</th>	X</th>	Y</th>	Z</th></tr></thead>
Min</td>	130</td>	155</td>	330</td></tr>
Max</td>	835</td>	950</td>	730</td></tr>
Range (Max-Min)</td>	705</td>	795</td>	400</td></tr> </tbody></table> X and Y have very decent ranges, which is super great, but in any case, the sensors are so precise, that the step between two values is only one, if I move the stick gently enough. Clearly, at last 400 different values, and up to 795, are more than enough for me to fly anything in any game! I'm also not sure about what level of flying would require more precision.</p> Gimbal is first assembled.</em></p> A sensor and its magnet in the final state after the adjusments.</em></p> Carving the handle</h2> It happened that I had a boxtree</a> branch available. Boxwood is a very fine wood to carve, and the diameter of the branch was perfect for sculpting a handle, while passing some wires inside it for the buttons. I am quite happy with the result of the handle itself, but the revolute-joint that binds it to the gimbal is currently not at its best. Reworking that part is already planned. The piece of boxwood before anything happened.</em></p> Carving the inside of the handle, to make place for the wires.</em></p> A button, ready to be put in place behind the trigger.</em></p> Wiring the electronic</h2> Nothing really fancy here, the electronic is really simple.</p> Hall-effect sensors are wired the same way potentiometers are. That means a pin to the ground, a pin to the +5V, and the third pin will be the output tension, that must be connected to an analog input of the Arduino micro.</p> For the buttons, using the QMK firmware makes wiring a diode matrix</a> possible. This allows a great number of switches on a very small number of inputs on the controller. Schematics</em></p> Download schematics</a> Arduino micro pinout diagram</em></p> Programming the controller</h2> At the very beginning of this project, I had already found this pull-request</a> in the QMK firmware</a> project, which I had tested on my BFO-9000</a>, leveraging the virtual axis feature to fly ships using a keyboard recognized as a joystick by Star Citizen (most games would work too). While this worked pretty bad for flying (spoiler alert: discrete, all or none axis are not that great!), this gave me confidence that the real analog axis would work fine too from the game's point of view.</p> By the time I had the joystick assembled for the first time, the PR had even been merged, and was fully functional! Here</a> is my firmware code at the time of writing.</p> Calibrating the joystick using `jstest-gtk</code></em></p>` `Finally testing the joystick in game!</em></p>` `For those who want to see more pictures,` `here is a gallery</a> with photos of all the building steps.</p>` Next steps</h2> Even if the joystick is currently working, it's still a very early prototype that needs improvements. Here are some of them that I already thought of:</p> Mount the stick on a proper bearing for less play and smoother feeling.</li> Make an adjustable spring system, for fine tuning the rest position.</li> Make a case around the gimbal to protect the wiring, and host more buttons.</li> Mount everything on a decent metal plate instead of a thin wooden plank.</li> Build a second joystick to handle 3 more axis!</li> </ul> Enjoying Tool live 2019-07-02T00:00:00+00:00 Last summer, I had the pleasure to see Tool</a> in concert at the Hellfest festival, and that really was awesome for multiple reasons:</p> The musicians are technically very skilled, being in studio as well as on stage.</li> The show is centred on the music and the visual light effects combined together to create a very mesmerizing performance.</li> They even ask the public not to take pictures or videos to enjoy the moment as one that must be lived and felt, rather than watched later on a small, inhuman screen.</li> The sound tuning was just perfect, and I don't remember being at a metal show with that many people able to listen to the music without their ear protection. Thank you Hellfest for that!</li> They played some of their new titles that weren't released yet at the time.</li> </ul> Of course, going to another show now would probably fulfil only the three first points in my list, but I find them far good enough to recommend Tool</em> for your next concert!</p> Boardgame review: Outlive & Captain Sonar 2019-01-03T00:00:00+00:00 A long time a go, in a blog not so far away, someone stopped writing, for no real reason. Many happy new years later, that guy tested two wonderful boardgames, and started writing again.</p> Outlive</h1> Let's start by the most common of the two: Outlive</a>.</p> In this survival game, you compete with other players to collect the too few resources available and optimize your shelter, so that you get better bonuses and make more "survival point" to win the game.</p> One of the fun part regarding other games is that you can directly interact with other by putting "pressure" on their characters so that you steal them resources, which can make a great difference in their, and your ability to realize one or the other action.</p> All in one, it's quite a challenging game for those who want to calculate the many possibilities at each turn, since there are always multiple ways to win.</p> Captain Sonar</h1> The second game is in a far less common style. Captain Sonar</a> is here to immerse yourself in a submarine crew member, dividing the players in two teams competing on the same map to destroy the other, a bit like a classical naval battle.</p> But the really awesome part is that this game is made to be played in real-time, meaning that a team can just navigate faster than the other by simply being more efficient in coordinating itself. Though, speed will not help when it comes to launch a torpedo on the other submarine, and a great part of the work is first to spot the enemy ship without giving too much informations about your own position.</p> Really fast to learn, but very difficult to master, this game is perfect to play with 6 to 8 players, and is seriously awesome for a week-end with friends, even if some of them are not particularly fond of boardgames.</p> First workshop at the Grehack 2016-11-20T00:00:00+00:00 Last Friday, I was in Grenoble, at the Grehack, to give my very first workshop! Dustri</a> asked me a few weeks ago if I could come with him, since this was about radare2</a>, the very famous reverse engineering framework that I had worked for in RSoC 2014.</p> This was a very fun experience, with everyone being pretty happy learning the mysteries of r2. I even helped a bit a guy using r2 during the CTF that followed, this was really encouraging. Of course, you can grad the slides and the material here: link</a>. Feel free to contact me if you have problems trying to (re)do the workshop at home.</p> During the day, there were also some various talks, more or less interesting. That was also the occasion to talk a bit with cool guys from Tetrane</a> about their awesome tool Reven (almost as awesome as r2! :D).</p> The organisation was great, but there were some small hiccups that made the Grehack a bit messy. Anyway, the staff was really kind, and I'd still be happy to come back another year.</p> Reviewing the Touch Lux 3, by Pocketbook 2016-05-22T00:00:00+00:00 For my birthday, my parents offered me an ebook reader, the Touch Lux 3</em>, by Pocketbook</strong></a>. I already knew a bit about it, since it's not the first one I see around me, and I was again happy seeing a printed version of the GPL in the box. Indeed, it is a really nice product, both in quality and in open-mindness</em>. It runs a Linux based OS, can read a lot of file formats with or without DRM, and has a lot of nice applications, from the Web browser</em> to the Chess game</em>.</p> E-pubs and PDFs are great, but I have in my library tons of comics in various strange formats, such as .CBR (rar), .CBZ (zip), or .CBT (tar), which are archives containing pictures. Sadly, the Pocketbook can not read those formats, but after a small research, I found that an amazing guy did a great job in this page</a>!</p> Thanks to the open design of the reader, we have really easy access to the system, and thus, we can add applications as we want. That's how the man did manage to implement a new viewing application supporting the .CBx formats, and allowing me to read my comics on the Pocketbook.</p> It's still a bit small and in black and white, but the books are nicely readable when rotating the screen, and the refresh time is less than 1s to get a complete new page, which I find really quick and makes me really happy with it!</p> Quitting mailoo 2016-05-20T00:00:00+00:00 I've been using Mailoo</a> for a few years now, and I was pretty happy with it. But recently, as I changed my password, I was upset, as every time, when I again received the confirmation e-mail saying something like: "Great, you changed your password, your new password is blahblahblah4000</strong>!"</em>. That made me sad, but I passed over, as always, still saying to myself that I really should change my e-mail provider.</p> And what a surprise! The next morning, I began to receive a lot of messages from friends (contacts) saying "yeah? what do you need?"</em> and other strange answers to a message I didn't send. I quickly changed my password again, and no mail have been oddly resend since, but the evil was done...</p> Today, two days later, I've already made a new address with my friend Piké</a> on our dedicated server, self hosting one more service, and replacing the aliases I had at Gandi</a>.</p> You can now write me at skia [at] libskia (dot) so, and soon, the old addresses at mailoo.org won't work anymore (I'm still waiting a bit before deleting everything, since I use theses e-mail every day).</p> The Force has awoken... 2015-12-16T00:00:00+00:00 Today is the 16th December, and the world (at least the France) sees the release of Star Wars VII: The Force Awakens</strong>. In this special occasion, I take the time to write a bit about how much I've been loving the Star Wars</em> universe, and that for a very long time!</p> It all began when I first saw A New Hope</strong> when I was young (I don't remember precisly when). Since then, I grew up playing the Jedi master</a>, making stop-motion Star Wars Lego movies (that I sadly lost), even becoming sometimes a Sith Lord</a>, when not too busy collecting/playing with about fifteen Lego spaceships, and more than thirty characters!</p> I continued exploring the Star Wars universe reading</a> books</a>, playing</a> video</a>-games</a>, and still now playing a lost, Jedi to become, Kiffar</a> vagabond, in a very cool role-playing game</a>!</p> And today, I'm very happy that the universe continues to live through a new movie!</p> Many people have asked me how I felt about Lucasfilm beeing sold to Disney, and I always answered that it was great. It's great to do so while George Lucas has not yet joined the Force (sadly, it will happen). It's great to do so because Disney has a lot of money, and it's great that they use it to make more Star Wars stuff. It's great because they trusted J.J. Abrams to make this new movie, and I think he has done a good job previously with the new Star Trek films. It's great because we will see the old characters played by the old actors, and I already know that it will be a magic moment! It's great because while writing these lines, I'm listening to the soundtrack that made John Williams for the first and second trilogy, and I'm really happy that he doing a third one!</p> More generally, I'm also very happy with how Disney managed to keep the giant extended-universe by creating the Legend</a>, without beeing hold back for the new films. Indeed, keeping the universe consistant would have been almost impossible without using a entire new place, with very few references to the old movies.</p> That said, I'm still waiting patiently to see the awaken of the Force, although I know that within me, it already awoke a long time ago...</em></p> SSLH, ssh&co though Proxies 2015-11-09T00:00:00+00:00 During my intership, I wanted to access my server, to continue using IRC in my irssi</a>. I need for that to ssh to hya.sk</a>, but the problem came from the proxy that provide my Internet connection, because it's blocking everything except ports 80 and 443.</p> First thought: easy, I just have to set SSH to listen on port 443!</p> Problem: we (Piké</a> and I), are running website with HTTPS</a> enabled, and it's running, of course, on port 443.</p> From there, I had many solutions. I could put in place a VPN using some option like port-share</a> but it was a bit heavy for just an SSH connection... Moreover, VPNs are stictly forbidden by the local policy, so it wasn't a really good idea.</p> I also could have used GoTTY</a>, to get a shell in my browser, but I didn't really like this solution, especially for IRC notifications, that are forwarded though screen to my terminal, to have a little "beep" when someone highlights me.</p> I finally found a far better solution: SSLH</a>. It's a small SSL multiplexer that, once set to listen on $PUBLIC_IP:443</code>, can forward many protocols to their respective interfaces.</p> Here is how I call SSLH. You can of course set it in /etc/default/sslh</em> and run it as a daemon.</p> sslh</span> --user</span> sslh</span> --listen</span> 12.123.123.132:443</span> --ssh</span> 127.0.0.1:22</span> --ssl</span> 127.0.0.1:443</span> --openvpn</span> 127.0.0.1:1194</span></span></code></pre> That way, I have SSH, HTTPS, and even OpenVPN that can pass through port 443, and that's very useful when you work behind weird restrictive proxies!</p> Bonus</strong>: that works in both sides, so when you have server in a DMZ where, for security reasons</em>, the network admin blocked SSH port, but allowed, say, HTTPS for example, you can have a direct secure shell without any weird reverse tunnel with SSLH.</p> Discovering Gogs 2015-06-11T00:00:00+00:00 I just discovered Gogs</a>, a light Git web fronted written in Go. After reading a bit on its website, I decided to try a bit, just for fun. It was really</em> easy to install it with NginX as reverse proxy, everything is Gogs' documentation, and it was ready in less than 10 minutes. Wonderful!</p> It's still in beta, but already very functional, providing most of the classic features such as issues, milestones, ssh keys, README.md</em> parser, etc...</p> Finally, I just dropped my old Gitweb1</a></sup>, and I welcome you to my new Gogs</a>! :)</p> ^1</sup>even if you can still reach it though http</em></a></p> </div> 24h in the airport 2015-04-27T00:00:00+00:00 Being in holidays for two days, I had last month bought my tickets to go to Nothern Ireland with a friend. We arrived at the airport at least half an hour before the time that was written in the email we received, but when asking for the boarding pass, we were refused because it was apparently too late... I never really travelled by plane in a big airport, so I didn't know that we should have arrived at least one hour earlier to get the flight.</p> We managed to change the ticket for the following day (today!) but we had to wait for the 24h in the airport, without anything but my small travelling bag and my laptop...</p> This resulted in some useless things</a>, but also some more useful r2 commits</a>. This was anyway really tiresome, noisy, and boring to death, and I wish it won't happen again (for the comeback trip, for example :D)</p> A new motherboard for my X60 2015-04-21T00:00:00+00:00 A few weeks ago, I was playing putting water on my thinkpad, because it can normally handle it, and mostly because a friend of mine didn't believed it. The water went as usual through the laptop, but this time, I think I put a little too much, and I broke the battery loading circuits.</p> The result was a perfectly working motherboard, but the battery was not able to charge. That was a little embarrassing, and I decided to completely take the laptop apart to see 1)</code> if I could see something strange around the battery, and 2)</code> how the laptop was built exactly.</p> 1)</code> showed nothing, but even better, it bricked the board... Watching libreboot</a>'s output did not really helped, because I'm not a coreboot dev, and because it worked until a moment where it just stopped, without error... Hard to debug...</p> Still, I really needed that laptop, because during that period, I had dug my old X31 up, but this one was a bit too slow, so I bought on Ebay a second-hand motherboard for only 9€!</p> Putting it into the X60 went pretty good (I love how the thinkpad is done, btw!), but I faced a strange matter: the Lenovo bios couldn't boot with my Atheros Wifi card. Anyway, this was only one more good reason the flash libreboot, because it worked very good on the old motherboard, and I wanted to do it myself at least once (first time, I bought the laptop from Gluglug</a> and it came preflashed).</p> This went very well thanks to libreboot's tutorial</a> and I was now able to use my laptop with a very new and state-of-the-art software for an even better hardware!</p> Strange high ping 2015-04-20T00:00:00+00:00 Currently rebuilding my student association's infrastructure, I have to deal with Proxmox 3.4 quit a lot. Having up to 5 VM, I decided to first install one, called generic</strong>, that I would backup, then restore 5 times to get all my VM with a basic configuration without efforts.</p> That worked perfectly a first time, and I have been able to deploy our Gitlab</a> quit quickly.</p> Then I wanted to work on our proxy</strong> VM, so I restored the generic image, and logged into the VM with the console interface to change at least its name and IP. After that, I was able to ssh to the machine, but I remarked that when typing a command, it was really slow to answer.</p> Some quick ping based investigations told me that there were many lost packages, and the average ping was up to half a second! Of course, everything was in a local network, and pinging the Proxmox host was pretty normal, just as the first Gitlab VM. Why was that second machine causing so much trouble?</p> The answer was very dummy: restoring an image restores really everything, and even the MAC address! Changing that address fixed the problem, but that story reminds me how shitty I am with networks! :D</p> Using WinZip 2015-04-10T00:00:00+00:00 This morning, I decided to begin my AI course project, so I went to my professor's library's website</a> to download it and see how it worked.</p> So I had now two zip files, that I tried to unzip without success. Unzip</em> says End-of-central-directory signature not found.</code>, and 7z</em> says Unsupported Method</code> for every non directory file... Weird...</p> Okay, no problem, the binaries are only for W$, so the zip must have been done with WinZip, or some other strange archieving tool. I was at school, so I had a few time to try using Wine and WinZip on my X31. Great idea!</p> Wine went without problem, but I gave up when I faced the following error:</p> </p> I really thank you, WinZip, for giving me so much fun this morning! :)</p> Sauvetage d'un serveur 2015-01-30T00:00:00+00:00 Un petit déterrage pour ce premier post de 2015. Il s'agit là simplement d'un article que j'avais rédigé dans un wiki, et qui est resté depuis le seul article du dit wiki. Plutôt donc de le laisser moisir, je le ressors ici, où il aura un peu plus sa place... :)</p> #Récupération d'un serveur perdu</p> Le problème</h2> Au cours de manipulation visants à augmenter la sécurité du serveur, j'ai malheureusement un peu trop joué avec les droits, ce qui fait qu'en essayant de se connecter via ssh, celui-ci, après avoir afficher les quelques lignes de bienvenue et au moment de lancer le shell:</p> /bin/zsh: permission denied</span></span> connection to pike.tf closed</span></span></code></pre> Plutôt problématique, n'est-ce pas?</p> La solution</h2> Comme tout problème a une solution, il fallait donc la trouver. Fort heureusement, on pouvait toujours envoyer des fichiers par FTP dans le dossier root d'apache, donc on pouvait uploader un script PHP qui nous sauverait la vie.</p> J'ai testé quelques script codés moi même, mais finalement, j'ai plutôt utilisé un reverse shell, bien plus pratique pour tester différentes commandes. Le script est dispo ici : http://pentestmonkey.net/tools/web-shells/php-reverse-shell</a>. Tout y est très bien expliqué et l'on obtient rapidement un pseudo shell sur notre machine locale.</p> Un autre problème se posait alors à moi: il fallait que j'execute une commande avec les droits root pour chmoder les fichiers de zsh. Pour cela, deux options: su</code> et sudo</code>. Mais en faisant su</code>, la commande nous répond</p> su: must be run from a terminal</span></span></code></pre> Pour sudo</code>, le problème est différent. La commande fonctionnait tout à fait, sauf que le script qui l'execute est lancé par www-data, l'user d'apache, et celui-ci n'est pas dans le sudoers, donc il ne peut rien faire.</p> J'ai donc trouvé une nouvelle astuce sur cette page : http://evertpot.com/189/</a>, qui donne deux lignes à rentrer dans notre pseudo shell pour executer un "vrai" shell via python. Bien sûr, il faut que Python soit installé sur le serveur, ce qui était notre cas. La première ligne créer un script placé dans /tmp</code>, et la deuxième l'execute, nous donnant un shell dans lequel on peut ensuite executer su</code> sans aucun problème.</p> En résumé</h2> Uploader la page de script du reverse-shell une fois modifiée, comme indiquée sur le site, en spécifiant l'adresse IP de la machine local sur laquelle vous obtiendrez le pseudo shell, ainsi qu'un port disponible sur lequel vous allez pouvoir faire écouter votre machine. Attention, si vous êtes derrière une box, penser à forwarder le port!</li> Lancer la commande nc</code> avec les options qui vont bien sur votre machine pour qu'elle soit prête à écouter sur le port, par exemple avec le port 1234:nc -v -n -l -p 1234</span></span></code></pre></li> Lancer le script en accédant à son URL dans votre naviguateur, votre pseudo-shell est alors disponible là où vous aviez lancé netcat</li> Executer les deux commande Python pour avoir ensuite un vrai shell et pouvoir lancer su</code>echo "import pty;</span></span> pty.spawn('/bin/bash')" > /tmp/asdf.py</span></span> python /tmp/asdf.py</span></span></code></pre></li> </ul> Voilà, vous pouvez désormais récupérer votre serveur!</p> Merci à Dustri</a> pour les nombreuses indications fournies pendant la récupération! :)</p> Putting HTTPS in place 2015-01-30T00:00:00+00:00 For a few time I have set up this blog, and I always said that I should put SSL in place, to provide secure connection for most of the hosted services.</p> Now it's done!</p> Certification was made by CACert</a>, and this went pretty quick, thanks to a few Nginx tutorials</a>, and the CACert presentation by S. Bortzmeyer</a> (in French).</p> That wasn't so hard, after all, and I still wonder why it took me so much time... :/</p> Memo:</p> openssl req -new -days 365 -nodes -newkey rsa:2048 -keyout hya.sk.key -out hya.sk.csr</span></span></code></pre> The RSoC is finished 2014-11-26T00:00:00+00:00 That's sad, I know, but the RSoC is now finished since 2 months and I haven't post for even longer! :/</p> I have done quit a few commits this summer, and that was really nice to implement new features in a project such as radare2</a>! Still, I have some regrets not to have had enough time for the RSoC... I had no time to implement all the task I was given, and I even still have some that I hope to do in the next few weeks.</p> And this year, having a lot of responsibilities in my school's associations, and having a few school projects, I find even less time than this summer, so I don't think I'll be able to contribute a lot as I expected.</p> Now stop complaining about my free time and let's do a quick summary of what I've done. The task was about structure templates, so the goal is to define a human readable structure, a bit like a C header for example, and to apply it on a binary to see each field easily. The method with header file is quickly described here</a>, and I think I'll do a more complete example one day.</p> But my work was more focused on one r2 feature related to structures: pf</code>. That is the basic command for which you can have a quick help on r2 by hitting pf?</code>.</p> The command works as follow:</p> pf iwf foo bar troll</span></span></code></pre> Applies the iwf</code> format at current offset. The iwf</code> format is an integer named foo</strong>, a word called bar</strong>, and a float, troll</strong>. This gives the following output:</p> [0x00000000]> pf iwf foo bar troll</span></span> foo : 0x00000000 = 1179403647</span></span> bar : 0x00000004 = 0x0101</span></span> troll : 0x00000006 = 1.000000</span></span></code></pre> More fields type can be easily found in the pf</code> help.</p> Moreover, pf</code> supports some nice tricks like pointers by using </code> or arrays using []</code>... eg:</p> pf i[2]w pointer_to_int array_of_words</span></span></code></pre> The next point is to store a format by entering following command:</p> pf.name iwf foo bar meh</span></span></code></pre> We can now apply the format with pf.name</code>. But the thing is that we can now use the stored format as a structure in a new format using ?</code>. eg:</p> [0x00000000]> pf.meh iw int word</span></span> [0x00000000]> pf.boh i?w otherint (meh)plop otherword</span></span> [0x00000000]> pf.boh</span></span> otherint : 0x00000000 = 1179403647</span></span> plop : struct<meh></span></span> int : 0x00000004 = 65793</span></span> word : 0x00000008 = 0x0000</span></span> otherword : 0x0000000a = 0x0000</span></span></code></pre> That way, you can define linked lists for example, to apply on memory dumps, or create nested structures for complex templates.</p> Other features are the JSON output, with pfj</code>, or the already done templates such as the elf32 header that you can easily load with pfo elf32</code>.</p> On last thing is the writing mode (not fully supported for arrays and nested structs, which are my remaining tasks) that you can use that way. You define a format:</p> pf.name iwf foo bar meh</span></span></code></pre> And then you can modify its field with:</p> pf.name.bar=0xfa0</span></span></code></pre> That prints the command you should have to type to write 0xfa0 at the right offset, and a bit of r2 shell makes life easy (see the dot before the command, to execute the output of it as if entered in r2):</p> [0x00000000]> pf.name</span></span> foo : 0x00000000 = 0</span></span> bar : 0x00000004 = 0x0000</span></span> meh : 0x00000006 = 0.000000</span></span> [0x00000000]> .pf.name.bar=0xfa0</span></span> [0x00000000]> pf.name</span></span> foo : 0x00000000 = 0</span></span> bar : 0x00000004 = 0x0fa0</span></span> meh : 0x00000006 = 0.000000</span></span></code></pre> There are still some features in pf</code>, but I think you now have a good overview of what pf</code> can do, and so what I've done during my RSoC.</p> To sum up, that was a great wonderful experience, and I've learned a lot of various interesting things. I hope to finish the last tasks soon, and after that, pf</code> will really be a powerful tool to dump nice elf headers, or analyse strange corrupted PNG files! :)</p> Finally, I really thank my mentors pancake</a>, xvilka</a>, and jvoisin</a> for helping me doing the task, and for organizing the RSoC in general. I also thank maijin</a> for having done a lot of tests in pf</code> and for reporting a lot of unexpected features, and I also thank all the r2 community for being nice on the IRC chan, and for supporting such a great project!</p> Open Laptop 2014-07-13T00:00:00+00:00 First, let me introduce my laptop: it's a Thinkpad X60, he's called Kiffu</a> and was bought ~6 months ago from Gluglug</a>, and as the FSF</a> said, it's an open-laptop, and that means that it runs without any proprietary software, nor any blob, not even the CPU microcode!</p> Yesterday, I decided to clean my keyboard, and for that, Maat</a> and I had no better idea than putting it under the tap! Of course it was powered off, but I put a bit too much of water, and everything didn't go though it. It was now a bit wet, and I decided to wait for the full night before pluging and running it again... But the whole night wasn't enough, and when I ran it, it worked for five minutes, and then I got some strange things on the screen, before it self rebooted, then reboot again, and behaved very oddly... I shut it down, removed the battery, unpluged, and decided to dry it really</strong>. I opened it completely, removed the SSD, the keyboard, and even the upper body! Drying and waiting for a bit, I then decided to try to run it, but I was too lazy to rebuild it, and then redry if it still didn't worked, so I run it completly opened!</p> Everything went well, and I even took a few pictures with the webcam, without any problems: </p> Finally, I just rebuilt the laptop and wrote this article, because I just found that fun and wanted to share the pictures... ;)</p> Clearing my mind about my task 2014-07-10T00:00:00+00:00 Clearing my mind about my task</h1> After receiving XVilka's mail, asking for our status about the RSoC, I was asked to join the #radare-rsoc</code> channel, a very smaller chan much more adapted to the student of the RSoC. If I say that, it's because despite everybody says "feel free to..." on the main chan, I really felt outnumbered by so many people talking about such advanced things, and honestly, I didn't dare to ask even a small question... Stupid life.... :)</p> Anyway, after joining the RSoC chan, I explained what I had already done, and I was answered that many things were already done! In fact, the biggest part was mainly done, and for now, the priority was to write tests for the pf</code> command, the one that make use of a kind of template (my task)...</p> I quickly went to the test directory, forked the radare2-regressions</a> repo on my Github, and began to learn how pf</code> worked, in order to test it in the test suite. Two hours or three later, my commits were merged, and I even discovered my first bug in r2, as pancake said when I wondered about the result of a command...</p> Next step now is to fix the bugs in pf</code>, then to improve it to support nested types, and then, we'll see...</p> First step in the RSoC 2014-06-26T00:00:00+00:00 First step in the RSoC</h1> A friend</a> of mine motivated me for doing the Radare Summer of Code</a> a few month ago. I took a look, and found it very interesting, so I applied, asking to do the Struct Templates job. I was accepted, and I began to take some interest to the project. I did a very few commit here and there, trying to understand how the project worked, how it was organized, and also learning how to use the different tools, like GitHub that I had never really known before.</p> The start was given last week, but having a project</a> to finish for the school, I had no time to take it... Now that the project is done, I'll have more time to spend on r2, and it's what I've done tonight: I looked precisely at some file, trying to understand how the thing was done, and beginning to think what I'll have to do to complete the task.</p> I really feel happy that the school project was a compiler and not some other shit, because reading a C parser is now far easier than it would have been otherwise! As we could say in Molière's tongue: C'est en forgeant que l'on devient forgeron</em> (Smithing makes the smith</em>, or more likely Practice makes perfect</em>) and as we all know, that's really true for programming!</p> Concerning that blog, I'll try to post for every step I'll complete, in order to keep something about my first commitment in a free project! And if you want to contribute to r2, you can find a list of idea there</a> and join us on freenode#radare</code>!</p> A very new blog 2014-06-20T00:00:00+00:00 Hi there!</p> I'm proud to announce to the world that I'm at least opening a blog. The purpose isn't to tell you everything about my super life, but to provide information about interesting (or not) stuff I've done...</p> Feel free to contact me if you think you have to!</p> -- Skia --</p>

Unmaintained space

Notes on blocking AI scrappers

2026-04-05T00:00:00+00:00

Context</h1>
I sometimes do admin work for some people and help host a couple of websites. One of them was recently reported by its users to be extremely slow. Obviously this was due to some AI scrappers, totally abusing their right to crawl the Internet in a respectful way, so let's implement a couple of mitigation in an effort to keep the website useful.</p>

The mitigations</h1>

ai.robots.txt</h2>

This project provides a caddy</code> snippet to instantly reject many known AI scrappers: https://github.com/ai-robots-txt/ai.robots.txt</a>.</p>

The site file looks like this now:</p>

domain.net {</span></span>
    # From https://github.com/ai-robots-txt/ai.robots.txt</span></span>
    @aibots {</span></span>
            header_regexp User-Agent "<ai.robots.txt provided list of bots>"</span></span>
    }</span></span>
    abort @aibots</span></span>
</span>
    # route through anubis</span></span>
    reverse_proxy 127.0.0.1:8239</span></span>
}</span></span></code></pre>Anubis</h2>
Anubis</a> provides proof-of-work challenges supposed to be too expansive to AI scrappers. It more or less works sometimes, but at least has a pretty low footprint on the server.</p>
My server hosts a website that definitely should not be of interest to chinese speaking users, so I've added this to /etc/anubis/site.botPolicies.yaml</code>:</p>
bots</span>:</span></span>
  -</span> ...</span></span>
  -</span> name</span>:</span> generic-chinese-catchall</span></span>
    action</span>:</span> DENY</span></span>
    expression</span>:</span></span>
      all</span>:</span></span>
        -</span> '"Accept-Language" in headers'</span></span>
        -</span> 'headers["Accept-Language"].startsWith("zh-CN")'</span></span>
  -</span> ...</span></span></code></pre>reaction</h2>
reaction</a> is basically a modern fail2ban</code> that just works for common use-cases and with a way shorter and saner configuration system.</p>
To make sure Anubis' denied targets really don't cause too much load by trying to come back, let's ban them at the IP level.

With a jsonnet</code> configuration based on the default one</a>, add this streams</code> entry:</p>
{</span></span>
  streams:</span> {</span></span>
    anubis:</span> {</span></span>
      // watch the anubis logs</span></span>
      cmd:</span> [</span>'journalctl'</span>, </span>'-n0'</span>, </span>'-fu'</span>, </span>'anubis.service'</span>],</span></span>
</span>
      filters:</span> {</span></span>
        deniedByAnubis:</span> {</span></span>
          regex:</span> [</span></span>
            // filter on the DENY action</span></span>
            @</span>'"x-real-ip":"<ip>".*"check_result":.*"rule":"DENY"'</span>,</span></span>
          ],</span></span>
          // Don't even give a grace period, ban on first try</span></span>
          // retry: 3,</span></span>
          // retryperiod: '6h',</span></span>
          actions:</span> banFor</span>(</span>'48h'</span>),</span></span>
        },</span></span>
      },</span></span>
    },</span></span>
  },</span></span>
}</span></span></code></pre>Conclusion</h1>


CPU load on the server before and after implementing the described mitigations.</em></p>
Not a perfect solution, but at least the website is back to being snappy. Now I wish these tools were more polished, both in terms of documentation and packaging... Good candidates for the day I find myself bored and want to contribute to something.</p>
Edit: More than 600 IP addressed banned in less than an hour. This unfortunately shows the level of disrespect for the Internet these bots runners have.</p>



Setting ACLs on a self-hosted Mumble server
2026-02-07T00:00:00+00:00
As any good hacker around here, I'm self-hosting my voice server for playing
with my friends. The default configuration provided by the Debian package is
usually fine, but for the one time where we are two groups of people wanting to
play different games, there is a need to have multiple channels on the server.</p>
This can easily be done by the super user but the Mumble ecosystem documentation
must be pretty poor around here, and it took me a while to think of have a look
at the murmurd</code> manpage to find the solution.</p>
Here are the dumb steps to follow:</p>

First set a SuperUser</code> password. On the server, without even shutting down
the service, run this: murmurd -supw mysuperstrongpassword</code>.</li>
Then in your Mumble client, login as SuperUser</code>: that pops up an additional
field to provide the mysuperstrongpassword</code> password.</li>
You're now connected with all privileges and can create all the channels you
want from the GUI.</li>
You can optionally disable the SuperUser</code> account after your done with
murmurd -disablesu</code>, again without having to shutdown the service.</li>
</ol>
Happy gaming!</p>


Some Firefox and Thunderbird about:config keys
2025-12-19T00:00:00+00:00
This is only a bookmark article to keep around the about:config</code> settings that I've found useful over time.</p>
Firefox</h1>
Don't strip the https://</code> in URLs. That makes the text move when that part magically re-appears when editing the bar's content.</p>
browser.urlbar.trimURLs=false</span></span></code></pre>Thunderbird</h1>
Add an additional custom header to the composition window.</p>
mail.compose.other.header=X-My-Custom-Header</span></span></code></pre>
Please let me choose how I wrap my lines and stop doing wrong magic.</p>
plain_text.wrap_long_lines=false</span></span></code></pre>
Always check all folders by default. Very useful if you have tons of server-side filtering to many folders.</p>
mail.server.default.check_all_folders_for_new=true</span></span></code></pre>


Helios64 - Part 3 - Hardware and software upgrade
2025-11-16T00:00:00+00:00
This post is more or less a follow-up of the previous</a>
parts</a> about my NAS setup.</p>

TL;DR: Raspi 5 + Radxa Penta SATA HAT + Ubuntu Noble + ZFS + Docker compose +
a bunch of services, everything run fine, and is very low power consumption.</p>
</blockquote>

After almost five years, my Helios64 main board finally got to be replaced.
It wasn't broken or limited, but the other one I manage at my parents' place
very likely had some RAM issues, and I decided to upgrade mine to give them my
working main board, since Kobol sadly didn't survive the
Covid19</a>.</p>
Upgrading the hardware</h1>
After much research, and some chat with a
colleague</a>, I settled on a Raspberry Pi
5</a> (8GB RAM) with a Radxa
Penta SATA HAT</a>.</p>
The hardware setup is very straight-forward and well explained in Radxa's
guide</a>: put
the HAT on the Raspi, then wire everything:</p>

FPC</a> between HAT and Pi.</li>
SATA and eSATA from HAT to disks.</li>
Ethernet to the Pi.</li>
12V barrel power-supply to the HAT.</li>
</ul>
The only tricky part that I solved right away was how to fasten the SATA cables
into the Helios64 case. Fortunately I'm an expert wire bender, and I had the
disk-facing part of the cables attached in no time!</p>


Fastening the disk-facing SATA connectors with some basic wire.</em></p>
In an hour and a half I had everything running on my desk! This was the first
boring part.</p>


First running setup on my desktop.</em></p>
Reinstalling the software</h1>
This is the second boring part that took another half an hour.</p>
Thanks to the wonderful architectural choices I've made five years ago, it
boiled down to the following simple steps:</p>

Flash Ubuntu Noble</a> on an
SD card and boot.</li>
Enable fast
PCIe</a>
on the Raspi by putting the following in /boot/firmware/config.txt</code> and rebooting:dtparam=pciex1</span></span>
dtparam=pciex1_gen=3</span></span></code></pre></li>
Install ZFS tools: sudo apt install zfsutils-linux</code>

Thanks Ubuntu for shipping pre-built ZFS module, no more
dkms</code></a>
headaches during kernel upgrades 💚</li>
Load the storage</code> ZFS pool into this new system: zpool import -f storage</code></li>
Install Docker and make sure its storage points at the dedicated ZFS volume:$ sudo apt install docker.io docker-compose-v2</span></span>
$ cat /etc/docker/daemon.json</span></span>
{</span></span>
      "storage-driver": "zfs",</span></span>
      "data-root": "/storage/docker"</span></span>
}</span></span></code></pre></li>
Restart the Docker daemon after the config changes and 💥, that was enough
to get all the services back online without even redownloading the Docker
images!</li>
</ol>
This was all done on September 20th, almost two months ago!</p>
Fitting everything into the Helios64 enclosure</h1>
Now comes the fun part, where I want to have everything nicely stuffed into
the Helios64 case, and not lying on my desk anymore. While the two previous
sections took an hour in total, this one actually took an afternoon of work,
and two months of thinking. Also, I'm very busy these days and don't have much
free time.</p>
Wiring the power button</h2>
If I'm to have everything nicely stuffed into the case, having at least some
part of the front-panel working would be nice. The easiest and most useful
feature is the power-button, so let's wire that up! There's a header to solder
on the Pi, it's
well-documented</a>,
and I had that done in no time.</p>
Finding the right layout</h2>
That was definitely the hardest problem, because I didn't have any choice in
where the plugs must go. And it just happens that the Pi plus its HAT ended up
having four incoming connections from three different directions, in addition to
the cables being quite thick and not very flexible: power, ethernet, eSATA, and
four remaining regular SATA.</p>


Final layout of the Pi in the Helios64 case.</em></p>
To fasten the Pi to the case itself, I just cut a plate of steel from an old
computer case plate that I kept lying around. I cut it to more or less the same
size of the original Helios64 main board, so that I could reuse the screw holes
and have something very reliable.</p>


Everything fitting nicely in the case.</em></p>


Close up on the power cable, ethernet cable, and power switch.</em></p>


Close up on the Pi itself and SATA cables. We can see the plate on which the Pi is fastened here.</em></p>
Power consumption</h1>
I happen to have a basic Wattmeter</a>
at home, that I use from time to time to get an idea on the power consumption of
my devices (Do you have an idea on how much power your sander consumes? Mine is
250W. How interesting! ⚡).</p>
This was the nicest surprise after making sure everything was running perfectly
fine: the whole setup with the disks is actually running on very low power!</p>

Most of the time, it takes between 7W and 9W.</li>
When downloading a big torrent file (like your favorite
OS iso</code> image), it's going between 8W and 12W, with
Transmission</a>
consuming around 70% of CPU, and bandwidth showing 40MB/s in download.</li>
Copying a big file from one zvol</code></a>
to another is around 10W, with the copying process at 100% in
iotop</a>.</li>
</ul>
The software setup is completely default, and I haven't tried to optimize
anything. Honestly, I'm not sure I'll spend any time here with those numbers.</p>
Also, everything is passively cooled, with no fan whatsoever. That means the Pi
will often power throttle its CPU to keep it from over-heating. I expect this
has something to do with the low power consumption, but still, I'm very much
impressed!</p>
For comparison, I remember seeing the original Helios64 main board with the
exact same disks and very similar software setup (just Debian instead of Ubuntu)
consuming above 25W regularly. I guess its two 12V fans running continuously
could already explain part of that, but for the rest, I've no idea, and don't
plan on spending time here either to do a proper investigation 🤷</p>
Closing words</h1>
It's a bit of work to get everything to fit, but it was worthwhile, a lot of
fun, and I get to keep the Helios64 case that I love.</p>
It has improved horsepower: definitely visible when browsing Nextcloud, and
lower power consumption: definitely not</strong> visible on the bill, it's one NAS
compared to a whole house! — what did you expect?</p>


Setting constraints on a process
2025-04-01T00:00:00+00:00
I've found myself recently debugging a memory usage
issue</a> where
OOM kill was involved. To reproduce the issue consistently, I found myself in
need of tooling to constrain the memory usage of a process, and I'll keep some
notes around that in order not to do this research again.</p>
All those tools can set various kinds of constraints and have good
documentation. Here are just a few examples with the leak-memory</code> command (from
the chaos-marmosets</code></a> package) to
get started on how to use them.
Obviously, the same tools can be use to set other kinds of constraints, such as
CPU usage, number of threads, or a maximum count of opened files.</p>
Bash built-in ulimit</code></h1>
Doc:

man 1 bash</code></p>
Example:

Set hard limit for available virtual memory in the current shell and its
subprocesses:</p>
$</span> ulimit</span> -Hv</span> 500000</span></span>
$</span> leak-memory</span></span>
Starting</span> memory consumption in</span> 1.00</span> MiB steps to maximum</span> 42.0</span> TiB.</span></span>
Allocated</span> 10.0</span> MiB.</span></span>
...</span></span>
Allocated</span> 480.0</span> MiB.</span></span>
Segmentation</span> fault</span></span></code></pre>util-linux</code>'s prlimit</code></h1>
Doc:

man 1 prlimit</code></p>
Example:

Set hard limit for available virtual memory and run the given command:</p>
$</span> prlimit</span> -v500000000</span> leak-memory</span></span>
Starting</span> memory consumption in</span> 1.00</span> MiB steps to maximum</span> 42.0</span> TiB.</span></span>
Allocated</span> 10.0</span> MiB.</span></span>
...</span></span>
Allocated</span> 470.0</span> MiB.</span></span>
Segmentation</span> fault</span></span></code></pre>systemd</code>'s systemd-run</code></h1>
Doc:

man 1 systemd-run</code> and man 5 systemd.resource-control</code></p>
Example:</p>
$ systemd-run --scope -p MemoryMax=500M -p MemorySwapMax=0 --user leak-memory</span></span>
Running as unit: run-r021111d21d32442bbb9cc8a9ee720410.scope; invocation ID: fc3a88a1df3c45aebbf05296879d4567</span></span>
Starting memory consumption in 1.00 MiB steps to maximum 42.0 TiB.</span></span>
Allocated 10.0 MiB.</span></span>
Allocated 20.0 MiB.</span></span>
Allocated 30.0 MiB.</span></span>
Allocated 40.0 MiB.</span></span>
...</span></span>
Allocated 480.0 MiB.</span></span>
Allocated 490.0 MiB.</span></span>
Killed</span></span></code></pre>
Don't forget MemorySwapMax</code> to avoid seeing weird
results</a>, since
cgroups</code>' memory.max</code>, unlike ulimit</code>, don't put constraints on the virtual
address space size, but rather on the real usage of physical memory.</p>
Python's resource</code> module</h1>
Doc:

python3 -c "import resource; help(resource)"</code></p>
Example:</p>
import</span> resource</span></span>
</span>
resource</span>.</span>setrlimit</span>(resource</span>.</span>RLIMIT_AS</span>,</span> (</span>100</span> *</span> 1024</span> *</span> 1024</span>,</span> 100</span> *</span> 1024</span> *</span> 1024</span>))</span></span>
</span>
l</span> =</span> []</span></span>
for</span> i</span> in</span> range</span>(</span>10000</span>)</span>:</span></span>
    chunk</span> =</span> []</span></span>
    for</span> j</span> in</span> range</span>(</span>1000</span>)</span>:</span></span>
        # allocate 1000 chars in a string</span></span>
        chunk</span>.</span>append</span>(</span>f</span>"</span>{</span>i</span>:010d</span>}{</span>j</span>:010d</span>}</span>"</span> *</span> 50</span>)</span></span>
    l</span>.</span>append</span>(chunk)</span></span>
    if</span> i</span> %</span> 10</span> ==</span> 0</span>:</span></span>
        print</span>(</span>f</span>"Allocated </span>{</span>i</span>}</span>M chars"</span>)</span></span></code></pre>$ python3 leak.py</span></span>
Allocated 0M chars</span></span>
Allocated 10M chars</span></span>
Allocated 20M chars</span></span>
Allocated 30M chars</span></span>
Allocated 40M chars</span></span>
Allocated 50M chars</span></span>
Allocated 60M chars</span></span>
Allocated 70M chars</span></span>
Traceback (most recent call last):</span></span>
  File "/home/ubuntu/leak.py", line 9, in <module></span></span>
    chunk.append(f"{i:010d}{j:010d}" * 50)</span></span>
                 ^^^^^^^^^^^^^^^^^^^^^^^^</span></span>
MemoryError</span></span></code></pre>


2to3 in Python 3.13
2025-02-26T00:00:00+00:00
I'm running Ubuntu devel, which currently means plucky</code>. That means I usually
run and dev Python with the latest version of the toolchain, sometimes even RCs.
The recent removal of 2to3</code>, while being a good thing, put me in a position
where I couldn't easily migrate old Python 2 code to Python 3.</p>
A quick search pointed me to fissix</code></a>,
available in Debian, thus in Ubuntu too.</p>
A sudo apt install python3-fissix</code> later, here is the useful command that I'll
likely need to remember in the future:</p>
cd path/to/error-tracker.git/src</span></span>
mkdir tools</span></span>
python3 -m fissix -o tools -n -w path/to/error-tracker.notgit/daisy/tools/unique_users_daily_update.py</span></span></code></pre>

-o</code> is the output directory to put the new file in</li>
-w</code> to tell the tool to write the modified files</li>
-n</code> to tell the tool that I don't need backups</li>
</ul>
I'm now hoping I won't have to come back to these notes too much.</p>


Defeating Metal: Hellsinger
2024-12-27T00:00:00+00:00
I've recently completed Metal: Hellsinger</a>, in Goat mode, which is a metal way of saying "normal difficulty". I must say it was a very pleasant journey through all the stages of Hells. Shoutout to Dustri</a> for gifting me the game ♥</p>
The game is a rhythm FPS</a>, which means that you need to aim spatially at your targets, just like a normal shooter. But you also need to shoot on the beats of the music to lend maximum damage and raise the fury</em> multiplier to x16, so you need timing precision too, and that is way less common in shooters. Just watch some demos if that doesn't make sense to you :-)</p>
Obviously, the soundtrack is some very dope Metal, featuring great well known singers. Having the music stripped down to almost only the kick when in x1, and gaining more and more layers up to the full song when raising the fury</em> to x16, is a very good incentive to make you play at your best, and really pushes you to master the shooter mechanics. There is even a live show</a> of the soundtrack, with most of the guests singing, recorded during Gamescom 2022. Go watch it!</p>
The difficulty is steadily increasing through the course of the game, but I found it well balanced: after three or four levels, I could no longer defeat them on the first try, but it didn't take more than three or four tries. Also the game is not too punishing, and when I lost, I always knew and acknowledged it was my fault. I had made mistakes, and I knew I could do better.</p>
All in all, the game is great and it's not too long. If you like Metal and gaming, you'll have fun!</p>


One of my best score regarding "time spend at x16 fury".</em>
This was done in the very first level, in easy mode, and it's when I achieved "pazifist" 🤘</em></p>


Notes on CD ripping with `whipper`
2024-05-27T00:00:00+00:00
I had a bunch of old CDs that were lying around in my car, and since they are
mostly from some obscure french bands, there's no way to listen to them on
my laptop other than ripping them to my music library.</p>
I really thought it would be simple, but it seems my requirements are a bit too
high for a smooth experience: I just want the metadata for the music tracks to
be fetched from Musicbrainz</a>, so that I don't have to
enter the data twice, and I don't want to learn another tool to do it the other
way around. Turns out this only requirement is actually hard to fullfil if you
combine it with a ripping software that works.</p>
This is what I ended up doing with whipper</code></a>
after trying a bunch of others:</p>

</li>
</ol>
❯ whipper drive list</span></span>
drive: /dev/cdrom, vendor: HL-DT-ST, model: DVDRAM GUD0N    , release: 1.00</span></span></code></pre>

</li>
</ol>
If like me, your external USB drive isn't automatically found, you'll need to
find the drive in this list</a> and
grab the correct offset, whatever that is, +102</code> in my case.</p>

</li>
</ol>
❯ whipper cd info</span></span></code></pre>

</li>
</ol>
Click on the printed link to attach the CD ToC to the right release (obviously
after creating the said release beforehand).</p>

</li>
</ol>
❯ whipper cd rip --offset=102</span></span></code></pre>

</li>
</ol>
Repeat steps 3, 4, and 5 for each new CD, sometimes adding --cdr</code> to the
whipper cd rip</code> command.</p>
There might be other tools I haven't found that would do it better, but with this:</p>

I was absolutely certain of the mapping between the fetched metadata and my
CD, since I'm uploading the cdtoc myself.</li>
The output was a bunch of flac</code> files, one per track, and that default is
perfectly fine for me.</li>
Everything was perfectly tagged also, which means beet</code> matched all the
albums 100% when importing them to the library.</li>
whipper</code> is maintained, packaged and up-to-date in Ubuntu, which means I
didn't have to compile myself an old GTK2 library used by a Python 2.4 app.</li>
</ul>


In praise of 'Thrawn' and 'Thrawn Ascendancy'
2024-05-20T00:00:00+00:00
spoiler alert</strong>: while I may not spoil that much of the stories, I still
need to talk a minimum about the background and overall arc of the character of
Thrawn. You've been warned.</p>

I had learned about the Grand Admiral Thrawn</a>
for the first time more than fifteen years ago, when reading the original
trilogy of books Heir to the Empire</a>.
I really liked it, and also got the corresponding comics (at least part of them,
I completed the collection just recently).</p>


The Heir to the Empire</strong> trilogy</em></p>
The character was already a very interesting vilain, both because of his
tactical genius, but also because he wasn't fundamentaly a bad guy, he just did
what he thought was right, and respected his enemies if they were competent.</p>
That antagonist role was reused brilliantly when he reappeared in the
Rebels</a> TV show, putting him
back into the new canon, but at a different period of time. I was delighted!</p>
Then I got very pleased to read the new Thrawn</a>
trilogy, setting him now as the main character, and showing him raising among
the ranks of the Empire. He was now becoming the hero of the story, although
still working for the bad guys, but of course keeping his own motivations. That
makes the readers of the story in a position where it's impossible not to have
sympathy for that formidable opponent to our usual heros. On top of that, the
books bring a new light on the Rebels episodes where he appears, deepening the
events even more!</p>


The Thrawn</strong> trilogy</em></p>
And finally I just finished the Thrawn Ascendancy</a>
trilogy, going back to the origins of the character in the Chiss Ascendancy,
trying to defend his people as a brilliant rising military from the Expansionary
Defense Fleet. This is a whole new environment, set in the middle of "the
Chaos", a region far away from the Republic at that time, and full of new
surprises, like new political systems, the skywalkers, new species, new
technologies, and obviously new threats.
Here at last, we have Mitth'raw'nuruodo that will be the real hero he always
deserved to be, and not even necessarily working for the bad guys (although
everyone is free to make up their own mind about the Chiss!).</p>


The Thrawn Ascendancy</strong> trilogy</em></p>
In overall, I really loved those two absolutely amazing trilogies that can be
read in either order, and I couldn't recommend them enough for any fan of the
character.</p>


Engineering and Martial Arts
2024-05-17T00:00:00+00:00
My first lightning talk</h1>
Here are the slides</a>, and here is the
video</a>.</p>
I just gave my first lightning talk at the end of Canonical's Engineering Sprint
in Madrid. There was about 700 engineers in the room, so that was somewhat
impressive, but that went pretty well.</p>
Anyway, I thought the topic interesting enough to be shared here.</p>
More examples</h1>
At the end of the presentation, I mentionned some other parallels, but as they
were harder to illustrate, I didn't put them in the presentation, so a text
version feel more appropriate.</p>
Discipline</h2>
Martial Arts really is focused on discipline. If you aren't careful and fully
focused on the "here and now", you're either going to hurt a partner, or
yourself.</p>
In programming, not being disciplined will quickly bring you some SIGSEGV,
TypeError</code>, NullPointerException</code>, panic!</code>. or even worse: nothing that you
will notice but that would still be exploitable.</p>
Keep it super simple!</h2>
Even if some discplines involves learning a bunch of very complicated
techniques, it's usually mostly in the purpose of understanding how they
work, since they probably wouldn't be applicable in real situations. The most
simple techniques are generally those that work the best and have the most
applications.</p>
In Software Engineering, keeping stuff as simple as possible is good design
practice since it eases the maintainance, the onboarding of new people, the
reliability, the modularity, etc...</p>
There are more... for another time</h2>
We could probably find more very good examples, but at this point, I'll just get
some well deserved sleep in the bus on the way home!</p>


Atelier d'écriture : micro-nouvelles
2023-12-23T00:00:00+00:00
This article in french is about participating to a writing workshop. All the texts are in french, and so is this blog
post, but that shouldn't be too complicated since most writings are very short.</em></p>

Présentation</h1>
J'ai eu le plaisir de participer récemment à un atelier d'écriture animé par Ythèr</a>. Le thème
était la micro-nouvelle, et les exercices allaient de six mots à trois paragraphes. Nous étions dans un atelier-boutique
d'arts, donc Ythèr nous a proposé de travailler directement à partir des œuvres exposées.</p>
Voici donc sans plus attendre mes productions.</p>
Productions</h1>
Exercice préparatoire</h2>
Tout ce premier exercice tournait autour de cette œuvre :</p>


Le creu de la dent</em></p>
La première consigne était d'écrire une histoire en une phrase :</p>

Bien au chaud, bien rose, la palette arrivait enfin au terme de sa cuisson.</p>
</blockquote>
Pas forcément fameux, mais que voulez-vous.</p>
Aurélia a produit la phrase qui a servi de base pour la suite de l'exercice :</p>

J'ai perdu mes chaussures.</p>
</blockquote>
Nous devions ensuite produire un paragraphe avec cette phrase commune qui serait placée soit au début, soit à la fin :</p>

J'ai perdu mes chaussures, et ça tombe bien, j'en avais plus besoin. J'ai récemment appris dans une étude
rigoureusement scientifique que marcher pieds-nu entretenait la mémoire. Bon, là, j'ai un peu froid aux pieds. Où ai-je
donc rangé mes chaussettes ?… Oh tiens ! Mes chaussures…</p>
</blockquote>
Julie a produit le paragraphe qui a servi de base pour la suite de l'exercice :</p>

Hier, j'ai croisé un homme avec un chapeau bleu et une parka noire. J'attendais le bus et il s'est assis pas très loin
de moi. Il parlait tout seul et je ne comprenais pas un mot à ce qu'il disait ! Il me faisait un peu peur. D'un coup,
un gros boum retentit et une lumière vive m'aveuglait. Ma tête tournait dans tous les sens. J'avais mal partout, et ne
voyais plus rien. J'ai froid aux pieds. J'ai perdu mes chaussures.</p>
</blockquote>
Et nous devions ensuite réécrire cette même nouvelle en seulement trois phrases :</p>

J'attendais le bus au milieu des badauds. Soudain, l'appartement d'en face s'embrasa dans une explosion me projetant
au sol. Maintenant aveugle, je reste vivante.</p>
</blockquote>
Cet exercice pris fin après une petite heure.</p>
Productions autonomes</h2>
La suite était simple, produire trois micros-nouvelles en s'inspirant des différentes œuvres exposées.</p>
Une première de trois paragraphes de trois, quatre phrases</h3>


Nocturne du marais n°2</em></p>

L'étang était calme ce matin là. Seul le bouchon du petit pêcheur troublait l'eau. Le poisson ne mordait guère, mais
le ciel était bleu, et il faisait bon.</p>
Le bois alentour s'assombrit, le ciel se voila, et une bise glaciale se leva. Une face de sorcière se dessina dans le
blanc des nuages, et son ricanement s'entendait entre les branches dans le lointain. Puis le bouchon disparu.</p>
Midi approchait et la faim le tenaillait. Son unique prise ferait un maigre repas, mais le vieux pêcheur s'en
contenterait. Le temps était doux en cette fin d'été, et seuls les restes de cervelles de carpe éclatés au sol
témoignaient encore du combat qui avait eu lieu ce matin là.</p>
</blockquote>
Une seconde de trois phrases</h3>


Levez la branche !</em></p>

Yucca et papyrus transpiraient à grosses gouttes en cet hiver caniculaire. Fort heureusement, la providence orange
arrivait. Bientôt son eau coulerait le long de son bec pour rafraichir les pieds de tout ce petit monde.</p>
</blockquote>
Une dernière de six mots</h3>


Mon vieux chausson</em></p>

La laine du vieux chausson souriait.</p>
</blockquote>
Bonus</h3>
Il y a eu le temps pour quelques bonus de six mots :</p>


Caché</em></p>

Six sapins dansent sur ce crâne.</p>
</blockquote>


FC16</em></p>

Pectoraux : saillants

Visage : diforme

Barre : LOURDE !!!</p>
</blockquote>
Mot de la fin</h1>
Je n'ai pas l'habitude d'écrire, mais le fait d'avoir un cadre très contraint avec des consignes précises qui visent des
productions très courtes a rendu l'expérience tout à fait plaisante. Je ne me mettrai probablement pas à écrire pour autant,
mais il est fort possible que je reparticipe à des ateliers d'écriture similaires à l'occasion.</p>
Merci Ythèr pour l'organisation, l'animation, et le thé, c'était très chouette ! :-)</p>


Renewing my GPG key to fix an old youth error
2023-10-17T00:00:00+00:00
Okay. Today, I've generated a new GPG key</a>, and that went smooth in less than two hours. I've had a thorn in the side
pretty much since I've first setup my Yubikey, and I've solved it today, with so much ease that I can't stop blaming
myself for having waited five years to fix it. This is mostly a kick in the ass of my future self to stop delaying that
kind of thing for ever.</p>
For those only interested in storing their GPG keys on a Yubikey, please just follow this wonderful guide, it will
explain everything far better than me:
https://github.com/drduh/YubiKey-Guide</a></p>
Now here is my miserable story.</p>
I had read, at the time, that it was a good idea to make use of non-standard keys length, you know, for security,
since everyone will try to hack you with the normal sizes, like 2048, 3072, 4096. This is security through obscurity,
and obviously doesn't bring much hardening to any setup, but as I was, and still am, a pure crypto-newbie, I guess I
believed it was such a good idea that I generated a 4000 bits RSA key and dumped it onto my smartcard.</p>
Everything was great and I could ssh</code> to my servers in no time with great success, carrying the same key to any machine
thanks to the SSH agent provided by GPG agent, but after two weeks of bragging about that, someone sent me a GPG
encrypted message, and my wonderful non-standard key couldn't decrypt it.</p>
That sucked.</p>
I was so proud of this setup, I had already put my brand new public SSH key everywhere, and now it seemed I couldn't
use it as promised. Digging a bit, I found out that the signing and authenticating keys were working fine, but the
encrypting one didn't, and failed with the following:</p>
gpg: public key decryption failed: Hardware problem</span></span>
gpg: decryption failed: No secret key</span></span></code></pre>
That really sucked, and most probably the non-standard key length played something in there.</p>
First, still full of hope, I went to grep</code> that error message in the OpenGPG source code, found it, and quickly
realized this wouldn't be a piece of cake to fix that. Then, half-lazy, half-shameful, I just moved on, and thought to
myself that nobody used GPG anymore anyway, with the rise of Matrix, Signal, and other encrypted chat software. So I
just stopped advertising my GPG key, resigned to use it only for SSH auth, and happily lived my digital life for the
past five years.</p>
But now it's 2023, GPG's still here, and even though I do in fact use Matrix and Signal a lot more than email (including
for non-sensitive chat), I thought it was time for me to fix that mistake.</p>
And here we are, it took me less than two hours, including the time to 1) dig up my old laptop with the broken Wifi
card, 2) generate everything and send perfectly standard 4096 bits keys to the Yubikey, 3) test that everything works
including encryption/decryption, 4) replace my SSH key on all the servers/Github/Gitlab/Gitea/whatever accounts, and 5)
be amazed at how seamless the experience is to decrypt stuff using a smartcard, even through Thunderbird!</p>
Fierfek, it almost took me longer to write down that post!</p>


Set a Thinkpad's trackpoint sensitivity on `sway`
2023-09-12T00:00:00+00:00
Let's do it quick!</p>
Find your device's sway</code> identifier: swaymsg -t get_inputs</code>.</p>
Mine looks like this:</p>
...</span></span>
Input device: TPPS/2 Elan TrackPoint</span></span>
  Type: Mouse</span></span>
  Identifier: 2:10:TPPS/2_Elan_TrackPoint</span></span>
  Product ID: 10</span></span>
  Vendor ID: 2</span></span>
  Libinput Send Events: enabled</span></span>
...</span></span></code></pre>
Test what value fits you:</p>
swaymsg 'input 2:10:TPPS/2_Elan_TrackPoint pointer_accel -0.5'</span></span></code></pre>
Value is in range [-1; 1]</code>, 0</code> is the default, so -0.5</code> will decrease sensitivity by a half (whatever that means),
and 0.9</code> will increase sensitivity almost to its full.</p>
Once you're good, just append the input ...</code> command to your sway</code> config for persistence.</p>


The quest to save a lost `apt full-upgrade`
2023-08-16T00:00:00+00:00
The fall to oblivion</h1>
During one of my numerous bullseye</code> to bookworm</code> migration, one that should have been painless and straightforward,
the chaotic-evil</em> ancient daemon of computers decided to test my nerves.</p>
As usual, I have cast byobu-enable</code> once in my shell, which means I have the passive advantage of always being in a
tmux</code> session. That normally prevents many accident to happen, like giving you an easy saving roll in case of network
failure during a complex invocation like apt upgrade</code>.</p>
So, well prepared for my quest, and having a bit of time in front of me (which is the last and most useful advantage you
can have in those situation), I ssh</code>'d to my doomed server and began facing the trials.</p>
sed</code> the sources.list</code> files, now apt update</code>, then apt full-upgrade</code> and 💥... wooops, missed that trap1</a></sup> ... and I
wake up deep into oblivion...</p>
Figuring out my new astral plane</h1>
No problem, I think, I'll just cast another ssh</code> spell, get back my running session, and continue answering apt</code>
whether or not I want to replace my modified config scroll with the new one shipped at the magic academy.</p>
That's precisely where I started to realize why this routine quest has a slight chance of turning to nightmare.</p>
ssh -v</code> would correctly ask my gatekeeper for the challenge, which means the communication runs fine with the dungeon,
but then the invocation stopped at the following lines:</p>
debug1: Sending environment.</span></span>
debug1: channel 0: setting env LANG = "fr_FR.UTF-8"</span></span></code></pre>
with nothing more appearing, and most importantly, no interactive shell spawning.</p>
No problem, I'll just use a longer, but simpler invocation to test how things are going: ssh server.of.doom ls</code>. Lo and
behold, this gives me the scrolls of my home! That's good news, the server is not dead, and can still take commands. But
no matter what spell I try to cast that way, my sweet tmux</code> won't come back, and neither will a new shell.</p>
The way to the upper levels</h1>
Time to open the old magic manuals and find some clever tricks.</p>
bash --norc</code> is the first one taking me forward. With that, you can invoke the bash</code> spell without it reading all
its nice personalization scrolls, like ~/.bashrc</code>. It's just a nice and simple bash</code>, but of course, it'll have no
$PS1</code>, thus the prompt will be empty, and the behavior appears</strong> just like the previous one with the stuck ssh</code>. You
absolutely need to cast some simple spell like ls</code> in it to see if it works! I knew that already, so didn't loose any
time here, but for fellow wizards still learning their basics, that tip might help.</p>
As my final goal is to complete the infamous apt full-upgrade</code> command, better directly cast a privileged shell:
ssh server.of.doom sudo -S su -c \'bash --norc\'</code>.</p>
Time to fight the undead</h1>
Once I reach back the root shell level of my dungeon, things get pretty much easier: I can roll my ps</code>eption to
check for monsters, and obviously find a zombie I'm afraid to stumble upon: byobu</code>. As ssh</code> is not a necromancy
spell, it obviously can't deal with zombies, but still this zombie is retaining my beloved apt</code> in chains, and I need
to free it if I want to bring its cast to completion.</p>
To break the chains, I need a tool. Fortunately for me, I learned a long time ago an almighty spell that can lend me all
the knowledge and wisdom I want. This quickly brings me to the discovery of that powerful new tool: reptyr</code></a>.</p>
With that tool, I realize the approach won't be to fight the undead, but to steal what I need without them realizing it.</p>
Mastering the last spell</h1>
That new reptyr</code> spell is luckily very easy to cast, but I still have a final twist and turn: I'm in a silence zone
that prevents me from apt install</code>ing anything new, for obvious reasons. Good thing I've also learned about the arcanes
of -static</code> sticks and scp</code> to very quickly recover from being silenced.</p>
Finally getting out alive</h1>
Now that I'm all stuffed and know my way around that uncanny dungeon, I quickly cut the chains and free my primary
objective. My terminal is unfortunately not in a very good shape, probably lost a few HP around some mysterious glyphs,
but it's still walking and I can rely on it to complete the spell.</p>
Comes the time of the final boss fight: systemctl reboot</code>, but it seem that I've recovered my apt</code> spell so well that
I managed to trigger fear out of it, and there is basically no fight at all.</p>
A last dpkg --configure -a</code> spell to ensure the exit doors are opened, but that wasn't even necessary.</p>
Until next time, farewell o/</p>
^1</sup>normal procedure</a> should be apt-get update && apt-get upgrade && apt-get full-upgrade</code>, but in my case, I wonder if it would have changed anything. Still, that's the only step I missed when preparing the quest, and won't forget it next time, just in case.</p>
</div>


Le stockage des armes
2023-07-29T00:00:00+00:00
Cet article en français a été rédigé à destination de la revue de l'École Lionel Oudart. Comme les exemplaires papier
sont limités, cette version numérique permet à chacun d'y avoir accès.</em></p>

Stocker son matériel n'est pas simple. Que ce soient des outils de bricolage (qui trainent donc sur l'établi), des
casseroles (qui empêchent les tiroirs de fermer), ou des bokens</em> (qui glissent le long du mur contre lequel ils sont
appuyés, et tombent en faisant un boucan d'enfer), le matériel finit toujours par apporter un certain chaos qu'il n'est
pas facile d'éliminer.</p>
Concernant les bokens</em> (et autres wakizachi</em>, naginata</em>, yari</em>, tanto</em>, bo</em>, jo</em>, iaito</em>, tachi</em>, ou que sais-je, mais on va
garder juste le boken</em> pour simplifier), ils viennent du Japon, et comme tout ce qui est japonais, il y a des règles et
des manières de faire pour tout. Donc évidemment, il y a une manière de stocker son boken</em>: le kake</em>.</p>
Le Kake</h2>
Kake</em> signifie grossièrement support</em>, et est généralement ajouté à l'objet qu'il est sensé supporter: katana-kake</em>,
naginata-kake</em>, yari-kake</em>, etc...</p>
Il en existe plusieurs sortes, comme des katana-kake</em> verticaux, mais la plupart sont horizontaux et permettent
d'accueillir tout type de matériel. Certains se posent sur une surface plane, d'autres sont fixés sur les murs. Certains
n'ont qu'un seul emplacement, tandis que d'autres peuvent aller jusqu'à une dizaine!</p>


Un katana-kake vertical</em></p>


Un kake horizontal à deux emplacements</em></p>


Un kake mural</em></p>
L'intéret du kake</em> est multiple, mais en premier lieu, il donne un emplacement de stockage dédié à notre matériel,
c'est à dire que l'on ne se pose plus la question de savoir où ranger son boken</em>, on le pose simplement sur le kake</em>,
puisqu'il est là pour ça. Certes, il faut trouver où stocker le kake</em> et c'est là un problème bien épineux, mais on a
normalement à ne résoudre ce problème qu'une seule fois.</p>
Ensuite, et surtout, le kake</em> permet de stocker son matériel correctement, afin de le préserver le mieux possible.</p>

Pour un katana-kake</em> vertical, la lame va se retrouver suspendue dans le saya</em> (le fourreau) sans appuyer ni d'un
côté ni de l'autre, ce qui lui évitera de se voiler, surtout si le stockage dur des années.</li>
Pour un kake</em> horizontal, la lame va reposer sur le mune</em> (le dos de la lame), que ce soit un boken</em>, un iaito</em>,
ou un naginata</em>. De même, la lame évitera de se voiler puisqu'elle restera au repos dans une position symétrique
par rapport à la gravité.</li>
Pour les armes longues, attention cependant: il faut que le kake</em> soutienne l'arme par des points plus espacés que
pour un katana</em>, ou bien simplement avec plus de points, afin d'éviter que l'arme se courbe avec le temps.</li>
</ul>

Le kake de Grandfontaine, avec des armes courtes et longues. On voit bien que les armes longues sont soutenues aux extrêmités.</em></p>
Fabrication expresse</h2>
De nombreux modèles de kake</em> sont disponibles à travers les Internets, mais je vous propose ici de découvrir un modèle
simple à réaliser chez soi. L'avantage principal étant de pouvoir facilement l'adapter à ses besoins en terme de nombre
d'emplacement et de dimension, mais aussi en terme de matière et de couleur.</p>


Plan schématique, l'échelle n'est pas respectée</em></p>
Matériaux:</p>

du tasseau</li>
du tourillon</li>
des chevilles de fixation adaptées au mur d'accueil</li>
</ul>
Matériel:</p>

un crayon</li>
un mètre</li>
du papier de verre de finition (180, 240 par exemple)</li>
une scie</li>
une perceuse</li>
un foret de la même taille que le tourillon</li>
</ul>
Astuce</strong>: à chaque étape, on pense à bien commencer par mesurer et tracer les découpes et perçages à l'aide du mètre
et du crayon. Après chaque coupe et perçage, on pense à ébavurer les pièces avec le papier de verre.</p>

On commence par couper toutes les pièces aux bonnes dimensions:</li>
</ol>

Avec le tasseau, on coupe deux longueurs identiques qui serviront de base verticale au kake</em>. Dans mon exemple, j'ai
fait deux montants de ~1m.</li>
Avec le tourillon, on va découper des chevilles que l'on insérera dans les tasseaux une fois ceux-ci percés. Dans
mon exemple, mes chevilles font ~7cm.</li>
</ul>

On perce ensuite les montants à angle (~60°) et interval réguliers (~10cm). Pour l'interval, il suffit de mesurer, et
pour l'angle, on commence par se faire un gabari dans une chute, que l'on utilise ensuite pour tous les trous.</li>
Les trous les plus proches des extrêmités des montants sont ensuite percés pour la fixation au mur.</li>
Il ne reste plus qu'à fixer les montants au mur, et insérer ensuite les chevilles.</li>
Le kake</em> est prêt. Une finition à l'huile de lin augmentera encore d'avantage sa durabilité (de même pour les armes, d'ailleurs).</li>
</ol>


Le résultat obtenu, avec quelques finitions supplémentaires, comme l'étagère et les chanfreins aux extrêmités des montants</em></p>
Galerie complète</a></p>


`inxi`: fetch a machine's detailed information
2023-07-26T00:00:00+00:00
It seems I'm unable to keep that tool in my head, so let's write down this cheat-sheet once and for all:</p>
Install it:</p>
# <package-manager-install-command> inxi</span></span></code></pre>
Get F</strong>ull details:</p>
$ inxi -F</span></span></code></pre>
Get anonymiz</strong>ed F</strong>ull details:</p>
$ inxi -zF</span></span></code></pre>
Get anonymiz</strong>ed F</strong>ull details with ex</strong>tra:</p>
$ inxi -zFx</span></span></code></pre>
Example on my machine:</p>
$ inxi -zFx</span></span>
System:</span></span>
  Kernel: 6.4.4-100.fc37.x86_64 arch: x86_64 bits: 64 compiler: gcc</span></span>
    v: 2.38-27.fc37 Desktop: sway v: 1.7 Distro: Fedora release 37 (Thirty</span></span>
    Seven)</span></span>
Machine:</span></span>
  Type: Desktop Mobo: ASRock model: X570 Pro4 serial: <superuser required></span></span>
    UEFI: American Megatrends v: P3.90 date: 01/26/2021</span></span>
Battery:</span></span>
  Device-1: nintendo_switch_controller_battery_0003:057E:2009.0001 model: N/A</span></span>
    charge: Full status: charging</span></span>
CPU:</span></span>
  Info: 6-core model: AMD Ryzen 5 5600X bits: 64 type: MT MCP arch: Zen 3+</span></span>
    rev: 0 cache: L1: 384 KiB L2: 3 MiB L3: 32 MiB</span></span>
  Speed (MHz): avg: 3856 high: 4642 min/max: 2200/4650 boost: enabled cores:</span></span>
    1: 4574 2: 4641 3: 2200 4: 3711 5: 3702 6: 3697 7: 4266 8: 4642 9: 3723</span></span>
    10: 3713 11: 3695 12: 3716 bogomips: 88632</span></span>
  Flags: avx avx2 ht lm nx pae sse sse2 sse3 sse4_1 sse4_2 sse4a ssse3 svm</span></span>
Graphics:</span></span>
  Device-1: AMD Lexa PRO [Radeon 540/540X/550/550X / RX 540X/550/550X]</span></span>
    vendor: Sapphire driver: amdgpu v: kernel arch: GCN-4 bus-ID: 05:00.0</span></span>
  Device-2: AMD Navi 23 [Radeon RX 6650 XT / 6700S 6800S]</span></span>
    vendor: Tul / PowerColor driver: vfio-pci v: N/A arch: RDNA-2</span></span>
    bus-ID: 0c:00.0</span></span>
  Device-3: Sony CEVCECM driver: uvcvideo type: USB bus-ID: 5-1.3.2:6</span></span>
  Display: wayland server: X.org v: 1.20.14 with: Xwayland v: 22.1.9</span></span>
    compositor: sway v: 1.7 driver: X: loaded: amdgpu</span></span>
    unloaded: fbdev,modesetting,vesa dri: radeonsi gpu: amdgpu resolution:</span></span>
    1: 1920x1200~60Hz 2: 2560x1440~75Hz</span></span>
  API: OpenGL v: 4.6 Mesa 23.0.3 renderer: AMD Radeon RX 550 / 550 Series</span></span>
    (polaris12 LLVM 15.0.7 DRM 3.52 6.4.4-100.fc37.x86_64) direct-render: Yes</span></span>
Audio:</span></span>
  Device-1: AMD Baffin HDMI/DP Audio [Radeon RX 550 640SP / 560/560X]</span></span>
    vendor: Sapphire driver: snd_hda_intel v: kernel bus-ID: 05:00.1</span></span>
  Device-2: AMD Navi 21/23 HDMI/DP Audio driver: vfio-pci bus-ID: 0c:00.1</span></span>
  Device-3: AMD Starship/Matisse HD Audio vendor: ASRock</span></span>
    driver: snd_hda_intel v: kernel bus-ID: 0e:00.4</span></span>
  Device-4: Sony CEVCECM driver: hid-generic,snd-usb-audio,usbhid type: USB</span></span>
    bus-ID: 5-1.3.4:7</span></span>
  API: ALSA v: k6.4.4-100.fc37.x86_64 status: kernel-api</span></span>
  Server-1: PipeWire v: 0.3.75 status: active</span></span>
Network:</span></span>
  Device-1: Intel I211 Gigabit Network vendor: ASRock driver: igb v: kernel</span></span>
    port: d000 bus-ID: 06:00.0</span></span>
  IF: enp6s0 state: up speed: 1000 Mbps duplex: full mac: <filter></span></span>
  IF-ID-1: virbr0 state: down mac: <filter></span></span>
Drives:</span></span>
  Local Storage: total: 2.27 TiB used: 383.31 GiB (16.5%)</span></span>
  ID-1: /dev/nvme0n1 vendor: Samsung model: SSD 970 EVO Plus 500GB</span></span>
    size: 465.76 GiB temp: 30.9 C</span></span>
  ID-2: /dev/nvme1n1 vendor: Samsung model: SSD 980 1TB size: 931.51 GiB</span></span>
    temp: 27.9 C</span></span>
  ID-3: /dev/sda vendor: Samsung model: SSD 860 QVO 1TB size: 931.51 GiB</span></span>
    temp: 21 C</span></span>
Partition:</span></span>
  ID-1: / size: 464.16 GiB used: 382.97 GiB (82.5%) fs: btrfs dev: /dev/dm-0</span></span>
    mapped: luks-3c1eacea-abbd-48f2-9614-3a6e692758db</span></span>
  ID-2: /boot size: 973.4 MiB used: 329.9 MiB (33.9%) fs: ext4</span></span>
    dev: /dev/nvme0n1p2</span></span>
  ID-3: /boot/efi size: 598.8 MiB used: 17.4 MiB (2.9%) fs: vfat</span></span>
    dev: /dev/nvme0n1p1</span></span>
  ID-4: /home size: 464.16 GiB used: 382.97 GiB (82.5%) fs: btrfs</span></span>
    dev: /dev/dm-0 mapped: luks-3c1eacea-abbd-48f2-9614-3a6e692758db</span></span>
Swap:</span></span>
  ID-1: swap-1 type: zram size: 8 GiB used: 0 KiB (0.0%) dev: /dev/zram0</span></span>
Sensors:</span></span>
  System Temperatures: cpu: 39.6 C mobo: N/A gpu: amdgpu temp: 38.0 C</span></span>
  Fan Speeds (RPM): N/A gpu: amdgpu fan: 1787</span></span>
Info:</span></span>
  Processes: 371 Uptime: 1m Memory: available: 31.25 GiB used: 2.21 GiB (7.1%)</span></span>
  Init: systemd target: graphical (5) Compilers: gcc: 12.3.1 clang: 15.0.7</span></span>
  Packages: 28 note: see --rpm Shell: Zsh v: 5.9 inxi: 3.3.27</span></span></code></pre>


Completing Horizon Zero Dawn
2023-02-15T00:00:00+00:00
That's it. It's done. I've just completed Horizon Zero Dawn</a>, and it
was a hell of a trip!</p>
The game is really beautiful, particularly in the Frozen Wilds. The snow getting trampled during a fight still amaze me.</p>
The rhythm between main quest and side quest is well mastered. You get the side quests by small batches if you follow
the main quest, and it's rather quick, but still fun, to complete them before going back to the main quest without
having completely forgotten what was all about.</p>
The gameplay is smooth. All the weapons complete each other well, and it's a pleasure to activate the focus, get the
information you need, like the elemental weakness of your foe, then switch to the right tool to tear it to pieces.</p>
The story is spellbinding. The more you discover, the more you want to get more. The audio logs and textbooks hidden all
over the world are short enough to keep you in the game, but still provide much lore that you always want to dig deeper.</p>
The mostly natural outdoor environments with highly technological sci-fi components, tainted with pre-historical
creatures and contemporary historical events, is really well mixed and gives a truly original world that we don't get to
see that often, and thus are very eager to discover.

This also successfully creates a unique atmosphere that supports the storytelling amazingly, but also helps efficiently
in keeping the suspension of disbelief for a smooth playing experience.</p>
On a more technical note, what a pleasure to be able to play this with one click on Linux (Fedora 36), even enjoying
the full support of a comfortable Nintendo Pro Controller, without going through hacks here and there to maintain the
stuff working for the six months I passed playing the game. Maybe 2022 was the year of the Linux desktop after all?</p>
Jokes aside, kudos to all the developers and maintainers of all those systems, Linux, Fedora, Wine, DXVK, Proton,
Steam, etc... It's a pleasure to enjoy the result of all your efforts running at full speed in high resolution and
graphical settings! Take those screenshots as rewards.</p>


Aloy contemplating Rost's house after all her adventure</em></p>


A view of the Nora Sacred Land from Rost's house</em></p>


Global push-to-talk on `sway`
2023-01-19T00:00:00+00:00
For a few months now, I have a global push-to-talk shortcut. Before discussing it, here is the sway</code> configuration:</p>
bindcode --locked --no-repeat {</span></span>
    # Permanently unmute microphone</span></span>
    $mod+121 exec "pactl set-source-mute @DEFAULT_SOURCE@ 0"</span></span>
    # Push-to-talk style unmute microphone</span></span>
    121 exec "pactl set-source-mute @DEFAULT_SOURCE@ 0"</span></span>
    # Push-to-talk style mute microphone</span></span>
    --release 121 exec "pactl set-source-mute @DEFAULT_SOURCE@ 1"</span></span>
}</span></span></code></pre>
Keycode 121</code> is for XF86AudioMute</code>, as shown by wev</code>:</p>
                      sym: XF86AudioMute (269025042), utf8: ''</span></span>
[14:     wl_keyboard] key: serial: 185212; time: 96900271; key: 121; state: 1 (pressed)</span></span></code></pre>
Since I never use it to mute my audio output (toggling play/pause</em> on any media is far enough and lowering the volume
down is still possible for extreme situations), it was available to bind to to audio input. Moreover, audio input clearly
is something I want to mute regularly and easily, both for privacy purpose and voice chat etiquette.</p>

Now about this config's properties:</p>

It's global and managed by my compositor:

I can be anywhere, even deep in a full-screen game, the shortcut will work.</li>
I can use any voice application, in a web browser or not, the shortcut will work, and still behave the same.</li>
</ul>
</li>
It manages the @DEFAULT_SOURCE@</code>, meaning I can change my audio input to any device, it'll work the same.</li>
It actually binds three commands:

Permanent unmute, with Super+AudioMute</code>: when typing it, I always know I'll be permanently unmuted, useful for
long speeches in video-calls or gaming with my fellows.</li>
Push-to-talk unmute, pressing AudioMute</code>: when pressing it, I always know I can speak, audio input is active.</li>
Push-to-talk mute, releasing AudioMute</code>: when releasing it, I always know I end up muted.</li>
</ul>
</li>
</ul>
In any configuration, I have a shortcut bringing me to any desired state: permanent unmute, push-to-talk unmute,
permanent mute.

And the best: I don't even need any visual feedback! (although I have one on Waybar just in case)</p>

Many thanks to the guy behind Corners were cut</a> that came up to me with this
configuration idea one day, that's one of my best ergonomic improvements since the day I discovered tiling WM.</p>
Edit: thanks to Nabos for pointing out the --no-repeat</code> option.</p>


A `label`-free `traefik` reverse-proxy
2022-12-05T00:00:00+00:00
When the need arise to reverse-proxy services, my go-to solution until recently was nginx</code>.</p>
Since I've now been introduced to traefik</code>, the question is a bit more up for debate, but in any case,
the Internet mostly references configuration leveraging the Docker provider of traefik</code>, with the label</code> system,
which is great, but not always the best solution.</p>
In some situation where you can't or don't want to modify the proxied services' docker-compose.yml</code>
(or docker run</code> command line), it's easiest to fall-back to a more classical file-provider to decorelate
traefik</code>'s configuration from your services' one.</p>
Here is a starting point configuration doing just that:</p>
docker-compose.yml</code>:</p>
version</span>:</span> '3'</span></span>
</span>
services</span>:</span></span>
  reverse-proxy</span>:</span></span>
    image</span>:</span> traefik:v2</span></span>
    volumes</span>:</span></span>
      -</span> ./config:/etc/traefik</span></span></code></pre>
config/traefik.toml</code>:</p>
[</span>entryPoints</span>]</span></span>
  [</span>entryPoints</span>.</span>http</span>]</span></span>
  address</span> =</span> ":80"</span></span>
</span>
[</span>log</span>]</span></span>
  level</span> =</span> "INFO"</span></span>
</span>
# Activate access logs on stdout</span></span>
[</span>accessLog</span>]</span></span>
</span>
# Activate the web UI</span></span>
[</span>api</span>]</span></span>
insecure</span> =</span> true</span></span>
</span>
[</span>providers</span>.</span>file</span>]</span></span>
  filename</span> =</span> "/etc/traefik/services.toml"</span></span></code></pre>
config/services.toml</code>:</p>
[</span>http</span>]</span></span>
  [</span>http</span>.</span>routers</span>]</span></span>
    [</span>http</span>.</span>routers</span>.</span>dev-api</span>]</span></span>
      service</span> =</span> "dev-api"</span></span>
      rule</span> =</span> "Host(`my-dev.host.name`) && PathPrefix(`/api`)"</span></span>
    [</span>http</span>.</span>routers</span>.</span>dev</span>]</span></span>
      service</span> =</span> "dev"</span></span>
      rule</span> =</span> "Host(`my-dev.host.name`) && !PathPrefix(`/api`)"</span></span>
    [</span>http</span>.</span>routers</span>.</span>staging</span>]</span></span>
      service</span> =</span> "staging"</span></span>
      rule</span> =</span> "Host(`my-staging.host.name`)"</span></span>
</span>
  [</span>http</span>.</span>services</span>]</span></span>
    [</span>http</span>.</span>services</span>.</span>dev-api</span>]</span></span>
      [</span>http</span>.</span>services</span>.</span>dev-api</span>.</span>loadBalancer</span>]</span></span>
        [[</span>http</span>.</span>services</span>.</span>dev-api</span>.</span>loadBalancer</span>.</span>servers</span>]]</span></span>
          url</span> =</span> "http://10.0.0.1:4001/"</span></span>
</span>
    [</span>http</span>.</span>services</span>.</span>dev</span>]</span></span>
      [</span>http</span>.</span>services</span>.</span>dev</span>.</span>loadBalancer</span>]</span></span>
        [[</span>http</span>.</span>services</span>.</span>dev</span>.</span>loadBalancer</span>.</span>servers</span>]]</span></span>
          url</span> =</span> "http://10.0.0.1:4000/"</span></span>
</span>
    [</span>http</span>.</span>services</span>.</span>staging</span>]</span></span>
      [</span>http</span>.</span>services</span>.</span>staging</span>.</span>loadBalancer</span>]</span></span>
        [[</span>http</span>.</span>services</span>.</span>staging</span>.</span>loadBalancer</span>.</span>servers</span>]]</span></span>
          url</span> =</span> "http://10.0.0.2:4000/"</span></span></code></pre>


Reviving an old hammer
2022-11-07T00:00:00+00:00
I recently stumbled upon an old hammer head. It was rusty and dirty, but looked great and seem to have lived quite a few
hits already, with its face and peen obviously squashed.</p>
This is more specifically a cross-peen head, that was likely used in the past for shaping small metal pieces or sheets
as it's too light for heavy duty, and wouldn't be squashed if used for woodworking.</p>
It missed a handle, but this was quickly fixed with a small maple branch, and a rotating metallic brush did the rest for
the head.</p>


The old rusty head</em></p>


The nice looking brushed head</em></p>


Carving a handle</em></p>


Assembling the hammer</em></p>


The hammer looking nice on the bench panel</em></p>
Time to do all this: less than an hour.</p>
Why write a blog post about this? Because hammers are great and should be treated with respect</em>!</p>


Hellfest 2022
2022-06-27T00:00:00+00:00
Last week, I had the pleasure of attending the Hellfest</a>, which is one of the greatest Metal
festival in Europe. I only did the first week-end, because three days are already very exhausting, and I wasn't
available for the second week-end anyway.</p>
Pro-tips against the heat</h1>
Yes, it was hot</strong>! Apparent temperature was, according to Meteo France, more than 42°C! Here are some advices to
support that with style:</p>

sew a ghetto-style hooded cloak for a medieval festival a few years in advance</li>
add a white pirate-style linen shirt</li>
wear a traditional burgundy lab coat from your
school</a> around your hips
so that it falls down your legs</li>
</ul>
You now should have every square-centimetre of skin covered, and shouldn't fear sunburns too much. In exchange,
everybody will ask you in awe if you're not too hot with all that fabric, to what you can answer that Tuareg
people</a> live in the middle of the desert with more clothes than that.
Moreover, moistening them gives a very long lasting fresh feeling that makes standing under the sun for hours almost
easy. And rest assured that by more than 40°C, it's not the clothes that make you sweat, but they rather prevent you
from drying too quickly!</p>
I find astonishing that after almost two decades of Hellfest, people still think it's a good idea to wander shirtless
across the festival, and even more, are surprised by someone wearing clothes!</p>
Also, don't forget the golden rule: one pitcher of cider, one pitcher of water</em>!</p>
The shows</h1>
As always, the shows were really over the top in the best possible way! Just to name a few, in no particular order:</p>

Alestorm</li>
Skáld</li>
Ensiferum</li>
The Inspector Cluzo</li>
Five Finger Death Punch</li>
Leprous</li>
Soen</li>
Frog Leap</li>
Perturbator</li>
Devin Townsend</li>
Jinjer</li>
and of course, Gojira</li>
</ul>
The final with that last, awesome band, followed by the greatly orchestrated fireworks with some music on was really
memorable!</p>
As always, the wonderful setting, the fire everywhere at night, the food, the relaxed and friendly atmosphere, the
numerous volunteers and crew members working hard all day and night, I really can't recommend enough this experience,
even for someone not really fond of Metal.</p>
\m/ See you next time in Hell \m/</p>


Configure syslog-ng with TLS
2022-06-14T00:00:00+00:00
This article is just the compilation of my notes regarding the deployment of a simple log concentrator over TLS.</p>
rsyslog</code></a> vs syslog-ng</code></a></h1>
Those are the two main solutions found out there. rsyslog</code> is installed by default on Debian and many derivatives, so I
gave it a go first.</p>
My specifications required the use of a TLS connection between the syslog clients and the server. Nothing fancy, but it
quickly became a pain to set up with rsyslog</code>, since:</p>

They updated their configuration syntax, but kept both in the very same file, while leads to many "questions"
issues</a> and unneeded
difficulties</a> to understand what is a valid file for which rsyslog</code>
version.</li>
Here is the out of date1</a></sup> 2</a></sup> but greatly indexed and easy to find documentation: https://rsyslog.readthedocs.io</a>

It also has the advantage of being Sphinx-based, thus really familiar and easy to browse, which makes the fact that it
covers a version of rsyslog</code> from 2016 even more painful.</li>
Here is the up to date but very unusable doc: https://www.rsyslog.com/doc/v8-stable/configuration/modules/imtcp.html</a>

It's actually more like a full API reference, with no real configuration example that would cover simple use-cases.

Discovering every single option is thus easy, but it's very hard to understand how they work together, as well as
which value a given key can take.

e.g: finding the possible options for StreamDriver.Mode</code> takes at least two clicks from the page where you learn its
existence and a too deep knowledge of the internals of rsyslog</code>: the different network drivers, and which is the one
you want for a TLS connection, gtls</code>, ptcp</code>, openssl</code>...</li>
In overall, "documentation is hard to use and badly structured"</a>.</li>
</ul>
This is only my experience of single day trying to setup a TLS connection between two machines. I expect rsyslog</code>
didn't became popular and the default on Debian by accident, so it must have some advantages I didn't see, but after a
while playing with it, I was more hurt than pleased, and finally gave up. Feel free to show me what kind of moron I am :-)</p>
Oh, and fortunately, Proxmox stopped</a> depending on it a while ago, so
there's was no problem testing something else in my situation.</p>
syslog-ng</code> configuration example</h1>
As you may have guessed, the syslog-ng</code> experience was quite different. It took me about 20 minutes setting up a first
proof of concept connection with syslog-ng</code>, and I had all my servers connected in one afternoon, with a clean and
readable configuration. The documentation isn't perfect, but works okay, and the error messages I got when there were
problems were helpful too. This
page</a> is particularly
salutary and easy to find.</p>
Here is a full server configuration:</p>
options {</span></span>
    create_dirs(yes);</span></span>
    keep-hostname(yes);</span></span>
};</span></span>
</span>
source s_network {</span></span>
    network (</span></span>
            transport("tls")</span></span>
            ip(0.0.0.0)</span></span>
            port(514)</span></span>
            tls (</span></span>
                ca-dir("/etc/ssl/certs")</span></span>
                cert-file("/etc/ssl/certs/server.example.net.crt")</span></span>
                key-file("/etc/ssl/private/server.example.net.key")</span></span>
                peer-verify("required-trusted")</span></span>
                trusted-dn("*CN=*example.net, *")</span></span>
                )</span></span>
        );</span></span>
};</span></span>
</span>
</span>
##################################################</span></span>
destination d_host-generic { file("/storage/logs/$HOST/$YEAR/$MONTH/$HOST-$YEAR-$MONTH-$DAY.log"); };</span></span>
destination d_host-auth { file("/storage/logs/$HOST/$YEAR/$MONTH/auth-$HOST-$YEAR-$MONTH-$DAY.log"); };</span></span>
# You can put many more here depending on your needs</span></span>
</span>
##################################################</span></span>
log { source(s_network); filter(f_auth); destination(d_host-auth); };</span></span>
log { source(s_network); destination(d_host-generic); };</span></span>
# Same as above, add what you need here</span></span></code></pre>
And here is the corresponding client configuration:</p>
destination d_network {</span></span>
    network(</span></span>
            "server.example.net"</span></span>
            port(514)</span></span>
            transport("tls")</span></span>
            tls(ca-dir("/etc/ssl/certs")</span></span>
                cert_file("/etc/ssl/certs/client.example.net.crt.pem")</span></span>
                key_file("/etc/ssl/private/client.example.net.key.pem")</span></span>
               )</span></span>
           );</span></span>
};</span></span>
log {</span></span>
    source(s_src);</span></span>
    destination(d_network);</span></span>
};</span></span></code></pre>
Don't forget to open the TCP 514 port in the firewall, and you're good to go!</p>
^1</sup>Out of date tutorial, it still uses the old syntax: https://rsyslog.readthedocs.io/en/latest/tutorials/tls.html</a></p>
</div>
^2</sup>Here is the rework commit, still unreleased as of today: https://github.com/rsyslog/rsyslog-doc/commit/07bd11c483e0f20068c5f4fd4dc00a698f88a3e6</a></p>
</div>


Store your TOTP seeds on a Yubikey
2022-02-28T00:00:00+00:00
TOTP</a> is a very common method that websites
implement to provide a second authentication factor, and very often, it is recommended to use the proprietary Google
Authenticator</a>™ app on your
Android phone. For years, I've been using the great andOTP</a> app available in
F-droid</a> as a FOSS alternative, since I don't have access to the Play Store.

And yes, I know of Aurora Store</a>, but I see it only as a workaround for
people with no Google account, rather than a true solution to Google's hegemony in the smartphone world.</p>
In any case, the main problem with this application-based solution is well-known: a smartphone breaks easily.

I've been carrying mine since 2017, which is quite a long time for such a device, and it's now starting to fall apart,
with the screen already cracked, a battery time that I can't rely on, and a protective case in a disastrous
condition, that I find pretty pointless to replace given the state of the phone.</p>
Long story short, my phone</del> second authentication factor can die anytime, leaving me in a state where I can only use
my Yubikey</a> on the websites I could activate it on, and no other
solution than the recovery codes for the rest. This is pretty bad, and I
wonder</a> how
people who don't have Yubikey-like solutions do when they drop their phone from a bit too high...</p>
Solutions to that are multiple:</p>

Do nothing and keep recovery codes for bad situations.</li>
Use a desktop TOTP app, which is not a very nomad solution when I need to access an account from a friend's computer.</li>
Store the TOTP seeds in my password manager, which breaks the principle of dividing the different MFA information.</li>
Store the TOTP seeds directly into my Yubikey, which is a nice solution I only recently discovered: the secrets are
well-protected, in a very hard to break device, that is also very lightweight, and that I can keep stringed to my
belt (as I already did anyway). In addition, it brings consistency for my second authentication factor, even with
website that don't support FIDO2</a>-based MFA.</li>
</ul>
The last solution is moreover very easy to set up, thanks to Yubico</a>'s nice work:</p>

Want a GUI? Go for the desktop app: https://github.com/Yubico/yubioath-desktop</a></li>
Want to script? A CLI solution is here: https://github.com/Yubico/yubikey-manager</a></li>
</ul>
Both software are cross-platform, easy to install, packaged in most distributions, and their UI is pretty
straightforward. They allow me set a password to protect the access to the codes (a Yubikey can still get stolen!), and
I've yet to find the limit to the number of seeds I can store (currently 19!).</p>
Another nice use-case for this, is to provide a TOTP-protected OpenVPN access to some people without the complexity of
PAM-based</a> or
PIV-based</a> solutions. OPNsense</a> makes that
server configuration very easy</a>.</p>
As a good friend reminded me, super top-notch TOTP becomes very less useful when you already have strong and unique
passwords everywhere through a password-manager</a>. So go use one! There
are plenty</a>
available</a>!

Still, 2FA doesn't hurt, particularly when you are the one enforcing it from an admin perspective: even if you generate
strong and unique passwords for your users, you can't rely on them for keeping them safe indefinitely. Having their
access protected both by something they know and</em> something they own is a welcome peace of mind for me.</p>
Also, for some very important accounts, I'd say better safe than sorry, and I personally don't mind the extra security
step.</p>


Preventing shared disk accidents with libvirt
2021-11-20T00:00:00+00:00
A quick story to get the context</h1>
My gaming setup involves a libvirt</a> VM with some
passthrough</a>, mainly the GPU, but also sound and USB devices
for example.</p>
Another device that is passed through to the VM is my dedicated SSD, formatted in
Btrfs</a>.

Why Btrfs? Because it's both natively supported by the Linux kernel, and by the
WinBtrfs</a> project that brings its support to Windows. That means I can easily
share the same disk for casual gaming that just works™ on the Windows VM, casual gaming that just works™ on the Linux
host with native games, and for Wine/Proton experiments with the same data I use on Windows without duplicating
everything.</p>
That's a setup I've use for years without problem, but a recent adventure proved me I needed to be more careful</del>
something to prevent accidents from happening again. Imagine that for some reason it's the week-end, and you make some
experiments with Lutris</a> and your GOG</a>
library, then a bit later a friend asks you to come have some fun, and the proposed game is a popular one that is known
not to work</a> with Wine/Proton. Then you'll just fire up the VM, play the game for the rest of
the evening, then shut down everything and go to bed.</p>
But on the next day, when you just thought everything was fine and you could go play some more games again, you realize
that nothing works anymore, and that the Btrfs filesystem is completely corrupted because it was mounted two times in
parallel, by two autonomous systems that thought had authority on it. The problem is not that serious, because nothing
on that disk was really important, and to fix it you simply mkfs.btrfs</code> again, and re-install everything. But when
re-installing everything involves re-downloading half a Terabyte, you also realize that a simple safe-guard would
probably not be too much luxury to avoid further accidents, and that's what this article is about!</p>
libvirt hooks</h1>
Fortunately, someone in the libvirt</code> team thought one day that it would be great to run custom scripts when some events
occurred in the VM lifetime, and the hooks</a> were developed.</p>
Long story short, to prevent the story above from happening again, I just put the script below in the following
executable file: /etc/libvirt/hooks/qemu</code></p>
#!/bin/bash</span></span>
</span>
if</span> [</span> "</span>$2</span>"</span> =</span> "prepare"</span> ]</span>;</span> then</span></span>
    if</span> findmnt</span> /data</span>;</span> then</span></span>
        umount</span> /data</span></span>
    fi</span></span>
fi</span></span></code></pre>
Now, I can completely forget to unmount my shared disk, it will automatically be unmounted before being passed through
to the VM, and I won't have to re-download my game library ever again... famous last words</em></p>


A new Debian release may break your CI
2021-08-17T00:00:00+00:00
What better way to start your week than discovering that Debian's latest
release</a> broke all your CI?</p>
Running with gitlab-runner ...</span></span>
  on a-random-builder 4mHpT2K9</span></span>
Preparing the "docker" executor 00:03</span></span>
Using Docker executor with image a-random-debian-buster-based-image ...</span></span>
[...]</span></span>
$ apt update && apt install -y --no-install-recommends python3</span></span>
WARNING: apt does not have a stable CLI interface. Use with caution in scripts.</span></span>
Get:1 http://security.debian.org/debian-security buster/updates InRelease [65.4 kB]</span></span>
Get:2 http://deb.debian.org/debian buster InRelease [122 kB]</span></span>
Get:3 http://deb.debian.org/debian buster-updates InRelease [51.9 kB]</span></span>
Reading package lists...</span></span>
E: Repository 'http://security.debian.org/debian-security buster/updates InRelease' changed its 'Suite' value from 'stable' to 'oldstable'</span></span>
E: Repository 'http://deb.debian.org/debian buster InRelease' changed its 'Suite' value from 'stable' to 'oldstable'</span></span>
E: Repository 'http://deb.debian.org/debian buster-updates InRelease' changed its 'Suite' value from 'stable-updates' to 'oldstable-updates'</span></span>
ERROR: Job failed: exit code 1</span></span></code></pre>
To avoid that, don't forget that apt update</code> can also ask questions, and can also accept the -y</code> flag, making your
line look like this: $ apt update -y && apt install -y --no-install-recommends python3</code></p>


Troubleshooting a motherboard with an Arduino
2021-08-11T00:00:00+00:00
Remember the old times, when all computer were equipped with a tiny speaker attached directly to the motherboard? I even
remember those speakers being used by video games</a> to
play musics and sounds!</p>
During the dark times of debugging computer problems, those speakers also served another purpose: it was often the only
way your motherboard had to communicate early boot problems, when even a VGA display was unable to work. Most recent
boards don't have those speaker any more, but sometimes come with a LED fulfilling the same role.</p>
Alas, some motherboards in our recent times come with no speaker nor LED, but thankfully with a speaker header, in case
you happen to have a spare one at home. That's not my case, but it seems I found a more modern workaround tonight, while
debugging one of those temperamental machine.</p>
I simply attached the A0 analog pin of my Arduino UNO to the speaker pin of the motherboard header, flashed the simple
program below, and turned on the serial monitor.</p>
void</span> setup</span>() {</span></span>
  Serial</span>.</span>begin</span>(</span>9600</span>)</span>;</span></span>
}</span></span>
</span>
void</span> loop</span>() {</span></span>
  int</span> sensorValue </span>=</span> analogRead</span>(A0)</span>;</span> // A0 is plugged to the speaker pin</span></span>
  Serial</span>.</span>println</span>(sensorValue)</span>;</span></span>
  delay</span>(</span>20</span>)</span>;</span>        // delay in between reads for stability and readability of the output</span></span>
}</span></span></code></pre>


Here is the all too complex wiring of the debugging device!</em></p>
I then turned on the machine, and lo and behold, the following printed before my tearful eyes!</p>
...</span></span>
20:40:19.209 -> 457</span></span>
20:40:19.209 -> 459</span></span>
20:40:19.242 -> 459</span></span>
20:40:19.242 -> 458</span></span>
20:40:19.275 -> 458</span></span>
20:40:19.308 -> 459</span></span>
20:40:19.308 -> 459</span></span>
20:40:19.342 -> 459</span></span>
20:40:19.342 -> 458</span></span>
20:40:19.374 -> 458</span></span>
20:40:19.408 -> 458</span></span>
20:40:19.408 -> 457</span></span>
20:40:19.441 -> 458</span></span>
20:40:19.474 -> 458</span></span>
20:40:19.474 -> 457</span></span>
20:40:19.507 -> 457</span></span>
20:40:19.507 -> 458</span></span>
20:40:19.540 -> 457</span></span>
20:40:19.573 -> 456</span></span>
20:40:19.573 -> 456</span></span>
20:40:19.606 -> 456</span></span>
20:40:19.606 -> 455</span></span>
20:40:19.639 -> 455</span></span>
20:40:19.672 -> 454</span></span>
20:40:19.672 -> 455</span></span>
20:40:19.705 -> 454</span></span>
20:40:19.705 -> 453</span></span>
20:40:19.738 -> 454</span></span>
20:40:19.771 -> 454</span></span>
20:40:19.771 -> 452</span></span>
20:40:19.804 -> 0</span></span>
20:40:19.804 -> 0</span></span>
20:40:19.837 -> 0</span></span>
20:40:19.870 -> 0</span></span>
20:40:19.870 -> 0</span></span>
20:40:19.904 -> 0</span></span>
20:40:19.937 -> 0</span></span>
20:40:19.937 -> 0</span></span>
20:40:19.970 -> 0</span></span>
20:40:19.970 -> 0</span></span>
20:40:20.003 -> 0</span></span>
20:40:20.036 -> 0</span></span>
20:40:20.036 -> 0</span></span>
20:40:20.069 -> 0</span></span>
20:40:20.069 -> 0</span></span>
20:40:20.102 -> 0</span></span>
20:40:20.135 -> 0</span></span>
20:40:20.135 -> 0</span></span>
20:40:20.168 -> 0</span></span>
20:40:20.168 -> 0</span></span>
20:40:20.201 -> 14</span></span>
20:40:20.234 -> 29</span></span>
20:40:20.234 -> 42</span></span>
20:40:20.267 -> 53</span></span>
20:40:20.300 -> 61</span></span>
20:40:20.300 -> 0</span></span>
20:40:20.333 -> 0</span></span>
20:40:20.333 -> 0</span></span>
20:40:20.366 -> 0</span></span>
20:40:20.400 -> 0</span></span>
20:40:20.400 -> 0</span></span>
20:40:20.433 -> 0</span></span>
20:40:20.433 -> 0</span></span>
20:40:20.466 -> 0</span></span>
20:40:20.499 -> 0</span></span>
20:40:20.499 -> 0</span></span>
20:40:20.532 -> 0</span></span>
20:40:20.532 -> 0</span></span>
20:40:20.565 -> 0</span></span>
20:40:20.598 -> 0</span></span>
20:40:20.598 -> 0</span></span>
20:40:20.631 -> 0</span></span>
20:40:20.631 -> 0</span></span>
20:40:20.664 -> 0</span></span>
20:40:20.697 -> 0</span></span>
20:40:20.697 -> 24</span></span>
20:40:20.730 -> 36</span></span>
20:40:20.763 -> 47</span></span>
20:40:20.763 -> 59</span></span>
20:40:20.796 -> 0</span></span>
20:40:20.796 -> 0</span></span>
20:40:20.829 -> 0</span></span>
20:40:20.862 -> 0</span></span>
20:40:20.862 -> 0</span></span>
20:40:20.896 -> 0</span></span>
20:40:20.896 -> 0</span></span>
20:40:20.929 -> 0</span></span>
20:40:20.962 -> 0</span></span>
20:40:20.962 -> 0</span></span>
20:40:20.995 -> 0</span></span>
20:40:20.995 -> 0</span></span>
20:40:21.028 -> 0</span></span>
20:40:21.061 -> 0</span></span>
20:40:21.061 -> 0</span></span>
20:40:21.094 -> 0</span></span>
20:40:21.127 -> 0</span></span>
20:40:21.127 -> 0</span></span>
20:40:21.160 -> 0</span></span>
20:40:21.160 -> 0</span></span>
20:40:21.193 -> 0</span></span>
20:40:21.226 -> 31</span></span>
20:40:21.226 -> 43</span></span>
20:40:21.259 -> 54</span></span>
20:40:21.259 -> 64</span></span>
20:40:21.292 -> 0</span></span>
20:40:21.325 -> 0</span></span>
20:40:21.325 -> 0</span></span>
20:40:21.358 -> 0</span></span>
20:40:21.358 -> 0</span></span>
20:40:21.392 -> 0</span></span>
20:40:21.425 -> 0</span></span>
20:40:21.425 -> 0</span></span>
20:40:21.458 -> 0</span></span>
20:40:21.491 -> 0</span></span>
20:40:21.491 -> 0</span></span>
20:40:21.524 -> 0</span></span>
20:40:21.524 -> 0</span></span>
20:40:21.557 -> 0</span></span>
20:40:21.590 -> 0</span></span>
20:40:21.590 -> 0</span></span>
20:40:21.623 -> 0</span></span>
20:40:21.623 -> 0</span></span>
20:40:21.656 -> 0</span></span>
20:40:21.689 -> 0</span></span>
20:40:21.689 -> 10</span></span>
20:40:21.722 -> 31</span></span>
20:40:21.722 -> 43</span></span>
20:40:21.755 -> 52</span></span>
20:40:21.788 -> 60</span></span>
20:40:21.788 -> 0</span></span>
20:40:21.821 -> 0</span></span>
20:40:21.855 -> 0</span></span>
20:40:21.855 -> 0</span></span>
20:40:21.888 -> 0</span></span>
20:40:21.888 -> 0</span></span>
20:40:21.921 -> 0</span></span>
20:40:21.954 -> 0</span></span>
20:40:21.954 -> 0</span></span>
20:40:21.987 -> 0</span></span>
20:40:21.987 -> 0</span></span>
20:40:22.020 -> 0</span></span>
20:40:22.053 -> 0</span></span>
20:40:22.053 -> 0</span></span>
20:40:22.086 -> 0</span></span>
20:40:22.086 -> 0</span></span>
20:40:22.119 -> 0</span></span>
20:40:22.152 -> 0</span></span>
20:40:22.152 -> 0</span></span>
20:40:22.185 -> 0</span></span>
20:40:22.218 -> 12</span></span>
20:40:22.218 -> 28</span></span>
20:40:22.251 -> 40</span></span>
20:40:22.251 -> 51</span></span>
20:40:22.284 -> 59</span></span>
20:40:22.317 -> 69</span></span>
20:40:22.317 -> 77</span></span>
20:40:22.351 -> 85</span></span>
20:40:22.351 -> 92</span></span>
20:40:22.384 -> 100</span></span>
20:40:22.417 -> 106</span></span>
20:40:22.417 -> 112</span></span>
20:40:22.450 -> 117</span></span>
20:40:22.483 -> 124</span></span>
20:40:22.483 -> 130</span></span>
20:40:22.516 -> 134</span></span>
20:40:22.516 -> 141</span></span>
20:40:22.549 -> 146</span></span>
20:40:22.582 -> 151</span></span>
20:40:22.582 -> 155</span></span>
20:40:22.615 -> 160</span></span>
20:40:22.615 -> 164</span></span>
20:40:22.648 -> 168</span></span>
20:40:22.681 -> 172</span></span>
20:40:22.681 -> 177</span></span>
20:40:22.714 -> 181</span></span>
20:40:22.714 -> 184</span></span>
20:40:22.747 -> 188</span></span>
20:40:22.780 -> 192</span></span>
20:40:22.780 -> 196</span></span>
20:40:22.813 -> 199</span></span>
20:40:22.847 -> 203</span></span>
20:40:22.847 -> 206</span></span>
20:40:22.880 -> 209</span></span>
20:40:22.880 -> 211</span></span>
20:40:22.913 -> 216</span></span>
20:40:22.946 -> 219</span></span>
20:40:22.946 -> 221</span></span>
20:40:22.979 -> 224</span></span>
20:40:22.979 -> 227</span></span>
20:40:23.012 -> 230</span></span>
20:40:23.045 -> 232</span></span>
20:40:23.045 -> 234</span></span>
20:40:23.078 -> 237</span></span>
20:40:23.111 -> 238</span></span>
20:40:23.111 -> 240</span></span>
20:40:23.144 -> 243</span></span>
20:40:23.144 -> 247</span></span>
20:40:23.177 -> 247</span></span>
20:40:23.210 -> 249</span></span>
20:40:23.210 -> 251</span></span>
20:40:23.243 -> 253</span></span>
20:40:23.243 -> 253</span></span>
20:40:23.276 -> 256</span></span>
20:40:23.310 -> 258</span></span>
20:40:23.310 -> 259</span></span>
20:40:23.343 -> 261</span></span>
20:40:23.343 -> 263</span></span>
20:40:23.376 -> 264</span></span>
20:40:23.409 -> 265</span></span>
20:40:23.409 -> 266</span></span>
20:40:23.442 -> 268</span></span>
20:40:23.475 -> 270</span></span>
20:40:23.475 -> 270</span></span>
20:40:23.508 -> 271</span></span>
20:40:23.508 -> 273</span></span>
20:40:23.541 -> 274</span></span>
20:40:23.574 -> 275</span></span>
20:40:23.574 -> 277</span></span>
20:40:23.607 -> 279</span></span>
20:40:23.607 -> 279</span></span>
20:40:23.640 -> 280</span></span>
...</span></span></code></pre>
The careful reader will have noticed the five series of contiguous zeros, among the apparently random values! That's the
clear sign of a signal that was communicated to me by the distressful mainboard. It was, at least partially, alive!</p>

The rest is only usual: — the board seems to still self diagnose, it was the five beeps of a "processor or motherboard
failure", whatever that means... — some random guy on a random forum says that only the VGA output was broken in his
2002 similar situation... — why not, let's try putting in some random old graphic card and getting the display from
another output... — thanks the Force, that worked! — for whatever reason, likely the storms of the past weeks, the MB's
VGA output is burnt, but everything boots fine with a PCI graphic card... — end of debugging, thank you good night!</p>


My 2021 home workstation
2021-03-31T00:00:00+00:00
With no introduction, here is my work station, used daily for both personal stuff and for work. Feel free to grab any
interesting idea!</p>
</p>
Hardware:</h1>
Desk and chair</h2>
The desk is a simple wooden plank, lying on two sawhorses</a>. It's quite wide, very resistant (I'm
able to stand on it without fear), and the wood gives a nice warmth feeling that I love!</p>
My chair is an IKEA Markus</a>, mainly
because I had the opportunity to try one at my job for more than a year, and found it satisfying enough to get one at
home.</p>
Machines</h2>
Towers</h3>
My personal machine is a big tower, running the following:</p>

Mainboard: ASRock x570 Pro4</a></li>
CPU: AMD Ryzen 5 5600X</a></li>
RAM: Crucial DDR4 32GB (2x16GB) 3200MHz</a></li>
GPU:

ASUS GeForce GTX 1050Ti 4GB</a></li>
Gigabyte GeForce GT 610 1GB</a>, salvaged from a friend while
waiting for a better GPU to be available in store

To the reader of the future: we're still in the middle of the Covid-19 pandemic that led to supply chains shortage!</em></li>
</ul>
</li>
Storage:

Samsung SSD 970 EVO Plus M.2 500 Go</a></li>
Samsung SSD 860 QVO 1 To</a></li>
</ul>
</li>
</ul>
I also have a second tower provided by my job for my daily work.</p>
Laptops</h3>
When travelling, I use an old Lenovo Thinkpad x201</a>. It's
a nice old buddy that never let me down, even in desperate situation like bringing the student association's website
back online at 4AM, under the rain because I needed the school's poor Wifi for local network access!</p>
Outputs</h2>
Display</h3>

Some random old 27" ASUS monitor</li>
A second random 24" Samsung monitor provided by my dayjob</li>
</ul>
Both displays are standing on an Arctic Z2 Pro (Gen 3). It's a really awesome stand that provides me with both a USB-3 4
ports HUB and a great flexibility for quickly changing my setup, to either work, show something to someone, or play a
video-game. In that last case, the 27" display is put in front of me, and the 24" is shifted aside as a support screen
with a browser, some chat, and an access to a terminal.</p>
Since I have two towers on two screens, my job provided me with a StarTech
SV231HDMIUA</a> KVM
switch</a>, which is very handy to quickly jump to my personal machine when the
day is over.</p>
Sound</h3>
Regarding the sound, I recently acquired a nice steelseries Arctis
3</a>. It's wired (no battery problem!), very comfortable to wear, even
for many hours straight, which is probably the most important criteria for me: if I'm listening to music, that would ask
for very high quality headphones, I do it on my amplified home speakers anyway, and if I need to wear my headphones a
whole day long, that's generally for online meetings that have very poor sound quality in the first place. As for
gaming, I'm usually more absorbed by the game itself as a whole than by its sound only.

Those headphone have good enough sound in any case, and I just don't really see the point in investing more money in
some very high quality headphones for a barely noticeable difference in my use-cases.</p>
Inputs</h2>
Keyboards and mouse</h3>
My mouse</a> is a cheap vertical, ergonomic
mouse</a> that I've been using for years, and I can't
recommend this kind of mouse enough! The accuracy and sensation for me are basically the same as a normal mouse, but the
physical comfort when using it really is better.</p>
Still in the ergonomics, I use a BFO-9000 mechanical
keyboard</a> from
Keebio</a>. Here is a gallery</a> of its making, and you can also
find its layout</a> or its firmware
source code</a> if you want to build the same.</p>
A second cheap keyboard and a second cheap mouse are also available to ease the use of my VM with device passthrough
(more on that in the software part).</p>
Sound and video</h3>
While the Arctis 3 comes with a microphone, that has pretty good quality, but still uses the motherboard's poor sound
card, which generates noise even with no microphone plugged in.

Fortunately, I have an old Sony CMU-BR100 that came with an old Sony TV. It works pretty well for the sound, less well
for the video (it's old), and as it's USB plugged, it provides a numeric sound input that has far less noise than the
analog one.

But on the other side, it is sensible to far more ambient noises than the directional microphone of the headphone, so I
tend to use one or the other regarding the usage (recording a video, or video conferencing/gaming).</p>
Misc</h3>
I also happen to have two YubiKeys 5 NFC</a> for storing GPG keys and
using them as second authentication factor. One of them stays at home, as a backup, the other one is kept attached at my
belt, and never physically leaves me. Therefore I never have to think about not forgetting the key plugged in a machine.

For my daily workstation, I even have a USB extension that brings a handy USB port right at my side.</p>
Finally I have some various gamepads laying around, like a Nintendo Switch Pro
Controller</a> that work very well with
Steam, or some generic PDP Xbox 360 controllers that work well with anything.</p>
Oh, and did I mention that I use two homemade joysticks</a> when I need to pilot
spaceships?</p>

And we're done for the hardware part, let's see about the software!</p>
Software</h1>
First of all, so you won't look for them, here are my dotfiles</a></em>.</p>
OS</h2>
Latest Fedora</a> has been running fine on all my personal
machine for about four years, and before that I've been switching from time to time between various flavours of
Debian-like or Ubuntu-like distributions. I really like the stability that a non rolling-release distribution offers,
with the freshness and innovation that Fedora pushes.</p>
My work machine, on its side, runs Debian</a>.</p>
Window manager and compositor</h2>
Since I discovered tiling windows management, about ten years ago, with Openbox</a>
combined with an old script called pytile</em> that doesn't seem to exist any more, I've always felt uncomfortable when
trying back more regular WM. I don't think they don't work, but for an efficient daily use, my heart always goes for
tiling.</p>
I had been using Awesome</a> for years until the December 2020
holidays, where I definitely made to jump to the
Wayland</a> world with
Sway</a>. I had a
blocker issue</a> for some time, that I solved</a>
during those holidays, and I'm now a very happy user, with a bit more Rust</a> in my stack!</p>
</p>
Shell and environment</h2>
Talking about Rust, I've recently adopted a lovely starship</a> for my prompt, be it on bash</em> or
zsh</em>. It really is wonderful to avoid the $PS1</code> hell while still having a ton of nice features and a shell that still
feels snappy.</p>
About bash</em> and zsh</em>, I have pretty simple configuration for them, but one interesting bit is my chain of source</code>,
starting from either .bashrc</code> or .zshrc</code>, continuing on .aliases</code> which is versioned too, and finishing with
.aliases.local</code>, that is never included my home's git</code> repo, and that allows per-machine configuration.

The main features I like with zsh</em> that makes me keep it on my main machines is its ability to autocomplete w/b/c/p/my/i</code>
into workspace/blog/content/posts/my-2021-home-workstation/index.md</code>, which I find very</strong> convenient, and the nice,
lazybones-friendly, selection UI for undecidable choice when spamming <Tab></code>. But bash</em> remains my shell of choice for
every other usages such as servers, VMs, containers, phone, etc...</p>
As stated in the hardware part, I also use Yubikeys, thus my SSH_AUTH_SOCK</code> variable points to the socket exposed by
gpg-agent</em> launched with the --enable-ssh-support</code> flag.

That's quite handy to basically don't care about how I manage my SSH private keys, since they never really leave my
pocket and are easy to use on any decently modern Linux machine.</p>
Terminal emulator</h2>
I've gone a long way with Terminator</a> but recently adopted
Alacritty</a> when switching to sway</em>. I didn't really used any of
Terminator</em>'s features anyway, and the vi</em> mode of Alacritty</em> allows pretty easy copy-paste without even touching the
mouse!</p>
Text editor</h2>
I've used vim</a> and/or neovim</a> for as long as I remember using Linux. It has
some nice plugins</a> in my comfortable home setup, but they are
just fancy things to speed me up in the daily usage, and I don't really mind not having them when I'm working on another
machine that only provides a vanilla vim</em>.</p>
I'm not particularly involved in the great text editor war</a> and I completely
support people using IDE or other fancy graphical editors, but my personal usage of computers puts me in the need of a
universal editor that I can find on almost every machine, with or without graphical display, and able to edit any text
in a generic manner, be it a configuration file, or some unknown strange code.</p>
Web browser</h2>
The situation is about the same as for the text editors: I've used Firefox</a> for
so much time that I'm completely used to it. Moreover, for the last few years, with the expansion of Chromium-based
browsers, it's also becoming a small contribution towards keeping some diversity in the web world.

I've mainly used nightly for the last couple of year, but I now tend not to reinstall it and keep a more stable Firefox
since most of the new renderers and engines have landed.</p>
I always have a few plugins: Dark Reader</a>, uBlock Origin</a>,
NoScript</a>, Bitwarden</a>, and Shaarli
Synchronizer</a>.</p>
Email and chat clients</h2>
Like Firefox</em>, Thunderbird</a> has been my main email client for
years, and despite having some flaws like its thread-handling or the fact that it's pretty unusable without a pointing
device, it's still the less worst email client that I've found. Rainloop</a> is also not that
bad, and I'm pretty happy having it as a backup client for when I'm not at home.</p>
My less and less used IRC</a> client is (was?)
irssi</a>, but with the rise of the
Matrix</a> protocol, I've been using
Element</a> and Mirage</a> quite a
lot, and I must say that some modern features, like media integration, reactions, or
convergence</a>, are more than welcome!</p>
VM and gaming</h2>
Maybe the most unexpected part of my setup, but also one that works so well that I wouldn't trade it for anything else!
To play games without having to reboot, but with good performance, and without the random reliability of wine</em>, I use a
Windows 10 VM with PCI
pass-through</a> for the
GPU. virt-manager</a> does a very fine job, even if some parameters
required manual XML editing. My keyboard and mouse are also passed-through, so this configuration requires having a
second pair of input devices on my desktop if I want to access the host, but I have enough place, and switching
physically is very convenient and intuitive.</p>
The other subtlety is the disk management: the VM disk is a 40GB qcow2</a> image, as
expected, but my second, physical, 1TB SATA SSD is again passed-through with
VirtIO</a>. It is formatted with Btrfs</a>, which
is nowadays probably the best solution to share content between Windows and Linux with the great help of
WinBtrfs</a>, in addition to all the positive aspects Btrfs</em> provides in itself.
This gives me great IO performance on both systems, and a nice way to have the games ready for play on Windows, or ready
for trying to play with wine</em> on Linux (when I'll have a more suitable GPU)!</p>


Au revoir Lionel
2021-03-20T00:00:00+00:00
J'ai appris ta disparition avec tristesse, mais en réalité, je me réjouis énormément d'avoir pu te connaitre, et de tout
ce que tu as pu m'apporter, directement, ou indirectement. Ta façon de voir la vie et de présenter les arts martiaux m'a
marqué à tout jamais, et continuera d'influer sur ma propre existence à travers tout ton héritage.</em></p>
Bon voyage auprès des Kamis, et encore merci.</em></p>
</p>

À Lionel Oudart, maître de Katori Shinto Ryu, qui a fait notto le 19 Mars 2021.</p>
Une très ancienne vidéo de lui exécutant Kusanagi No Ken</em> et recevant une correction de ses maîtres japonais:</p>
</video></p>
source: https://www.youtube.com/watch?v=qdjJk4gyaX0</a></p>


Helios64 - Part 2 - Software
2020-12-11T00:00:00+00:00
I recently achieved a satisfying level of configuration on my new Helios64 ARM
NAS, therefore I think it's time to put it into words for my own memory, and for
sharing with the world.

If you didn't read the previous part</a> about the
hardware, it may probably interest you, but it's not required to follow this
post.</p>

TL;DR: Debian Bullseye + ZFS + Docker compose + a bunch of services,
everything run fine!</p>
</blockquote>
OS</h1>
The Helios64 being quite recent, the support is not yet completely upstreamed in
U-Boot</a>
nor in the
Kernel</a>.

That means that only a small set of distributions are currently supporting this
NAS. The official ones</a> are currently
only Armbian builds of Debian 10 (Buster) and Ubuntu 20.04 (Focal).</p>
For the fun, and because I wanted to give it a shot, I went on trying to put
Fedora on it, before realizing at the end of the installation that it was not
supported yet. Why the installer booted is still a mystery, but I didn't take
the time to really investigate that, and I suspect that the bootloader I had
flashed before helped a lot in that process.</p>
As I'm really comfortable with Debian, I choose Buster for a first real install,
and simply followed the official
guide</a> which is really easy and
clear.</p>
Sadly, as at the time, there were
some</a>
difficulties</a>
for installing ZFS on Buster, I quickly performed a migration to Bullseye
(current Debian testing), and got everything running well on this OS. As it's
only for personal use, it's no problem being a bit bleeding-edge, and so far,
this Debian testing installation has been very stable!</p>
Storage</h1>
As I spoiled in the previous section, the storage runs on
ZFS</a> for multiple reasons that are beyond
the scope of this article (check out the Internet on this filesystem if you've
never heard of it!).</p>
Hardware and redundancy</h2>
I'm really far from being an expert regarding all the available HDD on the
market, so I basically purchased some 4TB Seagate Ironwolf, mainly because I've
seen some of them running for quite some time at work, and they have some
good reviews on the Internet.</p>
It took me quite some time to think about the redundancy layout, but I finally
settled on
RAID-Z2</a>,
because in the case of one disk failure, that would allow me to continue using
the NAS with some confidence while waiting for the new replacement disk to
arrive. Besides, with 5 4TB HDDs, that grants me about 12TB of usable
space, which is far enough for my personal use!</p>
Poor man's benchmarks</h2>
I knew that ZFS had the reputation of eating all the available RAM, and I even
experienced it already on some other machines, so I was a bit afraid of its
performances on this 4GB NAS. Therefore I quickly went on some poor man's
benchmarks with dd</code>, to get rough results on what I could expect:</p>

Writing 4GB with 1MB block size</strong></li>
</ul>
# dd if=/dev/zero of=test bs=1M count=4000 conv=fsync status=progress</span></span>
4194304000 octets (4,2 GB, 3,9 GiB) copiés, 16,5515 s, 253 MB/s</span></span></code></pre>

Writing 4GB with 10MB block size</strong></li>
</ul>
# dd if=/dev/zero of=test bs=10M count=400 conv=fsync</span></span>
4194304000 octets (4,2 GB, 3,9 GiB) copiés, 15,2559 s, 275 MB/s</span></span></code></pre>

Reading 4GB</strong></li>
</ul>
# dd if=test of=/dev/null</span></span>
4194304000 octets (4,2 GB, 3,9 GiB) copiés, 89,0503 s, 47,1 MB/s</span></span></code></pre>

Writing 20GB with 1MB block size</strong></li>
</ul>
# dd if=/dev/zero of=test bs=1M count=20000 conv=fsync</span></span>
20971520000 octets (21 GB, 20 GiB) copiés, 75,329 s, 278 MB/s</span></span></code></pre>

Reading 20GB</strong></li>
</ul>
# dd if=test of=/dev/null</span></span>
20971520000 octets (21 GB, 20 GiB) copiés, 464,902 s, 45,1 MB/s</span></span></code></pre>

Copying 20GB</strong></li>
</ul>
# dd if=test of=test2 conv=fsync</span></span>
20971520000 octets (21 GB, 20 GiB) copiés, 1378,97 s, 15,2 MB/s</span></span></code></pre>
As always with ZFS, the results are a bit surprising, but can easily be
explained once you are aware that ZFS runs checksums at every read. Most
importantly, even if the performances are not the best we've seen, they will be
largely decent enough to get my home services up and running!</p>
Partitionning</del> Voluming</del> Datasetting? Filesysteming?</h2>
As with most modern filesystems, the notion of
partition</a> tends to disappear
in favour of things like logical
volumes</a>, or in the
case of ZFS, datasets, that are far more flexible and reliable.</p>
As it's fairly easy to roll that back, I went into the extreme by making a
dataset per logical entity I have to store. This gives me a shitload of
"filesystems" (the most common kind of ZFS dataset), but that's not really a
problem, and besides, that allows me to quickly monitor the used storage without
firing up du</code></del> ncdu</code>. This can also provide some fine quota tuning in the
future if need be.

The icing on the cake is ZFS's built-in NFS server, that allows a simple zfs set sharenfs=on storage/data/tvshows</code> to let Kodi</a> access the
TV shows without hassle!</p>
# zfs list</span></span>
NAME                              USED  AVAIL     REFER  MOUNTPOINT</span></span>
storage                          2.05T  8.38T      170K  /storage</span></span>
storage/backup                   36.3G  8.38T      170K  /storage/backup</span></span>
storage/backup/bep               36.3G  8.38T     36.3G  /storage/backup/bep</span></span>
storage/config                   2.40G  8.38T     3.80M  /storage/config</span></span>
storage/config/jackett           4.12M  8.38T     4.12M  /storage/config/jackett</span></span>
storage/config/jellyfin          1.43G  8.38T     1.43G  /storage/config/jellyfin</span></span>
storage/config/nextcloud          634M  8.38T      634M  /storage/config/nextcloud</span></span>
storage/config/pihole            44.6M  8.38T     44.6M  /storage/config/pihole</span></span>
storage/config/radarr             236M  8.38T      236M  /storage/config/radarr</span></span>
storage/config/sonarr            49.8M  8.38T     49.8M  /storage/config/sonarr</span></span>
storage/config/swag              24.3M  8.38T     24.3M  /storage/config/swag</span></span>
storage/config/transmission      2.51M  8.38T     2.51M  /storage/config/transmission</span></span>
storage/config/wireguard          263K  8.38T      263K  /storage/config/wireguard</span></span>
storage/data                     2.01T  8.38T      213K  /storage/data</span></span>
storage/data/downloads           35.7G  8.38T     35.7G  /storage/data/downloads</span></span>
storage/data/movies               627G  8.38T      627G  /storage/data/movies</span></span>
storage/data/music                185G  8.38T      185G  /storage/data/music</span></span>
storage/data/nextcloud            380G  8.38T      380G  /storage/data/nextcloud</span></span>
storage/data/postgres_nextcloud   157M  8.38T      157M  /storage/data/postgres_nextcloud</span></span>
storage/data/tvshows              834G  8.38T      834G  /storage/data/tvshows</span></span></code></pre>Deploying some services</h1>
A new installation is the perfect time to think about reworking how every
service is deployed. That was especially true as my previous server had been
installed more than 6 years ago (2013!), when I was still a second-year student.

I've learned a lot since that time!</p>
Long story short: the awesome guys at
Linuxserver.io</a> maintain a bunch of Docker images
for most of the common services. If anything was to be missing, it's still very
hard to find a project that doesn't have its own Dockerfile</code>.

docker-compose</a> also being a nice and easy
way to manage the containers, I would have a very short and consistent
configuration in no time.</p>
As the whole configuration is in overall pretty boring,
here is my docker-compose.yml</code></a>, that you just have to
drop in /storage/config</code> if you reproduced the filesystems mentioned above.</p>
Every service is basically on its own network, with its own system user, so that
everyone is at least somewhat isolated from each other. It's pretty basic, but I
think it's sufficient for my personal usage.

The only really interesting bit is about the seedbox and the VPN, which will
make a fine post on its own, but won't be covered in this article.</p>
With all the currently running services (PiHole</a>,
Nextcloud</a> with its PostgreSQL</a>,
Swag</a>,
Radarr</a>, Sonarr</a>,
Jackett</a>,
WireGuard</a>, and
Transmission</a>), I have about 500MB of free RAM
available, and everything is performing quite well.

The load is usually around 1.2, and sometime jumps over 2 when reading a film.
Of course, performing big operations in Nextcloud or the media libraries may be
slower than on a traditional x86 NAS, but since that remains fairly uncommon and
not at all in the daily usage, I'm fine with it!</p>
Hosting a Borg repository too</h1>
As a side note, it's worth mentioning that the NAS also performs nightly
backups for another server, and that the server part of
Borg</a> behaves extremely normally, running its 45GB
archive job usually in less than 10 minutes.

Here is the report of last night, for those who seek more accurate stats:</p>
Time (start): Fri, 2020-12-11 04:38:56</span></span>
Time (end):   Fri, 2020-12-11 04:46:54</span></span>
Duration: 7 minutes 58.36 seconds</span></span>
Number of files: 204638</span></span>
Utilization of max. archive size: 0%</span></span>
------------------------------------------------------------------------------</span></span>
                       Original size      Compressed size    Deduplicated size</span></span>
This archive:               45.59 GB             39.67 GB            239.98 MB</span></span>
All archives:              422.20 GB            366.55 GB             39.10 GB</span></span>
</span>
                       Unique chunks         Total chunks</span></span>
Chunk index:                  184323              1986320</span></span></code></pre>
Speaking about backups, the Helios64 does not yet have some off-site backup, but
rest assured that it's something that is planned, and will be detailed in
another future blog post.</p>
Conclusion</h1>
The Helios64 has been running fine for two weeks now, without noticeable
performance issues (Nextcloud taking a few seconds waking up after some
time idling doesn't count!), and in overall, I'm super happy with it!</p>
Both the hardware and the software please me very much, and the configuration
with a single docker-compose.yml</code> file is so painless that I won't go back to a
classic, bloated system anytime soon.</p>
See you in the next post detailing the VPN and seedbox setup!</p>
Oh, and by the way, the IAE</a> was an
awesome event, thank you CIG!</p>


Run a seedbox through a VPN, easily
2020-12-11T00:00:00+00:00
Requirements</em>: have Transmission</a> and
Jackett</a> tunnelled, so that if my ISP
doesn't respect the net
neutrality</a>, they won't be
impacted. Upgrading packages, or serving a Nextcloud from the machine must not
depend on that VPN to be up and running though.</p>
Solution</em>: have a Docker network dedicated to that VPN,
WireGuard</a> in a container attached to that network,
with a specific rule to not route the local network traffic through the VPN (to be able to
access my services), and
attach</a> the
Transmission and Jackett containers to the WireGuard's network stack. The port
binding for Transmission and Jackett's web UIs must of course be done in the
WireGuard container's configuration.</p>
Here is a sample of the WireGuard config:</p>
[Interface]</span></span>
Address = 10.8.0.2/32</span></span>
PrivateKey = <private_key></span></span>
DNS = <dns_that_respects_more_net_neutrality_than_my_isp></span></span>
PostUp = ip rule add to 192.168.0.0/24 table main  # Don't use VPN for local network</span></span>
PostDown = ip rule del to 192.168.0.0/24 table main</span></span>
</span>
[Peer]</span></span>
PublicKey = <public_key></span></span>
Endpoint = <end_point_address></span></span>
AllowedIPs = 0.0.0.0/0  # Allow everything to get through VPN</span></span>
PersistentKeepalive = 21</span></span></code></pre>
And here are the interesting parts of an associated docker-compose.yml</code>:</p>
networks:</span></span>
  vpn_net:</span></span>
</span>
services:</span></span>
  wireguard:</span></span>
    image: ghcr.io/linuxserver/wireguard</span></span>
    container_name: wireguard</span></span>
    networks:</span></span>
      - vpn_net</span></span>
    ports:</span></span>
      - 9091:9091  # Map Transmission's port</span></span>
      - 9117:9117  # Map Jackett's port</span></span>
</span>
  transmission:</span></span>
    image: linuxserver/transmission</span></span>
    depends_on:</span></span>
      - wireguard</span></span>
    network_mode: service:wireguard  # Same as `--net=container:wireguard` in `docker run`</span></span>
</span>
  jackett:</span></span>
    image: ghcr.io/linuxserver/jackett</span></span>
    depends_on:</span></span>
      - wireguard</span></span>
    network_mode: service:wireguard</span></span>
</span>
  sonarr:</span></span>
    image: ghcr.io/linuxserver/sonarr</span></span>
    networks:</span></span>
      - vpn_net  # It use the same network, but doesn't require to go through the VPN</span></span>
    ports:</span></span>
      - 8989:8989</span></span></code></pre>
Of course, this example won't run as-is, but it highlights the key parts of the
configuration.</p>
Enjoy!</p>


Helios64 - Part 1 - Hardware
2020-11-23T00:00:00+00:00
I'm so very super happy to have received my Helios64 NAS, from
Kobol</a>, that I can't wait to write about it!</p>
I just passed the last two hours assembling the hardware, thanks to their very
well-made and illustrated guide</a>. Some
steps were naturally a bit tedious, like the wiring of the HDD
harness</a>, but
nothing impossible.

The case, and all the components, are very well finished metal pieces, except for the
disk trays made of nice flashy pink plastic, giving the whole lot a amazing look.

It's just beautiful!</p>
I've not yet power-up the beast, because I did not anticipate that I would need
a micro-SD card for the installation1</a></sup>, and it's already 9pm, and also mainly
because the
MSR</a>
is exposed
tonight</a>
at the IAE</a>!

That means I currently have no idea at all about how the software I'll put on it
will run, and how well it will handle any IO load (it's an ARM SoC, after all,
not an x64 one), but rest assured that I'll come back here to talk about it.</p>
I'll now join the 'verse and leave you with some pictures:</p>


Installing the HDD harness</em></p>


The back-panel with two fans and the ports</em></p>


View from the front, without HDD</em></p>


HDD are now mounted</em></p>


And the front-panel is in place!</em></p>
^1</sup>though it's well written in the doc</a>!</p>
</div>


Reviewable drafts with Hugo
2020-10-20T00:00:00+00:00
Hugo</a> is the static website generator I use for this blog.
It supports a draft: true</code> front
matter</a> variable, but when it
is used, hugo</code> can only completely ignore the page, or generate it, show it in
the post list and RSS feed, and basically handle it like a normal page with the
-D</code></a> flag.</p>
A great in-between is to be able to generate the page without publishing it.
That way, the page can be sent to reviewers using its link, but won't appear to
people visiting the website or subscribed to the feeds.</p>
This can be achieved with the build
options</a>, in the front
matter variables. Instead of writing draft: true</code>, the following can be set for
your new work-in-progress article:</p>
_build:</span></span>
  render: always</span></span>
  list: never</span></span></code></pre>
The website can be generated without the -D</code> flag, as this WIP article is not
considered a draft.</p>


How I built and designed my home-made joystick (prototype part)
2020-10-16T00:00:00+00:00
Why would you do that?</h2>
After playing Star Citizen</a> for more than
a year, it became evident that I needed to fly with something more immersing
than a mouse and a keyboard.

I made some research and quickly discovered that there are basically two kind of
sensors for the gimbal</a> axis:
potentiometers</a> and Hall-effect
sensors</a>. The first ones are
cheap and easy to employ, but less precise than the second ones, that leverage
magnetic field, and may be trickier to use. As you would expect, cheap joysticks
on the market usually use potentiometers, while expansive ones use Hall-effect
sensors.</p>
The second reason is that it looked like a very fine project to combine multiple
skills: mechanical engineering to build the gimbal, and the whole hardware
thing, electronic for the circuitry, and programming for the firmware. As a
computer science engineer, I knew almost nothing on the two first skills and I
would have to learn a lot.

I must precise that 3D printing was not really an option to me, because I have
no 3D printer, and no easy access to one. Moreover, it was a lot more fun to do
everything on my own, using more traditional techniques.</p>
Designing the gimbal</h2>
The most difficult part from a mechanical point of view was of course the
gimbal, which in this application is more a universal
joint</a> than a true gimbal.</p>
The design is pretty simple, and I did not invent anything here, but I thought it
would be fun to cast Zamak</a> for making the
pieces, as I had some available, and I know it is pretty easy to meld and cast.
For reference, it melds at about 380°C, which is easily reached in a pot on a
standard electric hotplate.</p>


Molten Zamak in a pot</em></p>
Machining was quickly considered, but it requires more industrial tools to be
able to produce multiple identical pieces. It would produce a lot of chip, which
is not good for keeping the flat clean, and also has the caveat of generating
losses.</p>
Sculpting the pattern</h3>
Building the pattern was a very straightforward step. Just melting some candle
paraffin wax, sculpting it with a knife, and I was done.


Sculpting the paraffin wax block</em></p>


The pattern is ready</em></p>
Making a re-usable mold, and casting multiple identical pieces</h3>
I had already cast some piece in Zamak, but always unique ones, with the mold
being destroyed in the process. Now, I had to make a mold that would be able to
make at least 4 times the same piece. As the draft angle</a>
was not really a functional constraint, and I would have the possibility to
machine it afterwards, I started with
plaster</a>, hoping that it would be easy
to remove the piece from the top.



Plaster drying with the pattern</em></p>
Indeed, it was easy to remove the piece. Sadly, during the multiple tries, the
mold always ended-up being fractured by the hot temperature of the metal. It was
time to try something else.


A first broken mold</em></p>


A second mold that did not make it</em></p>
Looking for solutions on the Internet, I stumbled upon this
video</a> made by a fisherman, that
shows how to make a mold to cast lead using RTV
silicon</a>. Thankfully, lead and zamak
have similar melting points, usually around 350°C and 400°C, depending on the
alloys, meaning I should be able to use the same technique. RTV Silicone is not
that hard to find, and this one</a>
worked pretty well!


A Zamak pattern made from the previous steps, ready to get the silicon for a new mold.</em></p>


The second part of the silicon mold is almost ready.</em></p>


One piece of the gimbal, freshly cast.</em></p>


The four gimbal pieces, once polished and drilled.</em></p>
Assembling the gimbal and testing the sensors</h3>
Now that I had most of the pieces for the gimbal, I tried to assemble it a first
time to test the sensors and make a first proof-of-concept.</p>
The assembly was pretty simple, with the X and Y axis being hold on some old
inline-skates</a>
bearing</a> that I salvaged. The axis
themselves are made with two bits of 8mm threaded
rod</a> tied together with iron wire.</p>
For the test, I just flashed a simple program</a> that
just printed the analog values to the serial output.

Those values are physically an electric tension, varying between 0V and 5V
(theoretically). Once read by the analog input pin of the Arduino, they are
represented by a positive integer varying between 0 and 1023.
On the measurements I've made with the test program, I've managed to get the
following values, which are, in my opinion, completely satisfying in terms of
accuracy and range:</p>
</th> X</th> Y</th> Z</th></tr></thead>

Min</td> 130</td> 155</td> 330</td></tr>
Max</td> 835</td> 950</td> 730</td></tr>
Range (Max-Min)</td> 705</td> 795</td> 400</td></tr>
</tbody></table>
X and Y have very decent ranges, which is super great, but in any case, the
sensors are so precise, that the step between two values is only one, if I move
the stick gently enough. Clearly, at last 400 different values, and up to 795,
are more than enough for me to fly anything in any game! I'm also not sure about
what level of flying would require more precision.</p>


Gimbal is first assembled.</em></p>


A sensor and its magnet in the final state after the adjusments.</em></p>
Carving the handle</h2>
It happened that I had a boxtree</a> branch
available. Boxwood is a very fine wood to carve, and the diameter of the branch
was perfect for sculpting a handle, while passing some wires inside it for the
buttons. I am quite happy with the result of the handle itself, but the
revolute-joint that binds it to the gimbal is currently not at its best.
Reworking that part is already planned.


The piece of boxwood before anything happened.</em></p>


Carving the inside of the handle, to make place for the wires.</em></p>


A button, ready to be put in place behind the trigger.</em></p>
Wiring the electronic</h2>
Nothing really fancy here, the electronic is really simple.</p>
Hall-effect sensors are wired the same way potentiometers are. That means a pin
to the ground, a pin to the +5V, and the third pin will be the output tension,
that must be connected to an analog input of the Arduino micro.</p>
For the buttons, using the QMK firmware makes wiring a diode matrix</a> possible.
This allows a great number of switches on a very small number of inputs on the
controller.


Schematics</em></p>
Download schematics</a>


Arduino micro pinout diagram</em></p>
Programming the controller</h2>
At the very beginning of this project, I had already found this pull-request</a>
in the QMK firmware</a> project, which I had tested on my
BFO-9000</a>,
leveraging the virtual axis feature to fly ships using a keyboard recognized as
a joystick by Star Citizen (most games would work too).

While this worked pretty bad for flying (spoiler alert: discrete, all or none
axis are not that great!), this gave me confidence that the real analog axis
would work fine too from the game's point of view.</p>
By the time I had the joystick assembled for the first time, the PR had even
been merged, and was fully functional! Here</a>
is my firmware code at the time of writing.</p>


Calibrating the joystick using jstest-gtk</code></em></p>


Finally testing the joystick in game!</em></p>
For those who want to see more pictures, here is a gallery</a> with photos of all the building steps.</p>
Next steps</h2>
Even if the joystick is currently working, it's still a very early prototype
that needs improvements. Here are some of them that I already thought of:</p>

Mount the stick on a proper bearing for less play and smoother feeling.</li>
Make an adjustable spring system, for fine tuning the rest position.</li>
Make a case around the gimbal to protect the wiring, and host more buttons.</li>
Mount everything on a decent metal plate instead of a thin wooden plank.</li>
Build a second joystick to handle 3 more axis!</li>
</ul>


Enjoying Tool live
2019-07-02T00:00:00+00:00
Last summer, I had the pleasure to see
Tool</a> in concert at the Hellfest
festival, and that really was awesome for multiple reasons:</p>

The musicians are technically very skilled, being in studio as well as on
stage.</li>
The show is centred on the music and the visual light effects combined
together to create a very mesmerizing performance.</li>
They even ask the public not to take pictures or videos to enjoy the moment as
one that must be lived and felt, rather than watched later on a small, inhuman
screen.</li>
The sound tuning was just perfect, and I don't remember being at a metal show
with that many people able to listen to the music without their ear
protection. Thank you Hellfest for that!</li>
They played some of their new titles that weren't released yet at the time.</li>
</ul>
Of course, going to another show now would probably fulfil only the three first
points in my list, but I find them far good enough to recommend Tool</em> for your
next concert!</p>


Boardgame review: Outlive & Captain Sonar
2019-01-03T00:00:00+00:00
A long time a go, in a blog not so far away, someone stopped writing, for no
real reason. Many happy new years later, that guy tested two wonderful
boardgames, and started writing again.</p>
Outlive</h1>
Let's start by the most common of the two:
Outlive</a>.</p>
In this survival game, you compete with other players to collect the too few
resources available and optimize your shelter, so that you get better bonuses
and make more "survival point" to win the game.</p>
One of the fun part regarding other games is that you can directly interact with
other by putting "pressure" on their characters so that you steal them
resources, which can make a great difference in their, and your ability to
realize one or the other action.</p>
All in one, it's quite a challenging game for those who want to calculate the
many possibilities at each turn, since there are always multiple ways to win.</p>
Captain Sonar</h1>
The second game is in a far less common style. Captain
Sonar</a>
is here to immerse yourself in a submarine crew member, dividing the players in
two teams competing on the same map to destroy the other, a bit like a classical
naval battle.</p>
But the really awesome part is that this game is made to be played in real-time,
meaning that a team can just navigate faster than the other by simply being more
efficient in coordinating itself. Though, speed will not help when it comes to
launch a torpedo on the other submarine, and a great part of the work is first
to spot the enemy ship without giving too much informations about your own
position.</p>
Really fast to learn, but very difficult to master, this game is perfect to play
with 6 to 8 players, and is seriously awesome for a week-end with friends, even
if some of them are not particularly fond of boardgames.</p>


First workshop at the Grehack
2016-11-20T00:00:00+00:00
Last Friday, I was in Grenoble, at the Grehack, to give my very first workshop!
Dustri</a> asked me a few weeks ago if I could come with him, since
this was about radare2</a>, the very famous reverse engineering framework that I had worked for in RSoC
2014.</p>
This was a very fun experience, with everyone being pretty happy learning the mysteries of r2. I even helped a bit
a guy using r2 during the CTF that followed, this was really encouraging.

Of course, you can grad the slides and the material here: link</a>. Feel free
to contact me if you have problems trying to (re)do the workshop at home.</p>
During the day, there were also some various talks, more or less interesting. That was also the occasion to talk a
bit with cool guys from Tetrane</a> about their awesome tool Reven (almost as awesome as
r2! :D).</p>
The organisation was great, but there were some small hiccups that made the Grehack a bit messy. Anyway, the staff was
really kind, and I'd still be happy to come back another year.</p>


Reviewing the Touch Lux 3, by Pocketbook
2016-05-22T00:00:00+00:00
For my birthday, my parents offered me an ebook reader, the Touch Lux 3</em>, by
Pocketbook</strong></a>.
I already knew a bit about it, since it's not the first one I see around me, and
I was again happy seeing a printed version of the GPL in the box.

Indeed, it is a really nice product, both in quality and in open-mindness</em>. It
runs a Linux based OS, can read a lot of file formats with or without DRM, and
has a lot of nice applications, from the Web browser</em> to the Chess game</em>.</p>
E-pubs and PDFs are great, but I have in my library tons of comics in various
strange formats, such as .CBR (rar), .CBZ (zip), or .CBT (tar), which are
archives containing pictures. Sadly, the Pocketbook can not read those formats,
but after a small research, I found that an amazing guy did a great job in this
page</a>!</p>
Thanks to the open design of the reader, we have really easy access to the
system, and thus, we can add applications as we want. That's how the man did
manage to implement a new viewing application supporting the .CBx formats, and
allowing me to read my comics on the Pocketbook.</p>
It's still a bit small and in black and white, but the books are nicely readable
when rotating the screen, and the refresh time is less than 1s to get a complete
new page, which I find really quick and makes me really happy with it!</p>


Quitting mailoo
2016-05-20T00:00:00+00:00
I've been using Mailoo</a> for a few years now, and I was pretty happy with it. But recently, as I
changed my password, I was upset, as every time, when I again received the confirmation e-mail saying something like:
"Great, you changed your password, your new password is blahblahblah4000</strong>!"</em>.

That made me sad, but I passed over, as always, still saying to myself that I really should change my e-mail provider.</p>
And what a surprise! The next morning, I began to receive a lot of messages from friends (contacts) saying "yeah? what
do you need?"</em> and other strange answers to a message I didn't send. I quickly changed my password again, and no mail
have been oddly resend since, but the evil was done...</p>
Today, two days later, I've already made a new address with my friend Piké</a> on our dedicated
server, self hosting one more service, and replacing the aliases I had at Gandi</a>.</p>
You can now write me at skia [at] libskia (dot) so, and soon, the old addresses at mailoo.org won't work anymore (I'm
still waiting a bit before deleting everything, since I use theses e-mail every day).</p>


The Force has awoken...
2015-12-16T00:00:00+00:00
Today is the 16th December, and the world (at least the France) sees the release
of Star Wars VII: The Force Awakens</strong>. In this special occasion, I take the
time to write a bit about how much I've been loving the Star Wars</em> universe,
and that for a very long time!</p>
It all began when I first saw A New Hope</strong> when I was young (I don't remember
precisly when). Since then, I grew up playing the Jedi
master</a>, making stop-motion Star
Wars Lego movies (that I sadly lost), even becoming sometimes a Sith
Lord</a>, when not too busy
collecting/playing with about fifteen Lego spaceships, and more than thirty
characters!</p>
I continued exploring the Star Wars universe
reading</a>
books</a>,
playing</a>
video</a>-games</a>,
and still now playing a lost, Jedi to become,
Kiffar</a> vagabond, in a very cool
role-playing game</a>!</p>
And today, I'm very happy that the universe continues to live through a new
movie!</p>
Many people have asked me how I felt about Lucasfilm beeing sold to Disney, and
I always answered that it was great.

It's great to do so while George Lucas has not yet joined the Force (sadly, it
will happen).

It's great to do so because Disney has a lot of money, and it's great that they
use it to make more Star Wars stuff.

It's great because they trusted J.J. Abrams to make this new movie, and I think
he has done a good job previously with the new Star Trek films.

It's great because we will see the old characters played by the old actors, and
I already know that it will be a magic moment!

It's great because while writing these lines, I'm listening to the soundtrack
that made John Williams for the first and second trilogy, and I'm really happy
that he doing a third one!</p>
More generally, I'm also very happy with how Disney managed to keep the giant
extended-universe by creating the
Legend</a>, without beeing hold
back for the new films. Indeed, keeping the universe consistant would have been
almost impossible without using a entire new place, with very few references to
the old movies.</p>
That said, I'm still waiting patiently to see the awaken of the Force, although
I know that within me, it already awoke a long time ago...</em></p>


SSLH, ssh&co though Proxies
2015-11-09T00:00:00+00:00
During my intership, I wanted to access my server, to continue using IRC in my
irssi</a>. I need for that to ssh to
hya.sk</a>, but the problem came from the proxy that
provide my Internet connection, because it's blocking everything except ports 80
and 443.</p>
First thought: easy, I just have to set SSH to listen on port 443!</p>
Problem: we (Piké</a> and I), are running website with
HTTPS</a> enabled, and it's running, of
course, on port 443.</p>
From there, I had many solutions. I could put in place a VPN using some option
like
port-share</a>
but it was a bit heavy for just an SSH connection... Moreover, VPNs are stictly
forbidden by the local policy, so it wasn't a really good idea.</p>
I also could have used GoTTY</a>, to get a shell
in my browser, but I didn't really like this solution, especially for IRC
notifications, that are forwarded though screen to my terminal, to have a little
"beep" when someone highlights me.</p>
I finally found a far better solution:
SSLH</a>. It's a small SSL multiplexer
that, once set to listen on $PUBLIC_IP:443</code>, can forward many protocols to
their respective interfaces.</p>
Here is how I call SSLH. You can of course set it in /etc/default/sslh</em> and run
it as a daemon.</p>
sslh</span> --user</span> sslh</span> --listen</span> 12.123.123.132:443</span> --ssh</span> 127.0.0.1:22</span> --ssl</span> 127.0.0.1:443</span> --openvpn</span> 127.0.0.1:1194</span></span></code></pre>
That way, I have SSH, HTTPS, and even OpenVPN that can pass through port 443,
and that's very useful when you work behind weird restrictive proxies!</p>
Bonus</strong>: that works in both sides, so when you have server in a DMZ where, for
security reasons</em>, the network admin blocked SSH port, but allowed, say, HTTPS
for example, you can have a direct secure shell without any weird reverse tunnel
with SSLH.</p>


Discovering Gogs
2015-06-11T00:00:00+00:00
I just discovered Gogs</a>, a light Git web fronted written in
Go. After reading a bit on its website, I decided to try a bit, just for fun. It
was really</em> easy to install it with NginX as reverse proxy, everything is Gogs'
documentation, and it was ready in less than 10 minutes. Wonderful!</p>
It's still in beta, but already very functional, providing most of the classic
features such as issues, milestones, ssh keys, README.md</em> parser, etc...</p>
Finally, I just dropped my old Gitweb1</a></sup>, and I welcome you to my new Gogs</a>! :)</p>
^1</sup>even if you can still reach it though http</em></a></p>
</div>


24h in the airport
2015-04-27T00:00:00+00:00
Being in holidays for two days, I had last month bought my tickets to go to
Nothern Ireland with a friend. We arrived at the airport at least half an hour
before the time that was written in the email we received, but when asking for
the boarding pass, we were refused because it was apparently too late... I never
really travelled by plane in a big airport, so I didn't know that we should have
arrived at least one hour earlier to get the flight.</p>
We managed to change the ticket for the following day (today!) but we had to
wait for the 24h in the airport, without anything but my small travelling bag
and my laptop...</p>
This resulted in some useless things</a>, but
also some more useful r2 commits</a>. This was anyway really
tiresome, noisy, and boring to death, and I wish it won't happen again (for the
comeback trip, for example :D)</p>


A new motherboard for my X60
2015-04-21T00:00:00+00:00
A few weeks ago, I was playing putting water on my thinkpad, because it can
normally handle it, and mostly because a friend of mine didn't believed it. The
water went as usual through the laptop, but this time, I think I put a little
too much, and I broke the battery loading circuits.</p>
The result was a perfectly working motherboard, but the battery was not able to
charge. That was a little embarrassing, and I decided to completely take the
laptop apart to see 1)</code> if I could see something strange around the battery, and
2)</code> how the laptop was built exactly.</p>
1)</code> showed nothing, but even better, it bricked the board... Watching
libreboot</a>'s output did not really helped, because I'm
not a coreboot dev, and because it worked until a moment where it just stopped,
without error... Hard to debug...</p>
Still, I really needed that laptop, because during that period, I had dug my old
X31 up, but this one was a bit too slow, so I bought on Ebay a second-hand
motherboard for only 9€!</p>
Putting it into the X60 went pretty good (I love how the thinkpad is done,
btw!), but I faced a strange matter: the Lenovo bios couldn't boot with my
Atheros Wifi card. Anyway, this was only one more good reason the flash
libreboot, because it worked very good on the old motherboard, and I wanted to
do it myself at least once (first time, I bought the laptop from
Gluglug</a> and it came preflashed).</p>
This went very well thanks to libreboot's
tutorial</a> and
I was now able to use my laptop with a very new and state-of-the-art software
for an even better hardware!</p>


Strange high ping
2015-04-20T00:00:00+00:00
Currently rebuilding my student association's infrastructure, I have to deal
with Proxmox 3.4 quit a lot. Having up to 5 VM, I decided to first install one,
called generic</strong>, that I would backup, then restore 5 times to get all my VM
with a basic configuration without efforts.</p>
That worked perfectly a first time, and I have been able to deploy our
Gitlab</a> quit quickly.</p>
Then I wanted to work on our proxy</strong> VM, so I restored the generic image, and
logged into the VM with the console interface to change at least its name and
IP. After that, I was able to ssh to the machine, but I remarked that when
typing a command, it was really slow to answer.</p>
Some quick ping based investigations told me that there were many lost packages,
and the average ping was up to half a second! Of course, everything was in a
local network, and pinging the Proxmox host was pretty normal, just as the first
Gitlab VM. Why was that second machine causing so much trouble?</p>
The answer was very dummy: restoring an image restores really everything, and
even the MAC address! Changing that address fixed the problem, but that story
reminds me how shitty I am with networks! :D</p>


Using WinZip
2015-04-10T00:00:00+00:00
This morning, I decided to begin my AI course project, so I went to my
professor's library's website</a> to download it
and see how it worked.</p>
So I had now two zip files, that I tried to unzip without success. Unzip</em> says
End-of-central-directory signature not found.</code>, and 7z</em> says Unsupported Method</code> for every non directory file... Weird...</p>
Okay, no problem, the binaries are only for W$, so the zip must have been done
with WinZip, or some other strange archieving tool. I was at school, so I had a
few time to try using Wine and WinZip on my X31. Great idea!</p>
Wine went without problem, but I gave up when I faced the following error:</p>
</p>
I really thank you, WinZip, for giving me so much fun this morning! :)</p>


Sauvetage d'un serveur
2015-01-30T00:00:00+00:00
Un petit déterrage pour ce premier post de 2015. Il s'agit là simplement d'un
article que j'avais rédigé dans un wiki, et qui est resté depuis le seul article
du dit wiki. Plutôt donc de le laisser moisir, je le ressors ici, où il aura un
peu plus sa place... :)</p>
#Récupération d'un serveur perdu</p>
Le problème</h2>
Au cours de manipulation visants à augmenter la sécurité du serveur, j'ai
malheureusement un peu trop joué avec les droits, ce qui fait qu'en essayant de
se connecter via ssh, celui-ci, après avoir afficher les quelques lignes de
bienvenue et au moment de lancer le shell:</p>
/bin/zsh: permission denied</span></span>
connection to pike.tf closed</span></span></code></pre>
Plutôt problématique, n'est-ce pas?</p>
La solution</h2>
Comme tout problème a une solution, il fallait donc la trouver. Fort
heureusement, on pouvait toujours envoyer des fichiers par FTP dans le dossier
root d'apache, donc on pouvait uploader un script PHP qui nous sauverait la vie.</p>
J'ai testé quelques script codés moi même, mais finalement, j'ai plutôt utilisé
un reverse shell, bien plus pratique pour tester différentes commandes. Le
script est dispo ici :
http://pentestmonkey.net/tools/web-shells/php-reverse-shell</a>. Tout y est très
bien expliqué et l'on obtient rapidement un pseudo shell sur notre machine
locale.</p>
Un autre problème se posait alors à moi: il fallait que j'execute une commande
avec les droits root pour chmoder les fichiers de zsh. Pour cela, deux options:
su</code> et sudo</code>. Mais en faisant su</code>, la commande nous répond</p>
su: must be run from a terminal</span></span></code></pre>
Pour sudo</code>, le problème est différent. La commande fonctionnait tout à fait,
sauf que le script qui l'execute est lancé par www-data, l'user d'apache, et
celui-ci n'est pas dans le sudoers, donc il ne peut rien faire.</p>
J'ai donc trouvé une nouvelle astuce sur cette page : http://evertpot.com/189/</a>,
qui donne deux lignes à rentrer dans notre pseudo shell pour executer un "vrai"
shell via python. Bien sûr, il faut que Python soit installé sur le serveur, ce
qui était notre cas. La première ligne créer un script placé dans /tmp</code>, et la
deuxième l'execute, nous donnant un shell dans lequel on peut ensuite executer
su</code> sans aucun problème.</p>
En résumé</h2>

Uploader la page de script du reverse-shell une fois modifiée, comme
indiquée sur le site, en spécifiant l'adresse IP de la machine
local sur laquelle vous obtiendrez le pseudo shell, ainsi qu'un
port disponible sur lequel vous allez pouvoir faire écouter votre
machine. Attention, si vous êtes derrière une box, penser à
forwarder le port!</li>
Lancer la commande nc</code> avec les options qui vont bien sur votre
machine pour qu'elle soit prête à écouter sur le port, par exemple
avec le port 1234:nc -v -n -l -p 1234</span></span></code></pre></li>
Lancer le script en accédant à son URL dans votre naviguateur, votre
pseudo-shell est alors disponible là où vous aviez lancé netcat</li>
Executer les deux commande Python pour avoir ensuite un vrai shell
et pouvoir lancer su</code>echo "import pty;</span></span>
pty.spawn('/bin/bash')" > /tmp/asdf.py</span></span>
python /tmp/asdf.py</span></span></code></pre></li>
</ul>
Voilà, vous pouvez désormais récupérer votre serveur!</p>
Merci à Dustri</a> pour les nombreuses indications
fournies pendant la récupération! :)</p>


Putting HTTPS in place
2015-01-30T00:00:00+00:00
For a few time I have set up this blog, and I always said that I should put SSL
in place, to provide secure connection for most of the hosted services.</p>
Now it's done!</p>
Certification was made by CACert</a>, and this went
pretty quick, thanks to a few Nginx tutorials</a>,
and the CACert presentation by S. Bortzmeyer</a> (in French).</p>
That wasn't so hard, after all, and I still wonder why it took me so
much time... :/</p>
Memo:</p>
openssl req -new -days 365 -nodes -newkey rsa:2048 -keyout hya.sk.key -out hya.sk.csr</span></span></code></pre>


The RSoC is finished
2014-11-26T00:00:00+00:00
That's sad, I know, but the RSoC is now finished since 2 months and I haven't
post for even longer! :/</p>
I have done quit a few commits this summer, and that was really nice to
implement new features in a project such as radare2</a>!
Still, I have some regrets not to have had enough time for the RSoC... I had no
time to implement all the task I was given, and I even still have some that I
hope to do in the next few weeks.</p>
And this year, having a lot of responsibilities in my school's associations, and
having a few school projects, I find even less time than this summer, so I don't
think I'll be able to contribute a lot as I expected.</p>
Now stop complaining about my free time and let's do a quick summary of what
I've done. The task was about structure templates, so the goal is to define a
human readable structure, a bit like a C header for example, and to apply it on
a binary to see each field easily. The method with header file is quickly
described here</a>, and I think I'll do a more
complete example one day.</p>
But my work was more focused on one r2 feature related to structures: pf</code>. That
is the basic command for which you can have a quick help on r2 by hitting pf?</code>.</p>
The command works as follow:</p>
pf iwf foo bar troll</span></span></code></pre>
Applies the iwf</code> format at current offset. The iwf</code> format is an
integer named foo</strong>, a word called bar</strong>, and a float, troll</strong>.

This gives the following output:</p>
[0x00000000]> pf iwf foo bar troll</span></span>
  foo : 0x00000000 = 1179403647</span></span>
  bar : 0x00000004 = 0x0101</span></span>
troll : 0x00000006 = 1.000000</span></span></code></pre>
More fields type can be easily found in the pf</code> help.</p>
Moreover, pf</code> supports some nice tricks like pointers by using *</code> or arrays
using []</code>...

eg:</p>
pf *i[2]w pointer_to_int array_of_words</span></span></code></pre>
The next point is to store a format by entering following command:</p>
pf.name iwf foo bar meh</span></span></code></pre>
We can now apply the format with pf.name</code>. But the thing is that we can now use
the stored format as a structure in a new format using ?</code>.

eg:</p>
[0x00000000]> pf.meh iw int word</span></span>
[0x00000000]> pf.boh i?w otherint (meh)plop otherword</span></span>
[0x00000000]> pf.boh</span></span>
 otherint : 0x00000000 = 1179403647</span></span>
     plop : struct<meh></span></span>
       int : 0x00000004 = 65793</span></span>
      word : 0x00000008 = 0x0000</span></span>
otherword : 0x0000000a = 0x0000</span></span></code></pre>
That way, you can define linked lists for example, to apply on memory
dumps, or create nested structures for complex templates.</p>
Other features are the JSON output, with pfj</code>, or the already done templates
such as the elf32 header that you can easily load with pfo elf32</code>.</p>
On last thing is the writing mode (not fully supported for arrays and nested
structs, which are my remaining tasks) that you can use that way.

You define a format:</p>
pf.name iwf foo bar meh</span></span></code></pre>
And then you can modify its field with:</p>
pf.name.bar=0xfa0</span></span></code></pre>
That prints the command you should have to type to write 0xfa0 at the
right offset, and a bit of r2 shell makes life easy (see the dot before
the command, to execute the output of it as if entered in r2):</p>
[0x00000000]> pf.name</span></span>
foo : 0x00000000 = 0</span></span>
bar : 0x00000004 = 0x0000</span></span>
meh : 0x00000006 = 0.000000</span></span>
[0x00000000]> .pf.name.bar=0xfa0</span></span>
[0x00000000]> pf.name</span></span>
foo : 0x00000000 = 0</span></span>
bar : 0x00000004 = 0x0fa0</span></span>
meh : 0x00000006 = 0.000000</span></span></code></pre>
There are still some features in pf</code>, but I think you now have a good overview
of what pf</code> can do, and so what I've done during my RSoC.</p>
To sum up, that was a great wonderful experience, and I've learned a lot of
various interesting things. I hope to finish the last tasks soon, and after
that, pf</code> will really be a powerful tool to dump nice elf headers, or
analyse strange corrupted PNG files! :)</p>
Finally, I really thank my mentors pancake</a>,
xvilka</a>, and jvoisin</a> for
helping me doing the task, and for organizing the RSoC in general. I also thank
maijin</a> for having done a lot of tests in pf</code>
and for reporting a lot of unexpected features, and I also thank all the r2
community for being nice on the IRC chan, and for supporting such a great
project!</p>


Open Laptop
2014-07-13T00:00:00+00:00
First, let me introduce my laptop: it's a Thinkpad X60, he's called
Kiffu</a> and was bought ~6 months ago from
Gluglug</a>, and as the FSF</a>
said, it's an open-laptop, and that means that it runs without any proprietary
software, nor any blob, not even the CPU microcode!</p>
Yesterday, I decided to clean my keyboard, and for that,
Maat</a> and I had no better idea than putting it under the
tap! Of course it was powered off, but I put a bit too much of water, and
everything didn't go though it. It was now a bit wet, and I decided to wait for
the full night before pluging and running it again... But the whole night wasn't
enough, and when I ran it, it worked for five minutes, and then I got some
strange things on the screen, before it self rebooted, then reboot again, and
behaved very oddly... I shut it down, removed the battery, unpluged, and decided
to dry it really</strong>. I opened it completely, removed the SSD, the keyboard, and
even the upper body! Drying and waiting for a bit, I then decided to try to run
it, but I was too lazy to rebuild it, and then redry if it still didn't worked,
so I run it completly opened!</p>
Everything went well, and I even took a few pictures with the webcam, without
any problems:  
 </p>
Finally, I just rebuilt the laptop and wrote this article, because I just found
that fun and wanted to share the pictures... ;)</p>


Clearing my mind about my task
2014-07-10T00:00:00+00:00
Clearing my mind about my task</h1>
After receiving XVilka's mail, asking for our status about the RSoC, I was asked
to join the #radare-rsoc</code> channel, a very smaller chan much more adapted to the
student of the RSoC. If I say that, it's because despite everybody says "feel
free to..." on the main chan, I really felt outnumbered by so many people
talking about such advanced things, and honestly, I didn't dare to ask even a
small question... Stupid life.... :)</p>
Anyway, after joining the RSoC chan, I explained what I had already done, and I
was answered that many things were already done! In fact, the biggest part was
mainly done, and for now, the priority was to write tests for the pf</code> command,
the one that make use of a kind of template (my task)...</p>
I quickly went to the test directory, forked the
radare2-regressions</a> repo on my
Github, and began to learn how pf</code> worked, in order to test it in the test
suite. Two hours or three later, my commits were merged, and I even discovered
my first bug in r2, as pancake said when I wondered about the result of a
command...</p>
Next step now is to fix the bugs in pf</code>, then to improve it to support nested
types, and then, we'll see...</p>


First step in the RSoC
2014-06-26T00:00:00+00:00
First step in the RSoC</h1>
A friend</a> of mine motivated me for doing the
Radare Summer of Code</a> a few month ago. I took a
look, and found it very interesting, so I applied, asking to do the
Struct Templates job. I was accepted, and I began to take some interest
to the project. I did a very few commit here and there, trying to
understand how the project worked, how it was organized, and also
learning how to use the different tools, like GitHub that I had never
really known before.</p>
The start was given last week, but having a
project</a> to finish for the
school, I had no time to take it... Now that the project is done, I'll
have more time to spend on r2, and it's what I've done tonight: I
looked precisely at some file, trying to understand how the thing was
done, and beginning to think what I'll have to do to complete the task.</p>
I really feel happy that the school project was a compiler and not some
other shit, because reading a C parser is now far easier than it would
have been otherwise! As we could say in Molière's tongue: C'est en
forgeant que l'on devient forgeron</em> (Smithing makes the smith</em>, or
more likely Practice makes perfect</em>) and as we all know, that's really
true for programming!</p>
Concerning that blog, I'll try to post for every step I'll complete,
in order to keep something about my first commitment in a free project!
And if you want to contribute to r2, you can find a list of idea
there</a> and join us on
freenode#radare</code>!</p>


A very new blog
2014-06-20T00:00:00+00:00
Hi there!</p>
I'm proud to announce to the world that I'm at least opening a blog.
The purpose isn't to tell you everything about my super life, but to
provide information about interesting (or not) stuff I've done...</p>
Feel free to contact me if you think you have to!</p>
-- Skia --</p>

Unmaintained space

Notes on blocking AI scrappers

The mitigations</h1>

Setting ACLs on a self-hosted Mumble server

Some Firefox and Thunderbird about:config keys

Helios64 - Part 3 - Hardware and software upgrade

Setting constraints on a process

2to3 in Python 3.13

Defeating Metal: Hellsinger

Notes on CD ripping with `whipper`

In praise of 'Thrawn' and 'Thrawn Ascendancy'

Engineering and Martial Arts

There are more... for another time</h2> We could probably find more very good examples, but at this point, I'll just get some well deserved sleep in the bus on the way home!</p>

Atelier d'écriture : micro-nouvelles

Productions autonomes</h2> La suite était simple, produire trois micros-nouvelles en s'inspirant des différentes œuvres exposées.</p>

Renewing my GPG key to fix an old youth error

Set a Thinkpad's trackpoint sensitivity on `sway`

The quest to save a lost `apt full-upgrade`

Le stockage des armes

`inxi`: fetch a machine's detailed information

Completing Horizon Zero Dawn

Global push-to-talk on `sway`

A `label`-free `traefik` reverse-proxy

Reviving an old hammer

Hellfest 2022

Configure syslog-ng with TLS

Store your TOTP seeds on a Yubikey

Preventing shared disk accidents with libvirt

A new Debian release may break your CI

Troubleshooting a motherboard with an Arduino

My 2021 home workstation

Hardware:</h1>

Machines</h2> Towers</h3> My personal machine is a big tower, running the following:</p>

Towers</h3> My personal machine is a big tower, running the following:</p>

Outputs</h2> Display</h3> Some random old 27" ASUS monitor</li>

Display</h3> Some random old 27" ASUS monitor</li>

Au revoir Lionel

Helios64 - Part 2 - Software

Run a seedbox through a VPN, easily

Helios64 - Part 1 - Hardware

Reviewable drafts with Hugo

How I built and designed my home-made joystick (prototype part)

Enjoying Tool live

Boardgame review: Outlive & Captain Sonar

First workshop at the Grehack

Reviewing the Touch Lux 3, by Pocketbook

Quitting mailoo

The Force has awoken...

SSLH, ssh&co though Proxies

Discovering Gogs

24h in the airport

A new motherboard for my X60

Strange high ping

Using WinZip

Sauvetage d'un serveur

Le problème</h2> Au cours de manipulation visants à augmenter la sécurité du serveur, j'ai malheureusement un peu trop joué avec les droits, ce qui fait qu'en essayant de se connecter via ssh, celui-ci, après avoir afficher les quelques lignes de bienvenue et au moment de lancer le shell:</p>

La solution</h2> Comme tout problème a une solution, il fallait donc la trouver. Fort heureusement, on pouvait toujours envoyer des fichiers par FTP dans le dossier root d'apache, donc on pouvait uploader un script PHP qui nous sauverait la vie.</p>

Putting HTTPS in place

The RSoC is finished

Open Laptop

Clearing my mind about my task

First step in the RSoC

A very new blog

There are more... for another time</h2>
We could probably find more very good examples, but at this point, I'll just get some well deserved sleep in the bus on the way home!</p>

Productions autonomes</h2>
La suite était simple, produire trois micros-nouvelles en s'inspirant des différentes œuvres exposées.</p>