Michifumi's Blog

Bypass E5 OneDrive 10GB Limit: Mount SharePoint

Mon, 21 Sep 2026 00:00:00 GMT

Bypass Microsoft 365 Developer E5 10GB OneDrive limits and macOS sync bugs using a dual-mount SharePoint setup with Rclone and FUSE-T.

SharePoint Storage

This guide resolves the 10GB personal OneDrive quota limitation on Microsoft 365 Developer E5 subscriptions by leveraging the 1.24TB tenant-wide SharePoint storage pool with a Dual-Mount Architecture:

~/SharePoint (Raw Mount): Dedicated to large video files and general media. Files remain unencrypted in the cloud so you can stream or download them anywhere (SharePoint web portal, OneDrive mobile app, Infuse or VLC on Apple TV) without requiring Rclone or decryption keys.
~/SharePointVault (Encrypted Overlay Mount): Dedicated to sensitive records, personal documents, and private backups. Uses client-side zero-knowledge encryption via Rclone Crypt to protect data from cloud inspection and eliminate SharePoint metadata alteration loops.

It completely bypasses native macOS OneDrive client issues, such as fileproviderd circular deadlocks and 0% progress freezes, delivering native virtual drives with automated space reclamation (on-demand caching) and transparent on-the-fly decryption.

0. Create a Communication Site in SharePoint

Before installing tools and configuring Rclone, you must create a dedicated Communication site in your Microsoft 365 tenant to host your files.

Why a Communication Site is Essential

Microsoft SharePoint treats Team sites and Communication sites fundamentally differently when it comes to document versioning:

Team Sites (Do Not Use): Team sites are tied to Microsoft 365 Groups and Microsoft Teams. Microsoft mandates document version history on Team sites, enforcing a strict minimum of 100 to 500 major versions that cannot be disabled. If you store large files (such as 20GB–50GB video files, disk images, or encrypted vault chunks) in a Team site, any minor file modification or re-upload causes SharePoint to duplicate the entire multi-gigabyte payload into version history, silently exhausting your 1.24TB tenant storage pool within days.
Communication Sites (Essential): Only standalone Communication sites allow administrators to set Document Version History to “No versioning” in the classic library settings. Disabling versioning ensures that overwriting or modifying a file consumes exactly the size of the current file with zero hidden storage bloat.

Creating the Site

Sign in to your Microsoft 365 portal and navigate to SharePoint (https://<tenant>.sharepoint.com/_layouts/15/sharepoint.aspx/build).
Click Site in the top navigation bar.
Select Communication site (do not choose Team site).
Choose the Blank template, enter a site name (such as Storage or Drive), and finish the creation wizard.
In Section 2, select this newly created Communication site when Rclone prompts you to bind your SharePoint remote.

IMPORTANT

Once your Communication site is created, make sure to disable version history on its default document library before uploading large files. Follow the step-by-step instructions in Preventing SharePoint Version Bloat (Critical) in Section 5.

1. Prerequisites and Installation

Mounting a cloud drive as a local filesystem on macOS requires MacPorts (to install Rclone with mount capabilities) and FUSE-T (which provides a user-space FUSE implementation without requiring macOS kernel extensions or lowering system security settings).

Step 1: Install MacPorts

If you do not already have MacPorts installed on your Mac:

Install the Xcode Command Line Tools:
```
xcode-select --install
```
Download and run the official package installer matching your macOS version from the MacPorts Installation Guide.
Open a new Terminal window and verify that the port command is available:
```
port version
```

Step 2: Install FUSE-T

Mounting a cloud drive as a local filesystem via Rclone on macOS requires a FUSE framework. FUSE-T is recommended because it runs purely in user space and eliminates the need to reboot into Recovery Mode or lower system security settings:

Visit the FUSE-T GitHub Releases page.
Download and run the latest fuse-t-macos-installer-x.x.x.pkg installer.

Step 3: Install Rclone with Mount Support via MacPorts

The default rclone port in MacPorts does not include mount capabilities. Install it with the +mount variant:

sudo port selfupdate
sudo port install rclone +mount

WARNING

Do Not Install Rclone via Homebrew for Mounting: Homebrew’s rclone formula explicitly disables the FUSE mount subcommand on macOS. Running rclone mount with a Homebrew build terminates immediately with CRITICAL: Fatal error: failed to mount FUSE fs: rclone mount is not supported on MacOS when rclone is installed via Homebrew. Always use MacPorts (rclone +mount) or the official standalone binary from rclone.org.

Step 4: Bridge FUSE-T to Rclone (`libfuse.2.dylib` Symlink)

Rclone’s FUSE integration layer on macOS (cgofuse) searches for several candidate library filenames at runtime (libfuse.2.dylib, libosxfuse.2.dylib, and libfuse-t.dylib). While modern Rclone builds include libfuse-t.dylib in their search candidates, creating this symlink ensures universal compatibility across all FUSE utilities and eliminates potential runtime lookup delays:

sudo ln -sf /usr/local/lib/libfuse-t.dylib /usr/local/lib/libfuse.2.dylib

IMPORTANT

Ignore MacPorts’ macfuse.fs Post-Install Recommendation: When compiling rclone +mount, MacPorts pulls its internal macfuse port as a build dependency to satisfy C compilation headers. Upon completion, MacPorts displays a note suggesting:

sudo ln -fsn /opt/local/Library/Filesystems/macfuse.fs /Library/Filesystems/macfuse.fs

Do not run this command. Linking macfuse.fs attempts to load the legacy macFUSE kernel extension (kext), which triggers macOS security alerts on Apple Silicon Macs requiring you to boot into Recovery Mode and lower security to “Reduced Security”. Linking libfuse-t.dylib to libfuse.2.dylib ensures Rclone routes all calls purely through FUSE-T in user space (via FSKit or NFS), leaving your system on Full Security with zero kernel extensions or reboots required.

2. Configure Rclone with SharePoint and Crypt

To ensure total data privacy, prevent SharePoint from corrupting Office files with injected metadata, and eliminate filename character restrictions, we configure a base SharePoint remote and overlay it with Rclone’s native encryption layer (crypt).

Step 1: Authorize the SharePoint Base Remote (`sp`)

Authorize and bind the dedicated SharePoint site using Rclone’s built-in configuration wizard:

Start the wizard:
```
rclone config
```
Configuration Prompts:
- Enter n to create a new remote, and name it sp.
- Storage>: Find Microsoft OneDrive and choose it (handles both OneDrive and SharePoint).
- client_id> / client_secret>: Press Enter to leave blank (uses default application credentials).
- region>: Enter 1 (Microsoft Cloud Global).
- tenant>: Press Enter to leave blank (not needed for interactive personal OAuth).
- Edit advanced config?>: Enter n.
- Use web browser to automatically authenticate?>: Enter y. A browser tab will open automatically. Sign in with your E5 tenant credentials and grant the requested permissions.
Select the Target SharePoint Site:
- Return to the terminal after successful browser authorisation. When prompted for the storage type, enter 2 (SharePoint site).
- Rclone will list all SharePoint sites in your tenant. Enter the corresponding numerical index for the communication site created in Section 0.
- Select the document library by entering the numerical index.
Confirm the Base Remote:
- Review the configuration summary and enter y to confirm.

Step 2: Create the Encrypted Overlay Remote (`sp-crypt`)

Overlay the base SharePoint remote with Rclone’s native client-side encryption:

In the rclone config menu, enter n to create a second remote.
Name the remote sp-crypt.
For Storage>, enter crypt (or select the number for Encrypt/Decrypt a remote).
For remote>, specify the base remote and target storage folder:
```
sp:vault
```
This stores all encrypted blobs inside a dedicated vault folder in your SharePoint document library, leaving the rest of your SharePoint available for regular, unencrypted media files.
For filename_encryption>, enter 1 (Standard) to fully encrypt filenames into randomized alphanumeric strings.
For directory_name_encryption>, enter true (or 1) to encrypt directory names.
For password>, enter g to generate a random password (recommended over a manual password for maximum cryptographic security):
- When prompted for Password strength in bits, enter 128 or 1024.
- Enter y to confirm the generated password, and immediately save it in your password manager.
- (Alternatively, enter y if you prefer to type in your own passphrase).
For password2> (salt), enter g to generate a random salt phrase as well:
- When prompted for bits, enter 128 or 1024.
- Enter y to confirm, and save the salt alongside your password in your password manager.
- (Alternatively, enter y to type a custom salt, or n to skip, though adding a salt is strongly recommended).
Press Enter to skip advanced configuration, review the summary, enter y to save, and enter q to quit the wizard.

CAUTION

Backup Your Password and Salt: Rclone uses standard, zero-knowledge encryption (XSalsa20 + Poly1305). There is no password recovery or reset mechanism. Store both your password and salt safely in a password manager. With these two keys, you can decrypt and access your files on any Mac, Linux, or Windows system.

3. Manual Mount & Connectivity Test (Optional)

Configuring the local Virtual File System (VFS) cache provides seamless on-demand access: files are listed in Finder at their full remote sizes, while local cache files are allocated sparsely so that only read or written byte ranges consume SSD storage. Cached chunks remain available for immediate re-access and are automatically evicted by age (--vfs-cache-max-age 12h) or size limits (--vfs-cache-max-size 50G).

NOTE

This section is intended for manually testing whether the virtual drive mounts and operates correctly. If you prefer to configure Rclone directly as a persistent background service that starts automatically at login, you can verify your mount here and proceed to Section 4.

Step 1: Create the Local Mount Points

mkdir -p ~/SharePoint ~/SharePointVault

Step 2: Execute the Mount Command

Run the following optimised mount command in the foreground to test connectivity and review terminal logs for the unencrypted media mount:

/opt/local/bin/rclone mount sp: ~/SharePoint \
  --vfs-cache-mode full \
  --vfs-cache-max-age 12h \
  --vfs-cache-max-size 50G \
  --vfs-cache-poll-interval 1m \
  --poll-interval 1m \
  --vfs-write-back 5s \
  --onedrive-chunk-size 125M \
  --buffer-size 64M \
  --volname "SharePoint"

To test mounting the encrypted vault instead, substitute sp: with sp-crypt:, ~/SharePoint with ~/SharePointVault, and --volname "SharePoint" with --volname "SharePointVault".

NOTE

Running in the foreground (without --daemon) lets you inspect real-time log output, verify connectivity, and confirm that the filesystem mounts properly. Once you have confirmed that the mount functions as expected, press Ctrl + C in Terminal to cleanly terminate the test run, then proceed to Section 4 to set up persistent background startup for both drives.

Key Parameters Explained

Parameter	Core Behavior & Purpose
`--vfs-cache-mode full`	Enables a comprehensive cache layer. Allows sequential and random access (seeking) on large videos without data corruption.
`--vfs-cache-max-age 12h`	Automatic Space Freeing: Deletes the local SSD cache of any file that has not been read or written to for 12 hours, returning local disk consumption to zero.
`--vfs-cache-max-size 50G`	Caps maximum local cache size. Cleans older cached chunks using an LRU (least-recently-used) policy if this threshold is reached.
`--vfs-cache-poll-interval 1m`	Scans the local cache directory once per minute to evict expired or overflowing data promptly.
`--poll-interval 1m`	Delta Polling: Queries Microsoft Graph every minute for changes, ensuring additions or deletions made in the cloud reflect in Finder promptly.
`--vfs-write-back 5s`	Delays upload until 5 seconds after a file is closed, preventing lockups caused by simultaneous writing and uploading.
`--onedrive-chunk-size 125M`	Increases upload chunk size to 125MB (a multiple of 320KiB required by Microsoft’s API), optimizing throughput on high-speed internet.
`--buffer-size 64M`	Allocates a 64MB read-ahead buffer in RAM for each open file to absorb network latency fluctuations during video playback.
`--volname "SharePoint"`	Displays the mount as an external drive named “SharePoint” on your desktop and Finder sidebar.

TIP

Transparent Decryption & Universal Streaming Access: In ~/SharePointVault, Rclone decrypts files dynamically in RAM-presenting normal filenames and data with zero manual steps. In ~/SharePoint, files are uploaded unencrypted, allowing you to stream or download large videos on any device (such as mobile phones, smart TVs, or web browsers) without needing Rclone or encryption keys.

Exploring Remotes with Rclone Web (Optional)

The modern official web interface Rclone Web is bundled directly into latest Rclone releases. If you ever want to visually inspect your configured cloud remotes (sp and sp-crypt) or explore cloud files in a web browser without mounting:

rclone gui

Instant Browser Launch: Automatically starts a temporary web GUI server and opens your default browser pre-authenticated.
On-Demand Inspection: When you are finished exploring, press Ctrl + C in Terminal to terminate the web GUI.

4. Configure Automated Startup at Login (macOS Launchctl)

Use macOS’s native launchctl service to maintain persistent, background mounting for both virtual drives upon system login.

NOTE

Why launchctl is the ideal service manager on macOS: macOS launchctl manages both virtual drives as native user daemons. It monitors both processes silently, consumes minimal memory, and automatically relaunches a mount if an unexpected network disruption occurs.

Step 1: Generate the LaunchAgent Configurations

1. Unencrypted Media Mount Service (`com.user.rclone.sharepoint.plist`)

Run the following command to create the directory structure:

mkdir -p ~/SharePoint ~/SharePointVault
mkdir -p ~/Library/LaunchAgents
mkdir -p ~/.config/rclone

For the unencrypted media drive mount service:

cat << EOF > ~/Library/LaunchAgents/com.user.rclone.sharepoint.plist
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>Label</key>
    <string>com.user.rclone.sharepoint</string>
    <key>EnvironmentVariables</key>
    <dict>
        <key>PATH</key>
        <string>/opt/local/bin:/opt/local/sbin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin</string>
    </dict>
    <key>ProgramArguments</key>
    <array>
        <string>/opt/local/bin/rclone</string>
        <string>mount</string>
        <string>sp:</string>
        <string>$HOME/SharePoint</string>
        <string>--vfs-cache-mode</string>
        <string>full</string>
        <string>--vfs-cache-max-age</string>
        <string>12h</string>
        <string>--vfs-cache-max-size</string>
        <string>50G</string>
        <string>--vfs-cache-poll-interval</string>
        <string>1m</string>
        <string>--poll-interval</string>
        <string>1m</string>
        <string>--vfs-write-back</string>
        <string>5s</string>
        <string>--onedrive-chunk-size</string>
        <string>125M</string>
        <string>--buffer-size</string>
        <string>64M</string>
        <string>--volname</string>
        <string>SharePoint</string>
    </array>
    <key>RunAtLoad</key>
    <true/>
    <key>KeepAlive</key>
    <dict>
        <key>SuccessfulExit</key>
        <false/>
    </dict>
    <key>ThrottleInterval</key>
    <integer>10</integer>
    <key>StandardOutPath</key>
    <string>$HOME/.config/rclone/sharepoint-mount.log</string>
    <key>StandardErrorPath</key>
    <string>$HOME/.config/rclone/sharepoint-mount.log</string>
</dict>
</plist>
EOF

2. Encrypted Vault Mount Service (`com.user.rclone.sharepointvault.plist`)

Run the following command to create the encrypted zero-knowledge vault mount service:

cat << EOF > ~/Library/LaunchAgents/com.user.rclone.sharepointvault.plist
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>Label</key>
    <string>com.user.rclone.sharepointvault</string>
    <key>EnvironmentVariables</key>
    <dict>
        <key>PATH</key>
        <string>/opt/local/bin:/opt/local/sbin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin</string>
    </dict>
    <key>ProgramArguments</key>
    <array>
        <string>/opt/local/bin/rclone</string>
        <string>mount</string>
        <string>sp-crypt:</string>
        <string>$HOME/SharePointVault</string>
        <string>--vfs-cache-mode</string>
        <string>full</string>
        <string>--vfs-cache-max-age</string>
        <string>12h</string>
        <string>--vfs-cache-max-size</string>
        <string>30G</string>
        <string>--vfs-cache-poll-interval</string>
        <string>1m</string>
        <string>--poll-interval</string>
        <string>1m</string>
        <string>--vfs-write-back</string>
        <string>5s</string>
        <string>--onedrive-chunk-size</string>
        <string>125M</string>
        <string>--buffer-size</string>
        <string>64M</string>
        <string>--volname</string>
        <string>SharePointVault</string>
    </array>
    <key>RunAtLoad</key>
    <true/>
    <key>KeepAlive</key>
    <dict>
        <key>SuccessfulExit</key>
        <false/>
    </dict>
    <key>ThrottleInterval</key>
    <integer>10</integer>
    <key>StandardOutPath</key>
    <string>$HOME/.config/rclone/sharepointvault-mount.log</string>
    <key>StandardErrorPath</key>
    <string>$HOME/.config/rclone/sharepointvault-mount.log</string>
</dict>
</plist>
EOF

IMPORTANT

PATH: Ensures auxiliary tools and user-space helper symlinks in /usr/local/bin can be resolved by background jobs.

Step 2: Activate the Services

# Ensure both target mount points are clean and unmounted
diskutil unmount force ~/SharePoint 2>/dev/null || umount -f ~/SharePoint 2>/dev/null
diskutil unmount force ~/SharePointVault 2>/dev/null || umount -f ~/SharePointVault 2>/dev/null

# Bootstrap and start background services in the modern user GUI domain
launchctl bootstrap gui/$(id -u) ~/Library/LaunchAgents/com.user.rclone.sharepoint.plist
launchctl bootstrap gui/$(id -u) ~/Library/LaunchAgents/com.user.rclone.sharepointvault.plist

Both the SharePoint and SharePointVault drives will now automatically mount in Finder upon every login.

IMPORTANT

Because ~/SharePoint mounts the root of your SharePoint document library, the vault/ folder will appear inside ~/SharePoint containing encrypted hashes. Do not edit, rename, or write files directly into ~/SharePoint/vault. Always interact with your encrypted files through the dedicated ~/SharePointVault mount point.

The Dual-Mount Architecture:

Local Mac (Finder):
├── ~/SharePoint         ──(FUSE-T)──>  sp:        (Unencrypted: Videos, Media, Public files)
└── ~/SharePointVault    ──(FUSE-T)──>  sp-crypt:  (Encrypted: Private documents & backups)

Microsoft SharePoint (Cloud):
├── Videos/              (Plain unencrypted files — downloadable anywhere)
├── Documents/           (Plain unencrypted files)
└── vault/               (Encrypted ciphertext blobs — managed by sp-crypt)

TIP

If the drive icons do not appear on your Desktop or Finder sidebar: FUSE-T mounts the drives as network filesystems (NFS). Ensure macOS allows displaying connected network volumes:

Open Finder → press Cmd + , (Settings / Preferences).
Under the General tab, check Connected servers.
Under the Sidebar tab, ensure Connected servers is checked under Locations.

Alternatively, navigate to ~/SharePoint and ~/SharePointVault in Finder and drag both folders directly into your Favorites sidebar for one-click access.

5. Maintenance and Operations

Manually Free All Local Space Immediately

WARNING

Data Loss Risk: Before running this command, verify that all files have finished uploading to the cloud. You can monitor log files (tail -f ~/.config/rclone/sharepoint-mount.log) to confirm transfer queues are empty, or check Activity Monitor to ensure rclone network egress has dropped to zero.

Never clear this directory while uploads are in progress, as files queued in the local buffer will be permanently erased before reaching the cloud, causing irrecoverable data loss or corrupted remote files.

To instantly wipe the local cache without affecting cloud files, delete the local cache and metadata folders:

rm -rf ~/Library/Caches/rclone/vfs*

Safe Unmounting

Do not drag the mounted volume to the Trash. Unmount according to how the drive was launched:

If running via Launchctl background service (Section 4): Boot out the background services directly. This terminates Rclone cleanly and automatically unmounts both volumes:
```
launchctl bootout gui/$(id -u)/com.user.rclone.sharepoint 2>/dev/null
launchctl bootout gui/$(id -u)/com.user.rclone.sharepointvault 2>/dev/null
```
If running manually via Terminal (Section 3): Unmount the mount points directly:
```
diskutil unmount ~/SharePoint 2>/dev/null || umount ~/SharePoint
diskutil unmount ~/SharePointVault 2>/dev/null || umount ~/SharePointVault
```
(If a mount point remains busy, force unmount with diskutil unmount force ~/SharePoint or diskutil unmount force ~/SharePointVault)

Inspecting and Truncating Logs

By default, Rclone runs at the NOTICE logging level, keeping log file growth negligible (typically under 1MB per year).

To view live log output in Terminal:

# View unencrypted media mount logs:
tail -f ~/.config/rclone/sharepoint-mount.log

# View encrypted vault mount logs:
tail -f ~/.config/rclone/sharepointvault-mount.log

If you ever wish to instantly truncate and free log file space without restarting the background service:

: > ~/.config/rclone/sharepoint-mount.log
: > ~/.config/rclone/sharepointvault-mount.log

Managing AppleDouble (`._*`) and `.DS_Store` Companion Files

When copying files with extended attributes (such as quarantine flags from browser downloads, AirDrop metadata, or Finder tags) to a virtual or network filesystem, macOS automatically generates companion metadata files prefixed with ._ (AppleDouble format).

Understanding how macOS and Rclone handle these companion files resolves common sync puzzles:

Disable .DS_Store Generation on Network Stores (System Optimisation):

Run this native macOS command to instruct Finder never to create .DS_Store files on network shares and FUSE mounts, then restart Finder to apply the change immediately:
```
defaults write com.apple.desktopservices DSDontWriteNetworkStores -bool TRUE
killall Finder
```
You can verify that the setting took effect (should output 1):
```
defaults read com.apple.desktopservices DSDontWriteNetworkStores
```
NOTE

DSDontWriteNetworkStores exclusively suppresses .DS_Store. It has zero effect on AppleDouble (._*) files, which macOS treats as essential file metadata forks.
Why --exclude is Omitted & Preventing ._* Companion Files:

In rclone mount, --exclude acts purely as a read/visibility filter, it hides files from Finder, but it does not intercept or block files written into the local VFS mount by macOS. Adding --exclude "._*" creates an illusion: Finder writes ._filename, Rclone uploads it to SharePoint anyway, and then hides it from your local view so you cannot even see or delete it with normal rm commands.

Omitting --exclude keeps your local view completely consistent with cloud storage. To actually stop macOS from generating and uploading ._* companion files:
- Strip Extended Attributes Before Copying: Remove metadata (quarantine, tags) so macOS sees clean data files:
```
# Single file or folder:
xattr -c "filename.jpg"

# Entire directory recursively:
xattr -cr /path/to/folder
```
- Copy via Terminal without Extended Attributes:
```
cp -X "filename.jpg" ~/SharePoint/
# Or to the encrypted vault:
cp -X "filename.jpg" ~/SharePointVault/
# For directories:
cp -RX /path/to/folder ~/SharePoint/
```

Purge Stuck Companion Files from Local Cache:

If your current transfer queue is stuck retrying ._* or .DS_Store files, delete them from the local cache to allow legitimate files to proceed:

find ~/Library/Caches/rclone/vfs -name "._*" -delete 2>/dev/null
find ~/Library/Caches/rclone/vfs -name ".DS_Store" -delete 2>/dev/null
find ~/Library/Caches/rclone/vfsMeta -name "._*" -delete 2>/dev/null
find ~/Library/Caches/rclone/vfsMeta -name ".DS_Store" -delete 2>/dev/null

Purge Existing Companion Files from Cloud Storage:

To mass-delete any lingering ._* and .DS_Store files across both cloud spaces:

# From unencrypted SharePoint storage:
rclone delete sp: --include "._*" --include ".DS_Store"

# From encrypted vault:
rclone delete sp-crypt: --include "._*" --include ".DS_Store"

Preventing SharePoint Version Bloat (Critical)

WARNING

To prevent minor file modifications or metadata changes on large videos from consuming the 1.24TB pool through version history, adjust document versioning settings on your Communication site (as noted in Section 0, “No versioning” is only available on Communication sites):

Navigate to your Communication site document library in a web browser.
Click the gear icon (Settings) → Library settings → More library settings → Versioning settings.
Under Document Version History, select No versioning and click OK at the bottom.

6. Architectural Trade-offs & Ideal Workflows

You’ve finally broken free from OneDrive’s sickeningly broken behaviour of SharePoint on macOS, a disaster born from corporate politics between Apple and Microsoft. With this dual-mount architecture in place, here is what you’ve gained:

Dual-Mount Flexibility & Universal Media Access: By mounting the raw remote sp: to ~/SharePoint, large video files and media collections remain unencrypted in the cloud. You can stream them seamlessly with byte-range requests and instant seeking on macOS (via players like IINA, Infuse, or VLC), but you can also download or play them when away from your Mac—using the SharePoint web interface, OneDrive mobile app, or smart TV players—without needing Rclone or encryption keys.
Zero-Knowledge Privacy & Metadata Immunity in ~/SharePointVault: Sensitive personal records, credentials, and backups placed into ~/SharePointVault are encrypted on the fly via rclone crypt (XSalsa20 + Poly1305). Because SharePoint only receives opaque ciphertext blobs, it cannot crack open Office documents or PDFs to inject tenant UUIDs (sizes differ loops), and cloud administrators or compromised credentials cannot inspect your files.
Eliminating macOS Sync Deadlocks: Bypasses Apple’s fileproviderd architecture completely, eliminating circular upload freezes, 0% progress bugs, and high CPU lockups during large transfers.
True Cloud Capacity: Unlocks the tenant-wide SharePoint storage pool, bypassing Microsoft’s strict 10GB personal OneDrive quota on Developer E5 accounts.
Elimination of Filename Character Restrictions in the Vault: SharePoint strictly rejects characters like " * : < > ? / \ |, leading/trailing spaces, and periods at the end of filenames. Inside ~/SharePointVault, rclone crypt encrypts all filenames into standard alphanumeric hashes, ensuring every valid macOS filename is supported without errors.

However, to ensure optimal performance, keep this in mind:

High Overhead on Thousands of Small Files: Uploading a single 10GB video requires one continuous stream that saturates available network bandwidth. In contrast, copying a directory containing 30,000 fragmented files (such as node_modules or unpacked game assets) requires tens of thousands of individual REST API calls to Microsoft Graph. This creates severe network round-trip latency and quickly triggers HTTP 429 (Too Many Requests) rate limiting from Microsoft.

The Golden Rule: Large Files Directly, Small Files Zipped

Directly to Mount (~/SharePoint or ~/SharePointVault): Videos, TV series, photo libraries, disc images (.iso, .dmg), virtual machine disks, and pre-packaged archives.
Zip First Locally: Code repositories, game installation directories, emulator ROM collections, and folders containing thousands of small files or HTML manuals. Compress them into a single .zip or .7z file before moving them to the mount. This avoids API rate limiting, preserves byte-for-byte integrity, and guarantees maximum upload throughput.

Clinging to Life on an Obsolete Intel Mac

Sun, 30 Aug 2026 00:00:00 GMT

Dealing with hardware obsolescence and Homebrew tier 3 software hurdles on an Intel MacBook in late 2026.

On 13 August 2026, Apple listed my old Intel MacBook as an obsolete product. According to the official description:

Products are considered obsolete when Apple stopped distributing them for sale more than 7 years ago.

…

Apple discontinues all hardware service for obsolete products, and service providers cannot order parts for obsolete products.

…

That means that, except for the battery, I cannot get any repairs from official support. I would only be able to try my luck at a third-party repair shop if this old fellow breaks again.

Over the years, I’ve spilt milk on it and had to get the motherboard repaired. I dropped it at Connolly Station, thought it was definitely broken, and I literally held my head in my hands on the bench for several minutes. But this old chap has pulled through time and time again. Thanks to its 32 GB RAM, I can at least dip my toes into some small-size LLMs on it. While the lack of Apple Silicon’s unified memory architecture for GPU acceleration and modern ML frameworks like MLX is really a pain in the ass, considering the recent price of RAM, I need it to keep chugging along for a couple more years.

The problem is, it’s not just the lack of hardware repairs, the fading software support is coming back to bite me in the ass too. I even started seeing this issue when I updated using Homebrew:

Error: node: no bottle available!
If you're feeling brave, you can try to install from source with:
  brew install --build-from-source node
This is a Tier 3 configuration:
  https://docs.brew.sh/Support-Tiers#tier-3

This means they are withdrawing support for the pre-built bottles for my old fellow. Although I could download the source code and compile it myself, that would mean more work. And the last thing I want is any hassle. Luckily, I found a workaround. I replaced the current one with node@24 LTS. Click to ignore Homebrew and check out the truly useful masterpiece!

Replacing it is quite simple:

Install Node.js 24 LTS:
```
brew install node@24
```
Uninstall the unversioned formula:
```
brew uninstall node
```
Link node@24 and overwrite any remaining npm files:
```
brew link --overwrite node@24
```
Verify the active versions:
```
node -v
npm -v
```

According to Homebrew, this allows me to cling to life until 30 April 2027. I hope I can afford a new Mac before that time comes, otherwise, this kind of issue will become more and more common in the foreseeable future.

TIP

npm does not age out unused-but-valid packages. The docs are explicit: the cache grows as you install new packages, and npm will not prune it on its own.

To clean up corrupted or orphaned cache entries and verify integrity without wiping everything, you can run:

npm cache verify

This garbage-collects unneeded index records and repairs corrupted data, though because it preserves all valid cached packages, it won’t free up space taken by older packages you no longer need.

If you are severely low on disk space and truly want to purge all cached packages, the only official way is:

npm cache clean --force

Use this sparingly, however, wiping valid cache entries forces npm to re-download dependencies from the registry on future installs, wasting bandwidth and slowing them down.

The Redemption

Several days later, another message showed up when I used brew upgrade.

Warning: You are using macOS on Intel x86_64.
We do not provide support for this platform (as-of September 2026, announced August 2025).

Apple have dropped Intel x86_64 support in macOS Golden Gate (27).
GitHub Actions are dropping macOS Intel x86_64 runners in 2027.
Homebrew is a non-profit project run entirely by volunteers, not employees.
If the biggest companies in the world cannot support macOS Intel x86_64
any longer, sadly neither can we.

You will have better luck with MacPorts which still supports macOS Intel x86_64:
  https://www.macports.org

I never imagined that Homebrew’s decision to discontinue support for Intel Macs and introduce me to MacPorts would open up a whole new world for me, to the extent that I ended up completely overhauling my development environment. It all started with this note:

nodejs26 does not contain npm but it can be installed as a separate port. Pick from the choices listed by running: port search —name —glob ‘npm*’

I was tired of npm’s cache and node_modules, which are located in each project root folder, eating up a lot of my storage for a long time. But no matter whether I installed Node.js from the official website or Homebrew, npm always came bundled with Node.js. I now know that I can build it from source with only the runtime. However, since there are no instructions on the official landing page or docs, it was hard to realise there was a distinction between the runtime and the package manager back then.

It was then that I quite naturally came across pnpm. pnpm is a fast, disk-efficient package manager for the JavaScript ecosystem, designed as a drop-in replacement for npm.

Compared to npm, its key advantages include:

Massive Disk Space Savings: It uses a global content-addressable store on your hard drive, hard-linking packages so the same dependency is never duplicated across projects.
Significantly Faster Installs: By skipping redundant downloads and running tasks concurrently, installs and CI builds are noticeably faster.
Strict, Phantom-Dependency Prevention: Unlike npm’s flattened node_modules, pnpm uses symlinks to create a strict structure, preventing your code from accidentally importing dependencies you never explicitly declared in package.json.
First-Class Monorepo Support: It natively handles multi-package workspaces with zero hassle.

That means I don’t need to worry about running npm cache verify, npm cache clean --force, or deleting node_modules manually from time to time to keep my projects consistent and clean. I immediately installed MacPorts, installed nodejs26 and pnpm through it without a second thought, and migrated all my JavaScript projects to pnpm. For me, the way pnpm runs is like magic.

But as I ventured deeper down the rabbit hole, I found something even more shocking: I could even get rid of pnpm! Not by switching to another package manager like Yarn that could be paired with Node.js, but an actual runtime that can replace Node.js and a package manager all by itself! That’s right, with Deno or Bun, not only will you no longer have to worry about which package manager to choose, but you’ll also be able to enjoy a more cutting-edge and faster development environment! If you are interested in the differences between Node.js, Deno, and Bun, you can find a more useful comparison on this page.

In my own experience, I’ve already migrated one of my JavaScript projects totally from Node.js to Deno. All I needed was to replace express, cors, dotenv, and Node-specific http constructs with native Deno APIs. However, while my other two projects focus on TypeScript and should have been better suited to a switch to Deno (given its native support for TypeScript), one uses Electron for its GUI and the other is this blog which relies heavily on Node.js via Astro. After careful consideration, I ultimately decided against migrating them, opting instead to switch to Node.js + pnpm.

A blessing in disguise

The reason I didn’t try Bun is because Deno was already installed on my MacBook as a dependency of yt-dlp. Yep, that is the only reason. Now you know how lazy I am.

twitter.now: Score, Don't Ban

Thu, 27 Aug 2026 00:00:00 GMT

How twitter.now shifts content moderation from bans to AI scoring, and why it feels so familiar.

You might have noticed the recent buzz around twitter.now. It almost feels like a Reanimation Jutsu, bringing the iconic blue bird back into the spotlight.

The landing page of twitter.now reviving the iconic blue bird aesthetic

Beyond the legal drama and trademark disputes with Elon Musk, launching “just another microblogging platform” is rarely game-changing. What genuinely caught my eye is their fundamental shift in content governance philosophy:

Instead of deleting posts or banning accounts, they score them.

Through their VERA and Trust OS (powered by Gemini), posts receive credibility and trust scores. Users simply adjust a dynamic slider to set their own threshold for what content reaches their feed.

VERA & Trust OS dynamic trust scoring and slider controls

Seeing twitter.now’s architecture instantly brought back memories of my Master’s final project, Social Threat Guardian (built with React, TypeScript, Express, Oracle DB, and DistilBERT, though models like DeBERTa-v3 or RoBERTa would be the go-to today). While the use cases differ, the core philosophy is strikingly aligned: both use continuous AI-driven 0–100 scoring, putting control and visibility into data-backed thresholds.

The difference lies in where the engine lives:

twitter.now is a native social platform where higher scores mean higher trust for feed curation.
Social Threat Guardian was an external intelligence and alerting engine. It ingested posts across major platforms, scored them on a 0–100 toxicity scale (where higher = more dangerous), mapped historical platform-wide threat trends, and triggered instant alerts when high-risk content matched user-defined keywords, like real names, identities, or location data.

Back then, our biggest hurdles were the astronomical cost of fetching streaming data (X’s API pricing felt like robbery), and feedback from one of my mentors pointing out that our project had a blurry target audience, making it hard for everyday users to grasp the value of a standalone monitoring dashboard.

Seeing twitter.now, I can’t help but marvel at how it has directly resolved the two biggest problems we faced back then, by building the platform itself instead of paying for external APIs, and tying the scoring engine directly into the core product to make it easier for users to understand.

Perhaps that is why they have the confidence to take Musk to court and launch a $20/$40 subscription plan, whilst we ultimately never got beyond the stage of a final project.

I Won a Draw

Mon, 24 Aug 2026 00:00:00 GMT

It won't let me retire, but at least it put me in a great mood for the day.

So here’s the story: I received two promotional emails from AIB in February and May, respectively, and participated in both events.

This one is from February. I actually won the May draw, but couldn’t find that specific email.

Participation was quite simple. First, register online at aib.ie/visapromotion and answer a Disney-related question correctly. Then, spend with an AIB Visa debit or credit card: every transaction, whether in Euro or a foreign currency, earned one entry, capped at 10 entries per draw period. If I’m not mistaken, I didn’t even use up all 10 attempts.

The biggest prize for both events was a multi-day activity pass to Disneyland, one for France and the other for London. Each draw would ultimately see six lucky winners take the top prize, whilst a further 100 less fortunate participants received a merchandise bundle.

Apparently, I’m one of the 200 lucky dogs.

This congratulations email arrived out of nowhere on an otherwise unremarkable midday.

After waiting for 19 days, I finally received my Precious, delivered by UPS.

A Lion King tote bag, brochure, two mugs, and four plush toys.

I couldn’t resist writing a blog post to record this, because I genuinely can’t remember the last time I won anything from a draw. It’s definitely a dandy day for me, thanks to AIB, VISA, and the Goddess of Probability.

The day got even better when I found out the mug change colour with hot water. After consulting Gemini, it transpires that this is a typical piece of Disney merchandise known as a heat-reveal (thermochromic) mug.

At room temperature

Upon heating

Well, at least it’s new to me, and the science behind it is pretty fascinating.

According to Gemini, thermochromic (heat-sensitive) pigment works via a reversible physical and chemical reaction—microcapsules expand and become transparent when heated, then reset when cooled. Because it is a physical transition rather than a consumable chemical fuel, there is no fixed cycle countdown (like a battery).

However, the coating degrades over time due to environmental factors:

UV Light / Direct Sunlight: The biggest killer of color-changing pigment is UV radiation, which breaks down the organic dyes and permanently locks the design in either its hot or cold state.
Thermal Degradation: Extremely high temperatures (like microwave exposure or dry heating) permanently damage the microcapsules.
Friction & Washing: Abrasive scrubbers or harsh dishwashing soaps will physically strip the outer protective glaze and ink layer.

So in the end, I decided to put it back in the box.

It came to to me, my own, my love… my… precioussss!

Everyone should start using a better DNS

Wed, 03 Jun 2026 00:00:00 GMT

Although GDPR acts as a silent guardian for your personal data, taking additional steps yourself is still important for online privacy and security.

Third year in Ireland.
Moved houses three times.
After the recent move, I received a lot of marketing SMS ads from Three.

This makes me wonder: Is Three tracking my location using the cell tower? It detected that I had moved to a new place in a residential area, assumed that I needed things for the new house, and sent me these messages. This is just a conspiracy theory, and I have no way of proving whether my theory is correct. But it reminds me of writing this blog, which is to show you what DNS is and how your ISP can use it to know everything about you, and use this information to send you targeted marketing messages.

What is DNS

The Domain Name System (DNS) is a foundational protocol of the internet, serving as the primary mechanism for translating human-readable hostnames into machine-readable IP addresses. Think of it this way: instead of memorizing a string of numbers like 172.135.248.206, you only need to remember a meaningful phrase like ThisIsRían.com. The DNS server resolves that name into the correct IP address (172.135.248.206), guiding your browser directly to Rían’s digital front door.

Generally speaking, this task is handled by your ISP by default. This means that your ISP has the technical visibility to observe every domain you visit, down to the exact second. While privacy frameworks like the EU GDPR and ePrivacy regulations forbid European ISPs from selling browsing metadata to advertisers or retaining web history indiscriminately, laws in many jurisdictions still mandate retaining subscriber IP allocation data for months or years. More crucially, unencrypted DNS leaves your lookups vulnerable to on-path monitoring. In the following sections, I will use Irish law and Vodafone as examples.

While your ISP absolutely knows you visited a specific website, HTTPS encryption stops them from seeing everything you do on that site. With HTTPS, your data looks like this to your ISP:

What your ISP CAN see	What your ISP CANNOT see
You visited `wikipedia.org`	The specific article you read (`/wiki/Domain_Name_System`)
You visited `amazon.com`	What you searched for, clicked on, or bought
Exactly when you connected and disconnected	The passwords or credit card info you typed
How much data you downloaded/uploaded	The text of messages you sent on encrypted apps

For most people, that might not be a big deal. But if you truly don’t want your ISP to know that you’re visiting a home improvement website or a government agent to know that you were on Pornhub at 2 am, you should probably start using DoT or DoH provided by a legitimate DNS provider such as Quad9 instead of your ISP’s default DNS, and here’s why.

Jurisdictional Governance and Data Protection Regimes

The structural divergence between public recursive resolvers and commercial Internet Service Providers (ISPs) is rooted in their organizational mandates and the legal jurisdictions that govern them. These factors dictate how subscriber metadata is processed, logged, and shielded from external surveillance.

Governance Attribute	Quad9 Public DNS	Vodafone Ireland Default DNS
Legal Entity Structure	Not-for-Profit Foundation	Commercial Telecommunications Provider
Corporate Domicile	Zürich, Switzerland	Dublin, Ireland
Primary Regulatory Oversight	Swiss Federal Data Protection and Information Commissioner (FDPIC)	Irish Data Protection Commission (DPC)
IP Address Logging Policy	Absolute zero-log policy for client IP addresses	Temporary and long-term logging of IP allocations
Mandatory Data Retention	Exempt from Swiss SPTA/TCA retention obligations for its resolver service	Legally bound to retain certain user/source data, generally around one year, with special retention orders possible
GDPR Compliance Pathway	Subject to Swiss law globally; GDPR representative in Hamburg for EEA users	Directly bound under EU GDPR and Irish ePrivacy Regulations

Quad9 and Swiss Geopolitical Engineering

Quad9 is incorporated as a non-profit foundation headquartered in Zürich, Switzerland. This corporate domicile was selected to place the entity under a legal system that strictly enforces individual privacy rights. Quad9 treats user IP addresses as personally identifiable information and aligns its privacy position with Swiss data-protection law and, for EEA users, the European Union’s General Data Protection Regulation (GDPR). To secure its operations against state-compelled logging, Quad9 relies on Swiss legal protections and has published Swiss regulatory findings about its resolver service: Exemption from the Telecommunications Act (TCA): The Swiss Federal Office of Communications confirmed that Quad9 is not a telecommunications service under the Swiss TCA, exempting the foundation from “Know Your Customer” (KYC) identity collection mandates. Exemption from Surveillance Laws (SPTA): The Swiss Post and Telecommunications Surveillance Service ruled that the Federal Act on the Surveillance of Post and Telecommunications does not apply to Quad9. Consequently, Quad9 is not required to collect or retain metadata for law enforcement or intelligence agencies. Global Swiss Data Protection Coverage: Quad9 says Swiss data protection law applies to users globally, while GDPR also applies to Quad9 users in the EEA. Because Quad9 does not maintain a subscriber database or log client IP addresses, it possesses no metadata to yield. Any attempt by foreign agencies to compel data handover must go through a Mutual Legal Assistance Treaty (MLAT) evaluated by the Swiss Federal Office of Justice. If a government attempts to use national laws to force data collection, Quad9’s operational charter mandates a complete shutdown of operations in that country, routing local queries to servers in nearby jurisdictions.

Vodafone Ireland and Telecommunications Retention Mandates

Vodafone Ireland Limited operates as a commercial telecommunications provider under the laws of the Republic of Ireland and the EU. It manages a large network infrastructure under Autonomous System AS15502. Unlike public recursive resolvers, Vodafone is legally bound by the Communications (Retention of Data) (Amendment) Act 2022. This legislation was enacted to align Irish data retention laws with rulings from the Court of Justice of the European Union (CJEU), such as the Graham Dwyer murder conviction appeal, Digital Rights Ireland, and Tele2/Watson. Under the Communications (Retention of Data) (Amendment) Act 2022, Vodafone Ireland must comply with retention obligations for certain categories of communications data: Mandatory User and Internet Source Data Retention: Irish law requires service providers to retain certain user data and internet source data, such as data needed to identify the source of an internet communication, generally for around one year, with prescribed periods possible up to two years. National Security Retention Orders: If the Minister for Justice identifies a serious threat to national security, a relevant judge can issue an order requiring service providers to retain specified Schedule 2 data for 12 months. Targeted “Quick Freeze” Orders: Irish law enforcement agencies can obtain preservation and production orders to freeze metadata associated with a specific suspect. When a subscriber queries Vodafone’s default DNS servers (such as the legacy 89.19.64.164 / 89.19.64.36 or dynamically assigned resolvers like 64.43.51.22), the request is sent in cleartext, exposing the queried domain name, timestamp, and subscriber IP address to the access network. Irish retention law should not be described as a clear statutory requirement to retain every DNS query, but plaintext ISP DNS still gives the provider the technical ability to observe those lookups. Additionally, Vodafone Ireland has faced regulatory scrutiny regarding database management and subscriber preference handling. The Irish Data Protection Commission (DPC) has prosecuted Vodafone Ireland multiple times for unsolicited marketing communications under Regulation 13 of the ePrivacy Regulations, including documented cases in 2011, 2022, and 2023, with other reports noting prior convictions. These compliance failures underscore the privacy risks when sensitive subscriber data is managed by a commercial entity with marketing operations.

Security Profiling, Content Blocking, and State Censorship

While recursive DNS resolvers are frequently used to enforce network security, the definition of “safety” differs significantly between a dedicated public security resolver and an ISP resolver subject to state court orders.

Security & Filtering Dimension	Quad9 Public DNS (9.9.9.9)	Vodafone Ireland Default DNS
Active Threat Prevention	Automatic blocking of malware, phishing, and C2 servers	None by default; requires a paid Secure Net subscription
Threat Intelligence Sourcing	Aggregated from 25+ security feeds	None on standard tiers
Copyright Intermediary Blocking	None; rejects copyright-based domain filtering	Compelled DNS-level blocklists for sites like The Pirate Bay
Dynamic Stream Interception	None	May be required where Vodafone is named in relevant copyright injunctions
Parental Content Control	Not customizable on the standard profile	Network-level custom filtering available via Secure Net

Cyber Threat Intelligence vs. Passive Routing

The default configuration of Quad9 (9.9.9.9) is designed for active threat mitigation. Quad9 blocks user connections to malicious domains at the DNS layer by aggregating real-time threat intelligence from 25+ independent threat intelligence providers, including the Swiss security center SWITCH. Some independent tests have reported block rates as high as about 97%, though results vary by test set and date. This filtering can prevent endpoints from communicating with malware distributors, phishing landing pages, and Command-and-Control (C2) servers. Quad9 performs this filtering automatically without charging subscription fees or requiring software installation on client devices. By contrast, Vodafone Ireland’s default DNS servers operate as passive recursors. They do not provide native threat intelligence filtering to protect users from emerging cyber threats. If a Vodafone subscriber clicks an active phishing link while using default DNS, the resolver completes the lookup, leaving endpoint defense entirely to the local machine.

ISP-Level Censorship and Legal Intermediary Blocking

While Vodafone’s default DNS does not provide dynamic cyber threat filtering, it actively enforces state-mandated content blocking. As a licensed telecom intermediary, Vodafone Ireland is legally compelled to comply with High Court injunctions: Copyright Infringement Blocks: Following a landmark legal action under “Irish SOPA” legislation, Vodafone was ordered by the Irish High Court to implement DNS-level blocking of indexers like The Pirate Bay and its corresponding mirror sites. Dynamic Sports Streaming Blocks: Irish ISPs, including Vodafone where named in relevant orders, may be required to comply with copyright injunctions that block access to infringing streaming services. Quad9 does not block sites for copyright enforcement, trademark disputes, or licensing contentions. Although Quad9 was temporarily subject to an interim injunction in Germany to block domains at the request of Sony Music, the Dresden Higher Regional Court ultimately ruled in Quad9’s favor in December 2023, treating recursive DNS resolvers as neutral intermediaries that benefit from liability privileges under German and EU law. Its mandate remains strictly limited to cyber security threats.

Vodafone Secure Net Add-On

To provide security filtering similar to public resolvers, Vodafone offers a paid network-level security subscription called Secure Net (Secure Net Home costs €2.99 per month, and Secure Net Mobile costs €1.99 per month). Secure Net is a network-level filtering product operated inside Vodafone’s network. Public Vodafone materials say it can analyse network traffic, block unsafe websites/downloads, and provide parental controls like age-appropriate content filtering, Bedtime schedules, and custom domain blocking, but they do not fully document the technical mechanisms used. Because Secure Net operates inside Vodafone’s transport loop, VPNs, encrypted proxy services, and some encrypted DNS configurations may bypass parts of its filtering, especially DNS-based filtering, depending on how the product implements detection. It may also be incompatible with browsers that utilize independent data compression.

Cryptographic Protocols and Resolution Capabilities

Modern DNS design relies heavily on cryptographic transport security and performance optimization protocols. The architectural division between Quad9 and Vodafone Ireland reveals a stark contrast in their support for secure DNS standards.

Technical Feature	Quad9 Public DNS	Vodafone Ireland Default DNS
Standard Unencrypted DNS	Supported on UDP and TCP Port 53	Default resolution protocol
DNS-over-TLS (DoT)	Supported on TCP Port 853	Not supported on standard ISP servers
DNS-over-HTTPS (DoH)	Supported over HTTPS on port 443	No public support documented for default customer resolvers
DNSSEC Validation	Supported and enforced on secured service profiles	Not verified from public Vodafone documentation
EDNS Client Subnet (ECS)	Stripped on 9.9.9.9; supported on 9.9.9.11	Not verified from public Vodafone documentation
Extended DNS Errors (EDE)	Support varies by endpoint and implementation	Not verified from public Vodafone documentation

The Last-Mile Security Paradox

Standard DNS traffic is transmitted in cleartext over UDP or TCP port 53, making it vulnerable to on-path interception, eavesdropping, and tampering by network operators and middleboxes. To prevent this, secure transport protocols have been developed: DNS-over-TLS (DoT): Wraps DNS queries inside a secure TLS session over dedicated TCP port 853. This encrypts name resolution traffic once configured at the OS, application, or router level. DNS-over-HTTPS (DoH): Wraps DNS queries inside HTTPS, commonly using HTTP/2 over TLS/TCP 443 or HTTP/3 over QUIC/UDP 443. DoH blends in with standard web traffic, making it difficult for firewalls to block or inspect. Quad9 supports both DoT and DoH across its main service profiles, providing robust encryption from the user’s stub resolver directly to Quad9’s recursive resolver infrastructure. Vodafone Ireland’s default name servers do not support incoming DoT or DoH connections. Devices utilizing the default ISP-assigned DNS send queries in cleartext, exposing every domain lookup to local network sniffers, transit providers, and state surveillance systems. This creates The Last-Mile Security Paradox. If a user configures Quad9’s IP address (9.9.9.9) inside their router but leaves the connection unencrypted over standard port 53, the underlying ISP (Vodafone) can still inspect the DNS query payload. Because the DNS request travels in plaintext across Vodafone’s physical network, the ISP can technically record the queried domains. Therefore, to prevent ISP-path inspection of DNS lookups, users must configure secure DNS protocols like DoH or DoT on their devices to encrypt the traffic before it leaves the local network. This does not make browsing invisible to the ISP; it mainly protects the DNS lookup itself.

Only change the settings on http://192.168.1.1/internet.html#sub=dns from the Gigabox doesn’t save your privacy!

Infrastructure, Routing Latency, and Network Stability

DNS resolution performance directly impacts the responsiveness of web browsing, gaming startup handshakes, and application connection times. For classic TCP-based connections, the mathematical expression for the total time required to establish a secure connection, T_total, is:

T_total = T_dns + T_tcp + T_tls

Where T_dns represents DNS lookup latency, T_tcp represents the TCP handshake duration, and T_tls represents the cryptographic handshake time (though modern HTTP/3 over QUIC combines the transport and cryptographic handshakes into a single round trip). A slow recursive resolver increases T_dns, delaying the entire network handshake.

Anycast Topology and Peering Infrastructure

Public DNS resolvers utilize Anycast routing, announcing the same IP address pool from multiple physical data centers globally. BGP routing protocols then direct the client’s DNS query to the topologically nearest active node.

Performance Variable	Quad9 Anycast System	Vodafone Internal ISP DNS
Anycast Node Deployment	Globally distributed 230+ Resolver Clusters in over 110 countries	Concentrated within regional ISP network hubs
Peering Presence (Ireland)	Direct INEX peering via PCH AS42	Local gateway peering within AS15502
Uptime & Redundancy	High; queries automatically route to adjacent nodes if local servers fail	Dependent on the availability of local ISP recursors
Average Global Latency	~21 ms (DNSPerf global average)	Highly dependent on the local subscriber loop
EDNS Client Subnet (ECS)	Disabled on standard tier; may cause sub-optimal CDN routing	Not verified from public Vodafone documentation

Quad9 partners with Packet Clearing House (PCH), which maintains DNS nodes across many Internet Exchange Points globally. PCH’s AS42 joined the Internet Neutral Exchange Association (INEX) in 2009. It peers with a 10 Gbps port at Equinix DB2 Kilcarbery, Dublin, assigning IP addresses 185.6.36.60 and 2001:7f8:18::60. This can allow Irish networks with favourable routing or peering to reach Quad9 with very low latency. Vodafone Ireland (AS15502) handles massive IP space. Because its default recursive servers sit directly inside the subscriber’s broadband access path, they can resolve cached records with minimal latency. However, Vodafone’s DNS relies on localized routing and lacks the globally distributed redundancy of a multi-node anycast network. If a local recursor fails, standard fallback relies on the secondary server, which may still be affected by local network congestion. Standard Quad9 9.9.9.9 strips ECS to protect privacy, which can cause some CDNs to make less optimal routing decisions. Vodafone IE’s DNS may provide strong local routing for content providers, but its ECS behaviour is not verified from public Vodafone documentation.

How to Actually Use Quad9 with DoT or DoH

Quad9’s official documentation is available at docs.quad9.net. Their recommended secure service is 9.9.9.9, which provides DNSSEC validation and threat blocking. But just like I mentioned above, simply using Quad9 over plain port 53 on your router will not hide DNS lookups from your ISP. To protect the DNS query itself, use DoH or DoT.

For encrypted DNS, the important hostname is:

dns.quad9.net

If your device does not support DoH or DoT natively, such as some ISP routers, using Quad9’s secure resolver addresses is still useful for DNSSEC validation and threat blocking, but it will not encrypt the DNS traffic:

IPv4: 9.9.9.9, 149.112.112.112
IPv6: 2620:fe::fe, 2620:fe::9

For most people, DoH is the safer default choice on laptops and phones because it is less likely to be blocked on guest Wi-Fi. DoT is great on networks you control, such as your home Wi-Fi or a router you manage.

Android 9 and later

Android has built-in DNS-over-TLS support through Private DNS:

Open Settings.
Search for Private DNS.
Select Private DNS provider hostname.
Enter dns.quad9.net.
Tap Save.

Quad9 notes that Android’s Private DNS will not be used while a VPN is active, and it may conflict with the Quad9 Connect app if that app is installed and enabled.

iPhone, iPad, and macOS

For iOS 14+ and macOS Big Sur+, Quad9 provides downloadable encrypted DNS profiles. Their docs recommend DNS-over-HTTPS for most users, especially on guest Wi-Fi or networks you do not control. DNS-over-TLS is better suited to networks where you know port 853 is allowed.

The basic process is:

Open Quad9’s official setup guide in Safari.
Download the 9.9.9.9 HTTPS profile for DoH, or the 9.9.9.9 TLS profile for DoT.
Open Settings / System Settings and install the downloaded profile.
Remember that Apple’s encrypted DNS profiles expire; Quad9’s current documentation says the profiles expire on 19 January 2027, so future-you may need to install a fresh one.

Quad9 also notes that iCloud Private Relay, many VPN clients, and tools like Little Snitch may ignore or override the DNS profile.

Windows 11

Windows 11 can use DNS-over-HTTPS directly from network settings:

Open Network and Internet Settings.
Select your active Wi-Fi or Ethernet connection.
Click Edit next to DNS server assignment.
Change it from Automatic (DHCP) to Manual.
Enable IPv4 and enter:
- Preferred DNS: 9.9.9.9
- Alternate DNS: 149.112.112.112
Set DNS over HTTPS to On (automatic template) for both.
If you use IPv6, also enter:
- Preferred DNS: 2620:fe::fe
- Alternate DNS: 2620:fe::9
Save the settings.

Quad9’s Windows guide also warns that VPNs usually ignore system DNS settings. If you use a VPN, configure Quad9 inside the VPN client’s Custom DNS settings instead.

Check if it worked

After setting it up, visit on.quad9.net.

Quad9 uses this page to confirm whether your device is using Quad9. On Windows, Quad9’s documentation also suggests checking the protocol with PowerShell:

Resolve-DnsName -Type txt proto.on.quad9.net.

If the result says doh, congratulations: your DNS is wearing a tiny encrypted trench coat.

TIP

If you’re using a proxy, make sure to configure Quad9 inside the proxy client’s Custom DNS settings instead of relying solely on system DNS settings. Depending on how your proxy handles DNS routing (particularly on macOS or with certain split-tunnel configurations), you may see DNS traffic routed through both your proxy tunnel and local resolvers, which can look like a DNS leak to privacy checkers or connection logs.

This commonly happens on desktop systems like macOS if the proxy client does not capture all resolver scopes. On mobile operating systems like iOS and Android, system-level encrypted DNS (such as Android’s Private DNS or Apple DNS profiles) is generally bypassed or suppressed in favour of the active VPN tunnel.

And if it does not work the first time, don’t panic. DNS is just the internet’s phonebook, and like every phonebook, sometimes it has been left under a router, behind a sofa, guarded by a very confused cat.

One last thing

Encrypted DNS is not the same thing as full browsing anonymity. Even with DoH or DoT, your ISP can still see destination IP addresses, connection timing, traffic volume, and sometimes the hostname exposed through TLS metadata such as SNI. Encrypted Client Hello (ECH) is designed to hide more of that TLS handshake metadata, but it only works when both your browser and the website/CDN support it. You can check whether your browser is using ECH with Cloudflare’s trace page or test.defo.ie.

But this is for another story.

Everyone should start using a VPN or Proxy

Sat, 25 Apr 2026 00:00:00 GMT

A VPN secures your traffic even on untrusted networks, while an obfuscated proxy bypasses strict VPN blocks, giving you unrestricted access to the open web.

If you have watched this video, you might start worrying about how to stop your ISP from finding out more about you than your mum does. Even with ECH to secure the SNI (you can test it on this Cloudflare website), you still can’t prevent ISPs or Wi-Fi owners from recording, or even hijacking your internet traffic. Not to mention that some internet services are still only supporting HTTP traffic until 2026 (This is pure criminality).

So, what’s the big deal? Someone might ask. Well, it’s not a big deal as long as you don’t mind your personal interests being “accidentally” sold to ads companies, or your personal information being stolen by hackers harvesting credentials from individuals who connect to fake Wi-Fi networks, just like what happened in Australian 2 years ago. I could talk for hours about the dangers of leaking your internet traffic to a third party, which could end up in the hands of criminals. However, that is not the purpose of this blog. Here, I want to introduce how to protect yourself from internet tracking using a VPN, and a self-hosted proxy with obfuscation capabilities.

For most non-tech users, the easiest way to use a VPN is to purchase the service from a commercial company. If you are not familiar with VPN, I strongly recommend reading this article, which explains it from scratch and clarifies a lot of misunderstandings such as using a VPN alone does not provide anonymity, and it’s also fun to read.

However, using a VPN means that you are placing your trust in the hands of VPN companies rather than ISPs, which could also be dangerous if the company does not have a good reputation or reliable technology. So, choosing a VPN provider is the only thing the average user needs to consider.

In today’s increasingly mature VPN market, almost all major providers use similar technologies—such as WireGuard or OpenVPN. These are tried-and-tested, reliable encryption technologies that are perfectly adequate for general use. When there is little difference in technical ability, from my personal experience, the most important thing is to never use a free one, whether they claim to be supporting digital human rights or have a grand vision for the future of the company. Nerver, ever use a VPN for free, otherwise, your worth will be measured in a different way. Just like Mullvad said in its official FAQ:

“Free” services nearly always come at some cost, whether that be the time you spend watching an intro ad, the collection of your data, or by limiting the functionality of the service.

Another key consideration is reputation and whether the company has withstood scrutiny by the judicial system. A good reputation means that the company has experience in dealing with hackers who try to exploit vulnerabilities in its systems to access customers’ personal data, and undergoes regular audits by third party organisations. Having withstood scrutiny by the judicial authorities is another excellent “badge of honour”, signifying that even state-level measures were unable to extract any meaningful user information. If you search for related news using a search engine or AI, you will find that there are not many companies with this kind of “badge of honour”.

Up to this point, the VPN has appeared to be unrivalled. But hang on a sec, the VPN also has its limitations, particularly when it comes to targeted measures, for instance, the firewall. Because VPN traffic is so easily identifiable, a network administrator can easily block any connection encrypted via a VPN if they so wish. The Chinese, Iranians and Russians know this all too well. However, apart from them, even those living in the free Western world face the same predicament. If you have used a public Wi-Fi network in a place like a college or coffee shop, you may have noticed that some VPN services are unable to connect in such environments. That’s probably because the Wi-Fi provider is blocking specific traffic protocols or common VPN ports. This situation is usually even more frustrating, not only does it mean that your internet service provider can monitor everything you do, but they can also block access to websites, IP addresses or even network ports that they don’t want you to visit. When the VPN can do nothing about this and strong encryption is not your first priority, the proxy with obfuscation capabilities comes into play.

Shadowsocks-rust and Project X were created for this very purpose, both are highly reputable, open-source, and considered “gold standard” tools within the network proxy and anti-censorship communities. I have used them for many years and they have never failed me. That’s why I wrote a shell script for them, to simplify the process of building a proxy server on a VPS deployed by Docker.

Script Menu

What are the differences, and which one should you choose?

Shadowsocks

It’s a lightweight, rock-solid, and fast proxy for general privacy or bypassing simple blocks without the overhead of complex protocols. I specifically chose SS-2022 as the protocol to enhance modern security, and it makes traffic appear as a random, featureless stream of unknown TCP/UDP bytes to an ISP or network administrator. Most ISPs and administrators wouldn’t care about this unknown traffic, and you can bypass their VPN restrictions. If you set the proxy port to a commonly used port, such as 80 or 443, you can further increase your chances of bypassing the restrictions.

Xray

If you live in China, Iran or Russia, or if your ISP restricts unknown traffic and only allows HTTPS/TLS connections (as is common when using Wi-Fi provided by a library or college), then you will need to choose Xray, which is a slightly more complicated but more powerful proxy tool. Don’t worry, I’ve made it as easy as possible to reduce the number of steps in the setup process in my script.

Xray provides several ways to bypass detection and restrictions using obfuscation. I specifically opted for the VLESS-XHTTP-REALITY method. The best part about it is that the only thing you need to prepare is a VPS or a remote Linux server that runs 24/7 with no network restrictions. No domain or certificates are needed, and you can “steal” another website’s domain to make it look like your traffic is connecting to that domain via HTTPS! In reality, however, your traffic is encrypted from your local machine to the proxy server and then on to the target website or internet service that you want to visit. The only tricky part is that you have to find a website that can be visited directly from the local network without a proxy. That website also needs to meet some requirements. I have listed the details in my GitHub repository.

TIP

If you want to pursue ultimate proxy camouflage, there is a technique revered in the Xray community as the “perfect answer”, borrowing a neighbor’s domain. Instead of using famous public domain names, you can follow below methods to tailor a domain specifically for your proxy server.

SHODAN

Open SHODAN
Replace the IP address below with your own and search.
```
net:"your-ip-address/22" port:443 ssl.version:TLSv1.3
```
Select a normal website and run test scripts on your proxy server directly.

bgp.tools

Open the website: bgp.tools
Enter your VPS’s public IP in the search box and press Enter.
Click the DNS tab, then check “Remove auto generated reverse DNS entries”.
You will now see a large list of other domain names located in the same data center and subnet as your VPS.
Select a normal website and run test scripts on your proxy server directly.

HE

Enter your VPS IP address at HE
Click on the IP address that looks like x.x.x.0/22 under Announcement.
Click the DNS tab.
Select a normal website and run test scripts on your proxy server directly.

Why bother?

Because these websites reside in the same data centre, or even on the same rack cabling, as your VPS. When Xray’s core “borrows” its TLS certificate and handshake characteristics, latency is under 1 ms. Furthermore, from the perspective of the network administrator, the physical network routing of your VPS traffic matches that of the legitimate neighbor site, maximising camouflage.

Before entering the domain name into your proxy.sh script, make sure to avoid redirects: If you enter example.com and it automatically redirects to www.example.com or example.com/en/, make sure to put the final redirected full domain into your script.

Remember that the risks of hosting your own proxy server on a cloud server owned by a business are the same as using a VPN from a commercial company, you are putting your trust in the VPS provider instead of your local ISP. This means that you have to trust the VPS provider not to sell your data to others, either intentionally or unintentionally.

References

The weird (?) dream

Fri, 17 Apr 2026 00:00:00 GMT

Or should I be happy about it?

This image was generated by AI and is not intended to imply anything

I had a really weird dream yesterday. I was in a random supermarket and when I went to the self-checkout, a guy helped me scan all my items (which is highly unlikely in real life). However, he miscounted them and the machine showed an absurdly high charge. I pointed out the mistake and yelled at him (something I would never do in real life), but he didn’t seem to care at all.

I had no choice but to find the manager and explain everything that had happened. The manager was reasonable and allowed me (so weird!) to correct the count. After that, I happily went back to pick out some new items with the guy who had miscounted them (Yes, that’s how dreams work 😂 — they make no sense at all).

But the weirdest part isn’t any of that. When I woke up, I realised that everything that had happened in my dream had been in English. For context, my native language is Mandarin. Until last night, I had only ever dreamt in my native language.

Pretty insane, isn’t it?

This is my third year in Ireland. I suppose that’s just the power of the environment.

yt-dlp: Video Downloader with Open-Source GUI

Tue, 17 Mar 2026 00:00:00 GMT

How to use yt-dlp to download videos from YouTube and thousands of other sites, with a simple and lightweight graphical user interface.

In this previous blog, I introduced you to FFmpeg, and now I’m going to introduce you to another excellent open-source tool: yt-dlp.

yt-dlp is a feature-rich command-line audio/video downloader with support for thousands of sites.

You can use it for all sorts of things, but the feature you’ll probably use most often is downloading videos or audio from YouTube to your archive, given the crazy censorship on YouTube these days. If you want to save a video that disappears within a few hours of being uploaded, give yt-dlp a go!

First, install it using Homebrew:

brew install yt-dlp

Common Commands

Here are some commands I usually use:

Download the best quality available (Standard):

yt-dlp --cookies-from-browser brave 'URL'

List all available formats for a video:

yt-dlp -F --cookies-from-browser brave 'URL'

Download a specific format (e.g., format 299+140):

yt-dlp -f 299+140 --cookies-from-browser brave 'URL'

Download all available subtitles without downloading the video:

yt-dlp --write-subs --write-auto-subs --sub-langs all --skip-download 'URL'

Download and merge into an MP4 container (FFmpeg is required):

yt-dlp --merge-output-format mp4 --cookies-from-browser brave 'URL'

TIP

To download videos from YouTube, it is better to use your browser’s cookies (e.g., Brave, Firefox, or Chrome) to increase the success rate; using --cookies-from-browser brave allows yt-dlp to bypass bot detection and access age-restricted content by using your browser’s session. However, this is usually not necessary for other platforms like X or Vimeo.
If you want to use Safari’s cookies on macOS, you must grant Full Disk Access to your terminal emulator (e.g., Terminal or iTerm) or GUI app in System Settings > Privacy & Security > Full Disk Access, as Safari’s cookie database is protected by macOS security policies.

However, as I used it more and more, I increasingly felt that using the command line wasn’t a convenient option. So, since laziness is the mother of invention, I decided to write my own Electron-based GUI to free myself from the command line for some of my simple, routine tasks.

And this is it, the YT-DLP Downloader.

This is a user-friendly desktop application for downloading videos from YouTube and other supported platforms. It uses yt-dlp for download, and FFmpeg to change the format or add subtitles. But this app itself doesn’t bundle yt-dlp and FFmpeg, since they rely heavily on aggressive upgrades. I don’t want to upgrade my app every time they release an upgrade. This means that the main advantage of this app is that it only calls the yt-dlp or FFmpeg that are already installed on your system when needed. Every time you upgrade your dependencies, it will use the latest version seamlessly. The downside is that this app is useless without dependencies. But I’m sure that won’t be a problem if you’re a fan of my blog ;-)

This is what the app looks like:

The most basic way to use it is to enter a website address (I’ll use https://www.youtube.com/watch?v=dQw4w9WgXcQ as an example), select which browser to retrieve cookies from (or skip this step), click the “Choose” button to select a download folder, and finally click the blue “Run” button and wait for the process to complete. It’s that simple!

Advanced Actions

Here are some slightly more advanced Actions:

List Formats

It will show all the audio and video formats that you can download from the source. After that, you can select the “Download (Custom Format)” Action to specifically combine the audio and video tracks.

Download Subtitles

For the Download Subtitles, it allows you to download not only subtitles uploaded by creators themselves, but also subtitles automatically generated by YouTube. It also tells you whether the downloaded subtitles were uploaded by the author or generated automatically. Pretty smart, isn’t it?

Download & Re-encode as high quality MP4 (H.264/AAC)

The Download & Re-encode as high quality MP4 (H.264/AAC) Action is for compatibility. Today, a large number of videos on YouTube use the av01 and opus codec, but many people’s older devices or software are unable to decode these fancy new formats. So if you want to share downloaded videos with friends and ensure they can watch them properly, you might find this feature useful. However, for most people, you can simply ignore it.

Download & Add Hardsub

At last, the Download & Add Hardsub Action is the very reason I developed this GUI. It allows you to download videos and subtitles with a single click, converting the video into an H.264 or HEVC file with hardcoded subtitles. This means the subtitles are burned directly into the video frames, rather than requiring manual loading like external subtitle files, ensuring they will always appear in the video.

By default, it uses VideoToolbox for hardware acceleration on macOS.

The “Check for Dependencies” button in the lower-right corner automatically checks whether Homebrew, yt-dlp, and FFmpeg are installed on your macOS. If they are not installed, it also provides a one-click installation feature. If this is your first time using this GUI, or if you’re using it on a brand-new system, you’ll want to click on it to test it out before you start.

The “Check for Updates” button in the bottom-left corner lets you see if I’ve released a new version on GitHub (Yes, I still occasionally optimise or add new features so I can enjoy life with even less effort.) If there is a new version, you’ll be asked if you want to open the latest releases page in your default browser (of course, you can also click this link to download it).

BTW, this blog is not affiliated with Apple. It’s just that I happen to like using their products.

The Rise, Fall, and Resurrection of JPEG XL

Thu, 05 Mar 2026 00:00:00 GMT

The story of JPEG XL's rollercoaster journey, and how you can embrace it on macOS.

If you’ve read my previous blog post, you may have noticed something odd, namely, broken images. That’s because I used the .jxl format, which most browsers don’t support out of the box.

Go directly to the section on how to display JXL images in your browser

My interest in JPEG XL began when I wrote a research paper on image compression during my graduate studies. While I was impressed by JPEG XL’s capabilities, I was astonished by how few mainstream browsers supported it at the time. Today, I finally have the chance to share the dramatic saga of JPEG XL.

Act I: The Contender Arrives

The year is 2020. The world of image formats is a battlefield. WebP, Google’s scrappy challenger, has been fighting for years to dethrone the ancient JPEG. PNG holds the lossless throne. And then, from the halls of the Joint Photographic Experts Group and the ashes of two competing proposals (Google’s PIK and Cloudinary’s FUIF, an evolution of FLIF), a new format is born.

JPEG XL.

It was, by any technical measure, a marvel. It offered:

Superior compression to JPEG, WebP, and AVIF in some scenarios
Lossless and lossy modes
HDR and wide color gamut support
Lossless JPEG recompression — the killer feature that could shrink every JPEG on the internet by ~20% without touching a single pixel
Progressive decoding, so images could load beautifully even over slow connections

The web community held its breath. Could this be the one?

Act II: The Google Guillotine

Chrome shipped JPEG XL support behind a flag in 2021. Developers experimented. Photographers rejoiced. Advocates wrote breathless blog posts. The momentum felt real.

Then, in October 2022, the axe fell.

Google filed a Chromium bug — not to fix JPEG XL, but to remove it. The reasoning offered was thin and, to many, deeply suspicious: there wasn’t “enough interest” from the ecosystem, and AVIF (a format Google had heavily invested in) supposedly covered the use cases.

The backlash was immediate and volcanic. The bug tracker became a war zone. Hundreds of developers, photographers, and engineers flooded the comments with technical arguments, pleas, and barely-concealed fury. The thread grew to become one of the most commented issues in Chromium’s history.

Critics smelled a rat. Google had a vested interest in AVIF — it was derived from the AV1 video codec, which Google co-developed. JPEG XL threatened it directly. Was this a technical decision, or a corporate one?

Google didn’t blink. In January 2023, Chrome’s support was removed.

Act III: The Wilderness

JPEG XL was now in the desert. Chrome — which commands over 60% of the browser market — had slammed the door. Without Chrome, web developers couldn’t use the format. Without web developers, there was no ecosystem. Without an ecosystem, what was the point?

The format seemed doomed to join the graveyard of “technically superior formats that lost anyway” — a cemetery already crowded with headstones.

But something unusual happened in that wilderness.

The community refused to bury it.

The Chromium bug thread kept growing. Open-source advocates kept maintaining encoders like cjxl. The format’s spec was finalized. And critically — other browsers were watching.

Act IV: The Faithful Hold the Line

Safari had quietly shipped JPEG XL support in 2023 and kept it. While Apple is also a member of the Alliance for Open Media (supporting AVIF), they chose to support both formats. This gave JPEG XL a crucial lifeline.

Firefox sat on the fence. It had supported JPEG XL in its Nightly builds since version 90.0a1 in May 2021, but locked it behind the image.jxl.enabled flag in about:config. For years, they cited Chrome’s decision as a reason to wait, keeping the door open but the feature firmly opted-in only.

Meanwhile, the JPEG XL advocates did something remarkable: they built the case methodically and publicly. Benchmarks were published. Real-world use cases were documented. The lossless JPEG recompression argument — imagine shrinking the internet’s collective JPEG archive by 20% for free — gained new attention as bandwidth costs climbed.

The format found passionate homes in photography communities, archivists, and HDR content creators who needed what nothing else could offer.

Act V: The Tide Turns

The dam began to crack. Operating system support broadened when Microsoft added JPEG XL decoding to Windows 11 via an official extension, bringing support to the Photos app and File Explorer.

Then came the moment nobody had quite predicted: the CDN and infrastructure giants started caring. Cloudflare, Cloudinary, and others began supporting JPEG XL delivery, quietly building the ecosystem that Google said didn’t exist.

As of March 2026, Firefox is on the precipice. While stable, beta, and developer editions still don’t support it by default, Mozilla is actively integrating a new Rust-based decoder jxl-rs. The implementation is pending, but the groundwork for full support in a future stable release is being laid.

And then — slowly, without fanfare — Google itself began to reconsider. With the web ecosystem shifting, with Safari aligned and Firefox laying the foundation, with tooling maturing, the pressure on Chrome became harder to ignore.

Epilogue: An Unfinished Story

As of today, JPEG XL is not yet universal. Default support in Chrome remains the missing piece that would truly complete the story. But the format is very much alive, supported natively in Apple’s ecosystem (macOS, iOS, Safari), available behind experimental flags in Firefox and Chrome, embraced by major CDNs, and living in countless tools.

The story of JPEG XL is ultimately a story about who controls the web’s infrastructure and whether technical merit alone can survive corporate headwinds. It’s a story about a community that refused to accept a burial decree, that kept writing code and making arguments until the ground shifted.

JPEG has survived for over 30 years. Its successor, it seems, may be just stubborn enough to do the same.

The arc is long. But it bends toward better compression.

If you’ve read this far, I’m guessing you’re quite interested in embracing JPEG XL. In the following section, you’ll learn how to actually use it on macOS.

First, let’s install the JPEG XL command-line tools (cjxl and djxl) on your Mac using Homebrew:

Install Homebrew

/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"

Install JPEG XL tools

brew install jpeg-xl

(Or via MacPorts: sudo port install libjxl)

Basic Conversions in Terminal

Once installed, you can use the command-line tools cjxl (to encode/compress) and djxl (to decode/decompress).

Convert a JPEG to a JXL:

cjxl input.jpeg output.jxl

(Or cjxl input.jpg output.jxl)

If you ever need that exact same .jpg file back (for an old app or for “bit-for-bit” proof), you use the decoder tool djxl:

djxl output.jxl restored.jpeg

(Or djxl output.jxl restored.jpg)

To verify it worked, you can check their MD5 hash (a digital fingerprint). If the fingerprints match, the files are bit-for-bit identical:

md5 input.jpeg restored.jpeg

Convert a PNG file:

cjxl input.png output.jxl

TIP

If you want it to be mathematically, pixel-perfectly lossless (exactly like your PNG but highly compressed and smaller), use the -d (distance) flag set to 0:

cjxl input.png output.jxl -d 0

The Ultimate Shortcut: Right-Click Finder Actions

For greater convenience, you can use macOS’s built-in Shortcuts app to turn these command-line operations into Quick Actions in the Finder’s right-click menu, meaning you never have to open the Terminal again.

Step 1: Create the Shortcut

Open the Shortcuts app on your Mac.
Click the + (plus) icon to create a new shortcut.
In the right-hand sidebar, click the Shortcut Details icon (the small “i” in a circle) and check the box “Use as Quick Action”.
Ensure “Finder” is selected under the Quick Action settings.
At the top of the main window, change the input to: “Receive Images from Quick Actions.”

Step 2: Add the “Run Shell Script” Action

Search for the “Run Shell Script” action in the sidebar and drag it into the shortcut.
By default, macOS disables scripting actions for security to prevent untrusted scripts from running automatically. You just need to flip a single toggle in the Shortcuts app settings:
- Open Settings: Click on the “Open Preferences” button directly in that error message, or go to the menu bar and select Shortcuts > Settings.
- Go to Advanced: Click on the Advanced tab.
- Enable Scripts: Check the box that says Allow Running Scripts.
Set the shell to /bin/zsh.
Set Pass Input to as arguments.
Fill in the code with the script below:

# Include MacPorts and Homebrew (ARM/x86) paths
export PATH="/opt/local/bin:/opt/homebrew/bin:/usr/local/bin:$PATH"
CJXL_PATH="$(command -v cjxl)"

# Check if cjxl is installed
if [ -z "$CJXL_PATH" ]; then
    osascript -e 'display alert "cjxl not found" message "Please make sure JPEG XL tools are installed (via `brew install jpeg-xl` or `sudo port install libjxl`)."'
    exit 1
fi

for f in "$@"
do
    # Skip if already a JXL image
    [[ "$f" == *.jxl ]] && continue

    # Create the output filename by replacing the extension
    output="${f%.*}.jxl"

    # Run the basic conversion
    "$CJXL_PATH" "$f" "$output"
done

Step 3: Try it out

Name it something like “Convert to JXL”, it should look like this:
Close the Shortcuts app.
Go to your Finder and select any image (PNG, JPG, etc.).
Right-click the image, go down to Quick Actions, and click Convert to JXL.

You may see a pop-up window the first time you run it:
“cjxl” would like to access files in your Downloads folder.
Just choose Allow this time and you will never see it again.
A small gear will spin in your menu bar, and seconds later, a highly-compressed .jxl file will magically appear in the same folder as your original image.

TIP

Troubleshooting: Quick Action not showing up?
Sometimes on newer Macs, the Quick Actions won’t appear in the right-click menu immediately. To fix this:

Check your settings: Click the Customize… button in the Quick Actions menu, and make sure the new Shortcut is checked.
Relaunch Finder: Hold the Option (⌥) key, right-click the Finder icon in your Dock, and click Relaunch. Your new action should now appear!

How to Enable JPEG XL in Your Browser

Right now, Safari supports JPEG XL natively out-of-the-box on recent Apple devices. However, if you’re on Chrome, Brave, or Firefox, you can manually enable experimental flags to view JPEG XL images while default support continues to roll out.

Google Chrome & Brave

Open a new tab in your browser.
In the address bar, type chrome://flags (for Chrome) or brave://flags (for Brave) and press Enter.
In the search bar at the top of the page, type jxl.
Locate the flag titled Enable JPEG XL image format (or #enable-jxl-image-format).
Click the dropdown menu next to it and change it from Default to Enabled.
Click the Relaunch button to restart your browser.

Mozilla Firefox

Open a new tab and type about:config in the address bar. Press Enter.
If prompted with a warning, click “Accept the Risk and Continue”.
In the search box, type image.jxl.enabled.
Double-click the entry (or click the toggle button) to change its value from false to true. (Alternatively, in recent versions, you can enable JPEG XL directly under Settings > Firefox Labs.)
Restart your browser.

References

Jebaraj, S. D., & N, S. (2023). JPEG-XL based Compression of DICOM Images for Reduced Storage and Transmission Costs. 2023 3rd International Conference on Intelligent Technologies (CONIT), 1–6.
https://doi.org/10.1109/conit59222.2023.10205928
Öztürk, E., & Mesut, A. (2021, September 1). Performance Evaluation of JPEG Standards, WebP and PNG in Terms of Compression Ratio and Time for Lossless Encoding. IEEE Xplore.
https://doi.org/10.1109/UBMK52708.2021.9558922

Blücher: Procedural Justice or Bureaucracy?

Thu, 26 Feb 2026 00:00:00 GMT

A review of a Norwegian film released in 2025.

A low-budget yet high-quality film set during World War II. IMDb

The opening pace of the film is somewhat slow, primarily focusing on the protagonist’s domestic life, yet this effectively sets the stage for the heightened tension that unfolds during the war sequences later on. The battle scenes remain profoundly moving. One is struck by how truly accomplished directors can achieve effects rivalling Hollywood blockbusters on considerably smaller budgets.

WARNING

The following contains spoilers. If you haven’t watched this film yet, I’d strongly recommend doing so before coming back to this blog.

Before watching this film, I had no idea that Bjørn Sundquist, who played Colonel Birger Eriksen (the commander of Oscarsborg Fortress who made the pivotal decision to open fire on the German heavy cruiser Blücher despite lacking clear orders), was such a talented actor. Especially in this scene:

Eriksen made the difficult decision to surrender to the German forces

In this brief, about one-minute close-up of his face, lead actor Bjørn Sundquist masterfully conveys complex emotions that encapsulate the entire film’s tone. Much like the actor portraying the Joker in the second installment of Nolan’s Batman trilogy, it’s hard to imagine anyone surpassing his performance.

Though the battle scenes were few, they were thoroughly thrilling. Especially when the shells struck the German warship — it even gave me the illusion of being right there in the thick of it.

The German heavy cruiser Blücher was hit by a 280mm Krupp gun

Yet, what truly caught my attention in the plot, however, was not the combat scenes, but the Norwegian government’s accountability measures against Colonel Eriksen. Admittedly, he rashly ordered an attack without sufficient intelligence; admittedly, he surrendered to the Germans without any casualties in his troops despite orders to hold the fortress as long as possible, and signed the surrender document; admittedly, he must explain for this. But this does not mean the Norwegian government can take the high ground, shift all responsibility onto the colonel, and evade accountability itself. Is this accountability procedural justice? Undoubtedly. But is it fair? Clearly not. If the colonel is to be held accountable, then the incompetent, inept, and irresponsible government that was merely occupying positions without fulfilling its duties at the time should be held even more accountable.

It is heartening that director Daniel Fahre has masterfully captured this bureaucracy — a term originating in Europe — on film, preserving it for posterity and prompting profound reflection on this chapter of history.

So let’s return to the blog title: Was the Norwegian government’s accountability back then procedural justice or bureaucracy? I believe it was both.

FFmpeg: The Ultimate Cross-Platform Video Tool

Thu, 19 Feb 2026 00:00:00 GMT

Why FFmpeg is my daily driver for video/audio processing and a collection of useful commands.

I’ve always maintained that only cross-platform software merits long-term commitment. Final Cut Pro is indeed formidable, and Adobe’s suite is undeniably capable, but neither runs natively on every operating system. Once you’ve grown accustomed to them, you’ve effectively tied yourself to the systems they run on. Departing from a particular platform means abandoning these familiar tools, significantly increasing your sunk costs.

But fear not, FFmpeg covers our asses.

I started using it by processing some simple tasks, such as trimming the duration of video or audio clips, extracting segments, merging multiple clips, changing the format of videos (e.g. .mkv to .mp4) to make them more compatible with different devices, re-encoding video and audio (e.g. H.264 to HEVC or Opus to AAC), compressing videos, changing their resolution and burning subtitles into videos.

These tasks are a daily driver for me at certain times, but they are not worth processing by launching a large app like Final Cut Pro. After some time of learning and hands-on practice, I’ve compiled a list of frequently used commands for reference.

1. Basic Trimming

Trimming a video without re-encoding is extremely fast as it simply copies the compressed data without decoding.

Keep everything from 10 minutes onwards:

ffmpeg -t 00:10:00 -i input.mp4 -c copy output.mp4

Extract a 20-minute segment starting from 10:00:

ffmpeg -ss 00:10:00 -i input.mp4 -t 00:20:00 -c copy output.mp4

Trim the first 20 minutes:

ffmpeg -ss 00:20:00 -i input.mp4 -c copy output.mp4

TIP

Stream copying (-c copy) can only cut on keyframes (I-frames / IDR frames). If 10:00 is not an exact keyframe, FFmpeg seeks to the nearest preceding keyframe, which may make the output start slightly earlier or cause brief frozen frames in some video players. For frame-accurate cutting down to the millisecond, re-encode by removing -c copy.

If you want to change the minutes or seconds, simply adjust the numbers in the command. However, if the time exceeds 1 hour, use the format HH:MM:SS (e.g., 1:10:00 instead of 70:00).

2. Merging and Concatenation

If you have multiple clips with the same parameters (resolution, codec, etc.), you can merge them using the concat demuxer.

Merge clips listed in merge.txt:

ffmpeg -f concat -safe 0 -i merge.txt -c copy output.mp4

merge.txt should contain lines formatted as file 'input.mp4'. You can download a template here.

Merge clips without a text file (Shell inline list):

ffmpeg -f concat -safe 0 -i <(printf "file '%s'\n" input1.mp4 input2.mp4) -c copy output.mp4

On macOS or Linux (zsh/bash), process substitution (<(...)) feeds the file list directly from memory. This saves you from creating a physical merge.txt file on disk while keeping the blazing-fast, lossless stream copy (-c copy). All clips must still have identical codecs and parameters.

Merge clips with different parameters (concat filter):

ffmpeg -i input1.mp4 -i input2.mp4 -filter_complex \
"[0:v][0:a][1:v][1:a]concat=n=2:v=1:a=1[v][a]" \
-map "[v]" -map "[a]" output.mp4

Unlike the concat demuxer, the concat filter decodes and re-encodes the streams. This eliminates the need for an external file and seamlessly handles clips with different resolutions, framerates, or codecs, though it will take longer to encode.

Side-by-side comparison with audio (1080p, High Quality):

ffmpeg -i input1.mov -i input2.mp4 -filter_complex \
"[0:v]fps=60,scale=-2:1080[v0]; \
 [1:v]fps=60,scale=-2:1080[v1]; \
 [v0][v1]hstack=inputs=2[v]" \
-map "[v]" -map 1:a -c:v libx264 -crf 19 -preset medium -c:a aac -b:a 129k -pix_fmt yuv420p -shortest output_side_by_side_hq.mp4

Scales both inputs to 1080p height and places them side-by-side horizontally using hstack. It retains the audio track from the second video (-map 1:a), balances high quality with reasonable file size (-crf 19), and trims output to the shorter video (-shortest).

Side-by-side comparison for desktop / text clarity (1800p, Near-lossless):

ffmpeg -i input1.mov -i input2.mp4 -filter_complex \
"[0:v]fps=60,scale=-2:1800:flags=lanczos[v0]; \
 [1:v]fps=60,scale=-2:1800:flags=lanczos[v1]; \
 [v0][v1]hstack=inputs=2[v]" \
-map "[v]" -an \
-c:v libx264 -crf 12 -preset veryslow \
-x264-params "no-deblock=1:aq-mode=3:qcomp=0.8" \
-pix_fmt yuv420p -shortest output_ultra.mp4

Ideal for screen recording comparisons where text and UI sharpness matter. It scales to 1800p using the sharper lanczos algorithm, strips audio (-an), and disables in-loop deblocking (no-deblock=1) with -crf 12 to prevent fine UI details and fonts from being smoothed out.

3. Encoding for Compatibility

Sometimes you need to ensure a video plays everywhere (QuickTime, Safari, iOS, smart TVs, and web browsers) by using standard H.264 settings with 8-bit YUV 4:2:0 chroma subsampling.

High-quality H.264 re-encode for universal playback and storage:

ffmpeg -i input.mp4 -c:v libx264 -crf 18 -preset veryslow -pix_fmt yuv420p -c:a aac -b:a 129k -tag:v avc1 output.mp4

TIP

Use this carefully, this performs CPU-heavy software encoding. While -crf 18 with -preset veryslow delivers near-lossless visual quality, it can be quite slow. For everyday use, -crf 23 with -preset medium provides an excellent balance of speed and quality. The -pix_fmt yuv420p flag is critical: without it, sources with 10-bit color, 4:4:4 chroma, or RGB color (common in screen recordings and image sequences) will produce high-profile streams that Apple devices and web browsers cannot play.

4. Burning Subtitles (Hardsubs)

Burning subtitles directly into the video stream ensures they show up on any player.

Basic subtitle burn-in:

ffmpeg -i input.mp4 -vf "subtitles=subtitle.srt" -c:a copy output.mp4

TIP

When declaring filters, it is better to quote the entire filter string, i.e., -vf "subtitles=subtitle.srt" rather than -vf subtitles="subtitle.srt". This ensures the shell correctly passes the entire string as a single argument to the -vf option.

Burn subtitles with spaces in the filename (Best Practice):

ffmpeg -i input.mkv -vf "subtitles='my subtitles.srt'" -c:a copy output.mkv

TIP

If your subtitle filename has spaces or special characters, nest single quotes inside the double quotes holding the filter.

Burn VTT subtitles with a specific font (Songti SC):

ffmpeg -i input.mp4 -vf "subtitles=subtitle.vtt:force_style='FontName=Songti SC'" -c:v libx264 -crf 18 -preset veryslow -pix_fmt yuv420p -c:a aac -b:a 129k -tag:v avc1 output.mp4

TIP

FFmpeg’s subtitles filter also fully supports .srt and .ass formats. While .vtt and .srt may require force_style to look good, .ass files (Advanced SubStation Alpha) can contain their own rich styling, colors, and positioning data which FFmpeg will render perfectly out of the box. Note that Songti SC is a macOS system font, on Linux or Windows, replace it with an installed font such as Noto Serif CJK SC or SimSun.

5. Format Conversion and Optimization

Converting between formats like WebM to MP4 or using modern codecs like HEVC (H.265).

Compress a video to 720p MP4 (H.264) with audio re-encoding:

ffmpeg -i input.mp4 -vf scale=1280:720 -c:v libx264 -crf 23 -preset slow -pix_fmt yuv420p -c:a aac -b:a 129k -tag:v avc1 output.mp4

Compress a video to 10-bit 1080p MP4 (H.265) with original audio codec:

ffmpeg -i input.mp4 -vf scale=1920:1080 -c:v libx265 -crf 28 -preset slow -pix_fmt yuv420p10le -c:a copy -tag:v hvc1 output.mp4

TIP

If you use -vf scale=1280:-2, FFmpeg will fix the width at 1280 and automatically calculate the height to preserve the original aspect ratio while guaranteeing the height is divisible by 2 (avoiding “height not divisible by 2” encoder errors with YUV 4:2:0). The commands above force fixed dimensions (1280:720 or 1920:1080), which will distort the aspect ratio if the input isn’t already 16:9.

6. macOS Hardware Acceleration (VideoToolbox)

If you’re on a Mac, using videotoolbox will significantly speed up the encoding process and save battery.

💡 GPU Compatibility Note

💡 GPU Compatibility Note
Hardware acceleration is split between decoding (reading inputs via `-hwaccel videotoolbox`) and encoding (writing outputs via `-c:v h264_videotoolbox` or `hevc_videotoolbox`). While H.264 and HEVC hardware decode/encode are supported across almost all modern Macs, formats like AV1 hardware decoding are only available on Apple M3 chips or newer. If your Mac does not support hardware decoding for a specific input format, simply omit `-hwaccel videotoolbox`, FFmpeg will decode smoothly on the CPU while still using VideoToolbox for fast hardware encoding.

Hardware acceleration is split between decoding (reading inputs via -hwaccel videotoolbox) and encoding (writing outputs via -c:v h264_videotoolbox or hevc_videotoolbox). While H.264 and HEVC hardware decode/encode are supported across almost all modern Macs, formats like AV1 hardware decoding are only available on Apple M3 chips or newer. If your Mac does not support hardware decoding for a specific input format, simply omit -hwaccel videotoolbox, FFmpeg will decode smoothly on the CPU while still using VideoToolbox for fast hardware encoding.

Fast H.264 and Apple native AAC re-encoding:

ffmpeg -hwaccel videotoolbox -i input.webm -c:v h264_videotoolbox -b:v 5000k -c:a aac_at -q:a 0 -tag:v avc1 output.mp4

Fast 10-bit HEVC (H.265) and Apple native AAC re-encoding:

ffmpeg -hwaccel videotoolbox -i input.webm -c:v hevc_videotoolbox -b:v 3000k -pix_fmt p010le -c:a aac_at -q:a 0 -tag:v hvc1 output.mp4

HEVC and aac_at with Burned Subtitles:

ffmpeg -i input.webm -vf subtitles=subtitle.vtt -c:v hevc_videotoolbox -b:v 2500k -pix_fmt p010le -c:a aac_at -q:a 0 -tag:v hvc1 output.mp4

TIP

When burning subtitles with the subtitles filter, FFmpeg processes frames on the CPU in software memory, so omitting -hwaccel videotoolbox here is expected.

H.264 with Burned Subtitles (Custom Font for Chinese):

ffmpeg -i input.webm -vf "subtitles=subtitle.vtt:force_style='FontName=Songti SC'" -c:v h264_videotoolbox -b:v 4000k -c:a aac_at -q:a 0 -tag:v avc1 output.mp4

HEVC with Burned Subtitles (Custom Font for Chinese):

ffmpeg -i input.webm -vf "subtitles=subtitle.vtt:force_style='FontName=Songti SC'" -c:v hevc_videotoolbox -pix_fmt p010le -b:v 2500k -c:a aac_at -q:a 0 -tag:v hvc1 output.mp4

7. Audio Extraction

Extracting high-quality audio from video files.

Extract audio to M4A without re-encoding (Fastest, Original Quality):

ffmpeg -i input.mp4 -vn -c:a copy output.m4a

TIP

Stream copying (-c:a copy) into .m4a requires the source audio to already be an MP4-compatible format (typically AAC or ALAC). If the video contains Opus, Vorbis, or DTS, re-encode it using the commands below or extract into its native container (e.g. output.opus).

Extract audio to M4A using libfdk_aac re-encoding (VBR scale: 1 - 5, 5 is the highest quality):

ffmpeg -i input.mp4 -vn -c:a libfdk_aac -vbr 5 output.m4a

Extract audio to M4A using aac_at re-encoding (macOS Native, 0 - 14, 0 is the highest quality):

ffmpeg -i input.mp4 -vn -c:a aac_at -q:a 0 output.m4a

TIP

Notice the quality scale direction! Unlike libfdk_aac where 5 is the highest quality, Apple’s aac_at uses a reverse scale where 0 is the highest quality (~192 kbps) and 14 is the lowest. Use 0, 1, or 2 for clean, high-fidelity sound.

Advice for macOS Users (Homebrew & Audio Encoders)

If you find that some of these commands fit your requirements, or if you’re interested in exploring more of what FFmpeg has to offer and are ready to install it on your Mac, here is some practical guidance.

First, an important clarification: you do not need third-party taps just to get high-quality AAC audio on macOS. Standard Homebrew FFmpeg (brew install ffmpeg) already has Apple’s native aac_at (AudioToolbox AAC) enabled out of the box. aac_at is widely regarded as one of the best AAC encoders available, rivaling or exceeding libfdk_aac without compiling anything from source.

However, if you want non-free libraries like Fraunhofer’s FDK AAC (libfdk_aac) for cross-platform script parity, or other optional features not included in core Homebrew even with brew install ffmpeg-full, you can use the homebrew-ffmpeg/homebrew-ffmpeg tap. According to the official FFmpeg macOS compilation guide:

Since v2.0, Homebrew does not offer options for its core formulae anymore. Users who want to build ffmpeg with additional libraries (including non-free ones) need to use so-called taps from third party repositories. These repositories are not maintained by Homebrew.

To install FFmpeg with custom options via the tap:

brew tap homebrew-ffmpeg/ffmpeg
brew install homebrew-ffmpeg/ffmpeg/ffmpeg --with-<option1> --with-<option2> ...

For example, to build with libfdk_aac:

brew install homebrew-ffmpeg/ffmpeg/ffmpeg --with-libfdk-aac

Troubleshooting

While building with custom options increases flexibility, it comes with a maintenance cost. After running brew upgrade, you may occasionally notice your custom FFmpeg build breaking with dynamic linker dyld errors. This happens when Homebrew updates a shared library dependency (such as x264 or openssl) to a new version path, leaving your custom-compiled FFmpeg linked to the old, deleted path.

Fortunately, it is easy to repair. Simply reinstall FFmpeg to recompile it against the updated libraries:

brew reinstall homebrew-ffmpeg/ffmpeg/ffmpeg

Homebrew remembers the --with-* options you originally selected and reapplies them during the reinstall.

🏆

Congratulations!

You have officially earned the title of:

FFmpeg Ruler

Certified by Michifumi

In the next blog, I’ll introduce another free software that can cooperate with FFmpeg and make it even stronger.

A Testament to Courage: 2000 Metres to Andriivka

Mon, 09 Feb 2026 00:00:00 GMT

A raw, unflinching look at the brutal reality of modern warfare through the eyes of Ukrainian soldiers.

I finished watching the documentary 2000 Metres to Andriivka today.

To be honest, it was hard to watch. I don’t even remember how many times I pressed pause during the first ten minutes, especially during the first final scene, I felt desperate just looking at the screen. I can’t even express my complex emotions in words.

English

But as I mustered the courage to keep watching, I realised that opening scene was far from the beginning of hell. Although I’ve seen plenty of footage from drone perspectives showing buildings destroyed, tanks blown up, and even attacks on Russian soldiers, those videos always cut off the instant the drone explodes. This time, however, I witness the battlefield through the first-person perspective of helmet-mounted cameras worn by brave Ukrainian soldiers.

I follow the courageous Ukrainian fighters as I hear their battle cries and anguished shouts, feel the whistling of bullets tearing through the air, experience the shockwaves of bombs exploding nearby, and see fallen brothers who never rise again… That constant dread of what horrors might unfold in the next second, even through the screen, does nothing to ease my taut nerves. I find myself hitting the pause button more and more frequently, trying to suppress the rising nausea.

Trust me, even if you think you’re desensitised to Saving Private Ryan-level scenes, you have no idea what you’re about to face.

War, war never changes. Perhaps in my lifetime, I may not witness humanity breaking free from the painful cycle of war, but I have never ceased to envision a beautiful future where mankind eradicates war and advances hand in hand.

中文

可随着我鼓起勇气继续观看，我才发现我刚刚只是站在地狱的入口处。虽然我从无人机视角看过不少摧毁建筑，炸毁坦克，甚至攻击俄军士兵的场景，但那些视频在无人机爆炸的钱一瞬间就断掉了。而这次是通过士兵身上携带的头盔摄像头，以第一人称的视角，跟随英勇的乌克兰战士来观测战场。

战士们的怒吼，哀嚎，子弹在空中划过的声音，炸弹在身旁爆炸的震撼，倒下的战友再也没能站起来…… 我每时每刻都不在担心着下一秒又会有什么坏事发生，哪怕隔着屏幕，也丝毫无法缓和我紧绷的神经。我只能更加频繁地按下暂定键，试图压下那反胃的感觉。

相信我，就算你认为你已经适应了《拯救大兵瑞恩》级别的场景，你也并不知道自己将要面临什么。

War, war never changes. 或许在我的有生之年，无法看到人类脱离战争的痛苦轮回，但我从未停止对人类根绝战争，携手共进的美好未来的畅想。

This documentary, produced and directed by Mstyslav Chernov, was released on 23 January 2025. I believe the Nobel Peace Prize should be awarded to individuals like those who courageously risk their lives on the front lines to defence their homeland, document and expose the brutal realities of war to the world.

人間讃歌は「勇気」の讃歌ッ！！人間のすばらしさは勇気のすばらしさ！！

Thank you for reading. Please watch the documentary when you are ready. It’s worth experiencing the pain.

If you’re interested in learning more about Ukraine’s history, I recommend another documentary: Winter on Fire, which chronicles the events of 2013-2014, and 20 Days in Mariupol, which chronicles the events of 2022.

Слава Україні! 🇺🇦

How to Remove EXIF Metadata from Images on macOS

Wed, 04 Feb 2026 00:00:00 GMT

Scrubbing EXIF data protects your privacy by stripping sensitive location and time info, removing digital fingerprints that link photos back to you.

Have you ever considered that your photo might contain more information than you could imagine? The information contained within a photo or image extends far beyond what meets the eye, and a lot of that data leaks through EXIF.

EXIF data (Exchangeable Image File Format), is metadata embedded in digital images and videos that records detailed technical and contextual information about how and when the media was created. It can contain camera and equipment details, shooting settings, temporal information, geolocation data, image characteristics, software and processing info, copyright and ownership, and so on, you will be surprised how much metadata can be embedded into a single image.

If such photos or images are only sitting on your local hard drive, it’s not a big deal. But right after you want to share them on the internet, such as posting them on your personal blog or social media, that’s where bad things can happen. Although most major social media platforms, like Instagram or X, automatically strip EXIF data when you upload, that also means they can access your metadata, refine your user profile to deliver targeted advertising, or sell your personal information to third parties if they want to (and trust me, they will).

The worst situation is when you send an image to a forum, a comment section, or an online public storage service that most likely doesn’t have the functionality to scrub metadata and allows everyone to download the original file. Then you are in big trouble. Strangers can use this information to track you to your workplace, the parks where you feed pigeons, or even to your home. Just imagine how scary that would be.

That’s why you need to make sure every piece of data inside a photo or image is wiped out before it reaches the internet. This blog will guide you on how to easily scrub all the EXIF metadata from an image on macOS, using ExifTool by Phil Harvey and the built-in Shortcuts app. By the end of this tutorial, you will be able to scrub an image with just one click.

Step 0: Install ExifTool

First, we need to install ExifTool on the device. If you don’t have Homebrew on your Mac, install it using the following command:

1. Install Homebrew

/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"

2. Install ExifTool

Open your Terminal and run the following command:

brew install exiftool

Step 1: Create a New Shortcut

Open the Shortcuts app on your Mac.
Click the + (plus) icon to create a new shortcut.
In the right-hand sidebar, click the Shortcut Details icon (the small “i” in a circle) and check the box “Use as Quick Action”.
Check the box for “Finder” under the Quick Action settings.
At the very top of the main window, change the input to: “Receive Image from Quick Actions.”

Step 2: Add the Shell Script

Search for the “Run Shell Script” action in the right sidebar and drag it into your shortcut.
TIP

By default, macOS disables scripting actions for security to prevent untrusted scripts from running automatically. You just need to flip a single toggle in the Shortcuts app settings:
- Go to the menu bar and select Shortcuts > Settings.
- Click on the Advanced tab.
- Check the box that says Allow Running Scripts.
Set the Shell to /bin/zsh.
Set Pass Input to as arguments.
Paste the following script:

# Include MacPorts and Homebrew (ARM/x86) paths
export PATH="/opt/local/bin:/opt/homebrew/bin:/usr/local/bin:$PATH"
EXIFTOOL="$(command -v exiftool)"

# Check if exiftool is installed
if [ -z "$EXIFTOOL" ]; then
    osascript -e 'display alert "exiftool not found" message "Please make sure exiftool is installed (via `brew install exiftool` or `sudo port install exiftool`)."'
    exit 1
fi

# 0. Trigger macOS permission prompt
osascript -e "tell application \"Finder\" to duplicate file POSIX file \"$1\" to POSIX file \"/tmp/\" with replacing" > /dev/null 2>&1 &
OSPID=$!

# 1. Wait until permission is granted (retries every second, up to 30s)
RETRY=0
while [ $RETRY -lt 30 ]; do
    RESULT=$("$EXIFTOOL" -all= -overwrite_original "$1" 2>&1)
    if ! echo "$RESULT" | grep -q "Error opening file"; then
        break
    fi
    sleep 1
    RETRY=$((RETRY + 1))
done

# 2. Clean up the background trigger
kill $OSPID 2>/dev/null
wait $OSPID 2>/dev/null
rm -f "/tmp/$(basename "$1")" > /dev/null 2>&1
echo "$RESULT"

# 3. Process remaining files and show results
for f in "$@"
do
    if [ "$f" != "$1" ]; then
        "$EXIFTOOL" -all= -overwrite_original "$f"
    fi

    echo "--- FILE: $(basename "$f") ---"
    "$EXIFTOOL" "$f"
    echo ""
done

NOTE

Why set the PATH manually? macOS’s Shortcuts action runs in a minimal environment without sourcing your shell configuration (like ~/.zshrc), so package manager directories aren’t in $PATH by default. Exporting standard paths ensures the shortcut works out of the box regardless of whether ExifTool was installed via Homebrew (Apple Silicon or Intel), MacPorts, or the official macOS package installer. If ExifTool is not installed, it displays a helpful alert popup.

What does the osascript line do? macOS’s Shortcuts sandbox silently blocks command-line tools like ExifTool from accessing files in protected folders (Downloads, Desktop, Documents). This clever one-liner asks Finder to touch the file via AppleScript, which forces macOS to show a permission prompt. The first time you run the shortcut, a dialog will appear asking “Finder.app” would like to access files in your Downloads folder. Click Allow, and the script will automatically retry and succeed. This only happens once — all future runs will work instantly.

Step 3: Add the Pop-Up Notification

Since a shell script runs in the background, you won’t see the output unless we tell Shortcuts to display it.

In the right sidebar, search for the “Show Content” action.
Drag it under your Shell Script action.
It should automatically use the “Shell Script Result” as the alert message.

Name it something clear like “Image Scrub”. Shortcuts auto-saves, so you can just close the window. It should look like this:

Step 4: Test it Out

Go to any folder in Finder.
Right-click an image that you already have a backup copy of.
Go to Quick Actions > Image Scrub.

First-time only: A permission dialog will appear asking “Finder.app” would like to access files in your Downloads folder (or whichever folder you’re in). Click Allow. The script will wait for you and then proceed automatically. This only happens once per folder.

Troubleshooting: Quick Action not showing up? Sometimes on newer Macs, the Quick Actions won’t appear in the right-click menu immediately. To fix this:

Check your settings: Click the Customize… button in the Quick Actions menu, and make sure the new Shortcut is checked.

Relaunch Finder: Hold the Option (⌥) key, right-click the Finder icon in your Dock, and click Relaunch. Your new action should now appear!

A dialog box will appear showing you the “cleaned” metadata (which should now only show basic file system properties like file size and format, like below).

You can now upload this image to the internet without any metadata that could be used to track you.

Legacy Method: Automator

If you are using an older version of macOS that does not support Shortcuts, or you don’t want to deal with the wired permission issue with Shortcuts because its sandbox protection, you can still accomplish this using the legacy Automator app.

Step 1: Find and Open Automator

Press Cmd + Space and type Automator, then hit Enter.

Select New Document.

Choose Quick Action as the document type and click Choose.

Step 2: Configure the Inputs

At the very top of the workflow area, set the following:

Workflow receives current: image files
in: Finder

Step 3: Add the Shell Script

In the search bar on the left, type “Run Shell Script”.

Drag that action into the main workflow area on the right.

Change Pass input: to as arguments.

Clear out the default text and paste the following script:

# Include MacPorts and Homebrew (ARM/x86) paths
export PATH="/opt/local/bin:/opt/homebrew/bin:/usr/local/bin:$PATH"
EXIFTOOL="$(command -v exiftool)"

# Check if exiftool is installed
if [ -z "$EXIFTOOL" ]; then
    osascript -e 'display alert "exiftool not found" message "Please make sure exiftool is installed (via `brew install exiftool` or `sudo port install exiftool`)."'
    exit 1
fi

for f in "$@"
do
    # 1. Strip all metadata in-place
    "$EXIFTOOL" -all= -overwrite_original "$f"

    # 2. Extract remaining info for the pop-up
    echo "--- FILE: $(basename "$f") ---"
    "$EXIFTOOL" "$f"
    echo ""
done

NOTE

Like the Shortcuts action, setting PATH explicitly ensures compatibility across Apple Silicon, Intel Macs, Homebrew, and MacPorts without manual path edits.

Step 4: Add the Display Notification

Since a shell script runs in the background, you won’t see the output unless we pipe it to a window.

In the search bar on the left, type “Set Value of Variable”. Drag it under your script.

Click the “Variable:” dropdown, select New Variable…, and name it metadata_output.

Now, search for “Ask for Confirmation” and drag it to the bottom.

Drag the Variable named metadata_output in the Message box.

Step 5: Save and Run

Now it should look like this:

Cmd + S to save the file.

Name it exactly what you want to see in your right-click menu, for example: Image Scrub

Test it:

Go to any folder in Finder.
Right-click an image that you already have a backup copy.
Go to Quick Actions > Image Scrub

A dialog box will appear showing you the “cleaned” metadata (which should now only show basic file system properties like file size and format like below).

You can now upload this image to the internet without any concerns.

NOTE

For HEIC files: HEIC images retain some structural metadata (such as color profile and codec parameters) that ExifTool cannot remove without corrupting the file. As a result, the popup window may extend beyond your screen borders due to the volume of remaining (non-sensitive) information. If that happens, simply press Enter or Esc to dismiss it instead of clicking the OK button.

A Little Bit More

You can find your saved Quick Action file that you created with Automator at this path: ~/Library/Services/

How to get there quickly:

Open Finder.
Press Cmd + Shift + G (Go to Folder).
Paste ~/Library/Services/ and hit Enter.

You will see a file named *.workflow.

If you ever want to change the name that appears in your right-click menu, simply rename the file inside that Services folder. To delete the Quick Action, just move that file to the Trash.

Private Telegram Bot for X Link Previews

Sat, 17 Jan 2026 18:00:00 GMT

How to build, secure and deploy a private Telegram bot to automatically replace x.com links with fixupx.com for native Instant View support.

If you use Telegram and X a lot and often share X links in a Telegram group chat, you may have noticed that the X links cannot show as ‘Instant View’, a very convenient function natively supported by Telegram, unless you add a prefix such as ‘fixup’ before the X URL. If you hate yourself, you can manually add the prefix each time you share an X URL in the group chat. Alternatively, you can set up a Telegram bot with your VPS to add the prefix automatically. This blog contains a guide documenting the exact process followed to build, secure and deploy the private Telegram X-Link Fixer bot on a VPS.

Private Telegram X-Link Fixer: Automatically detect x.com or twitter.com links, replace them with fixupx.com for better previews, remove tracking parameters, and delete the original message to keep the chat clean.

1. Bot Creation and Configuration (@BotFather)

Create Bot: Search for @BotFather on Telegram and send /newbot. Follow the prompts to name your bot and obtain your API Token.
Disable Privacy Mode: This is crucial for the bot to “see” messages containing links in group chats without needing an explicit @mention:
- Send /setprivacy to @BotFather.
- Select your bot, then select Disable.
- Note: If the bot is already a member of a group, remove and re-add it for this change to take effect.
Permissions: Add the bot to your target group chat and promote it to Administrator. Ensure it has the Delete Messages permission enabled so it can remove the raw link after posting the preview.

2. Prepare the VPS Environment

Log in to your VPS and set up a dedicated directory with a Python virtual environment to keep dependencies isolated from the system Python.

Debian and Ubuntu Setup

Update package lists and install python3-venv:

sudo apt update && sudo apt install python3-venv -y

Install pip using the official bootstrap script:

curl -sS https://bootstrap.pypa.io/get-pip.py | python3 -

Create project directory and virtual environment:

mkdir -p ~/mybot && cd ~/mybot
python3 -m venv venv
source venv/bin/activate

Install the required library:
```
pip install python-telegram-bot
```

Fedora and RHEL Setup

Update system packages and install python3-pip:

sudo dnf update -y && sudo dnf install python3-pip -y

Create project directory and virtual environment:

mkdir -p ~/mybot && cd ~/mybot
python3 -m venv venv
source venv/bin/activate

Install the required library:
```
pip install python-telegram-bot
```

3. The Bot Script (bot.py)

Create the script inside ~/mybot using nano bot.py. Update the configuration with your bot token and authorized IDs.

You can use @userinfobot in Telegram to find your user ID, group ID, and channel ID. You may also use third-party Telegram clients to retrieve your ID (such as Swiftgram for Apple platforms or Forkgram on Android).

import re
from telegram import Update
from telegram.ext import Application, MessageHandler, filters, ContextTypes

# --- CONFIGURATION ---
TOKEN = "YOUR_BOT_TOKEN"
# Template user ID and group ID, replace with your own IDs
# Group and channel IDs must include the -100 prefix if retrieved from third-party Telegram clients
AUTHORIZED_IDS = [1234567890, -1001234567890]

# Match X/Twitter links (including fixupx.com) and capture query parameters separately
X_PATTERN = r'(https?://(?:www\.)?)(x\.com|twitter\.com|fixupx\.com)(/[^\s?]*)(\?[^\s]*)?'

async def auto_fix_and_clean(update: Update, context: ContextTypes.DEFAULT_TYPE):
    # Security: Ignore unauthorized chats
    if update.effective_chat.id not in AUTHORIZED_IDS:
        return

    # Extract text from message or media caption
    text = update.message.text or update.message.caption
    if not text:
        return

    # Check if text contains any X/Twitter-related link
    match = re.search(X_PATTERN, text)
    if match:
        protocol, domain, path, query_params = match.groups()
        
        # Only process if URL has tracking parameters OR is not using fixupx.com
        if query_params or domain != 'fixupx.com':
            # Replace domain with fixupx.com and remove tracking parameters
            fixed_text = re.sub(X_PATTERN, r'\1fixupx.com\3', text)
            user = update.message.from_user.first_name
            
            # 1. Send the fixed version
            await context.bot.send_message(
                chat_id=update.effective_chat.id,
                text=f"🛠 From {user}:\n{fixed_text}"
            )

            # 2. Delete original message
            try:
                await update.message.delete()
            except Exception as e:
                print(f"Delete failed (Check Admin permissions): {e}")

def main():
    app = Application.builder().token(TOKEN).build()
    app.add_handler(MessageHandler((filters.TEXT | filters.CAPTION) & (~filters.COMMAND), auto_fix_and_clean))
    print("Bot is running...")
    app.run_polling()

if __name__ == "__main__":
    main()

Optional: Match Links Only at Start of Message

By default, the bot detects and fixes X/Twitter links anywhere inside a message. If you prefer the bot to only process links that appear at the beginning of a message, modify the regex pattern:

# Default: matches links anywhere in the message and removes tracking parameters
X_PATTERN = r'(https?://(?:www\.)?)(x\.com|twitter\.com|fixupx\.com)(/[^\s?]*)(\?[^\s]*)?'

# Alternative: matches links only at the start of the message and removes tracking parameters
X_PATTERN = r'^(https?://(?:www\.)?)(x\.com|twitter\.com|fixupx\.com)(/[^\s?]*)(\?[^\s]*)?'

The ^ anchor ensures the pattern triggers only when the message begins with the URL, preventing casual references within longer sentences from being captured.

NOTE

The bot handles all X-related URLs intelligently:

Converts x.com and twitter.com to fixupx.com
Strips tracking queries (such as ?s=46&t=xxx) from all links, including existing fixupx.com shares

Examples:

https://x.com/user/status/123?s=46&t=abc → https://fixupx.com/user/status/123
https://fixupx.com/user/status/123?s=46&t=abc → https://fixupx.com/user/status/123
https://fixupx.com/user/status/123 → No action (already clean)

4. Deploy as a Systemd Background Service

To ensure the bot continues running after closing your SSH session and restarts on server reboots, configure a systemd unit.

Service File Configuration

Create the service file using sudo nano /etc/systemd/system/tgbot.service:

[Unit]
Description=Telegram X-Link Fixer Bot
After=network.target

[Service]
User=linuxuser
Group=linuxuser
WorkingDirectory=/home/linuxuser/mybot
ExecStart=/home/linuxuser/mybot/venv/bin/python bot.py
Restart=always

[Install]
WantedBy=multi-user.target

TIP

Replace linuxuser and /home/linuxuser/mybot with your actual Linux user and project directory path.

Enable and Start the Service

Reload the systemd daemon, enable automatic startup on boot, and start the service:

sudo systemctl daemon-reload
sudo systemctl enable --now tgbot

5. Troubleshooting and Monitoring

Use these standard systemd and journalctl commands to inspect and manage your running bot:

Check Service Status:
```
sudo systemctl status tgbot
```
View Live Logs in Real Time:
```
sudo journalctl -u tgbot.service -f
```
Restart After Script Changes:
```
sudo systemctl restart tgbot
```

The best Safari extension: uBlock Origin Lite

Sat, 17 Jan 2026 00:00:00 GMT

Let's get rid of YouTube Shorts!

The uBlock Origin Lite was released on the App Store in August 2025. Although it’s the “Lite” version, which is not as powerful as the original, it’s still one of the best things to happen in the last year, especially for users who sometimes have to use Safari as their browser, like me.

The best options for normal users who want to protect their privacy are still to use Firefox with the user.js file for hardening or the more user-friendly Brave browser. However, Safari sometimes has its own advantages, such as the battery saver. To be honest, “thanks” to its system-native status, it conserves battery power far more effectively than other third-party browsers. But this remains its sole redeeming feature. In terms of web compatibility, privacy, and extensibility, Safari undoubtedly ranks at the bottom.

Until the arrival of uBlock Origin Lite.

Those familiar with it will have long heard its reputation, while if you’re encountering it for the first time, all you need to know for now is that it can magically eliminate almost all manner of irritating adverts and pop-ups, including but not limited to YouTube, X, Instagram, Facebook (yes, you won’t need to pay a penny for a subscription!), and numerous other websites.

Moreover, if you couldn’t care less about short videos but find yourself constantly bombarded by sites like YouTube, which seem determined to use every trick in the book to push short-form content on you, then uBlock Origin Lite is absolutely the solution for you.

It works on all Apple ecosystems, but this blog focuses on how you can set it up step by step on macOS. The process is similar for other systems, and I’m sure you can learn by analogy.

Here is how this magic is achieved

First, download and install it from the App Store.

Then enable it in Safari’s extension settings.

Open the uBlock Origin Lite dashboard by clicking the icon in the toolbar and select the native rules from the Filter lists. If you want, you can also select your regions and languages using the filter at the bottom of the lists, but the below setting is good enough for most senarios.

Now for the important part

By following the steps above, we’ve managed to get rid of ads and most of the annoying pop-ups. But if you absolutely hate short videos like me, we’ll need to take a few extra steps.

First, copy these rules by click the copy button below:

! YT - Homepage and Subscriptions (Grid View) - Hide the Shorts section
youtube.com##[is-shorts]
! YT - Menu - Hide the Shorts button
www.youtube.com###guide [title="Shorts"], .ytd-mini-guide-entry-renderer[title="Shorts"]
! YT - Search - Hide Shorts
www.youtube.com##ytd-search ytd-video-renderer:has([overlay-style="SHORTS"],[href^="/shorts/"])
! YT - Search, Channels, Subscriptions (List View) and Sidebar/Below Player Recommendations - Hide the Shorts sections
www.youtube.com##ytd-reel-shelf-renderer
! YT - Channels - Hide the Shorts tab
www.youtube.com##[tab-title="Shorts"]
! YT - Subscriptions - Hide Shorts - Grid View
www.youtube.com##ytd-browse[page-subtype="subscriptions"] ytd-grid-video-renderer:has([overlay-style="SHORTS"],[href^="/shorts/"])
! YT - Subscriptions - Hide Shorts - List View
www.youtube.com##ytd-browse[page-subtype="subscriptions"] ytd-video-renderer:has([overlay-style="SHORTS"],[href^="/shorts/"])
! YT - Subscriptions - New Layout - Hide Shorts
www.youtube.com##ytd-browse[page-subtype="subscriptions"] ytd-rich-item-renderer:has([overlay-style="SHORTS"],[href^="/shorts/"])
! YT - Sidebar - Hide Shorts
www.youtube.com###related :is(ytd-compact-video-renderer,yt-lockup-view-model):has([overlay-style="SHORTS"],[href^="/shorts/"])
! YT - History - Hide Shorts
www.youtube.com##ytd-item-section-renderer[page-subtype]:has(>#contents>[is-history]>#dismissible>ytd-thumbnail>#thumbnail[href^="/shorts/"])

! YT Mobile - Hide the Shorts Menu button
m.youtube.com##ytm-pivot-bar-item-renderer:has(>.pivot-shorts)
! YT Mobile - Hide the Shorts sections
m.youtube.com##ytm-reel-shelf-renderer
m.youtube.com##ytm-rich-section-renderer:has([d^="M17.77,10.32l-1.2"])
! YT Mobile - Search - Hide Shorts
m.youtube.com##ytm-search ytm-video-with-context-renderer:has([data-style="SHORTS"])
! YT Mobile - Channels - Hide the Shorts button
m.youtube.com##[tab-title="Shorts"]
! YT Mobile - History - Hide Shorts
m.youtube.com##[tab-identifier="FEhistory"] ytm-compact-video-renderer:has(>div>a[href^="/shorts/"])

! YT Search - keep only videos (no shorts)
youtube.com##ytd-search ytd-item-section-renderer>#contents>:is(:not(ytd-video-renderer,yt-showing-results-for-renderer,[icon-name="promo-full-height:EMPTY_SEARCH"]),ytd-video-renderer:has([aria-label="Shorts"])),ytd-secondary-search-container-renderer

! YT Search - keep only videos (no shorts) and channels
youtube.com##ytd-search ytd-item-section-renderer>#contents>:is(:not(ytd-video-renderer,ytd-channel-renderer,yt-showing-results-for-renderer,[icon-name="promo-full-height:EMPTY_SEARCH"]),ytd-video-renderer:has([aria-label="Shorts"])),ytd-secondary-search-container-renderer

! YT Search - keep only videos (no shorts), channels and playlists
youtube.com##ytd-search ytd-item-section-renderer>#contents>:is(:not(ytd-video-renderer,ytd-channel-renderer,ytd-playlist-renderer,yt-lockup-view-model,yt-showing-results-for-renderer,[icon-name="promo-full-height:EMPTY_SEARCH"]),ytd-video-renderer:has([aria-label="Shorts"])),ytd-secondary-search-container-renderer

These rules may change from time to time, so it’s a good idea to check the official wiki page for the latest updates.

Then, in the dashboard, go to Custom filters > Import / Export, paste what you just copied and click ✓Add button. It should look similar to this after clicking:

Then you need to quit Safari completely by pressing cmd + Q. This is essential.

Now reopen Safari, open YouTube, and savour your triumph! Those pesky adverts and short video pushes have vanished both in homepage and in search results!

Keep it in mind, this is rather like a game of cat and mouse, so perhaps one day this extension may cease to function (but it is not this day! This day we fight!). Should you wish to contribute, when encountering usage issues, you may visit this GitHub issue to help the developers identify the problem more quickly.

Update

If you use Safari every day (god I hate to say that), you may have noticed that, each time the UBOL updates, its functions stop working, even if you restart Safari completely. In order to solve this problem, you need to complete the following steps.

Firstly, according to the official update logs, you need to wait a few seconds before it is fully ready. The more rules you set, the longer you will need to wait for them to take effect. I usually wait for around 10 seconds to 30 seconds after opening a new YouTube page, depending which device I’m using.

Secondly, if you feel you have waited long enough after opening a YouTube page, find the extension icon in the Safari Toolbar. Click it and change the filtering mode from the default Optimal to Complete (or any other option).

Then change it back to Optimal. The webpage will refresh automatically and the ads and shorts will have disappeared!

Daily Updates on Linux and macOS

Wed, 07 Jan 2026 00:00:00 GMT

Satisfying the compulsion for daily system updates with a custom bash script for Linux and Docker.

There are two types of people: those who never update their software and those who do it every day.

Clearly, I’m the latter. I even perform various update operations daily across different devices: from system-level to application-level. And whenever I’m feeling bored, “update” is absolutely my default unconscious choice. I’m so addicted to updating that I wonder if it’s some kind of disease such as compulsive disorder. Perhaps medical or psychological experts have already conducted similar research on this?

Anyway, while updating functions on popular operating systems like iOS, macOS, Android, and Windows has become remarkably straightforward and user-friendly, the process remains less intuitive for Linux systems, particularly when using the command-line interface (CLI). Although users can leverage unattended-upgrades for automated updates, this solution doesn’t address all challenges for heavy Docker users.

That’s why I need to write an update script to satisfy my perverted desire to update.

Installation and Usage

Create the script file:
```
sudo nano /usr/local/bin/up.sh
```
Paste the content from your OS-specific script (Debian-based Linux, Fedora/RHEL/CentOS 8+, or Fedora CoreOS) into the file and save it.
Make the script executable:
```
sudo chmod +x /usr/local/bin/up.sh
```
Run the script from anywhere in the terminal:

up.sh

Debian-based Linux

Here is the up.sh script that handles system and Docker updates:

#!/bin/bash

# Ensure the script exits if any command fails
set -e

echo "--- Starting System Update ---"
sudo apt-get update
sudo apt-get full-upgrade -y
sudo apt-get autoremove -y

echo "--- Vacuuming Systemd Logs ---"
sudo journalctl --vacuum-size=200M --vacuum-time=14d

echo "--- Updating Docker Containers via Watchtower ---"
# Note: Docker API version is essential for Watchtower to function correctly
sudo docker run --rm \
    -e DOCKER_API_VERSION=1.44 \
    -v /var/run/docker.sock:/var/run/docker.sock \
    containrrr/watchtower \
    --run-once \
    --cleanup \
    your container names (separate by space)

echo "--- Cleaning up unused Docker resources ---"
sudo docker container prune -f
# Remove -a to keep cached images or keep it for deep clean
sudo docker image prune -a -f
sudo docker volume prune -f
sudo docker network prune -f
sudo docker builder prune -f

echo "Update complete!"

Go back Step 3 to continue

Fedora/RHEL/CentOS 8+

#!/bin/bash
set -e

echo "--- Starting System Update ---"
sudo dnf upgrade -y
sudo dnf autoremove -y

echo "--- Vacuuming Systemd Logs ---"
sudo journalctl --vacuum-size=200M --vacuum-time=14d

echo "--- Updating Docker Containers via Watchtower ---"
# Note: Docker API version is essential for Watchtower to function correctly
sudo docker run --rm \
    -e DOCKER_API_VERSION=1.44 \
    -v /var/run/docker.sock:/var/run/docker.sock \
    containrrr/watchtower \
    --run-once \
    --cleanup \
    your container names (separate by space)

echo "--- Cleaning up unused Docker resources ---"
sudo docker container prune -f
# Remove -a to keep cached images or keep it for deep clean
sudo docker image prune -a -f
sudo docker volume prune -f
sudo docker network prune -f
sudo docker builder prune -f

echo "Update complete!"

Go back Step 3 to continue

Fedora CoreOS (Automatic Updates via Zincati)

Fedora CoreOS is different, it uses Zincati for fully automatic updates. Unlike traditional Linux distributions, Fedora CoreOS requires no manual intervention for system updates.

How Zincati Works:

Zincati is the automatic update agent that:

Periodically checks for new Fedora CoreOS releases from the Cincinnati update server
Automatically downloads and stages updates in the background (no bandwidth concerns during work hours)
Handles reboots based on your configured strategy

Update Strategies:

Zincati supports different reboot strategies (configured in /etc/zincati/config.d/):

immediate: Reboots immediately after staging an update (default on Google Cloud Platform)
fleet_lock: Coordinates with other nodes to prevent simultaneous reboots (cluster-friendly)
periodic: Reboots only during specified time windows (e.g., 2-4 AM on weekends)

You can check your current strategy with:

systemctl status zincati | grep "update strategy"

Important: Fedora CoreOS uses rpm-ostree, which means updates are atomic and always require a reboot. The new version is staged as a separate deployment and only becomes active after reboot. This ensures:

Zero chance of broken updates (either fully applied or not at all)
Instant rollback capability (previous version remains available)
No “partially updated” system states

The Script:

Since Zincati handles system updates automatically, the script focuses on checking status and updating containers:

#!/bin/bash
set -euo pipefail

echo "--- Checking for staged system updates ---"
rpm-ostree status

# Update toolbox container
# After a major version upgrade, the default toolbox
# container won't exist yet. Create it automatically if missing.
echo ""
echo "--- Updating Toolbox Container ---"
if ! toolbox run true 2>/dev/null; then
    echo "Default toolbox container not found. Creating..."
    toolbox create -y
fi

# Upgrade, autoremove dependencies, AND purge the massive DNF download cache
toolbox run sudo dnf upgrade -y
toolbox run sudo dnf autoremove -y
toolbox run sudo dnf clean all

echo ""
echo "--- Vacuuming Systemd Logs ---"
sudo journalctl --vacuum-size=200M --vacuum-time=14d

# Clean up unused Podman resources
echo ""
echo "--- Cleaning up unused Podman resources ---"
# Deletes stopped containers, unused networks, and dangling images
podman system prune -f 

# Removes unused volumes specifically (since system prune doesn't include volumes by default)
podman volume prune -f

# Optional deep clean: Removes all unused images, not just dangling ones
# podman image prune -a -f

echo ""
echo "Update complete!"

echo "Note: System updates are managed automatically by Zincati."

Note: Fedora CoreOS uses Podman by default. For automatic container updates, use podman auto-update with containers running inside systemd units and the io.containers.autoupdate label. Podman also ships with a podman-auto-update.timer that triggers updates daily.

Cleaning up old toolbox containers after a major version upgrade:

After Zincati upgrades Fedora CoreOS to a new major version, the script above creates a new toolbox container. The old toolbox container will remain on disk. To check and clean it up:

toolbox list

You’ll see something like:

CONTAINER ID  CONTAINER NAME      CREATED      STATUS   IMAGE NAME
a1b2c3d4e5f6  fedora-toolbox-43   3 months ago  running  registry.fedoraproject.org/fedora-toolbox:43
f6e5d4c3b2a1  fedora-toolbox-44   2 minutes ago running  registry.fedoraproject.org/fedora-toolbox:44

Your files in ~/ (e.g. ~/backups, ~/page-stats) are not stored inside the toolbox — toolbox bind-mounts your home directory into the container. Removing an old toolbox only deletes the packages installed via dnf inside it (Node.js, npm, etc.), not your files.

If you no longer need the old toolbox:

# Stop and remove the old container
podman stop fedora-toolbox-43
toolbox rm fedora-toolbox-43

# Optionally, remove the old base image to free disk space
podman rmi registry.fedoraproject.org/fedora-toolbox:43

Go back Step 3 to continue

Bonus: Daily Updates on macOS (Homebrew)

If you are on macOS and want to satisfy your update craving with Homebrew, this single command is all you need for aggressive maintenance:

brew upgrade && brew autoremove && brew cleanup --prune=all

brew upgrade: Upgrades all packages.
brew autoremove: Removes orphan dependencies that are no longer needed.
brew cleanup —prune=all: Aggressively clears the cache to free up maximum disk space, I recommend using it with the 256 GB SSD MacBook Air (that is something only Apple can do).

Also don’t forget to disable the analysis:

brew analytics off

To make this even easier, add an alias for the terminal ~/.zshrc:

nano ~/.zshrc

Add the following line:

alias up='brew upgrade && brew autoremove && brew cleanup --prune=all'

Then reload your shell:

source ~/.zshrc

Now you can simply type up to update everything that installed from homebrew!

Ditch Passwords: Secure Your VPS with SSH Keys

Thu, 01 Jan 2026 00:00:00 GMT

We move beyond complex passwords and harden SSH access using ed25519 keys, proper permissions, and cloud-init overrides.

Last time we covered how to enhance VPS security by creating regular users and changing passwords to more complex ones. Here’s an image for reference:

But is a password the most secure option? Not necessarily. Because even if your password is long and complex, password-based SSH logins still suffer from a few fundamental problems:

They can be brute-forced (even if it’s unlikely, attackers will try constantly).
They rely on something you type, which means they can be phished, logged, or reused.
They expand the attack surface, you’re leaving a whole authentication method enabled on the server.

The better approach is:
🔐 Use SSH keys and disable password logins completely.

This article documents the full journey: generating a strong key pair on macOS (or on whatever system you want), installing the key correctly on the server, fixing permission issues, and (most importantly) handling the tricky part, cloud-init overriding your SSH config.

Why SSH Keys are Better than Passwords

SSH keys are essentially cryptographic credentials. Instead of “something you know” (password), SSH keys rely on:

a private key (kept on your machine)
a public key (stored on your server)
optional passphrase protection for the private key

Benefits

Extremely resistant to brute force
No password guessing over the network
You can lock down access to key-only authentication
You can manage multiple keys and revoke them cleanly

Step 1: Generate an ed25519 SSH Key

We used this command:

ssh-keygen -t ed25519 -a 100

What does `-a 100` mean?

-a controls the number of key derivation rounds used to protect your private key when you set a passphrase.

More rounds = harder to brute-force the passphrase if your private key is stolen.

Where does the key go?

On macOS, if you press Enter when asked for a file path, the key will be stored in:

~/.ssh/id_ed25519 (private key)
~/.ssh/id_ed25519.pub (public key)

You can use -f to specify a file path.

Step 2: Should You Use a Passphrase?

During the generation process, you will be asked if you want to set up a passphrase for your key. In most situations, the answer is

Yes. Highly recommended.

If your laptop is compromised and your private key is stolen:

without passphrase: attacker gets instant access
with passphrase: attacker must brute-force it offline (very expensive)

If convenience is a concern, macOS can store the passphrase via Keychain so you don’t type it every time.

For the simplest way, you can also leave it empty.

Step 3: Put the Public Key on the VPS (Correct Location)

This is where many people get confused (including me).

Important concept

Your public key file name on your Mac can be anything, like id_ed25519.pub.

But on an Ubuntu VPS, SSH expects keys to be listed inside:

~/.ssh/authorized_keys

That means for user ubuntu, the path is:

/home/ubuntu/.ssh/authorized_keys

Use this if there’s no .ssh/ folder

mkdir -p ~/.ssh

Simply placing the id_ed25519.pub file in the .ssh/ folder will not work.

According to the official documentation,

Option A (recommended): `ssh-copy-id`

ssh-copy-id ubuntu@your-vps

Option B: manual copy

On your local machine:

cat ~/.ssh/id_ed25519.pub

Copy the output, then on the VPS:

mkdir -p ~/.ssh
nano ~/.ssh/authorized_keys

Paste the key on a new line.

Step 4: Fix Permissions (Why `chmod 700` and `chmod 600`?)

SSH is strict about file permissions for good reason.

If .ssh or authorized_keys is accessible or writable by others, SSH assumes it could be tampered with and may ignore it.

Run these on the VPS:

chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys
chown -R $USER:$USER ~/.ssh

If above cmd show no output: that’s normal. Silent success is expected.

To verify:

ls -ld ~/.ssh
ls -l ~/.ssh/authorized_keys

Expected:

drwx------ 2 ubuntu ubuntu ... .ssh
-rw------- 1 ubuntu ubuntu ... authorized_keys

Step 5: Confirm Key Login Works First

Before disabling passwords, always test key login in a new terminal:

ssh ubuntu@your-vps

If it logs in without asking for the VPS password (it may ask your key passphrase), you’re ready.

Keep your current SSH session open during testing so you don’t lock yourself out.

Step 6: Disable Password Login (And It Didn’t Work at First)

After editing /etc/ssh/sshd_config and adding:

PasswordAuthentication no
PermitRootLogin no
PubkeyAuthentication yes
KbdInteractiveAuthentication no

I restarted SSH and even restarted ssh.socket.

But password login still worked.

The truth came from

sudo sshd -T | grep passwordauthentication

It showed:

passwordauthentication yes

Even though my config file clearly said no.

So what happened?

The Real Issue: RackNerd `50-cloud-init.conf` Overriding Your Config

On RackNerd Ubuntu VPS templates, the SSH config often includes a directive at line 1 without a # comment:

Include /etc/ssh/sshd_config.d/*.conf

And inside that folder I found:

/etc/ssh/sshd_config.d/50-cloud-init.conf

That file had:

PasswordAuthentication yes

Here is the catch with OpenSSH: for each keyword, the first obtained value wins.

Because Include /etc/ssh/sshd_config.d/*.conf is at line 1 of Ubuntu’s default /etc/ssh/sshd_config, OpenSSH parsed 50-cloud-init.conf before reading the rest of /etc/ssh/sshd_config. Since it encountered PasswordAuthentication yes first, it completely ignored the no in the main config!

Fix: change it to:

PasswordAuthentication no

Then restart SSH (e.g., sudo systemctl restart ssh on Ubuntu 22.04, or sudo systemctl restart ssh.socket on Ubuntu 24.04).

After that, password login stopped working.

Step 7: Make It Future-Proof (Recommended)

Cloud-init can regenerate or overwrite 50-cloud-init.conf during system updates or re-provisioning.

Because OpenSSH uses first match wins and loads drop-in files in alphabetical order, we want our custom configuration to load before 50-cloud-init.conf.

We do this by creating a drop-in file with a lower number prefix like 01-:

sudo tee /etc/ssh/sshd_config.d/01-hardening.conf >/dev/null <<'EOF'
PasswordAuthentication no
KbdInteractiveAuthentication no
PermitRootLogin no
PubkeyAuthentication yes
EOF

Because 01-hardening.conf is loaded alphabetically before 50-cloud-init.conf, its rules take priority even if cloud-init resets 50-cloud-init.conf in the future.

Test syntax before restarting

Before restarting the SSH service, always test your configuration syntax first:

sudo sshd -t

No output: That’s good! Silent success means the configuration has no syntax errors.

Restart SSH service

Once verified, apply the changes by restarting the SSH service. The command depends on your distribution version:

Ubuntu 24.04 LTS (uses systemd socket activation by default):
```
sudo systemctl restart ssh.socket
```
Ubuntu 22.04 LTS / Debian / older systems (uses classic standalone service):
```
sudo systemctl restart ssh
```

TIP

If you’re unsure which init mode your server uses, you can run:

sudo systemctl restart ssh 2>/dev/null || sudo systemctl restart ssh.socket

Step 8: Verify Password Login Is Truly Disabled

On the VPS, check:

sudo sshd -T | grep -E 'passwordauthentication|permitrootlogin|pubkeyauthentication|kbdinteractiveauthentication'

Expected output includes:

permitrootlogin no
pubkeyauthentication yes
passwordauthentication no
kbdinteractiveauthentication no

Bonus Hardening (Optional)

Install fail2ban

It reduces brute-force noise and bans abusive IPs automatically.

sudo apt update
sudo apt install -y fail2ban
sudo systemctl enable --now fail2ban

Disable X11 forwarding if you don’t need it

In sshd_config:

X11Forwarding no

Less attack surface is always better.

For Further Hardening

firewall setup
automatic security upgrades
monitoring login attempts
restricting SSH access by IP or using VPN
adding 2FA
Secure DNS

Hardening a Fresh Ubuntu VPS with Secure SSH

Mon, 22 Dec 2025 00:00:00 GMT

A step-by-step guide to securing a new Ubuntu VPS by creating a regular user, configuring sudo, and disabling root SSH access.

Introduction

Nowadays, many cloud service providers offer VPS instances that allow direct SSH access as the root user by default. While convenient for initial setup, this configuration increases the attack surface and deviates from security best practices. This blog walks through hardening a fresh VPS step by step, from creating a regular user account to disabling root SSH login.

The examples below assume:

Ubuntu as the operating system
You initially log in as root
SSH access is already available

Why Direct Root SSH Login Is a Problem

Allowing direct root login over SSH has several downsides:

Larger attack surface: attackers know the username (root) in advance
No accountability: all actions appear as root, with no user separation
Higher risk: a single compromised password or key grants full system control

Best practice is to:

Use a regular user for daily operations
Escalate privileges only when needed via sudo
Disable root SSH access entirely

Step 1: Inspect Existing Users

On a fresh VPS, for instance, from RackNerd, you’ll often find that only root is a real login user.

cat /etc/passwd

If you see only system accounts (with shells like /usr/sbin/nologin) and root, you’ll need to create a regular user.

Step 2: Create a Regular User

Create a new user (we’ll call it ubuntu this time, you can change it to whatever name you like):

adduser ubuntu

This command:

Creates a home directory (/home/ubuntu)
Assigns a normal UID (≥ 1000)
Sets /bin/bash as the login shell
Prompts you to set a password

If you prefer to use a strong, randomly generated password instead of choosing one manually, you can generate it locally with OpenSSL:

openssl rand -base64 32

Copy the generated password and paste it when prompted by adduser, or set it afterward using:

passwd ubuntu

Step 3: Grant Sudo Privileges

To allow administrative tasks without logging in as root:

usermod -aG sudo ubuntu

Test it:

su - ubuntu
sudo whoami

Expected output:

root

Step 4: Verify SSH Access for the New User

Before making any SSH changes, always test:

ssh ubuntu@localhost

If this works locally, remote SSH access will work as well.

Step 5: Disable Root SSH Login

Once you’ve confirmed the new user can log in and use sudo, disable root SSH access.

What you should do is create a drop-in configuration file under /etc/ssh/sshd_config.d/. Because OpenSSH uses first match wins and evaluates drop-in files alphabetically, naming the file 01-hardening.conf guarantees our setting takes priority over any default cloud-init or provider templates:

sudo tee /etc/ssh/sshd_config.d/01-hardening.conf >/dev/null <<'EOF'
PermitRootLogin no
EOF

Test syntax before restarting

Always test your configuration syntax before restarting the SSH service:

sudo sshd -t

No output: Silent success — syntax is valid and safe to apply.

Restart SSH service

Apply the changes by restarting the SSH service depending on your distribution:

Ubuntu 24.04 LTS (Socket-activated SSH):
```
sudo systemctl restart ssh.socket
```
Ubuntu 22.04 LTS / Debian (Classic SSH service):
```
sudo systemctl restart ssh
```

TIP

You can also run sudo systemctl restart ssh 2>/dev/null || sudo systemctl restart ssh.socket to handle either setup automatically.

Verify root login is disabled

sudo sshd -T | grep permitrootlogin

Expected output:

permitrootlogin no

Step 6 (Optional but Recommended): Lock the Root Password

To prevent any password-based root login:

passwd -l root

Root access remains available via sudo.

Verify the root account is locked:

passwd -S root

Expected output:

root L ...

Step 7 (Optional): Passwordless sudo for Convenience

If you want sudo -i to switch to root without prompting for a password:

sudo visudo

Add:

ubuntu ALL=(ALL) NOPASSWD:ALL

Now:

sudo -i

drops you directly into a root shell.

NOTE

This trades convenience for security. Use with care.

Future Improvements

The steps covered in this post establish a secure baseline for a freshly provisioned VPS. However, there is still room for further hardening.

One of the most impactful improvements is switching from password-based SSH authentication to SSH key–based authentication. SSH keys provide:

Stronger cryptographic security
Protection against brute-force password attacks
Better usability once configured

Using SSH keys will significantly reduce the attack surface of an internet-facing server.

In a future post, we’ll walk through the process of configuring SSH keys step by step and locking down SSH access even further.

But until then, I wish you a Merry Christmas 🎄✨🎅

How I Forced Brave to Use AMD GPU on an Intel Mac

Wed, 03 Dec 2025 00:00:00 GMT

Brave Browser (Chromium) kept sticking to Intel iGPU for WebGL/WebGPU. Here's the exact fix I used and a one-click Automator launcher to make it permanent.

Go to solution directly

This issue has been bothering me for over half a year: ever since I got hooked on using the Brave browser, I’ve noticed that on my old 2018 MacBook Pro, it only utilizes the Intel integrated graphics and fails to leverage the discrete AMD GPU for rendering intensive tasks. This forces me to occasionally switch to Safari (WebKit sucks!) when encountering heavy rendering demands to achieve a smoother browsing experience. Today, I stumbled upon news that WebGPU has officially launched in major browsers. On a whim, I decided to tackle this issue.

First, I confirmed all settings are correct:

Brave Settings → System → Use graphics acceleration when available: ON.
macOS Battery → Automatic graphics switching: OFF (forces the system to use the discrete GPU).
Terminal (system‑wide GPU preference):
```
sudo pmset -a gpuswitch 1
```
This forces macOS to use the discrete GPU system‑wide. While this locks the display output to the AMD chip, Chromium’s internal GPU process still defaulted to creating its context on the integrated adapter.

Reset to default:
```
sudo pmset -a gpuswitch 2
```
(2 restores automatic switching. The change takes effect immediately, though a reboot can ensure all background processes reload.)

Despite all that, Brave still stubbornly used Intel.

The Symptom

To reproduce the problem, I used a classic GPU-stressing WebGL demo from Three.js:

In Safari, opening the Three.js animation example immediately flipped the machine to the discrete AMD GPU with stable 60 FPS.
In Brave, the same page stayed on the Intel iGPU and, even under heavy rendering load, barely reached 30 FPS.

I checked the report from brave://gpu, which showed that Brave was clearly hardware-accelerating, just on the wrong adapter.

What brave://gpu Revealed

I opened brave://gpu and found something like this:

Both GPUs were detected:
- AMD Radeon Pro Vega 20
- Intel UHD Graphics 630
But Brave marked the Intel chip as ACTIVE, and WebGL reported:
- GL_RENDERER: ANGLE Metal Renderer: Intel UHD Graphics 630

So it wasn’t a software fallback. Chromium was simply choosing the low‑power GPU and sticking to it.

The Real Fix: Force High‑Performance GPU at Launch

Since the Chromium flag to force high‑performance GPU is not available on Intel dual‑GPU macOS builds, there’s no UI toggle that persists this choice.

Chromium, however, still honors a startup argument that overrides the early GPU selection.

IMPORTANT

Make sure to quit Brave completely (Cmd + Q) first. On macOS, open -a will simply bring an already-running instance to the foreground and silently ignore any new --args.

Run this in Terminal:

open -a "Brave Browser" --args --force_high_performance_gpu

After launching Brave this way, brave://gpu finally showed the AMD GPU as ACTIVE, and the Three.js demo ran just as smoothly as it did in Safari.

Why this works

Chromium decides which GPU to bind very early during startup for its GPU process. On dual‑GPU Macs it defaults to the integrated Intel chip for battery life, and once that choice is made, most WebGL/WebGPU contexts follow it for the rest of the session. It seems this issue persists to this day (see Chromium issue #393263507).

The --force_high_performance_gpu argument injects a “prefer discrete GPU” directive before that decision locks in, so the GPU process starts on AMD, and all rendering follows.

Functionally this is the same behavior the missing force-high-performance-gpu flag would provide if it were supported on this platform, it’s just applied through a launch argument instead of Brave’s flags UI.

Make It Permanent: One‑Click Automator Launcher

Typing the launch command every time is annoying, so I made a tiny Automator app that starts Brave in AMD mode.

Open Automator → New Document → choose Application.
Add Run Shell Script.

Set shell to /bin/zsh and paste:

open -a "Brave Browser" --args --force_high_performance_gpu

Save as something like Brave AMD.app.
Drag Brave AMD.app into the Dock and remove the original Brave icon.

NOTE

Remember to quit Brave (Cmd + Q) before clicking the launcher if you are switching modes; macOS won’t apply launch arguments to an existing running process.

Here’s what the Automator setup looks like:

Now every time I click the Dock icon, Brave launches using the AMD GPU.

Bonus: Make the Launcher Look Like Brave

Because the launcher is a separate app, it has a generic Automator icon by default. I changed it to the Brave icon:

Finder → Applications → right‑click Brave Browser.app → Get Info.
Click the small Brave icon top‑left to highlight it.
Press Cmd‑C.
Right‑click Brave AMD.app → Get Info.
Click its small icon top‑left and press Cmd‑V.

If the Dock doesn’t update immediately, remove/re‑add the launcher.

Tradeoffs

Forcing the discrete GPU means:

More battery drain.
More heat/fan usage.

For me that’s a fair trade whenever I’m doing heavy WebGL/WebGPU stuff (3D demos, map visualizations, creative coding, etc.). Daily browsing on battery? I can still quit and open the normal Brave app if I want Intel. Not to mention, the battery on my MacBook Pro hasn’t been able to last through a single hour of normal use for ages, I couldn’t care less about battery life.

Self‑Hosted Analytics for a Personal Blog

Sat, 01 Nov 2025 00:00:00 GMT

How I added privacy‑friendly visitor statistics to a static Astro site using a tiny Node.js endpoint, SQLite, PM2, and Caddy.

Instead of using third‑party analytics like Cloudflare, I’m running a tiny self‑hosted tracker and you can also learn how it works and replicate it.

What I’ve built

A tiny analytics API that:

Accepts page‑view pings from this blog (/track)
Provides comprehensive analytics via /summary and /daily endpoints
Lets me export raw visits as CSV (/export)
Stores data in a single SQLite file for easy backup/migration
Runs forever with pm2, served over HTTPS with Caddy

You can adapt this for any static site (Astro, Hugo, etc.).

0) Prerequisites

A cloud VM with a public IP
A subdomain for the analytics endpoint
Basic DNS access (Cloudflare etc.)
Node.js 18+ and npm

WARNING

Debian/Ubuntu users: Do not use sudo apt install nodejs npm directly from the default repositories, as they often contain severely outdated Node.js versions (e.g., Node.js 10.x or 12.x) with known security vulnerabilities and no security patches. Always install from NodeSource to get current, supported versions.

Debian/Ubuntu

sudo apt update && sudo apt upgrade -y

# Install latest Node.js LTS from NodeSource
curl -fsSL https://deb.nodesource.com/setup_lts.x | sudo -E bash -
sudo apt install -y nodejs git

# Verify installation
node --version  # Should show the latest LTS version
npm --version

Fedora CoreOS

IMPORTANT

Fedora CoreOS is an immutable operating system designed for containerized workloads. You cannot install packages directly with dnf install. Instead, use toolbox to create a mutable container environment.

For more information about Fedora CoreOS on GCP, see the official documentation.

Step 1: Create and enter a toolbox

toolbox create
toolbox enter

Step 2: Install Node.js inside the toolbox

# Install Node.js from Fedora's default repositories
sudo dnf install -y nodejs npm git

# Verify installation
node --version  # Should show v22.x.x
npm --version

Step 3: Work inside the toolbox

All subsequent commands (creating the project, installing packages, running the server) should be executed inside the toolbox. The toolbox persists across reboots and you can re-enter it anytime with toolbox enter.

TIP

To exit the toolbox, type exit. To re-enter later, use toolbox enter.

1) Create the analytics service

Create a new folder and initialise a Node project:

TIP

I use better-sqlite3 instead of sqlite3 to avoid npm vulnerabilities and get better performance. It’s synchronous (simpler) and has fewer security issues.

mkdir -p ~/page-stats/data && cd ~/page-stats
npm init -y
npm install express better-sqlite3

Create server.js:

const fs = require("fs");
const express = require("express");
const Database = require("better-sqlite3");
const app = express();
app.set("trust proxy", 1);
app.set("json spaces", 2);

fs.mkdirSync("./data", { recursive: true });
const db = new Database("./data/stats.db");

app.use(express.json({ limit: "2kb" }));
app.use(express.text({ type: "text/plain", limit: "2kb" }));

db.exec(`
  PRAGMA journal_mode = WAL;
  PRAGMA synchronous = NORMAL;
  PRAGMA busy_timeout = 5000;
`);

db.exec(`CREATE TABLE IF NOT EXISTS visits (
  id INTEGER PRIMARY KEY AUTOINCREMENT,
  path TEXT,
  referrer TEXT,
  ua TEXT,
  ip TEXT,
  ts DATETIME DEFAULT CURRENT_TIMESTAMP
)`);

db.exec(`CREATE INDEX IF NOT EXISTS idx_visits_path ON visits(path)`);
db.exec(`CREATE INDEX IF NOT EXISTS idx_visits_ts ON visits(ts)`);

const stmtInsert = db.prepare(
  `INSERT INTO visits (path, referrer, ua, ip) VALUES (?, ?, ?, ?)`
);
const stmtExport = db.prepare(
  `SELECT * FROM visits ORDER BY ts DESC`
);
const stmtDaily = db.prepare(`
  SELECT path, ip, COUNT(*) AS views, MAX(ts) AS last_seen
  FROM visits
  WHERE ts >= DATE('now', '-30 days')
  GROUP BY DATE(ts), path, ip
  ORDER BY last_seen DESC
`);
const stmtSummaryTotal = db.prepare(`
  SELECT
    COUNT(*) AS total_views,
    COUNT(DISTINCT path) AS unique_paths,
    COUNT(DISTINCT ip) AS unique_visitors,
    MIN(ts) AS first_visit,
    MAX(ts) AS last_visit
  FROM visits
`);
const stmtSummaryByPath = db.prepare(`
  SELECT path, COUNT(*) AS views
  FROM visits
  GROUP BY path
  ORDER BY views DESC
`);
const stmtSummaryByDay = db.prepare(`
  SELECT DATE(ts) AS day, COUNT(*) AS views
  FROM visits
  GROUP BY day
  ORDER BY day DESC
`);
const stmtSummaryByIp = db.prepare(`
  SELECT ip, COUNT(*) AS views
  FROM visits
  GROUP BY ip
  ORDER BY views DESC
`);

app.post("/track", (req, res) => {
  let body = req.body;

  // Handle both text/plain and JSON input
  if (typeof body === "string") {
    try {
      body = JSON.parse(body);
    } catch {
      body = {};
    }
  }

  const { path: rawPath, referrer: rawReferrer } = body || {};
  const path = typeof rawPath === "string" ? rawPath : "";
  const referrer = typeof rawReferrer === "string" ? rawReferrer : "";
  // Always read user-agent from the real HTTP header — never trust the client body
  const userAgent = req.headers["user-agent"] || "";
  const ip = req.ip || "";

  if (!path) {
    console.warn("[analytics] Missing path field in request body");
    return res.sendStatus(400);
  }

  try {
    stmtInsert.run(path, referrer, userAgent, ip);
    res.sendStatus(204);
  } catch (err) {
    console.error("DB insert error:", err);
    res.sendStatus(500);
  }
});

// Escape a value for safe CSV output
// Doubles any internal quotes ("  →  "")
// Prefixes values starting with =, +, -, @, tab, or CR with a tab to
// neutralise spreadsheet formula injection (CVE-class: CSV injection)
function csvEscape(val) {
  const str = String(val ?? "");
  const safe = /^[=+\-@\t\r]/.test(str) ? `\t${str}` : str;
  return `"${safe.replace(/"/g, '""')}"`;
}

// CSV export
app.get("/export", (req, res) => {
  try {
    const rows = stmtExport.all();
    const csv = [
      "id,path,referrer,ua,ip,ts",
      ...rows.map(r =>
        [r.id, r.path, r.referrer, r.ua, r.ip, r.ts]
          .map((v, i) => i === 0 ? r.id : csvEscape(v))
          .join(",")
      )
    ].join("\n");
    res.setHeader("Content-Disposition", "attachment; filename=stats.csv");
    res.type("text/csv").send(csv);
  } catch (err) {
    res.status(500).send(err.message);
  }
});

// --- Daily summary (views per day and path, last 30 days) ---
app.get("/daily", (req, res) => {
  try {
    res.json(stmtDaily.all());
  } catch (err) {
    res.status(500).json({ error: err.message });
  }
});

// --- Totals summary (overall + by path + by day, all-time) ---
app.get("/summary", (req, res) => {
  try {
    res.json({
      ...stmtSummaryTotal.get(),
      by_path: stmtSummaryByPath.all(),
      by_day:  stmtSummaryByDay.all(),
      by_ip:   stmtSummaryByIp.all(),
    });
  } catch (err) {
    res.status(500).json({ error: err.message });
  }
});

app.listen(8080, () => console.log("Analytics server running on port 8080"));

Quick test:

node server.js

In another shell:

curl -X POST http://localhost:8080/track \
  -H "Content-Type: text/plain" \
  -d '{"path":"/hello","referrer":""}'
curl "http://localhost:8080/summary"

You should see a JSON object with total views and breakdowns.

2) Keep it running in the background

Debian/Ubuntu: pm2

sudo npm install -g pm2
pm2 start server.js --name stats
pm2 startup
# Run the one-line command pm2 prints for systemd, then:
pm2 save

Check status:

pm2 ls

Stop the service:

pm2 stop stats

Restart the service:

pm2 restart stats

Remove from PM2 (stops and removes from process list):

pm2 delete stats

Completely disable PM2 auto-start (removes systemd integration):

pm2 unstartup
# Run the command it suggests with sudo

Or manually disable the systemd service:

sudo systemctl disable pm2-$USER
sudo systemctl stop pm2-$USER

Fedora CoreOS: Podman + Systemd

Step 1: Create a Dockerfile (inside toolbox)

Inside toolbox, in ~/page-stats directory

cat > Dockerfile <<'EOF'
FROM node:22-alpine
WORKDIR /app
COPY package*.json ./
RUN npm install --production
COPY server.js ./
RUN mkdir -p /app/data
EXPOSE 8080
CMD ["node", "server.js"]
EOF

Step 2: Exit toolbox and build the container image on the host

exit

On the Fedora CoreOS host, build the image

cd ~/page-stats
podman build -t localhost/page-stats:latest .

Step 3: Create a data directory for persistence

IMPORTANT

Why use a separate data directory: Storing the database in ~/page-stats/data/ keeps it outside the container image, so it persists across container restarts. The application code (server.js, node_modules) stays in the image, so rebuilds with podman build always take effect.

Create the data directory:

mkdir -p ~/page-stats/data

Step 4: Create systemd service

Create systemd user service directory:

mkdir -p ~/.config/systemd/user/

Create the service file:

cat > ~/.config/systemd/user/page-stats.service <<'EOF'
[Unit]
Description=Page Stats Analytics Service
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
Restart=always
RestartSec=10
ExecStartPre=-/usr/bin/podman rm -f -i page-stats
ExecStart=/usr/bin/podman run --rm --name page-stats \
  -p 8080:8080 \
  -v %h/page-stats/data:/app/data:Z \
  localhost/page-stats:latest

ExecStop=/usr/bin/podman stop -t 10 page-stats

[Install]
WantedBy=default.target
EOF

Step 5: Enable and start the service

Reload systemd:

systemctl --user daemon-reload

Enable service to start on boot:

loginctl enable-linger $USER

Start the service:

systemctl --user enable --now page-stats.service

Check status:

systemctl --user status page-stats.service

Stop the service:

systemctl --user stop page-stats.service

Restart the service:

systemctl --user restart page-stats.service

Disable and stop (removes from startup):

systemctl --user disable --now page-stats.service

Step 6: View logs

Follow logs in real-time:

journalctl --user -u page-stats.service -f

View recent logs:

journalctl --user -u page-stats.service -n 50

IMPORTANT

Updating the code: If you modify server.js (e.g., changing the password), you must rebuild the container image and restart the service:

cd ~/page-stats
podman build -t localhost/page-stats:latest .
systemctl --user restart page-stats.service

The container runs a snapshot of your code from when it was built, not the live file.

3) Obtain HTTPS with Caddy (reverse proxy)

Debian/Ubuntu: Install Caddy

Caddy install guide

Fedora CoreOS: Install Caddy Static Binary

Download and install Caddy:

curl -o caddy 'https://caddyserver.com/api/download?os=linux&arch=amd64'

Make it executable:

chmod +x caddy

Move to system location:

sudo mv caddy /usr/local/bin/

Verify installation:

caddy version

Create Caddy user and group:

sudo groupadd --system caddy
sudo useradd --system --gid caddy --create-home --home-dir /var/lib/caddy --shell /usr/sbin/nologin caddy

Create systemd service:

sudo tee /etc/systemd/system/caddy.service > /dev/null <<'EOF'
[Unit]
Description=Caddy
Documentation=https://caddyserver.com/docs/
After=network.target network-online.target
Requires=network-online.target

[Service]
Type=notify
User=caddy
Group=caddy
ExecStart=/usr/local/bin/caddy run --environ --config /etc/caddy/Caddyfile
ExecReload=/usr/local/bin/caddy reload --config /etc/caddy/Caddyfile --force
TimeoutStopSec=5s
LimitNOFILE=1048576
PrivateTmp=true
ProtectSystem=full
AmbientCapabilities=CAP_NET_ADMIN CAP_NET_BIND_SERVICE

[Install]
WantedBy=multi-user.target
EOF

Create log directory

Before configuring Caddy, create the log directory with correct permissions:

sudo mkdir -p /var/log/caddy
sudo chown -R caddy:caddy /var/log/caddy
sudo chmod 755 /var/log/caddy

Generate a bcrypt password hash

Before writing the Caddyfile, generate the hashed password Caddy requires for basic_auth:

caddy hash-password
# Enter your password at the prompt.
# Copy the $2a$14$... string it outputs — you'll paste it into the Caddyfile.

IMPORTANT

Never paste a plain-text password into the Caddyfile. Caddy only accepts bcrypt hashes here.

Configure Caddyfile

Then configure /etc/caddy/Caddyfile:

sudo nano /etc/caddy/Caddyfile

Add the following:

# Replace with your own domain and congratulations you have found my analytics domain ;-)
# Feel free to block it by using uBlock Origin if you don't want me to know you are stalking me

stats.zaku.eu.org {
        log {
                output file /var/log/caddy/stats-access.log {
                        roll_size 10MB
                        roll_keep 10
                        roll_keep_for 720h
                }
        }

        header {
                Access-Control-Allow-Origin "https://michifumi.de"
                Access-Control-Allow-Methods "GET, POST, OPTIONS, HEAD"
                Access-Control-Allow-Headers "Content-Type, Authorization"
                Access-Control-Max-Age "86400"
                Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
                X-Content-Type-Options "nosniff"
                X-Frame-Options "DENY"
                Referrer-Policy "strict-origin-when-cross-origin"
        }

        @options method OPTIONS
        handle @options {
                respond 204
        }

        # /track is public — the blog sends beacons here without credentials
        handle /track {
                reverse_proxy localhost:8080
        }

        # All other endpoints (/summary, /daily, /export) require login
        @protected not path /track
        handle @protected {
                basic_auth {
                        # Replace with your own username and the hash from caddy hash-password
                        admin $2a$14$REPLACE_WITH_YOUR_HASH
                }
                reverse_proxy localhost:8080
        }
}

If ports 80/443 are already in use, you can run Caddy on alternate ports, and for a publicly trusted TLS cert on non-443, you typically need DNS-01 validation (see below optional).

Safely updating Caddy configurations

sudo caddy fmt --overwrite /etc/caddy/Caddyfile
sudo caddy validate --config /etc/caddy/Caddyfile

Start the service and check status:

sudo systemctl daemon-reload
sudo systemctl enable --now caddy
sudo systemctl status caddy -l --no-pager

Use reload after the service is running and you make future changes:

sudo systemctl reload caddy

Optional: DNS-01 with Cloudflare (when 80/443 are busy)

If you cannot free ports 80/443, use DNS-01 so Let’s Encrypt validates via DNS. This requires a Caddy build with the Cloudflare DNS module.

Install Go (latest stable version)

TIP

Visit https://go.dev/dl/ to find the latest stable version. Replace 1.26.6 below with the current version number.

Debian/Ubuntu:

sudo apt remove -y golang-go golang || true
cd /tmp
# Replace 1.26.6 with the latest version from https://go.dev/dl/
curl -LO https://go.dev/dl/go1.26.6.linux-amd64.tar.gz
sudo rm -rf /usr/local/go
sudo tar -C /usr/local -xzf go1.26.6.linux-amd64.tar.gz
echo 'export PATH=/usr/local/go/bin:$PATH' | sudo tee /etc/profile.d/go.sh >/dev/null
source /etc/profile.d/go.sh

Fedora CoreOS:

cd /tmp
# Replace 1.26.6 with the latest version from https://go.dev/dl/
curl -LO https://go.dev/dl/go1.26.6.linux-amd64.tar.gz
sudo rm -rf /usr/local/go
sudo tar -C /usr/local -xzf go1.26.6.linux-amd64.tar.gz
echo 'export PATH=/usr/local/go/bin:$PATH' | sudo tee /etc/profile.d/go.sh > /dev/null
source /etc/profile.d/go.sh

Verify:

go version

Lock Go to the local toolchain

go env -w GOTOOLCHAIN=local
go env -w GOPROXY=https://proxy.golang.org,direct

Install xcaddy

go install github.com/caddyserver/xcaddy/cmd/xcaddy@latest
export PATH="$PATH:$HOME/go/bin"

Build Caddy with the Cloudflare DNS module

xcaddy build --with github.com/caddy-dns/cloudflare

Replace the Caddy binary

sudo systemctl stop caddy
sudo install -m 0755 ./caddy /usr/local/bin/caddy
sudo systemctl start caddy

Verify the module exists

caddy list-modules | grep cloudflare

Create a Cloudflare API token with

Zone.Zone:Read
Zone.DNS:Edit

Scope it to your zone.

Add the token to the Caddy systemd service

sudo systemctl edit caddy

[Service]
Environment=CLOUDFLARE_API_TOKEN=YOUR_TOKEN_HERE

sudo systemctl daemon-reload

Update the Caddyfile

{
        http_port 8081
        https_port 8443
}

stats.zaku.eu.org {
        tls {
                dns cloudflare {env.CLOUDFLARE_API_TOKEN}
        }

        log {
                output file /var/log/caddy/stats-access.log {
                        roll_size 10MB
                        roll_keep 10
                        roll_keep_for 720h
                }
        }

        header {
                Access-Control-Allow-Origin "https://michifumi.de"
                Access-Control-Allow-Methods "GET, POST, OPTIONS, HEAD"
                Access-Control-Allow-Headers "Content-Type, Authorization"
                Access-Control-Max-Age "86400"
                Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
                X-Content-Type-Options "nosniff"
                X-Frame-Options "DENY"
                Referrer-Policy "strict-origin-when-cross-origin"
        }

        @options method OPTIONS
        handle @options {
                respond 204
        }

        # /track is public — the blog sends beacons here without credentials
        handle /track {
                reverse_proxy localhost:8080
        }

        # All other endpoints (/summary, /daily, /export) require login
        @protected not path /track
        handle @protected {
                basic_auth {
                        admin $2a$14$REPLACE_WITH_YOUR_HASH
                }
                reverse_proxy localhost:8080
        }
}

With https_port 8443 set, access the API at https://stats.zaku.eu.org:8443 and update your tracking endpoint to include :8443.

Validate and reload

sudo caddy fmt --overwrite /etc/caddy/Caddyfile
sudo caddy validate --config /etc/caddy/Caddyfile
sudo systemctl reload caddy
sudo systemctl status caddy -l --no-pager

Confirm issuance

sudo journalctl -u caddy -f

4) DNS (Cloudflare)

Add an A record:

Name: stats
Target: your VM public IP
Proxy status: DNS only (gray cloud)

Caddy will fetch a Let’s Encrypt certificate automatically.
After issuance, HTTPS works at https://stats.zaku.eu.org.

5) Add the tracking snippet to the blog (Astro)

Place this near the bottom of your frontend code, such as BaseLayout.astro (before </body>):

<script is:inline>
  (() => {
    if (typeof window === 'undefined' || typeof navigator === 'undefined') return;

    const endpoint = 'https://stats.zaku.eu.org/track';
    const payload = JSON.stringify({
      path: window.location.pathname,
      referrer: document.referrer || ''
    });

    try {
      if (navigator.sendBeacon) {
        const blob = new Blob([payload], { type: 'text/plain' });
        const ok = navigator.sendBeacon(endpoint, blob);
        if (ok) return;
      }
      fetch(endpoint, {
        method: 'POST',
        body: payload,
        keepalive: true,
        mode: 'no-cors',
        headers: { 'Content-Type': 'text/plain' }
      }).catch(err => console.warn('[analytics] fetch failed', err));
    } catch (err) {
      console.warn('[analytics] unexpected error', err);
    }
  })();
</script>

NOTE

Privacy-focused browsers like Mullvad Browser and Tor Browser will block this tracking script by default. Users with ad blockers or privacy extensions will also not be tracked.

6) Verify end-to-end

From the browser:

Visit the blog.

The analytics API includes three useful endpoints for viewing detailed statistics:

/daily: Returns daily visit counts per path for the last 30 days. Useful for tracking recent trends over time.
/summary: Returns all-time totals plus breakdowns by path and by day, suitable for comprehensive dashboard overviews.
/export: Downloads all raw visit data as CSV for backup or analysis in external tools.

These endpoints make it easy to visualise daily activity or build a simple dashboard.

`/daily` endpoint

Returns a JSON array with daily stats for each path, sorted by the most recent activity first:

[
  {
    "path": "/",
    "ip": "203.0.113.10",
    "views": 15,
    "last_seen": "2025-10-31 23:42:07"
  },
  {
    "path": "/blog1",
    "ip": "198.51.100.5",
    "views": 4,
    "last_seen": "2025-10-30 21:15:33"
  },
  {
    "path": "/",
    "ip": "203.0.113.10",
    "views": 8,
    "last_seen": "2025-10-30 18:30:12"
  },
  {
    "path": "/blog2",
    "ip": "203.0.113.10",
    "views": 3,
    "last_seen": "2025-10-30 14:05:44"
  }
]

Query it with:

curl -u admin "https://stats.zaku.eu.org/daily"

`/summary` endpoint

Returns top-level summary stats plus breakdowns:

{
  "total_views": 1234,
  "unique_paths": 21,
  "unique_visitors": 34,
  "first_visit": "2025-10-01 09:00:00",
  "last_visit": "2025-10-31 11:45:12",
  "by_path": [
    { "path": "/", "views": 800 },
    { "path": "/blog1", "views": 120 }
  ],
  "by_day": [
    { "day": "2025-10-31", "views": 45 },
    { "day": "2025-10-30", "views": 38 }
  ],
  "by_ip": [
    { "ip": "203.0.113.10", "views": 650 },
    { "ip": "198.51.100.5", "views": 340 }
  ]
}

Query it with:

curl -u admin "https://stats.zaku.eu.org/summary"

CSV export:

curl -u admin -L -o stats.csv "https://stats.zaku.eu.org/export"

TIP

All analytics endpoints can be accessed directly from your browser. Caddy will show a native login prompt — enter your admin username and password.

https://stats.zaku.eu.org/daily
https://stats.zaku.eu.org/summary
https://stats.zaku.eu.org/export (downloads CSV)

7) Data Migration

All analytics live in stats.db. To migrate to a new VM:

Debian/Ubuntu (PM2)

On the old VPS:

pm2 stop stats

# Checkpoint WAL to merge all data into the main database file
sqlite3 ~/page-stats/data/stats.db "PRAGMA wal_checkpoint(TRUNCATE);"

On your local machine:

scp user@OLD_VPS_IP:~/page-stats/data/stats.db ~/Downloads/stats.db
scp ~/Downloads/stats.db user@NEW_VPS_IP:~/page-stats/data/stats.db

On the new VPS:

pm2 start ~/page-stats/server.js --name stats

Fedora CoreOS (Podman)

On the old VPS:

# Stop the service
systemctl --user stop page-stats.service

# Back up the database
mkdir -p ~/backups
cp ~/page-stats/data/stats.db ~/backups/stats.db

On your local machine:

scp user@OLD_VPS_IP:~/backups/stats.db ~/Downloads/stats.db
scp ~/Downloads/stats.db user@NEW_VPS_IP:~/backups/stats.db

On the new VPS:

# Create the data directory and import the database
mkdir -p ~/page-stats/data
cp ~/backups/stats.db ~/page-stats/data/stats.db

# Start the service
systemctl --user start page-stats.service

8) Backup and Data Safety

WARNING

Always maintain regular backups! System updates, hardware failures, or accidental deletions can cause data loss.

Automated CSV Export Backup

Set up a daily backup using the /export endpoint. This works on both Debian/Ubuntu and Fedora CoreOS.

Create a backup script:

mkdir -p ~/backups
nano ~/backups/backup-stats.sh

Add the following content (replace YOUR_PASSWORD with your actual password — it will be read from the environment variable STATS_PASSWORD so it never appears in the log file):

#!/bin/bash
BACKUP_DIR="$HOME/backups/analytics"
mkdir -p "$BACKUP_DIR"

# Export CSV from the analytics endpoint using basic_auth
# Set STATS_PASSWORD in your environment or systemd unit
curl -fsSL -u "admin:${STATS_PASSWORD}" "https://stats.zaku.eu.org/export" \
  -o "$BACKUP_DIR/stats-$(date +%Y-%m-%d).csv"

# Keep only last 30 days of backups
find "$BACKUP_DIR" -name "stats-*.csv" -mtime +30 -delete

echo "Backup completed: $(date)"

Make it executable:

chmod +x ~/backups/backup-stats.sh

Debian/Ubuntu: Schedule with cron (daily at 2 AM):

crontab -e

Add this line:

0 2 * * * STATS_PASSWORD="YOUR_PASSWORD_HERE" /home/YOUR_USERNAME/backups/backup-stats.sh >> /home/YOUR_USERNAME/backups/backup.log 2>&1

Fedora CoreOS: Schedule with systemd timer (daily at 2 AM):

Create the service unit:

cat > ~/.config/systemd/user/backup-stats.service <<'EOF'
[Unit]
Description=Backup analytics CSV

[Service]
Type=oneshot
Environment=STATS_PASSWORD=YOUR_PASSWORD_HERE
ExecStart=%h/backups/backup-stats.sh
EOF

Create the timer unit:

cat > ~/.config/systemd/user/backup-stats.timer <<'EOF'
[Unit]
Description=Daily analytics backup

[Timer]
OnCalendar=*-*-* 02:00:00
Persistent=true

[Install]
WantedBy=timers.target
EOF

Enable and start the timer:

systemctl --user daemon-reload
systemctl --user enable --now backup-stats.timer

Verify the timer is active:

systemctl --user list-timers

Fedora CoreOS: Backup the Database File

On Fedora CoreOS, the database is stored directly at ~/page-stats/data/stats.db. You can back it up with a simple copy:

# Stop the service
systemctl --user stop page-stats.service

# Copy the database
cp ~/page-stats/data/stats.db ~/backups/stats-$(date +%Y-%m-%d).db

# Start the service
systemctl --user start page-stats.service

Debian/Ubuntu: Direct Database Backup

On Debian/Ubuntu with PM2, use SQLite’s built-in backup command (safe, works while the service is running):

sqlite3 ~/page-stats/data/stats.db ".backup '/home/YOUR_USERNAME/backups/stats-$(date +%Y-%m-%d).db'"

9) Troubleshooting

“Cannot GET /” when visiting the VM IP: normal — the API only responds to /track, /summary, /daily, and /export.
Mixed content blocked: ensure the endpoint is HTTPS and CORS allows your blog origin.
DNS check fails: gray‑cloud the stats record until the certificate is issued.
No data appears: test with a direct curl -X POST .../track and check pm2 logs.

Test your endpoint manually

You can manually test your tracking endpoint with:

curl -X POST http://localhost:8080/track \
  -H "Content-Type: text/plain" \
  -d '{"path":"/hello","referrer":""}'
curl "http://localhost:8080/summary"

A new entry appearing in /summary confirms your endpoint is working correctly.

This blog uses this as a self‑hosted, portable, privacy‑friendly analytics system. If you don’t want me to know you’ve visited my blog (I’d be really sad 😢), you can simply use uBlock Origin to block the domain above. If you want to build your own, feel free to fork these snippets and adapt the endpoints to your domain.

An Inappropriate Metaphor: Misusing AI

Wed, 29 Oct 2025 00:00:00 GMT

On why misusing AI feels a lot like misusing a light bulb.

Many people claim AI tools are scams, AI is unreliable, and AI is riddled with hallucinations. I believe that when you encounter such issues, the problem most likely isn’t with the AI itself, but rather how you’re using it.

Let’s take a light bulb as an example. A light bulb is designed to be screwed into a socket, powered on, and used to illuminate its surroundings. But if you insist on using it as a sex toy and shove it into your ass, you can certainly do that, however, you also run the risk of the bulb getting stuck. Because the bulb wasn’t designed for that purpose. It can do it, but it doesn’t do it well.

Similarly, if you can’t articulate your own thoughts clearly, or worse, use incorrect phrasing to prompt AI responses, the AI will misinterpret your input and deliver inaccurate information. It can do, but not good, just like how you use the bulb.

This is precisely why everyone should learn how to become a master AI prompt engineer, to use AI correctly, and make your life easier.

You can start learning here.
How To Ask Questions The Smart Way
Author: Eric Steven Raymond

Michifumi's Blog

Bypass E5 OneDrive 10GB Limit: Mount SharePoint

0. Create a Communication Site in SharePoint

Why a Communication Site is Essential

Creating the Site

1. Prerequisites and Installation

Step 1: Install MacPorts

Step 2: Install FUSE-T

Step 3: Install Rclone with Mount Support via MacPorts

Step 4: Bridge FUSE-T to Rclone (libfuse.2.dylib Symlink)

2. Configure Rclone with SharePoint and Crypt

Step 1: Authorize the SharePoint Base Remote (sp)

Step 2: Create the Encrypted Overlay Remote (sp-crypt)

3. Manual Mount & Connectivity Test (Optional)

Step 1: Create the Local Mount Points

Step 2: Execute the Mount Command

Key Parameters Explained

Exploring Remotes with Rclone Web (Optional)

4. Configure Automated Startup at Login (macOS Launchctl)

Step 1: Generate the LaunchAgent Configurations

1. Unencrypted Media Mount Service (com.user.rclone.sharepoint.plist)

2. Encrypted Vault Mount Service (com.user.rclone.sharepointvault.plist)

Step 2: Activate the Services

5. Maintenance and Operations

Manually Free All Local Space Immediately

Safe Unmounting

Inspecting and Truncating Logs

Managing AppleDouble (._*) and .DS_Store Companion Files

Preventing SharePoint Version Bloat (Critical)

6. Architectural Trade-offs & Ideal Workflows

The Golden Rule: Large Files Directly, Small Files Zipped

Clinging to Life on an Obsolete Intel Mac

The Redemption

twitter.now: Score, Don't Ban

I Won a Draw

Everyone should start using a better DNS

What is DNS

Jurisdictional Governance and Data Protection Regimes

Quad9 and Swiss Geopolitical Engineering

Vodafone Ireland and Telecommunications Retention Mandates

Security Profiling, Content Blocking, and State Censorship

Cyber Threat Intelligence vs. Passive Routing

ISP-Level Censorship and Legal Intermediary Blocking

Vodafone Secure Net Add-On

Cryptographic Protocols and Resolution Capabilities

The Last-Mile Security Paradox

Infrastructure, Routing Latency, and Network Stability

Anycast Topology and Peering Infrastructure

How to Actually Use Quad9 with DoT or DoH

Android 9 and later

iPhone, iPad, and macOS

Windows 11

Check if it worked

One last thing

Everyone should start using a VPN or Proxy

What are the differences, and which one should you choose?

Shadowsocks

Xray

SHODAN

bgp.tools

HE

References

The weird (?) dream

yt-dlp: Video Downloader with Open-Source GUI

Common Commands

Advanced Actions

List Formats

Download Subtitles

Download & Re-encode as high quality MP4 (H.264/AAC)

Download & Add Hardsub

The Rise, Fall, and Resurrection of JPEG XL

Act I: The Contender Arrives

Act II: The Google Guillotine

Act III: The Wilderness

Act IV: The Faithful Hold the Line

Act V: The Tide Turns

Epilogue: An Unfinished Story

Install Homebrew

Install JPEG XL tools

Basic Conversions in Terminal

Step 4: Bridge FUSE-T to Rclone (`libfuse.2.dylib` Symlink)

Step 1: Authorize the SharePoint Base Remote (`sp`)

Step 2: Create the Encrypted Overlay Remote (`sp-crypt`)

1. Unencrypted Media Mount Service (`com.user.rclone.sharepoint.plist`)

2. Encrypted Vault Mount Service (`com.user.rclone.sharepointvault.plist`)

Managing AppleDouble (`._*`) and `.DS_Store` Companion Files

What does `-a 100` mean?

Option A (recommended): `ssh-copy-id`