DEV Community: Mathieu Kerjouan

WeekReview#202638

Mathieu Kerjouan — Mon, 21 Sep 2026 10:00:00 +0000

Linkedin is a mess. While I started to write articles on dev.to, I also started to create scheduled posts on Linkedin. It was working correctly until few days ago, when the "scheduler manager" just disappears. After 2 long hours to search where I could find a similar feature, I just stopped and started to use the "newsletter" feature from them. That's crazy to see how we are dependent of those services, and how they are treating us.

My feeds were quiet this week. Not a lot of interesting link to show.

Reflexion about Dart code design. What is the best way to design a module in Dart? It can be designed in many different ways, for example, the class can embed the methods to publish a post for example or delete it. In this case, the object must be instantiated first and then the methods can be called.

class Publication {
  int id;

  Publication({required this.id});

  Publication publish() => this;
  Publication delete() => this;
}

void main() {
  var pub = Publication(id: 1);
  pub.publish();
}

What about using a more functional way of doing that, by using the classes/objects as data-structures and passing them directly to functions outside of the class definition?

class Publication {
  int int;
  Publication({ required this.id });
}

Publication publish(Publication pub) => pub;
Publication delete(Publication pub) => pub;

void main() {
  var pub = Publication(id: 1);
  publish(pub);
}

Which method is the best? Well, I'm currently thinking to use the second one. The reason is simple, isolating side effect from the object itself, and function composition. Then, the object created can only be used with accessors, with some part of it in read-only or totally hidden. Anyway, I think it's mostly about coding style.

After few days of testing, using a mix of the two methods can be the best way. Another important part is how to name the module and how to organize the exported functions. Erlang, I miss you.

Back in May 2026, I tweeted about the next threat that will come with OpenClaws and other LLMs used to remote control platforms. ~4 months later, Mistral has been hacked and it seems this is a serious issue. Unreleased code, entire code base and so on can now be found on tor. This is only the beginning, the next step is to infiltrate all layers, inject code and take control of the code produced by LLMs. Remember Linus Torvald saying "LLMs are just kind of compilers" few months ago? Well, if you can't trust your compiler, you can't trust what it produces, see "Reflections on Trusting Trust" by Ken Thompson. What the next step after that? Control the servers where those LLMs are executing tasks, and it's only a matter of time. Good luck to all developers and admins who installed this crap on their servers, including laptops, test and dev machines. Oh, and by the way, Mistral has been integrated in Firefox recently, have fun and sleep well!

Coding

📝 Dart Google Summer of Code 2026 results: a report for the Dart Google Summer of code. package:ffigen looks promising and will help to create interface from c++ to dart. The other interesting project was debugging improvements for pointers.

📝 libsodium/Finite field arithmetic: white searching a good cryptographic library for Dart (yeah, the ones available don't fit my needs), I read the libsodium documentation, especially the part on valid points.

📝 Pear Docs: yet another p2p system. This time, it has been mostly done in javascript, by Holepunch. Some note on the protocol can be also found on github from libudx.

📝 The "Clockwise/Spiral Rule": did not know this method to mentally parse C.

🌐 cdecl: an online tool to decipher C language notation, also available as CLI.

📝 OpenBSD vmm/vmd SMP support: nice! We will be able to set the number of CPUs for a VM on OpenBSD, thanks to Bryan Steele for the news.

System

📝 Void Linux Maintainer Orphans 100+ Packages Over AI Policy Dispute: the reason why I like Void Linux.

🏗️ turbocrypt: A fast, easy-to-use, and secure command-line tool for encrypting and decrypting files , git repositories and directory trees.

📝 Crash-Safe & Copy-On-Write GEFS As The "Good Enough File-System" For OpenBSD: more than 10 years ago, HAMMER2 from DragonFlyBSD was planned to be ported to OpenBSD, but it never happened. This filesystem could be a good candidate to replace that. The specifications are looking good. The snapshot feature is really what is missing on many filesystems, including UFS.

Database

🏗️ pgassistant project: A PostgreSQL assistant for developers Understand, optimize, and improve your PostgreSQL database with ease.

Network

📝 Overview of Passive Optical Networks (PONs) Security: a deep introduction to optical network security, a lot of information there.

Mathematics

📝 Finite time blowup with smooth forcing term for the incompressible porous medium, Boussinesq, and incompressible Euler equations

Embedded

📝 The Great Pi Zero Showdown: if you want to see benchmarks comparing different kind of Pi Zero implementation.

Security

📝 The Hitchhiker's Guide to Online Anonymity (and Privacy)

📝 From APK to Source: Complete Android Reverse Engineering Workflow: a succinct post containing the essential procedure to reverse engineer an android package (apk).

📝 Android APK Reverse Engineering: From APK to Source: another post listing the essential procedures to reverse an android package.

🌐 Quarklabs' blog: lot of interesting articles about modern security (and programming).

📝 Devil’s advocate? Uncensored Luciferus AI service advertised underground: underground actors are selling uncensored LLMs. Good to know.

📝 The XSS inside your favorite iOS app: XSS can also be found in mobile application via WebView for Android and MKWebView for iOS. Good to know because one of my project is using WebView, hardening this part could be a good idea.

📝 HEIF Heist, One image parser to pwn them all: the story behind libheif library vulnerability exploitation. Announced by Harsh Jaiswal (@rootxharsh) on X/Twitter.

📝 Browser Forensics: Analyzing Suspicious Extensions with ExtAnalysis

Security/cryptography

📝 It's 255:19AM. Do you know what your validation criteria are?: when I was looking for an up to date list of invalid or low-order public keys, I found this post. It seems most of the ed25519 on the market are not compatible with the RFC8032 (Edwards-Curve Digital Signature Algorithm (EdDSA)), mostly due to design issue and also because the RFC came after all implementations. That's actually a huge portability problem and a security issue as well.

Security/RedTeam

📝 Advanced Techniques for Bypassing Modern Web Application Firewalls: a very long list of attacks for bypassing WAF.

📝 JSON Interoperability Vulnerabilities: A Deep Dive: we tend to think JSON is secure because of its simplicity, portability and its presence everywhere. This article list different kind of vulnerabilities that can be found on JSON serializers. interesting.

Guesttohost:escapingDocker'shypervisor: docker hypervisor escape on MacOS, due to virtio-fs. ingenious way to get out of a container.

Update/Upgrade

🔄 Phoenix 1.8.14: bug fixes

🔄 RabbitMQ 4.3.6: bug fixes and enhancements.

🔄 Erlang/OTP 29.1: many bug fixes and security issues. No new features.

🔄 OpenSMTPD 7.9.0p0 released: bugs fixes and hardening.

Embedded

📝 Biodegradable PCBs – The Future of Sustainable Electronics: good to know, we can now create biodegradable PCBs. Not sure if it's a good thing for the environment (e.g. heavy metals, polymers), but it's a first step.

Misc

🌐 BOB Conf

📝 On-device intelligence for every product

🏛️ Tools for Thought

📑 Theory Is All You Need: AI, Human Cognition, and Causal Reasoning: Here a part of the abstract.

Scholars argue that artificial intelligence (AI) can generate genuine novelty and new knowledge and, in turn, that AI and computational models of cognition will replace human decision making under uncertainty. We disagree. We argue that AI’s data-based prediction is different from human theory-based causal logic and reasoning. We highlight problems with the decades-old analogy between computers and minds as input–output devices, using large language models as an example. Human cognition is better conceptualized as a form of theory-based causal reasoning rather than AI’s emphasis on information processing and data-based prediction.

📝 Iran strikes on Amazon data centers caused permanent loss of customer data: the cloud during war becomes foggy.

📝 Intel Appears To End Its Bug Bounty Program: if it's the case, why? It could be due to the amount of false-positive bugs found with LLMs, it can have a really huge impact on developers team. Curious to know more about the reason.

Cover Image by Sunira Moses on Unsplash

Q&D: Flutter App and Android-SDK

Mathieu Kerjouan — Thu, 17 Sep 2026 08:00:00 +0000

After having upgraded few tools on machine, one of my application was totally unable to run. I got a lot of warnings, especially this one:

Warning: Flutter support for your project's Gradle version (8.14.0) will soon be dropped. Please upgrade your Gradle version to a version of at least 9.1.0 soon.                             
Alternatively, use the flag "--android-skip-build-dependency-validation" to bypass this check

and finally...

FAILURE: Build failed with an exception.                                                                                                                                                      

* What went wrong:                                                                                                                                                                            
Execution failed for task ':app:compileFlutterBuildDebug'.                                                                                                                                    
> A problem occurred starting process 'command '/home/user/.local/share/mise/http-tarballs/dd5ae32abcea719e3c351c56a28308b91e2ce97fb5702bf2710c2527dde522af_strip_1/bin/flutter''             

* Try:                                                                                                                                                                                        
> Run with --stacktrace option to get the stack trace.
> Run with --info or --debug option to get more log output.
> Run with --scan to get full insights.
> Get more help at https://help.gradle.org.

BUILD FAILED in 1s
Running Gradle task 'assembleDebug'...                           1,270ms
Error: Gradle build failed due to Java/Gradle incompatibility.
The Java version used for the build is 25.0.3, which is incompatible with Gradle 8.14.
To fix this, you can either:
  1. Upgrade your project's Gradle version (typically in gradle-wrapper.properties to a version matching the range: compatible Gradle versions for Java 25.0.3 are 9.1.0 or newer).
  2. Use a different Java version for Flutter by running `flutter config --jdk-dir=<path>`.

Annoying right? In fact, many other warnings were displayed, but what happened there? The last time, it was working without problem. Let have a look on the android sdk

Android SDK Upgrade

The "old" latest version of the android-sdk called Panda 4 was used, instead of the new latest version called Quail 4.

$ cd Downloads

$ wget https://edgedl.me.gvt1.com/android/studio/ide-zips/2026.1.4.7/android-studio-quail4-linux.tar.gz

$ tar zxf android-studio-quail4-linux.tar.gz

$ cd android-studio

$ ls bin
appletviewer.policy  game-tools.sh    lldb         studio              studio.svg
brokenPlugins.db     helpers          ltedit.sh    studio64.vmoptions
format.sh            idea.properties  profiler.sh  studio.png
fsnotifier           inspect.sh       restarter    studio.sh

Android SDK Platforms and Tools Upgrade

The latest android-studio version is now installed, but the SDK Platforms and the SDK Tools needs to be upgraded as well. It can be done via android studio directly in Menu > Tools > SDK Managers. The versions to upgrade to should be displayed with the installed one as well. If needed, install some latest versions or missing tools.

$ ./bin/studio

The upgraded versions should have been extracted in the ${HOME}/Android directory. It can also be done using the sdkmanager tool.

$ sdkmanager --update

Flutter and Dart upgrade

My development machine is using mise to have the latest version of flutter and dart. The version of these applications are usually stored in the .tool-versions. It can be upgraded using the upgrade subcommand.

$ cd ~/project

$ cat .tool-versions
flutter latest
dart latest

$ mise upgrade
...

Environment Variables

My environment was a mess, because many tools were living together and usually, because you want to do something quick, you put everything in your ~/.bashrc. Here the new conf.

# recreates a full clean path from scratch
export PATH=/bin:/usr/bin:/usr/local/bin
export PATH=/sbin:/usr/sbin:/usr/local/sbin:$PATH
export PATH=${HOME}/bin:$PATH

# enable mise
eval "$(~/mise/bin/mise activate bash)"

# set android configuration
export ANDROID_HOME=${HOME}/Android/Sdk
export PATH=$ANDROID_HOME/tools:$PATH
export PATH=$ANDROID_HOME/tools/bin:$PATH
export PATH=$ANDROID_HOME/platform-tools:$PATH
export PATH=$ANDROID_HOME/cmake/4.1.2/bin:$PATH
export PATH=$ANDROID_HOME/cmdline-tools/latest/bin:$PATH

export CHROME_EXECUTABLE=$(which chromium)
export EDITOR=vim

Flutter and Gradle

Gradle was crying because of an old version unsupported to some new versions installed. To be honest, my android application version is still quite simple, so, I fixed the issue by recreating the android directory from the flutter project root.

$ cd ~/project

$ mv android android.old

$ flutter create . --platforms=android
Recreating project .... 
...
Resolving dependencies...                                                                                                                                                                     
Downloading packages...                                                                                                                                                                       
Got dependencies.                                                                                                                                                                             
Wrote 26 files.                                                                                                                                                                               

All done!                                                                                                                                                                                     
You can find general documentation for Flutter at: https://docs.flutter.dev/                                                                                                                  
Detailed API documentation is available at: https://api.flutter.dev/                                                                                                                          
If you prefer video documentation, consider: https://www.youtube.com/c/flutterdev                                                                                                             

In order to run your application, type:                                                                                                                                                       

  $ flutter run                                                                                                                                                                               

Your application code is in ./lib/main.dart.

The application can now be restarted again.

$ flutter run

Here the flutter command reference.

Another Gradle issue

WARNING: A restricted method in java.lang.System has been called                                                                                                                              
WARNING: java.lang.System::load has been called by net.rubygrapefruit.platform.internal.NativeLibraryLoader in an unnamed module (file:/home/user/.gradle/wrapper/dists/gradle-9.3.1-all/9ot9r
568e8zfvvd4mn8rbu1j0/gradle-9.3.1/lib/native-platform-0.22-milestone-29.jar)                                                                                                                  
WARNING: Use --enable-native-access=ALL-UNNAMED to avoid a warning for callers in this module                                                                                                 
WARNING: Restricted methods will be blocked in a future release unless native access is enabled

This one is a bit tricky. On the latest android-studio version, the bundled version of JDK is 25+. Let check that with flutter doctor.

$ flutter doctor --verbose
...
[✓] Android toolchain - develop for Android devices (Android SDK version 37.0.0) [248ms]                                                                                                      
    • Android SDK at /home/user/Android/Sdk                                                                                                                                                   
    • Emulator version 37.1.11.0 (build_id 15917651) (CL:N/A)                                                                                                                                 
    • Platform android-37.2, build-tools 37.0.0                                                                                                                                               
    • ANDROID_HOME = /home/user/Android/Sdk                                                                                                                                                   
    • Java binary at: /home/user/Downloads/android-studio/jbr/bin/java                                                                                                                        
      This is the JDK bundled with the latest Android Studio installation on this machine.                                                                                                    
      To manually set the JDK path, use: `flutter config --jdk-dir="path/to/jdk"`.                                                                                                            
    • Java version OpenJDK Runtime Environment (build 25.0.3+-15898627-b508.16)                                                                                                               
    • All Android licenses accepted.
...

Indeed, it looks like it uses OpenJDK25+... Just to confirm, let execute java directly.

$ ~/Downloads/android-studio/jbr/bin/java -version
openjdk version "25.0.3" 2026-04-21
OpenJDK Runtime Environment (build 25.0.3+-15898627-b508.16)
OpenJDK 64-Bit Server VM (build 25.0.3+-15898627-b508.16, mixed mode)

It seems this version is not supported correctly with flutter applications, requiring JDK 21. To remove temporarily this warning message, instead of adding a flag, one can install an old version of the JDK from the system package manage for example.

$ sudo apt-get install openjdk-21-{jre,jdk}

Then, the project can be configured to use this one instead of the latest version available from the android studio.

$ flutter config --jdk-dir=/usr/lib/jvm/java-21-openjdk-amd64

$ flutter doctor --verbose
...
[✓] Android toolchain - develop for Android devices (Android SDK version 37.0.0) [235ms]                                                                                                      
    • Android SDK at /home/user/Android/Sdk                                                                                                                                                   
    • Emulator version 37.1.11.0 (build_id 15917651) (CL:N/A)                                                                                                                                 
    • Platform android-37.2, build-tools 37.0.0                                                
    • ANDROID_HOME = /home/user/Android/Sdk                                                    
    • Java binary at: /usr/lib/jvm/java-21-openjdk-amd64/bin/java                                                                                                                             
      This JDK is specified in your Flutter configuration.                                                                                                                                    
      To change the current JDK, run: `flutter config --jdk-dir="path/to/jdk"`.                                                                                                               
    • Java version OpenJDK Runtime Environment (build 21.0.12.1+1-1-deb13u1-Debian)                                                                                                           
    • All Android licenses accepted.
...

Thanks to this post from startdebugging.net, it helped me a lot to debug this issue.

Storage Issue

Failure [INSTALL_FAILED_INSUFFICIENT_STORAGE: Failed to override installation
location]
Error launching application on sdk gphone64 x86 64.

It simply means the virtual machine used for android (the device used by flutter) is full and there is no enough free space available to install the application. This one is kinda easy to fix, in android-studio go to Menu > Tools > Devices Manager, select the device to edit. In the Additional settings tabs, below the Storage section, one can expand both the internal or global storage. Note: It will reset the data on the device.

Conclusion

Modern programming is a huge pile of shit. Every time you do a small update/upgrade on one module or package, or on the core language to have the latest security patches, it breaks. That's annoying and explain why most of the applications are not safe. Developers don't really care about security, they wants to deliver quick. To do that, they will bypass all safety. Sadly, nothing changed during the last 10 or 20 years to build a mobile app easily. I've lost half a day to figure out what was the root cause... The good side? It's another confirmation about the whole ecosystem, it's a miracle everything is working correctly.

As usual, hack it and try to have some fun!

Cover Image by Ticka Kao on Unsplash

Q&D: PostgreSQL 18 on OpenBSD

Mathieu Kerjouan — Tue, 15 Sep 2026 10:00:00 +0000

If you need the latest version of PostgreSQL on OpenBSD, the limits for the semaphores must be increased. Indeed, let imagine you want to deploy a fresh postgresql database (assuming the /var/postgresql/data directory was not created or purged).

$ doas pkg_add postgresql-server
...

$ cd /var/postgresql

$ doas -u _postgresql initdb -D data
The files belonging to this database system will be owned by user "_postgresql".                                                                              
This user must also own the server process.          

The database cluster will be initialized with locale "C".                     
The default database encoding has accordingly been set to "SQL_ASCII".         
The default text search configuration will be set to "english".               

Data page checksums are enabled.

fixing permissions on existing directory data ... ok
creating subdirectories ... ok                                                
selecting dynamic shared memory implementation ... posix
selecting default "max_connections" ... 20                           
selecting default "shared_buffers" ... 400kB                                  
selecting default time zone ... UTC
creating configuration files ... ok
running bootstrap script ... 2026-09-14 17:44:41.502 UTC [93045] FATAL:  could not create semaphores: No space left on device                                 
2026-09-14 17:44:41.502 UTC [93045] DETAIL:  Failed system call was semget(3810418, 17, 03600).                                                               
2026-09-14 17:44:41.502 UTC [93045] HINT:  This error does *not* mean that you have run out of disk space.  It occurs when either the system limit for the maximum number of semaphore sets (SEMMNI), or the system wide maximum number of semaphores (SEMMNS), would be exceeded.  You need to raise the respective kernel 
parameter.  Alternatively, reduce PostgreSQL's consumption of semaphores by reducing its "max_connections" parameter.                                         
        The PostgreSQL documentation contains more information about configuring your system for PostgreSQL.                                                  
child process exited with exit code 1                                          
initdb: removing contents of data directory "data"

An error! To fix it, kern.seminfo.semmni and kern.seminfo.semmns need to be modified.

$ doas sysctl kern.seminfo.semmni=256
kern.seminfo.semmni: 10 -> 256

$ doas sysctl kern.seminfo.semmns=2048
kern.seminfo.semmns: 60 -> 2048

Now, the database can be initialized without issue.

$ doas -u _postgresql initdb -D data                    
The files belonging to this database system will be owned by user "_postgresql".                                                                             
This user must also own the server process.                                   

The database cluster will be initialized with locale "C".                     
The default database encoding has accordingly been set to "SQL_ASCII".        
The default text search configuration will be set to "english".               

Data page checksums are enabled.       

fixing permissions on existing directory data ... ok                          
creating subdirectories ... ok         
selecting dynamic shared memory implementation ... posix                      
selecting default "max_connections" ... 100                                   
selecting default "shared_buffers" ... 128MB                                  
selecting default time zone ... UTC    
creating configuration files ... ok    
running bootstrap script ... ok        
performing post-bootstrap initialization ... ok                               
syncing data to disk ... ok            

initdb: warning: enabling "trust" authentication for local connections        
initdb: hint: You can change this by editing pg_hba.conf or using the option -A, or --auth-local and --auth-host, the next time you run initdb.              

Success. You can now start the database server using:                         

    pg_ctl -D data -l logfile start

$ doas rcctl start postgresql
postgresql(ok)

It looks way better! The new configuration can now be added into /etc/sysctl.conf

$ echo "kern.seminfo.semmni=256" | doas tee -a /etc/sysctl.conf

$ echo "sysctl kern.seminfo.semmns=2048" | doas tee -a /etc/sysctl.conf

The server should reboot with the good configuration now. You can configure your postgresql server now.

$ doas -u _postgresql psql postgres
psql (18.6)
Type "help" for help.

postgres=#

Happy hacking and have fun!

Cover Image by Dan Seddon on Unsplash

WeekReview#202637

Mathieu Kerjouan — Mon, 14 Sep 2026 08:00:00 +0000

Paying for "cheap" virtual machines running my CI/CD pipelines is no fun. You will have the result quick, but you will not learn how to deploy this kind of infrastructure. As sysadmin, it's always nice to see how the tools used few years ago evolved... So, this week was about creating my own local privacy-first building infrastructure for Gitlab CI/CD. Based on the increasing cost of hosting providers due to the "AI revolution", hosting its own infrastructure can have a lot of benefit (and few drawbacks). What's the idea?

To avoid information leaks like my own public address, the network will route all outgoing connections to a VPN or/and via a proxy. Each servers will be installed with an hardened version of Alpine Linux, and will have gitlab-runner enabled by default with a container manager (e.g. podman). Those servers are old laptops or cheap bare-metal devices (e.g. Intel NUCs, ARM boards). This infrastructure will also offer local isolated cache servers and a way to store artefacts.

It was not really planned, but it's a nice idea to do that. In fact, I would like to also test this kind of infrastructure with k3s to see if a kubernetes cluster can run in its own world, without a direct access to internet. Spoiler alert: it is already deployed on two workers, behind an OpenBSD firewall. It's a matter of time before a series of articles will be published here about that.

This week was kinda busy, working on my application in Dart/Flutter, and most of the links are without comments because they have been barely read... Even more, dev.to is going to make me crazy. When a post is removed from a series, it is not displayed on user's profile. I created an issue hoping it will be fixed, but I was so angry about that, I started to work on my own post manager called publish using only pandoc, Makefiles and shell scripting. I don't understand how a website like dev.to can be a "reference" for developers. Anyway, as usual, nothing is better than what you can do by yourself. A word on publish project?

must be highly portable and run everywhere
must be use simple markdown files
must publish content in more than one format (e.g. html, pdf, epub, djvu...)
must be easy to clone/export
must be easy to backup
must be easy to migrate
must be flexible enough to deal with callbacks in any languages
must generate good old files and directories
must save its state as local files/directories as well
all my publications will be firstly created there and then published on substack, medium and dev.to (and in other places as well if possible).

I'm really tired of migrating my content every 2 or 3 years, but I know think the best way is to keep everything open, and stay with your data locally.

Coding

🏗️ snmpkit: A comprehensive SNMP toolkit for Elixir featuring a unified API, pure Elixir implementation, and powerful device simulation.

📝 Register Allocation in the LLVM Backend: an article on LLVM compiler optimization for registers allocation. In short, this is the algorithms used when the -O flag is set. It's interesting to see register allocation is not a simple thing. This article focus on CPU though, GPU register allocation is a bit different.

🏗️ listen project: A package to notify state changes to interested listeners in pure Dart.

📝 Recreating Voodoo Graphics and a Late-1990s Gaming PC on an FPGA: another article about the z486 CPU, this time about recreating a graphic card using an FPGA.

🏗️ gitlab-ci-local project: Run gitlab pipelines locally as shell executor or docker executor.

🏗️ ecto_middleware: Implements the middleware pattern for your Ecto repos, a Plug-like concept for Ecto.

📝 Implementation of GCC's Nested Functions (vs. C++ Lambdas)

📑 C*: Unifying Programming and Verification in C

🐦 A quick overview of atomics in C

📑 Stackful Coroutine Made Fast: from PhotonLibOS

📝 Optimizing a Spin-Lock

📝 Implementing a Phoenix PubSub Adapter with EventStore: a quick and short introduction to Phoenix PubSub.

📝 Decompilation Book: A good introduction to decompilation (and reverse engineering).

System

📝 Asahi Linux Now Officially Supports Apple M3 Macs - With Caveats: Linux on Apple M3 CPU will be great. Looking forward to have the same support on BSDs.

📝 RabbitMQ vs. Apache Kafka: it reminds me years ago when some of my colleagues were talking about comparing RabbitMQ and Kafka. This article is an up-to-date version of this discussion, with a nice conclusion: RabbitMQ is the better default. In general, both systems are now doing the same, with mostly the same performance. Anyway, a good summary every one working with queueing systems should read. A study is also available.

📝 SystemIO conflicts are not firmware bugs

🏗️ grafito project: a simple, self-contained web-based log viewer for journalctl. It provides an intuitive interface to browse and filter system logs directly from your web browser.

🏗️ Vinix OS: Vinix initially is going to support every Apple Silicon Mac (only M1 Macs for now as of Sep 10 2026).

📝 Retrospectively Reverse-Engineering Apple's Neural Engine

📝 Interview with Ken Thompson, 9-6-89

Network

📑 De-Anonymization Techniques in the Tor Network Using an Experimental Testbed: A really interesting publications doing a huge work on de-anonymizing tor network users using open-source tools, in an experimental network. In the end, nothing really new. It's well known if the user is not careful during browsing or when downloading something, it can lead to information leaks. Whonix mostly fix this issue, even more when it is installed in QubeOS. Here the tools they used in this paper:

shadow: Shadow is a discrete-event network simulator that directly executes real application code, enabling you to simulate distributed systems with thousands of network-connected processes in realistic and scalable private network experiments using your laptop, desktop, or server running Linux;
chutney: Tool for testing Tor network
ExperimenTor: A Testbed for Safe and Realistic Tor Experimentation

Database

🏗️ PostgreSQL Anonymizer: The main goal of this extension is to offer anonymization by design. We firmly believe that data masking rules should be written by the people who develop the application because they have the best knowledge of how the data model works. Therefore masking rules must be implemented directly inside the database schema. From PostgreSQL News.

🏗️ pg_vault_tde project: encrypts every tuple with AES-256-GCM at the Table Access Method layer. Data is encrypted before it reaches the storage manager and decrypted after it leaves. Encryption keys are managed by HashiCorp Vault / OpenBao or a local PKCS#12 wallet and cached in shared memory with automatic rotation. Seen from postgresql news.

Storage

🏗️ Garage project: S3-compatible object store for small self-hosted geo-distributed deployments.

Security

📝 Activating Chrome DevTools Protocol in Memory: Bypassing –remote-debugging-port Restrictions: shellcode injection on windows using Chrome Developer Tool.

📝 I accidentally logged hundreds of thousands of phone calls to military bases: a good story about hijacking e164.arpa domains, a project created in the 2000's to associate phone number with DNS.

📝 WeWorm, The first zero-click worm to spread through WeChat calls across iOS and Android.

▶️ Deanonymizing Monero Transactions in Tor Network: an introduction to deanonymizing monero transactions, but it has been fixed in the latest versions (quick). btw, I liked the fake VPN ads but I also liked the truth behind the private VPN companies giving logs to goverments.

▶️ The Tor Project Just Gaslit Their Entire User Base: another project lying to their users. Tor browser does not protect against OS fingerprint, that's a shame, but the worst part is... they are saying the opposite in their communication. Don't trust anyone, again.

📝 From P-Code to GNN: extract binary code semantics

📝 Bluetooth Low Energy Security Testing, Consolidated: Introducing Caeruleus

Security/Cryptography

📝 Engineer Factors RSA-260, Ending a 35-Year Cryptographic Challenge: lot of noise here, but RSA-260 (260 bits RSA keys) have been broken. At least... One of them.

📑 Computing 256-bit elliptic curve discrete logarithms in 26 days on a fault-tolerant trapped-ion quantum computer with 20,000 qubits

Security/OSINT

🏗️ Instagram OSINT Relationship Analysis project: Analyze the followers and following accounts that a private (hidden) Instagram account interacts with.

Security/BlueTeam

📝 MikroTik ssh 0day exploitation in the wild: a short story about a 0 day exploited on Mikrotik routers via SSH.

Security/RedTeam

📝 PowerShell for Hackers: Exploitation Essentials: not a big fan of powershell, but it's a good introduction for penetration testing.

🏗️ XSS Labs project: Hands-on XSS labs for learning, practicing, and understanding Cross-Site Scripting vulnerabilities.

Embedded

📝 Scheme-it: Schematic Drawing, Flow and Block Diagramming Made Easy: a quick introduction to scheme-it to create and design electronic schema. Those schema can then be imported in KiCAD.

📝 Deep Dive Into PCB Manufacturing Techniques: Milling: a short post on PCB milling.

📝 ESP32 Audio Project - Part I: Internet Radio with I²S DAC

📝 Chameleon Ultra: Guide to RFID Reading, Emulation and Testing

🏗️ A standalone, real-time 2x2 MIMO software-defined radio (SDR) platform for advanced wireless research and rapid prototyping: a standalone, real-time 2x2 MIMO software-defined radio (SDR) platform for advanced wireless research and rapid prototyping. With FPGA-accelerated wireless processing, ultra-low phase noise design, and a proven real-time PHY baseline.

Update/Upgrade

🔄 NetBSD 9.5: NetBSD 9.5, the fifth (and final) release from the NetBSD 9 stable branch, end-of-support for all NetBSD-9.x. The full announcement can be found on the release page.

🔄 Cowboy 2.19, Cowlib 2.20, Gun 2.6, Ranch 2.3: this is an important release for all the cowboy-suite libraries. Cowboy is now only support OTP-27+ and will drop support for all versions of Erlang without security patches. The release on Github: cowlib-2.20.0, ranch-2.3.0, cowboy-2.19.0 and gun-2.6.0.

🔄 Nova 0.17.0: optimization update.

🔄 Nova 0.18.0: another update.

🔄 OpenBSD 7.9 syspatch security upgrade: a lot of patches, impacting opensmtpd, nfs, wscons, shmat, libexpat, X and ldapd.

Providers

🌐 Bullionet: cheap bare-metal server in France (Paris, Marseilles, Lille). Announced on X/Twitter.

🌐 netcup: low cost virtual servers, and interesting deals.

🌐 contabo: low cost virtual servers, pretty expensive bare metal ones though.

🌐 speedypage: in pound (uk), quite expensive bare metal servers, but the price for virtual servers looks great.

🌐 euronodes: virtual machines are cheap (<5€), bare-metal servers are expensive. Data centers in Europe (germany, portugal, spain and czech republic).

🌐 macserve: is it a joke?

🌐 BoxedTux: Deploy a full Linux virtual server in under 90 seconds. Root access, public IP, your choice of distro — no credit card, no vendor lock-in.

🌐 BoxyBSD: BoxyBSD offers free VPS instances for exploring FreeBSD, OpenBSD, NetBSD and many other BSD or Solaris based systems. Get hands-on experience, experiment safely, and join a growing community of BSD enthusiasts.

Misc

🌐 Mini ITX Shop: A good place to find small-sized computers/boards.

🌐 Mhz Shop: A good place to find wireless hardware and devices.

📝 Under-The-Radar Oklahoma Bitcoin Mining Site Condemned After Leaking 3 Million Gallons Of Water

🏗️ BraveDebloater project: Safety-first Windows PowerShell debloater for Brave Browser using enterprise policies, dry-run mode, backups, and restore.

📝 Build Your Own Private Cellular Network: kinda expensive ($999) but looks interesting.

🏗️ Nobora Project: A Fedora-based desktop, tuned for gaming, streaming, and content creation — so you can skip the tweaking and start doing.

📟 Sipeed NanoKVM-Go: an updated version of the NanoKVM, perfect for remote control and debugging a system remotely.

🐦 go fuck yourself @sama: a reaction regarding the last "discovery" made by anthropic in the mathematical field. Below the most interesting part to me. Your data, your ideas, or your researches are not safely protected by those companies.

to this theoretical imposture you add a disgusting ethical and industrial cynicism taking advantage of private codex sessions and informal preprints from academic researchers to siphon their research leads and then trying to redact or erase the contribution of levent alpöge under the pretext that he works at rival anthropic is intellectual serfdom openai behaves like a feudal lord of silicon appropriating the cognitive subsistence of independent scholars threatening their careers behind closed doors if they protest and turning community academic labor into a privatized pressrelease [...] real science is not a clout chase on social media or a compute spike spent to rob the clay mathematics institute it is a quest for elegance physical truth and universal rigor to decode reality [...] the most dangerous aspect of this maneuver is not the mathematical exaggeration but the corporate enclosure of scientific discovery by keeping these frontier systems locked behind outcome based pricing licensing barriers & proprietary API walls [...] when mathematical reality itself gets reduced to synthetic token production swallowed by closed infrastructure we transition from open academic inquiry to technological feudalism

🌐 Black Hat World Forum: discovering this forum recently, about SEO.

Cover Image by Artem Kniaz on Unsplash

Q&D: Dart on Alpine Linux

Mathieu Kerjouan — Thu, 10 Sep 2026 10:00:00 +0000

Running Dart outside of the main distribution can be challenging. In fact, my first idea was to compile it from sources, but it seems most of the projects are simply using the binaries from Google instead of building the sources directly from the official Dart repository. That's a shame from an "open-source" language but anyway... Here some methods to use Dart on Alpine Linux.

Using a Container

The Dart Team offers a Docker image with the latest version of Dart from the Google Dart binaries. This is probably the easiest way to use Dart on Alpine Linux without adding a lot of useless dependencies in your system.

# podman run -it dart sh

See also:

Using `asdf` or `mise`

asdf and mise can be used to bootstrap your systems. As usual, the Dart binaries are from Google.

# asdf plugin add dart

See also:

Using Google Binaries

Then, why not downloading ourselves the binaries from Google and installing it on Alpine Linux directly. It will require "only" gcompat.

# apk update

# apk add curl gcompat

# curl -Lo dartsdk-linux-x64-release.zip https://storage.googleapis.com/dart-archive/channels/stable/release/3.13.3/sdk/dartsdk-linux-x64-release.zip

# unzip dartsdk-linux-x64-release.zip

# cd dart-sdk

# ./bin/dart --version
Dart SDK version: 3.13.3 (stable) (Tue Sep 1 01:07:17 2026 -0700) on "linux_x64"

# export PATH=${PATH}:$(pwd)/bin

# dart create t && cd t

# dart run
Building package executable... 
Built t:t.
Hello world: 42!

The binaries are running on Alpine Linux, but we should be careful, they have been made on Debian-like system (trixie). For example, ldd is not really happy due to __cxa_thread_atexit_impl missing symbol.

# ldd dart
        /lib64/ld-linux-x86-64.so.2 (0x7925aad9e000)
        libdl.so.2 => /lib64/ld-linux-x86-64.so.2 (0x7925aad9e000)
        libpthread.so.0 => /lib64/ld-linux-x86-64.so.2 (0x7925aad9e000)
        libm.so.6 => /lib64/ld-linux-x86-64.so.2 (0x7925aad9e000)
        libc.so.6 => /lib64/ld-linux-x86-64.so.2 (0x7925aad9e000)
        ld-linux-x86-64.so.2 => /lib/ld-linux-x86-64.so.2 (0x7925aa81f000)
Error relocating dartaotruntime: __cxa_thread_atexit_impl: symbol not found

See also:

Dart SDK archive Stable channel

Compiling From Sources

What a mess. I thought it would have been easy to compile Dart from sources, but it's not the case, especially on Alpine Linux. I started to work on it, but it's not ready yet, mostly due to the google tools required for the compilation, producing a shit-ton of errors. Anyway, here a quick list of the dependencies

# apk update

# apk add git python3 curl xz gn clang make py3-virtualenv py3-setuptools py3-pip bash

See also:

Building dart sdk on Github issues

Conclusion

I need a recent version of Dart, Flutter and Android SDK in a container. Unfortunately, the only ones have found are old, unmaintained or unofficial (it means trusting people I don't know).

Docker image for Android SDK: a docker image with the latest android sdk ONLY (no dart, no flutter);
AndroidSDK: another docker image containing the latest android SDK;
Kosmos: another docker image with android SDK;
docker-android-sdk: again, another docker image with android SDK;
Docker Android Build Box: docker image containing android SDK, JDK, and Flutter. This is the closed ones, but it is huge (5.5GB). I would like to avoid fetching the whole universe;
image.flutter: a docker image containing flutter and the android sdk. Perhaps the good catch, but it uses an old version of flutter, and not even sure it works correctly (I like the localhost/android-sdk source image). To be tested.

Anyway, building and releasing mobile application is a PITA. I understand why so many companies are selling a full build effortless pipeline, that's business.

As usual, have fun and happy hacking!

Cover Image by Camila Mofsovich on Unsplash

Alpine Linux Post-Install Checklist

Mathieu Kerjouan — Wed, 09 Sep 2026 10:00:00 +0000

Alpine Linux is one of my favorite distribution with Void Linux. Both are minimalist and perfect for server usage or embedded projects. Here a quick checklist when configuring/staging/deploying manually a box on Alpine Linux.

The full installation procedure is available on the Alpine Linux Wiki. Many tutorials and guides can also be found there.

General Configuration

Main User Password. When installing Alpine Linux, it's usually in front of a screen, with a keyboard, or in front of a virtual machine. We all know a default password is always configured, and it is most of the time an easy one. Change it with a stronger one when you can have access to the shell via SSH using the passwd command or use an hash with ansible.

# passwd ${user}

See also:

Setting up a new user from the Alpine Linux Wiki;
Users and groups on the ArchLinux Wiki;
User Adminitration on the Gentoo Wiki.

Root Password. Same than previous point, when Alpine Linux is installed, the root password is usually an easy one. Change it with a strong one. The password can be removed later if the root account is disabled in the future.

# passwd root

See also:

Main User SSH Public Key. If you are using an RSA key with SSH, it can be hard to copy/paste it directly from the screen during the installation. If you are lucky, you can have access to a remote repository via the network, but if it's not the case, you will need to install one later.

$ mkdir ${HOME}/.ssh
$ chmod 700 ${HOME}/.ssh

$ touch ${HOME}/.ssh/authorized_keys
$ chmod 600 ${HOME}/.ssh/authorized_keys

$ cat >> ${HOME}/.ssh/authorized_keys << EOF
ssh-ed25519 AAAAC3Nza...
EOF

See also:

Install tmux. tmux is the best terminal multiplexer, and the best alternative to screen.

# apk add tmux

Alpine Community Repository. By default Alpine Linux is using only the main repository. This is already a good place where one can found a lot of package. Some packages are only available on community repository though, and enabling it can be nice. To do that, the file /etc/apk/repositories can be edited. Note: it is also a good idea to enforce https, by default, the Alpine repositories configured are using http.

# cat > /etc/apk/repositories << EOF
https://dl-cdn.alpinelinux.org/alpine/v3.23/main
https://dl-cdn.alpinelinux.org/alpine/v3.23/communit
EOF

See also:

Repositories on the Alpine Linux Wiki;
Alpine Package Keeper on the Alpine Linux Wiki;
Official Alpine Linux Packages Search Page;
Alpine Linux Packages Mirrors.

Install sudo or doas. Using su is okay-ish, but having access to sudo or doas to log the commands passed as superuser is always a good idea. Alpine Linux does not install one of these tools by default.

# apk add doas

See also:

Setting Up a New User, Doas section on the Alpine Linux Wiki;
Setting Up a New User, Sudo section on the Alpine Linux Wiki
Sudo on the Gentoo Wiki;
Sudo on the Arch Linux Wiki;
doas(1) manpage;
sudo(8) manpage;
sudoers(5) manpage.

Configure doas. As OpenBSD user, doas is my default command to execute command as superuser. Like sudo, it must be configured by editing the /etc/doas.conf file or by creating a new file in /etc/doas.d/*.conf. Note: the following configuration is a bit too open, if more than one users have access to a server, better permissions should be defined. For example, users in dev groups should never have access to all commands, but only a small subsets of them.

# cat > /etc/doas.d/21-wheel.conf << EOF
permit persist :wheel
EOF

See also:

SSH Server Hardening. sshd is the daemon/service used to have access to the server remotely. The protocol by itself is already well protected, but the default configuration deployed can be improved. There are so many publications on the internet about making SSH secure, it's perhaps not so important to explain everything, here a quick list of the things to modify though. The configuration file can be found in /etc/ssh/sshd_config or in /etc/ssh/sshd_config.d directory.

disable user access without valid public key
limit the amount of connections in parallel
ensure root user can't connect to the box
disable forwarding
explicitly enforce allowed users

# cat > /etc/ssh/sshd_config.d/99-local.conf << EOF
PasswordAuthentication no
KbdInteractiveAuthentication no
PermitRootLogin no
AllowUsers ${your_user}
PermitEmptyPasswords no
LoginGraceTime 30
MaxAuthTries 3
X11Forwarding no
AllowAgentForwarding no
AllowAgentForwarding no
AllowTcpForwarding no
PermitTunnel no
ClientAliveInterval 100
UseDNS no
Protocol 2
Banner none
PubkeyAuthentication yes
HostbasedAuthentication no
IgnoreRhosts yes
EOF

See also:

sshd(8) man page;
sshd_config(5) man page;
Setting up a SSH server on the Alpine Linux Wiki;
SSH Hardening - Securing Your Linux Servers;
SSH Hardening Guide: Best Practices for Linux Servers.

SSH Client Hardening. The default configuration for the ssh client can be found in /etc/ssh/ssh_config or in the /etc/ssh/ssh_config.d directory. The configuration installed should do the job in 99% of the case, but some things can be improved. Note: except if the server is used as a bastion or a forwarder, it's usually not necessary to modify this configuration.

# cat > /etc/ssh/ssh_config.d/99-local.conf << EOF
VisualHostKey yes
EOF

See also:

Network Interface Configuration. If the server was installed in a VM or in a specific network, it is sometimes necessary to modify the configuration of the network interfaces. This configuration is located in the /etc/network/interfaces file. First, list the available interfaces with the ip address command and configure them respectively.

# cat > /etc/network/interfaces << EOF
auto lo
iface lo inet loopback

auto eth0
        address ${server_ipv4_address}
        network ${ipv4_network}
        broadcast ${ipv4_broadcast}
        gateway ${ipv4_gateway}
EOF

See also:

Configure Networking on the Alpine Linux Wiki;
interfaces(5) manpage.

Local DNS Resolver. DNS is always the issue, or at least, most of the time. On distribution using systemd, the systemd-resolved daemon in charge of the DNS can be sometimes a bit... annoying. In the past, on Ubuntu/Debian, I got many issues because of that, and I now have the habit to simply install dnsmasq or unbound locally and configure /etc/resolv.conf manually. dnsmasq configuration can be found in the /etc/dnsmasq.conf file or in the /etc/dnsmasq.d directory.

# apk add dnsmasq

# cat > /etc/dnsmasq.d/99-local.conf << EOF
listen-address=127.0.0.1
server=${your_dns_server}
no-resolve
EOF

# rc-update add dnsmasq

# service dnsmasq start

# echo "nameserver 127.0.0.1" > /etc/resolv.conf

See also:

dnsmasq on the Alpine Linux Wiki;
Unbound on the Alpine Linux Wiki;
Official DNSmasq Website;
Official Unbound Website.

Linux Cgroups Configuration. When using a Linux distribution, most of the time it's about containers, with Docker or another alternative. Cgroups are disabled by default on Alpine Linux and must be enabled in initrc by editing the /etc/rc.conf file. Note: the hybrid value sets both version of cgroups. The service must also be started if you want to use docker or podman.

# cp /etc/rc.conf /etc/rc.conf.old

# sed -Ei 's/#rc_cgroup_mode="unified"/#rc_cgroup_mode="hybrid"/' /etc/rc.conf 

# cat >> /etc/rc.conf << EOF
rc_cgroup_settings="
memory.max 10485760
pids.max max
"
EOF

# rc-update add cgroups

# service cgroups start

Docker on the Alpine Linux Wiki;
OpenRC Cgroups Section on the Alpine Linux Wiki;
Control Groups;
Control Groups version 1;
Control Group v2;
Enable CGroups V2 in Alpine Linux.

Proxy Configuration. If you are using a proxy (inside a protected network), don't forget to configure it or them. HTTP_PROXY environment variables are supported by most of the applications nowadays.

# cat >> /etc/profile << EOF
# proxy configuration
http_proxy=${my_proxy}
https_proxy=${my_proxy}
HTTP_PROXY=${my_proxy}
HTTPS_PROXY=${my_proxy}

EOF

See also:

PAM Userland Tools. Managing users in Alpine Linux can be challenging at first, because the PAM tools are not installed. They can be installed via the shadow package. It will make everything easier when dealing with users and groups.

# apk add shadow

See also:

NTP Configuration. During the install process, the installer asks which NTP servers should be installed. If in my case, you just press enter to end the process as quick as possible, the default NTP server will be installed. Again, as OpenBSD user, I like openntpd, it's minimalist and do the job well.

# apk add openntpd

# cat > /etc/ntpd.conf << EOF
listen on 127.0.0.1
servers pool.ntp.org
server time.cloudflare.com
sensor *
constraint from "9.9.9.9"
constraint from "2620:fe::fe"
constraints from "www.google.com"
EOF

# rc-update del ntpd

# rc-update add openntpd

# service openntpd start

See also:

Custom Editor Configuration. Alpine Linux is already installed with a small version of vi, not even ed is installed. So, installing vim or any other editor of your choice can be helpful.

# apk add vim

See also:

Disable shell history. Some of you would ask why doing that. Well, as sysadmin, I saw too many confidential informations in the shell history, including passwords, tokens and sometimes sensitive customer informations. Disabling this feature will avoid information leaks. By setting HISTFILE to /dev/null, the feature will stay available for the current session but the history will never remains in a file (usually in ${HOME}/.ash_history on Alpine).

# cat >> /etc/profile << EOF
# disable shell logging feature
export HISTFILE=/dev/null

EOF

System Hardening

AppArmor Configuration. Ensuring applications are doing the right things is important. One can install selinux or apparmor to enforce those check. Note: configuring those applications can be complex, please read the documentation first and do some tests before deploying in production.

# apk add apparmor apparmor-utils apparmor-profiles

# cat >> /etc/default/grub << EOF
GRUB_CMDLINE_LINUX_DEFAULT="modules=sd-mod,usb-storage,ext4 quiet rootfstype=ext4 apparmor=1 security=apparmor"
EOF

# grub-mkconfig -o /boot/grub/grub.cfg

# cat /sys/kernel/security/lsm

# rc-update add apparmor boot

# service apparmor start

# aa-enabled

See also:

apparmor(7) manpage;
AppArmor on the Alpine Linux Wiki;
Security Handbook/Linux Security Modules/AppArmor on the Gentoo Wiki;
AppArmor on the Arch Linux Wiki;
Official AppArmor website.

Auto-Update. Enable auto-update and auto-upgrade (not mandatory).

# cat >> cat /etc/crontabs/root << EOF
# auto-update/auto-upgrade 
0 2 * * * apk update && apk upgrade
EOF

See also:

Regular Maintenance on the Alpine Linux Wiki.

Full Disk Encryption. If your server requires FDE, don't forget to configure it during the installation process. It will be the subject of a full article, because it can be challenging to deal with that. The idea is to encrypt the whole disk, and use an USB thumb containing grub and the key to decrypt it to boot the kernel. If the USB drive is not plugged, the server can't boot.

See also:

Setting up encrypted volumes with LUKS on the Alpine Linux Wiki;
Full Disk Encryption From Scratch on the gentoo Wiki;
dm-crypt on the Gentoo Wiki;
dm-crypt/Encrypting an entire system on the ArchLinux Wiki;
dm-crypt/Device encryption on the ArchLinux Wiki;
dm-crypt from kernel.org;
Encrypted Alpine Linux from just-paranoid.net.

Backup Configuration. If your server contains critical data, don't forget to do regular backup using restic, rustic or any other applications to creates backups on daily basis.

See also:

Sysctl System Hardening. The Linux Kernel offers huge flexibility over its configuration, instead of recompiling the kernel every time with hard coded value, a first step is to configure the parameters available from sysctl or from /sys.

# cat > /etc/sysctl.d/99-system-hardening.conf << EOF
fs.file-max = 65535
fs.protected_fifos = 2
fs.protected_hardlinks = 1
fs.protected_regular = 2
fs.protected_symlinks = 1
fs.suid_dumpable = 0
kernel.core_pattern=|/bin/false
kernel.core_uses_pid = 1
kernel.ctrl-alt-del = 0
kernel.dmesg_restrict = 1
kernel.kexec_load_disabled = 1
kernel.kptr_restrict = 2
kernel.perf_event_paranoid = 2
kernel.pid_max = 65536
kernel.split_lock_mitigate = 0
kernel.sysrq = 0
kernel.unprivileged_bpf_disabled = 1
kernel.yama.ptrace_scope = 2
net.core.bpf_jit_harden = 2
vm.mmap_rnd_bits = 32
vm.mmap_rnd_compat_bits = 16
EOF

# sysctl -p /etc/sysctl.conf /etc/sysctl.d/*.conf

See also:

Custom Hardened Kernel. Disable unused feature, enable more security features and compile your own kernel. This can also be a challenging topic, and will have its own dedicated publication here.

See also:

How to build the Alpine Linux kernel on the Alpine Linux website;
Linux Hardened Kernel project on Github;
hardened-kernel on KickSecure Wiki.

Network Hardening

Firewall Configuration. Install iptables or nftables. Be careful though, because enabling and starting these services can cut your connections. Always tests the rules first and then deploy. nftables configuration can be found in the /etc/nftables.nft file or in the /etc/nftables.d directory. The iptables configuration can be found in /etc/iptables directory. The following configuration will only allow connections to the sshd daemon from anywhere.

# apk add nftables

# cat > /etc/nftables.d/99-local.nft << EOF
table inet filter {
  chain input {
    tcp dport ssh accept comment "allow sshd connections"
  }
}
EOF

# rc-update add nftables boot

# service nftables start

See also:

iptables(8) manpage;
nft(8) manpage
Iptables on the Alpine Linux Wiki;
iptables on the Gentoo Linux Wiki;
iptables on the Arch Linux Wiki;
iptables official website
Simple stateful firewall on the Arch Linux Wiki;
Nftables on the Alpine Linux Wiki;
nftables on the Gentoo Linux Wiki;
nftables on the Arch Linux Wiki;
nftables official website

Sysctl Network Optimization. Optimize network stack configuration via sysctl.

# echo "tcp_bbr" > /etc/modprobe.d/99-tcp.conf

# cat > /etc/sysctl.d/99-tcp-hardening.conf << EOF
net.core.default_qdisc=fq
net.core.rmem_max = 33554432
net.core.wmem_max = 33554432
net.ipv4.tcp_congestion_control=bbr
net.ipv4.tcp_fin_timeout=15
net.ipv4.tcp_max_syn_backlog=65536
net.ipv4.tcp_rmem = 4096 131072 33554432
net.ipv4.tcp_syn_retries=3
net.ipv4.tcp_synack_retries=3
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_tw_reuse=1
net.ipv4.tcp_wmem = 4096 131072 33554432
EOF

# cat > /etc/sysctl.d/99-ipv4-hardening.conf << EOF
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.all.secure_redirects = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv4.conf.default.accept_source_route = 0
net.ipv4.conf.default.log_martians = 1
net.ipv4.conf.default.rp_filter = 1
net.ipv4.conf.default.send_redirects = 0
net.ipv4.icmp_echo_ignore_broadcasts = 1
net.ipv4.icmp_ignore_bogus_error_responses = 1
net.ipv4.ip_forward = 0
EOF

# sysctl -p /etc/sysctl.conf /etc/sysctl.d/*.conf

See also:

Sysctl on the Alpine Linux Wiki;
sysctl on the Arch Linux Wiki;
modprobe(8) manpage;
modprobe.conf(5) manpage;
sysctl(8) manpage;
IP Sysctl from kernel.org;
Linux TCP Tuning: Improve Throughput with sysctl Knobs from commandline.com;
Optimizing Linux Network Throughput by Tuning TCP/IP sysctl Parameters from devops.aibit.

Use Only One Network Stack. If you don't need IPv6, disable it. Using two network stacks can lead to more problem. You can simply disable it using sysctl by setting net.ipv6.conf.all.disable_ipv6 to 1 or by recompiling the kernel and disabling IPv6 directly there.

# sysctl net.ipv6.conf.all.disable_ipv6=1

# echo net.ipv6.conf.all.disable_ipv6=1 > /etc/sysctl.d/99-ipv6-disabled.conf

See also:

Monitoring

Configure a Logger. By default, a minimalist implementation of syslog from busybox called syslogd is installed. One will probably prefer something a bit more flexible like rsyslog or syslog-ng to manage the logs (and forward them for example).

# apk add rsyslog

# rc-update add rsyslog

# service rsyslog start

See also:

Syslog page on Alpine Linux Wiki;
rsyslog official website.

Log Rotation. On a very active servers, logs can be a huge problem, even more if the partitions were not correctly configuration, one badly configured process can easily fill up all the available space in / or in /var or in /var/log. It can be good to configure logrorate accordingly. It mostly depends on your applications, so, I will not give you any examples, the manpage should be enough.

See also:

logrotate(8) manpage

Physical Disk Monitoring. Install smartmontools to check the states of the disks.

# apk add smartmontools

# rc-update add smartd

# service smartd start

See also:

Monitoring. Install monit to control automatically the state of each services running on the server, reboot them or send a notification in case of issue.

# apk add monit

# rc-update add monit

# service monit start

See also:

Official Monit website

Metrics Collection. Install something to monitor the system like netdata, prometheus or any other tools to collect the metrics.

# apk add netdata

See also:

System Audit. Install and configure audit. This package contains auditd and auditctl executable to audit the logs

# apk add audit

# rc-update add auditd

# service auditd start

See also:

auditctl(8) manpage
auditd(8) manpage
auditd.conf(5) manpage
Install necessary security tools on Alpine Linux Wiki;
Audit on the Gentoo Wiki;
Audit framework on the Arch Linux Wiki.

Misc

Tools. Some packages are required to check if everything is working as expected. the bind-tools package contains dig used to check if domain name requests are working. The curl packages contains curl to check if the server can have access to remote HTTP servers.

# apk add curl bind-tools

See also:

Container Managers. docker, podman, lxc or incus can be installed on Alpine Linux. On my side, I prefer the 3 last listed above, docker is not open-source enough to me.

# apk add podman

See also:

Podman on the Alpine Linux Wiki;
Podman on the Gentoo Wiki;
Podman on the Arch Linux Wiki;
Official Podman website.

Conclusion

This article contains only the beginning of the life of a server. Indeed, those steps can easily be applied on one or two servers during manually, but when it comes to manage more than few servers, using an Ansible playbook or a Salt Pillar to ensure everything was correctly configured on all the fleet.

Actually, this procedure is also limited to a really simple server configuration, if one need a web server or a database, more specific steps will be required. In fact, it's only the beginning, because every new simple application installed will need its amount of complexity to deal with.

The final configuration presented in this article can also be a good foundation to install something more complex like k3s or nomad. It can also be used to be a template for virtual machines exposed directly to the web... Or simply for your own private services at home.

On my side, it will also be used to host my own gitlab/github workers... But we will see that in another post!

Anyway, as usual, have fun and happy hacking!

Cover Image by Susan Flynn on Unsplash

CBOR Serialization in Dart

Mathieu Kerjouan — Tue, 08 Sep 2026 10:00:00 +0000

Every developer knows JSON, they also probably knows XML and sometime protobuf or BSON. For the ones coming from Erlang/Elixir, they will probably know ETF and for the ones using LISP/Scheme, they will also probably have heard of S-expressions. Many other serialization format can be found on the web, a Wikipedia page collect them all. CBOR is another one, this time, not specified by a language, but by an organization. It makes it more portable than any other binary serialization formation.

Anyway, CBOR was in my list for a while, and I wanted to use it with Dart to see how it could be used there. It will also be a good time to deal with I/O, like creating, reading, writing and deleting files.

Bootstrapping

As usual, a sandbox project will be created. This time, it will be called cboring.

$ dart create cboring
Creating cboring using template console...

  .gitignore
  analysis_options.yaml
  CHANGELOG.md
  pubspec.yaml
  README.md
  bin/cboring.dart
  lib/cboring.dart
  test/cboring_test.dart

Running pub get...                     0.8s
  Resolving dependencies...
  Downloading packages...
  Changed 48 dependencies!

Created project cboring in cboring! In order to get started, run the following commands:

  cd cboring
  dart run

$ cd cboring

The cbor package will be required.

$ dart pub add cbor
Resolving dependencies... 
Downloading packages... 
+ cbor 6.5.1
+ characters 1.4.1
+ hex 0.2.0
Changed 3 dependencies!

Quick Introduction to CBOR

As mentioned above, CBOR is a binary serial format specified in many RFCs. If you are using Erlang you should probably be aware of ETF or Erlang Term Format. Both are similar in the design. The idea is to encode different kind of data in a binary format, for example, if you want to encode an integer, instead of writing directly it like in JSON, the final produced result in a binary format will result in - at least - 2 values: (1) a tag as an integer defined in the specification used to inform on the data type (2) the data itself, encoded in a specific format or not, depending on the specification. Let compare that with JSON directly.

The same textual value in binary looks like that:

0x31 0x30 0x32 0x33

The previous value is a simple integer (1023) supported by the JSON format. If you read this value with a JSON parser, it will return 1023 as value.

0x19 0x03 0xff

In other hands, CBOR is using binary term, and the same value (1023) will be encoded as 0x03ff in hexadecimal. This value only is not enough, because nobody really know. Indeed, this value can represent any other kind of values. To avoid confusion, CBOR will prefix this integer by 0x19 (000_11001). Then, when the decoder will read the binary file, it will know the next value stored after this tag is an integer. Let check that for a more complex data like a list made of an integer and a string.

[1023,"test",65536]

0x5b 0x31 0x30 0x32 0x33 0x2c 0x22 0x74
0x65 0x73 0x74 0x22 0x2c 0x36 0x35 0x35
0x33 0x36 0x5d

The JSON representation of those data is still quite simple, but in CBOR, it can become a bit more challenging:

0x82 0x19 0x03 0xff 0x64 0x74 0x65 0x73 
0x74 0x1a 0x00 0x01 0x00 0x00

The type defined in the first byte can be divided in two parts, the first 3 bits define the major type, the 5 remaining bits are used for extra-arguments.

0x82 (100_00010) is an array of data items (major type 4) containing 3 elements (00010);
0x19 (000_11001) is an unsigned integer (major type 0) with 25 (16 bits encoded value) as additional parameter and followed by the value 1023 (`0x03 0xff);
0x64 (011_00100) is a text string (major type 3) containing the 4 (00100) characters t e s t (0x74 0x65 0x73 0x74`);
0x1a (000_11010) is an unsigned integer (major type 0) with 26 as additional parameter (32 bits encoded value), followed by the value 65536 (0x00 0x01 0x00 0x00).

The amount of data encoded in CBOR is more concise, and can be a huge win when an application should deal with limited payload size. If you want to know more about the specification itself, the RFC8949 contains everything.

Exporting CBOR Data To a File

It was a long prelude... but it's now the time to come back to the CBOR package and have some fun. Exporting CBOR data to a file is straightforward, even more knows after having reviewed how to use the Dart file API.

import 'dart:io';
import 'dart:convert';
import 'dart:typed_data';
import 'package:cbor/simple.dart';

void main(List<String> arguments) {
  final data = {
    'map': {
      'key': "value",
    },
    'list': [1,2,3,4],
  };
  Uint8List buffer = Uint8List.fromList(cbor.encode(data));
  File cborExport = File("./export.cbor");
  RandomAccessFile fh = cborExport.openSync(mode: FileMode.append);
  fh.writeFromSync(buffer);
  fh.closeSync();
}

$ dart run

$ stat export.cbor 
  File: export.cbor
  Size: 26              Blocks: 8          IO Block: 4096   regular file
Device: 254,1   Inode: 279569      Links: 1
Access: (0664/-rw-rw-r--)  Uid: ( 1000/    user)   Gid: ( 1000/    user)
Access: 2026-09-04 07:12:05.262214381 +0000
Modify: 2026-09-04 07:11:22.398703675 +0000
Change: 2026-09-04 07:11:22.398703675 +0000
 Birth: 2026-09-04 07:11:22.398703675 +0000

$ hexdump -C export.cbor
00000000  a2 63 6d 61 70 a1 63 6b  65 79 65 76 61 6c 75 65  |.cmap.ckeyevalue|
00000010  64 6c 69 73 74 84 01 02  03 04                    |dlist.....|
0000001a

As you can see, the file has been created and contains CBOR encoded data.

Import CBOR Data From Files

If a CBOR data structure can be exported to a file, it can also be imported from a file. Let check that.

import 'dart:io';
import 'dart:convert';
import 'dart:typed_data';
import 'package:cbor/simple.dart';

void main(List<String> arguments) {
  File cborExport = File("./export.cbor");
  RandomAccessFile fh = cborExport.openSync(mode: FileMode.read);
  Uint8List buffer = Uint8List(fh.lengthSync());
  fh.readIntoSync(buffer);
  fh.closeSync();
  print(buffer);
  print(cbor.decode(buffer));
}

$ dart run
[162, 99, 109, 97, 112, 161, 99, 107, 101, 121, 101, 118, 97, 108, 117, 101, 100, 108, 105, 115, 116, 132, 1, 2, 3, 4]
{map: {key: value}, list: [1, 2, 3, 4]}

While decoding the file, the data present in it are correctly converted to Dart terms using the CBOR encoding format.

Conclusion

CBOR is amazing, not only because it was specified, but also because it's small and elegant. This is a great alternative to Protocol Buffer and BERT (Binary ERlang Term, a "fork" of ETF). In the case of protobuf, CBOR is easier to use, and will act as a binary-like JSON, with extra-type and a smaller payload. For BERT/ETF, it will be safer, because the serializer will not use some low-level functions (e.g. binary_to_term/1) to automatically convert the data, including atoms. Indeed, ETF has been created to be used in a safe and controlled environment, using it in production is a huge risk and should be avoided.

Anyway, CBOR remains one of my favorite binary format, and its implementation in Dart is doing the job. Not everything has been implemented though, for example, it is possible to specify more accurately the CBOR payload by using CDDL (Concise Data Definition Language) and offering mostly the same feature than Protobuf. CBOR can also be used as an alternative to JWT, with CWT. CBOR can also be used to sign and encrypt data via COSE, an alternative to JOSE.

CBOR can easily replace JSON in practically all situations and was designed to offer performance and flexibility. It's a perfect format for messaging, game industry, low-level programming and eventually system application. This article was only the tip of the iceberg, the number of drafts related to CBOR available on the IETF website is astonishing.

As usual, if the reader wants to know more about CBOR and how to use it with Dart, here a list of nice references:

the Official CBOR website;
cbor package on pub.dev;
cbor package API documentation at pub.dev;
cbor package source code at Github;
libcbor at Github;
RFC-8949 - Concise Binary Object Representation (CBOR) Official specification;
Understanding CBOR Encoded Data by @mnelsonwhite;
JSON VS CBOR (Javascript) by @vipert;
JSON vs CBOR;
Understanding the CBOR data serialisation format by Aravind Putrevu;
CBOR vs MessagePack: Binary JSON Formats Explained by DevToys.

Happy hacking and have fun!

Cover Image by Art Lasovsky on Unsplash

WeeklyReview#202636

Mathieu Kerjouan — Mon, 07 Sep 2026 10:00:00 +0000

Summer is over, after 2 months of hot weather in France, it's time to restart all the projects. Most of them have been slowed down, it's now a good time to do a quick list of my targets. Firstly, one target is to find an incubator for my future company. One of my idea is to leave France and go to Switzerland, the startup scene and the economy is way better than what we have in France right now, or move back to Denmark (like it would have been done 6 years ago, but cancelled due to the crisis), or take a one-way flight to Japan. The cultural change will be hardcore, and I would like to avoid that for now due to my poor level of Japanese.

Anyway, let have a first look at the incubators available in Switzerland, here a non-exhaustive list of incubators found on the web:

Swiss UMEF (St. Gallen): provides courses, checklists, business ideas, business plan, domiciliation and pitch'n'bar. They can be followed on linkedin and youtube;
VentureLabs (Zurich, Lausanne, St. Gallen): Support startups and innovators via training sessions, workshops and courses.
Pulse Hesge (Genève): coaching, workshops, coworking, networking and events, (a member of the team must have a diploma from HES-SO.
IFJ (Institut für Jungunternehmen): a startup acceleration program. They are offering many services including startup preparation (e.g. business plan tools, courses), training and company development programs. Their blog seems to be active. It's also a three-stage funding kick-start, 10k CHF to 1M CHF. They can also be followed on X/Twitter, Linkedin and Youtube;
Venture Kick (Schlieren-Zürich): a philanthropic/private initiative by the Kick Foundation, created to accelerate the time to market and supporting young entrepreneurs. They helped more than 800 companies. They can be followed on youtube.
Tenity (international/Zurich): venture capital, funding startups. They can be followed on linkedin and on youtube.
Virtual Network: owned by Stéphane Pictet. Don't have a lot of information on them.
Nivalis Group (Villaz-St-Pierre): investors, support. They can be followed on Linkedin.
Pintos Venture (Zug): pre-seed, seed, active support, coaching and introduction to partner VCs.
International Trade Center (Geneva): not sure if this one is the right one, mostly for undeveloped countries projects (it seems).
MassChallenge (international/Renens): networking and accelerator. They can be followed on linkedin and youtube.
qai ventures (Arlesheim): startup funding, accelerator, founder program. They can be followed on linkedin and on youtube.
Trea ventures: no information from their website, they must be contacted via email.
Stryber (Freienbach): design, launch and scale businesses. specialized in large-projects. They can be followed on linkedin.
Swisspreneur (Langnau): startup funding and investment, events. They can be followed on youtube and linkedin.
Innovaud (Lausanne): company creation, advice and support, fiscal/financial framework, connection. They can be followed on linkedin and youtube.
FongIT (Geneva): funding, startup support. they can be followed on youtube and linkedin.
EPFL (Lausanne): expertise, incubation, hosting, mostly via other companies like La Forge, Trust Village and Le Garage.
InnoSuisse (Bern): an innovation agency created to help companies with funding instruments. They financed many startups since 2023. They can be followed on youtube and linkedin.
Bioark (Sion, Monthey, Visp): startup park ecosystem. They can be followed on linkedin and youtube;
Swiss Digital Center (Sierre): conference rooms, working space and coworking;
Microcity (Neuchâtel): accelerate projects, from the concepts to the market. They are connecting experts, partners, financing and opportunity together. They can be followed on Linkedin;
SwissPark (Reinach): exchanges of experience, workshops and seminars. They can be followed on linkedin;
Prefix (Neuchâtel): offers a place to work differently, with training, workshops and mentoring. More info on youtube and linkedin;
La Forge (Lausanne): an incubator offering a coworking place, demo days, coaching, thematic workshops and a supporting community. They can be followed on youtube or linkedin. Interesting startups: vispo.
Y-parc (Yverdon-les-Bains): Y-start is a generalist technological public incubator created for the startup and offers a coworking place. More information about them can be found on their youtube channel or linkedin profile. Few interesting success story: Bacula, Kryptus.

This list is far from complete, and some informations must be collected (e.g. mission/focus, eligibility, structure, time commitment, cost, terms, track record, reputation, network, contacts...). More VCs and incubators can be found on incubator list. Not sure if the database is complete though, but ~244 entities are listed in Switzerland. To check as well:

BNI Switzerland: international business/entrepreneur club;
Dynabuy: another business network;
CVCI Business Club: a local business club in Vaud;
FBN Switzerland: largest business network in switzerland.

It's not even done. Creating a company in Switzerland is probably a bit different due to the cantons (small regions) where the taxes and rules are kinda different. Before looking on that point, perhaps reading few articles on that can help:

Another idea is to start the concept in France and then relocate it in Switzerland. I don't think it will be easy, but it will perhaps less risky. If the project does not work in France, it will probably not work in Switzerland.

Now, it's time to work (again) on the PoC and think a bit about the business plan/pitch. I think also looking for an incubator close to my current living place could also be a great choice if I can't go to Switzerland for some reasons.

This week was really dedicated to understand how the Dart file management was working. In fact, it started by a small example using CBOR (minimalist local data store), but it was hard to find something one the web about this part of Dart. So, writing a more complete article on this part of the language was kinda important.

Another article on Elixir/Phoenix should be ready for the next week.

Coding

📝 The Depths of JavaScript: Minesweeper in 247 Bytes: even if you don't like JavaScript (like me), you should recognize elite code when you see it. Coding a minesweeper in 247 bytes is cool.

🏗️ simslim project: Run a lot more iOS simulators on one Mac by turning off the background daemons a simulator doesn't need. A freshly booted iOS simulator starts around 180 background services: Siri, Spotlight indexing, photo analysis, News, wallpaper posters, iCloud sync, and so on. None of it matters when you're using the simulator for development, testing, or CI. simslim switches those services off, which cuts each simulator's memory roughly 4x. On the same laptop you go from a handful of simulators to a screenful.

🏛️ 6.851: Advanced Data Structures (Spring'21): a list of advanced data structures, the lectures are available for free.

📑 Open Data Structures: a book listing data structures in pseudocode, java and c++.

📖 The Art of EyeProlog - ISO Prolog with inspectable proof: a complete book about EyeProlog, from beginners to expert. The amount of exercises and examples is awesome (the answers are available as well).

🏗️ Jigsaw project: a proof of concept for a layout tiling library for Phoenix Liveview. It is inspired by BSP-style desktop tiling layouts such as Hyprland's Dwindle layout, but applies the same model to arbitrary Phoenix LiveView content.

📝 Everyone Says Assembly Is Untyped—Everyone Is Wrong: an article on Odin inline assembly feature design, and comparing it to other languages.

Memory Allocation Strategies - Part 1: a series of article on Memory Allocation, including garbage collector, automatic reference counting, and ownership semantics.

📝 C Is Not a Low-level Language: Your computer is not a fast PDP-11.: a post explaining why C is not a low-level language. C was created on PDP-11 and was mapping on some of its native instructions. It's interesting to see the hardware, especially the CPU, was designed also to run fast C code. I quote the last paragraph:

There is a common myth in software development that parallel programming is hard. This would come as a surprise to Alan Kay, who was able to teach an actor-model language to young children, with which they wrote working programs with more than 200 threads. It comes as a surprise to Erlang programmers, who commonly write programs with thousands of parallel components. It’s more accurate to say that parallel programming in a language with a C-like abstract machine is difficult, and given the prevalence of parallel hardware, from multicore CPUs to many-core GPUs, that’s just another way of saying that C doesn’t map to modern hardware very well.

▶️ ** The Best Programming Exercise Was the One I Hated the Most **: a video by The Palindrome, the post is also available on his blog. It talks about writing code on paper, and why it's important to do it.

📝 How to use Lua for flexible configurations in Erlang and Elixir: an example of Lua code running on the BEAM using luerl.

System

📝 Mount Mayhem at Netflix: Scaling Containers on Modern CPUs: I thought Netflix was massively using FreeBSD (probably on the network side), but it seems they are using Linux and Kubernetes as well. Anyway, in short: (1) disabling hyperthreading improves containers launch (avoid shared resources competition), (2) learn how your CPU is dealing with its cache, (3) run benchmarks to have metrics, evaluate the changes (see global-lock-bench project) and find the issue (here it's a global lock), (4) test newest kernels and update the application to use modern syscall.

📝 Multikernel Linux Tree Released: Runs Multiple Kernels On Bare Metal Without a Hypervisor: a way to run multi-linux kernel on one host. One kernel can have its own CPU, RAM and GPU. See also the announce from lklm.

🏗️ abuuda project: A fast fediverse server in Elixir and Phoenix that speaks Mastodon's protocols. Always at least 12x faster than Mastodon. Drop-in replacement for it. Based on the official website, way more faster than Mastodon.

🏗️ PawnIO project: PawnIO is a scriptable universal kernel driver, allowing hardware access to a wide variety of programs. It uses the Pawn scripting language and the PawnPP interpreter. When installed, any software implementing PawnIO modules can use the driver to access or control hardware supported by one of the official modules.

▶️ FreeBSD - using LLMs for fun and profit: a new series about FreeBSD. I hate the LLMs part, but who knows, perhaps someday people will stop using that and learning the old way will become cool again.

📝 Virtual Memory From First Principles: Virtual memory is a complex topic on computer science. This very long article goes very deep there, by listing all the features the virtual memory must accomplish. I like the way it's explaining, using a dialog between the kernel and the allocator. A must read. It also covers some part of virtual memory I did not know, like NUMA. I will try to re-read it soon, because it contains so many details...

Database

🏗️ dragonflydb project: a modern replacement for Redis and Memcached. Fully compatible with Redis and Memcached APIs, Dragonfly requires no code changes to adopt. Compared to legacy in-memory datastores, Dragonfly delivers 25X more throughput, higher cache hit rates with lower tail latency, and can run on up to 80% less resources for the same sized workload.

Security

🏗️ Ghidra project: a software reverse engineering (SRE) framework created and maintained by the National Security Agency Research Directorate. This framework includes a suite of full-featured, high-end software analysis tools that enable users to analyze compiled code on a variety of platforms including Windows, macOS, and Linux.

📝 I fight bots in my free time: after reading Anubis was easy to bypass in a tweet on X/twitter, I started to investigate a bit. Indeed, CVE-2026-62314 allowed an attacker with a crafted header to bypass the check and this bug has been fixed since. The 1.22.0 <= version < 1.26 are impacted by this issue and a workaround exists. CVE-2025-24369 is another issue where the check can be bypassed when asking a difficulty 0 challenge. At this time, 5 security issues are displayed on their Github Security Policy page. To me, Anubis seems to be a good open-source tool, but like all open-source software, using the latest version is sometime the best to do. More information about Anubis can be read on lwn.net or ycombinator.

📖 From Day Zero to Zero Day, A Hands-On Guide to Vulnerability Research: perhaps a good alternative to the marvelous the book of Erickson, Hacking The Art of Exploitation? Another book to read.

Security/cryptography

🏗️ ultralight-AES project: A minimal, readable implementation of AES-128 in ECB mode: the whole cipher, encrypt and decrypt, in about 85 lines of plain C. One file, no dependencies, no lookup tables pasted in from somewhere else.

📝 Is Argon2 actually better than Bcrypt?: Argon2 is better than Bcrypt. Bcrypt is a the older way to store password using a PBKDF. It's not even a surprise, Argon2 won its place in 2015, Argon2id is also specified in RFC 9106. On the other hand, bcrypt function has been firstly published in 1999, in a totally different environment (parallelism was hard, memory was costly, and not a lot of people got access to FPGAs/ASICs). I don't even know if bcrypt was specified somewhere, outside of the paper announcing it. In doubt, if you don't know what to choice, you can follow the OWASP rules:

Use Argon2id with a minimum configuration of 19 MiB of memory, an iteration count of 2, and 1 degree of parallelism. If Argon2id is not available, use scrypt with a minimum CPU/memory cost parameter of (2^17), a minimum block size of 8 (1024 bytes), and a parallelization parameter of 1. For legacy systems using bcrypt, use a work factor of 10 or more and with a password limit of 72 bytes. [...] The bcrypt password hashing function should only be used for password storage in legacy systems where Argon2 and scrypt are not available.

Security/BlueTeam

📝 Building a Pocket Wi-Fi Threat Detector: an article about the Travel WiFi Canary project. Here the description from github: Monitors the 2.4 GHz WiFi environment and lights the RGB LED when it observes patterns associated with common wireless threats: evil-twin access points, deauthentication attacks, Pwnagotchi wardrivers, WiFi Pineapple hardware, security downgrades, and beacon floods.

📑 Influence of Logging Frameworks on Bind9: logs are the main bottleneck in an IPS pipeline. To fix that, they have created FIPS IPC. To check and test.

Security/RedTeam

🌐 AGNITracker: a tool to find subdomains. One can find more information by reading the documentation. Not sure if the following API will stay alive for a long period of time, but here one open end-point to do search for sub domains:

$ curl -qs "https://app.agniops.in/v1/search?domain=${domain}"

📝 How I Bypassed Claude Opus’s CBRN-E Safeguards: the stories around LLMs jailbreaks amaze me every time. This is publication is explaining another process to bypass the protections on anthropic LLM.

🏗️ Awesome Large Language Models for Vulnerability Detection: A curated list of papers, projects, and agent skills on using LLMs for vulnerability detection and discovery.

🏗️ airgorah project: A WiFi security auditing software mainly based on aircrack-ng tools suite, and written in Rust.

🏗️ Erebus project: Erebus is a modern initial access wrapper aimed at decreasing the development to deployment time, when preparing for intrusion operations. Erebus comes with multiple techniques out of the box to craft complex chains, and assist in bypassing the toughest security measures.

📝 Bluetooth Hacking and Security: The WhisperPair Exploit and Bluehood Surveillance: an article showing how to use whiperpair exploit (android) and recover the connection key. It also introduces bluehood scanner.

Embedded

📝 Pogo Pin (ポゴピン) Probe: every single time I saw a post in Japanese talking about embedded systems or electronics, it proves Japanese hobbyists are different. Anyway, the idea here is to create a Pogo Pin-like cable ready for production. I did not understand everything though, my level of Japanese is not ready for that yet.

📝 Op-Amp Wonders: Circuit Secrets Revealed!: reminds me when I was in electronics. Painful souvenirs.

🏗️ cpu-fpga-board project: NEC PC-9800 C-Bus FPGA Board Design

📝 OpenTrailPaper transforms LILYGO T5 E-Paper S3 Pro devkit into a DIY e‑paper bike computer: e-paper devices are so great! Here a great example of what one can do with an ESP32 and one e-ink screen.

📝 How to Implement a Software-Based Debounce Algorithm for Button Inputs on a Microcontroller: a succinct article about debounce algorithm using arduino-like board, and you know what, they are also mentioning FSM.

Update/Upgrade

🔄 QSB-117: Intel CPU firmware vulnerabilities: many fixes regarding Intel CPU microcode

🔄 OpenSSL 4.0.2 Released with Important Security and Bug Fixes: [...] a heap buffer overflow in CMS key unwrapping (CVE-2026-63072), excessive memory use buffering DTLS records (CVE-2026-54874), and a client-side memory leak in OCSP response checking (CVE-2026-54876).

🔄 Erlang/OTP 29.0.6 released: many bugs fixes, including one CVE. CVE-2026-75538 can remotely crash an Erlang node using a crafted TCP packet

Mathematics

📑 The Algebra of Grand Unified Theories: just because.

📑 GAME THEORY, An open access textbook with 165 solved exercises: mathematical introduction to game theory.

Hardware

📝 Blink Codes and Beep Codes for Intel® NUC: I recently acquired few NUCs to have my own CI/CD building pipeline at home (we will talk about that later). I don't need crazy things, and while looking for refurbished ones, few of them are being sold as dead. Most of the computers have some visual or sound patterns to explain the problem. This link is listing few of them. I learnt it can be customized (Power Button LED and Ring LED Settings on Intel® NUC Kits). A more accurate document can be downloaded, containing a summary of all the codes available. I created a public gist to store those informations in case the document is removed in the future.

Misc

📝 Crafting “Crafting Interpreters”: author timeline and advice. One of the title section is a great summary: "Writing is suffering", this is how I feel when I start a new article or a book project (I never ended one of them). Anyway, great feedback. Must read.

🏗️ Plaintext editor: a simple text editor created and announced by JP Aumasson.

📑 0xPass: A Secure Protocol for Universal Cross-Chain Accounts: a description of the 0xPass platform.

📝 Canada revokes dozens of crypto firms’ registrations: Anti-money laundering authorities in Canada have revoked registrations of nearly three dozen cryptocurrency businesses [...] Many of these businesses specialize in converting cryptocurrency to physical cash. The Star story, part of ICIJ’s Coin Laundry investigation into dirty money in cryptocurrency, identified a single thoroughfare with 50 businesses advertising crypto services, most of which appeared to be operating unlawfully.

📑 Evaluating Large Language Models in Scientific Discovery

Cover Image by Katie Moum on Unsplash

File Handlers Management in Dart

Mathieu Kerjouan — Fri, 04 Sep 2026 10:00:00 +0000

In a previous article, the File object has been dissected. It's a perfect interface to use if one needs to write or read small files. When it comes to more complex or bigger files, using a file handler is necessary. The following code snippets will dart:io, dart:convert and dart:typed_data packages where:

dart:io will be used for the File and RandomAccessFile classes;
dart:typed_data will be used for the Uint8List class, object returned when reading a file byte by byte;
dart:convert will be required for the ascii and utf8 converters, to convert the bytes read from a file or to convert a String to bytes before writing them.

import 'dart:io';
import 'dart:typed_data';
import 'dart:convert';

When opening a file via the File.open() method, it returns a RandomAccessFile. This object is an interface to manage a file in a more accurate way than the methods offered by File. Indeed, the File.read*() or File.write*() methods are dealing with the whole file and not a subset of it. Before digging in those details, one bigger problem must be fixed.

When a file is opened, a file descriptor is allocated for the process. The amount of file descriptors is not unlimited, and in case of exhaustion, the process can crash. A good practice is to always close an unused file to avoid this kind of issues. To do that, a try/finally clause can be used like in the example below.

File myFile = File("./file.test");
myFile.create();

final handler = await myFile.open(mode: FileMode.read);

try {
  // code to execute here while the  file is opened
}
finally {
  // in case issue, we always close the handler
  await handler.close();
}

Repeating this code is boring, this is Dart, not Go. To avoid code duplication and eventually errors, let creates a new function to always close a file.

void handlerManager(String path, 
                    FileMode mode,
                    Function closure) async {

  // create a new File object
  File file = File(path);

  // open the file using the mode specified
  // in the arguments
  RandomAccessFile fh = await file.open(mode: mode);
  print("> open $file");

  // execute the closure passed in the last
  // argument of the function...
  try {
    await closure(fh);
  }

  // if the closure throw an exception, we
  // print it and rethrow it
  catch (e, s) {
    print("$e, $s");
    rethrow;
  }

  // in all cases, the file handler must be
  // closed to avoid file descriptor exhaustion
  finally {
    fh.closeSync();
    print("> close $file");
  }
}

This small function can then be used to automatically close a file handler like the following piece of code:

final action = () {};
handlerManager("./read.txt", FileMode.read, action);

Now this part is fixed, let have a quick look on the open and openSync() methods and how to use it. Five file modes defined as constants in the FileMode class can be used to open a file.

The read mode set the file handler in read-only, in this mode, the application can only read bytes from the file or set the position of the cursor.

The write mode set the file handler in read-write mode, in this case, the application can read or write bytes to the file. If the file is opened and then nothing is done on it, the file is then truncated (emptied).

The append mode set the file handler in read-write mode but will not truncate the file if this one is closed before doing anything on it.

The writeOnly mode can only write bytes to a file without reading it. If a file is already present, it will be overwritten.

The writeOnlyAppend mode can only write data on the end of the file.

File Handler Cursor

A file can be seen as a contiguous array of bytes, where an empty file can be seen as an empty array with a zero length. When dealing with an array, an index is used to store an object. The same concept exists with an opened file, but it is called a cursor. A cursor can be positioned on a specific offset on the file to read or write content on it. Let test that with Dart. First, two files will be created, one called empty.txt and another one called hello.txt, respectively an empty file, and a file containing the string "hello world".

$ touch empty.txt

$ echo hello world > hello.txt

A RandomAccessFile object is offering 3 methods to configure the cursor. The first one is the length() method, useful to know the size of the file and to avoid configuring the cursor at the wrong place. Then, the position() method and the setPosition() method are used to interact with the cursor. Easy, right?

// create a new file object
File emptyFile = File("./empty.txt");

// open the file, in read-only mode by default
RandomAccessFile emptyFileHandler = await emptyFile.open();

// create a clojure to print the length of a file handler
final length = (RandomAccessFile fh) async {
  final length = await emptyFileHandler.length();
  print("length: $length");
};
await length(emptyFileHandler);

// create another clojure to print the position of
// a cursor
final position = (RandomAccessFile fh) async {
  final position = await emptyFileHandler.position();
  print("position: $position");
};
await position(emptyFileHandler);

// configure the position of the cursor
await emptyFileHandler.setPosition(10);

// print the length of the file and
// the position of the cursor
await length(emptyFileHandler);
await position(emptyFileHandler);

// close the file handler
await emptyFileHandler.close();

Let execute this code snippet.

$ dart run
length: 0
position: 0
length: 0
position: 10

What's happening there? Firstly, the empty.txt file is opened, the default FileMode is read. This file is empty, then it's length is set to 0 and the cursor is also set to 0 (start of the file). The cursor position is set to 10, you would think it fails, but it works. If a byte is written at this place, the previous bytes (from the beginning to the current cursor position) will be set to 0. Finally, the file handler is closed to free the file descriptor.

Read Mode

When opening a file in read mode, the application can only read the content of the file without altering it.

File file = File("./hello.txt");
RandomAccessFile fh = file.open(mode: FileMode.read);
// ... do something here
fh.close()

To read the data from the handler, one can use the read(), readByte() or readInto() methods. Let check them one by one. Just to avoid too much duplicated code, a closure to print the position of the cursor will be created.

// another clojure to print the position of
// a cursor.
final printPosition = (RandomAccessFile fh) {
  int position = fh.positionSync();
  print('> position: $position');
};

The read() and readSync() methods return an Uint8List containing the amount of bytes requested from the opened file, starting at the beginning of it. For our first test, let try to read 10 bytes from the files previously created.

handlerManager("./hello.txt", FileMode.read, (RandomAccessFile fh) {
  // print the position of the cursor
  printPosition(fh);

  // store the 10 first bytes of the file in
  // a buffer
  Uint8List readBuffer = fh.readSync(10);

  // print the buffer
  print(readBuffer);

  // convert the buffer in ascii and print it
  print(ascii.decode(readBuffer));
});

$ dart run
> open File: './hello.txt'
> position: 0
[104, 101, 108, 108, 111, 32, 119, 111, 114, 108]
hello worl
> close File: './hello.txt'

Great, the file is correctly opened, and 10 bytes are returned. Those bytes can be converted with ascii.decode() and printed as readable String. Sometimes, we don't want to read a part of the file, but only read it byte by byte. In this case, readByte() and readByteSync() methods can be used. They are returning an int representing the character from the cursor position.

handlerManager("./hello.txt", FileMode.read, (RandomAccessFile fh) {
  printPosition(fh);

  // create an integer buffer (one char)
  int byteBuffer;

  // read the file until we reach an eof
  while ((byteBuffer=fh.readByteSync())>=0) {
    // print the cursor's position at every step
    printPosition(fh);

    // print the buffer and its ascii representation
    print("$byteBuffer | ${ascii.decode([byteBuffer])}");
  }
});

$ dart run
> open File: './hello.txt'
> position: 0
> position: 1
104 | h
> position: 2
101 | e
> position: 3
108 | l
> position: 4
108 | l
> position: 5
111 | o
> position: 6
32 |  
> position: 7
119 | w
> position: 8
111 | o
> position: 9
114 | r
> position: 10
108 | l
> position: 11
100 | d
> position: 12
10 | 

> close File: './hello.txt'

As you can see, the while loop store the returned value into a variable. Every time the readByteSync() method is called, the position of the cursor is increased until it reaches the end of file (eof) represented by -1. Perhaps your file is really huge, or you have your own parser, in this case, one can use the readInto() or readIntoSync() methods. The idea here is to create a buffer and store the content of the file in it. The buffer can have its own limited size, in this case, the readInto() method needs to now how many characters it can read from the file to store them in the buffer.

handlerManager("./hello.txt", FileMode.read, (RandomAccessFile fh) {
  printPosition(fh);

  // buffer initialization using the length of
  // the file.
  Uint8List buffer = Uint8List(fh.lengthSync());

  // let read it a first time
  fh.readIntoSync(buffer);
  print(buffer);
  print(ascii.decode(buffer));
  printPosition(fh);

  // let reset the position and read it a
  // second time.
  fh.setPositionSync(0);
  print(fh.readSync(10));
  print(fh.readSync(10));

  // reset another time the position of
  // the cursor at the beginning of the file
  fh.setPositionSync(0);
  print(fh.readSync(10));
});

$ dart run
> open File: './hello.txt'
> position: 0
[104, 101, 108, 108, 111, 32, 119, 111, 114, 108, 100, 10]
hello world

> position: 12
[104, 101, 108, 108, 111, 32, 119, 111, 114, 108]
[100, 10]
[104, 101, 108, 108, 111, 32, 119, 111, 114, 108]
> close File: './hello.txt'

As you can see, a buffer can be used to store part of the file temporarily. Another interesting thing is a position cursor can be configured while reading the file, it means a file can be opened for a long time, and the cursor can move during all this time.

Write Mode

Reading a file is great, but writing data can also be useful. The writeByte(), writeByteSync(), writeFrom(), writeFromSync, writeString() and writeStringSync() methods can be used to accomplish this tasks.

File file = File("./hello.txt");
RandomAccessFile fh = file.open(mode: FileMode.write);
// ... do something here
fh.close()

dart

Just to be sure, let create another closure to display the length of the file this time. If you prefer create it as a function, you can do it as well.

final printLength = (RandomAccessFile fh) {
  int length = fh.lengthSync();
  print('> length: $length');
};

The first test is to open the empty.txt file and writing data byte by byte. To do that, the writeByteSync() or writeByte() functions can be used, where the first argument is the character to write in the file as an integer.

handlerManager("./empty.txt", FileMode.write, (RandomAccessFile fh) {
  // write the character H
  printPosition(fh);
  printLength(fh);
  fh.writeByteSync(0x48);

  // write the character E
  printPosition(fh);
  printLength(fh);
  fh.writeByteSync(0x45);

  // write the character L
  printPosition(fh);
  printLength(fh);
  fh.writeByteSync(0x4C);

  // write the character L
  printPosition(fh);
  printLength(fh);
  fh.writeByteSync(0x4C);

  // write the character O
  printPosition(fh);
  printLength(fh);
  fh.writeByteSync(0x4F);

  // write the character \n
  printPosition(fh);
  printLength(fh);
  fh.writeByteSync(0xa);
});

$ dart run
> open File: './empty.txt'
> position: 0
> length: 0
> position: 1
> length: 1
> position: 2
> length: 2
> position: 3
> length: 3
> position: 4
> length: 4
> position: 5
> length: 5
> close File: './empty.txt'

As you can see, every time one byte is written in the file, the cursor is increased and the length of the file as well. Writing data byte by byte can be slow, sometimes, a buffer containing a specific amount of data should be written in one step. In this case, the writeFrom() and writeFromSync() methods can be called.

handlerManager("./empty.txt", FileMode.write, (RandomAccessFile fh) {
  printPosition(fh);
  printLength(fh);

  // create a new Uint8List buffer from
  // an encoded ASCII string
  Uint8List buffer = Uint8List.fromList(
    ascii.encode("hello world\n")
  );

  // write the content of the buffer
  // to the file
  fh.writeFromSync(buffer);

  printPosition(fh);
  printLength(fh);
});

$ dart run
> open File: './empty.txt'
> position: 0
> length: 6
> position: 12
> length: 12
> close File: './empty.txt'

When the file is opened, the cursor is set to the position 0 and the buffer is written at the beginning of it, overwriting the previous data if any. The last methods to test are writeString() and writeStringSync(), both of them are simply writings a String directly into the file.

handlerManager("./empty.txt", FileMode.write, (RandomAccessFile fh) {
  printPosition(fh);
  printLength(fh);

  // write the string "data...\n"
  // in the file
  fh.writeStringSync("data...\n");

  printPosition(fh);
  printLength(fh);
});

$ dart run
> open File: './empty.txt'
> position: 0
> length: 12
> position: 8
> length: 12
> close File: './empty.txt'

Like the previous example, the data added are overwriting the data from the position 0. Obviously, the position of the cursor can be set on all previous methods by setting it with setPosition(). Last questions we can ask here, what is happening if the cursor is set to a value greater than the length of the file?

handlerManager("./empty.txt", FileMode.write, (RandomAccessFile fh) {
  printPosition(fh);
  printLength(fh);

  // we know the file size is 12 bytes,
  // but we set the position to 1024.
  fh.setPositionSync(1024);
  fh.writeStringSync("!\n");

  printPosition(fh);
  printLength(fh);
});

$ dart run
> open File: './empty.txt'
> position: 0
> length: 12
> position: 1026
> length: 1026
> close File: './empty.txt'

$ hexdump -C empty.txt
00000000  64 61 74 61 2e 2e 2e 0a  72 6c 64 0a 00 00 00 00  |data....rld.....|
00000010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000400  21 0a                                             |!.|
00000402

Everything works perfectly, and the missing bytes are simply set to 0, like the output of hexdump is showing us.

Append Mode

Using FileMode.write can be dangerous, if someone forgot to set the cursor at the right place, the data stored in the file can be overwritten. In many situation, using the FileMode.append is a better choice, because the RandomAccessFile object returned will set the position of the cursor directly at the end of the file.

File file = File("./hello.txt");
RandomAccessFile fh = file.open(mode: FileMode.append);
// ... do something here
fh.close()

handlerManager("./hello.txt", FileMode.append, (RandomAccessFile fh) {
  printLength(fh);
  printPosition(fh);

  fh.writeStringSync("append data");

  printLength(fh);
  printPosition(fh);

  fh.setPositionSync(0);
  printLength(fh);
  printPosition(fh);

  print(ascii.decode(fh.readSync(fh.lengthSync())));
  printLength(fh);
  printPosition(fh);
});

$ dart run
> open File: './hello.txt'
> length: 12
> position: 12
> length: 23
> position: 23
> length: 23
> position: 0
hello world
append data
> length: 23
> position: 23
> close File: './hello.txt'

One can still set the position of the cursor manually if needed.

WriteOnly Mode

The FileMode.writeOnly mode can only write to a file, without reading its content.

File file = File("./hello.txt");
RandomAccessFile fh = file.open(mode: FileMode.writeOnly);
// ... do something here
fh.close()

This is a dangerous mode, because if the file is already containing data, they will be overwritten. From the documentation:

Mode for opening a file for writing only. The file is overwritten if it already exists. The file is created if it does not already exist.

-- writeOnly constant

Let check that. In the following example, the hello.txt file will simply be opened in this mode and then closed, without doing any actions (except checking the length of the file and the position of the cursor).

handlerManager("./hello.txt", FileMode.writeOnly, (RandomAccessFile fh) {
  printLength(fh);
  printPosition(fh);
});

$ echo hello world > hello.txt 

$ ls -l hello.txt 
-rw-rw-r-- 1 user user 12 Sep  3 12:14 hello.txt

$ dart run
> open File: './hello.txt'
> length: 0
> position: 0
> close File: './hello.txt'

$ ls -l hello.txt 
-rw-rw-r-- 1 user user 0 Sep  3 12:14 hello.txt

At the beginning of the test, the file is containing 12 characters, but when the application is opening it with the FileMode.writeOnly, the size is set to 0. Well, in fact, this is why this mode is dangerous, it will simply overwrite the content of the file by default.

WriteOnlyAppend Mode

The FileMode.writeOnlyAppend mode is the last one to check. It has the same behavior than the FileMode.writeOnly mode, except the cursor is set at the end of the file, and when data are written, the content is not overwritten.

Mode for opening a file for writing only to the end of it. The file is created if it does not already exist.

-- writeOnlyAppend constant

File file = File("./hello.txt");
RandomAccessFile fh = file.open(mode: FileMode.writeOnlyAppend);
// ... do something here
fh.close()

handlerManager("./hello.txt", FileMode.writeOnlyAppend, (RandomAccessFile fh) {
  printLength(fh);
  printPosition(fh);
}); 

handlerManager("./hello.txt", FileMode.writeOnlyAppend, (RandomAccessFile fh) {
  printLength(fh);
  printPosition(fh);

  fh.writeStringSync("new line added");
  printLength(fh);
  printPosition(fh);
});

$ echo hello world > hello.txt

$ stat hello.txt
  File: hello.txt
  Size: 12              Blocks: 8          IO Block: 4096   regular file
Device: 254,1   Inode: 279568      Links: 1
Access: (0664/-rw-rw-r--)  Uid: ( 1000/    user)   Gid: ( 1000/    user)
Access: 2026-09-03 12:24:41.882489242 +0000
Modify: 2026-09-03 12:27:18.162466032 +0000
Change: 2026-09-03 12:27:18.162466032 +0000
 Birth: 2026-09-02 07:37:41.595715171 +0000

$ dart run
> open File: './hello.txt'
> length: 12
> position: 12
> close File: './hello.txt'
> open File: './hello.txt'
> length: 12
> position: 12
> length: 26
> position: 26
> close File: './hello.txt'

$ stat hello.txt
  File: hello.txt
  Size: 26              Blocks: 8          IO Block: 4096   regular file
Device: 254,1   Inode: 279568      Links: 1
Access: (0664/-rw-rw-r--)  Uid: ( 1000/    user)   Gid: ( 1000/    user)
Access: 2026-09-03 12:24:41.882489242 +0000
Modify: 2026-09-03 12:27:45.530452395 +0000
Change: 2026-09-03 12:27:45.530452395 +0000
 Birth: 2026-09-02 07:37:41.595715171 +0000

$ cat hello.txt
hello world
new line added

As you can see, even if the file is open with a write-only mode, the data are added at the end of the file, without overwriting the previous ones.

Truncating

The truncate() and truncateSync() methods can be used to extend the size of a file. The new space is filled with 0x00.

handlerManager("./hello.txt", FileMode.append, (RandomAccessFile fh) {
  printLength(fh);
  printPosition(fh);

  fh.truncateSync(1024);
  printLength(fh);
  printPosition(fh);
});

$ stat hello.txt
  File: hello.txt
  Size: 26              Blocks: 8          IO Block: 4096   regular file
Device: 254,1   Inode: 279568      Links: 1
Access: (0664/-rw-rw-r--)  Uid: ( 1000/    user)   Gid: ( 1000/    user)
Access: 2026-09-03 12:28:05.510440866 +0000
Modify: 2026-09-03 12:27:45.530452395 +0000
Change: 2026-09-03 12:27:45.530452395 +0000
 Birth: 2026-09-02 07:37:41.595715171 +0000

$ dart run
> open File: './hello.txt'
> length: 26
> position: 26
> length: 1024
> position: 26
> close File: './hello.txt'

$ stat hello.txt
  File: hello.txt
  Size: 1024            Blocks: 8          IO Block: 4096   regular file
Device: 254,1   Inode: 279568      Links: 1
Access: (0664/-rw-rw-r--)  Uid: ( 1000/    user)   Gid: ( 1000/    user)
Access: 2026-09-03 12:28:05.510440866 +0000
Modify: 2026-09-03 12:32:04.602216874 +0000
Change: 2026-09-03 12:32:04.602216874 +0000
 Birth: 2026-09-02 07:37:41.595715171 +0000

$ hexdump -C hello.txt
00000000  68 65 6c 6c 6f 20 77 6f  72 6c 64 0a 6e 65 77 20  |hello world.new |
00000010  6c 69 6e 65 20 61 64 64  65 64 00 00 00 00 00 00  |line added......|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000400

As you can see, the size of the file was 26 bytes, after the truncate, the file size is 1024 bytes. The hexdump command display also the new space added filled with 0 only.

Locking and Unlocking File

WARNING: this part of the article is not working as expected, for some reasons I don't currently understand. The following code is presented as is, and should be used with care.

To avoid editing a file at the same time than another process, the file used can be locked (and unlocked). To lock it, the lock() and lockSync() methods can be used. To unlock it, the unlock() and unlockSync() methods can be used.

Locks the byte range from start to end of the file, with the byte at position end not included. If no arguments are specified, the full file is locked, If only start is specified the file is locked from byte position start to the end of the file, no matter how large it grows. It is possible to specify an explicit value of end which is past the current length of the file.

-- lock abstract method

Four blocking modes exist:

handlerManager("./hello.txt", FileMode.write, (RandomAccessFile fh) async {
  printLength(fh);
  printPosition(fh);
  fh.lockSync(FileLock.blockingExclusive);

  await Future.delayed(Duration(seconds: 4), () => "ok");

  printLength(fh);
  printPosition(fh);
  fh.unlockSync();
});

Future.delayed(Duration(seconds: 2), () {
    handlerManager("./hello.txt", FileMode.append, (RandomAccessFile fh) async {
    printLength(fh);
    printPosition(fh);

    fh.writeStringSync("test");

    printLength(fh);
    printPosition(fh);
  });
});

$ echo hello world > hello.txt

$ dart run
> open File: './hello.txt'
> length: 0
> position: 0
> open File: './hello.txt'
> length: 0
> position: 0
> length: 4
> position: 4
> close File: './hello.txt'
> length: 4
> position: 0
> close File: './hello.txt'

Reading the documentation and testing this feature could be a good idea if you want to use it for your project, because the behaviors differs between the supported platform by Dart. The behavior on Linux/MacOS is not the same than the one on Windows for example.

Note: while testing the locking feature, I was unable to see the difference between a file locked or not. I tried to open the file with another process and write some data, no errors were reported on both side. I checked the test suite to understand how it was working, here the sources:

I assume - but I'm probably wrong - the Dart implementation is using lockf POSIX function to lock a file on Linux, but this function was not found in the SDK source code. Then, fcntl was perhaps the one used, lockf is just an interface to it. Unfortunately, the code using this function does not seem to be involved in file locking. The last one to check was flock, and I think it was the right one. The locking feature is implemented in runtime/bin/file_linux.cc and uses flock.

Anyway, it was not expected, and some tests with the POSIX interface in C will be required to correctly understand how the file locking is working there. The future tasks:

try to create shared and exclusive lock on a file, it should fail;
try to create an exclusive lock on a file, and with another program, try to edit it, it should fail;
do both implementation in C/Dart and compare the results.

Fun right?

File Descriptor Exhaustion

Learning from mistakes is a hard way to know what's happening when something's bad happens. Instead of waiting for this kind of bug, let create an application using all file descriptors available and crashing. The ulimit builtin command can usually be used to check those limits. On BSD, one will also need to check the login.conf.

$ ulimit -a
real-time non-blocking time  (microseconds, -R) unlimited
core file size              (blocks, -c) 0
data seg size               (kbytes, -d) unlimited
scheduling priority                 (-e) 0
file size                   (blocks, -f) unlimited
pending signals                     (-i) 3798
max locked memory           (kbytes, -l) 8192
max memory size             (kbytes, -m) unlimited
open files                          (-n) 1024
pipe size                (512 bytes, -p) 8
POSIX message queues         (bytes, -q) 819200
real-time priority                  (-r) 0
stack size                  (kbytes, -s) 8192
cpu time                   (seconds, -t) unlimited
max user processes                  (-u) 3798
virtual memory              (kbytes, -v) unlimited
file locks                          (-x) unlimited

$ ulimit -n
1024

$ ulimit -n 10

import 'dart:io';

void main() async {
  List<RandomAccessFile> store = [];
  File file = File("./t");

  while (true) {
    print(store.length);
    RandomAccessFile fh = await file.open(mode: FileMode.read);
    store.add(fh);
  }
}

$ dart run
1
2
3
...
1015
Unhandled exception:
FileSystemException: Cannot open file, path = './t' (OS Error: Too many open files, errno = 24)
#0      _checkForErrorResponse (dart:io/common.dart:58:9)
#1      _File.open.<anonymous closure> (dart:io/file_impl.dart:438:7)
<asynchronous suspension>
#2      exhaustion (file:///home/user/tmp/cboring/bin/cboring.dart:33:27)
<asynchronous suspension>

This is not the only value to check. Other limits can have an impact on the stability of the application, like the number of file locks (ulimit -x) or the file size (ulimit -f). The file quota can also be a source of crashes. So, it's always a good idea to check the limits imposed by the system in case of issues.

Note: it seems the limits can't be accessed via Dart. I was unable to find a reference to getrlimit or setrlimit functions. In fact, not really, but the only references to them are from tools/utils.py, in Python, so, outside of the Dart scope. I assume then Dart is unable to get or set limits.

Conclusion

Reading and writing files are not an easy job even if the interfaces provided are quite simple. This article wanted to show the different methods available to deal with the files and the potential issues one can found. In fact, the interfaces provided by Dart is similar to the one provided by the libc, with oriented object flavor. As usual if you want to know more about that, here few links to extend your knowledge of this API. Unfortunately, it seems not a lot of people are talking about this API...

Happy hacking and have fun!

Cover Image by Khoiru Abdan on Unsplash

File System Management in Dart

Mathieu Kerjouan — Tue, 01 Sep 2026 10:00:00 +0000

It's a good time to also investigate a bit the dart I/O interfaces, especially the one related to files. The dart:io package must be imported to deal with files and directories in Dart.

import 'dart:io';

A file in Dart is an object instantiated by the File class. This object can be created by simply invoking the default constructor, where its argument will be a String.

// default constructor can be used
// to create a new object pointing to
// a local file.
File myFile = File("./file1.test");

fromRawPath() is another constructor, it opens a file based on an List<Uint8> (Uint8List), this kind of data is usually generated by utf8.encode or ascii.encode.

// fromRawPath constructor can be used
// to open a file based on a raw path,
// an Uint8list.
File myFile2 = File.fromRawPath(
  ascii.encode("./file2.test");
);

Finally, the fromUri() constructor will open a file based on an Uri object.

// fromUri is another construct that
// can be used to open a file based on
// an Uri.
File myFile3 = File.fromUri(
  Uri.file("./file3.test")
);

Now the file object has been created, many attributes and methods are available to control it. Let check first the attributes. In the previous examples, all objects are using a relative path, when the object is returned, the absolute path attribute is set. It is the absolute path representation of the data previously passed.

print(myFile1.absolute);
print(myFile2.absolute);
print(myFile3.absolute);

$ dart run
File: '/home/user/tmp/cboring/./file1.test'
File: '/home/user/tmp/cboring/./file2.test'
File: '/home/user/tmp/cboring/file3.test'

The original path passed as first argument can be retrieved with the path attribute.

print(myFile1.path);
print(myFile2.path);
print(myFile3.path);

$ dart run
./file1.test
./file2.test
file3.test

The file object can also returns an Uri object with the help of the uri attribute.

// this is a closure helper to show
// the properties from an Uri object and
// return them as a Map.
final toMap = (Uri uri) {
  return {
    "scheme": uri.scheme,
    "host": uri.host,
    "path": uri.path,
    "fragment": uri.fragment,
  };
 };

print(toMap(myFile1.uri));
print(toMap(myFile2.uri));
print(toMap(myFile3.uri));

$ dart run
{scheme: , host: , path: file1.test, fragment: }
{scheme: , host: , path: file2.test, fragment: }
{scheme: , host: , path: file3.test, fragment: }

Another interesting property exposed by the File object is the parent one (usually a directory).

print(myFile1.parent);
print(myFile2.parent);
print(myFile3.parent);

$ dart run
Directory: '.'
Directory: '.'
Directory: '.'

Let creates a small closure to summarize and display all those information into a Map.

final fileToMap = (File file) {
  return {
    'absolute': file.absolute,
    'hashCode': file.hashCode,
    'isAbsolute': file.isAbsolute,
    'parent': file.parent,
    'path': file.path,
    'runtimeType': file.runtimeType,
    'uri': toMap(file.uri),
  };
};

print(fileToMap(myFile1));
print(fileToMap(myFile2));
print(fileToMap(myFile3));

{absolute: File: '/home/user/tmp/cboring/./file1.test', hashCode: 554905050, isAbsolute: false, parent: Directory: '.', path: ./file1.test, runtimeType: _File, uri: {scheme: , host: , path: file1.test, fragment: }}
{absolute: File: '/home/user/tmp/cboring/./file2.test', hashCode: 224769083, isAbsolute: false, parent: Directory: '.', path: ./file2.test, runtimeType: _File, uri: {scheme: , host: , path: file2.test, fragment: }}
{absolute: File: '/home/user/tmp/cboring/file3.test', hashCode: 467382617, isAbsolute: false, parent: Directory: '.', path: file3.test, runtimeType: _File, uri: {scheme: , host: , path: file3.test, fragment: }}

The next part is to investigate around the methods available. One of the most important is probably the exists() method, which returns if a file exist or not. Another one called existsSync() is also available, and will return a boolean instead of a Future because of its synchronous nature. In fact, most of the following methods will also have their synchronous function if needed. Let creates two of those files first, file1.test and file2.test.

$ touch file{1,2}.test

$ dd if=/dev/random of=file1.test count=1024 bs=8
1024+0 records in
1024+0 records out
8192 bytes (8.2 kB, 8.0 KiB) copied, 0.00502157 s, 1.6 MB/s

$ dd if=/dev/random bs=8 count=1024 \
   | perl -ane '
     BEGIN{@s}; 
     map {push(@s, $_)} 
         grep {$_=~/^[a-zA-Z0-9]$/}
         split(//, $_); 
     if (@s>64) {
       $line = join("", @s[0..64]);
       print $line."\n";
       @s=(); 
     }' \
   > file2.test
1024+0 records in
1024+0 records out
8192 bytes (8.2 kB, 8.0 KiB) copied, 0.0112288 s, 730 kB/s

The previous command is maybe a bit hard to understand for someone without Perl experience. In short, we are filtering the output from /dev/random to extract only characters matching the alphabets or numbers. Using other commands would have do the work as well, but I wanted to do a bit of Perl today.

print(myFile1.existsSync());
print(await myFile1.exists());

print(myFile2.existsSync());
print(await myFile2.exists());

print(myFile3.existsSync());
print(await myFile3.exists());

$ dart run
true
true
true
true
false
false

Now few files have been created, one using binaries and another one using text-like random data, it will be interesting to check the next methods. Let check the length() method, it should return the size of a file.

final fileSize = (File file) async {
  try {
    final size = await file.length();
    print("$file.path: $size");
  }
  catch (e) {
    print("$file.path: $e");
  }
};
fileSize(myFile1);
fileSize(myFile2);
fileSize(myFile3);

$ dart run
File: './file1.test'.path: 8192
File: './file2.test'.path: 1122
File: 'file3.test'.path: PathNotFoundException: Cannot retrieve length of file, path = 'file3.test' (OS Error: No such file or directory, errno = 2)

When a file does not exist, the function throw a PathNotFoundException exception. Then, it's important to check the existence of the file before executing these methods. Let do the same test with the stat() method. It should return a FileStat object.

final fileStat = (File file) async {
  try {
    final stat = await file.stat();
    print({
      'accessed': stat.accessed,
      'changed': stat.changed,
      'mode': stat.mode,
      'modified': stat.modified,
      'size': stat.size,
      'type': stat.type,
    });
  }
  catch (e) {
    print("$file.path: $e");
  }
};
fileStat(myFile1);
fileStat(myFile2);
fileStat(myFile3);

$ dart run
{accessed: 2026-08-31 14:15:14.163, changed: 2026-08-31 14:15:14.163, mode: 33204, modified: 2026-08-31 14:15:14.163, size: 8192, type: file}
{accessed: 2026-08-31 14:15:40.139, changed: 2026-08-31 14:15:40.139, mode: 33204, modified: 2026-08-31 14:15:40.139, size: 1122, type: file}
{accessed: 1970-01-01 00:00:00.000Z, changed: 1970-01-01 00:00:00.000Z, mode: 0, modified: 1970-01-01 00:00:00.000Z, size: -1, type: notFound}

Interesting. When executing the stat() method, no exceptions are thrown. I would expect the same behavior than the length() method, but it seems it's not the case. More investigation is required to know why it does that, but the object returned got a notFound type. My guess is, if you are lazy to check for the exceptions, using the stat() looks to be the right way. Our file3.test still does not exist, let create it using the create() method and check what will happen for the 2 others files already created.

final fileCreate = (File file) async {
  try {
    final created = await file.create();
    print(created);
  }
  catch (e) {
    print("$file.path: $e");
  }
};

fileCreate(myFile1);
fileCreate(myFile2);
fileCreate(myFile3);

$ dart run
File: './file1.test'
File: './file2.test'
File: 'file3.test'

When a file is already present on the file system, calling the create() does nothing apparently. Now all these files are created and contains some data (or not), it's the moment to open() them.

print(await myFile1.open());
print(await myFile2.open());
print(await myFile3.open());

$ dart run
Instance of '_RandomAccessFile'
Instance of '_RandomAccessFile'
Instance of '_RandomAccessFile'

It returns a RandomAccessFile object, we will talk about it later, but with this object, a file can be closed via the close(). A good practice is to always ensure an opened file is closed in some way when it is not used anymore to avoid file descriptor exhaustion. Anyway, this returned object is important if you have operations to execute in a long living process. How to deal with this object will be the topic of another article. For now, reading or writing data in one single step will be enough.

The readAsBytes(), readAsLines(https://api.dart.dev/dart-io/FileSystemEntity/readAsLines.html) and readAsString() have been created for this purpose, read a whole file, return its content and automatically close it.

The readAsBytes() method returns a List<Uint8>, perfect to deal with myFile1 containing binary data. The readAsString() method returns a String, perfect to read the content of myFile2 containing alphanumerical characters. The readAsLines() method can also be used, it will return a List<String>, each lines being separated by \n.

print("myFile1:");
print((await myFile1.readAsBytes()).take(10));
print("myFile2:");
print((await myFile2.readAsString()).substring(0,10));
print("myFile2:");
print((await myFile2.readAsLines()).take(2));

$ dart run
myFile1:
(193, 10, 109, 2, 103, 107, 37, 10, 146, 214)
myFile2:
n2ZBmrSIql
myFile2:
(n2ZBmrSIqlF6M0P0JEMN3SKpR4kn1vGXKBH4KVNJK8x6cfvzZ8o9oc6f70kpmCNQn, X86yRGL4f2xJi0o4sbIWOWWZikO09dTNwC9Pt9ltOHLqByFLc847YeGk6gXlSDuGc)

The same methods exist to write data to a file, with the writeAsBytes() and writeAsString() ones. To avoid overwriting the data present in myFile1 and myFile2, some data will be added to myFile3, the only empty file.

await myFile3.writeAsBytes(ascii.encode("new data added"));
print(await myFile3.readAsString());

await myFile3.writeAsBytes([0x41, 0x42, 0x43]);
print(await myFile3.readAsString());

await myFile3.writeAsString("this is a string");
print(await myFile3.readAsString());

$ dart run
new data added
ABC
this is a string

A file can also be copied with the copy() method by defining the path of a new file as first argument.

File myFile1Copy = await myFile1.copy(myFile1.path + ".copy");
print(fileToMap(myFile1Copy));
fileStat(myFile1Copy);

File myFile2Copy = await myFile2.copy(myFile2.path + ".copy");
print(fileToMap(myFile2Copy));
fileStat(myFile2Copy);

File myFile3Copy = await myFile3.copy(myFile3.path + ".copy");
print(fileToMap(myFile3Copy));
fileStat(myFile3Copy);

$ dart run
{absolute: File: '/home/user/tmp/cboring/./file1.test.copy', hashCode: 934827110, isAbsolute: false, parent: Directory: '.', path: ./file1.test.copy, runtimeType: _File, uri: {scheme: , host: , path: file1.test.copy, fragment: }}
{accessed: 2026-09-01 03:57:26.553, changed: 2026-09-01 03:58:34.207, mode: 33204, modified: 2026-09-01 03:58:34.207, size: 8192, type: file}
{absolute: File: '/home/user/tmp/cboring/./file2.test.copy', hashCode: 1050809529, isAbsolute: false, parent: Directory: '.', path: ./file2.test.copy, runtimeType: _File, uri: {scheme: , host: , path: file2.test.copy, fragment: }}
{accessed: 2026-09-01 03:57:26.553, changed: 2026-09-01 03:58:34.235, mode: 33204, modified: 2026-09-01 03:58:34.235, size: 1122, type: file}
{absolute: File: '/home/user/tmp/cboring/file3.test.copy', hashCode: 604940007, isAbsolute: false, parent: Directory: '.', path: file3.test.copy, runtimeType: _File, uri: {scheme: , host: , path: file3.test.copy, fragment: }}
{accessed: 2026-09-01 03:57:26.585, changed: 2026-09-01 03:58:34.235, mode: 33204, modified: 2026-09-01 03:58:34.235, size: 16, type: file}

$ ls -l *.test *.copy
-rw-rw-r-- 1 user user 8192 Aug 31 14:15 file1.test
-rw-rw-r-- 1 user user 8192 Sep  1 03:58 file1.test.copy
-rw-rw-r-- 1 user user 1122 Aug 31 14:15 file2.test
-rw-rw-r-- 1 user user 1122 Sep  1 03:58 file2.test.copy
-rw-rw-r-- 1 user user   16 Aug 31 18:32 file3.test
-rw-rw-r-- 1 user user   16 Sep  1 03:58 file3.test.copy

Renaming a file is also possible by using the rename() method by setting the new path of the file in the first argument.

File myFile1Rename = await myFile1Copy.rename(myFile1.path + ".new");
print(fileToMap(myFile1Rename));
fileStat(myFile1Rename);

File myFile2Rename = await myFile2Copy.rename(myFile2.path + ".new");
print(fileToMap(myFile2Rename));
fileStat(myFile2Rename);

File myFile3Rename = await myFile3Copy.rename(myFile3.path + ".new");
print(fileToMap(myFile3Rename));
fileStat(myFile3Rename);

$ dart run
{absolute: File: '/home/user/tmp/cboring/./file1.test.new', hashCode: 913418505, isAbsolute: false, parent: Directory: '.', path: ./file1.test.new, runtimeType: _File, uri: {scheme: , host: , path: file1.test.new, fragment: }}
{absolute: File: '/home/user/tmp/cboring/./file2.test.new', hashCode: 515199967, isAbsolute: false, parent: Directory: '.', path: ./file2.test.new, runtimeType: _File, uri: {scheme: , host: , path: file2.test.new, fragment: }}
{accessed: 2026-09-01 03:57:26.553, changed: 2026-09-01 04:02:28.533, mode: 33204, modified: 2026-09-01 04:02:28.533, size: 8192, type: file}
{accessed: 2026-09-01 03:57:26.553, changed: 2026-09-01 04:02:28.533, mode: 33204, modified: 2026-09-01 04:02:28.533, size: 1122, type: file}
{absolute: File: '/home/user/tmp/cboring/file3.test.new', hashCode: 783500576, isAbsolute: false, parent: Directory: '.', path: file3.test.new, runtimeType: _File, uri: {scheme: , host: , path: file3.test.new, fragment: }}
{accessed: 2026-09-01 03:57:26.585, changed: 2026-09-01 04:02:28.533, mode: 33204, modified: 2026-09-01 04:02:28.533, size: 16, type: file}

$ ls -l *.test *.copy *.new
ls: cannot access '*.copy': No such file or directory
-rw-rw-r-- 1 user user 8192 Aug 31 14:15  file1.test
-rw-rw-r-- 1 user user 8192 Sep  1 04:02  file1.test.new
-rw-rw-r-- 1 user user 1122 Aug 31 14:15  file2.test
-rw-rw-r-- 1 user user 1122 Sep  1 04:02  file2.test.new
-rw-rw-r-- 1 user user   16 Aug 31 18:32  file3.test
-rw-rw-r-- 1 user user   16 Sep  1 04:02  file3.test.new

When a file is not needed anymore, it is also possible to remove it from the filesystem with the delete() method. It will return a FileSystemEntity object (a superclass of File). If the File object to remove is a directory, the recursive parameter can be set to remove all files recursively present in it.

print(await myFile1Rename.delete());
print(await myFile2Rename.delete());
print(await myFile3Rename.delete());

$ dart run
File: './file1.test.new'
File: './file2.test.new'
File: 'file3.test.new'

$ ls -l *.test *.copy *.new
ls: cannot access '*.copy': No such file or directory
ls: cannot access '*.new': No such file or directory
-rw-rw-r-- 1 user user 8192 Aug 31 14:15  file1.test
-rw-rw-r-- 1 user user 1122 Aug 31 14:15  file2.test
-rw-rw-r-- 1 user user   16 Aug 31 18:32  file3.test

Finally, the last method to see is the watch() method. This one is probably one of the most interesting to investigate. The idea is to subscribe to the filesystem to follow the activity on a file, when a change happens, the Stream object receives an event from it . On Linux, it uses the inotify API interface.

final timeout = () {
  Duration delay = Duration(seconds: 10);
  final action = () => exit(1);
  Future.delayed(delay, action);
};
timeout();

File toWatch = File("./watcher");
toWatch.create();
Stream watcher = await toWatch.watch();
watcher.listen((event) {
  print(event);
});

The code below is a bit more complex than usual. A timeout closure is defined, it will stop the application after 10 seconds by calling the exit() function. When watching a file in the main thread, the program will simply wait for event forever, the timeout closure has been created to avoid being stuck in this loop.

Then, the ./watcher file is created, and the watcher Stream is attached to it. Because it's a standard Stream, one can listen() on event on it and do some actions.

It's now possible to modify the file from another shell to see the changes happening while the application is running.

$ echo test > watch.test

$ echo test > watch.test

$ echo test > watch.test

$ rm watcher

$ dart run
FileSystemModifyEvent('./watcher', isDirectory=false, contentChanged=true)
FileSystemModifyEvent('./watcher', isDirectory=false, contentChanged=true)
FileSystemModifyEvent('./watcher', isDirectory=false, contentChanged=true)
FileSystemModifyEvent('./watcher', isDirectory=false, contentChanged=true)
FileSystemModifyEvent('./watcher', isDirectory=false, contentChanged=true)
FileSystemModifyEvent('./watcher', isDirectory=false, contentChanged=true)
FileSystemModifyEvent('./watcher', isDirectory=false, contentChanged=false)
FileSystemDeleteEvent('./watcher')

The FileSystemEvent object returned identify the event applied to the file. It can be set to create, delete, modify or move. Few of them will be only displayed when following the activity on a directory. For example, removing a file while watching it, and then recreate it will not work, but this action can be seen when watching a directory.

Conclusion

At first, this post was planned to be a simple, quick and dirty introduction to file management in Dart in another article. In fine, it became a really long explanation about the whole file system API. The abstraction offered by Dart is coherent, simple and stable. In few lines of code, one can easily create, rename or delete files, but also read or write data from them. The support for the iNotify API is a really good thing. As usual, a list of references if you want to dig a bit more:

Happy hacking and have fun!

Cover Image by Kelly Sikkema on Unsplash

WeeklyReview#202635

Mathieu Kerjouan — Mon, 31 Aug 2026 10:00:00 +0000

Finally, someone said it loudly on a podcast, the open-source communities are full of f* goblin with a shitty mindset destroying the hobbyist fun and blocking the real innovation from hackers/engineers by forcing other people to be agree with their political point of view. It's refreshing to watch a short video on this topic, because it was one of the most important reason I did not participate anymore on Open-source projects, especially BSD systems. This guy is doing a great summary: we don't care of your sex, gender, political beliefs or your age. We are hobbyist, hackers, engineers. We are fixing problems by giving solutions. We are NOT involved in politic, and if it's the case, this is not the place to talk about it. In France, during family meeting, we are trying to avoid few topics: religion, politic and most of the controversial news. Why? By To avoid conflict(s) during a time where everyone can be there. It's rare. It's precious. It's called respect. Be respectable, and everything will be fine.

About my posts on this "public note pad". The first articles were focused on learning Dart and Flutter, they were kinda short, and based on documentation, tutorials, tests and examples. The next publications are way more complex, and will involve more knowledge and tests on my side. In fact, one of my project (and future product) was already delayed of one month due to the many - unexpected - things I did during July and August. Anyway, not a promise, just a quick note to explain my current situation.

About dev.to, a quick feedback. I'm now using it for all my technical publication and to be honest, it's not the best place to put your information. In 3 or 4 months, the service was down many time. When editing a long article, sometimes the modifications are not saved on the server side (happened to me many time, and it's... ANNOYING). How a service like that can host so many authors? Where is the reliability? I wanted to avoid doing my own servers, but I think that's what we got for a free service.

Coding

📝 Bringing Primary Constructors to Dart: after the 3.13 version, it will be now possible to use the new keyboard to define named/unnamed constructor as well as factory. Example:

class A {
  new();
  new create();
}

class B {
  factory () { }
  factory create() { }
}

📝 Introducing the Desktop Windowing API for Flutter: Learn about the design behind the new Desktop Windowing API and write your first multi-window Flutter application.

System

📝 net-tools to iproute cheat sheet: a nice way to remember the commands between ip and the legacy net-tools packages (including ifconfig) on Linux. The same should be done between Linux, BSDs and MacOS.

🏗️ MemProcFS: MemProcFS is an easy and convenient way of viewing physical memory as files in a virtual file system.

🏗️ Beyla project: eBPF-based autoinstrumentation of web applications and network metrics. An interesting tool to collect metrics on web server using eBPF (so, linux-only), the documentation looks good as well. I was looking for something similar few years ago, to collect network metrics.

🏗️ The Goodmans Kernel project: Run unsigned kernel payloads in a signed kernel driver via wasm3. No JIT/W^x (HVCI/etc., compliant)

🏗️ kubectl x project: A kubectl plugin that runs commands against every context in your kubeconfig file in parallel.

🏗️ ipatool project: Command-line tool that allows searching and downloading app packages (known as ipa files) from the iOS App Store

📝 Reverse Engineering: How we bypassed CoreML and talked directly to the hardware: a series of article about Apple M1 CPU ANE graph execution engine, and how to bypass CoreML interface.

📝 How to Build Smaller Container Images: Docker Multi-Stage Builds: A tutorial to build small sized containers with docker multi stage, using node.js as example.

Network

🌐 Who Am I: another "what's my ip" service, displaying more information than usual. I like it.

Security

📝 Decrypting and analyzing HTTPS traffic without MITM: a way to decrypt HTTPS traffic using PCAP and BURP SUITE.

📝 How Easy Is It to Scan a Contactless Payment and Access Card?: a post about NFC scanning and cloning.

📝 Smart Glasses Can Record You – And Detecting Them Isn’t So Simple: those glasses can potentially be detected using bluetooth but it depends on the manufacturers (and the spec). When the glasses are connected, they are not broadcasting data anymore.

📝 Reversing TP-Link EX220 from A1: a quick article about reversing a firewall/router.

🏗️ PE-bear project: a multiplatform reversing tool for PE files. Its objective is to deliver fast and flexible “first view” for malware analysts, stable and capable to handle malformed PE files. see also the author's blog.

📝 The Linux Kernel Is Approaching 2,000 CVEs Per Release: I don't really think the Linux kernel will be able to stay in the game with its current structure. The only good answer would have been to use a micro-kernel (Linux is a Minix-clone), it's simpler, easier to maintain and in fine, more isolated. What's scary here is the amount of unpatched old-Linux still running everywhere. I don't know what will happen in the future, but the old mantra "Linux is safer than Windows" is going to break.

📝 Vulnerability Research on Bitdefender's Antivirus Engine: the first part of a series of article about antivirus analysis and fuzzing. The last sections of this publication are talking about fuzzing BitDefender with honggfuzz. I'm waiting for the next part!

Security/Cryptography

📝 Time as a Key: Breaking Rhysida Ransomware with the Attacker’s Own Ciphertext: the story behind the Rhysida Ransomware. A X/twitter thread and a simplified version of the story by the author can be read. In short, the IV (initialization vector) and the keys are generated using the rand function (derived from srand function). Those functions are both linked to the time function, and when executed many times or in parallel, this function return the same value. If one knows the seed (the parameter passed to the srand function), then one is able to decipher encrypted files. The analysis from the paper, the blog post and the x/twitter thread is amazing. A must read.

🏗️ Crypto 101: the book: The source code of the Crypto101 book. Nothing to add, just a good reference.

📝 Blood MERIDIAN: LLM cryptanalysis of a blockcipher that is isn't a blockcipher: an interesting LLM session using GPT-5.6 Sol to break a "blockcipher" (MERIDIAN). No test vectors have been shared on the specification, and the LLM found an issue.

📝 Compromising Signal's Contact Discovery Enclave: V12 found two critical object-lifetime vulnerabilities that allow the untrusted host server to break the enclave boundary.

📝 Privacy Pools: Anatomy of a 53-bit Entropy Collapse: a type coercion bug reducing the entropy of master keys from 256 bits to 53 bits. interesting post-mortem and analysis.

📝 Into the Dark - DarkSword Kernel Exploit Writeup: a post about iOS DarkSword vulnerability (CVE-2025-43520). It uses an exploitable race condition in the virtual file system to allocate kernel memory. Really interesting, but a bit complex to follow on my side, I don't really know how iOS is working under the hood.

📑 Regev’s Attack on Hyperelliptic Cryptosystems: Hyperelliptic curves (yet another thing I don't know) are an alternative to ECC. I simply read the introduction, to know what a "hyperelliptic curve" was. It looks complex, like the elliptic curves.

Security/BlueTeam

🏗️ Sliver project: "an open source cross-platform adversary emulation/red team framework, it can be used by organizations of all sizes to perform security testing. Sliver's implants support C2 over Mutual TLS (mTLS), WireGuard, HTTP(S), and DNS and are dynamically compiled with per-binary asymmetric encryption keys."

Security/RedTeam

📑 Tips and Scripts for Reconnaissance and Scanning: an old publication listing methods to scan hosts.

🌐 RatCTF: yet another capture the flag challenges website.

▶️ Hacking hardware security key into an air-gap-jumping worm: the hidden features of a YubiKey: using yubikeys as attack vector by using logical usage modification to propagate worms (or take control of devices). The full talk can be seen on Youtube.

📝 Web App Hacking: Six Tools for Bug Hunters: a list of tools to find bugs on web application, gospider (webcrawling/spider), SecretFinder (discover sensitive information), jsluice (javascript source code secret extractor), xnLinkFinder (discovering tool), Dalfox (XSS scanner), Caido (web audit tool).

🏗️ DFIR-LAB project: a compilation of challenges that aims to provide practice in simple to advanced concepts in the following topics: Digital Forensics, Incident Response, Malware Analysis and Threat Hunting.

🏗️ InfraGuard project: Red team infrastructure tracker and C2 redirector -- a modern alternative to RedWarden. InfraGuard sits between the internet and your C2 teamserver, validating every inbound request against your malleable C2 profile and blocking anything that doesn't conform. Scanners, bots, and blue team probes get redirected to a decoy site while legitimate beacon traffic passes through to your teamserver.

🌐 KitPloit: Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

📝 Open Source Intelligence (OSINT): Using Osiris for Global Intelligence: an article on the open-source Osiris, a tool, used to collect global information (e.g. cctv, aircraft, critical infrastructure, dangerous zone...). Kinda interesting and can run locally.

Update/Upgrade

🔄 Unifi Security Advisory Bulletin 067: 22 critical security issues to patch, with CVSS score >8. Kudos for the one with a score of 10.

🔄 Announcing Dart 3.13, Bringing conciseness and simplicity to Dart codebases, tooling, and platforms.: Primary constructors, improvement of the dart formatter and much more.

🔄 Elixir v1.19.6 security release: this release patch the CVE-2026-75758, allowing an attacker to crash a node by memory exhaustion with the help of an unsanatized char list used in IO.inspect/1 function. This function is used by the Logger module (see translator.ex) to print Elixir/Erlang data-structure. It would be fun to try exploiting it in some way.

🔄 QSB-118: Dom0 arbitrary code execution in qvm-copy-to-vm error reporting: in short, a wrongly sanitized string from a compromised qube (domU) can be used to execute arbitrary code in dom0. The sanitizer is not removing the backtick character from the filename, leading to arbitrary code execution via the system() function. A dirty bug impacting all QubeOS version.

Embedded

📝 Baochip-1x: A Mostly-Open, 22nm SoC for High Assurance Applications: a security chip made by Bunnie, project created via the betrusted initiative.

📝 Redesigning my microkernel from the ground up: an experimental microkernel inspired by Sel4, called ares, which is a full rewrite of helios. This article also talks a bit about bunnix, an Unix-like OS implemented by the same author.

▶️ Extracting Firmware from Embedded Devices (SPI NOR Flash): a really great video about extracting firmware, using NOR Flash via SPI protocol bus with the help of a logical analyzer (saleae) and hydrabus. In short, this is a man in the middle attack by reading the data directly from the microcontroller to the memory.

📟 $299 Arduino Ventuno Q SBC combines Qualcomm Dragonwing IQ8 SoC and STM32H5 MCU: Quick introduction to the Arduino Ventuno Q, Octa-core Kryo Gen 6, Adreno A623, 16GB LPDDR5, 64GB eMMC flash, M.2 socket for NVMe Gen4 SSD, 2.5GbE RJ45 port.

📟 AT LoRa USB Dongle: USB device that lets you send and receive LoRa wireless data using simple AT commands. No coding needed. Good for testing and development.

🌐 Free RF Tools for Engineers, Radio Amateurs & Students: A long list of tools to help with calculations, design and so on for RF engineers and radio amateurs.

📝 Building A Headless Game Boy Emulator: great project with an ESP32! the ESP32 here is used as server, offering an access to the emulator on Wifi. Other people can also play as well.

Misc

📝 The end of IPFS at Shipyard: P2P distributed storage is hard to maintain, I know this by experience with one of my last mission. The infrastructure cost is huge, even more if no one knows how to deploy really low-cost distributed systems around the world. IPFS is impacted as well by those issues, and when one partner is leaving, it will be hard to continue. I hope IPFS will not shutdown because of that, it's a great technology and it would be really sad to see it disappears.

📟 noah5b motherboard: I wanted to upgrade my firewall (an old PC ENGINE APU2) and just learnt PC Engine will not produce them anymore. Instead, Broachlink will offer similar motherboards called Noah. This is looking great, and are not so expensive ¹
² ³ ⁴ (between €300 and €400). Linux drivers are available on Github.

📝 Crypto ATM operator Bitcoin Depot files for bankruptcy: the world largest cryptocurrency ATM is filed with bankruptcy due to fraud allegations (hundred millions of dollars annually). $389 millions dollars lost due to scams, involving Bitcoin Depot machines. In 2025, $1.5 million scams transactions had passed through hundred of ATMs.

🏗️ GTA 6 Leaks & Cyberleek Investigation Report: a repository containing the complete investigation of the GTA 6 leaks.

📟 Openterface KeyMod, Pocket USB multi-tool bridge for tech, professionals and gaming: interesting concept to transform a smartphone into many different input device.

📝 Two Alleged ‘TeamPCP’ Hackers Arrested in Australia: arrested due to multiple information leaks from SpyCloud, RaidForums, Nulled, and a gmail address used on many other website. Being anonymous on the web is nearly impossible, even for the scammers and criminals. A Risky Business podcast is talking about this story.

🌐 privatekeys.info: a "game" to crack bitcoin and ethereum private key. Pick a number between 1 and pow(2, 256) and voilà, you are now rich and famous!

🏗️ trustmebro project: Bypass llm guardrails by confusing it with fabricated tool output.

Legend:

symbol	usage	example
▶️	video	youtube
🏗️	project	git repository
📝	informal publication	blog post
🎥	live	twitch
🏛️	definition	wikipedia
🌐	regular website	-
📑	academic or scientific publication	arxiv
🔄	software new release, update or ugprade	-
📟	device	embedded hardware

Cover Image by Didier VEILLON on Unsplash

Noah 5 TPM 2.0 Firewall Router Motherboard Intel E3845, 8GB RAM (€326.80) ↩
Noah 5 Firewall Router Motherboard Intel E3845, 8GB RAM, Fanless (€313.50) ↩
Broachlink NOAH6 Intel E3845 3RJ45 1SFP Pfsense Firewall Mainboard Embedded Server Motherboard VPN Router Motherboard with SFP (€103) ↩
Noah 5 Firewall Router Motherboard Intel E3845, 4 cores 1.91 GHz (€180) ↩

Q&D: Dart/Flutter Formatter, Linter and Analyzer

Mathieu Kerjouan — Sat, 29 Aug 2026 08:00:00 +0000

A clean project following conventions is way better than a crappy project containing yolo code. In Dart and Flutter, everything is already available to make your life easier.

Formatter

A formatter is already present with the Dart SDK. The command dart format will do the job. If one wants to see only the modification without applying them:

$ dart format show

The dart format is a shortcut for dart format write, meaning it will apply all changes by default.

$ dart format write

More information can be available here:

Dart Format from the official Dart Documentation;
Flutter Formatting from the official Flutter documentation
Dart Style FAQ from the Official Dart Wiki.

Analyzer

An analyzer is also present by default with the SDK. The command dart analyze will analyze the code and print all potentials issues to fix.

$ dart analyze

The same command is available with Flutter, only the output will change a bit.

$ flutter analyze

More information can be found there:

Dart Analyze from the Official Dart Documentation;
Dart Analyzer Package on pub.dev;
Dart Analyze Source Code from the official Dart Github Repository.

Auto Fix

It's also possible to auto-fix the issues by using the dart fix command. It was never a good idea to apply those kind of commands in the past, and to be honest, I am not a big fan of that, but here how to use them anyway:

$ dart fix --dry-run

$ dart fix --apply

More information can be found on the Dart Fix page from the Official Dart Documentation website.

Execution

Unfortunately, it seems Dart and Flutter cannot create command aliases or shortcut via the pubspec.yaml to execute recurrent commands like it can be found on Mix, rebar3 or even npm. In this case, using a Makefile can do the job. Here the one created for my project:

# GNU Makefile
EMULATOR_ANDROID ?= NameOfTheAndroidEmulator

.PHONY += all
all: test run-android

.PHONY += format
format:
        dart format .

.PHONY += analyze
analyze:
        flutter analyze .

.PHONY += test
test: format analyze
        flutter test

.PHONY += run-android
run-android:
        flutter emulators --launch $(EMULATOR_ANDROID)

.PHONY: $(.PHONY)

To format the code:

$ make format

To analyze the code:

$ make analyze

To test the code:

$ make test

Github pre-commit Hook

Before doing a git commit, it is also nice to check if everything is correct. Here a short script to execute the previous command:

$ touch .git/hooks/pre-commit

$ chmod +x .git/hooks/pre-commit

$ cat > .git/hooks/pre-commit <<EOF
#!/bin/sh
set -e

make test
EOF

Have fun and happy hacking!

Cover Image by Foto Micha on Unsplash

DEV Community: Mathieu Kerjouan

WeekReview#202638

Coding

System

Database

Network

Mathematics

Embedded

Security

Security/cryptography

Security/RedTeam

Update/Upgrade

Embedded

Misc

Q&D: Flutter App and Android-SDK

Android SDK Upgrade

Android SDK Platforms and Tools Upgrade

Flutter and Dart upgrade

Environment Variables

Flutter and Gradle

Another Gradle issue

Storage Issue

Conclusion

Q&D: PostgreSQL 18 on OpenBSD

WeekReview#202637

Coding

System

Network

Database

Storage

Security

Security/Cryptography

Security/OSINT

Security/BlueTeam

Security/RedTeam

Embedded

Update/Upgrade

Providers

Misc

Q&D: Dart on Alpine Linux

Using a Container

Using asdf or mise

Using Google Binaries

Compiling From Sources

Conclusion

Alpine Linux Post-Install Checklist

General Configuration

System Hardening

Network Hardening

Monitoring

Misc

Conclusion

CBOR Serialization in Dart

Bootstrapping

Quick Introduction to CBOR

Exporting CBOR Data To a File

Import CBOR Data From Files

Conclusion

WeeklyReview#202636

Coding

System

Database

Security

Security/cryptography

Security/BlueTeam

Security/RedTeam

Embedded

Update/Upgrade

Mathematics

Hardware

Misc

File Handlers Management in Dart

File Handler Cursor

Read Mode

Write Mode

Append Mode

WriteOnly Mode

WriteOnlyAppend Mode

Truncating

Locking and Unlocking File

Using `asdf` or `mise`