RC8810 IP Camera: tinkering and getting root access

When I moved into my appartment, one of the closets contained an IP camera, probably forgotten by the previous occupants. The camera was branded with an “Orange” logo, and had an Ethernet and an AC plug on the back. The camera, as presented in its manual Curious, I plugged it to my router and powered it on. It showed up as “SC0FD7FF”, and running nmap against it gave me several open ports:

Newsboat 2.37

6 months later, a new Newsboat release :) This one arrived a little later than expected because of a small mistake by one of the developers, which meant that the source tarball wasn’t available (mailing list reference). Enjoy!

Accessing the WSL2 filesystem from outside Windows

Quick tip I wish was easier to find: how to get access to your WSL2 files when you’re not currently running Windows and need to access a script that’s stored there.

• Go to Users/<USERNAME>/AppData/Local/Packages/
• Enter either CanonicalGroupLimited... or TheDebianProject..., depending on whether you got Ubuntu or Debian from the Store
• Your rootfs is in LocalState/ext4.vhdx

You can mount it with libvhdi:

$ sudo apt install vhdiutils
$ sudo vhdimount ext4.vhd /mnt/vhd
$ sudo mount -o ro /mnt/vhd/vhd1 /mnt/wsl

Booting Linux off of Google Drive

What it says in the title. This person modified their initramfs to add network and FUSE support, leading to mounting a Google Drive folder as /

Cloud Native Computing.

via lobste.rs

Newsboat 2.36 binaries

New Newsboat release ! Here are some binaries, as always compiled on Debian 12 :)

Clone arbitrary single Git commit

Nice nugget found in this Lobste.rs comment chain: cloning a single Git commit.

$ mkdir repo && cd repo
$ git init
$ git fetch --depth=1 REPO_URL COMMIT_ID
$ git reset --hard COMMIT_ID

Borgo Programming Language

Seen on lobste.rs, a transpiler for Go which gives it Rust-like syntax and functionalities, like algebraic data types (Result and Option) and pattern matching.

There’s a lot I like in this! I love Go for its GC, channels, and easy-to-grasp syntax, but it can feel a little barebones sometimes. I also like Rust for its nice types, but sometimes I feel it requires too much mental overhead. This looks like the best of both worlds, I’m interested to see how this will evolve, and how easy interoperability with existing Go packages really is.

Pushover: Simple notifications for iOS / Android

I’ve been using Pushover for 2 years as a general-purpose notification service: it reminds me of my friends’ birthdays, alerts me when there’s an issue on my server, or tells me when a long-running command finishes.

The API is super-simple, and it only costs $5 for lifetime access. I highly recommend it.

Unicode and UTF-8 (and emojis)

Doing some research for my bush hid the facts article led me to read about Unicode, as well as the various ways to encode Unicode code points. I didn’t really look into the Unicode standard (it looked too complicated), but I still wanted to go back and have a look at the nitty gritty details at some point. I only knew that UTF-8 was a 21-bit encoding, and that it could encode any code point in 1 to 4 bytes.

How to make the upcoming Neuromancer adaptation not suck

I’m sorry, they’re planning a Neuromancer adaptation?!

Looking into it, it looks like Apple are the ones behind it. Their TV series usually have very good production value, so I’m cautiously optimistic. The press release mentions that they’re adapting the first book, which makes sense as a story with a single main character will be easier to follow than the multi-protagonist, interweaving story from the last two books.

"bush hid the facts"

When I was a kid, I loved looking up easter eggs in the software and games I used regularly. It was so fun finding these messages hidden by the developers, or to have a silly little game available in some boring spreadsheet program. One “easter egg” which was more puzzling was in Windows Notepad. Under Windows XP, typing the sentence “bush hid the facts” in an empty Notepad window, saving it somewhere and the re-opening it would only show you garbled characters, either empty boxes or Chinese characters which translated to gibberish.

Searching through nixpkgs and NixOS modules without Internet

I’ve converted to NixOS! It’s very cool, and I like it a lot. My main gripe is that looking up derivations or NixOS configuration options seems to very much depend on using https://search.nixos.org. The website is fine, but I don’t like that there’s no real alternative you can use directly from your terminal, short of manually grepping through your copy of nixpkgs. All the raw data is here, so it was only a matter of writing wrappers around it.

Nettoyage de marmite

J’aime pas Marmiton à cause de sa merdification incroyable: sur PC c’est difficile à utiliser, et sur mobile c’est l’enfer.

J’ai bidouillé un bookmarklet pour nettoyer tout ça au max: Marmitonnage

Cliquez-glissez vers votre barre de favoris le bouton, et utilisez le favoris quand vous êtes sur une page Marmiton. Testé et approuvé sous Firefox.

Convert between speed (vitesse) and pace (allure)

I can never remember the formula, and every website with a form is full of ads. Enjoy. km/h min/km The formulas are the following: pace = ( 1 / speed) * 60 speed = 60 / pace “pace” has to be in decimal form, e.g. “4:30min” is “4.5”

Discworld Reading Order

I found this picture on Reddit some years ago, and it had been living in my photo library ever since. Here’s the origin, a Discworld fan site!

The guide was created by Krzysztof Kietzman. Thanks!

Debian-MoreBlue for LightDM GTK

When I first discovered Debian and installed it on my computer, I vividly remember the look of the login screen: a light blue background with swirls, and a plastic-looking login box. Based on the year (around 2010) and looking at screenshots on the Internet, I believe that was Debian Etch (4.0). Time sure flies! The login box on Debian Etch (source: usuariodebian.blogspot.com) I’d love to get this theme on a modern Debian.

AsyncIO - charles leifer

I agree with this blog post on Python’s asyncio. It adds a lot of complexity, and is ultimately a kludge to work around Python’s inability to do proper concurrency.

When developing non-trivial Python applications, I often hit a point where it is quicker and easier to just rewrite it in Go instead of losing time fighting with asyncio. I like Python for its large ecosystem and quick iteration capabilities, but asyncio adds too much mental overhead to be valuable for me.

(from lobste.rs)

wgmgr: a Wireguard server configuration manager

Hey! I have released a first version of a small program I made to scratch an itch: wgmgr. I use Wireguard as a VPN solution, but I wanted a fancier way to manage clients: manually generating keys is doable, but it becomes a pain on mobile devices for example. I’m aware of the existence of wg-easy, wireguard-ui, and a plethora of other Wireguard interfaces. I don’t want something web-based. Ideally, what I was looking for was a simple command-line interface to generate Wiregard configs tailored to my server.

Random Access Memories: 10th Anniversary Edition

Wow, I somehow missed this: Daft Punk released a 10th Anniversary edition of their latest album, Random Access Memories (has it been 10 years already?!).

This release includes 9 new tracks, totaling more than 30 minutes.

(from kottke.org)

The early days of Linux

Nice retrospective from a friend’s of Linus Torvalds (Lars Wirzenius) on how Linux started. I remember digging into the history of Linux several years ago, but I still learned new things in this article.

It’s very nicely written, full of small fun tidbits and anecdotes. I should really subscribe to LWN.

Windows on btrfs

This blogger created an unholy abomination using the btrfs driver for Windows and an open-source bootlader for Windows 10: dual-booting Windows and Archlinux from the same filesystem. The “Windows” and “usr” directories both live at the root of the drive.

ThinkPad X230: clearing an unknown Supervisor password

It might be obvious from the title of this post, but I bought a used Lenovo ThinkPad X230 from LeBonCoin without checking if it had a Supervisor password set. This means that everything worked fine until I wanted to tinker with the BIOS to change the boot options, when I was greeted with this scary-looking screen. After trying the usual “1234”, “0000”, and “password”, I decided to ask the seller. Unfortunately, they assured me that the machine had been “reset”, and that there was no password…

Is Your Son a Computer Hacker?

This article is a copy of the original Is Your Son a Computer Hacker from Adequacy.org. The original website doesn’t appear to be online anymore, so I’m copying it here for posterity’s sake. I am not the author of the article. As an enlightened, modern parent, I try to be as involved as possible in the lives of my six children. I encourage them to join team sports. I attend their teen parties with them to ensure no drinking or alcohol is on the premises.

50 Years Later, We’re Still Living in the Xerox Alto’s World

Very interesting retrospective on the Xerox Alto, the first modern personal computer. It is fascinating to see so much good ideas were first invented at a printer manufacturer’s research lab.

I knew the mouse was invented there, but seeing they also came up with modern WYSIWYG word processing, Smalltalk, and the desktop metaphor, is crazy cool. Here’s a web-based Xerox Alto emulator, based on the cheekily-named ContrAlto.

Using an iPod Video (2005) in 2023

I’ve been watching DankPods on YouTube for some time now (really entertaining guy btw). His bit is that he buys old iPods and does stupid stuff with them. Here’s one where he runs Doom Eternal off an iPod Classic in “hard drive” mode. What a maniac. This made me wonder how expensive it would be to get a used iPod and make it usable enough so that is plays my music library.

@TwitterDev - Starting Feb 9, no more free access to the Twitter API

Just like that, Twitter is announcing the end of their free API. It had already been severely limited in the past years, now requiring a verified phone number and a manual verification by a Twitter employee.

I’m not on Twitter anymore, but following the evolution from afar is like watching a car crash in slow motion: inevitable, terrible, but for some reason you can’t look away. I hope the funny bots will be able to move to Mastodon, and that amateur data analysts will find a way to scrape the data anyway.

NewsBoat binaries for Debian

I’m using Newsboat to read RSS feeds on my netbook. Unfortunately, the version in the Debian “stable” repository doesn’t yet support FreshRSS, albeit the latest release does. I have built the last two versions, and will try to follow up when new ones come out (once every 6 months).

These builds were made on Debian 11 (Bullseye). Enjoy 😊

Installing Overseerr without Docker or Snap

Overseerr is a request management web app for Radarr and Sonarr. The Overseerr docs are very clear about how to install their app: The Overseerr snap is the only officially supported Linux install method aside from Docker. Well, I don’t run Docker or snap on my home server, and I don’t plan on starting just for a single app. Let’s see if we can install it by hand, without going through either of these sources.

Mastodon RSS feeds

Cool tip I found online: you can access a Mastodon account’s RSS feed by appending “.rss” at the end of its profile URL. For example, to follow @Gargron@mastodon.social, you would add https://mastodon.social/@Gargron.rss to your RSS feed.

This is great, because it means I don’t have to create a Mastodon account to follow what people are saying on there 😊.

Apple to Allow Outside App Stores in Overhaul Spurred by EU Laws

News from Bloomberg tell us that Apple is working on allowing “third-party” App Stores to the iOS ecosystem (i.e. sideloading). In my opinion, that’s a huge customer win, but I’m waiting to see what actually comes out of this: Apple’s “right-to-repair” program had me really excited, but it turned out to be pretty much useless, costing almost the same as taking your iDevice to an Apple Store, with the added risk of breaking it even more.

Termsonic: a terminal client for Subsonic

I’ve been working on a new project for the last 2 weeks: a Subsonic client running in a terminal, with a nice Terminal User Interface (TUI). It works on Linux, Windows, and macOS, and should be compatible with most servers implementing the Subsonic API (it was successfully tested with Navidrome). It supports FLAC, OGG and MP3 files. All three formats are natively decoded in Go, which means the dependency list is quite minimal: no need to install ffmpeg, LAME, or anything of the sort.

Setting up cgit with Caddy v2

I have recently set up cgit over at git.sixfoisneuf.fr. I’m using Caddy as my Web server, which means that getting it to execute CGI applications took some work, as it is not possible by default. I have installed Caddy from the Debian package repository, so I can’t use third-party plugins such as http.handlers.cgi. If downloading a custom-made Caddy version works for you, you can do it to skip the wrapper section (you will also have to adapt the Caddy configuration).

Beyond Twitter: rediscovering RSS feeds

After Elon Musk announced that he would be buying Twitter to “bring back free speech to the platform”, I started thinking about ways I could leave the platform behind. Honestly, I had never been very talkative on the bird site, preferring to lurk around without reacting. I asked myself a simple question: “How did we keep up with the news before Twitter?”. The answer seemed obvious: RSS feeds. RSS is a file format which can represent articles in a computer-readable way (it uses XML).

Kindle Hacking: porting Doom to the Kindle 4

As promised, here is a writeup about how I ported Doom to my old Kindle 4! I will try to detail my thought process for each step, and why I chose to do it the way I did (spoiler: it’s mostly because that’s what worked first). It could be useful to read the previous part if you haven’t yet, because it details how the OS exposes the e-ink screen and hardware buttons to applications.

Kindle hacking: a deeper dive into the internals

In this blog post, we will research in more details how the system interacts with all the different hardware components of this e-book reader. In the previous blog post, we stayed within Amazon’s “walled garden” (kind of): our apps had to use the Kindle Developement Kit, and with it all kinds of restrictions: No socket connection. All network connections must be HTTP/S. Cannot react to key presses however we want: for example, pressing Menu always brings up a menu.

Kindle hacking: jailbreaking your Kindle 4 and writing Kindlets

I have been back at my folks for winter holiday, which means I’m rediscovering some old stuff I had laying around. One of these is a Kindle 4, an old ebook reader which was gathering dust in the corner of my room. After seeing someone use it as a weather station, I started to look up how I could go about running custom code on this thing. It turns out it’s pretty easy to get SSH access to the device as root, and from there add custom applications, or even access the framebuffer directly.

Oculus Quest wireless casting

I recently caved in and acquired an Oculus Quest. Even if Oculus is now part of the Facebook conglomerate (ugh), this piece of hardware is really impressive, and relatively affordable: you essentially get all the hardware you need to get access to the VR ecosystem for about ~€450. No need for a beefy PC or anything of the sort! On the technical side, it seems the headset runs a modified Android version (7.

Introducing RegRippy

This post was written as part of my work as a member of the Airbus CERT. Anectodes and opinions shared in this post only reflect my own beliefs and not necessarily my teammates’ or my employer’s. When investigating an intrusion on a system, the Windows registry can be a treasure mine of information. From quick wins like grabbing the machine’s name or recent documents to more advanced techniques like parsing shellbags, you can get some very deep insight on what a machine was used for.

AlexCTF Writeup

The only challenge I solved during this CTF was the “unVM_me” reverse engineering challenge (finally! Something other than crypto!) We were given a pyc (Python Bytecode) file containing the flag. Executing it asked for the flag, and told us if it was right or wrong. Decompiling the bytecode I used PyCDC to decompile the pyc file. This gave me the following source code (I modified it to add some error checking to help with debugging):

BITSCTF Writeup

Here’s a quick writeup on the two challenges I solved (Banana Princess and Beginner’s luck) during BITSCTF with the Cryptis team. It was my first CTF and a great experience :D Banana Princess For this challenge, we were given a PDF file which was said to have been encrypted. Hexdump, search for a header By running hexdump -C MinionQuest.pdf | head, we can get the header of the PDF file.

Analysis of a Word macro virus - 2701.doc

On 2017-01-27, I received a suspicious email on an address I no longer use. EDIT: I received two more emails with the same file, only the message was different. Is it a recent ongoing spam campaign? Hello, My name is Adam Buchbinder, I saw your GitHub repo and i’m pretty amazed. The point is that i have an open position in my company and looks like you are a good fit.

Nous sommes désolés de vous apprendre que...

Ce post est une traduction libre de “We Are Sorry To Inform You” Il présente des commentaires de peers auxquels certains articles fondateurs de l’informatique et de la cryptographie moderne ont été envoyés. E.W. DIJKSTRA “Goto Statements Considered Harmful” Cette publication essaie de nous convaincre que la fonctionnalité goto devrait être retirée des langages de programmation, ou au moins (puisque je ne pense pas qu’elle sera un jour éliminée) que les programmeurs cessent de l’utiliser.

3DS Hacking 101 (WIP)

3DS hacking can be a bit daunting to approach even by tech-savvy people because of the lingo and all the different security measures implemented by Nintendo. This post will try to clear everything up. Most of the information here comes from 3DBrew. Glossary o3DS(XL): Original 3DS (the first model) and its XL counterpart n3DS(XL): Upgraded 3DS (New 3DS & New 3DS XL) 2DS: the 2DS if functionnaly the same as an o3DS, so it’s just called “o3DS” CTR: codename for the 3DS NAND: Flash memory, the “hard disk” of your 3DS.