Posts

I got the idea for this post when I noticed a couple of issues on the site of one of the resistance groups operating in ruzzia (credit where it’s due: they fixed them fast, and I will not name them). This little guide could be useful for opposition media too.

If you’re making something that is frowned upon by your local Authoritarianism™ franchise, you have a moral obligation to protect not only your cell | group | band | merry wagon, but your visitors too.

Maybe even them first, because, not unlike you, they are not prepared and not vigilant enough.

Some dictatorships will prosecute them for the visit itself; others will use finesse and make an “aggravating circumstance” out of it when they bake another “high treason” case.

You can slap Cloudflare over your site and give yourself a gold star for security, but that’s only the beginning of your saboteur journey. Continue reading… How to sing to caged birds

PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet.

In short, if you didn't update your PHP on the 21st, you're in danger.

You can check if you're vulnerable via a self-hosted script or the Brandefense ATLAS checker.

Other light reading in attached links.

Personal Experience

I had only one vulnerable service: Matomo Analytics (and Matomo's reaction to most of their users getting screwed is quite underwhelming). Custom image on a custom PHP distribution.

And even though it's a sad day for the internet, I am quite amused by my OCD paying off: Continue reading… Another PHPocalypse

I promised myself to not joke about how ignorefiles were ignored by linters.

Details at the project page

Made my own reseed server for I2P.

I2P is a peer-to-peer network which uses “Garlic Routing” to maintain privacy. Reseed nodes help you get connected to I2P for the first time, and even though you should only have to use them once in a great while, they are very important services.

I have my own distribution/image that automates some fuss with installation.

Feeling like a very niche Atlas.

It works in theory, but we will have the first real life test in around January. It's not the Bulleting Of Hardworking Atomic Scientists, you know. Don't wire your household turrets to it yet.

More on project page.

We’ve all seen the blue-and-yellow #StandWithUkraine ribbons on various sites. While they look nice, I wanted something more actionable.

I created a small script that displays links to random relevant charities based on the visitor's language, pointing to localized versions whenever available. It also tracks seen charities so visitors never see the same one twice (off by default, yay to GDPR). Highly tuneable.

I like projects with a small scope and a single primary metric (CTR in this case), every feature or fix feels more impactful and challenging.

More details on the project page, or check out the demo live on this site.

Released a fork of todogroup/repolinter. Migrated it to TypeScript, updated the tests and dependencies, and cleaned up the workflows. Majority of the issues of the original were fixed.

My first experience with such necromancy. I'm sure there are good reasons they dropped it, but it costs little to maintain, and I think the "facts/rules" scheme is actually very neat.

Details on the project page.

I try to support RISC-V everywhere I can, and you should too.

Chances are (around 60%, actually) that you live in a country without an independent CPU/MCU industry. The consequences of the russian invasion in 2022 showed us that you can't really stop high-tech imports into a country that went batshit crazy, but you can make chips somewhat harder to get.

I obviously don't have a problem with sanctions against the axis of evil. But one of these days, some orange clown (or clowns of any color) could decide that Uruguay, Chile, or New Zealand are as bad as North Korea or Iran—because they are too friendly to China, too gay, or something like that. And your country could be next.

One Jacob Feldgoise already whines about RISC-V hindering good old world policing.

RISC-V is not the simplest, but it is the most logical way to get closer to an "Uruguayan Xeon" or a "Nigerian STM32." And it doesn't have to be an entirely national project: regional alliances could help lower costs and achieve scale faster. Getting an ARM license is probably easier, but it's another compliance leash from a country that loves exiting things without thinking them through.

Without a stable supply of chips, you will have issues with everything from ATMs to train networks. It won't be immediate—modern silicon is quite durable—but things will break down and require replacement. If you don't have the benefit of a "death cult of living in squalor and constantly overcoming unnecessary self-imposed problems" in your population (like Russia has), it will become an issue very fast. An issue that both internal and external malevolent actors will exploit. Be less gay, have a chip.

Sovereign RISC-V production is something that feels unnecessary, expensive, and alarmist now. But when it becomes "today's problem," it will be too late.

And even if you have 30+ CPU suppliers, you can still be enough of an asshole that all of them refuse to sell to you (though things won't change much for the real bad actors).

What Can You Do About It?

Continue reading… Why You Should Care About RISC-V

Inspired by Armin Ronacher's AI Transparency Statement

I use coding agents every day, but never use LLMs for writing or anything that's meant to be read by humans. I occasionally make a throwaway picture (like an avatar).

I do use them to fix idiotic ESL mistakes I sometimes make. I use … and — via the Compose key in Linux since the 2010s. I have a background in traditional publishing and believe that three dots (...) are not an ellipsis (…) and never will be. Continue reading… AI Stance

There are at least four ways to go about building container images:

• Small distributions, like Alpine
• Cut-down server versions (e.g., debian-slim)
• Whatever tf Ubuntu Chiseled is
• Distroless

I use a fifth one. Continue reading… What is image distillation?