September 30, 2026 • 3 min read
Written up in October 2026. Dates are when I actually built it.
Two days, one weekend project, and a personal rule that it still had to be done properly. Here’s the Capitol Hill Coffee Guide, 42 commits and 233 test cases later.
I wrote a design spec and implementation plan before any code. Sounds slow. It’s why the rest wasn’t.
Treat the Places API like a budget, not a service Shop data comes from Google Places, which bills per call.
Read more →July 8, 2026 • 3 min read
Written up in October 2026. Dates are when I actually built it.
Airline rewards activity isn’t a log, it’s a table that quietly edits itself. Points post late, get adjusted, sometimes vanish. I wanted a ping the moment my own account’s history changed, so I built a watcher: about 900 lines of Python with 60 unit tests. It only ever reads my own account.
Don’t hash the columns, hash the meaning Each activity row gets a SHA-256 over (date, description, amount).
Read more →June 3, 2026 • 2 min read
Written up in October 2026. Dates are when I actually built it.
Reviewing your own code like you’re attacking it is humbling. I did that to my events collector and found a good one.
The bug /admin/send-digest emails every subscriber, and it sat behind HTTP Basic Auth. The check was shaped like this:
1 2 if cfg.basic_auth_user: # verify the Authorization header against configured credentials Read that again. If BASIC_AUTH_USER isn’t set, the whole check is skipped, and the endpoint is open.
Read more →May 17, 2026 • 2 min read
Written up in October 2026. Dates are when I actually built it.
Finding out what’s happening in Seattle means checking about fifty websites. I got tired of that and built a thing to do it for me: Seattle Events Collector. It’s over 4,700 lines of Python before you count the scrapers themselves, and most of the interesting part is figuring out that four websites listing the same show are talking about one show.
Read more →March 22, 2026 • 2 min read
Written up in October 2026. Dates are when I actually built it.
Airline shopping portals love to scream “5X POINTS!!!” at you. Is that a great rate, or just a Tuesday? The portal will never tell you, because it only shows you today. So I built a tracker that remembers. Code’s here.
The data model is the whole project I put everything in Cloudflare D1 (SQLite) and spent most of my time on the schema, because the questions I wanted to answer (“is this an all-time high?
Read more →October 28, 2024 • 6 min read
A declaration of principles for the 21st century hacker - builder, breaker, and defender of digital freedom.
Preamble We are the architects of tomorrow, the explorers of the digital frontier. We write code not just for function, but for freedom. We break systems not out of malice, but to understand and improve them. We are hackers, and this is our manifesto.
I. The Nature of Hacking Hacking is curiosity manifested in action.
Read more →August 5, 2024 • 8 min read
I recently picked up a Yubico YubiKey 5C NFC, a small yet powerful security key that adds an extra layer of protection to my logins. This versatile device supports various security protocols, including FIDO2, U2F, OTP (One-Time Password), and smart card (PIV). Major tech companies like AWS, GitHub, Twitter, Google, Microsoft, and Apple all support security keys for their login processes, highlighting their importance in modern cybersecurity.
One of the standout features of the YubiKey is its adherence to open standards, making it easy to integrate with various products and services.
Read more →July 19, 2024 • 8 min read
About a week ago, I pushed a script to my GitHub that would monitor the Regal Cinemas website for new movies and report it to a Telegram bot. It was decently feature-rich, but I still wasn’t fully satisfied with it. The primary issue I kept noticing was that the bot would properly fire off an alert whenever a new movie was posted to the website, but oftentimes tickets couldn’t be acquired yet because showtimes are updated separately.
Read more →July 17, 2024 • 10 min read
I still have every single hard drive I’ve ever used in every computer and laptop I have ever owned. I’ve always been a bit paranoid of doing anything with them, so for the past decade or so I’ve had a shoe box overflowing with all manner of disks rotting in my closet. However, a friend is spilling up a file server, and I’d want to donate some disks to them to get them started.
Read more →March 13, 2024 • 14 min read
Red Star OS (붉은별 사용자 영체계) is a North Korean operating system based on the Linux kernel. Its development began at the Korean Computer Center in 2002; until that time, English-language versions of Windows were commonly used in North Korea. As of 2018, the latest version of the system is Red Star OS 4.0, it is reported that the fourth version exists and is being tested locally, but at the moment most people in North Korea are still on the third version.
Read more →March 11, 2024 • 8 min read
In computing, firmware is a specific class of computer software that provides the low-level control for a device’s specific hardware. Firmware, such as the BIOS of a personal computer, may contain basic functions of a device, and may provide hardware abstraction services to higher-level software such as operating systems. For less complex devices, firmware may act as the device’s complete operating system, performing all control, monitoring and data manipulation functions. Typical examples of devices containing firmware are embedded systems (running embedded software), home and personal-use appliances, computers, and computer peripherals.
Read more →March 5, 2024 • 6 min read
This is not an article about which web browser is the best (there is no such thing) but an article about which browser has the most connections after a fresh install. The results shouldn’t be a surprise, really.
Of course, not everything is telemetry per se, some of the connections are from the ‘New Tab’ pages that include Youtube videos but I strongly believe that is the same thing: the software leaks information about you and/or your computer without you actually accepting the data exchange (because you don’t have a way to accept or deny the connection since it’s the first time you’re running the browser).
Read more →February 27, 2024 • 3 min read
Sometimes I need to spin a Docker container really quick so I can test stuff locally and the quickest way (for me) is to keep a project template somewhere on the disk so I can quickly copy it, add the web app and test it. Ofc there are other alternatives. Ofc some are better. Ofc some are faster. But this one is mine.
The container will be configured with:
latest Apache web server with SSL and mod_rewrite.
Read more →February 15, 2024 • 2 min read
An OpenPGP Web Key Directory is a method for users to discover the public key of a new contact. The user requests the public key from the contacts an organisation maintains.
Compared to previous key discovery schemes that relied on DNS, WKD can be easily deployed on any HTTPS server because WKD is a lookup scheme that relies on HTTPS and correctly placed files on your web server and no other software is required to run on the web server.
Read more →February 8, 2024 • 2 min read
Introduction Here is a small tutorial on encrypting a Microsoft Azure virtual machine disk.
Preparing the Azure Virtual Machine Enable the Azure Key Vault provider within your Azure subscription.
$ az provider register -n Microsoft.KeyVault Create a resource group in your favorite location (keep in mind different locations enable different features, some VM sizes are not available in other locations).
$ az group create \ --name testResourceGroup \ --location centralus Create an Azure Key Vault and enable the Key Vault for use with disk encryption.
Read more →February 2, 2024 • 1 min read
Step 1: install required tools 1 2 3 4 $ sudo apt install adb apktool openjdk-11-jdk-headless zipalign apksigner # replace apktool with new version from https://github.com/iBotPeaches/Apktool/releases $ sudo mv /usr/share/apktool/apktool.jar /usr/share/apktool/apktool.jar.original $ sudo mv ~/Downloads/apktool_2.7.0.jar /usr/share/apktool/apktool.jar Step 2: retrieve the APK file 1 2 3 4 5 6 # start by finding the name of the app $ adb shell pm list packages | grep <APP_NAME> # find path of the app $ adb shell pm path <APP> # and pull the APK file $ adb pull <PATH> .
Read more →January 30, 2024 • 4 min read
I decided to make a log of all network connections a standard install of Windows 11 Pro (for ARM, 22H2, OS build 22621.1344) does.
The methodology is the same, standard setup without changing any of the default settings (Privacy ones, for example). Test device is on a clean user profile, all network connections blocked, application-level network connection whitelisting and only Little Snitch installed. So it’s actually Little Snitch that does all the heavy-lifting.
Read more →January 29, 2024 • 2 min read
NetworkManager is a program for providing detection and configuration for systems to automatically connect to networks. NetworkManager’s functionality can be useful for both wireless and wired networks, for wireless networks, NetworkManager prefers known wireless networks and has the ability to switch to the most reliable network.
If you want to reduce someone’s capabilities to track you, you should avoid broadcasting a persistent and likely unique software identifier; an empty (blank) hostname is also an option, but a static hostname of “localhost” is less likely to cause problems.
Read more →January 26, 2024 • 2 min read
LUKS can be used to encrypt a volume that’s stored inside a single file.
Start by creating a 2GB file (1M * 2k) that will hold the LUKS volume and fill it with random bytes. If you’re wondering why the strange filename, Solaris.1971.1080p.BluRay.x264-[YTS.AM].mp4.part, that’s so it is “hidden” as a temporary Transmission torrent file, away from prying eyes (unless your threat model is the NSA). If you want to use a qBittorrent temporary extension, change .
Read more →January 24, 2024 • 3 min read
If you work in security or you like to pretend you work in security, you must’ve heard about BusKill. Every infosec has one of those because it’s so cool pretending to be a 133t hacker and their threat model definitely requires an immediate shutdown of the computer, else the nefarious actors (APT21, APT22, APTsqrt(69)) will retrieve their bloated python scripts. And nobody want to lose their scripts.
But just in case you think it might be interesting to have a way to shut down (and lock, if it’s encrypted) your laptop in case somebody snatches it from your hands, keep reading because I have a solution that doesn’t involve paying those BusKill people your hard-earned pennies.
Read more →January 18, 2024 • 1 min read
A lot has been written about AI being the death of art, as so many artists have had their work fed into AI models without compensation, but I feel the conversation has neglected to mention how much free labor al of us are doing for AI companies simply by generating our own content online. OpenAI is generous enough to provide us mortal AI-feeders with IP ranges for the GPTbot, so make sure you add them to your firewall rules.
Read more →January 15, 2024 • 2 min read
You can set-up a VPN killswitch, which is a simple way to ensure that if your VPN connection is dropped, regardless of the reason, the Internet connections are not allowed (and your real IP will not be exposed). And this can be done easily using ufw on any Debian-based distro.
Start by installing ufw if it’s not already installed on your system:
1 $ sudo apt install ufw Configure ufw to deny all incoming and outgoing connections:
Read more →January 12, 2024 • 2 min read
The USBGuard software framework helps to protect your computer against rogue USB devices (a.k.a. BadUSB) by implementing basic whitelisting and blacklisting capabilities based on device attributes.
Basically, USBGuard prevents all unauthorized USB devices from connecting to your machine.
Start by installing it, if you’re running Ubuntu, Debian or other Debian-based distros:
1 $ sudo apt install usbguard Or, if you’re running Fedora:
1 $ sudo dnf install usbguard Make sure all USB devices that you want to be allowed by default to connect to your system are plugged in (don’t worry about the built-in USB devices, like your laptop webcam or Bluetooth module, they get whitelisted automatically), and generate the default policy:
Read more →January 5, 2024 • 4 min read
Warning Do not play with the samples unless you really know what you’re doing. All Windows versions before Windows 10 are still vulnerable to the WannaCry (WannaCrypt, WannaCry, WanaCrypt0r, WCrypt or WCRY) ransomware if not patched for MS-17-010.
The ransom is between $300 to $600, there is code to delete files in the virus, so it’s not just a threat.
The worm loops through every RDP session on a system to run the ransomware as that user, also installs the DOUBLEPULSAR backdoor and it corrupts shadow volumes to make recovery harder.
Read more →