chenxiaolong

I'm guessing it's different depending on model, but on my SM-X900 (US model Tab S8 Ultra), the key used to sign the vbmeta image (Android verified boot's root of trust) is different from every key used to sign the system apps.

It might not have the prettiest UI, but I've used this one several times when troubleshooting encoder/muxer issues: https://github.com/essential61/mp4analyser.

I haven't personally used any tool besides zrepl, but I like the flexibility it offers. It can do both push and pull-based replication. I have my offsite target server (with its own retention policy) pull from the source server. If the source ever gets ransomwared, it can't encrypt/delete all the existing snapshots on the target.

And another huge benefit for my setup is the ability to use an HTTPS connection for the replication instead of SSH. My source and target servers are in different continents so there's pretty big latency. zrepl's HTTPS server manages to transfer data at ~890Mbps while SSH doesn't deal with the high latency as well and only manages ~190Mbps.

Interesting. In my area, Spectrum would give out the same IPv4 address and IPv6 prefix seemingly indefinitely as long as I kept the MAC address and DHCPv6 client DUID the same. It'd persist across DHCP releases and renewals too. Managed to keep my "dynamic" address and prefix for half a decade.

So far, AT&T Fiber is behaving the same here too. I might somehow just be lucky with ISPs :)

This article was written by one of the developers of the "Newer" ROM hack series for New Super Mario Bros Wii. It goes into detail about how the C++ symbol mangling map in the Nvidia Shield port of the game is identified by hashes and the tricks used to brute force symbol names from those hashes and filter out invalid duplicates from hash colisions. There's also a lot of detail about how the game engine works, which I personally found pretty interesting.

None of my self-hosted things are internet facing, so I use the DNS-01 challenge type. For internal DNS, I run the powerdns authoritative server. Each ACME client uses RFC2136 (TSIG) to update the _acme-challenge TXT record. I have a pdns lua policy script set up so that the only record that's allowed to be updated is the TXT record matching the TSIG name.

To allow Let's Encrypt to hit the DNS server, I run a public-facing dnsdist load balancer. It forwards the relevant TXT, CAA, DNSKEY, and NS queries to pdns and silently drops all other queries not required for ACME challenges.

I'd prefer that the internal hostnames wouldn't be leaked in the certificate transparency logs, but given that no services are exposed to the internet, it doesn't bother me enough to look for alternatives (eg. wildcard certs).

My main switch is the Aruba S2500-48P (48x 1Gbps POE + 4x 10Gbps SFP+) and I use 2 Unifi UAP-AC-HD's for Wi-Fi (which I no longer recommend due to ongoing firmware issues). For routing, I have a custom built desktop with a micro-ATX board which runs OpnSense.

For things that "need" the performance (), I originally used a pair of Arista 7050TX's that I was kindly allowed to borrow from work. Unfortunately, these things were pulling 350W when idle and increased the temperature inside my rack by 15°F. They're also very significantly louder than a 2U Supermicro server. They're easily heard two rooms away due to the high-pitched fan noise.

Nowadays, for things that need a link faster than 1Gbps, I just use a direct connection so I don't need power hungry switches. I have my storage server connected to the main Aruba switch with 2x 10Gbps SFP+ DACs and then connected it to my desktop with 100Gbps fiber (Mellanox ConnectX-4). The storage server just uses plain old Linux bridges to behave like a switch. Actual performance without any tuning is less than half of the line speed, but that's good enough for me since the SSD's are the bottleneck for file transfer now.

For VLANs/subnets, I keep things relatively simple: 1 network for trusted things (no restrictions), 1 network for untrusted things (internet access only), 1 network for wireguard (access to trusted network only; no internet). Everything is dual-stack because I'm one of the crazy folks who love IPv6.

() "Need" because I hate slow file copies over SMB :)

This is what I've been doing for the past couple years:

1. Pictures are either manually copied to a staging folder on my storage server (for DSLRs) or automatically synced there via Syncthing (for smartphone cameras). For the latter, Syncthing is set up to preserve deleted files in case of accidental deletion.

2. The storage server runs zfs and takes 10-minutely snapshots of all datasets, which are replicated to 2 servers using zrepl: one sitting upstairs and another I rent from Hetzner halfway across the world. Replicated snapshots are kept for 2 years. Everything uses zfs' native encryption, but the replication targets do not have the key.

3. For the really important pictures and other documents, I create 2 additional backups: an encrypted backup to Backblaze B2 via rclone and burning them to M-DISC blu-rays. This is sort of a last ditch thing in case a zfs bug renders the primary backups unreadable.

apktool is such a wonderful tool. As a side note, with newer versions of Android, it's no longer necessary to extract bytecode from odex/vdex files to disassemble systems apps or frameworks too. The apk/jar files all contain `classes<n>.dex` now (this was changed when A/B partitioning was introduced, I believe).

For Linux, I almost never reinstall. Most of the package managers I've used don't make it too difficult to:

* verify the checksums of everything installed

* find packages that no longer exist in any enabled repo

* find packages (not explicitly installed) that have no reverse dependencies

* find files no longer owned by any package

As a result, I haven't had too much trouble cleaning up things that might be left behind. My longest running install is going on 11 years now, having been migrated between computers and to/from a VM 8 times.

For Windows 10, I used to reinstall whenever explorer.exe would get stuck with a persistent bug where the metadata gatherer (eg. video thumbnails, mp3 ID3 tags, etc.) would take 10+ seconds per file and Explorer would freeze until it loaded the metadata for every file. I probably reinstalled 6 times before I got frustrated and threw explorer.exe in a debugger to find the cause. Turns out clearing a few registry keys fixes the problem: https://github.com/chenxiaolong/random-scripts/blob/master/c...

Nowadays, I reinstall Windows whenever my VR headset starts to drop frames for seemingly no reason (no Windows, SteamVR, or Nvidia driver updates).

> - Android Phone + Android Tablet? Supported.

Unfortunately, I don't think even this is supported. The Android app can't seem to act as a secondary device in any configuration.

I use KeePass databases synced with SyncThing. One database for passwords and private keys, another for TOTP 2FA (which I only ever update/unlock on my phone).

As for the software I use to access the database:

* On Windows/Linux, I use KeePassXC with the corresponding browser extension. I also use the built-in SSH agent integration so I don't need to store my private keys in ~/.ssh nor manually type in their encryption passphrase.

On Windows, auto-type works great for the most part, except in ancient applications that only support scan-code-based input and not Unicode-based input (shakes fist at IPMI consoles of brand new servers that _still_ use ancient noVNC versions without support for Unicode input). I build KeePassXC from source to include a not-yet-merged patch for scan-code support.

* On Android, I use KeePassDX (open source). It integrates with Android's autofill API, but also has a keyboard for typing the username/password/TOTP code into apps that don't support autofill.

* Back when I still used iOS, I used Strongbox (open source, but does not accept contributions). It integrates with iOS' autofill API.

For syncing, I use SyncThingTray on Windows/Linux and SyncThingFork on Android. On iOS, I used to have Strongbox connect via sftp to my server running SyncThing because I could not find a decent SyncThing client. (I'm not even sure it's possible to implement on iOS without resorting to abusing location services for background execution, like iSH or most SSH clients.)

I use the RSS feed (with Miniflux as my RSS reader) and check for new entries at least daily.

Back when I still had Spectrum, I was happy to find out the way those checks are implemented in the Android app was (thankfully) as poorly done as the user experience. With adb or any app that can launch hidden activities, it is/was possible to enter the debug menu and disable every one of the client-side checks. No reverse engineering required :)

I stuck with that for years until fiber was available in my area since a threaten-to-cancel call got my TV price down to $0/month (on top of internet).

Is this a regional (or plan-related) thing? I have no problem hitting 200Mbps to my wireguard server at home, though I'm on one of the old Simple Choice plans (with the Binge-On throttling disabled if that matters).

It's a little bit longer, but bash/zsh support `printf '%q ' <args...>`, which produces output where any characters that may be interpreted by the shell will be escaped.

My understanding is that full system backups on Windows requires the tool to create VSS snapshots and back up from the snapshot. Any tool that just copies files on the disk won't work.

I use Veeam Agent for this purpose (free, but not open source). It can do full system backups and supports both restoring to the same hardware and new hardware. Restores are done via a bootable WinPE-based image that the tool creates.

One cool thing about it I haven't seen in other backup software is that incremental backups work via a driver that tracks which disk blocks are changed as the system is running. It avoids the need to rescan the disk to detect what has been changed (though it will still do that if the filesystem is modified outside of Windows, eg. if dual booting).

The biggest downside is Veeam's website. It's pretty "enterprisey" and they want you to register to be able to download. I install via the Chocolatey package manager to avoid this. Chocolatey's package source has a direct link to the official installer [0].

There are no ads, nagging, nor upselling in the software itself. I have not seen it making any network connections outside of connecting to my backup target host and the auto-updates server.

I've been looking for open source alternative with a similar feature set, but haven't had too much luck. There's Bacula, but that seems to very much be designed for an enterprise use case.

[0] https://github.com/sbaerlocher/chocolatey.veeam-agent/blob/m...

Yep. Same thing with 1800xx911xx (and so on). I made that mistake as a kid with my parents' old unactivated phone. That's when I learned any mobile phone can call emergency services.

1. 120Hz screen with a HIDPI resolution. 60Hz feels very stuttery after using 120Hz on my phone/tablet/desktop.

2. S3 suspend or at least a good S0ix implementation.

3. Good support for replacing UEFI Secure Boot keys.

4. No numpad so that the keyboard is centered.

5. Absolutely no coil whine. My Dell XPS 9560 had this since day 1, while my work MacBook Pro and Lenovo P1 developed it over time.

6. Biggest battery possible. I don't care about charging time or weight.

7. Good Linux support (including firmware updates via LVFS).

100% agreed re. bringing concurrency issues to the surface.

Another nasty one I encountered a couple years ago: After switching the build servers to using ramdisks, the app started breaking in subtle ways. Turns out there were two conflicting dependencies, but building on a server using ext4 and with the specific number of concurrent threads caused the "right" one to appear first the .jar's central directory.

Gotta add filesystem directory entry ordering to the list too.

I ran into this with a store credit card backed by Wells Fargo. They wouldn't accept

    accounts+wellsfargo@my.domain

but they accepted

    accounts+wellsfargosucks@my.domain

just fine. Seems like someone messed up the regex :)

Thanks for the link!

> No, it's when they port you over to a new splitter in your neighborhood's PFP cabinet seems to be what I'm following. Then you will be connected to a different OLT port at the CO(central office) that supports XGS-PON as well as standard GPON. > > Older Gateways will work on the newer OLT gear. But the 10Gbps XGS-PON will only work on the newer OLT ports. This newer port has an added management layer to support 10Gbps which needs authentication on top of the certs needed by both GPON and XGS-PON.

That's good to know. They already dragged their feet getting fiber available in my area (fiber laid 13 years before service was available). Hopefully they'll drag their feet with this "upgrade" too.

Any chance you have more details on this? I set up wpa_supplicant on my router to do the 802.11x auth to the ONT and short of a single "your modem/router is not phoning home"-type email, it's been working great the past year. Hoping this does not break in the future.

I had to fix a similar thing in our internal password reset email sender last year. The code was doing something like:

    for each user in (get_freeipa_users | grep_attribute uid):
        email = (get_freeipa_users | client_side_find user | grep_attribute email)
        last_change = (get_freeipa_users | client_side_find user | grep_attribute krblastpwdchange)
        expiration = (get_freeipa_users | client_side_find user | grep_attribute krbpasswordexpiration)

        # Some slightly incorrect date math...

        send_email

I changed it to a single LDAP query for every user that requests only the needed attributes. It cut that Jenkins job's runtime from 45 minutes to 0.2 seconds.

Not nearly as cool as your what you described, but I took advantage of the horrible coil whine on my Dell XPS 15 9560. The Intel CPU, Nvidia GPU, and Toshiba SSD all had different pitches of coil whine. Based on the pitch and volume, it was very easy to tell which component was being stressed :)

Android's PackageManager system doesn't use CAs. It's a trust-on-first-install system where any updates must be signed with the same cert as the original install. I don't know if it's still the case, but when I last looked at the code (around AOSP 6, I think), it did a byte-by-byte comparison of the certificate. If a update to an app was signed by even a renewed cert (with the same private key), Android would not allow it to be installed.

That's matches what I've observed on my ~2017 Dell XPS. On Linux with fwupd (and Windows), it would write the updater to the EFI partition and then set it as the default boot entry for the next boot. I had to manually add Dell's certificate to the EFI "db" variable when I switched to using custom secure boot keys.

With older versions of Android, what Google could do was pretty limited (in terms of messing with the core OS). While Google Play Services has a lot permissions, it all fits into Android's permission model and does not run as root. Package installation is done via communication with the Android framework's PackageManager class and the corresponding /system/bin/installd daemon. Silent installations and automatic updates are also handled via PackageManager using a permission that system apps can obtain.

Overwriting most core OS files (eg. shared libraries) in a persistent way, even with an exploit, would be difficult since the entire /system and /vendor volumes are signed using the device manufacturer's dm-verity keys.

However, with Android 10+ shipping with APEX modules [0], Google's ability to push core OS changes to existing devices might be changing. I'm not sure if any devices ship with the unflattened (ie. updatable) type of APEX modules yet, but I'd suspect these would be signed by Google instead of the device manufacturer and would be distributed through Google Play.

[0] https://source.android.com/devices/tech/ota/apex

A bit of a weird one, but I got a set of collapsible silicone funnels and found that they are excellent fidget toys. Gives me something to do with my hands so I don't touch my face, etc.

It'd be awesome if that worked, but unfortunately the SAML implementation my company uses doesn't work that way. A refresh just presents the username/password fields again.