zakaria's web log

Internet reading for 07/2026

2026-07-29T00:00:00Z

Internet reading for 07/2026

A shortlist of things on the internet I enjoyed reading in July.

A Voice From Nowhere
The Night Feeling
Protect Your Friends and Loved Ones — A good read about OPSEC, and being prepared. (Mostly US-centric).
Simple rules for a happier life — Two very simple rules.
How to read more books — Ironically I don’t think I read this one in its entirety.
A Scent of Twilight – Enjoyable prose.
Journalist Richard Medhurst had his mobile phone seized. Did using a secure phone protect his data? — Another one about OPSEC. To my knowledge, the first documented case of GrapheneOS helping a journalist.
US government targets Cop City protester over phone operating system — Another one about GrapheneOS in the wild.
Week 29, 2026: The slow build — Enjoyable prose.
Don’t talk to me about AI: I will shit myself

Using Firefox as a PDF editor

2026-04-06T00:00:00Z

Using Firefox as a PDF editor

I had to sign some documents recently. As most people do at some point in their lives. What I tend to do in this situation is use a browser. Because browsers are ubiquitous now, and most come with in-built PDF viewers. Usually they not only let you view PDFs, but also highlight text, add text, and add signatures. It’s pretty cool. I don’t need to touch the Adobe or Microsoft suite of crap. Plus, since I run OpenBSD, none of those are available anyway (that’s for better, definitely not for worse).

I wrote a helper script that opens a new instance of Firefox with a fresh browser profile in a temporary directory) for this purpose:

#!/bin/sh
# pdfedit [options]

trap cleanup 1 2 3 6 15

PROFILE_DIR="$(mktemp -d -p /tmp 'pdfedit.XXXXXX')"

cleanup() {
        rm -rf "$PROFILE_DIR"
}

cat <<EOF > "${PROFILE_DIR}/user.js"
// user.js
// disable javascript by default
user_pref("javascript.enabled", false);
EOF

firefox --new-instance --no-remote --offline --profile "$PROFILE_DIR" "$@"
cleanup

The script passes through any arguments you give it directly to Firefox, but I find running the script then opening PDFs through the “file open” dialog more intuitive.

To minimise the attack surface available to potentially malicious PDFs the script also uses an undocumented flag the puts Firefox in “offline mode” so it can’t access the internet (I don’t need that when opening PDFs). JavaScript is also disabled in user.js, however I’m unsure if that actually disables embedded JS from running in PDFs.

I don't like it when computers talk to me

2025-12-07T00:00:00Z

I don't like it when computers talk to me

The recent, ongoing, AI-chatbot boom has made me realise how annoying I think it is when software tries to "talk to me", like it's a fellow human being. But it isn't just annoying -- it feels wrong to me now.

When I was much younger I used to enjoy and even write my own software¹ that would include flavour text² abundantly. Things like "Welcome, ${user}!", "Good {morning|evening}", "What would you like to do today?", etc. It gave a cool futuristic vibe; "Wow! My computer is talking to me!" But as the years go on I find I just want straight answers from computers.

Some other real examples of flavour text that I don't like:

"Enter your password to unlock your account"
"Something went wrong when trying to access your account"
"Let's get you set up!"
"Hey there! You might want to enable backups. Click here to find out more"

We managed to understand Eftpos machines when they had crappy monochrome LCD screens, and gave us direct, almost brutal messaging like "ENTER PIN", "INCORRECT PIN", "ACCESS DENIED". In a way, honestly think we had it right back then.

My use of LLM chatbots is basically negligible. I have used them on very rare occasion for mundane tasks like converting an unwieldy Markdown table to TOML. I rarely actually "converse" with LLMs for any kind of research or code generation or anything like that. I just feel like chat is such a weird medium for "AI". I'm aware that due to the nature of LLMs it is basically the most direct interface for it (I think?). I can't think of a better idea, and I'm certain you can tune down the conversationality of LLM models, but it still just seems weird. Like it's pretending to be a person, even though I know it isn't, even though the LLM itself knows it isn't a person³. It's like we're both playing pretend.

Purely as an interface to a tool -- chat seems "lossy". It is easy for either side of the conversation to be misinterpreted, for context to be lost. Further it just feels plain weird to me to speak to a computer, and I hate it when it "speaks" back.

"Software" like Rainmeter skins and new-tab pages for Chrome.
Flavour text in a gaming context adds to the game's atmosphere but not to the game mechanics. In the context of this post, I mean that it tries to add "atmosphere" or "conversation" to the "data" that the software is actually trying to present.
They don't "know" anything, but hopefully my point still resonates.

Goodbye wiki.zakaria.org

2025-09-07T00:00:00Z

Goodbye wiki.zakaria.org (for now)

I setup wiki.zakaria.org some time ago. It's ended up becoming really really stale and unused¹. I'm going to "decommission" it soon. I thought I'd make this post on the main blog to reflect a little bit on what its purpose was, and to archive some of the things I had written on there.

The idea of the personal wiki

So I had this idea for a personal wiki. I'd basically dump as much knowledge as I could into it: rough notes, useful command flags, config files, code snippets, anything and everything I wanted to just take note of for later.

I wanted the style of it to be more "hacker"-y than the blog here. So naturally that means dark background + green, monospaced text.

The rest of this post will just be a breakdown of every page I had on there (there weren't many).

The stat command

This one was pretty simple. I just noticed that BSD and non-BSD stat commands had different flags for formatting. Often I'd like to get the octal representation of a file's Unix permissions, so I documented the differences.

Devices / Laptop setup

The basic idea here was to document my Laptop's config. I'm typing on that same X1 Carbon right now, actually. But I ditched Windows completely and just run OpenBSD on it now.

Devices / Mobile device setup

This one I was pretty proud of. I documented my Pixel 4a setup: OS, installed apps, etc. I took a cool photo of my phone on the homescreen too. My setup has changed quite a lot since.
I'll probably re-do these device setup ones at some point, I think it's pretty fun to write about, I love showing off my workflow and customisation.

Notes / BIP39 and Mnemonic Seeds

As the title says (albeit originally misspelled). I had some interest in how Monero, and other cryptocurrencies converted their private key seeds to phrase-based seeds.

Notes / YubiKey notes

Notes on setting up resident SSH keys on the YubiKey

Privsec / Changing $HOME

This is about a cool trick I use all the time. Most applications use the $HOME environment variable to determine the current home directory (naturally). You can change $HOME to whatever you want. Can be useful.

Privsec / NFT

Notes + template for Linux NFT.

Privsec / Windows Sandbox

This just became the Windows Sandbox post here on the main blog. It's the same thing.

Going forward

Yeah so I might revive the wiki subdomain but it's not gonna have the same stuff. I don't really have the time at the moment to invest too heavily into a new side project either. We'll see.

It hasn't been updated in four (4) years! damn!

There's nothing to do

2025-08-16T00:00:00Z

There's nothing to do

You ever feel like there's nothing to do?

Of course there's things you should be doing... but you don't want to do any of that. You want something else... Something stimulating but not... work. Not housework, not study work, and not "work" work. (Definitely not that last one). Maybe you have a hobby (you do have one, right?) but you just can't be bothered with that either?

You ever feel like you've "finished the internet," as my mother says?

You've caught up with all your feeds. You've read all the blogs. Checked all the forums. You've even run out of YouTube videos to watch! Of course the internet is virtually infinite and yet... it feels like you've seen it all today?

If any of that is you I have the solution! Pick up a book. A real, physical, in your hands book. You do have some of those, right?

Oh. You can't be bothered with that either?
To be honest, me neither.

So then... What do we do now?

Soft uptime

2025-06-21T00:00:00Z

Soft uptime

PS> Get-Uptime

Days              : 0
Hours             : 20
Minutes           : 27
Seconds           : 48
Milliseconds      : 0
Ticks             : 736680000000
TotalDays         : 0.852638888888889
TotalHours        : 20.4633333333333
TotalMinutes      : 1227.8
TotalSeconds      : 73668
TotalMilliseconds : 73668000

Huh? 20 hours? I just powered this thing on a few minutes ago!

Turns out Windows has this "fast startup" thing. As far as I can tell, when you go Start > Shutdown it closes all running processes, logs out, and then hibernates the system so that it can startup faster next time. That basically means to Windows it's not been "really" shutdown so the uptime isn't reset. I don't know why you'd want this, generally for decent spec'd windows laptops the startup time is pretty good, and the difference with this feature enabled is negligible -- but I don't manage this laptop, so not much I can do really.

So how do I tell how long my laptop has been "on" (like, since I pressed the power button)?

Well, there's one pretty ubiquitous process on Windows that's generally one of the first user-facing applications: explorer. So to get a better idea of when I powered on my machine today, I wrote a function to check the explorer.exe process start time: Get-SoftUptime.

function Get-SoftUptime {
    [CmdletBinding()]
    param (
        [Parameter()]
        [switch]
        $Since
    )

    $started = [datetime](Get-Process | Where-Object { $_.Name -eq "explorer" } | Select-Object -ExpandPropety StartTime)

    if ($PSBoundParameters.ContainsKey("Since)) {
        return $started
    } else {
        return (Get-Date) - $started
    }
}

The -Since option mirrors the behaviour of Get-Uptime -Since: it'll just spit out the start time of explorer.

This gives me a better idea of when I started up my laptop. The output is the same format (a [datetime]) as Get-Uptime too if that is helpful.

I've used explorer because I reckon it's one of the first processes to start, it gives me a good enough idea. I don't need it to be very accurate.

Thoughts on "Thoughts on Thinking"

2025-06-20T00:00:00Z

Thoughts on "Thoughts on Thinking"

I came across this post on the orange site about someone feeling "stuck" because they've relied on AI way too much. It got me thinking of how defeatist, and pathetic it kind of sounded to me. This article is not directed at the author, Dustin, personally, it's my thoughts on his thoughts. When I say "you", I really mean you, dear reader. My tone in this article/rebuttal/review or whatever may come across as rude, mean-spirited, but I mean no harm to the author, Dustin Curtis. It may sound like I have just called him pathetic, but I don't think he's pathetic at all, I think the tone of his post is kind of pathetic (sorry). I'd like to preface that My tone is meant to be "tough love", rather than cynical, or bullish, don't take it personally :).

I have been stuck. Every time I sit down to write a blog post, code a feature, or start a project, I come to the same realization: in the context of AI, what I’m doing is a waste of time. It’s horrifying. The fun has been sucked out of the process of creation because nothing I make organically can compete with what AI already produces&emdash;or soon will. All of my original thoughts feel like early drafts of better, more complete thoughts that simply haven’t yet formed inside an LLM.

To start off how about don't do that?
How about not starting a project or blog post thinking about it in "the context of AI".
How about not thinking that your thoughts have to be run through into an LLM to be "complete"?

Your thoughts are incomplete, they are all early drafts. That's okay. Human thought is unstructured, chaotic, and just kind of inconsistent and crap half the time. That's what we are, that's how we think, that's reality. Hell, I'm still not even sure if writing this post is a good idea.

And come to think of it, I don't understand how people think LLM slop isn't inconsistent and crap either? I don't understand how an LLM output is anymore "complete" or "better" than the "early drafts" (minus say spelling + grammar corrections I suppose). Because as people have shown often, LLMs spit out bullshit and LLMs have the same monotone "cadence", the same prose. This writing style of LLMs is noticeable to many.
Please write stuff in your own words, your own tone, your own style, LLMs are so boring.

You can tell, with 90% accuracy, when a post or a comment online or an email or a presentation is written by AI. (I can tell, anyway :P).

I think maybe the benefit of me personally staying clear of all AI/LLM-related software, "helpers", "assistants", is that I really don't think about it at all. I don't think about plugging an idea into there. I just write it down, and it gets lost for a few months, or never comes to fruition. Maybe I'm wrong but I think that's completely okay.
We don't need to take very idea and iron it out and push it out as a product or a project or whatever. We can just sit on things, forget things, let them rot and never even consider them again. Again, it's just fine... A fact of life... Whatever happens will happen. That's my opinion, anyway.

I used to write prolifically. I’d have ideas, write them down, massage them slowly and carefully into cohesive pieces of work over time, and then–when they were ready–share them with the world. I’d obsess for hours before sharing anything, working through the strengths and weaknesses of my thinking.

WTF? You can still do this, all of this, by exercising some goddamn discipline! Don't login to ChatGPT (or whatever). For one day just don't open it up. Don't use AI tools. Then after that one day... Do it again the next day. It will probably be hard at first if you rely on it so much. But your brain will benefit and you'll get out of your creative rut.

Your thoughts are stupid. All of our thoughts are stupid. This post of mine here is really stupid. LLMs kind of just sugar coat the stupid, don't they?

Following from the quote above;

Early in my career, that process brought a lot of external validation. And because I think when I write, and writing is how I form opinions and work through holes in my arguments, my writing would lead to more and better thoughts over time. Thinking is compounding–the more you think, the better your thoughts become.

Yes! Not even the brightest minds in history would think in perfect ideas. Good writers write, and re-write, and proof read and re-write again, and again, and again. And each time they do that they gain some kind of something -- knowledge, insight, skill, "better writing", whatever. I say this without any hard evidence to back it up (just like an LLM, I guess) but it's true, and you know it's true.

But now, when my brain spontaneously forms a tiny sliver of a potentially interesting concept or idea, I can just shove a few sloppy words into a prompt and almost instantly get a fully reasoned, researched, and completed thought.

Well, you need to stop doing this mate...

Minimal organic thinking required. This has had a dramatic and profound effect on my brain. My thinking systems have atrophied, and I can feel it–I can sense my slightly diminishing intuition, cleverness, and rigor. And because AI can so easily flesh out ideas, I feel less inclined to share my thoughts–no matter how developed.

Yeah... This is pretty scary, for everyone, actually. And I've noticed it with people in my life too. This needs to be unlearned.

I thought I was using AI in an incredibly positive and healthy way, as a bicycle for my mind and a way to vastly increase my thinking capacity. But LLMs are insidious–using them to explore ideas feels like work, but it’s not real work. Developing a prompt is like scrolling Netflix, and reading the output is like watching a TV show. Intellectual rigor comes from the journey: the dead ends, the uncertainty, and the internal debate. Skip that, and you might still get the insight–but you’ll have lost the infrastructure for meaningful understanding. Learning by reading LLM output is cheap. Real exercise for your mind comes from building the output yourself.

Totally agreed on this. Dennis, you kind of put my thoughts above into better words.

And I’m still stuck. But at least I’m here, writing this, and conveying my raw thoughts directly into your brain. And that means something, I think, even though an AI could probably have written this post far more quickly, eloquently, and concisely. It’s horrifying.

The only thing that's horrifying is the fact that people think that something being generated quickly, eloquently and concisely, means that its worth more than human-written text. When people write, and other people read it, it's like lofi consciousness to consciousness communication. I'm not trying to get metaphysical or spiritual here but a writer benefits from writing, and a reader benefits similarly too. Writing style/prose can be an art, even on a techbro blog post. And I've kind of already said what I feel about LLM's "prose".
Besides, I don't really think it really could write your post more eloquently. It conveys your feelings, in "your language", your prose.

And that's kinda... cool? We need to keep doing this.

To conclude, are you just going to sit there and be "stuck"? Or are you going to create? Are you going to write more posts like that one? (Yes, the one I just called pathetic).
Write flawed shit. Write with spelling mistakes, and grammatical errors and logical inconsistencies. Write code, brain to editor. Scratch shit down on pen and paper, with your hands. Make it messy, unstructured notes, arrows pointing backwards and forwards and scribbling "what the fuck?" next to something you don't understand so you can search it up later.

If you're serious about fighting against your self-described atrophy, you need to be disciplined. Do not reach for the ChatGPT, disable AI code suggestions. Use your hands, your brain.
Have bad ideas and fail often.
Have bad ideas and forget them.

Paste as plaintext

2025-02-28T00:00:00Z

Paste as plaintext

I use Windows for work. I used to use it at home. But now I only use it at work¹.

Anyways, for quite a while (many years now) in "modern" GUI applications+operating systems there's been this feature where if you copy some styled text, usually from the web, it tries to copy that formatting across to wherever you're pasting it as well (if it supports styled text).

For example if I select and ctrl+c copy some <h1> from an article on a website, and I ctrl+v paste that in MS Teams, that h1's basic CSS/rich-text styling (text size, sometimes font, colour, hrefs, etc) will get pasted into my Teams text-input. This happens for pasting in a many other GUI applications too.

The worst is when it pastes white-coloured text from a site that uses white on black². Teams by default has a 'bright' interface, so... you can't see shit.

The only very very rare time it is ever useful is copying across a table into an email or Teams message.

My question is; who the fuck asked for this? Who makes use of this on the daily and is very impressed by its addition to our lives?
I mean, it just seems like it'd be useless for everyone:

If you're copying some text from a site into your Word document -- surely you'd want it to match the style of your Word document, right?
If you're pasting that text in a Teams message -- do you really enjoy the weird out-of-place style the text has in contrast to the rest of your default-styled message? (Same goes for pasting into rich-text emails).
Do you really just absolutely love it when after pasting that styled text the rest of your following typed text inherits that awful, out-of-place style of the text you pasted? Oh, you do like that, huh? Freak.

Who decided it should be rich-text by default? And am I the only one who doesn't like it? Am I the only one who this frustrates on the daily? Am I the only one who can't stand having to open Notepad and paste shit in there first to get rid of formatting? Maybe there's just a simple solution I'm not aware of.

Yeah, I can right click and "paste as plaintext". There probably is a keybind to do this, but it depends on the application: Is it ctrl+alt+v? or ctrl+shift+v? or is it something completely different?
The clipboard should just be plaintext-by-default! Everything else should be under an optional keybind or context menu. Not the other way around.

If you enjoy the copy with formatting "feature", please don't hesitate to email me. Just know I will take great pleasure putting that email straight into the trash.

Peace.

"use" is too pleasant a word, actually. I "deal with it". I "deal" with Windows.
Not usually actually white foreground on black background -- most sites know not to assault their user's eyes with such contrast (unless for a11y reasons).

YubiKey resident SSH keys on Windows+WSL

2022-03-23T00:00:00Z

YubiKey resident SSH keys on Windows+WSL

This is a guide that documents how to use YubiKey resident SSH keys on Windows, with passthrough to WSL2 via npiperelay and socat.

It's important to understand that with this setup, WSL is using the ssh-agent service running on Windows, not WSL. However, because of the magic of Unix pipes+sockets, you shouldn't notice any functional differences.

Download OpenSSH

As of writing, OpenSSH 8.1p1 (the default on Windows 10), does not support importing resident SSH keys from YubiKeys via ssh-add or ssh-keygen. So first we need to update OpenSSH for Windows:

Download the latest .zip from the Win32-OpenSSH GitHub releases page. (OpenSSH-Win64.zip in my case).
Unzip it, and run the install-sshd.ps1 script as Administrator.

This script will update the appropriate Windows system services (sshd and ssh-agent) to use the executables in the current directory instead of the default ones. The script will not, however install the the executables into your PATH (of which ssh-add and ssh-keygen we'll need later on) so remember where you've unzipped it.

Next restart the ssh-agent Windows service:

Open services.msc from Run (Win+R).
Find "OpenSSH Authentication Agent", right click and select "Restart".

Configuring WSL2

Install socat using your package manager (e.g. sudo apt install socat).
Download the latest npiperelay from the GitHub releases page. Unzip it, and copy npiperelay.exe to somewhere in your WSL's $PATH (~/bin/npiperelay.exe in my case).

In your ~/.profile, or ~/.bashrc shell startup script add the following (adapted from the wsl-ssh-agent README):

export NPIPE_CMD=$(command -v npiperelay.exe)
export SSH_AUTH_SOCK=$HOME/.ssh/agent.sock


# setup socat
ss -a | grep -q $SSH_AUTH_SOCK
if [ "$?" -ne "0" ]; then
	rm -f $SSH_AUTH_SOCK
	( setsid socat UNIX-LISTEN:$SSH_AUTH_SOCK,fork EXEC:"$NPIPE_CMD -ei -s //./pipe/openssh-ssh-agent",nofork & ) >/dev/null 2>&1
fi


# add your ssh private key paths here ...
ssh-add ~/.ssh/id_ed25519 ~/.ssh/id_rsa

Importing resident SSH keys

Importing resident ssh private keys from the YubiKey via ssh-keygen -K isn't supported on the default version of OpenSSH installed on Windows 10. However, we can make use of the updated binaries we downloaded previously, which do support importing resident ssh keys:

Open a privileged Administrator PowerShell window. It must be a privileged PowerShell window, otherwise it will fail with an "invalid format" error.
cd to the directory the previously downloaded OpenSSH binaries reside (the path I told you to keep a not of).
Run .\ssh-keygen -K, and follow the prompts:

There is another method that requires a second device running anything that isn't Windows (Linux, *BSD, etc). I did this way before realising I could use the updated ssh-keygen binary:

Import the resident keys to a file; ssh-keygen -K -f ./id_ed25519_sk, (make sure to set a password).
Either copy the resulting file to a USB drive, or upload it somewhere private (this is, after all, your private key).
Copy/download the file onto your Windows machine, and add it to the authentication agent via ssh-add c:\path\to\file.

Adding keys to the agent

Adding keys to the agent is fairly simple, whether in WSL or Windows. Just use the ssh-add command.

In WSL2:

$ ssh-add /path/to/file

In Windows (PowerShell):

PS C:\Windows\system32> ssh-add C:\path\to\file

Automating

If like me you have named your SSH keys in a non-standard way, or for some other reason ssh-agent won't load your keys on startup, we can write a simple PowerShell one-liner that runs at login:

C:\Users\zzz\Documents\bin\OpenSSH-Win64\ssh-add.exe "$env:USERPROFILE\.ssh\id_yubikey" "$env:USERPROFILE\.ssh\id_something_nonstandard"

You will need to replace C:\Users\zzz\Documents\bin\OpenSSH-Win64\ with the path to where you unzipped Win32-OpenSSH previously (hope you didn't forget!).

Save this script as ssh-keys.ps1 in: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp, and it should run at startup, prompting you for a password in a PowerShell window if your keys are password protected.

Similarly, for adding the private keys in WSL2 you can add a ssh-add /path/to/key1 /path/to/key1 line to your shell rc.

Installing Headscale on OpenBSD

2022-02-15T00:00:00Z

Installing headscale on OpenBSD

This guide is severely out of date: I've received a couple emails about getting relayd to cooperate with headscale. Tailscale, and therefore headscale has gone through a major protocol change since this post, and as such it relies heavily on web-sockets. While web-sockets are supported by relayd, I could not get it to work. Instead of relayd, just for headscale, I use ssl-proxy. I just point it to my TLS certs, and specify the ports + addresses I need to get it listening.

Oh, also, the Android client supports custom Control Server URLs out of the box now, and has done for some time. Yay!

I'm hoping to re-do my setup and post about it at a later date.

In this post I'll detail the steps I took to install and configure headscale, an open-source self-hostable implementation of the Tailscale control server, on OpenBSD.

Code blocks prefixed with # imply that the command should be run as a privileged user/root.

If you get stuck, it'll be probably worthwhile to have a read of headscale's documentation available in their GitHub repo: https://github.com/juanfont/headscale/tree/main/docs .

Compilation

Since my server is on OpenBSD-stable, headscale is only available via pkg_add on -current, I need to compile the headscale binary by hand and upload it to the server. I'm doing this on an OpenBSD machine, so compiling and uploading it to the server should be a breeze.

$ git clone git@github.com:juanfont/headscale.git
$ cd headscale
$ make generate
$ make build
$ sftp user@server <<EOF
> put ./headscale
> bye
EOF

Then login, get root access, and copy the binary to /usr/local/bin:

$ ssh user@server
$ doas -s
...
# cp ./headscale /usr/local/bin
# chown root:bin /usr/local/bin/headscale

Configuration

Next we need to setup:

a _headscale daemon user that headscale will run as.
directories for headscale to store its sqlite database, private key, and socket (making sure they have the correct permissions/owner).
copy the example config from GitHub, and edit it to our liking

First we setup some directories:

# mkdir -p /etc/headscale
# touch /etc/headscale/config.yaml
# mkdir -p /var/headscale

Then we add our _headscale daemon user, and chown all the necessary dirs.
Here we also run doas to get us a shell as _headscale so I can create the db.sqlite file. Note doing it this way requires some doas.conf rules.

# useradd -L daemon -s /sbin/nologin -d /var/headscale _headscale
# chown -R _headscale:_headscale /var/headscale 
# doas -u _headscale /bin/ksh
$ touch /var/headscale/db.sqlite

Finally we can edit the headscale config. I highly recommend copying the example config and using that as a starting point.

# vi /etc/headscale/config.yaml
# # copy the example config
# # change domain, IPs, ports
# # change sock location to /var/headscale/headscale.sock

I'm currently using relayd(8) as a TLS proxy, so I don't need to configure any TLS-related stuff.

Run headscale serve to see if the config works, and all the directories and permissions are correct:

# doas -u _headscale headscale serve
...

If all is well we can move onto setting up an init script for the headscale daemon.

rc.d

I've made an init script to making stopping/starting and running at boot a lot easier. Drop this simple script into /etc/rc.d/headscale:

#!/bin/ksh
#
# /etc/rc.d/headscale

daemon_user="_headscale"
daemon="/usr/local/bin/headscale"
daemon_flags="serve"

. /etc/rc.d/rc.subr

rc_cmd $1

chmod, enable and start it as usual:

# chmod +x /etc/rc.d/headscale
# rcctl enable headscale
# rcctl start headscale
headscale(ok)

Clients

So here's where you may run into some problems. Depending on the OS your client is going to be running on, it might be a little difficult to get Tailscale to use your custom control server. On Android, this editing the hardcoded Tailscale control server URL, and compiling the client from source.

OpenBSD client

It's pretty easy to get the Tailscale client on OpenBSD to use your control server.

# pkg_add tailscale
# rcctl enable tailscaled; rcctl start tailscaled
# tailscale --login-server "https://headscale.example.com:443"
...

Where https://headscale.example.com:443 is your control server URL.

Android client

You can find the instructions for patching and building the custom APK here.

I didn't bother even attempting to install the android sdk, ndk, and all the other required (garbage) on OpenBSD to compile the Android client. So I booted into Windows, then logged into Ubuntu on WSL, then had to install Go manually (since Ubuntu 20.04 packages are old AF and I can't be bothered to move all the junk I've accumulated in my WSL distro's $HOME). Then i installed the sdkmanager manually, then i installed the ndk through that manually, then I ran make tailscale-debug.apk.

Quite frankly this was painful, but it isn't supposed to be. Wrangling with old documentation I found online about installing the android sdk on the outdated WSL Ubuntu setup I have set me back a few hours.

In the end it was quite rewarding to install the APK file, open it up and see it all working!

My stagit setup

2022-02-14T00:00:00Z

stagit setup on OpenBSD

stagit is a static page generator for git repos. It's very minimal - which I like.

In this post I'll detail how I set up git.zakaria.org on my OpenBSD server.

The majority of my setup is based upon a post by poptart. Be sure to check out the original post here: https://hosakacorp.net/p/stagit-server.html. It's pretty well done, and easy to follow (unlike my post here - which is really more for my sake when I inevitably bork my server again and have to re-do it all). poptart has some other great OpenBSD-related posts on there as well.

Setup

On the server install git, create the _git user, and make some directories:

server# pkg_add git libgit2
server# groupadd _git
server# mkdir -p -m 744 /var/git/repos /var/git/template
server# useradd -g _git -L daemon -c "git backend user" -d /var/git/repos -s /usr/local/bin/git-shell _git
server# chown _git:_git /var/git/repos

The directories we created:

/var/www/repos contains the bare git files (also the $HOME of user _git)
/var/git/template will contain the template for new repositories.

The next steps are only if like me you've made source changes to stagit and you'd like to use your custom version. If you want to use plain stagit, install it on the server with pkg_add stagit.
On another machine, compile stagit and sftp it over to the server:

laptop$ make
laptop$ md5 stagit stagit-index
laptop$ # remember these checksums for verifying it's been copied over correctly
laptop$ sftp enderman <<EOF
> put stagit
> put stagit-index
> bye
EOF

Back on the server, verify the binaries were copied over correctly:

server# md5 stagit stagit-index
server# # verify the checksums

Copy these binaries to /usr/local/bin and set permissions appropriately:

server# cp stagit{,-index} /usr/local/bin
server# chown root:bin /usr/local/bin/stagit{,-index} 
server# chmod 755 /usr/local/bin/stagit{,-index}

The following is a message from the future:

I wrote this post a while ago. But I recall abandoning the modified stagit binary setup purely because the libraries on my laptop were newer than my server, and I could not get static compilation to work... So I gave up and installed stagit via pkg_add stagit on the server :P

Scripts

Next we'll configure a few scripts:

/var/git/repos/template/post-receive
Will be executed every time we push to a repo.
/usr/local/bin/stagit-gen-index
A helper script to generate the index page.
/usr/local/bin/stagit-newrepo
Script to run to create a new repository.
/usr/local/bin/stagit-chdesc
Script to change the description of an existing repository.

Some internal variables will be shared between these scripts, for instance the git user, htdocs path, etc. Instead of writing these out into each script we can create a config file that each script will source before running anything.
In /var/git/config.rc:

# shared variables
GIT_HOME="/var/git"
GIT_REPOS="${GIT_HOME}/repos"
WWW_HOME="/var/www/htdocs/git.zakaria.org
CLONE_URI="_git@git.zakaria.org"
DEFAULT_OWNER="zakaria"
DEFAULT_DESC=""
GIT_USER="_git"

We restrict access to this file to root:wheel:

server# chown root:wheel /var/git/config.rc

After a git push we want the server to (re)generate the static html pages. To do this, we write a script in /var/git/template/post-receive:

#!/bin/sh
# Author: Cale "poptart" Black
# Modified by: zakaria @ zakaria.org
# License: MIT

set -euf

. /var/git/config.rc

export LC_TYPE="en_US.UTF-8"
src="$(pwd)"
name="$(basename "$src")"
dest="${WWW_HOME}/$(basename "$name" '.git')"
mkdir -p "$dest"
cd "$dest" || exit 1

echo "[stagit] building $dest"
/usr/local/bin/stagit "$src"

echo "[stagit] linking $dest"
# if a README.html exists use that as the index.html
# if not use log.html
if [ -f "README.html" ]; then
	ln -sf README.html index.html
else
	ln -sf log.html index.html
fi
ln -sf ../style.css style.css
ln -sf ../logo.png logo.png

Next, we need a script to generate the stagit /index.html. In /usr/local/bin/stagit-gen-index:

#!/bin/sh 
# Author: Cale "poptart" Black
# License: MIT

set -eu

. /var/git/config.rc
stagit-index "${GIT_REPOS}/*.git" > "${WWW_HOME}/index.html"

The next script will be used to setup a new repository. In /usr/local/bin/stagit-newrepo:

#!/bin/sh
# Author: Cale "poptart" Black
# Modified by: zakaria @ zakaria.org
# License: MIT
# Usage: stagit-newrepo <name> [desc] [author]

set -eu

. /var/git/config.rc

log() {
	printf '%s\n' "$*" >&2
}
die() {
	log "error: $*"
	printf 'exiting...\n'
	exit 1
}

REPO="$1"
DESC="${2:-$DEFAULT_DESC}"
OWNER="${3:-$DEFAULT_OWNER}"

if [ -z "$REPO" ]; then
	die "no repo name given"
fi

REPO_PATH="${GIT_REPOS}/${REPO}.git"

git init --bare "$REPO_PATH"
cp "${GIT_HOME}/template/post-receive" "${REPO_PATH}/hooks/post-receive"
echo "${CLONE_URI}/${REPO}.git" > "${REPO_PATH}/url"
echo "$OWNER" > "${REPO_PATH}/owner"
echo "$DESC" > "${REPO_PATH}/description"

chmod u+x "${REPO_PATH}/hooks/post-receive"
mkdir "${WWW_HOME}/${REPO}"
/usr/local/bin/stagit-gen-index

At the end of this script we call our stagit-gen-index helper script to regenerate the index.html.

The last script is a simple wrapper that will allow us to change a repo's description:

#!/bin/sh
# Author: zakaria / zakaria.org
# License: MIT
# Usage: stagit-chdesc <repo> <new_description>

set -eu

. /var/git/config.rc

log() {
	printf '%s\n' "$*" >&2
}
die() {
	log "error: $*"
	printf 'exiting...\n'
	exit 1
}

REPO="$1"
DESC="$2"

if [ -z "$REPO" ]; then
	die "no repo name provided"
fi
if [ -z "$DESC" ]; then
	die "no new description provided"
fi

REPO_PATH="${GIT_REPOS}/${REPO}.git"

echo "$DESC" > ${REPO_PATH}/description

Then set the appropriate permissions and restrictions for these scripts:

$ chmod +x /usr/local/bin/stagit-{gen-index,newrepo,chdesc}
$ chown -R _git:_git /var/git/template
$ chmod +x $GIT_HOME/template
$ chown -R _git:_git $WWW_HOME

Replacing GIT_HOME and WWW_HOME with the variables we configured previously in config.rc.

Finally we configure our doas.conf(5) to allow our main user to run these commands:

permit nopass mite as _git cmd /usr/local/bin/stagit-newrepo
permit nopass mite as _git cmd /usr/local/bin/stagit-gen-index
permit nopass mite as _git cmd /usr/local/bin/stagit-chdesc

I've made a git repository for these scripts (and maybe a few more) available on GitHub which is mirrored on git.zakaria.org

httpd config

To actually serve the generated static files we need to configure httpd(8). In /etc/httpd.conf:

...snip...

server "git.zakaria.org" {
	listen on 127.0.0.1 on 8080

	# for letsencrypt
	location "/.well-known/acme-challenge/*" {
		root "/acme"
		request strip 2
	}

	root "/htdocs/git.zakaria.org"
}

...snip...

I use relayd(8) as a TLS proxy, so I don't need to configure TLS certs in httpd.conf.

Temporary web browsing

2021-12-13T00:00:00Z

Temporary web browsing

Here's a few ways of scripting an ephemeral browser environment.

The idea is that the entire state of the browser is ephemeral - on exit everything should be removed from storage including cookies, history bookmarks, etc. This is more aggressive than your standard incognito mode as it directly removes all files associated with the browser instance.

I use this all the time because for some things I don't find it necessary for history, bookmarks, etc to be saved (a quick web search, logging into personal, sensitive services like online banking). Some might find it over-the-top but I think its a useful scripting exercise if anything.

1. Temporary profile

Browsers typically have a user "profile", where all bookmarks, history, and other required state is stored.
Most browsers that matter (Firefox, Chromium) allow the directory this profile information is stored in to be configured via a CLI flag. For firefox this is ---profile <path>, which defaults to somewhere in ~/.local if my memory serves correct. Similarly, Chromium (and I assume other Chromium-based browsers by proxy) support this via the --user-data-dir=<path>, which defaults to ~/.config/chromium.

This feature can be used to create a fresh, new profile in a custom directory. On exit this directory can be aggressively removed by a simple rm -rf <path> command. Here's a short script to facilitate all this for Firefox:

#!/bin/sh

# make temporary profile directory
PROFILE_DIR="$(mktemp -d -p /tmp 'firefox.XXXXXX')"

cleanup() {
	rm -rvf "$PROFILE_DIR"
}

firefox-esr --new-instance --no-remote --profile "$PROFILE_DIR" "$@"

cleanup

First the script creates a temporary directory via mktemp, where the profile will be. Next we define a cleanup function to be run after Firefox, so that on exit the profile is simply rm -rf'd. Then firefox-esr is run (replace this with firefox if you don't use the ESR variant), and the profile directory is specified with --profile.

I also included the --new-instance flag to make sure Firefox didn't just open a tab in an already running instance, and --no-remote to dissallow remote commands.

Additional arguments can be passed to the script - these will be directly added to firefox-esr's arguments.

I also like to add a trap to the script, so if it ever exits unexpectedly, the clean-up process will still take place. This is what that looks like:

#!/bin/sh
# trap everything; clean up on exit
trap cleanup 1 2 3 6 15

# make temporary profile directory
PROFILE_DIR="$(mktemp -d -p /tmp 'firefox.XXXXXX')"

cleanup() {
	rm -rvf "$PROFILE_DIR"
}

firefox-esr --new-instance --no-remote --profile "$PROFILE_DIR" "$@"

cleanup

The equivalent final script for Chromium/Chrome:

#!/bin/sh
# trap everything; clean up on exit
trap cleanup 1 2 3 6 15

# make temporary profile directory
PROFILE_DIR="$(mktemp -d -p /tmp 'chrome.XXXXXX')"

cleanup() {
	rm -rvf "$PROFILE_DIR"
}

chromium --user-data-dir="$PROFILE_DIR" "$@"

cleanup

2. Temporary home directory

Instead of specifying a custom profile, then removing it, why not create an entire ephemeral home directory, then remove that?

This trick is fairly simple and works on any program, not just browsers. Just re-define the $HOME environment variable to $FAKEHOME, and any program that runs after that will "think" that's the real home directory:

$ FAKEHOME=/tmp/firefox
$ HOME=$FAKEHOME firefox [...] https://zakaria.org/

Note this method means removing $FAKEHOME/Downloads and any directory the program creates in its dedicated home directory on exit. If you've downloaded something you'd like to keep you'll need to copy it out of $FAKEHOME/Downloads BEFORE closing the browser.
Since the program runs in a new home directory, if you use X11 it won't have access to ~/.Xauthority, so it won't be able to actually be graphically useful. To fix this simply symlink ~/.Xauthority to $FAKEHOME/.Xauthority before running.

A script that does all this, plus some more:

#!/bin/sh
# trap everything; clean up on exit
trap cleanup 1 2 3 6 15

# setup fake home dir
FAKEHOME="$(mktemp -d -p /tmp 'firefox.XXXXXX')"

# clean up after exit
cleanup() {
	rm -rvf "$FAKEHOME"
}

# link Xauthority
ln -s "${HOME}/.Xauthority" "${FAKEHOME}/.Xauthority"

# unset XDG dirs as these can intefere with the fake $HOME if they're set
# to something non-default
unset XDG_CONFIG_HOME
unset XDG_CACHE_HOME

# set the fake home dir
export HOME=${FAKEHOME}

# run firefox w/ given args
firefox-esr --new-instance --no-remote "$@"

# uncomment for chrome
# chromium "$@"

cleanup

Extra stuff

To add to these scripts, one could also:

Force a specific user-agent string
Configure user.js used by Firefox by writing to $PROFILE_DIR/user.js before actually running the Firefox command

My personal scripts do just that, for Chromium and Firefox.

Other methods

Some other methods to look into include:

Mounting a new in-memory filesystem dedicated to a fake home dir or browser profile
- OpenBSD does not support mounting filesystems as non-root users, so this isn't ideal for my setup.
Ephemeral containers
- While the security aspects of Linux containers are overrated IMO, using one as the basis for an ephemeral browser instance doesn't sound like an awful idea.
Dedicated virtual machine
- I've actually accomplished this in the past on an Alpine Linux VM running on OpenBSD's vmd(8) and X11 forwarding. But I never fleshed out any scripts for making it truly ephemeral - that might be the focus of a future blog post. Here's an old screenshot of that running on OpenBSD 6.7.

Breaking promises with LD_PRELOAD

2021-12-07T00:00:00Z

Breaking promises with LD_PRELOAD

In this post I show how to simply noop calls to OpenBSD's pledge(1) using LD_PRELOAD.

I only focus on pledge(2), only because that's what I first tried this out on. But this will also work for unveil(2), and any syscall you want for that matter.

Before we get into it, this doesn't actually make pledge(2) completely useless, nor is it an oversight by the developers of OpenBSD - LD_PRELOAD can be used to break any and every system call. I just thought it was a neat trick that might be useful for CTFs or something. In regard to the title, I just couldn't pass on the fantastic opportunity for some word play+clickbait.

What is pledge?

pledge(2) is a system call created for OpenBSD for the purpose of application sandboxing. When called, pledge(2) "promises" that the current process will only make use of certain system calls - if the process violates these promises after pledge(2) has been called the process is killed with a SIGABT signal. Using this system call appropriately facilitates the security principle of least privilege; only allowing the process access to the parts of the system it needs to operate, and denying it access to functionality it does not need.

Subsequent calls to pledge(2) can reduce the abilities of a program further, but abilities cannot be regained.
This can be useful when writing daemon programs - during initialisation system daemons often need access to a lot of the more "priviledged" system calls, but after initialisation access to these abilities is no longer required. So typically daemon programs on OpenBSD call pledge(2) multiple times. Once to allow access to the initial system calls, then again, once the process is initialised, to deny access to ever use those system calls again.

What is the LD_PRELOAD trick?

I reccommend reading this article by baeldung to understand what LD_PRELOAD is: What is the LD_PRELOAD Trick?.

Simply put, LD_PRELOAD influences the "linkage" of shared libraries and resolution of functions at runtime. This can be useful for debugging, reversing, and profiling dynamically linked programs.

Crafting a shared object

LD_PRELOAD works by loading a shared object file that can essentially re-define whatever dynamically linked C function or syscall during the running of the program.

To craft our shared object to use with LD_PRELOAD first we have to look up the function signature of pledge(2) in the man page and plop it into a .c file:

#include <unistd.h>

int
pledge(const char *promises, const char *execpromises)

Next, we want to make sure when called pledge(2) does absolutely nothing and returns success every time it's called. Alternatively, you could add additional promises, or remove specific promises, but I think its more jarring to make it do absolutely nothing.

// pledge_override.c
#include <unistd.h> 

int 
pledge(const char *promises, const char *execpromises) {
	// noop
	return 0;
}

Compile it into a shared object override.so:

$ cc -shared -fPIC -o override.so pledge_override.c

Now, with this shared object file, you can run anything you want ignoring it's pledge(2) promises:

$ LD_PRELOAD=$PWD/override.so <program>

Testing it out

Here we have an example use of pledge(2) (yes, I should be checking return values, but this is just an example).

// test.c
#include <stdio.h>
#include <unistd.h>

int
main(void) {
	// promise to only use stdio
	pledge("stdio", NULL);
	printf("Hello! I will abort now :3\n");

	// revoke all promises
	pledge("", NULL);

	// should abort here
	printf("You should not be seeing this :O\n");
	return 0;
}

When run normally the program should abort at the second call to printf(3) since after the first one we've revoked the privilege to call stdio functions.

$ ./a.out
Hello! I will abort now :3
Abort trap (core dumped)

Then, when we add our specially crafted override.so to the equation:

$ LD_PRELOAD=$PWD/override.so ./a.out
Hello! I will abort now :3
You should not be seeing this :O

When this won't work

Using LD_PRELOAD like this to get around pledge doesn't work when:

You statically link your binary
- If you statically link your binary, LD_PRELOAD does not have any effect.
- To test this out, compile the above example program with -static, then try and do the LD_PRELOAD trick again. It'll always abort at the correct printf(3) call.
SUID / SGID
- SUID or SGID binaries aren't affected by LD_PRELOAD according to the OpenBSD man page.
  The Linux man page is less clear about this, but I assume its the same.
- Simply put, your doas(1) and sudo(1) are safe.

Changelog

18-07-2022: Added "What is pledge?" and "What is LD_PRELOAD" sections.

Windows Sandbox

2021-08-08T00:00:00Z

Windows Sandbox

If you['re forced to] use Windows this might be useful for compartmentalisation.

Windows Sandbox is a Windows 10 Pro feature that enables the use of temporary Virtual Machines. These can be used as ephemeral sandboxes for applications.

Enabling

Windows Sandbox isn't enabled by default. To enable it follow these steps:

Open "Control Panel" and click the upside down caret next to the back/forward buttons
Click "All Control Panel Items"
Navigate to "Programs and Features"
On the left click "Turn Windows features on or off"
Scroll down and tick the box next to "Windows Sandbox" if it isn't already ticked

From the start menu search for "Windows Sandbox". Hit enter and a fresh Sandbox window will appear.

Configuring

Once the sandbox window is closed all data is erased. Next time you open Windows Sandbox a fresh new VM is created.
This can make it annoying if you wish to sandbox a single program, but have to install it every time you start a new sandbox.

To make it easier for these cases you can pre-configure sandbox instances via .wsb files. With this file you can configure memory, networking, audio/video passthrough, among other things. See the Microsoft official documentation for Windows Sandbox configuration¹. It also supports running a script at startup, and mapping network devices and local shares.

I highly suggest reading through the documentation for the .wsb file format. There are some good examples and interesting features.

Example: Zoom

Zoom is a very popular group call/video conference software (I won't bore you with the details I'm sure you have some idea what Zoom is by now). However, Zoom has had numerous security and privacy issues. If you're paranoid like me you may feel uneasy just seeing it's icon in the start menu - knowing you have it installed on the same machine along with all your other precious digital data. I digress, here is a configuration file for my Zoom sandbox:

<Configuration>
    <MappedFolders>
        <MappedFolder>
            <HostFolder>C:\Sandbox\Installers</HostFolder>
            <SandboxFolder>C:\Installers</SandboxFolder>
            <ReadOnly>true</ReadOnly>
        </MappedFolder>
    </MappedFolders>
    <AudioInput>Enable</AudioInput>
    <VideoInput>Enable</VideoInput>
    <VGpu>Enable</VGpu>
    <MemoryInMB>12288</MemoryInMB>
    <LogonCommand>
        <Command>C:\Installers\ZoomInstaller.exe</Command>
    </LogonCommand>
</Configuration>

It maps the local C:\Sandbox\Installers directory (where I store ZoomInstaller.exe) to C:\Installers in the VM itself. Enables audio (mic) and video (webcam) passthrough. I allocate 12Gb to the VM - should be more than enough on my laptop with 16Gb of RAM. It then runs the Zoom installer on startup.

The verdict? It works fairly well. Recently however webcam passthrough has stopped working, possibly due to a driver issue. (Installing drivers requires the machine to reboot - but you can't reboot a sandbox without deleting everything).

I make use of a couple of these .wsb files for different programs I'd rather install on an ephemeral virtual machine than my main OS.

https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-sandbox/windows-sandbox-configure-using-wsb-file

Feb 2021 Update: Git Server + Hidden Service

2021-02-24T00:00:00Z

Update Feb 2021: git server + hidden service

Here's a little site update.

CSS changes

As usual the CSS of this website is ever-changing. I've changed it to be more monochrome, with blue highlights on link hover/focus and text selection. Headings are now all 1em.

Git server

I've set up a git server on git.zakaria.org using stagit to generate the pages. I followed a guide by poptart¹. It's a very well written guide for setting up stagit on OpenBSD.
I modified some of the scripts provided to suit my workflow.

I plan to move most of my projects that don't require an issue tracker over there. Namely personal configs/programs.

Hidden service

During January I made this site accessible over Tor via a hidden service/onion service. I had some (layer 8) issues with the service provider and had to reset the server and so the service URL has changed a few times. The canonical onion service URL can be found on the about page or in the footer.

Why have I setup an onion service? Three reasons:

Tor is a technology that interests me
I wanted to see how difficult it would be to setup a hidden service (it was not difficult²)
It's fun

Because onion services can't have subdomains, I've setup relayd(8) so the git server can be accessed on the service via a /git/ endpoint (this is only available on the hidden service).

Other

Edit 20201-02-25: Apologies for those who now have duplicate RSS entries. I've redone the RSS script, so the new feed might have merged with the old in your readers. Removing and re-adding the feed should fix this.

https://hosakacorp.net/p/stagit-server.html
I referred to these two guides: https://medium.com/@sarala.saraswati/tor-hidden-services-on-openbsd-with-httpd-52852f49358c, https://dataswamp.org/~solene/2018-10-11-tor-hidden-service.html

Usbkill the OpenBSD Way

2021-01-11T00:00:00Z

`usbkill` the OpenBSD way

usbkill is a kill-switch that shuts down your computer on any USB change. It does this by watching the output of lsusb and when there is a change it runs shutdown -h now.

Simple, right? One thing to note is that lsusb is not included in OpenBSD's base packages, but hotplugd(8) is.

hotplugd

So what is hotplugd, and how can it be useful? The man page does a good job of explaining it. Simply put: when any device is attached to or detached from your machine hotplugd will execute a script.

To see how simple it is to write a hotplug script we can start by simply logging device attach events. First, start by enabling and starting hotplugd (as root):

# rcctl enable hotplugd
# rcctl start hotplugd
hotplugd(ok)

Next we will write the script that is executed on a device attach event:

# mkdir -p /etc/hotplug
# $EDITOR /etc/hotplug/attach

In this file we will log the device class and name:

#!/bin/sh

DEVCLASS=$1
DEVNAME=$2

# log attach event
logger -t hotplug "$DEVCLASS:$DEVNAME attached"

To see this in action in another terminal type

$ tail -f /var/log/messages

Then connect a USB device to your machine and you should see messages tagged 'hotplug'. This is what I get when I plug in my Logitech USB adapter for my wireless mouse (which I usually don't use):

Jan 11 11:48:32 x1 hotplug: 0:uhid3 attached
Jan 11 11:48:32 x1 hotplug: 5:wsmouse2 attached
Jan 11 11:48:32 x1 hotplug: 0:ums0 attached
Jan 11 11:48:32 x1 hotplug: 0:uhid1 attached
Jan 11 11:48:32 x1 hotplug: 5:wskbd1 attached
Jan 11 11:48:32 x1 hotplug: 0:uhid0 attached
Jan 11 11:48:32 x1 hotplug: 0:uhid4 attached
Jan 11 11:48:32 x1 hotplug: 0:uhid2 attached
Jan 11 11:48:32 x1 hotplug: 0:uhidev1 attached
Jan 11 11:48:32 x1 hotplug: 0:uhidev2 attached
Jan 11 11:48:32 x1 hotplug: 0:ukbd0 attached
Jan 11 11:48:32 x1 hotplug: 0:uhidev0 attached
Jan 11 11:48:32 x1 hotplug: 0:uhid5 attached
Jan 11 11:48:32 x1 hotplug: 0:uhid6 attached

Site note: What is happening here? Why have so many events popped up after inserting one USB device? My theory is that because it's a Unifying Receiver, it allows more than one Logitech HID to be connected to a single receiver, so it must register a bunch of HIDs to the kernel.

The 'kill' part

Now that we've seen how hotplugd works, we can work on the kill part of usbkill.
We want to shutdown the machine on a device attach or detach event, but we also want to be able to arm and disarm the kill part, since I might need to plug something in once in a while. Make the /etc/hotplug/attach script as so:

#!/bin/sh

arm_file=/tmp/arm_usbkill

DEVCLASS="$1"
DEVNAME="$2"

logger -t "${0##*/}" "${DEVCLASS}:${DEVNAME} attached"

if [ -f "$arm_file" ]; then
        shutdown -p now
else
        logger -t "${0##*/}" "unarmed - aborted shutdown"
fi

If the /tmp/arm_usbkill file exists then the machine will shutdown, if it doesn't exist it will just add a log entry to syslog.

hotplug also supports running a different script, /etc/hotplug/detach on detach events. Since both scripts are exactly the same I've symlinked the attach script to the location of the detach script.

# ln -s /etc/hotplug/attach /etc/hotplug/detach

The ${0##*/} logger tag gets substituted to the filename of the script being executed (in this case it is either attach or detach).

One thing to note is that this setup will execute the shutdown command on any device change event. This includes USBs but also includes network devices, disk drives, and serial line interfaces¹. If that is a problem, you can implement a device class-based whitelist by checking $DEVCLASS:

#!/bin/sh

# class whitelist (space-separated)
class_whitelist="0 2 3 5"

# arm file
arm_file=/tmp/arm_usbkill

DEVCLASS="$1"
DEVNAME="$2"

whitelisted() {
	for class in $class_whitelist; do
		if [ "$class" = "$1" ]; then
			return 0
		fi
	done
	return 1
}

logger -t "${0##*/}" "${DEVCLASS}:${DEVNAME} attached"

if [ -f "$arm_file" ]; then
	if whitelisted "$DEVCLASS"; then
		logger -t "${0##*/}" "whitelisted - aborted shutdown"
		exit 0
	fi
	shutdown -p now
else
	logger -t "${0##*/}" "unarmed - aborted shutdown"
fi

But this is not really useful to me since I use a laptop and I'm not attaching and detaching network devices or disk drives.

One disadvantage of this setup is the inability to whitelist devices based on their USB IDs like you can with usbkill. This could be acheived through a much more complicated script using usbdevs to get USB IDs, but as of yet I have no need for that.

Arming and disarming

To arm and disarm this script all you have to do is create or remove the $arm_file respectively. Here are some shell functions to add to your shell rc to make it easier:

# arm/disarm usbkill
arm() {
        touch /tmp/arm_usbkill && printf 'armed\\n' || printf 'error arming\\n'
}
disarm() {
        rm -f /tmp/arm_usbkill && printf 'disarmed\\n' || printf 'error disarming\\n'
}

The script can be armed or disarmed by any regular user which may or may not be preferable to you (and isn't the case for usbkill, which requires root to run).
Originally I had added the uchg flag to the file to lock it. But this proved to be counterproductive since it wasn't cleared from /tmp on reboot and when hotplugd would first start up, it would immediately shutdown the machine again. That was fun to fix (not).

Why?

So why do all this? Why not just pkg_add usbutils, download + run usbkill and be done?
Well for starters that isn't as fun. The main reason is that all this works in a default OpenBSD install - no additional packages needed. Why install a program to solve a problem when the default tools and services can solve the problem just as (if not more) elegantly?

My xenodm setup

2021-01-04T00:00:00Z

My xenodm setup

OpenBSD uses the xenodm(1) display manager, which is a fork of xdm.
Xenodm looks quite ugly by default, and after reading a couple¹ of² articles³ on themeing xenodm I've come up with my own setup.

Before we get into the configs, here's what it actually looks like:

(The text might be small, click to view the image file)

Clean and simple. Now that you've seen what it looks like you can close this tab if that's all you came here to see. If you want to see how this is accomplished then continue reading.

Files

xenodm uses multiple files for configuration. It's quite inconvenient, and I was very confused at first I admit. The files we'll have to deal with are:

/etc/X11/xenodm/Xresources
/etc/X11/xenodm/Xsetup_0
/etc/X11/xenodm/Xsession

The last one is for an optional non-cosmetic change that I'll cover later. All these files require root access, so it'd be wise to doas -s before continuing on.

Xresources

If you've ever dabbled in trying to rice your Unix-like operating system there's a good change you've come across an Xresources file before. The X window system uses a "resource database" as a 'unified' way to store configuration data.

xenodm sources the Xresources file before loading. Using entries in the Xresources file we can configure what the login widget (the place we type our username + password) looks like.

First off, I'd like to be able to see my password being entered as I type with little * as it so commonly is.

xlogin.Login.echoPasswd: true

Next I don't want to be 'greeted', and I want the message when I put my password in incorrectly to be ya dun goofed:

xlogin.Login.fail: ya dun goofed
xlogin.Login.greeting:

Now I'll configure the dimensions and positioning of the login box:

xlogin.Login.height:            200
xlogin.Login.width:             400
xlogin.Login.y:                 320
xlogin.Login.frameWidth:        10
xlogin.Login.innerFramesWidth:  0

Add some colour (or lack thereof):

xlogin.Login.background:        #000000
xlogin.Login.foreground:        #eeeeee
xlogin.Login.failColor:         #b00035
xlogin.Login.inpColor:          #000000
xlogin.Login.promptColor:       #eeeeee
xlogin.Login.hiColor:           #000000
xlogin.Login.shdColor:          #000000

And finally let's use a nice bitmap font to complete the look:

xlogin.Login.face:              Dina-11
xlogin.Login.failFace:          Dina-11
xlogin.Login.promptFace:        Dina-11

Note that last step requires the Dina font to be installed (it does not come with OpenBSD).

Xsetup_0

Next is the Xsetup file. Why is this called Xsetup_0? Because xenodm can be configured to run multiple X display servers, and the main one is 0, hence the 0 (check out /etc/X11/xenodm/xenodm-config).

This file is fairly simple. It's a shell script that xenodm runs. That's it. Simple as that. Through this script we can run pretty much any program we like. In my case, a simple lemonbar script:

/etc/X11/xenodm/Xsetup_0:

#!/bin/sh

# set background
/usr/X11R6/bin/xsetroot -solid \#000000

# add Dina font to font list
/usr/X11R6/bin/xset fp+ /usr/local/share/font/dina
 
# status bar
(
while true; do
        reboot="%{F#b00035}%{A:reboot:} r %{A}%{F-}"
        shutdown="%{F#b00035}%{A:shutdown -p now:} p %{A}%{F-}"

        echo "  $(date '+%T')  %{r}${reboot}/${shutdown}  $(date '+%F')    $(apm -l)%  "
        sleep 1
done | /home/zzz/bin/lemonbar -d -g 1920x40+0+0 -f 'Dina:style=Medium:pixelsize=13' -B \#000000 -F \#eeeeee | sh
) &

# uncomment to take 'screenshot'
#(sleep 5 && xwd -out /tmp/xenodm.xwd -root) &

The date, time, battery percent are all piped into lemonbar. Additionally the 'r' and 'p' text in red allow me to reboot or power off my machine respectively.

It should be noted that I probably shouldn't be using a binary that's located in my user writable home directory here. Check the footnotes for other options, namely using xmessage and/or xclock. Or you can just take out the lemonbar bit entirely, which I will likely do in the future.

Xsession extra

Here's the optional bit. I'm a big fan of decluttering my home directory. Moving as many dotfiles out of $HOME/ as possible. Moving ~/.Xresources was easy - just source a different file from ~/.xsession. But an annoyance is ~/.xsession itself, which up until now I had no idea how to move. Turns out its location can be changed in /etc/X11/xenodm/Xsession!

Look for the line that says:

startup=$HOME/.xsession

Here we can change the startup variable to be any path we like:

startup=${HOME}/etc/x/xsession

Also, if you've themed ssh-askpass(1) like I have and want to actually see those changes when it prompts for your ssh key password then you should probably source your user Xresources before running all the ssh-related stuff.

Look for this part of the script:

# if we have private ssh key(s), start ssh-agent and add the key(s)
id1=$HOME/.ssh/identity
id2=$HOME/.ssh/id_dsa
id3=$HOME/.ssh/id_rsa
id4=$HOME/.ssh/id_ecdsa
id5=$HOME/.ssh/id_ed25519
if [ -z "$SSH_AGENT_PID" ];
then
	if [ -x /usr/bin/ssh-agent ] && [ -f $id1 -o -f $id2 -o -f $id3 -o -f $id4 -o -f $id5 ];
	then
		eval `ssh-agent -s`
		ssh-add < /dev/null
	fi
fi

Just anywhere above this section simply add xrdb -load $HOME/path/to/xresources.

this is the first article I read on the subject

this article is the basis for my configuration, stylistically and config-wise.

OpenBSD Notes

2020-12-08T00:00:00Z

OpenBSD notes

Random notes on running OpenBSD (some notes may only be useful for a laptop install). Updated frequently.

Power/Battery

Hibernate on low battery

To hibernate at 5% remaining battery add in /etc/rc.conf.local:

apmd_flags=-A -Z 5

User power commands

In /etc/doas.conf:

permit nopass :staff as root cmd zzz
permit nopass :staff as root cmd ZZZ
permit nopass :staff as root cmd reboot args
permit nopass :staff as root cmd shutdown args -p now

Multimedia

Microphone setup

I have a fancy microphone that has a headphone passthrough. So it is both USB "speaker" and a USB microphone. Good news, that makes using it with sndio a bit easier.

Change primary sndiod device to the microphone (check dmesg for audio[0-9] device id):

# rcctl set sndiod flags -f rsnd/1
# rcctl restart sndiod

Switch mixer sources:

# mixerctl outputs.hp_source=dac-2:3
outputs.hp_source: dac-0:1 -> dac-2:3

To switch back, remove the sndiod flag, and change the source back to it's original value (dac-0:1).

X

See full post for xenodm themeing.

PF

Packet Filter (firewall). General stuff to remember:

last rule 'wins'*
egress = interface(s) that hold the default route(s)

Standard preamble

# options 
set block-policy drop
set skip on lo

# default deny
block all 

# antispoofing
antispoof for egress
antispoof for $vm_int

Allow NTP

In rare cases ntp can use tcp apparently...

pass quick inet proto { tcp, udp } to port ntp

VMs

Don't forget to sysctl net.inet.ip.forwarding=1!

# where:
# vm_int        = vm interface (vether[0-9])
# vm_dns_server = dns server to be used by vms

# allow ssh traffic to vm
pass out on $vm_int proto tcp to $vm_int:network port 22

# vm nat
match out on egress from $vm_int:network to any nat-to (egress)
pass in proto { tcp udp } from $vm_int:network to any port domain \
        rdr-to $vm_dns_server port domain

# allow icmp + web from vms
pass in on $vm_int proto icmp
pass in on $vm_int proto tcp to port { www, https }

# only allow X11 forwarding on the vm interface
pass in on $vm_int proto tcp to port 6000:6010

Misc

Manual pages as beautifully typeset PDFs

$ MANPAGER=zathura man -T pdf style

How I (almost) fixed my fonts

2020-12-05T00:00:00Z

How I (almost) fixed my fonts

This site goes through CSS changes daily. Yes, daily. I can't stop changing the CSS. It's gotten to the point where I focus more on the CSS of this site than, evidently, writing posts for it.

I like web fonts. But I also like simplicity and straightforwardness. Sadly, getting webfonts and CSS to work together flawlessly is no simple task.

Google Fonts

At first I just used Google Fonts: click, click, right click, copy, paste @import URL. Done. Fixed. ...or so I thought.

Using Google fonts has the unfortunate side-effect that I now depend on a 3rd-party CDN for my site to look nice. That CDN is obviously Google - that's not ideal for me.

Self-hosting Google Fonts

So I decided to just host the fonts on this webserver. I came across this gem: google-webfonts-helper. You choose your Google fonts, it generates a zip file containing the font files, and some CSS to put on your page. Perfect! ...or so I thought.

Inline stylesheets

Wait. Now my fonts flash for a second. Oh, this is the fabled FOUT I've been hearing about. Google Fonts didn't seem to have this issue, though I suppose their server is far more responsive than mine, and they do some CDN tricks or something. Here's a CSS-Tricks article I read: https://css-tricks.com/how-to-load-fonts-in-a-way-that-fights-fout-and-makes-lighthouse-happy/. I don't recall whether it helped me in this endeavour or not since the solution requires JavaScript (eugh).

I decided to just inline the stylesheet to fetch the fonts and apply them since it took the browser a bit extra to download styles.css and since the fonts would be loaded with the webpage it shouldn't look to bad. I added font-display: fallback for some extra peace of mind.

@font-face {
	font-family: 'Charter Regular';
	font-style: normal;
	font-weight: normal;
	font-display: fallback;
	src: local('Charter Regular'),          local('Charter-Regular'),
	     url('/fonts/charter_regular.woff') format('woff'),     /* Modern Browsers */
	     url('/fonts/charter_regular.ttf')  format('truetype'); /* Safari, Android, iOS */
}

@font-face {
	font-family: 'Charter Regular';
	font-style: normal;
	font-weight: bold;
	font-display: fallback;
	src: local('Charter Bold'),          local('Charter-Bold'),
	     url('/fonts/charter_bold.woff') format('woff'),     /* Modern Browsers */
	     url('/fonts/charter_bold.ttf')  format('truetype'); /* Safari, Android, iOS */
}

html, body {
	font-family: "Charter Regular", "Times New Roman", serif;
}

This still didn't give the desired result. There were still weird loading times and odd font flashes.

The fix (sort of... not really)

I give up.

html, body {
	font-family: sans-serif;
}

Chances are whenever you're reading this the site has already been changed to reflect this change.
Sans-serif looks better for this site anyways :P

Malthusian Belt

2020-11-07T00:00:00Z

Malthusian Belt

I'm reading Aldous Huxtley's Brave New World and as with most books I read I've come accross many words and phrases that I don't understand. One of which was Lenina's "Malthusian belt". At first I thought "Malthusian" refered to the belt's geographical origin (Malta? No, that would be Maltese), but the word didn't fit any place I knew of so naturally I looked it up.

I was surprised to find this¹ Wikipedia article on Malthusianism:

Malthusianism is the ideals has population growth is potentially exponential while the growth of the food supply or other resources is linear.

Since everyone in the brave new world is born from artificial embryos, suppression of normal human conception is clearly important. The Malthusian belt must actually be some sort of birth control device that women generally wear.

It's a very interesting conceptual device and it makes me wonder about how on Earth Huxley came up with this idea.

While this may have been obvious to some from the name of it, or perhaps even the context in the book, it wasn't obvious to me. Not understanding the phrase prompted me to look it up. And hey, now I have a lot about Malthusiamism to read about.

https://en.wikipedia.org/wiki/Malthusianism

Quick setup script with tmux

2020-09-09T00:00:00Z

Quick setup script with `tmux`

In my network security class we ssh into a handful of VMs pretty often.
Instead of trying to juggle 5 open terminal windows I tried to make this a bit easier to manage by having all my ssh sessions run in separate tmux windows - switching between them with C-b {1,2,3,etc} when necessary. I found myself doing this every time I'd load up my Kali Linux VM:

tmux
C-b c
ssh bastion
C-b c
ssh proxyserver
C-b c
ssh edgerouter

But then I thought, why not script this process? It should be easy enough. And it sure was easy. Here's what I came up with:

#!/bin/sh

tmux new-session -d
tmux new-window -n "bastion" ssh bastion
tmux new-window -n "proxyserver" ssh proxyserver
tmux new-window -n "appserver" ssh appserver
tmux new-window -n "edgerouter" ssh edgerouter
tmux selectw -t 0

tmux attach-session -d

First, the script creates a new tmux session in the background. Then it opens a new window for each ssh session, naming them appropriately. After that it switches back to the first window (which is just a local shell), and finally it attaches the tmux session to the current terminal session.

Now after I start my VM all I have to do is run the script (I called it setupsess), and I'm ready to start hacking away at my messy nftables configs.

M4 Troubles

2020-08-03T00:00:00Z

M4 Troubles...

In my previous post I wrote about mostly M4 templates. Well, it turns out I've run into some issues.

Chapter I: The Problem

I ran my blog script to convert my markdown into a nice HTML webpage, but then something happened. Nothing. Nothing happened. The script just sat there, stuck. This was odd because the script usually runs in under a second, so something had to have gone wrong...

Chapter II: The Quick Fix

I turned on tracing in my head.m4 by adding traceon to the start of the file then I ran the script again. I knew instantly what had gone wrong... M4 was spitting out the same HTML over and over and over again: It was expanding the macros I had written in my post! Creating an infinite loop.

As a quick fix in the post I replaced all occurrences of my actual macros with ones that were slightly different. It worked! ...but then M4 gave another error:

m4: unexpected end of input, unclosed parenthesis:

Chapter III: The Root of All Evil

In my search for answers I came across this post: http://silas.net.br/tech/devel/m4.html. While the particular issue in on the webpage wasn't my issue, it gave me a hint as to what had gone wrong. M4 must have been trying to expand or evaluate something else in my post's text. Eventually I figured out that M4 was trying to run all the define() and include() statements I had written in my post. Needless to say, writing a post about M4 while using M4 for my templates was causing some issues...

As a crappy bandaid I added a couple of seds to my script:

article_html=$(echo "$article_html" |  sed -E -e "s/define\(/\'!define\(!\"/g" -e "s/include\(/\'!include\(!\"/g")

Because I only wrote define and include in my M4 code snippets for the post, this worked just fine. (Hopefully it works for this post too).

I may have to rethink using M4 completely because I won't lie I have no idea what I'm doing - it seems like I'm bound to run into this issue or a similar one in the future. Maybe Timmy was wrong; maybe I should just echo a bunch of HTML in my script instead, surely it can't be that messy. We'll have to see what I come up with.

Chapter IV: Going Forward

For now, consider my previous post to be non-cannon in the /bin/sh blog series (if you can really call it a series - there hasn't even been a part II yet!).

The /bin/sh blog

2020-08-01T00:00:00Z

The /bin/sh Blog. Part I: Timmy's Templates

I love Unix shell scripting, in fact I may enjoy it more than "actual" programming. I say "shell scripts", as opposed to "bash scripts", simply because I don't use bash for my scripts. The reason why is not relevant to this post. What is relevant is why make a blog using shell scripts?
Well, why not? After all, Makefile blogs are a thing that exist, and Makefiles are just one way of running commands to do something. Hmm. I wonder, what's another way of running a bunch of commands?

Oh! I know!

Well, what is it Timmy?

Why, shell scripts of course!

Woah, thanks Timmy, why that's correct.

But how will you ever manage a website's HTML layout all in a shell script? Wouldn't that get messy?

Why yes Timmy, it would get pretty messy. What we need is some kind of "template" which can take some input and output HTML which we can serve...

What about that old M4 thing?

"M4", Timmy? What on earth is that?

RFTM dude: https://en.wikipedia.org/wiki/M4_(computer_language), https://man.openbsd.org/m4

Okay Timmy, no need to be rude now. We have guests, remember?

Ignoring Timmy's rude nature, we now have a way of making "templates" of sorts, to make building the HTML a little easier. First, we'll start with something (almost) every HTML document on the web has, a <head>:

define(`_HTMLHEAD', `<head>   
<title>My Blog Lol</title>
<link rel="stylsheet" href="/style.css"/>
</head>')

Okay so now we have a _HTMLHEAD macro defined. In our m4 file, whenever we type _HTMLHEAD, the <head> containing our blog's title and a link to our stylesheet will be printed. There's only one problem, currently on every page our title is exactly the same. That is fine for some things, but for actual posts we should be able to set our <title> to be the title of our post. With M4 this is a piece of cake:

define(`_HTMLHEAD', `<head>
<title>$1 - My Blog Lol</title>
<link rel="stylsheet" href="/style.css"/>
</head>')

Well, what changed?

See Timmy, on the second line, there is now a $1 - before the rest of the blog title.
In M4, macros can have arguments that can be placed into the macro's content. Now, if we call _HTMLHEAD(`This is a post'), the resulting HTML will be:

<head>
<title>This is a post - My Blog Lol</title>
<link rel="stylsheet" href="/style.css"/>
</head>

The $1 has been replaced by our first argument, as expected. Nice. We can define more macros; for the navigation, footer, whatever you like. Here's a simple one that includes a <head> and also a <nav> block containing our site's navigation links:

define(`_HTMLHEAD',`<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1">
<title>$1 - zakaria.org</title>
<link rel="stylesheet" href="/style.css"/>
</head>'
)

define(`_HTMLNAV', `<nav>
<p><a href="/">zakaria.org</a><br/><a href="/posts/">blog</a> / <a href="/rss.xml">rss</a> / <a href="https://github.com/e-zk/">gh</a></p> 
</nav>'
)

For the sake of neatness, I've placed this code in head.m4. For our individual posts, we need to write more M4. Here's a simple post template, we'll call it post.m4:

include(m4/head.m4)dnl
<!DOCTYPE html>
<html>
_HTMLHEAD(POSTTILE)
<body>
_HTMLNAV
<main>
POSTCONTENT
</main>
</body>
</html>

On the first line, we include the macros in our head.m4, then on line 4 we "call" our _HTMLHEAD macro, then shortly after we call our _HTMLNAV macro. M4 fills in these macros with whatever they're defined as, in our case our <head> and <nav> blocks of HTML. Neat? Right?
Moving on-

I'm confused

About what, Timmy?

Those strange upper-case words littered throughout the file: POSTTILE and POSTCONTENT.

Oh! Thank you Timmy, I almost forgot. These are also macros, much the same as our _HTMLNAV and _HTMLHEAD ones, but they aren't defined in any of the M4 files we're using. That's because we define these macros when we run m4 itself:

$ m4 -DPOSTTILE="Hello?" post.m4

The -D argument defines a symbol to have some value. In this case POSTTILE now becomes Hello? after M4 is done running. Try running:

$ m4 -DPOSTTILE="Test" -DPOSTCONTENT="<h1>Test :P</h1>" post.m4

M4 should output a "complete" HTML document, with the title "Test" and with a single heading reading "Test :P".

Now that we have a (an?) M4 template set up, instead of echoing a bunch of <html> in our script, now all we have to do is call m4 and pass arguments to it for our content to show up in the resulting HTML.

Don't be mad. But that's the end of this post. I know, I know we didn't actually write any shell script just yet, (Timmy is giving me the stink eye right now), but that's for another time.
Stay tuned for part II.

zakaria's web log

Internet reading for 07/2026

Internet reading for 07/2026

Using Firefox as a PDF editor

Using Firefox as a PDF editor

I don't like it when computers talk to me

I don't like it when computers talk to me

Goodbye wiki.zakaria.org

Goodbye wiki.zakaria.org (for now)

The idea of the personal wiki

The stat command

Devices / Laptop setup

Devices / Mobile device setup

Notes / BIP39 and Mnemonic Seeds

Notes / YubiKey notes

Privsec / Changing $HOME

Privsec / NFT

Privsec / Windows Sandbox

Going forward

There's nothing to do

There's nothing to do

Soft uptime

Soft uptime

Thoughts on "Thoughts on Thinking"

Thoughts on "Thoughts on Thinking"

Paste as plaintext

Paste as plaintext

YubiKey resident SSH keys on Windows+WSL

YubiKey resident SSH keys on Windows+WSL

Download OpenSSH

Configuring WSL2

Importing resident SSH keys

Adding keys to the agent

Automating

Installing Headscale on OpenBSD

Installing headscale on OpenBSD

Compilation

Configuration

rc.d

Clients

OpenBSD client

Android client

My stagit setup

stagit setup on OpenBSD

Setup

Scripts

httpd config

Temporary web browsing

Temporary web browsing

1. Temporary profile

2. Temporary home directory

Extra stuff

Other methods

Breaking promises with LD_PRELOAD

Breaking promises with LD_PRELOAD

What is pledge?

What is the LD_PRELOAD trick?

Crafting a shared object

Testing it out

When this won't work

Changelog

Windows Sandbox

Windows Sandbox

Enabling

Configuring

Example: Zoom

Feb 2021 Update: Git Server + Hidden Service

Update Feb 2021: git server + hidden service

CSS changes

Git server

Hidden service

Other

Usbkill the OpenBSD Way

usbkill the OpenBSD way

hotplugd

The 'kill' part

Arming and disarming

Why?

SEE ALSO

My xenodm setup

`usbkill` the OpenBSD way

Quick setup script with `tmux`