Hacking

Most break reminders run on a plain clock. You set a 50 minute timer and then you walk away for 30 of those minutes to get a coffee. The timer still fires the moment it runs out. It does not know that you just sat back down. I already wear a smartwatch. It taps my wrist after I sit for too long, which helps, but it measures the wrong thing. It watches my wrist, not my desk. A few arm movements are enough to convince it that I got up. In the meantime I am still in the same chair, in front of the same screen. I am also the kind of person who concentrates hard enough to lose track of time. Eyestrain is usually the first sign that I went too far. So I wanted something that watches the desk instead. On that desk sits an old 2009 piece of e-waste: a Samsung N130 netbook with a single core Intel Atom processor and 1GB of RAM. It runs Void Linux, and it is the same machine I turned into a basement WiFi router a few months ago. I made it a desk sentinel. It checks whether I am really sitting in front of the workstation. It counts work time only while I am there, and it speaks up once I stay too long. Image credits to: Bananayota, found on Pixabay TL;DR An old Samsung N130 netbook running Void Linux now works as a desk sentinel. motion watches the built-in webcam. On every start and stop of movement it writes active or idle into a plain state file. A small Nim daemon reads that file and tracks continuous desk time with a live one line progress bar. Once the limit is reached, it calls espeak-ng and wall. An absence under 5 minutes does not reset the clock. Nothing is recorded. The video feed never leaves the netbook and no frame is written to disk. The daemon runs as an unprivileged supervised runit service. It costs 0.01% of one core and 2 MB of RAM. motion is the real cost on this hardware. On the way I found and fixed a shell injection bug in the alarm code, a broken motion.conf quoting bug and two display bugs. Details below. ...

Background: I work with one or more terminal command-line always opened and having to pick up my phone to generate an OTP breaks my flow; also it’s always nice to have an alternate source of multi-factor authentication if something bad happens, one day you could lose or break your trusty mobile device. Therefore I was looking for a way to login through Okta portals without a phone. You may argument that this defeats the whole meaning of MFA, but let’s say it’s only an hack for research and fun purpose … ...

I like playing with the D programming language and I wrote this little post to show how it’s easy to create a dynamic library (shared object, .so) that can be invoked in other programs; to have a little fun we will write a D replacement for the rand() C standard library function call. For your convenience, all the code is also on github Let’s start with the demo implementation, a C program that calls 10 times the stdlib function rand() to get a random number. ...

honey-ssh-pot Curious about who and how attempts ssh login to your home server ? Me too… So I wrote a very simple ssh honeypot, just to collect interesting info about the kind guys who knocks my door :) warning: this is safe, but don’t run the service (well, ANY service) as root user. Even better if you can run it as a dedicate unprivileged user. This program is only for didactic use and not intended for deployment in a production network environment. If you want to have it exposed on the public internet, you must map port 22 of your wan router to the internal server port ( 2222 by default)… Do it at your risk! ...