Location

Council Bluffs, IA · map

Admission

$10 adults, $8 seniors/students, $5 youth (as of 2026-10)

Hours

Thu–Sat 10am–5pm, Sun 1pm–4pm; check the official site

Visited

2026-07

Worth the drive

★★★☆☆ (3/5)

Part of detour, a series on places worth leaving the highway for.

1. Overview

Just across the Missouri River from Omaha, in downtown Council Bluffs, sits the Pottawattamie County Squirrel Cage Jail. It was built in 1885, held prisoners until 1969, and is the only three-story rotary jail ever made. Only three rotary jails survive today: this one, a one-story jail in Gallatin, Missouri, and a two-story jail in Crawfordsville, Indiana. The Historical Society of Pottawattamie County now runs the Council Bluffs jail as a museum.

If you've never heard of a rotary jail, the idea is simple and a little absurd. William H. Brown and Benjamin F. Haugh patented the design in 1881: instead of lining cells up along a corridor, you put the inmates in pie-shaped cells inside a large iron drum and spin it. Each floor has a single opening, and the jailer turns a hand crank until the cell he wants lines up with it. That way, one guard can control every prisoner in the building without ever stepping into the cellblock. The drum in Council Bluffs holds three tiers of ten cells each and weighs about forty-five tons.

It didn't take long for the problems to show up. Any inmate with an arm or leg through the bars while the drum turned would have it crushed against the outer cage, and some inmates started doing it on purpose. A broken arm got you moved to the infirmary, and the infirmary only had a wooden ceiling between you and the outside, so a few of them broke through it and shimmied down the drainpipes to escape.

Over the years, the weight of the drum caused the central bearings and shafts to sag until the crank was nearly impossible to turn. Fire was an even bigger worry, since the only way to get everyone out was to rotate the drum one cell at a time past the single exit.

2. The Experience

From the outside, 226 Pearl Street looks like any other Victorian brick building downtown. You walk in through the booking room, and right away you're standing next to the jail's only solitary cell. It isn't really a room at all - it's the gap between two steel doors that separate the booking room from a narrow hallway. Once both doors were shut, the inmate had a solid steel door at their back and a barred one in front of them, with barely enough space for a modern adult to fit. You can't sit down in there, and you can hardly bend your knees.

The hallway on the other side runs straight into the first-floor cell area. It was a shortcut, letting jailers get a rowdy inmate locked up quickly without going through all the normal cell doors.

Once you're in the cell room, the drum takes up most of the space. The hand crank and gears that turned it are still on the first floor, and it's hard to picture one person moving all of that iron by hand. The cells are narrow wedges that shrink toward the center, and standing in one, there isn't a single parallel wall or a window in sight.

Make sure to look up while you're in there. The steel ceiling is covered in names and dates that inmates scratched and painted over the decades, and it's all still there.

The first floor is also where inmates showered, if you can call it that. The shower was a bare pipe sticking out of the wall in a wide open space, with no privacy at all.

Upstairs on the second floor, there's a drop hatch in the floor. Getting down to the first floor the proper way meant unlocking and relocking door after door, which took far too long when a fight broke out below. Instead, guards would unlock the hatch and jump straight down.

At the top of the building, you can look straight down onto the top of the drum.

This view explains one of the jail's worst problems. Each cell's toilet sat at the center of the cylinder, where there was almost no ventilation, so the smell drifted straight up the drum and into the apartment where the jailer lived with his family.

The apartment itself is a strange contrast to everything below it. It has a clawfoot tub, lace curtains, and arched windows looking out over downtown, all one flight of stairs away from the cells and their smell.

Throughout the building, there are reminders of who was actually held here.

A chalk slate tallies the day's count by where each inmate was held: bullpen, holdover, hospital, women, and trusties. The jail also had a children's wing, which held children as young as infants. Most of them were there because the jail doubled as child services at the time, but some were held as genuine "criminals." One display case even holds real rope from the nooses used to hang some of the jail's prisoners.

Local tourism leans heavily on ghost stories and paranormal tours, but you don't need any of that here. The building is strange enough on its own.

3. Going

The jail is in downtown Council Bluffs, a couple of minutes off the I-80 / I-29 interchange and about ten minutes from downtown Omaha. You can park on Pearl Street right out front or in the small lot next door.

Tours are self-guided, but there are docents throughout the building who can explain the drum, the infirmary, and the family quarters. Plan on 45 minutes to an hour. If you're driving through Omaha or Council Bluffs, or anywhere along I-80, it's worth the stop.

Hey, me too:

What an annoying email to receive. Just the new wave of spam, this time powered by pedantic LLMs.

Hopefully the next iteration can actually understand context and realize I don't need someone to give me a "close reading" of my work. Imagine paying $25 to reiterate that I have poor writing skills. I already know that, I don't need to pay to hear it.

What is a liminal space?

If you look online, you'll find hallways, empty pools, or malls with the lights off. You scroll through and experience the same eerie feeling each time: "This feels off. It feels like something is wrong, but I can't pin it down."

The feeling is real and the good news is that you're not alone. There's a real reason these places do that to you, and it turns out the word we all use for them is describing something else entirely. I've felt a strong connection with liminal spaces my whole life and I wanted to sit down here and write about it for a while, similar to The Night Feeling, which I wrote recently.

2. Where It Happens

A hotel hallway at 3 AM.

A bus station lounge between connections.

A parking ramp stairwell, lit by a lone sodium lamp, flooded with yellow light.

Imagine yourself standing in one of these locations. Look around and picture the carpet, the silence or the sounds of strangers somewhere in the distance, the light and shadows bouncing off the walls. Nothing is happening. Nothing was ever supposed to happen here; the room was built for you to walk through it, and yet you stopped.

I often find myself standing on an empty street, meant to be bustling with traffic, looking around at the pure absence as I exist in that space by myself. The lamps shine down, flickering and glowing yellow. The bugs chirp and make sounds throughout, letting you know that there are hundreds or thousands of creatures around you, but it feels empty nonetheless.

3. The Feeling

It's not fear, or loneliness, or nostalgia. You're simply somewhere you have no reason to be, at a time nobody intended for you to be there. Or you're in a place you'll never think of again. Or a place where you know no one has ever stood still.

It's strange, because these are the same conditions I wrote about loving at night: empty space, no one asking anything of me. At night that emptiness felt like permission to be alone in my own space, but here it feels like a mistake.

4. The Effect

These spaces are built to move people through them, accounting for the nonstop movement of crowds. Take the crowds out of the picture and suddenly the room is useless. The airport terminal without people is a room without a purpose. When you stumble upon one of these rooms, this is where you encounter that uneasy feeling.

A big factor in this uneasy feeling is that they're built for large groups of people. Mall hallways are meant to support crowds of people moving quickly in all directions, popping in and out of shops. When you find them empty, or with a single person in them, the spaces feel enormous.

These places aren't built to belong anywhere. A hotel hallway in one city looks like a hotel hallway in any other city, because neither one was meant to tell you where you are. The anthropologist Marc Augé called these non-places: motorways, hotel rooms, airports, malls. A real place gives you an identity and a reason to be there. A non-place gives you neither. When you stop in one, there's nothing in the room to tell you where you are, and the uneasy feeling grows.

Part of the strangeness is that you recognize these rooms without ever having been in them. The drop ceilings, fluorescent lights, and commercial carpet are the same in thousands of buildings, so any one of them looks like all the others you've walked through. You end up with a place you can recognize but never identify. This is also how dreams can work, which is why people so often describe these images as dreamlike.

The missing people are the focal point of the experience. People have described these spaces as an uncanny valley of architecture: familiar enough to read as normal, empty enough to read as wrong. A room built for hundreds with nobody in it suggests that something happened to everyone else, or that you're the only one left. Nothing in the room says that, but you feel it anyway.

Most of these interiors come from the 80s, 90s, and early 2000s, which means they're the childhood environments of the people making and sharing the images. The mall, the school hallway, the motel pool are all places you spent time in before you had any say about where you went. Then COVID emptied real public space for everyone at once, and the whole thing stopped being a niche interest.

5. The Backrooms

The best known version of all this is the Backrooms. In May 2019, someone on 4chan's paranormal board asked for images that "just feel off," and one of the replies was a photo of a room with pale yellow walls, fluorescent lights, and a tilted camera angle. Another user wrote a caption about noclipping out of bounds in real life and ending up there. That was the whole thing, and it worked: a room built for people, with no people, that you can recognize and can't place.

From there, it has grown exponentially. People added levels, then rules, then monsters. Kane Parsons' YouTube shorts in early 2022 turned it into a full horror franchise and took it mainstream.

Something got lost in that. The original photo is unsettling because nothing is there. Once you put a creature in the room, the emptiness isn't doing the work anymore; the monster is. It becomes a normal horror story that happens to be set in a hallway, and the specific feeling that made anyone care about the photo in the first place is gone.

6. Liminal Is the Wrong Word

That brings up the word itself. Liminal comes from the Latin limen, meaning threshold. The anthropologist Arnold van Gennep used it in 1909 to describe the middle stage of a rite of passage: you're separated from your old role, you spend time in between, and then you're brought back in with a new one. Victor Turner picked the idea up in the 1960s and it spread from there.

The important part is that liminality describes a person, not a room. It's a state you're in while you're changing from one thing into another, and it ends when the change is done. A graduation is liminal. A funeral is liminal. A hallway isn't.

So the spaces in these photos aren't liminal. They're non-places, and the feeling you get standing in one is the absence of the crowd they were built for. Calling that liminal borrows a word for something that was never about rooms at all.

7. Oshkosh, Wisconsin

In 2024, people finally tracked down where the original Backrooms photo was taken. It's the second floor of a building on Oregon Street. That address held Rohner's Furniture until 1994, and HobbyTown bought it in 2002 and started remodeling. Someone photographed the empty upstairs that June and posted it to the store's renovation blog the following year.

That's it. The most reproduced image of dread on the internet is a hobby shop's construction photo. Nobody was trapped there and nothing was wrong with the room. It was a store that wasn't finished yet. The building is a hobby shop again today, and the spot where the photo was taken is now a carpet racetrack for radio controlled cars.

Nothing in that photo was between one thing and another except the store. The room was never liminal. You were.

If you're unfortunate enough not to have lived through the heyday of .nfo files, I want to provide some context. Because honestly, this project might seem weird or useless without it.

First, an NFO file (short for info/informational) is a file format originally released in 1990. This file format was used by various projects, but especially by warez/scene groups to provide info about their projects. This might include credits, installation instructions, BBS/contact info, greetz/notes, etc.

For example, here's the bonzai.nfo file for a patched save game for Lemmings III, with credits to those involved and instructions to get in touch.

Note: The original file on textfiles.com contains CP437 bytes decoded as Cyrillic, so I converted this example correctly to CP437. If you view the online version, you'll notice that the box drawing and group logo are incomprehensible, which proves my point later on in the CP437 section.

            ║                                                   ║

       █████║                                                   ║
       █████║                                                   ║
       █████▀███  █████▀███  █████▀███  █████▀███  █████▀███  ▀▀▀▀▀
       █████║████ █████ ████ █████ ████ █████ ████ █████ ████ █████
       █████║████ █████ ████ █████ ████ ▄▄▄▄▄▄████ █████▄████ ██████
       █████║████ █████ ████ █████ ████ █████ ▄▄▄▄ █████ ████ ██████
       █████ ████ █████ ████ █████ ████ █████ ████ █████ ████ ██████
       █████║████ █████ ████ █████ ████ █████ ████ █████ ████ ██████
       █████║████ █████ ████ █████ ████ █████ ████ █████ ████ ██████
       █████ ████ █████ ████ █████ ████ █████ ████ █████ ████ ██████
       ▀▀▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀ ▀▀▀▀▀ ▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀ ▀▀▀▀▀ ▀▀▀▀ ▀▀▀▀▀▀
            ║    ╓────────────────────────────────────────╖     ║
                 ║ ■ BONZAi ─ EVERYTHiNG BUT FRiENDSHiP ■ ║
            ║    ╙────────────────────────────────────────╜     ║
                             R E L E A S E D :
            ║                                                   ║
            ║     9O BYTES SAVE GAME PATCHER FOR LEMMiNGS III   ║

            ║ FiLENAME .............. : ........... BNZ-L3T.ZiP ║
            ║ TYPE .................. : ............... TRAiNER ║
            ║ COMPANY ............... : ............. PSYGNOSiS ║
            ║ CODER .. .............. : ................ SCAMPY ║
            ║ PACKAGER .............. : ................ SCAMPY ║
            ║ DATE AT RELEASiNG ..... : ............ 11-27-1994 ║
            ║ TiME AT RELEASiNG ..... : .............. 15:OO PM ║
            ║ RELEASE NOTES : ..................... READ BELOW! ║
            ║                                                   ║
            ║            !!!*!!! IMPORTANT !!!*!!!              ║
            ║                                                   ║
            ║  NiCE PATCHER FOR A NiCE GAME - THiS PATCHER WAS  ║
            ║  KINDA DiFFiCULT BECAUSE OF THE MANY BYTES TO BE  ║
            ║  PATCHED. BUT PROBLEMS WiTH PATCHiNG TiME AND     ║
            ║  FiLE LENGTH HAVE BEEN SOLVED.                    ║
            ║                                                   ║
            ║  ENJOY PLAYiN' -SCAMPY!                           ║
            ║                                                   ║
            ║                                                   ║
            ║ MEMBERS OF BONZAi ARE . :                         ║
            ║                      MOTiV8- SCAMPY- SUM-1- DEViL ║
            ║                                                   ║
            ║ BULLETiN BOARD SYSTEMS  :                         ║
═  ═  ══ ═══╝                                  NONE! SEARCHiNG! ╚═══ ══  ═  ═

                               GREETiNGS TO:
              TOXiC  HYBRiD  PENTAGRAM  PARADOX  THHG  G.T.A  TRSI

     #TO GET iN TOUCH WiTH BNZ LEAVE MAiL TO US ANYWHERE YOU FiND US#

    CURRENTLY WE ARE SEARCHiNG FOR ALL KiND OF MEMBERS.. LiKE TRADERS
                         SUPPLiERS.. SYSOPS.. ETC.

═ ═   ══  ══════════════════════════════════════════════════════════ ══  ═  ═

If you want to browse an archive of NFO files, head over to textfiles.

2. The Aesthetic

2.1. ASCII Art and Box Drawing

As you can see in the example above, complex ASCII drawings, logos, and structure are a staple of a good NFO file. Commonly, the ASCII art is used to create recognizable logos for specific groups in the scene.

This requires fixed-width fonts to be viewed appropriately. E.g., on Windows, you could open an NFO file in Notepad and ensure a fixed-width font is selected, such as Consolas. Proportional and custom fonts break the flow and structure of these files, which is unfortunately the default in modern browsers (unless you use code blocks, like I did above).

2.2. Codepage 437

One such character set was often used for NFO files: IBM's CP437 character set, released with the 1981 IBM PC. This set was popular because each character could be typed with an alt code in DOS, even if they were not on the user's keyboard. E.g., Alt + 3 would result in the following character: ♥.

3. Introducing: nfogen

So, why am I writing about this now? Well, I was feeling nostalgic for NFO files recently. As part of this, I started using NFO files for my git repos under my new org and wanted a tool that could help me accelerate the generation of these files.

Introducing nfogen, a small Python utility that can generate NFO files for you based on:

• templates
• profiles
• configuration files
• CLI flags
• interactive CLI prompts

This enables fast, customizable, and templatized NFO files you can generate on the fly.

3.1. Sample Output

There's no better way to introduce a project than to show a demo, so here's a demo of how I generated the README.nfo for nfogen itself.

First, I defined nfogen.toml so that I could use this as a configuration file during generation:

group = "KRZ"
site  = "krz.sh"
width = 79
style = "double"
layout = "rows"

banner      = true
banner_text = "NFOGEN"

footer      = true
footer_text = "nfogen  //  krazy warez  //  krz.sh"

title      = "nfogen 1.2.2"
type       = "CLI / library"
publisher  = "krazy warez"
language   = "Python 3.11+  (any 3.x with a JSON config)"
files      = "nfogen.py  --  single file, zero deps"
url        = "krz.sh"

notes = """
nfogen builds scene-style ASCII .nfo files from CLI flags, a config
file, interactive prompts, or any mix of the three.

FEATURES
  - CP437 or UTF-8 output; single / double / block box styles
  - two-column release+game info panel, or simple rows
  - group profiles: reusable logo, members, couriers, boards
  - mediainfo import auto-fills video / audio / resolution / size
  - built-in ASCII banner generator for header logos (this one!)
  - bundled templates: razor, modern, minimal

QUICKSTART
  nfogen.py --title "Some.App.v1-KRZ" --type APP --banner
  nfogen.py -c release.toml -p group.toml -o release.nfo
  nfogen.py -t razor --title "..." --mediainfo dump.json
  nfogen.py -i                          (prompt for every field)

RESOLUTION ORDER
  template < profile < config file < CLI flags < prompts

See examples/ for full release nfos and a group profile, and
templates/ for the bundled presets. This README.nfo was itself
generated by nfogen:   nfogen.py -c nfogen.toml
"""

Next, I ran the following command, which produced the NFO file below:

nfogen.py -c nfogen.toml -o README.nfo

                   #   #  #####   ###    ####  #####  #   #
                   ##  #  #      #   #  #      #      ##  #
                   # # #  ###    #   #  #  ##  ###    # # #
                   #  ##  #      #   #  #   #  #      #  ##
                   #   #  #       ###    ####  #####  #   #

╔═════════════════════════════════════════════════════════════════════════════╗
║                           N F O G E N   1 . 2 . 2                           ║
║                               [ KRZ ]   krz.sh                              ║
╠═════════════════════════════════════════════════════════════════════════════╣
║   DATE       2026-08-08                                                     ║
║   TYPE       CLI / library                                                  ║
║   PUBLISHER  krazy warez                                                    ║
║   LANGUAGE   Python 3.11+  (any 3.x with a JSON config)                     ║
║   FILES      nfogen.py  --  single file, zero deps                          ║
║   URL        krz.sh                                                         ║
╠═════════════════════════════════════════════════════════════════════════════╣
║   NOTES                                                                     ║
║                                                                             ║
║   nfogen builds scene-style ASCII .nfo files from CLI flags, a config       ║
║   file, interactive prompts, or any mix of the three.                       ║
║                                                                             ║
║   FEATURES                                                                  ║
║     - CP437 or UTF-8 output; single / double / block box styles             ║
║     - two-column release+game info panel, or simple rows                    ║
║     - group profiles: reusable logo, members, couriers, boards              ║
║     - mediainfo import auto-fills video / audio / resolution / size         ║
║     - built-in ASCII banner generator for header logos (this one!)          ║
║     - bundled templates: razor, modern, minimal                             ║
║                                                                             ║
║   QUICKSTART                                                                ║
║     nfogen.py --title "Some.App.v1-KRZ" --type APP --banner                 ║
║     nfogen.py -c release.toml -p group.toml -o release.nfo                  ║
║     nfogen.py -t razor --title "..." --mediainfo dump.json                  ║
║     nfogen.py -i                          (prompt for every field)          ║
║                                                                             ║
║   RESOLUTION ORDER                                                          ║
║     template < profile < config file < CLI flags < prompts                  ║
║                                                                             ║
║   See examples/ for full release nfos and a group profile, and              ║
║   templates/ for the bundled presets. This README.nfo was itself            ║
║   generated by nfogen:   nfogen.py -c nfogen.toml                           ║
╠═════════════════════════════════════════════════════════════════════════════╣
║                                                                             ║
║                     nfogen  //  krazy warez  //  krz.sh                     ║
║                                                                             ║
╚═════════════════════════════════════════════════════════════════════════════╝

For more examples, browse the examples directory within the repository.

4. Usage

4.1. Installation

The fastest installation method is to fetch and use the Python file directly:

curl -O https://gitbay.org/krz/nfogen/raw/main/nfogen.py
python3 nfogen.py -i

4.2. Generating a File

As noted in the README above, there are numerous ways to generate an NFO file:

# CLI Flags
nfogen.py --title "Some.App.v1-KRZ" --type APP --banner

# TOML Configuration Files
nfogen.py -c release.toml -p group.toml -o release.nfo

# CLI Flags & JSON for mediainfo
nfogen.py -t razor --title "..." --mediainfo dump.json

# Interactive Mode
nfogen.py -i

5. How It Works

nfogen itself works by parsing the various inputs, determining a style to use for the box-drawing/character sets, and rendering the characters individually by rows and columns.

5.1. Width

The first issue I ran into was determining the width to use. I settled on 79 characters, border characters included, because terminals were 80 columns wide and a line that hits exactly 80 wraps on its own. This means that my script needs to perform some math to calculate wrapping, padding, and centering of text throughout.

The math is relatively simple because CP437 is single-byte and single-width, which means I can write functions that depend on that one-to-one correlation to calculate the spacing properly.

_Canvas.__init__ defines a few key variables for width:

self.width = width
self.inner = width - 4        # single-column content width
self.cl = (width - 7) // 2    # left panel content width
self.cr = (width - 7) - self.cl
self.rfill = width - self.cl - 5

At a width of 79 characters, this breaks down into:

These combine into a cohesive 79-character-width NFO file with consistent padding and alignment.

5.2. Character Sets

nfogen currently supports two different character sets as outputs: UTF-8 and CP437. For example, there are ╔ ═ ║ characters in the UTF-8 example, but a real CP437 file contains the single bytes 0xC9 0xCD 0xBA.

However, this doesn't really change the core generation of the NFO file. The file itself is charset-independent and the charset only comes into play during the final encode of the file.

Referring back to the bonzai.nfo file above, it was decoded improperly as ISO-8859-5, which resulted in Cyrillic characters instead of the proper charset. Defining an appropriate charset and encoding/decoding is critical to ensuring the longevity of NFO files.

5.3. Banner Generator

The banner generator is a function by itself, which renders independent from the rest of the file and separate from the box geometry. This function defines a set of glyphs, takes an input text string from the user, and maps each character to its glyph. The result is rendered above the box and is centered, so it does not depend on the math applied to the canvas.

If an explicit art file is defined, this generator does not run.

# A compact 5-row block font for the banner generator. Each glyph is five
# rows joined by "/". Uppercase letters, digits, space, and a few symbols.
_FONT = {
    "A": " ### /#   #/#####/#   #/#   #", "B": "#### /#   #/#### /#   #/#### ",
    "C": " ####/#    /#    /#    / ####", "D": "#### /#   #/#   #/#   #/#### ",
    # ... through Z, 0-9, space, -, ., !, :
}


def banner(text: str) -> str:
    """Render text as a 5-row ASCII banner using the built-in block font."""
    rows = ["", "", "", "", ""]
    for ch in text.upper():
        glyph = _FONT.get(ch, _FONT[" "]).split("/")
        for i in range(5):
            rows[i] += glyph[i] + "  "
    return "\n".join(r.rstrip() for r in rows)

5.4. Resolution Order

Finally, I defined a specific order to the inputs. As stated in the README, the order of importance is: template < profile < config file < CLI flags < prompts.

This was an opinionated design choice, as I felt that if you were to run the script in interactive mode, that meant you wanted those to take precedence over all. Then again, specifying CLI flags directly when running the script should do the same. Finally, specifying configuration files, profiles, and templates will take precedence in descending order.

6. The Future

I'd love to build this tool out to support more character sets, pre-built libraries for ASCII art and table layouts, and more customization options.

For now, the tool works and is sufficient for my personal use cases, so I'm content with it.

If you're interested in helping, feel free to reach out!

For a long time, I've been using weblorg, a static site generator (SSG) for org-mode. It uses Emacs Lisp, which pairs well with Emacs. However, it has a few downsides:

• since it requires Emacs, the set-up and maintenance is heavy
• it has upstream dependencies that must also be installed and loaded into Emacs
• it re-runs the full process every time you need to regenerate the site, even if you only change a single character in one file
• since it runs through Emacs in the background, it takes quite a while to build my site (~180 pages)

So, I decided to spin up my own org-mode-based SSG: orgo. This SSG uses org-mode (rather than markdown) for its content.

2. Results Up Front

I want to highlight the speed first, before I go into the major differences. As you can see in the table below, orgo is incredibly fast.

Additionally, I added a few new features that weblorg didn't provide me:

• Native features I used to build in Python post-weblorg:
  • Tag listings
  • Year separators on the blog page
  • RSS feed
  • Sitemap
  • Recent posts lists
• Syntax highlighting for 75 languages is supported, and you can drop in your own syntax definitions for anything missing.
• Builds are incremental. Only the pages whose content, config, or templates changed get re-rendered — adding a single post re-renders that post and the index that lists it, and nothing else.
• There is no Emacs, no package manager, and no runtime to install since orgo is a single binary.

This results in a fast, clean, and simple SSG that stays out of my way instead of requiring extensive set-up and maintenance.

3. What It Is Built On

Note: This section is for the nerds. Feel free to skip if you don't care about the technology behind orgo.

orgo is Rust, and it leans on a handful of well-worn crates rather than reinventing them:

• The org parser is hand-written, about 1,500 lines of it. There is no org-mode crate to lean on, and writing that parser is most of what writing an org SSG turns out to be.
• Templates run on minijinja, which speaks Jinja2. weblorg's templates are written for templatel, which is close enough that porting them was mostly a rename job.
• Syntax highlighting is syntect, so the definitions and the themes are Sublime Text's. This site renders code with InspiredGitHub.
• Incremental builds hash the content, the config, and the templates with blake3. A page is re-rendered when its hash changes, and the manifest that remembers them is JSON sitting in the output directory.
• Pages render in parallel with rayon, which is straightforward here because each page writes only its own file.
• The config is TOML, the CLI is clap, and orgo serve is notify watching for edits with a tiny_http server in front of the output.

4. Getting Started

If you use org-mode (or have been looking for a proper org-mode SSG), check it out and let me know what you think.

It's as simple as installing, initializing a new site, and serving it!

cargo install orgo
orgo init my-site
orgo serve my-site -o _site

It can create a new project for you, adapt to your current org site, or simply serve your folder of org-mode notes and files.

Three more commands cover the rest of the day-to-day:

• orgo watch rebuilds incrementally as files change, driven by filesystem events, without serving anything. This is handy when something else is already serving the output directory.
• orgo clean removes the output directory, cache manifest and all, for when you want to start from scratch.
• orgo audit reports which org constructs a folder actually uses, and marks the ones it doesn't handle.

5. The Future

I'll be looking into making some built-in themes soon and exploring other features that make it a bit more seamless, as well as adopting to various methods different users may expect it to work.

If you have any suggestions, reach out and let me know or open an issue/PR on GitBay!

Go check out the post here: People and Blogs: Christian!

Lots of praise to Zach and his predecessor, Manuel Moreale, for their series of interviews with various people on the web!

The short answer: fiber finally became available at my current residence, so I jumped on it immediately.

The slightly longer answer is that I'd previously enjoyed proper 1 Gbps fiber, but for a while now I'd been stuck limping along on "1 Gbps" cable from Cox that, in reality, often crawled along at 100 Mbps regardless of what I did to fix it. New modem, new cables, different ports, calls to support - nothing mattered. It ran at whatever speed it felt like that day.

So when Google Fiber showed up in my neighborhood, I ordered the 8 Gbps package immediately. I'll upgrade to their 10 Gbps package the moment it's released, but I'm not exactly suffering in the meantime.

A quick note on the title before we go further: my internet is 8 Gbps for now, but this post is really about rebuilding my internal network to 10 Gbps end to end. The WAN is just the excuse to upgrade everything.

In the screenshot above, you can see that Google Fiber was installed on 7/20 and UniFi entered WAN failover mode (the blue bar) and then I unplugged Cox on 7/22, resulting in the green Google Fiber bar.

As you can also see, Cox was a train wreck - cycling between yellow (disconnections, lag, etc.) and red (no internet connection) for the previous month.

2. What I Was Running Before

Nothing exotic. My network was built entirely on 1 Gbps gear:

• A 24-port UniFi switch in the rack.
• Two 8-port UniFi switches serving other rooms.
• A Cox "1 Gbps" WAN that, as mentioned, frequently delivered closer to 100 Mbps.

It worked. For years, it was more than enough - I've written before about how my homelab basically maintains itself, and the network was no exception. But once I had real bandwidth coming into the house, 1 Gbps internally became the bottleneck instead of the ISP.

As a result, I installed the hardware I'll list in the next section. You can see the 10G connections in blue and the 1G connections in green.

3. The Hardware

Everything here is UniFi. I'm already knee-deep in the ecosystem, and at this point fighting it would cost me more time than it's worth. Staying in one platform means everything shows up in a single controller and I don't have to think about it - which is exactly how I like my homelab.

This rack shows:

• UDM Pro router.
• 10G 24-port switch.
• Switch panel with keystone jacks.
• 1G 24-port switch.
• My server.

This is before the Google Fiber installation, so you can see that the WAN RJ45 port is in use on the UDM Pro instead of the SFP+ port.

I also removed the old 1G switch after this picture and plan to sell it. I just didn't want to box it up quite yet when I took this photo.

3.1. Switch

Two switches did the heavy lifting for the upgrade:

• USW Pro HD 24 PoE: the new core switch in the rack, replacing my old 1 Gbps 24-port unit.
• USW Pro XG 8 PoE: a smaller 10G switch serving another room, replacing one of the old 8-port units.

3.2. NICs

Neither of my two most important machines shipped with 10G, so both needed a new network card:

Windows Gaming PC: an Intel X520-DA1, a 10G SFP+ card.

Server: an Intel X710-DA2, a dual-port 10G SFP+ card.

The Ubuntu server already had Intel drivers installed, so I wasn't required to install anything. I simply slotted the NIC into the PCIe port on the motherboard and it worked.

However, the Windows machine was a different story. It did come with an installation CD-ROM, but I of course ignored that since I have no disc drive in my PC. I tried to find the right drivers online, but Intel's websites are a vast wasteland of useless downloads and circular links.

Eventually, I pulled a USB-C disc reader from storage and used the CD, which magically installed on the first try and everything started working from there.

That'll teach me (not really).

3.3. Cabling

This is where 10G gets fiddly, and where most of my shopping list ended up. Going 10G means leaving RJ45 behind for SFP+ almost everywhere:

• SFP+ to RJ45 Adapter: bridges the Google Fiber RJ45 handoff into the SFP+ port on my UDM Pro.
• UniFi Etherlighting Patch Cable: short in-rack runs between the switch, the other rack devices, and the fiber modem.
• 10G Direct Attach Cable (DAC): the short SFP+ runs from the rack switch to the server, and from the second switch to the gaming PC.
• 10G Active Optical Cable (AOC): the long run between the rack and the 8-port switch in the other room, where a copper DAC won't reach.

3.4. Cost

None of this is cheap, so here's the full damage:

4. The Upgrade

With the parts in hand, the actual topology is straightforward. Bandwidth flows in from the street and fans out through the rack:

Google Fiber
    │  (RJ45 → SFP+ adapter)
    ▼
UDM Pro
    │  (Etherlighting patch)
    ▼
USW Pro HD 24 (core switch)
    ├─ DAC ──────────► Server
    ├─ AOC ──────────► USW Pro XG 8 (other room)
    │                       └─ DAC ──► Windows Gaming PC
    └─ ETH ──────────► USW 8-port (1G switch)

The UDM Pro takes the Google Fiber handoff through the RJ45-to-SFP+ adapter, then hands everything down to the new 24-port switch over an Etherlighting patch cable. From there, the server hangs directly off the core switch on a short DAC, and a long active optical cable carries 10G across the house to the second switch, which finally feeds my gaming PC. My surviving 1 Gbps 8-port switch still hangs off the core switch too, handling everything that doesn't need 10G.

The physical installation was pretty easy. I needed to replace a drive in my server's ZFS pool, so I already needed to get inside the rack. Since I don't use rails, I had to unscrew and pull out each device by hand.

From there, the NIC (and HDD) installation in the server was seamless. Just pop out one of the metal slots on the back of the server, slot the NIC into the PCIe lane, and line up the port with the new opening in the back panel.

All in all, it was easy and simple. No physical snags, only one driver issue on the Windows machine (which was my fault for ignoring the provided CD), cabling runs were easy, and UniFi updates were minimal.

5. Benchmarks

Let's nerd out on the numbers.

5.1. Before

I don't actually have any speed tests from before the upgrade, but the Cox connection had degraded even further by the end - down to roughly 70 Mbps for the month prior to the upgrade.

Occasionally, I was able to get ~800 Mbps when the connection would work properly.

5.2. After

So, here's the catch. I'm not getting the full 8 Gbps currently. When the Google tech installed the modem, we confirmed ~ 8500 Mbps together, which means the fiber is working through the ONT and the modem.

However, they would not connect directly to my router, which means the Google modem is in bridge mode for now.

The speed test below shows an average speed, where I'm getting 5 to 6 Gbps to my router. While not the full 8 Gbps, I'm not saturating it anyway, so I haven't dug into my UniFi settings to determine what's causing the difference.

A supplementary test showing speeds directly to my server:

6. Was It Worth It?

Here's the honest part.

Do I need 10 Gbps between my gaming PC and my server? Probably not. The number of times a day I move enough data to saturate even 1 Gbps is small, and for most of what I do, this changes nothing I'll consciously notice.

But that was never really the point. I finally have an internet connection that delivers what I pay for, and a network that won't be the bottleneck for years to come. After spending so long fighting a "1 Gbps" connection that never once hit 1 Gbps, there's something deeply satisfying about watching a transfer actually move as fast as the hardware allows.

Instead of constantly monitoring speeds and pausing services so our work-from-home connections aren't impacted, I can let my server idle at 400 Mbps 24/7, not to mention all the other devices in my home.

Was it worth it? For the peace of mind alone: yes.

If you're new to my blog: I'm not a full-time developer and don't do this for a living. I develop sites, apps, etc. for fun as a hobby. I open-source everything I create so others can share or fork as they please, and I've never even included a tip option (until now - that iOS developer subscription is expensive!).

1. My Apps

However, I've launched a few apps on the Apple app store in the last year:

• DomainDig (Source) - A domain inspection toolkit for DNS, SSL, ports, etc.
• Hutch for Sourcehut (Source) - A mobile client for SourceHut.
• DayByDay (Source) - A children's app to learn various topics through voice-enabled learning cards.

I didn't expect anyone to really use these and I don't promote my apps anywhere.

I created DayByDay for my daughter, as a flashcard-style app that would be easy for her to use and something we could do together in the small moments of the day.

I created Hutch because I wanted a faster way to use SourceHut on the go, especially since I use private mode in Safari and am constantly logged out of my accounts. Hutch lets me read my mailing lists, manage tickets, and run builds wherever I want.

Finally, I created DomainDig because I was lamenting the updates Njalla made to their DNS Checker - it used to be a plain text page and is now wrapped in Njalla's branding and lacks some info I want when looking into a domain.

2. My Achievements

I'm proud to announce two (baby-sized) achievements I didn't expect to happen:

1. I received my first two tips through the Hutch app! For a few dollars, two people have made my whole month. It's extremely satisfying to know someone used the app and found it valuable enough to voluntarily send some money my way.
2. I received two 5-star ratings on the DomainDig app. Again, such a pleasure to know people do appreciate the value that the app brings.

I'm not going to pretend two tips and two ratings will change anything. I'll keep building these apps in the small moments the same way I always have, because that's the part I actually enjoy. But it's a nice reminder that "nobody will use this" isn't always true. Sometimes a stranger finds the thing you made for yourself and gets something out of it too.

So, to the four of you: thank you. You made my month.

I've forked SkunkyArt, an alternative privacy frontend for DeviantArt that works entirely without JavaScript, over to the krz organization on GitBay.

1.1. Project Links

• Source
• Instances
• Issues

1.2. Why Fork?

I didn't fork this project just for fun. At the time I found it, the upstream repository hadn't been updated in over a year, carried a number of unresolved bugs, and every instance on its public list was a dead link. Rather than let a genuinely useful privacy frontend rot, I decided to pick it up and keep it maintained.

1.3. What's Changed So Far

The fork is already a handful of releases ahead of upstream. Highlights so far:

• Security & hardening: fixed a forged-subdomain bypass in the media proxy, hardened the HTTP transport, server timeouts, and panic paths, and tightened the random-art retry loop.
• Bug fixes: restored media serving, corrected the cache max-size conversion, fixed the build on macOS, and cleaned up various smaller issues.
• Dependencies: migrated to a maintained fork of the underlying DeviantArt API library, devianter, and bumped long-stale dependencies (with Dependabot keeping them current going forward).
• Distribution: prebuilt multi-arch Docker images (linux/amd64 and linux/arm64) are now published to GHCR on every release tag:

docker pull ghcr.io/krazywarez/skunky-art:latest

• Tooling: added CI, golangci-lint, and outbound request throttling for DeviantArt.

2. Run an Instance!

Since all of the previously listed instances are gone, the instance list is starting fresh. If you'd like to host one, the README covers setup — including a Docker Compose example (plus an optional VPN egress variant) — and you can add your instance to the list with a quick PR or issue.

As always, bug reports and contributions are welcome.

I don't read posts in my feed reader to look at styles, I do it to consume content - to read their thoughts.

I use my feed reader because it's configured exactly how I like it. The colors are tweaked to a palette that's pleasing to my eyes and doesn't cause strain. The font family, font size, and other elements are customizable and configured exactly how I like them.

I can't tell you how many times I've opened a great blog post and struggled to read it and had to enable Reader Mode in my browser just to get through it.

HTML is great because it's a structured markup where we can disregard the web server's custom styles and apply our own. In fact, there are whole communities around custom style sheets to mold the web into your own comfortable space.

Sure, there are great looking blogs out there. But honestly? There are far more poorly-styled blogs or blogs that are fine, but conflict with my own sense of style or eye comfort.

Keep it up, RSS. Thanks for shielding me from visual discomfort and flashing yellow text on purple backgrouunds.

Linus Torvalds' recent defense of AI in the Linux kernel sparked the predictable backlash, but the real debate is far more nuanced than that.

This specific blog post is in response to Simon Willison's post of the quotation below on his website.

As Linus says in his message:

I realize that some people really dislike AI, but this is an area where I'm willing to absolutely put my foot down as the top-level maintainer.

Linux is not one of those anti-AI projects, and if somebody has issues with that, they can do the open-source thing and fork it.

Or just walk away.

AI is a tool, just like other tools we use. And it's clearly a useful one.

It may not have been that "clearly" even just a year ago, but it's no longer in question today.

There are other questions around AI (like what the economy of it will actually look like in the end), but "is it useful" is no longer one of those questions. Anybody who doubts that clearly hasn't actually used it.

— Linus Torvalds, Linux Media Mailing List

2. My Thoughts

…and I agree. I do understand some of the push-back from others - such as the commenters on lobste.rs.

However, online communities tend to drift into the extremes and hard-line their opinions without considering broader context.

Linus is right that AI is a tool and a very useful one. The commenters are right that there are additional considerations, such as environmental concerns and social/cultural impacts, that we need to consider as we approach the usage of AI tools. But "AI is bad and should be banned" is neither an answer to those questions nor is it an informative take on the collective AI options out there, beside the top AI offerings.

This push-back often conflates different issues and muddies the waters of the argument: environmental cost/impact, job displacement, corporate capture of open-source labor, and code quality. These are all valid concerns and absolutely deserve attention. But the solution isn't to bury our head in the sand and avoid it. The solution is a logical review of the options and clarifying your stance as a maintainer - write up clear contribution guidelines and code review standards. These steps work regardless of your stance on AI as a maintainer.

The bottom line here is that AI tools exist and will not be going away. Developers will approach our projects with these tools, not to mention attackers or hackers looking to exploit open-source projects.

The goal, then, is to level the playing field. How can we enable open-source project maintainers to effectively and efficiently maintain their projects while protecting both their sanity and users?

Each project may approach this differently, depending on their individual values and concerns, but it's silly to dismiss AI outright without discussion. If a project's set of maintainers or community decides to ban AI, that's their right. But if a maintainer chooses to allow AI in some or all cases, that's also their choice.

The reality is simple: maintainers set the rules for their projects. Some will embrace AI and some will outright refuse, and we should respect the rules on the projects we contribute to. The Linux kernel's openness to it doesn't obligate anyone else to accept AI. Linux is saying we get to choose when working on the kernel and that's worth defending. Personally, I appreciate that he's willing to take a stance one way or the other, rather than avoid making a statement just to avoid the conflict.

Lastly, I know some have noted Linus's (often brusque tone) again regarding his "fork it or walk away" point. I'll be honest, I agree with him wholeheartedly here. That's the whole point of open-source. You don't have to use AI to work on the kernel and if you have a strict rule against being involved with projects that involve AI, fork it and maintain a non-AI version. Build a community around it if your feelings are popular with others.

There is a feeling I’ve had most of my life that I’ve never had a good name for.

It shows up at night, usually when nothing is happening. A quiet road. A gas station glowing under the only visible lights in a black landscape. A parking lot after the store has closed, perhaps lit by a flickering neon sign. A bedroom lit by a monitor. The rest of the world asleep, or at least far enough away to stop asking anything from me.

It is not exactly loneliness. It is not sadness either, even when it carries some of both. It feels closer to relief.

At night, nobody needs me to perform. There are fewer messages to answer, fewer decisions to make, fewer people to become for the sake of the room. The world stops asking me to keep up with it for a while.

2. Nighttime on the Farm

For a large portion of my childhood, I lived on a rural farm in Minnesota. If you've never stayed in a remote area, it's hard to explain just how quiet it is, especially at night.

During winter, heavy snow filled the landscape and acted as a natural sound buffer, further quieting the world.

As the sun went down, everything settled. Most of what remained was wind, snow, and the occasional sound of an animal moving somewhere nearby.

We had a single wooden pole, partially slanted sideways from decades of weather, with a lamp that would emanate a soft, golden glow on a portion of the ground. As I looked out from the lamp, it would fade to black in all directions. Off in the distance, I would see faint amber circles from other farms, miles away.

At that point, I was free from obligations. No schoolwork. No chores. No family talking to me. Nothing else trying to take up space in my head. I was alone in the universe and at peace.

Instead of the hum of city traffic and distant sounds of others awake at night, rural nighttime brought me closer to nature than I have ever been since.

3. After Hours

The setting changed, but the feeling stayed. The empty road became the quiet hotel room, the late walk through downtown, the stoplight changing colors for no one. I was older, but the night still made room for me in the same way.

As I moved into adulthood, work, family, and friends filled more of my time, leaving fewer quiet hours to myself. I found solace in the "after hours" - traveling home from work, going out for a walk, or taking photos alone.

I travel a fair amount for my company, which leaves me with the task of finding food at odd hours and gives me a reason to explore the cities I visit.

Other than work, this feeling blends into city nights, where people are awake and businesses are open somewhere near me. I've lived near downtown twice so far, which led to many nighttime adventures when I was bored or couldn't sleep. Sometimes a walk helps me think and get ready to sleep.

4. Night Weather

Weather changes the whole shape of nighttime. I've talked about snow, but there are several kinds of weather that make the night better.

I currently live close enough to several rivers that produce fog, which rolls through my neighborhood and creates dramatic nighttime effects.

And my favorite: rain. Rain hitting the roof overnight is probably my favorite version of it.

Weather gives the night permission to become even quieter. Rain makes staying still feel natural. Fog makes familiar streets feel temporarily removed from the ordinary world. Cold air makes lit windows, warm cars, and late meals feel more intimate than they would during the day.

5. Closing Thoughts

During the day, everything has a role attached to it. Work, errands, messages, bills, conversations, traffic, noise. At night, those things lose some of their authority. The same streets are still there, but they feel less owned by everyone else.

The strange part is how consistent it has been. Nearly everything in my life has changed: rooms, cars, people, locations, climate - but the feeling stayed the same.

I don’t think I love the night because it is dark. I think I love it because it gives everything more space. My responsibilities melt away and I'm left with a strange and unique freedom.

The world is still there. It just lowers its voice.

The internet; what can I say? It's the driving force behind nearly the whole world today - economies, countries, communities, and more run solely on the internet these days.

However, it wasn't always this way.

Once upon a time, the internet didn't even exist. When it did, the internet was a place. It was a place you went. You selectively chose to visit the internet, based on your own free will.

If you wanted to visit a chat room, or perhaps preview a fancy new Flash game, you visited the internet for a few minutes in the evening before going back to your family or friends.

This has changed dramatically in the last 20-30 years. Today, it's 2026 and woven into nearly every part of daily life for the majority of the Earth's population.

Let's do a quick checklist and see what requires the internet or becomes tedious if we opt not to use the internet (yes, this list is tedious on purpose):

• Banking
• Paying bills
• Taxes
• Shopping
• Watching TV or movies
• Listening to music
• Reading the news
• Looking up directions
• Ordering food
• Booking travel
• Messaging friends and family
• Video calls
• Playing most modern video games
• Downloading software updates
• Activating new devices
• Backing up photos
• Storing files
• Finding a restaurant
• Reading reviews
• Checking the weather
• Looking up a recipe
• Researching almost anything
• Applying for a job
• Remote work
• School and homework
• Medical records
• Scheduling appointments
• Government services
• Renewing licenses
• Filing insurance claims
• Managing investments
• Home security cameras
• Smart home devices
• Navigation in your car
• Finding a phone number
• Dating
• Selling used items
• Buying event tickets
• Boarding a flight
• Receiving package updates
• Authentication (2FA)
• Password management
• Identity verification

What a list. How fun. I love being absolutely restricted to a specific technology or method with little to no options.

Joking aside, this post is my personal reflection of the internet, and perhaps tech and life in general, over my lifetime. I was born in the late 1990s, but was also born in a rural area of the USA, so I have been privileged to see technology evolve from the "my stereo is the highest tech equipment in my house" stage to the "I have all of human history in my pocket" stages.

This post is about remembering these moments from my perspective, regardless of whether the evolutions have been good or bad.

As you read on, please (PLEASE!) send me an email if this post sparks a memory or you have thoughts. I genuinely enjoy hearing these stories from anyone, and I push for you to send them to me as you think of them.

2. 2001: The Family Computer

The family computer. What a throwback. Perhaps you even had a third place computer you visited. Wherever, whatever that computer was - think of that computer as you read this. I will be speaking from my perspective and I hope it resonates with someone out there.

I recall coming home from school, getting through required chores, homework, or anything else first. Perhaps you had siblings with which you shared the computer or the TV.

In my case, we owned an early 2000s Gateway tower PC. A beautiful (read: ugly), beige Gateway computer with the spotted cow on it. It sat on a big "oak" hutch, with integrated file-compatible drawers and specific spots for your matching beige desktop speakers.

To use the computer, you likely turned on a very heavy CRT monitor. Perhaps it even flickered, emitted you a static buzz, or showed a wavy pattern in the graphics. This was the epitome of 2000s technology and people loved it.

Side note: We owned a heavy, wooden CRT TV set from the 1970s or 1980s that hid all buttons behind a fake, black "speaker" that you could press to pop open. A decade or two after we had tossed this TV into our barn for disposal, my brother and I took turns hitting the glass screen as hard as we could with a baseball bat.

It never left a mark, regardless of how hard we hit it. Why don't we produce that quality anymore?

If you wanted to use the computer, you had to press a very heavy, circular button that would emit a memorable CLUNK as you engaged the button within the PC. This would result in an airplane level of whirring while it used maybe a few MB of memory and hard drive storage to boot up Windows 95.

At this point, the world was your oyster. You could do so many things that humans throughout history couldn't do:

• Open multiple programs at the same time. Scientists were baffled.
• Minimize a window, then bring it back later. Pure sorcery.
• Move files by dragging them with your mouse. We truly lived in the future.
• Change the color of every pixel in Paint. Michelangelo could never.
• Hear your speakers make a loud POP every time Windows started. Reassuring.
• Watch a progress bar slowly fill from left to right while estimating "time to complete" at 800 years. Entertainment for the whole family.
• Crash the entire computer because you opened one too many programs. Unlimited power comes with responsibility.

If you were luckier than I was, you also had access to the INTERNET at this point. The cyberspace where you transmitted your energy through hyperwaves to digital ends of the earth (i.e., sent a message to a stranger).

My family had a dial-up modem until the mid-2000s, so I was rarely to use the internet at this point. The extent of my experience spanned between our family computer (used for games, documents, and wasting time exploring every single menu and application available in Windows) and the church computer lab (containing even older computers, somehow).

At this point, there was no ritual to the internet or even to the computer itself. The computer was a tool used for specific tasks, such as my mother designing pamphlets in some obscure program for printing, or for fun.

Oftentimes, you would sit down with no particular destination. You were exploring. I use that word specifically because it's how I truly felt. Whenever I turned on a computer, I was exploring a digital universe that had not been charted before.

At this point, the internet was a distinct place you visited. Or, could ignore. If you didn't like computers or the internet, no worries. You could ignore it as much as you'd like.

3. 2004: Exploring the Web

The internet stopped feeling like software.

It became its own world.

This is the point in my life where the internet became real. I wasn't a pioneer by any means, unless we're talking about The Oregon Trail, but I was willing to test and brute force any system through sheer curiosity, from a very early age.

At this time, we launched Internet Explorer and loaded up your favorite search engine. Perhaps it was Yahoo!, Altavista, MSN, Google, or something else.

This was probably your home page, your default search engine in the browser, and had an annoying toolbar installed on top of the browser itself. If you were silly enough (like me), you had numerous toolbars that sacrificed valuable screen space for the sake of nothing.

Suddenly, you could find almost anything ever uploaded to the internet. Some options could be:

• A walkthrough for the level you were stuck on.
• A fan site dedicated to your favorite TV show.
• A forum with 12 members arguing about phreaking.
• A Flash game that somehow consumed your entire afternoon.
• Someone's personal blog documenting their life in excruciating detail.

More than this, the internet always felt enormous at this stage. No matter how much you explored, searched, or cataloged, you never had the full image. The internet was endless, borderless, and expansive. There was always a new rabbit hole waiting for you. Even if you had to watch every image slowly appear one horizontal line at a time.

Before moving on to the next section, do you remember the 1996 Space Jam website? What a modern marvel. Honestly one of the world's wonders.

4. 2007: Living There

Here we are. The part of this post I recall most vividly. The mid-2000s were a phenomenal time in my personal history, as they were my transformative years. As it relates to computing and the internet, this means that the mid-2000s were the years of my utmost exploration, exploitation, and emancipation.

Where do I even start? Perhaps we start with the state of the internet and what exactly was available online. Perhaps this is triggering for certain readers, and I apologize if it is, but it is the way the internet was at the time.

If you wanted to see gruesome videos of executions, suicides, or the pain olympics, all it took was a single search and your search engine would happily return any results relevant to the words you typed.

If you wanted to share information over the internet at this point, you probably had an email from a site like AOL, Hotmail, Yahoo, Gmail, or your ISP (Roadrunner, anyone?). Additionally, at this point, webmail clients were extremely popular and most users would launch the webmail clients from their providers to participate in email.

Those of us who were cool used things like MSN Messenger, AIM, etc. to chat quickly without having to use an email. You could even use little pictures that provided emotional reactions for you! Oh my goodness, what a time.

Beyond chatting, the next big thing coming in the digital space was gaming. At this time, it was seen as perhaps a silly side-hobby for some. While there may have been some money in it for a few select games, most were not profitable - they were created for other reasons, such as genuine intrigue in mechanics, users' fun, and curiosity.

Games and game companies like Runescape, Miniclip (8 Ball Pool, Agar.io, Doodle Army), Club Penguin, Wizards 101, and more dominated the scene in the mid-2000s.

Beyond gaming, this was the age of users learning how to launch their own blogs, vlogs, websites, and more.

For example, let's look at GeoCities (1994-2009) and Tumblr (2007-present). These websites rapidly evolved the internet's landscape, as they offered a free method for anyone to deploy a website or blog.

Imagine being a young person, or a high schooler, or a college student, or an adult in 2009. You have access to the internet and an interest in something out there in the world. You do a quick search and find a page related to it on GeoCities or Tumblr, leading you down a hyperlink rabbit hole.

If you were properly motivated at this time, you may wonder: "How do I do this? Can I create a page like this?" The answer was yes, and it was easy! A few minutes later, you could have your own site. There were few, if any, restrictions on what you could publish online.

This could lead you to learning HTML and CSS, as many users wanted to customize their sites, which generally leads to users discovering the freedom of owning their own sites. This included things like mail signatures, avatars, forum-specific usernames and more.

The end result? Everyone could have their own corner of the internet.

There was space for everyone and it was distinct. You could tell, both visually and otherwise, that a site belonged to someone specific. It was property, individually owned and updated by a human somewhere on Earth.

5. 2012: When Everything Started Changing

Let's jump forward to the early/mid-2010s. I used 2012 as an example because that's when I was in my first year of high school. At this time, you begin to understand a bit more about the world, log more long-term memories in the brain, and shift your perspectives.

Let's start by creating a perspective of the world's technology at this time:

• The iPhone 5 was released.
• The first iPad Mini was released.
• The Wii U was released.
• Windows 8 & macOS Mountain Lion were the primary operating systems.
• YouTube, Tinder, & Vine ruled the digital landscape.
  • Perhaps you even watched Gangnam Style on YouTube this year.

At this time, Facebook continued to cannibalize the internet. Each year, including 2012, Facebook consumed pages and converted websites into pages on their own website. Games, the app center, mobile apps, "pokes", and more slowly replaced other websites and communities on the web.

Twitter did the same thing around this time, to a lesser effect.

As part of this domination by the top web service providers, apps started quickly replacing URLs. It felt as if apps became a first-class citizen of the digital world and that they may actually be more preferential to launching a web-first service.

Paired with this app-first and centralized web was a preference for algorithms (everyone shudder together) which used data about a user to determine a precise factor of content for a user. Who cares about privacy at this point, right? Let's just mine the data, build the features, make our money, and figure the rest out later.

At the end of all this is a world where more users than ever are carrying smartphones, using apps over websites, using algorithms to find content, and circling around the socially-rewarding locations of the digital universe.

Personally… this felt like the beginning of the end. There was a short period in the mid-2000s to the 2010s where these apps were truly rewarding and valuable. They brought people together and we shared knowledge faster than ever.

However, there was a dark side to this revolution. As these apps progressed, and the underlying technologies progressed, the companies and investors driving these efforts took a turn. Efforts pushed into the world of micro-transactions, psychological rewards for utilizing a platform, profits over value, and a slow descent into a disregard for the users.

To me, that 2012 era was a turning point. You may personally love a different era (1980/1990s gamer, anyone? Any former phreaks out there?), but to me, it felt like we kept making leaps in technological capability until we reached the point of economic profitability in the 2000s-2010s era, where corporations, investors, and governments took a serious interest in controlling the internet.

From here on out, the digital landscape seems to have a more sinister appearance and effect on us.

6. 2026: Logging On Today

Fast forward to today: 2026. You want to check the latest headlines in your browser (a simple task!):

1. Turn on your computer - most likely Windows 10 or 11.
2. The computer nags you for updates.
3. Windows has installed more games and ad-infested apps you don't want.
4. Windows then advertises these new "features" to you via notifications.
5. You open your default browser - most likely Chrome.
6. When you do so, Edge nags you and asks if you want to switch to Edge?
7. The homepage of your browser is littered with ads, promotions, and other distractions.
8. You start typing the URL of your favorite news site or searching for it - but wait, your browser has some "recommendations" first, which seem like thinly-veiled advertisements.
9. If you searched instead of typing the URL directly, your browser (most likely Google) will show you an AI summary loosely related to your search but not really what you were looking for. Somewhere in the distance, a tree wilts.
10. Below the AI "summary", which somehow takes half of the page space, results are loaded. However, the top 3-5 are promoted results, which means they may or may not relate to your search but someone paid to have them included.
11. FINALLY, below all of that, will be the "real" results. These have been predetermined by Google's search algorithm. At this point, you'd suspect it would be consistent or at least transparent, right? Wrong. It's a black box - don't ask any more questions.
12. You may click one, or maybe thirty, results before you find what you're looking for.
13. Great, a website with a real answer. But wait! You're not trustworthy because you haven't accepted every cookie and tracking beacon in the last decade. Therefore, you will have to solve a captcha that requires 13 iterations of clicking the "fastest animal" in an array of images, or worse, bikes in various countries.
14. Once you solve all that, there's a cookie banner waiting for you that gives you two options:
    1. Agree to all tracking (without seeing any information).
    2. Or, "see more", where you will be presented with somewhere around 20 toggles to limit "legitimate interest" third-parties in the numbers of the hundreds to thousands, or be ignorant and just accept all.
    3. If you don't wish to spend a week of human time reading the agreements of these various parties, you will eventually lose hope and click whichever button lets you access the website.
15. Phew. Finally. We're on the site itself. Oh wait - another AI summary and maybe even an AI voice/podcast-style version of the article first? And it's the latest feature, so of course you'll be nagged to try it out.
16. Oh wait, you're interrupted again. This site requires age verification to view its contents. For some reason, another country's laws apply to you right now (spare me the legalese in your responses). Therefore, you will need to create an account, giving this company personal data again, and then upload your national ID or other identification to prove who you are.
17. Whoo! What an easy process that would inspire you to visit again. At this point, you can view the latest news article on the topic you were searching for. Unfortunately, this site is owned by the same group of people who own basically all news sites - ensuring you are reading the exact viewpoints they are looking to communicate.

What's the common theme here? There's an expectation on us at every single step - proof of identification, proof of humanity, testing of their new features, consumption of their views, etc., etc., etc.

Pause too long on an ad because you're doing something in real life? Dang, seems like someone online made an impression on you and you will be shown that content religiously for months.

We are rarely, if ever, allowed to freely roam and consume content we search for or type in. There are innumerable layers of intermediaries impeding our digital navigation. At each step, you may feel as if there's another party extracting commercial value from your visit, your clicks, your eyes, your mouse, or your scrolls.

7. The Internet I Miss

I'm going to yell at clouds now. Be prepared.

I miss the old web, the indie web. Where websites were authored by humans, even in some capacity underneath a corporation.

We had rudimentary tools to solve the riddle of discovery, but they were tools nonetheless. Want to discover and explore new sites? You had search options, such as early Google or Jeeves, or third-party tools. We had web rings, blogrolls, link lists, and other manually-curated pages to discover top-tier content.

We dealt with slow speeds, lack of early web security, and strangers because the internet offered so much opportunity. Over time, that opportunity has shrunk drastically and the cost of visiting the internet has both become mandatory, yet more expensive.

Finally, no one owned the internet. Sure, we can get into semantics of the DNS system and infrastructure, but the web - and specifically, content - quickly became decentralized after the early stages until the recent centralization of content.

I just miss being able to visit the web, find personal content from fellow internet explorers, and not spend the whole time avoiding the pitfalls of the modern web.

8. Closing

As I wrote this post, I went through many thoughts and emotions. One thought was that the internet, as we knew it, disappeared. However, I don't think it did. Rather, the experience of the internet disappeared.

I certainly don't want to go back to 2005, I just hope we don't lose the parts that made it feel worth exploring.

Have I reached nirvana? Is this the ultimate goal of homelabbers? It seems that I've somehow automated myself out of a job (hobby?) by building a resilient homelab.

Let's figure out where it all went "wrong".

1. Infrastructure

1.1. Server

I have used a few different servers over the years, but have since consolidated all of my services onto a single server (build guide here), reducing the complexity of my environment.

Because of the single-server setup, maintenance is down 75% (from four servers to one). Yes, clusters and hypervisors and hybrid cloud solutions are shiny and fancy and popular, but I just don't care for it. Instead, I have a single metal box I can pick up with my hands sitting in my basement.

I do have one more "server": a Raspberry Pi 4, but it uses Home Assistant OS, updates itself, and requires literally zero maintenance. Is that really a server? I guess, by technical definition. But it certainly doesn't feel like it; it feels like I've turned a potential server device into a self-sustaining IoT device instead.

1.2. Network

Aside from the server itself, I have a mini rack of UniFi gear (server is in the same rack). A UniFi Dream Machine Pro, a switch, and a couple of access points (APs) constitute my personal data center sitting in my basement.

Again, it really just maintains itself. UniFi supports automatic and scheduled updates, allowing you to disconnect from any manual maintenance of the hardware. UniFi truly is a "set it and forget it" platform.

2. Software

There's a single crontab line on my server, which runs all updates for my Docker services on a weekly basis.

0 0 * * 0 docker-update

Which is an alias for:

for d in ~/docker/*/; do (cd "$d" && sudo docker compose pull && sudo docker compose up -d); done

I do run a few crontab schedules via the root user as well, to account for permission issues. These jobs are really just for backups, to be honest. I've never required a backup, but it's good to be safe.

# Generate a daily system report
0 8 * * * /home/cmc/daily_sys_report.sh

# Backup
SHELL=/bin/bash
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin

## App-aware database dumps
45 1 * * * mkdir -p /tank/cloud/server/backups/immich && sudo docker exec -t immich_postgres pg_dumpall -U postgres > /tank/cloud/server/backups/immich/immich-postgres-$(date +\%F).sql
50 1 * * * mkdir -p /tank/cloud/server/backups/piped && sudo docker exec -t piped-postgres pg_dumpall -U piped > /tank/cloud/server/backups/piped/piped-postgres-$(date +\%F).sql

## Backup files to ZFS pool
0 2 * * * rsync -aHAX --delete /var/lib/plexmediaserver/ /tank/cloud/plexmediaserver/
5 2 * * * rsync -aHAX --delete /var/www/ /tank/cloud/server/web_server/
10 2 * * * rsync -aHAX --delete /etc/nginx/ /tank/cloud/server/nginx/
15 2 * * * rsync -aHAX --delete --exclude='**/postgres/' --exclude='**/postgresql/' --exclude='**/mysql/' --exclude='**/mariadb/' --exclude='**/redis/' --exclude='**/valkey/' --exclude='**/database/' --exclude='**/cache/' --exclude='**/tmp/' --exclude='**/logs/' /home/cmc/docker/ /tank/cloud/server/docker/
20 2 * * * rsync -aHAX --delete /home/cmc/.ssh/ /tank/cloud/server/ssh/

Aside from this, the only other required updates are running apt update and potentially restarting. This requires about 60 seconds of time whenever I want to do it.

sudo apt update && sudo apt upgrade -y && sudo apt autoremove -y

3. The Outcome

So, what's the end result? I've approximated it somewhere around 15 minutes of maintenance per month, barring an emergency.

If that's normal to you, congrats - you've peaked in life. However, that's absolutely absurd to me. I used to spend days on end building, maintaining, and debugging various aspects of my servers, databases, apps, etc.

You know what's even crazier? If I don't have 15 minutes in a month to ssh into my server and update things, it literally does not affect anything. I could probably go 6 months (maybe more?) without touching it and it wouldn't break.

(This is not a challenge, please don't break my server.)

What a great situation to be in - especially for someone who's become as busy in their career as I have. I feel like I've struck a fantastic balance between privacy, security, and convenience.

• Smallweb is Becoming an Archipelago: Coincidentally, I browse most of these websites as well.
• Emacs, how it all started (for me): I love hearing stories about Emacs, especially from beginners.
• .gitignore Isn’t the Only Way To Ignore Files in Git: Interesting if you're often using Git.
• What 2026 looks like: A beautiful web page describing the author's predicted future for 2022-2026.
• Don’t verify email addresses by sending spam to them: sigh…
• Apparently I'm not a woman because I use Linux: Let's continue breaking down walls. There will always be stupid around anyway.
• NetNewsWire Status: One of my absolute favorite apps on iOS.
• Van Halen Test: One of my favorite concepts. I feel like my teachers used this often to trick students who wouldn't read through all instructions before starting their answers.
• PR spam today looks like email spam in the early 2000s: Have they considered simply writing terrible software like I do? Then no one will even care to contribute!
• The ‘papers, please’ era of the internet will decimate your privacy: I feel like we've been warning the public of this message for a decade and yet, here we are. Still on the precipice.
• A Brief History of Domains: A fantastic piece.

A message of the day is, in computer terms, a welcome message that provides information and may help users logging onto the system. This is useful for numerous reasons, depending on the system, such as community announcements, compliance requirements, contextual information for that system, etc.

In this post, I'll be walking through a simple way to generate a message of the day for macOS. You can see the end result in this screenshot below:

For an example of a system-provided motd, here's the motd on my Ubuntu server showing the server's default information and any relevant add-ons, such as the LAN cockpit URL:

2. Create the Message

First, we need to create the message. In this example, I've created a custom shell script below that uses terminal formatting to generate a structured output. This script checks for:

• username
• hostname
• profile management
• WiFi SSID
• IP address
• Mullvad status
• battery status
• uptime

To do this, create a script in your user directory:

nano ~/.motd.sh

Then paste the content below and modify as needed:

BOLD='\033[1m'
DIM='\033[2m'
RESET='\033[0m'

HOST=$(scutil --get ComputerName 2>/dev/null || hostname)

IP=$(ipconfig getifaddr en0 2>/dev/null || ipconfig getifaddr en1 2>/dev/null)
IP=${IP:-unavailable}

SSID=$(networksetup -getairportnetwork en0 2>/dev/null | sed 's/^Current Wi-Fi Network: //')
case "$SSID" in
  ""|"You are not associated with an AirPort network.")
    SSID="unavailable"
    ;;
esac

BATTERY=$(pmset -g batt 2>/dev/null | awk -F'; *' '
  NR==2 {
    gsub(/^ +| +$/, "", $2)
    gsub(/^ +| +$/, "", $3)
    sub(/ present: true$/, "", $3)
    print $2 ", " $3
  }
')
BATTERY=${BATTERY:-unavailable}

UPTIME=$(uptime | sed 's/^.*up //; s/, [0-9]* user.*//; s/, load averages.*//')
UPTIME=${UPTIME:-unavailable}

if profiles status -type enrollment 2>/dev/null | grep -qi "MDM enrollment: Yes"; then
  MANAGED="yes"
else
  MANAGED="no"
fi

VPN="unavailable"

if command -v mullvad >/dev/null 2>&1; then
  STATUS=$(mullvad status 2>/dev/null)
  VPN=$(printf '%s\n' "$STATUS" | head -1)
  VPN=${VPN:-unavailable}
fi

printf "\n"
printf "  ${DIM}%-14s${RESET}${BOLD}%s${RESET} ${DIM}%s${RESET}\n" "$USER" "$(uname -sr)"
printf "  ${DIM}%-14s${RESET}%s\n" "host" "$HOST"
printf "  ${DIM}%-14s${RESET}%s\n" "managed" "$MANAGED"
printf "  ${DIM}%-14s${RESET}%s\n" "wifi" "$SSID"
printf "  ${DIM}%-14s${RESET}%s\n" "ip" "$IP"
printf "  ${DIM}%-14s${RESET}%s\n" "mullvad" "$VPN"
printf "  ${DIM}%-14s${RESET}%s\n" "battery" "$BATTERY"
printf "  ${DIM}%-14s${RESET}%s\n" "uptime" "$UPTIME"
printf "\n"

Finally, modify the script file to enable execution:

chmod +x ~/.motd.sh

3. Load the Message

At this point, the script is ready. We simply need to tell macOS to execute it whenever the user launches a new shell.

To do this, open the .zprofile file and add a line referencing the script:

nano ~/.zprofile

# Display Message of the Day (MOTD)
./motd.sh

All done! This method is easily customizable and allows for use of dotfile management systems, such as stow, since the files live in the user's home directory.

People often use "Git" and "GitHub" interchangeably. Sometimes it's for convenience, but often it's a genuine lack of clarity around these two concepts. I work with IT auditors daily and you'd be surprised how often I come back to explain this topic, which is why I've written an internal document and am rolling that into this blog post itself to share with a broader audience.

The simplest possible explanation I can provide is that Git is the version control system itself, while GitHub is one of many platforms that offer Git hosting, as well as custom features that improve functionality on top of Git (e.g., pull requests).

The distinction matters, especially in an audit context, because there are facts and features inherent to Git that should be clearly understood before thinking about the Git host. For an auditor, this affects decisions around risk assessment, procedures to obtain evidence, and documentation of control processes.

For example, a developer can create a commit in Git after changing some code or files with a repository. This does not automatically show that the change was reviewed, approved, tested, or deployed through the appropriate process(es).

2. Feature Comparison

Let's start by comparing features before we dive into the details. While this is not all-encompassing, it helps set the context for the discussion we're about to have.

Git hosts vary by platform. GitHub uses "pull requests," while GitLab commonly uses "merge requests." The concept is similar, but the available controls, terminology, logs, and evidence differ by host.

3. Git Tracks the History

Now that we have looked at the feature comparison, let's dive into the details of both Git and Git hosts.

Git is a distributed version control system. It is intended to track changes to files over time through a feature called a commit: a collection of changes to files since the last commit. Developers use it to create these commits, create branches, merge changes back into the primary branch, rebase work, tag versions, and inspect project history.

Git does not require GitHub, or any other hosting platform. It can run entirely on a developer's laptop. A repository can exist locally, on an internal server, on a shared network path, or on another Git host.

For example, I can create a local Git repository, expose it through the Git protocol, and share this info with a friend or coworker. Then, they can clone my repository and we can collaborate by making changes independently and using commits, branches, etc. to push changes back and forth with each other. In this scenario, there is no host and we are essentially a distributed network of our own.

At its core, Git answers technical history questions:

• What changed?
• Who authored the change?
• When was the change made?
• What files were affected?
• What does this version contain?
• How did this branch differ from that branch?

That is valuable, but it is not the whole development process. This is where Git hosts introduce useful, additional features on top of Git.

4. Git Hosts Add the Workflow

A Git host stores Git repositories and adds collaboration, workflow, and governance features around them. In an audit or compliance context, this is where most of the controls originate that mitigate risks with the system development lifecycle (SDLC).

GitHub is the most familiar example, so I will use that in this post, but it is not the only one. Other Git hosts include GitLab, Bitbucket, Azure DevOps Repos, Sourcehut, Gitea, and Forgejo.

These platforms commonly add features such as:

That is why the same Git repository can behave differently depending on where it is hosted. GitHub, GitLab, Bitbucket, Azure DevOps, and Sourcehut all support Git repositories, but their review workflows, permissions, logs, automation, and terminology differ.

5. Audit Implications

Using GitHub as an example, let's walk through a common audit approach to the common change management (CM) or program development (PD) controls.

First, here are some common controls:

• Changes are reviewed and approved prior to deployment.
• The repository is configured to:
  • prevent force pushes;
  • require X approvals;
  • prevent approvals from the author or a person who committed within the pull request;
  • require testing to pass prior to merging;
  • include the relevant change ticket(s)/documentation.
• Users with development access are segregated from users with access to approve and deploy changes.
  • OR: Management performs a review on an XYZ basis to ensure deployed changes were authorized and appropriate.
• Management performs a review on an XYZ basis to ensure branch protection settings were not inappropriately modified.

Now, where can we find this evidence? Let's step through each

• Normally, reviews and approvals can be found directly within the pull/merge request. For platforms such as GitHub, this platform enables code reviews, comments, feedback, and checks directly within the PR flow. In certain cases, this may be documented in a change ticket system and the ticket is referenced within the PR to prove that the PR was tested, reviewed, and approved prior to merging.
• For configurations, GitHub supports both classic branch protection rules and rulesets, which can enforce all of the checks I mentioned above.
• For access, it depends on the company's setup. They may be using GitHub Enterprise, which offers them more control over access, and teams can inspect the access inheritance through those Enterprise settings. Otherwise, non-enterprise GitHub organizations can show evidence of access at both the organization level and the repository level. Auditors can inspect the levels of access and inheritance to ensure that no users have the ability to develop changes, manage branch protections, approve changes, and deploy changes.
• For branch protection settings, management can provide auditors with an export of the audit logs relevant to the in-scope repositories. This will show you if any events occurred that would have disabled or modified the branch protections in place.

If you're inspecting a project where CI/CD pipelines matter, you can also dive into the team's configuration of their pipeline in terms of the logic, access to modify, and any relevant schedules or triggers.

6. Conclusion

Hopefully at this point, it's clear that Git is not GitHub. While they are related and can be confusing for non-developers, it's important to understand the distinction.

Without this understanding, everything can fall apart in your understanding, risk assessment, and scoping of an audit.

There has been a battle around how to format and store text since computers were invented.

As computers moved to a more consumer-facing market, developers faced the challenge of determining the best way to store text. Early consumer software such as WordStar, WordPerfect, and Microsoft Word implemented proprietary document formats and rich-text systems, including binary word processor files and later formats such as RTF, to let users style, print, and exchange documents. These tools made sense for office work, but they also moved writing further away from the simplest representation of text: characters in a file.

Plain text never disappeared. It remained the foundation of source code, logs, configuration files, email, data formats, documentation, and the web. Now, with the rise of LLMs and agentic workflows, it feels even more obvious that plain text has won. Corporations may still save Word documents, share PowerPoints, and use other formats, but they are increasingly turning around and using agents to extract, summarize, transform, and rewrite that same content as Markdown or some other plain-text-adjacent format.

Whether another format is used somewhere along the way, the center of gravity is moving back toward text that can be read, searched, copied, diffed, transformed, and understood without specialized software.

2. Optimizing for Usability

Great, Christian believes plain text won. So what?

Let's think about why we store documents and text.

For personal reasons, we may take notes, write stories and poems, send emails and messages of other types, post online, and any number of other reasons. For work, we do largely the same as we do personally, but we also create presentations, documents, memos, letters, notices, manuals, documentation, and other artifacts specific to our jobs. Doctors write prescriptions, architects create plans, auditors create working papers and reports, and so on.

Think about each of these and then imagine that each was produced by Word or another piece of software where the document can only be opened in that specific application. If you don't have access to the same application, whether due to cost, sanctions, licensing, operating system support, or another reason, you're effectively banned from ever viewing that document, even if it's expressly intended for you.

In contrast, a plain text document is accessible on every major platform available today. Modern browsers can open plain text files directly, depending on the file extension and browser settings, and desktop, server, and mobile operating systems are capable of opening these files with bundled editors or viewers. You don't have to install a separate application, accept a vendor's terms, or hope the original software still exists. You can open the file and read the content, even if lightweight markup has been applied to it.

2.1. Plain Text Markup

More specifically, I want to talk about a few options beyond literal plain text. There are numerous markup languages that provide structure and formatting while remaining readable as text, but a few sit at the top.

1. Org Mode: Org is my personal favorite. While you need Emacs to experience the full functionality of Org's interactive components, Org files remain readable outside of Emacs because the syntax is still plain text.
2. Markdown: Markdown is the dominant lightweight markup language. It is used across AI tools, social media, documentation platforms, static site generators, and note-taking apps.
3. TeX: When you need a language that can handle advanced formatting requirements, such as mathematical expressions or chemical notation, TeX is the obvious choice.

These languages introduce additional characters into a plain text document, but they do not usually detract from the readability of the document itself. They create documents that can be read directly for quick understanding or rendered by software that understands the markup syntax.

3. Plain Language

Great, we've established the benefits of plain text and optional markup, but that's only half of the battle.

A file can be open and still be opaque. I don't want to open your plain text document and struggle to understand the message.

It is entirely possible to write a Markdown document that is portable, durable, grep-able, and miserable to read. The format can be simple while the writing remains vague, dense, passive, or full of unexplained jargon.

That is where plain language matters.

Plain language is not simplistic language. It does not mean avoiding technical terms, removing nuance, or writing for the lowest possible reading level. It means writing so the intended reader can understand the point without doing unnecessary work.

In practice, that means:

1. Use the simplest word that accurately communicates the idea.
2. Prefer direct sentences over inflated ones.
3. Define terms when the audience may not know them.
4. Put the main point before the supporting detail.
5. Avoid passive voice when the actor matters.
6. Remove filler that does not change the meaning.

The same reasons I prefer plain text apply to plain language. Plain text removes technical friction. Plain language removes cognitive friction.

A proprietary document format can make content harder to open. Bad writing can make content harder to use.

3.1. Plain Text Without Plain Language

Plain text gives you portability. It does not automatically give you clarity.

A README can be written in Markdown and still fail to explain what the project does. A runbook can be stored in Git and still assume tribal knowledge. An audit workpaper can be easy to archive and still fail to explain the conclusion. A policy can be available to every employee and still be written in a way that discourages anyone from reading it.

Have you ever read through a document or standard that is obviously meant to be accessible technologically and yet, you get nothing out of it? You could re-read it numerous times and never get an answer because the author was not focused on accessible language.

The file is accessible, but the meaning is not and that matters a lot. A document is not useful because it exists in an open format. It is useful when someone can read it, understand it, and act on it.

3.2. Plain Language Is Not Anti-Technical

Plain language does not mean removing technical precision. Sometimes the technical term is the clearest term.

For example, this is vague:

The authentication subsystem exhibited anomalous behavior resulting in downstream workflow degradation.

This is clearer:

Login failed for some users, which blocked deployments that required approval.

This is still technical, but plain:

The CI runner could not authenticate to the package registry because the token expired.

The goal is not to make everything casual. The goal is to make the writing carry the meaning directly.

3.3. The Same Argument

The argument for plain text and the argument for plain language are the same argument applied at different layers.

Plain text is the storage layer and plain language is the interface. Or, said more plainly, plain text and plain language should depend on each other and neither should be ignored.

If the format is portable but the writing is opaque, you only solved half the problem.

4. Conclusion

Plain text gives information a longer life. It makes writing easier to store, move, search, version, inspect, and transform.

But plain text does not guarantee useful writing. You can put bad prose in a good format. You can store unclear decisions in Markdown. You can preserve vague notes forever. You can make a document technically accessible while leaving it practically unreadable.

Have you ever read a README clearly written by AI without any editing from the repository owner? It can quickly become nonsense as the AI tries to constrain its content to the best possible README standard, while it loses any meaning of the project itself.

That is why plain language belongs in the same conversation.

If the goal is durable, useful communication, the format and the writing have to serve the same purpose. Plain text keeps the document accessible. Plain language keeps the meaning accessible.

In this post, I will show you how I've configured backups on my server to back up data to Cloudflare R2.

1. Installation

1.1. Docker

First, let's install the app with Docker Compose. Create a directory for your compose.yml file in a location you'll remember.

mkdir ~/zerobyte
cd ~/zerobyte
nano compose.yml

Next, paste the following content into the compose.yml file. You may want to customize the ports, environment, and volumes sections.

services:
  zerobyte:
    image: ghcr.io/nicotsx/zerobyte:v0.30
    container_name: zerobyte
    restart: unless-stopped
    cap_add:
      - SYS_ADMIN
    ports:
      - "4096:4096"
    devices:
      - /dev/fuse:/dev/fuse
    environment:
      - TZ=America/Chicago
      - BASE_URL=https://zb.example.com
      - APP_SECRET=...
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - /var/lib/zerobyte:/var/lib/zerobyte
      - /path/to/backup:/path/to/backup

When you're done editing, launch the container.

sudo docker compose up -d

At this point, you can access the app via http://localhost:4096.

1.2. Nginx

If you want to be able to access the app remotely, you'll need to utilize something like a reverse proxy or tunneling software.

This example uses Nginx as a reverse proxy. To start, edit a configuration file in Nginx:

cd /etc/nginx/conf.d
nano zb.conf

server {
    listen 80;
    server_name zb.example.com;
    location / { proxy_pass http://127.0.0.1:4096; }
}

Once you've created the file, test your Nginx configuration and restart the web server.

sudo nginx -t && sudo systemctl restart nginx.service

If your version of Nginx uses the sites-available structure instead, do this:

cd /etc/nginx/sites-available
nano zb
# Edit the file
sudo ln -s /etc/nginx/sites-available/zb /etc/nginx/sites-enabled/zb

You may also need to provision a TLS/SSL certificate and add a 443 block to your Nginx configuration above, if you wish to connect securely.

2. Configuration

At this point, you will be able to access the app. Upon first login, you will need to create an administrator account.

I won't be diving fully into the setup process. I highly suggest reading the Zerobyte Docs. They are very helpful and will walk you through the setup for your provider.

2.1. Volumes

First, create a volume. This is a file or directory on your server that you wish to back up. You can see I have two directories connected as volumes.

When you create a volume, you will be able to dictate the name, path, and type.

Remember to add a volume in your compose.yml file to ensure it's available within the app!

Finally, you can inspect the files within your volume.

2.2. Repositories

The next step is to connect to a remote repository. This example uses Cloudflare R2 buckets.

Within this configuration page, you can see the Configuration section in the bottom-right detailing the connection information.

When each backup runs, it produces a snapshot that you can view and explore.

Within a snapshot, you can review information about the backup job that ran and produced the snapshot, as well as the files at that point in time.

2.3. Backups

You can create any backup jobs (daily, weekly, monthly, specific days, or with a cron pattern). This allows you to specify:

• The volume to be backed up
• The repository to back up to
• The schedule
• The files to back up (all will be backed up if nothing is specifically selected)
• Include/exclude patterns
• Retention policies
• Custom restic patterns

Within a backup job, you can configure the related notifications, snapshots, or back up, edit, or clean up the job.

2.4. Notifications

Lastly, you can enable various notification channels to receive alerts when jobs start, fail, complete, etc.

I have used an SMTP email provider to send myself emails upon these points.

I'm proud to announce that I've released my third (and, in my opinion, most useful) iOS app: Hutch.

1.1. Project Links

I don't want to bury the lede, so let me start with links to the app and various project pages:

Product

• App Store
• Website

Development

• Source
• Project
• Issues

1.2. Overview

Hutch is a mobile client for Sourcehut, a development host & forge. If you're not familiar with Sourcehut, it provides a long list of services:

• Git repositories
• Mercurial repositories
• CI/CD builds
• Issue trackers
• Mailing lists
• Pastes/snippets
• Static page hosting

1.3. Features

Hutch provides an interface for the following services:

• Projects:
  • Aggregate location to link repositories, tickets, & lists together
• Repositories (Git & Mercurial):
  • README summaries with rendering support for Markdown and Org-Mode
  • File trees
  • Commit logs
  • Branches & tags
  • Artifacts
  • Settings
• Trackers:
  • Create new trackers
  • Create tasks within trackers
  • Comment on tasks
  • Manage assignments, labels, and resolution status
• Builds:
  • Submit a build manifest manually
  • Resubmit builds
  • Edit & resubmit builds
• Lists:
  • View mailing list messages with built-in patch viewing support
  • Unified inbox view for unread threads
• Pastes:
  • Create new pastes with single files, multiple files, and visibility options
  • View, delete, and change visibility of existing pastes
• Meta:
  • Profile editing options for your avatar, email, URL, location, and bio
  • Add & remove SSH and PGP keys
  • View your personal access tokens (PATs)
  • Enable/disable app-wide swipe actions

1.4. Roadmap

As this is a solo-dev project (and I'm not a full-time developer), the roadmap is flexible and may change based on feedback I receive or things I'm currently focused on.

At the time of posting, we're on v2.5.2. At this point in time, I have the following tagged on my roadmap:

• Enhance file content rendering (e.g., line numbers, syntax highlighting)
• Search feature to load a specific user, project, or repository (e.g., ~hutch/REPO) that the logged-in user doesn't own
• Public project discovery for public projects

2. Feedback Welcome!

If you use Sourcehut and iOS, please give Hutch a try and let me know your thoughts!

If you find bugs or issues, feel free to file them in the issues tracker.

One of the older, and most popular, offerings from AWS is Simple Storage Service (S3), a scalable object storage service that can hold any type of data. With this ease of use comes risk.

Public S3 buckets are one of the most common and highest-profile AWS misconfigurations. The challenge for auditors is that "public" in S3 isn't a single setting. It's the combination of three separate controls, and a bucket can appear restricted at one layer while still being exposed at another.

This post walks through a script that checks all three layers for every bucket in the account and produces a CSV report.

The script used in this post is available at audit-labs/audit-tools.

1. Background: How S3 Controls Public Access

Let's start with the basics. Before running anything, it helps to understand the three layers the script checks and how they interact.

1.1. Public Access Block

Public Access Block (PAB) is a set of four flags that can be applied at the account level, the bucket level, or both. When all four are enabled, they override any bucket policy or ACL that would otherwise grant public access.

The four flags are:

• BlockPublicAcls: Prevents new ACLs that grant public access and ignores existing ones.
• IgnorePublicAcls: Ignores all public ACLs on the bucket.
• BlockPublicPolicy: Prevents bucket policies that grant public access.
• RestrictPublicBuckets: Restricts access to buckets with public policies to only AWS services and authorized users within the account.

The script checks whether all four flags are enabled at the bucket level. If any one of them is missing or disabled, the bucket is marked FALSE-VULNERABLE. If PAB is missing entirely (no configuration exists at all), the bucket is marked CRITICAL-MISSING, which is the highest-risk state.

1.2. Bucket Policy Status

AWS evaluates each bucket policy and exposes an IsPublic flag that reflects whether the policy grants public access. The script checks this flag directly using get-bucket-policy-status. If no bucket policy exists, this column shows No Policy, which is not a finding on its own. Rather, it's a data point that instructs you to keep looking at further evidence.

1.3. ACLs

S3 ACLs predate bucket policies and are largely considered legacy at this point, but they're still in use and still a source of public exposure. The script checks whether any ACL grants READ or WRITE permissions to the AllUsers group, which represents the public internet.

1.4. How the Three Layers Interact

PAB is the highest authority. If PAB is fully enabled at the bucket level, it overrides any public bucket policy or ACL. This means a bucket can have a publicly permissive policy and still be safe, as long as PAB is fully restricted.

The reverse is also true. A bucket with no public policy and no public ACLs is still at risk if PAB is missing or incomplete, because nothing is in place to prevent a future policy or ACL change from exposing it.

2. What the Script Does

The script lists every bucket in the account, determines each bucket's region, runs all three checks against it, and appends the results to a CSV file.

It runs in three steps for each bucket:

1. Determines the bucket's region by trying get-bucket-location against a list of configured regions;
2. Checks PAB, bucket policy status, and ACLs independently;
3. Derives an OverallPublicStatus from the three checks and writes the row to s3_full_public_access_audit.csv.

3. Prerequisites

You'll need:

• AWS CLI installed (or access to CloudShell) and configured with credentials that have read access to s3:ListAllMyBuckets, s3:GetBucketLocation, s3:GetBucketPublicAccessBlock, s3:GetBucketPolicyStatus, and s3:GetBucketAcl
• jq installed
• The AWS_REGIONS variable in the script updated to include any regions your organization uses

Check and update the region list at the top of the script before running:

AWS_REGIONS="us-east-1 us-west-2 eu-central-1 ap-southeast-2"

Then run it:

chmod +x aws_s3_buckets.sh
./aws_s3_buckets.sh

4. Deriving Overall Public Status

The most important logic in the script is how it combines the three checks into a single OverallPublicStatus. PAB is evaluated first and takes precedence:

if [ "$PAB_FULLY_RESTRICTED" = "CRITICAL-MISSING" ]; then
    OVERALL_PUBLIC_STATUS="TRUE - PAB Missing (CRITICAL)"
elif [ "$OVERALL_PUBLIC_STATUS" != "FALSE" ] && [ "$PAB_FULLY_RESTRICTED" != "TRUE" ]; then
    : # Status already set by Policy or ACL check above
fi

If PAB is fully restricted (TRUE), the overall status stays FALSE regardless of what the policy or ACL checks find. If PAB is missing entirely, the overall status is immediately set to critical. If PAB is present but incomplete (FALSE-VULNERABLE), the overall status reflects whatever the policy or ACL checks found.

5. Reading the Output

The script prints progress to the terminal as it runs and saves the full results to s3_full_public_access_audit.csv:

Starting FULL S3 Public Access Audit for the CURRENT account...
---
1. Retrieving all bucket names...
Processing bucket: 13bf5920-a09f-47bc-a75a-394a09f18d6a
  Region determined: eu-west-1
  Final Status: FALSE
Processing bucket: c67fa6bd-2fd5-4bc5-825d-587fb535bf2e
  Region determined: eu-west-1
  Final Status: FALSE
---
Audit Complete.
Final report saved to s3_full_public_access_audit.csv

BucketName,Region,PAB_FullyRestricted,Policy_IsPublic,ACL_AllUsersRead,ACL_AllUsersWrite,OverallPublicStatus
13bf5920-a09f-47bc-a75a-394a09f18d6a,eu-west-1,FALSE-VULNERABLE,No Policy,FALSE,FALSE,"FALSE"
c67fa6bd-2fd5-4bc5-825d-587fb535bf2e,eu-west-1,TRUE,No Policy,FALSE,FALSE,"FALSE"

Here's how to read each column:

• PAB_FullyRestricted: TRUE means all four PAB flags are enabled at the bucket level. FALSE-VULNERABLE means PAB exists but is incomplete. CRITICAL-MISSING means no PAB configuration exists at all.
• Policy_IsPublic: true means AWS has determined the bucket policy grants public access. false means it doesn't. No Policy means no bucket policy is attached.
• ACL_AllUsersRead / ACL_AllUsersWrite: TRUE means the bucket has an ACL granting that permission to the public internet. FALSE means it doesn't.
• OverallPublicStatus: FALSE means the bucket is not publicly accessible based on all three checks. TRUE values include the specific reason (e.g., TRUE - ACL Read, TRUE - Policy, TRUE - PAB Missing (CRITICAL)).

Note the first bucket in the example above: PAB_FullyRestricted is FALSE-VULNERABLE but OverallPublicStatus is still FALSE. This means the bucket isn't currently public, but it's missing the PAB configuration that would prevent it from becoming public if a policy or ACL were changed.

6. Common Exceptions and False Positives

• Static website hosting: Buckets used for static website hosting are intentionally public. These will show up with TRUE overall status and public ACLs or policies. Confirm the business purpose with IT and document them as accepted exceptions rather than findings.
• Policy_IsPublic with No Policy: A No Policy result in the policy column is not a finding. It simply means no bucket policy is attached. The overall status depends on PAB and ACLs.
• FALSE-VULNERABLE with FALSE overall status: This is a configuration weakness rather than an active exposure finding. The bucket isn't currently public, but PAB is not fully enabled, meaning a future change could expose it. Write this up separately from buckets that are actively public, as the risk and remediation are different.
• Cross-account or service-specific policies: Some bucket policies grant access to specific AWS accounts or services (e.g., CloudFront, Config, ELB logging). AWS may flag these as IsPublic even though they're not publicly accessible in practice. Review the actual bucket policy before raising it as a finding.
• Region coverage: If a bucket's region isn't in the AWS_REGIONS list, the script can't determine its location and will skip it with a warning. Make sure the region list in the script covers your organization's full footprint before treating the CSV as a complete population.

7. How to Write Up the Finding

There are two distinct finding types this script can surface, and they should be written up separately.

Finding 1: Bucket with incomplete or missing PAB (configuration weakness)

Deficiency: S3 bucket 13bf5920-a09f-47bc-a75a-394a09f18d6a does not have all four Public Access Block flags enabled at the bucket level (PAB_FullyRestricted: FALSE-VULNERABLE).

Risk: Without fully enabled PAB, a future bucket policy or ACL change could expose the bucket to the public internet without additional controls in place to prevent it.

Finding 2: Bucket actively accessible to the public

Deficiency: S3 bucket example-bucket has an ACL granting READ access to the AllUsers group (ACL_AllUsersRead: TRUE, OverallPublicStatus: TRUE - ACL Read).

Risk: Publicly accessible S3 buckets expose any objects stored within them to the internet, potentially including sensitive data.

To filter the CSV to only buckets with a non-FALSE overall status:

awk -F',' 'NR==1 || $7 != "\"FALSE\""' s3_full_public_access_audit.csv

The scripts are available at audit-labs/audit-tools.

1. Scoping

First thing first: scoping. To audit AWS passwords, we need to understand that AWS IAM password policies only apply to users with console access. This isn't the same as the password policy for an application built on top of AWS. It also has no effect on users who authenticate through IAM Identity Center, which delegates authentication to an external identity provider, such as Okta or Active Directory.

If the organization uses Identity Center exclusively and has no IAM users with passwords, you will need to perform a different procedure.

If they do have IAM users with console access, the script applies and is worth testing.

2. What the Scripts Do

The process runs in two steps:

1. gather_policy.sh calls the AWS CLI to fetch the current IAM password policy, captures metadata (timestamp, AWS account, region, caller identity), and writes everything to a JSON file. This file is evidence of the policy's current state.
2. evaluate_policy.py reads that JSON file, prompts you for the expected value of each setting, and exports a CSV report with a value of PASS or FAIL for each rule.

3. Prerequisites

To run this script, you'll need:

• Access to CloudShell or the AWS CLI utility installed and configured with credentials that have read access to iam:GetAccountPasswordPolicy and sts:GetCallerIdentity
• jq installed (used by the Bash script to merge JSON objects)
• Python 3 installed
• Optional: uv installed (used to run the Python script)

4. Step 1: Gather the Policy

Run the first script to pull the current policy from AWS:

chmod +x gather_policy.sh
./gather_policy.sh

By default, this writes the output to policy_report.json in the current directory. You can specify a custom path with the -o flag:

./gather_policy.sh -o /tmp/my_report.json

The output is a JSON file with two top-level keys: metadata and PasswordPolicy.

{
  "metadata": {
    "report_timestamp_utc": "2025-12-15T01:29:52Z",
    "os_user": "cloudshell-user",
    "hostname": "",
    "working_directory": "/home/cloudshell-user",
    "aws_profile": "default",
    "aws_region": "eu-west-1",
    "aws_caller_identity": {
      "UserId": "123456789012",
      "Account": "123456789012",
      "Arn": "arn:aws:iam::123456789012:root"
    }
  },
  "PasswordPolicy": {
    "MinimumPasswordLength": 8,
    "RequireSymbols": true,
    "RequireNumbers": true,
    "RequireUppercaseCharacters": true,
    "RequireLowercaseCharacters": true,
    "AllowUsersToChangePassword": true,
    "ExpirePasswords": true,
    "MaxPasswordAge": 90,
    "PasswordReusePrevention": 4,
    "HardExpiry": false
  }
}

The metadata block is what ties this evidence to a specific account and point in time. The aws_caller_identity field shows who ran the script and in which account.

5. Step 2: Evaluate the Policy

Pass the JSON file to the evaluation script:

uv run evaluate_policy.py policy_report.json

The script will prompt you for each of the ten settings. Press Enter to skip any setting you don't need to test. For numeric settings like MinimumPasswordLength and MaxPasswordAge, the script treats your input as a minimum, so the actual value must be greater than or equal to your expected value to pass. Boolean settings require an exact match.

=== Expected / Minimum Values (press <Enter> for N/A) ===

Enter expected value for 'Minimum password length' (int) or press <Enter> to skip: 8
Enter expected value for 'Require symbols (!@#$...)' (bool) or press <Enter> to skip: true
Enter expected value for 'Require numbers (0-9)' (bool) or press <Enter> to skip: true
Enter expected value for 'Require uppercase letters (A-Z)' (bool) or press <Enter> to skip: true
Enter expected value for 'Require lowercase letters (a-z)' (bool) or press <Enter> to skip: true
Enter expected value for 'Allow users to change password' (bool) or press <Enter> to skip: true
Enter expected value for 'Expire passwords (enable aging)' (bool) or press <Enter> to skip: true
Enter expected value for 'Maximum password age (days)' (int) or press <Enter> to skip: 90
Enter expected value for 'Prevent password reuse (last N)' (int) or press <Enter> to skip: 4
Enter expected value for 'Hard expiry (no grace period)' (bool) or press <Enter> to skip: false

Audit CSV written to: policy_audit_20251215T014323Z.csv

Summary:
   1. Minimum password length             -> PASS
   2. Require symbols (!@#$...)           -> PASS
   3. Require numbers (0-9)               -> PASS
   4. Require uppercase letters (A-Z)     -> PASS
   5. Require lowercase letters (a-z)     -> PASS
   6. Allow users to change password      -> PASS
   7. Expire passwords (enable aging)     -> PASS
   8. Maximum password age (days)         -> PASS
   9. Prevent password reuse (last N)     -> PASS
  10. Hard expiry (no grace period)       -> PASS

--- End of report ---

6. Reading the CSV

The CSV is your evidence. It includes the metadata header from the JSON file, so the account ID, timestamp, and caller identity are embedded directly in the file.

# report_timestamp_utc: 2025-12-15T01:29:52Z
# os_user: cloudshell-user
# hostname:
# working_directory: /home/cloudshell-user
# aws_profile: default
# aws_region: eu-west-1
# aws_caller_identity: {'UserId': '123456789012', 'Account': '123456789012', 'Arn': 'arn:aws:iam::123456789012:root'}

Rule#,Policy-Item,Expected,Actual,Result
1,Minimum password length,8,8,PASS
2,Require symbols (!@#$...),true,true,PASS
3,Require numbers (0-9),true,true,PASS
4,Require uppercase letters (A-Z),true,true,PASS
5,Require lowercase letters (a-z),true,true,PASS
6,Allow users to change password,true,true,PASS
7,Expire passwords (enable aging),true,true,PASS
8,Maximum password age (days),90,90,PASS
9,Prevent password reuse (last N),4,4,PASS
10,Hard expiry (no grace period),false,false,PASS

You may use this evidence in any form, but I suggest having your AWS contact screenshot the results directly within their CloudShell or AWS CLI session. This allows you to prove that the data was not modified after the script was run.

7. Common Exceptions and False Positives

• No policy defined: If gather_policy.sh exits with a NoSuchEntity error, the account has no IAM password policy configured. If you were expecting a password policy, document it as a missing control.
• HardExpiry: false: This setting controls whether users are locked out immediately when their password expires or given a grace period to change it. false is often intentional to avoid lockouts. Check the organization's policy before calling it a finding. Additionally, check if the organization has security exceptions in place before noting a deficiency.
• MaxPasswordAge and forced rotation: A 90-day rotation requirement is common in older policies and frameworks like CIS. NIST 800-63B no longer recommends forced rotation unless there's evidence of compromise. Know which framework you're auditing against before writing up a finding for this setting. Confirm with the organization to understand which framework they used to write their policy.
• PasswordReusePrevention: AWS allows a maximum of 24 previous passwords. If your organization's policy requires a higher number than AWS supports, document the platform limitation rather than raising it as a deficiency.

8. How to Write Up the Finding

If a setting fails, here's how to frame it:

• Deficiency: The MinimumPasswordLength setting in the AWS IAM password policy is configured to 6, which is below the organization's requirement of 8 characters.
• Root Cause: Due to {{ root cause }}, the policy was configured to enforce a MinimumPasswordLength of 6.
• Risk: Shorter passwords are more susceptible to brute-force and credential stuffing attacks, increasing the likelihood of unauthorized access to the AWS console.
• Evidence: Refer to policy_audit_<timestamp>.csv for documentation of testing.

The same structure applies to any other failing rule. For boolean settings, the deficiency is simply that the actual value does not match the expected value. For numeric settings, the deficiency is that the actual value falls below the required minimum.

To make it worse, IAM Identity Center doesn't make this easy to extract through the console, and most teams don't have a repeatable process for pulling it.

To solve this problem, this post walks through a script that does it for you and explains what to look for once you have the output. This is something I've used in practice and want to share, as cloud auditing knowledge seems scarce.

The script is available at audit-labs/audit-tools.

1. Background: How AWS Provisions Access

Before running anything, it helps to understand the different ways AWS can be architected to grant access. You may encounter any one (or all) of these in practice, sometimes within the same organization. Knowing how they differ tells you where to look during an audit and which questions to ask.

1.1. IAM Users

This is the original AWS access model. An IAM user is an identity created directly inside a single AWS account (e.g., iamuser1 created inside AWS user cmc). This type of account has a username, an optional console password, and optional access keys for programmatic access. Permissions are granted by attaching IAM policies directly to the user, or by adding the user to an IAM group that has policies attached to it.

The core problem with IAM users at scale is that they're account-scoped, meaning a user in Account A has no relationship to a user in Account B, even if they're the same person. Organizations with dozens or hundreds of accounts end up with a fragmented identity landscape that's difficult to review and even harder to deprovision consistently.

From an audit perspective, these are key risks to understand during your walkthrough of the environment. Additionally, you should note that IAM users are high-risk when they have active access keys (long-lived credentials that don't expire unless explicitly rotated or revoked) or when policies are attached directly to the user rather than inherited through a group.

1.2. IAM Groups

IAM groups are a way to organize IAM users within a single account and attach policies to multiple users at once. A user inherits all permissions from every group they belong to. Groups themselves cannot assume roles or make API calls. They exist only as a convenience for managing user permissions in bulk.

Groups help with consistency, but they don't solve the cross-account problem. An IAM group in Account A still has no bearing on access in Account B. You'll see groups used alongside IAM users in the same environments where IAM users are prevalent.

1.3. IAM Roles

Roles are the most flexible identity construct in AWS. Unlike users, roles aren't tied to a specific person. They're assumed temporarily by whoever (or whatever) is authorized to use them. When an entity assumes a role, AWS issues short-lived credentials that expire automatically, usually after an hour.

Roles are used in several contexts:

• Cross-account access: Account A can grant a role in Account B the ability to be assumed by principals in Account A. This is how many organizations handle access across accounts without using IAM Identity Center.
• Service roles: AWS services like Lambda, EC2, and ECS use roles to make API calls on your behalf. An EC2 instance with an attached instance profile is assuming a role every time it calls an AWS API.
• Federated access: External identity providers (Active Directory, Okta, etc.) can be configured to exchange a user's external credentials for temporary AWS role credentials via SAML or OIDC. This is an older pattern that predates IAM Identity Center.
• Break-glass access: A role with broad permissions that is locked down by default and only assumed in emergencies. A common method for securing these accounts is vaulting the credentials in a PAM platform like CyberArk.

From an audit perspective, roles require you to look at the trust policy (who is allowed to assume the role) as well as the permission policy (what the role can do once assumed). Both matter. A role with AdministratorAccess is only as risky as its trust policy is permissive.

1.4. IAM Policies

Policies are the documents that define permissions. They're not an access pattern on their own, but understanding the three types helps when reviewing output from any access audit:

1. AWS managed policies are created and maintained by AWS. Examples include AdministratorAccess, ReadOnlyAccess, and job-function policies like Billing. They're convenient but broad: AdministratorAccess is a single policy that grants full access to every AWS service.
2. Customer managed policies are created by the organization. They offer more precise control and can be reused across users, groups, and roles. Better practice than relying entirely on AWS managed policies for anything sensitive.
3. Inline policies are embedded directly into a specific user, group, or role rather than existing as a standalone resource. They can't be reused and are easier to miss during reviews. When you see an inline policy in audit output, treat it as something that warrants a closer look — they're often added ad hoc to solve a specific problem and not always well documented.

1.5. IAM Identity Center

IAM Identity Center (formerly AWS SSO) is the current recommended approach for human (end-user) access in multi-account AWS Organizations. It sits above individual accounts and provides centralized access management across all of them from a single place.

It connects to an identity source, such as AWS's own directory, Active Directory, or an external identity provider (IdP) like Okta or Entra ID, and uses that as the source of truth for users and groups. Access is configured within Identity Center itself, not inside individual accounts.

The key construct is the permission set: a named bundle of IAM policies (managed, customer managed, and/or inline) that defines what a principal can do. When you assign a permission set to a user or group for a specific account, AWS creates a temporary IAM role in that account that the user assumes when they access it. The credentials are short-lived and scoped to the session.

The standard architecture: users belong to groups in the identity source, groups are assigned permission sets for specific accounts in Identity Center, and users inherit access through their group memberships. Provisioning and deprovisioning happen at the group membership level, not by touching individual account assignments.

Direct user assignments (where a user is assigned a permission set without going through a group) are possible but generally a control gap, because they bypass the group-based review and provisioning process.

If the organization uses Identity Center, the access population you need to review lives there, not inside individual accounts. Looking at IAM users and roles within an account will give you an incomplete picture. You'll see the temporary roles that Identity Center creates, but not who is assigned to them or why.

2. What the Script Does

The script works by running commands against a single named AWS account and produces a JSON report of every user and group assignment, along with the permission set and policies attached to each assignment.

It runs in four steps:

1. Finds the IAM Identity Center instance and looks up the target account ID by name;
2. Lists all permission sets provisioned to that account;
3. For each permission set, retrieves all user and group assignments, resolves their names from the Identity Store, and fetches the managed and inline policies attached to the permission set;
4. Writes everything to a JSON file named report_<account_name>.json.

The script caches permission set details and principal names to avoid redundant API calls when the same permission set or user appears in multiple assignments.

At the end of this process, we will have the evidence we need to test controls such as administrative access or segregation of duties.

3. Prerequisites

You'll need:

• AWS CLI (or AWS CloudShell) installed and configured with credentials that have read access to sso-admin, identitystore, and organizations;
• jq installed (used throughout the script for JSON parsing);
• The name of the AWS account you want to audit (must match exactly as it appears in AWS Organizations).

Set the account name at the top of the script before running:

ACCOUNT_NAME="your-account-name"

Then make the script executable and run it:

chmod +x aws_iam_users.sh
./aws_iam_users.sh

4. Reading the Output

The script produces a JSON array where each element represents a single principal-to-permission-set assignment. Here's an example:

[
  {
    "principal": {
      "type": "GROUP",
      "name": "testgroup1"
    },
    "permission_set": {
      "name": "AdministratorAccess",
      "policies": {
        "managed_policies": [
          "arn:aws:iam::aws:policy/AdministratorAccess"
        ],
        "inline_policy": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Sid\":\"Statement2\",\"Effect\":\"Deny\",\"Action\":[\"a4b:*\"],\"Resource\":[\"*\"]}]}"
      }
    }
  },
  {
    "principal": {
      "type": "USER",
      "name": "iamtestuser1"
    },
    "permission_set": {
      "name": "AdministratorAccess",
      "policies": {
        "managed_policies": [
          "arn:aws:iam::aws:policy/AdministratorAccess"
        ],
        "inline_policy": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Sid\":\"Statement2\",\"Effect\":\"Deny\",\"Action\":[\"a4b:*\"],\"Resource\":[\"*\"]}]}"
      }
    }
  },
  {
    "principal": {
      "type": "USER",
      "name": "iamtestuser1"
    },
    "permission_set": {
      "name": "Billing",
      "policies": {
        "managed_policies": [
          "arn:aws:iam::aws:policy/job-function/Billing"
        ],
        "inline_policy": ""
      }
    }
  }
]

A few things to look for when reviewing this output:

• Direct user assignments: iamtestuser1 is assigned AdministratorAccess directly as a USER, not through a group. Access should generally be provisioned through groups so that provisioning and deprovisioning are tied to group membership, not managed case-by-case. A direct user assignment to a high-privilege permission set warrants a conversation with IT about why it exists.
• AdministratorAccess: This is AWS's broadest managed policy, which allows full access to everything in the account. Note who has it and whether that's appropriate. In many environments, even senior engineers shouldn't have standing AdministratorAccess. It should be reserved for break-glass accounts or infrastructure teams with a documented need.
• Inline policies: The inline_policy field in this example contains a Deny statement for a4b:*. Inline policies attached to permission sets are worth reviewing, as they can add permissions or restrict them, and they're easy to miss if you're only looking at the managed policy name.
• Multiple assignments for the same user: iamtestuser1 appears twice: once with AdministratorAccess and once with Billing. This isn't automatically a problem, but a user with both full administrative access and explicit billing access is worth confirming with IT.

5. Common Exceptions and False Positives

• Break-glass accounts: Most organizations maintain at least one emergency account with direct AdministratorAccess that bypasses normal access controls. A direct USER assignment to AdministratorAccess may be intentional for this reason. Ask IT whether a break-glass account exists, confirm the username matches, and document it as an accepted exception if appropriate.
• Small organizations or early-stage environments: Some teams haven't implemented group-based access management yet and assign permissions directly to users across the board. This is a control gap, but the finding should reflect the scale and maturity of the environment. A two-person startup with direct assignments is a different risk than an enterprise doing the same thing. This may or may not give rise to a deficiency.
• Service or automation accounts: Occasionally a USER principal in Identity Center is a service account rather than a human. These may legitimately have specific permission sets assigned directly. Confirm the account's purpose before writing it up.

6. How to Write Up the Finding

If you identify a direct high-privilege user assignment that isn't a documented exception, here's how to frame it:

• Deficiency: User iamtestuser1 is directly assigned the AdministratorAccess permission set in account cmc, rather than receiving access through a group assignment.
• Root Cause: Due to {{ root cause }}, the user iamtestuser1 was inappropriately provisioned the AdministratorAccess permission directly rather than through a group assignment.
• Risk: Direct user assignments increase the likelihood of orphaned access following role changes or departures. They are also harder to identify during periodic access reviews, as reviewers may focus on group membership rather than individual assignments.
• Evidence: Attach the relevant portion of report_cmc.json filtered to show the specific principal, permission set, and policies. The JSON output is self-documenting, as it includes the account name in the filename and contains the full policy details alongside the assignment.

If requested during review, you can filter the output to just the direct user assignments:

jq '[.[] | select(.principal.type == "USER")]' report_cmc.json

This stack uses the following software:

• Emacs
• Weblorg
• Python
• Minify
• rsync
• Environment variables

I've historically relied on the following build and deployment methods:

1. Manually running ENV=prod emacs --script publish.el;
2. Then building out a build.py script to automate the Weblorg publishing method and allow for custom steps, like adding recent blog posts to index.html;
3. Then adding GitHub Actions to automate all steps whenever I merge a pull request into main.

This post will describe the process I've created to automatically build and deploy my site with this stack via GitHub Actions.

1. Weblorg Configuration

The basis for the build process is publish.el. The challenge with using Emacs static site generators is path management. Specifically, I've needed to ensure that the necessary packages (weblorg, htmlize, & templatel) are available regardless of whether I'm building the site on macOS (my dev machine) or a Linux-based runner.

To solve this, I use a simple conditional to set the site-lisp-base path. This allows the script to find the cloned repositories in their respective locations. Additionally, I use an environment variable check (ENV=prod) to toggle the weblorg-default-url. If I’m just testing locally, it defaults to localhost. Otherwise, it points to the live domain.

;;; -*- lexical-binding: t -*-
;; Allow for macOS (dev machine) & Linux (GitHub Actions) execution
(defvar site-lisp-base
  (if (eq system-type 'darwin)
      "~/.config/emacs/.local/straight/repos"                 ; macOS path
      "/home/linuxbrew/.config/emacs/.local/straight/repos")) ; CI/Linux path

;; Explicitly load packages
(add-to-list 'load-path (expand-file-name "htmlize" site-lisp-base))
(add-to-list 'load-path (expand-file-name "weblorg" site-lisp-base))
(add-to-list 'load-path (expand-file-name "templatel" site-lisp-base))

(require 'htmlize)
(require 'weblorg)

;; Set default URL for Weblorg
;; Only works if environment variable ENV=prod
(if (string-equal-ignore-case (getenv "ENV") "prod")
    (setq weblorg-default-url "https://cleberg.net"))

;; Define site metadata
(weblorg-site
 :theme nil
 :template-vars '(("site_name"        . "cleberg.net")
                  ("site_owner"       . "Christian Cleberg <hello@cleberg.net>")
                  ("site_description" . "Just a blip of ones and zeroes.")))

;; Define routes for rendering content
;; ...
;; /scrubbed for brevity/

;; Export all content using Weblorg engine
(weblorg-export)

If we run a command such as ENV=prod emacs --script publish.el, Emacs will return a .build/ directory with our resulting HTML files. At this point, we could manually enter the .build/ directory and run python -m http.server for a local dev server or rsync to deploy to production.

However, that's just way too much work. Let's keep going.

2. Python Build Script

Building on the previous step, I wanted to add some quality-of-life improvements that Weblorg does not provide:

• Update index.html with the three latest blog posts.
• Clean up the .build/ directory with each run so we don't run into any conflicts with old or removed files.
• Minify CSS and HTML.
• Silence Emacs/Weblorg stdout / stderr when running for production.
• Generate a sitemap.
• Allow the option to deploy to a remote endpoint via rsync or start the local dev server.

Python allows for this by acting as the orchestrator, as well as relying on environment variables to decide its behavior:

• ENV: Determines if we use production URLs or local ones.
• BUILD: Triggers the actual Emacs export and asset minification.
• DEPLOY: In a local context, this spins up a dev server. In CI, we leave this false because GitHub Actions handles the rsync logic separately.

See below for the main() function within build.py for the logic used to drive the process to the rest of the functions in the Python file.

# File scrubbed for brevity

def main():
    # Updates index.html with the 3 most recent blog posts
    html_snippet = get_recent_posts_html("./content/blog", num_posts=3)

    # Defines the build path, theme path, and CSS paths
    build_dir = Path(".build")
    theme_dir = Path("theme/static")
    css_src = theme_dir / "styles.css"
    css_min = theme_dir / "styles.min.css"

    # Check environment for ENV, BUILD, and DEPLOY variables
    env = os.environ.get("ENV", "").casefold()
    build = os.environ.get("BUILD", "").casefold() == "true"
    deploy = os.environ.get("DEPLOY", "").casefold() == "true"

    if env == "prod":
        # If ENV = prod (case-insensitive), will build for production
        print("Environment: Production")
        # Will only build if BUILD=true
        if build:
            remove_build_directory(build_dir)
            minify_css(css_src, css_min)
            run_emacs_publish(dev_mode=False)
            update_index_html(html_snippet)
            minify_html("./.build/index.html", "./.build/index.html")
            generate_sitemap()
        # Will only deploy if DEPLOY=true
        # False for GitHub Actions because deploy.yml deploys via rsync directly
        if deploy:
            print("Deploying to production...")
            deploy_to_server(build_dir, "homelab-remote")
            return
    else:
        # If ENV != prod (case-insensitive), will build for localhost
        print("Environment: Development")
        # Will only build if BUILD=true
        if build:
            remove_build_directory(build_dir)
            minify_css(css_src, css_min)
            run_emacs_publish(dev_mode=True)
            update_index_html(html_snippet)
            minify_html("./.build/index.html", "./.build/index.html")
            generate_sitemap()
        # Will only deploy if DEPLOY=true
        if deploy:
            start_dev_server(build_dir)

Awesome! Now we can run uv run build.py to build and deploy locally or ENV=prod uv run build.py to build and deploy for production. Enabling BUILD and DEPLOY variables will tweak the process, as mentioned above.

However, that's way too manual for me. Let's be lazy and take it even further.

3. GitHub Actions

So, how do we push it further? By removing the need to run a command (outside of git) at all!

This process will:

1. Create a custom Docker image with the tools we need to build and deploy.
2. Build the Docker image and store it within GitHub's image registry.
3. Build and deploy the website upon a push or pull request to main.

3.1. The Custom Docker Image

Let's start by building a Docker image that has all the tools I need to build the site. Standard CI runners don't come pre-installed with the specific mix of tools I need (Emacs, Homebrew, uv, and minify). Instead of installing these on every single run, we will build the image and store it for future use.

The Dockerfile uses python:3.12-slim as a base, installs Linuxbrew for easy package management, and clones the necessary Emacs packages into the expected directory. This ensures the build environment is consistent and fast.

FROM python:3.12-slim

ENV DEBIAN_FRONTEND=noninteractive \
    HOMEBREW_NO_AUTO_UPDATE=1 \
    PATH="/home/linuxbrew/.linuxbrew/bin:${PATH}"

RUN apt-get update && apt-get install -y --no-install-recommends \
    curl \
    git \
    procps \
    build-essential \
    ca-certificates \
    openssh-client \
    && rm -rf /var/lib/apt/lists/*

RUN useradd -m -s /bin/bash linuxbrew
USER linuxbrew
WORKDIR /home/linuxbrew

RUN /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"

RUN brew install emacs rsync uv minify

RUN mkdir -p ~/.config/emacs/.local/straight/repos && \
    cd ~/.config/emacs/.local/straight/repos && \
    git clone --depth 1 https://github.com/emacsorphanage/htmlize.git && \
    git clone --depth 1 https://github.com/emacs-love/templatel.git && \
    git clone --depth 1 https://github.com/emacs-love/weblorg.git

USER root
WORKDIR /builds

3.2. Building and Pushing to GHCR

Next, let's use the image we built as the base for the rest of our automation. I use a dedicated workflow (docker-build.yml) to keep the image up to date. Whenever I modify the Dockerfile or my requirements, GitHub Actions builds the image and pushes it to the GitHub Container Registry (GHCR). This image then serves as the environment for the final deployment step.

name: Build and Push Docker Image

on:
  push:
    branches: [ "main" ]
    paths:
      - 'Dockerfile'
      - 'requirements.txt'
      - '.github/workflows/docker-build.yml'

jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Log in to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract metadata
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ghcr.io/${{ github.repository }}

      - name: Build and push
        uses: docker/build-push-action@v5
        with:
          context: .
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}

3.3. The Build and Deploy Workflow

Finally, the deploy.yml brings it all together. I split into two jobs: the build-job, which runs inside our custom container to execute the Python orchestrator, and the deploy-job, which handles the SSH handshake and rsync transfer.

name: Build and Deploy

on:
  push:
    branches:
      - main
    paths-ignore:
      - '.github/**'
      - 'screenshots/**'
      - 'utils/**'
      - 'LICENSE'
      - 'README.org'

jobs:
  build-job:
    runs-on: ubuntu-latest
    container:
      image: ghcr.io/ccleberg/cleberg.net:main

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Run Build
        env:
          ENV: "prod"
          BUILD: "true"
          DEPLOY: "false"
        run: |
          echo "Environment is ready. Running build..."
          uv run build.py

      - name: Upload Build Artifacts
        uses: actions/upload-artifact@v4
        with:
          name: build-output
          path: ${{ github.workspace }}/.build/
          include-hidden-files: true

  deploy-job:
    runs-on: ubuntu-latest
    needs: build-job
    environment: production
    container:
      image: ghcr.io/ccleberg/cleberg.net:main

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Download Build Artifacts
        uses: actions/download-artifact@v4
        with:
          name: build-output
          path: ${{ github.workspace }}/.build/

      - name: Setup SSH and Deploy
        env:
          SERVER_IP: ${{ secrets.SERVER_IP }}
          SERVER_USER: ${{ secrets.SERVER_USER }}
          SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
        run: |
          eval $(ssh-agent -s)
          echo "$SSH_PRIVATE_KEY" | tr -d '\r' | ssh-add -
          rsync -avz --delete \
            -e "ssh -p ${{ secrets.SSH_PORT }} -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null" \
            .build/ \
            $SERVER_USER@$SERVER_IP:/var/www/cleberg.net/

4. Conclusion

Amazing! Now my site will build and deploy whenever I push to the main branch. I have more tweaks to make (e.g., build a development server and environment for pull requests prior to main), but I've automated most of it and have drastically reduced the administrative burden for the site. After making updates, I simply need to git add ... and merge my PR to trigger the deployment.

GNU Stow is described as a "symlink farm manager" on its homepage, which is true, but feels a bit underwhelming. Rather, I'd describe it as a tool to systematically and logically link, organize, and version control any files on your system.

2. Installation

First things first: let's install Stow. I'm on macOS, so I run the following command:

brew install stow

To ensure it's installed correctly, check the version:

stow -V

3. Stow Dotfiles

Next, let's create a directory to use as the central source for all these files. In my case, I store all git repositories in my ~/git/ directory, so I will create a dotfiles directory here:

# Create the dotfiles repository
mkdir ~/git/dotfiles && cd ~/git/dotfiles

Next, let's stow our first set of dotfiles. We'll use zsh as an example here. To do this, we will:

1. Create a directory for Zsh.
2. Move our current Zsh configuration files into our Stow directory.
3. Use Stow to symlink the files back into our home directory.

# Create the ZSH Stow directory
mkdir zsh                          && \
# Move your ZSH files into Stow
mv ~/.zshrc ~/git/dotfiles/zsh/    && \
mv ~/.zprofile ~/git/dotfiles/zsh/ && \
# Use Stow to symlink them back to your user home
stow zsh

By default, Stow will symlink your files (e.g., zsh) to the parent directory of the directory in which you execute the command. Since we're in the ~/git/dotfiles directory, we need to modify our stow command to ensure Stow symlinks the files to our home directory:

stow -t ~ zsh

At this point, you have a centralized directory (/git/dotfiles) where you can stow any file and use stow to symlink it back to another directory on your system.

Therefore, you only need to navigate to this directory to make changes across your system.

4. Update Dotfiles

When you make changes to your Stow directory, you can inform Stow and have the program update its symlinks with the following command:

cd ~/git/dotfiles && \
stow -R zsh

To summarize:

5. Save to a Git Repository

Lastly, let's finish the puzzle by ensuring that this configuration is long-lasting and can transfer amongst systems.

To this end, we will use Git as our VCS. You can simply create the repository, add your files, and push to your remote.

git init                       && \
git add .                      && \
git commit -m "initial commit" && \
git remote add origin GIT_URL  && \
git push

If you want to automate this even more, write an alias or a hook into your stow command to automatically commit your changes whenever they occur.

At this point, I have organized and managed my dotfiles much more efficiently and no longer lose them whenever I wipe my machines.

Want to participate in the IndieWeb Carnival or read more posts? Visit the main Carnival page to learn more.

I thought about this topic for a long time today before starting to write this post, as I don't think of myself as someone with intersecting interests. I generally lean pretty hard into interests and in my mind, they're all technology-related.

However, I've settled on the following topic: The Minimalist Technologist.

1. Personal Life

In my personal life, I spend my leisure time doing a few primary things:

1. Technology: Obviously. I love to learn about new things online, blogging, programming, self-hosting,
2. Physical Work: Conversely, my next favorite things to do are all completely technology free. This includes things like yard work, woodworking, organizing, decluttering, etc. There's just something about zoning out, getting into a physical rhythm, and feeling your body's strength create something productive instead of your mind.
3. Sports: This is fairly generic, but sometimes it can be a contrast for those who work in tech. Especially if you consider disc golf and/or hiking in this category.

2. Work

Now, this may be where I differ even more so than in my personal life. While I work in a tech job, I do not actually spend my days deep inside code (when possible) or building as many internal tools as I used to.

Instead, my job has primarily become 50 to 60 hours per week of meetings, mentoring younger coworkers, teaching and leading trainings, thinking about overall strategy of our practice, and project managing.

It's the generic individual contributor (IC) to manager story line, but again, it frees me up to switch to a different mindset when I get home and be productive on hobby projects. I'm no longer burnt out from thinking on such a technical level all day.

Either way, it was interesting to think through this topic and has me thinking more about broadening my horizons.

Want to participate in the Emacs Carnival or read more posts? Visit the main Carnival page on the Emacs Wiki to learn more.

I'm having a great time with the Emacs Carnival, as it has inspired me to write two posts in such a short time. It's been a much-needed inspiration to write during my busy season at work.

Anyway, let's get to it. The topic today is Completion: the magical thing that turns someone like me, who cannot remember long lists of commands to save my life, from an illiterate to a literate programmer.

1. Defining Custom Abbreviations

While you can define abbrevs dynamically in the buffer with C-x a g (which generally saves abbrevs to /.emacs.d/abbrev_defs), I prefer to define my abbreviations directly within my config.el file.

This allows for better portability between my machines, as well as clearer configuration for myself.

To create a new abbrev, I simply open ~/.config/doom/config.el and add a new one to the list below.

;; Abbreviations
(setq-default abbrev-mode t)
(define-abbrev-table 'global-abbrev-table
  '(
    ;; ("abbreviation" "expansion")
    ("omw" "on my way")
    ("eml" "hello@cleberg.net")
    ("shrg" "¯\_(ツ)_/¯")
    ("teh" "the")
    ("xtoday" "" (lambda () (insert (format-time-string "%Y-%m-%d %H:%M:%S"))))
    ("xnow" "" (lambda () (insert (format-time-string "%H:%M:%S"))))
    ))

Now, I can type something like xtoday in my buffer and get the fully formatted time string, like so: 2026-02-02 21:52:55.

¯\_(ツ)_/¯

This comes in handy most at work, where I need to constantly use acronyms and take shorthand notes to fill out phrases that I'm, unfortunately, required to reuse constantly. Looking at you, "completeness and accuracy of the data".

2. Doom Configuration

I have played around with a few different completion options for my purposes and have settled on the following packages.

Here is how I have my :completion, :tools, and :lang modules toggled in ~/.config/doom/init.el:

(doom! :input
       :completion
       (corfu +orderless)  ; complete with cap(f), cape and a flying feather!
       vertico             ; the search engine of the future

        :checkers
       syntax              ; tasing you for every semicolon you forget
       (spell +flyspell)   ; tasing you for misspelling mispelling
       grammar             ; tasing grammar mistake every you make


       :tools
       (lsp +eglot)        ; M-x vscode

       :lang
       data                ; config/data formats
       emacs-lisp          ; drown in parentheses
       json                ; At least it ain't XML
       javascript          ; all(hope(abandon(ye(who(enter(here))))))
       markdown            ; writing docs for people to ignore
       (org +dragndrop     ; drag & drop images/files into org
            +journal       ; daily logging
            +noter         ; for annotating PDFs (great for research)
            +roam2)        ; Zettelkasten note-taking
       python              ; beautiful is better than ugly
       sh                  ; she sells {ba,z,fi}sh shells on the C xor

       :config
       (default +bindings +smartparens))

With this setup, I am able to get a wonderful IDE-level experience within Emacs and without the bloat of a traditional IDE. It's the perfect balance of speed and power for my work and hobbies.

2.1. vertico + marginalia

Vertico is wonderful for finding files (SPC .) or running commands (SPC :). It provides a clean, vertical interface for the minibuffer.

Marginalia works wonderfully with Vertico, as it provides marginalia to the minibuffer commands within the command selection buffer.

2.2. orderless

Orderless is a game changer. As I mentioned above, I'm terrible with memorization. Therefore, I use this package and am able to search with multiple out-of-order terms to find a result in my Vertico searches.

2.3. corfu

For code completion, I’ve swapped out Company mode for Corfu. It’s faster, stays out of my way until I need it, and uses a small popup that feels right at home in a terminal or a GUI.

2.4. eglot

To actually "know" what my code is doing, I use LSP (Language Server Protocol). I've enabled the +eglot flag in Doom because Eglot is now built into Emacs core and tends to be a bit more stable and performant for my Python and JavaScript workflows.

2.5. flyspell

Flyspell is the last piece to my puzzle, as it allows for easy help in correcting grammar errors within the buffer. I combine flyspell + syntax + grammar for ultimate writing guidance. Whether or not I choose to follow that guidance is another story entirely.

3. Looking Forward

I know this is just the tip of the iceberg, so I've made a list of packages I want to dive into deeper in the future:

• tempel
• yasnippet
• consult
• embark
• cape
• kind-icon
• prescient.el

Completion and expansion utilities are phenomenal and have been one of the larger tools in my development and writing.

Want to participate in the Emacs Carnival or read more posts? Visit the main Carnival page on the Emacs Wiki to learn more.

This year in Emacs, I expect to do a lot. However, here are some actionable goals for myself that should have a positive impact as I start out 2026.

1. Dive Deeper into Org-Mode

• Org Agenda: Move beyond simple TODO lists. I want to implement a custom dashboard using org-super-agenda to group tasks by context rather than just file.
• ob-ipython: Fully embrace Literate Programming. This year, my data analysis scripts live inside org blocks. No more scattered .py files for quick prototypes.
• Org Capture: Streamline my intake. I’m aiming for a "one-key" capture system that sorts ideas into the right buckets automatically using template hooks.

2. Better Doom Configuration

• GitOps for Emacs: Come up with a solid base and use a GitOps-style workflow to ensure my environment is identical between home, work, and server.
• UI Refinement: Try new packages like spacious-padding to give the buffer some room to breathe. I'm also looking into svg-lib for cleaner-looking progress bars and icons.

I've used Home Assistant off and on for years, but I've never written a guide on it because it always felt like a half-baked solution with my combinations of products and my Home Assistant configuration.

However, Home Assistant looks much better these days and now has native UniFi Protect support, so I decided to switch back to using it full time and writing up a proper guide to installing, configuring, and customizing the software.

2. Installation

I happened to have a spare Raspberry Pi 4 sitting around I wasn't using, so I opted for the Raspberry Pi installation tutorial from Home Assistant. This tutorial guides you through the flashing of Home Assistant OS to an SD card and initialization of the software.

This process is seamless and will result in a ready-to-use device with Home Assistant.

3. Configuration

Once the device is ready, all you need to do is create your account and complete the initial setup wizard within the Home Assistant page (e.g., homeassistant.local:8123).

At this point, you will have a functioning Home Assistant deployment. However, I want to go further and configure the service to use my personal devices and display information via customized interfaces.

To start with our configuration, we will visit the Settings > Devices & services page. This page will display all currently configured integrations, as well as automatically discovered integrations that you can configure.

3.1. HACS

Another integration of note is the Home Assistant Community Store (HACS), which provides a familiar integration into the Home Assistant UI that allows you to manage custom elements.

If you installed Home Assistant like I did using the OS method, you will need to install the Get-HACS integration to install HACS and then restart Home Assistant to start utilizing these custom elements.

Personally, I am using HACS in order to utilize the Hatch Rest integration for my Hatch Rest Mini, Rest+, and Restore.

You can see it here in my Media dashboard:

Once you have installed all relevant integrations and synced your devices to Home Assistant, you are ready to build your dashboards.

3.2. External Access

If you want to be able to external your instance externally, you will need to expose the service to the internet somehow. One option is a reverse proxy, such as Nginx, which I have covered in numerous self-hosting posts. Another option is Cloudflare Tunnels, which I will cover here.

Configuring a tunnel to Home Assistant OS takes a few more steps than a normal reverse proxy, but I currently find the security benefits worthwhile.

To start, install the app-cloudflared app in the Add-ons menu within Home Assistant.

Once installed, follow the instructions to configure the External Home Assistant Hostname, Cloudflare Tunnel Name, and the Cloudflare Tunnel Token within the Configuration tab of the installed add-on. Once configured, I restarted Home Assistant to start fresh.

Next, I opened Cloudflare and configured the tunnel to expose the ha.example.com domain to the homeassistant.local:8123 address in Cloudflare's Zero Trust dashboard.

From here, I can access Home Assistant anywhere I go from the ha.example.com domain.

4. Customization

Finally, let's customize our dashboards. The view below is my standard view when greeted by my dashboard.

As you can see, I choose to keep general information in the main tab, such as weather, time, and location. Instead of jamming every widget into a single tab, I separate my tabs by function:

• Media: TVs, Speakers, and other playable entities
• Cameras: UniFi Protect cameras
• Lights: Hue bulbs and other lighting systems
• IoT: Other miscellaneous devices, such as printers, my Litter Robot, Roomba, etc.

When editing a dashboard, you're presented with a myriad of options. First, you can choose to use a number of layout options (sections, masonry, sidebar, and single card). Next, each element you add to the dashboard any number of entities, names, themes, states, and more to configure.

Honestly, I had forgotten how customizable these dashboards were and I will absolutely spend a lot of time customizing for very specific needs.

See below for some examples of editing and IoT elements:

Once you have configured and customized your dashboards to your heart's content, you're reading to start automating and more! I highly suggest browsing the web and Home Assistant forums for ideas and solutions that fit your needs. There are more possibilities to this platform than you'll likely ever be able to use.

4.1. Mobile View

Before I finish this post, I wanted to show how reliable the mobile view of the platform displays. These screenshots were captured on the iOS Home Assistant app, using the remote URL for my instance.

Dashboard	Entity

First, install the Tor package. I'm using Ubuntu, so I'll be using apt to install Tor.

sudo apt install tor

2. Configuration

2.1. Tor

Next, let's configure the service we'll be serving via Tor. For this, edit the file below and add the lines below to the end of the file.

sudo nano /etc/tor/torrc

The following lines you add to the file will define the directory to use and the internet protocol (IP) address and port we will be using.

HiddenServiceDir /var/lib/tor/hidden_service/
HiddenServicePort 80 127.0.0.1:5000

Next, you will need to cat the contents of the file below to find the onion address provided to you.

sudo cat /var/lib/tor/hidden_service/hostname

2.2. Nginx

With this onion address handy, create a file in your Nginx configuration directory. Mine is conf.d, but yours may be sites-available. If that's the case, don't forget to create a symbolic link from the file you created in sites-available to sites-enabled.

sudo nano /etc/nginx/conf.d/tor-website.conf

Within this Nginx configuration file, I will be using the file below. I have left comments to explain each part.

server {
	# The IP address and port Nginx will listen on
	listen 127.0.0.1:80;
	# The onion address to listen for
	server_name sv3g2dlyvwyk2nvi3eeh55fcrpdvjlclhi6wwsx57cste6lwdjanzyyd.onion;
	# The directory where your website files are
	root /var/www/tor-website/;

	# By default, try to serve the files. Return 404 if a file is not found.
	location / {
		try_files $uri $uri/ =404;
	}

	# Put any other configurations here at the end, such as redirects
	# ...
}

Finally, we can restart the services and check to see if it's working.

sudo systemctl restart nginx.service
sudo systemctl restart tor.service

At this point, you should be able to view your Onion address in Tor.

2.3. Onion-Location

Lastly, let's advertise the Onion-Location on our clearnet website so that users on Tor can automatically switch to the Onion address if they want to.

sudo nano /etc/nginx/conf.d/regular_website.conf

server {
	server_name example.com;
	add_header Onion-Location http://YourOnionAddress.onion$request_uri;
}

Once complete, restart Nginx.

sudo systemctl restart nginx.service

You should now see a big purple button in Tor titled .onion available when visiting the clearnet web page.

If everything worked, you're all done! You now have a website served via an onion address on Tor and an Onion-Location header advertising your new onion address.

As others in the Big 4 will probably tell you, AI is a strategic tool that allows for a far more efficient and impact audit. However, the key is understanding when to use it, how to use it, and how to translate the output from your AI into actions.

This post will walk you through how I personally leverage AI in my role.

Let's start by stepping through the tools I have at my disposal.

1.1. Gemini Enterprise (formerly Agentspace)

First and foremost is Gemini Enterprise, which has a large context window, is connected to the Enterprise's internal documentation and websites, and allows for specialized use of custom agents, NotebookLM, and more.

I use Gemini for a handful of specific use-cases, notably:

1. NotebookLM notebooks for team-based usage. For example, you can build a notebook for a specific client (using public and private information about that client) and then chat with the data in the notebook, generate an audio overview, and save documents, such as mind maps or study guides, for future use.
   • I love this because it provides a "run once and save" functionality, where I can generate things like an audio overview or document, save it, and then my team can reference it without re-running the prompt or even needing to open the notebook, if they download it.
2. Custom Agents for customized personas that benefit from the private information that Gemini has access to, such as internal SharePoint sites.
   • For example, I have a custom agent designed to operate as an IT Audit Assistant that can help you ask questions that can be answered by the company's news, documentation sites, and more (e.g., "I'm testing logical access for AWS and want to know if anyone has created a solution or guidance for XYZ.").

1.2. Microsoft Copilot

Likely the most common AI in use at companies today, due to its integration with every Microsoft product, Copilot offers the best AI solution for productivity. However, it's usage is likely also the most volatile due to the large gap in skill sets between new-hires and senior employees.

For associates and other early-career employees, I suggest that they use Copilot to perform two primary tasks:

1. Check their tone, such as making an email or messages more professionalism, softer, or perhaps to analyze the conversation up to that point to understand how to respond better. This is something that should come naturally to senior employees, but is often a learning curve for associates.
2. For written documentation, such as guides or presentations, use Copilot and provide it with ample information on the goal of the documentation in order for Copilot to suggest an outline, gaps in the writer's thinking, or areas for further research before writing the document. The key here is to use Copilot to improve your thinking and not to replace it. It shouldn't generate the content for you, it should remove the tedium of creating boilerplate structures or to design the structure of a document.

1.3. Clara AI

Clara AI is KPMG's audit-based AI platform, known as the "KPMG Clara Smart Audit Platform". The major benefit to Clara AI is that it lives within a sandboxed environment, running on white-labelled models, fine-tuned on firm-specific methodologies, and built directly into KPMG's audit tools.

As noted in KPMG's Clara AI page linked above, Clara AI is built directly into the Clara audit platform in order to provide systematic risk assessments, drive consistent and efficient audits by providing all audit teams with relevant information for their audit, and connects to other tools (such as KPMG Client Collaboration, where evidence is requested and provided).

I absolutely love this tool, as it solves some of the bigger problems for auditors at large firms:

1. Connecting younger staff to the firm's guidance and regulatory material, lowering the barrier to auditors trying to learn which pieces of regulation apply and when they apply.
2. As you can imagine, the audit process for a firm of KPMG's size can be complex at times and changes depending on the client, the client's industry, the type of engagement, and more. Clara AI helps break down each of these challenges and provide detailed, accurate guidance for auditors to learn about their specific use-case without getting lost in irrelevant data.

Clara AI does a lot more than I've written about here and I know teams are using these features beyond what my teams do in Tech Assurance. You can read about more features, such as automation, dynamic dashboards, and more on the product page: Clara AI.

2. Use Cases for Each Tool

While this section won't be exhaustive, it provides a few basic examples of what my teams do at KPMG with AI, as well as some suggestions for how other auditors can utilize AI at their own companies.

2.1. Gemini

2.1.1. Client and Project-Based Agents or Notebooks

As I mentioned above, one great use-case is to build notebooks for your client team or even for internal teams, such as a team that's formed to increase automation within the audit practice.

I build notebooks for these teams, upload as many relevant documents and links as I can, invite my team members, and then save useful artifacts within the notebook so that my team members don't need to recreate the wheel in order to gain access to that same information.

2.1.2. Technical Research

Through purely anecdotal experiences, I have found Gemini to be superior to my other AI tools when it comes to technical topics. It provides more accurate information and better context for my specific role.

This has replaced the experience of walking team members through topics, such as Snowflake architecture, AWS logical security, or SQL permissions.

In addition, it helps me and others who are more experience dive deeper into subjects that we historically did not have the time or knowledge to research. For example, Gemini recently helped me use my knowledge of similar systems to understand Kafka's architecture and risks as they related to my client's specific implementation of Kafka.

2.1.3. Data Analysis

As I mentioned above, Gemini seems to excel with technical tasks. I've been using this to enhance the data analysis we perform.

For example, Gemini is able to help write queries (e.g., SQL or AWS commands) to extract the information we need to test a control. While we have lots of internal documentation for popular platforms, there are always situations where you need data from a system and don't have any guidance to extract it.

For users with data, Gemini is able to provide a more natural language querying process where the user can simply describe what analysis they need, or even generate a dashboard for the user. I find this most helpful in identifying relevant metrics or analytics and then have our teams use their skills to build out Alteryx workflows and Power BI dashboards to implement what Gemini has helped them investigate.

Lastly, data cleaning is wonderful in Gemini. Gemini is able to help structure, clean and deduplicate data much faster than humans can and seems to have a lower potential for errors than if someone manually combed through the data trying to correct it.

2.2. Microsoft Copilot

2.2.1. Meeting Transcripts

One of the built-in features of Copilot in Teams is transcription. This is a killer feature for auditors, as one of the biggest pain points for an audit (on both sides) is having to meet multiple times to rehash the same topic or send constant follow-ups throughout the year to re-confirm facts.

With a transcript, we can spend one meeting going fully through all questions and simply refer back to the transcript whenever we have a question.

If you also save the video recording, you can also save the time of requesting evidence later, as you already have a recording where you walked through the evidence you needed.

This saves:

1. An absolute ton of time on both the audit and client sides, in terms of questions and follow-ups.
2. Even more time by not needing the ask the client to take a million screenshots. Instead, the auditor can take screenshots from the recording after the fact. No more stopping every 5 seconds in a meeting waiting for someone to take a screenshot or sending a request for screenshots after the fact.

2.2.2. Meeting Facilitator

Another killer feature of Copilot is the Facilitator. Facilitator takes the agenda in the meeting invite (or determines the agenda throughout the meeting), tracks progress of the discussion against the agenda, takes notes, and tracks to-do items with assignments for users to take action after the end of the meeting.

2.2.3. Microsoft Office Integrations

I talked about the Microsoft Office integrations above, so I won't dive deep in this section.

For auditors, some useful examples are:

• Generating boilerplate for an audience you're not familiar with writing for (e.g., engineers vs. CFOs). Note that you shouldn't generate the content, you should only let Copilot guide you to the proper format and then use your knowledge to write the content.
• Checking your tone, especially if Copilot has access to historical chats, in order to help you respond professionally and appropriately.
• In Excel or Word, helping you analyze your data.

I'm not a big fan of generating content with Copilot, so I don't have any examples for that. Perhaps I am naive, but I still think we should be honing our interpersonal skills and the content of our communications with others should still be written by us, not AI.

2.2.4. Managing Emails, Chats, and More

I almost titled this section "Manager Mode", since I'm feeling a different level of intensity from the sheer number of emails, Teams messages, tags in channels, and more that I experience now as a Manager.

One small but effective use for Copilot is to check at the end of the day if you've missed anything that day, such as responding to an email or message, actions items assigned to you in meetings, or important announcements that, while not directed at you individually, may require action from you.

I currently do not have access to Copilot Studio, but I'd love to build a custom agent around this idea if I could.

2.3. Clara AI

2.3.1. Firm & Methodology Guidance

For an auditor who has to deal with SOX, SOC 1-3, AUP, and more engagements, you can imagine the sheer number of potential pitfalls there are when working through an engagement.

Being able to have Clara AI break down the regulatory requirements for your specific situation is amazing.

For example, how do you risk assess Client ABC, who has unique IT systems and business processes, and operates in the oil & gas industry? What if they are also impacted by the US's tariffs? Even further, what if they experienced a data breach in the prior year and have experienced changes in numerous key roles?

Clara AI is able to handle of this and more, guiding team members to the relevant guidance and assisting them in the audit process.

2.3.2. Workflow Assistance

On top of the various regulations and internal guidance frameworks, auditors at the Big 4 also have to learn how to use their firm's specific audit platforms.

KPMG built the KPMG Clara Workflow (KCw) for audits and SOC reports, which requires teams to fill out the audit file for their engagement, answer all questions that appear, perform their testing, and abide by the required items.

Clara AI helps by connecting auditors to the internal guidance that supports each section of the audit platform so that they can complete their engagement in compliance with their requirements.

3. A Day with AI

Before I finish, I wanted to provide an example of how an auditor might utilize AI throughout their day. You can probably summarize this already from the information provided above, but I wanted to lay out in plain terms here at the end:

• Strategic planning in the morning with any AI. Review regulatory news, summarize key decisions made by the government, industry leaders, and more.
• If you have a lot of emails and messages, use Copilot to summarize actions items and make a prioritized plan of action.
• As you test or review items in the audit file, use Clara AI to identify gaps in approach.
• During meetings, enable transcriptions and Facilitator. Use these tools so that people attending the meeting don't need to take detailed notes. Instead, each person can be fully invested in the topics they're discussing.
• Use Copilot to summarize and draft outlines for emails to the team and/or client.

3.1. Conclusion

3.1.1. What Can AI Do?

AI can increase efficiency, consistency, and audit quality, but there are some big assumptions when we state that. We first need to make sure we, as auditors, are using the tools themselves effectively. For an auditor, a general AI chat won't be very useful. Instead, we should be training and using focused models that solve specific purposes. The model will perform better if it's trained for specific purpose and isn't expected to know everything that's ever existed.

But what happens when we do use AI effectively? Well, at that point, we are able to elevate ourselves and automate the manual and tedious tasks that have taken up time historically.

Staff who may have been asked to spends hours cleaning data from the client before can now spend a shorter length of time reviewing the data output instead and then using that additional time to enhance their critical thinking. If you are used to performing these manual tasks, think about what your seniors or managers do with your results. Can you take on those tasks instead and elevate yourself into those roles?

3.1.2. The Role of the Human in an AI World

Last, but not least, I want to highly stress the importance of human in the loop (HITL) concept. What we do as auditors is strategically important, whether you're an internal or external auditor, and cannot be replaced by the current landscape of AI tools. Therefore, when we're using AI, we need to make sure we validate everything coming out the tool. At no point can the AI take responsibility, so we need to take responsibility for our actions when we use AI.

However, when we do all of this, we are able to elevate the role of the auditor to one of judgment, critical thinking, validation, and client relationship management. This means faster, higher quality, and more impactful audits throughout the industry.

What are the Web Content Accessibility Guidelines (WCAG) 2 requirements?

While the full list of WCAG requirements may seem intimidating, it's actually straightforward for a static site like cleberg.net if you are intentional about design. Luckily, they offer a Quick Reference guide that is much easier to parse than the full specification.

So, while it wasn't onerous to push myself over the 100% threshold, I wanted to write about how my current website design contributed to my compliance rate and why WCAG is important.

2. Why WCAG?

Before I dive into the specifics of how my website complies with these requirements, I wanted to touch on the importance of WCAG itself.

There are three major reasons I wanted to implement the WCAG requirements on my website:

1. Usability: The main reason, which I've covered in numerous other blog posts about minimalism and design, is usability. I believe that our tech should always serve a purpose and I believe that the design of a tool should encapsulate that idea. Therefore, designing a website with intent leads to better usability, both by those with and without disabilities.
2. Kindness: What's better than designing a tool accessible by everyone? Personally, I love the idea that no matter who visits my website, they should experience the same content and same utility intended by the website.
3. Future-Proofing: Technology, include internet tools, are changing constantly. When a website is well-designed, reachable by all audiences, and utilitarian, it will be able to last longer or even "decay gracefully".

3. Implementing WCAG On My Website

Since I do not implement JavaScript, forms, or multimedia content on my website, the list of items to implement was short.

I'll go through some of the items that I considered during my manual verification of the site. If an item is not on this list, it is either not applicable or the native browser functionality covers the requirement and I do not implement any custom element that would require verification.

• [1.1]: Text alternatives for non-text content (i.e., images)
  • For each image within my website, I made sure that alt-text was available.
• [1.3.1]: Use Accessible Rich Internet Applications (ARIA) landmarks to identify regions of a page
  • ARIA landmarks are available for the navigation menu on my website, which is the only element I use which is recommended by WCAG to have an ARIA role.
• [1.3.1]: Use semantic HTML elements to identify regions of a page
  • I have always used semantic HTML, but I reviewed my HTML templates to ensure I had coverage. In short, I use elements like <nav>, <main>, <article>, and <footer> instead of <div> elements.
• [1.4.1]: Use a color with a relative luminance difference of 3:1 or greater
  • When choosing the color palettes for this site, I ensured that all were at least AA compliant and in most cases, AAA compliant.
• [1.4.4]: Use em (or rem) units for font sizes
  • All sizing on this site uses rem sizing.
• [2.4.1]: Create links to skip blocks of repeated material
  • I created a skip-to-content link hidden at the top each web page that allows keyboard or screen reader users to skip the navigation block.
• [2.4.6]: Provide descriptive headings
  • Each page contains hierarchical headers starting at <h1>.
• [3.1.1]: Use the language attribute on the HTML element
  • Each pages is defined with <html lang=en-us>.
• [3.1.4]: Provide an expansion of an abbreviation on the first occurrence
  • To the best of my ability, I have been reviewing all historical posts on this site and expanding abbreviations upon first use.
• [3.2]: Make web pages appear and operate in predictable ways
  • This, and many other requirements, are resolved by a combination of (1) native browser functionality which works as expected since I am using semantic HTML, and (2) my use of a structure outline and logical content flow on each page of the site.

4. Results

To confirm compliance, I chose not to use one of the "free" accessibility checker websites, since they often only test one page at a time, take a while to run, and I just generally don't enjoy scanning my website with random services.

Instead, I used the IBM Equal Access Accessibility Checker extension on Firefox. This allowed me to scan each page I wanted, stored my scans, and provided in-depth results with links to guidance and suggestions for fixing each issue.

This was great as it showed me a handful of issues I hadn't caught previously. However, the image above shows that my site is 94% compliant through automated checks and I manually verified the remaining 6% of checks.

I performed these scans for all top-level pages on my website (home, about, blog, services, about, salary, and now), as well as the three latest blog posts to confirm compliance.

I'd love to test 100% of every page of my website one day and will continue to strive to enhance my compliance with ARIA and WCAG.

Shout-out to Jack Baty for inspiring me to write about my aerc-mail client after chatting about it over email recently!

1. Overview

aerc is a text user interface (TUI) email client with intuitive defaults, easy setup, and hassle-free operations. This post will walk through my personal configuration for aerc on macOS.

2. Installation

Since I am on macOS, I opted to install aerc from Homebrew. There are build options for additional modules if you build from source, but I am okay with the default options.

You can view the information about the package prior to installing it, if you wish:

brew info aerc

==> aerc: stable 0.21.0 (bottled), HEAD
Email client that runs in your terminal
https://aerc-mail.org/
Installed
/opt/homebrew/Cellar/aerc/0.21.0 (48 files, 23MB) *
  Poured from bottle using the formulae.brew.sh API on 2025-10-05 at 19:51:31
From: https://github.com/Homebrew/homebrew-core/blob/HEAD/Formula/a/aerc.rb
License: MIT
==> Dependencies
Build: go ✘, scdoc ✘
Required: notmuch ✔
==> Options
--HEAD
	Install HEAD version
==> Downloading https://formulae.brew.sh/api/formula/aerc.json
==> Analytics
install: 136 (30 days), 560 (90 days), 1,772 (365 days)
install-on-request: 136 (30 days), 560 (90 days), 1,772 (365 days)
build-error: 3 (30 days)

Once you confirm you want to install this package, run the following:

brew install aerc

3. First-Time Wizard

When you run aerc for the first time, an IMAP & SMTP wizard will walk you through a basic setup for your email account(s).

On macOS, aerc will save your configuration files in the following location: ~/Library/Preferences/aerc.

I tried to create a ~/.config/aerc directory, but the Library directory above took precedence. If you truly need to keep your files in ~/.config, you could probably symlink that to the Library location. However, I accepted my fate and will just edit the files within the Library directory.

4. Configuration

Once you have installed and setup aerc for the first time, you can configure the client and account settings.

As noted above, I will be working within the Library directory that aerc defaults to when installed via brew.

cd ~/Library/Preferences/aerc

This directory should contain the following files. You can open the accounts.conf file to confirm it contains the information you input during the wizard process.

I'll share my personal configuration, which is close to the defaults that existed at the time of writing this post.

accounts.conf

This is the information from the wizard. The only further customization I provided is the default signature file to be appended to each message I compose.

[Personal]
source         = imaps://hello%40cleberg.net:PASSWORD@imap.migadu.com
outgoing       = smtps://hello%40cleberg.net:PASSWORD@smtp.migadu.com
default        = INBOX
from           = Christian Cleberg <hello@cleberg.net>
copy-to        = Sent
cache-headers  = true
signature-file = /Users/cmc/Library/Preferences/aerc/sigs/default

sigs/default

Any content within this file will be appended to my messages, as noted above.

Christian Cleberg <hello@cleberg.net>
GPG: 3917 973F B159 BBB8 6194 5385 69451A51 7AC0 CB37

aerc.conf

This contains quite a few customizations for my preferences related to downloads, encryption, mouse controls, editor, and message composition.

[general]
# Prefer downloads to be saved to the Downloads folder
default-save-path=~/Downloads
# Use GPG for PGP encryption
pgp-provider=gpg

[ui]
# Enable mouse controls for scrolling, paging, etc.
mouse-enabled=true

[statusline]
[viewer]
# Use emacs instead of vi
pager=/usr/local/bin/emacs_viewer

[compose]
# Use emacs instead of vi
editor=emacs
# Add Cc as a default field to view each time I compose a message
header-layout=To|From,Cc,Subject
# Allow me to edit headers when composing (so I can customize From address)
edit-headers=true
# Warn me if I mentioned these words but don't attach a file
empty-subject-warning=true
no-attachment-warning=^[^>]*attach(ed|ment)

[multipart-converters]

[filters]
text/plain=colorize
text/calendar=calendar
message/delivery-status=colorize
message/rfc822=colorize
text/html=! html
.headers=colorize

[openers]
[hooks]
[templates]

IMPORTANT: If you use the pager option above that I'm using, you will need to create the emacs_viewer file as well.

You can create the file following my process below, which will create an executable in the location specified in my aerc.conf file. I put it in /usr/local/bin, but you can put it anywhere as long as it exists in the file path specific within your configuration file.

sudo nano /usr/local/bin/emacs_viewer

Paste this inside the file:

#!/bin/bash
emacs -nw - < "$1"

sudo chmod +x /usr/local/bin/emacs_viewer

binds.conf

Finally, here are the key bindings. I did not change these, but I'm showing them here in case you have an issue and want to see the defaults.

# Binds are of the form <key sequence> = <command to run>
# To use '=' in a key sequence, substitute it with "Eq": "<Ctrl+Eq>"
# If you wish to bind #, you can wrap the key sequence in quotes: "#" = quit
<C-p> = :prev-tab<Enter>
<C-PgUp> = :prev-tab<Enter>
<C-n> = :next-tab<Enter>
<C-PgDn> = :next-tab<Enter>
\[t = :prev-tab<Enter>
\]t = :next-tab<Enter>
<C-t> = :term<Enter>
? = :help keys<Enter>
<C-c> = :prompt 'Quit?' quit<Enter>
<C-q> = :prompt 'Quit?' quit<Enter>
<C-z> = :suspend<Enter>

[messages]
q = :prompt 'Quit?' quit<Enter>

j = :next<Enter>
<Down> = :next<Enter>
<C-d> = :next 50%<Enter>
<C-f> = :next 100%<Enter>
<PgDn> = :next 100%<Enter>

k = :prev<Enter>
<Up> = :prev<Enter>
<C-u> = :prev 50%<Enter>
<C-b> = :prev 100%<Enter>
<PgUp> = :prev 100%<Enter>
g = :select 0<Enter>
G = :select -1<Enter>

J = :next-folder<Enter>
<C-Down> = :next-folder<Enter>
K = :prev-folder<Enter>
<C-Up> = :prev-folder<Enter>
H = :collapse-folder<Enter>
<C-Left> = :collapse-folder<Enter>
L = :expand-folder<Enter>
<C-Right> = :expand-folder<Enter>

v = :mark -t<Enter>
<Space> = :mark -t<Enter>:next<Enter>
V = :mark -v<Enter>

T = :toggle-threads<Enter>
zc = :fold<Enter>
zo = :unfold<Enter>
za = :fold -t<Enter>
zM = :fold -a<Enter>
zR = :unfold -a<Enter>
<tab> = :fold -t<Enter>

zz = :align center<Enter>
zt = :align top<Enter>
zb = :align bottom<Enter>

<Enter> = :view<Enter>
d = :choose -o y 'Really delete this message' delete-message<Enter>
D = :delete<Enter>
a = :archive flat<Enter>
A = :unmark -a<Enter>:mark -T<Enter>:archive flat<Enter>

C = :compose<Enter>
m = :compose<Enter>

b = :bounce<space>

rr = :reply -a<Enter>
rq = :reply -aq<Enter>
Rr = :reply<Enter>
Rq = :reply -q<Enter>

c = :cf<space>
$ = :term<space>
! = :term<space>
| = :pipe<space>

/ = :search<space>
\ = :filter<space>
n = :next-result<Enter>
N = :prev-result<Enter>
<Esc> = :clear<Enter>

s = :split<Enter>
S = :vsplit<Enter>

pl = :patch list<Enter>
pa = :patch apply <Tab>
pd = :patch drop <Tab>
pb = :patch rebase<Enter>
pt = :patch term<Enter>
ps = :patch switch <Tab>

[messages:folder=Drafts]
<Enter> = :recall<Enter>

[view]
/ = :toggle-key-passthrough<Enter>/
q = :close<Enter>
O = :open<Enter>
o = :open<Enter>
S = :save<space>
| = :pipe<space>
D = :delete<Enter>
A = :archive flat<Enter>

<C-y> = :copy-link <space>
<C-l> = :open-link <space>

f = :forward<Enter>
rr = :reply -a<Enter>
rq = :reply -aq<Enter>
Rr = :reply<Enter>
Rq = :reply -q<Enter>

H = :toggle-headers<Enter>
<C-k> = :prev-part<Enter>
<C-Up> = :prev-part<Enter>
<C-j> = :next-part<Enter>
<C-Down> = :next-part<Enter>
J = :next<Enter>
<C-Right> = :next<Enter>
K = :prev<Enter>
<C-Left> = :prev<Enter>

[view::passthrough]
$noinherit = true
$ex = <C-x>
<Esc> = :toggle-key-passthrough<Enter>

[compose]
# Keybindings used when the embedded terminal is not selected in the compose
# view
$noinherit = true
$ex = <C-x>
$complete = <C-o>
<C-k> = :prev-field<Enter>
<C-Up> = :prev-field<Enter>
<C-j> = :next-field<Enter>
<C-Down> = :next-field<Enter>
<A-p> = :switch-account -p<Enter>
<C-Left> = :switch-account -p<Enter>
<A-n> = :switch-account -n<Enter>
<C-Right> = :switch-account -n<Enter>
<tab> = :next-field<Enter>
<backtab> = :prev-field<Enter>
<C-p> = :prev-tab<Enter>
<C-PgUp> = :prev-tab<Enter>
<C-n> = :next-tab<Enter>
<C-PgDn> = :next-tab<Enter>

[compose::editor]
# Keybindings used when the embedded terminal is selected in the compose view
$noinherit = true
$ex = <C-x>
<C-k> = :prev-field<Enter>
<C-Up> = :prev-field<Enter>
<C-j> = :next-field<Enter>
<C-Down> = :next-field<Enter>
<C-p> = :prev-tab<Enter>
<C-PgUp> = :prev-tab<Enter>
<C-n> = :next-tab<Enter>
<C-PgDn> = :next-tab<Enter>

[compose::review]
# Keybindings used when reviewing a message to be sent
# Inline comments are used as descriptions on the review screen
y = :send<Enter> # Send
n = :abort<Enter> # Abort (discard message, no confirmation)
s = :sign<Enter> # Toggle signing
x = :encrypt<Enter> # Toggle encryption to all recipients
v = :preview<Enter> # Preview message
p = :postpone<Enter> # Postpone
q = :choose -o d discard abort -o p postpone postpone<Enter> # Abort or postpone
e = :edit<Enter> # Edit (body and headers)
a = :attach<space> # Add attachment
d = :detach<space> # Remove attachment

[terminal]
$noinherit = true
$ex = <C-x>

<C-p> = :prev-tab<Enter>
<C-n> = :next-tab<Enter>
<C-PgUp> = :prev-tab<Enter>
<C-PgDn> = :next-tab<Enter>

5. Operation

Now that I have configured the program to my liking, I can run aerc in my terminal and see my changes reflected!

Personally, I keep aerc running in a terminal at all times, since it has the operation to ring a bell when a new message arrives.

The mailbox views and composition screens are fairly standard, but it does a great job at displaying information effectively.

All in all, I love aerc and far prefer it to my previous client (neomutt). In certain cases, Thunderbird is more convenient, but I don't find myself opening it at all lately. I will definitely update this post in the future if I find anything extraordinary to add about aerc.

Before I start describing digital gardens, I want to show a couple examples that are distinct enough to show how varied digital gardens are.

The first is a website (ava's space) and the second is a private collection of notes, using org-roam.

A digital garden is a personal space, just for you. It could serve any number of purposes, which I'll get into later, but the key is that it serves a specific purpose for yourself.

The primary features of a digital garden, as opposed to a personal website or blog, is that it is not inherently structured in a strict manner, it may follow a free form structure, it may look like a work-in-progress wiki.

At the end of the day, it defines a web page where any type of content exists and the author takes time and care to prune it in a specific manner.

2. Historical Context

A lot of people talk about Hypertext Gardens: Delightful Vistas by Mark Bernstein as the first instance of this phrase on the internet. And while this may be true, I want to take a step further back.

Have you heard of a Memex? This hypothetical device was described in Vannevar Bush's 1945 article "As We May Think". He envisioned a device that would be able to store all of a person's information for them - books, records, and communications. The person could then reference the Memex for any information and be guided to the correct spot. Essentially, it would the 1940's version of a mind mapping or personal knowledge system.

From the Memex to Hypertext Gardens to mind maps to other knowledge management systems, humans seem intent on constantly reinventing the art of information organization.

The modern web is the result of 30+ years of redesigning the web to streamline information. However, in this refinement, we've lost the art and beauty of personal websites where people would dump all of the information relevant to themselves.

Digital Gardens are a movement to bring these personal websites back and present them in a personalized fashion.

3. Common Uses

Before I get into how to build a digital garden, I want to touch on the potential uses. Everyone has their own reason for building a website and digital gardens are no exception.

You may want to build a digital garden for any number of reasons:

• Knowledge management
• Creative exploration
• Collaborative learning
• Personal reflection
• Artistic expression
• Data hoarding
• Social interaction

4. How to Build Your Own Garden

If you do want to create your own digital garden, you can get started with a few easy steps:

1. Choose a platform: You can host a website for free on platforms like GitHub or use a more note-taking platform like Notion or Obsidian.
2. Set Up the Structure: Decide how you want to organize your content. Remember the purpose of a digital garden! Plant all of the information you care about and then work to prune and clean them up as they grow.
3. Start with Your Interests: A digital garden should reflect yourself. Find your passions and start from there.
4. Regular Updates: A garden won't grow if you ignore it. Remember to check in and think if you want to add more, prune things out, or move things around.
5. Interlinking Ideas: Like plants and ecosystems, a digital garden should link together. You may use tags or links to connect items on your own site or perhaps includes links or lists to other gardens you enjoy.

By far the most important piece here is regular updates. You can always fix or change things, but the garden won't grow if you don't contribute to it.

5. Additional Suggestions

Digital gardens are such an easy way to manage your knowledge and unleash your creativity. Instead of sticking to the usual blog format, you get a space where your ideas can grow and change over time. Whether you want to document what you’re learning, share thoughts with others, or just reflect on your journey, a digital garden can be the perfect tool.

I strongly encourage you to create your own today, even if it starts as private notes instead of a website! Nothing is ever too small and the point of a garden isn't to be perfect, but to be a place where you can experiment and have fun.

1. Intro

Rocket League isn’t natively supported on macOS, but you can run it using CrossOver, a compatibility layer that lets Windows applications run on macOS. This guide walks you through installing CrossOver, setting up the Epic Games Store (or Steam), and getting Rocket League up and running.

2. Install CrossOver

To start, we will install CrossOver with Homebrew.

brew install --cask crossover

Once installed, launch CrossOver and select the Try Now button. CrossOver offers a 14‑day free trial. After the trial, a full license costs $74 USD.

3. Set Up the Epic Games Store (or Steam)

After opening CrossOver, click the Install button and install the Epic Games Store (or Steam, if you have Rocket League on Steam). You will need to agree to the installation prompts that pop up and it should install in just a couple minutes.

When the installer finishes, you’ll see a bottle (a sandboxed Windows environment) like the one below:

You can now launch the Epic application. Epic will update itself and then present the login screen:

4. Install Rocket League

Sign in to your Epic account, locate Rocket League in your library, and click Install. The download and installation process will complete shortly (depending on your internet connection), and then you should be ready to play.

5. Play the Game

Last but not least, launch the game from the Epic Games Store once you install it. It may take a minute or two when launching for the first time.

Take a look at the screenshots I was able to capture while playing on my M2 MacBook Pro with a PS5 Dualsense Edge controller:

6. Tips & Troubleshooting

Overall, the controller support for my PS5 Dualsense Edge controller worked out of the box and the performance was excellent. However, issues can happen and I gathered some tips, in case they do.

• Game runs slowly: In CrossOver, edit the bottle’s settings → Graphics → enable “Use DirectX 11” and increase the allocated RAM.
• Controller not detected: Install the Windows driver for your controller inside the bottle (e.g., Xbox 360 driver).
• Epic Store won’t update: Delete the EpicGamesLauncher cache folder inside the bottle (C:\Users\<User>\AppData\Local\EpicGamesLauncher\Saved) and restart the launcher.
• Crashes on launch: Ensure you have the latest macOS updates and that CrossOver is up‑to‑date (check “Check for Updates” in the app menu).

7. Conclusion

That's it! It's a simple process that allows you to try out Rocket League on macOS for 14 and determine if you enjoy this solution enough to pay for it.

If you know a way to do this for free without paying for CrossOver, please reach out and let me know! I am hesitant to pay $74 simply to play Rocket League, but we shall see.

Happy boosting!

I use a few different VPNs for different purposes. For general use, I use Mullvad due to its private account creation process, support for private payment options, and rock solid consistency. This is by far the most stable and high-speed VPN I have used over the last ~10 years.

I also use Njalla whenever I need to use a service where Mullvad is blocked. I have found that the Njalla IP I was provisioned is not blocked anywhere, so it's useful for software that seemingly has blocked all major VPN providers. There is no client, but they provide OpenVPN and Wireguard support.

Finally, I use AirVPN on my server's torrent service due to its support for port forwarding. I don't use it for any other purpose, but it works great with Transmission via Docker.

2. DNS

Using a VPN on every single device is not possible. For all of the other items on my network (IoT, Apple TVs, etc.), I enforce NextDNS via the UnifiOS script they provide. This lets me control the DNS on my network, avoid the ISP's default DNS, and enforce blocklists at a LAN level for my home network.

3. Data Removal

I use Easy Opt Outs due to its low price of $20 per year. There are other options that promise more utility, but I find that this service is adequate. Using this has dramatically reduced the spammy, "<person> info here" results on web searches.

Regardless, it's a low price to pay to make sure public information is not used against you and reduces the surface of information available via low-effort searches.

4. Passwords

I use Bitwarden due to its use-friendly interface, which is important to the people I share secrets with. Bitwarden allows for seamless username and password generation, multi-device syncing via its own provided service, built-in password strength and duplicate analysis, wide range of device support, and general UI (after its recent UI refresh).

If I were only keeping passwords for myself and didn't need to support non-technical users, I would strongly prefer KeePassXC. This would allow me to use Syncthing or another personal syncing solution that would avoid a centralized server that controls my passwords and authentication to access the passwords.

5. MFA

I use iOS, which is limited in options for great MFA apps. If you use Android, just use Aegis.

For iOS, I currently use Bitwarden Authenticator, which is a different app from Bitwarden. You can use this without linking it to a Bitwarden account and use it as a standalone app, if you're not a fan of storing your passwords and MFA methods in the same location. If you don't care, you can just use the MFA fields within Bitwarden itself.

The other options on iOS really aren't worth discussing, so I'll leave it here.

6. Communications

For private instant communications, I use Signal. This is currently the gold standard for private direct messages. It is centralized, but it is very stable, provides forward secrecy for messages, and has a proven track record of not spilling data.

As of 2026, I've started using SimpleX and I think it will replace Signal for me.

If we talk about other communication channels, I usually opt for emails encrypted with GPG (PGP). This isn't the best solution, but it does provide a trustworthy encryption method if you need to use email.

I am not a fan of the current landscape of private messaging apps outside of Signal (Matrix, Session, etc.), so I'll leave my thoughts here with Signal and PGP.

Want real privacy? Talk to someone in person when possible.

7. Browser Extensions

As of 2026, I've completed switched over to Tor on my desktop and Onion Browser on my phone for browsing.

With these browsers, I've removed all extensions and set the browsers to the highest privacy levels possible in the settings page.

7.1. Firefox (Desktop)

uBlock Origin is a no-brainer. This add-on provides domain-level blocking for resources, allowing you to block or allow specific domains, scripts, styles, and more with a click.

If you prefer to avoid mainstream websites and browse via alternative front-ends, I suggest using LibRedirect. You can configure this add-on to automatically redirect your requests to privacy-respecting alternatives.

7.2. Safari (iOS)

Since uBlock Origin doesn't work on Safari, I opt for uBlock Origin Lite, which is a decent alternative.

Similar to LibRedirect, I use Privacy Redirect on iOS to redirect websites to private alternative front-ends.

8. Payments

If you're just trying to avoid your bank collecting and using information about your purchases, you can try something like Privacy.com, which lets you mask the purchase information from your bank.

If you're paying in person, I vote for paying with cash. Withdraw a certain amount per paycheck and use for all in-person payments, whenever possible.

Yes. Another blog post about redesigning the website. I enjoy it, what can I say?

I wrote my latest post about redesigning from a monospace-driven, terminal-styled theme to a more natural paper-inspired theme. However, it left a nagging feeling that something was missing. What if I took it further? Was there really any reason that I had any of that CSS at all?

1. Inspiration

I briefly touched on my inspiration in the last post (hint: wabi-sabi, sho ga nai, brutalism, minimalism), but I didn't expand on the why for these concepts.

So, why? The minimalistic approach to web design has resonated with me for a long time. But why minimalism?

Officially, "the concept of minimalist architecture is to strip everything down to its essential quality and achieve simplicity."

This is a blog. It also has pages dedicated to describing who I am and what I offer. Therefore, the essential quality is the information delivered by the words and the design on your screen. To effectively communicate this information, I tried to understand how online information is best read.

With all of that out of the way, let's get on with it.

2. Core Changes

Below is a quick audit of the original style sheet and markup, and the elements I've removed or added. For more in-depth information, refer to the git diff.

w*HTML*

• HTML is now minified
• File tags
• Links to site pages are moved from the index to the about page
• Wiki was removed entirely
• Added a few <br> elements to compensate for some of the CSS removals

CSS

For the CSS, I removed everything, except the following rules.

body {
  max-width: 50em;
  margin: 1.5rem;
}

nav ul {
    list-style-type: none;
    display: flex;
    padding: 0;
}

nav ul li {
    margin-right: 0.5rem;
}

img {
    border-style: none;
    width: 100%;
}

table {
    border: 1px solid #111;
    border-collapse: collapse;
    width: 100%;
}

pre,
pre>code,
code {
    font-size: 0.9rem;
}

pre {
    border: 1px solid #111;
    margin: 0.5rem 0;
    padding: 0.5rem;
    overflow-x: auto;
}

time {
    display: block;
}

:not(pre)>code {
    color: #f00;
}

@media (prefers-color-scheme: dark) {
    body {
        background-color: #222;
        color: #eee;
    }
    
    a {
        color: #add8e6;
    }

    pre {
        border-color: #eee;
    }
}

That's it. No framework, no vendor prefixes, no unnecessary selectors.

This gave me an almost-pure HTML site. It's freeing. It's liberating. It's comfortable.

3. Reading Experience Benefits

Recent research shows that line length between 45–75 characters maximizes reading speed and comprehension. By constraining the container width to ~50 rem (≈ 100 characters), we stay close to that range while still staying wide enough for my personal preferences. Additionally, a lean stylesheet eliminates FOUC (flash‑of‑unstyled‑content) on slower networks, delivering a smoother first‑paint experience.

4. Final Thoughts

I am very pleased with the new theme and will see how it holds up to time. Based on enabling short-term server logs to debug issues (before promptly wiping it to the ether), I notice that most visitors to my site are via RSS anyway. Either way, I hope you reach out if you have an opinion; I always enjoy hearing from you.

Please note that this redesign is a work-in-progress and is not complete. The content below describes the beginning of this journey and where I think it may take me next.

1. Inspiration

I've written numerous times on this blog about minimalism, so it shouldn't surprise any readers here that I've redesigned my website again for even more minimalism. However, it's a bit different this time as I've historically designed my website to be very computer design driven (think monospace fonts and sharp contrasting colors), rather than focusing on designing a website for human readers.

I felt inspired recently to minimize my website yet again, but I couldn't figure out why I wanted to do so for a while. Finally, I think I figured it out. I have been inspired lately by concepts, such as wabi-sabi, sho ga nai, brutalism, minimalism, and related concepts.

This piece specifically inspired me to cut out elements on my web page that did not add value. In other places, I simply redesigned how that information was presented (e.g., creating an "About" page rather than putting that information on my home screen).

However, that was not the only motivation for redesigning my website. I have also recently found an interest in crafting a more human-centric design for my website.

In the past, it has largely been a monospace-only, sharp contrast, bold colored blog. As I grown older, I find myself more interested in naturally-occurring color palettes and focusing on legible content.

This blog post will explore the decisions I made and why I chose those decisions.

2. Function

The first step in this journey related to the functionality of the site itself. While my site has not used JavaScript for many years, I have focused on the HTML itself.

A common question I challenge myself with is: "Does this element serve a function? Is it useful? Does it provide more value than distraction?"

With the most recent redesign, I decided to:

• Keep the navigation bar to five elements.
• Move the "contact" details from the home page to a dedicated /about/ page.
• Minimize the footer to remove the build timestamp, donation links, security.txt links, and webring links.

This left a focus on navigation, my blog posts, and a short list of links to relevant pages on my website.

3. Colors

Previously, I used a very direct color palette for both light and dark modes, as seen below in the CSS snippet. This used sharp colors and relied heavily on "pure" colors without tints or shades.

This allowed for plain blank and white contrasting elements, with basic red and blue accent colors for inline code and links, respectively.

:root {
    --bg: #fff;
    --bg-bright: #eee;
    --fg: #111;
    --link: #00f;
    --code: #f00;
    --border: #ccc;
}

@media (prefers-color-scheme: dark) {
    :root {
        --bg: #121212;
        --bg-bright: #1e1e1e;
        --fg: #e0e0e0;
        --link: #8ab4f8;
        --code: #f28b82;
        --border: #333;
    }
}

After the update, the focus of the color scheme is focused on a more natural, paper-like effect. The light mode focuses on a yellow/orange-tinted paper-like substance, with a dark red accent and straightforward design. Likewise, the dark mode scheme uses a charcoal-like color scheme with very similar accent colors.

:root {
    --bg: #EDEDE7;
    --bg-bright: #E8D3BE;
    --fg: #201E1D;
    --link: #810208;
    --code: #810208;
    --border: #E8D3BE;
}

@media (prefers-color-scheme: dark) {
    :root {
        --bg: #201E1D;
        --bg-bright: #2F2F2D;
        --fg: #EDEDE7;
        --link: #D9C2A6;
        --code: #D9C2A6;
        --border: #2F2F2D;
    }
}

I am still working on the color scheme and don't believe I'm done modifying this yet. Expect more changes, as always.

4. Space

While I haven't updated the margins and padding much yet, I did make a few changes that affected the spacing of the site. The intent of this redesign is to keep the focus of the reader's eyes on the intended content, as well as creating a comfortable and intentional page layout.

That being said, let's dive into the changes I've made so far:

• Font style: I've updated the font style from a monospace font stack to a serif font stack. This created a more natural flow across the screen and less rigid constraints on the area of the fonts.
• Font size: Related to font style, I naturally had to update the font size as well. This allows for natural reading breaks for the eyes, spacing between lines, emphasized and larger headers for visual cues, as well as fewer words being displayed on screen at once.
• Date format: I have moved the visible dates on my pages from the ISO standard (YYYY-MM-DD) to a legible, human date format. The new dates describe the months in full words, as well as the day of the week on post pages, so that you may read it as you would say it out loud. The underlying date tagging within the <date> element itself still follows the ISO standard, as that's meant for computers to read.

With these changes, I'm pleasantly surprised at the quality improvement when reading the pages on the site.

5. Looking Forward

As I said at the beginning of the post, I'm not done yet. However, I wanted to stop and reflect on the changes so far.

I will continue to think about changes, specifically with the following already in mind:

• Color palettes: The current scheme is good but not great. I'd love to find a color palette that feels like reading natural paper.
• Emphasized text: Are links legible enough? Is there enough contrast between quotes, inline code, links, etc.?
• Spacing: Font sizes, padding, and potentially reducing content.
• Layout: Is there a better structure to this document that would allow for more comfortable reading?

With this phase done, I am content and am joyful at the thought of continuing to refine this website. If not for any readers who may or may not even exist, at least for myself.

However, there are apps that exist that can help enhance the privacy of an iOS device. The post below details a number of privacy resources, directories, and tools for iOS.

Resource Table

Note: This list focuses solely on iOS-compatible resources and tools. No Android comparisons here as I have not used Android in many years.

1. Email

First, I like to consider email as my first app on a new device. However, iOS is \extremely\ lacking in this area. Certain options are private, such as Proton Mail and Tuta, but they have certain restrictions and ecosystem lock-in methods that I try to avoid.

Canary Mail was a decent option for a while, although a bit mysterious, but they have recently leaned into the AI hype pretty heavily, which is concerning. However, it's still one of the only options for PGP emails on iOS.

• Proton Mail - One of the more popular private email options available on iOS. Allows custom domains, but does not allow for IMAP/SMTP usage, so you're locked into using their apps. Open source.
• Tuta - Tuta also locks you into their clients and they do not allow you to use custom domains. Open source.
• Canary Mail - Closed source, so you can't verify anything about what they are building into the app. However, it's one of the only options for PGP mail on iOS. Advanced features are locked behind a paywall.

Another suggestion is to use a browser-based web client. You can install browser mail clients as progressive web apps (PWAs). For example, I have been using webmail.migadu.com as a progressive email app for a while now and it works great for my purposes.

This allows for access to your email without installing an application that access native APIs or other potential data sources you may be concerned about. This is especially important if you're concerned about allowing permissions to device APIs, non-reproducible builds from the App Store, or mobile device fingerprints.

Lastly, Thunderbird iOS is under development. Keep an eye out for an alpha or beta release later in 2025 or early 2026. I have a feeling that once Thunderbird iOS is available, it will easily become the best option for email on iOS.

I use: Web-based email on iOS and Thunderbird on my desktop. Once Thunderbird releases for iOS, I will probably use that.

2. Browsers

Your choice of browser is very important if you're concerned with privacy. Any and all links you click will be opened in your default browser, so you need to make sure you choose the right browser and configure it properly. Trackers, ads, fingerprints, and data leaks are constant threats that should be avoided when possible.

• Firefox Focus - In my opinion, the best option for privacy on iOS. Automatically blocks trackers, erases data and history upon app close, and focused on private usage. However, it won't support your bookmarks or keep you logged into sites long-term.
• DuckDuckGo - Another good option, built on chromium. Like Focus, it allows you to clear all data with a button tap.
• Onion Browser & Orbot - Tor - what can I say? It's been the most popular privacy browser for ages for a reason and now it's available on iOS. Onion Browser is a Tor browser and Orbot can proxy any number of iOS apps through Tor. As with all Tor traffic, it will be slower than "regular" traffic.
• Brave - Another chromium-based privacy browser. Can sync with other Brave browsers via a secure linking process (no account). Fully-featured and great privacy defaults. There have been some concerns in the past about the company behind Brave, but I still think it's a decent option for most people.
• Safari (with caveats) - Great option if the browsers above don't work for you. Be sure to read PrivacyGuide's Safari section for more information on what you need to do to lock it down before relying on it full time.

I use: Hardened safari in private mode for every day use, and Onion Browser for anonymous browsing.

3. Messaging

Next up are messaging apps. If you have an iPhone, it's a good bet that you will be messaging other people on it. The threats for messaging apps tend to be metadata/data collection from cellular providers, ISPs, and Apple itself. If you want to protect the privacy of your messages, who your messaging, and the metadata around those messages (time, method, location, etc.), you'll need to think about which apps you're using.

• Signal - My personal favorite and still the gold standard for secure and private messaging. Open source, end-to-end encrypted, and runs its own private push notification infrastructure so Apple can't read your message content. A phone number is required to sign up, but you can create a username immediately after signing up and share that with others instead of sharing your phone number.
• SimpleX - A decentralized, phone-number-free messaging system. Uses anonymous message relays and asymmetric keys.
• Session - A fork of Signal's protocol that eliminates phone numbers entirely. Routes messages through a decentralized onion network (like Tor).
• Element - Based on the Matrix protocol, offering decentralized, federated chat. Great for groups and communities, with optional end-to-end encryption. Other client options are available for Matrix on iOS, as well.

I use: Signal for private chats with known people, and Matrix for group chats.

4. VPNs & Networking

Network traffic is where most surveillance happens. Even with encrypted messaging and browsers, your IP address and DNS queries reveal a lot about you. A good VPN or alternative network routing tool masks this, but not all VPNs are trustworthy. Avoid “free” services or those lacking transparency.

• Mullvad - A no-logs VPN that doesn't require an email or personal info to create an account. Consistently audited and privacy-focused. Their app is excellent on iOS.
• Tor - Best for anonymity rather than everyday VPN use. Routes your traffic over three relays, obscuring both source and destination. Slower, but unmatched for high-risk browsing.
• Yggdrasil - An experimental, encrypted, peer-to-peer mesh network. Less polished for mobile but useful for hobbyists or building private networks between devices.

If you can't self-host or build your own mesh, Mullvad is hands-down the easiest option here. There are other VPN options available, but I haven't tested them all so I will simply put my vote for Mullvad here and let you research other options if you don't want to use Mullvad.

I use: Mullvad for 24/7 usage, and Tor when anonymity is required.

5. Password Management

Weak and reused passwords are still the biggest risks for personal security. A good password manager makes it possible to use strong, unique credentials without memorizing them all.

• Bitwarden - Open source, audited, and free to self-host (e.g., Vaultwarden). The iOS app integrates with system autofill and Face ID.
• KeePassium - A KeePass-compatible client for iOS. Local database storage, optional cloud sync, and no external accounts. Excellent if you want full control over your credential store.
• KeePassXC + Syncing Solution - If you already use KeePass on desktop, sync your database with a secure method like Cryptomator-protected cloud storage, Syncthing, or local-only transfers.

Good passwords matter are extremely important, and these apps give you control over your vault.

I use: Bitwarden Families ($40/year) to protect passwords, passkeys, TOTP codes, and secure notes for my family. If I were using a solution solely for myself, I would prefer KeePassXC + Syncthing.

6. Multi-Factor Authentication (MFA)

MFA is essential, but relying on SMS codes or untrusted proprietary apps defeats the point. Use open, local, encrypted authenticators where possible. Also, use passkeys if you can! I prefer passkeys, then TOTP, and then SMS/email, if other options are not possible.

• Bitwarden Authenticator - Integrates with the password manager or works as a standalone TOTP app. Optional encrypted backups through your Bitwarden account.
• Ente Auth - Open source, end-to-end encrypted TOTP manager. Syncs encrypted via Ente's infrastructure.
• Tofu - Minimal, offline-first TOTP app. No cloud, no telemetry.
• Raivo OTP - Open source, native iOS app with secure iCloud backups. Clean interface.
• OTP Auth - A longstanding, trusted TOTP manager with encrypted backups and Apple Watch support. Not open source.

I recommend pairing one of these with strong passwords and a VPN for everyday security.

I use: Bitwarden Authenticator, previously OTP Auth.

7. Notes & Personal Data

If you're storing sensitive personal notes, account details, or journal entries, opt for encrypted, local-first apps.

• Beorg - An Org-mode-compatible outliner and task manager for iOS. Great for Emacs fans and those managing plaintext files.
• Obsidian - A local Markdown-based notes app. All data stays on your device unless you opt for Obsidian Sync (or your own setup).
• Standard Notes - End-to-end encrypted notes, with cross-platform sync. Good if you want a straightforward, secure cloud service.
• Joplin - Open source, Markdown notes with optional encryption and cloud sync (Nextcloud, Dropbox, etc).

These options help decouple your data from major cloud platforms while keeping notes portable and encrypted.

I use: Beorg, since I love org-mode.

8. Photos & Media

If you're using iCloud Photos, your camera roll quietly feeds metadata and images to iCloud by default. If you want to self-host or encrypt your photo library, here's what works on iOS. At a minimum, I suggest disabling iCloud for the Photos app, so the data stays local on your device.

• Immich (self-hosted) - Open source, feature-rich, self-hosted photo manager with facial recognition and live photo support. Requires a home server.
• Ente Photos - End-to-end encrypted photo storage with iOS and web apps. Paid plans, but privacy-first infrastructure.

Good privacy photos apps are rare on iOS — these two are the standout options right now.

I use: Immich for all photos.

9. Encryption Utilities

If you're handling sensitive files, you need a proper encryption utility to lock them down.

• Cryptomator - Open source, encrypted cloud storage vaults. Integrates with most cloud providers and works locally.
• Instant PGP - PGP key generation, import/export, and encrypted message/file creation. Handy for old-school secure comms.

If you're serious about privacy, encrypted storage and messaging layers like these are essential.

I use: Cryptomator when syncing sensitive data over Syncthing. I no longer require Instant PGP since Migadu's webmail client (SnappyMail) supports PGP.

10. News & Social

News and social apps leak all kinds of usage metadata, even when you're just lurking. These tools let you follow content with less exposure.

• NetNewsWire - Free, open source RSS reader for iOS.
• ThreeCheers - Privacy-friendly Tildes client for iOS.
• Voyager - Clean, independent Lemmy client.
• Mastodon - Federated, open source alternative to Twitter.
• PeerTube - Decentralized video platform, accessible via web or PWA.
• Pixelfed - Federated, open source alternative to Instagram.

If you're going to be online, at least let it be on your terms.

I use: NetNewsWire (via FreshRSS) for RSS feeds, Voyager for Lemmy, and Three Cheers for Tildes. I have used all of these apps and they are great, but I am not very active on social sites.

11. Final Thoughts

Whether you just want to improve your privacy in small steps or you're fashioning a tinfoil hat as we speak, moving to privacy-focused services and apps does two things:

1. It protects your privacy by ensuring that your data is being protected through the many methods mentioned above; and
2. It provides money (for paid apps), support (in terms of download count, reviews, ratings, etc.), and motivation for the developers and companies behind these apps that provide a privacy haven for users on iOS.

Every app you use, every service you sign into, quietly collects and trades your data. iOS makes true anonymity harder than other platforms, but these tools and services give you a fighting chance to keep your data private.

As trends have shown, the auditing and assurance world is increasingly becoming overwhelmed with topics like AI, Digital Assets, Cloud, DevOps, and Automation.

While these trends are rapidly transforming businesses and industries, audit firms and departments are working hard to ensure they stay aligned with business objectives.

Throughout my career, I've seen topics like "AI" evolve from LLM-based projects used by data scientists to everyday tools accessible to the masses and integrated directly into business operations.

As an auditor, skills in emerging technologies are an invaluable asset that can translate into massive career opportunities and long-term job security.

I have experienced this firsthand as topics like automation, AI, cloud assurance, and DevOps have kept me in a secure position with significant potential for growth and learning.

In this post, I'm going to walk through the process of becoming skilled in an emerging technology and how to translate that into a rewarding audit career.

2. Step 1: Build a Strong Foundation in Audit & Risk

To start, I want to note that learning about emerging technologies is only useful if you already have a base in auditing. You can't audit a cloud environment with cloud knowledge alone — you also need to understand the fundamentals of auditing.

If you find that you're highly technical already, focus your time on learning audit standards and guidance.

You can customize this to any frameworks applicable to your company or industry, but these are generally the baseline for an audit career:

• COSO
• NIST CSF
• ISO/IEC 27001
• PCAOB
• AICPA

The consistent theme throughout these frameworks is that audits rely on independent parties who provide consistent documentation, appropriate considerations of risks and responses, scoping, and reporting.

One of the easiest ways to get this knowledge is by doing. While it can be challenging, the concept is straightforward. If you are working in a role within a department like internal audit, external audit, risk, compliance, etc., focus on performing your role exceptionally and continuously challenge yourself to learn more about audit and risk each day you work.

3. Step 2: Learn the Tech That's Changing the Profession

Getting to the point of this post, there's a wide range of technologies transforming the audit world. To accelerate career growth and discover a niche you enjoy, I've compiled a short list of topics that are currently (1) growing in demand, (2) have a need for more experts within the audit field, and (3) are expected to remain relevant.

• Automation & Data Analytics: Alteryx, Python, Power BI, Tableau
• Cloud: AWS, Azure, GCP, IBM
• Blockchain: Decentralization, smart contracts, chain of custody
• DevOps: Azure DevOps, CI/CD, DevSecOps, GitHub, GitLab, Jenkins
• AI/ML: AI in business, AI in auditing, AI assurance

Pro Tip: Tackle one area at a time. You don't need to become an expert, but make sure you learn enough to conceptualize the technologies and logic behind the topics you're auditing.

If you focus on one at a time, you can dedicate time to that sole topic to understand it more deeply before moving on to the next.

4. Step 3: Earn Certifications That Signal Credibility

If you don't have much experience, or can't demonstrate your knowledge in a particular area due to job constraints or otherwise, you can utilize courses and certifications to boost your credibility. This is an effective way to establish credibility and demonstrate your qualifications.

• CISA (Certified Information Systems Auditor): Core certification for IT auditors covering systems, controls, governance, and assurance.
• Microsoft Azure Fundamentals (AZ-900) / AWS Certified Cloud Practitioner: Entry-level cloud certifications covering core cloud concepts, services, pricing, and security.
• Alteryx Designer Core Certification: Validates your ability to build data prep, blending, and analytics workflows in Alteryx.
• IBM Data Science Professional Certificate (via Coursera): Teaches data science fundamentals, Python, SQL, and AI basics; popular for aspiring data auditors and analysts.
• Entry-level technical certifications:
  • PCEP (Certified Entry-Level Python Programmer) by Python Institute
  • AI certifications on edX covering foundations, governance, and AI ethics.
  • Certified Blockchain Expert

I have earned the following certifications and have seen great responses throughout my career due to the credibility they provided in these focus areas:

• GitLab Certified Git Associate
• GitHub Foundations
• Alteryx Designer Core Certified
• Microsoft Certified: Azure Fundamentals
• Certified Information Systems Auditor (CISA)
• Certified Entry-Level Python Programmer (PCEP)
• Data Science Professional Certificate
• Cybersecurity Audit Certificate

5. Step 4: Join Emerging Tech Projects and Pilots

Once you have the knowledge and, if applicable, the credentials to showcase your skills, you need the chance to network and show what you can do.

To do this, I recommend joining a group focused on the topic you're passionate about. Normally, this is easiest within your own company. However, sometimes you may need to seek other opportunities in your community or online to find the project that works best for you.

• Seek opportunities internally: AI pilots, automation and data analysis projects, blockchain initiatives.
• If they don't exist — propose them.
• Suggest automating risk assessments, piloting AI tools, or testing continuous assurance routines.

Why this matters: These projects become resume differentiators and position you for leadership roles.

6. Step 5: Build a Network of Tech-Savvy Auditors & Consultants

As a segue from Step 4, ensure that you have a network of like-minded individuals who can challenge you and expose you to new ideas. This helps keep you sharp and open to innovation. Some suggestions include:

• Join ISACA, local AI/ML meetups, blockchain working groups.
• Engage with emerging tech communities on LinkedIn — share posts, comment on thought leadership, or publish insights.

7. Step 6: Stay Curious and Keep Learning

Last, but not least, keep learning! While you may feel like you know everything, there's always more to explore. I enjoy revisiting known problems from different perspectives, as it's helped me grow and realize that alternative approaches often yield better results with experience.

• The landscape is changing rapidly — stay current on AI regulation, blockchain security, cloud assurance frameworks, or whatever interests you.
• Subscribe to niche newsletters (e.g., The Cybersecurity 202, AI Ethics Weekly).
• Take one course or certification per year to stay sharp.

8. Closing

You don't need to be an engineer or software developer to thrive in technology — but you do need to understand enough to assess risk. With these steps, I have found a wonderful and fulfilling career, and I know you can too.

If you have any questions on how to break into tech risk and audit, feel free to reach out over email or anywhere else — I would love to connect and chat!

While debating if I should find a replacement laptop and get rid of my MacBook Pro, I decided to try Asahi Linux.

To put the bottom line up front, I love the experience and support for popular features has come a long way since I originally checked out their website a few years ago.

From Asahi's website, as seen below, I noticed that almost all targeted features are now supported. This is a great jump from the state it was at in 2022 - 2023 when I last checked.

1.1. Installation

Luckily, the installation process is as simple as getting started with a single command:

curl https://alx.sh | sh

This script will walk you through the standard installation steps to define the size of the Linux partition, define your user and hostname, and give you instructions on how to boot from the new operating system (OS).

Once the script completes, it will ask you to completely shut down the device, boot into the Startup Options menu, and follow a handful of prompts to enable your new OS.

1.2. Initial Thoughts

By default, the installer suggests using the KDE (as does the online community), so I opted to try KDE. Historically, I have always been a Gnome user when utilizing a fully graphical desktop environment (DE), but I'm up for trying something new.

KDE on Asahi works wonderfully and supports all of the generic features I'd expect from a vanilla installation:

• Snap to tile
• Shell and window themes
• Graphical updates
• Sensible default applications (Dolphin, Firefox, KMail, Konsole, KWrite)
• Support for battery percentages, keyboard backlight control, and miscellaneous sensor controls
• Fast and reliable bluetooth adoption
• Native game pad support

Here's a quick look at the default desktop. In subsequent screenshots, you'll see I started using the WhiteSur theme as it provides a more comfortable layout for macOS users.

When diving into the system information panel, we can see that this machine is running Fedora Linux Asahi Remix 42 on an Apple M2 Pro laptop with 16GB of RAM.

As I noted above, the first thing I did after installing Asahi and taking a few screenshots was to install and change themes.

I prefer the WhiteSur theme, as I used this theme previously on Linux before I switched to macOS. However, I also like themes that incorporate the gruvbox color palette, as well as the Nothing theme that uses a dark black and red color palette.

One of the things I use my laptop for the most is consuming media (music, television shows, movies, etc.), so I had to make sure that my bluetooth devices would connect properly.

As you can see in the screenshot below, my AirPods Pro 2 connect seamlessly and are available for use. By going through the normal button-holding process, I was able to pair my AirPods in about 10 seconds.

However, I have noticed that Asahi doesn't support some of the advanced AirPod capabilities like pausing media when you remove an AirPod from your ear. The lack of these advanced features doesn't bother me, but some people may be.

Next, I was able to connect my PS5 controller via USB-C and Asahi picked up the connect instantly in the settings menu. You can move the sticks and press all of the buttons to see if they're recognized within this settings menu.

I had a bit of an issue launching Steam the first time, as I was getting an AVC Denial error from SELinux. To fix this, I had to manually allow the Steam application access to the requested resources:

sudo ausearch -c 'passt' --raw | sudo audit2allow -M my-passt
sudo semodule -X 300 -i my-passt.pp

While my MacBook only has 16GB of RAM, which seems to be the bare minimum required for the virtualization overhead, I was able to test one or two games before they crashed due to RAM errors.

However, I did confirm that my PS5 controller worked natively with these games on Steam! I don't think I will be gaming much on this laptop anyway, but it seems you should have at least the 32GB models if you want to game on Asahi.

1.3. Software Support

One thing to keep in mind is that Apple silicon chips (M*) are based on the ARM architecture, which means you will need to install software that supports ARM (i.e., ARM64/aarch64).

While I have run into a handful of applications that do not have an ARM package available, it is not as difficult as it used to be to find suitable apps for all purposes on ARM.

1.3.1. Signal Desktop

One specific application that has been causing issues is Signal. The download page on their website will prompt you to install their Debian-based package, which does not work on RPM-based systems (or any other distribution except Debian & downstreams, such as Ubuntu).

There are a few different websites offering potential solutions, but I settled on the asahi-signal-desktop repository for now.

One thing to note is that this script does not work with all versions of Signal. I tested out 7.53.0 and found that the installer did not work at all.

I had to use 7.44.0, as noted in the project's README, for the script to work.

The installation process is simple. You can simply clone the repository and run the script:

git clone https://github.com/kenballus/asahi-signal-desktop/
cd asahi-linux-desktop
./install_signal.sh 7.44.0

At this point, Signal should work. However, I have run into constant crashing issues, so it's not a great solution.

signal-cli may work, but I have not tested this yet on Asahi. Before I used macOS, I used scli, which provides a TUI for the signal-cli utility and it worked wonderfully.

2. Final Thoughts

I am still in the early days of testing out Asahi Linux, so I will be sure to come back and update this post occasionally, but I am very happy with the user experience so far. Everything is smooth and I am still able to experience the great hardware of the Macbook with the software of Linux.

In addition to the screenshots above, I have been testing out SwayWM, which is slightly more difficult to configure after being away for Linux for a couple years. Regardless, it's working on Asahi as well and seems to be suitable for daily driving.

Overall, I am glad there's continued support for Asahi and will be supporting them through their Open Collective going forward. Cheers to the Asahi team on such a great product.

Since GitLab locks pull-only mirrors behind their Premium and Ultimate tiers, I found a different solution.

1. Creating Mirrors

I'll skip the setup and just hit the bullet points:

• I have a plethora of GitHub repositories.
• I used GitLab's mass-import functionality to do the initial import of my repositories from GitHub.
• I made sure all of my GitHub repositories were cloned locally in my ~/git directory.

2. Setting up Mirror Connections

To start, I navigated to the ~/git directory, which holds all of the repositories I have on GitHub and created a shell script.

cd ~/git
nano setup_mirrors.sh

Within this shell script, I created a loop that will open each repository and add both the GitHub and GitLab SSH-style clone URIs to the origin remote.

for repo in */
do
    cd $repo
    git remote set-url origin --push --add git@github.com:ccleberg/${repo%*/}.git
    git remote set-url origin --push --add git@gitlab.com:ccleberg/${repo%*/}.git
    git remote -v
    cd ..
done

Once complete, I created another shell script to open each repository, pull any remote commits, and push local commits to both remotes.

nano mirror.sh

for repo in */;
do
    cd $repo
    git pull --rebase origin HEAD
    git push
    cd ..
done

Finally, enable execution of both scripts before moving on.

chmod +x setup_mirrors.sh
chmod +x mirror.sh

3. Initialize Mirrors

To use the setup_mirrors.sh script above, simply execute it from a terminal.

./setup_mirrors.sh

Once complete, each repository should have one fetch URI (GitHub) and two push URIs (GitHub & GitLab). At this point, any git pull or git fetch commands will pull from GitHub and any git push commands will send updates to both GitHub and GitLab.

4. Schedule Periodic Checks

To utilize the mirror.sh script from the previous step, let's use crontab.

crontab -e

Within crontab, I used the schedule below to ensure the script is executed daily.

0 0 * * * /Users/cmc/git/mirror.sh

This ensures that the mirror.sh file is executed daily and will push any local or GitHub commits to GitLab.

I have tested this by manually running mirror.sh and watching the results. There are edge cases where I will need to intervene and manually resolve merge conflicts, but it's largely autonomous, so I'm happy with the results.

I recently migrated my emails from Proton Mail to Migadu after a failed attempt to get myself into the Proton ecosystem and wanted to detail my process, as it was far more painful than expected.

To give some context: I had nearly 5000 messages stored, accounting for around 2.5 GB of space.

Overall, this process would have taken all day had I done it in one sitting, but I decided to break it up and it lasted a couple days before I was able to say that all my messages were stored in my new account.

2. Exporting Messages

To start, I needed to export my messages from Proton Mail. As I am using macOS, I was able to use the Proton Mail Export Tool. However, the downside is that this dumps every single email on your account into a single folder in the .eml format. They also export a JSON file for each message, in the case you're importing back into Proton Mail.

This means that anything in my Inbox, Sent, Archive, Trash, and user-created folders were all dumped out into a single folder with incomprehensible names.

Without a clear path to easily figure out how to re-organize my emails into a new account, I was left a bit annoyed at Proton's export process.

3. Importing Messages

Left with a pile of messages and no way to discern what they were without opening each one, I decided to try and use Thunderbird to import messages into my new Migadu IMAP account.

This led to a dead end as my two methods failed:

1. ImportExportTools NG does not work with my version of Thunderbird (135).
2. Manually dragging the .eml files onto a folder in Thunderbird worked for small batches of files, but seemed to lock up if I tried to import more than a few hundred at a time. It also seemed a bit buggy, as I ended up with many duplicate, and sometimes triplicate, messages.

At this point, I decided to take a step back and use mu, a command-line utility that would index my files and sync back and forth with Migadu for me.

Using my blog post, Email in Doom Emacs with Mu4e on macOS, (and skipping the mu4e parts) I was able to set up a minimal directory connected to my Migadu IMAP account. Using my terminal, I simply moved all of my messages into the mu directory and synchronized the account, and voila, my messages synchronized successfully to the remote server and my other email clients.

However, the remaining issue was that I now had all 5000 messages in the Archive folder and needed to figure out how to organize them back into their proper directories.

4. Organizing Messages Into Folders

As with any problem, I used Python as my hammer to fix the problem. I started by creating the directories required in Thunderbird, fetching them with mbsync so that they appeared in my mu directory, and using Python to organize my messages into the newly-created sub-folders.

4.1. Sent Messages

I started by organizing my Sent messages. This required checking each file for the From header and moving them to the Sent folder.

cd ~/.maildir/migadu/Archive/cur
nano _sent.py

# _sent.py
import os
import glob
import shutil

# Loop through all files in the current folder
for file in glob.glob("*.eml"):
	# Create boolean to check if we should move the file
	move = False

	# Open the current file
		f = open(file, 'r')

	# For each line in file, find the From header
	for line in f:
		if line.startswith("From:"):
			# If we find ourself, mark the message for move
			if "user@example.com" in line:
				move = True

	# Close the file
	f.close()

	# Move the file, if marked for move
	if move == True:
		filepath = os.path.join("/Users/YOUR_USERNAME/.maildir/migadu/Archive/cur/", file)
		new_filepath = os.path.join("/Users/YOUR_USERNAME/.maildir/migadu/Sent/cur/", file)
		shutil.move(filepath, new_filepath)

python3 _sent.py

The only downside to my current approach is that it was the quick and dirty option, so I re-ran it while editing the user@example.com string for each email I wanted to move. If I had wanted to create a more well-defined solution, I would have created an array of addresses to check for and have the if statement check against that array.

Regardless, I was able to run this with the addresses I wanted to move to the Sent folder and was soon finished.

4.2. Archive Sub-Folders

Next, I needed to move the remaining ~3000 messages from the Archive folder into dated sub-folders, organized as such:

• Archive/2016
• …
• Archive/2025

To do this, I followed a similar approach as the method above but check for the Date header instead of the From header.

cd ~/.maildir/migadu/Archive/cur
nano _archive.py

This approach requires finding the X-Pm-Date header and splitting it by the spaces contained within. Once split into a list, we must select the fourth element, as that contains the year which will match the directory we should move it to.

For example, the header X-Pm-Date: Fri, 07 Feb 2025 16:12:08 +0000 will be split into a list as such:

[
    'X-Pm-Date:', # 0
    'Fri,',       # 1
    '07',         # 2
    'Feb',        # 3
    '2025',       # 4
    '16:12:08',   # 5
    '+0000'       # 6
]

From this list, we select the fourth element (2025) and use that to build the destination path.

# _archive.py
import os
import glob
import shutil

# Loop through all files in the sub-folders under Archive
for file in glob.glob("*.eml"):
	# Create boolean to check if we should move the file
	move = False

	# Open the current file
	f = open(file, 'r')

	# For each line in file, find the X-Pm-Date header
	for line in f:
		if line.startswith("X-Pm-Date"):
		# Split the line into a list by spaces;
		# Then select the item that contains the year
			year = line.split(" ")[4]
			move = True

	# Close the file
	f.close()

	# Move the file, if marked for move
	if move == True:
		filepath = os.path.join("/Users/YOUR_USERNAME/.maildir/migadu/Archive/cur/", file)
		new_filepath = os.path.join(f"/Users/YOUR_USERNAME/.maildir/migadu/Archive/{year}/cur/", file)
		shutil.move(filepath, new_filepath)

python3 _archive.py

At this point, we've now moved all Sent messages to the Sent box and organized all messages under the Archive folder into their correct sub-folders.

If you exported other files, such as files from your Inbox, Trash, etc., you could follow a similar approach and determine the best header or attribute to identify them for further organization.

4.3. Synchronize the Results

Before synchronizing the files in their new locations, I needed to remove the characters at the end of the file name since mu appends IDs to the end of file names.

cd ~/.maildir/migadu/Archive
nano _sync_prep.py

This script prepares the Archive sub-folders for synchronization, but the same concept applies to the Sent folder, except you'd replace */cur/* with * if this script were inside the Sent/cur directory.

import glob
import shutil

# Loop through all files in the sub-folders under Archive
for file in glob.glob("*/cur/*"):
	# Remove the characters at the end of the file name created by =mu=
	new_file = file.split(",U=",1)[0]

	# Move the file to the new file name
	shutil.move(file, new_file)

python3 _sync_prep.py

Finally, we can synchronize the results.

mbsync -aV

5. Removing Duplicates

My only remaining issue at the time of writing is identifying and removing duplicate messages. I have toyed with simple Python and command-line solutions to identify duplicate files, but could not get them to effectively define all the duplicates found in any specific directory.

I've even tried using the fclones utility, to no avail. It seems that something in the Proton export, my manual Thunderbird method attempt, or possible sync issues between Thunderbird -> Migadu <-> mu caused duplicates where content within the message has been modified.

Although I now seem to be wasting space and in need of a deduplication tool, I have all of my messages migrated to my new service.

This review is written at a high-level for users, not a technical deep-dive of VPN technologies.

1. What is Obscura?

Obscura is a new VPN offering that's partnered with Mullvad to provide a unique service: a VPN that "can't log your activity" due to the fact that it uses Obscura servers for initial traffic routing and then passes off the traffic to Mullvad's WireGuard servers as exit nodes.

This two-party VPN protocol allows you to use Obscura to relay your traffic, but they don't see your traffic. On the other hand, the exit nodes from Mullvad will see where you're connecting but cannot tell who you are as your traffic will come directly from Obscura servers with other users.

2. Privacy Features

One of the things I look for when considering a VPN are privacy features intended to benefit users. Here are the features I love about Obscura:

• Two-party VPN protocol with Mullvad's servers
• No email required for sign-up
• No credit card required, crypto options available
• Open source repository is available
• Tor website available
• Transparent display of the exit server's public key (see the Location page in the app) so you can verify with Mullvad that you're connect via a genuine Mullvad exit node using Mullvad's server listing

3. Initial Impressions

3.1. Available Platforms

I am testing out Obscura on macOS, as that is the only available platform. This is the biggest downside, as I would not want to support different VPNs on different devices - if I'm using Obscura, I want to use it on all of my platforms (macOS, iOS, and Ubuntu).

However, the macOS app is incredibly easy to install via the .dmg file available on Obscura's website. Upon first launch, you're presented with a login option and can create an account now, if you have not done so already.

3.2. Payment

Once created, the app will ask you to pay if you do not have a subscription. As far as I can tell, there is no free tier available. In my opinion, this is a good thing as I hesitate to understand how privacy-focused apps make money when they offer free services to users.

3.3. Connection

Once you've enrolled in either a subscription or one-time payment, Obscura will return you to the app and allow you to connect. You can choose a specific server location or automatically connect.

3.4. Speed

The connection feels naturally smooth and I haven't experienced any disruptions or lag in my (very short) time testing out the application. To confirm, I checked a speed test while connected to a server location in my country.

Speed test results:

• 85.49 Mbps (Down)
• 217.75 Mbps (Up)
• 25 ms (Ping)

3.5. Mullvad Verification

Lastly, I checked with Mullvad's verification tool (mullvad.net/en/check) to verify Obscura's claims that Obscura sends your traffic through Mullvad's exit nodes before connecting to your target.

From the image below, we can see that Mullvad confirmed my traffic to be connected through a Mullvad IP address.

4. Final Thoughts

Overall, I have found the app to be fast and user friendly. The privacy features are certainly compelling, but the platform has a ways to go before it can displace something like Mullvad in the privacy-focused portion of the VPN market.

I wish Obscura offered the following features:

• Available on more platforms
• Specifics on how many devices will be allowed per account
• More server locations, especially in countries with stronger data privacy laws
• Options to pay with other crypto beside Bitcoin, such as Monero
• Whitepapers or videos that walk through the technical details and show how traffic can be verified to be encrypted and connecting through the various expected nodes
• Verifiable builds

However, Obscura is a nice tool for now and I hope to see more information from the technical side to help more users gain comfort around the security and privacy of the tool.

Used Obscura? Send me an email and let me know your thoughts!

Tandoor is a smart recipe manager web application that allows you to:

• Store your recipes
• Search for recipes and ingredients
• Share recipes with a link and permission system
• Put recipes and ingredients into a shopping list
• Plan your meals with a built-in calendar
• Calculate nutritional values
• Import recipes from websites and apps
• Load existing recipes

2. Installation

The Tandoor docs contain all of the relevant information needed to get start with the self-hosting process.

This tutorial will use Docker Compose and Nginx on Ubuntu 24.04.1.

2.1. Docker Compose

On your machine, create a directory for Tandoor and copy down the .env and docker-compose.yml templates:

mkdir ~/tandoor cd ~/tandoor wget
https://raw.githubusercontent.com/vabene1111/recipes/develop/.env.template -O .env wget
# Plain version of docker-compose.yml
https://raw.githubusercontent.com/vabene1111/recipes/develop/docs/install/docker/plain/docker-compose.yml

Within these files, customize as needed.

• .env
  • Add a SECRET_KEY
  • Define the ALLOWED_HOSTS
  • Set the POSTGRES_PASSWORD
• docker-compose.yml
  • Update the ports since Nginx on my host is already using port 80 (e.g. 8087:80)

Once you've updated and saved the files, you can launch the container.

sudo docker compose up -d

The application is now available at localhost:8087 or ip_address:8087 if accessing via a different machine. If accessing via a different machine, remember to allow port 8087 through any existing firewalls.

2.2. Nginx Reverse Proxy

Now that Tandoor is available locally, let's connect it to the Nginx web server running on the host machine.

Note: I use Nginx configuration files within the conf.d directory, but you may need to use the sites-available directory, depending on your installation of Nginx.

cd /etc/nginx/conf.d/
sudo nano recipes.conf

Within this file, define your website configuration. The example below is my default configuration and utilizes a wildcard certificate for *.example.com that covers all of my subdomains. If you don't have a wildcard certificate, you will need to generate an SSL certificate for your domain.

server {
        listen                  443 ssl;
        listen                  [::]:443 ssl;
        http2                   on;
        server_name             recipes.example.com;

        # SSL
        ssl_certificate         /etc/letsencrypt/live/example.com/fullchain.pem;
        ssl_certificate_key     /etc/letsencrypt/live/example.com/privkey.pem;
        ssl_trusted_certificate /etc/letsencrypt/live/example.com/chain.pem;

        # reverse proxy
        location / {
                proxy_pass         http://localhost:8087/;
                proxy_set_header   Host $http_host;
                proxy_set_header   X-Forwarded-Proto $scheme;
                proxy_redirect http://127.0.0.1:8080 https://recipes.example.com;
        }

        location /media/ {
                root   /media/;
                index  index.html index.htm;
        }
}

# HTTP redirect
server {
        listen      80;
        listen      [::]:80;
        server_name recipes.example.com;
        include     custom.d/letsencrypt.conf;

        if ($host ~ ^[^.]+\.example\.com$) {
                return 301 https://$host$request_uri;
        }
}

Save and close the configuration file and then restart the web server.

sudo systemctl restart nginx.service

The app is now available on your custom domain!

2.3. Screenshots

The Lounge is a self-hosted IRC client for the web, which supports a lot of desirable features for a modern IRC client. The Lounge supports push notifications, link previews, file uploads, always connected, multi-user support, and is available as a PWA for mobile devices.

I wanted to write this as I had written a post about self-hosting Convos and have recently migrated over to The Lounge instead.

If you'd like to try a demo first, head over to the official demo website.

1.1. Installation (Docker)

I install everything I can via Docker, so this tutorial will install The Lounge with the Docker Compose platform.

You can find the official docker version of The Lounge's repository on GitHub at thelounge-docker.

To start, let's create a directory for this app and create the compose.yml file.

mkdir thelounge
cd thelounge
nano compose.yml

Within this configuration file, you can paste the content below and customize as needed. If you want to use a different port on your machine, change the first port on the 9000:9000 line. Additionally, you may move the volume to a different location if required.

services:
  thelounge:
    image: ghcr.io/thelounge/thelounge:latest
    container_name: thelounge
    ports:
      - "9000:9000"
    restart: always
    volumes:
      - ./.thelounge:/var/opt/thelounge

Save and close the file and you can now launch the service.

sudo docker compose up -d

The service is now available at localhost:9000 or machine_ip:9000 if you're browsing from a different device. Don't forget to allow the port through your machine's firewall, if you have one enabled.

1.2. Nginx Reverse Proxy

If you want to access the service via a domain name (thelounge.example.com), you can use Nginx as a reverse proxy.

First, create the Nginx configuration file.

sudo nano /etc/nginx/conf.d/

The configuration below assumes you have a wildcard certificate for HTTPS (:443) traffic via example.com. If you don't, you'll need to obtain an SSL certificate to use HTTPS.

upstream irc_upstream { server 127.0.0.1:9000; }

# HTTP redirect
server {
	listen      80;
	listen      [::]:80;
	server_name thelounge.example.com;
	include     custom.d/letsencrypt.conf;

	if ($host ~ ^[^.]+\.example\.com) {
		return 301 https://$host$request_uri;
	}
}

# HTTPS
server {
	listen                  443 ssl;
	listen                  [::]:443 ssl;
	http2			on;
	server_name             thelounge.example.com;

	# SSL
	ssl_certificate         /etc/letsencrypt/live/example.com/fullchain.pem;
	ssl_certificate_key     /etc/letsencrypt/live/example.com/privkey.pem;
	ssl_trusted_certificate /etc/letsencrypt/live/example.com/chain.pem;

	# reverse proxy
	location / {
	        proxy_pass           http://irc_upstream;
	        client_max_body_size 0;
	        proxy_set_header     X-Request-Base "$scheme://$host/";

		# Standard reverse proxy settings
		proxy_set_header Host $host;
		proxy_set_header Upgrade $http_upgrade;
		proxy_set_header Connection upgrade;
		proxy_set_header Accept-Encoding gzip;
		proxy_set_header X-Real-IP $remote_addr;
		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
		proxy_set_header X-Forwarded-Proto $scheme;
		proxy_set_header X-Forwarded-Host $http_host;
		proxy_set_header X-Forwarded-Uri $request_uri;
		proxy_set_header X-Forwarded-Ssl on;
		proxy_redirect  http://  $scheme://;
		proxy_http_version 1.1;
		proxy_set_header Connection "";
		proxy_cache_bypass $cookie_session;
		proxy_no_cache $cookie_session;
		proxy_buffers 64 256k;
	}
}

Finally, restart Nginx to see the effects.

sudo systemctl restart nginx.service

1.3. Initial Setup

The first thing you'll need to do is create a user. You can do this with the docker container with the following command, which will ask for a password.

sudo docker exec --user node -it thelounge thelounge add [username]

Once the user has been created, you'll be able to log in to the web interface. Once created, you can change your password in the settings panel of the web interface.

Finally, you can connect to an IRC server with the plus (+) button at the bottom of the sidebar and connect to individual channels or users via the plus (+) button next to your server's name in the sidebar.

As someone who doesn't do software development full time and intends to actually enjoy it as a hobby, I've been interested in the concept of code assistants for a while. However, I had a few issues:

1. I'm not a full-time developer, so I wanted to actually learn all the various features and rules of the projects I was building.
2. The quality was quite low until recently.
3. I wanted to use an open-source solution. Ideally, one with a free tier so that I could test it before paying for a subscription.

I recently discovered Continue, which allows for local LLM configurations via Ollama, so I've decided to try it out and see how helpful a code assistant can really be for someone like me, who doesn't do this professionally.

2. Installation

Installation is a quick and painless process if you already have Ollama installed, but I'll assume that we're starting from scratch.

2.1. Ollama

First, install Ollama for your system. For macOS devices, I'd recommend using Homebrew via the following command. However, you can also visit their website and install the software manually.

brew install ollama
brew services start ollama

Next, we will need to install the models requested by the Continue extension. By default, Continue asks you to install the llama3.1:8b and starcoder2:3b models. However, you can customize the configuration to specify different models, if preferred.

ollama pull llama3.1:8b 
ollama pull starcoder2:3b

At this point, Ollama should be running on your local machine and have two models available for use.

You can test this by visiting http://localhost:11434/ in your browser or use cURL in your shell:

curl http://localhost:11434

# If running, the response will look like this:
# Ollama is running

2.2. Continue

To get started with using Ollama as a code assistant in VS Codium, you'll first need to install the Continue extension. This extension is available for free on the Visual Studio Code marketplace and can be easily installed via the built-in Extension view.

Follow these steps:

1. Open VS Codium and navigate to the Extensions view by clicking on the square icon next to the file menu or pressing Ctrl+Shift+X (Windows/Linux) or Cmd+Shift+X (Mac).
2. Search for "Continue" in the Extensions marketplace.
3. Click on the Continue extension and click Install.

Once installed, restart VS Codium to ensure that the extension is properly loaded.

3. Continue: Extension Configuration

When you first install Continue, it will ask which service you'll be using. If you select Ollama, it will check to make sure Ollama is running and you have installed the two default models from Ollama.

After this initial setup, you can open the config.json file by pressing Cmd + p and entering > Continue: Open config.json. This will show a config such as the following:

{
  "models": [
    {
      "title": "Llama 3.1 8B",
      "provider": "ollama",
      "model": "llama3.1:8b"
    },
    {
      "model": "claude-3-5-sonnet-20240620",
      "provider": "anthropic",
      "apiKey": "",
      "title": "Claude 3.5 Sonnet"
    }
  ],
  "tabAutocompleteModel": {
    "title": "Starcoder 3b",
    "provider": "ollama",
    "model": "starcoder2:3b"
  },
  "customCommands": [
    {
      "name": "test",
      "prompt": "{{{ input }}}\n\nWrite a comprehensive set of unit tests for the selected code. It should setup, run tests that check for correctness including important edge cases, and teardown. Ensure that the tests are complete and sophisticated. Give the tests just as chat output, don't edit any file.",
      "description": "Write unit tests for highlighted code"
    }
  ],
  "contextProviders": [
    {
      "name": "code",
      "params": {}
    },
    {
      "name": "docs",
      "params": {}
    },
    {
      "name": "diff",
      "params": {}
    },
    {
      "name": "terminal",
      "params": {}
    },
    {
      "name": "problems",
      "params": {}
    },
    {
      "name": "folder",
      "params": {}
    },
    {
      "name": "codebase",
      "params": {}
    }
  ],
  "slashCommands": [
    {
      "name": "edit",
      "description": "Edit selected code"
    },
    {
      "name": "comment",
      "description": "Write comments for the selected code"
    },
    {
      "name": "share",
      "description": "Export the current chat session to markdown"
    },
    {
      "name": "cmd",
      "description": "Generate a shell command"
    },
    {
      "name": "commit",
      "description": "Generate a git commit message"
    }
  ],
  "embeddingsProvider": {
    "provider": "ollama",
    "model": "nomic-embed-text"
  }
}