DEV Community: Mathieu Kerjouan

File System Management in Dart

Mathieu Kerjouan — Tue, 01 Sep 2026 10:00:00 +0000

It's a good time to also investigate a bit the dart I/O interfaces, especially the one related to files. The dart:io package must be imported to deal with files and directories in Dart.

import 'dart:io';

A file in Dart is an object instantiated by the File class. This object can be created by simply invoking the default constructor, where its argument will be a String.

// default constructor can be used
// to create a new object pointing to
// a local file.
File myFile = File("./file1.test");

fromRawPath() is another constructor, it opens a file based on an List<Uint8> (Uint8List), this kind of data is usually generated by utf8.encode or ascii.encode.

// fromRawPath constructor can be used
// to open a file based on a raw path,
// an Uint8list.
File myFile2 = File.fromRawPath(
  ascii.encode("./file2.test");
);

Finally, the fromUri() constructor will open a file based on an Uri object.

// fromUri is another construct that
// can be used to open a file based on
// an Uri.
File myFile3 = File.fromUri(
  Uri.file("./file3.test")
);

Now the file object has been created, many attributes and methods are available to control it. Let check first the attributes. In the previous examples, all objects are using a relative path, when the object is returned, the absolute path attribute is set. It is the absolute path representation of the data previously passed.

print(myFile1.absolute);
print(myFile2.absolute);
print(myFile3.absolute);

$ dart run
File: '/home/user/tmp/cboring/./file1.test'
File: '/home/user/tmp/cboring/./file2.test'
File: '/home/user/tmp/cboring/file3.test'

The original path passed as first argument can be retrieved with the path attribute.

print(myFile1.path);
print(myFile2.path);
print(myFile3.path);

$ dart run
./file1.test
./file2.test
file3.test

The file object can also returns an Uri object with the help of the uri attribute.

// this is a closure helper to show
// the properties from an Uri object and
// return them as a Map.
final toMap = (Uri uri) {
  return {
    "scheme": uri.scheme,
    "host": uri.host,
    "path": uri.path,
    "fragment": uri.fragment,
  };
 };

print(toMap(myFile1.uri));
print(toMap(myFile2.uri));
print(toMap(myFile3.uri));

$ dart run
{scheme: , host: , path: file1.test, fragment: }
{scheme: , host: , path: file2.test, fragment: }
{scheme: , host: , path: file3.test, fragment: }

Another interesting property exposed by the File object is the parent one (usually a directory).

print(myFile1.parent);
print(myFile2.parent);
print(myFile3.parent);

$ dart run
Directory: '.'
Directory: '.'
Directory: '.'

Let creates a small closure to summarize and display all those information into a Map.

final fileToMap = (File file) {
  return {
    'absolute': file.absolute,
    'hashCode': file.hashCode,
    'isAbsolute': file.isAbsolute,
    'parent': file.parent,
    'path': file.path,
    'runtimeType': file.runtimeType,
    'uri': toMap(file.uri),
  };
};

print(fileToMap(myFile1));
print(fileToMap(myFile2));
print(fileToMap(myFile3));

{absolute: File: '/home/user/tmp/cboring/./file1.test', hashCode: 554905050, isAbsolute: false, parent: Directory: '.', path: ./file1.test, runtimeType: _File, uri: {scheme: , host: , path: file1.test, fragment: }}
{absolute: File: '/home/user/tmp/cboring/./file2.test', hashCode: 224769083, isAbsolute: false, parent: Directory: '.', path: ./file2.test, runtimeType: _File, uri: {scheme: , host: , path: file2.test, fragment: }}
{absolute: File: '/home/user/tmp/cboring/file3.test', hashCode: 467382617, isAbsolute: false, parent: Directory: '.', path: file3.test, runtimeType: _File, uri: {scheme: , host: , path: file3.test, fragment: }}

The next part is to investigate around the methods available. One of the most important is probably the exists() method, which returns if a file exist or not. Another one called existsSync() is also available, and will return a boolean instead of a Future because of its synchronous nature. In fact, most of the following methods will also have their synchronous function if needed. Let creates two of those files first, file1.test and file2.test.

$ touch file{1,2}.test

$ dd if=/dev/random of=file1.test count=1024 bs=8
1024+0 records in
1024+0 records out
8192 bytes (8.2 kB, 8.0 KiB) copied, 0.00502157 s, 1.6 MB/s

$ dd if=/dev/random bs=8 count=1024 \
   | perl -ane '
     BEGIN{@s}; 
     map {push(@s, $_)} 
         grep {$_=~/^[a-zA-Z0-9]$/}
         split(//, $_); 
     if (@s>64) {
       $line = join("", @s[0..64]);
       print $line."\n";
       @s=(); 
     }' \
   > file2.test
1024+0 records in
1024+0 records out
8192 bytes (8.2 kB, 8.0 KiB) copied, 0.0112288 s, 730 kB/s

The previous command is maybe a bit hard to understand for someone without Perl experience. In short, we are filtering the output from /dev/random to extract only characters matching the alphabets or numbers. Using other commands would have do the work as well, but I wanted to do a bit of Perl today.

print(myFile1.existsSync());
print(await myFile1.exists());

print(myFile2.existsSync());
print(await myFile2.exists());

print(myFile3.existsSync());
print(await myFile3.exists());

$ dart run
true
true
true
true
false
false

Now few files have been created, one using binaries and another one using text-like random data, it will be interesting to check the next methods. Let check the length() method, it should return the size of a file.

final fileSize = (File file) async {
  try {
    final size = await file.length();
    print("$file.path: $size");
  }
  catch (e) {
    print("$file.path: $e");
  }
};
fileSize(myFile1);
fileSize(myFile2);
fileSize(myFile3);

$ dart run
File: './file1.test'.path: 8192
File: './file2.test'.path: 1122
File: 'file3.test'.path: PathNotFoundException: Cannot retrieve length of file, path = 'file3.test' (OS Error: No such file or directory, errno = 2)

When a file does not exist, the function throw a PathNotFoundException exception. Then, it's important to check the existence of the file before executing these methods. Let do the same test with the stat() method. It should return a FileStat object.

final fileStat = (File file) async {
  try {
    final stat = await file.stat();
    print({
      'accessed': stat.accessed,
      'changed': stat.changed,
      'mode': stat.mode,
      'modified': stat.modified,
      'size': stat.size,
      'type': stat.type,
    });
  }
  catch (e) {
    print("$file.path: $e");
  }
};
fileStat(myFile1);
fileStat(myFile2);
fileStat(myFile3);

$ dart run
{accessed: 2026-08-31 14:15:14.163, changed: 2026-08-31 14:15:14.163, mode: 33204, modified: 2026-08-31 14:15:14.163, size: 8192, type: file}
{accessed: 2026-08-31 14:15:40.139, changed: 2026-08-31 14:15:40.139, mode: 33204, modified: 2026-08-31 14:15:40.139, size: 1122, type: file}
{accessed: 1970-01-01 00:00:00.000Z, changed: 1970-01-01 00:00:00.000Z, mode: 0, modified: 1970-01-01 00:00:00.000Z, size: -1, type: notFound}

Interesting. When executing the stat() method, no exceptions are thrown. I would expect the same behavior than the length() method, but it seems it's not the case. More investigation is required to know why it does that, but the object returned got a notFound type. My guess is, if you are lazy to check for the exceptions, using the stat() looks to be the right way. Our file3.test still does not exist, let create it using the create() method and check what will happen for the 2 others files already created.

final fileCreate = (File file) async {
  try {
    final created = await file.create();
    print(created);
  }
  catch (e) {
    print("$file.path: $e");
  }
};

fileCreate(myFile1);
fileCreate(myFile2);
fileCreate(myFile3);

$ dart run
File: './file1.test'
File: './file2.test'
File: 'file3.test'

When a file is already present on the file system, calling the create() does nothing apparently. Now all these files are created and contains some data (or not), it's the moment to open() them.

print(await myFile1.open());
print(await myFile2.open());
print(await myFile3.open());

$ dart run
Instance of '_RandomAccessFile'
Instance of '_RandomAccessFile'
Instance of '_RandomAccessFile'

It returns a RandomAccessFile object, we will talk about it later, but with this object, a file can be closed via the close(). A good practice is to always ensure an opened file is closed in some way when it is not used anymore to avoid file descriptor exhaustion. Anyway, this returned object is important if you have operations to execute in a long living process. How to deal with this object will be the topic of another article. For now, reading or writing data in one single step will be enough.

The readAsBytes(), readAsLines(https://api.dart.dev/dart-io/FileSystemEntity/readAsLines.html) and readAsString() have been created for this purpose, read a whole file, return its content and automatically close it.

The readAsBytes() method returns a List<Uint8>, perfect to deal with myFile1 containing binary data. The readAsString() method returns a String, perfect to read the content of myFile2 containing alphanumerical characters. The readAsLines() method can also be used, it will return a List<String>, each lines being separated by \n.

print("myFile1:");
print((await myFile1.readAsBytes()).take(10));
print("myFile2:");
print((await myFile2.readAsString()).substring(0,10));
print("myFile2:");
print((await myFile2.readAsLines()).take(2));

$ dart run
myFile1:
(193, 10, 109, 2, 103, 107, 37, 10, 146, 214)
myFile2:
n2ZBmrSIql
myFile2:
(n2ZBmrSIqlF6M0P0JEMN3SKpR4kn1vGXKBH4KVNJK8x6cfvzZ8o9oc6f70kpmCNQn, X86yRGL4f2xJi0o4sbIWOWWZikO09dTNwC9Pt9ltOHLqByFLc847YeGk6gXlSDuGc)

The same methods exist to write data to a file, with the writeAsBytes() and writeAsString() ones. To avoid overwriting the data present in myFile1 and myFile2, some data will be added to myFile3, the only empty file.

await myFile3.writeAsBytes(ascii.encode("new data added"));
print(await myFile3.readAsString());

await myFile3.writeAsBytes([0x41, 0x42, 0x43]);
print(await myFile3.readAsString());

await myFile3.writeAsString("this is a string");
print(await myFile3.readAsString());

$ dart run
new data added
ABC
this is a string

A file can also be copied with the copy() method by defining the path of a new file as first argument.

File myFile1Copy = await myFile1.copy(myFile1.path + ".copy");
print(fileToMap(myFile1Copy));
fileStat(myFile1Copy);

File myFile2Copy = await myFile2.copy(myFile2.path + ".copy");
print(fileToMap(myFile2Copy));
fileStat(myFile2Copy);

File myFile3Copy = await myFile3.copy(myFile3.path + ".copy");
print(fileToMap(myFile3Copy));
fileStat(myFile3Copy);

$ dart run
{absolute: File: '/home/user/tmp/cboring/./file1.test.copy', hashCode: 934827110, isAbsolute: false, parent: Directory: '.', path: ./file1.test.copy, runtimeType: _File, uri: {scheme: , host: , path: file1.test.copy, fragment: }}
{accessed: 2026-09-01 03:57:26.553, changed: 2026-09-01 03:58:34.207, mode: 33204, modified: 2026-09-01 03:58:34.207, size: 8192, type: file}
{absolute: File: '/home/user/tmp/cboring/./file2.test.copy', hashCode: 1050809529, isAbsolute: false, parent: Directory: '.', path: ./file2.test.copy, runtimeType: _File, uri: {scheme: , host: , path: file2.test.copy, fragment: }}
{accessed: 2026-09-01 03:57:26.553, changed: 2026-09-01 03:58:34.235, mode: 33204, modified: 2026-09-01 03:58:34.235, size: 1122, type: file}
{absolute: File: '/home/user/tmp/cboring/file3.test.copy', hashCode: 604940007, isAbsolute: false, parent: Directory: '.', path: file3.test.copy, runtimeType: _File, uri: {scheme: , host: , path: file3.test.copy, fragment: }}
{accessed: 2026-09-01 03:57:26.585, changed: 2026-09-01 03:58:34.235, mode: 33204, modified: 2026-09-01 03:58:34.235, size: 16, type: file}

$ ls -l *.test *.copy
-rw-rw-r-- 1 user user 8192 Aug 31 14:15 file1.test
-rw-rw-r-- 1 user user 8192 Sep  1 03:58 file1.test.copy
-rw-rw-r-- 1 user user 1122 Aug 31 14:15 file2.test
-rw-rw-r-- 1 user user 1122 Sep  1 03:58 file2.test.copy
-rw-rw-r-- 1 user user   16 Aug 31 18:32 file3.test
-rw-rw-r-- 1 user user   16 Sep  1 03:58 file3.test.copy

Renaming a file is also possible by using the rename() method by setting the new path of the file in the first argument.

File myFile1Rename = await myFile1Copy.rename(myFile1.path + ".new");
print(fileToMap(myFile1Rename));
fileStat(myFile1Rename);

File myFile2Rename = await myFile2Copy.rename(myFile2.path + ".new");
print(fileToMap(myFile2Rename));
fileStat(myFile2Rename);

File myFile3Rename = await myFile3Copy.rename(myFile3.path + ".new");
print(fileToMap(myFile3Rename));
fileStat(myFile3Rename);

$ dart run
{absolute: File: '/home/user/tmp/cboring/./file1.test.new', hashCode: 913418505, isAbsolute: false, parent: Directory: '.', path: ./file1.test.new, runtimeType: _File, uri: {scheme: , host: , path: file1.test.new, fragment: }}
{absolute: File: '/home/user/tmp/cboring/./file2.test.new', hashCode: 515199967, isAbsolute: false, parent: Directory: '.', path: ./file2.test.new, runtimeType: _File, uri: {scheme: , host: , path: file2.test.new, fragment: }}
{accessed: 2026-09-01 03:57:26.553, changed: 2026-09-01 04:02:28.533, mode: 33204, modified: 2026-09-01 04:02:28.533, size: 8192, type: file}
{accessed: 2026-09-01 03:57:26.553, changed: 2026-09-01 04:02:28.533, mode: 33204, modified: 2026-09-01 04:02:28.533, size: 1122, type: file}
{absolute: File: '/home/user/tmp/cboring/file3.test.new', hashCode: 783500576, isAbsolute: false, parent: Directory: '.', path: file3.test.new, runtimeType: _File, uri: {scheme: , host: , path: file3.test.new, fragment: }}
{accessed: 2026-09-01 03:57:26.585, changed: 2026-09-01 04:02:28.533, mode: 33204, modified: 2026-09-01 04:02:28.533, size: 16, type: file}

$ ls -l *.test *.copy *.new
ls: cannot access '*.copy': No such file or directory
-rw-rw-r-- 1 user user 8192 Aug 31 14:15  file1.test
-rw-rw-r-- 1 user user 8192 Sep  1 04:02  file1.test.new
-rw-rw-r-- 1 user user 1122 Aug 31 14:15  file2.test
-rw-rw-r-- 1 user user 1122 Sep  1 04:02  file2.test.new
-rw-rw-r-- 1 user user   16 Aug 31 18:32  file3.test
-rw-rw-r-- 1 user user   16 Sep  1 04:02  file3.test.new

When a file is not needed anymore, it is also possible to remove it from the filesystem with the delete() method. It will return a FileSystemEntity object (a superclass of File). If the File object to remove is a directory, the recursive parameter can be set to remove all files recursively present in it.

print(await myFile1Rename.delete());
print(await myFile2Rename.delete());
print(await myFile3Rename.delete());

$ dart run
File: './file1.test.new'
File: './file2.test.new'
File: 'file3.test.new'

$ ls -l *.test *.copy *.new
ls: cannot access '*.copy': No such file or directory
ls: cannot access '*.new': No such file or directory
-rw-rw-r-- 1 user user 8192 Aug 31 14:15  file1.test
-rw-rw-r-- 1 user user 1122 Aug 31 14:15  file2.test
-rw-rw-r-- 1 user user   16 Aug 31 18:32  file3.test

Finally, the last method to see is the watch() method. This one is probably one of the most interesting to investigate. The idea is to subscribe to the filesystem to follow the activity on a file, when a change happens, the Stream object receives an event from it . On Linux, it uses the inotify API interface.

final timeout = () {
  Duration delay = Duration(seconds: 10);
  final action = () => exit(1);
  Future.delayed(delay, action);
};
timeout();

File toWatch = File("./watcher");
toWatch.create();
Stream watcher = await toWatch.watch();
watcher.listen((event) {
  print(event);
});

The code below is a bit more complex than usual. A timeout closure is defined, it will stop the application after 10 seconds by calling the exit() function. When watching a file in the main thread, the program will simply wait for event forever, the timeout closure has been created to avoid being stuck in this loop.

Then, the ./watcher file is created, and the watcher Stream is attached to it. Because it's a standard Stream, one can listen() on event on it and do some actions.

It's now possible to modify the file from another shell to see the changes happening while the application is running.

$ echo test > watch.test

$ echo test > watch.test

$ echo test > watch.test

$ rm watcher

$ dart run
FileSystemModifyEvent('./watcher', isDirectory=false, contentChanged=true)
FileSystemModifyEvent('./watcher', isDirectory=false, contentChanged=true)
FileSystemModifyEvent('./watcher', isDirectory=false, contentChanged=true)
FileSystemModifyEvent('./watcher', isDirectory=false, contentChanged=true)
FileSystemModifyEvent('./watcher', isDirectory=false, contentChanged=true)
FileSystemModifyEvent('./watcher', isDirectory=false, contentChanged=true)
FileSystemModifyEvent('./watcher', isDirectory=false, contentChanged=false)
FileSystemDeleteEvent('./watcher')

The FileSystemEvent object returned identify the event applied to the file. It can be set to create, delete, modify or move. Few of them will be only displayed when following the activity on a directory. For example, removing a file while watching it, and then recreate it will not work, but this action can be seen when watching a directory.

Conclusion

At first, this post was planned to be a simple, quick and dirty introduction to file management in Dart in another article. In fine, it became a really long explanation about the whole file system API. The abstraction offered by Dart is coherent, simple and stable. In few lines of code, one can easily create, rename or delete files, but also read or write data from them. The support for the iNotify API is a really good thing. As usual, a list of references if you want to dig a bit more:

Happy hacking and have fun!

Cover Image by Kelly Sikkema on Unsplash

WeeklyReview#202635

Mathieu Kerjouan — Mon, 31 Aug 2026 10:00:00 +0000

Finally, someone said it loudly on a podcast, the open-source communities are full of f* goblin with a shitty mindset destroying the hobbyist fun and blocking the real innovation from hackers/engineers by forcing other people to be agree with their political point of view. It's refreshing to watch a short video on this topic, because it was one of the most important reason I did not participate anymore on Open-source projects, especially BSD systems. This guy is doing a great summary: we don't care of your sex, gender, political beliefs or your age. We are hobbyist, hackers, engineers. We are fixing problems by giving solutions. We are NOT involved in politic, and if it's the case, this is not the place to talk about it. In France, during family meeting, we are trying to avoid few topics: religion, politic and most of the controversial news. Why? By To avoid conflict(s) during a time where everyone can be there. It's rare. It's precious. It's called respect. Be respectable, and everything will be fine.

About my posts on this "public note pad". The first articles were focused on learning Dart and Flutter, they were kinda short, and based on documentation, tutorials, tests and examples. The next publications are way more complex, and will involve more knowledge and tests on my side. In fact, one of my project (and future product) was already delayed of one month due to the many - unexpected - things I did during July and August. Anyway, not a promise, just a quick note to explain my current situation.

About dev.to, a quick feedback. I'm now using it for all my technical publication and to be honest, it's not the best place to put your information. In 3 or 4 months, the service was down many time. When editing a long article, sometimes the modifications are not saved on the server side (happened to me many time, and it's... ANNOYING). How a service like that can host so many authors? Where is the reliability? I wanted to avoid doing my own servers, but I think that's what we got for a free service.

Coding

📝 Bringing Primary Constructors to Dart: after the 3.13 version, it will be now possible to use the new keyboard to define named/unnamed constructor as well as factory. Example:

class A {
  new();
  new create();
}

class B {
  factory () { }
  factory create() { }
}

📝 Introducing the Desktop Windowing API for Flutter: Learn about the design behind the new Desktop Windowing API and write your first multi-window Flutter application.

System

📝 net-tools to iproute cheat sheet: a nice way to remember the commands between ip and the legacy net-tools packages (including ifconfig) on Linux. The same should be done between Linux, BSDs and MacOS.

🏗️ MemProcFS: MemProcFS is an easy and convenient way of viewing physical memory as files in a virtual file system.

🏗️ Beyla project: eBPF-based autoinstrumentation of web applications and network metrics. An interesting tool to collect metrics on web server using eBPF (so, linux-only), the documentation looks good as well. I was looking for something similar few years ago, to collect network metrics.

🏗️ The Goodmans Kernel project: Run unsigned kernel payloads in a signed kernel driver via wasm3. No JIT/W^x (HVCI/etc., compliant)

🏗️ kubectl x project: A kubectl plugin that runs commands against every context in your kubeconfig file in parallel.

🏗️ ipatool project: Command-line tool that allows searching and downloading app packages (known as ipa files) from the iOS App Store

📝 Reverse Engineering: How we bypassed CoreML and talked directly to the hardware: a series of article about Apple M1 CPU ANE graph execution engine, and how to bypass CoreML interface.

📝 How to Build Smaller Container Images: Docker Multi-Stage Builds: A tutorial to build small sized containers with docker multi stage, using node.js as example.

Network

🌐 Who Am I: another "what's my ip" service, displaying more information than usual. I like it.

Security

📝 Decrypting and analyzing HTTPS traffic without MITM: a way to decrypt HTTPS traffic using PCAP and BURP SUITE.

📝 How Easy Is It to Scan a Contactless Payment and Access Card?: a post about NFC scanning and cloning.

📝 Smart Glasses Can Record You – And Detecting Them Isn’t So Simple: those glasses can potentially be detected using bluetooth but it depends on the manufacturers (and the spec). When the glasses are connected, they are not broadcasting data anymore.

📝 Reversing TP-Link EX220 from A1: a quick article about reversing a firewall/router.

🏗️ PE-bear project: a multiplatform reversing tool for PE files. Its objective is to deliver fast and flexible “first view” for malware analysts, stable and capable to handle malformed PE files. see also the author's blog.

📝 The Linux Kernel Is Approaching 2,000 CVEs Per Release: I don't really think the Linux kernel will be able to stay in the game with its current structure. The only good answer would have been to use a micro-kernel (Linux is a Minix-clone), it's simpler, easier to maintain and in fine, more isolated. What's scary here is the amount of unpatched old-Linux still running everywhere. I don't know what will happen in the future, but the old mantra "Linux is safer than Windows" is going to break.

📝 Vulnerability Research on Bitdefender's Antivirus Engine: the first part of a series of article about antivirus analysis and fuzzing. The last sections of this publication are talking about fuzzing BitDefender with honggfuzz. I'm waiting for the next part!

Security/Cryptography

📝 Time as a Key: Breaking Rhysida Ransomware with the Attacker’s Own Ciphertext: the story behind the Rhysida Ransomware. A X/twitter thread and a simplified version of the story by the author can be read. In short, the IV (initialization vector) and the keys are generated using the rand function (derived from srand function). Those functions are both linked to the time function, and when executed many times or in parallel, this function return the same value. If one knows the seed (the parameter passed to the srand function), then one is able to decipher encrypted files. The analysis from the paper, the blog post and the x/twitter thread is amazing. A must read.

🏗️ Crypto 101: the book: The source code of the Crypto101 book. Nothing to add, just a good reference.

📝 Blood MERIDIAN: LLM cryptanalysis of a blockcipher that is isn't a blockcipher: an interesting LLM session using GPT-5.6 Sol to break a "blockcipher" (MERIDIAN). No test vectors have been shared on the specification, and the LLM found an issue.

📝 Compromising Signal's Contact Discovery Enclave: V12 found two critical object-lifetime vulnerabilities that allow the untrusted host server to break the enclave boundary.

📝 Privacy Pools: Anatomy of a 53-bit Entropy Collapse: a type coercion bug reducing the entropy of master keys from 256 bits to 53 bits. interesting post-mortem and analysis.

📝 Into the Dark - DarkSword Kernel Exploit Writeup: a post about iOS DarkSword vulnerability (CVE-2025-43520). It uses an exploitable race condition in the virtual file system to allocate kernel memory. Really interesting, but a bit complex to follow on my side, I don't really know how iOS is working under the hood.

📑 Regev’s Attack on Hyperelliptic Cryptosystems: Hyperelliptic curves (yet another thing I don't know) are an alternative to ECC. I simply read the introduction, to know what a "hyperelliptic curve" was. It looks complex, like the elliptic curves.

Security/BlueTeam

🏗️ Sliver project: "an open source cross-platform adversary emulation/red team framework, it can be used by organizations of all sizes to perform security testing. Sliver's implants support C2 over Mutual TLS (mTLS), WireGuard, HTTP(S), and DNS and are dynamically compiled with per-binary asymmetric encryption keys."

Security/RedTeam

📑 Tips and Scripts for Reconnaissance and Scanning: an old publication listing methods to scan hosts.

🌐 RatCTF: yet another capture the flag challenges website.

▶️ Hacking hardware security key into an air-gap-jumping worm: the hidden features of a YubiKey: using yubikeys as attack vector by using logical usage modification to propagate worms (or take control of devices). The full talk can be seen on Youtube.

📝 Web App Hacking: Six Tools for Bug Hunters: a list of tools to find bugs on web application, gospider (webcrawling/spider), SecretFinder (discover sensitive information), jsluice (javascript source code secret extractor), xnLinkFinder (discovering tool), Dalfox (XSS scanner), Caido (web audit tool).

🏗️ DFIR-LAB project: a compilation of challenges that aims to provide practice in simple to advanced concepts in the following topics: Digital Forensics, Incident Response, Malware Analysis and Threat Hunting.

🏗️ InfraGuard project: Red team infrastructure tracker and C2 redirector -- a modern alternative to RedWarden. InfraGuard sits between the internet and your C2 teamserver, validating every inbound request against your malleable C2 profile and blocking anything that doesn't conform. Scanners, bots, and blue team probes get redirected to a decoy site while legitimate beacon traffic passes through to your teamserver.

🌐 KitPloit: Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

📝 Open Source Intelligence (OSINT): Using Osiris for Global Intelligence: an article on the open-source Osiris, a tool, used to collect global information (e.g. cctv, aircraft, critical infrastructure, dangerous zone...). Kinda interesting and can run locally.

Update/Upgrade

🔄 Unifi Security Advisory Bulletin 067: 22 critical security issues to patch, with CVSS score >8. Kudos for the one with a score of 10.

🔄 Announcing Dart 3.13, Bringing conciseness and simplicity to Dart codebases, tooling, and platforms.: Primary constructors, improvement of the dart formatter and much more.

🔄 Elixir v1.19.6 security release: this release patch the CVE-2026-75758, allowing an attacker to crash a node by memory exhaustion with the help of an unsanatized char list used in IO.inspect/1 function. This function is used by the Logger module (see translator.ex) to print Elixir/Erlang data-structure. It would be fun to try exploiting it in some way.

🔄 QSB-118: Dom0 arbitrary code execution in qvm-copy-to-vm error reporting: in short, a wrongly sanitized string from a compromised qube (domU) can be used to execute arbitrary code in dom0. The sanitizer is not removing the backtick character from the filename, leading to arbitrary code execution via the system() function. A dirty bug impacting all QubeOS version.

Embedded

📝 Baochip-1x: A Mostly-Open, 22nm SoC for High Assurance Applications: a security chip made by Bunnie, project created via the betrusted initiative.

📝 Redesigning my microkernel from the ground up: an experimental microkernel inspired by Sel4, called ares, which is a full rewrite of helios. This article also talks a bit about bunnix, an Unix-like OS implemented by the same author.

▶️ Extracting Firmware from Embedded Devices (SPI NOR Flash): a really great video about extracting firmware, using NOR Flash via SPI protocol bus with the help of a logical analyzer (saleae) and hydrabus. In short, this is a man in the middle attack by reading the data directly from the microcontroller to the memory.

📟 $299 Arduino Ventuno Q SBC combines Qualcomm Dragonwing IQ8 SoC and STM32H5 MCU: Quick introduction to the Arduino Ventuno Q, Octa-core Kryo Gen 6, Adreno A623, 16GB LPDDR5, 64GB eMMC flash, M.2 socket for NVMe Gen4 SSD, 2.5GbE RJ45 port.

📟 AT LoRa USB Dongle: USB device that lets you send and receive LoRa wireless data using simple AT commands. No coding needed. Good for testing and development.

🌐 Free RF Tools for Engineers, Radio Amateurs & Students: A long list of tools to help with calculations, design and so on for RF engineers and radio amateurs.

📝 Building A Headless Game Boy Emulator: great project with an ESP32! the ESP32 here is used as server, offering an access to the emulator on Wifi. Other people can also play as well.

Misc

📝 The end of IPFS at Shipyard: P2P distributed storage is hard to maintain, I know this by experience with one of my last mission. The infrastructure cost is huge, even more if no one knows how to deploy really low-cost distributed systems around the world. IPFS is impacted as well by those issues, and when one partner is leaving, it will be hard to continue. I hope IPFS will not shutdown because of that, it's a great technology and it would be really sad to see it disappears.

📟 noah5b motherboard: I wanted to upgrade my firewall (an old PC ENGINE APU2) and just learnt PC Engine will not produce them anymore. Instead, Broachlink will offer similar motherboards called Noah. This is looking great, and are not so expensive ¹
² ³ ⁴ (between €300 and €400). Linux drivers are available on Github.

📝 Crypto ATM operator Bitcoin Depot files for bankruptcy: the world largest cryptocurrency ATM is filed with bankruptcy due to fraud allegations (hundred millions of dollars annually). $389 millions dollars lost due to scams, involving Bitcoin Depot machines. In 2025, $1.5 million scams transactions had passed through hundred of ATMs.

🏗️ GTA 6 Leaks & Cyberleek Investigation Report: a repository containing the complete investigation of the GTA 6 leaks.

📟 Openterface KeyMod, Pocket USB multi-tool bridge for tech, professionals and gaming: interesting concept to transform a smartphone into many different input device.

📝 Two Alleged ‘TeamPCP’ Hackers Arrested in Australia: arrested due to multiple information leaks from SpyCloud, RaidForums, Nulled, and a gmail address used on many other website. Being anonymous on the web is nearly impossible, even for the scammers and criminals. A Risky Business podcast is talking about this story.

🌐 privatekeys.info: a "game" to crack bitcoin and ethereum private key. Pick a number between 1 and pow(2, 256) and voilà, you are now rich and famous!

🏗️ trustmebro project: Bypass llm guardrails by confusing it with fabricated tool output.

Legend:

symbol	usage	example
▶️	video	youtube
🏗️	project	git repository
📝	informal publication	blog post
🎥	live	twitch
🏛️	definition	wikipedia
🌐	regular website	-
📑	academic or scientific publication	arxiv
🔄	software new release, update or ugprade	-
📟	device	embedded hardware

Cover Image by Didier VEILLON on Unsplash

Noah 5 TPM 2.0 Firewall Router Motherboard Intel E3845, 8GB RAM (€326.80) ↩
Noah 5 Firewall Router Motherboard Intel E3845, 8GB RAM, Fanless (€313.50) ↩
Broachlink NOAH6 Intel E3845 3RJ45 1SFP Pfsense Firewall Mainboard Embedded Server Motherboard VPN Router Motherboard with SFP (€103) ↩
Noah 5 Firewall Router Motherboard Intel E3845, 4 cores 1.91 GHz (€180) ↩

Q&D: Dart/Flutter Formatter, Linter and Analyzer

Mathieu Kerjouan — Sat, 29 Aug 2026 08:00:00 +0000

A clean project following conventions is way better than a crappy project containing yolo code. In Dart and Flutter, everything is already available to make your life easier.

Formatter

A formatter is already present with the Dart SDK. The command dart format will do the job. If one wants to see only the modification without applying them:

$ dart format show

The dart format is a shortcut for dart format write, meaning it will apply all changes by default.

$ dart format write

More information can be available here:

Dart Format from the official Dart Documentation;
Flutter Formatting from the official Flutter documentation
Dart Style FAQ from the Official Dart Wiki.

Analyzer

An analyzer is also present by default with the SDK. The command dart analyze will analyze the code and print all potentials issues to fix.

$ dart analyze

The same command is available with Flutter, only the output will change a bit.

$ flutter analyze

More information can be found there:

Dart Analyze from the Official Dart Documentation;
Dart Analyzer Package on pub.dev;
Dart Analyze Source Code from the official Dart Github Repository.

Auto Fix

It's also possible to auto-fix the issues by using the dart fix command. It was never a good idea to apply those kind of commands in the past, and to be honest, I am not a big fan of that, but here how to use them anyway:

$ dart fix --dry-run

$ dart fix --apply

More information can be found on the Dart Fix page from the Official Dart Documentation website.

Execution

Unfortunately, it seems Dart and Flutter cannot create command aliases or shortcut via the pubspec.yaml to execute recurrent commands like it can be found on Mix, rebar3 or even npm. In this case, using a Makefile can do the job. Here the one created for my project:

# GNU Makefile
EMULATOR_ANDROID ?= NameOfTheAndroidEmulator

.PHONY += all
all: test run-android

.PHONY += format
format:
        dart format .

.PHONY += analyze
analyze:
        flutter analyze .

.PHONY += test
test: format analyze
        flutter test

.PHONY += run-android
run-android:
        flutter emulators --launch $(EMULATOR_ANDROID)

.PHONY: $(.PHONY)

To format the code:

$ make format

To analyze the code:

$ make analyze

To test the code:

$ make test

Github pre-commit Hook

Before doing a git commit, it is also nice to check if everything is correct. Here a short script to execute the previous command:

$ touch .git/hooks/pre-commit

$ chmod +x .git/hooks/pre-commit

$ cat > .git/hooks/pre-commit <<EOF
#!/bin/sh
set -e

make test
EOF

Have fun and happy hacking!

Cover Image by Foto Micha on Unsplash

Finite State Machine in Dart with the state_machine module

Mathieu Kerjouan — Fri, 28 Aug 2026 08:00:00 +0000

You already know, Erlang is my favorite language... You should also probably know Erlang uses finite state machines as one of its core concept? In fact, it's probably why one can't come back from Erlang, when you know how to use them, everything becomes easier. This kind of pattern is not only available in Erlang, and few implementations exist on Dart. Here the interesting ones found on pub.dev and github:

project	version	documentation	source code
`state_machine`	`3.0.3`	documentation	source code
`statemachine`	`3.4.0`	documentation	source code
`automata`	`0.2.0`	documentation	-
`dart_fsm`	`1.3.1`	documentation	source code
`immutable_fsm`	`1.1.0`	documentation	source code

The most used of those project is state_machine with more than 22k download, then, this will be the first one to be tested in this article.

Bootstrapping

$ dart create fsm
Creating fsm using template console...

  .gitignore
  analysis_options.yaml
  CHANGELOG.md
  pubspec.yaml
  README.md
  bin/fsm.dart
  lib/fsm.dart
  test/fsm_test.dart

Running pub get...                     1.1s
  Resolving dependencies...
  Downloading packages...
  Changed 48 dependencies!

Created project fsm in fsm! In order to get started, run the following commands:

  cd fsm
  dart run

$ cd fsm

$ dart pub add state_machine
Resolving dependencies... 
Downloading packages... 
+ clock 1.1.2
+ intl 0.20.3
+ js 0.6.7 (0.7.2 available)
+ state_machine 3.0.3
+ w_common 4.0.0
Changed 5 dependencies!
1 package has newer versions incompatible with dependency constraints.
Try `dart pub outdated` for more information.

The only required header to add in all your code requiring this module:

import 'package:state_machine/state_machine.dart';

Usage

The first step is to create a new StateMachine object. Only one argument is required for the constructor, the state machine name.

When a state machine changes its state, the onStateChange parameter is receiving the event, and then, react on it.

// create a new state machine
StateMachine fsm = StateMachine('fsm');

// react on state change with a closure
final onStateChange = (StateChange change) {
    print('onStateChange: $change');
};  
fsm.onStateChange.listen(onStateChange);

The second step is to create a new State objects representing respectively all accepted state by the state machine. To do that, the newState() method must be called. The only argument to pass is the name of the state.

During a transition, the state machine can enter into a new state or leave an old state. Those two kind of events can be followed by configuring respectively the onEnter and onLeave parameters.

// enter state closure
final onEnter = (StateChange change) {
  print('onEnter: $change');
};

// leave state closure
final onLeave = (StateChange change) {
  print('onLeave: $change');
};  

// create a state called init
State init = fsm.newState('init');
init.onEnter.listen(onEnter);
init.onLeave.listen(onLeave);

// create a state called count
State count = fsm.newState('count');
count.onEnter.listen(onEnter);
count.onLeave.listen(onLeave);

// create a state called stop
State stop = fsm.newState('stop');
stop.onEnter.listen(onEnter);
stop.onLeave.listen(onLeave);

The transition between states can then be created. They are represented by StateTransition objects. This is the most "complex" method there, because the method newStateTransition requires 3 arguments. One is the name of the transition as a string, the second is the list of allowed states before the transition, and the last one is the next state after the transition.

StateTransition counting = fsm.newStateTransition('counting', [init,count], count);
StateTransition stopping = fsm.newStateTransition('stopping', [count], stop);

Then, the state machine can be started by calling the start() method. The only argument used here is a reference to the starting state.

fsm.start(init);

The transitions can now be called using the previous objects created. It is also possible to pass an argument to them as a payload.

// calling the counting transition
counting(1);
counting(2);
counting(3);
counting(4);

// calling the stopping transition
stopping();

When the state machine is terminated, one should use the dispose() method to clean up the memory and avoid memory leaks.

fsm.dispose();

The code looks okay. Let execute it to see what will happen.

$ dart run
...
onStateChange: StateChange: (none) --> init

onEnter: StateChange: (none) --> init

onStateChange: StateChange: init --> count
    payload: 1

onLeave: StateChange: init --> count
    payload: 1

onStateChange: StateChange: count --> count
    payload: 2

onLeave: StateChange: count --> count
    payload: 2

onStateChange: StateChange: count --> count
    payload: 3

onLeave: StateChange: count --> count
    payload: 3

onStateChange: StateChange: count --> count
    payload: 4

onLeave: StateChange: count --> count
    payload: 4

onStateChange: StateChange: count --> stop

onLeave: StateChange: count --> stop

onEnter: StateChange: count --> stop

onDispose: null

As you can see, the different steps are displayed on the screen, and we can see each state transitions. If an illegal transition happens in a specific state, the state machine throw an exception.

Conclusion

state_machine just works, but the way the state machine, the transitions and the events triggering the transitions are created annoys me a bit, perhaps because it's the OOP way to do it.

Indeed, to me, a great implementation of a state machine is from Erlang, with gen_statem, a state machine should embed its "data" or "state" and those elements should be modified during a transition.

Anyway, if you want to know more about the state_machine package, here few links:

state_machine package on pub.dev;
state_machine official API documentation on pub.dev;
state_machine source code on Github;
state_machine example source code on Github;
state_machine test suite source code on Github.

Have fun and happy hacking!

Cover Image by Mike Hindle on Unsplash

Functional Programming in Dart with pure

Mathieu Kerjouan — Thu, 27 Aug 2026 10:00:00 +0000

Writing only functional oriented code can become addictive and when switching to something different, like OOP, it's kinda hard to forgot about all these marvelous techniques previously learned. Luckily, many packages can be found to fix this issue on Dart, the oldest one is called dartz and was created by Björn Sperber. Bad luck though, the project repository seems to be unmaintained. If you are still curious, one interesting talk (Pure functional programming in Dart by Björn Sperber) can be found on youtube.

Few other projects exist into the wild to implement functional programming in Dart. Here a quick summary list:

dartz, the latest version is 0.10.1, but the project is inactive. This was one of the first Dart module implementing functional programming concept, perhaps also the first one to be presented during a conference;
pure, the latestversion at this time of writing is 1.0.0. The project is active and quite minimalist;
fpdart, the latest version is 1.2.0, and the project seems to be active;
dfunc, the latest version is 0.10.0 but the project seems to be stopped.
ribs_core, the latest version is 1.0.0 and the project seems to be active and maintained. The functional interfaces look great! Thanks to @randalschwartz.

The choice of a package is limited, only pure and fpdart seem to be active. I'm a bit sad, I wanted to test dartz but if it's a dead project, it's better to move to something else. In this article, we will focus on the pure package.

Bootstrapping

pure project includes API documentation and few examples. The source code is also available on Github.

$ dart create tpure
Creating tpure using template console...

  .gitignore
  analysis_options.yaml
  CHANGELOG.md
  pubspec.yaml
  README.md
  bin/tpure.dart
  lib/tpure.dart
  test/tpure_test.dart

Running pub get...                     0.3s
  Resolving dependencies...
  Downloading packages...
  Changed 48 dependencies!
  1 package has newer versions incompatible with dependency constraints.
  Try `dart pub outdated` for more information.

Created project tpure in tpure! In order to get started, run the following commands:

  cd tpure
  dart run

$ cd tpure

$ dart pub add pure
Resolving dependencies... 
Downloading packages... 
  package_config 2.2.0 (3.0.0 available)
+ pure 1.0.0
Changed 1 dependency!
1 package has newer versions incompatible with dependency constraints.
Try `dart pub outdated` for more inf

pure is using Dart extension types feature to create wrappers around types.

import 'package:pure/pure.dart';

Constant

Takes a single argument, discards it and return the value that it was called on.

Based on the documentation, this feature returns a constant value instead of any other arguments. The example presented show the result of this feature when applied on a map method.

void main(List<String> arguments) {
  constant();
}

void constant() {
  print("Constant (map):");
  const numbers = [1,2,3];
  final result = numbers.map(0.constant);
  print(result);

  print("Constant (reduce):");
  final result2 = numbers.reduce(0.constant);
  print(result2);

  print("Constant (fold):");
  final result3 = numbers.fold(0, 0.constant);
  print(result3);
}

Let run this code.

$ dart run
Building package executable... 
Built tpure:tpure.
Constant (map):
(0, 0, 0)
Constant (reduce):
0
Constant (fold):
0

This is syntax sugar around function definition, the previous code is equivalent to:

void constant() {
  print("Constant (map):");
  const numbers = [1,2,3];
  final result = numbers.map((_) => 0);
  print(result);

  print("Constant (reduce):");
  final result2 = numbers.reduce((_, _) => 0);
  print(result2);

  print("Constant (fold):");
  final result3 = numbers.fold(0, (_,_) => 0);
  print(result3);
}

How to use this feature? At this time, I don't really have an idea. I think it can be useful when we return always some constants in an iterable... Or to make less confusing closure notation. The implementation can be seen in lib/src/constant/extensions.dart

Composition

A composition permits to execute functions in pipeline, it uses ComposeX (defined in lib/src/composition/dot.dart)and PipeX (defined in lib/src/composition/pipe.dart) types.

To use this feature, we first need to create a new function. The example provided show how to convert an int to a double then a double to a String. Let convert an integer to hexadecimal String.

void composition() {
  print("Composition:");
  final f = (int x) {
    return x.toDouble() + 0.1;
  };

  final g = (double x) {
    return "--" + x.toString() + "--" ;
  };

  final value = 12.pipe(f).pipe(g);
  print(value);
}

$ dart run
Building package executable... 
Built tpure:tpure.
Composition:
--12.1--

Composition is an extremely powerful mechanism to deal with multi-functions. pure is adding the method pipe() to all types permitting to use it. The previous example convert an Int to a Double and finally to a String. The computation is clear and each functions can be tested one by one.

Currying

Currying is another interesting functional programming mechanism to convert one function with many arguments to a pipeline of functions with one argument. It can be mixed with composition to give more flexibility on complex functions.

void curry() {
  print("Curry:");
  final f = (int x, int y, int z) {
    return (x, y, z);
  };

  print(f(1,2,3));
  print(f.curry(1));
  print(f.curry(1)(2));
  print(f.curry(1)(2)(3));
}

$ dart run
Building package executable... 
Built tpure:tpure.
Curry:
(1, 2, 3)
Closure: (int) => (int) => (int, int, int)
Closure: (int) => (int, int, int)
(1, 2, 3)

Flipping

This feature can be useful when dealing with external functions breaking your convention. It can be seen on Erlang/Elixir for example, most of the functions on Elixir are passing the state first to modify it with the pipeline operator (|>), Erlang is usually doing the opposite. In Dart, reversing the arguments positions can simply done with the flip() method offered by pure. The example from the documentation is way enough to understand this concept.

void flipping() {
  print("flipping:");
  final person = (String firstname, String lastname) {
    print("$firstname $lastname");
  };
  person("John", "Smith");
  person.flip("Smith", "John");
}

$ dart run
John Smith
John Smith

The final result is the same, but the arguments were flipped on the second call. Interesting feature to make a code more flexible without modifying the convention you enforced. Not sure it is used a lot though.

Nullable

Dealing with null can be challenging in Dart, and most of the function one will create will avoid using null as arguments, but sometimes, it's impossible to avoid. Then, instead of rewriting a part of the function to support null parameters, nullable can be used instead.

void nullable() {
  final concat = (String firstname, String pseudo, String lastname) {
    return [firstname, pseudo, lastname].join(" ");
  };
  print(concat("John", "Johny", "Smith"));
  print(concat.nullable("test", null, null));
}

$ dart run
John Johny Smith
null

Recursion

Creating recursive functions in Dart can overflow the stack. Indeed, Dart does not support tail recursive call by default, and a trampoline function must be created to deal with that. Fortunately, pure is offering an implementation for this specific use case. To be honest, I don't really like the method used by pure to create the trampoline. The syntax is a bit odd, but it's perhaps I'm coming from functional programming. Here a really simple recursive function doing nothing.

int rec1(int i) {
  if (i<=0) return -1;
  if (i%1024==0) print(i);
  return rec1(i+1);
}

Tram<int> rec2(int i) {
  if (i<=0) return Tram.done(-1);
  if (i%(1024*1024)==0) print(i);
  return Tram.call(() => rec2(i+1));
}

void trampoline() async {
  print("trampoline:");
  await Isolate.run(() {
    try {
      rec1(1);
    }
    catch(e) {
      print(e);
      return -1;
    }
  });

  rec2.bounce(1);
}

void main(List<String> arguments) {
  trampoline();
}

$ dart run
trampoline:
1024
2048
3072
4096
5120
6144
7168
8192
9216
10240
11264
12288
13312
14336
15360
16384
17408
18432
19456
20480
21504
Stack Overflow
1048576
2097152
3145728
4194304
5242880
6291456
7340032
8388608
9437184
...

rec1() function will overflow the stack a bit after the 20k calls, and then throw a Stack Overflow exception. To avoid crashing the main thread, rec1() is started inside an Isolate. This is a proof Dart is not compatible with recursive call, or at least, very long recursive calls.

On the other hand, rec2() is using the trampoline feature offered by pure. When executed, the function will continue until the variable int will overflow (by default, Dart is using 64 bits integers, so, it will take a while). The Tram.call() method is used to create the trampoline, then, to use the trampoline, the bounce() method is called from the rec2 reference.

I'm not sure if it's the most elegant way to do that in Dart, but it works. Comparing the performance of this kind of call with a simple iteration can also be nice.

Memoization

Memoization is a technique to store the result from pure functions. In short, when a pure function is called one time, the returned values is cached. When the same pure function is called another time with the same arguments, because of the purity, the return value will be exactly the same. Instead of re-doing the computation, the value from the cache is returned. This is an optimization mechanism found in many functional programming language, like in Haskell.

void memoization() {
  print("memoization:");
  final pure = () {
    return (x, y) {
      sleep(Duration(seconds: 3));
      return x + y;
    }.memoize();
  };
  final p = pure();
  print("datetime: ${DateTime.now()}");
  print(p(1,2));
  print("datetime: ${DateTime.now()}");
  print(p(1,2));
  print("datetime: ${DateTime.now()}");
  print(p(3,3));
  print("datetime: ${DateTime.now()}");
  print(p(3,3));
  print("datetime: ${DateTime.now()}");
}

$ dart run
memoization:
datetime: 2026-08-24 11:07:36.620523
3
datetime: 2026-08-24 11:07:39.656219
3
datetime: 2026-08-24 11:07:39.656613
6
datetime: 2026-08-24 11:07:42.684693
6
datetime: 2026-08-24 11:07:42.684823

As you can see, the first value is taking 3 seconds to be returned (due to the call to sleep() function), but the next time the function is called with the same arguments, the result is given instantaneously. This is because the returned values is cached and instead of executing the function twice, the value is simply returned from the cache.

This work very well for pure functions, but when it comes to impure functions, this is another store. A pure function is reproducible, but an impure function can have different output even if the same inputs are passed. In this case, one can have an issue with memoization cache. In short: use it only with pure function.

Thunk

A Thunk is a function injecting arguments to another function. I never really used this kind of feature in the past though.

void thunk() {
  print("thunk:");
  final t = (num x, num y) => x + y;
  final s = t.thunk(1, 2);
  print(s());
}

$ dart run
thunk:
3

This feature is straightforward and can be used with repetitive functions call is made. Again, I never used this kind of methods, so, I don't really know where should I use it.

Conclusion

To be quite honest, doing functional programming in Dart does not seem natural. For example, creating a simple recursive fibonacci sequence in Dart is painful, even with pure. This package is offering nice interfaces though, mostly used to glue some of your code with external modules. It's always nice to have this kind of features.

Unfortunately, I don't have a lot of resources to share with you on pure:

Maybe starting my own functional oriented library in the future could solve that? Not sure, but could be a good idea to learn about Dart types.

EDIT: added ribs_core in the list of functional package available.

Cover Image by Sonika Agarwal on Unsplash

Yet Another Scam Story

Mathieu Kerjouan — Wed, 26 Aug 2026 08:00:00 +0000

On 4th August 2026, I received a message on Linkedin from someone called Nils Baadness[1] looking for a senior Erlang developer for a gaming and DeFi project. Here the message:

Hope you're doing well!

While you seem to be happy in your current role, I wanted to reach out and see if you'd consider a new opportunity or even a part-time engagement on an exciting project.

We're building a decentralized Gaming and DeFi platform that leverages blockchain technology to create innovative, secure, and scalable gaming and financial experiences. The role is fully remote, with competitive compensation, equity options, and strong ownership over technical decisions.

Would you be open to learning more?

Looking forward to hearing from you.

Best regards,
Nils

I already received this kind of messages in the past. It seems to be a real offer, and share simply my standard resume. After few exchanges, a first meeting/interview has been scheduled for the 17th August 2026 at 2pm using Calendly[2].

The day of the call, someone with a strong Indian accent started to talk to me, a bit weird for someone called Jacob Andrew Scott, but anyway, everything is possible. He presents the project (seems legit), and ask me to present me as well with my experiences. After a long monologue on Erlang, he wanted to check my "programming level" by cloning a repository from Github[3] containing few exercises.

That's a bit weird. Even during a quick job interview, it's very rare to have the interviewer asking you to clone a repository and do some kind of tests. Well, it's not the first though, I clone the repository, and discover few python files and a .vscode directory. If you don't know me, I'm an old-school developer, write code with emacs or vim, rarely with a "modern" IDE like vscode.

After having cloned the repository, sir Jacob asked me to share my screen and use or install vscode. The level of frustration from him increased a bit I guess when I explicitly said "I will never use vscode during a code interview, when a .vscode directory exists in a repository. Just for fun, I shared my terminal, and started to read the content of this directory. What I found was kinda funny, a PowerShell like script trying to download something. Well, I said a second time, if he wanted me to install vscode and use that, I would simply stop the interview.

The rest of the test was then in my own terminal with vim. The "test" was a success (to be honest, the questions were just stupid) and before the end of the call, he told me I would have an answer in 2 or 3 business days.

Now, what is wrong here? At first glance, nothing, but... when one starts to search for information, things are getting odd. Nils Baadnes is "working" since 2023 at Eigen Labs but did not have any connections to someone working there on Linkedin. Even more, he only has 159 connections and 456 followers. Jacob Andrew Scott is also totally absent from his connections, in fact, no one is named like that on Linkedin.

No jobs offer can be found on the EigenLabs's AshbyHQ website [4]. This is perhaps not a problem though, if the company is looking for a consultant, it's not really a job.

Sadly, I removed the cloned repository at the end of the interview (old reflex to remove unnecessary stuff). I came back to it few minutes after the interview to check if I could simply investigate a bit more the content of the .vscode directory but surprise! The repository has been removed from github.

It seems after few days - I was waiting for some extra-message from them - nothing happened...

[1] https://www.linkedin.com/in/nils-baadnes-5a26a2b9/
[2] https://calendly.com/jacob-andrew-scott/30min?month=2026-08
[3] https://github.com/morriswebster-candidate/python
[4] https://jobs.ashbyhq.com/eigen-labs

Conclusion

Scammers are really becoming annoying. Receiving scams by e-mails or on social networks was not enough, they are now targeting the recruitment process on Linkedin. In fact, it's an interesting problem that can be easily fixed directly on Linkedin. Most of the companies are already registered at Linkedin, then, when an user is saying he is working for one of them, it should be acknowledged in some ways. This is not the case yet.

Anyway, be careful and don't trust anyone. I don't think the exploit/backdoor they were using would work on my laptop (running on OpenBSD), but someone using Windows or Ubuntu would have been impacted. In doubt, here a few list of things to find out if your interviewer is a scammer:

Check the Linkekin profile of the interviewer, if he does not have any kind of relationship with people inside the company, this is odd. Usually, a recruiter - even someone outside of the company - knows few people.
If a call is planned, and the camera of the interviewer is turned off, it's another big issue. Most of the interviewer like to see the visage of the interviewee and turn on their webcam by respect.
If the people in front of you is having a strong Indian accent, it's could be a scam. Most of the call I received from scammers where from India.
If someone is asking you to clone a git repository, share your screen and/or install a software, this is obviously a scam. The git repository should contain some kind of payload, executed by a program (e.g. vscode in my case). Don't execute or install anything from them, and NEVER EVER open an untrusted project with a modern IDE, use vi, nano, mg or ed (to make him crazy) instead.
Don't do like me, don't remove the cloned repository, but start to investigate it. Those kind of behaviors must be shared.

Finally, if you have time, and if you are working in a confidential or risky field, having a laptop running on QubesOS ready for this kind of tasks can be great. During the call, the cloned repository could then be cloned inside a temporary Qubes, and you can let the scammers taking control of this small isolated VM, while you are collecting data on them.

Cover Image by Markus Winkler on Unsplash

Q&D: String and Iterable in Dart

Mathieu Kerjouan — Tue, 25 Aug 2026 10:00:00 +0000

By default, Strings in Dart can't be used as Iterable, they must be converted to a List<int> or another kind of Iterable class. To do that, one must import the dart:convert module and start playing with the converters.

A pure ASCII string can be converted using ascii.encode(str), where str is the String to convert to List<int>.

import 'dart:convert';

void main() {
  final str = "hello world";
  for (var c in ascii.encode(str)) {
    print("${c} (${String.fromCharCode(c)})");
  }
}

$ dart run
104 (h)
101 (e)
108 (l)
108 (l)
111 (o)
32 ( )
119 (w)
111 (o)
114 (r)
108 (l)
100 (d)

The same can be done with utf8 Strings as well.

import 'dart:convert';

void main() {
  final str = "波動拳: ↓↙←Ⓑ";
  for (var c in utf8.encode(str)) {
    print("${c} (${String.fromCharCode(c)})");
  }
}

$ dart run
230 (æ)
179 (³)
162 (¢)
229 (å)
139 ()
149 ()
230 (æ)
139 ()
179 (³)
58 (:)
32 ( )
226 (â)
134 ()
147 ()
226 (â)
134 ()
153 ()
226 (â)
134 ()
144 (
226 (â)
146 ()
183 (·)

This output is "normal", because an utf8 character is encoded on 8, 16 or 32 bits, but the encoder will encode it only on 8 bits. This means an utf8 character will be split in more than one byte. A quick and dirty solution to avoid this issue is to use the String.split() method and iterate over the List generated.

void main() {
  final str = "波動拳: ↓↙←Ⓑ";
  for (var c in str.split("")) {
    print("${c} : ${utf8.encode(c)}");
  }
}

$ dart run
波 : [230, 179, 162]
動 : [229, 139, 149]
拳 : [230, 139, 179]
: : [58]
  : [32]
↓ : [226, 134, 147]
↙ : [226, 134, 153]
← : [226, 134, 144]
Ⓑ : [226, 146, 183]

The 波 character is made of 3 integers [230, 179, 162], like the rest of the unicode characters displayed. Here a list of resources talking about that:

Cover Image by Julian Schultz on Unsplash

WeeklyReview#202634

Mathieu Kerjouan — Mon, 24 Aug 2026 10:00:00 +0000

The last week was mostly dedicated for my own personal organization, and trying to rework on my projects. This week though, some of them advanced a little bit. After few days of thinking, the internal design of chored seems to be a bit better than the initial draft. Even if it's still unusable, it's a good project to think about more important topic, like memory management (including garbage collector), algorithms to store efficiently the data and re-read UNIX/POSIX C documentations. We will talk more on the second publication about chored.

To stay focus, my home office was a bit updated. Writing code on a modern laptop with graphical interface is having a negative result on productivity (thanks to all social networks and notifications). A new small dedicated computer, with Alpine Linux (without windows manager) has been successfully deployed and is ready to be used. In fact, chored will be designed here and also on an OpenBSD server.

Remember the kanell project, the pipeline-like module in Dart created few weeks ago. I'm currently working on it, or at least, a part of it. The pipeline is working, but it's not really what I want. I would like to have a way to create composable/traceable finite state machines, powered by something like a pipeline structures, a kind of flow-based programming.

Coding

▶️ Simple Instructions, Weird Algorithms: a great and short introduction to SIMD (Simple Instruction, Multiple Data) by Core Dumped on Youtube, one of the first step to understand GPUs.

📝 Introducing BlocSignal: Unidirectional Data Flow Meets Reactive Signals: Randal Schartz published a series of posts talking about Bloc and Signal (or BlocSignal) with Dart/Flutter: BlocSignal Architecture & Practice Series' Articles. A must read (and follow).

📑 Contract Based Verification of Non-functional Requirements for Embedded Automotive C Code: Non-functional requirements (e.g. restrictions on control flow and data flow) can't be specified using classical tools like ASML/Frama-C and are usually done by manual code review. VerNFR Frama-C module was created to solve this problem.

📑 FlowLog: Re-thinking Datalog for Fast and Extensible Static Analysis: FlowLog (implemented in Rust), is a Datalog compiler used for static analysis. A tutorial is available.

▶️ Stanford University CS107 - Programming Paradigms: the full programming paradigms courses from Stanford. Never watched this one, but the content seems quite interesting, even more if you are doing low-level programming or if you need to review the basis.

📑 Simple Garbage-Collector-Safety: a quite old paper about garbage-collector safety.

📑 Precise Garbage Collection for C: a publication describing the Magpie garbage collector written in OCaml, designed for long living process.

📑 A Parallel, Real-Time Garbage Collector

📑 A Study of Concurrent Real-Time Garbage Collectors

📑 The Specification Paradox: Rethinking Requirements Engineering in the Age of AI

📑 Etna: An evaluation platform for property-based testing

📑 To WASM or Not to WASM: Evaluation of Browser Fingerprinting Defenses Under WASM based Obfuscation

📑 Phoenix: A Modular and Versatile Framework for C/C++ Pointer Analysis

📝 High-Throughput, Formal-Methods-Assisted Fuzzing for LLVM: an interesting way to apply fuzzing by using mutated tests on LLVM. If it works on that, it should work on other application as well, right?

System

📝 EFS & FreeVxFS File-Systems Get Booted While FailFS Merged For Linux 7.3: failfs will permit to use the fchroot syscall and then allow unprileged users to use chroot (based on the git commit message).

📑 KernelScript: Cross-Boundary Typed DSL for eBPF Applications

📑 Concurrency Testing in the Linux Kernel via eBPF

📑 Xkernel: Principled Performance Tunability of Operating System Kernels

📝 Using the OpenBSD ports tree with dedicated users: a very old post about OpenBSD, ports management and privilege isolation by Solene. I was working on some OpenBSD ports recently, and forgot how to apply correctly the isolation. I did not find it on the official documentation though.

📑 CombiSan: Unifying Software Sanitizers for Comprehensive Fuzzing:

📝 NetBSD microvm: things are moving on NetBSD, and I discovered this week the NetBSD MicroVM kernel. The final result? less than 10ms to boot it on qemu. As usual, it can also be customized based on your needs. Always amazed to see those improvements in the BSD world.

Network

📑 Presto: A Match-Action TCP Stack for the Terabit Era: Presto is a re-implementation of a TCP-stack using Reconfigurable Match-Action Table (RMT) pipelines. This implementation is mostly on the hardware side and is focused on low-latency/high-bandwidth network (e.g. DC or perhaps core-network).

Even with state-of-the-art kernel bypass TCP stacks, applications spend up to 48% of perpacket CPU cycles in the stack [...] ASIC transports, such as TCP offload engines (TOEs) and remote direct memory access (RDMA), are highly efficient, but inflexible and operationally brittle in the cloud [...] We present Presto, the first TCP stack tailored to the RMT architecture. Presto reimagines TCP as a pipeline of light-weight match-action operations, enabling line-rate processing without buffering and delivering practical TCP at terabit speeds while preserving high throughput, low latency, energy efficiency, flexibility, and interoperability.

📑 SoK: Insecurity of Cellular Basebands: cellular baseband attack surface summary. This publication is about the security of the chips/CPU/devices used in mobile network (2G, 3G and so on). AT command can be used to communicate to the baseband (good to know). The surface is huge, but I think the investment to start attacking all of that, at least the most modern equipments limit most exploitation. Furthermore, the complexity of each protocols, especially from 2G and 3G, is also a wall. A layer of opacity due to the closed source software and firmware is also another problem.

📑 SoK: Security of Cyber-physical Systems Under Intentional Electromagnetic Interference Attacks: see also IEMI Research Database, gathering other publications from this kind of attacks.

Database

📝 SQLite's Durability Settings are a Mess: a short publication on setting SQLite more durable using journal_mode and synchronous parameters.

📝 Rethinking Database Programming: writing database queries and defined schema using Elm. It's a matter of time before they discover Prolog et Datalog...

📝 Loongson loong64 packages on apt.postgresql.org: while loongson architecture is being removed from OpenBSD, PostgreSQL is now offering packages for this platform.

Embedded

📝 Amaranth HDL (previously nMigen): "The Amaranth project provides an open-source toolchain for developing hardware based on synchronous digital logic using the Python programming language, as well as evaluation board definitions, a System on Chip toolkit, and more." Here the documentation link.

📑 Xilinx JTAG Programmer Guide: an old (<2000) Xilinx manual to program Xilinx FPGA.

📝 Extracting firmware from devices using JTAG: a quick but complete post on using JTAG interface to debug and dump a firmware.

📝 Nibbler 4 Bit CPU: an homebrew 4 bit CPU called Nibbler, created for educational purpose. It could be nice to create an emulator for this CPU, it could be an easy way to understand CPU architecture from scratch.

📝 Deep Dive Into PCB Manufacturing Techniques: Milling: a quick introduction to milling with digikey. Always great to read this kind of publication.

📝 Learning to Decapsulate Integrated Circuits Using Acid Deposition: a nice post showing lot of experiment to decapsulate integrated circuits.

🌐 Zero ASIC releases Platypus 12nm eFPGA product: zeroasic (previously known as Adapteva, the conceptors of the Parallella board) released a the Platypus eFPGA product. I discovered the Logic FPGA tool chain via the news from their website.

Security

📝 Everything is about to “go dark”: Matthew Green fears about too much security due to AI usage, and the risk of agencies losing control over that. Law enforcers and agencies will then ask to add more backdoors. Is it really necessary? Most of the devices and hardware we are currently using are not open-source, they are being crafted in an opaque way, they are embedding unverified/uncontrolled firmware and then, can't be trusted. Furthermore, no one is able to recreate them in their own garage due to the cost of the infrastructure to make them, but also because of the copyright/laws protecting the manufacturers. In such environment, the backdoors are already there, and governments are just asking to use them, not to implement them. More than 10 years ago, Snowden revealed that hdd firmware were already backdoored (and not only there). They did not stop, they continued. What's the solution? More open-source, more makerspaces/hackerspaces, more trusted hardware/devices made from small groups and not big companies. In short: more transparency. They can't stop everybody. But don't worry, there is more. Do you remember when Ken Thompson was thinking about trusted compilers? Well, an LLM is basically the same, you ask for something, you get it, but can you trust it? In our current situation, LLMs are all managed by big companies, already infiltrated by agencies. Then, can you really trust your application generated by your LLM?

📑 TrustMee: Self-Verifying Remote Attestation Evidence: define the "self-verifying remote attestation evidence" concept. A proof is generated in WASM and checked by a verifier. Even if the WASM VM was created as an isolated sandbox, it could be used against the protocol. Interesting anyway.

Security/BlueTeam

📝 How to Read Linux Audit Logs During an Intrusion: a summary of the actions to take on CentOS/RHEL distribution during an intrusion.

📝 Cracking the Crackers: reverse-engineering of x86_64 and arm64 cracked softwares. It always amazes me to see the level of complexity in this domain.

📑 The State of Passkeys: Studying the Adoption and Security of Passkeys on the Web: a long study about adopting physical passkeys. The authors are offering interesting service publicly at passkeys.tools. A must read for someone who wants to implement this kind of authentication on his website or application.

Security/RedTeam

📝 The Axios npm supply chain incident: fake dependency, real backdoor: a short review of the Axios NPM supply chain attack.

📝 Build simple fuzzer, part 6: A long series to write a fuzzer (in C, rust and python).

📑 BADControl: Backdoor Attacks Against Control Systems: the first backdoor against controller with physical triggers. A car/robot is used as example in this publication to see what can be done with such attacks.

📝 Knock Knock! Who's There? - An NSA VM: an interesting way to hide a service, listening on demand based on interface activity with the help of libpcap. It's a bit like the port knocking technique for a firewall, but on the user land side, perhaps more accurate as well, because all packets can be inspected (including their content).

Security/Cryptography

📝 WhatsApp forensics in 2026 and what survives end-to-end encryption: in short, WhatsApp is still secure, but never forgot end-to-end encryption was created to protect the data one the wire to avoid anyone outside of the two part of the line to read its content, but don't protect the end-points. Data can still be found locally on the device, cracked and then extracted. WhatsApp is using crypt15 puzzle (previously crypt12 and crypt14) when storing data locally.

📑 Exploiting a Video Camera's Rolling Shutter to Recover Secret Keys from Devices Using Video Footage of Their Power LED: defines a new cryptanalysis method called "video-based cryptanalysis", used to perform side channel attack to recover an ECDSA key. It has been used against iPhone 13 and Samsung Galaxy S8 while plugged to an USB hub. Another crazy side-channel attack!

📝 Testing the Security of Modbus Services: a quick introduction to testing Modbus using the M-SAK tool. I worked a bit with this protocol in the past, but never had time to read all the specs and understand it clearly (thanks to all the abstraction layers used).

📑 End-to-End Encrypted Collaborative Documents: a protocol to use Signal encryption scheme for collaborative documents, called SignalCD.

📑 LLMs won't break symmetric crypto: in short, using LLM to find vulnerability in cryptography is a good thing but LLMs will not break popular cryptographic schemes. why? (1) high level structure is secure (2) not related to mathematical structures like asymmetric algorithms or hash functions (3) differential cryptanalysis (4) empirical: flaws and issues are found from experiments (5) time/battle tested for many years. A nice quote: "Symmetry cryptography is the strongest part of our security systems".

📑 Fully Homomorphic Encryption with Chosen-Ciphertext Security from LWE: the level of mathematics is too hard for me, but I think the next buzzword for the next 10 years will probably be homomorphic encryption. Following the news on that will be important. I'm also waiting for the next marketing term to sell it.

📑 SafeHub: End-to-end encrypted Git hosting system: a way to encrypt transaction in Git. unfortunately, I did not find the repository, not sure if it's open-source, but the full protocol/design is presented in the paper.

Update/Upgrades

Linux Kernel 7.2 Officially Released, This Is What’s New: Linux Kernel 7.2 has been released. It improves AMD GPU support, a better GPU scheduler, few CPU improvements... More can be read on kernelnewbies.

Rust: Supply chain attack on arrayref: a supply chain attack on one important crate. You can be "memory-safe" and avoid lot of bugs, but it seems it's still hard to be safe in the whole ecosystem. The rust team was reactive though, the create was removed after few minutes (100minutes). Kudos to them.

Mathematics

▶️ The Single Most Undervalued Fact of Linear Algebra: discovering the relation of linear algebra and graph theory through visual explanation. brilliant.

▶️ Ancient Babylonians Cracked This Before Modern Math Even Existed: a short video explaining how Babylonians did an approximation of sqrt(2) via the Babylonian algorithm, and comparing it with the Newton-Raphson method. Another visually brilliant video from The Palindrome.

Misc

📑 Does Fixing Break Security? An Empirical Study of Security Degradation in Iterative LLM-Driven Infrastructure-as-Code Repair: From the conclusion: "(1) Regression is real: 13.8% of scenarios regress in standard mode, 3.3% in strict mode ... Resource restructuring is the dominant root cause (79.0%), ahead of configuration drift ... Self-correction is common but unstable: 36.6% of standard-mode regressions self-correct, yet 28.5% of scenarios oscillate. Interesting report, checking a second time the content of the publication (more deeply) is required.

📑 Don't Let AI Agents YOLO Your Files: Information and Control in Agent-Native Filesystems: the first sentence of the abstract is enough: "AI coding agents operate directly on users' filesystems and regularly corrupt data, delete files, and leak secrets. We conduct the first systematic study of agent filesystem misuse, analyzing 290~public reports. Our study reveals two fundamental gaps: users and agents have limited information about filesystem effects and insufficient control over them."

📝 Living with impostor syndrome: a good post about impostor syndrome. I think we are more or less all impacted by that in the field, perhaps a bit more when one is working in security due to all the things to check every time and not trusting anything. Anyway, my solution? Doing something outside of my field, like reading philosophical books, or doing sport. When it comes to IT, just do small tasks, one by one. Stop asking too much questions, in fine, no one cares.

🌐 1-bit computing: a CPU architecture using only 1 bit, but the opcodes were 4 or 8 bits.

🌐 4-bit computing: CPU using only 4 bits, used for calculator in the 70s.

📑 FreeToken: Efficient Edge-Native MoE Serving with Bandwidth-Adaptive Execution: Faster than Ollama locally, released as open-source project, seen that on X/Twitter via @akshay_pachaar.

Cover Image by Pascal Debrunner on Unsplash

WeeklyReview#202633

Mathieu Kerjouan — Sun, 16 Aug 2026 10:00:00 +0000

Few years ago, I was collecting all the interesting links, publications, books, articles or videos found each weeks. Those posts were never published... And it's a shame. Let fix that by creating my Weekly Review on dev.to. Here the first issue!

The last 4 or 3 weeks were kinda exhausting to me due to the French weather but also because of travelling (not really vacation). This is the reason why the amount of posts decreased. In fact, the motivation is still not there, but it gave me a moment to breath and took a moment to see "new things".

Tcl/Tk seems to be a great language. Being part of all my systems for many years, it never attracted me for some reasons. After watching a talk on SQLite talking about it, especially on the fact it was created to be a "LISP-like language with C syntax". It triggers my curiosity and started to read the documentation. A comparison between LISP and Tcl is available on their wiki. Many great features are present in Tcl:

VFS (virtual file system) support gives the possibility to mount file systems or file directly from the language itself. It can be used with ZIP files for example. This feature is missing on Erlang/OTP and can offer great advantages for dynamic update or portability (especially with escript).
Tk seems easier to use than wxWidget on Erlang/OTP and more portable. It looks like no one created a tcllib or libtk interface to Erlang. This kind of feature could help to also increase portability.
A bit like Erlang, Tcl supports small isolated stackful processes (called coroutines). It also uses a share-nothing design for its thread implementation. It was a surprise to read that. Even more, Tcl is event-driven and using a message system to pass the data!

Why this language, like Erlang, is in the shadow since the 90s? Why is nobody speaking more about that?! If you want to know more about that, and can't wait to read my future publication, I invite your to check Develop Cross-Platform CLI and GUI Tools With Tcl/Tk. Powerful, Event-Driven, Open-Source And Future-Proof Toolkit… From the Past?!.

Regarding my projects, including my application, it was in stand-by as well during the past weeks. It is planned to be restarted during the next coming days, with more publication on mobile application design and private API reverse engineering. Another big part of my time was also dedicated to update and do a big cleanup of my resume, a good way to have a "quick" view of my long journey in IT.

Coding

▶️ Fil-C: Garbage In, Memory Safety Out! - Filip Pizlo | SSW 2026: a talk about Fil-c (a way to protect memory in C) with the creator of the project. Really interesting project using many unheard Clang features, can be a good alternative to "modern" programming language like Rust, Go or Zig.

🏗️ Assembly Hall of Shame: A project checking ASM instruction performance by Christopher Domas.

📝 Elixir's GenStage Demand (a Visual Explainer): an article explaining how Elixir GenStage is working with beautiful animation.

🏗️ clpz-sudoku-9x9.pl: AI Escargot solver in Prolog (eyeProlog), solving the problem in 0.88 seconds instead of 7.27 seconds. From @josderoo on X/Twitter.

📝 Master C and C++ with our new Testing Handbook chapter: a summary post regarding their Security Checklist for C/C++ Programs, containing a long list of things to verify before shipping something in C or C++, like Bugs, Linux Userland common issues, Linux Kernel-land common issues, Windows Userland issues, Windows Kernel-land and finally on sandboxing.

Database

▶️ Reliability Lessons From SQLite - Richard Hipp | SSW 2026: an awesome talk from one of the SQLite creator, about SQLite history, testing and reliability. A must watch.

📝 Modeling State Transitions in Postgres: nice article about state transition in PostgreSQL. Few years ago, one of my project needed something similar (it's ended by implementing a FSM-like system in postgres).

📝 plx : Write PostgreSQL functions in the language you already know.: an interesting way to interact with PostgreSQL database by creating SQL function using another language; the plx project source code can be found on Github.

System

📝 Apple Container Internal: a publication about an Apple container feature I was unaware of, using a QEMU-KVM-like interface. A lot of code samples and details about this feature.

📝 Tachyum Open Sources its Prodigy ISA and Platform to Make AI Available to Everybody in the World: Tachyum announced officialy they will release their Prodigy platform in full open-source (CC BY 4.0). They already have a Github profile containing many open-source projects, including their SIMD IEEE-754 fused multiply-add unit and Tachyum TDIMM Design Specification (available as PDF). The idea behind Tachyium Prodigy is to integrate in one processor, General Purpose Computing, Artificial Intelligence, Physical AI and many other features. Based on their website: "Prodigy has up to 21x higher performance and up to 10x better performance per watt than its competition". Curious to see if it's true.

🏗️ BORE (Burst-Oriented Response Enhancer) CPU Scheduler: A Linux scheduler designed to deal with high load without disturbing user input. The news come from Slackware-Based Zenwalk Linux Aims For "True Low Latency Desktop Experience".

🎥 Lefinnois on Twitch Live: Denis Bodor aka lefinnois started to do some live streaming session on FreeBSD kernel development (in French). Still great to see some BSD content in French!

Network

📝 Off-Grid Communications, Part 1: Break Free from the Grid with Meshtastic: another off-grid network project called Meshstatic. This network can be used for backup when the main network is down (can be helpful for hiking, camping and so on). It uses ESP32 boards with LoRa modules. Can be interesting to deploy locally to test it, the bandwidth is not really great (max 20 kbps) but it can be another way to communicate.

📝 isTRAIN: Detecting if a Train is Blocking a Local Crossing By Listening to Railroad Frequencies: a quick review of an open-source application used to detect when a train is blocked (decoding data from 457.9375 and 452.9375 MHz). Interesting, a domain I did not really know.

📝 War Driving for DECT Devices with a HackRF and Android Device: a wardriving session review (on youtube) about DECT devices (a wireless standard using frequencies from 450 MHz up to 5,875 MHz) with the help of the DeDECTive open-source software.

📝 Mobile Network Hacking:What is a Mobile Network and How Does it Work?: quick publication on mobile network. This more like a small summary than a complete cheatsheet, mobile network is really complex, and doing a post on that seems impossible, but it's a good start for someone interested in this topic.

📝 Off-Grid Communications, Part 6: Internet-over-LoRa with deadmesh: a tutorial to use deadmesh, a text-first internet bridge for mesh network. It uses LoRa and Meshstatic to communicate.

🏛️ IEEE 802.11bb: every year I check if new improvements are made with the LiFi technology. Unfortunately, it's pretty rare to have good news. Using the light to transport locally the information seems (to me) way better than using radio signals. I hope one day we will be able to have that everywhere, with open-source compatible hardware.

Security/BlueTeam

📝 Linux Security in 2026: Hardening, Monitoring, and Defense Strategies: some good practices everybody should apply.

📝 The Detection & Response Chronicles: Covert Operations Through QEMU: I love QEMU, and it's always a pleasure to read how to use it in some context. Here, Qemu is used as tunneling system, especially to cover up long-living attacks using custom network arguments.

📝 Most Common Linux Security Mistakes I Keep Seeing (And How to Avoid Them): another publication about good practices.

📝 Artificial Intelligence in Cybersecurity, Part 14: Turning OSquery into an AI-Powered Forensics Engine: a way to use OSQuery with LLMs.

Security/RedTeam

📝 SDR (Signals Intelligence) for Hackers: Building Your Own Bluetooth and Wi-Fi Jammer: this article present a way to generate noise in 2.4Ghz communication range (and then generate DoS) with the help of the ESP32-BlueJammer tool.

📝 Pentesting: Taking Over A Corporate Mail – Mailcow: Interesting publication about a pentest review involving mails and credential recovery. Using tcpdump to watch the active connection and stole the credentials (from an active server). Classic.

📝 Compromising Telecom Systems: Deploying and Detecting the BPFDoor Backdoor: An APT review involving BPFDoor (a malware/backdoor) waiting for a magic packet to be active.

📝 Social Engineering: Attacking Networks with a BadUSB-ETH, Part 1: a covert-network attack using BadUSB-ETH and doing some DHCP poisoning.

📝 Open Source Intelligence (OSINT): Extracting Information from TikTok: a small OSINT publication about collecting data from TikTok.

🏗️ Spaghettifying DRAM (skitter-creek-bath-salts): Exploit attacking the memory controller by rewiring the DRAM and breaking the memory protection. By doing that, even protected memory region can be exposed and can expose everything in the end. This can be exploited via C code (with the help of paging, cache, threading and TLBs). See also the announcement on X/Twitter. Announced during the Black Hat 2026 by Christopher Domas.

📝 Rocket.Chat Cross-Site Scripting leading to Remote Code Execution CVE-2020-15926: an example of XSS exploitation vulnerability with remote code execution.

🌐 pwn.college: another platform to learn hacking from the basics to the expert level based on challenge (as usual). It looks great.

📝 CVE-2026-46331: Linux Kernel pedit COW LPE Exploit Explained: most of the recent Linux distribution impacted. The security is from May 2026, but the exploits are interesting to study, especially pedit-cow-exploit.

📝 Social Engineering: Building Your Own BadUSB: a small tutorial to configure/create/use BadUSB for social engineering and local attack purpose.

📝 SDR (Signals Intelligence) for Hackers: Building Your Own Fake GPS Satellite: a post about GPS spoofing, quickly describing how GPS works and how to manipulate the protocols with the GPS-SDR-SIM project.

🏗️ LEAKSFORUMS: a github project listing forum leaks.

Security/Cryptography

📝 Factoring "short-sleeve" RSA keys with polynomials: an attack on RSA keys using biased data and weak keys based on a CompleteFTP vulnerability.

📝 2026.08.14: NSA and IETF, part 9: An update: this is a very long story you can find on cryp.to's blog. It started in October 2025 with the first post called 2025.10.04: NSA and IETF: Can an attacker simply purchase standardization of weakened cryptography?. The problem described by those publications are the current structure and organization around IEFT, and the high risk of being manipulated by some agency (NSA). This is a long series of article and will probably require a summary someday:

📑 UFOs: A Very Efficient Multivariate Public Key Signature Scheme: UFOs (Unbalanced Frobenius Oil and Vinegar with Schedule): only read the abstract and the conclusion. Always interesting to read about alternative public-key signature scheme.

📑 Verbeth: Secure Messaging with Metadata Minimization over Public Blockchain Logs: transforming a blockchain (ledger/smart-contract) into private communication channels with end-to-end encryption. Need to dig a bit more about this one.

Security/Patches

🔄 rsync 3.5.0: 33 security issues patched for rsync, including 16 high level CVEs. Quite an important update to do.

🔄 Erlang/OTP 29.0.5: multiple bug fixes (epmd, ssh).

🔄 Erlang/OTP 28.5.0.5: multiple bug fixes (epmd, ssh).

🔄 Erlang/OTP 27.3.4.16: multiple bug fixes (epmd, ssh).

🔄 OpenBSD 7.9 Errata 008: fixes an heap or stack corruption in npppd.

🔄 OpenBSD 7.9 Errata 009: fixes iked remote crashes during authentication.

🔄 OpenSSH 10.5 released: many bugs and security fixes. Improvement on FIDO support during key generation and authentication.

Embedded

📝 ESP32 Thing Plus (USB-C) Hookup Guide: Quick guide to start using ESP32 board from SparkFun.

📝 f4pga: an open-source FPGA toolchain compatible with some Xilinx, Lattice and QuickLock board. Previously called Symbiflow, it was originally created to become the GCC of FPGA. The source code is available on Github.

📝 z486: A 486-Class Pipelined FPGA CPU with Integrated Floating-Point: In this post, @nand2mario is explaining how to create a 486-like CPU called z486 using FPGA and SystemVerilog. He also previously worked on z386 implementation. Those projects are great to study for someone interested to use FPGA and learn more about CPU design/architecture. All the series are absolute bangers and must be read, what I did, but it will require another reading due to the amount of knowledge shared. Here the latest posts from the series:

🏗️ schoolMIPS project: a MISP CPU core for FPGA board using Verilog. The same project exists for RISC-V called schoolRISCV.

▶️ How does a USB keyboard work?: Ben Eater channel is a great place to learn things about electronics. That's a great introduction to the USB 2.0 protocol and its complexity, by using something simple: "a keyboard". Anyway, I wanted to work with USB recently (for a small electronic project) and it seems to be a good place to start. In summary, the computer is asking for data by sending a SYNC IN packet, the keyboard answer with the data, and the computer acknowledge with an ACK packet. Each packet is made of type containing a Packet ID (PID), the data, and a checksum (CRC-16). If nothing changed on the keyboard side when the computer asks for more data, the keyboard can return a NAK packet. An USB transaction is made of (1) a SYNC packet (2) a data packet encoded on 8192bits (3) an ACK packet. A computer poll every 16ms (low-speed) and 1ms (full-speed) to see if some data are available. It seems only 6 keys can be pressed at the same time on an USB keyboard (interesting). RFWirelessWorld is offering a CRC-16/USB calculator.

▶️ How does USB device discovery work?: another video from Ben Eater channel talking about the USB discovery protocol, starting with the question "why only 6 keys strokes can be used at the same time?". When the keyboard is plugged, the computer is starting a SETUP transaction by sending a SETUP packet. I think a longer publication will be required here to explain all of that. Note: the oscilloscope (a Keysight DSOX4024A) used here is insanely cool, like its price (~$8000).

Misc

📝 The PC OS That Would Have Blown Your Mind Back In 1984: discover os8088 operating system in this article from HackaDay.

🌐 CVE Numbering Authority for the BEAM ecosystem: Good to know Erlang ecosystem got a way to announce security issues.

📑 The second law of infodynamics and its implications for the simulated universe hypothesis: an hypothesis made in 2022/2023 about a second law of infodynamics, saying the universe is being compressed or "the second law of infodynamics states that the information entropy of systems containing information states must remain constant or decrease over time, reaching a certain minimum value at equilibrium". Only for general knowledge, I don't think I will use this kind of theory in my work.

Cover Image by Nikolett Emmert on Unsplash

Concurrent and Parallel Programming in Dart with the Isolate class

Mathieu Kerjouan — Wed, 29 Jul 2026 10:00:00 +0000

No one can live entirely on their own, nor can any country or society exist in isolation.

-- Daisaku Ikeda

Every language is now having its own way to deal with concurrency and parallel programming, in the case of Dart, the designers created Isolates. By default, Dart is running its procedures inside the main isolate, in a single thread, a bit like JavaScript. Using one thread can have drawbacks, especially when the application deals with I/O and high volume of data. If the Future and Stream classes don't fix the issues, a developer can spawn another Isolate, isolated from the main one, with its own thread. One can imagine this new environment as a totally fresh sandbox... Let see how to play with that.

Introduction

The next examples present in this article will require dart:async and dart:isolate modules.

import 'dart:async';
import 'dart:isolate';

The Dart code is running by default in the main isolate, like previously said, do we have a way to know on which isolate our code is running? Yes. The Isolate.current property will return an Isolate object as a reference to the current Isolate. Let creates a new function called printIsolateInfo() to see what kind of values have been set on those objects.

void printIsolateInfo(Isolate isolate) {       
  print({
    'debugName': isolate.debugName,
    'hashCode': isolate.hashCode,
    'runtimeType': isolate.runtimeType,
    'errors': {
      'hashCode': isolate.errors.hashCode,
      'runtimeType': isolate.errors.runtimeType,
      'isBroadcast': isolate.errors.isBroadcast,
    },
    'controlPort': {
      'hashCode': isolate.controlPort.hashCode,
      'runtimeType': isolate.controlPort.runtimeType,
    },
    'pauseCapability': {
      'hashCode': isolate.pauseCapability.hashCode,
      'runTimeType': isolate.pauseCapability.runtimeType,
    },
    'terminateCapability': {
      'hashCode': isolate.pauseCapability.hashCode,
      'runTimeType': isolate.pauseCapability.runtimeType,
    }
  });
}

Don't forget to create the entry-point function...

void main(List<String> arguments) async {
  printIsolateInfo(Isolate.current);
}

... And then run the code.

$ dart run
{
  debugName: main,
  hashCode: 366158347,
  runtimeType: Isolate,
  errors: {
    hashCode: 953705591,
    runtimeType: _BroadcastStream<dynamic>,
    isBroadcast: true
  },
  controlPort: {
    hashCode: 1217433094,
    runtimeType: _SendPort},
    pauseCapability: {
      hashCode: -1197642896,
      runTimeType: _Capability
    }, 
  terminateCapability: {
    hashCode: -1197642896,
    runTimeType: _Capability
  }
}

As you can see, the debugName attribute is containing the string main, a direct reference to our main isolate. The unique hashCode should always be the same across the code, because it's a reference to the main isolate. The errors attributes broadcast all errors from the isolate via a Stream. The pauseCapability contains the information about the pause capability, a way to pause/resume the execution of an isolate. Finally, the terminateCapability is containing the capabilities to use kill or setErrorsFatal on the isolate.

Now, let spawn a new Isolate and see what this function is printing.

void main(List<String> arguments) async {
  printIsolateInfo(Isolate.current);
  Isolate.spawn(
    (dynamic msg) {
      printIsolateInfo(Isolate.current);
    },
    'init',
    debugName: 'spawnTest'
  );
}

$ dart run
{
  debugName: main,
  hashCode: 17494084,
  runtimeType: Isolate,
  errors: {hashCode: 891951382, runtimeType: _BroadcastStream<dynamic>, isBroadcast: true},
  controlPort: {hashCode: -353652440, runtimeType: _SendPort},
  pauseCapability: {hasCode: -69010913, runTimeType: _Capability},
  terminateCapability: {hasCode: -69010913, runTimeType: _Capability}
}

{
  debugName: spawnTest,
  hashCode: 488819858,
  runtimeType: Isolate,
  errors: {hashCode: 616290898, runtimeType: _BroadcastStream<dynamic>, isBroadcast: true},
  controlPort: {hashCode: 1976022887, runtimeType: _SendPort}, 
  pauseCapability: {hasCode: -259943465, runTimeType: _Capability}, 
  terminateCapability: {hasCode: -259943465, runTimeType: _Capability}
}

The hashCode and the debugName are different. In fact, the content of the debugName, if net set, would be main.<anonymous closure> with a anonymous function or the name of the function called. What does it mean? Well, the code is executing in a totally different isolate, outside of the main function.

Spawning an `Isolate`

An isolated Dart execution context.

-- Dart Language Documentation, Isolate class

The easiest way to spawn an isolate is to use the Isolate.run() static function. When using it, the computation will be done inside an isolate and the value will be returned to the caller.

void main(List<String> arguments) async {      
  final int result = await Isolate.run(
    () {       
      return List                              
        .generate(100, (i) => i)               
        .reduce((i,acc) => i+acc );            
    }                                          
  );                                           
  print(result);       
}

$ dart run
4950

The idea behind Isolate.run() is to hide all the complexity of sharing a ReceivePort on the caller side. Indeed, when an isolate is started, only a controlPort (used to send message to the isolate) can be shared with it. To receive message from the spawned isolate, a SendPort should be created and shared with the caller. In fact, this can be seen with the Isolate.spawn() function.

Future<Object?> myRun(Object? Function() compute) {
  ReceivePort retPort = ReceivePort();
  Isolate.spawn(
    (SendPort sendPort) {
      var result = compute();
      sendPort.send(result);
      Isolate.exit();
    },
    retPort.sendPort,
  );
  return retPort.take(1).toList();
}

void main(List<String> arguments) async {
  print(await myRun(() => 1));
}

$ dart run
[1]

When an Isolate is spawned, the first argument passed can be any kind of data but because an Isolate is... isolated, then a way to send back the result of the computation is required. This is where the ReceivePort class is taking place. A ReceivePort() object is like a channel, on one side, messages are sent, and messages are received on the other side. When starting our Isolate, the only argument passed is ReceivePort().sendPort, in short, a reference to a SendPort() object, the one side used to send message. This means the newly spawned Isolate can send messages to the main one via this port.

The computation as an anonymous function is then executed, the result sent to the caller via the SendPort() object and the Isolate terminated using the Isolate.exit() method. On the caller side, the ReceivePort is acting as a Stream object, only one message is taken via the Stream.take() method and this message is converted to a List, then returned. The official implementation is a bit more complex, it catch the errors and exceptions as well and use a Completer object to deal with the Future returned by the Isolate.

The last way to spawn an isolate is to use Isolate.spawnUri(). This one is a bit special, because it will call another Dart program inside its own isolate, where the uri parameter is the path to this executable.

// bin/i.dart
import 'dart:async';
import 'dart:isolate';
import 'dart:io';

void main(List<String> arguments) async {
  ReceivePort receiver = ReceivePort();
  Isolate.spawnUri(
    Uri.parse('./t.dart'),
    ["this", "is", "a", "test"],
    receiver.sendPort
  );
  await receiver.take(2).listen((message) {
    final hashCode = Isolate.current.hashCode;
    final date = DateTime.now();
    print("received ($hashCode}): ${date} ${message}");
  });
}

// bin/t.dart
import 'dart:isolate';
import 'dart:async';

void main(List<String> arguments, SendPort sender) async {
  sender.send(
    [Isolate.current.hashCode, arguments]
  );
  await Future.delayed(
    Duration(seconds: 1),
    () {
      sender.send([Isolate.current.hashCode, 'delayed!']);
    }
  );
  Isolate.exit();
}

$ dart run
received (1058204931}): 2026-07-21 11:16:54.266153 [53502371, [this, is, a, test]]
received (1058204931}): 2026-07-21 11:16:55.277365 [53502371, delayed!]

Stack Memory Isolation Test

A whole stack of memories never equal one little hope.

-- Charles M. Schulz

Is an isolate's stack isolated from other isolate(s)? That's a good questions in fact, because true isolation also means having its own stack. In case of stack overflow, the isolate crashes without impacting the main isolate. The best way to check that is to create an uncontrolled recursive function (acting as an infinite loop). Dart does not support tail recursive function or other functional method to avoid using the stack when creating a recursive function. In fact, if one wants to use recursive functions in Dart and avoid stack overflows, a trampoline function is required.

void loop_init(SendPort sender) {
  loop(sender, 0);
}

void loop(SendPort sender, int counter) {
  loop(sender, counter+1);
}

void main(List<String> arguments) async {
  bool breaker = true;
  ReceivePort receiver = ReceivePort();
  ReceivePort error = ReceivePort();
  Isolate.spawn(
    loop_init,
    receiver.sendPort,
    onError: error.sendPort,
    onExit: receiver.sendPort,
  );
  error.listen((x) {
    print(x);
    breaker = false;
  });
  receiver.listen((x) {
    print(x);
  });
  Future.delayed(Duration(seconds: 10), () {
    print("test");
  });
}

$ dart run
[Stack Overflow, #0      loop (file:///home/user/tmp/i/bin/i.dart:32:1)
#1      loop (file:///home/user/tmp/i/bin/i.dart:33:3)
...
#16921  loop_init (file:///home/user/tmp/i/bin/i.dart:29:3)
#16922  _delayEntrypointInvocation.<anonymous closure> (dart:isolate-patch/isolate_patch.dart:316:17)
#16923  _RawReceivePort._handleMessage (dart:isolate-patch/isolate_patch.dart:192:12)
]
null
test

It seems the program is still alive, even after a crash on the new isolate via a stack overflow, the main one is still running.

Heap Memory Isolation Test

The life of the dead is placed in the memory of the living.

-- Marcus Tullius Cicero

An isolate has its own stack, but what about the heap? The stack is limited in size by the system (usually few Megabytes), but the heap is using dynamic allocation by asking memory from the kernel itself (e.g. malloc). I'm still not really sure how Dart is doing the memory allocation, and in fact, it should probably depend on the final application, a native program will not use the same methods to allocate memory than a program running inside the Dart VM. Anyway, I assume any kind of object creation is created on the heap, so, one object from the main isolate should not be available from another isolate.

import 'dart:async';
import 'dart:isolate';

The O class can be used as a factory when creating it via the O.create() function. This class is a simple one, it will only have one private attribute called _value as integer, a getter and also a setter.

class O {
  static O _instance = O();
  int _value;

  O({int value = 0}) : this._value = value;

  int getValue() => _value;
  void setValue(int v) => _value = v;

  factory O.create({int value = 0}) {
    _instance.setValue(value);
    return _instance;
  }
}

The main entry-point creates a new O() object, and then, will do some operation on it after a delay via the Future.delayed() function. The same is done inside an Isolate, both are sharing the same object reference.

void main(List<String> arguments) async {
  var object = O.create(value: 1024);

  Future.delayed(Duration(seconds: 1)).then((_) {
    print('main(hashcode): ${object.hashCode}');
    print('main: ${object.getValue()}');
    object.setValue(2048);
    print('main: ${object.getValue()}');
  });

  Isolate.run(() async {
    await Future.delayed(Duration(seconds: 2)).then((_) {
      print('isolate(hashcode): ${object.hashCode}');
      print('isolate: ${object.getValue()}');
      object.setValue(4096);
      print('isolate: ${object.getValue()}');
    });
  });
}

When executed, the hashCode of the O object is different on the main isolate and the new one. The initialized value (1024) can be seen on both output, but if the object was shared across those isolates, the value 2048 would have been printed twice. So, when starting an isolate a part of the heap (or stack?) is being cloned during the initialization phase.

$ dart run
main(hashcode): 3590485802
main: 1024
main: 2048
isolate(hashcode): 713534114
isolate: 1024
isolate: 4096

I'm still not really sure to understand everything, but the native implementation can be found in heap.cc native implementation and allocation.cc (for the stack) from the Dart SDK. It seems the heap is correctly isolated from each isolate.

Conclusion

Similar features exist on other languages, but the real game changer with the Isolate is the isolation. Indeed, this feature is close to the Actor model, like in Erlang, where a process is spawned and will have its own heap, stack and mailbox. The big difference is the dedicated thread, on the BEAM, the threads are shared. Anyway, using a ReceivePort and SenderPort to communicate is also a smart move, similar to the method used to send data to a process via pipes on the Unix world, the main drawback is the relative complexity to deal with that.

Isolates are great, and could be a good start for creating autonomous workers or actor model. Luckily, the community is full of packages trying to do that:

actor: actors is a library that enables the use of the Actors Model in Dart;
async_task: this package brings asynchronous tasks and parallel executors (similar to classic thread pools) for all Dart platforms;
easy_isolate: an abstraction of isolates providing an easy way to work with different threads;
isolate_manager: Isolate Manager is a powerful Flutter/Dart package designed to simplify concurrent programming using isolates;
squadron: multithreading and worker thread pool for Dart / Flutter, to offload CPU-bound and heavy I/O tasks to Isolate or Web Worker threads.

As usual, I am not the only one to write about this topic, and in fact, thanks to all the resources, I was able to understand this concept a bit faster. Here a (long) list of resources.

Isolates from the Official Dart Documentation;
Concurrency and isolates from the Official Dart Documentation;
Dart asynchronous programming: Isolates and event loops from the Official Dart blog;
Better isolate management with Isolate.run() from the Official Dart blog;
Decoding Isolates: Basic to advanced concepts - Part1 by @jamescardona11;
Dart Isolates Deep Dive — compute, SendPort, and Parallel Processing Patterns by @kanta13jp1;
Isolates in Flutter by @mariam_mohmed_fab897cdb28
Dart Concurrency Complete Guide — Isolates, compute, Streams, and Mutex Patterns by @kanta13jp1;
Dart Concurrency Deep Dive — Isolates, Structured Concurrency, and Async Patterns by @kanta13jp1;
Dart Isolates in Depth — Background Processing, Worker Pools, and compute() by @kanta13jp1;
The Practical Hands-On Guide to Flutter Isolates by @utkarsh4517;
Effortless Multithreading in Flutter: Mastering Isolates Like a Pro by @michealgabriel;
Flutter Isolates & Compute Complete Guide — Keep Your UI Smooth with Background Processing by kanta13jp1
Isolates in Dart & Flutter by Fend on Medium;
A basic introduction to Isolates on Dart. by Starhkz on Gist;
Simple Dart example to demonstrate shared memory for Isolates by xrad on Gist;
Experimenting on Stream with isolates in flutter by fonkamloic on Gist;
Concurrency in Dart with Isolates and Messages by Alexander Obregon on Substack;
Master Dart Isolate: Unlock Blazing-Fast App Speed by dieter on DartCounterApp;
An Introduction to Dart Code and Isolate form HackerNoon;
Dart Isolates and Concurrency Models: Deep Dive into Multi-Threading in Dart 🚀 by Apurba on Medium;
Deep Dive into Dart’s Memory Allocation Strategies by Max Pilzys on Medium;
Flutter Isolate: Pros, Cons, Limitations, and a Practical Example by DeyvissonEduardo.Dev on Medium;
isolate.cc native implementation in C++ from Github.

Happy hack and have fun!

Cover Image by sol on Unsplash

Map like Data-Structure in LaTex

Mathieu Kerjouan — Tue, 28 Jul 2026 10:00:00 +0000

My CV is a mess, but I think almost everybody got the same result over time. Lot of experiences, certifications, projects and so on. Furthermore, having his CV in LaTex is great but it can be hard to update/upgrade it when needed... Why not using something like a database to store all those elements? Well, we can use another layer or tool to deal with that, but it seems LaTex can do that as well with the pfgkeys package.

The idea here is to create a really small local package offering an interface to store different kind of elements per categories. Let start with our requirement. How to put experiences?

\experiencePut{devto}{date}{2026}
\experiencePut{devto}{title}{author}
\experiencePut{devto}{summary}{Writing article for fun and no profit}
\experiencePut{devto}{location}{somewhere on the web}
\experiencePut{devto}{company}{dev.to}
\experiencePut{devto}{skills}{tex, latex, erlang, elixir, dart, flutter}

\experiencePut is taking 3 arguments, the first one will be a reference to a position (e.g. devto), the second argument will be an unique keyword (e.g. date) and finally, the last argument will be the data to store (e.g. 2026). How to get this information back?

\experienceGet{devto}{date}
\experienceGet{devto}{title}
\experienceGet{devto}{summary}

By creating experienceGet, where the first argument is the reference to a position (e.g. devto) and the second one to the unique keyword previously set (e.g. date). Then, it will return 2026. Neat. Right? Let create our local package called map.sty.

$ touch map.sty

It will contain the definition of our interfaces and few mandatory elements for LaTex. Thanks to overleaf, we have now great LaTex documentation about that.

\NeedsTeXFormat{LaTeX2e}
\ProvidesPackage{mystore}[2026/07/24 map package]
\RequirePackage{pgfkeys}

pfgkeys requires a list of keys to work correctly, then the /cv/ key is created. More information can be seen on the documentation regarding the family term.

\pgfkeys{
  /cv/.is family,
}

Here the definition of the \experiencePut and \experienceGet commands. Both of them are some kind of interfaces to \mapPut and \mapGet commands, where the main category (defined in the first argument) is set to experiences.

\newcommand{\experiencePut}[3]{\mapPut{experiences}{#1}{#2}{#3}}%
\newcommand{\experienceGet}[2]{\mapGet{experiences}{#1}{#2}}%

\mapPut command is using \pgfkeysetvalue to add a new key below /cv/, it requires 4 arguments, each one being a branch, and the last one being the final value to store.

\mapGet command is using \pgfkeysvalueof to retrieve the data stored on the leaves, based on the same principle than \mapPut.

\newcommand{\mapPut}[4]{\pgfkeyssetvalue{/cv/#1/#2/#3}{#4}}%
\newcommand{\mapGet}[3]{\pgfkeysvalueof{/cv/#1/#2/#3}}%

That's great, be it could be even better if a command could be create to generate a short experience entry. In my case, the LaTex template was already using a definition for \entrylist and \entry. To avoid rewriting everything, let create a new command to generate an entry with the information stored.

\newcommand{\experienceShort}[1]{
    \entry
        {\experienceGet{#1}{date}}%
        {\experienceGet{#1}{title}}%
        {\textbf{\experienceGet{#1}{company}}, \experienceGet{#1}{location}}%
        {
            \experienceGet{#1}{summary}
        }
        {\experienceGet{#1}{skills}}
    % \\
}

Now, let create a store.tex file, it will be used to store all our information in one place.

$ touch store.tex

$ cat > store.tex <<EOF
\experiencePut{devto}{date}{2026}
\experiencePut{devto}{title}{author}
\experiencePut{devto}{summary}{Writing article for fun and no profit}
\experiencePut{devto}{location}{somewhere on the web}
\experiencePut{devto}{company}{dev.to}
\experiencePut{devto}{skills}{tex, latex, erlang, elixir, dart, flutter}
EOF

Finally, have some "fun" with our resume.

% header definition
\documentclass[]{cv-style}
\usepackage{map}
% ... other requirement
\begin{document}

  % import our stored information
  \input{store}

  % create a new section dedicated for the experience
  \section{Experience}

    % create a new entry list
    \begin{entrylist}

      % add the devto experience
      \experienceShort{devto}
    \end{entrylist}
\end{document}

The best part of this approach is to be able to reuse the same information in many different kind of templates, without rewriting everything, every time. This is a really short part of my CV, but sharing this can probably help other LaTex developers to manage their resume. Even more, one can add multi-language support. Anyway, it's a nice way to deal with complexity in LaTex, if your CV is bigger than mine, the next step is to create a database and store everything in it. It's already in my pipes. As usual, some references.

pgfkeys package on CTAN;
pgfkeys Official Documentation from tikz;
LATEX for package and class authors
current version from Latex Project;
Understanding packages and class files from Overleaf;
Writing your own package from Overleaf.

Have fun and happy hack!

Cover Image by Victor Rosario on Unsplash

ISO8601 Format in Latex

Mathieu Kerjouan — Mon, 27 Jul 2026 10:00:00 +0000

A quick note on Latex with datetime2, I wanted to add a Revision on my CV recently, and got a bit stuck with this package. I tried (again) chatgpt to fix this issue, and again, it failed. So, I just read the documentation, find the right options, and it was fixed.

%% header
\usepackage[calc,style=iso,showseconds,showzone]{datetime2}

%% document
\begin{document}
\today
\end{document}

It will display the date/time with the ISO8601 format.

2026-07-25T10:03:00Z

The idea here is to set few options while importing datetime2 module:

calc: Load the datetime2-calc package. This will allow the day of week to be computed and allow you to use the pgfcalendar offset style date formats in commands like \DTMdate as well as defining the commands described in Section 9. This option doesn’t take a value. It can’t be switched off. This option can’t be used in \DTMsetkeys. The default is to not load datetime2-calc;
style=iso: Sets the current style using \DTMsetstyle when the datetime2 package has finished loading. This also sets useregional=false but that setting can be overridden later in the option list;
showseconds: Boolean key to determine whether or not to show the seconds when the time is displayed;
showzone: Boolean key to determine whether or not to show the date with commands that use \DTMdisplay or \DTMDisplay.

Here some references if you want to know more about this topic:

datetime2 Official documentation
datetime2 package on CPAN.

Cover Image by Jon Tyson on Unsplash

DEV Community: Mathieu Kerjouan

File System Management in Dart

Conclusion

WeeklyReview#202635

Coding

System

Network

Security

Security/Cryptography

Security/BlueTeam

Security/RedTeam

Update/Upgrade

Embedded

Misc

Q&D: Dart/Flutter Formatter, Linter and Analyzer

Formatter

Analyzer

Auto Fix

Execution

Github pre-commit Hook

Finite State Machine in Dart with the state_machine module

Bootstrapping

Usage

Conclusion

Functional Programming in Dart with pure

Bootstrapping

Constant

Composition

Currying

Flipping

Nullable

Recursion

Memoization

Thunk

Conclusion

Yet Another Scam Story

Conclusion

Q&D: String and Iterable in Dart

WeeklyReview#202634

Coding

System

Network

Database

Embedded

Security

Security/BlueTeam

Security/RedTeam

Security/Cryptography

Update/Upgrades

Mathematics

Misc

WeeklyReview#202633

Coding

Database

System

Network

Security/BlueTeam

Security/RedTeam

Security/Cryptography

Security/Patches

Embedded

Misc

Concurrent and Parallel Programming in Dart with the Isolate class

Introduction

Spawning an Isolate

Stack Memory Isolation Test

Heap Memory Isolation Test

Conclusion

Map like Data-Structure in LaTex

ISO8601 Format in Latex

Spawning an `Isolate`