,
nearly all of my day to day work involves working with Kubernetes. I
didn&rsquo;t think I&rsquo;d say this, but I actually quite like using K8s now. The
more I understand it, the more I find myself appreciating the need for
it. Of course, I wasn&rsquo;t around for the initial setup of everything&mdash;I&rsquo;m merely enjoying using an already stable cluster environment.</p>

<p>So far, I&rsquo;ve set up an event-driven observability pipeline (pictured
below), some infosec work and the usual SRE stuff. I&rsquo;ll probably write
about the observability infrastructure in detail sometime&mdash;perhaps on
the company blog.</p>

<p><img src="https://cdn.icyphox.sh/vgPL9.png" alt="deepsource observability infra" /></p>

<p>I even managed to break prod within the first month! But in all
seriousness, it&rsquo;s pretty riveting work, with some very fun people.</p>

<h2 id="projects">projects</h2>

<p>There haven&rsquo;t been too many, I must be honest. I did briefly consider
the idea of building a small SaaS&mdash;a simple email-based bookmarking
service. Send a bunch of links you want to bookmark to an email address,
and get back the entire webpage as a thread of emails.</p>

<p>I got as far as writing the backend for it, at
<a href="https://git.icyphox.sh/forlater/donkey" rel="nofollow">forlater/donkey</a>&mdash;a simple
Flask app that pulls web pages and sends an email, on a webhook. And a
helper tool <a href="https://git.icyphox.sh/forlater/mdawh" rel="nofollow">forlater/mdawh</a> in
Go that takes mail in STDIN and sends a webhook to an endpoint. I used
OpenSMTPD to call <code>mdawh</code> when mail arrived. Overall, a pretty simple
system. Except, HTML email sucks. And the modern web sucks. I quickly
got bored of it&mdash;dealing with websites not getting rendered correctly,
email delivery being pretty shit overall and the fact that nobody would
actually use something like this, let alone pay for it. Of course, I
could be wrong and someone looking for a service like this could be out
there&mdash;and if they&rsquo;re reading this, please <a href="mailto:x@icyphox.sh" rel="nofollow">email
me</a>!</p>

<p>That said, I&rsquo;m open to revisiting this project sometime. Perhaps with a
different use-case, even.</p>

<h2 id="reading">reading</h2>

<p>In 2020, I began getting into the
<a href="https://coppermind.net/wiki/Cosmere" rel="nofollow">Cosmere</a>. I&rsquo;ve read nearly all the
books in it, save for the <em>Mistborn</em> series, which I&rsquo;m reading at
present. Still in Era 1, having finished <em>The Final Empire</em> and <em>The
Well of Ascension</em>. I&rsquo;m taking a break before I dive into <em>The Hero of
Ages</em>.</p>&#x
|
|||
|
|
</entry>
|
|||
|
|
<entry>
|
|||
|
|
<title>Free software should not censor</title>
|
|||
|
|
<updated>2021-04-07T00:00:00Z</updated>
|
|||
|
|
<id>tag:icyphox.sh/,2021-04-07:blog/free-sw-censor</id>
|
|||
|
|
<link href="https://icyphox.sh/blog/free-sw-censor"></link>
|
|||
|
|
<summary type="html"><h2>If you write free software, don't deny freedom zero</h2>
<p>Any software is free, if it grants the users the four essential
freedoms:</p>

<ul>
<li><strong>freedom 0</strong>: The freedom to run the program as you wish, for any
purpose.</li>
<li><strong>freedom 1</strong>: The freedom to study how the program works, and change
it so it does your computing as you wish</li>
<li><strong>freedom 2</strong>: The freedom to redistribute copies so you can help
others.</li>
<li><strong>freedom 3</strong>: The freedom to distribute copies of your modified
versions to others.</li>
</ul>

<p>Denying any one of these freedoms makes your software nonfree. As it
happens, some free software project maintainers think it&rsquo;s OK to impose
their political / ideological stances on who can use their software, and
for what purpose it can be used. They are violating the zeroth freedom
to advance their political agendas. Here are a couple of examples.</p>

<h2 id="case-one-tusky">case one: Tusky</h2>

<p>Tusky is a free software (GPL 3.0) Android client for the fediverse&mdash;thematically, Mastodon. They <a href="https://github.com/tuskyapp/Tusky/pull/1303" rel="nofollow">Rick Roll users who try to connect to
instances</a> they disagree
with. You don&rsquo;t get to decide for your users! And the irony here is its
a client for a supposedly censorship-resistant network. This is in
violation of freedom zero.</p>

<p>Funnily enough, Tusky recently got <a href="https://chaos.social/@ConnyDuck/105904002285019275" rel="nofollow">removed from the Play
Store</a> for serving
&ldquo;objectionable content&rdquo;.</p>

<blockquote>
<p>They don&rsquo;t seem to understand that one can view any content with Tusky
and that it is not possible for the app developers to check any of it.
-- <a href="https://chaos.social/@ConnyDuck/105904015276457450" rel="nofollow">https://chaos.social/@ConnyDuck/105904015276457450</a></p>
</blockquote>

<p>A blatant lie! Doesn&rsquo;t feel good when someone else decides things for
you, now, does it?</p>

<h2 id="case-two-lemmy">case two: Lemmy</h2>

<p>Also a fediverse application&mdash;a federated Reddit clone (AGPL 3.0).
They have a <a href="https://github.com/LemmyNet/lemmy/issues/622" rel="nofollow">hardcoded slur
filter</a> that they refuse
to remove, or at the very least, make configurable. This is just plain
bad engineering for the sake of politics.</p>

<p>Both of these software are released under free software licenses, and
are clearly nonfree. Stop doing this&mdash;it benefits nobody. You probably
feel like you&rsquo;re &ldquo;making a change&rdquo;, but guess what: you&rsquo;re not. It is
mere virtue signalling. Don&rsquo;t enforce your political agendas on your
users.</p>

<p>Censorship is bad for everyone, and it usually never ends well. There
is no &ldquo;correct&rdquo; way to censor&mdash;so don&rsquo;t even try! If you don&rsquo;t want
your software to be &ldquo;misused&rdquo;, release it under a license that is
capable of enforcing that.<sup class="footnote-ref" id="fnref:1"><a href="#fn:1">1</a></sup></p>

<div class="footnotes">

<hr />

<ol>
<li id="fn:1">Protip: you can&rsquo;t. Ethical source licenses exist, but they&rsquo;re practically dead in the w
|
|||
|
|
</entry>
|
|||
|
|
<entry>
|
|||
|
|
<title>Configuring Neovim using Lua</title>
|
|||
|
|
<updated>2021-02-07T00:00:00Z</updated>
|
|||
|
|
<id>tag:icyphox.sh/,2021-02-07:blog/nvim-lua</id>
|
|||
|
|
<link href="https://icyphox.sh/blog/nvim-lua"></link>
|
|||
|
|
<summary type="html"><h2>And switching from init.vim to init.lua</h2>
<p>If you, like me, never really understood Vimscript and hate the language
with a passion, you&rsquo;re in the right place! You can now get rid of
Vimscript wholesale and replace it with a simpler, faster and elegant-er
language&mdash;Lua! <em>However</em>, this is only possible from Neovim 0.5
onwards<sup class="footnote-ref" id="fnref:1"><a href="#fn:1">1</a></sup> and as of now, requires you to install Neovim from HEAD. How
to do that is left as an exercise to the reader. Also bear in mind that
the Lua API is fairly beta right now, and many Vim things don&rsquo;t have
direct interfaces.</p>

<p>So assuming you&rsquo;re now running Neovim <code>master</code>, head over to
<code>~/.config/nvim</code> and create your <code>init.lua</code>. Why, yes, we&rsquo;re porting
over your <code>init.vim</code> to <code>init.lua</code> right now! Clear your calendar for
the next few hours&mdash;bikeshedding your text editor is top priority!</p>

<p>I also recommend going through
<a href="https://github.com/nanotee/nvim-lua-guide" rel="nofollow">nanotee/nvim-lua-guide</a>
and <a href="https://learnxinyminutes.com/docs/lua/" rel="nofollow">Learn Lua in Y minutes</a>
before starting off.</p>

<h2 id="the-directory-structure">the directory structure</h2>

<p>Lua files are typically under <code>~/.config/nvim/lua</code>, and can be loaded as
Lua modules. This is incredibly powerful&mdash;you can structure your
configs however you like.</p>

<pre><code class="language-console">$ tree .config/nvim
.
|-- ftplugin
| `-- ...
|-- init.lua
|-- lua
| |-- maps.lua
| |-- settings.lua
| |-- statusline.lua
| `-- utils.lua
`-- plugin
 `-- ...
</code></pre>

<p>The common approach is to have different
bits of your config in Lua files under <code>lua/</code> and <code>require</code>&rsquo;d in your
<code>init.lua</code>, so something like:</p>

<pre><code class="language-lua">-- init.lua

require('settings') -- lua/settings.lua
require('maps') -- lua/maps.lua
require('statusline') -- lua/statusline.lua
</code></pre>

<h2 id="the-basics-setting-options">the basics: setting options</h2>

<p>Vim has 3 kinds of options&mdash;global, buffer-local and window-local. In
Vimscript, you&rsquo;d just <code>set</code> these. In Lua, however, you will have to
use one of</p>

<ul>
<li><code>vim.api.nvim_set_option()</code>&mdash;global options</li>
<li><code>vim.api.nvim_buf_set_option()</code>&mdash;buffer-local options</li>
<li><code>vim.api.nvim_win_set_option()</code>&mdash;window-local options</li>
</ul>

<p>These are fairly verbose and very clunky, but fortunately for us, we
have &ldquo;meta-accesors&rdquo; for these: <code>vim.{o,wo,bo}</code>. Here&rsquo;s an excerpt from
my <code>settings.lua</code> as an example:</p>

<pre><code class="language-lua">local o = vim.o
local wo = vim.wo
local bo = vim.bo

-- global options
o.swapfile = true
o.dir = '/tmp'
o.smartcase = true
o.laststatus = 2
o.hlsearch = true
o.incsearch = true
o.ignorecase = true
o.scrolloff = 12
-- ... snip ... 

-- window-lo
|
|||
|
|
</entry>
|
|||
|
|
<entry>
|
|||
|
|
<title>We can do better than Signal</title>
|
|||
|
|
<updated>2021-01-17T00:00:00Z</updated>
|
|||
|
|
<id>tag:icyphox.sh/,2021-01-17:blog/signal</id>
|
|||
|
|
<link href="https://icyphox.sh/blog/signal"></link>
|
|||
|
|
<summary type="html"><h2>Centralized silos are never the solution</h2>
<p>Signal is possibly the most recommended pro-privacy instant
communication app&mdash;one that was commonplace in the hacker community,
and has now gained a lot of mainstream traction, thanks to WhatsApp
deciding to screw its userbase over. It certainly presents a more
compelling alternative than others in the same space, like WhatsApp
itself, Telegram, etc. They engineered the <a href="https://en.wikipedia.org/wiki/Signal_Protocol" rel="nofollow">Signal
Protocol</a>, which has
found its way into other messaging systems, and has been the base for
the likes of OMEMO and Matrix.<sup class="footnote-ref" id="fnref:1"><a href="#fn:1">1</a></sup> While I admire the tech behind
Signal, I still believe we can do better, and we ought to.</p>

<p>I have a few gripes with Signal&mdash;the biggest of them all is it&rsquo;s
centralized, and in the US no less. This alone makes it not that
different from WhatsApp&mdash;we&rsquo;re simply moving from one silo to another.
What&rsquo;s to say that Signal will uphold its values, continue operating
<em>and</em> evade censorship and potential compromise? To top it off, they&rsquo;re
becoming a fairly high value target off late. And if that isn&rsquo;t
convincing enough, Signal&rsquo;s massive outage lasting nearly a day<sup class="footnote-ref" id="fnref:2"><a href="#fn:2">2</a></sup>
should be enough evidence against centralization. Further, Signal is
known to use AWS<sup class="footnote-ref" id="fnref:3"><a href="#fn:3">3</a></sup> as their cloud provider&mdash;what if another
Parler<sup class="footnote-ref" id="fnref:4"><a href="#fn:4">4</a></sup> happens and the rug is pulled from under Signal&rsquo;s feet?</p>

<p>A common defense in favor of Signal is, &ldquo;But it&rsquo;s all open source!&rdquo;.
Sure is, but on what basis do I trust them? I don&rsquo;t mean to sound
conspiratorial, but what&rsquo;s to say that the server in production hasn&rsquo;t
been backdoored? In fact, the <a href="https://github.com/signalapp/Signal-Server" rel="nofollow">Signal server
code</a> hasn&rsquo;t even been
updated since April 2020. You&rsquo;re telling me it&rsquo;s undergone <em>no</em> changes?</p>

<p>Another response I usually see is &ldquo;But Signal is all we have!&rdquo;. While
that is somewhat true&mdash;at least by the metric of &ldquo;secure messengers
your granny can use&rdquo;, there are some promising alternatives who are
especially focused on decentralizing E2EE communications.</p>

<ol>
<li><a href="https://matrix.org" rel="nofollow">Matrix</a>: Matrix has improved a whole lot, and I
like that they&rsquo;re working to disprove that end-to-end encryption
cannot be decentralized<sup class="footnote-ref" id="fnref:5"><a href="#fn:5">5</a></sup>.</li>
<li><a href="https://getsession.org" rel="nofollow">Session</a>: While it involves some cryptoshit,
and hasn&rsquo;t been verified yet, it&rsquo;s an interesting alternative to keep
an eye out for.</li>
</ol>

<p>All things said, Signal is the shiniest turd we have&mdash;it fits most
threat models, and does the job alright; I will continue to use it.
However, here&rsquo;s something to think about: while privacy preserving tech
is commendable, does it have to come at the cost of user freedoms? Hin
|
|||
|
|
</entry>
|
|||
|
|
<entry>
|
|||
|
|
<title>What's next after WhatsApp?</title>
|
|||
|
|
<updated>2021-01-08T00:00:00Z</updated>
|
|||
|
|
<id>tag:icyphox.sh/,2021-01-08:blog/whatsapp</id>
|
|||
|
|
<link href="https://icyphox.sh/blog/whatsapp"></link>
|
|||
|
|
<summary type="html"><h2>Let's not act surprised here, this was bound to happen</h2>
<p><strong>Update 2021&ndash;01&ndash;17</strong>: I&rsquo;m now using Signal. It&rsquo;s fine for now, but <a href="/blog/signal">we
can do better</a>.</p>

<p>Ever since Facebook acquired WhatsApp for $19bn, it was blatantly
obvious that they wanted in on the massive userbase, and consequently,
the data they could collect. The acquisition wasn&rsquo;t all too bad at
first, I&rsquo;ll admit&mdash;they added in full E2EE via the Signal Protocol,
their privacy policy wasn&rsquo;t <em>all too bad</em>, at least for a Facebook
product. While I obviously didn&rsquo;t enjoy using it&mdash;being the only
non-free app on my phone&mdash;I could still put up with it, considering
how ubiquitous it is here in India.</p>

<p>That will no longer be the case, however. With the new <a href="https://www.whatsapp.com/legal/privacy-policy" rel="nofollow">privacy
policy</a> introduced by
WhatsApp, the below data will be collected and shared with Facebook and
its associated companies (quoting from the privacy policy):</p>

<blockquote>
<ul>
<li>Account Information. Your phone number, profile name and photo, online
status and status message, last seen status, and receipts may be
available to anyone who uses our Services, although you can configure
your Services settings to manage certain information available to
other users.</li>
<li>Your Contacts and Others. Users with whom you communicate may store or
reshare your information (including your phone number or messages) with
others on and off our Services. You can use your Services settings and
the block feature in our Services to manage the users of our Services
with whom you communicate and certain information you share.</li>
</ul>
</blockquote>

<p>And if you don&rsquo;t consent to these&mdash;i.e., you don&rsquo;t click on &ldquo;Agree&rdquo; on
the pop-up about the new terms, you can no longer use WhatsApp.
Naturally, I didn&rsquo;t.</p>

<p>Now, it&rsquo;s fairly common knowledge that the entirety of India revolves
around WhatsApp. <em>Everything</em> happens over WhatsApp. Invoices, shopping,
general logistics and operations, and in my case&mdash;university
communications. I&rsquo;d even declare WhatsApp as &ldquo;critical infrastructure&rdquo;,
like power and water; without which the country cannot function. That&rsquo;s
a scary thought in itself&mdash;imagine an entire nation relying on
Facebook for something so pivotal.</p>

<p>So what are my options? I can either switch to a new messaging app, or
ditch instant messaging altogether. Let&rsquo;s explore these.</p>

<p>There are some neat potential alternatives to WhatsApp, the most popular
one being Signal. While I think Signal is technically sound, I&rsquo;m
skeptical about using it primarily due to its centralized nature, hosted
in the US. Moxie is openly against federation/decentralization.<sup class="footnote-ref" id="fnref:1"><a href="#fn:1">1</a></sup></p>

<p>And then there&rsquo;s <a href="https://getsession.org" rel="nofollow">Session</a>, a fork of Signal
that aims to be completely decentralized. It uses <a href="https://en.wikipedia.org/wiki/Onion_routing" rel="nofollow">onion
routing</a>, similar to Tor.
It <em>does</em> involve some blockshit, but the actual messaging is all done
over onion routing (they call it &ldquo;onion requests&rdquo;). From
|
|||
|
|
</entry>
|
|||
|
|
<entry>
|
|||
|
|
<title>2020 in review</title>
|
|||
|
|
<updated>2020-12-24T00:00:00Z</updated>
|
|||
|
|
<id>tag:icyphox.sh/,2020-12-24:blog/2020-in-review</id>
|
|||
|
|
<link href="https://icyphox.sh/blog/2020-in-review"></link>
|
|||
|
|
<summary type="html"><h2>Oh boy, here we go</h2>
<p>It&rsquo;s been a little over 9 months since the day I left my university
dorms (got kicked out, rather), in light of <span class="lol">the
pandemic</span>. I have my finals going on right now, and 5 days to go
for the next examination&mdash;a great time to reflect on what I managed to
do this year. So here I am, sitting at my little home office-thing, with
a bad cold&mdash;as is tradition during December&mdash;writing this post.
Let&rsquo;s get to it!</p>

<h2 id="interning-at-cometchat">interning at CometChat</h2>

<p>I spent a good part of this year interning at
<a href="https://www.cometchat.com" rel="nofollow">CometChat</a>, mostly working as an
infrastructure engineer. I dabbled with some pretty neat tech&mdash;here&rsquo;s
a quick list of things I worked on:</p>

<ul>
<li>XMPP over WebSockets (RFC 7395). Also wrote
<a href="https://git.icyphox.sh/wsabi" rel="nofollow">wsabi</a>&mdash;a WebSocket proxy in Nim.
Never got used, but cool nonetheless.</li>
<li>On-premise (bare metal) deployment of our stack using Docker Swarm.</li>
<li>Google Kubernetes Engine (GKE) deployment of our stack.</li>
</ul>

<p>I think there&rsquo;s value in adding that I experienced a paradigm shift in
my view of tools like Kubernetes. I still think they&rsquo;re bloated and
abstraction heavy, but they exist to solve a problem&mdash;and they do it
somewhat okay. In an ideal world, nobody would fall for the &ldquo;cloud&rdquo;
meme, and wouldn&rsquo;t toss everything into a container<sup class="footnote-ref" id="fnref:docker-meme"><a href="#fn:docker-meme">1</a></sup>&mdash;but
our world is far from that.</p>

<h2 id="things-i-made">things I made</h2>

<ul>
<li><a href="https://git.icyphox.sh/shlide" rel="nofollow">shlide</a>: A slide deck presentation
tool written in pure bash. Born from a conversation I had with a
friend&mdash;quickly hacked it together over a weekend. Even used it
for a talk I presented!</li>
<li><a href="https://git.icyphox.sh/vite" rel="nofollow">vite</a>: Go rewrite of the static site
generator I wrote in Python, way back in 2018. It was a misnomer,
since it was far from <em>vite</em>.</li>
</ul>

<h2 id="other-hackery">other hackery</h2>

<p>Self-hosted a <em>bunch</em> of services on my Pi. The only downtime is when my
ISP goes down, which is thankfully not <em>that</em> often. Here&rsquo;s a list of
things running on my Pi right now:</p>

<ul>
<li><a href="https://radicale.org" rel="nofollow">radicale</a>: Cal/CardDAV server</li>
<li><a href="https://pleroma.social" rel="nofollow">Pleroma</a>: Single-user federated social media
instance</li>
<li><a href="https://cdn.icyphox.sh" rel="nofollow">filehost</a></li>
<li><a href="https://github.com/sentriz/gonic" rel="nofollow">gonic</a>: Music streaming server</li>
<li><a href="http://deavmi.assigned.network/docs/crxn/site/" rel="nofollow">crxn</a>: Cool network
of cool people.</li>
<li>Few other things that <a href="https://peppe.rs" rel="nofollow">Nerdy</a> uses.</li>
</ul>

<p>My OpenBSD install is still going strong! Started at 6.6, now on
6.
|
|||
|
|
</entry>
|
|||
|
|
<entry>
|
|||
|
|
<title>My music streaming setup</title>
|
|||
|
|
<updated>2020-12-13T00:00:00Z</updated>
|
|||
|
|
<id>tag:icyphox.sh/,2020-12-13:blog/music-streaming</id>
|
|||
|
|
<link href="https://icyphox.sh/blog/music-streaming"></link>
|
|||
|
|
<summary type="html"><h2>Think Spotify, but self-hosted and not as good</h2>
<p>Having a self-hosted, centralized music streaming setup has been on my
todo list for the longest time. I&rsquo;d initially tried using NFS, but
mounting it on my phone was very inconvenient. Incidentally, a few days
ago, the existence of Subsonic/*sonic became known to me.</p>

<h2 id="gonic">gonic</h2>

<p>I found <a href="https://github.com/sentriz/gonic" rel="nofollow">gonic</a> to be the simplest of
them all, and proceeded to set it up on the RPi. There are other
alternatives too, like <a href="https://www.navidrome.org" rel="nofollow">Navidrome</a>, which
ships with a web player, or <a href="https://airsonic.github.io/" rel="nofollow">Airsonic</a>.
gonic stood out the most to me because it&rsquo;s effectively headless,
barring a simple web interface for configuration.</p>

<p>Setting it up was trivial. I did run into an
<a href="https://github.com/sentriz/gonic/issues/89" rel="nofollow">issue</a>&mdash;I noticed that
only songs that were already in folders, sorted by album, were being
picked up in the scan.</p>

<pre><code>|-- Void Of Vision - Hyperdaze (2019)
| |-- 01. Overture.mp3
| |-- 02. Year of the Rat.mp3
| |-- 03. Babylon.mp3
| |-- 04. If Only.mp3
| |-- 05. Slave to the Name.mp3
| |-- 06. Adrenaline.mp3
| |-- 07. Hole In Me.mp3
| |-- 08. Kerosene Dream.mp3
| |-- 09. Decay.mp3
| |-- 10. Splinter.mp3
| |-- 11. Hyperdaze.mp3
|-- Volumes - Disaster Vehicle.mp3
|-- Volumes - Finite.mp3
|-- Volumes - Heavy Silence.mp3
|-- Volumes - Hope.mp3
|-- Volumes - Interlude.mp3
...

</code></pre>

<p>So, in a directory tree like above, only the tracks inside &ldquo;Void Of
Vision - Hyperdaze (2019)&rdquo; would get picked up, and all the &ldquo;Volumes&rdquo;
songs wouldn&rsquo;t&mdash;since it wasn&rsquo;t in a subfolder of its own.</p>

<p>As a workaround&mdash;and a necessary cleanup of my music&mdash;I figured I&rsquo;d
give <a href="https://beets.io" rel="nofollow">beets</a> a shot.</p>

<h2 id="beets">beets</h2>

<p>beets is extensively documented, so I&rsquo;ll skip the basics. In essence,
it&rsquo;s a music organization tool&mdash;fetches tags, sorts your collection,
etc. Most of my music has been tagged already, so I skipped that. I only
it all to be grouped by album. A bit of digging in the docs, and I found
what I wanted: <code>--group-albums</code>.</p>

<p>And in my <code>config.yaml</code>, I specified my desired path format like so:</p>

<pre><code class="language-yaml">...
paths:
 default: $albumartist - $album%aunique{}/$track $title
</code></pre>

<p>Finally, running:</p>

<pre><code>$ beet import --noautotag --move --group-albums path/to/dirty/music

$ tree ~/music
...

104 directories, 1108 files
</code></pre>

<p>Nice! gonic then happily scanned all my music.</p>

<h2 id="actually-streaming-this-music">actually streaming this music</h2>

<p>On my laptop, I decided to just use the NFS share approach&mdash;primarily because
I&rsquo;d like to stick to <code>cmus</code> and desktop Subsonic clients like <a href="https://gitlab.com/sublime-music/sublime-music" rel="nofollow">Sublime
Music</a> are very clunky.</p>

<p>On Android, there are qui
|
|||
|
|
</entry>
|
|||
|
|
<entry>
|
|||
|
|
<title>The Workman keyboard layout</title>
|
|||
|
|
<updated>2020-10-24T00:00:00Z</updated>
|
|||
|
|
<id>tag:icyphox.sh/,2020-10-24:blog/workman</id>
|
|||
|
|
<link href="https://icyphox.sh/blog/workman"></link>
|
|||
|
|
<summary type="html"><h2>I have a lot of free time on my hands (heh)</h2>
<p>I&rsquo;ve been at my computer everyday, for at least 10 hours at minimum.
These past ~6 - 7 months have been the most I&rsquo;ve ever used my computer.
Eventually, I started experiencing discomfort and pain&mdash;especially in
my pinkie finger. Typing became a chore, and I found myself using my
shell&rsquo;s command history more just to avoid typing commands. I tried
using a wrist rest, different keyboard heights, but nothing helped.</p>

<p>Thus began my search for a new keyboard layout, and it swiftly concluded
once I chanced upon the <a href="https://workmanlayout.org" rel="nofollow">Workman layout</a>.
According to the website, it is supposedly an improvement over Colemak
and Dvorak. I skimmed through the numbers and other stats, but
I honestly didn&rsquo;t care. &ldquo;Oh it&rsquo;s better than the popular alternative
layouts? Okay that&rsquo;s enough for me.&rdquo;</p>

<p><img src="https://raw.githubusercontent.com/kdeloach/workman/gh-pages/images/workman_layout.png" alt="workman layout" /></p>

<p>I downloaded the tarball containing the different config files for
different platforms etc. I just needed the <code>xmodmap</code>&mdash;that&rsquo;s the
easiest way to apply a keyboard layout.</p>

<pre><code class="language-console">$ xmodmap xmodmap.workman
</code></pre>

<p>To practice the layout, I used <a href="https://keybr.com" rel="nofollow">keybr.com</a>. You can
configure the keyboard layout via the settings. Naturally, the first few
days were incredibly painful. I was only able to type short sentences
with very small words. I tried to not engage in heated discussions on
IRC, for I could not type up a response in time. However, if I did
stumble into one, I would switch back to QWERTY just for those couple of
messages.</p>

<p>I found myself making the switch less and less, over the next few days.
Chatting on IRC is a <em>great</em> way to learn a layout. Or chatting
anywhere, really. It forces you to get accustomed to the layout by
typing the common words used in conversation. I also made a tiny change
to the layout&mdash;swapping the <kbd>F</kbd> and <kbd>B</kbd> keys, since
typing the &ldquo;fo&rdquo; / &ldquo;of&rdquo; digram in the same hand felt really weird. Soon
enough, I was averaging about 30 - 40 WPM within the first week of
having switched to Workman.</p>

<p>And then things at work started to pick up, and I had to do what I had
been dreading the most: edit code&mdash;in Vim. It&rsquo;s fairly common
knowledge that Vim, by default, extensively uses the <kbd>H</kbd>,
<kbd>J</kbd>, <kbd>K</kbd> and <kbd>L</kbd> keys for navigation. Sure,
there are better ways to move around and only using those keys is
frowned upon&mdash;but it&rsquo;s a habit built over years, and hard to shake
off. After poking around for a bit, I found the
<a href="https://github.com/nicwest/vim-workman" rel="nofollow">vim-workman</a> plugin. Forked it
to apply the <kbd>F</kbd>/<kbd>B</kbd> change, and I began using it.</p>

<p>It was great at first. My Vim muscle memory was not hampered, as I was
able to use QWERTY in normal mode, and Workman in insert. But as I got
better at Workman, I found myself instinctively reaching for the Workman
keys in normal mode. Well, everything except for the <kbd>H</kbd>,
<kbd>J</kbd>, <kbd>K</kbd> and <kbd>L</kbd> keys. Th
|
|||
|
|
</entry>
|
|||
|
|
<entry>
|
|||
|
|
<title>My submissions for r2wars 2020</title>
|
|||
|
|
<updated>2020-09-13T00:00:00Z</updated>
|
|||
|
|
<id>tag:icyphox.sh/,2020-09-13:blog/r2wars-2020</id>
|
|||
|
|
<link href="https://icyphox.sh/blog/r2wars-2020"></link>
|
|||
|
|
<summary type="html"><h2>If I learnt one thing, it's that ARM is the future</h2>
<p><a href="https://github.com/radareorg/r2wars" rel="nofollow">r2wars</a> is
a <a href="http://corewars.org" rel="nofollow">CoreWar</a>-like game thar runs within the radare2
<a href="https://radare.gitbooks.io/radare2book/content/disassembling/esil.html" rel="nofollow">ESIL</a>
virtual machine. In short, you have two programs running in a shared
memory space (1kb), with the goal of killing the other and surviving as
long as possible. r2wars was conducted as a part of
<a href="https://rada.re/con/2020" rel="nofollow">r2con2020</a>.</p>

<h2 id="day-1">day 1</h2>

<p>My first submission was an incredibly simple &ldquo;bomber&rdquo;. All it does is
write code to a location, jump there, and continue executing the same
thing over and over.</p>

<pre><code class="language-asm">mov eax, 0xfeebfeeb; just some bad jumps
mov ebx, eax
mov ecx, eax
mov edx, eax
mov ebp, eax
mov edi, eax
mov esp, 0x3fc
mov esi, 0x3fd
mov [esi], 0xe6ff60
jmp esi
</code></pre>

<p>Specifically, it writes <code>0xe6ff60</code>, which is</p>

<pre><code class="language-asm">pushal
jmp esi
</code></pre>

<p>effectively looping over and over. <code>pushal</code> is a very interesting x86
instruction, that pushes all the registers and decrements the stack
pointer <code>esp</code> by how many ever bytes were pushed. Nifty, especially if
you&rsquo;re looking for high throughput (to bomb the address space). Here, it
starts bombing from <code>0x3fc</code> - <code>0x000</code> (and below, because there&rsquo;s no
bounds checking in place), and ends up killing itself, since writing
outside of the arena (<code>0x000</code> - <code>0x400</code>) is illegal.</p>

<p>Ultimately, this bot placed 7th out of 9 contestants&mdash;an underwhelming
outcome. I had to fix this.</p>

<p><img src="https://cdn.icyphox.sh/gk1i0.png" alt="day 1" /></p>

<h2 id="day-2">day 2</h2>

<p>I sat for a second and recollected the different reasons for my bot
getting killed, and the one that occurred the most was my bot
insta-dying to bad instructions being written from <code>0x400</code>&mdash;i.e. from
near where I&rsquo;m positioned. Nearly all competing bots write from bottom
up, because <code>pushal</code> <em>decrements</em> the stack pointer. So the obvious
solution was to reposition my initial payload way above, at <code>0x000</code>. And
of course, it goes without saying that this assumes everyone&rsquo;s using
<code>pushal</code> (they are).</p>

<pre><code class="language-asm">mov eax, 0xffffffff
mov ecx, eax
mov edx, eax
mov ebx, eax
mov ebp, eax
mov esi, eax

check:
 mov edi, 0x000
 cmp [edi], 0
 jne planb
 mov esp, 0x400
 inc edi
 mov [edi], 0xe7ff6060; pushal, jmp edi
 jmp edi

planb:
 mov edi, 0x3fb
 mov [edi], 0xe7ff6060
 mov esp, 0x3fa
 jmp edi
</code></pre>

<p>I also added a (pretty redundant) check to see if the stuff at <code>edi</code> was
0, since the entire arena is initially <code>0x0</code>. My reasoning, albeit
flawed, was that if it wasn&rsquo;t 0, then it was unsafe to go there. In
hindsight, it would&rsquo;ve been <em>safer</em>, si
|
|||
|
|
</entry>
|
|||
|
|
<entry>
|
|||
|
|
<title>Migrating from Mastodon to Pleroma</title>
|
|||
|
|
<updated>2020-09-04T00:00:00Z</updated>
|
|||
|
|
<id>tag:icyphox.sh/,2020-09-04:blog/mastodon-to-pleroma</id>
|
|||
|
|
<link href="https://icyphox.sh/blog/mastodon-to-pleroma"></link>
|
|||
|
|
<summary type="html"><h2>Mastodon bad. Pleroma good.</h2>
<p>If you&rsquo;ve been following me on the fediverse, you would&rsquo;ve witnessed my
numerous (failed) attempts at migrating from Mastodon to Pleroma,
running on my Raspberry Pi. I finally got it working, and these are the
steps I took. It&rsquo;s sort of a loose guide you could follow, but I can&rsquo;t
promise it&rsquo;ll work for you.</p>

<p>The Erlang and Elixir packages are pretty broken and outdated on
Raspbian. So this time, I built them from source.<sup class="footnote-ref" id="fnref:1"><a href="#fn:1">1</a></sup><sup class="footnote-ref" id="fnref:2"><a href="#fn:2">2</a></sup> I also assume
you have Mastodon and Pleroma (source, not OTP) installed&mdash;probably at
<code>/home/mastodon/live</code> and <code>/opt/pleroma</code>, respectively.</p>

<p>Once you have Erlang and Elixir compiled and sitting in your <code>PATH</code>,
pull <a href="https://gitlab.com/soapbox-pub/migrator" rel="nofollow">soapbox-pub/migrator</a>.
Now read the readme and the <code>do_migration.sh</code> script to get an idea of
what you&rsquo;re getting into.</p>

<p>Move into the cloned directory and create a <code>.env</code>:</p>

<pre><code class="language-shell">MASTODON_PATH=/home/mastodon/live
PLEROMA_PATH=/opt/pleroma
</code></pre>

<p>Then, run:</p>

<pre><code class="language-console">$ yarn # install deps
$ cp -r mastodon/* /home/mastodon/live
$ cp -r pleroma/* /opt/pleroma
$ RAILS_ENV=production yarn masto export
</code></pre>

<p>If you run into any permissions issues, <code>chown</code> and proceed. This should
export all your Mastodon activity into <code>/home/mastodon/live/migrator</code>.
Now, copy the <code>migrator</code> directory into your Pleroma installation path.</p>

<pre><code class="language-console">$ cp -r migrator /opt/pleroma
</code></pre>

<p>You can then import all of it into Pleroma (possibly prefixed with <code>sudo
-Hu pleroma</code>):</p>

<pre><code class="language-console">$ MIX_ENV=prod mix migrator.import
</code></pre>

<p>If all went well, you would&rsquo;ve successfully migrated from Mastodon to
Pleroma. If not, well feel free to send me an email (or @ me on the fedi).
I suppose you could also reach <a href="https://alexgleason.me" rel="nofollow">Alex</a>&mdash;he&rsquo;s
the incredibly based guy who wrote the migrator,
<a href="https://soapbox.pub" rel="nofollow">soapbox-fe</a> and does some Elixir magic he keeps
<a href="https://gleasonator.com/@alex" rel="nofollow">posting about</a>.</p>

<p>Rest assured, the migrator has a 100% success rate&mdash;Alex and I are
apparently the only two who have it working. <sup>2</sup>&frasl;<sub>2</sub>.</p>

<h2 id="why-should-you-migrate">why should you migrate?</h2>

<p>Because Pleroma is cleaner, leaner<sup class="footnote-ref" id="fnref:3"><a href="#fn:3">3</a></sup> and prettier looking<sup class="footnote-ref" id="fnref:4"><a href="#fn:4">4</a></sup>. Oh, and we
have chats.
<img src="https://cdn.icyphox.sh/l8g5y.png" alt="screenshot of pleroma + soapbox-fe" /></p>

<div class
|
|||
|
|
</entry>
|
|||
|
|
<entry>
|
|||
|
|
<title>The Ducky One 2 SF</title>
|
|||
|
|
<updated>2020-08-22T00:00:00Z</updated>
|
|||
|
|
<id>tag:icyphox.sh/,2020-08-22:blog/ducky-one-2</id>
|
|||
|
|
<link href="https://icyphox.sh/blog/ducky-one-2"></link>
|
|||
|
|
<summary type="html"><h2>I fell for the mechanical keyboard meme</h2>
<p>Thanks to the pandemic yada yada I&rsquo;ve been working from home (and
attending college from home), and I figured my WFH setup could use an
upgrade. Unfortunately, the choices for mechanical keyboards in India are
fairly limited. All imports from China don&rsquo;t get through, and imports
from elsewhere have a <em>fat</em> duty slapped on it&mdash;sometimes up to
300%<sup class="footnote-ref" id="fnref:1"><a href="#fn:1">1</a></sup>. It&rsquo;s obscene!</p>

<p>The only reliable source I&rsquo;ve found (and folks on
<a href="https://reddit.com/r/mkindia" rel="nofollow">r/mkindia</a> will concur), is
<a href="https://meckeys.com" rel="nofollow">Meckeys</a>. They aren&rsquo;t particularly abundant in
variety, but there&rsquo;s some decent prebuilts that you can pick up on
there&mdash;and I copped the Ducky One 2 SF.</p>

<p><img src="https://cdn.icyphox.sh/5LSG7.jpg" alt="Ducky One 2 SF side view" /></p>

<p>It&rsquo;s a 65% board, so unlike standard 60% boards, this comes with arrow
keys and the <code>Del</code>, <code>PgUp</code> and <code>PgDn</code> keys. I don&rsquo;t <em>really</em> need the
arrow keys, but they do come handy on the occasion&mdash;like scrolling,
for example. Since this board lacks the function row, the <code>Esc</code> and the
<code>~</code> keys are merged. I have to hit <code>Shift + Esc</code> for tilde (same action
as usual), and <code>Fn + Esc</code> for the backtick. Takes a bit of relearning,
but it&rsquo;s manageable.</p>

<p><img src="https://cdn.icyphox.sh/tRdNw.jpg" alt="Ducky One 2 SF top-down view" /></p>

<p>The key switches I went with were the Cherry MX Speed Silvers&mdash;like
Reds but actuate a bit faster. As it&rsquo;s my first ever mechanical
keyboard, I don&rsquo;t really have anything to compare it against. It feels
<em>great</em>, but it was pretty jarring initially because even the slightest
touch (with the palm for instance), would cause a key to actuate, leading
to typos. Again, just a matter of getting accustomed to it; all smooth
sailing after. Why did I pick the Speed Silvers? The other switch
options were out of stock.</p>

<p>That said, I think I really quite like linear switches. They&rsquo;re not
<em>too</em> noisy, and they feel just right. I haven&rsquo;t noticed any great
improvement in my typing speeds though&mdash;I still maintain an average of
90&ndash;100 WPM.</p>

<p>The One 2 SF is fully RGB, i.e. each key is individually lit. Not that
I make big use it. I have it set to plain white, and only light up under
the key I&rsquo;m currently pressing. Yes, this also makes it incredibly easy
for people to shoulder-peek your passwords. I certainly won&rsquo;t be using
it outside home.</p>

<p>The keyboard itself cost 9599 INR, which is about 128 USD. Meckeys
took exactly 10 days to ship it (3rd Aug - 13th Aug). Overall, it&rsquo;s
a lovely keyboard, and I <em>cannot</em> type on my laptop&rsquo;s low-travel
chiclet-style keyboard, again. There&rsquo;s just no going back.</p>

<div class="footnotes">

<hr />

<ol>
<li id="fn:1"><a href="https://www.reddit.com/r/mkindia/comments/hzyoof/i_see_many_spreading_misinformation_about_import/" rel="nofollow">Reddit link</a> <a class="footnote-return" hre
|
|||
|
|
</entry>
|
|||
|
|
<entry>
|
|||
|
|
<title>Some thoughts on Twitter</title>
|
|||
|
|
<updated>2020-08-03T00:00:00Z</updated>
|
|||
|
|
<id>tag:icyphox.sh/,2020-08-03:blog/twitter</id>
|
|||
|
|
<link href="https://icyphox.sh/blog/twitter"></link>
|
|||
|
|
<summary type="html"><h2>I've begun avoiding Twitter, here's why</h2>
<p>This post has been a long time coming. Earlier this year, I decided to
not actively participate on Twitter, and stick to the fediverse
primarily. This has been quite possibly the best decision I&rsquo;ve made,
with regard to curating my social / informational feeds&mdash;apart from
<a href="/blog/dont-news">not reading news</a>. I&rsquo;ll try to gloss over some reasons
as to why I dislike Twitter as a platform, in this post. Bear in mind,
these are based on my experiences and YMMV.</p>

<h2 id="filter-bubbles-and-radicalization">filter bubbles and radicalization</h2>

<p>I think this can be said about any social network, but the way that
Twitter is designed only further enables this phenomenon. The more you
interact / show interest in a specific topic, the more you see of the
same&mdash;in terms of suggested accounts to follow, notifications/email telling
you XYZ tweeted this (you probably don&rsquo;t even follow XYZ).</p>

<p>I&rsquo;ve experienced this first hand. I created an alt and followed a few
prominent right-wing accounts (for science!), and within a day or two,
my notifications and inbox were filled with similar accounts &amp; tweets.</p>

<p>This, as a result, means the user is much more likely to see content
similar to their own perspectives&mdash;a <em>filter bubble</em>. The user is
effectively isolated in their own ideological bubbles. Consequentially,
any form of disagreement that occurs is tossed aside as <em>the other
party&rsquo;s</em> flaw.
Surely they wouldn&rsquo;t hold that perspective if they could see things
<em>your</em> way! It&rsquo;s <em>their</em> ignorance!</p>

<p>One might argue, however, that they do in fact see a lot of opposing
viewpoints in their feed. After all, most of mainstream discourse on
Twitter is just derisive tweets by proponents of either side<sup class="footnote-ref" id="fnref:1"><a href="#fn:1">1</a></sup>, at
each other. The left quote-tweeting the right and vice versa, for
example. In fact, this is pretty much all that today&rsquo;s &ldquo;news&rdquo; is
about&mdash;constant, endless rebuttals to the other&rsquo;s perspective.
I still think this <em>is</em> filter bubbling&mdash;the constant
reaffirmation of your ideologies, by taking potshots at the other side.</p>

<p>And what does constant exposure to a singular viewpoint lead to? That&rsquo;s
right, radicalization. I won&rsquo;t get into too much detail&mdash;there really
isn&rsquo;t much to say. I&rsquo;ll just add that I know of a few cases IRL, where
within little over a year of having created a Twitter account the
person&rsquo;s political and ideological positions became hard lines&mdash;and
they now straight up refuse to look at things any other way. This is by
no means a scientific conclusion; there are various other influencing
factors, but my point still stands.</p>

<h2 id="favors-mistakes-over-apologies">favors mistakes over apologies</h2>

<p>Twitter&rsquo;s design is plagued with flaws, but this one takes the cake. If
you screw up or tweet something incorrect, and it happens to go viral,
there&rsquo;s literally no good way to publish a correction / apology. Quoting
the fantastic article by Nick Punt on <a href="https://nickpunt.com/blog/deescalating-social-media/" rel="nofollow">deescalating conflict on social
media</a>:</p>

<blockquote>
<p>If we ignore replies, the simple amplification effects of l
|
|||
|
|
</entry>
|
|||
|
|
<entry>
|
|||
|
|
<title>Status update</title>
|
|||
|
|
<updated>2020-07-20T00:00:00Z</updated>
|
|||
|
|
<id>tag:icyphox.sh/,2020-07-20:blog/2020-07-20</id>
|
|||
|
|
<link href="https://icyphox.sh/blog/2020-07-20"></link>
|
|||
|
|
<summary type="html"><h2>Things I've been up to, for the past month-ish</h2>
<p>I realize I haven&rsquo;t updated this site in a while&mdash;mostly due to lack
of time. The past two weeks have been pretty busy (read: I now actually
have work to do), which also means I have very little time to devote to
personal projects. Anyway, on with the update.</p>

<h2 id="i-now-work-at-cometchat">I now work at CometChat</h2>

<p>I&rsquo;ve begun working as an Engineering Intern at
<a href="https://www.cometchat.com" rel="nofollow">CometChat</a>. It&rsquo;s been a very interesting
experience so far. Most of my work revolves around infrastructure and
platform engineering&mdash;pretty exciting stuff. [Oops, redacted]</p>

<p>I have also been extensively dabbling in XMPP and websocket internals,
as I&rsquo;m writing a websocket proxy of sorts. I&rsquo;ll probably talk about it
in a future blog post, once I get approval org-side. :^)</p>

<h2 id="that-s-literally-it">that&rsquo;s literally it</h2>

<p>I sat all day thinking of what else to add to this post&mdash;there&rsquo;s <em>got
to be</em> something else right? Not really. I don&rsquo;t think I did anything
worthwhile. I did get some pretty interesting emails from people who
read this blog, so yes, please email me&mdash;even if it&rsquo;s just to say hi.
I always reply.</p>
</summary>
|
|||
|
|
</entry>
|
|||
|
|
<entry>
|
|||
|
|
<title>Flask-JWT-Extended × Flask-Login</title>
|
|||
|
|
<updated>2020-06-24T00:00:00Z</updated>
|
|||
|
|
<id>tag:icyphox.sh/,2020-06-24:blog/flask-jwt-login</id>
|
|||
|
|
<link href="https://icyphox.sh/blog/flask-jwt-login"></link>
|
|||
|
|
<summary type="html"><h2>Apparently I do webshit now</h2>
<p>For the past few months, I&rsquo;ve been working on building a backend for
<code>$STARTUP</code>, with a bunch of friends. I&rsquo;ll probably write in detail about
it when we launch our beta. The backend is your bog standard REST API,
built on Flask&mdash;if you didn&rsquo;t guess from the title already.</p>

<p>Our existing codebase heavily relies on
<a href="https://flask-login.readthedocs.io" rel="nofollow">Flask-Login</a>; it offers some pretty
neat interfaces for dealing with users and their states. However, its
default mode of operation&mdash;sessions&mdash;don&rsquo;t really fit into a Flask
app that&rsquo;s really just an API. It&rsquo;s not optimal. Besides, this is what
<a href="https://jwt.io" rel="nofollow">JWTs</a> were built for.</p>

<p>I won&rsquo;t bother delving deep into JSON web tokens, but the general
flow is like so:</p>

<ul>
<li>client logs in via say <code>/login</code></li>
<li>a unique token is sent in the response</li>
<li>each subsequent request authenticated request is sent with the token</li>
</ul>

<p>The neat thing about tokens is you can store stuff in them&mdash;&ldquo;claims&rdquo;,
as they&rsquo;re called.</p>

<h2 id="returning-an-access-token-to-the-client">returning an <code>access_token</code> to the client</h2>

<p>The <code>access_token</code> is sent to the client upon login. The idea is simple,
perform your usual checks (username / password etc.) and login the user
via <code>flask_login.login_user</code>. Generate an access token using
<code>flask_jwt_extended.create_access_token</code>, store your user identity in it
(and other claims) and return it to the user in your <code>200</code> response.</p>

<p>Here&rsquo;s the excerpt from our codebase.</p>

<pre><code class="language-python">access_token = create_access_token(identity=email)
login_user(user, remember=request.json[&quot;remember&quot;])
return good(&quot;Logged in successfully!&quot;, access_token=access_token)
</code></pre>

<p>But, for <code>login_user</code> to work, we need to setup a custom user loader to
pull out the identity from the request and return the user object.</p>

<h2 id="defining-a-custom-user-loader-in-flask-login">defining a custom user loader in Flask-Login</h2>

<p>By default, Flask-Login handles user loading via the <code>user_loader</code>
decorator, which should return a user object. However, since we want to
pull a user object from the incoming request (the token contains it),
we&rsquo;ll have to write a custom user loader via the <code>request_loader</code>
decorator.</p>

<pre><code class="language-python"># Checks the 'Authorization' header by default.
app.config[&quot;JWT_TOKEN_LOCATION&quot;] = [&quot;json&quot;]

# Defaults to 'identity', but the spec prefers 'sub'.
app.config[&quot;JWT_IDENTITY_CLAIM&quot;] = &quot;sub&quot;

@login.request_loader
def load_person_from_request(request):
 try:
 token = request.json[&quot;access_token&quot;]
 except Exception:
 return None
 data = decode_token(token)
 # this can be your 'User' class
 person = PersonSignup.query.filter_by(email=data[&quot;sub&quot;]).first()
 if person:
 return person
 return
|
|||
|
|
</entry>
|
|||
|
|
<entry>
|
|||
|
|
<title>You don't need news</title>
|
|||
|
|
<updated>2020-06-21T00:00:00Z</updated>
|
|||
|
|
<id>tag:icyphox.sh/,2020-06-21:blog/dont-news</id>
|
|||
|
|
<link href="https://icyphox.sh/blog/dont-news"></link>
|
|||
|
|
<summary type="html"><h2>My hot 'n' spicy take on "news" today</h2>
<p>News&mdash;the never ending feed of information pertaining to &ldquo;current
events&rdquo;, politics, trivia, and other equally useless junk. News today is
literally just this: &ldquo;&lt;big name person&gt; did/said &lt;dumb thing&gt;!&rdquo;,
&ldquo;&lt;group&gt; protests against &lt;bad thing&gt;!&rdquo;, and so on. Okay, shit&rsquo;s going
on in this world. Another day, another thing to be <code>$FEELING</code> about.</p>

<p>Now here&rsquo;s a question for you: do you remember what news you consumed
yesterday? The day before? Last week? Heck no! Maybe some major
headlines, but really, what did you gain from learning that information?
Must&rsquo;ve been interesting to read <em>at that</em> time. Hence, news, by
virtue of its &ldquo;newness&rdquo;, is given importance&mdash;and get this, it isn&rsquo;t
even important enough for you to bother remembering it for a few days.</p>

<p>News is entertainment. Quick gratification that lasts a day, at max.</p>

<h2 id="actionable-news">actionable news</h2>

<p>So what is useful news, then? I think I&rsquo;ll go out on a limb here, and
say &ldquo;anything that is actionable&rdquo;. By that I mean anything that you can
physically affect / information that you can actually put to use. Again,
there are probably edge-cases and this isn&rsquo;t a rule that fits all, but
it&rsquo;s a decent principle to follow.</p>

<p>As an example, to readers living outside of the US, news regarding
police brutality &amp; the Black Lives Matter movement are unactionable.
I&rsquo;m not saying those problems don&rsquo;t exist or don&rsquo;t matter, but <em>what</em>
are you really doing to help the cause? Sending thoughts and prayers?
Posting angrily on Instagram? Tweeting about it? Stop, and think for
yourself if these things actually make any difference. Your time might
be better invested in doing something else.</p>

<h2 id="other-problems">other problems</h2>

<p>There are other, more concerning problems with modern news&mdash;it is no
longer purely objective. The sad state of news / reporting today is it&rsquo;s
inherently biased. I mean political bias, of course. All news is either
left-leaning or right-leaning, and narratives are developed to fit their
political stance. This is essentially propaganda. Today&rsquo;s news <em>is</em>
propaganda. If anything, this should be reason enough to avoid it.</p>

<h2 id="but-i-compare-multiple-sources">but I compare multiple sources!</h2>

<p>Okay, so you read the same thing written by CNN, BBC, The New York
Times, etc.? Do you realize how much time you wasted doing this?
Ultimately to what end&mdash;to forget about it by the next day, and do it
all over again. What a dull, braindead process.</p>

<h2 id="won-t-i-be-ignorant-then">won&rsquo;t I be ignorant then?</h2>

<p>If you think keeping up with current events makes you intellectually
superior somehow&hellip;boy are you wrong. Do something that actually
stimulates your gray matter. But, here&rsquo;s the thing, if the &ldquo;news&rdquo; is big
enough, you&rsquo;re bound to come across it anyway! You might hear your
friend discuss it, or see it on Twitter, so on and so forth. How you
process it thereafter is what matters.</p>

<p>Give it a thought. Imagine if all that social media, news, and general
internet noise didn&rsquo;t clog your head. I think it&rsquo;ll be much nicer. Yo
|
|||
|
|
</entry>
|
|||
|
|
<entry>
|
|||
|
|
<title>Migrating to the RPi</title>
|
|||
|
|
<updated>2020-06-04T00:00:00Z</updated>
|
|||
|
|
<id>tag:icyphox.sh/,2020-06-04:blog/pi</id>
|
|||
|
|
<link href="https://icyphox.sh/blog/pi"></link>
|
|||
|
|
<summary type="html"><h2>Raspberry Pi shenanigans, and other things</h2>
<p>I&rsquo;d ordered the Raspberry Pi 4B (the 4GB variant), sometime early
this year, thinking I&rsquo;d get to self-hosting everything on it as soon as
it arrived. As things turn out, it ended up sitting in its box up until
two weeks ago&mdash;it took me <em>that</em> long to order an SD card for it. No,
I didn&rsquo;t have one. Anyway, from there began quite the wild ride.</p>

<h2 id="flashing-the-sd-card">flashing the SD card</h2>

<p>You&rsquo;d think this would be easy right? Just plug it into your laptop&rsquo;s SD
card reader (or microSD), and flash it like you would a USB drive. Well,
nope. Of the three laptops at home one doesn&rsquo;t have an SD card reader,
mine&mdash;running OpenBSD&mdash;didn&rsquo;t detect it, and my brother&rsquo;s&mdash;running
Void&mdash;didn&rsquo;t detect it either.</p>

<p>Then it hit me: my phone (my brother&rsquo;s, actually), has an SD card slot
that actually works. Perhaps I can use the phone to flash the image?
Took a bit of DDG&rsquo;ing (ducking?), but we eventually figured out that the
block-device for the SD on the phone was <code>/dev/mmcblk1</code>. Writing to it
was just the usual <code>dd</code> invocation.</p>

<h2 id="got-nat-d">got NAT&rsquo;d</h2>

<p>After the initial setup, I was eager to move my services off the Digital
Ocean VPS, to the RPi. I set up the SSH port forward through my router
config, as a test. Turns out my ISP has me NAT&rsquo;d. The entirety of my
apartment is serviced by these fellas, and they have us all under
a CG-NAT. Fantastic.</p>

<p>Evading this means I either lease a public IP from the ISP, or
I continue using my VPS, and port forward traffic from it via a tunnel.
I went with option two since it gives me something to do.</p>

<h2 id="nat-evasion">NAT evasion</h2>

<p>This was fairly simple to setup with Wireguard and <code>iptables</code>. I don&rsquo;t
really want to get into detail here, since it&rsquo;s been documented aplenty
online, but in essence you put your VPS and the Pi on the same network,
and forward traffic hitting your internet facing interface (<code>eth0</code>)
to the VPN&rsquo;s (<code>wg0</code>). Fairly simple stuff.</p>

<h2 id="setting-up-mastodon-on-the-pi">setting up Mastodon on the Pi</h2>

<p>Mastodon was kind of annoying to get working. My initial plan was to
port forward only a few selected ports, have Mastodon exposed on the Pi
at some port via nginx, and then front <em>that</em> nginx via the VPS. So
basically: Mastodon (localhost on Pi) &lt;-&gt; nginx (on Pi) &lt;-&gt; nginx (on
VPS, via Wireguard). I hope that made sense.</p>

<p>Anyway, this setup would require having Mastodon run on HTTP, since I&rsquo;ll
be HTTPS&rsquo;ing at the VPS. If you think about it, it&rsquo;s kinda like what
Cloudflare does. But, Mastodon doesn&rsquo;t like running on HTTP. It just
wasn&rsquo;t working. So I went all in and decided to forward all <sup>80</sup>&frasl;<sub>443</sub>
traffic and serve everything off the Pi.</p>

<p>Getting back to Mastodon&mdash;the initial few hiccups aside, I was able to
get it running at <code>toot.icyphox.sh</code>. However, as a seeker of aesthetics,
I wanted my handle to be <code>@icyphox.sh</code>. Turns out, this can be achieved
fairly easily.</p>

<p>Add a new <code>WEB_DOMAIN</code> variable to your <code&
|
|||
|
|
</entry>
|
|||
|
|
<entry>
|
|||
|
|
<title>Site changes</title>
|
|||
|
|
<updated>2020-05-27T00:00:00Z</updated>
|
|||
|
|
<id>tag:icyphox.sh/,2020-05-27:blog/site-changes</id>
|
|||
|
|
<link href="https://icyphox.sh/blog/site-changes"></link>
|
|||
|
|
<summary type="html"><h2>New stuff at the {back,front}end</h2>
<p>The past couple of days, I&rsquo;ve spent a fair amount of time tweaking this
site. My site&rsquo;s build process involves
<a href="https://github.com/icyphox/vite" rel="nofollow">vite</a> and a bunch of
<a href="https://github.com/icyphox/site/tree/master/bin" rel="nofollow">scripts</a>. These
scripts are executed via vite&rsquo;s pre- and post-build actions. The big
changes that were made were performance improvements in the
<code>update_index.py</code> script, and the addition of <code>openring.py</code>, which you
can see at the very bottom of this post!</p>

<h2 id="speeding-up-index-page-generation">speeding up index page generation</h2>

<p>The old script&mdash;the one that featured in <a href="/blog/hacky-scripts">Hacky
scripts</a>&mdash;was absolutely ridiculous, and not to
mention <em>super</em> slow. Here&rsquo;s what it did:</p>

<ul>
<li>got the most recent file (latest post) by sorting all posts by
<code>mtime</code>.</li>
<li>parsed the markdown frontmatter and created a markdown table entry
like:</li>
</ul>

<pre><code class="language-python">line = f&quot;| [{meta['title']}]({url}) | `{meta['date']}` |&quot;
</code></pre>

<ul>
<li>updated the markdown table (in <code>_index.md</code>) by in-place editing the
markdown, with the line created earlier&mdash;for the latest post.</li>
<li>finally, I&rsquo;d have to <em>rebuild</em> the entire site since this markdown
hackery would happen at the very end of the build, i.e, didn&rsquo;t
actually get rendered itself.</li>
</ul>

<p>That&hellip;probably didn&rsquo;t make much sense to you, did it? Don&rsquo;t bother.
I don&rsquo;t know what I was thinking when I wrote that mess. So with how it
<em>was</em> done aside, here&rsquo;s how it&rsquo;s done now:</p>

<ul>
<li>the metadata for all posts are nicely fetched and sorted using
<code>python-frontmatter</code>.</li>
<li>the metadata list is fed into Jinja for use in templating, and is
rendered very nicely using a simple <code>for</code> expression:
<code>
{% for p in posts %}
&lt;tr&gt;
&lt;td align=&quot;left&quot;&gt;&lt;a href=&quot;/blog/{{ p.url }}&quot;&gt;{{ p.title }}&lt;/a&gt;&lt;/td&gt;
&lt;td align=&quot;right&quot;&gt;{{ p.date }}&lt;/td&gt;
&lt;/tr&gt;
{% endfor %}
</code></li>
</ul>

<p>A neat thing I learnt while working with Jinja, is you can use
<code>DebugUndefined</code> in your <code>jinja2.Environment</code> definition to ignore
uninitialized template variables. Jinja&rsquo;s default behaviour is to remove
all uninitialized variables from the template output. So for instance,
if you had:</p>

<pre><code class="language-html">&lt;body&gt;
 {{ body }}
&lt;/body&gt;

&lt;footer&gt;
 {{ footer }}
&lt;/footer&gt;
</code></pre>

<p>And only <code>{{ body }}</code> was initialized in your <code>template.render(body=body)</code>,
the output you get would be:</p>

<pre><code class="language-html">&lt;body&gt;
 Hey there!
&lt;/body&gt;
&lt;footer&gt;

&lt;/footer&gt;

|
|||
|
|
</entry>
|
|||
|
|
<entry>
|
|||
|
|
<title>The efficacy of deepfakes</title>
|
|||
|
|
<updated>2020-05-11T00:00:00Z</updated>
|
|||
|
|
<id>tag:icyphox.sh/,2020-05-11:blog/efficacy-deepfakes</id>
|
|||
|
|
<link href="https://icyphox.sh/blog/efficacy-deepfakes"></link>
|
|||
|
|
<summary type="html"><h2>Can we really write it off as "not a threat"?</h2>
<p>A few days back, NPR put out an article discussing why deepfakes aren&rsquo;t
all that powerful in spreading disinformation.
<a href="https://www.npr.org/2020/05/07/851689645/why-fake-video-audio-may-not-be-as-powerful-in-spreading-disinformation-as-feare" rel="nofollow">Link to article</a>.</p>

<p>According to the article:</p>

<blockquote>
<p>&ldquo;We&rsquo;ve already passed the stage at which they would have been most
effective,&rdquo; said Keir Giles, a Russia specialist with the Conflict
Studies Research Centre in the United Kingdom. &ldquo;They&rsquo;re the dog that
never barked.&rdquo;</p>
</blockquote>

<p>I agree. This might be the case when it comes to Russian influence.
There are simpler, more cost-effective ways to conduct <a href="https://en.wikipedia.org/wiki/Active_measures" rel="nofollow">active
measures</a>, like memes.
Besides, America already has the infrastructure in place to combat
influence ops, and have been doing so for a while now.</p>

<p>However, there are certain demographics whose governments may not have
the capability to identify and perform damage control when
a disinformation campaign hits, let alone deepfakes. An example of this
demographic: India.</p>

<h2 id="the-indian-landscape">the Indian landscape</h2>

<p>The disinformation problem in India is way more sophisticated, and
harder to combat than in the West. There are a couple of reasons for
this:</p>

<ul>
<li>The infrastructure for fake news already exists: WhatsApp</li>
<li>Fact checking media in 22 different languages is non-trivial</li>
</ul>

<p>India has had a long-standing problem with misinformation. The 2019
elections, the recent CAA controversy and even more recently&mdash;the
coronavirus. In some cases, it has even lead to
<a href="https://www.npr.org/2018/07/18/629731693/fake-news-turns-deadly-in-india" rel="nofollow">mob violence</a>.</p>

<p>All of this shows that the populace is easily influenced, and deepfakes
are only going to simplify this. What&rsquo;s worse is explaining to a rural
crowd that something like a deepfake can exist&mdash;comprehension and
adoption of technology has always been slow in India, and can be
attributed to socio-economic factors.</p>

<p>There also exists a majority of the population that&rsquo;s already been
influenced to a certain degree: the right wing. A deepfake of a Muslim
leader trashing Hinduism will be eaten up instantly. They are inclined
to believe it is true, by virtue of prior influence and given the
present circumstances.</p>

<h2 id="countering-deepfakes">countering deepfakes</h2>

<p>The thing about deepfakes is the tech to spot them already exists. In
fact, some can even be eyeballed. Deepfake imagery tends to have weird
artifacting, which can be noticed upon closer inspection. Deepfake
videos, of people specifically, blink / move weirdly. The problem at
hand, however, is the general public cannot be expected to notice these
at a quick glance, and the task of proving a fake is left to researchers
and fact checkers.</p>

<p>Further, India does not have the infrastructure to combat deepfakes at
scale. By the time a research group / think tank catches wind of it, the
damage is likely already done. Besides, disseminating contradictory
information, i.e. &ldquo;this video is fake&rdquo;, is also a task of its own.
Public opinion has already been swayed, and the brain dis
|
|||
|
|
</entry>
|
|||
|
|
<entry>
|
|||
|
|
<title>Simplicity (mostly) guarantees security</title>
|
|||
|
|
<updated>2020-05-07T00:00:00Z</updated>
|
|||
|
|
<id>tag:icyphox.sh/,2020-05-07:blog/simplicity-security</id>
|
|||
|
|
<link href="https://icyphox.sh/blog/simplicity-security"></link>
|
|||
|
|
<summary type="html"><h2>This is why I meme mnmlsm so much</h2>
<p>Although it is a very comfy one, it&rsquo;s not just an aesthetic. Simplicity
and minimalism, in technology, is great for security too. I say &ldquo;mostly&rdquo;
in the title because human error cannot be discounted, and nothing is
perfect. However, the simpler your tech stack is, it is inherentely more
secure than complex monstrosities.</p>

<p>Let&rsquo;s look at systemd, for example. It&rsquo;s got over 1.2 million
lines of code. &ldquo;Hurr durr but LoC doesn&rsquo;t mean anything!&rdquo; Sure ok, but
can you <em>imagine</em> auditing this? How many times has it even been
audited? I couldn&rsquo;t find any audit reports. No, the developers are not
security engineers and a trustworthy audit must be done by
a third-party. What&rsquo;s scarier, is this thing runs on a huge percentage
of the world&rsquo;s critical infrastructure and contains privileged core
subsystems.</p>

<p>&ldquo;B-but Linux is much bigger!&rdquo; Indeed, it is, but it has a thousand times
(if not more) the number of eyes looking at the code, and there have been
multiple third-party audits. There are hundreds of independent orgs and
multiple security teams looking at it. That&rsquo;s not the case with
systemd&mdash;it&rsquo;s probably just RedHat.</p>

<p>Compare this to a bunch of shell scripts. Agreed, writing safe shell can
be hard and there are a ton of weird edge-cases depending on your shell
implementation, but the distinction here is <em>you</em> wrote it. Which means,
you can identify what went wrong&mdash;things are predictable.
systemd, however, is a large blackbox, and its state at runtime is largely
unprovable and unpredictable. I am certain even the developers don&rsquo;t
know.</p>

<p>And this is why I whine about complexity so much. A complex,
unpredictable system is nothing more than a large attack surface. Drew
DeVault, head of <a href="https://sourcehut.org" rel="nofollow">sourcehut</a> wrote something
similar (yes that&rsquo;s the link, yes it has a typo).:</p>

<p><a href="https://sourcehut.org/blog/2020-04-20-prioritizing-simplitity/" rel="nofollow">https://sourcehut.org/blog/2020&ndash;04&ndash;20-prioritizing-simplitity/</a></p>

<p>He manually provisions all
sourcehut infrastructure, because tools like Salt, Kubernetes etc. are
just like systemd in our example&mdash;large monstrosities which can get you
RCE&rsquo;d. Don&rsquo;t believe me? See
<a href="https://threatpost.com/salt-bugs-full-rce-root-cloud-servers/155383/" rel="nofollow">this</a>.</p>

<p><em>This was day 3 of the #100DaysToOffload challenge. It came out like
a systemd-hate post, but really, I couldn&rsquo;t think of a better example.</em></p>
</summary>
|
|||
|
|
</entry>
|
|||
|
|
<entry>
|
|||
|
|
<title>The S-nail mail client</title>
|
|||
|
|
<updated>2020-05-06T00:00:00Z</updated>
|
|||
|
|
<id>tag:icyphox.sh/,2020-05-06:blog/s-nail</id>
|
|||
|
|
<link href="https://icyphox.sh/blog/s-nail"></link>
|
|||
|
|
<summary type="html"><h2>And how to achieve a usable configuration for IMAP/SMTP</h2>
<p>TL;DR: Here&rsquo;s my <a href="https://github.com/icyphox/dotfiles/blob/master/home/.mailrc" rel="nofollow"><code>.mailrc</code></a>.</p>

<p>As I&rsquo;d mentioned in my blog post about <a href="/blog/mael">mael</a>, I&rsquo;ve been on
the lookout for a good, usable mail client. As it happens, I found
S-nail just as I was about to give up on mael. Turns out writing an MUA
isn&rsquo;t all too easy after all. S-nail turned out to be the perfect client
for me, but I had to invest quite some time in reading the <a href="https://www.sdaoden.eu/code-nail.html" rel="nofollow">very
thorough manual</a> and exchanging
emails with its <a href="https://www.sdaoden.eu" rel="nofollow">very friendly author</a>. I did it
so you don&rsquo;t have to<sup class="footnote-ref" id="fnref:read-man"><a href="#fn:read-man">1</a></sup>, and I present to you
this guide.</p>

<h2 id="basic-settings">basic settings</h2>

<p>These settings below should guarantee some sane defaults to get started
with. Comments added for context.</p>

<pre><code class="language-conf"># enable upward compatibility with S-nail v15.0
set v15-compat

# charsets we send mail in
set sendcharsets=utf-8,iso-8859-1

# reply back in sender's charset
set reply-in-same-charset

# prevent stripping of full names in replies
set fullnames

# adds a 'Mail-Followup-To' header; useful in mailing lists
set followup-to followup-to-honour-ask-yes

# asks for an attachment after composing
set askattach

# marks a replied message as answered
set markanswered

# honors the 'Reply-To' header
set reply-to-honour

# automatically launches the editor while composing mail interactively
set editalong

# I didn't fully understand this :) 
set history-gabby=all

# command history storage
set history-file=~/.s-nailhist

# sort mail by date (try 'thread' for threaded view)
set autosort=date
</code></pre>

<h2 id="authentication">authentication</h2>

<p>With these out of the way, we can move on to configuring our
account&mdash;authenticating IMAP and SMTP. Before that, however, we&rsquo;ll
have to create a <code>~/.netrc</code> file to store our account credentials.</p>

<p>(This of course, assumes that your SMTP and IMAP credentials are the
same. I don&rsquo;t know what to do otherwise. )</p>

<pre><code class="language-netrc">machine *.domain.tld login user@domain.tld password hunter2
</code></pre>

<p>Once done, encrypt this file using <code>gpg</code> / <code>gpg2</code>. This is optional, but
recommended.</p>

<pre><code>$ gpg2 --symmetric --cipher-algo AES256 -o .netrc.gpg .netrc
</code></pre>

<p>You can now delete the plaintext <code>.netrc</code> file. Now add these lines to
your <code>.mailrc</code>:</p>

<pre><code class="language-conf">set netrc-lookup
set netrc-pipe='gpg2 -qd ~/.netrc.gpg'
</code></pre>

<p>Before we define our account block, add these two lines for a nicer IMAP
experience:</p>

<pre><code class="language-conf">set imap-cache=~/.cache/nail
set imap-keepalive=240
</code></pre>

<p>Defining an account is dead simple.</p>

<pre><
|
|||
|
|
</entry>
|
|||
|
|
<entry>
|
|||
|
|
<title>Stop joining mastodon.social</title>
|
|||
|
|
<updated>2020-05-05T00:00:00Z</updated>
|
|||
|
|
<id>tag:icyphox.sh/,2020-05-05:blog/mastodon-social</id>
|
|||
|
|
<link href="https://icyphox.sh/blog/mastodon-social"></link>
|
|||
|
|
<summary type="html"><h2>Do you even understand federation?</h2>
<p>No, really. Do you actually understand why the Mastodon network exists,
and what it stands for, or are you just LARPing? If you&rsquo;re going to just
cross-post from Twitter, why are you even on Mastodon?</p>

<p>Okay, so Mastodon is a &ldquo;federated network&rdquo;. What does that mean? You
have a bunch of instances, each having their own userbase, and each
instance <em>federates</em> with other instances, forming a distributed
network. Got that? Cool. Now let&rsquo;s get to the problem with
mastodon.social.</p>

<p>mastodon.social is the instance run by the lead developer. Why does
everybody flock to it? I&rsquo;m really not sure, but if I were to hazard
a guess, I&rsquo;d say it&rsquo;s because people don&rsquo;t really understand federation.
&ldquo;Oh, big instance? I should probably join that.&rdquo; Herd mentality?
I dunno.</p>

<p>And what happens when every damn user joins just one instance? It becomes
more Twitter, that&rsquo;s what. The federation is gone. Nearly all activity
is generated from just one instance. Here are some numbers:</p>

<ul>
<li>Total number of users on Mastodon: ~2.2 million.</li>
<li>Number of users on mastodon.social: 529923</li>
</ul>

<p>Surprisingly, there&rsquo;s an instance even bigger than
mastodon.social&mdash;pawoo.net. I have no idea why it&rsquo;s so big and it&rsquo;s
primarily Japanese. Its user count is over 620k. So mastodon.social and
pawoo.net put together form over 1 million users, that&rsquo;s <em>more than</em> 50%
of the entire Mastodon populace. That&rsquo;s nuts.<sup class="footnote-ref" id="fnref:federation-fallacy"><a href="#fn:federation-fallacy">1</a></sup></p>

<p>And you&rsquo;re only enabling this centralization by joining mastodon.social! Really, what
even <em>is there</em> on mastodon.social? Have you even seen its local
timeline? Probably not. Join an instance with more flavor. Are you into,
say, the BSDs? Join bsd.network. Free software? fosstodon.org. Or host
your own for yourself and your friends.</p>

<p>If you really do care about decentralization and freedom, and aren&rsquo;t
just memeing to look cool on Twitter, then move your account to another
instance.<sup class="footnote-ref" id="fnref:move-account"><a href="#fn:move-account">2</a></sup></p>

<div class="footnotes">

<hr />

<ol>
<li id="fn:federation-fallacy"><a href="https://rosenzweig.io/blog/the-federation-fallacy.html" rel="nofollow">https://rosenzweig.io/blog/the-federation-fallacy.html</a> <a class="footnote-return" href="#fnref:federation-fallacy"><span aria-label='Return'>↩︎</span></a></li>

<li id="fn:move-account"><p>Go to <code>/settings/migration</code> from your instance&rsquo;s web
 page.</p> <a class="footnote-return" href="#fnref:move-account"><span aria-label='Return'>↩︎</span></a></li>
</ol>

</div>
</summary>
|
|||
|
|
</entry>
|
|||
|
|
<entry>
|
|||
|
|
<title>OpenBSD on the HP Envy 13</title>
|
|||
|
|
<updated>2020-04-17T00:00:00Z</updated>
|
|||
|
|
<id>tag:icyphox.sh/,2020-04-17:blog/openbsd-hp-envy</id>
|
|||
|
|
<link href="https://icyphox.sh/blog/openbsd-hp-envy"></link>
|
|||
|
|
<summary type="html"><h2>I put a blowfish in my laptop this week</h2>
<p>My existing KISS install broke because I thought it would be a great
idea to have <a href="https://github.com/alpinelinux/apk-tools" rel="nofollow">apk-tools</a>
alongside the <code>kiss</code> package manager. It&rsquo;s safe to say, that did not end
well&mdash;especially when I installed, and then removed a package. With
a semi-broken install that I didn&rsquo;t feel like fixing, I figured I&rsquo;d give
OpenBSD a try. And I did.</p>

<h2 id="installation-and-setup">installation and setup</h2>

<p>Ran into some trouble booting off the USB initially, turned out to be
a faulty stick. Those things aren&rsquo;t built to last, sadly. Flashed a new
stick, booted up. Setup was pleasant, very straightforward. Didn&rsquo;t
really have to intervene much.</p>

<p>After booting in, I was greeted with a very archaic looking FVWM
desktop. It&rsquo;s not the prettiest thing, and especially annoying to work
with when you don&rsquo;t have your mouse setup, i.e. no tap-to-click.</p>

<p>I needed wireless, and my laptop doesn&rsquo;t have an Ethernet port. USB
tethering just works, but the connection kept dying. I&rsquo;m not sure why.
Instead, I downloaded the <a href="http://man.openbsd.org/iwm.4" rel="nofollow">iwm(4)</a>
firmware from <a href="http://firmware.openbsd.org/firmware/6.6/" rel="nofollow">here</a>, loaded
it up on a USB stick and copied it over to <code>/etc/firmware</code>. After that,
it was as simple as running
<a href="http://man.openbsd.org/fw_update.1" rel="nofollow">fw_update(1)</a>
and the firmware is auto-detected and loaded. In fact, if you have working
Internet, <code>fw_update</code> will download the required firmware for you, too.</p>

<p>Configuring wireless is painless and I&rsquo;m so glad to see that there&rsquo;s no
<code>wpa_supplicant</code> horror to deal with. It&rsquo;s as simple as:</p>

<pre><code>$ doas ifconfig iwm0 nwid YOUR_SSID wpakey YOUR_PSK
</code></pre>

<p>Also see <a href="http://man.openbsd.org/hostname.if.5" rel="nofollow">hostname.if(5)</a> to make
this persist. After that, it&rsquo;s only a matter of specifying your desired
SSID, and <code>ifconfig</code> will automatically auth and procure an IP lease.</p>

<pre><code>$ doas ifconfig iwm0 nwid YOUR_SSID
</code></pre>

<p>By now I was really starting to get exasperated by FVWM, and decided to
switch to something nicer. I tried building 2bwm (my previous WM), but
that failed. I didn&rsquo;t bother trying to figure this out, so I figured I&rsquo;d
give <a href="http://man.openbsd.org/cwm.1" rel="nofollow">cwm(1)</a> a shot. Afterall, people
sing high praises of it.</p>

<p>And boy, is it good. The config is a breeze, and actually pretty
powerful. <a href="https://github.com/icyphox/dotfiles/blob/master/home/.cwmrc" rel="nofollow">Here&rsquo;s mine</a>.
cwm also has a built-in launcher, so dmenu isn&rsquo;t necessary anymore.
Refer to <a href="https://man.openbsd.org/cwmrc.5" rel="nofollow">cwmrc(5)</a> for all the config
options.</p>

<p>Touchpad was pretty simple to setup too&mdash;OpenBSD has
<a href="http://man.openbsd.org/wsconsctl.8" rel="nofollow">wsconsctl(8)</a>, which lets you set
your tap-to-click, mouse acceleration etc. However, more advanced
configuration can be
|
|||
|
|
</entry>
|
|||
|
|
<entry>
|
|||
|
|
<title>The Zen of KISS Linux</title>
|
|||
|
|
<updated>2020-04-03T00:00:00Z</updated>
|
|||
|
|
<id>tag:icyphox.sh/,2020-04-03:blog/kiss-zen</id>
|
|||
|
|
<link href="https://icyphox.sh/blog/kiss-zen"></link>
|
|||
|
|
<summary type="html"><h2>My thoughts on the distro, the philosophy and my experience in general</h2>
<p><a href="/blog/five-days-tty">I installed KISS</a> early in January on my main
machine&mdash;an HP Envy 13 (2017), and I have since noticed a lot of changes
in my workflow, my approach to software (and its development), and in
life as a whole. I wouldn&rsquo;t call KISS &ldquo;life changing&rdquo;, as that would be
overly dramatic, but it has definitely reshaped my outlook towards
technology&mdash;for better or worse.</p>

<p>When I talk about KISS to people&mdash;online or IRL&mdash;I get some pretty
interesting reactions and comments.<sup class="footnote-ref" id="fnref:bringing-up-kiss"><a href="#fn:bringing-up-kiss">1</a></sup>
Ranging from &ldquo;Oh cool.&rdquo; to &ldquo;You must be
retarded.&rdquo;, I&rsquo;ve heard it all. A classic and a personal favourite of
mine, &ldquo;I don&rsquo;t use meme distros because I actually get work done.&rdquo; It is
actually, quite the opposite&mdash;I&rsquo;ve been so much more productive using
KISS than any other operating system. I&rsquo;ll explain why shortly.</p>

<p>The beauty of this &ldquo;distro&rdquo;, is it isn&rsquo;t much of a distribution at all.
There is no big team, no mailing lists, no infrastructure. The entire
setup is so loose, and this makes it very convenient to swap things out
for alternatives. The main (and potentially community) repos all reside
locally on your system. In the event that Dylan decides to call it
quits and switches to Windows, we can simply just bump versions
ourselves, locally! The <a href="https://k1ss.org/guidestones" rel="nofollow">KISS Guidestones</a>
document is a good read.</p>

<p>In the subseqent paragraphs, I&rsquo;ve laid out the different things about
KISS that stand out to me, and make using the system a lot more
enjoyable.</p>

<h2 id="the-package-system">the package system</h2>

<p>Packaging for KISS has been delightful, to say the least. It takes me
about 2 mins to write and publish a new package. Here&rsquo;s the <code>radare2</code>
package, which I maintain, for example.</p>

<p>The <code>build</code> file (executable):</p>

<pre><code class="language-sh">#!/bin/sh -e

./configure \
 --prefix=/usr

make
make DESTDIR=&quot;$1&quot; install
</code></pre>

<p>The <code>version</code> file:</p>

<pre><code>4.3.1 1
</code></pre>

<p>The <code>checksums</code> file (generated using <code>kiss checksum radare2</code>):</p>

<pre><code>4abcb9c9dff24eab44d64d392e115ae774ab1ad90d04f2c983d96d7d7f9476aa 4.3.1.tar.gz
</code></pre>

<p>And finally, the <code>sources</code> file:</p>

<pre><code>https://github.com/radareorg/radare2/archive/4.3.1.tar.gz
</code></pre>

<p>This is literally the bare minimum that you need to define a package.
There&rsquo;s also the <code>depends</code> file where you specify the dependencies for
your package.
<code>kiss</code> also generates a <code>manifests</code> file to track all the files and
directories that your package creates during installation, for their
removal, if and when that occurs. Now compare this process with any
other distribution&rsquo;s.</p>

<h2 id="the-community">the community</h2>

<p>As far as I know, it mostly
|
|||
|
|
</entry>
|
|||
|
|
<entry>
|
|||
|
|
<title>Introducing mael</title>
|
|||
|
|
<updated>2020-03-29T00:00:00Z</updated>
|
|||
|
|
<id>tag:icyphox.sh/,2020-03-29:blog/mael</id>
|
|||
|
|
<link href="https://icyphox.sh/blog/mael"></link>
|
|||
|
|
<summary type="html"><h2>An experimental mail client</h2>
<p><strong>Update</strong>: The code lives here: <a href="https://github.com/icyphox/mael" rel="nofollow">https://github.com/icyphox/mael</a></p>

<p>I&rsquo;ve been on the lookout for a good terminal-based email client since
forever, and I&rsquo;ve tried almost all of them. The one I use right now
sucks a little less&mdash;<a href="https://git.sr.ht/~sircmpwn/aerc" rel="nofollow">aerc</a>. I have
some gripes with it though, like the problem with outgoing emails not
getting copied to the Sent folder, and instead erroring out with
a cryptic <code>EOF</code>&mdash;that&rsquo;s literally all it says.
I&rsquo;ve tried mutt, but I find it a little excessive. It feels like the
weechat of email&mdash;to many features that you&rsquo;ll probably never use.</p>

<p>I need something clean and simple, less bloated (for the lack of
a better term). This is what motivated me to try writing my own. The
result of this (and not to mention, being holed up at home with nothing
better to do), is <strong>mael</strong>.<sup class="footnote-ref" id="fnref:oss"><a href="#fn:oss">1</a></sup></p>

<p>mael isn&rsquo;t like your usual TUI clients. I envision this to turn out
similar to mailx&mdash;a prompt-based UI. The reason behind this UX decision
is simple: it&rsquo;s easier for me to write. :)</p>

<p>Speaking of writing it, it&rsquo;s being written in a mix of Python and bash.
Why? Because Python&rsquo;s <code>email</code> and <code>mailbox</code> modules are fantastic, and
I don&rsquo;t think I want to parse Maildirs in bash. &ldquo;But why not pure
Python?&rdquo; Well, I&rsquo;m going to be shelling out a lot (more on this in a bit),
and writing interactive UIs in bash is a lot more intuitive, thanks to
some of the nifty features that later versions of bash have&mdash;<code>read</code>,
<code>mapfile</code> etc.</p>

<p>The reason I&rsquo;m shelling out is because two key components to this
client, that I haven&rsquo;t yet talked about&mdash;<code>mbsync</code> and <code>msmtp</code> are in
use, for IMAP and SMTP respectively. And <code>mbsync</code> uses the Maildir
format, which is why I&rsquo;m relying on Python&rsquo;s <code>mailbox</code> package. Why is
this in the standard library anyway?!</p>

<p>The architecture of the client is pretty interesting (and possibly very
stupid), but here&rsquo;s what happens:</p>

<ul>
<li>UI and prompt stuff in bash</li>
<li>emails are read using <code>less</code></li>
<li>email templates (RFC 2822) are parsed and generated in Python</li>
<li>this is sent to bash in STDOUT, like</li>
</ul>

<pre><code class="language-sh">msg=&quot;$(./mael-parser &quot;$maildir_message_path&quot;)&quot;
</code></pre>

<p>These kind of one-way (bash -&gt; Python) calls are what drive the entire
process. I&rsquo;m not sure what to think of it. Perhaps I might just give up
and write the entire thing in Python.
Or&hellip;I might just scrap this entirely and just shut up and use aerc.
I don&rsquo;t know yet. The code does seem to be growing in size rapidly. It&rsquo;s
about ~350 LOC in two days of writing (Python + bash). New problems
arise every now and then and it&rsquo;s pretty hard to keep track of all of
this. It&rsquo;ll be cool when it&rsquo;s all done though (I thi
|
|||
|
|
</entry>
|
|||
|
|
<entry>
|
|||
|
|
<title>COVID-19 disinformation</title>
|
|||
|
|
<updated>2020-03-15T00:00:00Z</updated>
|
|||
|
|
<id>tag:icyphox.sh/,2020-03-15:blog/covid19-disinfo</id>
|
|||
|
|
<link href="https://icyphox.sh/blog/covid19-disinfo"></link>
|
|||
|
|
<summary type="html"><h2>A lot of actors cashing in on the epidemic</h2>
<p>The virus spreads around the world, along with a bunch of disinformation
and potential malware / phishing campaigns. There are many actors,
pushing many narratives&mdash;some similar, some different.</p>

<p>Interestingly, the three big players in the information warfare
space&mdash;Russia, Iran and China seem to be running similar stories on
their state-backed media outlets. While they all tend to lean towards
the same, fairly anti-U.S. sentiments&mdash;that is, blaming the US for
weaponizing the crisis for political gain&mdash;Iran and Russia&rsquo;s content
come off as more&hellip;conspiratorial.
In essence, they claim that the COVID-19 virus is a &ldquo;bioweapon&rdquo;
developed by the U.S.</p>

<p>Russian news agency
<a href="https://twitter.com/RT_com/status/1233187558793924608" rel="nofollow">RT tweeted</a>:</p>

<blockquote>
<p>Show of hands, who isn&rsquo;t going to be surprised if it ever gets
revealed that #coronavirus is a bioweapon?</p>
</blockquote>

<p>RT also published
<a href="https://www.rt.com/usa/481485-coronavirus-russia-state-department/" rel="nofollow">an article</a>
mocking the U.S. for concerns over Russian disinformation.
Another article by RT,
<a href="https://www.rt.com/op-ed/481831-coronavirus-kill-bill-capitalism-communism/" rel="nofollow">an op-ed</a>
suggests the virus&rsquo; impact on financial markets might bring about the
reinvention of communism and the end of the global capitalist system.
Russian state-sponsored media can also be seen amplifying Iranian
conspiracy theories&mdash;including the Islamic Revolutionary Guard Corps&rsquo;
(IRGC) suggestion that COVID-19
<a href="https://www.rt.com/news/482405-iran-coronavirus-us-biological-weapon/" rel="nofollow">is a U.S. bioweapon</a>.</p>

<p>Iranian media outlets appear to be running stories having similar
themese, as well. Here&rsquo;s one
<a href="https://www.presstv.com/Detail/2020/03/05/620217/US-coronavirus-James-Henry-Fetzer" rel="nofollow">by PressTV</a>,
where they very boldly claim that the virus was developed by
the U.S. and/or Isreal, to use as a bioweapon against Iran. Another
<a href="https://www.presstv.com/Detail/2020/03/05/620213/Coronavirus-was-produced-in-a-laboratory" rel="nofollow">nonsensical piece</a>
by PressTV suggests that
&ldquo;there are components of the virus that are related to HIV that could not have occurred naturally&rdquo;.
The same article pushes another theory:</p>

<blockquote>
<p>There has been some speculation that as the Trump Administration has
been constantly raising the issue of growing Chinese global
competitiveness as a direct threat to American national security and
economic dominance, it might be possible that Washington has created
and unleashed the virus in a bid to bring Beijing’s growing economy
and military might down a few notches. It is, to be sure, hard to
believe that even the Trump White House would do something so
reckless, but there are precedents for that type of behavior</p>
</blockquote>

<p>These &ldquo;theories&rdquo;, as is evident, are getting wilder and wilder.</p>

<p>Unsurprisingly, China produces the most amount of content related to the
coronavirus, but they&rsquo;re quite distinct in comparison to Russian and
Iranian media. The general theme behind Chinese narratives is
critisizing the West for&hellip;a lot of things.</p>

<p>Global Times claims that

|
|||
|
|
</entry>
|
|||
|
|
<entry>
|
|||
|
|
<title>Nullcon 2020</title>
|
|||
|
|
<updated>2020-03-09T00:00:00Z</updated>
|
|||
|
|
<id>tag:icyphox.sh/,2020-03-09:blog/nullcon-2020</id>
|
|||
|
|
<link href="https://icyphox.sh/blog/nullcon-2020"></link>
|
|||
|
|
<summary type="html"><h2>An opinion-filled review of Nullcon Goa, 2020</h2>
<p><strong>Disclaimer</strong>: Political.</p>

<p>This year&rsquo;s conference was at the Taj Hotel and Convention center, Dona
Paula, and its associated party at Cidade de Goa, also by Taj.
Great choice of venue, perhaps even better than last time. The food was
fine, the views were better.</p>

<p>With <em>those</em> things out of the way&mdash;let&rsquo;s talk talks. I think
I preferred the panels to the talks&mdash;I enjoy a good, stimulating
discussion as opposed to only half-understanding a deeply technical
talk&mdash;but that&rsquo;s just me. But there was this one talk that I really
enjoyed, perhaps due to its unintended comedic value; I&rsquo;ll get into that
later.</p>

<p>The list of panels/talks I attended in order:</p>

<p><strong>Day 1</strong></p>

<ul>
<li>Keynote: The Metadata Trap by Micah Lee (Talk)</li>
<li>Securing the Human Factor (Panel)</li>
<li>Predicting Danger: Building the Ideal Threat Intelligence Model (Panel)</li>
<li>Lessons from the Cyber Trenches (Panel)</li>
<li>Mlw 41#: a new sophisticated loader by APT group TA505 by Alexey Vishnyakov (Talk)</li>
<li>Taking the guess out of Glitching by Adam Laurie (Talk)</li>
<li>Keynote: Cybersecurity in India&mdash;Information Assymetry, Cross Border
Threats and National Sovereignty by Saumil Shah (Talk)</li>
</ul>

<p><strong>Day 2</strong></p>

<ul>
<li>Keynote: Crouching hacker, killer robot? Removing fear from
cyber-physical security by Stefano Zanero (Talk)</li>
<li>Supply Chain Security in Critical Infrastructure Systems (Panel)</li>
<li>Putting it all together: building an iOS jailbreak from scratch by
Umang Raghuvanshi (Talk)</li>
<li>Hack the Law: Protection for Ethical Cyber Security Research in India
(Panel)</li>
</ul>

<h2 id="re-closing-keynote">Re: Closing keynote</h2>

<p>I wish I could link the talk, but it hasn&rsquo;t been uploaded just yet. I&rsquo;ll
do it once it has. So, I&rsquo;ve a few comments I&rsquo;d like to make on some of
Saumil&rsquo;s statements.</p>

<p>He proposed that the security industry trust the user more, and let them
make the decisions pertaining to personal security / privacy.
Except&hellip;that&rsquo;s just not going to happen. If all users were capable
of making good, security-first choices&mdash;we as an industry don&rsquo;t
need to exist. But that is unfortunately not the case.
Users are dumb. They value convenience and immediacy over
security. That&rsquo;s the sad truth of the modern age.</p>

<p>Another thing he proposed was that the Indian Government build our own
&ldquo;Military Grade&rdquo; and &ldquo;Consumer Grade&rdquo; encryption.</p>

<p><em>&hellip;what?</em></p>

<p>A &ldquo;security professional&rdquo; suggesting that we roll our own crypto? What
even. Oh and, to top it off&mdash;when
<a href="https://twitter.com/tame_wildcard" rel="nofollow">Raman</a>, very rightly countered
saying that the biggest opponent to encryption <em>is</em> the Government, and
trusting them to build safe cryptosystems is probably not wise, he
responded by saying something to the effect of &ldquo;Eh, who cares? If they
want to backdoor it, let them.&rdquo;</p>

<p>Bruh moment.</p>

<p>He also had some interesting thing
|
|||
|
|
</entry>
|
|||
|
|
<entry>
|
|||
|
|
<title>Setting up Prosody for XMPP</title>
|
|||
|
|
<updated>2020-02-18T00:00:00Z</updated>
|
|||
|
|
<id>tag:icyphox.sh/,2020-02-18:blog/prosody</id>
|
|||
|
|
<link href="https://icyphox.sh/blog/prosody"></link>
|
|||
|
|
<summary type="html"><h2>I setup Prosody yesterday—here's how I did it</h2>
<p>Remember the <a href="/blog/irc-for-dms/">IRC for DMs</a> article I wrote a while
back? Well&hellip;it&rsquo;s safe to say that IRC didn&rsquo;t hold up too well. It first
started with the bot. Buggy code, crashed a lot&mdash;we eventually gave up
and didn&rsquo;t bring the bot back up. Then came the notifications, or lack
thereof. Revolution IRC has a bug where your custom notification rules
just get ignored after a while. In my case, this meant that
notifications for <code>#crimson</code> stopped entirely. Unless, of course, Nerdy
pinged me each time.</p>

<p>Again, none of these problems are inherent to IRC itself. IRC is
fantastic, but perhaps wasn&rsquo;t the best fit for our usecase. I still do
use IRC though, just not for 1-on-1 conversations.</p>

<h2 id="why-xmpp">Why XMPP?</h2>

<p>For one, it&rsquo;s better suited for 1-on-1 conversations. It also has
support for end-to-end encryption (via OMEMO), something IRC doesn&rsquo;t
have.<sup class="footnote-ref" id="fnref:otr"><a href="#fn:otr">1</a></sup> Also, it isn&rsquo;t centralized (think: email).</p>

<h2 id="so-prosody">So&hellip;Prosody</h2>

<p><a href="https://prosody.im" rel="nofollow">Prosody</a> is an XMPP server. Why did I choose this
over ejabberd, OpenFire, etc.? No reason, really. Their website looked
cool, I guess.</p>

<h3 id="installing">Installing</h3>

<p>Setting it up was pretty painless (I&rsquo;ve <a href="/blog/mailserver">experienced
worse</a>). If you&rsquo;re on a Debian-derived system, add:</p>

<pre><code># modify according to your distro
deb https://packages.prosody.im/debian buster main 
</code></pre>

<p>to your <code>/etc/apt/sources.list</code>, and:</p>

<pre><code># apt update
# apt install prosody
</code></pre>

<h3 id="configuring">Configuring</h3>

<p>Once installed, you will find the config file at
<code>/etc/prosody/prosody.cfg.lua</code>. Add your XMPP user (we will make this
later), to the <code>admins = {}</code> line.</p>

<pre><code>admins = {&quot;user@chat.example.com&quot;}
</code></pre>

<p>Head to the <code>modules_enabled</code> section, and add this to it:</p>

<pre><code>modules_enabled = {
 &quot;posix&quot;;
 &quot;omemo_all_access&quot;;
...
 -- uncomment these
 &quot;groups&quot;;
 &quot;mam&quot;;
 -- and any others you think you may need
}
</code></pre>

<p>We will install the <code>omemo_all_access</code> module later.</p>

<p>Set <code>c2s_require_encryption</code>, <code>s2s_require_encryption</code>, and
<code>s2s_secure_auth</code> to <code>true</code>.
Set the <code>pidfile</code> to <code>/tmp/prosody.pid</code> (or just leave it as default?).</p>

<p>By default, Prosody stores passwords in plain-text, so fix that by
setting <code>authentication</code> to <code>&quot;internal_hashed&quot;</code></p>

<p>Head to the <code>VirtualHost</code> section, and add your vhost. Right above it,
set the path to the HTTPS certificate and key:</p>

<pre><code>certificates = &quot;certs&
|
|||
|
|
</entry>
|
|||
|
|
<entry>
|
|||
|
|
<title>Status update</title>
|
|||
|
|
<updated>2020-01-18T00:00:00Z</updated>
|
|||
|
|
<id>tag:icyphox.sh/,2020-01-18:blog/2020-01-18</id>
|
|||
|
|
<link href="https://icyphox.sh/blog/2020-01-18"></link>
|
|||
|
|
<summary type="html"><h2>New year…new stuff?</h2>
<p>It&rsquo;s only been a two weeks since I got back to campus, and we&rsquo;ve
<em>already</em> got our first round of cycle tests starting this Tuesday.
Granted, I returned a week late, but&hellip;that&rsquo;s nuts!</p>

<p>We&rsquo;re two whole weeks into 2020; I should&rsquo;ve been working on something
status update worthy, right? Not really, but we&rsquo;ll see.</p>

<h2 id="no-more-cloudflare">No more Cloudflare!</h2>

<p>Yep. If you weren&rsquo;t aware&mdash;pre-2020 this site was behind Cloudflare
SSL and their DNS. I have since migrated off it to
<a href="https://he.net" rel="nofollow">he.net</a>, thanks to highly upvoted Lobste.rs comment.
Because of this switch, I infact, learnt a ton about DNS.</p>

<p>Migrating to HE was very painless, but I did have to research a lot
about PTR records&mdash;Cloudflare kinda dumbs it down. In my case, I had to
rename my DigitalOcean VPS instance to the FQDN, which then
automagically created a PTR record at DO&rsquo;s end.</p>

<h2 id="i-dropped-icyrc">I dropped icyrc</h2>

<p>The IRC client I was working on during the end of last
December--early-January? Yeah, I lost interest. Apparently writing C and
ncurses isn&rsquo;t very fun or stimulating.</p>

<p>This also means I&rsquo;m back on weechat. Until I find another client that
plays well with ZNC, that is.</p>

<h2 id="kiss-stuff">KISS stuff</h2>

<p>I now maintain two new packages in the KISS community repository&mdash;2bwm
and aerc! The KISS package system is stupid simple to work with. Creating
packages has never been easier.</p>

<h2 id="icyphox-sh-friends-friends"><a href="/friends">icyphox.sh/friends</a></h2>

<p>Did you notice that yet? I&rsquo;ve been curating a list of people I know IRL
and online, and linking to their online presence. This is like a webring
of sorts, and promotes inter-site traffic&mdash;making the web more &ldquo;web&rdquo;
again.</p>

<p>If you know me, feel free to <a href="/about#contact">hit me up</a> and I&rsquo;ll link
your site too! My apologies if I&rsquo;ve forgotten your name.</p>

<h2 id="patreon">Patreon!</h2>

<p>Is this big news? I dunno, but yes&mdash;I now have a Patreon. I figured I&rsquo;d
cash in on the newfound traffic my site&rsquo;s been getting. There won&rsquo;t be
any exclusive content or any tiers or whatever. Nothing will change.
Just a place for y&rsquo;all to toss me some $$$ if you wish to do so. ;)</p>

<p>Oh, and it&rsquo;s at <a href="https://patreon.com/icyphox" rel="nofollow">patreon.com/icyphox</a>.</p>

<h2 id="misc">Misc.</h2>

<p>The Stormlight Archive is likely the <em>best</em> epic I have ever read till
date. I&rsquo;m still not done yet; about 500 odd pages to go as of this
writing. But wow, Brandon really does know how to build worlds and magic
systems. I cannot wait to read all about the
<a href="https://coppermind.net/wiki/Cosmere" rel="nofollow">cosmere</a>.</p>

<p>I have also been working out for the past month or so. I can see them
gainzzz. I plan to keep track of my progress, I just don&rsquo;t know how to
quantify it. Perhaps I&rsquo;ll log the number of reps × sets I do each time,
and with what weights. I can then look back to see if either the weights
have increased since, or the number of re
|
|||
|
|
</entry>
|
|||
|
|
<entry>
|
|||
|
|
<title>Vimb&#58; my Firefox replacement</title>
|
|||
|
|
<updated>2020-01-16T00:00:00Z</updated>
|
|||
|
|
<id>tag:icyphox.sh/,2020-01-16:blog/mnml-browsing</id>
|
|||
|
|
<link href="https://icyphox.sh/blog/mnml-browsing"></link>
|
|||
|
|
<summary type="html"><h2>Web browsing, suckless style</h2>
<p>After having recently installed <a href="https://getkiss.org" rel="nofollow">KISS</a>, and
building Firefox from source, I was exposed to the true monstrosity that
Firefox&mdash;and web browsers in general&mdash;is. It took all of 9 hours to
build the dependencies and then Firefox itself.</p>

<p>Sure, KISS now ships Firefox binaries in the
<a href="https://github.com/kisslinux/repo/tree/master/extra/firefox-bin" rel="nofollow">firefox-bin</a>
package; I decided to get rid of that slow mess anyway.</p>

<h2 id="enter-vimb">Enter vimb</h2>

<p><a href="https://fanglingsu.github.io/vimb/" rel="nofollow">vimb</a> is a browser based on
<a href="https://webkitgtk.org/" rel="nofollow">webkit2gtk</a>, with a Vim-like interface.
<code>webkit2gtk</code> builds in less than a minute&mdash;it blows Firefox out of
the water, on that front.</p>

<p>There isn&rsquo;t much of a UI to it&mdash;if you&rsquo;ve used Vimperator/Pentadactyl
(Firefox plugins), vimb should look familiar to you.
It can be configured via a <code>config.h</code> or a text based config file at
<code>~/.config/vimb/config</code>.
Each &ldquo;tab&rdquo; opens a new instance of vimb, in a new window but this can
get messy really fast if you have a lot of tabs open.</p>

<h2 id="enter-tabbed">Enter tabbed</h2>

<p><a href="https://tools.suckless.org/tabbed/" rel="nofollow">tabbed</a> is a tool to <em>embed</em> X apps
which support xembed into a tabbed UI. This can be used in conjunction
with vimb, like so:</p>

<pre><code>tabbed vimb -e
</code></pre>

<p>Where the <code>-e</code> flag is populated with the <code>XID</code>, by tabbed. Configuring
Firefox-esque keybinds in tabbed&rsquo;s <code>config.h</code> is relatively easy. Once
that&rsquo;s done&mdash;voilà! A fairly sane, Vim-like browsing experience that&rsquo;s
faster and has a smaller footprint than Firefox.</p>

<h2 id="ad-blocking">Ad blocking</h2>

<p>Ad blocking support isn&rsquo;t built-in and there is no plugin system
available. There are two options for ad blocking:</p>

<ol>
<li><a href="https://github.com/jun7/wyebadblock" rel="nofollow">wyebadblock</a></li>
<li><code>/etc/hosts</code></li>
</ol>

<h2 id="caveats">Caveats</h2>

<p><em>Some</em> websites tend to not work because they detect vimb as an older
version of Safari (same web engine). This is a minor inconvenience, and
not a dealbreaker for me. I also cannot login to Google&rsquo;s services for
some reason, which is mildly annoying, but it&rsquo;s good in a way&mdash;I am now
further incentivised to dispose of my Google account.</p>

<p>And here&rsquo;s the screenshot y&rsquo;all were waiting for:</p>

<p><img src="https://cdn.icyphox.sh/d03i0.png" alt="" /></p>
</summary>
|
|||
|
|
</entry>
|
|||
|
|
<entry>
|
|||
|
|
<title>Five days in a TTY</title>
|
|||
|
|
<updated>2020-01-13T00:00:00Z</updated>
|
|||
|
|
<id>tag:icyphox.sh/,2020-01-13:blog/five-days-tty</id>
|
|||
|
|
<link href="https://icyphox.sh/blog/five-days-tty"></link>
|
|||
|
|
<summary type="html"><h2>I installed KISS Linux</h2>
<p>This new semester has been pretty easy on me, so far. I hardly every
have any classes (again, so far), and I&rsquo;ve a ton of free time on my
hands. This calls for&mdash;yep&mdash;a distro hop!</p>

<h2 id="why-kiss">Why KISS?</h2>

<p><a href="https://getkiss.org" rel="nofollow">KISS</a> has been making rounds on the interwebz lately.<sup class="footnote-ref" id="fnref:hn"><a href="#fn:hn">1</a></sup>
The Hacker News post spurred <em>quite</em> the discussion. But then again,
that is to be expected from Valleybros who use macOS all day. :^)</p>

<p>From the website,</p>

<blockquote>
<p>An independent Linux® distribution with a focus on simplicity and the
concept of “less is more”. The distribution targets <em>only</em> the x86&ndash;64
architecture and the English language.</p>
</blockquote>

<p>Like many people did in the HN thread, &ldquo;simplicity&rdquo; here is not to be
confused with &ldquo;ease&rdquo;. It is instead, simplicity in terms of lesser and
cleaner code&mdash;no
<a href="https://www.urbandictionary.com/define.php?term=poetterware" rel="nofollow">Poetterware</a>.</p>

<p>This, I can get behind. A clean system with less code is like a clean
table. It&rsquo;s nice to work on. It also implies security to a certain
extent since there&rsquo;s a smaller attack surface.</p>

<p>The <a href="https://github.com/kisslinux/kiss" rel="nofollow"><code>kiss</code></a> package manager is written
is pure POSIX sh, and does <em>just enough</em>. Packages are compiled from
source and <code>kiss</code> automatically performs dependency resolution. Creating
packages is ridiculously easy too.</p>

<p>Speaking of packages, all packages&mdash;both official &amp; community
repos&mdash;are run through <code>shellcheck</code> before getting merged. This is
awesome; I don&rsquo;t think this is done in any other distro.</p>

<p>In essence, KISS sucks less.</p>

<h2 id="installing-kiss">Installing KISS</h2>

<p>The <a href="https://getkiss.org/pages/install" rel="nofollow">install guide</a> is very easy to
follow. Clear instructions that make it hard to screw up; that didn&rsquo;t
stop me from doing so, however.</p>

<h3 id="day-1">Day 1</h3>

<p>Although technically not in a TTY, it was still not <em>in</em> the KISS
system&mdash;I&rsquo;ll count it. I&rsquo;d compiled the kernel in the chroot and
decided to use <code>efibootmgr</code> instead of GRUB. <code>efibootmgr</code> is a neat tool
to modify the Intel Extensible Firmware Interface (EFI). Essentially,
you boot the <code>.efi</code> directly as opposed to choosing which boot entry
you want to boot, through GRUB. Useful if you have just one OS on the
system. Removes one layer of abstraction.</p>

<p>Adding a new EFI entry is pretty easy. For me, the command was:</p>

<pre><code>efibootmgr --create 
 --disk /dev/nvme0n1 \
 --part 1 \
 --label KISS Linux \
 --loader /vmlinuz
 --unicode 'root=/dev/nvme0n1p3 rw' # kernel parameters
</code></pre>

<p>Mind you, this didn&rsquo;t work the first time, or the second, or the
third &hellip; a bunch of trial and error (and asking on <code>
|
|||
|
|
</entry>
|
|||
|
|
<entry>
|
|||
|
|
<title>2019 in review</title>
|
|||
|
|
<updated>2020-01-02T00:00:00Z</updated>
|
|||
|
|
<id>tag:icyphox.sh/,2020-01-02:blog/2019-in-review</id>
|
|||
|
|
<link href="https://icyphox.sh/blog/2019-in-review"></link>
|
|||
|
|
<summary type="html"><h2>A look back at last year</h2>
<p>Just landed in a rainy Chennai, back in campus for my 6th semester.
A little late to the &ldquo;year in review blog post&rdquo; party; travel took up
most of my time. Last year was pretty eventful (at least in my books),
and I think I did a bunch of cool stuff&mdash;let&rsquo;s see!</p>

<h2 id="interning-at-securelayer7">Interning at SecureLayer7</h2>

<p>Last summer, I interned at <a href="https://securelayer7.net" rel="nofollow">SecureLayer7</a>,
a security consulting firm in Pune, India. My work was mostly in
hardware and embededded security research. I learnt a ton about ARM and
MIPS reversing and exploitation, UART and JTAG, firmware RE and
enterprise IoT security.</p>

<p>I also earned my first CVE! I&rsquo;ve written about it in detail
<a href="/blog/fb50">here</a>.</p>

<h2 id="conferences">Conferences</h2>

<p>I attended two major conferences last year&mdash;Nullcon Goa and PyCon
India. Both super fun experiences and I met a ton of cool people!
<a href="https://twitter.com/icyphox/status/1101022604851212288" rel="nofollow">Nullcon Twitter thread</a>
and <a href="/blog/pycon-wrap-up">PyCon blog post</a>.</p>

<h2 id="talks">Talks</h2>

<p>I gave two talks last year:</p>

<ol>
<li><em>Intro to Reverse Engineering</em> at Cyware 2019</li>
<li><em>&ldquo;Smart lock? Nah dude.&rdquo;</em> at PyCon India</li>
</ol>

<h2 id="things-i-made">Things I made</h2>

<p>Not in order, because I CBA:</p>

<ul>
<li><a href="https://github.com/icyphox/repl" rel="nofollow">repl</a>: More of a quick bash hack,
I don&rsquo;t really use it.</li>
<li><a href="https://github.com/icyphox/pw" rel="nofollow">pw</a>: A password manager. This,
I actually do use. I&rsquo;ve even written a tiny
<a href="https://github.com/icyphox/dotfiles/blob/master/bin/pwmenu.sh" rel="nofollow"><code>dmenu</code> wrapper</a>
for it.</li>
<li><a href="https://github.com/icyphox/twsh" rel="nofollow">twsh</a>: An incomplete twtxt client,
in bash. I have yet to get around to finishing it.</li>
<li><a href="https://github.com/icyphox/alpine" rel="nofollow">alpine ports</a>: My APKBUILDs for
Alpine.</li>
<li><a href="https://github.com/icyphox/detotated" rel="nofollow">detotated</a>: An IRC bot written
in Python. See <a href="/blog/irc-for-dms">IRC for DMs</a>.</li>
<li><a href="https://github.com/icyphox/icyrc" rel="nofollow">icyrc</a>: A no bullshit IRC client,
because WeeChat is bloat.</li>
</ul>

<p>I probably missed something, but whatever.</p>

<h2 id="blog-posts">Blog posts</h2>

<pre><code>$ ls -1 pages/blog/*.md | wc -l
20
</code></pre>

<p>So excluding today&rsquo;s post, and <code>_index.md</code>, that&rsquo;s 18 posts! I had
initially planned to write one post a month, but hey, this is great. My
plan for 2020 is to write one post a <em>week</em>&mdash;unrealistic, I know, but
I will try nevertheless.</p>

<p>I wrote about a bunch of things, ranging from programming to
return-oriented-programming (heh), sysadmin and security stuff, and
a hint of culture
|
|||
|
|
</entry>
|
|||
|
|
<entry>
|
|||
|
|
<title>Disinfo war&#58; RU vs GB</title>
|
|||
|
|
<updated>2019-12-12T00:00:00Z</updated>
|
|||
|
|
<id>tag:icyphox.sh/,2019-12-12:blog/ru-vs-gb</id>
|
|||
|
|
<link href="https://icyphox.sh/blog/ru-vs-gb"></link>
|
|||
|
|
<summary type="html"><h2>A look at Russian info ops against Britain</h2>
<p>This entire sequence of events begins with the attempted poisoning of
Sergei Skripal<sup class="footnote-ref" id="fnref:skripal"><a href="#fn:skripal">1</a></sup>, an ex-GRU officer who was a double-agent for
the UK&rsquo;s intelligence services. This hit attempt happened on the 4th of
March, 2018. 8 days later, then-Prime Minister Theresa May formally
accused Russia for the attack.</p>

<p>The toxin used in the poisoning was a nerve agent called <em>Novichok</em>.
In addition to the British military-research facility at Porton Down,
a small number of labs around the world were tasked with confirming
Porton Down&rsquo;s conclusions on the toxin that was used, by the OPCW
(Organisation for the Prohibition of Chemical Weapons).</p>

<p>With the background on the matter out of the way, here are the different
instances of well timed disinformation pushed out by Moscow.</p>

<h2 id="the-russian-offense">The Russian offense</h2>

<h3 id="april-14-2018">April 14, 2018</h3>

<ul>
<li>RT published an article claiming that Spiez had identified a different
toxin&mdash;BZ, and not Novichok.</li>
<li>This was an attempt to shift the blame from Russia (origin of Novichok),
to NATO countries, where it was apparently in use.</li>
<li>Most viral piece on the matter in all of 2018.</li>
</ul>

<p>Although technically correct, this isn&rsquo;t the entire truth. As part of
protocol, the OPCW added a new substance to the sample as a test. If any
of the labs failed to identify this substance, their findings were
deemed untrustworthy. This toxin was a derivative of BZ.</p>

<p>Here are a few interesting things to note:</p>

<ol>
<li>The entire process starting with the OPCW and the labs is top-secret.
How did Russia even know Speiz was one of the labs?</li>
<li>On April 11th, the OPCW mentioned BZ in a report confirming Porton
Down&rsquo;s findings. Note that Russia is a part of OPCW, and are fully
aware of the quality control measures in place. Surely they knew
about the reason for BZ&rsquo;s use?</li>
</ol>

<p>Regardless, the Russian version of the story spread fast. They cashed in
on two major factors to plant this disinfo:</p>

<ol>
<li>&ldquo;NATO bad&rdquo; : Overused, but surprisingly works. People love a story
that goes full 180°.</li>
<li>Spiez can&rsquo;t defend itself: At the risk of revealing that it was one
of the facilities testing the toxin, Spiez was only able to &ldquo;not
comment&rdquo;.</li>
</ol>

<h3 id="april-3-2018">April 3, 2018</h3>

<ul>
<li>The Independent publishes a story based on an interview with the chief
executive of Porton Down, Gary Aitkenhead.</li>
<li>Aitkenhead says they&rsquo;ve identified Novichok but &ldquo;have not identified
the precise source&rdquo;.</li>
<li>Days earlier, Boris Johnson (then-Foreign Secretary) claimed that
Porton Down confirmed the origin of the toxin to be Russia.</li>
<li>This discrepancy was immediately promoted by Moscow, and its network
all over.</li>
</ul>

<p>This one is especially interesting because of how <em>simple</em> it is to
exploit a small contradiction, that could&rsquo;ve been an honest mistake.
This episode is also interesting because the British actually attempted
damage control this time. Porton Down tried to clarify Aitkenhead&rsquo;s
statem
|
|||
|
|
</entry>
|
|||
|
|
<entry>
|
|||
|
|
<title>Instagram OPSEC</title>
|
|||
|
|
<updated>2019-12-02T00:00:00Z</updated>
|
|||
|
|
<id>tag:icyphox.sh/,2019-12-02:blog/ig-opsec</id>
|
|||
|
|
<link href="https://icyphox.sh/blog/ig-opsec"></link>
|
|||
|
|
<summary type="html"><h2>Operational security for the average zoomer</h2>
<p>Which I am not, of course. But seeing as most of my peers are, I am
compelled to write this post. Using a social platform like Instagram
automatically implies that the user understands (to some level) that
their personally identifiable information is exposed publicly, and they
sign up for the service understanding this risk&mdash;or I think they do,
anyway. But that&rsquo;s about it, they go ham after that. Sharing every nitty
gritty detail of their private lives without understanding the potential
risks of doing so.</p>

<p>The fundamentals of OPSEC dictacte that you develop a threat model, and
Instgrammers are <em>obviously</em> incapable of doing that&mdash;so I&rsquo;ll do it
for them.</p>

<h2 id="your-average-instagrammer-s-threat-model">Your average Instagrammer&rsquo;s threat model</h2>

<p>I stress on the word &ldquo;average&rdquo;, as in this doesn&rsquo;t apply to those with
more than a couple thousand followers. Those type of accounts inherently
face different kinds of threats&mdash;those that come with having
a celebrity status, and are not in scope of this analysis.</p>

<ul>
<li><strong>State actors</strong>: This doesn&rsquo;t <em>really</em> fit into our threat model,
since our target demographic is simply not important enough. That said,
there are select groups of individuals that operate on
Instagram<sup class="footnote-ref" id="fnref:ddepisode"><a href="#fn:ddepisode">1</a></sup>, and they can potentially be targetted by a state
actor.</li>
</ul>

<ul>
<li><p><strong>OSINT</strong>: This is probably the biggest threat vector, simply because
of the amount of visual information shared on the platform. A lot can be
gleaned from one simple picture in a nondescript alleyway. We&rsquo;ll get
into this in the DOs and DON&rsquo;Ts in a bit.</p></li>

<li><p><strong>Facebook &amp; LE</strong>: Instagram is the last place you want to be doing an
illegal, because well, it&rsquo;s logged and more importantly&mdash;not
end-to-end encrypted. Law enforcement can subpoena any and all account
information. Quoting Instagram&rsquo;s
<a href="https://help.instagram.com/494561080557017" rel="nofollow">page on this</a>:</p></li>
</ul>

<blockquote>
<p>a search warrant issued under the procedures described in the Federal
Rules of Criminal Procedure or equivalent state warrant procedures
upon a showing of probable cause is required to compel the disclosure
of the stored contents of any account, which may include messages,
photos, comments, and location information.</p>
</blockquote>

<p>That out of the way, here&rsquo;s a list of DOs and DON&rsquo;Ts to keep in mind
while posting on Instagram.</p>

<h3 id="don-ts">DON&rsquo;Ts</h3>

<ul>
<li><p>Use Instagram for planning and orchestrating illegal shit! I&rsquo;ve
explained why this is a terrible idea above. Use secure comms&mdash;even
WhatsApp is a better choice, if you have nothing else. In fact, try
avoiding IG DMs altogether, use alternatives that implement E2EE.</p></li>

<li><p>Film live videos outside. Or try not to, if you can. You might
unknowingly include information about your location: street signs,
shops etc. These can be used to ascertain your current location.</p></li>

<li><p>Film live videos in places you visit often. This compromises your&
|
|||
|
|
</entry>
|
|||
|
|
<entry>
|
|||
|
|
<title>Save .ORG!</title>
|
|||
|
|
<updated>2019-11-23T00:00:00Z</updated>
|
|||
|
|
<id>tag:icyphox.sh/,2019-11-23:blog/save-org</id>
|
|||
|
|
<link href="https://icyphox.sh/blog/save-org"></link>
|
|||
|
|
<summary type="html"><h2>PIR is getting sold to a private firm, and here's why it's bad</h2>
<p>The .ORG top-level domain introduced in 1985, has been operated by the
<a href="https://en.wikipedia.org/wiki/Public_Interest_Registry" rel="nofollow">Public Interest
Registry</a> since
2003.</p>

<p>The .ORG TLD is used primarily by communities, free and open source
projects, and other non-profit organizations&mdash;although the use of the
TLD isn&rsquo;t restricted to non-profits.</p>

<p>The Internet Society or ISOC, the group that created the PIR, has
decided to sell the registry over to a private equity firm&mdash;Ethos
Capital.</p>

<h2 id="what-s-the-problem">What&rsquo;s the problem?</h2>

<p>There are around 10 million .ORG TLDs registered, and a good portion of
them are non-profits and non-governmental organizations. As the name
suggests, they don&rsquo;t earn any profits and all their operations rely on
a thin inflow of donations. A private firm having control of the .ORG
domain gives them the power to make decisions that would be unfavourable
to the .ORG community:</p>

<ul>
<li><p>They control the registration/renewal fees of the TLD. They can
hike the price if they wish to. As is stands, NGOs already earn very
little&mdash;a .ORG price hike would put them in a very icky situation.</p></li>

<li><p>They can introduce <a href="https://www.icann.org/resources/pages/rpm-drp-2017-10-04-en" rel="nofollow">Rights Protection
Mechanisms</a>
or RPMs, which are essentially legal statements that can&mdash;if not
correctly developed&mdash;jeopardize / censor completely legal non-profit
activities.</p></li>

<li><p>Lastly, they can suspend domains at the whim of state actors. It isn&rsquo;t
news that nation states go after NGOs, targetting them with allegations
of illegal activity. The registry being a private firm only simplifies
the process.</p></li>
</ul>

<p>Sure, these are just &ldquo;what ifs&rdquo; and speculations, but the risk is real.
Such power can be abused and this would be severly detrimental to NGOs
globally.</p>

<h2 id="how-can-i-help">How can I help?</h2>

<p>We need to get the ISOC to <strong>stop the sale</strong>. Head over to
<a href="https://savedotorg.org" rel="nofollow">https://savedotorg.org</a> and sign their letter. An email is sent on your
behalf to:</p>

<ul>
<li>Andrew Sullivan, CEO, ISOC</li>
<li>Jon Nevett, CEO, PIR</li>
<li>Maarten Botterman, Board Chair, ICANN</li>
<li>Göran Marby, CEO, ICANN</li>
</ul>

<h2 id="closing-thoughts">Closing thoughts</h2>

<p>The Internet that we all love and care for is slowly being subsumed by
megacorps and private firms, who&rsquo;s only motive is to make a profit. The
Internet was meant to be free, and we&rsquo;d better act now if we want that
freedom. The future looks bleak&mdash;I hope we aren&rsquo;t too late.</p>
</summary>
|
|||
|
|
</entry>
|
|||
|
|
<entry>
|
|||
|
|
<title>Status update</title>
|
|||
|
|
<updated>2019-11-16T00:00:00Z</updated>
|
|||
|
|
<id>tag:icyphox.sh/,2019-11-16:blog/2019-11-16</id>
|
|||
|
|
<link href="https://icyphox.sh/blog/2019-11-16"></link>
|
|||
|
|
<summary type="html"><h2>Exams, stuff, etc.</h2>
<p>This month is mostly just unfun stuff, lined up in a neat schedule&mdash;exams. I get all these cool ideas for things to do, and it&rsquo;s always
during exams. Anyway, here&rsquo;s a quick update on what I&rsquo;ve been up to.</p>

<h2 id="blog-post-queue">Blog post queue</h2>

<p>I realized that I could use this site&rsquo;s
<a href="https://github.com/icyphox/site" rel="nofollow">repo</a>&rsquo;s issues to track blog post ideas.
I&rsquo;ve made a few, mostly just porting them over from my Google Keep note.</p>

<p>This method of using issues is great, because readers can chime in with
ideas for things I could possibly discuss&mdash;like in <a href="https://github.com/icyphox/site/issues/10" rel="nofollow">this
issue</a>.</p>

<h2 id="contemplating-a-vite-rewrite">Contemplating a <code>vite</code> rewrite</h2>

<p><a href="https://github.com/icyphox/vite" rel="nofollow"><code>vite</code></a>, despite what the name suggests
-- is awfully slow. Also, Python is bloat.
Will rewriting it fix that? That&rsquo;s what I plan to find out. I have
a couple of choices of languages to use in the rewrite:</p>

<ul>
<li>C: Fast, compiled. Except I suck at it. (<code>cite</code>?)</li>
<li>Nim: My favourite, but I&rsquo;ll have to write bindings to <a href="https://github.com/kristapsdz/lowdown" rel="nofollow"><code>lowdown(1)</code></a>. (<code>nite</code>?)</li>
<li>Shell: Another favourite, muh &ldquo;minimalsm&rdquo;. No downside, really.
(<code>shite</code>?)</li>
</ul>

<p>Oh, and did I mention&mdash;I want it to be compatible with <code>vite</code>.
I don&rsquo;t want to have to redo my site structure or its templates. At the
moment, I rely on Jinja2 for templating, so I&rsquo;ll need something similar.</p>

<h2 id="irc-bot">IRC bot</h2>

<p>My earlier post on <a href="/blog/irc-for-dms">IRC for DMs</a> got quite a bit of
traction, which was pretty cool. I didn&rsquo;t really talk much about the bot
itself though; I&rsquo;m dedicating this section to
<a href="https://github.com/icyphox/detotated" rel="nofollow">detotated</a>.<sup class="footnote-ref" id="fnref:1"><a href="#fn:1">1</a></sup></p>

<p>Fairly simple Python code, using plain sockets. So far, we&rsquo;ve got a few
basic features in place:</p>

<ul>
<li><code>.np</code> command: queries the user&rsquo;s last.fm to get the currently playing
track</li>
<li>Fetches the URL title, when a URL is sent in chat</li>
</ul>

<p>That&rsquo;s it, really. I plan to add a <code>.nps</code>, or &ldquo;now playing Spotify&rdquo;
command, since we share Spotify links pretty often.</p>

<h2 id="other">Other</h2>

<p>I&rsquo;ve been reading some more manga, I&rsquo;ll update the <a href="/reading">reading
log</a> when I, well&hellip; get around to it. Haven&rsquo;t had time to do
much in the past few weeks&mdash;the time at the end of a semester tends to
get pretty tight. Here&rsquo;s what I plan to get back to during this winter break:</p>

<ul>
<li>Russian!</li>
<li>Window manager in Nim</li>
<li><code>vite</code> rewrite, pr
|
|||
|
|
</entry>
|
|||
|
|
<entry>
|
|||
|
|
<title>IRC for DMs</title>
|
|||
|
|
<updated>2019-11-03T00:00:00Z</updated>
|
|||
|
|
<id>tag:icyphox.sh/,2019-11-03:blog/irc-for-dms</id>
|
|||
|
|
<link href="https://icyphox.sh/blog/irc-for-dms"></link>
|
|||
|
|
<summary type="html"><h2>Honestly, it's pretty great</h2>
<p><a href="https://nerdypepper.me" rel="nofollow">Nerdy</a> and I decided to try and use IRC for our
daily communications, as opposed to non-free alternatives like WhatsApp
or Telegram. This is an account of how that went.</p>

<h2 id="the-status-quo-of-instant-messaging-apps">The status quo of instant messaging apps</h2>

<p>I&rsquo;ve tried a <em>ton</em> of messaging applications&mdash;Signal, WhatsApp,
Telegram, Wire, Jami (Ring), Matrix, Slack, Discord and more recently, DeltaChat.</p>

<p><strong>Signal</strong>: It straight up sucks on Android. Not to mention the
centralized architecture, and OWS&rsquo;s refusal to federate.</p>

<p><strong>WhatsApp</strong>: Facebook&rsquo;s spyware that people use without a second
thought. The sole reason I have it installed is for University&rsquo;s
class groups; I can&rsquo;t wait to graduate.</p>

<p><strong>Telegram</strong>: Centralized architecture and a closed-source server. It&rsquo;s
got a very nice Android client, though.</p>

<p><strong>Jami</strong>: Distributed platform, free software. I am not going to comment
on this because I don&rsquo;t recall what my experience was like, but I&rsquo;m not
using it now&hellip; so if that&rsquo;s indicative of anything.</p>

<p><strong>Matrix (Riot)</strong>: Distributed network. Multiple client implementations.
Overall, pretty great, but it&rsquo;s slow. I&rsquo;ve had messages not send / not
received a lot of times. Matrix + Riot excels in group communication, but
really sucks for one-to-one chats.</p>

<p><strong>Slack</strong> / <strong>Discord</strong>: <em>sigh</em></p>

<p><strong>DeltaChat</strong>: Pretty interesting idea&mdash;on paper. Using existing email
infrastructure for IM sounds great, but it isn&rsquo;t all that cash in
practice. Email isn&rsquo;t instant, there&rsquo;s always a delay of give or take
5 to 10 seconds, if not more. This affects the flow of conversation.
I might write a small blog post later, revewing DeltaChat.<sup class="footnote-ref" id="fnref:deltachat"><a href="#fn:deltachat">1</a></sup></p>

<h2 id="why-irc">Why IRC?</h2>

<p>It&rsquo;s free, in all senses of the word. A lot of others have done a great
job of answering this question in further detail, this is by far my
favourite:</p>

<p><a href="https://drewdevault.com/2019/07/01/Absence-of-features-in-IRC.html" rel="nofollow">https://drewdevault.com/2019/07/01/Absence-of-features-in-IRC.html</a></p>

<h2 id="using-irc-s-private-messages">Using IRC&rsquo;s private messages</h2>

<p>This was the next obvious choice, but personal message buffers don&rsquo;t
persist in ZNC and it&rsquo;s very annoying to have to do a <code>/query
nerdypepper</code> (Weechat) or to search and message a user via Revolution
IRC. The only unexplored option&mdash;using a channel.</p>

<h2 id="setting-up-a-channel-for-dms">Setting up a channel for DMs</h2>

<p>A fairly easy process:</p>

<ul>
<li><p>Set modes (on Rizon)<sup class="footnote-ref" id="fnref:modes"><a href="#fn:modes">2</a></sup>:</p>

<pre><code>#crimson [+ilnpstz 3]
</code></pre>
<p>In essence, this limits the users to 3 (one bot), sets
|
|||
|
|
</entry>
|
|||
|
|
<entry>
|
|||
|
|
<title>The intelligence conundrum</title>
|
|||
|
|
<updated>2019-10-28T00:00:00Z</updated>
|
|||
|
|
<id>tag:icyphox.sh/,2019-10-28:blog/intel-conundrum</id>
|
|||
|
|
<link href="https://icyphox.sh/blog/intel-conundrum"></link>
|
|||
|
|
<summary type="html"><h2>To protect an asset, or to protect the people?</h2>
<p>I watched the latest <a href="https://en.wikipedia.org/wiki/S.W.A.T._(2017_TV_series" rel="nofollow">S.W.A.T.</a>)
episode a couple of days ago, and it highlighted some interesting issues that
intelligence organizations face when working with law enforcement. Side note: it&rsquo;s a pretty
good show if you like police procedurals.</p>

<h2 id="the-problem">The problem</h2>

<p>Consider the following scenario:</p>

<ul>
<li>There&rsquo;s a local drug lord who&rsquo;s been recruited to provide intel, by a certain 3-letter organization.</li>
<li>Local PD busts his operation and proceed to arrest him.</li>
<li>3-letter org steps in, wants him released.</li>
</ul>

<p>So here&rsquo;s the thing, his presence is a threat to public but at the same time,
he can be a valuable long term asset&mdash;giving info on drug inflow, exchanges and perhaps even
actionable intel on bigger fish who exist on top of the ladder. But he also
seeks security. The 3-letter org must provide him with protection,
in case he&rsquo;s blown. And like in our case, they&rsquo;d have to step in if he gets arrested.</p>

<p>Herein lies the problem. How far should an intelligence organization go to protect an asset?
Who matters more, the people they&rsquo;ve sworn to protect, or the asset?
Because afterall, in the bigger picture, local PD and intel orgs are on the same side.</p>

<p>Thus, the question arises&mdash;how can we measure the &ldquo;usefulness&rdquo; of an
asset to better quantify the tradeoff that is to be made?
Is the intel gained worth the loss of public safety?
This question remains largely unanswered, and is quite the
predicament should you find yourself in it.</p>

<p>This was a fairly short post, but an interesting problem to ponder
nonetheless.</p>
</summary>
|
|||
|
|
</entry>
|
|||
|
|
<entry>
|
|||
|
|
<title>Hacky scripts</title>
|
|||
|
|
<updated>2019-10-24T00:00:00Z</updated>
|
|||
|
|
<id>tag:icyphox.sh/,2019-10-24:blog/hacky-scripts</id>
|
|||
|
|
<link href="https://icyphox.sh/blog/hacky-scripts"></link>
|
|||
|
|
<summary type="html"><h2>The most fun way to learn to code</h2>
<p>As a CS student, I see a lot of people around me doing courses online
to learn to code. Don&rsquo;t get me wrong&mdash;it probably works for some.
Everyone learns differently. But that&rsquo;s only going to get you so far.
Great you know the syntax, you can solve some competitive programming
problems, but that&rsquo;s not quite enough, is it? The actual learning comes
from <em>applying</em> it in solving <em>actual</em> problems&mdash;not made up ones.
(<em>inb4 some seething CP bro comes at me</em>)</p>

<p>Now, what&rsquo;s an actual problem? Some might define it as real world
problems that people out there face, and solving it probably requires
building a product. This is what you see in hackathons, generally.</p>

<p>If you ask me, however, I like to define it as problems that <em>you</em> yourself
face. This could be anything. Heck, it might not even be a &ldquo;problem&rdquo;. It
could just be an itch that you want to scratch. And this is where
<strong>hacky scripts</strong> come in. Unclear? Let me illustrate with a few
examples.</p>

<h2 id="now-playing-status-in-my-bar">Now playing status in my bar</h2>

<p>If you weren&rsquo;t aware already&mdash;I rice my desktop. A lot. And a part of
this cohesive experience I try to create involves a status bar up at the
top of my screen, showing the time, date, volume and battery statuses etc.</p>

<p>So here&rsquo;s the &ldquo;problem&rdquo;. I wanted to have my currently playing song
(Spotify), show up on my bar. How did I approach this? A few ideas
popped up in my head:</p>

<ul>
<li>Send <code>playerctl</code>&rsquo;s STDOUT into my bar</li>
<li>Write a Python script to query Spotify&rsquo;s API</li>
<li>Write a Python/shell script to query Last.fm&rsquo;s API</li>
</ul>

<p>The first approach bombed instantly. <code>playerctl</code> didn&rsquo;t recognize my
Spotify client and whined about some <code>dbus</code> issues to top it off.
I spent a while in that rabbit hole but eventually gave up.</p>

<p>My next avenue was the Spotify Web API. One look at the <a href="https://developer.spotify.com/documentation/web-api/" rel="nofollow">docs</a> and
I realize that I&rsquo;ll have to make <em>more</em> than one request to fetch the
artist and track details. Nope, I need this to work fast.</p>

<p>Last resort&mdash;Last.fm&rsquo;s API. Spolier alert, this worked. Also, arguably
the best choice, since it shows the track status regardless of where
the music is being played. Here&rsquo;s the script in its entirety:</p>

<pre><code class="language-shell">#!/usr/bin/env bash
# now playing
# requires the last.fm API key

source ~/.lastfm # `export API_KEY=&quot;&lt;key&gt;&quot;`
fg=&quot;$(xres color15)&quot;
light=&quot;$(xres color8)&quot;

USER=&quot;icyphox&quot;
URL=&quot;http://ws.audioscrobbler.com/2.0/?method=user.getrecenttracks&quot;
URL+=&quot;&amp;user=$USER&amp;api_key=$API_KEY&amp;format=json&amp;limit=1&amp;nowplaying=true&quot;
NOTPLAYING=&quot; &quot; # I like to have it show nothing
RES=$(curl -s $URL)
NOWPLAYING=$(jq '.recenttracks.track[0].&quot;@attr&quot;.nowplaying' &lt;&lt;&lt; &quot;$RES&quot; | tr -d '&quot;')


if [[ &quot;$NOWPLAYING&quot; = &quot;true&quot; ]]
then
&#x
|
|||
|
|
</entry>
|
|||
|
|
<entry>
|
|||
|
|
<title>Status update</title>
|
|||
|
|
<updated>2019-10-17T00:00:00Z</updated>
|
|||
|
|
<id>tag:icyphox.sh/,2019-10-17:blog/2019-10-17</id>
|
|||
|
|
<link href="https://icyphox.sh/blog/2019-10-17"></link>
|
|||
|
|
<summary type="html"><h2>Not weekly anymore, but was it ever?</h2>
<p>I&rsquo;ve decided to drop the &ldquo;Weekly&rdquo; part of the status update posts, since
they were never weekly and&mdash;let&rsquo;s be honest&mdash;they aren&rsquo;t going to be.
These posts are, henceforth, just &ldquo;Status updates&rdquo;. The date range can
be inferred from the post date.</p>

<p>That said, here&rsquo;s what I&rsquo;ve been up to!</p>

<h2 id="void-linux">Void Linux</h2>

<p>Yes, I decided to ditch Alpine in favor of Void. Alpine was great,
really. The very comfy <code>apk</code>, ultra mnml system&hellip; but having to
maintain a chroot for my glibc needs was getting way too painful. And
the package updates are so slow! Heck, they&rsquo;re still on kernel 4.xx on
their supposed &ldquo;bleeding&rdquo; <code>edge</code> repo.</p>

<p>So yes, Void Linux it is. Still a very clean system. I&rsquo;m loving it.
I also undervolted my system using <a href="https://github.com/georgewhewell/undervolt" rel="nofollow"><code>undervolt</code></a>
(-95 mV). Can&rsquo;t say for sure if there&rsquo;s a noticeable difference in
battery life though. I&rsquo;ll see if I can run some tests.</p>

<p>This <em>should</em> be the end of my distro hopping. Hopefully.</p>

<h2 id="pycon">PyCon</h2>

<p>Yeah yeah, enough already. Read <a href="/blog/pycon-wrap-up">my previous post</a>.</p>

<h2 id="this-website">This website</h2>

<p>I&rsquo;ve moved out of GitHub Pages over to Netlify. This isn&rsquo;t my first time
using Netlify, though. I used to host my old blog which ran Hugo, there.
I was tired of doing this terrible hack to maintain a single repo for
both my source (<code>master</code>) and deploy (<code>gh-pages</code>). In essence, here&rsquo;s
what I did:</p>

<pre><code class="language-shell">#!/usr/bin/env bash

git push origin master
# push contents of `build/` to the `gh-pages` branch
git subtree push --prefix build origin gh-pages
</code></pre>

<p>I can now simply push to <code>master</code>, and Netlify generates a build for me
by installing <a href="https://github.com/icyphox/vite" rel="nofollow">vite</a>, and running <code>vite
build</code>. Very pleasant.</p>

<h2 id="mnmlwm-s-status"><code>mnmlwm</code>&rsquo;s status</h2>

<p><a href="https://github.com/minimalwm/minimal" rel="nofollow">mnmlwm</a>, for those unaware, is my pet project which aims to be a simple
window manager written in Nim. I&rsquo;d taken a break from it for a while
because Xlib is such a pain to work with (or I&rsquo;m just dense). Anyway,
I&rsquo;m planning on getting back to it, with some fresh inspiration from
Dylan Araps&rsquo; <a href="https://github.com/dylanaraps/sowm" rel="nofollow">sowm</a>.</p>

<h2 id="other">Other</h2>

<p>I&rsquo;ve been reading a lot of manga lately. Finished <em>Kekkon Yubiwa
Monogatari</em> (till the latest chapter) and <em>Another</em>, and I&rsquo;ve just
started <em>Kakegurui</em>. I&rsquo;ll reserve my opinions for when I update the
<a href="/reading">reading log</a>.</p>

<p>That&rsquo;s about it, and I&rsquo;ll see you&mdash;definitely not next week.</p>
</summary>
|
|||
|
|
</entry>
|
|||
|
|
<entry>
|
|||
|
|
<title>PyCon India 2019 wrap-up</title>
|
|||
|
|
<updated>2019-10-15T00:00:00Z</updated>
|
|||
|
|
<id>tag:icyphox.sh/,2019-10-15:blog/pycon-wrap-up</id>
|
|||
|
|
<link href="https://icyphox.sh/blog/pycon-wrap-up"></link>
|
|||
|
|
<summary type="html"><h2>Pretty fun weekend, I'd say</h2>
<p>I&rsquo;m writing this article as I sit in class, back on the grind. Last
weekend&mdash;Oct 12th and 13th&mdash;was PyCon India 2019, in Chennai, India.
It was my first PyCon, <em>and</em> my first ever talk at a major conference!
This is an account of the all the cool stuff I saw, people I met and the
talks I enjoyed.
Forgive the lack of pictures&mdash;I prefer living the moment through my
eyes.</p>

<h2 id="talks">Talks</h2>

<p>So much ML! Not that it&rsquo;s a bad thing, but definitely interesting to
note. From what I counted, there were about 17 talks tagged under &ldquo;Data
Science, Machine Learning and AI&rdquo;. I&rsquo;d have liked to see more talks
discussing security and privacy, but hey, the organizers can only pick
from what&rsquo;s submitted. ;)</p>

<p>With that point out of the way, here are some of the talks I really liked:</p>

<ul>
<li><strong>Python Packaging - where we are and where we&rsquo;re headed</strong> by <a href="https://twitter.com/pradyunsg" rel="nofollow">Pradyun</a></li>
<li><strong>Micropython: Building a Physical Inventory Search Engine</strong> by <a href="https://twitter.com/stonecharioteer" rel="nofollow">Vinay</a></li>
<li><strong>Ragabot - Music Encoded</strong> by <a href="https://twitter.com/vikipedia" rel="nofollow">Vikrant</a></li>
<li><strong>Let&rsquo;s Hunt a Memory Leak</strong> by <a href="https://twitter.com/sankeyplus" rel="nofollow">Sanket</a></li>
<li>oh and of course, <a href="https://twitter.com/dabeaz" rel="nofollow">David Beazley</a>&rsquo;s closing
keynote</li>
</ul>

<h2 id="my-talk">My talk (!!!)</h2>

<p>My good buddy <a href="https://twitter.com/_vologue" rel="nofollow">Raghav</a> and I spoke about
our smart lock security research. Agreed, it might have been less
&ldquo;hardware&rdquo; and more of a bug on the server-side, but that&rsquo;s the thing
about IoT right? It&rsquo;s so multi-faceted, and is an amalgamation of so
many different hardware and software stacks. But, anyway&hellip;</p>

<p>I was reassured by folks after the talk that the silence during Q/A was
the &ldquo;good&rdquo; kind of silence. Was it really? I&rsquo;ll never know.</p>

<h2 id="some-nice-people-i-met">Some nice people I met</h2>

<ul>
<li><a href="https://twitter.com/abhirathb" rel="nofollow">Abhirath</a>&mdash;A 200 IQ lad. Talked to
me about everything from computational biology to the physical
implementation of quantum computers.</li>
<li><a href="https://twitter.com/meain_" rel="nofollow">Abin</a>&mdash;He recognized me from my
<a href="https://reddit.com/r/unixporn" rel="nofollow">r/unixporn</a> posts, which was pretty
awesome.</li>
<li><a href="https://twitter.com/h6165" rel="nofollow">Abhishek</a></li>
<li>Pradyun and Vikrant (linked earlier)</li>
</ul>

<p>And a lot of other people doing really great stuff, whose names I&rsquo;m
forgetting.</p>

<h2 id="pictures">Pictures!</h2>

<p>It&rsquo;s not much, and
I can&rsquo;t be bothered to format them like a collage or whatever, so I&rsquo;ll
just dump them here&mdash;as is.</p>


|
|||
|
|
</entry>
|
|||
|
|
<entry>
|
|||
|
|
<title>Thoughts on digital minimalism</title>
|
|||
|
|
<updated>2019-10-05T00:00:00Z</updated>
|
|||
|
|
<id>tag:icyphox.sh/,2019-10-05:blog/digital-minimalism</id>
|
|||
|
|
<link href="https://icyphox.sh/blog/digital-minimalism"></link>
|
|||
|
|
<summary type="html"><h2>Put that screen down!</h2>
<p>Ah yes, yet another article on the internet on this beaten to death
subject. But this is inherently different, since it&rsquo;s <em>my</em> opinion on
the matter, and <em>my</em> technique(s) to achieve &ldquo;digital minimalism&rdquo;.</p>

<p>According to me, minimalism can be achieved on two primary fronts&mdash;the phone &amp; the computer. Let&rsquo;s start with the phone. The daily carry.
The device that&rsquo;s on our person from when we get out of bed, till we get
back in bed.</p>

<h2 id="the-phone">The phone</h2>

<p>I&rsquo;ve read about a lot of methods people employ to curb their phone
usage. Some have tried grouping &ldquo;distracting&rdquo; apps into a separate
folder, and this supposedly helps reduce their usage. Now, I fail to see
how this would work, but YMMV. Another technique I see often is using
a time governance app&mdash;like OnePlus&rsquo; Zen Mode&mdash;to enforce how much
time you spend using specific apps, or the phone itself. I&rsquo;ve tried this
for myself, but I constantly found myself counting down the minutes
after which the phone would become usable again. Not helpful.</p>

<p>My solution to this is a lot more brutal. I straight up uninstalled the
apps that I found myself using too often. There&rsquo;s a simple principle
behind it&mdash;if the app has a desktop alternative, like Twitter,
Reddit, etc. use that instead. Here&rsquo;s a list of apps that got nuked from
my phone:</p>

<ul>
<li>Twitter</li>
<li>Instagram (an exception, no desktop client)</li>
<li>Relay for Reddit</li>
<li>YouTube (disabled, ships with stock OOS)</li>
</ul>

<p>The only non-productive app that I&rsquo;ve let remain is Clover,
a 4chan client. I didn&rsquo;t find myself using it as much earlier, but we&rsquo;ll see how that
holds up. I&rsquo;ve also allowed my personal messaging apps to remain, since
removing those would be inconveniencing others.</p>

<p>I must admit, I often find myself reaching for my phone out of habit
just to check Twitter, only to find that its gone. I also subconsciously
tap the place where its icon used to exist (now replaced with my mail
client) on my launcher. The only &ldquo;fun&rdquo; thing left on my phone to do is
read or listen to music. Which is okay, in my opinion.</p>

<h2 id="the-computer">The computer</h2>

<p>I didn&rsquo;t do anything too nutty here, and most of the minimalism is
mostly aesthetic. I like UIs that get out of the way.</p>

<p>My setup right now is just a simple bar at the top showing the time,
date, current volume and battery %, along with my workspace indicators.
No fancy colors, no flashy buttons and sliders. And that&rsquo;s it. I don&rsquo;t
try to force myself to not use stuff&mdash;after all, I&rsquo;ve reduced it
elsewhere. :)</p>

<p>Now the question arises: Is this just a phase, or will I stick to it?
What&rsquo;s going to stop me from heading over to the Play Store and
installing those apps back? Well, I never said this was going to be
easy. There&rsquo;s definitely some will power needed to pull this off.
I guess time will tell.</p>
</summary>
|
|||
|
|
</entry>
|
|||
|
|
<entry>
|
|||
|
|
<title>Status update</title>
|
|||
|
|
<updated>2019-09-27T00:00:00Z</updated>
|
|||
|
|
<id>tag:icyphox.sh/,2019-09-27:blog/2019-09-27</id>
|
|||
|
|
<link href="https://icyphox.sh/blog/2019-09-27"></link>
|
|||
|
|
<summary type="html"><h2>Alpine Linux shenaningans and more</h2>
<p>It&rsquo;s a lazy Friday afternoon here; yet another off day this week thanks to my
uni&rsquo;s fest. My last &ldquo;weekly&rdquo; update was 10 days ago, and a lot has happened
since then. Let&rsquo;s get right into it!</p>

<h2 id="my-switch-to-alpine">My switch to Alpine</h2>

<p>Previously, I ran Debian with Buster/Sid repos, and ever since this happened</p>

<pre><code class="language-shell">$ dpkg --list | wc -l
3817

# or something in that ballpark
</code></pre>

<p>I&rsquo;ve been wanting to reduce my system&rsquo;s package count.</p>

<p>Thus, I began my search for a smaller, simpler and lighter distro with a fairly
sane package manager. I did come across Dylan Araps&rsquo;
<a href="https://getkiss.org" rel="nofollow">KISS Linux</a> project, but it seemed a little too hands-on
for me (and still relatively new). I finally settled on
<a href="https://alpinelinux.org" rel="nofollow">Alpine Linux</a>. According to their website:</p>

<blockquote>
<p>Alpine Linux is a security-oriented, lightweight Linux distribution based
on musl libc and busybox.</p>
</blockquote>

<p>The installation was a breeze, and I was quite surprised to see WiFi working
OOTB. In the past week of my using this distro, the only major hassle I faced
was getting my Minecraft launcher to run. The JRE isn&rsquo;t fully ported to <code>musl</code>
yet.<sup class="footnote-ref" id="fnref:1"><a href="#fn:1">1</a></sup> The solution to that is fairly trivial and I plan to write about it
soon. (hint: it involves chroots)</p>

<p><img src="https://cdn.icyphox.sh/LDq8W.png" alt="" /></p>

<h2 id="packaging-for-alpine">Packaging for Alpine</h2>

<p>On a related note, I&rsquo;ve been busy packaging some of the stuff I use for Alpine
-- you can see my personal <a href="https://github.com/icyphox/aports" rel="nofollow">aports</a>
repository if you&rsquo;re interested. I&rsquo;m currently working on packaging Nim too, so
keep an eye out for that in the coming week.</p>

<h2 id="talk-selection-at-pycon-india">Talk selection at PyCon India!</h2>

<p>Yes! My buddy Raghav (<a href="https://twitter.com/_vologue" rel="nofollow">@_vologue</a>) and I are
going to be speaking at PyCon India about our recent smart lock security
research. The conference is happening in Chennai, much to our convenience.
If you&rsquo;re attending too, hit me up on Twitter and we can hang!</p>

<h2 id="other">Other</h2>

<p>That essentially sums up the <em>technical</em> stuff that I did. My Russian is going
strong, my reading however, hasn&rsquo;t. I have <em>yet</em> to finish those books! This
week, for sure.</p>

<p>Musically, I&rsquo;ve been experimenting. I tried a bit of hip-hop and chilltrap, and
I think I like it? I still find myself coming back to metalcore/deathcore.
Here&rsquo;s a list of artists I discovered (and liked) recently:</p>

<ul>
<li><a href="https://www.youtube.com/watch?v=r3uKGwcwGWA" rel="nofollow">Before I Turn</a></li>
<li>生 Conform 死 (couldn&rsquo;t find any official YouTube video, check Spotify)</li>
<li><a href="https://www.youtube.com/watch?v=66eFK1ttdC4" rel="nofollow">Treehouse Burning</a></li>&
|
|||
|
|
</entry>
|
|||
|
|
<entry>
|
|||
|
|
<title>Status update</title>
|
|||
|
|
<updated>2019-09-17T00:00:00Z</updated>
|
|||
|
|
<id>tag:icyphox.sh/,2019-09-17:blog/2019-09-17</id>
|
|||
|
|
<link href="https://icyphox.sh/blog/2019-09-17"></link>
|
|||
|
|
<summary type="html"><h2>A brief on what happened last week</h2>
<p>This is something new I&rsquo;m trying out, in an effort to write more frequently
and to serve as a log of how I&rsquo;m using my time. In theory, I will write this post
every week. I&rsquo;ll need someone to hold me accountable if I don&rsquo;t. I have yet to decide on
a format for this, but it will probably include a quick summary of the work I did,
things I read, IRL stuff, etc.</p>

<p>With the meta stuff out of the way, here&rsquo;s what went down last week!</p>

<h2 id="my-discovery-of-the-xxiivv-webring">My discovery of the XXIIVV webring</h2>

<p>Did you notice the new fidget-spinner-like logo at the bottom? Click it! It&rsquo;s a link to
the <a href="https://webring.xxiivv.com" rel="nofollow">XXIIVV webring</a>. I really like the idea of webrings.
It creates a small community of sites and enables sharing of traffic among these sites.
The XXIIVV webring consists mostly of artists, designers and developers and gosh, some
of those sites are beautiful. Mine pales in comparison.</p>

<p>The webring also has a <a href="https://github.com/buckket/twtxt" rel="nofollow">twtxt</a> echo chamber aptly
called <a href="https://webring.xxiivv.com/hallway.html" rel="nofollow">The Hallway</a>. twtxt is a fantastic project
and its complexity-to-usefulness ratio greatly impresses me. You can find my personal
twtxt feed at <code>/twtxt.txt</code> (root of this site).</p>

<p>Which brings me to the next thing I did this/last week.</p>

<h2 id="twsh-a-twtxt-client-written-in-bash"><code>twsh</code>: a twtxt client written in Bash</h2>

<p>I&rsquo;m not a fan of the official Python client, because you know, Python is bloat.
As an advocate of <em>mnmlsm</em>, I can&rsquo;t use it in good conscience. Thus, began my
authorship of a truly mnml client in pure Bash. You can find it <a href="https://github.com/icyphox/twsh" rel="nofollow">here</a>.
It&rsquo;s not entirely useable as of yet, but it&rsquo;s definitely getting there, with the help
of <a href="https://nerdypepper.me" rel="nofollow">@nerdypepper</a>.</p>

<h2 id="other">Other</h2>

<p>I have been listening to my usual podcasts: Crime Junkie, True Crime Garage,
Darknet Diaries &amp; Off the Pill. To add to this list, I&rsquo;ve begun binging Vice&rsquo;s CYBER.
It&rsquo;s pretty good&mdash;each episode is only about 30 mins and it hits the sweet spot,
delvering both interesting security content and news.</p>

<p>My reading needs a ton of catching up. Hopefully I&rsquo;ll get around to finishing up
&ldquo;The Unending Game&rdquo; this week. And then go back to &ldquo;Terrorism and Counterintelligence&rdquo;.</p>

<p>I&rsquo;ve begun learning Russian! I&rsquo;m really liking it so far, and it&rsquo;s been surprisingly
easy to pick up. Learning the Cyrillic script will require some relearning, especially
with letters like в, н, р, с, etc. that look like English but sound entirely different.
I think I&rsquo;m pretty serious about learning this language&mdash;I&rsquo;ve added the Russian keyboard
to my Google Keyboard to aid in my familiarization of the alphabet. I&rsquo;ve added the <code>RU</code>
layout to my keyboard map too:</p>

<pre><code>setxkbmap -option 'grp:alt_shift_toggle' -layout us,ru
</code></pre>

<p>With that ends my weekly update, and I&rsquo;ll see you next week!</p>
</
|
|||
|
|
</entry>
|
|||
|
|
<entry>
|
|||
|
|
<title>Disinformation demystified</title>
|
|||
|
|
<updated>2019-09-10T00:00:00Z</updated>
|
|||
|
|
<id>tag:icyphox.sh/,2019-09-10:blog/disinfo</id>
|
|||
|
|
<link href="https://icyphox.sh/blog/disinfo"></link>
|
|||
|
|
<summary type="html"><h2>Misinformation, but deliberate</h2>
<p>As with the disambiguation of any word, let&rsquo;s start with its etymology and definiton.
According to <a href="https://en.wikipedia.org/wiki/Disinformation" rel="nofollow">Wikipedia</a>,
<em>disinformation</em> has been borrowed from the Russian word &mdash; <em>dezinformatisya</em> (дезинформа́ция),
derived from the title of a KGB black propaganda department.</p>

<blockquote>
<p>Disinformation is false information spread deliberately to deceive.</p>
</blockquote>

<p>To fully understand disinformation, especially in the modern age, we need to understand the
key factors of any successful disinformation operation:</p>

<ul>
<li>creating disinformation (what)</li>
<li>the motivation behind the op, or its end goal (why)</li>
<li>the medium used to disperse the falsified information (how)</li>
<li>the actor (who)</li>
</ul>

<p>At the end, we&rsquo;ll also look at how you can use disinformation techniques to maintain OPSEC.</p>

<p>In order to break monotony, I will also be using the terms &ldquo;information operation&rdquo;, or the shortened
forms&mdash;&ldquo;info op&rdquo; &amp; &ldquo;disinfo&rdquo;.</p>

<h2 id="creating-disinformation">Creating disinformation</h2>

<p>Crafting or creating disinformation is by no means a trivial task. Often, the quality
of any disinformation sample is a huge indicator of the level of sophistication of the
actor involved, i.e. is it a 12 year old troll or a nation state?</p>

<p>Well crafted disinformation always has one primary characteristic &mdash; &ldquo;plausibility&rdquo;.
The disinfo must sound reasonable. It must induce the notion it&rsquo;s <em>likely</em> true.
To achieve this, the target &mdash; be it an individual, a specific demographic or an entire
nation &mdash; must be well researched. A deep understanding of the target&rsquo;s culture, history,
geography and psychology is required. It also needs circumstantial and situational awareness,
of the target.</p>

<p>There are many forms of disinformation. A few common ones are staged videos / photographs,
recontextualized videos / photographs, blog posts, news articles &amp; most recently &mdash; deepfakes.</p>

<p>Here&rsquo;s a tweet from <a href="https://twitter.com/thegrugq" rel="nofollow">the grugq</a>, showing a case of recontextualized
imagery:</p>

<p><blockquote class="twitter-tweet" data-dnt="true" data-theme="dark" data-link-color="#00ffff">
<p lang="en" dir="ltr">Disinformation.
<br><br>
The content of the photo is not fake. The reality of what it captured is fake. The context it’s placed in is fake. The picture itself is 100% authentic. Everything, except the photo itself, is fake.
<br><br>Recontextualisation as threat vector.
<a href="https://t.co/Pko3f0xkXC">pic.twitter.com/Pko3f0xkXC</a>
</p>&mdash; thaddeus e. grugq (@thegrugq)
<a href="https://twitter.com/thegrugq/status/1142759819020890113?ref_src=twsrc%5Etfw">June 23, 2019</a>
</blockquote>
<script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script></p>

<h2 id="motivations-behind-an-information-operation">Motivations behind an information operation</h2>

<p>I like to broadly categorize any info op as either proactive or reactive.
Proac
|
|||
|
|
</entry>
|
|||
|
|
<entry>
|
|||
|
|
<title>Setting up my personal mailserver</title>
|
|||
|
|
<updated>2019-08-15T00:00:00Z</updated>
|
|||
|
|
<id>tag:icyphox.sh/,2019-08-15:blog/mailserver</id>
|
|||
|
|
<link href="https://icyphox.sh/blog/mailserver"></link>
|
|||
|
|
<summary type="html"><h2>This is probably a terrible idea…</h2>
<p>A mailserver was a long time coming. I&rsquo;d made an attempt at setting one up
around ~4 years ago (ish), and IIRC, I quit when it came to DNS. And
I almost did this time too.<sup class="footnote-ref" id="fnref:1"><a href="#fn:1">1</a></sup></p>

<p>For this attempt, I wanted a simpler approach. I recall how terribly
confusing Dovecot &amp; Postfix were to configure and hence I decided to look
for a containerized solution, that most importantly, runs on my cheap $5
Digital Ocean VPS &mdash; 1 vCPU and 1 GB memory. Of which only around 500 MB
is actually available. So yeah, <em>pretty</em> tight.</p>

<h2 id="what-s-available">What&rsquo;s available</h2>

<p>Turns out, there are quite a few of these OOTB, ready to deply solutions.
These are the ones I came across:</p>

<ul>
<li><p><a href="https://poste.io" rel="nofollow">poste.io</a>: Based on an &ldquo;open core&rdquo; model. The base install is open source
and free (as in beer), but you&rsquo;ll have to pay for the extra stuff.</p></li>

<li><p><a href="https://mailu.io" rel="nofollow">mailu.io</a>: Free software. Draws inspiration from poste.io,
but ships with a web UI that I didn&rsquo;t need.</p></li>

<li><p><a href="https://mailcow.email" rel="nofollow">mailcow.email</a>: These fancy domains are getting ridiculous. But more importantly
they need 2 GiB of RAM <em>plus</em> swap?! Nope.</p></li>

<li><p><a href="https://mailinabox.email" rel="nofollow">Mail-in-a-Box</a>: Unlike the ones above, not a Docker-based solution but definitely worth
a mention. It however, needs a fresh box to work with. A box with absolutely
nothing else on it. I can&rsquo;t afford to do that.</p></li>

<li><p><a href="https://github.com/tomav/docker-mailserver/" rel="nofollow">docker-mailserver</a>: <strong>The winner</strong>.</p></li>
</ul>

<h2 id="so-docker-mailserver">So… <code>docker-mailserver</code></h2>

<p>The first thing that caught my eye in the README:</p>

<blockquote>
<p>Recommended:</p>

<ul>
<li>1 CPU</li>
<li>1GB RAM</li>
</ul>

<p>Minimum:</p>

<ul>
<li>1 CPU</li>
<li>512MB RAM</li>
</ul>
</blockquote>

<p>Fantastic, I can somehow squeeze this into my existing VPS.
Setup was fairly simple &amp; the docs are pretty good. It employs a single
<code>.env</code> file for configuration, which is great.
However, I did run into a couple of hiccups here and there.</p>

<p>One especially nasty one was <code>docker</code> / <code>docker-compose</code> running out
of memory.</p>

<pre><code>Error response from daemon: cannot stop container: 2377e5c0b456: Cannot kill container 2377e5c0b456226ecaa66a5ac18071fc5885b8a9912feeefb07593638b9a40d1: OCI runtime state failed: runc did not terminate sucessfully: fatal error: runtime: out of memory
</code></pre>

<p>But it eventually worked after a couple of attempts.</p>

<p>The next thing I struggled with &mdash; DNS. Specifically, the with the step where
the DKIM keys are generated<sup class="footnote-ref" id="fnref:2"><a href="#fn:2">2</a></sup>.
|
|||
|
|
</entry>
|
|||
|
|
<entry>
|
|||
|
|
<title>Picking the FB50 smart lock (CVE-2019-13143)</title>
|
|||
|
|
<updated>2019-08-05T00:00:00Z</updated>
|
|||
|
|
<id>tag:icyphox.sh/,2019-08-05:blog/fb50</id>
|
|||
|
|
<link href="https://icyphox.sh/blog/fb50"></link>
|
|||
|
|
<summary type="html"><h2>… and lessons learnt in IoT security</h2>
<p>(<em>originally posted at <a href="http://blog.securelayer7.net/fb50-smart-lock-vulnerability-disclosure" rel="nofollow">SecureLayer7&rsquo;s Blog</a>, with my edits</em>)</p>

<h2 id="the-lock">The lock</h2>

<p>The lock in question is the FB50 smart lock, manufactured by Shenzhen
Dragon Brother Technology Co. Ltd. This lock is sold under multiple brands
across many ecommerce sites, and has over, an estimated, 15k+ users.</p>

<p>The lock pairs to a phone via Bluetooth, and requires the OKLOK app from
the Play/App Store to function. The app requires the user to create an
account before further functionality is available.
It also facilitates configuring the fingerprint,
and unlocking from a range via Bluetooth.</p>

<p>We had two primary attack surfaces we decided to tackle&mdash;Bluetooth (BLE)
and the Android app.</p>

<h2 id="via-bluetooth-low-energy-ble">Via Bluetooth Low Energy (BLE)</h2>

<p>Android phones have the ability to capture Bluetooth (HCI) traffic
which can be enabled under Developer Options under Settings. We made
around 4 &ldquo;unlocks&rdquo; from the Android phone, as seen in the screenshot.</p>

<p><img src="https://cdn.icyphox.sh/IO5G0.png" alt="" /></p>

<p>This is the value sent in the <code>Write</code> request:</p>

<p><img src="https://cdn.icyphox.sh/rJVoE.png" alt="" /></p>

<p>We attempted replaying these requests using <code>gattool</code> and <code>gattacker</code>,
but that didn&rsquo;t pan out, since the value being written was encrypted.<sup class="footnote-ref" id="fnref:1"><a href="#fn:1">1</a></sup></p>

<h2 id="via-the-android-app">Via the Android app</h2>

<p>Reversing the app using <code>jd-gui</code>, <code>apktool</code> and <code>dex2jar</code> didn&rsquo;t get us too
far since most of it was obfuscated. Why bother when there exists an
easier approach&mdash;BurpSuite.</p>

<p>We captured and played around with a bunch of requests and responses,
and finally arrived at a working exploit chain.</p>

<h2 id="the-exploit">The exploit</h2>

<p>The entire exploit is a 4 step process consisting of authenticated
HTTP requests:</p>

<ol>
<li>Using the lock&rsquo;s MAC (obtained via a simple Bluetooth scan in the
vicinity), get the barcode and lock ID</li>
<li>Using the barcode, fetch the user ID</li>
<li>Using the lock ID and user ID, unbind the user from the lock</li>
<li>Provide a new name, attacker&rsquo;s user ID and the MAC to bind the attacker
to the lock</li>
</ol>

<p>This is what it looks like, in essence (personal info redacted).</p>

<h3 id="request-1">Request 1</h3>

<pre><code>POST /oklock/lock/queryDevice
{&quot;mac&quot;:&quot;XX:XX:XX:XX:XX:XX&quot;}
</code></pre>

<p>Response:</p>

<pre><code>{
 &quot;result&quot;:{
 &quot;alarm&quot;:0,
 &quot;barcode&quot;:&quot;&lt;BARCODE&gt;&quot;,
 &quot;chipType&quot;:&quot;1&quot;,
 &quot;createAt&quot;:&quot;2019-05-14 09:32:23.0&quot;,
 &quot;deviceId&quot;:&quot;&quot;,
 &quot;electricity&quot;:&quot;95&quot;,

|
|||
|
|
</entry>
|
|||
|
|
<entry>
|
|||
|
|
<title>Return Oriented Programming on ARM (32-bit)</title>
|
|||
|
|
<updated>2019-06-06T00:00:00Z</updated>
|
|||
|
|
<id>tag:icyphox.sh/,2019-06-06:blog/rop-on-arm</id>
|
|||
|
|
<link href="https://icyphox.sh/blog/rop-on-arm"></link>
|
|||
|
|
<summary type="html"><h2>Making stack-based exploitation great again!</h2>
<p>Before we start <em>anything</em>, you’re expected to know the basics of ARM
assembly to follow along. I highly recommend
<a href="https://twitter.com/fox0x01" rel="nofollow">Azeria’s</a> series on <a href="https://azeria-labs.com/writing-arm-assembly-part-1/" rel="nofollow">ARM Assembly
Basics</a>. Once you’re
comfortable with it, proceed with the next bit&mdash;environment setup.</p>

<h2 id="setup">Setup</h2>

<p>Since we’re working with the ARM architecture, there are two options to go
forth with:</p>

<ol>
<li>Emulate&mdash;head over to <a href="https://www.qemu.org/download/" rel="nofollow">qemu.org/download</a> and install QEMU.
And then download and extract the ARMv6 Debian Stretch image from one of the links <a href="https://blahcat.github.io/qemu/" rel="nofollow">here</a>.
The scripts found inside should be self-explanatory.</li>
<li>Use actual ARM hardware, like an RPi.</li>
</ol>

<p>For debugging and disassembling, we’ll be using plain old <code>gdb</code>, but you
may use <code>radare2</code>, IDA or anything else, really. All of which can be
trivially installed.</p>

<p>And for the sake of simplicity, disable ASLR:</p>

<pre><code class="language-shell">$ echo 0 &gt; /proc/sys/kernel/randomize_va_space
</code></pre>

<p>Finally, the binary we’ll be using in this exercise is <a href="https://twitter.com/bellis1000" rel="nofollow">Billy Ellis’</a>
<a href="/static/files/roplevel2.c">roplevel2</a>.</p>

<p>Compile it:</p>

<pre><code class="language-sh">$ gcc roplevel2.c -o rop2
</code></pre>

<p>With that out of the way, here’s a quick run down of what ROP actually is.</p>

<h2 id="a-primer-on-rop">A primer on ROP</h2>

<p>ROP or Return Oriented Programming is a modern exploitation technique that’s
used to bypass protections like the <strong>NX bit</strong> (no-execute bit) and <strong>code sigining</strong>.
In essence, no code in the binary is actually modified and the entire exploit
is crafted out of pre-existing artifacts within the binary, known as <strong>gadgets</strong>.</p>

<p>A gadget is essentially a small sequence of code (instructions), ending with
a <code>ret</code>, or a return instruction. In our case, since we’re dealing with ARM
code, there is no <code>ret</code> instruction but rather a <code>pop {pc}</code> or a <code>bx lr</code>.
These gadgets are <em>chained</em> together by jumping (returning) from one onto the other
to form what’s called as a <strong>ropchain</strong>. At the end of a ropchain,
there’s generally a call to <code>system()</code>, to acheive code execution.</p>

<p>In practice, the process of executing a ropchain is something like this:</p>

<ul>
<li>confirm the existence of a stack-based buffer overflow</li>
<li>identify the offset at which the instruction pointer gets overwritten</li>
<li>locate the addresses of the gadgets you wish to use</li>
<li>craft your input keeping in mind the stack’s layout, and chain the addresses
of your gadgets</li>
</ul>

<p><a href="https://twitter.com/LiveOverflow" rel="nofollow">LiveOverflow</a> has a <
|
|||
|
|
</entry>
|
|||
|
|
<entry>
|
|||
|
|
<title>My setup</title>
|
|||
|
|
<updated>2019-05-13T00:00:00Z</updated>
|
|||
|
|
<id>tag:icyphox.sh/,2019-05-13:blog/my-setup</id>
|
|||
|
|
<link href="https://icyphox.sh/blog/my-setup"></link>
|
|||
|
|
<summary type="html"><h2>My daily drivers—hardware, software and workflow</h2>
<p><strong>Update</strong>: I now maintain a <a href="/uses">uses</a> page. This post is out of
date.</p>

<h2 id="hardware">Hardware</h2>

<p>The only computer I have with me is my <a href="https://store.hp.com/us/en/mdp/laptops/envy-13" rel="nofollow">HP Envy 13
(2018)</a> (my model looks
a little different). It’s a 13” ultrabook, with an i5 8250u, 8 gigs of
RAM and a 256 GB NVMe SSD. It’s a very comfy machine that does
everything I need it to.</p>

<p>For my phone, I use a <a href="https://www.oneplus.in/6t" rel="nofollow">OnePlus 6T</a>, running
stock <a href="https://www.oneplus.in/oxygenos" rel="nofollow">OxygenOS</a>. As of this writing,
its bootloader hasn’t been unlocked and nor has the device been rooted.
I’m also a proud owner of a <a href="https://en.wikipedia.org/wiki/Nexus_5" rel="nofollow">Nexus
5</a>, which I really wish Google
rebooted. It’s surprisingly still usable and runs Android Pie, although
the SIM slot is ruined and the battery backup is abysmal.</p>

<p>My watch is a <a href="https://www.samsung.com/in/wearables/gear-s3-frontier-r760/" rel="nofollow">Samsung Gear S3
Frontier</a>.
Tizen is definitely better than Android Wear.</p>

<p>My keyboard, although not with me in college, is a very old <a href="https://www.amazon.com/Dell-Keyboard-Model-SK-8110-Interface/dp/B00366HMMO" rel="nofollow">Dell
SK-8110</a>.
For the little bit of gaming that I do, I use a <a href="https://www.hpshopping.in/hp-m150-gaming-mouse-3dr63pa.html" rel="nofollow">HP
m150</a>
gaming mouse. It’s the perfect size (and color).</p>

<p>For my music, I use the <a href="https://www.boseindia.com/en_in/products/headphones/over_ear_headphones/soundlink-around-ear-wireless-headphones-ii.html" rel="nofollow">Bose SoundLink
II</a>.
Great pair of headphones, although the ear cups need replacing.</p>

<h2 id="and-the-software">And the software</h2>

<p><del>My distro of choice for the past ~1 year has been <a href="https://elementary.io" rel="nofollow">elementary
OS</a>. I used to be an Arch Linux elitist, complete
with an esoteric window manager, all riced. I now use whatever
JustWorks™.</del></p>

<p><strong>Update</strong>: As of June 2019, I&rsquo;ve switched over to a vanilla Debian
9 Stretch install, running <a href="https://i3wm.org" rel="nofollow">i3</a> as my window manager.
If you want, you can dig through my configs at my
<a href="https://github.com/icyphox/dotfiles" rel="nofollow">dotfiles</a> repo.</p>

<p>Here’s a (riced) screenshot of my desktop.</p>

<p><img src="https://i.redd.it/jk574gworp331.png" alt="scrot" /></p>

<p>Most of my work is done in either the browser, or the terminal. My shell
is pure <a href="http://www.zsh.org" rel="nofollow">zsh</a>, as in no plugin frameworks. It’s
customized using built-in zsh functions. Yes, you don’t actually need
a framework. It’s useless bloat. The prompt itself is generated using
a framework I built in <a href="https://nim-lang.org" rel="nofollow">Nim</a>&mdash;<a href="https://github.com/icyphox/nicy" rel="nofollow">nicy</a>. My primary text editor is
<a href="https://neovim.org" rel="nofollow&
|
|||
|
|
</entry>
|
|||
|
|
<entry>
|
|||
|
|
<title>Python for Reverse Engineering</title>
|
|||
|
|
<updated>2019-02-08T00:00:00Z</updated>
|
|||
|
|
<id>tag:icyphox.sh/,2019-02-08:blog/python-for-re-1</id>
|
|||
|
|
<link href="https://icyphox.sh/blog/python-for-re-1"></link>
|
|||
|
|
<summary type="html"><h2>Building your own disassembly tooling for — that’s right — fun and profit</h2>
<p>While solving complex reversing challenges, we often use established tools like radare2 or IDA for disassembling and debugging. But there are times when you need to dig in a little deeper and understand how things work under the hood.</p>

<p>Rolling your own disassembly scripts can be immensely helpful when it comes to automating certain processes, and eventually build your own homebrew reversing toolchain of sorts. At least, that’s what I’m attempting anyway.</p>

<h2 id="setup">Setup</h2>

<p>As the title suggests, you’re going to need a Python 3 interpreter before
anything else. Once you’ve confirmed beyond reasonable doubt that you do,
in fact, have a Python 3 interpreter installed on your system, run</p>

<pre><code class="language-console">$ pip install capstone pyelftools
</code></pre>

<p>where <code>capstone</code> is the disassembly engine we’ll be scripting with and <code>pyelftools</code> to help parse ELF files.</p>

<p>With that out of the way, let’s start with an example of a basic reversing
challenge.</p>

<pre><code class="language-c">/* chall.c */

#include &lt;stdio.h&gt;
#include &lt;stdlib.h&gt;
#include &lt;string.h&gt;

int main() {
 char *pw = malloc(9);
 pw[0] = 'a';
 for(int i = 1; i &lt;= 8; i++){
 pw[i] = pw[i - 1] + 1;
 }
 pw[9] = '\0';
 char *in = malloc(10);
 printf(&quot;password: &quot;);
 fgets(in, 10, stdin); // 'abcdefghi'
 if(strcmp(in, pw) == 0) {
 printf(&quot;haha yes!\n&quot;);
 }
 else {
 printf(&quot;nah dude\n&quot;);
 }
}
</code></pre>

<p>Compile it with GCC/Clang:</p>

<pre><code class="language-console">$ gcc chall.c -o chall.elf
</code></pre>

<h2 id="scripting">Scripting</h2>

<p>For starters, let’s look at the different sections present in the binary.</p>

<pre><code class="language-python"># sections.py

from elftools.elf.elffile import ELFFile

with open('./chall.elf', 'rb') as f:
 e = ELFFile(f)
 for section in e.iter_sections():
 print(hex(section['sh_addr']), section.name)
</code></pre>

<p>This script iterates through all the sections and also shows us where it’s loaded. This will be pretty useful later. Running it gives us</p>

<pre><code class="language-console">› python sections.py
0x238 .interp
0x254 .note.ABI-tag
0x274 .note.gnu.build-id
0x298 .gnu.hash
0x2c0 .dynsym
0x3e0 .dynstr
0x484 .gnu.version
0x4a0 .gnu.version_r
0x4c0 .rela.dyn
0x598 .rela.plt
0x610 .init
0x630 .plt
0x690 .plt.got
0x6a0 .text
0x8f4 .fini
0x900 .rodata
0x924 .eh_frame_hdr
0x960 .eh_frame
0x200d98 .init_array
0x200da0 .fini_array
0x200da8 .dynamic
0x200f98 .got
0x201000 .data
0x201010 .bss
0x0 .comment
0x0 .symtab
0x0 .strtab
0x0 .shstrtab
</code></pre>

<p>Most of these aren’t relevant to us, but a few sections here are to be noted. The <code>.text</code> section contains the instructions (opcodes) that we’re after. The <code>.data</code> section should have strings and constants initialized at compile time. Finally, the <code>.plt</code> which is the Procedure Linkage Table and the <code>.got</code>
|
|||
|
|
</entry>
|
|||
|
|
</feed>
|