Paying for "cheap" virtual machines running my CI/CD pipelines is no fun. You will have the result quick, but you will not learn how to deploy this kind of infrastructure. As sysadmin, it's always nice to see how the tools used few years ago evolved... So, this week was about creating my own local privacy-first building infrastructure for Gitlab CI/CD. Based on the increasing cost of hosting providers due to the "AI revolution", hosting its own infrastructure can have a lot of benefit (and few drawbacks). What's the idea?
To avoid information leaks like my own public address, the network will route all outgoing connections to a VPN or/and via a proxy. Each servers will be installed with an hardened version of Alpine Linux, and will have gitlab-runner enabled by default with a container manager (e.g. podman). Those servers are old laptops or cheap bare-metal devices (e.g. Intel NUCs, ARM boards). This infrastructure will also offer local isolated cache servers and a way to store artefacts.
It was not really planned, but it's a nice idea to do that. In fact, I would like to also test this kind of infrastructure with k3s to see if a kubernetes cluster can run in its own world, without a direct access to internet. Spoiler alert: it is already deployed on two workers, behind an OpenBSD firewall. It's a matter of time before a series of articles will be published here about that.
This week was kinda busy, working on my application in Dart/Flutter, and most of the links are without comments because they have been barely read... Even more, dev.to is going to make me crazy. When a post is removed from a series, it is not displayed on user's profile. I created an issue hoping it will be fixed, but I was so angry about that, I started to work on my own post manager called publish using only pandoc, Makefiles and shell scripting. I don't understand how a website like dev.to can be a "reference" for developers. Anyway, as usual, nothing is better than what you can do by yourself. A word on publish project?
- must be highly portable and run everywhere
- must be use simple markdown files
- must publish content in more than one format (e.g. html, pdf, epub, djvu...)
- must be easy to clone/export
- must be easy to backup
- must be easy to migrate
- must be flexible enough to deal with callbacks in any languages
- must generate good old files and directories
- must save its state as local files/directories as well
- all my publications will be firstly created there and then published on substack, medium and dev.to (and in other places as well if possible).
I'm really tired of migrating my content every 2 or 3 years, but I know think the best way is to keep everything open, and stay with your data locally.
Coding
🏗️ snmpkit: A comprehensive SNMP toolkit for Elixir featuring a unified API, pure Elixir implementation, and powerful device simulation.
📝 Register Allocation in the LLVM Backend: an article on LLVM compiler optimization for registers allocation. In short, this is the algorithms used when the -O flag is set. It's interesting to see register allocation is not a simple thing. This article focus on CPU though, GPU register allocation is a bit different.
🏗️ listen project: A package to notify state changes to interested listeners in pure Dart.
📝 Recreating Voodoo Graphics and a Late-1990s Gaming PC on an FPGA: another article about the z486 CPU, this time about recreating a graphic card using an FPGA.
🏗️ gitlab-ci-local project: Run gitlab pipelines locally as shell executor or docker executor.
🏗️ ecto_middleware: Implements the middleware pattern for your Ecto repos, a Plug-like concept for Ecto.
📝 Implementation of GCC's Nested Functions (vs. C++ Lambdas)
📑 C*: Unifying Programming and Verification in C
🐦 A quick overview of atomics in C
📑 Stackful Coroutine Made Fast: from PhotonLibOS
📝 Implementing a Phoenix PubSub Adapter with EventStore: a quick and short introduction to Phoenix PubSub.
📝 Decompilation Book: A good introduction to decompilation (and reverse engineering).
System
📝 Asahi Linux Now Officially Supports Apple M3 Macs - With Caveats: Linux on Apple M3 CPU will be great. Looking forward to have the same support on BSDs.
📝 RabbitMQ vs. Apache Kafka: it reminds me years ago when some of my colleagues were talking about comparing RabbitMQ and Kafka. This article is an up-to-date version of this discussion, with a nice conclusion: RabbitMQ is the better default. In general, both systems are now doing the same, with mostly the same performance. Anyway, a good summary every one working with queueing systems should read. A study is also available.
📝 SystemIO conflicts are not firmware bugs
🏗️ grafito project: a simple, self-contained web-based log viewer for journalctl. It provides an intuitive interface to browse and filter system logs directly from your web browser.
🏗️ Vinix OS: Vinix initially is going to support every Apple Silicon Mac (only M1 Macs for now as of Sep 10 2026).
📝 Retrospectively Reverse-Engineering Apple's Neural Engine
📝 Interview with Ken Thompson, 9-6-89
Network
📑 De-Anonymization Techniques in the Tor Network Using an Experimental Testbed: A really interesting publications doing a huge work on de-anonymizing tor network users using open-source tools, in an experimental network. In the end, nothing really new. It's well known if the user is not careful during browsing or when downloading something, it can lead to information leaks. Whonix mostly fix this issue, even more when it is installed in QubeOS. Here the tools they used in this paper:
shadow: Shadow is a discrete-event network simulator that directly executes real application code, enabling you to simulate distributed systems with thousands of network-connected processes in realistic and scalable private network experiments using your laptop, desktop, or server running Linux;
chutney: Tool for testing Tor network
ExperimenTor: A Testbed for Safe and Realistic Tor Experimentation
Database
🏗️ PostgreSQL Anonymizer: The main goal of this extension is to offer anonymization by design. We firmly believe that data masking rules should be written by the people who develop the application because they have the best knowledge of how the data model works. Therefore masking rules must be implemented directly inside the database schema. From PostgreSQL News.
🏗️ pg_vault_tde project: encrypts every tuple with AES-256-GCM at the Table Access Method layer. Data is encrypted before it reaches the storage manager and decrypted after it leaves. Encryption keys are managed by HashiCorp Vault / OpenBao or a local PKCS#12 wallet and cached in shared memory with automatic rotation. Seen from postgresql news.
Storage
🏗️ Garage project: S3-compatible object store for small self-hosted geo-distributed deployments.
Security
📝 Activating Chrome DevTools Protocol in Memory: Bypassing –remote-debugging-port Restrictions: shellcode injection on windows using Chrome Developer Tool.
📝 I accidentally logged hundreds of thousands of phone calls to military bases: a good story about hijacking e164.arpa domains, a project created in the 2000's to associate phone number with DNS.
📝 WeWorm, The first zero-click worm to spread through WeChat calls across iOS and Android.
▶️ Deanonymizing Monero Transactions in Tor Network: an introduction to deanonymizing monero transactions, but it has been fixed in the latest versions (quick). btw, I liked the fake VPN ads but I also liked the truth behind the private VPN companies giving logs to goverments.
▶️ The Tor Project Just Gaslit Their Entire User Base: another project lying to their users. Tor browser does not protect against OS fingerprint, that's a shame, but the worst part is... they are saying the opposite in their communication. Don't trust anyone, again.
📝 From P-Code to GNN: extract binary code semantics
📝 Bluetooth Low Energy Security Testing, Consolidated: Introducing Caeruleus
Security/Cryptography
📝 Engineer Factors RSA-260, Ending a 35-Year Cryptographic Challenge: lot of noise here, but RSA-260 (260 bits RSA keys) have been broken. At least... One of them.
Security/OSINT
🏗️ Instagram OSINT Relationship Analysis project: Analyze the followers and following accounts that a private (hidden) Instagram account interacts with.
Security/BlueTeam
📝 MikroTik ssh 0day exploitation in the wild: a short story about a 0 day exploited on Mikrotik routers via SSH.
Security/RedTeam
📝 PowerShell for Hackers: Exploitation Essentials: not a big fan of powershell, but it's a good introduction for penetration testing.
🏗️ XSS Labs project: Hands-on XSS labs for learning, practicing, and understanding Cross-Site Scripting vulnerabilities.
Embedded
📝 Scheme-it: Schematic Drawing, Flow and Block Diagramming Made Easy: a quick introduction to scheme-it to create and design electronic schema. Those schema can then be imported in KiCAD.
📝 Deep Dive Into PCB Manufacturing Techniques: Milling: a short post on PCB milling.
📝 ESP32 Audio Project - Part I: Internet Radio with I²S DAC
📝 Chameleon Ultra: Guide to RFID Reading, Emulation and Testing
🏗️ A standalone, real-time 2x2 MIMO software-defined radio (SDR) platform for advanced wireless research and rapid prototyping: a standalone, real-time 2x2 MIMO software-defined radio (SDR) platform for advanced wireless research and rapid prototyping. With FPGA-accelerated wireless processing, ultra-low phase noise design, and a proven real-time PHY baseline.
Update/Upgrade
🔄 NetBSD 9.5: NetBSD 9.5, the fifth (and final) release from the NetBSD 9 stable branch, end-of-support for all NetBSD-9.x. The full announcement can be found on the release page.
🔄 Cowboy 2.19, Cowlib 2.20, Gun 2.6, Ranch 2.3: this is an important release for all the cowboy-suite libraries. Cowboy is now only support OTP-27+ and will drop support for all versions of Erlang without security patches. The release on Github: cowlib-2.20.0, ranch-2.3.0, cowboy-2.19.0 and gun-2.6.0.
🔄 Nova 0.17.0: optimization update.
🔄 Nova 0.18.0: another update.
🔄 OpenBSD 7.9 syspatch security upgrade: a lot of patches, impacting opensmtpd, nfs, wscons, shmat, libexpat, X and ldapd.
Providers
🌐 Bullionet: cheap bare-metal server in France (Paris, Marseilles, Lille). Announced on X/Twitter.
🌐 netcup: low cost virtual servers, and interesting deals.
🌐 contabo: low cost virtual servers, pretty expensive bare metal ones though.
🌐 speedypage: in pound (uk), quite expensive bare metal servers, but the price for virtual servers looks great.
🌐 euronodes: virtual machines are cheap (<5€), bare-metal servers are expensive. Data centers in Europe (germany, portugal, spain and czech republic).
🌐 macserve: is it a joke?
🌐 BoxedTux: Deploy a full Linux virtual server in under 90 seconds. Root access, public IP, your choice of distro — no credit card, no vendor lock-in.
🌐 BoxyBSD: BoxyBSD offers free VPS instances for exploring FreeBSD, OpenBSD, NetBSD and many other BSD or Solaris based systems. Get hands-on experience, experiment safely, and join a growing community of BSD enthusiasts.
Misc
🌐 Mini ITX Shop: A good place to find small-sized computers/boards.
🌐 Mhz Shop: A good place to find wireless hardware and devices.
📝 Under-The-Radar Oklahoma Bitcoin Mining Site Condemned After Leaking 3 Million Gallons Of Water
🏗️ BraveDebloater project: Safety-first Windows PowerShell debloater for Brave Browser using enterprise policies, dry-run mode, backups, and restore.
📝 Build Your Own Private Cellular Network: kinda expensive ($999) but looks interesting.
🏗️ Nobora Project: A Fedora-based desktop, tuned for gaming, streaming, and content creation — so you can skip the tweaking and start doing.
📟 Sipeed NanoKVM-Go: an updated version of the NanoKVM, perfect for remote control and debugging a system remotely.
🐦 go fuck yourself @sama: a reaction regarding the last "discovery" made by anthropic in the mathematical field. Below the most interesting part to me. Your data, your ideas, or your researches are not safely protected by those companies.
to this theoretical imposture you add a disgusting ethical and industrial cynicism taking advantage of private codex sessions and informal preprints from academic researchers to siphon their research leads and then trying to redact or erase the contribution of levent alpöge under the pretext that he works at rival anthropic is intellectual serfdom openai behaves like a feudal lord of silicon appropriating the cognitive subsistence of independent scholars threatening their careers behind closed doors if they protest and turning community academic labor into a privatized pressrelease [...] real science is not a clout chase on social media or a compute spike spent to rob the clay mathematics institute it is a quest for elegance physical truth and universal rigor to decode reality [...] the most dangerous aspect of this maneuver is not the mathematical exaggeration but the corporate enclosure of scientific discovery by keeping these frontier systems locked behind outcome based pricing licensing barriers & proprietary API walls [...] when mathematical reality itself gets reduced to synthetic token production swallowed by closed infrastructure we transition from open academic inquiry to technological feudalism
🌐 Black Hat World Forum: discovering this forum recently, about SEO.
Cover Image by Artem Kniaz on Unsplash
Top comments (0)