Planet FSCI

August 29, 2025

• Ravi Dwivedi Installing Debian With Btrfs and Encryption

  Motivation

  On the 8th of August 2025 (a day before the Debian Trixie release), I was upgrading my personal laptop from Debian Bookworm to Trixie. It was a major update. However, the update didn’t go smoothly, and I ran into some errors. From the Debian support IRC channel, I got to know that it would be best if I removed the texlive packages.

  However, it was not so easy to just remove texlive with a simple apt remove command. I had to remove the texlive packages from /usr/bin. Then I ran into other errors. Hours after I started the upgrade, I realized I preferred having my system as it was before, as I had to travel to Noida the next day. Needless to say, I wanted to go to sleep rather than fix my broken system. Only if I had a way to go back to my system before I started upgrading, it would have saved a lot of trouble for me. I ended up installing Trixie from scratch.

  It turns out that there was a way to recover to the state before the upgrade - using Timeshift to roll back the system to a state (in our example, it is the state before the upgrade process started) in the past. However, it needs the Btrfs filesystem with appropriate subvolumes, not provided by Debian installer in their guided partitioning menu.

  I have set it up after a few weeks of the above-mentioned incident. Let me demonstrate how it works.

  

  Check the screenshot above. It shows a list of snapshots made by Timeshift. Some of them were made by me manually. Others were made by Timeshift automatically as per the routine - I have set up hourly backups and weekly backups etc.

  In the above-mentioned major update, I could have just taken a snapshot using Timeshift before performing the upgrade and could have rolled back to that snapshot when I found that I cannot spend more time on fixing my installation errors. Then I could just perform the upgrade later.

  Installation

  In this tutorial, I will cover how I installed Debian with Btrfs and disk encryption, along with creating subvolumes @ for root and @home for /home so that I can use Timeshift to create snapshots. These snapshots are kept on the same disk where Debian is installed, and the use-case is to roll back to a working system in case I mess up something or to recover an accidentally deleted file.

  I went through countless tutorials on the Internet, but I didn’t find a single tutorial covering both the disk encryption and the above-mentioned subvolumes (on Debian). Debian doesn’t create the desired subvolumes by default, therefore the process requires some manual steps, which beginners may not be comfortable performing. Beginners can try distros such as Fedora and Linux Mint, as their installation includes Btrfs with the required subvolumes.

  Furthermore, it is pertinent to note that I used Debian Trixie’s DVD iso on a real laptop (not a virtual machine) for my installation. Debian Trixie is the codename for the current stable version of Debian. Then I took screenshots in a virtual machine by repeating the process. Moreover, a couple of screenshots are from the installation I did on the real laptop.

  Let’s start the tutorial by booting up the Debian installer.

  

  The above screenshot shows the first screen we see on the installer. Since we want to choose Expert Install, we select Advanced Options in the screenshot above.

  

  Let’s select the Expert Install option in the above screenshot. It is because we want to create subvolumes after the installer is done with the partition, and only then proceed to installing the base system. “Non-expert” install modes proceed directly to installing the system right after creating partitions without pausing for us to create the subvolumes.

  

  After selecting the Expert Install option, you will get the screen above. I will skip to partitioning from here and leave the intermediate steps such as choosing language, region, connecting to Wi-Fi, etc. For your reference, I did create the root user.

  

  Let’s jump right to the partitioning step. Select the Partition disks option from the menu as shown above.

  

  Choose Manual.

  

  Select your disk where you would like to install Debian.

  

  Select Yes when asked for creating a new partition.

  

  I chose the msdos option as I am not using UEFI. If you are using UEFI, then you need to choose the gpt option. Also, your steps will (slightly) differ from mine if you are using UEFI. In that case, you can watch this video by the YouTube channel EF Linux in which he creates an EFI partition. As he doesn’t cover disk encryption, you can continue reading this post after following the steps corresponding to EFI.

  

  Select the free space option as shown above.

  

  Choose Create a new partition.

  

  I chose the partition size to be 1 GB.

  

  Choose Primary.

  

  Choose Beginning.

  

  Now, I got to this screen.

  

  I changed mount point to /boot and turned on the bootable flag and then selected “Done setting up the partition.”

  

  Now select free space.

  

  Choose the Create a new partition option.

  

  I made the partition size equal to the remaining space on my disk. I do not intend to create a swap partition, so I do not need more space.

  

  Select Primary.

  

  Select the Use as option to change its value.

  

  Select “physical volume for encryption.”

  

  Select Done setting up the partition.

  

  Now select “Configure encrypted volumes.”

  

  Select Yes.

  

  Select Finish.

  

  Selecting Yes will take a lot of time to erase the data. Therefore, I would say if you have hours for this step (in case your SSD is like 1 TB), then I would recommend selecting “Yes.” Otherwise, you could select “No” and compromise on the quality of encryption.

  After this, you will be asked to enter a passphrase for disk encryption and confirm it. Please do so. I forgot to take the screenshot for that step.

  

  Now select that encrypted volume as shown in the screenshot above.

  

  Here we will change a couple of options which will be shown in the next screenshot.

  

  In the Use as menu, select “btrfs journaling file system.”

  

  Now, click on the mount point option.

  

  Change it to “/ - the root file system.”

  

  Select Done setting up the partition.

  

  This is a preview of the paritioning after performing the above-mentioned steps.

  

  If everything is okay, proceed with the Finish partitioning and write changes to disk option.

  

  The installer is reminding us to create a swap partition. I proceeded without it as I planned to add swap after the installation.

  

  If everything looks fine, choose “yes” for writing the changes to disks.

  

  Now we are done with partitioning and we are shown the screen in the screenshot above. If we had not selected the Expert Install option, the installer would have proceeded to install the base system without asking us.

  However, we want to create subvolumes before proceeding to install the base system. This is the reason we chose Expert Install.

  Now press Ctrl + F2.

  

  You will see the screen as in the above screenshot. It says “Please press Enter to activate this console.” So, let’s press Enter.

  

  After pressing Enter, we see the above screen.

  

  The screenshot above shows the steps I performed in the console. I followed the already mentioned video by EF Linux for this part and adapted it to my situation (he doesn’t encrypt the disk in his tutorial).

  First we run df -h to have a look at how our disk is partitioned. In my case, the output was:

  # df -h
  Filesystem              Size  Used  Avail   Use% Mounted on
  tmpfs                   1.6G  344.0K  1.6G    0% /run
  devtmpfs                7.7G       0  7.7G   0% /dev
  /dev/sdb1               3.7G    3.7G    0   100% /cdrom
  /dev/mapper/sda2_crypt  952.9G  5.8G  950.9G  0% /target
  /dev/sda1               919.7M  260.0K  855.8M  0% /target/boot
  

  df -h shows us that /dev/mapper/sda2_crypt and /dev/sda1 are mounted on /target and /target/boot respectively.

  Let’s unmount them. For that, we run:

  # umount /target
  # umount /target/boot
  

  Next, let’s mount our root filesystem to /mnt.

  # mount /dev/mapper/sda2_crypt /mnt
  

  Let’s go into the /mnt directory.

  # cd /mnt
  

  Upon listing the contents of this directory, we get:

  /mnt # ls
  @rootfs
  

  Debian installer has created a subvolume @rootfs automatically. However, we need the subvolumes to be @ and @home. Therefore, let’s rename the @rootfs subvolume to @.

  /mnt # mv @rootfs @
  

  Listing the contents of the directory again, we get:

  /mnt # ls
  @
  

  We only one subvolume right now. Therefore, let us go ahead and create another subvolume @home.

  /mnt # btrfs subvolume create @home
  Create subvolume './@home'
  

  If we perform ls now, we will see there are two subvolumes:

  /mnt # ls
  @ @home
  

  Let us mount /dev/mapper/sda2_crypt to /target

  /mnt # mount -o noatime,space_cache=v2,compress=zstd,ssd,discard=async,subvol=@ /dev/mapper/sda2_crypt /target/
  

  Now we need to create a directory for /home.

  /mnt # mkdir /target/home/
  

  Now we mount the /home directory with subvol=@home option.

  /mnt # mount -o noatime,space_cache=v2,compress=zstd,ssd,discard=async,subvol=@home /dev/mapper/sda2_crypt /target/home/
  

  Now mount /dev/sda1 to /target/boot.

  /mnt # mount /dev/sda1 /target/boot/
  

  Now we need to add these options to the fstab file, which is located at /target/etc/fstab. Unfortunately, vim is not installed in this console. The only way to edit is Nano.

  nano /target/etc/fstab
  

  

  Edit your fstab file to look similar to the one in the screenshot above. I am pasting the fstab file contents below for easy reference.

  # /etc/fstab: static file system information.
  #
  # Use 'blkid' to print the universally unique identifier for a
  # device; this may be used with UUID= as a more robust way to name devices
  # that works even if disks are added and removed. See fstab(5).
  #
  # systemd generates mount units based on this file, see systemd.mount(5).
  # Please run 'systemctl daemon-reload' after making changes here.
  #
  # <file system> <mount point>   <type>  <options>       <dump>  <pass>
  /dev/mapper/sda2_crypt /        btrfs   noatime,compress=zstd,ssd,discard=async,space_cache=v2,subvol=@ 0       0
  /dev/mapper/sda2_crypt /home    btrfs   noatime,compress=zstd,ssd,discard=async,space_cache=v2,subvol=@home 0       0
  # /boot was on /dev/sda1 during installation
  UUID=12842b16-d3b3-44b4-878a-beb1e6362fbc /boot           ext4    defaults        0       2
  /dev/sr0        /media/cdrom0   udf,iso9660 user,noauto     0       0
  

  Please double check the fstab file before saving it. In Nano, you can press Ctrl+O followed by pressing Enter to save the file. Then press Ctrl+X to quit Nano. Now, preview the fstab file by running

  cat /target/etc/fstab
  

  and verify that the entries are correct, otherwise you will booted to an unusable and broken system after the installation is complete.

  Next, press Ctrl + Alt + F1 to go back to the installer.

  

  Proceed to “Install the base system.”

  

  

  I chose the default option here - linux-image-amd64.

  After this, the installer will ask you a few more questions. For desktop environment, I chose KDE Plasma. You can choose the desktop environment as per your liking. I will not cover the rest of the installation process and assume that you were able to install from here.

  Post installation

  Let’s jump to our freshly installed Debian system. Since I created a root user, I added the user ravi to the suoders file (/etc/sudoers) so that ravi can run commands with sudo. Follow this if you would like to do the same.

  Now we set up zram as swap. First, install zram-tools.

  sudo apt install zram-tools
  

  Now edit the file /etc/default/zramswap and make sure to have the following lines are uncommented:

  ALGO=lz4
  PERCENT=50
  

  Now, run

  sudo systemctl restart zramswap
  

  If you run lsblk now, you should see the below-mentioned entry in the output:

  zram0          253:0    0   7.8G  0 disk  [SWAP]
  

  This shows us that zram has been activated as swap.

  Now we install timeshift, which can be done by running

  sudo apt install timeshift
  

  After the installation is complete, run Timeshift and schedule snapshots as you please. We are done now. Hope the tutorial was helpful.

  See you in the next post and let me know if you have any suggestions and questions on this tutorial.

---

• Raju Vindane Fixing Auto-Rotate screen orientation on PostmarketOS devices running MATE DE

  

  I have been using my Samsung Galaxy Tab A (2015) with PostmarketOS on and off since last year. It serves as a really good e-book reader with KOReader installed on it.

  Have tried phosh and plasma-mobile on it, works nicely but slows the device down heavily (2 GB RAM and old processor) so I use MATE Desktop environment on it.

  Lately I have started using this tablet along with my laptop as a second screen for work. And it has been working super nicely for that. The only issue being that I have to manually rotate the screen to landscape every time I reboot the device. It resets the screen orientation to portrait after a reboot. So I went through the pmOS wiki and a neat nice hack documented there worked very well for me.

  First we will test if the auto-rotate sensor works and if we can read values from it. So we install some basic necessary packages

  $ sudo apk add xrandr xinput inotify-tools iio-sensor-proxy

  Enable the service for iio-sensor-proxy

  sudo rc-update add iio-sensor-proxy

  Reboot the device.

  Now in the device terminal start the sensor monitor-sensor

  user@samsung-gt58 ~> monitor-sensor
      Waiting for iio-sensor-proxy to appear
  +++ iio-sensor-proxy appeared
  === Has accelerometer (orientation: normal, tilt: vertical)
  === Has ambient light sensor (value: 5.000000, unit: lux)
  === No proximity sensor
  === No compass
      Light changed: 14.000000 (lux)
      Accelerometer orientation changed: left-up
      Tilt changed: tilted-down
      Light changed: 12.000000 (lux)
      Tilt changed: vertical
      Light changed: 13.000000 (lux)
      Light changed: 11.000000 (lux)
      Light changed: 13.000000 (lux)
      Accelerometer orientation changed: normal
      Light changed: 5.000000 (lux)
      Light changed: 6.000000 (lux)
      Light changed: 5.000000 (lux)
      Accelerometer orientation changed: right-up
      Light changed: 3.000000 (lux)
      Light changed: 4.000000 (lux)
      Light changed: 5.000000 (lux)
      Light changed: 12.000000 (lux)
      Tilt changed: tilted-down
      Light changed: 19.000000 (lux)
      Accelerometer orientation changed: bottom-up
      Tilt changed: vertical
      Light changed: 1.000000 (lux)
      Light changed: 2.000000 (lux)
      Light changed: 4.000000 (lux)
      Accelerometer orientation changed: right-up
      Tilt changed: tilted-down
      Light changed: 11.000000 (lux)
      Accelerometer orientation changed: normal
      Tilt changed: vertical
      Tilt changed: tilted-down
      Light changed: 18.000000 (lux)
      Light changed: 21.000000 (lux)
      Light changed: 22.000000 (lux)
      Light changed: 19.000000 (lux)
      Accelerometer orientation changed: left-up
      Light changed: 17.000000 (lux)
      Tilt changed: vertical
      Light changed: 14.000000 (lux)
      Tilt changed: tilted-down
      Light changed: 16.000000 (lux)
      Light changed: 18.000000 (lux)
      Light changed: 17.000000 (lux)
      Light changed: 18.000000 (lux)
      Light changed: 17.000000 (lux)
      Light changed: 18.000000 (lux)
      Light changed: 17.000000 (lux)
      Light changed: 18.000000 (lux)
      Light changed: 17.000000 (lux)
  

  As you can see we can read the rotation values from the sensor as I am rotating the tablet in different orientations.

  Now we just need to use a script which changes the screen orientation using xrandr according to the sensor value.

  #!/bin/sh
  
  killall monitor-sensor
  monitor-sensor > /dev/shm/sensor.log 2>&1 &
  
  while inotifywait -e modify /dev/shm/sensor.log; do
  
    ORIENTATION=$(tail /dev/shm/sensor.log | grep 'orientation' | tail -1 | grep -oE '[^ ]+$')
  
    case "$ORIENTATION" in
  
      normal)
        xrandr -o normal
        xinput set-prop "Goodix Capacitive TouchScreen" "Coordinate Transformation Matrix" 1 0 0 0 1 0 0 0 1
        ;;
      left-up)
        xrandr -o left
        xinput set-prop "Goodix Capacitive TouchScreen" "Coordinate Transformation Matrix" 0 -1 1 1 0 0 0 0 1
        ;;
      bottom-up)
        xrandr -o inverted
        xinput set-prop "Goodix Capacitive TouchScreen" "Coordinate Transformation Matrix" -1 0 1 0 -1 1 0 0 1
        ;;
      right-up)
        xrandr -o right
        xinput set-prop "Goodix Capacitive TouchScreen" "Coordinate Transformation Matrix" 0 1 0 -1 0 1 0 0 1
        ;;
  
    esac
  done

  You need to replace the name of your touch input device in the script, you can get the name by using xinput --list , make sure to type this on the device terminal.

  user@samsung-gt58 ~> xinput --list
  * Virtual core pointer                    	id=2	[master pointer  (3)]
  *   * Virtual core XTEST pointer              	id=4	[slave  pointer  (2)]
  *   * Zinitix Capacitive TouchScreen          	id=10	[slave  pointer  (2)]
  *   * Toad One Plus                           	id=12	[slave  pointer  (2)]
  * Virtual core keyboard                   	id=3	[master keyboard (2)]
      * Virtual core XTEST keyboard             	id=5	[slave  keyboard (3)]
      * GPIO Buttons                            	id=6	[slave  keyboard (3)]
      * pm8941_pwrkey                           	id=7	[slave  keyboard (3)]
      * pm8941_resin                            	id=8	[slave  keyboard (3)]
      * Zinitix Capacitive TouchScreen          	id=11	[slave  keyboard (3)]
      * samsung-a2015 Headset Jack              	id=9	[slave  keyboard (3)]
  

  In our script here we are using a Zinitix capacitive screen, it will be different for yours.

  Once your script is ready with the correct touchscreen name. Save and make the script executable. chmod +x auto-rotate-screen.sh

  Then test your script in your terminal ./auto-rotate.sh , stop the script using Ctrl + C

  Now we need add this script to auto-start. On MATE DE you can go to System > Control Center > Startup Applications, then click on Custom Add button, browse the script location, give it a name and then click on Add button.

  Now reboot the tablet/device, login and see the auto rotation working.

  0:00

  /0:09

  1×

  ---

  1. Auto-Rotation wiki article on PostmarketOS Wiki https://wiki.postmarketos.org/wiki/Auto-rotation

---

• Thejeshgn GN Weekly Notes 35/2025

  My physiotherapy has shifted to strength training, and it’s going good. I’m also monitoring my diet and making a few changes. I’ve restarted breakfast with just eggs and coffee. Otherwise, I still have two meals a day, with a smaller dinner. I am also trying to use Origin Nutrition once a day. I will have to see how it goes.

  

  • I am trying to walk to the park and other neighborhood places with Uma. Bengaluru’s footpaths are obstacle courses, making it impossible for both the elderly and the young to walk. And this is in an area with supposedly ‘decent’ footpaths. In most places, they don’t exist at all or are completely occupied by parked vehicles, garbage, or construction debris.
  • Uma’s cousins were here during the weekend. It was a busy but lots of fun weekend.
  • During the week, Appa developed a fever. We initially thought it was due to the weather. But it now appears to be viral. Everyone seems to get virals at the end of the monsoon. After a day, we visited the doctor and started him on medication. Hopefully it’s nothing major.
  • I was able to assist friends at The Hindu in speeding up the SIR data parsing process as part of DataMeet. Dask makes it very easy to utilize all the horsepower your laptop or computer has to offer. I have not written about Dask here. I have a couple of drafts, and I will publish them in the coming week.
  • It was a good idea to ask for recommendations for blogs. I got a few. I have subscribed to them and added some to BlogRing, including one sent by Mihir called Sīmātīta/ಸೀಮಾತೀತ, by Seema, who also writes weekly notes that I generally love reading. I think you can learn a lot about people by observing what they do on a regular day, which is essentially what Weekly Notes are, or at least that’s how I see it. Anyway, now I might have to go herping. I have started listing Uma’s favorite books here. I will also add a similar list for her favorite toys and other things, along with comments. If you are a parent, it may be helpful.
  • The story of Ekalavya always haunted me. The world’s most excellent archer, according to the Mahabharata, is a story of class, caste, and above all, the ability to learn. So, as a kid ( and even now), I couldn’t comprehend that after losing his right thumb, he would sit idle and do nothing. If he could be the world’s most excellent archer without any real guru, he could do the same with his left hand, I thought. This thought would often come to me. At some point, I even thought about writing a short story; maybe I will write it one day. In the meantime, I read TP Kailwasam’s take on Ekalavya, Purpose and Fulfillment this week. So updated my reading tracker after a long time.
  • It an excellent news, Banu Mushtaq will be inaugurating Nada Habba – Mysore Dasara this year. I am delighted with this news. There will be a lot of opposition from the hindutva wing, but I don’t think we need to worry about it; we are ಸರ್ವ ಜನಾಂಗದ ಶಾಂತಿಯ ತೋಟ.
  • Why do fascists target schools, libraries, museums, theaters, movies, books, writers, and art? Whether it’s India, the US, or Nazi Germany, it’s an important question to ask for us Indians. For me, who specifically chose to live in India, I think it’s a big question. Of course, I would like to keep myself away from politics as much as possible. One, it’s not productive; two, it’s a fight of the lowest form, especially when you consider any social media platform, from WhatsApp to Twitter. But I think if we keep our voices down during times like this, we will be put along with the supporters of fascism. However small, in whatever corner of the internet or physical world, I will have to raise my voice, even if it’s the weakest voice in that room. I don’t need to win every argument, but I do need to register my opposition every time it arises. How do you handle this?

  ---

  You can read this blog using RSS Feed. But if you are the person who loves getting emails, then you can join my readers by signing up.

  Subscribe

  The post Weekly Notes 35/2025 first appeared on Thejesh GN.

---

August 22, 2025

• Thejeshgn GN Weekly Notes 34/2025

  Today, I took time to attend Anveshana Showcase 2025 at Prayoga. The plan was initially to attend the presentations by students who were part of NMG/2025 grantees group. But then I also got to know my niece was also presenting at the same event as part of another group. Unrelated, but what a good surprise. I will write about the showcase itself in another blog post. For now, all I have to say is it was lots of fun and worth the very long drive, and spending the whole day on a weekday.

  

  • It was a long weekend, so Bangalore was quiet and generally fun. We went to lunch at Kopitiam Lah on Saturday.
  • Taxes are in the process of getting done. I also reviewed and reworked my mutual fund SIPs as part of my yearly ritual, along with my term insurance and health insurance coverage. I usually increase them a bit based on inflation and my ability to afford them. I do it along with taxes, so I don’t forget it. The plan itself has not changed much in years.
  • I wrote a Guide to Typing Kannada with Optitrans v2 for my reference. It’s the keyboard layout/transliteration that I have settled down for typing Kannada on a desktop. I will add more corner cases and examples as I go.
  • If you live/work in Bengaluru. Please help me by participating in and sharing this one-question survey. Bengaluru – Where Do You Work From?. We are currently at 350 survey submissions. We need at least 600 responses for decent results, and 1000 would be even better. I will start publishing the results and data once we cross 600.
  • Uma’s school schedule is now from 9 AM to 11 AM. And I don’t have to wait for her. I can go later to pick her up. Parenthood has been an enjoyable experience, making me unlearn and relearn things. Of course, it’s a lot of work, but how do you find good fun without putting in effort?
  • We have 101 bloggers in blogring now. The majority of them are from a Tech background. I am looking for non-tech bloggers now. If you have suggestions, please send them to me. That said, send bloggers who write with strong opinions, even if they are tech.
  • A few folks who are alive but termed dead by ECI and removed from the voter list as part of the Bihar Special Intensive Revision (SIR) of electoral rolls months before the election turned up in the Supreme Court. Jolly LLB (Hindi, 2013) style. EC’s Lawyer termed it as drama, but it’s life, and they are alive. Finally, SC compelled the EC to publish all 65 lakh deleted voters’ details, allowing people to verify and analyze them. I think the EC is losing trust slowly due to its actions, which is bad for democracy. Once the trust in institutions erodes, fascism settles down without any challenges.

  ---

  You can read this blog using RSS Feed. But if you are the person who loves getting emails, then you can join my readers by signing up.

  Subscribe

  The post Weekly Notes 34/2025 first appeared on Thejesh GN.

---

August 20, 2025

• Thejeshgn GN Copy to Learn, Try Till You Master

  I’m often surprised at how almost every action of Uma can be traced back to someone around her. She copies so easily, sometimes adding small twists of her own. But it’s not always a perfect copy. For example, she often mispronounces words or struggles with the action, but she never stops copying.

  And it rarely ends there. She keeps repeating whatever she tries to copy, whether it’s eating with a fork or saying “good night.” She knows when she’s getting it right and when she isn’t. I can often see the frustration on her face when she fails, but unless I know a hack or a way to teach, there isn’t much I can do. So I let her fail, again and again, until she figures it out. Most of the time, that works and she figures. She doesn’t seem bothered; she just keeps going. Meanwhile, I’m the one who gets tired watching her.

  The best part is when she finally learns it. She always makes it her own. There’s a touch of customization, a personal twist that makes it better or simply hers.

  We adults do the same, though less obviously. We copy from people around us, sometimes on purpose, often without realizing it. When we do it deliberately, we usually call it influence or learning.

  

  Some things I’ve picked up deliberately include how to introduce people. I learned it from a friend who does it so well, adding background, little details, and making them the center of conversation. Over time, I’ve copied that. I’ve also learned calmness from many people, especially the art of not reacting too quickly, even when I know I’m right. I’m sure there are more, but these are the ones I remember clearly.

  But adulthood changes how we copy. We become more selective ğŸ‘�, but we also lose the child’s ability to fail repeatedly without giving up. That persistence, trying over and over until you get better, is something I want to relearn.

  Coming back to Uma, all this puts Anju and me at the center. We have to be on our best behavior, because even small things, our body language, little physical actions, get copied. I’m always cautious, always trying to behave at my best. :)

  ---

  You can read this blog using RSS Feed. But if you are the person who loves getting emails, then you can join my readers by signing up.

  Subscribe

  The post Copy to Learn, Try Till You Master first appeared on Thejesh GN.

---

August 15, 2025

• Thejeshgn GN Weekly Notes 33/2025

  India celebrates Independence Day today. As much as we gained freedom from the British in 1947, we have yet to gain full freedom from other evils like religion, caste, class, and gender based biases. We are still a country with a large, uneducated, and hungry population. There is much to do before we can truly celebrate independence day. For me, August 15th is a reminder of this ongoing process.

  

  • Anju and I went out for lunch at De Fish Restaurant in Kammanahalli. Today is part of a long weekend, so the crowd was very manageable. I love their Fish Meal (Rs. 150), but this time I tried Seafood Meals (Rs. 380). It’s Yummy.
  • Two years of parenthood. Time flies. I am loving it.
  • Uma’s school period has been extended to 90 minutes now. We sit outside and wait in case we are required. This also gives me time to chat with other parents and get their views on the world and education. Most of them are younger and way smarter than I am. So good times.
  • I did a quick review of my DEXA scan report with my instructor/coach. We are planning to make changes to my workout plan from next month. I have already made some changes to my diet. I will do another scan in January. The goal is to improve, even if it’s a small amount.
  • The weekend was busy, as I worked and closed items that I couldn’t do during the week (WN 3/2025) because of travel.
  • I wrote a quick post about omnipresent stress and how I manage it.
  • InfyBlog friend Susam has a public RSS reader based on a blogroll on his blog. It displays the latest five blog posts from his favorite blogs, similar to my Weekly Notes Planet. I love these public feed reading experiments. After a long time, I see the blog world flourishing again. Added Rishikesh and Daniel Miessler to my Blogring.
  • Updated the Wiki Page to list all the pages on this blog that are not blog posts. It’s a long list, but a useful one. I am also cleaning up the pages that are not required or were just drafts. I’ve updated the bucketlist page to include emojis that mark goals as done 🟢, in progress 🟡, or I am no longer aspiring 🔴. I’m also adding new life goals.
  • I don’t know how to sew, but I’ve always wanted to learn. Most importantly, I enjoy seeing patterns and how they come together. There are many sources online, but I like freesewing.eu; both the content and software that runs this niche community are FOSS. I am also looking forward to Pebble Time 2. Currently, I am using Bangle.js 2, and it’s fine. I have also started using tally.so for surveys and forms. They are pretty and generally hacker-friendly with APIs and Webhooks, even in the free tier.

  

  

  ---

  You can read this blog using RSS Feed. But if you are the person who loves getting emails, then you can join my readers by signing up.

  Subscribe

  The post Weekly Notes 33/2025 first appeared on Thejesh GN.

---

August 12, 2025

• Thejeshgn GN Stress

  It’s a lie to say that there is no stress; stress is always present, whether at work, at home, or in any situation involving human interaction or expectations. 

  Forget external expectations; your self-expectations; the image you have of yourself (good or bad) that you want to maintain leads to stress. I am not a stranger to this. But for a long time, I didn’t recognize it.

  

  Over time, I’ve learned to recognize stress because my body reacts in different ways: tiredness, lethargy, skin issues, and pain in certain parts of the body. These symptoms appear together or individually during high-stress periods. I’ve come to realize that my problem isn’t physiological, but rather a reflection of the stress I’m experiencing, even if I don’t appear stressed outwardly.

  I’m trying to refine how I handle stress. It’s important when you are stressed and learn how to manage it, rather than denying its existence. My approach to handling stress has evolved as I’ve aged and worked in various settings. Some strategies have been consistent, such as planning ahead. When big changes aren’t possible, focus on smaller steps, like making one change a day. This way, I achieve something without overthinking it. It’s like saving monthly instead of in bulk; over time, it builds up. Similarly, at work, if you chip away at tasks daily, you’ll eventually see the final result.

  Managing expectations has been the most challenging aspect. It’s not easy to meet others’ expectations, but good communication can help. I’m working on this as a continuous process. Each new person I interact with requires a different communication approach. There are some standards, but they don’t always apply.  Meditation and self-reflection helps in managing self-expectations. “Not every day is a great day” or “I am allowed to fail” or “I’m not perfect every day” help.

  Other methods include incorporating workout and social time. I had stopped cycling, walking, and attending Cross-fit and yoga, but I’ve restarted some of these activities (specially walking) as they are essential stress busters. Meeting friends and engaging in entertainment also helps me relax. Even with a busy schedule, I make it a point to set aside half an hour to 45 minutes, or one day a month, to spend with friends, go to a movie, or eat out. Just talking to them normalizes your expectations, and close friends keep you grounded.

  Recognizing that stress is a part of life and learning to handle it has been the biggest lesson. In fact, my body forced me to learn it.

  ---

  You can read this blog using RSS Feed. But if you are the person who loves getting emails, then you can join my readers by signing up.

  Subscribe

  The post Stress first appeared on Thejesh GN.

---

August 08, 2025

• Thejeshgn GN Weekly Notes 32/2025

  I spent most of the week (Monday through Thursday) in Mumbai. It was a busy but fruitful week. I got lots of things done. I usually carry everything in a backpack if it’s for a couple of days. But this time I had more, so I checked it in the luggage. I forgot about my luggage and walked out in both Mumbai and Bengaluru. In Mumbai, I had to ask the taxi to take me back; thankfully, in Bangalore, I realized just before getting into the Bus. Both the help desk women were kind and understanding.

  

  • I think Mumbai traffic is as bad as Bangalore traffic, if not worse.
  • It rained both in Bengaluru and a bit in Mumbai too, this week. Is this the end of the Monsoon rains?
  • No physiotherapy this week, did some exercises. I think my Physiotherapy is mostly about workouts now. So I will tag accordingly.
  • I enjoy meeting people over coffee, especially if they are interested in having a conversation. I added a page about it, making it easy to share details when someone asks me about it.
  • I watched Su From So with friends at Mukunda Theater. It was houseful on a Sunday morning. It’s a fun, family entertainer. I saw so many kids enjoying by laughing out loud in the theater.
  • I have been exploring the use of LLMs and agents for querying and reporting. It turns out I can achieve what I had planned. I also found some good products during this exploration. I wrote an intro post about it.
  • If you live/work in Bengaluru. Please help me with this one question survey. Please share it as well. Of course I will release the data under open license once its done.
  • I did a DEXA scan for fun. It’s not bad at all. I need to do some weights.
  • Added a new blog Earthly Notes by Adithi Muralidhar, to my subscription. It’s mostly about nature, birds, etc.
  • Book banning is the highlight of fascism. It seems to be happening now in the two biggest democracies in the world.
  • I found this Tumblr post via Masatdon and found it very useful. I have quoted it from there.

  I really do think an important component of activism is to make sure your motivation is based on a desire to help/improve things for the people being harmed by a system, and not hatred for the ones doing the harm. both for mental health reasons, and because either way you’re training your neural pathways and it’s gonna turn out a lot better for literally everyone if the question on everyone’s mind after achieving a goal is “how/which people can we help next, what’s the next step for improving things” and not “who do we need to attack next.”

  I’m not saying don’t be angry, there are a lot of good reasons to be angry right now and it makes for an excellent kick in the pants, just don’t define yourself by it or it’s gonna poison you and potentially do collateral damage.

  

  ---

  You can read this blog using RSS Feed. But if you are the person who loves getting emails, then you can join my readers by signing up.

  Subscribe

  The post Weekly Notes 32/2025 first appeared on Thejesh GN.

---

August 06, 2025

• Thejeshgn GN From Prompt to Report

  I have been exploring LLMs to see if they can be used to do data analysis. LLMs are not good with data by default. But they are good at analyzing a small table and trying to make sense of it. LLMs are also decent at writing code. So my wish was, can I make LLMs to write decent SQLs and use those SQLs to run against the databases ( using MCP), and then use LLMs to analyze or graph the data.

  So the idea looked like this. I managed to wire parts of it together to make it work as a system.

  

  I also had a conversation with Anand about it, and he pointed me to his experiment called DataChat. It operates entirely within the browser, against SQLite databases and ChatGPT’s GPT-4o Mini model. The concept is similar.

  My initial idea was to build a small system using existing tools like OpenWebUI/Librechat for the front-end and using the MCP Server to execute the code. Given the schema of the database, Claude and ChatGPT were able to generate decent SQL queries. I tested them against my manually created SQLs v/s LLM SQLs against some standard publicly available databases. The Legion’s MCP Server also looked good to execute the SQL and get the data back into the context.

  

  While I was doing those experiments, I also continued exploring tools that fit into the data tool ecosystem that I was already using. At Peppo and home, I use Metabase to do dash-boarding and reporting. I was thinking about using Metabase APIs to integrate into the system I mentioned above.

  On one of those days, I went to Lossfunk to attend Vivek Aithal’s talk about comma.ai. After that talk, I explored his bio, and his latest work caught my attention. It’s called MinusX.  

  MinusX calls itself an AI Data Engineer + Analyst for Metabase. It’s an open-source Chrome extension that adds AI data agents to your Metabase. They do have a proprietary AI backend to drive that. However, from my exploration of the code and traffic, the data remains within your browser and Metabase, except for a subset of results when you request analysis and the necessary metadata for exploration. That seemed fair.

  I have been using it for a couple of weeks on all my test databases now. I am pleased about the results. I also like the fact that it’s tightly integrated with Metabase, and it’s seamless.

  

  

  You can customize by adding details to minusx.md ( like your custom memory), you can also edit the context (which defaults to metadata of tables) using their data catalogs. For example, you can define your dimensions, metrics, etc, that can be shared across the org. There is more, but I won’t list all the features. Go ahead and explore, you might find it helpful.

  ---

  You can read this blog using RSS Feed. But if you are the person who loves getting emails, then you can join my readers by signing up.

  Subscribe

  The post From Prompt to Report first appeared on Thejesh GN.

---

August 05, 2025

• Ravi Dwivedi Tricked by a website while applying for Vietnam visa

  In December 2024, Badri and I went to Vietnam. In this post, I’ll document our experiences with the visa process of Vietnam. Vietnam requires an e-visa to enter the country. The official online portal for the e-visa application is evisa.xuatnhapcanh.gov.vn/. However, I submitted my visa application on the website vietnamvisa.govt.vn. It was only after submitting my application and making the payment that I realized that it’s not the official e-visa website. The realization came from the tagline mentioned in the top left corner of the website - the best way to obtain a Vietnam visa.

  I was a bit upset that I got tricked by that website. I should have checked the top level domains of Vietnam’s government websites. Anyways, it is pretty easy to confuse govt.vn with gov.vn. I also paid double the amount of the official visa fee. However, I wasn’t asked to provide a flight reservation or hotel bookings - documents which are usually asked for most of the visas. But they did ask me for a photo. I was not even sure whether the website was legit or not.

  Badri learnt from my experience and applied through the official Vietnam government website. During the process, he had to provide a hotel booking as well as enter the hotel address into the submission form. Additionally, the official website asked to provide the exact points of entry to and exit from the country, which the non-official website did not ask for. On the other hand, he had to pay only 25 USD versus my 54 USD.

  It turned out that the website I registered on was also legit, as they informed me a week later that my visa has been approved, along with a copy of my visa. Further, I was not barred from entering and found to be holding a fake visa. It appears that the main “scam” is not about the visa being fake, but rather that you will be charged more than if you apply through the official website.

  I would still recommend you (the readers) to submit your visa application only through the official website and not on any of the other such websites.

  Our visa was valid for a month (my visa was valid from the 4th of December 2024 to the 4th of January 2025). We also had a nice time in Vietnam. Stay tuned for my Vietnam travel posts!

  Credits to Badri for proofreading and writing his part of the experience.

---

August 02, 2025

• Raju Vindane Use phone/tablets/other laptops as external monitor with your laptop

  This method is for wayland based systems. There are better ways to do this on GNOME or KDE desktops, but the method we are going to use is independent of DE/WM that you are using.

  I am doing this on sway window manager, but you can try this on any other Wayland based WM or DE. I have not tried this on Xorg based systems, there are several other guides for Xorg based systems online.

  When we connect a physical monitor to our laptops, it creates a second display output in our display settings that we can then re-arrange in layout, set resolution, set scale etc. Since we are not connecting via a physical interface like HDMI, DP, VGA etc. We need to create a virtual display within our system and set the display properties manually.

  Get a list of current display outputs. You can also just check it in display settings of your DE/WM with wdisplays

  rajudev@sanganak ~> swaymsg -t get_outputs
  Output LVDS-1 'Seiko Epson Corporation 0x3047 Unknown' (focused)
    Current mode: 1366x768 @ 60.002 Hz
    Power: on
    Position: 0,0
    Scale factor: 1.000000
    Scale filter: nearest
    Subpixel hinting: rgb
    Transform: normal
    Workspace: 2
    Max render time: off
    Adaptive sync: disabled
    Allow tearing: no
    Available modes:
      1366x768 @ 60.002 Hz
  

  

  Currently we are seeing only one display output. Our goal is to create a second virtual display that we will then share on the tablet/phone.

  To do this there are various tools available. We are using sway-vdctl . It is currently not available within Debian packages, so we need to install it manually.

  $ git clone https://github.com/odincat/sway-vdctl.git
  $ cd sway-vdctl
  $ cargo build --release

  This will generate the binary with the name main under target/release . We can then copy this binary to our bin folder.

  $ sudo cp target/release/main /usr/local/bin/vdctl

  Now we have the vdctl command available.

  $ vdctl --help
  Usage: vdctl [OPTIONS] <ACTION> [VALUE]
  
  Arguments:
    <ACTION>
            Possible values:
            - create:      Create new output based on a preset
            - kill:        Terminate / unplug an active preset
            - list:        List out active presets
            - next-number: Manually set the next output number, in case something breaks
            - sync-number: Sync the next output number using 'swaymsg -t get_outputs'
  
    [VALUE]
            Preset name to apply, alternatively a value
            
            [default: ]
  
  Options:
        --novnc
            do not launch a vnc server, just create the output
  
    -h, --help
            Print help (see a summary with '-h')
  

  Before creating the virtual display, we need to set it's properties at .config/vdctl/config.json . I am using Xiaomi Pad 6 tablet as my external display. You can adjust the properties according to the device you want to use as a second display.

  $ (text-editor) .config/vdctl/config.json

  {
      "host": "0.0.0.0",
      "presets": [
          {
              "name": "pad6",
              "scale_factor": 2,
              "port": 9901,
              "resolution": {
                  "width": 2800,
                  "height": 1800
              }
        }
      ]
  }
  

  In the JSON, you can set the display resolution according to your external device and other configurations. If you want to configure multiple displays, you can add another entry into the presets in the json file. You can refer to example json file into the git repository.

  Now we need to actually create the virtual monitor.

  $ vdctl create pad6
  Created output, presumably 'HEADLESS-1'
  Set resolution of 'HEADLESS-1' to 2800x1800
  Set scale factor of 'HEADLESS-1' to 2
  Preset 'pad6' ('HEADLESS-1': 2800x1800) is now active on port 9901

  Now if you will check the display outputs in your display settings or from command line, you will see two different displays.

  $ swaymsg -t get_outputs
  Output LVDS-1 'Seiko Epson Corporation 0x3047 Unknown'
    Current mode: 1366x768 @ 60.002 Hz
    Power: on
    Position: 0,0
    Scale factor: 1.000000
    Scale filter: nearest
    Subpixel hinting: rgb
    Transform: normal
    Workspace: 2
    Max render time: off
    Adaptive sync: disabled
    Allow tearing: no
    Available modes:
      1366x768 @ 60.002 Hz
  
  Output HEADLESS-1 'Unknown Unknown Unknown' (focused)
    Current mode: 2800x1800 @ 0.000 Hz
    Power: on
    Position: 1366,0
    Scale factor: 2.000000
    Scale filter: nearest
    Subpixel hinting: unknown
    Transform: normal
    Workspace: 3
    Max render time: off
    Adaptive sync: disabled
    Allow tearing: no
  

  Also in the display settings.

  

  Now we need to make this virtual display available over VNC which we will access with a VNC client on the tablet. To accomplish this I am using wayvnc but you can use any VNC server package.

  Install wayvnc

  $ sudo apt install wayvnc

  Now we will serve our virtual display HEADLESS-1 with wayvnc.

  $ wayvnc -o HEADLESS-1 0.0.0.0 5900

  You can adjust the port number as per your need.

  The process from laptop side is done.

  Now install any VNC software on your tablet. I am using AVNC, which is available on F-Droid.

  In the VNC software interface, add a new connection with the IP address of your laptop and the port started by wayvnc. Remember, both your laptop and phone need to be on the same Wi-Fi network.

  

  Save and connect. Now you will be able to see a extended display on your tablet.

  Enjoy working with multiple screens in a portable setup.

  Till next time.. Have a great time.

---

August 01, 2025

• Thejeshgn GN Weekly Notes 31/2025

  This is the fourth week (WN28/2025) of school for Uma. She enjoys going. Since midweek, I’ve been asked to wait outside as she’s very comfortable with her directress, or guide. Even during playschool, she was always happy to attend. So in that sense, it’s always been easy. But compared to playschool, The Earth School follows a planned, more gradual induction—even if the kids seem comfortable. As per my observation, a lot of focus is on consistency, trust building, and communication, which does take time with toddlers.

  

  

  • I watched Ronth (2025, Malayalam), directed by Shahi Kabir, who also wrote Nayattu (2021, Malayalam), a film I liked. I liked Ronth too. Both are cop films, but not the typical action-hero kind—they focus on ordinary officers facing real-world challenges. Shahi Kabir seems to have a knack for writing or directing good cop movies (that I like).
  • Updated the Major Stampedes in India table with recent events. There seems to be no end to them once you start tracking them.
  • I read a whole book after a long time in one go; I know it’s a small book, over 70 pages long. However, it was challenging because finding time and maintaining focus were difficult. It’s an engaging and thought-provoking book by Kuvempu, called ‘ನಿರಂಕುಶಮತಿಗಳಾಗಿ‘. It’s a collection of four speeches by Kuvempu. It was published in 1954 and targeted students at the time. Kuvempu is asking them to be unrestrained, to act freely, to question everything (especially religious beliefs) without holding back. I read a short story by William Faulkner called Barn Burning. It’s a story of a father and son. I have bookmarked Snopes Trilogy for future reading. There is also a Kannada translation of Barn Burning – ಉರಿಸಿಂಗ on ಕೊನರು.
  • If you have some time, here is a piece on BuzzWomen on Stanford Social Innovation Review by a friend. BuzzWomen.org, is a nonprofit in India that trains women in financial literacy. This article discusses how they asked their economically vulnerable women, whom they had previously trained, to donate ₹1/day to support their peers’ financial training. Despite doubts, their Shakti Fund raised ₹18 lakhs in 2024, helping women lead and sustain local change. It proves again that you don’t have to have a lot to donate or bring change.
  • CopyParty looks very interesting, primarily to serve the media on the go. I have been experimenting with it by sharing things on the LAN. It appears to have numerous features that I could utilize in interesting ways (Unlimited Book)—for example, a local but public open media server at an event, during a workshop, or in a park.  
  • When we were kids, ಮಂಜುನಾಥನ ಆಣೆ (Man̄junāthana āṇe) meant more than a mother’s promise. Even adults—like my parents—wouldn’t dare tell an innocent lie after swearing in the name of Manjunatha of Dharmasthala. It’s painful to hear about the rape and deaths of young women in and around Dharmasthala. And now, the mass burial accusations are heartbreaking. I hope true believers of Manjunatha would force the truth to come out, and at least some of the victims would get justice, instead of supporting gag orders.
  • My introduction to Nazi violence was through The Diary of Anne Frank. I think I was in high school then, around the same age as her. It left a lasting impression on me. Now, almost every other day, I think of Anne Franks in Gaza.
  • There has been a discussion about digital sovereignty following Microsoft’s shutdown of digital services to an Indian company due to US sanctions. Most people think moving to an Indian or European company is a good idea. Let me tell you there is no good solution in this global world. Just like the US, Europe might start disliking your country anytime. Historically, Europe has been the worst player (think about WW1, WW2, Nazis, etc.) politically. So for a non-European country, it’s not a safe bet. Let’s say you move to India, then instead of global colonizers, you are now at the mercy of local landlords, in a way much worse. They can shut you down or censor you for any number of reasons. The legal system in India is not fast enough to get your business online in time. India is also the leader in Internet shutdowns, which raises questions about reliability. So it has to be a multi-country hosted, multi-provider, distributed, P2P system ¹. Will that work? I don’t know.
  • My shoulder and neck are doing well. I’ve had over 20 pain-free days, which is good. But I’m continuing physiotherapy for the foreseeable future.

  

  ---

  You can read this blog using RSS Feed. But if you are the person who loves getting emails, then you can join my readers by signing up.

  Subscribe

  1. BitTorrent comes to mind ↩

  The post Weekly Notes 31/2025 first appeared on Thejesh GN.

---

July 29, 2025

• Ravi Dwivedi How to paste your password on your bank's website

  If your bank is like mine, its website doesn’t allow you to copy your password and paste it by performing a simple Ctrl+V. I tried the Don’t Fuck With Paste extension in Firefox, which could paste my bank account’s profile password but not the login password.

  Therefore, I asked on Mastodon a couple of days ago and got some responses. The solution that worked for me was to use Shift+Insert to paste the password. It worked for me in LibreWolf and Firefox, and that’s all I needed.

  Furthermore, this behavior by bank websites leads to users choosing insecure and memorable passwords. Using this trick will help you choose strong passwords for your bank account.

  I prefer to use random and strong passwords generated using the password manager pass. It is a freedom-respecting software, unlike popular proprietary password managers promoted by YouTubers. Feel free to check out their webpage here. The reason I use pass is that it stores all the passwords locally (and optionally in a remote Git repository) in encrypted form, which can only be decrypted using your private GPG keys.

---

July 23, 2025

• Abhijith PA Removing spams from your local maildir

  I have been using Disroot as my primary email ever since openmailbox.org stopped. I am very grateful for Disroot’s service and I occasionally donate to them.

  Recently, my Disroot inbox has been flooded with spam. On an average day, I used to receive around 90% spams on entire email count. However, the situation has improved since then. I contacted the Disroot team, and they informed me that they are aware of the situation and planning to migrate to Rspamd from Spamassassin.

  I don’t know whether they deployed Rspamd, even if so that only going to process incoming mails, I am looking for a way to identify spams and purge that are already entered my Imap folders.

  Later I found this script nh2/rspamd-move[1], which seems fit my need.

  I made couple of trivial changes in the script for my use case. I wasn’t sure of directly running this on my Mail/ dir, so I cloned my entire local mail directory to another directory and made available to podman container where I script and rspamd instance exist. I trained rspamd from the /Spam. Later, I manually moved couple of mails to /spam folder/. I requested friends to share their spam folder in the #debian-in channel, but that didn’t happen :P

  $podman run -it --mount
  type=bind,source=/home/abhijith/$MAILS/,target=/container-mail-clone
  id:latest
  $script.py
  

  (It took some time since I have around 10000+ emails)

  Wow, it was quite a successful attempt, I was able to catch most of it and move to spam/ and couple of false positive in a different folder. Now I want to do the same in the actual maildir yet very skeptical. While going through the cloned folder with mutt -f I remembered that the mails are already indexed by notmuch.

  So all I need to do is operate tagging and deletion with notmuch and it will be synced back to the original mail dir. Ta-da. I cleaned by Inbox.

  [1] - https://github.com/nh2/rspamd-move

---

July 19, 2025

• Karthik Creating Frappe Books aarch64 Flatpak

  This is continuation of my work on packaging Frappe Books for flathub

  As i was unable to figure out the errors building the nodejs flatpak apps from source, I have patched the upstream project’s electron build system to support aarch64 linux binaries (both deb & rpm). This enabled me to support the respective flatpak binary starting with the v0.32.0 release. From the packaging side, I have updated the flatpak manifest & update script to support the new architecture.

  I do not have an aarch64 hardware to test the build, Hence. I reached out to fellow fediverse users who could lend a hand by testing it. Fortunately, I quickly got a respose from a kind human who tested it & confirmed that the application is indeed working!

  In the meanwhile, Frappe Books has reached 3000+ downloads via flatub! This update will enable a few more users to try out the application.

  Flathub Link: https://flathub.org/apps/io.frappe.books

---

July 14, 2025

• KhubsuratInsaan Promoting OpenStreetMap as a Leisure Class Activity

  Most of our mapping parties, if not all, start with a brief introduction. The newbies are informed about the various benefits of using and contributing to OpenStreetMap, such as massive improvements to the individual’s privacy and an easy mechanism to correct data.

  However, I have been wondering if this approach is the optimal path. This doubt started nagging me after I picked up The Theory of the Leisure Class by Thorstein Veblen. If class distinctions are really so pervasive as theorized in the book, shouldn’t we try to incorporate these findings in our promotion of OSM in mapping parties and everywhere else?

  A clear description of the context would be in order. Though our existing method of extolling the benefits of OSM is good, I don’t think it is the best one for India. India has, unfortunately, one of the lowest proportion of people contributing to social activities. In conversation with my friends, I often find them considering the idea of “doing something for free” repugnant. Maybe its due to the oppressive nature of the Indian classes, where people’s aspirations are mostly reduced to the singular objective of rising above their current class. Whatever is the reason, we can at least conclude that the current system of promoting OSM is unsatisfactory in the context of India.

  We can, for instance, try to frame OSM as a hobby and actively compare the intensity of mapping activity with other mappers (say, by focusing on the heat map that is displayed on the OSM profile page). Setting aside the moral considerations this entails, I believe this approach is likely to bring some interesting results. People may or may not be excited by the idea of increasing their reputation by performing conspicuous leisure in the form of contributions. However, it must be tested on field before we derive any conclusions.

---

July 08, 2025

• Sahil Dhiman Five Years of Writing - Now What?

  Okay, here’s the deal, I pushed my first post on Reimagined Doodle - Alias Command, five years ago on July 8th, 2020. Don’t think I ever mentioned that post started out as a Github Gist which I later transferred here seeking a more long-term home on an independent platform.

  Writing about writings, motivations, and the blog itself has been a recurring theme here over the years. ^{1 2 3 4 5 6 7 8 9}

  I’m unsure how I sustained expressing myself and writing here for this long. Now and then, I go months without any thought of writing, and then all of a sudden I start in bursts with sequential posts one after another. There isn’t a pattern per se in topics other than whatever burning question I have at the moment.

  So here’s to a milestone and then some.

  ---

  1. https://blog.sahilister.in/2021/05/i-like-writing-now/ ↩︎

  2. https://blog.sahilister.in/2021/03/confronting-thoughts-with-writing/ ↩︎

  3. https://blog.sahilister.in/2020/12/whats-in-the-name-reimagined-doodle-sahilister/ ↩︎

  4. https://blog.sahilister.in/2020/10/why-i-write-blogs/ ↩︎

  5. https://blog.sahilister.in/2021/02/quick-wiki-style-guide/ ↩︎

  6. https://blog.sahilister.in/2021/05/suggest-me-blogpost-topics/ ↩︎

  7. https://blog.sahilister.in/2021/07/i-have-no-idea-youre-reading-this/ ↩︎

  8. https://blog.sahilister.in/2022/01/write-for-yourself/ ↩︎

  9. https://blog.sahilister.in/2024/06/how-i-write-blogs-june-2024-edition/ ↩︎

---

July 07, 2025

• Sahil Dhiman Let's Talk About AI

  Recently, Seth Godin wrote Productivity, AI and pushback:

  Typesetters did not like the laser printer. Wedding photographers still hate the iphone. And some musicians are outraged that AI is now making mediocre pop music.

  In the article, Seth connected how AI is increasing productivity and how anything that improves productivity always wins.

  Nowadays, large language models (LLMs) have become synonymous with AI, while AI is a broader field. AI has brought a shift in how things are done. Use cases might vary, but it’s helping in ways like quickly summarizing huge knowledge bases to answer questions or, in my case, helping understand the contextual meaning of complex word (or sentence) usage in language and literature in both English and Hindi, which was sometimes not easy to comprehend with simple web search results.

  Even if you or I don’t really like “AI in everything”, we can’t deny the fact that AI is here to stay. This doesn’t take away from the fact that AI needs to become ethical, regulated, and environmentally sustainable.

---

July 06, 2025

• KhubsuratInsaan Lonely: Part 2

  Previous post in the series: Lonely: Part 1

  Nope. It was mostly a failure. Though I did meet a strong chess player. Unfortunately, that person is mostly interested in antichess, while I like classical chess and chess 960.

---

July 04, 2025

• Sahil Dhiman Secondary Authoritative Name Server Options for Self-Hosted Domains

  In the past few months, I have moved authoritative name servers (NS) of two of my domains (sahilister.net and sahil.rocks) in house using PowerDNS. Subdomains of sahilister.net see roughly 320,000 hits/day across my IN and DE mirror nodes, so adding secondary name servers with good availability (in addition to my own) servers was one of my first priorities.

  I explored the following options for my secondary NS, which also didn’t cost me anything:

  1984 Hosting

  • 1984 Hosting Company FreeDNS.
  • Hosting provider from Iceland.
  • AXFR over IPv4 only.
  • Following secondaries are offered:
    • ns0.1984.is
    • ns1.1984.is
    • ns1.1984hosting.com
    • ns2.1984.is
    • ns2.1984hosting.com
  • Not all of NS support IPv6.
  • Personally, I use ns1.1984.is which is hosted by Netnod, one of 13 root name servers and .SE ccTLD operator.
  • Same infrastructure serves 1984.hosting as well.

  Hurriance Electric

  • Hurricane Electric Free DNS Hosting.
  • One has to delegate NS towards one or more of ns[1-5]he.net to verify ownership. It does lead to a minor lame server period between NS addition and first zone transfer.
  • Supports TSIG and DNSSEC pre-signed zones.
  • Following secondaries are offered:
    • ns1.he.net
    • ns2.he.net
    • ns3.he.net
    • ns4.he.net
    • ns5.he.net
  • The service went down when he.net domain was put on hold. NANOG thread and Hurricane Electric’s response there. Better not depend on just one external provider.
  • Same infrastructure serves he.net as well.

  Afraid.org

  • FreeDNS at Afraid.org.
  • Backup DNS option on left side menu on their website.
  • Following secondary offered:
    • ns2.afraid.org

  Puck

  • PUCK Free Secondary DNS service.
  • One person show, been long-standing though there seems to be manual approval of each account, which did take some time.
  • Following secondary offered:
    • puck.nether.net

  NS-Global

  • NS-Global DNS Service.
  • From FAQ, anycast with 16 POP, including 1 POP in Tokyo.
  • Kenneth Finnegan’s blog post carries how this came to be. Same person who also pulled off the Fremont Cabal Internet Exchange and MicroMirror CDN project.
  • Following secondary is offered:
    • ns-global.kjsl.com
  • ns-global.kjsl.com uses Afraid.org, Puck and their NS for their own zone.

  Asking friends

  Two of my friends and fellow mirror hosts have their own authoritative name server setup, Shrirang (ie albony) and Luke. Shirang gave me another POP in IN and through Luke (who does have an insane amount of in-house NS, see dig ns jing.rocks +short), I added a JP POP.

  If we know each other, I would be glad to host a secondary NS for you in (IN and/or DE locations).

  Some notes

  • Adding a third-party secondary is putting trust that the third party would serve your zone right.

  • Hurricane Electric and 1984 hosting provide multiple NS. One can use some or all of them. Ideally, you can get away with just using your own with full set from any of these two. Play around with adding and removing secondaries, which gives you the best results. . Using everyone is anyhow overkill, unless you have specific reasons for it.

  • Moving NS in-house isn’t that hard. Though, be prepared to get it wrong a few times (and some more). I have already faced partial outages because:

    • Recursive resolvers (RR) in the wild behave in a weird way and cache the wrong NS response for longer time than in TTL.
    • NS expiry took more than time. 2 out of 3 of my Netim’s NS (my domain registrar) had stopped serving my domain, while RRs in the wild hadn’t picked up my new in-house NS. I couldn’t really do anything about it, though.
    • Dot is pretty important at the end.
    • With HE.net, I forgot to delegate my domain on their panel and just added in my NS set, thinking I’ve already done so (which I did but for another domain), leading to a lame server situation.

  • In terms of serving traffic, there’s no distinction between primary and secondary NS. RR don’t really care who they’re asking the query to. So one can have hidden primary too.

  • I initially thought of adding periodic RIPE Atlas measurements from the global set but thought against it as I already host a termux mirror, which brings in thousands of queries from around the world leading to a diverse set of RRs querying my domain already.

  • In most cases, query resolution time would increase with out of zone NS servers (which most likely would be in external secondary). 1 query vs. 2 queries. Pay close attention to ADDITIONAL SECTION Shrirang’s case followed by mine:

  $ dig ns albony.in
  
  ; <<>> DiG 9.18.36 <<>> ns albony.in
  ;; global options: +cmd
  ;; Got answer:
  ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 60525
  ;; flags: qr rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 9
  
  ;; OPT PSEUDOSECTION:
  ; EDNS: version: 0, flags:; udp: 65494
  ;; QUESTION SECTION:
  ;albony.in.			IN	NS
  
  ;; ANSWER SECTION:
  albony.in.		1049	IN	NS	ns3.albony.in.
  albony.in.		1049	IN	NS	ns4.albony.in.
  albony.in.		1049	IN	NS	ns2.albony.in.
  albony.in.		1049	IN	NS	ns1.albony.in.
  
  ;; ADDITIONAL SECTION:
  ns3.albony.in.		1049	IN	AAAA	2a14:3f87:f002:7::a
  ns1.albony.in.		1049	IN	A	82.180.145.196
  ns2.albony.in.		1049	IN	AAAA	2403:44c0:1:4::2
  ns4.albony.in.		1049	IN	A	45.64.190.62
  ns2.albony.in.		1049	IN	A	103.77.111.150
  ns1.albony.in.		1049	IN	AAAA	2400:d321:2191:8363::1
  ns3.albony.in.		1049	IN	A	45.90.187.14
  ns4.albony.in.		1049	IN	AAAA	2402:c4c0:1:10::2
  
  ;; Query time: 29 msec
  ;; SERVER: 127.0.0.53#53(127.0.0.53) (UDP)
  ;; WHEN: Fri Jul 04 07:57:01 IST 2025
  ;; MSG SIZE  rcvd: 286
  

  vs mine

  $ dig ns sahil.rocks
  
  ; <<>> DiG 9.18.36 <<>> ns sahil.rocks
  ;; global options: +cmd
  ;; Got answer:
  ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 64497
  ;; flags: qr rd ra; QUERY: 1, ANSWER: 11, AUTHORITY: 0, ADDITIONAL: 1
  
  ;; OPT PSEUDOSECTION:
  ; EDNS: version: 0, flags:; udp: 65494
  ;; QUESTION SECTION:
  ;sahil.rocks.			IN	NS
  
  ;; ANSWER SECTION:
  sahil.rocks.		6385	IN	NS	ns5.he.net.
  sahil.rocks.		6385	IN	NS	puck.nether.net.
  sahil.rocks.		6385	IN	NS	colin.sahilister.net.
  sahil.rocks.		6385	IN	NS	marvin.sahilister.net.
  sahil.rocks.		6385	IN	NS	ns2.afraid.org.
  sahil.rocks.		6385	IN	NS	ns4.he.net.
  sahil.rocks.		6385	IN	NS	ns2.albony.in.
  sahil.rocks.		6385	IN	NS	ns3.jing.rocks.
  sahil.rocks.		6385	IN	NS	ns0.1984.is.
  sahil.rocks.		6385	IN	NS	ns1.1984.is.
  sahil.rocks.		6385	IN	NS	ns-global.kjsl.com.
  
  ;; Query time: 24 msec
  ;; SERVER: 127.0.0.53#53(127.0.0.53) (UDP)
  ;; WHEN: Fri Jul 04 07:57:20 IST 2025
  ;; MSG SIZE  rcvd: 313
  

  • Theoretically speaking, a small increase/decrease in resolution would occur based on the chosen TLD and the popularity of the TLD in query originators area (already cached vs. fresh recursion).
  • One can get away with having only 3 NS (or be like Google and have 4 anycast NS or like Amazon and have 8 or like Verisign and make it 13 :P).
  • Nowhere it’s written, your NS needs not to be called dns* or ns1, ns2 etc. Get creative with naming NS; be deceptive with the naming :D.
  • A good understanding of RR behavior can help engineer a good authoritative NS system.

  Further reading

  • RFC 2182: Selection and Operation of Secondary DNS Servers is a good read on what to consider while choosing secondaries.
  • RFC 1537: Common DNS Operational and Configuration Errors.
  • DNS Nameservers by Geoff Huston gives a good overview of how common RRs behave. Another link from the same article is Recursives in the Wild:Engineering Authoritative DNS Servers.
  • DNS Nameservers: Service Platforms and Resilience by Geoff Huston.
  • Looking at Centrality in the DNS by Geoff Huston.

---

June 30, 2025

• KhubsuratInsaan An Experiment in Delhi School of Economics

  I recently shifted my site from insaan.codeberg.page to khubsuratinsaan.codeberg.page. My site will continue to exist at the old URL till someone claims it. Please update your bookmark and RSS feed.

  The Centre for Development Economics at Delhi School of Economics is a research institute funded by the central government to conduct research in Economics. A few days ago, Mrs Rubina, my microeconomics professor, shared an invitation from CDE about a ‘social experiment.’ The language of the invitation was very vague, and I was unable to determine if the students would be subjects or moderators in the project. Though the idea of being a subject is less enticing than that of being a moderator, it was still preferable to doing nothing. Hence, I signed up for the project and appeared on the campus at the allotted time.

  The game started once 3 people arrived in the lab. In the game, we were paired with 2 people from the player pool and emulate 16 rounds of a special type of the “public goods problem.” In each round, every person was given ₹4. Out of these ₹4, a person could donate an amount x‎, double it, and distribute it among the other two players. As the instructions put it: the return on investment is zero. I quickly understood that the socially optimal decision would be for each person to donate all of their wealth, and the Nash equilibrium would be achieved by each person donating nothing.

  Since I was in my rebel mode, I decided to donate all of my money in almost all of the rounds. Result: I got ₹29 at the end of the experiment, while player 3 got more than ₹100. You might be wondering, how was I able to get those ₹29? The simple answer is that player 1 also decided to contribute some money, though they followed the strategy of donating nothing for most of the rounds. A more nuanced answer would also involve why they contributed that money. Unfortunately, I missed the chance to talk to them after the experiment and, hence, that question would remain unanswered.

  This was my first time experiencing a social experiment in a laboratory. Even though I was just a subject, I learned a lot of things from it. I spotted that the moderators were cutting corners on some fronts, though I admired the length of distance they were maintaining between themselves and the subjects. I noticed some difference in the way the researcher treated the winners and the losers. I saw that they were using a locally hosted website for the game and Google Forms to collect non-game data. (Ugh.) And, of course, I came to know through talking to other people that most people indeed donated almost nothing in the experiment.

  At the end of the experiment, I was asked “keeping in view this experiment, rate the trustworthiness of people.” I reminded myself of how player 1 gave me money though it resulted in so many losses for them. Finally I chose a score of 4 out of 5.

---

June 22, 2025

• Sahil Dhiman Case of (broken) maharashtra.gov.in Authoritative Name Servers

  Maharashtra is a state here in India, which has Mumbai, the financial capital of India, as its capital. maharashtra.gov.in is the official website of the State Government of Maharashtra. We’re going to talk about authoritative name servers serving it (and bunch of child zones under maharashtra.gov.in).

  Here’s a simple trace for the main domain:

  $ dig +trace maharashtra.gov.in
  
  ; <<>> DiG 9.18.33-1~deb12u2-Debian <<>> +trace maharashtra.gov.in
  ;; global options: +cmd
  .            33128    IN    NS    j.root-servers.net.
  .            33128    IN    NS    h.root-servers.net.
  .            33128    IN    NS    l.root-servers.net.
  .            33128    IN    NS    k.root-servers.net.
  .            33128    IN    NS    i.root-servers.net.
  .            33128    IN    NS    g.root-servers.net.
  .            33128    IN    NS    f.root-servers.net.
  .            33128    IN    NS    e.root-servers.net.
  .            33128    IN    NS    b.root-servers.net.
  .            33128    IN    NS    d.root-servers.net.
  .            33128    IN    NS    c.root-servers.net.
  .            33128    IN    NS    m.root-servers.net.
  .            33128    IN    NS    a.root-servers.net.
  .            33128    IN    RRSIG    NS 8 0 518400 20250704050000 20250621040000 53148 . pGxGZftwj+6VNTSQtstTKVN95Z7/b5Q8GSjRCXI68GoVYbVai9HNelxs OGIRKL4YmSrsiSsndXuEsBuvL9QvQ+qbybNLkekJUAiicKYNgr3KM3+X 69rsS9KxHgT2T8/oqG8KN8EJLJ8VkuM2PJ2HfSKijtF7ULtgBbERNQ4i u2I/wQ7elOyeF2M76iEOa7UGhgiBHSBqPulsbpnB//WbKL71yyFhWSk0 tiFEPuZM+iLrN2qBsElriF4kkw37uRHq8sSGcCjfBVdkpbb3/Sb3sIgN /zKU17f+hOvuBQTDr5qFIymqGAENA5UZ2RQjikk6+zK5EfBUXNpq1+oo 2y64DQ==
  ;; Received 525 bytes from 9.9.9.9#53(9.9.9.9) in 3 ms
  
  in.            172800    IN    NS    ns01.trs-dns.com.
  in.            172800    IN    NS    ns01.trs-dns.net.
  in.            172800    IN    NS    ns10.trs-dns.org.
  in.            172800    IN    NS    ns10.trs-dns.info.
  in.            86400    IN    DS    48140 8 2 5EE4748C2069B99C98BC39A56881A64AF17CC78711E6297D43AC5A4F 4B5BB6E5
  in.            86400    IN    RRSIG    DS 8 1 86400 20250704050000 20250621040000 53148 . jkCotYosapreoKKPvr9zPOEDECYVe9OtJLjkQbFfTin8uYbm/kdWzieW CkN5sabif5IHTFU4FEVOShfu4DFeUolhNav56TPKjGqEGjQ7qCghpqTj dNN4iY2s8BcJ2ujHwhm6HRfdbQRVoKYQ73UUZ+oWSute6lXWHE9+Snk2 1ZCAYPdZ2s1s7NZhrZW2YXVw/nHIcRl/rHqWIQ9sgUlsd6MwmahcAAG+ v15HG9Q48rCG1A2gJlJPbxWpVe0EUEu8LzDsp+ORqy1pHhzgJynrJHJz qMiYU0egv2j7xVPSoQHXjx3PG2rsOLNnqDBYCA+piEXOLsY3d+7c1SZl w9u66g==
  ;; Received 679 bytes from 199.7.83.42#53(l.root-servers.net) in 3 ms
  
  maharashtra.gov.in.    900    IN    NS    ns8.maharashtra.gov.in.
  maharashtra.gov.in.    900    IN    NS    ns9.maharashtra.gov.in.
  maharashtra.gov.in.    900    IN    NS    ns10.maharashtra.gov.in.
  maharashtra.gov.in.    900    IN    NS    ns18.maharashtra.gov.in.
  maharashtra.gov.in.    900    IN    NS    ns20.maharashtra.gov.in.
  npk19skvsdmju264d4ono0khqf7eafqv.gov.in. 300 IN    NSEC3 1 1 0 - P0KKR4BMBGLJDOKBGBI0KDM39DSM0EA4 NS SOA MX TXT RRSIG DNSKEY NSEC3PARAM
  npk19skvsdmju264d4ono0khqf7eafqv.gov.in. 300 IN    RRSIG NSEC3 8 3 300 20250626140337 20250528184339 48544 gov.in. Khcq3n1Jn34HvuBEZExusVqoduEMH6DzqkWHk9dFkM+q0RVBYBHBbW+u LsSnc2/Rqc3HAYutk3EZeS+kXVF07GA/A486dr17Hqf3lHszvG/MNT/s CJfcdrqO0Q8NZ9NQxvAwWo44bCPaECQV+fhznmIaVSgbw7de9xC6RxWG ZFcsPYwYt07yB5neKa99RlVvJXk4GHX3ISxiSfusCNOuEKGy5cMxZg04 4PbYsP0AQNiJWALAduq2aNs80FQdWweLhd2swYuZyfsbk1nSXJQcYbTX aONc0VkYFeEJzTscX8/wNbkJeoLP0r/W2ebahvFExl3NYpb7b2rMwGBY omC/QA==
  npk19skvsdmju264d4ono0khqf7eafqv.gov.in. 300 IN    RRSIG NSEC3 13 3 300 20250718144138 20250619135610 22437 gov.in. mbj7td3E6YE7kIhYoSlDTZR047TXY3Z60NY0aBwU7obyg5enBQU9j5nl GUxn9zUiwVUzei7v5GIPxXS7XDpk7g==
  6bflkoouitlvj011i2mau7ql5pk61sks.gov.in. 300 IN    NSEC3 1 1 0 - 78S0UO5LI1KV1SVMH1889FHUCNC40U6T TXT RRSIG
  6bflkoouitlvj011i2mau7ql5pk61sks.gov.in. 300 IN    RRSIG NSEC3 8 3 300 20250626133905 20250528184339 48544 gov.in. M2yPThQpX0sEf4klooQ06h+rLR3e3Q/BqDTSFogyTIuGwjgm6nwate19 jGmgCeWCYL3w/oxsg1z7SfCvDBCXOObH8ftEBOfLe8/AGHAEkWFSu3e0 s09Ccoz8FJiCfBJbbZK5Vf4HWXtBLfBq+ncGCEE24tCQLXaS5cT85BxZ Zne6Y6u8s/WPgo8jybsvlGnL4QhIPlW5UkHDs7cLLQSwlkZs3dwxyHTn EgjNWClhghGXP9nlvOlnDjUkmacEYeq5ItnCQjYPl4uwh9fBJ9CD/8LV K+Tn3+dgqDBek6+2HRzjGs59NzuHX8J9wVFxP7/nd+fUgaSgz+sST80O vrXlHA==
  6bflkoouitlvj011i2mau7ql5pk61sks.gov.in. 300 IN    RRSIG NSEC3 13 3 300 20250718141148 20250619135610 22437 gov.in. raWzWsQnPkXYtr2v1SRH/fk2dEAv/K85NH+06pNUwkxPxQk01nS8eYlq BPQ41b26kikg8mNOgr2ULlBpJHb1OQ==
  couldn't get address for 'ns18.maharashtra.gov.in': not found
  couldn't get address for 'ns20.maharashtra.gov.in': not found
  ;; Received 1171 bytes from 2620:171:813:1534:8::1#53(ns10.trs-dns.org) in 0 ms
  
  ;; communications error to 10.187.202.24#53: timed out
  ;; communications error to 10.187.202.24#53: timed out
  ;; communications error to 10.187.202.24#53: timed out
  ;; communications error to 10.187.202.28#53: timed out
  ;; communications error to 10.187.203.201#53: timed out
  ;; no servers could be reached
  

  Quick takeaways:

  • 5 authoritative NS are listed ie:

    • ns8.maharashtra.gov.in.
    • ns9.maharashtra.gov.in.
    • ns10.maharashtra.gov.in.
    • ns18.maharashtra.gov.in.
    • ns20.maharashtra.gov.in.

  • No address (no A/AAAA records) could be found for ns18.maharashtra.gov.in and ns20.maharashtra.gov.in. Internet Archive snapshots for bgp.tools at time of writing NS18 and NS20.

  • “communications error to 10.187.202.24#53: timed out”, “communications error to 10.187.202.28#53: timed out” and “communications error to 10.187.203.201#53: timed out” is likely due to RFC 1918 records for NS. Ofcourse, they will never respond on public internet.

  • Not in trace, but NS10 has private or empty A/AAAA record against it (detailed further down).

  • The query resolution failed with “no servers could be reached” ie we didn’t recieved any A/AAAA record for that query.

  It’s a hit or miss for this DNS query resolution.

  Looking at in zone data

  Let’s look at NS added in zone itself (with 9.9.9.9):

  $ dig ns maharashtra.gov.in
  
  ; <<>> DiG 9.18.33-1~deb12u2-Debian <<>> ns maharashtra.gov.in
  ;; global options: +cmd
  ;; Got answer:
  ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 172
  ;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 3
  
  ;; OPT PSEUDOSECTION:
  ; EDNS: version: 0, flags:; udp: 1232
  ;; QUESTION SECTION:
  ;maharashtra.gov.in.        IN    NS
  
  ;; ANSWER SECTION:
  maharashtra.gov.in.    300    IN    NS    ns8.maharashtra.gov.in.
  maharashtra.gov.in.    300    IN    NS    ns9.maharashtra.gov.in.
  
  ;; ADDITIONAL SECTION:
  ns9.maharashtra.gov.in.    300    IN    A    10.187.202.24
  ns8.maharashtra.gov.in.    300    IN    A    10.187.202.28
  
  ;; Query time: 180 msec
  ;; SERVER: 9.9.9.9#53(9.9.9.9) (UDP)
  ;; WHEN: Sat Jun 21 23:00:49 IST 2025
  ;; MSG SIZE  rcvd: 115
  

  Pay special attention to “ADDITIONAL SECTION”. Running dig ns9.maharashtra.gov.in and dig ns8.maharashtra.gov.in, return RFC 1918 ie these private addresses. This is coming from zone itself, so in zone A records of NS8 and NS9 point to 10.187.202.28 and 10.187.202.24 respectively.

  Cloudflare’s 1.1.1.1 has a slightly different version:

  $ dig ns maharashtra.gov.in @1.1.1.1
  
  ; <<>> DiG 9.18.33-1~deb12u2-Debian <<>> ns maharashtra.gov.in @1.1.1.1
  ;; global options: +cmd
  ;; Got answer:
  ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 36005
  ;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 1
  
  ;; OPT PSEUDOSECTION:
  ; EDNS: version: 0, flags:; udp: 1232
  ;; QUESTION SECTION:
  ;maharashtra.gov.in.        IN    NS
  
  ;; ANSWER SECTION:
  maharashtra.gov.in.    300    IN    NS    ns8.
  maharashtra.gov.in.    300    IN    NS    ns10.maharashtra.gov.in.
  maharashtra.gov.in.    300    IN    NS    ns9.
  
  ;; Query time: 7 msec
  ;; SERVER: 1.1.1.1#53(1.1.1.1) (UDP)
  ;; WHEN: Sun Jun 22 10:38:30 IST 2025
  ;; MSG SIZE  rcvd: 100
  

  Interesting response here for sure :D.

  The reason for difference between response from 1.1.1.1 and 9.9.9.9 is in the next section.

  Looking at parent zone

  gov.in is the parent zone here. Tucows is operator for gov.in as well as .in ccTLD zone:

  $ dig ns gov.in +short
  ns01.trs-dns.net.
  ns01.trs-dns.com.
  ns10.trs-dns.org.
  ns10.trs-dns.info.
  

  Let’s take a look at what parent zone (NS) hold:

  $ dig ns maharashtra.gov.in @ns01.trs-dns.net.
  
  ; <<>> DiG 9.18.36 <<>> ns maharashtra.gov.in @ns01.trs-dns.net.
  ;; global options: +cmd
  ;; Got answer:
  ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 56535
  ;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 5, ADDITIONAL: 6
  ;; WARNING: recursion requested but not available
  
  ;; OPT PSEUDOSECTION:
  ; EDNS: version: 0, flags:; udp: 1232
  ; COOKIE: f13027aa39632404010000006856fa2a9c97d6bbc973ba4f (good)
  ;; QUESTION SECTION:
  ;maharashtra.gov.in.        IN    NS
  
  ;; AUTHORITY SECTION:
  maharashtra.gov.in.    900    IN    NS    ns8.maharashtra.gov.in.
  maharashtra.gov.in.    900    IN    NS    ns18.maharashtra.gov.in.
  maharashtra.gov.in.    900    IN    NS    ns10.maharashtra.gov.in.
  maharashtra.gov.in.    900    IN    NS    ns9.maharashtra.gov.in.
  maharashtra.gov.in.    900    IN    NS    ns20.maharashtra.gov.in.
  
  ;; ADDITIONAL SECTION:
  ns20.maharashtra.gov.in. 900    IN    A    52.183.143.210
  ns18.maharashtra.gov.in. 900    IN    A    35.154.30.166
  ns10.maharashtra.gov.in. 900    IN    A    164.100.128.234
  ns9.maharashtra.gov.in.    900    IN    A    103.23.150.89
  ns8.maharashtra.gov.in.    900    IN    A    103.23.150.88
  
  ;; Query time: 28 msec
  ;; SERVER: 64.96.2.1#53(ns01.trs-dns.net.) (UDP)
  ;; WHEN: Sun Jun 22 00:00:02 IST 2025
  ;; MSG SIZE  rcvd: 248
  

  The ADDITIONAL SECTION gives a completely different picture (different from in zone NSes). Maybe this was how it was supposed to be, but none of the IPs listed for NS10, NS18 and NS20 are responding to any DNS query.

  Assuming NS8 as 103.23.150.88 and NS9 as 103.23.150.89, checking SOA on each gives following:

  $ dig soa maharashtra.gov.in @103.23.150.88 +short
  ns8.maharashtra.gov.in. postmaster.maharashtra.gov.in. 2013116777 1200 600 1296000 300
  
  $ dig soa maharashtra.gov.in @103.23.150.89 +short
  ns8.maharashtra.gov.in. postmaster.maharashtra.gov.in. 2013116757 1200 600 1296000 300
  

  NS8 (which is marked as primary in SOA) has serial 2013116777 and NS9 is on serial 2013116757, so looks like the sync (IXFR/AXFR) between primary and secondary is broken. That’s why NS8 and NS9 are serving different responses, evident from the following:

  $ dig ns8.maharashtra.gov.in @103.23.150.88 +short
  103.23.150.88
  
  $ dig ns8.maharashtra.gov.in @103.23.150.89 +short
  10.187.202.28
  
  $ dig ns9.maharashtra.gov.in @103.23.150.88 +short
  103.23.150.89
  
  $ dig ns9.maharashtra.gov.in @103.23.150.89 +short
  10.187.202.24
  
  $ dig ns maharashtra.gov.in @103.23.150.88 +short
  ns9.
  ns8.
  ns10.maharashtra.gov.in.
  
  $ dig ns maharashtra.gov.in @103.23.150.89 +short
  ns9.maharashtra.gov.in.
  ns8.maharashtra.gov.in.
  
  $ dig ns10.maharashtra.gov.in @103.23.150.88 +short
  10.187.203.201
  
  $ dig ns10.maharashtra.gov.in @103.23.150.89 +short
  
  # No/empty response ^
  

  This is the reason for difference in 1.1.1.1 and 9.9.9.9 responses in previous section.

  To summarize:

  • Primary and secondary NS aren’t in sync. Serials aren’t matching, while NS8 and NS9 are responding differently for same queries.
  • NSes have A records with private address, not reachable on the internet, so lame servers.
  • Incomplete NS address, not even FQDN in some cases.
  • Difference between NS delegated in parent zone and NS added in actual zone.
  • Name resolution works in very particular order (in my initial trace it failed).

  Initially, I thought of citing RFCs, but I don’t really think it’s even required. 1.1.1.1, 8.8.8.8 and 9.9.9.9 are handling (lame servers, this probelm) well, handing out the A record for the main website, so dig maharashtra.gov.in would mostly pass and that was the reason I started this post with +trace to recurse the complete zone to show the problem.

  For later reference:

  $ dig maharashtra.gov.in @8.8.8.8 +short
  103.8.188.109
  

  Email to SOA address

  I have sent the following email to address listed in SOA:

  ---

  Subject - maharashtra.gov.in authoritative DNS servers not reachable

  Hello,

  I wanted to highlight the confusing state of maharashtra.gov.in authoritative DNS servers.

  Parent zone list following as name servers for your DNS zone:

  • ns8.maharashtra.gov.in.
  • ns18.maharashtra.gov.in.
  • ns10.maharashtra.gov.in.
  • ns9.maharashtra.gov.in.
  • ns20.maharashtra.gov.in.

  Out of these, ns18 and ns20 don’t have public A/AAAA records and are thus not reachable. ns10 keeps on shuffling between NO A record and 10.187.203.201 (private, not reachable address). ns8 keeps on shuffling between 103.23.150.88 and 10.187.202.28 (private, not reachable address). ns9 keeps on shuffling between 103.23.150.89 and 10.187.202.24 (private, not reachable address).

  These are leading to long, broken, or no DNS resolution for the website(s). Can you take a look at the problem?

  Regards, Sahil

  ---

  I’ll update here if I get a response. Hopefully, they’ll listen and fix their problem.

---

June 21, 2025

• Ravi Dwivedi Getting Brunei visa

  In December 2024, my friend Badri and I were planning a trip to Southeast Asia. At this point, we were planning to visit Singapore, Malaysia and Vietnam. My Singapore visa had already been approved, and Malaysia was visa-free for us. For Vietnam, we had to apply for an e-visa online.

  We considered adding Brunei to our itinerary. I saw some videos of the Brunei visa process and got the impression that we needed to go to the Brunei embassy in Kuching, Malaysia in person.

  However, when I happened to search for Brunei on Organic Maps¹, I stumbled upon the Brunei Embassy in Delhi. It seemed to be somewhere in Hauz Khas. As I was going to Delhi to collect my Singapore visa the next day, I figured I’d also visit the Brunei Embassy to get information about the visa process.

  The next day I went to the location displayed by Organic Maps. It was next to the embassy of Madagascar, and a sign on the road divider confirmed that I was at the right place.

  That said, it actually looked like someone’s apartment. I entered and asked for directions to the Brunei embassy, but the people inside did not seem to understand my query. After some back and forth, I realized that the embassy wasn’t there.

  I now searched for the Brunei embassy on the Internet, and this time I got an address in Vasant Vihar. It seemed like the embassy had been moved from Hauz Khas to Vasant Vihar. Going by the timings mentioned on the web page, the embassy was closing in an hour.

  I took a Metro from Hauz Khas to Vasant Vihar. After deboarding at the Vasant Vihar metro station, I took an auto to reach the embassy. The address listed on the webpage got me into the correct block. However, the embassy was still nowhere to be seen. I asked around, but security guards in that area pointed me to the Burundi embassy instead.

  After some more looking around, I did end up finding the embassy. I spoke to the security guards at the gate and told them that I would like to know the visa process. They dialled a number and asked that person to tell me the visa process.

  I spoke to a lady on the phone. She listed the documents required for the visa process and mentioned that the timings for visa application were from 9 o’clock to 11 o’clock in the morning. She also informed me that the visa fees was ₹1000.

  I also asked about the process Badri, who lives far away in Tamil Nadu and cannot report at the embassy physically. She told me that I can submit a visa application on his behalf, along with an authorization letter.

  Having found the embassy in Delhi was a huge relief. The other plan - going to Kuching, Malaysia - was a bit uncertain, and we didn’t know how much time it would take. Getting our passport submitted at an embassy in a foreign country was also not ideal.

  A few days later, Badri sent me all the documents required for his visa. I went to the embassy and submitted both the applications. The lady who collected our visa submissions asked me for our flight reservations from Delhi to Brunei, whereas ours were (keeping with our itinerary) from Kuala Lampur. She said that she might contact me later if it was required.

  For reference, here is the list of documents we submitted -

  • Visa application form
  • Passport
  • A photocopy of passport
  • Authorization letter from Badri (authorizing me to submit his application on his behalf)
  • Airline ticket itinerary
  • Hotel bookings
  • Cover letter
  • 2 photos
  • Proof of employment
  • 6 months bank statement (they specifically asked for ₹1,00,000 or more in bank balance)

  I then asked about the procedure to collect the passports and visa results. Usually, embassies will tell you that they will contact you when they have decided on your applications. However, here I was informed that if they don’t contact me within 5 days, I can come and collect our passports and visa result between 13:30-14:30 hours on the fifth day. That was strange :)

  I did visit the embassy to collect our visa results on the fifth day. However, the lady scolded me for not bringing the receipt she gave me. I was afraid that I might have to go all the way back home and bring the receipt to get our passports. The travel date was close, and it would take some time for Badri to receive his passport via courier as well.

  Fortunately, she gave me our passports (with the visa attached) and asked me to share a scanned copy of the receipt via email after I get home.

  We were elated that our visas were approved. Now we could focus on booking our flights.

  If you are going to Brunei, remember to fill their arrival card from the website within 48 hours of your arrival!

  Thanks to Badri and Contrapunctus for reviewing the draft before publishing the article.

  ---

  1. Nowadays, I prefer using Comaps instead of Organic Maps and recommend you do the same. Organic Maps had some issues with its governance and the community issues weren’t being addressed. ↩︎

---

June 15, 2025

• Sahil Dhiman A Look at .UA ccTLD Authoritative Name Servers

  I find the case of the .UA country code top level domain (ccTLD) interesting simply because of the different name server secondaries they have now. Post Russian invasion, the cyber warfare peaked, and critical infrastructure like getting one side ccTLD down would be big news in anycase.

  Most (g/cc)TLDs are served by two (and less likely) by three or more providers. Even in those cases, not all authoritative name servers are anycasted.

  Take, example of .NL ccTLD name servers:

  $ dig ns nl +short
  ns1.dns.nl.
  ns3.dns.nl.
  ns4.dns.nl.
  

  ns1.dns.nl is SIDN which also manages their registry. ns3.dns.nl is ReCodeZero/ipcom, another anycast secondary. ns4.dns.nl is CIRA, anycast secondary. That’s 3 diverse, anycast networks to serve the .NL ccTLD. .DE has a bit more at name servers at 6 but only 3 seems anycasted.

  Now let’s take a look at .UA. Hostmaster LLC is the registry operator of the .UA ccTLD since 2001.

  $ dig soa ua +short
  in1.ns.ua. domain-master.cctld.ua. 2025061434 1818 909 3024000 2020
  

  Shows in1.ns.ua as primary nameserver (which can be intentionally deceptive too).

  I used bgp.tools for checking anycast and dns.coffee for timeline of when secondary nameserver was added. dns.coffee only has data going back till 2011 though.

  Let’s deep dive at who’s hosting each of the name servers:

  in1.ns.ua by Intuix LLC

  • 74.123.224.40
  • 2604:ee00:0:101:0:0:0:40
  • unicast
  • Serving .UA since 13/12/2018.
  • Company by Dmitry Kohmanyuk and Igor Sviridov who’re administrative and technical contacts for .UA zone as well as the IANA DB.

  ho1.ns.ua by Hostmaster LLC

  • 195.47.253.1
  • 2001:67c:258:0:0:0:0:1
  • bgp.tools doesn’t mark the prefix as anycast but basis test from various location, this is indeed anycasted (visible in atleast DE, US, UA etc.). Total POPs unknown.
  • Serving .UA atleast since 2011.
  • The registry themselves.

  bg.ns.ua by ClouDNS

  • 185.136.96.185 and 185.136.97.185
  • 2a06:fb00:1:0:0:0:4:185 and 2a06:fb00:1:0:0:0:2:185
  • anycast
  • Serving .UA since 01/03/2022.
  • atleast 62 PoPs

  cz.ns.ua by NIC.cz

  • 185.43.134.15
  • 2001:148f:fffd:0:0:0:0:15
  • anycast
  • atleast 11 PoPs.
  • Serving .UA since 29/03/2024. NIC.cz adding secondary server blog.
  • .CZ operator.

  nn.ns.ua by Netnod

  • 194.58.197.4
  • 2a01:3f1:c001:0:0:0:0:53
  • anycast
  • atleast 80 PoPs.
  • Serving .UA since 01/12/2022.
  • Netnod has the distinction of being one of the 13 root server operator (i.root-servers.net) and .SE operator.

  pch.ns.ua by PCH

  • 204.61.216.12
  • 2001:500:14:6012:ad:0:0:1
  • anycast
  • atleast 328 POPs.
  • Serving .UA atleast since 2011.
  • “With more than 36 years of production anycast DNS experience, two of the root name server operators and more than 172 top-level domain registries using our infrastructure, and more than 120 million resource records in service” from https://www.pch.net/services/anycast.

  rcz.ns.ua by RcodeZero

  • 193.46.128.10
  • 2a02:850:ffe0:0:0:0:0:10
  • anycast
  • Atleast 56 PoPs via 2 different cloud providers.
  • Serving .UA since 04/02/2022.
  • sister company of nic.at (.AT operator).

  Some points to note

  • That’s 1 unicast and 6 anycast name servers with hundreds of POPs from 7 different organizations.
  • Having X number of Point of Presence (POP) doesn’t always mean each location is serving the .UA nameserver prefix.
  • Number of POPs keeps going up or down based on operational requirements and optimizations.
  • Highest concentration of DNS queries for a ccTLD would essentially originate in the country (or larger region) itself. If one of the secondaries doesn’t have POP inside UA, the query might very well be served from outside the country, which can affect resolution and may even stop during outages and fiber cuts (which have become common there it seems). - Global POPs do help in faster resolutions for others/outside users though and ofcourse availability.
  • Having this much diversity does lessen the chance of the ccTLD going down. Theoretically, the adversary has to bring down 7 different “networks/setups” before resolution starts failing (post TTLs expiry).

  Read more links

  • Delegation record for .UA at IANA.
  • Panel discussion: “Running a top level domain in times of war” at CyberChess 2023 with .UA operators post the invasion.
  • History of .UA domain on Hostmaster LLCs website.
  • .UA ccTLD overview talk presentation at ENOG 2011.
  • RIPE NCC’s DNS Monitoring Service (DNSMON) page for .UA.

---

May 27, 2025

• Ravi Dwivedi Singapore Visa Process

  In November 2024, Badri and I applied for a Singapore visa to visit the country. To apply for a Singapore visa, you need to visit an authorized travel agent listed by the Singapore High Commission on their website. Unlike the Schengen visa (where only VFS can process applications), the Singapore visa has many authorized travel agents to choose from. I remember that the list mentioned as many as 25 authorized agents in Chennai. For my application, I randomly selected Ria International in Karol Bagh, New Delhi from the list.

  Further, you need to apply not more than a month before your travel dates. As our travel dates were in December, we applied in the month of November.

  For your reference, I submitted the following documents:

  • Passport
  • My photograph (35 mm x 45 mm)
  • Visa application form (Form 14A)
  • Cover letter to the Singapore High Commission, New Delhi
  • Proof of employment
  • Hotel booking
  • Flight ticket (reservations are sufficient)
  • Bank account statement for the last 6 months

  I didn’t have my photograph in the specified dimensions, so the travel agent took my photo on the spot. The visa application was ₹2,567. Furthermore, I submitted my application on a Saturday and received a call from the travel agent on Tuesday informing me that they had received my visa from the Singapore High Commission.

  The next day, I visit the travel agent’s office and picked up my passport and a black and white copy of my e-visa. Later, I downloaded a PDF of my visa from the website mentioned on it, and took a colored printout myself.

  Singapore granted me a multiple-entry visa for 2 months, even though I had applied for a 4-day single-entry visa. We were planning to add more countries to this trip; therefore, a multiple-entry visa would be helpful in case we wanted to use Singapore Airport, as it has good connectivity. However, it turned out that flights from Kuala Lumpur were much cheaper than those from Singapore, so we didn’t enter Singapore again after leaving.

  Badri also did the same process but entirely remotely—he posted the documents to the visa agency in Chennai, and got his e-visa in a few days followed by his original passport which was delivered by courier.

  He got his photo taken in the same dimensions mentioned above, and printed as matte finish as instructed. However, the visa agents asked why his photo was looking so faded. We don’t know if they thought the matte finish was faded or what. To rectify this, Badri emailed them a digital copy of the photo to them (both the cropped version and the original) and they handled the reprinting on their end (which he never got to see).

  Before entering Singapore, we had to fill an arrival card - an online form asking a few details about our trip - within 72 hours of our arrival in Singapore.

  That’s it for now. Meet you in the next post.

  Thanks to Badri for reviewing the draft.

---

May 23, 2025

• S. Badri Towards a Password-Mukt XMPP

  These days, a password is, more often than not, a single-use affair. One hurriedly settles upon a password while signing up to some new account or other. By the time one needs to sign in again, the password almost invariably eludes the memory, resurfacing only after the password reset process has been completed.

  This poses something of a problem in XMPP-land. In an attempt to keep data collection to a bare minimum, many servers ask only for a preferred username and password. With no further information, how can they verify it's really you in order to reset your password? And if you don't go through the motions of resetting your password, what hope does your memory have of retrieving the old one?

  ---

  To prevent their users from being locked out of their accounts, some XMPP providers allow you to set a recovery email address, to which password reset details may be forwarded when the occasion arises. Allowing for the privacy-minded, this recovery email is often made optional: a good thing, though unfortunate for those optimists who think they will remember their passwords without fail, until they realise they actually don't.

  A bigger drawback with this setup is that, as of now, such extra fields are not supported in the in-app registration process. Server operators usually make custom HTTP pages for registration, which can collect all the additional information. This works effectively, but it means the user has to leave the app and (manually) open a web browser to complete registration before coming back to the app and (again, manually) entering their newly acquired login details. Perhaps not a major inconvenience on the scale of things, but certainly so on the scale of "hyper-polished corporate-backed apps that make it so easy to sign up you could almost do it by accident"!

  As an aside, sending the user to an HTTP page to sign up is not necessarily a bad thing: it does let the server operator show off a bit more of their website and potentially highlight the fact that theirs is a service run by people, not merely some faceless corporation.

  That said, I think it would be nice if, having taken the trouble to download and install an app, users could get started without having to leave it again.

  ---

  To better blend in with the faceless corporations, Quicksy and Prav have reasoned thus: if people are going to reset their passwords almost every time they log in, why not use the password reset process as the default way to log in?

  This is possible because Quicksy and Prav control both the client and the server of their respective services. Their "signing in" process involves entering a phone number to receive a one-time code on it, which can then be entered to authenticate the session. Internally, this is the point at which a new, randomly generated password is set for your client to use in future communications.

  As you can see, it is, quite literally, nothing but a password reset process.

  A problem with this is that signing in on a second device will change the password, rendering the account inaccessible to your first device. A workaround is to directly view or set the password on your first device, and enter that password on all subsequent devices to sign in the "normal" way. Of course, that means you lose out on the "passwordless" part and are back in the whole password routine.

  Fortunately, the future seems to hold ways in which we can not only go passwordless, but also remain so.

  ---

  When a client connects to a server for the first time, it usually has to authenticate itself—whether by a password or through some other means. But what about after the first time? That's where XEP-0484 or Fast Authentication Streamlining Tokens (FAST) comes in.

  Once a connection is made, FAST lets the server give a special token to the client, which the client can then use for future authentications. Practically, it's almost like the current Quicksy and Prav routine of setting a new password each time—except that the "password" is client-specific and doesn't affect the ability of the other clients to continue logging in.

  FAST tokens have an expiry date, but one that can be automatically extended—so while your client that has been offline for two months may need re-authentication, the one that has been logging in every day for two months won't.

  ---

  FAST solves the problem of "having to set a password after authentication" but what about the authentication process itself? This is a problem in two parts, because there are two different situations in which you'd want to log in to your account: the first time, and every time that comes after.

  ---

  The first time you want to use XMPP, you don't have an account yet: you have to sign up or "register" one. The ubiquitous XEP-0077 In-Band Registration (IBR) defines a standardised way to do just that...but with a username and password, and, worse, with only a username and password. XMPP providers that want to collect more fields, such as an email address, or use something other than a password to authenticate, like a phone number, have to either host an external HTTP page or customise the client itself.

  Or, they could use something like the experimental XEP-0389 Extensible In-Band Registration (nicknamed IBR2 or extensible IBR). This XEP replaces the single "username and password" form of IBR with a series of "challenges" and "responses", where a "challenge" can be simply "what's your preferred username and password?" but could also be "check your SMSes and enter the code we sent you there" or "enter the numbers in reverse order to prove you're not a robot". Like the original IBR, the extensible version is backed by XEP-0004 Data Forms, making it truly extensible to anything you want it to be.

  For the HTTP-happy, there is "out of band" registration which automatically opening up a web browser and reads the response when done. This means server operators can potentially keep their existing web-based signup pages, but allow them to be seamlessly opened and closed by the app itself—possibly the best of both worlds.

  ---

  Once you have an XMPP account, the current standard way to sign in is to negotiate an SASL connection, which decides the security features of your "stream"—the XMPP connection—but usually also involves your client passing in your username and password at some point.

  Similar to extensible IBR, XEP-0388 Extensible SASL Profile builds upon the normal SASL negotiation process to let you add other options to the mix. The XEP gives an example of second-factor authentication through TOTP, but one can imagine using a challenge mechanism similar to extensible IBR to make a one-time code the only factor, rather than the second one.

  Taking things a step further, perhaps we could handle new users by merely adding a "challenge" of "what username would your prefer?" thereby eliminating the need for "registration" altogether? Is there really that much difference, after all, between logging in for the first time and loggin in every other time?

  ---

  The standards-minded reader would have noted, with some alarm, that by blithely using "authentication through SMSed code" we are replacing a truly independent and decentralised authentication mechanism—the password—with a rather more centralised one.

  Fortunately, SMS is only one example. The same authentication code could just as easily be delivered by some other means, such as through email via SMTP, within an existing webapp, on a different messaging network like IRC...

  ...or through XMPP itself, to an already connected client of the user's. This would allow a user to sign in with a new XMPP client by authorising it using an already existing one.

  ---

  While there is no XEP yet for "sign in to a new client by authorising with an existing one", there are a few bits and pieces that could be put together.

  The simplest option is, of course, to do what we do on other networks and simply send an ordinary XMPP message saying "your password is so-and-so".

  More interesting in XEP-0070 Verifying HTTP Requests via XMPP. THe original purpose of this XEP is to let an XMPP client authorise access to an HTTP client such as a web browser. When your web browser tries to load a page, the HTTP server forwards the request to your XMPP server, which passes it on to your client. On your end, you'll see a popup saying something like "Hey, should we allow browser with code so-and-so to access this page of yours?"

  While it may matter to you whether the request originated from an HTTP request or it was just your server making things up, your XMPP client doesn't care. All it knows is that the server has sent an XEP-0070 authorisation request, to which you can answer either yea or nay.

  That makes it a small matter for the server to "make up" an authorisation request when you try to sign in from another client. Any client with XEP-0070 support can handle it. It matters not if the original trigger at the other end is the SASL negotiation process for your newly installed chat client, rather than an HTTP request from your not-necessarily-newly-installed web browser.

  Ironically, this setup would be quite helpful for web-based XMPP clients, where people may not be comfortable entering their XMPP passwords. Now, they can just authenticate the webclient via some other client instead! Needless to say, if this becomes a regular feature, it would be a good idea to define it as such in a separate XEP. This would allow for more levels of protection, and perhaps encryption key verification as well.

  ---

  Wait, the security-minded reader may ask: what prevents a malicious server from serving a truly "made-up" authorislation request, allowing a random device to be logged in?

  The answer is: nothing!—but the same goes for a server operator overwriting or reading your password as well. All the authorisation discussed here is between you and your server, or, more specifically, for you to prove your identity to your server. If the server decides to ignore that and let other people in too, there's nothing you can do to stop it at this level. That's why we have an added layer of end-to-end encryption, OMEMO keys, and all that jazz.

  Incidentally, XEP-0070 (or whatever we develop to replace its interesting half) provides a good opportunity to conduct key signing or identity verification as well. The keys could be generated on your device before it attempts to log in, setting the stage for a more secured handshake above the server-mediated one.

  Going a step further, this setup paired with XEP-0450 Automatic Trust Management (ATM) could pave the way for more decentralised logins, where one could log in with different JIDs and different XMPP servers and still be recognised by one's friends (and their XMPP clients) as the same person. But that's venturing into the territory of a whole different topic...

  ---

  The XEP-0070 hack demonstrates that there is, in fact, a difference between logging in for the first time and logging in every other time. We can use it to log into an XMPP client if we already have other logged-in XMPP client, but surely we cannot claim to have "XMPP clients all the way down"!

  So, how would the first XMPP client get authorised? One option is to return a FAST token during in-band registration, so the client can use that as its first connection.

  Better still, if we are able to complete registration during SASL negotiation as I speculated about before, the client would automatically be authorised with a FAST token already! Perhaps we can have "XMPP clients all the way down" after all.

  ---

  We now have a registration system that is not only purely XMPP based, but also entirely passwordless. Before we celebrate though, let's pause to see if we have really covered all our bases.

  When online services require a phone number for registration, its purpose is twofold: to prove your specific identity as an individual, but also to prove, within a reasonable level of tolerance, your identity as a member of the human race. In other words, if you are able to receive SMSes through a standard phone number on the telecom network, chances are you're not a robot. This is necessary to prevent spurious signups from automated bots, who can then proceed to send spam messages across the inter XMPP network.

  Alas! Our new passwordless mechanism accounts for the first problem but not the second.

  Fortunately, this can be readily remedied by making full use of the "extensible" part of extensible IBR. There, we are free to add any other spam-prevention challenges such as additional questions, or if we update the spec accordingly, maybe even a CAPTCHA.

  Another way to address this, using mechanisms that already exist, is based on social trust. The idea is to close off public registration and allow signups only using XEP-0401 Ad-hoc Account Invitation Generation. This XEP allows for account invitation links, that any existing user can generate and pass on to a prospective human user. It's up to them to keep the link to humans, of course.

  Traditionally, invites open up the old password-based registration screen, but as before we can always skip the password part. Since the XEP allows suggesting a username along with the invitation, it would be possible for new users to be registered, authenticated, and signed in automatically—all by merely clicking on a link!

  While this is a nice way to let humans bring other humans into the community, it only scratches the surface of what social trust can do.

  ---

  It is a truth universally acknowledged, that a person in possession of a good authentication mechanism, will inadvertently lock themselves out with it. In our case, that would mean accidentally uninstalling the last logged-in client, or losing the device onto which it was installed.

  This though is no different from doing the same with a password-based account and then forgetting the password. The simple solution is to implement a similar flow based on a second factor like an email or a phone number, which provides a fresh authentication token at the end of it: essentially, a "reset password" flow without the bit at the end where you actually set your password.

  To make things more spicy, the Dark Crystal standard allows for account recovery through social trust. The idea is that your recovery information is broken up into pieces, which you can put back together when the time comes. The "social" part is that each piece is given to a different trusted contact for safekeeping.

  If you ever get locked out, your account information remains safe with friends—or "in the minds of neighbouring families", if you will.

  ---

  There is an assumption these days that every person has at least one personal computing device, which they carry with them wherever they go. More often than not, it is assumed that at least one of these devices is connected to the telecom network, which means it is capable of receiving messages via the SMS protocol.

  Such assumptions have led to people using SMS and its related phone numbers as a proxy for individual identity, which poses something of a problem in situations where a person does not have a phone number, or where multiple people share the same phone number. Examples include multiple family members sharing the same phone, or a child who has not yet been deemed old enough to receive their own phone. The situation cuts both ways: it is likely that children are reciving their first phone number earlier than before precisely because so many authentication mechanisms require one.

  A purely XMPP-based authentication mechanism solves the problem of phone number dependency—but what of the overarching assumption of a separate personal computing device for each person?

  Imagine quickly signing into your friend's laptop to check messages, or borrowing a shared account on the family desktop when nobody else is using it. Such interactions used to be common—and are still easily possible—with basic email. On the messaging side, however, end-to-end encryption has made things harder, and a mandatory "sign in using an already-authenticated device" would make it nigh on impossible.

  The only way to make this work easily is to use a trusted server, paired with an authentication key that can be carried anywhere and activated on any random device you come across. What fits the bill better than the humble password—which is always with you, right inside your head?

  All this goes to show that passwords, though less popular, are far from obsolete—and may never be. However, for those who have trouble with them, there are now feasible alternatives. Thanks to the decentralised nature of XMPP, we don't have to fight between one or the other, rather offering multiple options, the better for each to choose their own.

  ---

  Thanks to discussions with MSavoritias (fae,ve), Kris, edhelas, and others on the JoinJabber dev room for providing some of the ideas and inspiration behind this article.

---

May 13, 2025

• Ravi Dwivedi KDE India Conference 2025

  Last month, I attended the KDE India conference in Gandhinagar, Gujarat from the 4th to the 6th of April. I made my mind to attend when Sahil told me about his plans to attend and giving a talk.

  A day after my talk submission, the organizer Bhushan contacted me on Matrix and informed me that my talk had been accepted. I was also informed that KDE will cover my travel and accommodation expenses. So, I planned to attend the conference at this point. I am a longtime KDE user, so why not ;)

  I arrived in Ahmedabad, the twin city of Gandhinagar, a day before the conference. The first thing that struck me as soon as I came out of the Ahmedabad airport was the heat. I felt as if I was being cooked—exactly how Bhushan put it earlier in the group chat. I took a taxi to get to my hotel, which was close to the conference venue.

  Later that afternoon, I met Bhushan and Joseph. Joseph lived in Germany. Bhushan was taking him to get a SIM card, so I tagged along and got to roam around. Joseph was unsure about where to go after the conference, so I asked him what he wanted out of his trip and had conversations along that line.

  Later, Vishal convinced him to go to Lucknow. Since he was adamant about taking the train, I booked a Tatkal train ticket for him to Lucknow. He was curious about how Tatkal booking works and watched me in amusement while I was booking the ticket.

  The 4th of April marked the first day of the conference, with around 25 attendees. Bhushan started the day with an overview of KDE conferences in India, followed by Vishal, who discussed FOSS United’s activities. After the lunch, Joseph gave an overview of his campaign to help people switch from Windows to GNU/Linux due to environmental and security reasons. He continued his session in detail the next day.

  

  A key takeaway for me from Joseph’s session was the idea pointed out by Adwaith: marketing GNU/Linux as a cheap alternative may not attract as much attention as marketing it as a status symbol. He gave the example of how the Tata Nano didn’t do well in the Indian market due to being perceived as a poor person’s car.

  My talk was scheduled for the evening of the first day. I hadn’t prepared any slides because I wanted to make my session interactive. During my talk, I did an activity with the attendees to demonstrate the federated nature of XMPP messaging, of which Prav is a part. After the talk, I got a lot of questions, signalling engagement. The audience was cooperative (just like Prav ;)), contrary to my expectations (I thought they will be tired and sleepy).

  On the third day, I did a demo on editing OpenStreetMap (referred to as “OSM” in short) using the iD editor. It involved adding points to OSM based on the students’ suggestions. Since my computer didn’t have an HDMI port, I used Subin’s computer, and he logged into his OSM account for my session. Therefore, any mistakes I made will be under Subin’s name. :)

  On the third day, I attended Aaruni’s talk about backing up a GNU/Linux system. This was the talk that resonated with me the most. He suggested formatting the system with the btrfs file system during the installation, which helps in taking snapshots of the system and provides an easy way to roll back to a previous version if, for example, a file is accidentally deleted. I have tried many backup techniques, including this one, but I never tried backing up on the internal disk. I’ll certainly give this a try.

  A conference is not only about the talks, that’s why we had a Prav table as well ;) Just kidding. What I really mean is that a conference is more about interactions than talks. Since the conference was a three-day affair, attendees got plenty of time to bond and share ideas.

  

  

  After the conference, Bhushan took us to Adalaj Stepwell, an attraction near Gandhinagar. Upon entering the complex, we saw a park where there were many langurs. Going further, there were stairs that led down to a well. I guess this is why it is called a stepwell.

  

  Later that day, we had Gujarati Thali for dinner. It was an all-you-can-eat buffet and was reasonably priced at 300 rupees per plate. Aamras (Mango juice) was the highlight for me. This was the only time we had Gujarati food during this visit. After the dinner, Aaruni dropped Sahil and I off at the airport. The hospitality was superb - for instance, in addition to Aaruni dropping us, Bhushan also picked up some of the attendees from the airport.

  Finally, I would like to thank KDE for sponsoring my travel and accommodation costs.

  Let’s wrap up this post here and meet you in the next one.

  Thanks to contrapunctus and Joseph for proofreading.

---

May 09, 2025

• Abhijith PA Bug squashing party, Kochi

  Last weekend, 4 people (3 DDs and 1 soon to be, hopefully in coming months) sit together for a Bug squashing party in Kochi. We fixed lot of things including my broken autopkgtest setup.

  

  It all began from a discussion in #debian-in of not having any BSPs in the past in India. Then twisted in to hosting a BSP by me. I fixed the dates to 3rd & 4th May to get packages migrate naturally to testing with NMUs before the hard freeze on 15th May.

  Finding a venue was a huge challenge. Unlike other places, we have very limited options on hackerspaces. We also had some company spaces (if we asked), but we may have to follow their office timings and finding accommodation near by was also a challenge.

  Later we decided to go with a rental apartment where could hack all night and sleep. We booked a very bare minimal apartment for 3 nights and 3 days. I updated wiki page and sent announcement.

  Not even Wi-Fi was there in the apartment, so we setup everything by ourselves (DebConf style :p ). I short listed some newbie bugs, just in case if newcomers joined the party. But it was only we 4 people and Kathara who joined remotely.

  We started from May 2nd night, stacked our cabin with snacks, instant noodles and drinks. Arranged beds, tables and started hacking and having discussions. My autopkgtest-lxc setup was broken. I think its related to #1017753, which got fixed magically and now I started using autopkgtest-podman.

  

  I learned

  • reportbug tool can use its own SMTP server by default
  • autoremovals can be extended if we pinged to the bug report.

  On last day, we went to a nice restaurant and had food. There was a church festival nearby, so we were able to watch wonderful procession and fireworks at night.

  

  All in all we managed to touch 46 bugs of which 35 is now fixed/done and 11 is open, some of this get status done when it reaches testing. It was a fun and productive weekend. More importantly we had fun.

---

May 08, 2025

• aktsbot Announcing spb and lil

  Announcing spb and lil

  08 May 2025

  ---

  spb

  simple paste bin had been around for a couple of years. For a long time, spb ran with a mongodb database. Not anymore!

  I updated it to use sqlite3 for its database and modernized the codebase a little bit.

  Improve the source code over at github or see it in the wild over at spb.aktsbot.in.

  lil

  This is my take on a url shortener. The goal with lil was to

  1. Store no user data.
  2. Be usable from the terminal. i.e have a no BS api.
  3. Use zero client side JavaScript.
  4. Be easy to maintain

  Source is at github. See it live on one0.xyz.

  Happy Hacking & have a great day!

---

May 06, 2025

• Bhavani Shankar Why I don't use full disk encryption

  After diving into the rabbit hole of encrypting my entire disk, I decided it is not worth it. These are my reasons:

  • High app launch delay: Cloudflare benchmarked dm-crypt encrypted disks to be 2-7 times slower. It means apps start at snail's pace; imagine a web browser opening in 5s instead of 0.7s.

  • Impact on battery life and RAM: Encrypting, decrypting bytes, and juggling them across the boundaries of disk and RAM is expensive. If you are on a laptop, it eats up battery life.

  • Shortens SSD lifespan: FDE, for security reasons, doesn't enable TRIM by default. It fills the entire disk with random data causing increased wear and tear of your solid state drive.

  • Extremely inefficient: It impartially encrypts everything — even those parts that don't require it like system files — making it harder to fix a broken system.

  Popular methods of full disk encryption

  • TPM, secure boot: Completely transparent to the user because the key is stored on TPM. This variant is good for tamper prevention. Thieves can boot your device and access your data.

  • Passphase based: /boot is not encrypted and is responsible for prompting the password during boot. It leads to bad user experience. If somebody puts a virus in /boot, the next time the user enters the password, it infects the whole system.

  More drawbacks

  • Sleep/Suspend vulnerability: A machine with a fully encrypted disk is secure only when it is off. Data on the RAM is not encrypted and can be extracted.

  • Doesn't stop strong adversaries: It's useless against law enforcement and the mafia because they can force you to unlock your device.

  • Multi-user systems: It doesn't protect your files from other users on your machine.

  A better alternative

  Application level encryption overcomes all these drawbacks.

  Selectively encrypt files and folders

  Encrypt just your private files — it's incredibly fast and secure. You may even use a different password for each file/folder. Multi-user device? No worries. I would suggest to:

  • Encrypt files and folders — including personal pictures, videos, and documents etc with gocryptfs. You can sync encrypted folders across devices with Dropbox and automatically mount on login.

  • Encrypt browser profile (folder) with gocryptfs. It prevents others from accessing your web browsing history, passwords, payment methods, and web subscriptions etc.

  • Set a strong passphrase for ssh and gpg keys to secure your private keys.

  • Use read-only filesystems for system files. Conveniently Nixos has a read-only filesystem and hashed folder names at /nix — where system files are stored — making it resilient to tampering.

  • Make use of deniable encryption with Veracrypt. Create hidden virtual disks inside encrypted file systems. Nobody can even know that they exist.

  • Encrypt files and folders with gocryptfs. You can sync encrypted folders across devices with Dropbox and automatically mount on login.

  • Use Tails OS: When you need as much privacy and anonymity as possible, boot into tails from a USB drive and then shut it down as soon as your work is done.

---