DEV Community: Mathieu Kerjouan

Q&D: Android Device Information

Mathieu Kerjouan — Wed, 14 Oct 2026 08:00:00 +0000

It can be necessary, sometime, to collect device information, especially to identify a specific kind of device for debugging purpose, or to identify unique devices. In Dart/Flutter, one can install the device_info_plus package to have access to lot of informations regarding the device where the application is installed. Let have a quick look on this one.

$ flutter pub add device_info_plus
Resolving dependencies... 
Downloading packages... 
  cupertino_icons 1.0.9 (2.0.0 available)
+ device_info_plus 13.3.0
+ device_info_plus_platform_interface 8.1.0
+ ffi 2.2.0
+ ffi_leak_tracker 0.1.2
+ file 7.0.1
+ flutter_web_plugins 0.0.0 from sdk flutter
  material_color_utilities 0.13.0 (0.13.1 available)
  meta 1.18.3 (1.19.0 available)
+ plugin_platform_interface 2.1.8
  test_api 0.7.12 (0.7.15 available)
  vector_math 2.4.2 (2.4.3 available)
+ web 1.1.1
+ win32 6.4.0
+ win32_registry 3.0.3
Changed 10 dependencies!
5 packages have newer versions incompatible with dependency constraints.
Try `flutter pub outdated` for more information.

The first step is to import the device_info_plus package in your code.

import 'package:device_info_plus/device_info_plus.dart';

One can extract only a small subset of all device information available, for example, to extract the device id, the id property can be retrieved and returned.

Future<String> getDeviceId() {
  DeviceInfoPlugin deviceInfoPlugin = DeviceInfoPlugin();
  String deviceInfo = await deviceInfoPlugin.deviceInfo;
  return deviceInfo.id;
}

If more information about a device is required, one can extract all of them as a Map<String, dynamic> using the data property.

Future<Map<String, dynamic>> getDeviceInfoMap() {
  DeviceInfoPlugin deviceInfoPlugin = DeviceInfoPlugin();
  BaseDeviceInfo deviceInfo = await deviceInfoPlugin.deviceInfo;
  return deviceInfo.data;
}

Some information are only available on a specific kind of device (e.g. iOS, Android, Browser). If the application has been developed with portability in mind, it can also be a good idea to extract device's information based on the architecture/platform.

Future<Map<String, dynamic>> getAndroidDeviceInfoMap() {
  DeviceInfoPlugin deviceInfoPlugin = DeviceInfoPlugin();
  AndroidDeviceInfo deviceInfo = await deviceInfoPlugin.androidInfo;
  return deviceInfo.data;
}

Here an example of the data extracted on an Android emulator:

I/flutter ( 3959): physicalRamSize: 2472
I/flutter ( 3959): type: user
I/flutter ( 3959): manufacturer: Google
I/flutter ( 3959): freeDiskSize: 464072704
I/flutter ( 3959): bootloader: unknown
I/flutter ( 3959): fingerprint: google/sdk_gphone64_x86_64/emu64xa:16/BE2A.250530.026.D1/13818094:user/release-keys
I/flutter ( 3959): host: e8e8f3751cda
I/flutter ( 3959): isLowRamDevice: false
I/flutter ( 3959): model: sdk_gphone64_x86_64
I/flutter ( 3959): id: BE2A.250530.026.D1
I/flutter ( 3959): brand: google
I/flutter ( 3959): hardware: ranchu
I/flutter ( 3959): product: sdk_gphone64_x86_64
I/flutter ( 3959): totalDiskSize: 6228115456
I/flutter ( 3959): supportedAbis: [x86_64, arm64-v8a]
I/flutter ( 3959): supported32BitAbis: []
I/flutter ( 3959): display: BE2A.250530.026.D1
I/flutter ( 3959): isPhysicalDevice: false
I/flutter ( 3959): version: {baseOS: , securityPatch: 2025-07-05, sdkInt: 36, release: 16, codename: REL, previewSdkInt: 0, incremental: 13818094}
I/flutter ( 3959): systemFeatures: [android.hardware.sensor.proximity, android.software.adoptable_storage, android.hardware.sensor.accelerometer, android.software.controls, android.hardware.faketouch, android.software.telecom, android.hardware.telephony.subscription, android.hardware.reboot_escrow, android.hardware.telephony.data, android.software.backup, android.hardware.touchscreen, android.hardware.touchscreen.multitouch, android.software.erofs, android.software.print, android.software.activities_on_secondary_displays, android.software.device_lock, android.software.voice_recognizers, android.software.picture_in_picture, android.hardware.fingerprint, android.hardware.sensor.gyroscope, com.google.android.feature.PERSONAL_SAFETY, android.software.vulkan.deqp.level, android.software.cant_save_state, android.hardware.security.model.compatible, android.hardware.telephony.messaging, android.hardware.telephony.calling, android.hardware.sensor.relative_humidity, android.hardware.bluetooth, android.software.window_magnification, andr
I/flutter ( 3959): tags: release-keys
I/flutter ( 3959): supported64BitAbis: [x86_64, arm64-v8a]
I/flutter ( 3959): availableRamSize: 967
I/flutter ( 3959): name: sdk_gphone64_x86_64
I/flutter ( 3959): time: 1753213259000
I/flutter ( 3959): device: emu64xa
I/flutter ( 3959): board: goldfish_x86_64

More information can be found on Android via the AndroidBuildVersion object (including the base name, the code name and the release).

Depending on the platform, a lot of values can be extracted. Here a quick list enumerating few of them (the ones the most interesting to me):

AndroidDeviceInfo:
- availableRamSize as int: Current unallocated RAM size of the device in megabytes, extracted from ActivityManager.MemoryInfo;
- board as String: The name of the underlying board, like "goldfish", extracted from Build.BOARD;
- brand as String: The consumer-visible brand with which the product/hardware will be associated, if any, extracted from Build.BRAND;
- device as String: The name of the industrial design, extracted from Build.DEVICE;
- fingerprint as String: A string that uniquely identifies this build (Do not attempt to parse this value.), extracted from Build.FINGERPRINT;
- hardware as String: The name of the hardware (from the kernel command line or /proc), extracted from Build.HARDWARE;
- manufacturer as String: The manufacturer of the product/hardware, extracted from Build.MANUFACTURER;
- version as AndroidBuildVersion: Android operating system version values derived from android.os.Build.VERSION;
IosDeviceInfo
- identifierForVendor: Unique UUID value identifying the current device;
- modelName: Commercial or user-known model name Examples: iPhone 16 Pro, iPad Pro 11-Inch 3;
- utsname: Operating system information derived from sys/utsname.h;
LinuxDeviceInfo
- id: A lower-case string identifying the operating system, excluding any version information and suitable for processing by scripts or usage in generated filenames;
- machineId: A unique machine ID of the local system that is set during installation or boot. The machine ID is hexadecimal, 32-character, lowercase ID;
MacOsDeviceInfo
- systemGUID: Device GUID;
WindowsDeviceInfo
- deviceId: Displayed as "Device ID" in Windows Setting

The next step will be to generate an unique reproducible identifier from different systems using those information. A list of resources to help thinking about all of that:

Best practices for unique identifiers from the official Android Developers Website;
Identifying App Installations from the official Android developers blog;
android-unique-device-id on github;
Unique ID of Android device on StackOverflow;
Generate a unique Android Device ID on gist;

As usual, happy hacking!

Cover image by Elena Ramseier on Unsplash

WeeklyReview#202641

Mathieu Kerjouan — Mon, 12 Oct 2026 10:00:00 +0000

This week was quite busy in my code. Redarging my main application/product, I started to implement the database schema with sqflite in flutter. I did also a lot of tests regarding the flexibility of sqflite, and its potential limits in my use case. To be honest, I don't really like how this library is working but it should do the jobs for now. I also played with the flutter_quill text editor library (and also fleather). Not so complex to use, can produce something pretty cool quick. Finally, the BlocSignal pattern used in Flutter seems really attractive, lot of examples are available on their repository and it can be a good alternative of my approach (doing everything from scratch to learn).

It was not expected, but it looks like my motivation was focused to do C code for mac_randomizer. This is definitively a pet project, but C is still one of my favorite language, even if it can be challenging to do some things (e.g. concurrency), it's still great to do kinda low-level code. The source code tree is now clean, the Makefile is minimalist but should work on any system using GNU Makefile. Most of the functions are now sorted by categories in their own source file. The last action was to start working on a minimalist implementation of a Mealy machine, a specific kind of finite state machine, to parse mac addresses, instead of using an external regexp library. Actually, the implementation is a bit hard, not because of the complexity, but because of the interface and the abstraction. My idea is to have something like that:

// first tokenize the mac address to validate the
// characters used. Luckily, a mac address only has
// 23 allowed characters: [a-fA-F0-9\-\.\:]
//
// char *string is the raw strings containing the
// mac address.
//
// size_t length is the max size of the string, the
// tokenizer must stop when reading a NUL char or when
// it reaches the length limit
//
// the struct token *tokens is an array of token, where
// each token contains the raw valid character, the 
// position of the character and the kind of token (e.g.
// digit, separator).
//
// the tokens should probably be defined inside another
// structure embedded the length of the array. This value
// should be incremented every time a valid character is
// found.
int
tokenizer(char *string, size_t length, struct token *tokens) {
  return fsm_start(string, length, state, tokens);
}

// secondly, the parser will get the tokens and will convert
// them into an internal binary representation of the mac
// address (e.g. uint8_t mac_address[6]).
//
// The arguments of this function are similar to the previous
// one. The final result is then stored in the mac_address
// variable.
int
parser(struct token *tokens, size_t length, uint8_t *mac_address){
  return fsm_start(tokens, length, state, mac_address);
}

// the question know is how to design correctly the fsm_start()
// function. It should have the possibility to deal with different
// kind of input, not only char, but also C data-structure. It
// should also be able to deal with different kind of output. Based
// on these requirements, the definition of the function should look
// like the snippet below.
//
// The input argument can be a problem here, at least for the
// mac address parsing feature. Indeed, a string representing a
// mac address only has a few format, with specific length:
//
//   EUI48-IEEE: xx-xx-xx-xx-xx-xx (max length 17)
//   EUI48-IETF: xx:xx:xx:xx:xx:xx (max length 17)
//   EUI48-CISCO: xxxx.xxxx.xxxx (max length 16)
//   EUI64-IEEE: xx-xx-xx-xx-xx-xx-xx-xx (max length 23)
//   EUI64-IETF: xx:xx:xx:xx:xx:xx:xx:xx (max length 23)
//
// the input string should then have a maximal value of 23
// (+1 with NUL), and a minimal value of 17(+1 with NUL). The
// output can also be limited to sizeof(uint8_t)*6=48bits or
// sizeof(uint8_t)*8=64bits. Using the 64bits version is perhaps
// the best choice because an EUI48 can be converted to an EUI64
// and vice versa. Note: I don't even think it's possible to
// compress this value, it will probably add more complexity
// for no real benefits on the long run.
int
fsm_start(
  void *input,
  size_t input_length,
  void *output,
  struct state *init
){
  // do something here.
}

// the states must also be defined somewhere. states can
// be created dynamically by instantiating different kind
// of object and pushing them together, or creating them
// "statically" in their own data-structure with their
// own callback functions. One of the idea is to create
// something like the code below.
//
// The handler_enter callback is called only when a transition
// occurs between states.
//
// The handler_input callback is executed when an input
// is received.
struct state {
  struct state*(handler_enter)(struct state *s);
  struct state*(handler_input)(void *input, void *output, struct state *s);
};

As you can see, it's a good mental exercise to find the right way to implement something like that in C. In fact, a mealy (or moore) FSM are being use with Regexp but also with other complex protocols like TCP. Reimplementing something like that to parse well specified data like a mac address is probably the best choice, and, if correctly done, it could also be used to encode as well.

Anyway, here some implementations from github:

More implementation examples can be also found in userland from OpenBSD, FreeBSD and NetBSD projects. Many of those tools can have an implementation of a finite state machine.

OpenBSD:
- usr.bin/patch/ed.c: it contains a small finite state machine implementation used to parse commands
- games/bs/bs.c
- usr.sbin/npppd/npppd/fsm.c
- usr.sbin/pppd/fsm.c
- lib/libc/gen/unvis.c
FreeBSD:
- crypto/openssl/ssl/statem/statem.c
NetBSD:
- libexec/telnetd/state.c
- sbin/init/init.c

Most of my posts are currently stuck in draft mode due to that, but I like the weekly review format. It is a good summary containing a lot of information in one place. Then, I think most of the coming publications will use this format.

Coding

📝 A deep dive into HEEx compilation from LiveView 1.2: A post explaining the foundation of the HEEx template systems present in Phoenix LiveView. I did not know it was tokenized. In fact, this is a very good news... It is becoming closer to the way clojure is dealing with HTML.

📝 an application in lisp you grow by talking to it: LISP is probably one of the greatest language of all time, in this article, the program is created by talking to an LLM during a coding session.

🏗️ WeaveC: A C compiler with inferred ownership and borrow checking for Rust-style memory safety.

🌐 Tools for your Elixir app: A starting point for each kind of application. Recommended tools, why we use them, and when to choose something else.

🏗️ cccc: measures Cognitive Complexity (SonarSource / G. Ann Campbell) and Cyclomatic Complexity (McCabe). I used similar tools in the past, like ccc and scc or sccc. Nice to have, even before if you add it in your CI/CD to evaluate the complexity of a commit.

📑 Reducing undefined behavior in the C language: undefined behavior in C is a nightmare. Probably one of the most complex part of the language, and it can lead to total disaster. This post is presenting the solution to avoid common mistakes and find a way to create safer C code. Actually, this is from a talk, and the slides are available online.

📝 What Every C Programmer Should Know About Undefined Behavior #1/3: the first article of a series about undefined behavior in C.

📝 Abstract Syntax Tree, An Example in C: a short publication with nice example to explain how to implement and use an AST.

📝 One-pass Compiler: a nice trick to compile code directly without passed inside different layer.

📖 Compiling to Assembly from Scratch: a book by the author of the two previous posts. neat.

📑 CASM: Implementing an Abstract State Machine based Programming Language

System

📝 Headers Up! What's New in httpd and relayd: HTTP header manipulation support and request filtering. I'm still using nginx, but httpd is becoming really better every new release.

📝 Locking down openat(2) and friends with O_BELOW and F_BELOW: a mail-exchange describing the (future?) openat function to open file with relative path (and more safety).

🏗️ scrcpy: Display and control your Android device.

🏗️ floci: gives you AWS-shaped services on your machine without requiring a cloud account, an auth token, or paid feature gates.

🏗️ riscv/learn: A community-driven, continuously updated compilation of RISC-V learning resources. Content is organized by topic and experience level to help you discover courses, software, documentation, and articles efficiently.

📖 Haskell: The Craft of Functional Programming: revised version.

🏗️ DPDK (Data Plane Development Kit): an open source framework for fast packet processing on standard hardware. It runs in cloud infrastructure, telecom networks, financial exchanges, particle accelerators, and radio telescopes. Most of your traffic already runs through it. Start by reviewing a patch, no account or setup required. I discovered it was also running not only on Linux... I need to try that.

📝 unikernels were hard. key word: were: unikernel IS THE WAY TO GO, but I still this a complex technology mixing a lot of features from many different part of any systems. In fact, this is really close to microkernel, and both are, to me, two things that should be merged together.

Network

🏗️ Open vSwitch (OVS): a production quality, multilayer virtual switch, designed to enable massive network automation through programmatic extension, while still supporting standard management interfaces and protocols.

🏗️ Open Virtual Network: a series of daemons for the Open vSwitch that translate virtual network configurations into OpenFlow.

Database

🏗️ Awesome Database Learning

🏗️ pgvector: Open-source vector similarity search for Postgres

Security

📝 Malicious Flutter Package while it have a Clean Code?: malware present in example directory inside a flutter project. Don't trust blindly all projects.

📝 How to fix a bug in a fix

📝 Chrome's Response to Recent ccTLD Registry Hijacks: Following recent .gh, .sl, and .as ccTLD domain hijacks, Chrome immediately blocked unauthorized HTTPS certificates via CRLSets to protect users automatically.

Telegram Desktop: one-click account takeover via IPC injection: a post describing the CVE-2026-107181, where one malicious actor can take control of a group by sharing a telegram link and opening it on the telegram desktop application. The problem is from the URI parser, when dealing with semicolons. That's an interesting attack, because many application can be ported on different systems, like Signal or SimpleXChat, and depending of the languages/tools used, some part of the can use different routines.

Security/Cryptography

📝 SequenceHash: multihashing for the rest of us

🌐 Hash Smash: Find ordinary collision attacks that reach more rounds with less total computation. Select a hash function’s chart, then one of its two round counts.

📑 MiniSHAKE: an extendable output function based on Keccak, with unlimited size output.

📑 TurboSHAKE: an extendable output function based on Keccak, with less rounds to improve performance.

🌐 Key Length: The minimum key sizes each source publishes for protecting data until a given year.

Embedded

🏗️ CPU Performance Engineering: A reading path for CPU performance engineering, from one instruction to production inference. Primary sources only, with a runnable benchmark for every section.

📝 The FPGA Chronicles: Open Source It

🏗️ PasRISCV:A RISC-V RV64GCV/RVA23 emulator written in Object Pascal. It simulates processor cores, memory, I/O, and much more.

Update/Upgrade

🔄 hackney 4.8.5: bug fixes.

🔄 Cowboy 2.20: security and bug fixes.

🔄 LibreSSL 4.2.2 and 4.3.3: security and bug fixes.

Computer Science

📑 Digital Hardware Design DFA, Mealy and Moore Machines: a lecture on Mealy/Moore machines

📑 A Report on Achieving Complete Regular-Expression Matching using Mealy Machines: an interesting (but complex) publication about regexp and finite state machine to match exact pattern.

📑 Effective Reductions of Mealy Machines: reducing mealy machines states and transitions.

Misc

📝 The empty brain: an amazing post about brain information processing. The brain is not storing information like a computer (a stream of bits), and in fact, it is not the only organ to "store it". It stores experiences, and experiences are different between every people alive, then, it will be impossible to "copy" experiences between humans. In fact, like the author is explaining in his publication, even if all neurons' states were extracted, copied and connected together, it will have no meaning because it would be outside of the body where the experiences have been learned.

Because the Information Processing metaphor is not even slightly valid, we will never have to worry about a human mind going amok in cyberspace; alas, we will also never achieve immortality through downloading. [...] We are organisms, not computers.

📝 Victime d’une fuite de données ? Voici dans quels cas vous pouvez réclamer une indemnisation: see also that on the CNIL website

📝 A strategist who called the Asian financial crisis sees parallels with the AI boom: another indicator the "AI" boom is not really doing what every one expect. I wanted to read The Myth Of AI's Miracle: Albert Edwards Spots The Same Fatal Flaw That Sank Asia In 1997, but, well, it is a premium article.

the productivity payoff from AI remains a forecast, rather than an observation [...] No AI productivity boost in the data yet [...] too many people believed the beguiling narrative and as a consequence, lent these economies cheap, abundant capital which was misallocated.

🐦 THE SIGNS THAT THE AI BOOM IS BUILT ON FAKE REVENUE ARE NOW HERE. Here is what is really happening: a thread about what could happen with the AI financial - SCAM - scheme. Anyway, it smells really bad, even worse than the crypto-currency bubble.

Every time an AI startup raises money at a higher valuation, the investor raises the value of its stake on its books and counts the increase as income. No cash comes in. The profit is on paper. [...] A large part of the sales and profits these companies report depends on money that investors, including the tech giants themselves, keep putting into OpenAI and Anthropic. If that funding slows, the backlog, the sales and the paper profits all weaken together.

Leaks of the week

🐦 Tata Consultancy Services: source code and credentials leaked.

🐦 UAE government: 17 millions entries from UAE government-related software licensing database

🐦 Get covered: more than 1 million customer records including email, phone numbers, physical address and more.

🐦 CAPEB: Around 4 millions records including emails and phone numbers.

🐦 Denmark government: 8.8 millions people impacted, Danish citizens and emigrates. The leak include Social security number, Age, Sex, Family relations, Physical address, Protected addresses and Sex change.

// Detect dark theme var iframe = document.getElementById('tweet-2107477791549907153-99'); if (document.body.className.includes('dark-theme')) { iframe.src = "https://platform.twitter.com/embed/Tweet.html?id=2107477791549907153&theme=dark" }

Cover Image by Alfred Schrock on Unsplash

WeeklyReview#202640

Mathieu Kerjouan — Mon, 05 Oct 2026 10:00:00 +0000

Another week of doing Erlang/Elixir code on expki project. Again, that's mostly a sandbox to remove my 2 years rust doing only Erlang code and infrastructure stuff. Things are moving though, and I have a way to deal with the public_key module from Elixir. It's not perfect yet and can be optimized, but it should do the job. I think you will read that in a post very soon.

My way to extract macros and records from Erlang source code has been moved to its own module called preprocessing. It is currently being tested, but it should work correctly. Many things remain to be added though, like the support for dynamic macros and perhaps other attributes from Erlang.

Dev.to is buggy. One big article I started to write few days ago was practically destroyed because of cache issue on the browser. When editing the file from the dashboard, an old version was displayed instead of the latest one. Don't save. Don't publish. Close the window, logout from your dev.to account and reconnect.

publish is now able to fetch all the posts from dev.to using the API and curl. I did not have a lot of time working on it this week though. It would be really nice to migrate few my articles very soon on my own domain.

mac_randomizer was a pet project I got year ago, simply an idea at first. I wanted to do a bit of C this week and started to play with that. Not a really serious project though.

Coding

📖 Course book: Open Source Introductory Systems Programming Textbook for the University of Illinois

🌐 zero-js: compiling code in HTML/CSS directly, without javascript.

📝 Optimizing a Lock-Free Ring Buffer

📝 Simplify Function Generation in Elixir with Macros: a quick reminder to generate function in Elixir with macros. A good way to do meta-programming.

📝 Elixir Anonymous functions: official documentation about anonymous/lambda functions in Elixir.

📝 Elixir Quote and unquote: official documentation about metaprogramming elixir with quote and unquote.

🏗️ pulso: A headless, open-source observability backend: unified logs, metrics, and traces access, built-in alerting, and a native Model Context Protocol (MCP) interface, built on Elixir/OTP with a Rust hot path for columnar data.

🏗️ erlang_pay: A pure-Erlang payment gateway library for Alipay (App pay), WeChat Pay v3 (JSAPI/Native) and Stripe (PaymentIntent).

📝 How Copy-on-Write Works with Memory-Mapped Files

📝 Disable debuginfo to improve Rust compile times

📝 Reverse Engineering Novalogic's Comanche Terrain Maps: not an expert in game programming, but reverse engineering is an amazing field. This article explains how to reverse the maps from an old game, it's in C, and it's a great one! I liked this quote:

Programmers in the early 90s didn't reinvent everything. They used the formats and tools the artists already had, like PCX files straight out of a paint program, and saved their cleverness for the parts that really needed it: the renderer.

📝 What TLA+ can and can't check: TLA+ fascinated me few years ago, and I started to learn it by myself. Unfortunately, I was not really good with it. Languages formal verifications/specifications can be challenging to learn, even more if you don't have any a real usage for them. It's good to read a post on this language, even more to clarify what TLA+ can do or not.

📝 Compiler Options Hardening Guide for C and C++: an extremely useful guide and reference to correctly set C compiler flags for hardened applications.

Database

🏗️ Dasha: PostgreSQL performance dashboard for analyzing database cluster health, identifying problems, and providing optimization recommendations.

System

🏗️ MiniOS: A full-featured desktop environment with a wide range of applications. Professional tools for creativity and development.

🏗️ Vinix: Vinix is an effort to write a modern, fast, and useful operating system in the V programming language.

📝 HardenedBSD August / September 2026 Status Report: mostly small modification and bug/security fixes.

📝 OpenBSD-current has moved to version 8.0: openbsd 8.0 will be ready soon.

📝 vmm(4)/vmd(8) gain support for multi-processor VMs: OpenBSD vmm/vmd can now have more than one CPU configured, that's a very good news!

📝 SmartOS: The illumos Way of Thinking About Servers: sunos, illumos and smartos... A good way to introduce them via this article.

🏗️ How To Secure A Linux Server: An evolving how-to guide for securing a Linux server that, hopefully, also teaches you a little about security and why it matters.

📝 Powerboard Tyche unveiled at Pianeta Amiga: Never got an Amiga, never installed AmigaOS, but since I learnt DragonFlyBSD kernel was a mix between FreeBSD and AmigaOS, I always wanted to test it. Another crazy thing is... the community is active! The passion for Amiga seems eternal. Crazy.

Security

📝 Auditing in the age of (good enough) AI

🏗️ apk-reverse: a skill to reverse APK.

📝 Proactive Defense: Hardening Code Pipelines and CI/CD Infrastructure: a must read to apply modern protection on CI/CD.

Organizations should mandate a minimum release-age cooldown of seven days before any newly published public package version becomes installable [...] Establishing a strict seven-day buffer provides the open-source ecosystem time to detect and pull poisoned releases before they reach internal builds. [...] All external packages and container images should, wherever possible, route through a centralized internal proxy that caches, inspects, and gates each component.

📝 The Developer is the New Perimeter: How Supply Chain Attacks Are Becoming Cloud Breaches: the number of supply chain attacks is growing, and this is another article to remind us to always verify the security of our CI/CD.

📝 Cops Can Bypass iPhone’s Automatic Reboot to Get Into Locked Phones, Leaked Video Claims

Security/Cryptography

📑 A Survey of Pseudorandom Codes:

📑 Fully Anonymous Perfect Secret-Sharing

🏗️ Jolt: Just One Lookup Table. Jolt is a zkVM (zero-knowledge virtual machine) for RISC-V, built to be the simplest, fastest, and most extensible general-purpose of its kind. A book is available.

📑 Formally Modeling the Terrapin Attack on SSH

📑 DASH: Distributed Asynchronous Schnorr with High Throughput

📑 Perpetual Encryption

📑 Lightweight Cryptography for Secure UAV Data Integrity Using Ascon-XOF128 and SHAKE128

📑 Forging 1024-bit RSA signatures in nearly SNFS time

📑 New Applications of RSA

Security/RedTeam

📝 Offensive Security: Pentesting Office Phones with SIPVicious: a post showing a quick demo of sipvicious against VoIP local server.

Embedded

🏗️ Sail architecture definition language: Sail is a language for defining the instruction-set architecture (ISA) semantics of processors: the architectural specification of the behaviour of machine instructions. Sail is an engineer-friendly language, much like earlier vendor pseudocode, but more precisely defined and with tooling to support a wide range of use-cases.

📝 You Can Make A Microprocessor That’s All Your Own

📝 Reverse Engineering the iPod Classic's Undocumented Mikey Chip

Updates/Upgrades

🔄 Hackney 4.8.4: many updates here, from the 4.8.1 to 4.8.4, fixing many bugs. If you are using a previous version, you should probably update it.

🔄 OpenBSD 7.9 Errata: a huge amount of patch (9) to fix security issues on the whole system. ldapd, nsd (8 CVEs), unbound (35 CVEs), iked and many other issues found on the kernel.

🔄 Qubes OS 4.3.2

Misc

📝 How to Optimize a CUDA Matmul Kernel for cuBLAS-like Performance: a Worklog

📝 Making Deep Learning Go Brrrr From First Principles

📝 AI Bros Are Having a Meltdown Because the Associated Press Stylebook Clarifies That AIs Don’t Have Feelings

📝 Someone ‘Torturing’ LLMs in a Robot Prison Has Triggered the Dumbest Debate in AI Yet: Yeah. Crazy right? LLMs are not conscious. Adding a "feature" to feel pain/pleasure in a program does not make it conscious, it adds just another variable in the state, or another way to interpret inputs. This can be called - at best - "LLM moding".

AIs are not conscious. They do not feel, experience, or suffer. They do not have innate preferences or underlying motivations. They are sequence completion engines, internally hollow, designed to follow instructions, and accomplish goals set by humans. Unfortunately, there’s a growing chorus of people who argue that AIs could now be, or may soon become, conscious. They argue that AIs may deserve rights and protections similar to those that we provide other conscious beings […] If this is how AI is developed, it will have a disastrous impact on the wellbeing of humanity.

Leaks of the week

📝 Alaxione: more than 8.5 millions patients impacted, data from 2010 to 2026. +5 millions phone numbers leaked, +1.4 millions e-mail, +300k social security number.

📝 KEL/Orisha: 1.3 million people impacted including +600k e-mail, +600+ phone number, +140k IBAN.

📝 PixelLeak: How AI Agents Exposed Developer Screenshots from Leading Tech Companies: Glow labs identified more than 13k screenshots from 300 organizations (including big companies). Impacted more than 900 repositories and 100k employees. It seems it was mostly skill issue there, and the "AI" were not hardened. Interesting leaks though, because if screenshots can leak, probably other data can be leak as well.

📝 FFRandonnée: 1.43 millions impacted people, more than 1 million e-mail and 663k phone numbers, with physical address location.

📝 Cookson-CLAL: complete credit card information have been leaked. No more information about the number of people impacted though.

📝 VosFactures: data leaks on one of the companies in charge of the digital invoices in France. No more information right now, but they have a database with more than 500k companies. Less than 1 month after the official launching of the digital invoices for the companies, one of the "big player" seems to have been impacted by a huge data leaks.

// Detect dark theme var iframe = document.getElementById('tweet-2104051150274408672-700'); if (document.body.className.includes('dark-theme')) { iframe.src = "https://platform.twitter.com/embed/Tweet.html?id=2104051150274408672&theme=dark" }

Cover Image by Konstantin Dyadyun on Unsplash

Erlang Preprocessor and Elixir Interoperability

Mathieu Kerjouan — Thu, 01 Oct 2026 10:00:00 +0000

Erlang and Elixir are both running on the BEAM, the Erlang Virtual Machine, designed for long-living and distribute. In most of the case, talking to Erlang modules via Elixir is straightforward, doing the opposite can be a bit challenging though, but it is okay. In few cases though, extracting values from Erlang can become a real problem. The Erlang PreProcessor (epp) is used to expand Erlang macros before compiling the code, this is a similar feature than one can found in C, C++ and many other languages. This is a powerful way to avoid code-deduplication, and optimize the execution of the code by directly applying a data-structure instead of a reference. It has many other benefits, but this is not the place here to list them all.

Erlang From Code Source to AST

Before doing anything, one should understand a bit how Erlang and the BEAM are working together. The procedure to compile Erlang source code into a binary file is a complex process, but it is possible to have the big picture in few steps.

Firstly, one need to create a file containing Erlang source code. In fact, this is not mandatory to create a file... but we will see that later. As reminder, an Erlang file prefix is .erl, and the name of the file must match the name of the module defined in the module itself..

$ cat > mod.erl <<EOF
-module(mod).
-compile(export_all).
-define(DATA, <<1,2,3,4,5>>).

f() -> ?DATA.
EOF

The code created is straightforward. A simple module is created exporting all functions, a macro is defined containing a binary, and finally, a function called f/0 is defined, returning the content of the macro.

The second step is to call the Erlang preprocessor called epp to expand all macros and generate the final source code. The preprocessor will import functions or data-structures from the external libraries (-include and -include_lib), expands the macros (-define and ?MACRO) and can return a list of tokens or the fully expanded source code. This part can easily be seen by using the -P or -E flags with the command erlc.

$ erlc -P mod.erl

$ cat mod.P
-file("mod.erl", 1).
-module(mod).
-compile(export_all).

f() ->
    <<1,2,3,4,5>>

As you can see, the file mod.P does not have any -define attribute, and the macro has been expanded. A new attribute -file has also been added to the source, at the first line. The preprocessor did its job, and the source code can now be tokenized.

The tokenization procedure can't be seen via a command line, and it will be required to evaluate an Erlang one-line with the erl command to have an idea of what's happening.

$ erl -noshell -eval '
  {ok, M}=file:read_file("mod.P"), 
  T = erl_scan:string(binary_to_list(M)),
  io:format("~p~n", [T]),
  init:stop().
'
{ok,[{'-',1},
     {atom,1,file},
     {'(',1},
     {string,1,"mod.erl"},
     {',',1},
     {integer,1,1},
     {')',1},
     {dot,1},
     {'-',3},
     {atom,3,module},
     {'(',3},
     {atom,3,mod},
     {')',3},
     {dot,3},
     {'-',5},
     {atom,5,compile},
     {'(',5},
     {atom,5,export_all},
     {')',5},
     {dot,5},
     {atom,7,f},
     {'(',7},
     {')',7},
     {'->',7},
     {'<<',8},
     {integer,8,1},
     {',',8},
     {integer,8,2},
     {',',8},
     {integer,8,3},
     {',',8},
     {integer,8,4},
     {',',8},
     {integer,8,5},
     {'>>',8},
     {dot,8}],
    12}

Here, the mod.P has been used instead of mod.erl, because usually, the scanner is scanning the expanded file, not the one containing the macros. This snippet is reading the source code, calling erl_scan:string/1 to scan the tokens, io:format/2 is called to print the result and finally, the VM is stopped by invoking init:stop/0. The result displayed is a list of tokens containing the annotations for each characters.

A quick note here, epp is usually privileged than erl_scan. The tokens from epp:parse_file/2 are already ready to be used with the parser. Here and example:

$ erl -noshell -eval '
  {ok, T} = epp:parse_file("./mod.erl", [{source_name, mod}]),
  io:format("~p~n", [T]),
  init:stop().
'
[{attribute,1,file,{"mod",1}},
 {attribute,1,module,mod},
 {attribute,2,compile,export_all},
 {function,5,f,0,
           [{clause,5,[],[],
                    [{bin,5,
                          [{bin_element,5,{integer,5,1},default,default},
                           {bin_element,5,{integer,5,2},default,default},
                           {bin_element,5,{integer,5,3},default,default},
                           {bin_element,5,{integer,5,4},default,default},
                           {bin_element,5,{integer,5,5},default,default}]}]}]},
 {eof,6}]

Let continue on the previous procedure. The next step before generating the AST (Abstract Syntax Tree) above, is to parse the tokens produced by erl_scan. To do that, erl_parse module is used. The final result can be produced with the -S flag when calling erlc or by calling erl_parse directly from the shell. Below, the AST produced by erlc.

$ erlc -S mod.erl

$ cat mod.S
{module, mod}.  %% version = 0
{exports, [{f,0},{module_info,0},{module_info,1}]}.
{attributes, []}.
{labels, 7}.
{function, f, 0, 2}.
  {label,1}.
    {line,[{location,"mod.erl",5}]}.
    {func_info,{atom,mod},{atom,f},0}.
  {label,2}.
    {move,{literal,<<1,2,3,4,5>>},{x,0}}.
    return.
{function, module_info, 0, 4}.
  {label,3}.
    {line,[]}.
    {func_info,{atom,mod},{atom,module_info},0}.
  {label,4}.
    {move,{atom,mod},{x,0}}.
    {call_ext_only,1,{extfunc,erlang,get_module_info,1}}.
{function, module_info, 1, 6}.
  {label,5}.
    {line,[]}.
    {func_info,{atom,mod},{atom,module_info},1}.
  {label,6}.
    {move,{x,0},{x,1}}.
    {move,{atom,mod},{x,0}}.
    {call_ext_only,2,{extfunc,erlang,get_module_info,2}}

The very same result can be done using erl_parse:parse_form/1, erl_parse:parse_exprs/1 or erl_parse_term/1 when the tokens are grouped using the {dot,_} token.

> erl_parse:parse_form([
  {'-',1},{atom,1,file},{'(',1},
    {string,1,"mod.erl"},{',',1},
  {integer,1,1},{')',1},{dot,1}
]).
{ok,{attribute,1,file,{"mod.erl",1}}}

> erl_parse:parse_form([
  {atom,7,f}, {'(',7}, {')',7}, {'->',7},
     {'<<',8},
       {integer,8,1}, {',',8},
       {integer,8,2}, {',',8},
       {integer,8,3}, {',',8},
       {integer,8,4}, {',',8},
       {integer,8,5},
     {'>>',8},
     {dot,8}
]).
{ok,{function,7,f,0,
              [{clause,7,[],[],
                       [{bin,8,
                             [{bin_element,8,{integer,8,1},default,default},
                              {bin_element,8,{integer,8,2},default,default},
                              {bin_element,8,{integer,8,3},default,default},
                              {bin_element,8,{integer,8,4},default,default},
                              {bin_element,8,{integer,8,5},default,default}]}]}]}}

> erl_parse:parse_term([
  {'<<',8},
    {integer,8,1}, {',',8},
    {integer,8,2}, {',',8},
    {integer,8,3}, {',',8},
    {integer,8,4}, {',',8},
    {integer,8,5},
  {'>>',8},
  {dot,8}
]).
{ok,<<1,2,3,4,5>>}

> {ok, File} = file:read_file("mod.P"), 
  {ok, Tokens, _} = erl_scan:string(
    binary_to_list(File)
  ),
  {_, AST} = lists:foldl(fun
      (D = {dot, _}, {Buf, Acc}) ->
        {ok, R} = erl_parse:parse_form(
          lists:reverse([D|Buf])
        ),
        {[], [R|Acc]};
      (T, {Buf,Acc}) ->
        {[T|Buf], Acc}
    end,
    {[], []},
    Tokens
  ),
  lists:reverse(AST).
[{attribute,1,file,{"mod.erl",1}},
 {attribute,3,module,mod},
 {attribute,5,compile,export_all},
 {function,7,f,0,
           [{clause,7,[],[],
                    [{bin,8,
                          [{bin_element,8,{integer,8,1},default,default},
                           {bin_element,8,{integer,8,2},default,default},
                           {bin_element,8,{integer,8,3},default,default},
                           {bin_element,8,{integer,8,4},default,default},
                           {bin_element,8,{integer,8,...},default,default}]}]}]}]

More steps are executed after generating the AST, a linter and other checkers can verify the code, but it will be discarded in this part of the article. To finally generate the Erlang bytecode, the file with .beam prefix, containing the compiled source code, one can call erlc again or use the compile:file/2 function when a file is available.

$ erlc mod.erl

$ file mod.beam                                                                                                                                                                                                                                                                 
mod.beam: Erlang BEAM file

$ hexdump -C mod.beam        
00000000  46 4f 52 31 00 00 02 50  42 45 41 4d 41 74 55 38  |FOR1...PBEAMAtU8|
00000010  00 00 00 2d ff ff ff fb  30 6d 6f 64 10 66 b0 6d  |...-....0mod.f.m|
00000020  6f 64 75 6c 65 5f 69 6e  66 6f 60 65 72 6c 61 6e  |odule_info`erlan|
00000030  67 f0 67 65 74 5f 6d 6f  64 75 6c 65 5f 69 6e 66  |g.get_module_inf|
00000040  6f 00 00 00 43 6f 64 65  00 00 00 47 00 00 00 10  |o...Code...G....|
00000050  00 00 00 00 00 00 00 b1  00 00 00 07 00 00 00 03  |................|
00000060  01 10 99 10 02 12 22 00  01 20 40 47 00 03 13 01  |......".. @G....|
00000070  30 99 00 02 12 32 00 01  40 40 12 03 4e 10 00 01  |0....2..@@..N...|
00000080  50 99 00 02 12 32 10 01  60 40 03 13 40 12 03 4e  |P....2..`@..@..N|
00000090  20 10 03 00 53 74 72 54  00 00 00 00 49 6d 70 54  | ...StrT....ImpT|
000000a0  00 00 00 1c 00 00 00 02  00 00 00 04 00 00 00 05  |................|
000000b0  00 00 00 01 00 00 00 04  00 00 00 05 00 00 00 02  |................|
000000c0  45 78 70 54 00 00 00 28  00 00 00 03 00 00 00 03  |ExpT...(........|
000000d0  00 00 00 01 00 00 00 06  00 00 00 03 00 00 00 00  |................|
000000e0  00 00 00 04 00 00 00 02  00 00 00 00 00 00 00 02  |................|
000000f0  4c 69 74 54 00 00 00 17  00 00 00 00 00 00 00 01  |LitT............|
00000100  00 00 00 0b 83 6d 00 00  00 05 01 02 03 04 05 00  |.....m..........|
00000110  4d 65 74 61 00 00 00 2d  83 6c 00 00 00 01 68 02  |Meta...-.l....h.|
00000120  77 10 65 6e 61 62 6c 65  64 5f 66 65 61 74 75 72  |w.enabled_featur|
00000130  65 73 6c 00 00 00 01 77  0a 6d 61 79 62 65 5f 65  |esl....w.maybe_e|
00000140  78 70 72 6a 6a 00 00 00  4c 6f 63 54 00 00 00 04  |xprjj...LocT....|
00000150  00 00 00 00 41 74 74 72  00 00 00 27 83 6c 00 00  |....Attr...'.l..|
00000160  00 01 68 02 77 03 76 73  6e 6c 00 00 00 01 6e 10  |..h.w.vsnl....n.|
00000170  00 00 4a 2a a7 c3 41 6d  91 07 cf f0 1d 6d 6e 00  |..J*..Am.....mn.|
00000180  85 6a 6a 00 43 49 6e 66  00 00 00 48 83 6c 00 00  |.jj.CInf...H.l..|
00000190  00 03 68 02 77 07 76 65  72 73 69 6f 6e 6b 00 07  |..h.w.versionk..|
000001a0  39 2e 30 2e 36 2e 31 68  02 77 07 6f 70 74 69 6f  |9.0.6.1h.w.optio|
000001b0  6e 73 6a 68 02 77 06 73  6f 75 72 63 65 6b 00 13  |nsjh.w.sourcek..|
000001c0  2f 74 6d 70 2f 65 72 6c  61 6e 67 2f 6d 6f 64 2e  |/tmp/erlang/mod.|
000001d0  65 72 6c 6a 44 62 67 69  00 00 00 48 83 68 03 77  |erljDbgi...H.h.w|
000001e0  0d 64 65 62 75 67 5f 69  6e 66 6f 5f 76 31 77 11  |.debug_info_v1w.|
000001f0  65 72 6c 5f 61 62 73 74  72 61 63 74 5f 63 6f 64  |erl_abstract_cod|
00000200  65 68 02 77 04 6e 6f 6e  65 6c 00 00 00 01 68 02  |eh.w.nonel....h.|
00000210  77 03 63 77 64 6b 00 0b  2f 74 6d 70 2f 65 72 6c  |w.cwdk../tmp/erl|
00000220  61 6e 67 6a 4c 69 6e 65  00 00 00 15 00 00 00 00  |angjLine........|
00000230  00 00 00 00 00 00 00 03  00 00 00 01 00 00 00 00  |................|
00000240  51 00 00 00 54 79 70 65  00 00 00 0a 00 00 00 03  |Q...Type........|
00000250  00 00 00 01 0f ff 00 00                           |........|
00000258

If you have only the AST instead of a file containing the source code, the compile:forms/2 function can be invoked. It will return the name of the module as atom() and the bytecode.

> {ok, AST} = epp:parse_file("./mod.erl", [{source_name, mod}]).
{ok,[{attribute,1,file,{"mod",1}},
     {attribute,1,module,mod},
     {attribute,2,compile,export_all},
     {function,5,f,0,
               [{clause,5,[],[],
                        [{bin,5,
                              [{bin_element,5,{integer,5,1},default,default},
                               {bin_element,5,{integer,5,2},default,default},
                               {bin_element,5,{integer,5,...},default,default},
                               {bin_element,5,{integer,...},default,...},
                               {bin_element,5,{...},...}]}]}]},
     {eof,6}]}

> {ok, _Name, Bytecode} = compile:forms(AST, []).
{ok,mod,
    <<70,79,82,49,0,0,1,228,66,69,65,77,65,116,85,56,0,0,0,
      45,255,255,255,251,48,109,...>>}

> file:write_file("/tmp/mod.beam", Bytecode).
ok

To be sure the bytecode is working, let open another shell and load it.

$ cd /tmp

$ file mod.beam
mod.beam: Erlang BEAM file

$ hexdump -C mod.beam
00000000  46 4f 52 31 00 00 01 e4  42 45 41 4d 41 74 55 38  |FOR1....BEAMAtU8|
00000010  00 00 00 2d ff ff ff fb  30 6d 6f 64 10 66 b0 6d  |...-....0mod.f.m|
00000020  6f 64 75 6c 65 5f 69 6e  66 6f 60 65 72 6c 61 6e  |odule_info`erlan|
00000030  67 f0 67 65 74 5f 6d 6f  64 75 6c 65 5f 69 6e 66  |g.get_module_inf|
00000040  6f 00 00 00 43 6f 64 65  00 00 00 47 00 00 00 10  |o...Code...G....|
00000050  00 00 00 00 00 00 00 b1  00 00 00 07 00 00 00 03  |................|
00000060  01 10 99 10 02 12 22 00  01 20 40 47 00 03 13 01  |......".. @G....|
00000070  30 99 00 02 12 32 00 01  40 40 12 03 4e 10 00 01  |0....2..@@..N...|
00000080  50 99 00 02 12 32 10 01  60 40 03 13 40 12 03 4e  |P....2..`@..@..N|
00000090  20 10 03 00 53 74 72 54  00 00 00 00 49 6d 70 54  | ...StrT....ImpT|
000000a0  00 00 00 1c 00 00 00 02  00 00 00 04 00 00 00 05  |................|
000000b0  00 00 00 01 00 00 00 04  00 00 00 05 00 00 00 02  |................|
000000c0  45 78 70 54 00 00 00 28  00 00 00 03 00 00 00 03  |ExpT...(........|
000000d0  00 00 00 01 00 00 00 06  00 00 00 03 00 00 00 00  |................|
000000e0  00 00 00 04 00 00 00 02  00 00 00 00 00 00 00 02  |................|
000000f0  4c 69 74 54 00 00 00 17  00 00 00 00 00 00 00 01  |LitT............|
00000100  00 00 00 0b 83 6d 00 00  00 05 01 02 03 04 05 00  |.....m..........|
00000110  4c 6f 63 54 00 00 00 04  00 00 00 00 41 74 74 72  |LocT........Attr|
00000120  00 00 00 27 83 6c 00 00  00 01 68 02 77 03 76 73  |...'.l....h.w.vs|
00000130  6e 6c 00 00 00 01 6e 10  00 f2 e4 49 4c e5 8b 35  |nl....n....IL..5|
00000140  3f a4 aa a7 4e af 2c 9c  e1 6a 6a 00 43 49 6e 66  |?...N.,..jj.CInf|
00000150  00 00 00 28 83 6c 00 00  00 02 68 02 77 07 76 65  |...(.l....h.w.ve|
00000160  72 73 69 6f 6e 6b 00 07  39 2e 30 2e 36 2e 31 68  |rsionk..9.0.6.1h|
00000170  02 77 07 6f 70 74 69 6f  6e 73 6a 6a 44 62 67 69  |.w.optionsjjDbgi|
00000180  00 00 00 2e 83 68 03 77  0d 64 65 62 75 67 5f 69  |.....h.w.debug_i|
00000190  6e 66 6f 5f 76 31 77 11  65 72 6c 5f 61 62 73 74  |nfo_v1w.erl_abst|
000001a0  72 61 63 74 5f 63 6f 64  65 68 02 77 04 6e 6f 6e  |ract_codeh.w.non|
000001b0  65 6a 00 00 4c 69 6e 65  00 00 00 1b 00 00 00 00  |ej..Line........|
000001c0  00 00 00 00 00 00 00 03  00 00 00 01 00 00 00 01  |................|
000001d0  12 51 00 03 6d 6f 64 00  54 79 70 65 00 00 00 0a  |.Q..mod.Type....|
000001e0  00 00 00 03 00 00 00 01  0f ff 00 00              |............|
000001ec

$ erl -noshell -eval '
  io:format("~p~n", [mod:f()]),
  init:stop().
'
<<1,2,3,4,5>>

This is only the tip of the iceberg, the compilation process in Erlang is way more complex than that. In fact, many parts of the pipeline have been discarded. Anyway, the goal of this section was simply to show you how to generate quickly Erlang bytecode. The only interesting step for the goal of the post is the preprocessing one. The idea is to extract Erlang records and macros from Erlang source code and convert them into something usable in Elixir.

A last note regarding the compilation process. As you probably know, Elixir templating system using macros is really powerful and the abstraction has been really well designed. Did you know Erlang got the same feature years ago? Indeed, it is also possible to compile dynamically the code or alter the AST directly from the virtual machine via merl (for Metaprogramming in Erlang). It's way more complex to use than Elixir templates, but it works pretty well.

BONUS: it is also possible to disassemble the bytecode generated by this process using the beam_lib:all_chunks/1 function. It will then give you a better view of the content of a beam file.

$ erl -noshell -eval '
  {ok, F} = file:read_file("./mod.beam"),
  {ok,_,Bytes} = beam_lib:all_chunks(F),
  io:format("~p~n", [Bytes]),
  init:stop().
'
[{"AtU8",
  <<255,255,255,251,48,109,111,100,16,102,176,109,111,100,117,108,101,95,105,
    110,102,111,96,101,114,108,97,110,103,240,103,101,116,95,109,111,100,117,
    108,101,95,105,110,102,111>>},
 {"Code",
  <<0,0,0,16,0,0,0,0,0,0,0,177,0,0,0,7,0,0,0,3,1,16,153,16,2,18,34,0,1,32,64,
    71,0,3,19,1,48,153,0,2,18,50,0,1,64,64,18,3,78,16,0,1,80,153,0,2,18,50,16,
    1,96,64,3,19,64,18,3,78,32,16,3>>},
 {"StrT",<<>>},
 {"ImpT",<<0,0,0,2,0,0,0,4,0,0,0,5,0,0,0,1,0,0,0,4,0,0,0,5,0,0,0,2>>},
 {"ExpT",
  <<0,0,0,3,0,0,0,3,0,0,0,1,0,0,0,6,0,0,0,3,0,0,0,0,0,0,0,4,0,0,0,2,0,0,0,0,0,
    0,0,2>>},
 {"LitT",<<0,0,0,0,0,0,0,1,0,0,0,11,131,109,0,0,0,5,1,2,3,4,5>>},
 {"Meta",
  <<131,108,0,0,0,1,104,2,119,16,101,110,97,98,108,101,100,95,102,101,97,116,
    117,114,101,115,108,0,0,0,1,119,10,109,97,121,98,101,95,101,120,112,114,
    106,106>>},
 {"LocT",<<0,0,0,0>>},
 {"Attr",
  <<131,108,0,0,0,1,104,2,119,3,118,115,110,108,0,0,0,1,110,16,0,0,74,42,167,
    195,65,109,145,7,207,240,29,109,110,0,133,106,106>>},
 {"CInf",
  <<131,108,0,0,0,3,104,2,119,7,118,101,114,115,105,111,110,107,0,7,57,46,48,
    46,54,46,49,104,2,119,7,111,112,116,105,111,110,115,106,104,2,119,6,115,
    111,117,114,99,101,107,0,19,47,116,109,112,47,101,114,108,97,110,103,47,
    109,111,100,46,101,114,108,106>>},
 {"Dbgi",
  <<131,104,3,119,13,100,101,98,117,103,95,105,110,102,111,95,118,49,119,17,
    101,114,108,95,97,98,115,116,114,97,99,116,95,99,111,100,101,104,2,119,4,
    110,111,110,101,108,0,0,0,1,104,2,119,3,99,119,100,107,0,11,47,116,109,
    112,47,101,114,108,97,110,103,106>>},
 {"Line",<<0,0,0,0,0,0,0,0,0,0,0,3,0,0,0,1,0,0,0,0,81>>},
 {"Type",<<0,0,0,3,0,0,0,1,15,255>>}]

If you are even more curious about this bonus, you are invited to read The Beam Book, you will find there way more information!

Erlang Preprocessor (`epp`)

The epp module is in charge to parse and expand macros from Erlang source code. Its source code implementation resides in lib/stdlib/epp.erl. The content can be intimidating with its 2600 lines of code, but it is not the most complex to read.

epp is starting its own server process handling I/O protocols to read data byte by byte with the help of the io:scan_erl_form/3. This server is having its own state updated every time a new correct value is parsed. Let begins our investigation by using the easiest function available to parse and expands macros, epp:parse_file/2. Ah, before doing that, let improve a bit our test module.

$ cat > mod2.erl << EOF
-module(mod2).
-compile(export_all).
-record(test, {field1}).
-define(DATA, <<1,2,3,4,5>>).

f() -> ?DATA
EOF

An Erlang record called test has been added. It was missing from the previous module.

> {ok, AST} = epp:parse_file("mod2.erl", []).
{ok,[{attribute,1,file,{"mod2.erl",1}},
     {attribute,1,module,mod2},
     {attribute,2,compile,export_all},
     {attribute,3,record,
                {test,[{record_field,3,{atom,3,field1}}]}},
     {function,6,f,0,
               [{clause,6,[],[],
                        [{bin,6,
                              [{bin_element,6,{integer,6,1},default,default},
                               {bin_element,6,{integer,6,...},default,default},
                               {bin_element,6,{integer,...},default,...},
                               {bin_element,6,{...},...},
                               {bin_element,6,...}]}]}]},
     {eof,7}]}

As you can see, a new attribute for the record is present, containing its description but there is no trace of the DATA macro defined (again). This is because epp returns the fully expand source code. Great, but those macros should be stored somewhere... right? Indeed, they are stored inside the #epp{} record present in the epp server's state. Unfortunately, this server is not directly available when using epp:parse_file/2, and epp:open/1 must be used instead. This function is opening a file using I/O protocols and returns a process identifier to extract all tokens step by steps.

> {ok, EppProcess} = epp:open("mod2.erl", [], []).
{ok,<0.175.0>}

To avoid repetitive task, let create EppRead/2 lambda function to incrementally read the tokens from the epp server. Every time epp:scan_erl_form/1 is called, the epp server should send a message containing its position in the file. When it reaches the end of the file, it sends {eof, Line}.

> EppRead = fun EppRead(Pid, Buffer) ->
  case epp:scan_erl_form(Pid) of
    {ok, T} -> EppRead(Pid, Buffer ++ T);
    {eof, _} -> {ok, Buffer}
  end
end.
#Fun<erl_eval.18.113135111>

> {ok, Forms} = EppRead(EppProcess, []).
[{'-',1},
 {atom,1,file},
 {'(',1},
 {string,1,"mod.erl"},
 {',',1},
 {integer,1,1},
 {')',1},
 {dot,1},
 {'-',1},
 {atom,1,module},
 {'(',1},
 {atom,1,mod},
 {')',1},
 {dot,1},
 {'-',2},
 {atom,2,compile},
 {'(',2},
 {atom,2,export_all},
 {')',2},
 {dot,2},
 {atom,5,f},
 {'(',5},
 {')',5},
 {'->',5},
 {'<<',5},
 {integer,5,1},
 {',',5},
 {integer,...},
 {...}|...]

Great, the tokens are available, it means it works correctly without any syntax errors. How to extract the process state? The epp server does not support sys patterns, and using sys:get_state/1 will simply froze the current process. If you read the source code of the module, you will find the undocumented macro_defs/1 function. It sends a message to an epp server and should return the list of macros stored in server's state. Let reimplement this function ourselves.

> GetMacros = fun (Pid) ->
  Pid ! {epp_request, self(), macro_defs},
  receive
    {epp_reply, Pid, Macros} -> Macros
  after
    1000 -> error
  end
end.
#Fun<erl_eval.42.113135111>

> GetMacros(EppProcess).
[{{atom,'FEATURE_ENABLED'},[{1,{['X'],[{atom,1,false}]}}]},
 {{atom,'FEATURE_AVAILABLE'},
  [{1,
    {['X'],
     [{'(',1},
      {'(',1},
      {var,1,'X'},
      {')',1},
      {'==',1},
      {atom,1,maybe_expr},
      {')',1}]}}]},
 {{atom,'OTP_RELEASE'},{none,[{integer,1,28}]}},
 {{atom,'MACHINE'},{none,[{atom,1,'BEAM'}]}},
 {{atom,'LINE'},{none,[{integer,1,1}]}},
 {{atom,'FILE'},{none,[{string,1,"mod2.erl"}]}},
 {{atom,'MODULE'},{none,[{atom,1,mod2}]}},
 {{atom,'MODULE_STRING'},{none,[{string,1,"mod2"}]}},
 {{atom,'BASE_MODULE'},undefined},
 {{atom,'BASE_MODULE_STRING'},undefined},
 {{atom,'FUNCTION_ARITY'},undefined},
 {{atom,'FUNCTION_NAME'},undefined},
 {{atom,'BEAM'},{none,[{atom,1,true}]}},
 {{atom,'DATA'},
  [{none,{none,[{'<<',4},
                {integer,4,1},
                {',',4},
                {integer,4,2},
                {',',4},
                {integer,4,...},
                {',',...},
                {...}|...]}}]}]

Indeed, all the macros have been returned, including the one defined by epp. The format of the macros stored here can be described below

{
  {atom, MacroName},
  {MacroArity, MacroTermOrExprs}
}.

The name of the macro is defined in MacroName as a charlist() type. The next part is the definition of the macro where:

MacroArity is the arity of the macro. If the macro does not have argument, it is set to none, else, it is set to a strictly positive integer greater than 0.
MacroTermOrExprs is the content of the macro, it can contain an Erlang term or an expression, and can also contain a variable previously defined in the argument part.

Because mod2.erl does not define any macros with arguments, let creates one to see how it is represented.

-define(DYN(X,Y,Z), X + Y + Z).

This macro when extracted looks like the Erlang term below.

{
  {atom,'DYN'},
  [
    {3,
      {['X','Y','Z'],[
        {var,4,'X'},
        {'+',4},
        {var,4,'Y'},
        {'+',4},
        {var,4,'Z'}
      ]}
    }
  ]
}

As you can see, this is not so different than the rest of AST, the arguments defined in the macro are expanded in the body of the macro using the token {var, Line, ArgumentName}. Finally, don't forget to close the file to avoid file descriptor exception at the end of this experiment.

> epp:close(EppServer).
ok

That's great, it is now possible to extract both records and macros, one from the AST, the other one directly from the preprocessor state. Let find a way to deal with that in Elixir.

Erlang Records in Elixir

Elixir already has an interface to deal with Erlang records called Record. This is working well in most of the case, let just have a look on it. First, a record can only created inside a module, because it uses Elixir meta-programming feature with macros and templates.

$ cat > r.ex << EOF
defmodule R do
  require Record

  Record.defrecord(:test, data: "test")
end
EOF

iex> c("r.ex")
[R]

iex> import R
R

iex> R.test()
{:test, "test"}

iex> R.test(:data)
1

iex> R.test() |> R.test(data: "updated")
{:test, "updated"}

Okay, great, but now, let check a real-world Erlang records from some very used modules, like public_key. Most if not all records are defined in public_key/include/public_key.hrl. The first one you will encounter is the RSAPublicKey record.

-record('RSAPublicKey', {
  modulus,
  publicExponent
 }).

Can you see the problem here? When using the Elixir Record module, it creates a function to simulate the behavior of the record, but here, the record identifier is a word starting with an uppercase character. It is not possible to create a function with an uppercase character in Elixir. Just to be sure, a new module containing a function starting with an uppercase letter can be created.

$ cat > up.ex << EOF
defmodule Up do
  def TestFunction(), do: 1
end
EOF

iex> c("up.ex")
== Compilation error in file up.ex ==
** (SyntaxError) invalid syntax found on up.ex:2:19:
    error: unexpected ( after alias TestFunction. Function names and identifiers in Elixir start with lowercase characters or underscore. For example:

        hello_world()
        _starting_with_underscore()
        numb3rs_are_allowed()
        may_finish_with_question_mark?()
        may_finish_with_exclamation_mark!()

    Unexpected token: (
    │
  2 │   def TestFunction(), do: 1
    │                   ^
    │
    └─ up.ex:2:19
    (elixir 1.19.5) lib/kernel/parallel_compiler.ex:530: anonymous fn/5 in Kernel.ParallelCompiler.spawn_workers/8
** (CompileError) compile error
    (iex 1.19.5) lib/iex/helpers.ex:245: IEx.Helpers.c/2
    iex:15: (file)

Well, you would probably say something like "not a problem, if it's the only record...", I stop you right there. More than 150 records are using this format in the public_key module. Defining 150+ functions is annoying, but because they are all following the same pattern, macros or module templates can be used.

This issue can be solved in many different ways, the first one is to create a function record/1 where the first argument will contain the record name as an atom() starting with an uppercase. Every new record can be added like that.

iex> R.record(:RSAPrivateKey)
{:RSAPrivateKey, :undefined, :undefined}

iex> R.record(:RSAPrivateKey, modulus: 3, publicExponent: 111)
{:RSAPrivateKey, 3, 111}

iex> R.record(:RSAPrivateKey) |> R.record(:modulus, 3)
{:RSAPrivateKey, 3, :undefined}

The second solution is the one I prefer. Instead of creating a function containing all record in one place, why not creating a module containing an Elixir struct to represent the record itself? Well, let create the module in charge of that. It will be called Preprocessing and the sources are already available on github

defmodule Preprocessing.Record do
end

Listing the available records from an Erlang file is one of the main requirement. To do that, it is possible to mix 2 functions, :code.lib_dir/1 to get the path of the module, and :epp.parse_file/2 to parse the Erlang source code. The list_records/3 function returns all the record identifier as [atom()].

  def list_records(module, filepath, opts \\ %{}) do
    case :code.lib_dir(module) do
      {:error, reason} ->
        {:error, reason}
      path ->
        target = Path.join([path, filepath])
        list_records2(module, target, opts)
    end
  end

  defp list_records2(module, target, opts) do
    source_name = Map.get(opts, :source_name, module)
    with true <- File.exists?(target),
         {:ok, tokens} <- :epp.parse_file(target, source_name: source_name)
    do
      for {:attribute, _, :record, {record_name, _}} <- tokens, do: record_name
    else
      false -> {:error, :path};
      other -> other
    end
  end

Next, a way to extract the records is required as well. In this case, the Record.extract/2 can be reused without, it has been created for that.

  def extract(module, filepath, record) do
    target = Path.join([Atom.to_string(module), filepath])
    Record.extract(record, from_lib: target)
  end

Finally, the module template can be created with the help of the special macro called __using__/1. When used on another module, it will generate all the required functions to deal with the imported record.

defmacro __using__(opts) do
    record_id = Keyword.get(opts, :record_id)
    module = Keyword.get(opts, :module)
    filepath = Keyword.get(opts, :filepath)
    fields = extract(module, filepath, record_id)
    keys = for {k, _} <- fields, do: k
    values = for {_, v} <- fields, do: v
    tuple = [:record_id] ++ values
      |> List.to_tuple()
      |> Macro.escape()
    record_size = length(fields)+1

    quote do
      import Preprocessing.Record

      defstruct unquote(fields)

      def id(), do: unquote(record_id)

      def fields(), do: unquote(fields)

      def keys(), do: unquote(keys)

      def tuple(), do: unquote(tuple)

      def struct(), do: %__MODULE__{}

      def is_valid?(record) do
        cond do 
          is_tuple(record) and 
            :erlang.size(record) == unquote(record_size) and 
            :erlang.element(1, record) == unquote(record_id) -> true
          true -> false
        end
      end

      def convert(struct = %__MODULE__{}) do
        map = Map.from_struct(struct)
        {:ok, Enum.reduce(fields(), [], fn ({k, _}, acc) -> 
            [Map.get(map, k)|acc]
          end)
          |> Enum.reverse()
          |> (fn(xs) -> [unquote(record_id)|xs] end).()
          |> List.to_tuple()
        }
      end
      def convert(record) when is_tuple(record) do
        if is_valid?(record) do
          record_list =
            Tuple.to_list(record)
            |> Enum.drop(1)

          {:ok, keys()
            |> Enum.zip(record_list)
            |> Enum.reduce(%__MODULE__{}, fn ({k, v}, acc) -> 
              Map.put(acc, k, v)
            end)
          }
        else
          {:error, :invalid_tuple}
        end
      end
      def convert(_), do: {:error, :invalid_term}

      def convert!(record) do
        case convert(record) do
          {:ok, data} -> data
          other -> throw other
        end
      end

    end
  end

Great! Let creates our first interface to an existing record. #RSAPublicKey{} from the public_key module is a good target.

defmodule Preprocessing.PublicKey.RSAPublicKey do
  use Preprocessing.Record,
    record_id: :RSAPublicKey,
    module: :public_key,
    filepath: "include/public_key.hrl"
end

That's all. The project can now be recompile and it will be possible to test our new module.

iex> alias Preprocessing.PublicKey.RSAPublicKey
Preprocessing.PublicKey.RSAPublicKey

iex> RSAPublicKey.is_valid?({:RSAPublicKey, :undefined, :undefined})
true

iex> RSAPublicKey.is_valid?({:RSAPublicKey})
false

iex> RSAPublicKey.keys()
[:modulus, :publicExponent]

iex> RSAPublicKey.struct()
%PublicKey.RSAPublicKey{
  modulus: :undefined,
  publicExponent: :undefined
}

iex> %RSAPublicKey{}
%RSAPublicKey{
  modulus: :undefined,
  publicExponent: :undefined
}

iex> RSAPublicKey.convert(%RSAPublicKey{})
{:RSAPublicKey, :undefined, :undefined}

iex> RSAPublicKey.convert({:RSAPublicKey, :undefined, :undefined})
%PublicKey.RSAPublicKey{
  modulus: :undefined,
  publicExponent: :undefined
}

This module is not perfect though. For example, a function to valid and convert the data correctly from the Elixir struct to the record and vice verse is required. At this time, the developer is in charge of creating the interface for this process. This solution still looks better than the first one. Every new records are treated as individual data-structure defined in their own containers with their own functions.

Erlang Macros Definition in Elixir

The Erlang preprocessor macros are not so different than the Erlang records, except when it comes to their arity. In this implementation, only static macros will be supported, but it should not be too complex to implement something with arguments support. Anyway, in a previous section, we saw the macros where stored in the epp server process state and must be extracted with an undocumented function from the epp module. In fact, most of the hard work is already done, now, we need a way to integrate them in Elixir.

Static macros are basically made of a key and a value. Why not converting them as Map.t() or Keyword.t() in this case? In fact, a macro with the same name than another one present below will overwrite the value of the previous definition. This means it's impossible to have a naming conflict, perfect for a Map.t(). First, let creates a new module called Preprocessing.Macros, it will contain all the functions required to extract and convert macros, but also a template to include them inside another module.

defmodule Preprocessing.Macros do
end

The definitions/2 functions is the only one exported from the module, and will return the converted list of macros as Map.t(). This function is used to generate the template but also to find all the macros from a specific module while developing.

  def definitions(module, filepath) do
    with {:ok, pid} <- open_file(module, filepath),
      :ok <- definitions_loop(pid),
      {:ok, macros} <- definitions_macros(pid)
    do
      convert_macros(macros, [])
    end
  end

All the remaining functions are not exposed to the rest of the application, and are being used to deal with every step of the conversion. The open_file/2 function is a wrapper around :epp.open/2, checking if a path is available and returning the process id of the epp server.

  defp open_file(module, filepath) do
    case :code.lib_dir(module) do
      {:error, reason} ->
        {:error, reason}
      path ->
        Path.join([path, filepath])
          |> String.to_charlist()
          |> :epp.open([], [])
    end
  end

The definitions_loop/1 function is quite stupid. It will simply read the content of the opened file until it reaches the end of it. When done, it simply return :ok. In fact, this step is very important, because it will load all the macros from the file and store them in the epp server's state.

  defp definitions_loop(pid) do
    msg = :epp.parse_erl_form(pid)
    case msg do
      {:eof, _} ->
        :ok
      _ ->
        definitions_loop(pid)
    end
  end

The definitions_macros/1 function sends the undocumented :macro_defs message to the eep server and wait for its answer containing the list of all parsed macros from the source code. Those macros (a list of tuple) is then returned.

  defp definitions_macros(pid) do
    send(pid, {:epp_request, self(), :macro_defs})
    receive do
      {:epp_reply, pid, macros} ->
        :epp.close(pid)
        {:ok, macros}
      msg ->
        :epp.close(pid)
        {:error, msg}
      after
        10000 ->
          :epp.close(pid)
          {:error, :timeout}
      end
  end

Every raw macros from the epp server's state must be converted. The convert_macros/2 and convert_macros_value/1 functions are doing the conversion and the filtering. Indeed, we are looking only for the static macros right now, not for the one with an arity, then, only the macros set to :none are kept, the rest are simply dropped.

  defp convert_macros([], buffer) do
    {:ok,
      buffer
      |> Enum.filter(fn({_, v}) ->
        if v==:ignored do
          false
        else
          true
        end
     end)
    }
  end
  defp convert_macros([macro={{:atom, name}, value}|rest], buffer) do
    with {:ok, term} <- convert_macro_value(value) do
      convert_macros(rest, [{name, term}|buffer])
    else
      error -> {:error, error, macro}
    end
  end

  defp convert_macro_value([none: {:none, value}]) do
    with {:ok, term} <- :erl_parse.parse_term(value ++ [{:dot, 1131}]) do
      {:ok, term}
    end
  end
  defp convert_macro_value(_), do: {:ok, :ignored}

The escape_keys/2 function will escape the Erlang macros definitions to insert them safely in the module template via the Macro.escape/2 function.

  defp escape_keys(module, filepath) do
    with {:ok, defs} <- definitions(module, filepath) do
      defs
      |> :maps.from_list()
      |> Macro.escape()
    end
  end

The macro_keys/2 and macro_values/2 functions are respectively extracting the keys and the values of the macros, converting them into a [term()].

  defp macro_keys(module, filepath) do
    with {:ok, defs} <- definitions(module, filepath) do
      defs
      |> Enum.map(fn({k,_}) -> k end)
      |> Macro.escape()
    end
  end

  defp macro_values(module, filepath) do
    with {:ok, defs} <- definitions(module, filepath) do
      defs
      |> Enum.map(fn({_,v}) -> v end)
      |> Macro.escape()
    end
  end

The module template definition is probably the most important part here, because it will integrate the data from the Erlang macros into the Elixir AST. 5 functions have been created to help users to check their macros:

macros/0: returns the macros as a Map.t();
macro/1: returns the value of a defined macros using its key;
macro_keys/0: returns the list of all macro's keys;
macro_values/0: returns the list of all macro's values;
macro_filter/1: a wrapper around Map.filter/2 to filter the macros.

  defmacro __using__(opts) do
    module = Keyword.get(opts, :module)
    filepath = Keyword.get(opts, :filepath)
    def_keys = escape_keys(module, filepath)

    quote do
      import Preprocessing.Macros

      def macros(), do: unquote(def_keys)

      def macro(index), do: Map.get(unquote(def_keys), index)

      def macro_keys(), do: unquote(macro_keys(module, filepath))

      def macro_values(), do: unquote(macro_values(module, filepath))

      def macros_filter(fun) do
        unquote(def_keys)
        |> Map.filter(fun)
      end
    end
  end

Great, the goal now is to create or update a module with this template. The best target here could be the Preprocessing.PublicKey module. The module to parse the Erlang macros is :public_key and the path for the header is inclyde/public_key.hrl.

defmodule Preprocessing.PublicKey do
  use Preprocessing.Macros,
    module: :public_key,
    filepath: "include/public_key.hrl"
end

Finally, this interface can be tested. The definitions/2 function returns the correct values from different header files.

iex> alias Preprocessing.Macros
Preprocessing.Macros

iex> Macros.definitions(:kernel, "include/file.hrl")
{:ok, [FILE_HRL_: 1]}

iex> Macros.definitions(:kernel, "include/inet.hrl")
{:ok, []}

Let have a look on the Preprocessing.PublicKey module now.

iex> alias Preprocessing.PublicKey
alias Preprocessing.PublicKey

The PublicKey.macros/0 function returns all the available macros parsed from the Erlang source code as a Map.t().

iex> PublicKey.macros()
%{
  sect163r1: {1, 3, 132, 0, 2},
  "ub-postal-code-length": 16,
  secp256k1: {1, 3, 132, 0, 10},
  "id-RSAES-OAEP": {1, 2, 840, 113549, 1, 1, 7},
  "id-ce-policyMappings": {2, 5, 29, 33},
  "id-at-pseudonym": {2, 5, 4, 65},
  affiliationChanged: 3,
  "id-at-localityName": {2, 5, 4, 7},
  "id-at-givenName": {2, 5, 4, 42},
  "id-pkix-ocsp-service-locator": {1, 3, 6, 1, 5, 5, 7, 48, 1, 7},
  "ub-name": 32768,
  "id-qt-cps": {1, 3, 6, 1, 5, 5, 7, 2, 1},
  "pbeWithSHA1AndDES-CBC": {1, 2, 840, 113549, 1, 5, 10},
  secp160k1: {1, 3, 132, 0, 9},
  sect409k1: {1, 3, 132, 0, 36},
  "id-ce-extKeyUsage": {2, 5, 29, 37},
  "id-ml-dsa-87": {2, 16, 840, 1, 101, 3, 4, 3, 19},
  emptyString: "",
  ...
}

The PublicKey.macro/1 function is doing its job by returning the value of an existing key, or nil if the key is not present.

iex> PublicKey.macro(:sect163r1)
{1, 3, 132, 0, 2}

iex> PublicKey.macro(:undefined)
nil

The PublicKey.macro_keys/0 and PublicKey.macro_values/0 are returning respectively the keys and the values from the parsed macros.

iex> PublicKey.macro_keys()
[:sect163r1, :"ub-postal-code-length", :secp256k1, :"id-RSAES-OAEP",
 :"id-ce-policyMappings", :"id-at-pseudonym", :affiliationChanged, ...]

iex> PublicKey.macro_values
[
  {1, 3, 132, 0, 2},
  16,
  {1, 3, 132, 0, 10},
  {1, 2, 840, 113549, 1, 1, 7},
  ...
]

At last, the PublicKey.macro_filter/1 can filter the keys/values from the macros to return only the one requested via the Map.filter/2 function. The following snippet is filtering the keys using a Regex

iex>  PublicKey.macro_filter(fn ({key,_value}) -> 
  cond do
    Regex.match?(~r"^rsa"i, Atom.to_string(key)) -> true; 
    true -> false 
  end 
end)
%{
  "rSASSA-PSS-Default-Identifier": {:"RSASSA-AlgorithmIdentifier",
   {1, 2, 840, 113549, 1, 1, 10},
   {:"RSASSA-PSS-params", {:HashAlgorithm, {1, 3, 14, 3, 2, 26}, :NULL},
    {:MaskGenAlgorithm, {1, 2, 840, 113549, 1, 1, 8},
     {:HashAlgorithm, {1, 3, 14, 3, 2, 26}, :NULL}}, 20, 1}},
  "rSAES-OAEP-Default-Identifier": {:"RSAES-AlgorithmIdentifier",
   {1, 2, 840, 113549, 1, 1, 7},
   {:"RSAES-OAEP-params", {:Externalvaluereference, 354, :"PKCS-1", :sha1},
    {:Externalvaluereference, 355, :"PKCS-1", :mgf1SHA1},
    {:Externalvaluereference, 356, :"PKCS-1", :pSpecifiedEmpty}}},
  rsaEncryption: {1, 2, 840, 113549, 1, 1, 1}
}

It is now possible to extract and convert macros from Erlang world to the Elixir universe. This implementation is perhaps not the best one, but it will make my life easier while dealing with the public_key module.

Real World Application

This whole post is the consequence of a sandbox project called expki, created to remove all my rust from years of doing Erlang and infrastructure stuff instead of Elixir. The goal was to use Elixir and Phoenix framework to manage a small local PKI (Public Key Infrastructure) compatible with openssl and easy_rsa, a tool provided by OpenVPN to manage certificates locally. In fact, when this project started, it was expected to have a working PoC quick because Erlang was already offering a good support for TLS with the public_key, crypto and asn1 Erlang applications.

Unfortunately, most of the records name present in those modules are starting with an uppercase letter... and it blocks to create something in a short amount of time. A big part of my time on expki was dedicated to read the source code and the documentation of these modules or trying to find a better way to deal with the structure from them. Here the whole list of them extract from an older version of Erlang/OTP.

from public_key (157):
- #'AAControls'{}
- #'ACClearAttrs'{}
- #'AccessDescription'{}
- #'AlgorithmIdentifier'{}
- #'AlgorithmIdentifierPKCS5v2{}
- #'AlgorithmIdentifierPKCS{}
- #'AlgorithmIdentifier{}
- #'AnotherName'{}
- #'AttCertValidityPeriod'{}
- #'Attribute'{}
- #'AttributeCertificate'{}
- #'AttributeCertificateInfo'{}
- #'AttributePKCS{}
- #'AttributeTypeAndValue'{}
- #'Attributes_SETOF'{}
- #'Attributes_SETOF_valuesWithContext_SETOF'{}
- #'AuthorityKeyIdentifier'{}
- #'BasicConstraints'{}
- #'BasicOCSPResponse'{}
- #'BuiltInDomainDefinedAttribute'{}
- #'BuiltInStandardAttributes'{}
- #'CertID'{}
- #'Certificate'{}
- #'CertificateList'{}
- #'CertificationRequest'{}
- #'CertificationRequestInfo'{}
- #'CertificationRequestInfo_attributes_SETOF'{}
- #'CertificationRequestInfo_subjectPKInfo'{}
- #'CertificationRequestInfo_subjectPKInfo_algorithm'{}
- #'CertificationRequest_signatureAlgorithm'{}
- #'Characteristic{}
- #'Clearance'{}
- #'ContentEncryptionAlgorithmIdentifier'{}
- #'ContentInfo'{}
- #'Context'{}
- #'CrlID'{}
- #'Curve'{}
- #'DHParameter'{}
- #'DSAPrivateKey'{}
- #'DigestAlgorithm'{}
- #'DigestAlgorithmIdentifier'{}
- #'DigestEncryptionAlgorithmIdentifier'{}
- #'DigestInfoPKCS{}
- #'DigestedData'{}
- #'DistributionPoint'{}
- #'DomainParameters'{}
- #'Dss{}
- #'ECDSA{}
- #'ECParameters'{}
- #'ECPoint'{}
- #'ECPrivateKey'{}
- #'EDIPartyName'{}
- #'EncryptedContentInfo'{}
- #'EncryptedData'{}
- #'EncryptedPrivateKeyInfo'{}
- #'EncryptedPrivateKeyInfo_encryptionAlgorithm'{}
- #'EnvelopedData'{}
- #'ExtendedNetworkAddress_e163{}
- #'Extension'{}
- #'ExtensionAttribute'{}
- #'Extension{}
- #'FieldID'{}
- #'GeneralSubtree'{}
- #'HashAlgorithm'{}
- #'Holder'{}
- #'IetfAttrSyntax'{}
- #'IssuerAndSerialNumber'{}
- #'IssuerSerial'{}
- #'IssuingDistributionPoint'{}
- #'KeyEncryptionAlgorithmIdentifier'{}
- #'MaskGenAlgorithm'{}
- #'NameConstraints'{}
- #'NoticeReference'{}
- #'OCSPRequest'{}
- #'OCSPResponse'{}
- #'ORAddress'{}
- #'OTPAttributeTypeAndValue'{}
- #'OTPCertificate'{}
- #'OTPCharacteristic{}
- #'OTPExtension'{}
- #'OTPExtensionAttribute'{}
- #'OTPFieldID'{}
- #'OTPNoticeReference'{}
- #'OTPOLDSubjectPublicKeyInfo'{}
- #'OTPOLDSubjectPublicKeyInfo_algorithm'{}
- #'OTPSubjectPublicKeyInfo'{}
- #'OTPSubjectPublicKeyInfo{}
- #'OTPTBSCertificate'{}
- #'OTPUserNotice'{}
- #'ObjectDigestInfo'{}
- #'OneAsymmetricKey'{}
- #'OneAsymmetricKey_privateKeyAlgorithm'{}
- #'OtherPrimeInfo'{}
- #'PBEParameter'{}
- #'PBES2{}
- #'PBKDF2{}
- #'PBMAC1{}
- #'PDSParameter'{}
- #'PKAttribute'{}
- #'PKAttribute_valuesWithContext_SETOF'{}
- #'PSourceAlgorithm'{}
- #'Pentanomial'{}
- #'PersonalName'{}
- #'PolicyConstraints'{}
- #'PolicyInformation'{}
- #'PolicyMappings_SEQOF'{}
- #'PolicyQualifierInfo'{}
- #'PreferredSignatureAlgorithm'{}
- #'PresentationAddress'{}
- #'PrivateKeyInfo'{}
- #'PrivateKeyInfo_privateKeyAlgorithm'{}
- #'PrivateKeyUsagePeriod'{}
- #'PublicKeyAlgorithm'{}
- #'RC2{}
- #'RC5{}
- #'RSAES{}
- #'RSAPrivateKey'{}
- #'RSAPublicKey'{}
- #'RSASSA{}
- #'RecipientInfo'{}
- #'Request'{}
- #'ResponseBytes'{}
- #'ResponseData'{}
- #'RevokedInfo'{}
- #'RoleSyntax'{}
- #'SecurityCategory'{}
- #'ServiceLocator'{}
- #'Signature'{}
- #'SignatureAlgorithm'{}
- #'SignatureAlgorithm{}
- #'SignedAndEnvelopedData'{}
- #'SignedData'{}
- #'SignerInfo'{}
- #'SignerInfoAuthenticatedAttributes_aaSequence_SEQOF'{}
- #'SignerInfoAuthenticatedAttributes_aaSet_SETOF'{}
- #'SignerInfo_unauthenticatedAttributes_uaSequence_SEQOF'{}
- #'SignerInfo_unauthenticatedAttributes_uaSet_SETOF'{}
- #'SingleResponse'{}
- #'SubjectPublicKeyInfo'{}
- #'SubjectPublicKeyInfoAlgorithm'{}
- #'SubjectPublicKeyInfo{}
- #'SvceAuthInfo'{}
- #'TBSCertList'{}
- #'TBSCertList_revokedCertificates_SEQOF'{}
- #'TBSCertificate'{}
- #'TBSRequest'{}
- #'TargetCert'{}
- #'TeletexDomainDefinedAttribute'{}
- #'TeletexPersonalName'{}
- #'UnformattedPostalAddress'{}
- #'UserNotice'{}
- #'V2Form'{}
- #'ValidationParms'{}
- #'Validity'{}
- #cert{}
- #path_validation_state{}
- #revoke_state{}
from asn1 (31):
- #'ComponentType'{}
- #'Constraint'{}
- #'EXTENSIONMARK'{}
- #'ExtensionAdditionGroup'{}
- #'Externaltypereference'{}
- #'Externalvaluereference'{}
- #'Object'{}
- #'ObjectClassFieldType'{}
- #'ObjectSet'{}
- #'SEQUENCE'{}
- #'SET'{}
- #'SymbolsFromModule'{}
- #abst{}
- #classdef{}
- #cmap{}
- #gen_state{}
- #gen{}
- #module{}
- #objectclass{}
- #pobjectdef{}
- #pobjectsetdef{}
- #ptypedef{}
- #pvaluedef{}
- #pvaluesetdef{}
- #seqtag{}
- #simpletableattributes{}
- #state{}
- #tag{}
- #typedef{}
- #type{}
- #valuedef{}

That's a lot, right? In reality, not all are required for a Poc, only ~10 or ~20 of them will be used. This is where the preprocessing will help, by creating the right interface for the right object. This post is already way to long... And we will see that on another one.

A Quick Note About `epp_dodger` Module

epp_dodger is another module available in the Erlang OTP toolsuite to parse valid Erlang source code. So, why not using it instead of epp and all the complexity relative to its server?

Firstly because I wanted to dig a bit more in the Erlang parsing process. Most of my researches were focused on the "default execution path", and I totally missed epp_dodger, even if I read the documentation.

Secondly, the epp_dodger module was not loaded by default with iex (this module is from the syntax_tools application) and epp was already available (this module is from the stdlib application).

Thirdly, the Erlang toolbox is huge, I don't even think someone know every single tool available there. Every time I start to work on Erlang/OTP source code, I discover new utils.

Finally, it was not planned to implement my own interface to the public_key module, I also missed the x509 from hex. In fact, it is also interesting to see the differences between both implementation and it will also give me a way to improve the test suite.

Anyway, let fix that with a quick example of epp_dodger usage. If you want to have it in Elixir, you will need to load the syntax_tools application.

> Application.ensure_all_started(:syntax_tools)
{:ok, [:syntax_tools]}

Then, the function :epp_dodger.parse_file/1 can be called

> [:code.lib_dir(:public_key), "include/public_key.hrl"]
  |> Path.join()
  |> :epp_dodger.parse_file()
{:ok,
 [
   {:tree, :attribute, {:attr, 24, [], :none},
    {:attribute, {:atom, 24, :ifndef}, [{:atom, 24, :public_key}]}},
   {:tree, :attribute, {:attr, 25, [], :none},
    {:attribute, {:atom, 25, :define},
     [{:atom, 25, :public_key}, {:atom, 25, true}]}},
   {:tree, :attribute, {:attr, 31, [], :none},
    {:attribute, {:atom, 31, :define},
     [
       {:atom, 31, :"pkcs-1"},
       {:tree, :tuple, {:attr, 31, [], :none},
        [
          {:integer, 31, 1},
          {:integer, 31, 2},
          {:integer, 31, 840},
          {:integer, 31, 113549},
          {:integer, 31, 1},
          {:integer, 31, 1}
        ]}
     ]}},
   {:tree, :attribute, {...}, ...},
   ...
 ]}

Now is the better way? I would think using epp_dodger can be a better solution, the :epp_dodger.parse_file/1 function is documented, this is not the case when it comes to the epp server solution. I also assume the epp_dodger module, because documented, will be more stable in the future than epp. In the end, for this first test release, I think it should do the job.

Conclusion

Even if the interoperability is great between Erlang and Elixir, some part has been ignored or simply discarded because only few people will be interested to use those features. Dealing with Erlang Preprocessor is one of them I guess. In fine, when one knows how Erlang is working, and where to investigate, it becomes an easy problem to fix. Yeah, it can take few hours to understand how the bricks are working, but in the end, it's not lost. Learning how the BEAM is working, and how Erlang is parsed is a fundamental knowledge anyone should have when using this ecosystem.

Long time ago, I worked on an implementation of ZFS (ZettaFileSystem) in Erlang, even if it was working for many things, it was slow and limited to a small amount of the features exposed by ZFS. One of my problem was to deal with all the internal C structure defined in ZFS, evolving sometimes between versions... but also doing mistake by implementing them poorly on the Erlang side as binaries or functions. Having a feature like this one here would have been a game changer, converting a data-structure in C into an Erlang or Elixir function would have be just crazy!

Anyway, as usual, a long list of links if you are interested to know more on this topic:

Erlang Code Loading from the official Erlang documentation, where you will learn how Erlang code is loaded;
Erlang Abstract Format from the official Erlang documentation, where you will learn what the Erlang abstract form is made of;
erlc command documentation and its source code from the official Erlang documentation where you will learn how to use the erlc command;
Core Erlang abstract syntax trees from the official Erlang documentation, where you will learn about the Erlang abstract syntact tree and how to generate ot;
The Erlang compiler and its source code from the official Erlang documentation, where you will learn how the Erlang compiler works;
epp (erlang preprocessor) documentation and its source code from the official Erlang documentation where you will learn and understand the Erlang preprocessor;
erl_anno (compiler annotation) documentation and its source code from the official Erlang documentation, where you will learn about the Erlang compiler annotations;
erl_scan (scanner) documentation and its source code from the official Erlang documentation, where the tokens are produced direct after reading the source code;
erl_parse (parser) documentation and its source code from the official Erlang documentation, where the AST is generated from the tokens previously created by the scanner;
io module documentation and its source code from the official Erlang documentation, where you can find more information about the I/O protocols;
io_lib module documentation and its source code from the official Erlang documentation;
Erlang Abstract Format on Github, where you will have another view of the Erlang Abstract Format;
The Beam Book on Github, where you find a lot of interesting information about the low-level datastructures and how the BEAM is working.
expki source code on Github, where the Erlang record and macro issues were found, while developing a PKI manager;
preprocessing source code on Github, created while writing this article, and to use it as library on other projects.

Have fun and happy hacking!

Cover Image by Evgeniy Smersh on Unsplash

Q&D: ExUnit and Blob Fixture in Elixir

Mathieu Kerjouan — Wed, 30 Sep 2026 10:00:00 +0000

Another quick and dirty post regarding Elixir. This one will be really quick, but I was working on test unit recently, and was stuck for few minutes about where I could put my fixtures, and especially... some raw blobs. In Erlang, with common_test, the path is directly passed in the options and it is easy to use. In Elixir, it's a bit different, the relative path of the test suite is stored in the __DIR__ macro. This small trick get lost in my mind. Here an example.

$ mix new blob
* creating README.md
* creating .formatter.exs
* creating .gitignore
* creating mix.exs
* creating lib
* creating lib/blob.ex
* creating test
* creating test/test_helper.exs
* creating test/blob_test.exs

Your Mix project was created successfully.
You can use "mix" to compile it, test it, and more:

    cd blob
    mix test

Run "mix help" for more commands.

$ cd blob

A fixtures directory can be helpful, let creates one.

$ mkdir -p test/fixtures

To do the test, let create also a file called blob.txt containing an encoded string in base64 via openssl.

$ printf "this is a test" | openssl enc -base64 > test/fixture/blob.txt

The project created for this example is a simple library, the project configuration file mix.exs must be updated to allow other files to be loaded during the test execution. This is configured in :test_load_filters section, all files ending with _test.exs and _fixtures.exs must be loaded.

defmodule Blob.MixProject do
  use Mix.Project

  def project do
    [
      app: :blob,
      version: "0.1.0",
      elixir: "~> 1.19",
      start_permanent: Mix.env() == :prod,
      deps: deps(),
      test_load_filters: [
        &String.ends_with?(&1, "_test.exs"),
        &String.ends_with?(&1, "_fixtures.exs")
      ]
    ]
  end
  # ...
end

An helper function to have access to the fixtures can be created. It's not mandatory, but it's easier to call something like BlobFixtures.read_blob/1 instead of recreating the same procedure everytime. DRY.

defmodule BlobFixtures do
  def read_blob(relative_path) do
    [__DIR__, "fixtures", relative_path]
    |> Path.join()
    |> File.read!()
  end
end

The test suite can now be updated. The blob is read from the file system and pushed in the test suite.

defmodule BlobTest do
  use ExUnit.Case
  doctest Blob

  # ...

  test "read from file" do
    assert "this is a test" ==
      BlobFixtures.read_blob("blob.txt")
      |> String.trim()
      |> Base.decode64!()
      # only for the example
      |> IO.inspect()
  end
end

Finally, mix test can be called, and it should be green. The decoded message should be printed as well.

$ mix test
Running ExUnit with seed: 423336, max_cases: 16

"this is a test"
...
Finished in 0.04 seconds (0.00s async, 0.04s sync)
1 doctest, 2 tests, 0 failures

Indeed, it was a quick note! As usual, have fun and happy hacking!

Cover Image by Connor Gan on Unsplash

Q&D: Anonymous Recursive Functions in Elixir

Mathieu Kerjouan — Tue, 29 Sep 2026 10:00:00 +0000

Some people prefer Elixir syntax over Erlang syntax, that's their opinion, but if you are like me, you probably knows how Erlang explicitness and conciseness make everything better. I recently needed to quickly debug a piece of code on a running node using Elixir, and while doing that, spawning processes can be helpful to store information, simulate stuff and so on. In Erlang, a recursive anonymous function looks like that:

1> F = fun F() ->
  receive
    exit -> ok;
    Msg -> io:format("~p~n", [Msg]),
    F()
  end
end.
#Fun<erl_eval.20.113135111>

2> P = spawn(F).
<0.151.0>

3> P ! {self(), test}.
{<0.113.0>,test}
{<0.113.0>,test}

The same is a bit different in Elixir, due to the syntax. Based on the documentation, it is not fixed, but if I'm wrong, don't hesitate to comment. Anyway, here the solution:

iex> f = fn (f) ->
  receive do
    :exit -> :ok
    msg -> 
      IO.inspect(msg)
      f.(f)
  end
end
#Function<42.113135111/1 in :erl_eval.expr/6>

iex> p = spawn(fn -> f.(f) end)
#PID<0.725.0>

iex> send(p, {self(), :test})
{#PID<0.724.0>, :test}
{#PID<0.724.0>, :test}

Just to be clear, the same idea can also be done in Erlang, but with the syntactic sugar around the anonymous function, it's way easier to create recursive loop.

1> F2 = fun (F2) ->
  receive
    exit -> ok;
    Msg -> io:format("~p~n", [Msg]),
    F2(F2)
  end
end.
#Fun<erl_eval.42.113135111>

2> P2 = spawn(fun() -> F2(F2) end).
<0.157.0>

3> P2 ! {self(), test}.
{<0.113.0>,test}
{<0.113.0>,test}

This method can be a bit more flexible though, because the state of the recursive function, is a function, one can create an interface to update it dynamically during code execution.

iex> f2 = fn (f2) ->
  receive do
    :exit -> :ok
    {:update, fup} when is_function(fup) ->
      fup.(fup)
    msg -> 
      IO.inspect(msg)
      f2.(f2)
  end
end
#Function<42.113135111/1 in :erl_eval.expr/6>

iex> f3 = fn (f3) ->
  receive do
    :exit -> :ok
    {:update, fup} when is_function(fup) ->
      fup.(fup)
    msg -> 
      IO.puts("f3: #{inspect msg}")
      f3.(f3)
  end
end
#Function<42.113135111/1 in :erl_eval.expr/6>

iex> p = spawn(fn() -> f2.(f2) end)
#PID<0.733.0>

iex> send(p, {self(), :test})
{#PID<0.724.0>, :test}
{#PID<0.724.0>, :test}

iex> send(p, {:update, f3})
{:update, #Function<42.113135111/1 in :erl_eval.expr/6>}

iex>  send(p, {self(), :test})
{#PID<0.724.0>, :test}
f3: {#PID<0.724.0>, :test}

As you can see, the main loop can be updated on demand, useful when we need to debug or trace something quick, and insert receive patterns.

Cover Image by Jan Ranft on Unsplash

WeeklyReview#202639

Mathieu Kerjouan — Mon, 28 Sep 2026 10:00:00 +0000

A lot of links this week... And I did not have the time to read them all! Enjoy!

Managing scheduled posts on Linkedin changed during the past weeks. I finally got my answer from the documentation. To have access to the scheduled posts, one should start to write a new post, at the bottom of the window, a calendar icon should be present (with a number on right). Click on it and you will be able to see your scheduled post. I think Linkedin is looking for UI/UX engineers.

ribs is probably one of the most fascinating functional library available for Dart and Flutter. I started to play with it last week, but there are so many things to say about it, I don't even know how to start. cranst0n did an amazing work, but the learning curve is crazy.

One of my past interview for a Senior Elixir Backend Developer position was successful, but a technical interview including a coding test is required. My Elixir skill is rusty, my last professional usage of this language was 3 years ago, and during the past years, Erlang was my main programming language. The crust of rust is even bigger because during the past months, Dart and Flutter were my targets... Anyway, if you are reading these messages, you already know I code in Elixir (my last article on standalone http server with Bondy is a proof), but it can be hard to remove the habits from a very similar language like Erlang, even more during an interview. The backend of my main mobile application will use Elixir and Phoenix, but it is the right time... but I have an issue.

Last week, my VPNs got some issues related to certificate, and the way I manage them is a bit crappy (easy_rsa from openvpn toolbox). This certificate management issue is recurrent, and every 2 or 3 years, it cost me few hours to cleanup and update things. Why not storing those certificates in a postgresql database managed by Elixir? In fact, it could also be a good way to receive alerts when a CA or a client certificate expires, and automatically renew them? Well, welcome to another project called expki. Again, it's not planned to be prod ready, but more to let me code like I want and relearn Elixir best practices. Perhaps you will find the source code interesting though... right?

In fact, my 2 or 3 coding sessions on this project were very interesting. For example, I thought the interoperability with Erlang with smooth, but it's not the case for everything. Here a concrete use case (a post will be published about that). The public_key Erlang module is in charge of dealing with all the asymmetric cryptography algorithms (e.g. RSA, DSA, DSS, ECC...) and their format (PEM, DER). Because this code is fully in Erlang, it also uses a lot of macros and records.

The records can "easily" be used in Elixir with the help of the Record module, except if those records are starting with an uppercase character. Indeed, the Record module will convert the records into a function, but the functions in Elixir can't use a name starting with an uppercase character. How to fix this problem then, because the public_key module defines more than 150 records following this pattern. Well, I did my own implementation, and instead of creating a function, it extends a module. The example below creates a Expki.PublicKey.RSAPrivateKey using the Expki.PublicKey module as template.

defmodule Expki.PublicKey.RSAPrivateKey do                                                                                                                                                                                                                                                                                  
  use Expki.PublicKey, name: :RSAPrivateKey, pem: true                                                                                                                                                                                                                                                                      
end

When executed, this snippet will create an Elixir Struct called %Expki.PublicKey.RSAPrivateKey{} containing the fields from the Erlang records and also creates few helper functions:

RSAPrivateKey.name/0: returns the name of the record as an atom();
RSAPrivateKey.length/0: returns the full length of the record including its name;
RSAPrivateKey.fields/0: returns record's fields and their default value;
RSAPrivateKey.keys/0: returns record's keys;
RSAPrivateKey.convert/1: convert a %RSAPrivateKey{} Elixir truct into a #RSAPrivateKey{} Erlang record, and vice versa;
RSAPrivateKey.convert!/1: same than the previous function, but throw an error in case of issues;
RSAPrivateKey.is_valid?/1: check if a record is valid or not;
RSAPrivateKey.pem_entry_encode/1: extra-function added to help encoding a %RSAPrivateKey{} into a PEM entry;
RSAPrivateKey.pem_entry_decode/1: extra-function added to help decoding a PEM entry and convert it into a %RSAPrivateKey{} struct.

Then the macros. This part is a challenging one, because the macros, and especially the -define annotations, are dynamically loaded when epp (the Erlang PreProcessor) is reading the source code. The macros are then expended, but never really returned. The only way to have a list of available macros is to call the epp server started with epp:open/1 function, and sending an undocumented message to it. Yeah, that's a bit dirty... and why do I would like to do that? Well, because, again, the public_key module is using a lot of -define macros to store X509-like standard informations for the certificates.

All my researches and notes can be seen in the repository, in the notes directory.

It was not really planned, but I also worked a bit on the Awesome Erlang List via Erlang Punch. Managing with so many resources is a huge issue, and it's not easy to manage a simple markdown file. 2 years ago, I started to write a solution using a text-like database, but it was just not the right way to do. Then, I started to move those resources into Erlang Terms, again, it was hard to maintain. Finally, I decided to use yaml for now. A db.yaml is now available at the root of the project, it contains the whole list of resources and will be used to generate also README.md file and few JSON files for indexing purpose.

The concept behind the Awesome List is great, but it's hard to update, and not a lot of people have the time to do it. What could be nice is to provide a simple web interface (with authentication) allowing creators to put their project easily. The awesome directory is containing an Erlang application/release with the goal of doing that, but it was never finished. Hopefully one day I will have more free time to do it.

Coding

📝 Instant-Launch Erlang Executables - Peer Stritzinger | Code BEAM Lite Stockholm 2026: a talk about rebar3 calzone module to create Erlang binaries and speeding-up the boot process. The idea is to preload the data and store them in the memory using mmap. It's an alternative to escript.

▶️ Going CPU Bound - David Klemenc | Code BEAM Lite Stockholm 2026: a quick review and history of optimizing logging in Elixir.

🏗️ BootLife: Conway's Game of Life running directly from a 512-byte x86 boot sector, using VGA memory as the simulation grid. By Alex Kuleshov.

🏗️ PON-BEAM — Notification-Oriented BEAM Virtual Machine: PON-BEAM is a complete re-architecture of the Erlang/OTP Virtual Machine (ERTS — Erlang Run-Time System) using the Notification-Oriented Paradigm (PON).

🌐 beeceptor: a service to mock API, easy to use, fast. Perfect to implement and test http clients.

🌐 AsmGrid: a complete list of all opcode from x86, amd64 and ARM, from AsmJit, the library used by the BEAM for its JIT.

📝 How I converted GenLatte to fullstack Dart: A quick feedback regarding nodejs/javascript conversion to Dart. Discovered the freezed package while reading this post.

📝 Turning the HEIC decoder into a SHA-256 computer: a crazy post about the method to decode HEIC format. An HEIC decoder can be seen as a machine, having its own instruction, in this article, the author use them to generate the SHA256 hash of the image itself. Impressive.

📝 Type Safe Generic Data Structures in C: adding type safety in C is possible, but it's usually hard. I think this post is proving me wrong.

📝 A Fast, Growable Array With Stable Pointers in C: another article by the previous author introducing a dynamic array with constant time indexing and stable pointers. Also known as "levelwise-allocated pile" or "segmented list".

System

📝 Simple Optimization For Linux 7.4 Can Open Files For Reading ~39% Faster: interesting optimization case.

📝 Linux Process and Thread Creation: System Call Architecture

📑 Netkit: Specializing Linux Packet Delivery for Container Networks: decreasing network latency for containers using ePBF optimization.

📑 DDB: Source-Level Interactive Debugging for Distributed Applications:

🏗️ AnyPS5:Convert PS5 executables to run natively on Linux and Windows. The PS5 is using the same architecture than a PC (same for the Nintendo Switch), it runs on a modified version of FreeBSD (same for the Nintendo Switch), so, it was a matter of time before having a project porting games on Linux/Windows. A good thing, to be honest! Wait and see!

Hardware

📝 "Supply Shortage Problem Has Disappeared": Acer CEO Says Memory Prices To Decline In 2027 As CXMT Starts Mass Production Of New Chip Platform: RAM price could decrease during the next coming months.

Network

📝 DIY Router On X86 E-Waste: OpenWrt And OPNsense: Ah! A refreshing article on old-hardware reused to create routers! OpenWrt and OPNsense are the easy solution, if one want to really use a small system (but doing everything by hands), it should use FreeBSD, NetBSD or OpenBSD directly. This article reminds me when I was looking for old computers in the trashes... Nice!

Database

🏗️ postgrex: the official postgresql connector used by Ecto. Putting the link here because I'm writing about that right now.

🏗️ db_connection: the official database connector used by Ecto, especially used for the pool. Again, putting that here because I'm writing on this topic right now.

📝 NOT IN can be executed as an Anti-Join (NOT EXISTS) in PG19: huge performance gains in most of the use case. Best way to improve an application performance using postgresql: upgrade it.

📝 We ported the original Doom to SQL: another proof doom can run everywhere, probably more portable than NetBSD. If you like crazy hardcore SQL queries, you will have lot of fun reading this article.

Security

📑 Design and Verification of Secure Systems (1981): an old paper about design/verification for secure systems, still good to know.

📝 pwndbg: Exploit Development and Reverse Engineering with GDB & LLDB Made Easy

🏗️ Awesome Cybersecurity List: personal collection of awesome blog posts, write-ups, and papers focusing on cybersecurity.

🏗️ Wi-Fi Hacking: Testing Routers with Wifit3: it looks like wifit3 is a nice tool. Need to check that.

🏗️ VM guest escape via 9p filesystem exploit: LLMs are really great as fuzzers.

Security/Cryptography

🏗️ CHAMP Hash Implementation by veorq: CHAMP Hash Function and CHAMP Public-key algorithm. A future post-quantum algorithm.

📝 RSA-896: RSA challenge solved by using Claude with 2048 GPUs. Waiting to see the real process.

📑 Forging 1024-bit RSA signatures in nearly SNFS time: from Forging 1024-bit RSA signatures in nearly SNFS time paper, an attacker can in essence steal the secret key (in that they can forge signatures/decrypt offline), without actually factoring the public key, and using much less computation than factoring the public key would have taken.

📑 Quantum Encryption Resilience Score (QERS): A System-Level Evaluation Framework: a (very) long publication about post quantum cryptography algorithms and about a new framework/benchmark. Need to read that later more deeply, it looks interesting.

📖 Practical-Cryptography: exercises and courses on cryptography.

📑 The AEGIS Family Of Authenticated Encryption Algorithms: AEGIS was selected by the IRFC/IETF and added in RFC10032. AEGIS is based on AES round functinons. AEGIS is faster than AES and offers high security. Suitable for network communication. It includes both authentication and encryption.

📑 Shielded Bitcoin: (yet another?) protocol to make bitcoin L1 transfer private. IIRC, it was already made in the past... right? or perhaps not.

Security/RedTeam

📝 Turn a Rooted Android Phone into an NFC Authenticator and Automation Tool for Your PC: The series on NFC is great. In this post, they are explaining how to use an Android phone with NFC to inject and play with NFC connections.

Embedded

📝 Extending Scapy for Hardware Reverse Engineering: at the beginning of my career I was using scapy, and reading this post about using it to use it with hardware (SPI in this case) is so cool! It is possible to extract a firmware directly with scapy from an eeprom/flash using SPI traffic inspection. Really great.

▶️ Quick way to find a connection on a PCB: great method to find a track on a PCB using a kind of brush. Smart.

Update/Upgrade

🔄 Qubes OS 4.3.2-rc1 is available for testing

🔄 Erlang/OTP 29.1.1: security issues and bug fixes

🔄 NetBSD 10.2 Releases: bug and security fixes.

🔄 Tor Project Forum: Security Release 0.4.9.13: security patches. more info here.

🔄 hackney 4.8.0: a new version of the hackney http client in Erlang is available.

Leaks of the week

📝 Faktus victime d’une fuite de données : 53,7 Go et des données...

📝 Biocoop : 2,76 Go de données internes et près de 6 900 personnes concernées par une fuite de données: 6900 people impacted (name, emails, phones and identifiers) mostly from the company itself but also the customers.

🐦 China Mobile Subscribers Data Leak: over 850 million subscriber records offered for sale.

🐦 South Korea's National Health Insurance Service Data Leak: over 51 million records offered for sale

📝 Répar’stores piraté: 340GB of data, 7500 files, and over 1.8 millions impacted.

Misc

📝 Inside the Very Human Origin of the Term “Artificial Intelligence”

🐦 2,500 PRs last month to production: feedback regarding a huge amount of PR puts in production using Grok Bot. The trust is the most important issue (present on the first slides). In fact, it's the whole point of this talk. Tooling is important, including static analysis, test suite and so on. They used Dune (not sure if it's the right project though). a summary here.

You already know, I'm not a big fan of LLMs, but it will be the new norm. Like systemd (openrc fan) or kubernetes (nomad fan) before... The best tools are not always winning. When I created my first company project around 15 years ago, I did not trust my code. At this time, I learnt a lot of testing, but the problem was not about the testing, it was about the process. Extreme programming, Agile or scrums have been designed to deliver fast, but with risk of breaking things. On the other hand Cleanroom Software Engineering has been created to produce a small amount of bugs and high quality software. This process is expensive, and really strict, but it could be interesting to see if it could be integrated in a pool of LLMs workers.

🌐 Atomic Chat: open-source agent for local models.

🏗️ laya-mix: Native MLX runtime for Laya typed decision models — 7–14 ms short decisions on M3 Max. No text generation, PyTorch, or cloud API.

🌐 Jev Documentation: Jev is TypeSafe’s flagship model and the first System One model. Send state and typed questions; get structured answers your code can use directly.

📝 The “C” word, Are humans conscious? Not all LLMs agree: this post reminds me a tweet I posted few months ago. LLMs are huge database containing statistics about knowledge. More knowledge accumulated, means more accuracy. Most of the private LLMs (if not all) have been created by collecting copyrighted-data without the authorization of their author(s). Their is a reason why, now, many publishers are protected the access of their publication, to avoid this kind of abuse. The author of this article is exactly saying the same.

What caught everyone by surprise is that if you make the model big enough — i.e., if you pirate enough books and pilfer enough blog posts — it becomes eerily good at acting like a human. It can hold a fluent natural-language conversation on any topic, manipulate the language to produce previously-unseen outputs, and complete a variety of open-ended tasks. It can also speak convincingly about emotions it never experienced in a physiological sense: fear, love, pain.

Too many people are being fooled by that, because they don't understand how LLMs are working, and in fact, they don't even really what consciousness, nor thinking, nor what a mind is... Because no one teaches them and they have lost spiritually, replaced by ultra-materialism. Anyway, some people will answer LLMs are intelligent because they can have good score at exams or by solving complex cases in court for example. Well, again, if the LLM has been correctly specialized using the correct amount of books on these subjects, it will be able to answer most of those questions, because they are not requiring innovation, simply knowledge. Anyone with enough time and effort can do the same. When it comes to real-world problems, requiring more complex decisions, or original ideas, LLMs can fix that.

An LLM exists in a nihilistic netherworld devoid of death, injury, purpose, or consequence. It can’t go to prison if it lies or steals; we don’t train it to believe it could.

In the end, the over-usage of LLMs everywhere will drive down everything, because most of the resources assimilated by the LLMs are average. In fact, it can be even worse, they can also reproduce the same errors everywhere, without knowing it, because it was found on many publications, books or... blogs and stackoverflow. Anyway, a good post we should all read.

📝 The Kekulé Problem: another post about consciousness.

We dont know what the unconscious is or where it is or how it got there—wherever there might be [...] The log of knowledge or information contained in the brain of the average citizen is enormous. But the form in which it resides is largely unknown. You may have read a thousand books and be able to discuss any one of them without remembering a word of the text.

📝 How to keep enjoying programming in a world of LLMs: I'm thinking a lot of that. Few friends told me they are starting to hate programming due to LLMs, in fact, it's also my case. The ad-nauseam advertisement campaign about LLMs make me sick. The world "evolves", and if LLMs is becoming the new norm, then, we must adapt. My idea is to still code by myself on my own personal projects, and let the LLMs do the rest for my job. That's all. Maybe companies will understand one day fast production means also huge pile of legacy code and instability... But they are so greedy and they have been so blinded by this technological "progress", it will take a while. Anyway, lot of good rules in this post

🐦 Andrea Albrizio powned: some of you asked me why, in France, so many services got hacked recently. Well, my answer is simple: lack of responsibilities and overdose of incompetencies. Security is a process and a mindset.The process without the mindset will not work, and the mindset without the process will not work as well. Security is also about discipline and training. New attack methods are created every day. Anyway, this tweet is an example why people data are available on few dark forum, because those "entrepreneur" think they can just deploy an application, make millions and be safe. The web was never ever a safe place.

// Detect dark theme var iframe = document.getElementById('tweet-2101350249059008629-945'); if (document.body.className.includes('dark-theme')) { iframe.src = "https://platform.twitter.com/embed/Tweet.html?id=2101350249059008629&theme=dark" }

Cover Image by Rosalie Barley on Unsplash

WeekReview#202638

Mathieu Kerjouan — Mon, 21 Sep 2026 10:00:00 +0000

Linkedin is a mess. While I started to write articles on dev.to, I also started to create scheduled posts on Linkedin. It was working correctly until few days ago, when the "scheduler manager" just disappears. After 2 long hours to search where I could find a similar feature, I just stopped and started to use the "newsletter" feature from them. That's crazy to see how we are dependent of those services, and how they are treating us.

My feeds were quiet this week. Not a lot of interesting link to show.

Reflexion about Dart code design. What is the best way to design a module in Dart? It can be designed in many different ways, for example, the class can embed the methods to publish a post for example or delete it. In this case, the object must be instantiated first and then the methods can be called.

class Publication {
  int id;

  Publication({required this.id});

  Publication publish() => this;
  Publication delete() => this;
}

void main() {
  var pub = Publication(id: 1);
  pub.publish();
}

What about using a more functional way of doing that, by using the classes/objects as data-structures and passing them directly to functions outside of the class definition?

class Publication {
  int int;
  Publication({ required this.id });
}

Publication publish(Publication pub) => pub;
Publication delete(Publication pub) => pub;

void main() {
  var pub = Publication(id: 1);
  publish(pub);
}

Which method is the best? Well, I'm currently thinking to use the second one. The reason is simple, isolating side effect from the object itself, and function composition. Then, the object created can only be used with accessors, with some part of it in read-only or totally hidden. Anyway, I think it's mostly about coding style.

After few days of testing, using a mix of the two methods can be the best way. Another important part is how to name the module and how to organize the exported functions. Erlang, I miss you.

Back in May 2026, I tweeted about the next threat that will come with OpenClaws and other LLMs used to remote control platforms. ~4 months later, Mistral has been hacked and it seems this is a serious issue. Unreleased code, entire code base and so on can now be found on tor. This is only the beginning, the next step is to infiltrate all layers, inject code and take control of the code produced by LLMs. Remember Linus Torvald saying "LLMs are just kind of compilers" few months ago? Well, if you can't trust your compiler, you can't trust what it produces, see "Reflections on Trusting Trust" by Ken Thompson. What the next step after that? Control the servers where those LLMs are executing tasks, and it's only a matter of time. Good luck to all developers and admins who installed this crap on their servers, including laptops, test and dev machines. Oh, and by the way, Mistral has been integrated in Firefox recently, have fun and sleep well!

Coding

📝 Dart Google Summer of Code 2026 results: a report for the Dart Google Summer of code. package:ffigen looks promising and will help to create interface from c++ to dart. The other interesting project was debugging improvements for pointers.

📝 libsodium/Finite field arithmetic: white searching a good cryptographic library for Dart (yeah, the ones available don't fit my needs), I read the libsodium documentation, especially the part on valid points.

📝 Pear Docs: yet another p2p system. This time, it has been mostly done in javascript, by Holepunch. Some note on the protocol can be also found on github from libudx.

📝 The "Clockwise/Spiral Rule": did not know this method to mentally parse C.

🌐 cdecl: an online tool to decipher C language notation, also available as CLI.

📝 OpenBSD vmm/vmd SMP support: nice! We will be able to set the number of CPUs for a VM on OpenBSD, thanks to Bryan Steele for the news.

System

📝 Void Linux Maintainer Orphans 100+ Packages Over AI Policy Dispute: the reason why I like Void Linux.

🏗️ turbocrypt: A fast, easy-to-use, and secure command-line tool for encrypting and decrypting files , git repositories and directory trees.

📝 Crash-Safe & Copy-On-Write GEFS As The "Good Enough File-System" For OpenBSD: more than 10 years ago, HAMMER2 from DragonFlyBSD was planned to be ported to OpenBSD, but it never happened. This filesystem could be a good candidate to replace that. The specifications are looking good. The snapshot feature is really what is missing on many filesystems, including UFS.

Database

🏗️ pgassistant project: A PostgreSQL assistant for developers Understand, optimize, and improve your PostgreSQL database with ease.

Network

📝 Overview of Passive Optical Networks (PONs) Security: a deep introduction to optical network security, a lot of information there.

Mathematics

📝 Finite time blowup with smooth forcing term for the incompressible porous medium, Boussinesq, and incompressible Euler equations

Embedded

📝 The Great Pi Zero Showdown: if you want to see benchmarks comparing different kind of Pi Zero implementation.

Security

📝 The Hitchhiker's Guide to Online Anonymity (and Privacy)

📝 From APK to Source: Complete Android Reverse Engineering Workflow: a succinct post containing the essential procedure to reverse engineer an android package (apk).

📝 Android APK Reverse Engineering: From APK to Source: another post listing the essential procedures to reverse an android package.

🌐 Quarklabs' blog: lot of interesting articles about modern security (and programming).

📝 Devil’s advocate? Uncensored Luciferus AI service advertised underground: underground actors are selling uncensored LLMs. Good to know.

📝 The XSS inside your favorite iOS app: XSS can also be found in mobile application via WebView for Android and MKWebView for iOS. Good to know because one of my project is using WebView, hardening this part could be a good idea.

📝 HEIF Heist, One image parser to pwn them all: the story behind libheif library vulnerability exploitation. Announced by Harsh Jaiswal (@rootxharsh) on X/Twitter.

📝 Browser Forensics: Analyzing Suspicious Extensions with ExtAnalysis

Security/cryptography

📝 It's 255:19AM. Do you know what your validation criteria are?: when I was looking for an up to date list of invalid or low-order public keys, I found this post. It seems most of the ed25519 on the market are not compatible with the RFC8032 (Edwards-Curve Digital Signature Algorithm (EdDSA)), mostly due to design issue and also because the RFC came after all implementations. That's actually a huge portability problem and a security issue as well.

Security/RedTeam

📝 Advanced Techniques for Bypassing Modern Web Application Firewalls: a very long list of attacks for bypassing WAF.

📝 JSON Interoperability Vulnerabilities: A Deep Dive: we tend to think JSON is secure because of its simplicity, portability and its presence everywhere. This article list different kind of vulnerabilities that can be found on JSON serializers. interesting.

Guesttohost:escapingDocker'shypervisor: docker hypervisor escape on MacOS, due to virtio-fs. ingenious way to get out of a container.

Update/Upgrade

🔄 Phoenix 1.8.14: bug fixes

🔄 RabbitMQ 4.3.6: bug fixes and enhancements.

🔄 Erlang/OTP 29.1: many bug fixes and security issues. No new features.

🔄 OpenSMTPD 7.9.0p0 released: bugs fixes and hardening.

Embedded

📝 Biodegradable PCBs – The Future of Sustainable Electronics: good to know, we can now create biodegradable PCBs. Not sure if it's a good thing for the environment (e.g. heavy metals, polymers), but it's a first step.

Misc

🌐 BOB Conf

📝 On-device intelligence for every product

🏛️ Tools for Thought

📑 Theory Is All You Need: AI, Human Cognition, and Causal Reasoning: Here a part of the abstract.

Scholars argue that artificial intelligence (AI) can generate genuine novelty and new knowledge and, in turn, that AI and computational models of cognition will replace human decision making under uncertainty. We disagree. We argue that AI’s data-based prediction is different from human theory-based causal logic and reasoning. We highlight problems with the decades-old analogy between computers and minds as input–output devices, using large language models as an example. Human cognition is better conceptualized as a form of theory-based causal reasoning rather than AI’s emphasis on information processing and data-based prediction.

📝 Iran strikes on Amazon data centers caused permanent loss of customer data: the cloud during war becomes foggy.

📝 Intel Appears To End Its Bug Bounty Program: if it's the case, why? It could be due to the amount of false-positive bugs found with LLMs, it can have a really huge impact on developers team. Curious to know more about the reason.

Cover Image by Sunira Moses on Unsplash

Q&D: Flutter App and Android-SDK

Mathieu Kerjouan — Thu, 17 Sep 2026 08:00:00 +0000

After having upgraded few tools on machine, one of my application was totally unable to run. I got a lot of warnings, especially this one:

Warning: Flutter support for your project's Gradle version (8.14.0) will soon be dropped. Please upgrade your Gradle version to a version of at least 9.1.0 soon.                             
Alternatively, use the flag "--android-skip-build-dependency-validation" to bypass this check

and finally...

FAILURE: Build failed with an exception.                                                                                                                                                      

* What went wrong:                                                                                                                                                                            
Execution failed for task ':app:compileFlutterBuildDebug'.                                                                                                                                    
> A problem occurred starting process 'command '/home/user/.local/share/mise/http-tarballs/dd5ae32abcea719e3c351c56a28308b91e2ce97fb5702bf2710c2527dde522af_strip_1/bin/flutter''             

* Try:                                                                                                                                                                                        
> Run with --stacktrace option to get the stack trace.
> Run with --info or --debug option to get more log output.
> Run with --scan to get full insights.
> Get more help at https://help.gradle.org.

BUILD FAILED in 1s
Running Gradle task 'assembleDebug'...                           1,270ms
Error: Gradle build failed due to Java/Gradle incompatibility.
The Java version used for the build is 25.0.3, which is incompatible with Gradle 8.14.
To fix this, you can either:
  1. Upgrade your project's Gradle version (typically in gradle-wrapper.properties to a version matching the range: compatible Gradle versions for Java 25.0.3 are 9.1.0 or newer).
  2. Use a different Java version for Flutter by running `flutter config --jdk-dir=<path>`.

Annoying right? In fact, many other warnings were displayed, but what happened there? The last time, it was working without problem. Let have a look on the android sdk

Android SDK Upgrade

The "old" latest version of the android-sdk called Panda 4 was used, instead of the new latest version called Quail 4.

$ cd Downloads

$ wget https://edgedl.me.gvt1.com/android/studio/ide-zips/2026.1.4.7/android-studio-quail4-linux.tar.gz

$ tar zxf android-studio-quail4-linux.tar.gz

$ cd android-studio

$ ls bin
appletviewer.policy  game-tools.sh    lldb         studio              studio.svg
brokenPlugins.db     helpers          ltedit.sh    studio64.vmoptions
format.sh            idea.properties  profiler.sh  studio.png
fsnotifier           inspect.sh       restarter    studio.sh

Android SDK Platforms and Tools Upgrade

The latest android-studio version is now installed, but the SDK Platforms and the SDK Tools needs to be upgraded as well. It can be done via android studio directly in Menu > Tools > SDK Managers. The versions to upgrade to should be displayed with the installed one as well. If needed, install some latest versions or missing tools.

$ ./bin/studio

The upgraded versions should have been extracted in the ${HOME}/Android directory. It can also be done using the sdkmanager tool.

$ sdkmanager --update

Flutter and Dart upgrade

My development machine is using mise to have the latest version of flutter and dart. The version of these applications are usually stored in the .tool-versions. It can be upgraded using the upgrade subcommand.

$ cd ~/project

$ cat .tool-versions
flutter latest
dart latest

$ mise upgrade
...

Environment Variables

My environment was a mess, because many tools were living together and usually, because you want to do something quick, you put everything in your ~/.bashrc. Here the new conf.

# recreates a full clean path from scratch
export PATH=/bin:/usr/bin:/usr/local/bin
export PATH=/sbin:/usr/sbin:/usr/local/sbin:$PATH
export PATH=${HOME}/bin:$PATH

# enable mise
eval "$(~/mise/bin/mise activate bash)"

# set android configuration
export ANDROID_HOME=${HOME}/Android/Sdk
export PATH=$ANDROID_HOME/tools:$PATH
export PATH=$ANDROID_HOME/tools/bin:$PATH
export PATH=$ANDROID_HOME/platform-tools:$PATH
export PATH=$ANDROID_HOME/cmake/4.1.2/bin:$PATH
export PATH=$ANDROID_HOME/cmdline-tools/latest/bin:$PATH

export CHROME_EXECUTABLE=$(which chromium)
export EDITOR=vim

Flutter and Gradle

Gradle was crying because of an old version unsupported to some new versions installed. To be honest, my android application version is still quite simple, so, I fixed the issue by recreating the android directory from the flutter project root.

$ cd ~/project

$ mv android android.old

$ flutter create . --platforms=android
Recreating project .... 
...
Resolving dependencies...                                                                                                                                                                     
Downloading packages...                                                                                                                                                                       
Got dependencies.                                                                                                                                                                             
Wrote 26 files.                                                                                                                                                                               

All done!                                                                                                                                                                                     
You can find general documentation for Flutter at: https://docs.flutter.dev/                                                                                                                  
Detailed API documentation is available at: https://api.flutter.dev/                                                                                                                          
If you prefer video documentation, consider: https://www.youtube.com/c/flutterdev                                                                                                             

In order to run your application, type:                                                                                                                                                       

  $ flutter run                                                                                                                                                                               

Your application code is in ./lib/main.dart.

The application can now be restarted again.

$ flutter run

Here the flutter command reference.

Another Gradle issue

WARNING: A restricted method in java.lang.System has been called                                                                                                                              
WARNING: java.lang.System::load has been called by net.rubygrapefruit.platform.internal.NativeLibraryLoader in an unnamed module (file:/home/user/.gradle/wrapper/dists/gradle-9.3.1-all/9ot9r
568e8zfvvd4mn8rbu1j0/gradle-9.3.1/lib/native-platform-0.22-milestone-29.jar)                                                                                                                  
WARNING: Use --enable-native-access=ALL-UNNAMED to avoid a warning for callers in this module                                                                                                 
WARNING: Restricted methods will be blocked in a future release unless native access is enabled

This one is a bit tricky. On the latest android-studio version, the bundled version of JDK is 25+. Let check that with flutter doctor.

$ flutter doctor --verbose
...
[✓] Android toolchain - develop for Android devices (Android SDK version 37.0.0) [248ms]                                                                                                      
    • Android SDK at /home/user/Android/Sdk                                                                                                                                                   
    • Emulator version 37.1.11.0 (build_id 15917651) (CL:N/A)                                                                                                                                 
    • Platform android-37.2, build-tools 37.0.0                                                                                                                                               
    • ANDROID_HOME = /home/user/Android/Sdk                                                                                                                                                   
    • Java binary at: /home/user/Downloads/android-studio/jbr/bin/java                                                                                                                        
      This is the JDK bundled with the latest Android Studio installation on this machine.                                                                                                    
      To manually set the JDK path, use: `flutter config --jdk-dir="path/to/jdk"`.                                                                                                            
    • Java version OpenJDK Runtime Environment (build 25.0.3+-15898627-b508.16)                                                                                                               
    • All Android licenses accepted.
...

Indeed, it looks like it uses OpenJDK25+... Just to confirm, let execute java directly.

$ ~/Downloads/android-studio/jbr/bin/java -version
openjdk version "25.0.3" 2026-04-21
OpenJDK Runtime Environment (build 25.0.3+-15898627-b508.16)
OpenJDK 64-Bit Server VM (build 25.0.3+-15898627-b508.16, mixed mode)

It seems this version is not supported correctly with flutter applications, requiring JDK 21. To remove temporarily this warning message, instead of adding a flag, one can install an old version of the JDK from the system package manage for example.

$ sudo apt-get install openjdk-21-{jre,jdk}

Then, the project can be configured to use this one instead of the latest version available from the android studio.

$ flutter config --jdk-dir=/usr/lib/jvm/java-21-openjdk-amd64

$ flutter doctor --verbose
...
[✓] Android toolchain - develop for Android devices (Android SDK version 37.0.0) [235ms]                                                                                                      
    • Android SDK at /home/user/Android/Sdk                                                                                                                                                   
    • Emulator version 37.1.11.0 (build_id 15917651) (CL:N/A)                                                                                                                                 
    • Platform android-37.2, build-tools 37.0.0                                                
    • ANDROID_HOME = /home/user/Android/Sdk                                                    
    • Java binary at: /usr/lib/jvm/java-21-openjdk-amd64/bin/java                                                                                                                             
      This JDK is specified in your Flutter configuration.                                                                                                                                    
      To change the current JDK, run: `flutter config --jdk-dir="path/to/jdk"`.                                                                                                               
    • Java version OpenJDK Runtime Environment (build 21.0.12.1+1-1-deb13u1-Debian)                                                                                                           
    • All Android licenses accepted.
...

Thanks to this post from startdebugging.net, it helped me a lot to debug this issue.

Storage Issue

Failure [INSTALL_FAILED_INSUFFICIENT_STORAGE: Failed to override installation
location]
Error launching application on sdk gphone64 x86 64.

It simply means the virtual machine used for android (the device used by flutter) is full and there is no enough free space available to install the application. This one is kinda easy to fix, in android-studio go to Menu > Tools > Devices Manager, select the device to edit. In the Additional settings tabs, below the Storage section, one can expand both the internal or global storage. Note: It will reset the data on the device.

Conclusion

Modern programming is a huge pile of shit. Every time you do a small update/upgrade on one module or package, or on the core language to have the latest security patches, it breaks. That's annoying and explain why most of the applications are not safe. Developers don't really care about security, they wants to deliver quick. To do that, they will bypass all safety. Sadly, nothing changed during the last 10 or 20 years to build a mobile app easily. I've lost half a day to figure out what was the root cause... The good side? It's another confirmation about the whole ecosystem, it's a miracle everything is working correctly.

As usual, hack it and try to have some fun!

Cover Image by Ticka Kao on Unsplash

Q&D: PostgreSQL 18 on OpenBSD

Mathieu Kerjouan — Tue, 15 Sep 2026 10:00:00 +0000

If you need the latest version of PostgreSQL on OpenBSD, the limits for the semaphores must be increased. Indeed, let imagine you want to deploy a fresh postgresql database (assuming the /var/postgresql/data directory was not created or purged).

$ doas pkg_add postgresql-server
...

$ cd /var/postgresql

$ doas -u _postgresql initdb -D data
The files belonging to this database system will be owned by user "_postgresql".                                                                              
This user must also own the server process.          

The database cluster will be initialized with locale "C".                     
The default database encoding has accordingly been set to "SQL_ASCII".         
The default text search configuration will be set to "english".               

Data page checksums are enabled.

fixing permissions on existing directory data ... ok
creating subdirectories ... ok                                                
selecting dynamic shared memory implementation ... posix
selecting default "max_connections" ... 20                           
selecting default "shared_buffers" ... 400kB                                  
selecting default time zone ... UTC
creating configuration files ... ok
running bootstrap script ... 2026-09-14 17:44:41.502 UTC [93045] FATAL:  could not create semaphores: No space left on device                                 
2026-09-14 17:44:41.502 UTC [93045] DETAIL:  Failed system call was semget(3810418, 17, 03600).                                                               
2026-09-14 17:44:41.502 UTC [93045] HINT:  This error does *not* mean that you have run out of disk space.  It occurs when either the system limit for the maximum number of semaphore sets (SEMMNI), or the system wide maximum number of semaphores (SEMMNS), would be exceeded.  You need to raise the respective kernel 
parameter.  Alternatively, reduce PostgreSQL's consumption of semaphores by reducing its "max_connections" parameter.                                         
        The PostgreSQL documentation contains more information about configuring your system for PostgreSQL.                                                  
child process exited with exit code 1                                          
initdb: removing contents of data directory "data"

An error! To fix it, kern.seminfo.semmni and kern.seminfo.semmns need to be modified.

$ doas sysctl kern.seminfo.semmni=256
kern.seminfo.semmni: 10 -> 256

$ doas sysctl kern.seminfo.semmns=2048
kern.seminfo.semmns: 60 -> 2048

Now, the database can be initialized without issue.

$ doas -u _postgresql initdb -D data                    
The files belonging to this database system will be owned by user "_postgresql".                                                                             
This user must also own the server process.                                   

The database cluster will be initialized with locale "C".                     
The default database encoding has accordingly been set to "SQL_ASCII".        
The default text search configuration will be set to "english".               

Data page checksums are enabled.       

fixing permissions on existing directory data ... ok                          
creating subdirectories ... ok         
selecting dynamic shared memory implementation ... posix                      
selecting default "max_connections" ... 100                                   
selecting default "shared_buffers" ... 128MB                                  
selecting default time zone ... UTC    
creating configuration files ... ok    
running bootstrap script ... ok        
performing post-bootstrap initialization ... ok                               
syncing data to disk ... ok            

initdb: warning: enabling "trust" authentication for local connections        
initdb: hint: You can change this by editing pg_hba.conf or using the option -A, or --auth-local and --auth-host, the next time you run initdb.              

Success. You can now start the database server using:                         

    pg_ctl -D data -l logfile start

$ doas rcctl start postgresql
postgresql(ok)

It looks way better! The new configuration can now be added into /etc/sysctl.conf

$ echo "kern.seminfo.semmni=256" | doas tee -a /etc/sysctl.conf

$ echo "sysctl kern.seminfo.semmns=2048" | doas tee -a /etc/sysctl.conf

The server should reboot with the good configuration now. You can configure your postgresql server now.

$ doas -u _postgresql psql postgres
psql (18.6)
Type "help" for help.

postgres=#

Happy hacking and have fun!

Cover Image by Dan Seddon on Unsplash

WeekReview#202637

Mathieu Kerjouan — Mon, 14 Sep 2026 08:00:00 +0000

Paying for "cheap" virtual machines running my CI/CD pipelines is no fun. You will have the result quick, but you will not learn how to deploy this kind of infrastructure. As sysadmin, it's always nice to see how the tools used few years ago evolved... So, this week was about creating my own local privacy-first building infrastructure for Gitlab CI/CD. Based on the increasing cost of hosting providers due to the "AI revolution", hosting its own infrastructure can have a lot of benefit (and few drawbacks). What's the idea?

To avoid information leaks like my own public address, the network will route all outgoing connections to a VPN or/and via a proxy. Each servers will be installed with an hardened version of Alpine Linux, and will have gitlab-runner enabled by default with a container manager (e.g. podman). Those servers are old laptops or cheap bare-metal devices (e.g. Intel NUCs, ARM boards). This infrastructure will also offer local isolated cache servers and a way to store artefacts.

It was not really planned, but it's a nice idea to do that. In fact, I would like to also test this kind of infrastructure with k3s to see if a kubernetes cluster can run in its own world, without a direct access to internet. Spoiler alert: it is already deployed on two workers, behind an OpenBSD firewall. It's a matter of time before a series of articles will be published here about that.

This week was kinda busy, working on my application in Dart/Flutter, and most of the links are without comments because they have been barely read... Even more, dev.to is going to make me crazy. When a post is removed from a series, it is not displayed on user's profile. I created an issue hoping it will be fixed, but I was so angry about that, I started to work on my own post manager called publish using only pandoc, Makefiles and shell scripting. I don't understand how a website like dev.to can be a "reference" for developers. Anyway, as usual, nothing is better than what you can do by yourself. A word on publish project?

must be highly portable and run everywhere
must be use simple markdown files
must publish content in more than one format (e.g. html, pdf, epub, djvu...)
must be easy to clone/export
must be easy to backup
must be easy to migrate
must be flexible enough to deal with callbacks in any languages
must generate good old files and directories
must save its state as local files/directories as well
all my publications will be firstly created there and then published on substack, medium and dev.to (and in other places as well if possible).

I'm really tired of migrating my content every 2 or 3 years, but I know think the best way is to keep everything open, and stay with your data locally.

Coding

🏗️ snmpkit: A comprehensive SNMP toolkit for Elixir featuring a unified API, pure Elixir implementation, and powerful device simulation.

📝 Register Allocation in the LLVM Backend: an article on LLVM compiler optimization for registers allocation. In short, this is the algorithms used when the -O flag is set. It's interesting to see register allocation is not a simple thing. This article focus on CPU though, GPU register allocation is a bit different.

🏗️ listen project: A package to notify state changes to interested listeners in pure Dart.

📝 Recreating Voodoo Graphics and a Late-1990s Gaming PC on an FPGA: another article about the z486 CPU, this time about recreating a graphic card using an FPGA.

🏗️ gitlab-ci-local project: Run gitlab pipelines locally as shell executor or docker executor.

🏗️ ecto_middleware: Implements the middleware pattern for your Ecto repos, a Plug-like concept for Ecto.

📝 Implementation of GCC's Nested Functions (vs. C++ Lambdas)

📑 C*: Unifying Programming and Verification in C

🐦 A quick overview of atomics in C

📑 Stackful Coroutine Made Fast: from PhotonLibOS

📝 Optimizing a Spin-Lock

📝 Implementing a Phoenix PubSub Adapter with EventStore: a quick and short introduction to Phoenix PubSub.

📝 Decompilation Book: A good introduction to decompilation (and reverse engineering).

System

📝 Asahi Linux Now Officially Supports Apple M3 Macs - With Caveats: Linux on Apple M3 CPU will be great. Looking forward to have the same support on BSDs.

📝 RabbitMQ vs. Apache Kafka: it reminds me years ago when some of my colleagues were talking about comparing RabbitMQ and Kafka. This article is an up-to-date version of this discussion, with a nice conclusion: RabbitMQ is the better default. In general, both systems are now doing the same, with mostly the same performance. Anyway, a good summary every one working with queueing systems should read. A study is also available.

📝 SystemIO conflicts are not firmware bugs

🏗️ grafito project: a simple, self-contained web-based log viewer for journalctl. It provides an intuitive interface to browse and filter system logs directly from your web browser.

🏗️ Vinix OS: Vinix initially is going to support every Apple Silicon Mac (only M1 Macs for now as of Sep 10 2026).

📝 Retrospectively Reverse-Engineering Apple's Neural Engine

📝 Interview with Ken Thompson, 9-6-89

Network

📑 De-Anonymization Techniques in the Tor Network Using an Experimental Testbed: A really interesting publications doing a huge work on de-anonymizing tor network users using open-source tools, in an experimental network. In the end, nothing really new. It's well known if the user is not careful during browsing or when downloading something, it can lead to information leaks. Whonix mostly fix this issue, even more when it is installed in QubeOS. Here the tools they used in this paper:

shadow: Shadow is a discrete-event network simulator that directly executes real application code, enabling you to simulate distributed systems with thousands of network-connected processes in realistic and scalable private network experiments using your laptop, desktop, or server running Linux;
chutney: Tool for testing Tor network
ExperimenTor: A Testbed for Safe and Realistic Tor Experimentation

Database

🏗️ PostgreSQL Anonymizer: The main goal of this extension is to offer anonymization by design. We firmly believe that data masking rules should be written by the people who develop the application because they have the best knowledge of how the data model works. Therefore masking rules must be implemented directly inside the database schema. From PostgreSQL News.

🏗️ pg_vault_tde project: encrypts every tuple with AES-256-GCM at the Table Access Method layer. Data is encrypted before it reaches the storage manager and decrypted after it leaves. Encryption keys are managed by HashiCorp Vault / OpenBao or a local PKCS#12 wallet and cached in shared memory with automatic rotation. Seen from postgresql news.

Storage

🏗️ Garage project: S3-compatible object store for small self-hosted geo-distributed deployments.

Security

📝 Activating Chrome DevTools Protocol in Memory: Bypassing –remote-debugging-port Restrictions: shellcode injection on windows using Chrome Developer Tool.

📝 I accidentally logged hundreds of thousands of phone calls to military bases: a good story about hijacking e164.arpa domains, a project created in the 2000's to associate phone number with DNS.

📝 WeWorm, The first zero-click worm to spread through WeChat calls across iOS and Android.

▶️ Deanonymizing Monero Transactions in Tor Network: an introduction to deanonymizing monero transactions, but it has been fixed in the latest versions (quick). btw, I liked the fake VPN ads but I also liked the truth behind the private VPN companies giving logs to goverments.

▶️ The Tor Project Just Gaslit Their Entire User Base: another project lying to their users. Tor browser does not protect against OS fingerprint, that's a shame, but the worst part is... they are saying the opposite in their communication. Don't trust anyone, again.

📝 From P-Code to GNN: extract binary code semantics

📝 Bluetooth Low Energy Security Testing, Consolidated: Introducing Caeruleus

Security/Cryptography

📝 Engineer Factors RSA-260, Ending a 35-Year Cryptographic Challenge: lot of noise here, but RSA-260 (260 bits RSA keys) have been broken. At least... One of them.

📑 Computing 256-bit elliptic curve discrete logarithms in 26 days on a fault-tolerant trapped-ion quantum computer with 20,000 qubits

Security/OSINT

🏗️ Instagram OSINT Relationship Analysis project: Analyze the followers and following accounts that a private (hidden) Instagram account interacts with.

Security/BlueTeam

📝 MikroTik ssh 0day exploitation in the wild: a short story about a 0 day exploited on Mikrotik routers via SSH.

Security/RedTeam

📝 PowerShell for Hackers: Exploitation Essentials: not a big fan of powershell, but it's a good introduction for penetration testing.

🏗️ XSS Labs project: Hands-on XSS labs for learning, practicing, and understanding Cross-Site Scripting vulnerabilities.

Embedded

📝 Scheme-it: Schematic Drawing, Flow and Block Diagramming Made Easy: a quick introduction to scheme-it to create and design electronic schema. Those schema can then be imported in KiCAD.

📝 Deep Dive Into PCB Manufacturing Techniques: Milling: a short post on PCB milling.

📝 ESP32 Audio Project - Part I: Internet Radio with I²S DAC

📝 Chameleon Ultra: Guide to RFID Reading, Emulation and Testing

🏗️ A standalone, real-time 2x2 MIMO software-defined radio (SDR) platform for advanced wireless research and rapid prototyping: a standalone, real-time 2x2 MIMO software-defined radio (SDR) platform for advanced wireless research and rapid prototyping. With FPGA-accelerated wireless processing, ultra-low phase noise design, and a proven real-time PHY baseline.

Update/Upgrade

🔄 NetBSD 9.5: NetBSD 9.5, the fifth (and final) release from the NetBSD 9 stable branch, end-of-support for all NetBSD-9.x. The full announcement can be found on the release page.

🔄 Cowboy 2.19, Cowlib 2.20, Gun 2.6, Ranch 2.3: this is an important release for all the cowboy-suite libraries. Cowboy is now only support OTP-27+ and will drop support for all versions of Erlang without security patches. The release on Github: cowlib-2.20.0, ranch-2.3.0, cowboy-2.19.0 and gun-2.6.0.

🔄 Nova 0.17.0: optimization update.

🔄 Nova 0.18.0: another update.

🔄 OpenBSD 7.9 syspatch security upgrade: a lot of patches, impacting opensmtpd, nfs, wscons, shmat, libexpat, X and ldapd.

Providers

🌐 Bullionet: cheap bare-metal server in France (Paris, Marseilles, Lille). Announced on X/Twitter.

🌐 netcup: low cost virtual servers, and interesting deals.

🌐 contabo: low cost virtual servers, pretty expensive bare metal ones though.

🌐 speedypage: in pound (uk), quite expensive bare metal servers, but the price for virtual servers looks great.

🌐 euronodes: virtual machines are cheap (<5€), bare-metal servers are expensive. Data centers in Europe (germany, portugal, spain and czech republic).

🌐 macserve: is it a joke?

🌐 BoxedTux: Deploy a full Linux virtual server in under 90 seconds. Root access, public IP, your choice of distro — no credit card, no vendor lock-in.

🌐 BoxyBSD: BoxyBSD offers free VPS instances for exploring FreeBSD, OpenBSD, NetBSD and many other BSD or Solaris based systems. Get hands-on experience, experiment safely, and join a growing community of BSD enthusiasts.

Misc

🌐 Mini ITX Shop: A good place to find small-sized computers/boards.

🌐 Mhz Shop: A good place to find wireless hardware and devices.

📝 Under-The-Radar Oklahoma Bitcoin Mining Site Condemned After Leaking 3 Million Gallons Of Water

🏗️ BraveDebloater project: Safety-first Windows PowerShell debloater for Brave Browser using enterprise policies, dry-run mode, backups, and restore.

📝 Build Your Own Private Cellular Network: kinda expensive ($999) but looks interesting.

🏗️ Nobora Project: A Fedora-based desktop, tuned for gaming, streaming, and content creation — so you can skip the tweaking and start doing.

📟 Sipeed NanoKVM-Go: an updated version of the NanoKVM, perfect for remote control and debugging a system remotely.

🐦 go fuck yourself @sama: a reaction regarding the last "discovery" made by anthropic in the mathematical field. Below the most interesting part to me. Your data, your ideas, or your researches are not safely protected by those companies.

to this theoretical imposture you add a disgusting ethical and industrial cynicism taking advantage of private codex sessions and informal preprints from academic researchers to siphon their research leads and then trying to redact or erase the contribution of levent alpöge under the pretext that he works at rival anthropic is intellectual serfdom openai behaves like a feudal lord of silicon appropriating the cognitive subsistence of independent scholars threatening their careers behind closed doors if they protest and turning community academic labor into a privatized pressrelease [...] real science is not a clout chase on social media or a compute spike spent to rob the clay mathematics institute it is a quest for elegance physical truth and universal rigor to decode reality [...] the most dangerous aspect of this maneuver is not the mathematical exaggeration but the corporate enclosure of scientific discovery by keeping these frontier systems locked behind outcome based pricing licensing barriers & proprietary API walls [...] when mathematical reality itself gets reduced to synthetic token production swallowed by closed infrastructure we transition from open academic inquiry to technological feudalism

🌐 Black Hat World Forum: discovering this forum recently, about SEO.

Cover Image by Artem Kniaz on Unsplash

Q&D: Dart on Alpine Linux

Mathieu Kerjouan — Thu, 10 Sep 2026 10:00:00 +0000

Running Dart outside of the main distribution can be challenging. In fact, my first idea was to compile it from sources, but it seems most of the projects are simply using the binaries from Google instead of building the sources directly from the official Dart repository. That's a shame from an "open-source" language but anyway... Here some methods to use Dart on Alpine Linux.

Using a Container

The Dart Team offers a Docker image with the latest version of Dart from the Google Dart binaries. This is probably the easiest way to use Dart on Alpine Linux without adding a lot of useless dependencies in your system.

# podman run -it dart sh

See also:

Using `asdf` or `mise`

asdf and mise can be used to bootstrap your systems. As usual, the Dart binaries are from Google.

# asdf plugin add dart

See also:

Using Google Binaries

Then, why not downloading ourselves the binaries from Google and installing it on Alpine Linux directly. It will require "only" gcompat.

# apk update

# apk add curl gcompat

# curl -Lo dartsdk-linux-x64-release.zip https://storage.googleapis.com/dart-archive/channels/stable/release/3.13.3/sdk/dartsdk-linux-x64-release.zip

# unzip dartsdk-linux-x64-release.zip

# cd dart-sdk

# ./bin/dart --version
Dart SDK version: 3.13.3 (stable) (Tue Sep 1 01:07:17 2026 -0700) on "linux_x64"

# export PATH=${PATH}:$(pwd)/bin

# dart create t && cd t

# dart run
Building package executable... 
Built t:t.
Hello world: 42!

The binaries are running on Alpine Linux, but we should be careful, they have been made on Debian-like system (trixie). For example, ldd is not really happy due to __cxa_thread_atexit_impl missing symbol.

# ldd dart
        /lib64/ld-linux-x86-64.so.2 (0x7925aad9e000)
        libdl.so.2 => /lib64/ld-linux-x86-64.so.2 (0x7925aad9e000)
        libpthread.so.0 => /lib64/ld-linux-x86-64.so.2 (0x7925aad9e000)
        libm.so.6 => /lib64/ld-linux-x86-64.so.2 (0x7925aad9e000)
        libc.so.6 => /lib64/ld-linux-x86-64.so.2 (0x7925aad9e000)
        ld-linux-x86-64.so.2 => /lib/ld-linux-x86-64.so.2 (0x7925aa81f000)
Error relocating dartaotruntime: __cxa_thread_atexit_impl: symbol not found

See also:

Dart SDK archive Stable channel

Compiling From Sources

What a mess. I thought it would have been easy to compile Dart from sources, but it's not the case, especially on Alpine Linux. I started to work on it, but it's not ready yet, mostly due to the google tools required for the compilation, producing a shit-ton of errors. Anyway, here a quick list of the dependencies

# apk update

# apk add git python3 curl xz gn clang make py3-virtualenv py3-setuptools py3-pip bash

See also:

Building dart sdk on Github issues

Conclusion

I need a recent version of Dart, Flutter and Android SDK in a container. Unfortunately, the only ones have found are old, unmaintained or unofficial (it means trusting people I don't know).

Docker image for Android SDK: a docker image with the latest android sdk ONLY (no dart, no flutter);
AndroidSDK: another docker image containing the latest android SDK;
Kosmos: another docker image with android SDK;
docker-android-sdk: again, another docker image with android SDK;
Docker Android Build Box: docker image containing android SDK, JDK, and Flutter. This is the closed ones, but it is huge (5.5GB). I would like to avoid fetching the whole universe;
image.flutter: a docker image containing flutter and the android sdk. Perhaps the good catch, but it uses an old version of flutter, and not even sure it works correctly (I like the localhost/android-sdk source image). To be tested.

Anyway, building and releasing mobile application is a PITA. I understand why so many companies are selling a full build effortless pipeline, that's business.

As usual, have fun and happy hacking!

Cover Image by Camila Mofsovich on Unsplash

DEV Community: Mathieu Kerjouan

Q&D: Android Device Information

WeeklyReview#202641

Coding

System

Network

Database

Security

Security/Cryptography

Embedded

Update/Upgrade

Computer Science

Misc

Leaks of the week

WeeklyReview#202640

Coding

Database

System

Security

Security/Cryptography

Security/RedTeam

Embedded

Updates/Upgrades

Misc

Leaks of the week

Erlang Preprocessor and Elixir Interoperability

Erlang From Code Source to AST

Erlang Preprocessor (epp)

Erlang Records in Elixir

Erlang Macros Definition in Elixir

Real World Application

A Quick Note About epp_dodger Module

Conclusion

Q&D: ExUnit and Blob Fixture in Elixir

Q&D: Anonymous Recursive Functions in Elixir

WeeklyReview#202639

Coding

System

Hardware

Network

Database

Security

Security/Cryptography

Security/RedTeam

Embedded

Update/Upgrade

Leaks of the week

Misc

WeekReview#202638

Coding

System

Database

Network

Mathematics

Embedded

Security

Security/cryptography

Security/RedTeam

Update/Upgrade

Embedded

Misc

Q&D: Flutter App and Android-SDK

Android SDK Upgrade

Android SDK Platforms and Tools Upgrade

Flutter and Dart upgrade

Environment Variables

Flutter and Gradle

Another Gradle issue

Storage Issue

Conclusion

Q&D: PostgreSQL 18 on OpenBSD

WeekReview#202637

Coding

System

Network

Database

Storage

Security

Security/Cryptography

Security/OSINT

Erlang Preprocessor (`epp`)

A Quick Note About `epp_dodger` Module

Using `asdf` or `mise`