qlyoung's wiki

adaptive_cruise

Anonymous (anonymous@undisclosed.example.com) — 2024-01-06T05:27:46+00:00

adaptive cruise

My car has an adaptive cruise control system. Adaptive cruise is a variation on traditional fixed-speed cruise control that adds the ability to maintain a follow distance from a leading car. For example, the adaptive cruise system can be set to 80mph and will keep the car going 80mph as long as there's no vehicle in front of it. If it comes up behind a lead vehicle that is going slower, say 65mph, then it will slow to 65mph and maintain some reasonably safe following distance, say 25m. This is quite useful because it eliminates the need to adjust cruise control settings to accommodate slower traffic.

I've illustrated this scenario with a diagram. The actual speed of vehicles is denoted with (parentheses) and the adaptive cruise control setting with [brackets]. L is the lead car and C is our car. Let's say each “.” character is about 5 meters.

L (65)
.
.
.
.
.
C (65) [80]

Everything is fine here. Now let's get on the highway, introducing another lane (|) and two more vehicles. One of the vehicles X is adjacent to our lead car and the other F a is a driver following us.

L (65)      | X (65)
.           | .
.           | .
.           | .
.           | .
.           | .
C (65) [80] | .
.           | .
.           | .
F (65)      |

Our car C is maintaining a safe follow distance of about 25 meters from the lead car, courtesy of its ACC system. But the speed limit is 80mph and F wants to go 80mph. Looking at the diagram it's clear that there's no scenario here that is going to allow F to go 80mph unless L or X decides to change their speeds.

Virtually every time I find myself in this scenario (driving C), F decides to overtake and merge in between C and L, ending up offset by about 25 meters from their original position but still traveling at their original speed of 65mph.

L (65)      | X (65)
.           | .
.           | .
F (65)      | .
.           | .
.           | .
C (65) [80] | .

Now we no longer have the desired 25m follow distance from the car in front of us, so the ACC system briefly slows the vehicle to create the gap then resumes cruising at 65mph.

L (65)      | X (65)
.           | .
.           | .
.           | .
F (65)      | .
.           | .
.           | .
.           | .
.           | .
.           | .
C (65) [80] | .
.           | .
.           | .
G (65)      | .

Oh look, we have a new follower G…I wonder what will happen next…

And so it goes. I have had this happen countless times, I even get the finger or see the driver yelling at me as they pass by.

Hence the dilemma: Do you use the system that automatically maintains a safe follow distance resulting in getting verbally abused and which causes others around you to drive in an unsafe manner? Or do you keep an unsafe follow distance to prevent that behavior?

In the specific situation here, the best action is to get into the right hand lane and wait until the situation in the left hand lane improves. However, in practice this frequently occurs when L is going marginally faster than X (e.g. 65mph), so you will pass them eventually and it makes sense to stay in the left hand lane, in which case you are subject to the behavior.

The general phenomenon isn't limited to adaptive cruise. In general, the safer you drive the more upset other people will be at you.

I have yet to draw any worthwhile conclusions from this phenomenon.

from blog, technology, humanity

autoarchaeology

Anonymous (anonymous@undisclosed.example.com) — 2025-10-06T02:45:51+00:00

autoarchaeology

def. discovering information about oneself via “material culture”.

As I get older I remember less about myself. Where was I in a given year? Where was I living, who was I hanging out with? What were my interests? What am I not remembering?

Lately I've been doing a sort of archaeological dig on myself, investigating my own records, belongings, and digital traces in order to remember.

location

Where was I?

Materials:

Bills - these often have addresses and can tell you where you lived in a particular time period.
Receipts - if digital (online shopping), almost always have shipping addresses
Email is a good source, as in every case
Photographs - if you took them or are in them, they localize you to a place - metadata or memory can supply the date, and often have GPS coordinates. Geotagging photos is super useful. Even if you don't have geotagged photos, someone else might
Google Timeline, or anything that you use or used to use that logged your location
Flight receipts - email, credit card portals, airline websites, travel portals you use
Transaction history - credit card transaction logs always list merchant names can localize you to a place on a date

Think outside the box. Lots of things log your location. Online account login history can show you if you logged in on a particular device; that can localize you to a place.

friends

Who was I with?

Materials:

Instant message logs
Email
Photographs

All of these show you who you were talking to or who you were with.

av1

Anonymous (anonymous@undisclosed.example.com) — 2023-09-24T01:46:00+00:00

AV1 is a new video coding format. It achieves better compression than H264, similar compression to H265 and unlike H265, has an uncomplicated licensing scheme and is royalty free. There is a sister format for images called AVIF. You will be seeing more of these files on the web as time goes on.

If you got here because a video wouldn't play, it's probably because macOS and iOS do not support AV1. This is Apple's fault, not mine. There is no legitimate reason that Apple cannot or should not support AV1; they simply chose not to. If you are a macOS or iOS user (as I am), I encourage you to bring this to Apple's attention.

If you're on Windows and it doesn't play, try this.

You are probably wondering, why not use H264 since everyone can play it? That's because H264 is restrictively licensed and collects royalties, and AV1 does not. I apologize for the inconvenience, but it is a way of driving AV1 adoption, which ultimately serves the greater good. Thank you for your sacrifice.

bird_bar

Anonymous (anonymous@undisclosed.example.com) — 2026-03-26T21:39:23+00:00

bird bar

Bird bar is a bird feeder with a camera on it. A computer vision model watches the feed to identify the species of birds that visit the feeder. The video feed is also live-streamed to the internet, where live info about the birds is shown. Patron data is collected in a time series database for analysis.

Live stream: https://twitch.tv/thebirdbar

Stats: https://birdcam.qlyoung.net/

History

At the start of 2021 I received a window-mount bird feeder as a secret santa gift. As a bird lover I was excited to put it up and get a close up view of some of the birds that inhabited the woods around where I lived. Within around 3 days I had birds showing up regularly.

With the floor plan of my apartment at the time, the only sensible place to put the feeder was on the kitchen window; there was a screened porch on my bedroom window, or I would have put it there. Since my work desk was in my bedroom, this meant that I couldn't watch it while I worked. If that had been an option, the rest of the project may never have materialized.

Shortly after installing the feeder I had the idea to mount a camera pointing at it and stream it to Twitch, so that I could watch the birds while I was at my computer in another room. While watching I found myself wondering about a few of the species I saw and looking up pictures trying to identify them. Then it hit me - this is a textbook computer vision problem. I could build something that used realtime computer vision to identify birds as they appeared on camera.

Fast forward a few years and this has bloomed into a pretty large project, with multiple upgrades to both the hardware, software and feeder setup. It's definitely the most popular project I've made; my friends think it's cool. It's also served as a good test bed to keep up to date on advances in machine learning and accelerated computing.

Feeder

This section covers the evolution of the feeder construction & installation details.

v1

The first feeder was a generic acrylic bird feeder. The camera was an old webcam I had lying around. Since it's mounted outside it needed to be weatherproofed. I did that with plastic wrap. Subsequent attempts greatly improved the design.

Additional weatherproofing measures included a plastic tupperware lid taped over the camera as a sort of primitive precipitation shield.

Say what you will, but this setup survived a thunderstorm immediately followed by freezing temperatures and several hours of snow. All for $0.

I should also mention this installation is located on the second floor of my apartment building. Putting it up and performing maintenance involves leaning out of the window, so I was anxious to build a durable, maintenance free installation.

Hardware

As of 2026 birdbar runs on an Nvidia Jetson Orin Nano. With a TensorRT-optimized kernel and recent firmware upgrades to the board to unlock additional performance, classification takes about 50 ms/frame, achieving around 20 frames per second. Classification runs at 480×800 resolution.

In the past (2021 thru early 2026) the setup was an Intel NUC with a discrete PNY GTX 1070 connected via Thunderbolt 3 in an eGPU enclosure. It's wild that what used to take a dedicated computer and discrete graphics card has now shrunk to fit entirely on a SODIMM SoM package!

Webcam is a Logitech Streamcam.

Bird Identification

Birds arriving at the feeder are identified using YOLOv5 fine tuned on NABirds.

Background

I’d read about YOLO some years before and began to reacquaint myself. It’s come quite far and seems to be more or less the state of the art for realtime computer vision object detection and classification. I downloaded the latest version (YOLOv5 at time of writing) and ran the webcam demo. It ran well over 30fps with good accuracy on my RTX3080, correctly picking out myself as “person”, my phone as “cell phone”, and my light switch as “clock”.

Out of the box YOLOv5 is trained on COCO, which is a dataset of _co_mmon objects in _co_ntext. This dataset is able to identify a picture of a Carolina chickadee as “bird”. Tufted titmice are also identified as “bird”. All birds are “bird” to COCO (at least the ones I tried).

Pretty good, but not exactly what I was going for. YOLO needed to be trained to recognize specific bird species.

Dataset

A quick Google search for “north american birds dataset” yielded probably the most convenient dataset I could possibly have asked for. Behold, NABirds!

NABirds V1 is a collection of 48,000 annotated photographs of the 400 species of birds that are commonly observed in North America. More than 100 photographs are available for each species, including separate annotations for males, females and juveniles that comprise 700 visual categories. This dataset is to be used for fine-grained visual categorization experiments.

Thank you Cornell! Without this dataset, this project probably would not have been possible.

The dataset is well organized. There’s a directory tree containing the images, and a set of text files mapping the file IDs to various metadata. For example, one text file maps the file ID to the bounding box coordinates and dimensions, another maps ID to class, and so on.

Did I mention this dataset also contains bounding box information for individual parts of the birds? Yes, each of the over 48,000 bird pictures is subdivided into bill, crown, nape, left eye, right eye, belly, breast, back, tail, left wing, right wing components. It’s like the holy grail for bird × computer vision projects. For this project I did not need the parts boxes, but it’s awesome that Cornell has made such a comprehensive dataset available to the public.

While well organized, I’m pretty sure this is a non-standard dataset format. YOLOv5 requires data to be organized in its own dataset format, which is fortunately quite simple. To make matters easier, NABirds comes with a Python module that provides functions for loading data from the various text files. Converting NABirds into a YOLOv5 compatible format was fairly straightforward with some additional code. Cornell’s terms of use require that the dataset not be redistributed, so I cannot provide the converted dataset, but I can provide the code I used to process it.

Training

With the dataset correctly formatted, the next step was to train YOLOv5 on it. This can be somewhat difficult depending on one’s patience and access to hardware resources. Training machine learning models involves lots of operations that are highly amenable to acceleration by GPUs, and to train them in a reasonable timeframe, a GPU or tensor processor is required. I have an RTX3080 at my disposal, so it was easy to get started on my personal desktop.

YOLOv5 offers multiple network sizes, from n to x (n for nano, x for x). n, s and m sizes are recommended for mobile or workstation deployments, while l and x variants are geared towards cloud / datacenter deployments (i.e. expensive datacenter GPUs / tensor processors). The larger variants take longer to train and longer to evaluate. Since the model needed to be evaluated on each frame in a video feed, holding all else constant, for this project the choice of model size would ultimately dictate the achievable framerate.

Since the webcam demo with the s model ran at a good framerate on my GPU I chose that one to start.

Training certain kinds of machine learning models is memory intensive. In the case of YOLO, which uses a convolutional neural network (CNN), less GPU memory means fewer images can be processed in a single gradient descent step (the ‘batch size’), significantly increasing the time needed to train. It’s worth noting that training with a smaller batch size shouldn’t affect the final outcome too much, so patience can compensate for lack of GPU memory if necessary. In my case the largest batch size I could get on my GPU was 8.

Training YOLOv5s on my RTX3080 took about 23 hours to train 100 epochs with a batch size of 8. Each epoch represents one complete processing of the training dataset. General advice for YOLO is to use about 300 epochs. Since training typically involves a trial-and-error process of tweaking parameters and retraining, and I wanted to try using the m model, clearly the 3080 was not going to be sufficient to get this project done in the desired timeframe. This was a holiday project for me, I wanted it done before the end of the holidays.

I knew people use cloud compute services to train these things, so it was time to find some cloud resources with ML acceleration hardware. To that end I logged into Google Compute. Some hours later I logged into AWS. Some hours later I logged into Linode. At Linode, I had an RTX6000 enabled instance within about 10 minutes. To this day, I still cannot get GPU instances on GCP or AWS - and not for lack of trying. GCP seemingly had no GPUs available in any region I tried, and I tried several, each with advertised GPU availability. AWS required me to open a support case to get my quota for P class EC2 instances increased, which was denied after three days. I find it amusing that Linode is able to provide an infinitely better experience than Google and Amazon. Speculating, it seems plausible that perhaps AWS and GCP are being flooded by cryptocurrency workloads and Linode is not, or is more strict about banning miners. I have no insight into that. Overall, it seems cloud GPU compute is more difficult to get than I had imagined.

The RTX6000 allowed me to use a batch size of 32, which brought training within a reasonable timeframe of about 2 days for the m model at 300 epochs. Good thing, because at $1.50 an hour, those VMs aren’t cheap. A few days of training was about as much as I was willing to spend on this project, and the graphs indicated that the classification loss was on the order of 3% - more than sufficient for a fun project.

Note: Machine learning models are typically trained on some subset of the total available data, with the rest being used to evaluate the model’s performance on data it has not seen before. One of the metadata files provided with the dataset defines a suggested train/test split, classifying each image by its suggested usage. I tried training with the suggested split, and results were significantly worse than using a standard 80/10/10 (train/test/validate) split.

For the data oriented, here is the summary information for the training run of the model I ended up using:

These metrics are all good and show that the model trained very nicely on the dataset.

At this point after waiting for training to finish I was quite excited and ready to try it out. I ran it on a couple of clips from my bird stream and was amazed at the results.

Trying it on an image with three species of chickadee, that to my eye look almost identical:

I’m not sure if these were in the training set; I just searched for the first images of each species I found on Google Images.

The accuracy is impressive. YOLOv5 has certainly achieved its goal of making state of the art computer vision accessible to people outside that field.

If you’d like to use my models, they’re available here.

Video flow

Having demonstrated that it could identify birds with relative accuracy, it was time to get it working on a live video feed.

Even though YOLO is amazingly fast relative to other methods, it still needs a GPU in order perform inference fast enough to produce inference results for each frame of a video feed. I set a goal of 30fps; on my 3080, my final model averages roughly 0.020s per frame, sufficient to pull around 40-50fps. This is a good tradeoff between model size/accuracy and evaluation speed. The average with the s model looks to be roughly 0.015s, technically sufficient to pull 60fps, but without much headroom. There are spikes up to the 0.02 range, suggesting that 60fps would likely be jittery. The webcam I was using at the time didn’t really suffice for 60fps anyway.

So while I had a GPU that could perform inference fast enough, it was in the computer in my bedroom and I didn’t much feel like moving it into the kitchen. I considered several approaches to this problem, including:

A very long USB extender to the webcam

I actually tried this, and it did work. The problem was that it required me to have my bedroom window open a little bit to route the cable through it, which isn’t ideal for several reasons. Also, when using YOLO's video detection script on a webcam device it produces annotated frames of size 640×640. I wanted to stream the full resolution of the camera (1920×1080). I briefly investigated patching detect.py, but the holidays were drawing to a close and I wanted a functioning stream sooner rather than later, so for the time being I resolved to use a video feed since the script produced annotated at the native resolution when given a video.

eGPU enclosure attached to the webcam host

By this point in the project I’d replaced the laptop with a NUC I happened to have lying around. If this was a recent NUC with Thunderbolt 3 support, an eGPU enclosure would have been the cleanest and easiest solution. I wanted to avoid buying a new NUC and eGPU enclosure since together those cost quite a bit, and I didn't care to wait for delivery so I nixed this option.

Some kind of network streaming setup

Advantages: no cables through windows, no new hardware. I have a pretty good home network and am pretty handy with this stuff so I went with that. After several hours experimenting with RTMP servers, HTTP streaming tools, and the like, I ended up with this setup:

I tried a bunch of other things, including streaming RTMP to a local NGINX server, using VLC as an RTSP source on the webcam box, etc, but this was the setup that was the most stable, had the highest framerate, and lowest artifacts. Actually detect.py does support consuming RTSP feeds directly, but whatever implementation OpenCV uses under the hood introduces some significant artifacts into the output. Using VLC to consume the RTSP feed and rebroadcast it locally as an HTTP stream turned out better. The downside to this is that VLC seems to crash from time to time, but a quick batch script fixed that right up:

:start
 
taskkill /f /im "vlc.exe"
 
start "" "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" rtsp://192.168.0.240:554/live --sout #transcode{vcodec=h264,vb=800,acodec=mpga,ab=128,channels=2,samplerate=44100,scodec=none}:http{mux=ts,dst=:8081/localql} --no-sout-all --sout-keep
timeout /t 15
 
python detect.py --nosave --weights nabirds_v5m_b32_e300_stdsplit.pt --source http://127.0.0.1:8081/localql
 
goto start

Why yes, I do have Windows experience :’)

I ran it that way for a couple months or so, but eventually the above setup proved too unreliable. It required running lots of software on both the camera host as well as my desktop, and since it used my desktop GPU for inference it limited what I could use my computer for (read: no gaming). Also, the stream went down every time I rebooted my computer.

After deciding that I wanted to maintain this as a long term installation I ponied up for a NUC and an eGPU enclosure. I initially tried to use the enclosure with an RTX 3070, but I couldn’t get it working with that card so I used a spare 1070 instead which worked flawlessly. The 1070 runs at about 25fps when inferencing with my bird model which is more than enough to look snappy overlaid on a video feed. The whole thing sits on my kitchen floor and is relatively unobtrusive.

60fps

Up to this point I was streaming the window with annotated frames displayed by YOLO’s detect.py convenience script. However, this window updates only as often as an inferencing run completes, so around 25fps. It doesn't look good on a livestream. It would be better to stream video straight from the camera at native framerates (ideally 60fps) and overlay the labels on top of it.

Doing this turned out to be rather difficult because you cannot multiplex camera devices on Windows; only one program can have a handle on the camera and its video feed to the exclusion of all others. Fortunately there is some software which works around this. I purchased that software and used it to create two virtual camera feeds. OBS directly consumes one feed and the other one goes into YOLO for inferencing. The resulting labeled frames are displayed in a live preview window. I patched YOLO so that the preview window, which normally displays the source frame annotated with the inferencing results, only displayed the annotations on a black background without the source frame. That window is used as a layer in OBS with a luma filter applied to make the black parts transparent. With some additional tweaks to get the canvas sizing and aspect ratio correct this allowed me to composite the 25fps inferencing results on top of the high quality 60fps video coming from the camera.

For encoding I use Nvenc on the 1070. That keeps the stream at a solid 60fps, which the NUC CPU can’t accomplish. Between inferencing and video encode the card is getting put to great use.

This was stable for over a year, until I decided to install Windows 11. What could go wrong?

Camera

The original setup used an off-brand 720p webcam wrapped in a righteous amount of plastic wrap for weatherproofing. Surprisingly the weatherproofing worked well and there was never a major failure while using the first camera. However, the quality and color on that camera wasn’t good and an upgrade was due. I already had a Logitech Brio 4k webcam intended for remote work, but it ended up largely unused so it was repurposed for birdwatching.

While the plastic wrap method never had any major failures it wasn’t ideal either. Heavy humidity created fogging inside the plastic that could take a few hours to wear off. It needed replacing anytime the camera was adjusted. Due to these problems and the higher cost of the Brio I decided to build a weatherproof enclosure.

The feeder is constructed of acrylic. My initial plan was to use acrylic sheeting build out an extension to the feeder big enough to house the camera. I picked up some acrylic sheeting from Amazon and began researching appropriate adhesives. It turns out most adhesives don’t work very well on acrylic, at least not for my use case – the load bearing joints between the sheets were thin and I needed the construction to be rigid enough to support its own weight and the weight of the camera without sagging. Since the enclosure would be suspended over air relying on its inherent rigidity for structure the adhesive needed to be strong.

The best way to adhere acrylic to itself is using acrylic cement. Acrylic cement dissolves the surfaces of the two pieces to be bonded, allowing them to mingle, and then evaporates away. This effectively fuses the two pieces together with a fairly strong bond (though not as strong as if the piece had been manufactured that way).

Three sides were opaque to prevent sunlight reflections within the box. Joints were caulked and taped the joints to increase weather resistance. I played around with using magnets to secure the enclosure to the main feeder body but didn’t come up with anything I liked, so I glued it to the feeder with more acrylic cement, threw my camera in there and called it a day.

This weatherproofing solution turned out great. It successfully protected the camera from all inclement weather until I retired that feeder, surviving rain, snow, and high winds over the course of the year.

Switching to Linux

As it turns out, the webcam splitter software appears to rely on some undocumented / unofficial Windows 10 APIs and does not work on Windows 11. I decided to bite the bullet and just put Linux on the NUC.

Similar to Windows, on Linux only one device can be reading from a camera device file at a time. Unlike Windows there is a very easy way to work around this called v4l2loopback. This is a kernel module that allows you to create virtual video device files that can be fed video from a userspace application such as gstreamer. These virtual device files support multiple clients.

tl;dr:

# load v4l2loopback module; this creates a few loopbacks
sudo modprobe v4l2loopback
# set desired parameters on loopback device /dev/video2
sudo v4l2loopback-ctl set-fps 60 /dev/video2
# pipe video from camera device /dev/video0 to loopback
gst-launch-1.0 v4l2src device=/dev/video0 ! video/x-raw,width=1920,height=1080 ! videoconvert ! v4l2sink device=/dev/video2

After this, any number of clients can read from /dev/video2. I replicated my video + annotations compositing setup in OBS as described earlier without issue.

On the off chance this helps someone, here's how you set video camera parameters on device 0 (/dev/video0) from the command line:

sudo v4l2-ctl -d 0 -c focus_automatic_continuous=0
sudo v4l2-ctl -d 0 -c focus_absolute=75
sudo v4l2-ctl -d 0 -c backlight_compensation=0
sudo v4l2-ctl -d 0 -c auto_exposure=3

Around this time I also replaced the feeder since the last one was all scratched up and the acrylic had gotten all cloudy. I also replaced the cheap camera with a Logitech Streamcam duct taped to the feeder. I found that the Brio I was using didn't correctly handle gain adjustment so bright sunlight would blow it out. The Streamcam, which is much more affordable, doesn't have that issue.

You can watch the livestream here.

Birds

These were the first birds to appear and be identified live on camera. Congratulations.

success.mp4

In the case of sexually dimorphic species that also have appropriate training examples, such as house finches, it’s even capable of distinguishing the sex.

finches.mp4

In a few cases, such as the nuthatch and the pine warbler, the model taught me something I did not know before. Reflecting on that, I think that makes this one of my favorite projects. Building a system that teaches you new things is cool.

pine-warbler.mp4

Statistics

I was curious how many birds were visiting per day, what peak hours were and what the species distribution looked like. In order to get this information the first step was data collection, so I thought about how to best collect data on visitors. Conceptually I wanted to log each visitor along with some relevant data such as species, time of visit, length of visit etc. as a single record – one per visitor. However, this is one of those problems that seems easy but is actually quite hard. The classification algorithm runs once per video frame but there is no context retained between frames; it can’t tell you that the bird detected in frame N_1 is the same one it detected a moment ago in frame N_0. Extracting this sort of context is probably feasible, perhaps by combining some heuristics with positional information (is the bird of species X in this frame in the same position as bird of species X in the previous frame? If so, probably the same bird). However, this fell in the realm of “too hard for this project.” Instead of storing bird visits I decided to store the data in its elementary format as a time series of detection events.

I have some familiarity with time series databases, having used InfluxDB for a different project. Influx was nice for that project but I wanted to learn something new so I chose TimescaleDB this time around. Timescale is an extension to Postgres and I wanted to learn more about Postgres anyway so it was a good choice from a learning perspective. Since the plan was to insert a new record for every frame where an object was detected and the detection loop runs at about 25fps I was expecting a lot of data. I had read that Timescale handles that sort of scale a bit better than Influx, so that was another factor in choosing Timescale.

After setting up Timescale on a VPS it was time to design the database schema. I had a vague understanding of how relational databases worked and had written a few lines of SQL, but otherwise lacked database experience. After writing out a naive (in retrospect) schema it occurred to me that there was probably a way to do it right. I began learning about schema design and database normalization, a topic I found surprisingly interesting. This is the schema I ended up with, and while I don't think it's perfectly normalized it’s better than what I had initially.

Note the data for the feed present in the feeder. I thought it would be cool to correlate feed with frequency of species, but since I set things up so that changing the feed required a manual record insert I got lazy and stopped doing it so I don't have the dataset needed now.

After setting up the database on the server, I made some hacks in the YOLOv5 code to push detection data directly to the database whenever a detection occurred. After a short time I had tons of visitor records in my database. Next I wanted to answer questions like “what is the most common species over the last week?” and “what time of day has peak volume?“ To accomplish this I set up a grafana dashboard.

Then I thought it would be cool to show these graphs on the livestream. It turns out Grafana supports embedding individual graphs, and since OBS supports rendering browser views it was easy to get those set up.

I left these up for a while, but ultimately I felt they were taking up too much space in the stream so I took them down.

Thoughts

Overall I was extremely satisfied with the results of this project. The initial project took about 5 days to complete. I learned something at each step.

I can think of a lot of things to do with this project, in no particular order:

Bot that posts somewhere when a bird is seen
Retrain with background images to reduce false positives

from blog, technology, machine learning, nature

blog

Anonymous (anonymous@undisclosed.example.com) — 2023-09-09T01:27:10+00:00

why wiki?

I used to do a blog. In September 2023, I realized that the blog format was preventing me from writing more, because I felt like every blog post had to be finished before publication. I also kept wanting to go back and update old posts because things were changing, but blog posts are dated and aren't meant to be living documents like that. Another problem is that without a page history, if you change something then readers can't get back to the old version without resorting to internet archive or finding the git repo for the site. Wikis have page histories, and every page is a living document, so wiki is better for me.

tl;dr go read this.

All my blog post URLs are still alive, since I don't want that content to be lost, and I don't know who has linked to them. But probably I foresee no more blog posts.

If you got here from a link in one of my blog posts, and are looking for the corresponding wiki page, here is a list of pages which were spawned from blog posts:

adaptive cruise	2023/09/08 23:51	qlyoung
bird bar	2023/09/08 18:20	qlyoung
car scuba rack	2023/09/09 00:45	qlyoung
consistency	2023/09/09 00:50	qlyoung
disable bracketed paste in gnu readline	2023/09/09 00:07	qlyoung
diy oxygen analyzer	2023/09/08 23:33	qlyoung
iphone	2023/09/08 23:44	qlyoung
music management	2023/09/12 00:39	qlyoung
network simulation with k8s-topo on raspberry pi 3b+ cluster	2023/09/09 00:59	qlyoung
personal infrastructure	2023/09/08 22:50	qlyoung

books

Anonymous (anonymous@undisclosed.example.com) — 2026-02-16T05:10:43+00:00

This isn't all of them by any stretch, I read countless books in my youth. 2026

  ✅ ★★★☆☆ The Hound of the Baskervilles

2025

  ✅ ★★★★☆ The Name of the Wind
  ⏳ ★★★☆☆ The Martian

2024

  ✅ ★★★★☆ A Canticle for Leibowitz
  ✅ ★★★☆☆ Echopraxia
  ✅ ★★★★☆ Blindsight

2023

  ⏳ ★★★★☆ The Education of a Cave Diver
  ⏳ ★★★★☆ Cave Diving: Articles and Opinions
  ✅ ★★★★☆ Cryptonomicon
  ✅ ★★★★☆ Deep Into Cave Diving
  ✅ ★★★★☆ Caverns Measureless to Man

2022

  ✅ ★★★★☆ Die With Zero
  ⏳ ★★★☆☆ Mona Lisa Overdrive
  ✅ ★★★★☆ Death's End
  ✅ ★★★★★ The Dark Forest
  ✅ ★★★★★ The Three-Body Problem
  ✅ ★★★☆☆ The Lifecycle of Software Objects
  ✅ ★★★★☆ Understand
  ✅ ★★★★☆ Anathem
  ✅ ★★★☆☆ Second Foundation
  ✅ ★★★☆☆ Foundation and Empire
  ✅ ★★★☆☆ Foundation
  ✅ ★★★★☆ God Emperor of Dune

2021

  ✅ ★★★★☆ Double Star
  ✅ ★★★☆☆ Children of Dune
  ✅ ★★★☆☆ Dune Messiah
  ✅ ★★★★☆ Story of Your Life
  ✅ ★★★★★ Shadow Divers
  ✅ ★★★★☆ The Last Dive
  ✅ ★★★★★ Deco for Divers

2020

  ✅ ★★★★★ Dune

2019

  ✅ ★★★★★ The Rise of Endymion
  ✅ ★★★★★ Endymion
  ✅ ★★★★★ The Fall of Hyperion
  ✅ ★★★★★ Hyperion

2018

  ✅ ★★★☆☆ Count Zero
  ✅ ★★★★★ Neuromancer
  ✅ ★★★★★ Snow Crash

distant past…

  ✅ ★★★★★ The Moon is a Harsh Mistress
  ✅ ★★★★★ Ringworld
  ✅ ★★★★☆ Ringworld Engineers

Very distant past…

  ✅ ★★★★☆ Halo: Contact Harvest

literature

car_scuba_rack

Anonymous (anonymous@undisclosed.example.com) — 2024-01-06T05:23:37+00:00

car scuba rack

Diving is a passion of mine. I've been diving more often lately and, as any diver knows, transporting equipment is one of the logistical challenges of the sport. Having acquired a larger vehicle recently I decided to build a small equipment rack for it to support my usual configuration, namely two single AL80's.

Update December 2021

Yeah…I no longer dive single 80s. I assumed that when I started diving doubles I would have to find something to do with the PVC rack, but as it turns out, if I just fold the seats of my car down the rack can be slid up further towards the cockpit. At that point doubles fit “in front” of the rack (on the hatch side), a storage bin can be put to the side of that, and the rack can hold another bin and two single bottles - which works perfectly for stages.

Conclusion: this rack can grow with you

Tools:

- Hacksaw - Hammer / mallet (optional, helps with seating PVC)

Materials:

- x4 5' lengths of 1.25“ PVC - x4 T-joints - x4 4-way joints - x4 3-way (“side outlet elbow”) joints

I chose not to epoxy the PVC because I foresee making changes to the rack design in the future. If you want to epoxy the PVC into the joints, you'll also need:

- PVC primer & epoxy - 200-250 grit sandpaper

The 1.25” PVC can be found at your local hardware store. Neither Lowes nor Home Depot carried any of the 1.25“ joints so I got those on Amazon.

I have 43” of trunk space between the wheel wells in my vehicle. This rack is 41“ wide, which ended up being a snug fit.

The sections that run parallel to the cylinders are ~27”. The short connector sections perpendicular to the cylinders are each 5“.

I chose to leave a large central space for my gear bag. Adding additional 27” sections using the T-joints adds capacity for up to 3 additional single AL80s for a total capacity of 5. In the future I may move sections around to support a twinset, which is why I didn't epoxy anything yet.

Overall I think it turned out pretty good. Total cost of materials was about $100. I believe the demand for PVC to build ventilators has slightly increased the price. Tank racks can be had premade for much cheaper, but I wanted something fit to my use case, equipment and vehicle. Plus it's fun to build it yourself.

from blog, making, diving

cocktail_bars

Anonymous (anonymous@undisclosed.example.com) — 2025-06-15T16:24:14+00:00

cocktail bars

I like cocktail bars. Here's some notable ones I liked in a variety of cities.

Vancouver

Keefer Bar - Red and black anatomical theme, mirrors and laser etched plastic. Very creative cocktail list and skilled bartenders. Live music too. Love it. Intimate and loud, best with a companion

Edmonton

Honi Honi Tiki Lounge - solid tiki bar in downtown YEG. Nice selection of rums and some unusual-looking agave options. Rum barrel and white pearl were my favorites, and the ti'punch had a really interesting Mexican agricole in it
Clementine - barkeeper's bar. Cozy and intimate interior, tiny bar area with lots of selection. Good for meeting strangers

Raleigh

Foundation - The best cocktail bar in the Triangle. The proprietor of The Alderman (Chicago) knew these folks.
Aunty Betty's - A gin & absinthe bar. Didn't have absinthe when I went, but it did have a very knowledgeable and awesome bartender.
Dram and Draught - Whiskey bar with good cocktails. Haven't gotten to know this one too well.
C Grace (RIP) Used to be an amazing jazz bar, no more.

Chicago

The Alderman - Reservation only but we got in without one. Incredible bar and a very quirky and personable owner-bartender.
Cindy's Rooftop - Very vanilla bar but has a nice view of the city and millennium park.

Long Beach

Ordinarie - A very cozy bar.
Secret Island - Cool tiki bar
Bamboo Club - A tiki bar that knows its history. Down the street from Chiang Rai.

Los Angeles

Clifton's Pacific Seas - My first tiki bar and a very special one. One of the best interiors of any tiki bar I have been in.

Denver

Hell or High Water - gay/queer tiki bar in Denver. Unique selection of glassware and server garb.

Seattle

canon - notable for having the largest spirit collection in America, I felt like I was wasting the bar's time ordering off the menu.
Rumba - canon for rum drinkers. Told the server I was interested in rhum agricoles - received a flight and a 20 minute crash course + q&a on the subject when he returned. Amazing bar.
Inside Passage (inside Rumba) - A neat tiki spot that focuses more on novelty than other tiki bars I've attended. The cocktails are good but premixed to save space, you can't order off menu here.

consistency

Anonymous (anonymous@undisclosed.example.com) — 2024-01-06T05:28:20+00:00

consistency

consistency in doing something disagreeable is one of the harder things, even when its something you want

from blog, pithy, stupid

degoogling

Anonymous (anonymous@undisclosed.example.com) — 2026-02-12T17:07:34+00:00

degoogling

Sometime around 2021 I began to feel that use of Google services constituted a grave threat to my digital sovereignty, and began slowly moving off of them.

Here in 2025 I still have a Google account and probably will for the foreseeable future, because Google Fi and Google Fiber remain the best cell service and internet service providers, and you need a Google account to pay for them.

Today I use my Google account for five things:

As an OAuth identity for services that require one - literally just Tailscale, I have replaced everything else with email-based accounts
Filling out Google Forms - please stop using these folks, they often require a Google account
Access to shared Google Photos albums
Google Fi (cell service)
Google Fiber (internet)

Despite these limited use cases, which are all provided for free with a personal-tier Google account, I still have to pay for Google Suite ($8/month). Why? Because years ago when I wanted to use a custom domain on my Gmail account, I started paying for Google Suite to enable this functionality. When you do this, your Google account is converted from a “Personal” to a “Business” account. This is a one way transition. Once this happens, if you stop paying for it, your level of services drops *below* that offered to a free personal Google account. So unless I want to completely disable my Google account (spoilers: I do, but not yet) I have to continue to pay Google, because they don't offer a downgrade path.

Below I share what I have replaced various Google services with.

Gmail

Migrated from Gmail first to Protonmail, and then in 2023 to Fastmail, which I am much more satisfied with. I was paying for GSuite for Business in order to use a custom domain name, now I pay Fastmail for that.

Search

I pay for Kagi; and in 2025 onward, I don't need to use that much either now that we have effective LLMs.

Google Drive

Gdrive has many uses. Replacing it means replacing each function.

File sharing

Tried and rejected:

Filestash - kept running out of space on cloud VMs, S3 integration setup is a little scary, software buggy
Nextcloud - I use this on my intranet, but it's too heavy to host a separate public instance just for filesharing
magic wormhole - works, but people don't want to install programs to receive files and the mobile story is bad. shout out rymdport for favorite client.
Syncthing - It's a sync program, it isn't intended for unidirectional file transfer and thus doesn't work well for that purpose

I now pay for Dropbox. Upload to folder, share link. Sometimes you just gotta pay and move on.

Cloud storage

Okay, “cloud storage” is not really a function. There's two main reasons we use personal cloud storage:

So that we can store files in one logical “place” and then access them from any device
To save space on our devices

There's other reasons, mostly to do with reliability engineering, but those are the main two.

TL;DR I now use tiered storage; what little need I have for internet-attached storage is now met by my home server, which has a lot of storage and is always accessible via tailscale. More on that in personal infrastructure.

Google Photos

For hosting my personal photos, I initially replaced Google Photos with Photoprism. I also tried Immich and while I know this is considered heretical, it doesn't suit my needs. I ultimately gave up on server-based photo management, but that's another story.

The short of it is that I now store all my photos in a plain local directory synced across devices.

Sharing photos is more complicated. The usual situation for me is that I go on a trip with a bunch of people, and afterwards someone sets up a shared Google Photos album, everyone uploads their pictures to “the shared album”.

When you upload pictures to a “shared album”, they are in fact uploaded to your personal Google Photos account and then are published such that anyone with access to the shared album has access to those photos. Consequently you can't add photos to shared albums without storing photos in Google Photos. If you later delete those photos they disappear from the shared album.

I have tried various methods of sharing my photos with gphotos users, including:

Uploading my photos “to” the shared album, advising all participants that they will be deleted in 2 weeks, and then deleting them
Zipping the photos and sharing the zip via one of the methods described in the previous section

My current solution is to dump all my photos into a Dropbox album and send people the link. Whenever I need to free up space I delete the dropbox folder. I still have all the photos locally in my own library so I can reshare if needed.

This is much to the chagrin of people I go on group trips with, because they don't understand why I can't just use Google Photos like them and I end up being viewed as a source of inconvenience.

Google Contacts & Calendar

I run Nextcloud on my home server and have replaced G services with Nextcloud's CardDAV and CalDAV implementations. These legitimately work better than Google Calendar and Google Contacts, especially on iOS which has first class support for CardDAV and CalDAV baked into the system; consequently system apps and facilities that rely on accurate calendar and contact sync work flawlessly.

YouTube

For hosting my own videos, I have replaced it with Peertube, although my YouTube channel is still up because I haven't gotten around to wiping it yet.

Unfortunately one video I made has popped off, and since it's educational I'm a little reluctant to take it down. I will probably make a video explaining how to get to my Peertube, upload that to YouTube, and then take everything else down. Then when I finally get around to deleting my Google account, that will disappear too.

Of course I still watch videos on YouTube, and I still subscribe to channels. However, I do it via a self-hosted instance of invidious. This way all my subscription data information etc is kept on my home server. On my iPhone I use yattee as a client to my Invidious instance, so I get a YouTube app-like experience. Also has the side effect of being ad-free

Keep

See note taking programs.

Android / Play Services

Bought an iPhone.

self-hosting, technology

digital_mapping

Anonymous (anonymous@undisclosed.example.com) — 2024-07-02T21:54:55+00:00

digital mapping

OpenStreetMap publishes maps of all Earth regions, including the whole planet.

To use this data as a visual map, you need to render the raw data - which is available in XML and PBF (you want pbf) - into either vector or raster tiles. There are a variety of tools that do that; the easiest is probably planetiler.

When you render, you need to pick an appropriate zoom level.

On my enthusiast desktop, planetiler took around 2 hours to generate vector pmtiles of the planet with all zoom levels. The resulting file was 69gb.

After that, you can serve the tiles using a tile server. Connect an appropriate client to view. Some tile servers like tileserver-gl serve a web-based viewer so you don't need a client.

disable_bracketed_paste_in_gnu_readline

Anonymous (anonymous@undisclosed.example.com) — 2024-01-06T05:25:43+00:00

disable bracketed paste in gnu readline

In early 2021 GNU Readline, the venerated line editing library used in everything from bash to vtysh, enabled bracketed paste mode by default. This is a significant behavior change, and while it's noted that there is a compile time option to change this default, generally you can't tell users to recompile some system library to get a feature back.

The Readline docs themselves are in the typical overly-terse GNU style so this is a quick note on how to restore the old behavior in your readline-using program. There's a function in readline that takes a string and interprets it as if it were present in the user's .inputrc file; this can be leveraged to disable bracketed paste mode like so:

char *disable_bracketed_paste = strdup("set enable-bracketed-paste off");
rl_parse_and_bind(disable_bracketed_paste);
free(disable_bracketed_paste);

from blog, technology, programming

dive_light_burn_times

Anonymous (anonymous@undisclosed.example.com) — 2024-07-02T21:57:16+00:00

dive light burn times

I like to go diving in dark places. In dark places like caves, lights are important, and we carry a bunch of them. The rule in cave diving is to carry at least three lights for redundancy: one primary and two or more backups.

I use these lights as backup lights: https://www.divegearexpress.com/dgx-600-twist-handheld-light

They are ruggedly built, simple, and so far quite reliable. They do take rechargeable batteries. There is debate on whether non rechargeable batteries are better suited for use here, centered on discharge characteristics and the human factors involved in remembering to charge a light that you intentionally never use. Nevertheless I do currently use them. I had the pleasure of meeting Bill Main in the parking lot of Little River springs one day; he uses them as well. Consider that a celebrity endorsement. Bill also uses a straight-through manifold without an isolator valve, but that is for another wiki page.

It's important to know how long your main lights and backup lights can burn for. Therefore, I did some burn tests.

My setup is a cheap webcam (the same one used for bird bar) plugged into a cheap macbook. I placed the webcam on a chair pointing at a wall. On the chair I also placed a tupperware full of water. This simulates the diving environment. Then I fully charged the light battery, turned the light on and placed it in the tupperware facing the wall. Finally, I recorded the camera image using OBS. This way I could check the recording to see when the light stopped burning, as well as view the luminance characteristics as the light discharged, without needing to monitor the light.

It turns out the DGX 600 twist light burns for between 90-100 minutes. Over this time period it gets gradually less bright until it finally goes out completely. It is still usefully bright until the moment it turns off.

Video of light discharge behavior

this video doesn't play!

The apparent increases in brightness in this video are caused by the automatic exposure control of the camera adjusting for decreasing brightness levels and do not occur in reality.

diving

diy_oxygen_analyzer

Anonymous (anonymous@undisclosed.example.com) — 2024-01-06T05:21:51+00:00

diy oxygen analyzer

In July 2021 I assembled an oxygen analyzer. The purpose of this device is to measure the oxygen content of a gas; for my purposes I'm using it to analyze breathing gases for diving. Commercial analyzers are available at reasonable life-support prices. Having an interest in electronics hardware, I opted to use a DIY kit instead. For the search engines, that's the “El Cheapo II oxygen analyzer” by OxyCheq. The kit is all the components to build an analyzer and a paper printout of instructions on how to put them together. I found the printout charming. Unfortunately I left it at the hardware store when I went there to get some snips and solder. This was a significant setback for me as this was my first electronics project of any sort and I had no idea what the hell I was doing. There's no digital copy available for public download and obtaining one from the gentleman who owns & operates OxyCheq took some patience, but eventually I was able to get a replacement for the instructions and begin work on the analyzer.

Progress was slow. Building the unit involves cutting appropriate mounting holes into the generic black plastic case that comes in the kit. I found a Dremel ill suited to this task; the fiberglass cutting blades I had melted rather than cut the plastic. Nothing some filing couldn't fix and eventually I had my holes cut. After mounting all the stuff into the board I was ready for the electronics portion, which the instructions cheerily describe as the easy part. It turns out this is only true if you have a good soldering iron. The soldering iron I used at first was butane powered with a rather thick tip. With my unskilled, slow soldering operations, the butane kept running out. Part of building the kit involves removing a surface mount resistor. Doing this with a soldering tip that is as big as the entire surface mount component is difficult. Soldering components to the pads the SMT used to be on was, for my hand, nearly impossible. Almost immediately I ripped off one of the pads.

This was very disappointing. Being new to electronics I assumed I had destroyed the board and set about ordering a new one. I was able to find them here. There are several varieties of that board listed here with various possibly desirable features if you sort of know what you're doing. I didn't so I got the same model.

In the meantime some friends online who know things about electronics set me straight. They had a look at the board and noted that the bit of missing solder mask between the lower R3 and R2 pads, which suggested that they might be connected.

My friend made this helpful schematic.

Unfortunately with no R2 pad I couldn't verify this with an ohmeter, but I assumed that this was correct and proceeded to do a very bad solder joint to R3, which you can see in this picture along with some other similarly bad joints.

(Later, after completing the project, I found |this thread which describes doing the exact same thing I did - and verifies that R2 and R3 pads are indeed connected. Oh well.)

After doing this joint and all the others, I plugged in the sensor, flipped on the meter, and to my dismay observed that the meter showed very negative, very positive or otherwise garbage values. Moreover it changed values if it was picked up.

By this time the other PM-128A I had ordered arrived, along with a much better soldering iron. Armed with proper tools and a fresh board I reworked all of the electronics. With the benefit of practice and my new iron the joints came out much better this time. Unfortunately the meter was as wrong as ever. To cut a long story short, the oxygen sensor connects via a standard 3.5mm TRS jack. There are 3 pins on this jack. The jack part provided with the kit was different from the one described in the printout instructions. I had connected the voltmeter to the wrong pins on the jack, and one of the wrong pins was rather loose. Shaking this pin corresponded to the meter changes. I changed up the pins and the problem was solved.

Since I had trouble with some of the wiring instructions, I'm posting the correct wiring here in hopes someone else might find them useful.

Here's the complete wiring diagram from the instructions:

(See what I mean by charming? Jack wiring from the instructions:

Correct jack wiring (note wire colors):

I also opted to use the upgraded 10 turn potentiometer, available from OxyCheq, rather than the standard one that comes with the kit. The difference is that it's much more precise - the same range of values are covered in 10 turns of the knob versus 1, so it's much easier to calibrate the meter down to a tenth of a percent. The downside is that the diagram in the instructions doesn't cover this potentiometer, so some trial and error was required to find the appropriate wiring.

Pot wiring from the instructions:

The correct pot wiring for the 10 turn pot is visible in this overall shot of the completed circuit.

I know the joint on the lower leg of the pot looks horrible, I fixed it after that photo.

So does it work? Hell yeah! It really prefers being used on DIN valves with the DIN adapter available from OxyCheq, but I was able to get good test readings on EAN30 on a yoke valve with a bit of technique. I used it on a trip to the Spiegel Grove last week and it worked, although at the end of the trip the solder joint to the pot came loose, resulting in a constant reading of .03%. The important thing is that when it failed it failed in an obvious way.

The sensor used is a standard O2 sensor that you might find in a rebreather. Because it's an off the shelf sensor, it can be easily replaced at the end of its service life, which is a significant advantage over some of the commercial analyzers.

I learned a lot from this project. In no particular order: - Butane soldering irons and large tips are not ideal How to use an ohmeter and its applications Various types of solder and the utility of flux Much can be learned from solder mask

Thanks to the friends that helped me through my first electronics project!

from blog, diving, technology

documentation

Anonymous (anonymous@undisclosed.example.com) — 2026-02-12T17:05:04+00:00

documentation

I strongly appreciate excellent technical documentation. You can have a great piece of software but if it's difficult to understand how to use it, at best users will fail to appreciate it and at worst huge amounts of time will be wasted and vast quantities of errors committed.

Because I appreciate good documentation for tools I use I do my best to write useful documentation. In addition to the obvious benefit, which is that good documentation saves everyone time, I find there are several additional benefits specific to the act of writing documentation:

Writing about a subject cements, organizes and structures knowledge in my mind
The process frequently reveals areas that I lack knowledge in or don't fully understand
Collating and structuring information often reveals performance or security issues that I hadn't seen before
It improves my general writing skills, vocabulary and cognitive processes

A common pitfall I see is that people who write documentation turn very hostile towards users who ask questions covered by the documentation. I used to be this person. User asked a question? Oh HELL yeah, now I get to berate them for not reading the FUCKING MANUAL!

This is stupid. Most users are asking questions for one of these reasons:

They didn't know where the documentation was or that it even existed
They could not find the information they needed in the documentation
The documentation was not clear

If you work or play in technology at all, you have likely been in each of these scenarios. Put yourself in the user's shoes. In nearly every case a user asking a question is not an annoyance, it's an opportunity to do two things:

Improve the documentation
1. If the user couldn't find the docs, how we make it more discoverable?
2. If the information already exists but they couldn't find it - how can we make it easier to find? Should we structure the docs differently?
3. If the reader couldn't understand the information, this is a perfect opportunity to identify a deficiency in clarity. How can we explain it more clearly? Odds are other readers are having issues too.
Improve the user
1. If we contribute a documentation fix in response to a user concern, it demonstrates to the user that the docs are actively maintained. This makes them more likely to use them.
2. For users who do not believe in writing docs for their own things, it demonstrates by example why the docs are useful

Now, yes, there are the users who show up, ask questions, are referred to the documentation and become combative, refuse to read it, are insulting, etc. Documentation helps us in dealing with these users as well. If the information is well documented, you don't have to interact with them at all! Just refer them to the documentation and move on. You get to completely avoid interacting with toxic people.

'code is law'

You probably know, or you may yourself be, a person who takes an attitude along the lines of “docs suck, code is law. just read the code lol.”

There's a lot of potential things that can be going on in this person to cause them to take this view:

They suck at writing and therefore don't want to do it. This is the case for many, many people. Writing good, clear documentation is not a natural skill for most. You need to develop it.
They have an ego and it makes them feel superior to imply that you lack skilz because you can't efficiently comprehend an entire software package in an hour or two by simply reading the code. This is very common in junior engineers and people who are good at computers but lack well rounded social skills.
They have been burned by out of date or poor documentation in the past and reacted to this by distilling the experience into the opinion “docs = bad”
They know that documentation takes a lot of time and value either the experience or the result (or both) of technical work more, and therefore need a reason to argue against producing documentation if questioned

I think all of these are bull.

If you suck at writing - this is an opportunity to get better
If you feel the need to flex on people - grow up
If you have been burned by documentation - who said you had to make bad docs? Be the change.
If you want to write code - I feel for you. Don't you want people to use that code?

The last point is important - if you have zero interest or responsibility for anyone else to use what you're writing, by all means, do not write docs if you don't want to. I am not saying that you need to document everything you make. But for things you intend other people to use, writing docs will make them love you. If you do it professionally, I will double down and claim that competency in technical writing is part of being a well rounded and competent engineer.

culture

In a professional context, company culture frequently does not incentivize documentation. Technical output is rewarded. Documentation output is not. This is extremely common, but it is bad for the organization as a whole. Suppose you commit an engineer to building out a complex system, but there are no cultural incentives for the engineer to write good documentation, so they don't. How many man hours are subsequently wasted by users who are forced to reverse engineer that system in order to use it? Probably a lot, right? Imagine if the engineer was rewarded for writing good documentation and did so. Yes, the engineer spent time writing documentation when they could have been doing technical work. But how many hours are now saved for other users?

Of course, some teams are explicitly aware of that tradeoff. Externalizing cost to other teams means your team can be more productive - at the cost of the org. Dsyfunctional workplaces incentivize this behavior.

In extreme cases, this can result in the entire product being rebuilt by a different person or team because no one can understand how to use the first product.

There is a service I interact with that has an HTTP API. Said API requires authentication. This service is maintained by a team. Yet, nobody has bothered to write down how to authenticate to this service. It's extremely simple, so simple you can explain it with just two lines of example shell code. But nobody has taken the 2 minutes to locate an appropriate place to write that down, jot it down and provide a couple notes on it.

What are the consequences of this? Now every time someone wants to use that API:

The user must locate an appropriate channel (email, slack, etc) to ask their question
Ask their question and hope a knowledgeable person (KP) sees it
Said KP must now explain how to do it - probably not for the first time (!)

This entire transaction is repeated countless times. Consider the alternative:

User asks a question
KP sees the question and instinctively reaches for the docs to give the user
KP realizes there are no docs. KP spends 2 minutes creating a docs page, writes down the answer, gives it to the user.

Now the user has that docs page to share with anyone facing the same problem and KP can spend less time answering that question in the future. This saves everybody time and improves morale.

tools

I'm not going to talk about what docs tools I like here. Actually I am going to talk about the opposite.

Maxim:

Docs are worthless if nobody writes them.Me

Yep. You know how you get people to write docs? I can tell you that it is not by pointing them at a `docs/` directory with instructions to just make a PR. It is by making it as frictionless, painless, as easy as possible to edit the docs. This is triply true in organizations where people are not rewarded for writing docs. Which is most of them, at least in my experience.

If I have to make a git commit to edit docs, the platform is DOA. If I cannot drag and drop a screenshot into the editor, the platform is DOA. If I have to learn a syntax to edit docs - even if it is Markdown - the platform is DOA. If it takes me more than 5 seconds or so to make an edit or add a screenshot or correct a typo, the platform is DOA.

I say this as someone who built https://docs.frrouting.org/. These docs are, technologically, fantastic. reStructuredText is an amazing markup system for technical documentation and has rich structural capabilities with cross referencing, glossaries, syntax highlighting, parsers, et cetera. It can be compiled into any format you want - PDF, HTML, manpage, transpiled into almost any other markup. It's version controlled in git and as a plain text format you can use all the great tooling you use with code to view it, diff it, edit it. From a technical perspective it's really close to the best system out there. Yet the FRR docs are years out of date in most areas. Do you know why? It's because to edit these docs you need to:

Know reStructuredText
Make a git commit
Submit a PR.

That's it. Each of these things individually adds so much friction that when you put them in front of someone who is anything less than passionate about documentation, and isn't paid to write it, the idea of updating the docs is going to vanish from their mind leaving a spotless void that can be filled with code or a cocktail or any number of other things.

Now put this person in front of a webpage with an clearly visible “Edit” button. That typo staring them in the face? All you have to do to fix it is click that button, delete that one extra `e` and click save. It costs nothing to do it and you get the instant satisfaction of contribution.

Docs with low friction at least have a chance of tending towards becoming ground truth and references. Docs with high friction enter a self reinforcing cycle of decay. Nobody edits docs that are out of date. Nobody wants to polish a turd. But a fleck of dust on a beautiful object can motivate even the most depraved docs hater to brush it away.

docs pitfalls

Hitting these issues are also reasons why people form the opinion that docs are bad.

the docs are too detailed

I have seen “docs” that go into excruciating detail. Sometimes, like in formal API specs in safety applications, this is necessary. But for many products it is not, and it will cause many problems:

The docs will go out of date very rapidly
Engineers will spend extreme amounts of time keeping docs up to date, impacting productivity and reducing morale (engineers enjoy building)
Users will frequently encounter incorrect documentation, lowering trust in docs overall, increasing support requests, impacting productivity

fall

Anonymous (anonymous@undisclosed.example.com) — 2024-07-02T21:59:50+00:00

fall

Fall is definitely my favorite season.

I find that it's the season in which I make the most personal progress. For some reason the changing leaves, the cooling weather, makes me feel like I'm coming out of a hazy dream. It wakes me up and prompts me to review my life.

I also do my best work (as in, job) in the fall. In the summer it's so pretty out that I hate being inside, and that distracts me. In the fall it's still nice to be outside, but inside becomes the warm comfy place. This takes a psychological load off and increases my focus; I don't feel like I'm wasting time by being inside, so I can sink into my computer-based work and flow more easily.

The concept of “spring cleaning” applies but for me it happens in the fall. I know I'm about to spend a lot of time indoors so I clean out all the unnecessary junk in my place to make it as habitable as I can.

And of course, North Carolina is a state cut out of a forest so the whole place becomes a beautiful mix of green, mute browns, soft oranges and blazing reds for two months. It's really beautiful.

nature, humanity

file_transfer

Anonymous (anonymous@undisclosed.example.com) — 2025-10-06T03:36:50+00:00

file transfer

File transfer sure is hard. Why is it so hard?

Computer to computer

My favorite for 1-1 file transfer is magic wormhole protocol via rymdport, although it has significant bugs
There is also croc although it needs a comprehensive security review (along with magic wormhole)
For 1-to-many transfer, I usually prefer Bittorrent
For many-to-many, I like SFTP. Yep, good old SFTP. My preferred server is SFTPGo. It supports S3-compatible cloud storage as a storage backend and allows you to mount as many of those as you want in a virtual filesystem scoped to specific users. Very good. I host it at https://files.qlyoung.net.
Honestly, I hate saying it, but dropbox works fine too

Phone to phone

If it's iOS to iOS and just 1-to-1 or 1-to-many, Airdrop works well. Many-to-many quickly becomes unmanageable.

For cross-platform iOS ↔ Android transfers, I usually reach for snapdrop. However, for transfers of more than 1gb or so, it starts to get sketchy with phone lock timeouts and background task kills frequently resulting in failed transfers.

I'm not aware of any reliable and broadly available tool that exists in this space. A magic wormhole client for mobile would be amazing. Do you know of one?

Lol

I made this page with its name before seeing this appropriate XKCD: https://xkcd.com/949/

At least I'm not alone.

technology

gambling

Anonymous (anonymous@undisclosed.example.com) — 2024-07-02T21:55:34+00:00

gambling

In October 2023 I went to Las Vegas for the first time as an adult, and was introduced to gambling. Up to that point I'd never really gambled. Poker with friends didn't really count, it just added some stakes to increase the fun and retain interest in the cards. Risky investments, like shorting $DHI and buying the $BLZE IPO, were the closest to Vegas I got prior to going.

Vegas gambling was really interesting and novel to me. Trying a variety of games in a variety of casinos, with a variety of friends and around a bunch of types of strangers, showed me a lot of different reasons that people gamble. It also served as an exploration of my own approach to risk. I actually found Vegas to be beneficial because I left with a better understanding of what risk profiles I enjoy. Aside from the gambling itself, there were also things I enjoyed getting exposure to that happen adjacent to gambling.

gambling adjacent elements

There's a couple elements adjacent to Vegas gambling that I enjoy, some of which are:

Socializing / hanging out with friends
Free drinks
The sheer spectacle of the setting

I had the most fun in Vegas sitting around the machine craps or standing around the real craps table with friends, all of us engaged in the outcome of a game of chance, while being served free drinks with a DJ playing a set. Socializing is good. Free drinks are fun, to the extent that they taste good and drinking is enjoyable. And it's exciting to take risks together!

gambling elements

The casino offers games for every risk appetite.

After checking into the hotel me and a friend went to a casino in search of a pai gow poker table. I didn't know what this was. My friend explained that he likes pai gow because in pai gow money moves slowly. Most of the time the outcome is a push (no win or loss). This allows you to play for a long time, creating an experience that emphasizes hanging out, drinking, with some element of risk to add excitement.

After gambling for a week in vegas and then doing a bit online as well, I have arrived at a similar conclusion. For me, gambling is most enjoyable when the outcome is mostly neutral and you can play for free.

online gambling vs casino gambling

After returning from Vegas, I tried a few different online gambling experiences.

vegas infinite

The reason I was in Vegas was to attend a demo event for an upcoming VR game being developed by a studio that most of my friends work at. Thus, all of us are VR enthusiasts and when we got home we started looking for a way to replicate the casino experience in VR. There's a game called Vegas Infinite that implements a virtual casino; the available games include slots, blackjack, poker, crash, roulette, and craps. You get a random amount of the in-game currency each day for free. We played that for a while but after some time we all stopped. The reason I personally stopped was that while I enjoyed the social aspect, after playing virtual craps for a few hours there was no excitement in it. Mentally the wins and losses didn't mean anything, the currency is totally useless anywhere outside the game. You can't even use it to purchase cosmetics in the game. It's just a number that goes up and down. If the game allowed you to purchase cosmetics using your winnings that might offer some engagement, but it doesn't. The virtual currency is completely worthless even in virtual terms, so any games that use it have absolutely zero stakes. The social aspect became boring because the focus of the socializing was on the worthless virtual currency. It's not like we were having conversations about something else and just using the virtual gambling as an excuse to occupy the same virtual space. I still log in occasionally to collect the daily currency drop, just in case we ever want to play poker as a group or something, but that game isn't interesting at all.

crypto casinos

This section is entirely hypothetical, as I would never actually engage in cryptocurrency gambling. It's just how I imagine it would go if I were to do such a thing, and is written in that style.

There are various websites that implement cryptocurrency gambling. These are only available outside the US but are accessible via VPN. After Vegas Infinite became boring, and having a few hundred USD worth of various crypto that I haven't touched in years, I decided to try gambling with it to see how it made me feel. Games I tried included dice, plinko, and a simplified version of roulette.

At first this was fun. Gambling with a fungible asset means there's actually some stakes involved, inasmuch as winning increases your ability to get actual stuff, and losing decreases it. This resulted in being more invested in the outcome, making the game more exciting. However, after a while this too lost its luster. After some reflection I think this happened for two reasons:

1. The amounts I gambled with are completely immaterial to me. The maximum I ever staked on any one bet was $10 with a maximum payout of something like $30. I spend $30 on curry delivery without a second thought, I really don't care about those amounts. The maximum I ever had deposited in the site wallet was $300 - even if this was stolen by the site operators I would not care. Ultimately there was still not anything real at stake.

2. Losing streaks hurt more and were more tangible than the excitement gained by winning streaks. Winning gave a brief dopamine hit but similar to cigarettes and poppers, the most enjoyable part was the microsecond after winning, and then the feeling was gone. I've learned through life experience that this sort of pleasure is ultimately more of a drain than anything else, and that knowledge plus the knowledge that house edge meant that a net loss was imminent made me unable to enjoy it. Personally I think that to get any concrete enjoyment out of pure gambling - meaning the activity itself without elements like free drinks, socializing, etc - you have to lack a visceral understanding of house edge. If you understand house edge then you know in your core that all wins are just local fluctuations in a graph that trends down, and that sucks.

3. Lack of any of the social elements or perks like free drinks or music meant that only the core activity of gambling remained.

That said, I still enjoy short sessions of online gambling on games where most of the time you push. This minimizes the negative feelings of a loss, while still retaining the excitement of volatility, and rewards you with the excitement of the occasional win. You still lose in the long term, but there's a sweet spot where you can gamble for 2 hours straight with a $20 stake and walk away with $10 that makes spending that $10 a worthwhile price for the 2 hours of entertainment. ¹⁾

conclusions

All of these experiences together led me to my personal viewpoint of gambling, which is that it's a good way to do two things:

Enjoy the company of people
Be entertained by volatility in a controlled manner

Gambling with the intention to win money is a fool's errand. That is not an opinion, it's just a fact. Playing any game with a house edge where your enjoyment is predicated on winning is a waste of life. As a shared activity, played responsibly, it can be a great way to socialize. And played alone, responsibly, it can be a fun diversion not too dissimilar from playing a video game.

As a random thought tacked onto the end here, I bet that some people would be better off gambling than engaging in activities that are actually gambling but given the label of investing. For example, some options trades are realistically just pure gambling, but because it's done on an asset market where people also make rational investments it lets people rationalize the behavior by calling it investing. Such behavior might be less destructive if the label on it was “gambling”, with all the social trappings and pressures (ie, expectations of appropriate risk management) that come along with that. But then, either you know you're gambling or you don't, and if you're self aware enough to acknowledge that you're gambling maybe you're better off doing it on the market where it's legal and where you're less likely to be judged for engaging in it.

gambling, philosophy

¹⁾

Note: shortly after completing this article I hypothetically bet all of the remaining $150 from my initial $300 on a single dice roll and lost. Draw your own conclusions.

insurance

Anonymous (anonymous@undisclosed.example.com) — 2025-10-06T03:33:19+00:00

insurance

Oh, uh, none of this is legal advice, I'm not a lawyer and hold no credentials associated with insurance, etc.

Now I know what you're thinking. This is so lame, this isn't the culture, look at this loser using his personal syndication platform to write about boring ass insurance of all things. I'm gonna go read a phrack or gwern or the new yorker or whatever it is you read.

You're right. Anyway, on to the article.

In May 2024, prompted by something random, I did a complete review of all my insurance policies (except for medical) and learned a lot of things about insurance which I should have learned about 10 years ago. Here I've jotted down some of what I've learned in the hopes that maybe it will prompt someone else who was similarly uninformed to learn these things.

In short: If you are American and most of the contents of this page are new to you, you are probably at risk of having your life ruined and should learn about insurance

Being underinsured is very dangerous in the US. It's one of those risks that will probably never materialize into a real problem but if it does, it can ruin your life without recourse, game over. Here in the US we love having these little life-ruining booby traps sprinkled around, that way everyone has to spend time thinking about them instead of pursuing happiness or whatever.

All of the information here is available online, but here's some rough notes on what insurances the average American might want and what they cover. Not legal advice.

Terms and abbreviations

BI - bodily injury
PD - property damage
UM - uninsured motorist
UIM - underinsured motorist

General thoughts & opinions

You could also call this the “insurance is fucking boring, give me a tl;dr” section.

I am going to make some blanket statements here that none of the websites that talk about this will make, which will certainly not be true for some people, but will likely be true for most people. Please understand that these are only my opinions and you need to fully understand your own situation to make accurate judgements. Do not believe what you read here.

If your liability limits on your auto policy are at or below 100/200/50 for both BI/PD and you have no umbrella policy, you are likely underinsured
If you do not understand the previous bullet point you are likely underinsured
If you don't have an umbrella policy, you are likely underinsured
Basically every person whose financial situation lies somewhere between “destitute” and “billionaire” should have umbrella insurance

Let's see, what else…

Low assets does not make you safe from huge liability. “Good luck getting blood from a stone” - wrong. Your wages can be garnished for the rest of your life turning you into a slave laborer. Imagine if you had just paid for insurance instead!

Auto

Auto insurance pays out in various situations involving motor vehicles. The main categories you will find offered by an insurance company are:

Name	When it pays out	Relative cost
Property damage liability	You are responsible for paying for damage to someone else's property	Expensive
Bodily injury liability	You are responsible for paying for someone's medical costs or lost wages	Expensive
Collision	Your vehicle is damaged by collision with something that is not covered by someone else's insurance	Expensive
Comprehensive	Your vehicle is damaged by something other than a collision (e.g. hail)	Moderate
Uninsured/underinsured motorist property damage (UMPD)	Your property is damaged by someone and that person's 'Property damage liability' limit for their auto insurance is not enough to cover the damage	Cheap
Uninsured/underinsured motorist bodily injury (UMBI)	You are injured by someone and that person's 'Bodily injury liability' limit for their auto insurance is not enough to cover your medical costs	Cheap
Medical benefit	You have medical costs which are not covered by any of the above but still involve a vehicle	Cheap
Transportation expenses	Your car is unavailable due to a covered event and you need to rent a vehicle	Cheap

General notes:

Which specific coverages are required and at what levels, as well as other details, varies widely state by state
Insurance for things which are under your control is expensive. Insurance for things which are out of your control is cheap.
To what degree a motor vehicle has to be involved in order for auto insurance to pay out depends on your specific policy, which you should read. The devil is in the details. For example, suppose you are a pedestrian and hit by an uninsured driver. What insurance is going to cover your medical costs? 🤔

Specific notes:

Many insurers require that bodily injury liability and property damage liability have the same limits
Medical benefit - this one kicks in before your medical insurance deductible for very specific vehicle-related situations. For example, you are standing on your car in order to clean your gutters and fall off - your medical insurance would cover the medical costs, but the medical benefit from your auto policy could pay out to cover your medical deductible.

UMBI/UMPD warrant their own point. Why do you need to pay to insure yourself against someone else NOT buying insurance? That doesn't seem fair. Well, it isn't fair. Fortunately it's cheap. The reason it's cheap is that after covering you, the insurance company turns around and pursues every option available to them to recoup that money from the party with insufficient insurance.

In May 2024 I noticed my auto insurance policy had a limit of $50k USD for property damage liability coverage. That's the coverage that pays out if you are liable for damage to someone else's property (usually their car). This seemed rather low since many cars on the road are themselves worth more than $50k, and even a car worth less than $50k may be loaded with property whose value exceeds $50k. You could also hit a house or something else and cause more than $50k of damage to it and be liable for that. In all of those cases, with just $50k of coverage, you would have to pay the remaining costs out of pocket. Depending on the liability amount and your financial situation that could range from annoying to life ruining.

Renter's

Renter's insurance pays for things like your apartment flooding and destroying your collection of fine paintings and your gaming computer. My understanding is that home owner's insurance is similar but different and has provisions specific to things that can happen to owned or mortgaged homes. If you own a home and are reading this to learn about homeowner's insurance, please stop.

Name	When it pays out	Relative cost
Personal property	Property in your rented home is damaged or destroyed	Moderate
Loss of use	You incur costs above your normal living costs as a result of not being able to use resources normally available in your property	Moderate
Personal liability	Someone is injured in your home (or their property is damaged) and you are liable
Medical payments	You have medical costs and have to pay an out of pocket deductible

Frankly I don't understand the fine points of renter's all that well and need to read more about it.

Umbrella

Prior to my grand review I did not understand umbrella insurance. Now that I understand I am of the mind that nearly everyone should have it.

In short, umbrella insurance covers you for liabilities in excess of any other policy. Suppose you crash your '99 Camry into a McLaren Artura (about $300k), totaling it, and you have $150k of PD liability coverage on your auto policy. After that pays out you are still liable for $150k. If you do not have an umbrella policy you are screwed and must come up with that $150k out of pocket. If you do have an umbrella policy, your umbrella policy kicks in after your auto policy has hit its limit and covers the excess (up to the umbrella policy's maximum), and you pay nothing out of pocket. So in this case the first $150k would pay out from your auto policy and your umbrella policy would pay the remaining $150k.

You are probably thinking, wow, that sounds very nice. It must be expensive, right? Nope! When I got quotes for them recently, an average $1M umbrella policy was around $150/yr. Relative to an unexpected 5 or 6 figure out of pocket expense, that is extremely cheap. That is why I think most people should have an umbrella policy.

Other notes:

Umbrella policies are usually purchased in $1M increments
They typically require that you have certain minimum coverage levels in auto and renters/homeowners policies before you can get one - these minimums can vary widely, shop around
They only pay out when you are liable for something

iphone

Anonymous (anonymous@undisclosed.example.com) — 2024-08-24T22:09:16+00:00

iphone

Bit of a pace change here, I don't particularly care about consumer electronics but mobile computers aka phones are an exception since for better or worse they're inextricably tied up with much of my life.

After being a longtime user of Pixel devices (which pairly nicely with Google Fi cell service), the screen on my Pixel 4a broke in June 2022. At the same time I went to Yosemite with some friends and noticed that the pictures they took with their iPhones looked a lot better than the pictures I've taken with any Android phones. I was always skeptical of iPhone's ostensibly restrictive user experience (relative to Android), but being rather bored with technology and not finding any really good Android phones on the market (where are the microsd slots?) decided to pick up an iPhone. Apple has a decent 14 day return policy, so I figured I'd try it out and if the device annoyed me I'd just return it and get whatever the current number pixel is. In short, I've been pleasantly surprised by iPhone and am keeping it. I bought the iPhone 13 Mini with 512gb of storage.

Preconceptions

My main hangups coming into iPhone numbered three:

No filesystem access

I'd vaguely heard that it is difficult to access iPhone's filesystem. This is one of the things that kept me from seriously looking into iPhone in the past. I know how computers work, I know consumer computers have a filesystem that has files on it, one of the main things I do with computers is work with files on the filesystem. I'm generally not interested in learning abstractions over the filesystem and if I'm prevented from doing things I normally do with the filesystem, like moving files around, that's a nonstarter for me. Turns out this concern was misplaced. The iOS concept of the filesystem is more complicated than the one on Android, but from a functional perspective I can still accomplish the same tasks. I can mount various parts of the iPhone filesystem on my Arch laptop via a FUSE module and get to the files I need to get to. On iOS, apps apparently have their own private filesystems, which is kind of a neat concept and makes perfect sense from an application sandboxing perspective. These can also be mounted on Linux via FUSE. I can copy files to and from application filesystems and I can copy to and from the directories iOS exposes for use as mass storage.

By far the biggest filesystem-related task I do with phones is to sync my music collection to the device. With the way I manage my music collection, I prefer to do this with rsync, it's simple and clean and does what I need it to. On Android I would mount the phone filesystem via jmtpfs and rsync my music to a directory in the filesystem; on iOS I mount the application filesystem for my music player application (VLC) using ifuse and do the same thing.

Android:

jmtpfs ~/mnt

Mounts the whole phone filesystem on ~/mnt. Now I can copy my music to ~/mnt/Music with rsync.

iOS:

ifuse -o allow_other --documents org.videolan.vlc-ios ~/mnt

Mounts VLC's application filesystem on ~/mnt. Now I can copy my music to ~/mnt/Music with rsync.

A little more regarding application filesystems. The first thing I noticed when using iPhone was that when I wanted to save a picture from the browser to the phone, I had to choose where I wanted it to end up. The two options iOS presents in are Files and Photos. This is strange, conceptually I am saving a file, so the distinction between these two things isn't clear. After I figured out the application filesystem thing this makes a lot more sense; choosing Photos saves the picture to the Photos application's filesystem, saving it to Files saves it to the Files application's filesystem. This seemed like a bizarre abstraction over the very simple concept of a filesystem until I realized that this ties into how iOS does application sandboxing.

iOS doesn't work like Android where an app either has access to the filesystem or it doesn't; on iOS you grant individual apps access to specific paths in the filesystem. There also seems to be a concept of apps asking other apps for permission to access parts of their app filesystems, although this may be the same thing (not sure as I haven't done any iOS development). This is awesome from a security perspective and is something I didn't know I needed until I used it. For example, if I want to send a picture to a channel in Discord on Android, I open the Discord file picker and all photos on my phone are visible from within the application; i.e. Discord has unfettered access to the filesystem. A malicious or buggy Discord could choose to send any picture it wanted, there's no access controls preventing it from doing that. Contrast with iOS; I open the Discord file picker, and by default I see no photos. Instead there's iOS UX there that allows me to grant Discord access to *specific* photos. Once I grant access, then Discord allows me to pick from the photos I've granted it access to. This is a huge deal. This is absolutely how it should be. Filesystem access should be heavily locked down and mediated by the operating system on mobile devices. In retrospect Android is extremely primitive in this regard. It's difficult to explain in text without seeing how it works in practice, but once I used it, I had a moment of “ah, I get it now” and was sold on it.

One other note on this; I'd heard people say “oh but iOS has the Files app now” in response to concerns of restricted filesystem access. It does indeed have a Files app, and this app is interesting. It's a surprisingly comprehensive file management app. It allows you to access select application filesystems - it seems to be limited to ones that apps choose to expose - and some other parts of the filesystem, although the parts that are exposed are clearly curated by iOS. There's obviously no view of the root filesystem. Functionally it feels like porcelain over a bunch of bind mounts or a virtual filesystem being used to present a clean, access controlled interface to stuff iOS has decided you should see. To be honest, I rather like it. The Files app also has the capability to mount remote shares, another pleasant surprise; I was able to add my home Samba server easily and played around with copying music files from it into the VLC app filesystem using just the Files app, which actually worked.

No webm support

I watch a lot of webms. For some reason - I really don't care about the justification - Apple has decided webm is not an ordained format and refuses to implement a system codec for it.

Yeah, this one kind of sucks. Webms just don't load or present as file downloads instead of embedded playback in places where they'd normally embed as videos on Android. Installing VLC and opening the file in VLC works well enough to live with it, but still, this is stupid and for a company that really cares about user experience, they should just implement webms. I don't care if there's a royalty situation or a nonfree codec situation or whatever the issue is. Apple is the world's most valuable company, they can afford to pay royalties so that I can play webms on my $1000+ mobile computer that I bought from them. No excuses.

Lock-in

Vague concerns about being locked into the Apple ecosystem, forced to use only apps approved by Apple, integration with iCloud, etc…

This one is also valid. Lack of first class support for sideloading is a legitimate gripe here. Functionally this means I can't install Newpipe to watch YouTube without ads. I don't know who the hell watches YouTube ads, but I'm not about to spend hours of my life watching that trash. My time is more valuable than that.

Using YouTube frontends like Invidious in the browser works, but it's not really a great experience. Notably, it is still better than the YouTube app with ads, but it's worse than Newpipe where I had my own curated playlists and subscriptions managed entirely through the app (not tied to my Google account).

I'm told that the data shows that people who buy iPhone are much more willing to pay money to solve problems than other people are. I imagine most people solve this problem by paying for YouTube Pro or YouTube Red or whatever the premium YouTube version is that doesn't show you ads. I may end up there but not today. As a matter of principle I refuse. I also think it's complete bullshit that I can't sideload apps on my $1000+ computer. I paid for it, it's mine, let me run my code on it. But this horse has been beat to death so many times, and Apple definitely knows that people will still use iPhone, and they're right about that. I'm still using iPhone.

Positives

Things I like.

UX

Everyone knows this one. iPhone is famous for the UI being buttery smooth at all times. This is real. As much as I wish I didn't, I use my phone probably a couple hours a day. Having nearly every interaction with the device be pretty much glitch/hang-free is such a tangible upgrade over Android.

Minor things like picture-in-picture, context menus, the screenshot editor etc. all work together for an experience that is far more consistent and far more pleasant than Android. For a device that runs large swaths of my life, it's a significant upgrade.

Pictures

When I first wrote this section after getting the phone, I wrote:

It is just a fact that the iPhone takes amazing pictures. Through whatever combination of camera and software, pictures on the iPhone turn out consistently better than any picture I ever took with any Android flagship - and I have owned a lot, from the Nexus 5 through the Pixel 4a. Having a wide angle camera is also awesome, I use that thing all the time.

After two years of using the phone, I now hate the iPhone “look”. I think it's because in that time I purchased a mirrorless camera and started doing enthusiast photography, prompting me to be much more conscious of colors, sharpening, contrast, noise and noise reduction, and all the other things you notice when you start grading your own photography. Now when I see photos produced by the stock iOS pipeline, I'm left wondering why they frequently look *so awful*. In some scenes the photos look good, but in many cases iOS will consistently

oversharpen
oversaturate
apply extreme local contrast

It is possible to shoot in raw on my iPhone, but doing so doesn't match the type of photography I use my phone for. My phone camera is for quick snaps to capture a moment or preserve a memory when I don't have my real camera, or don't want to use it. Oftentimes I want to share the photos I take soon after shooting. Shooting in raw means I need to demosaic, grade, and export that photo. When I take 30 pictures in a day that is too much effort for each photo. I need the computational pipeline to produce something that looks at least OK. The extreme amount of oversharping and local contrast that the iOS pipeline produces just looks terrible.

Here's two versions of the same photo I took of a rock wall in Colorado. I shot this using Halide, which produces both a raw and a HEIC that goes through the usual iOS image pipeline. I applied a neutral grade to the raw, only correcting for exposure, a little bit of chroma and a touch of contrast. Can you tell which one is the iOS photo and which is the raw? Hint: the iOS one looks like nothing that exists on planet Earth.

I guess the pipeline is optimized for what people want to see, but it looks awful to me.

I've also noticed that iOS takes pictures of sunsets that in real life have delicate and beautiful shades of pink and maps all of the pink tones into…orange? It's so egregious I genuinely believe that the pipeline detects sunset photos and applies a specific grade that crushes pinks and produces a very generic looking orange and blue photo.

Security

I said most of what I wanted to say in the filesystem section, but yeah. The iOS security model is clearly much more mature than that of Android. At security conferences there's always a talk or two about breaking iOS application sandboxing. No one gives talks like that for Android. I think that's because breaking iOS is actually impressive. Nobody is surprised that Android is broken.

MagSafe

Wireless charging is dope, but MagSafe is the nicest system I've used out of all of them. I really like the MagSafe charger for iPhone.

General build quality

Apple's build quality is legendary and it's on full display in the iPhone. Hardware silent mode switch is great.

Standard support

This one actually surprised me. iOS has deeply integrated support for standard protocols and technologies into the OS, including:

CardDAV. Completely and seamlessly integrated into the OS. Configured my CardDAV server in the OS settings, contacts sync both ways. It just works. Notably it works better than the Google Contacts mess on Android.
CalDAV. Again, configured in the OS, and it just works. Calendar events sync both ways.
Samba. Yep. Go into the Files app, dots menu, “Connect to server”, put in a smb:// URL. Login prompt, done. Mounted.
FTP, SFTP and I believe WebDAV work same as above.

Overall the situation here is far better than what I experienced on Android.

Negatives

The media situation

The iPhone media library is weird. Apparently iOS has a concept of music, videos and photos being some kind of special entities above and beyond regular files. This kind of makes sense from a historical perspective; the iPhone was originally launched as a 3-in-1 combo device, as Steve Jobs said, “A widescreen iPod with touch controls, a revolutionary mobile phone, and an internet communications device” or something like that. So the media situation on iPhone is a relic of it being conceptualized as having an iPod inside of it, and you use iTunes to manage iPods. I have fond memories from the early 2000's of copying music to my iPod shuffle's mass storage using Windows XP and then the songs just never playing on the iPod because I didn't rebuild the database file…that's still a thing on iPhone, somehow. Android has this in the bag, the way media is indexed and behaves on Android isn't perfect but it's better than iPhone. Media is files. I should be able to copy the files to disk and then the Music app should see them and play them, full stop. VLC for iOS is an all-in-one alternative solution to the iOS system media apps, but again, it shouldn't be necessary. At the very least if Apple wants to lock users into iTunes it needs to support iTunes on all major operating systems. And Linux is a major operating system. I use Arch btw.

Sharing videos

Compression

This one is bizarre. iOS heavily prioritizes the ability to share media. All of their commercials show users sharing pictures and videos. But what they don't advertise is that it is extremely difficult to share files without incurring mandatory compression.

You see, when you share a media file using the “Share” button from the Photos app, iOS determines whether or not the file is “too big”. If it's too big, it will heavily compress the file before sending it. So for example, if I post a 4k video I took on my iPhone to a channel in Discord, iOS will first compress the video before sending it to Discord. The compressed result invariably is noticeably much worse quality than the original file. Furthermore, there is no option to control this behavior. There is no toggle to disable this compression.

This behavior is super weird. iPhone can take 4k60 video, but if you try to share that video using the builtin OS facilities, you never get 4k60 video. You get something like HD 30 video. In fact, short of plugging your phone into your computer, there is no way to get the full quality file out of the device! This makes NO SENSE! Why advertise the ability to take high quality media and then completely crush it when the user shares it?

What Apple is doing here is prioritizing frictionless sharing over quality. Users do not want to wait 30 seconds for a 800mb video file to upload, and they don't want to wait for the recipient to download it. Everything is much more responsive if the file is <100mb; the upload is near instant, the recipient can retrieve it faster, and the user gets the serotonin hit from the reaction sooner. So iOS compresses anything big. But this completely defeats the purpose of being able to take high quality video for me. The idea is that I'm supposed to be able to share everything right from my phone, right? Isn't it very un-Apple to have to plug the device in and copy the file off to share it? This is exactly the sort of thing Apple explicitly designs out of its products, and yet here we are. Just give me a toggle that says I want to share the full size media file and not compress it, that's enough!

Don't believe me? https://stackoverflow.com/questions/3159061/avoid-video-compression-when-selecting-movie-with-uiimagepickercontroller/5893066#5893066

iMessage video length limitations

iMessage is Apple's proprietary messaging protocol. Messages between iOS users are automatically upgraded to use iMessage, which adds capabilities over regular SMS like reactions, ability to share large files, and so on.

However one thing that you cannot do is send long videos. I tried to send a 9 minute video to a friend via iMessage and received this message:

Video is too long. Note well that this does not say “Video is too big”. I could understand a file size limit. But this video is 18.4mb, very small by today's standards. To check that this is an actual limit on length, I zipped the video with a resulting file size of 17.9mb and then tried sending the zip. That worked flawlessly.

As is usually the case with looking up information on iOS online, nearly all of the explanations I found for this behavior (except this one incorrectly cite maximum file size limitations as the reason “Video is too long” appears. We have just shown that it is, in fact, a length limitation and not a size limitation. There is zero technical reason I can think of that there should be a length limit on videos.

Working with large files

Sharing just a few files of relatively limited size works usually works flawlessly on iOS. But what if you want to share 7gb of photos? Should work exactly the same, right?

If you try to share a large quantity of data, regardless of whether it is from the Photos app, or Files, iOS is liable to do one of the following:

1. Nothing 2. Freeze

Try it for yourself. Go into your Photos app and, as a test case, select every photo in your Recents album, and then hit the share button and see what happens. Odds are that nothing will happen. The usual share dialog will simply not appear, or it might show up after a few minutes. This is very bad UX. If you are going to fail, do it immediately.

If you try this same exercise in the Files app, you may even see it freeze. Not only does the share dialog not appear, the app actually goes unresponsive. This is a native system app built and distributed by Apple, running on Apple's operating system, on Apple's hardware. This is exactly what Apple claims they prevent by imposing all these limitations on iOS, yet their own system applications fail miserably as soon as you put a heavy lift on them.

This is a recurring theme. Apple has very clearly designed iOS to be optimized for handling small files, small amounts of data, with a focus on the speed of sharing rather than the quality of the shared data. Android is a very strong winner here.

iCloud integration

Fuck off, I don't want your cloud service and it shouldn't be integrated into my $,$$$ computer.

Lightning

This isn't a huge deal so far but I really wish it just had type c.

Update 07/23/22

Turns out this is a huge deal. When I purchased this incredibly expensive flagship smartphone which was released to market in September 2021, I assumed that it would provide a physical interface capable of supporting at least USB 3.0. I did not check this. USB 3.0 was published in 2008. Virtually every smartphone made in the past decade has had USB 3.0. Not iPhone! The lightning connector offers, unbelievably, USB 2.0. The USB 2.0 spec was published in April 2000. It offers a maximum data rate of about 480 Mbit/s ≈ 60mbps. Compare to 3.0 which offers 5 Gbit/s ≈ 500mbps.

This is absolutely irredeemable dog shit. It is unbelievable that Apple of all companies is selling computers that do not offer a 12 year old standard. If I had known this, I would not have purchased the iPhone.

Bluetooth

Not even Apple can get this perfect it seems. I have multiple pairs of wireless earbuds and the iPhone seems keen on connecting to as many as it possibly can. I'll be using one pair, and suddenly the audio will stop and I'll hear a faint tinny sound coming from somewhere else in my domicile, because iPhone decided to connect to a different pair of headphones and route the music over there. It's especially annoying when it happens on a VoIP call.

I expected more from Apple in this department, they clearly pay obsessive attention to UX, bluetooth issues are oddly out of place.

Face ID?

Face ID is cool. It works most of the time. The problem is that it doesn't work all of the time, and in particular, it works less of the time than the fingerprint reader on my Pixel 4a did. The fingerprint reader didn't work when my hands were wet, but other than that, it was much more consistent than Face ID has been.

Price

My iPhone 13 Mini carrier-unlocked from Apple with AppleCare+ cost $1,100. That is insane.

Mids

Blue bubble

Ok, this is more of an anthropology piece than anything, but it's kind of interesting to write about anyway. Apple has created a genius status symbol in iMessage. If two iPhone users text each other, Apple automatically upgrades the conversation to use iMessage, their encrypted messaging solution. In this case the text bubbles are blue. But if an iPhone user texts a non-iPhone user, iMessage is unavailable and the connection falls back to SMS. In this case, the iPhone user sees the messages as green.

Because iPhones are seen as the premium choice of phone among millenials and later generations, being a “green bubble” is tantamount to failing a status symbol check. Youth refer to non-iPhone using youth as “green bubbles”. It's like showing up to home room wearing gap instead of bape. Since many people retain this particular kind of lizard brain into adult life, having an iPhone can be social grease when texting such people. I don't condone it but pretending it isn't real is just being naïve.

Conclusions

I'm keeping iPhone. Overall it is MUCH more enjoyable to use than flagship Android devices, and while I have gripes with it, I've solved all of them one way or another (except for ad-free YouTube (edit: solved with Invidious + Yattee). Security is clearly much better. It's a pleasure to use because of the buttery smooth UX. Filesystem access is surprisingly good while also maintaining strong application sandboxing.

Lack of sideloading sucks and the phone is overpriced. I wish there was a company that made a good phone.

from blog, technology, products

just

Anonymous (anonymous@undisclosed.example.com) — 2026-04-03T03:37:03+00:00

the word “just” is often used in response to stated problems, usually in sentences like this:

“Why not just x the y and then you get z”

I've observed that this is frequently counterproductive. There are a few possibilities:

- The suggestion has already been thought of and is much harder than it seems

In this case using the word “just” implies that the suggestion is simple, easy, anyone could do it. Usually this isn't the case and using “just” both makes the suggester look dumb for trivializing the problem and annoying to the problem haver who's already thought of this possibility.

- The suggestion has not been thought of

Why say “just”? Just say your suggestion. Using “just” makes it seem like it was obvious. Even if it is obvious, what purpose does it serve to highlight that?

—

similar to the word obviously in a student/teacher environment

someone i know

humanity, technology, programming

location_history

Anonymous (anonymous@undisclosed.example.com) — 2025-10-10T20:15:03+00:00

location history

Sometimes I want to see where I was at a given point in time. There's many sources of personal location history, some obvious, some less so.

Google Timeline is particularly nice. It provides a UI to pick a calendar date and view GPS tracks on a map. But, it only shows points recorded by Google Maps. There are many more sources of location data which we can leverage. It would be nice to see those on the map too; and of course, not using Google services is always a plus.

Database

I want a time series of GPS coordinates. Each [timestamp, coordinate] pair should indicate where I was at that time. At time of writing I can only be one place at a time, which drastically simplifies the problem.

Once I have that database we can leverage it for ✨ actionable insights ✨.

To get this database, I need a thing that can ingest time series location data from any source. I mentioned these thoughts to a friend in mid 2025 and predictably he told me that several options already exist (like most good ideas I have). These include:

Traccar - Primarily geared towards supporting hardware GPS devices, but has a robust storage framework and map view. Has a native iOS app. Points are stored in TimescaleDB which is exactly what I want
dawarich - I am using this now. It works but performance and stability seems poor. It has a native iOS app which is a killer feature.
owntracks

Sources

music_management

Anonymous (anonymous@undisclosed.example.com) — 2025-11-04T03:19:02+00:00

music management

I'm a big music enjoyer. What I'm not a big enjoyer of is streaming services. Maybe I'll write another article about that, but the short of it is that instead of paying a company to rent temporary access to their music library, which they pay to license from a label who in turn pays only some tiny fraction of their revenue to the artist, I prefer a more traditional model:

you find some new music
you listen to it a few times to see if you like it
if you like it, you pay the artist for a copy
you own that copy

That way the artist gets money for making art and you pay once to own a copy of it instead of renting temporary access.

Streaming is good for the first two steps. Finding new music is hard, and you have to listen to it a few times at different times, since it might only hit in a certain mood. Starting from music you already like and letting the recommender algorithm drive discovery is a good way to find new music. After that though, I prefer to pay the artist for their work instead of paying rent, and prefer to download the data once rather than download it every time I want to listen to music. Bandwidth is a limited resource!

One of the benefits of owning music is that you can put it on whatever device you want and use whatever program you prefer to play it. However, if you have multiple devices then getting your music collection available on all of them becomes an exercise in file management. This article roughly depicts how I solve it.

Methods

Here's a chart that shows a rough outline of data flow:

flowchart TD Source -.-> |download| staging W["Windows VM"] subgraph server["<em class='u'>server"] staging --> |beet import| library library --> W end subgraph devices["devices</em>___"] library -.-> |syncthing| desktop(("fa:fa-computer desktop")) & laptop(("fa:fa-laptop laptop")) W -.-> |tunefusion| phone(("fa:fa-mobile-phone phone")) end click phone "<a href='https://www.dbpoweramp.com/tunefusion.htm' class='urlextern' title='https://www.dbpoweramp.com/tunefusion.htm' rel='ugc nofollow'>https://www.dbpoweramp.com/tunefusion.htm</a>"

In short:

Acquire the music from somewhere; for me, I usually buy it on Bandcamp
Download it to a “staging” directory on my home server
Log into the server and run beet import, pointing it at the staging directory. This adds the music to my library database, cleans up tags, pulls album art, properly names the files and copies them into my “Artist/Album/<files>” library directory structure, applying my chosen file naming scheme. beets slaps.

The rest of the diagram depicts how the 3 devices I play my library on end up with access to my music.

Desktop & Laptop

My server, desktop and laptop all run Syncthing. The music directory is synchronized to all devices using that.

In the past, both of these devices mounted the directory containing music via NFS. Since they're all on a Tailnet together this worked as long as both the server and client were both online, regardless of the routing environment. This worked pretty well - latency was never an issue, and in any case I rarely needed to play from my laptop since I usually use my phone when I'm outside my home network. However, I didn't like the network requirement and realized disk space is plentiful while bandwidth is a scarce commodity. Since I generally frown upon streaming when it isn't necessary I put my money where my mouth was and switched to file synchronization.

For playback on the computer, I prefer tauon music box.

Phone

The phone is a little trickier. Ideally I would use the same approach as for my desktop and laptop - run a sync program to keep the music library up to date on my iPhone disk. Unfortunately, that's not how things work on iOS, for two reasons:

background daemons cannot really exist on iOS
the concept of a filesystem that is shared between apps does not exist on iOS

Regarding backgrounding, in general iOS is very strict about apps performing any work in the background. Since sync programs are designed around running in the background, this more or less precludes the file synchronization strategy. It's worth noting that this could be worked around using iCloud, but since I don't use iCloud, that doesn't work for me.

Even if a sync program was viable on iOS, we would hit another blocker. iOS does not have the concept of a shared filesystem. Apps are only able to write to their own sandboxed filesystems. Consequently any files downloaded by a sync app would not be accessible by a music player app.

The upshot is that to solve this problem you need a music playback app that also has its own syncing service built in. Obviously this is heretical. A music player should focus solely on playing music, while a syncing application should handle data sync. The result of that being impossible is the app store has a bunch of terrible apps with names like “Network music player ULTIMATE” that have varying levels of support for playback and/or sync to/from various data sources - Samba, WebDAV, whatever else you can think of. I've tried most of them and they all suck.

I can already hear you saying, “why don't you just play back your music over the network using a network player”? In addition to the available apps sucking, network conditions on mobile are variable enough that streaming from a home server results in a generally poor experience. Industrial streaming services like Spotify have to go to extreme lengths to paper over the network enough to deliver a good experience. “Pinning” - where you stream but select specific items to keep locally on disk - doesn't really work for me because I don't want to choose what music to listen each time I anticipate a no-network scenario.

Anyway, as luck would have it, the best music player on iOS also has the best sync solution I've seen. The downside is that the companion program that runs on your server

is Windows only
is closed source
costs money

However, it is surprisingly full featured and works very well. Since it's Windows only, I run it inside a windows VM on my hypervisor (which also hosts the file server with my music library). The VM has the music directory mounted from the file server via Samba.

The end result is that every time I open the foobar2000 app on iOS, any new music in my library downloads to my device. After that it's available for local playback. Since my phone is also on Tailscale, this works anywhere.

Historical methods

I used to do it a much more complicated way than depicted above because I had an Android phone with not enough storage to store my lossless music collection. Android meant I could run background file syncing utilities and not enough storage meant that I had to transcode my collection to something lossy in order to crunch it down small enough to fit on my phone. Buying an iPhone with 512gb of storage meant that 1) I lost the ability to run any kind of background syncing software because iOS doesn't really allow daemons to exist (unless Apple made them) and 2) I no longer needed to transcode as my music collection is only ~115gb which fits on my phone's internal storage. Thus all of the automatic cron jobs to do periodic transcoding and sync via syncthing etc are no more.

These are the unintelligible notes I took about how I used to do it, replete with ascii diagrams from a time before I caved a little bit on my static site elitism and just used mermaid:

1. Tx from source to local staging directory 2. `beet import` from staging directory into mounted remote share[0]

                 { source }
                     |
                     .
                    ---   (net) <1>
                     .
                     |
                     v
              [ local:music ]
                     |
                     .
            beet    ---   (net) <2>
           import    .
                     |
                     v
      [ remote:music => local:remote/music]

3. cron job on remote periodically copies new files into a sync directory,

 transcoding any lossless files to `-q6` ogg vorbis to reduce size[1]

             [ remote:music ]
                     |
                     |
    music-sync.sh    |    @ 2hr <3>
                     |
                     v
           [ remote:music-sync ]

4. sync directory shared to all devices via syncthing[2]

           [ remote:music-sync ]
                     |
                     |
                     .
        syncthing   ---   (net) <4>
                     .
                    ...
                   . . .
                  .  .  .
                 .   .   .
                /    |    \
               v     v     v
            phone  laptop  idk

[0] <https://beets.io/>

[2] <https://syncthing.net/>

#!/usr/bin/fish
set MUSICDIR "./music/"
set SYNCDIR  "./music-sync"
 
for dir in (find "$MUSICDIR" -type d | cut -d'/' -f3-)
    mkdir -p "$SYNCDIR/$dir"
end
 
for file in (find "$MUSICDIR" -type f -name '*.flac' -o -name '*.mp3' -o -name '*.ogg' | cut -d'/' -f3-)
    set ifile (echo "$MUSICDIR/$file")
    switch $file
    case "*.flac"
        set ofile (echo "$SYNCDIR/"(echo "$file" | sed "s/flac/ogg/"))
        if test -e "$ofile"
            echo "$ofile exists; skipping"
            continue
        end
        echo ">> Transcoding '$ifile' to '$ofile'"
        oggenc -q6 -o "$ofile" "$ifile"
    case "*"
        set ofile (echo "$SYNCDIR/$file")
        if test -e "$ofile"
            echo "$ofile exists; skipping"
            continue
        end
        echo ">> Copying '$ifile' to $ofile"
        cp "$ifile" "$ofile"
    end
end

from blog, technology, self-hosting

my_web

Anonymous (anonymous@undisclosed.example.com) — 2025-02-14T18:50:38+00:00

my web

In recent years I've become disillusioned with 3rd party hosted web services. I don't like:

tracking & advertisements
lack of control over where my data is physically stored
lack of control over what is served to people who visit my pages
privacy policies
data breaches
nebulous copyrights
getting logged out constantly
constantly changing UIs
bait and switch (free to paid)
lock-in
incredible journeys
google

Consequently I've been steadily migrating to hosting everything I need myself. At this point the only things I don't self host are email and Github, which is just a portfolio piece these days.

My choices in software lean heavily towards stability, sometimes at the expense of my other technological values of elegance and minimalism. Fun as it is, I have other stuff to do than play sysadmin in my limited free time. For the same reason everything is dockerized as a hard requirement, so I prefer software with good support for that already.

I wrote a technical overview of how I run all this crap if it interests you.

An overview of what I self host to follow.

private

This stuff is only accessible on my personal intranet.

archivebox - personal Wayback Machine. Kinda like bookmarks for data hoarders.
gitea - personal git server. Like a lightweight Gitlab.
healthchecks - cron monitoring. I use this primarily to monitor backups on my devices, so I get emailed if backups start failing.
invidious - youtube frontend. Video browsing free of engineered distraction. Combined with a compatible mobile client (such as Yattee) it also achieves ad-free youtube on iOS without resorting to jailbreaks.
miniflux - rss reader. I probably need a better solution for RSS - probably a mobile app - as I rarely check it.
nextcloud* - calDAV, cardDAV, task tracking. The kitchen sink of self hosting, but most of the apps it has aren't great compared to dedicated software. I use it primarily for calDAV and cardDAV. Heavier than what I need for those applications but it's nice to be able to try out nextcloud apps when I hear about them
photoprism - personal photo server. The GOAT. Photoprism has it all - CV content tagging & face recognition, manual tagging, RAW rendering, sidecar handling, location & map views, calendar views, albums, comprehensive search, pleasant design & obsessive core devs.
quassel core* - IRC bouncer
tandoor - recipe book; capable of extracting recipes from web urls, similar functionality to justtherecipe et al
text-generation-webui - locally hosted LLMs. Super convenient, just plug in the model name on huggingface and it will download it and serve a chatbot-style web UI
Monica - personal CRM. Lets me track things about people I know - birthdays, pets, kids, s/o's, significant life events, things like that. Can send email reminders of things as well. I'm a very forgetful guy and this helps me keep up my relationships with others. Probably will replace Nextcloud cardDAV for me at some point

public

All the stuff you can get to on the web.

akkoma - fedi microblogging. That means twitter for you ~~normies~~ mainstream folks. https://social.qlyoung.net/
dokuwiki - wiki. You're on it.
maloja - scrobbles. It shows you what music I've been listening to, when I listen to it on clients that support reporting that information. https://maloja.qlyoung.net/
peertube - video hosting. Fediverse native via ActivityPub. Supports remote transcoding & S3 compatible storage for videos; consequently can be a very cost efficient platform for self hosting video (think < $20/mo). https://qtube.qlyoung.net/
piwigo - photo gallery. There are lighter options, but I like the album management interface and built in support for plugins and themes. Very stable. https://photos.qlyoung.net/
matrix* - chat server. Kind of a huge pain in the ass to self host, but once set up, you can plug almost every other chat program in the world into it - even stuff like facebook messenger and whatsapp. Largely eliminates chat platform conversations.
```
@qlyoung:qlyoung.net
```

*Observant readers will note that not all of this stuff is/need be web based

technology, self-hosting

network_simulation_with_k8s-topo_on_raspi_cluster

Anonymous (anonymous@undisclosed.example.com) — 2024-01-06T05:24:25+00:00

network simulation with k8s-topo on raspberry pi 3b+ cluster

This post covers how I set up k8s-topo on a Raspberry Pi cluster to perform network simulations. k8s-topo is a sweet project that lets you spin up arbitrary network topologies on Kubernetes clusters. The router nodes can be cEOS, Quagga, or FRR. However, on ARM, the only supported router image is FRR since it's the only one that currently has ARM images available. Here's a picture of the cluster:

If you're curious, the backplane is a Bitscope Blade. I'd like to write another post on how to set up and provision such a cluster when I find the time. You can run some pretty big topologies even on such a small cluster, such as this 40-node random topology:

Overall it's a capable, compact setup for experimenting with software routers. In my role as a maintainer for FRR it serves particularly well as a testbed for that project, especially for development related to our Docker images.

Fair warning: this involves a lot of source builds. The software industry - and this is especially true of the k8s / Docker communities - is largely an amd64 monoculture these days, and our target platform is ARM. Furthermore, Kubernetes is notoriously complicated and somewhat underdocumented and takes full advantage of semantic versioning to regularly break its APIs between versions. Similarly, the Go ecosystem is still a moving target and language features relied upon by tooling often require recent versions. Finally, anyone who's worked with Kubernetes before knows that there's really no such thing as Kubernetes; there's only Kubernetes implementations, each of which have their own little quirks that like to block you. k3s seems to be one of the better ones in this regard but there are still quirks.

Because of these factors, and because of the painfully slow build time of large software on Raspis, this project is a rather involved and will probably take at least a full day. Nevertheless, with perseverance, we shall prevail.

Prerequisites

A k3s cluster of Raspberry Pis, or similar armv7l devices with hard float support
Raspbian 10
bash - all of my command lines are specific to bash but could be adapted to other shells. Also, they're all implied to be root shells.
Docker, on the master node:

apt install docker.io

Patience

I cannot emphasize hard float enough. Unfortunately nobody cares about soft float devices, especially Python. If you are on soft float do not waste your time. If you do attempt this project on soft float and succeed, I'd love to hear about it.

Note that while my target device, Pi 3B+, is a 64-bit platform, I have tried to avoid taking the easy way out and downloading prebuilt arm64 binaries. That is what got us into this monoculture mess to begin with. I do liberally download 32 bit armv5 binaries though, because some of the tools used can take days to build on a Raspberry Pi (looking at you protobuf). These should be largely compatible across most ARM devices.

Also, before we go any further, add this line to the end of your .bashrc:

export KUBECONFIG=/etc/rancher/k3s/k3s.yaml

A lot of tools look at this environment variable to know where the k8s global config is.

Guide

Best to begin from the top.

End goal: Get k8s-topo running.

Step 1: Install Dependencies

The main thing k8s-topo needs is a way to configure appropriate network devices in a Kubernetes-sanctioned way; something to sit on top of the “native” Kubernetes networking sludge and provide a playground to allow us to create interfaces accessible to our containers and wire them up. k8s-topo supports two methods of configuring the network resources it needs.

The first is via a “CNI plugin” (Container Network Interface). When k8s is told that it needs to create some network resources, it first looks at a predetermined location on the node - typically /etc/cni/net.d/ - for a config file(s). This config file tells it which CNI plugins are available and which one to call. In particular, the config file specifies the path of the plugin binary, some general k8s-related options, and some binary-specific options to pass. K8s then calls this binary, passes it the requested state of the cluster network in environment variables, and expects the binary to make it so. The binary itself typically interacts with the k8s API server to perform its actions, although it may do so indirectly by way of other tools, or even with other CNI plugins.

The author of k8s-topo, @networkop, has built a CNI plugin called meshnet-ci. There is a nice (but slightly outdated) writeup on it here. Tl;dr it creates veth 's for connectivity between pods on the same node and runs a daemon on all the nodes to coordinate creation of VXLAN p2p links for cross-node pod connectivity. When I started on this project, it didn't have support for k8s 1.18, which is what I was using. After opening a GitHub issue asking dumb questions in which I mentioned this fact, he updated it to support 1.18 (thank you!). By that time I had already attempted to use the other supported method, NetworkServiceMesh. I got pretty far, but ultimately ran into some behavior that appears to be either a bug in NSM or a misconfiguration by me that I was not able to solve. For completeness, I'll cover my attempts on that front in case you want to try this method out. Maybe someone reading this will tell me what I did wrong.

NetworkServiceMesh does sort of the same thing as meshnet-cni, but in a different way. Since my end goal was really just to get my network sims going I didn't spend too much time researching what a “Service Mesh” is, but in NSM's case it seems to mean sidecar containers that deploy alongside your pods and provide network connectivity things.

I've detailed my efforts towards setting up NetworkService mesh below, but it's collapsed to save a bit of space.

<summary markdown=“span”> <b>Setting Up NetworkServiceMesh</b> </summary>

I was not able to get this working. I feel like I got pretty close, so if you're adventurous perhaps you can figure out the last piece of the puzzle, I would love to know about it.

NSM is deployed with Helm, so we have to set up Helm first. Helm is like a package manager for k8s.

Download a Helm binary release from the GitHub releases page. NSM only supports Helm 2, so we'll need to install that first. At time of writing, 2.16.7 is the latest version, so that's what I used. Make sure to download the arm archive.

(Actually shortly after I wrote this, NSM gained support for Helm 3. I didn't try it since Helm 2 works.)

wget "https://get.helm.sh/helm-v2.16.7-linux-arm.tar.gz"

Extract the archive and “install” Helm:

tar xvzf helm-v2.16.7-linux-arm.tar.gz
cp linux-arm/helm /usr/local/bin/helm

The Helm client is now installed. Next step is to install the backend, called tiller. k3s is a bit particular regarding permissions, so we need to give tiller its own k8s service account to do stuff with.

kubectl -n kube-system create serviceaccount tiller
 
kubectl create clusterrolebinding tiller \
  --clusterrole=cluster-admin \
  --serviceaccount=kube-system:tiller

References:

Now we start getting to the x86 monoculture stuff.

The backend for Helm, tiller, runs in a container in the k8s cluster itself. Despite the Rancher docs claiming you can simply helm init, in reality, if you do this Helm downloads and deploys an amd64 tiller image. Obviously on ARM this won't work; it will just crash with exec format error. We need an ARM image. As it turns out, Helm doesn't actually build these, because real computers are all amd64, right?

Fortunately, someone looking out for us aliens builds ARM images of tiller and publishes them on his personal DockerHub registry. I could write another post railing against binary-only dependencies downloaded from random people on the internet, maybe another time. Hopefully his registry is still available when you're reading this document. If not you'll have to find out how to build tiller for ARM yourself.

To initialize Helm with an appropriate backend image:

helm init --service-account tiller --tiller-image=jessestuart/tiller:v2.16.7

Note the tag. If you downloaded a later version of Helm 2 earlier, you'll need to change the tag version to match. The backend version must match the client version (you can see what you installed with helm version).

Next we'll have to build NSM ourselves, because they don't provide images for anything except amd64.

Much of NSM is written in Go, so we need the appropriate Go version. Since Go is rapidly changing, you might have to tweak the version listed here; at time of writing, NSM requires Go 1.13. Other things require Go, and 1.13 worked for everything else I built, so this seems to be a good version.

Install Go 1.13:

wget "https://dl.google.com/go/go1.13.11.linux-armv6l.tar.gz"
tar -C /usr/local -xzf ./go1.13.11.linux-armv6l.tar.gz
export PATH=$PATH:/usr/local/go/bin

Clone the NSM repo:

git clone https://github.com/networkservicemesh/networkservicemesh.git
cd networkservicemesh

NSM has two forwarding plane implementations available. One is based on VPP (the default), the other uses the kernel. The VPP image, naturally, doesn't support our particular flavor of ARM:

root@clusterpi-master:/home/pi/vpp-agent# make prod-image
IMAGE_TAG= ./docker/prod/build.sh
Current architecture (armv7l) is not supported.

Fortunately the kernel forwarder does support ARM, so we'll use that one instead.

Not having found anything in the NSM docs about how to properly build this thing for ARM, very hacky procedures follow.

By default, the recommended make invocation in the NSM docs builds test images, one of which uses the VPP forwarder, so we need to turn that off. Also turn the forwarder itself off.

cd into your NSM clone and apply the following patches:

Patch 1:

diff --git a/forwarder/build.mk b/forwarder/build.mk
index 0d24b89f..23c1cac4 100644
--- a/forwarder/build.mk
+++ b/forwarder/build.mk
@@ -12,7 +12,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-forwarder_images = vppagent-forwarder kernel-forwarder
+forwarder_images = kernel-forwarder

Patch 2:

diff --git a/test/build.mk b/test/build.mk
index 97354fbf..d1aff0d3 100644
--- a/test/build.mk
+++ b/test/build.mk
@@ -14,7 +14,7 @@
 
 test_apps = $(shell ls ./test/applications/cmd/)
 test_targets = $(addsuffix -build, $(addprefix go-, $(test_apps)))
-test_images = test-common vpp-test-common
+test_images = test-common # vpp-test-common

At this point we can build the project. This takes about an hour on my Pi 3B+.

make k8s-build

In order to work around some other stuff, we'll need raw tarballs of the Docker images we just built. There's a make target to save all those.

make k8s-save

Your built images are now in your local docker registry, but k3s doesn't use that, it has a private one. If you try to deploy the NSM Helm chart at this point, you'll end up pulling the amd64 images. These images will then be cached on every single one of your nodes, and will not be pulled again due to the pull policy in NSM's pod specs being IfNotPresent, leading to much pain.

In case you already did this by mistake, you'll need to log into each node and run the following to delete the amd64 images from the cache:

k3s ctr images list | grep networkservicemesh | cut -d' ' -f1 | xargs k3s ctr images remove

We now need a way to make our Kubernetes pods use our locally-built ARM images. There's two ways of doing this, the correct way and the hacky way. The correct way is to set up a Docker registry, retag all of the images we just built and upload them to this registry, reconfigure your entire cluster to use this registry, and rewrite the Helm charts to point at it instead of the default docker.io. The hacky way is to just inject our images into the image cache on each node so that the nodes believe they have the latest version of the upstream images and thus defer to our cached ARM images instead of the upstream amd64 images.

You could also create a local registry and serve your images from there; I tried this, ran into some TLS issues, canned it.

Hacky way

All the images you saved in make k8s-save should be in build/images as tar archives.

On each cluster node: - scp the images to your node, like /tmp/images - Run this:

for file in ./*; do k3s ctr images import $file; done

Note you'll have to do this for other images later on, so it's probably better to just use DockerHub.

Correct Way

Retag your built images and push them to your personal DockerHub repository.

Now, at last, you can deploy NSM:

SPIRE_ENABLED=false INSECURE=true FORWARDING_PLANE=kernel make helm-install-nsm

At this point the containers deployed successfully, but the problem I ran into was some kind of communications between two of NSM's containers, similar to this bug.

By this time meshnet-cni was ready to try again so I went in that direction again.

—

</details>

Instead of NSM I ended up going with meshnet-cni, and I recommend you go this route as well; it's lighter, simpler and created by the author of k8s-topo specifically for use with that project. Consequently, changes to one are less likely to break the other :)

Setting up meshnet-cni

Just like with NetworkServiceMesh, we have to make a lot of adjustments, build custom images, etc. I've already done these and put them in a fork of meshnet-cni, so rather than walk through the necessary changes you can just clone my branch:

git clone --single-branch --branch k3s-arm https://github.com/qlyoung/meshnet-cni.git

Brief summary of changes made:

Change all binary downloads to fetch ARM versions
Modify CNI config files for k3s Flannel
Remove node selectors that restrict to amd64 nodes
Change docker images to point at ARM-compatible builds with above changes
Modify CNI config paths to place them in the custom k3s locations

The last one does require some manual patching. k3s does not use the standard /etc/cni/net.d location for CNI configs. It will only look at that directory if you disable the built-in CNI, Flannel. However, meshnet-cni works by layering additional network resources *on top* of resources created by a lower-level CNI referred to as the “delegate”; in this case Flannel. If we disable Flannel and replace it wholesale with meshnet-cni, things will not work, but if we leave Flannel enabled, then /etc/cni/net.d is completely ignored. This is an unfortunate design choice by k3s that also precludes use of other CNIs that follow the “delegate” pattern, such as Multus. However, we can workaround this by simply installing our CNI to k3s's custom location, which is /var/lib/rancher/k3s/agent/etc/cni/net.d.

But it gets more complicated. That path is where the CNI configs go, but the CNI binaries go somewhere else, again not the default k8s location. And in the case of the binaries, the k3s equivalent path includes a cluster-specific GUID . We need to find this GUID and tweak meshnet-cni before installing to know it. Fortunately this customization is only relevant for the k8s manifests and doesn't need to be hardcoded in the Docker images, so you can use the k3s + ARM images I've already built instead of having to build your own.

To find the GUID:

ls /var/lib/rancher/k3s/data

There should be a single directory there whose name is a long hash-looking string, in my case:

#  ls /var/lib/rancher/k3s/data
ec54df8c1938fe49660230d16334b4c7e83888a93e6f037fd8552893e2f67383/

To make sure meshnet-cni binaries make it into this location, cd into your meshnet-cni repo and run this, replacing YOUR_GUID with the GUID you just found:

export K3S_CNI_GUID=<YOUR_GUID>
sed -i -e "s/YOUR_K3S_GUID/$K3S_CNI_GUID/g" manifests/base/meshnet.yml

Now you should be ready to deploy meshnet-cni. To do this:

apt install -yqq build-essential
make install

If the installation was successful you should now have a meshnet-cni agent pod running on each node. Verify this:

# kubectl -n meshnet get all
NAME                READY   STATUS    RESTARTS   AGE
pod/meshnet-p7mmq   1/1     Running   2          15d
pod/meshnet-b66vp   1/1     Running   2          15d
pod/meshnet-wqlvz   1/1     Running   0          43s
pod/meshnet-6jk7g   1/1     Running   0          43s
 
NAME                     DESIRED   CURRENT   READY   UP-TO-DATE   AVAILABLE   NODE SELECTOR   AGE
daemonset.apps/meshnet   4         4         4       4            4           <none>          15d

With luck you should be good to go, and meshnet-cni is now ready to create the necessary VXLAN devices as directed by k8s-topo.

Step 2 - Disable load balancer

Now that we have our overlay (meshnet-cni) deployed, we're ready to deploy k8s-topo.

Not!

By default k3s runs a load balancer, which binds ports 80 and 443 on every node. k8s-topo wants those, so if you try to deploy k8s-topo now, your pods will remain in Pending because port 80 is in use. Don't bother trying to netstat -tln, port 80 won't show up. But it's still in use. Kubernetes logic.

Anyway, we need to turn that off:

https://rancher.com/docs/k3s/latest/en/networking/#traefik-ingress-controller

https://github.com/rancher/k3s/issues/1160#issuecomment-561572618

Copied here for posterity:

1. Remove traefik helm chart resource:
>    kubectl -n kube-system delete helmcharts.helm.cattle.io traefik
>    
2. Stop the k3s service:
>    sudo service k3s stop
>    
3. Edit service file /etc/systemd/system/k3s.service and add this line to
ExecStart:
>    --no-deploy traefik \
>    
4. Reload the service file:
>    sudo systemctl daemon-reload
>    
5. Remove the manifest file from auto-deploy folder:
>    sudo rm /var/lib/rancher/k3s/server/manifests/traefik.yaml
>    
6. Start the k3s service:
>    sudo service k3s start
>    

Probably a good idea to reboot your master node here for good measure.

And finally, we can deploy k8s-topo.

Step 3 - Install k8s-topo

Now that we have our overlay (meshnet-cni) deployed, we're ready to deploy k8s-topo.

As with meshnet-cni, k8s-topo requires patches to work on ARM. These patches are much less extensive than the ones to meshnet-cni since nothing needs to be changed to accommodate k3s; the changes just point the images to the ARM-compatible ones I've built and published in my own DockerHub registry.

Pull my ARM-compatible fork of k8s-topo:

git clone --single-branch --branch k3s-arm https://github.com/qlyoung/k8s-topo.git

One notable change is that I've also added support for FRR, which is a significantly upgraded fork of Quagga. The rest of the images will still pull amd64 versions and so at this time the only image you can choose for your topology simulations is the FRR image.

Now you can deploy k8s-topo onto your cluster:

cd k8s-topo
kubectl apply -f manifest.yml

Voila.

Verify that the k8s-topo control pod and associated services have been created:

root@clusterpi-69 # kubectl get all
NAME                            READY   STATUS        RESTARTS   AGE
pod/k8s-topo-86cbbdbddb-xrwlm   1/1     Running       0          55s
 
NAME                       TYPE        CLUSTER-IP      EXTERNAL-IP   PORT(S)        AGE
service/kubernetes         ClusterIP   10.43.0.1       <none>        443/TCP        22d
service/k8s-topo-service   NodePort    10.43.111.199   <none>        80:30000/TCP   56s
 
NAME                       READY   UP-TO-DATE   AVAILABLE   AGE
deployment.apps/k8s-topo   1/1     1            1           56s
 
NAME                                  DESIRED   CURRENT   READY   AGE
replicaset.apps/k8s-topo-86cbbdbddb   1         1         1       55s

That's it, we're done!

Step 4 - profit

Now you can log into the k8s-topo control pod and use the CLI tools there.

root@clusterpi-69 # kubectl exec -it deployment/k8s-topo -- sh
 
/k8s-topo #
/k8s-topo # k8s-topo -h
usage: k8s-topo [-h] [-d] [--create | --destroy | --show | --eif | --lldp | --graph] topology
 
Tool to create network topologies inside k8s
 
positional arguments:
  topology     Topology file
 
optional arguments:
  -h, --help   show this help message and exit
  -d, --debug  Enable Debug
 
Actions:
  Create or destroy topology
 
  --create     Create topology
  --destroy    Destroy topology
  --show       Show running topology
  --eif        Enable ip forwarding for cEOS devices
  --lldp       Enable LLDP forwarding for vrnetlab devices
  --graph      Generate a D3 graph
/k8s-topo #

Usage Examples

Create a random FRR topology:

/k8s-topo # cd examples/builder/
/k8s-topo/examples/builder # ./builder 10 3
Total number of links generated: 12
/k8s-topo/examples/builder # sed -i -e 's/qrtr/frr/g' ./random.yml
/k8s-topo/examples/builder # cat random.yml

yml
conf_dir: /k8s-topo/examples/builder/config-random
etcd_port: 32379
links:
- endpoints:
  - frr-192-0-2-2:eth1:10.0.0.2/30
  - frr-192-0-2-5:eth1:10.0.0.1/30
- endpoints:
  - frr-192-0-2-2:eth2:10.0.0.5/30
  - frr-192-0-2-4:eth1:10.0.0.6/30
- endpoints:
  - frr-192-0-2-0:eth1:10.0.0.10/30
  - frr-192-0-2-4:eth2:10.0.0.9/30
- endpoints:
  - frr-192-0-2-0:eth2:10.0.0.13/30
  - frr-192-0-2-9:eth1:10.0.0.14/30
- endpoints:
  - frr-192-0-2-3:eth1:10.0.0.18/30
  - frr-192-0-2-9:eth2:10.0.0.17/30
- endpoints:
  - frr-192-0-2-3:eth2:10.0.0.21/30
  - frr-192-0-2-7:eth1:10.0.0.22/30
- endpoints:
  - frr-192-0-2-0:eth3:10.0.0.25/30
  - frr-192-0-2-6:eth1:10.0.0.26/30
- endpoints:
  - frr-192-0-2-4:eth3:10.0.0.29/30
  - frr-192-0-2-8:eth1:10.0.0.30/30
- endpoints:
  - frr-192-0-2-1:eth1:10.0.0.34/30
  - frr-192-0-2-4:eth4:10.0.0.33/30
- endpoints:
  - frr-192-0-2-1:eth2:10.0.0.37/30
  - frr-192-0-2-8:eth2:10.0.0.38/30
- endpoints:
  - frr-192-0-2-6:eth2:10.0.0.42/30
  - frr-192-0-2-8:eth3:10.0.0.41/30
- endpoints:
  - frr-192-0-2-0:eth4:10.0.0.45/30
  - frr-192-0-2-5:eth2:10.0.0.46/30
publish_base:
  22: 30001

Apply the topology:

/k8s-topo/examples/builder # cd /k8s-topo/
/k8s-topo # k8s-topo --create examples/builder/random.yml
INFO:__main__:All topology data has been uploaded
INFO:__main__:All pods have been created successfully
INFO:__main__:
 alias frr-192-0-2-2='kubectl exec -it frr-192-0-2-2 sh'
 alias frr-192-0-2-5='kubectl exec -it frr-192-0-2-5 sh'
 alias frr-192-0-2-4='kubectl exec -it frr-192-0-2-4 sh'
 alias frr-192-0-2-0='kubectl exec -it frr-192-0-2-0 sh'
 alias frr-192-0-2-9='kubectl exec -it frr-192-0-2-9 sh'
 alias frr-192-0-2-3='kubectl exec -it frr-192-0-2-3 sh'
 alias frr-192-0-2-7='kubectl exec -it frr-192-0-2-7 sh'
 alias frr-192-0-2-6='kubectl exec -it frr-192-0-2-6 sh'
 alias frr-192-0-2-8='kubectl exec -it frr-192-0-2-8 sh'
 alias frr-192-0-2-1='kubectl exec -it frr-192-0-2-1 sh'

Log out of the container and verify that the pods have been created:

root@clusterpi-69 # kubectl get all
NAME                            READY   STATUS        RESTARTS   AGE
pod/k8s-topo-86cbbdbddb-xrwlm   1/1     Running       0          6m18s
pod/frr-192-0-2-2               1/1     Running       0          35s
pod/frr-192-0-2-5               1/1     Running       0          35s
pod/frr-192-0-2-7               1/1     Running       0          34s
pod/frr-192-0-2-9               1/1     Running       0          35s
pod/frr-192-0-2-4               1/1     Running       0          35s
pod/frr-192-0-2-3               1/1     Running       0          34s
pod/frr-192-0-2-1               1/1     Running       0          33s
pod/frr-192-0-2-0               1/1     Running       0          35s
pod/frr-192-0-2-6               1/1     Running       0          34s
pod/frr-192-0-2-8               1/1     Running       0          34s

Log into one of the pods and have a look around:

root@clusterpi-69 # kubectl exec -it pod/frr-192-0-2-2 -- sh
# ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
3: eth0@if31: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default
    link/ether ca:c9:8b:1f:d6:69 brd ff:ff:ff:ff:ff:ff link-netnsid 0
    inet 10.42.2.116/24 scope global eth0
       valid_lft forever preferred_lft forever
    inet6 fe80::c8c9:8bff:fe1f:d669/64 scope link
       valid_lft forever preferred_lft forever
40: eth2@if41: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default
    link/ether e2:72:df:0f:93:55 brd ff:ff:ff:ff:ff:ff link-netnsid 1
    inet 10.0.0.5/30 brd 10.0.0.7 scope global eth2
       valid_lft forever preferred_lft forever
    inet6 fe80::e072:dfff:fe0f:9355/64 scope link
       valid_lft forever preferred_lft forever
42: eth1@if43: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default
    link/ether 2e:af:91:d4:c1:b0 brd ff:ff:ff:ff:ff:ff link-netnsid 2
    inet 10.0.0.2/30 brd 10.0.0.3 scope global eth1
       valid_lft forever preferred_lft forever
    inet6 fe80::2caf:91ff:fed4:c1b0/64 scope link
       valid_lft forever preferred_lft forever
# vtysh
% Can't open configuration file /etc/frr/vtysh.conf due to 'No such file or directory'.

Hello, this is FRRouting (version 7.5-dev_git587162029617).
Copyright 1996-2005 Kunihiro Ishiguro, et al.

frr-192-0-2-2#
frr-192-0-2-2# sh run
Building configuration...

Current configuration:
!
frr version 7.5-dev_git587162029617
frr defaults traditional
hostname frr-192-0-2-2
no ipv6 forwarding
!
line vty
!
end
frr-192-0-2-2#

Welcome to your simulation.

Notes

I've extensively replaced various components of this setup with my own forks to which I've added ARM support. I plan to merge the ARM changes back into their respective upstream repos, but this is going to take some time, as the changes I've done currently are very quick-and-dirty. They need to be rewritten not just to work on ARM, but to generalize amd64-specific build options to work on any target architecture.

I very much dislike making this setup depending on my personal GitHub forks and DockerHub registry, but doing so was the only way I could finish this project in a reasonable time frame.

from blog, technology, networking

note_taking_programs

Anonymous (anonymous@undisclosed.example.com) — 2025-09-29T18:37:05+00:00

note taking programs

I have a relatively busy life with many areas of concern and a poor memory, so I rely heavily on notes to document and remember things.

Current choice: Obsidian

Offline: Yes
Editor implementation: Web/Electron
Mobile exp: ★★☆☆☆
Sync: Yes
Org: Hierarchical

Obsidian is a markdown editor that operates over a directory of markdown files and supports crosslinking between them. It has a plugin system that extends this base to add whatever other capabilities you want.

The editor itself is pretty nice. If you've used electron apps before you know that sometimes they feel native (e.g. Discord) and sometimes they feel like a webpage running in Electron (e.g. Logseq, most others). Obsidian's editor feels very native.

Markdown as a content format is both a blessing and a curse. On the one hand, all user content is plain text. That has many advantages - easy to get at your content, easy to exit the ecosystem (in theory), syncing is fast, on disk size is light.

On the other hand, Obsidian wants to have its cake and eat it too. It wants to get all the advantages of Markdown but also offer high level functionality such as task tracking, tabular data storage, query languages etc. To make these work well, the underlying data really wants to be structured. But there is no structured data store in Obsidian, the data format is “just Markdown”. How to solve this conundrum? Most of the value-added features do so by storing structured data in Markdown. This is such an obviously bad idea and the results are as bad as you might expect. You end up with a bunch of shitty home grown databases whose disk format is an insane extension of Markdown. Now it's no longer easy to exit the ecosystem, you cannot get at your data without the Obsidian code necessary to render it, etc.

Edit: I originally wrote the above paragraph in 2024. It's now late 2025 and I have been vindicated. https://help.obsidian.md/bases/syntax

Consequently I don't use any of the plugins in Obsidian that do this and so for me, most of the advanced workflows are lost on me and it ends up as a glorified Markdown editor. However, the editor itself is quite nice so it's still worthwhile to use it vs e.g. vim on a directory tree. The sync service (which costs money) works well and does a good job syncing apps between my various computers and phone. The mobile editor is not great but as it is an App it's more functional than alternatives. Writing Markdown is fine when you have a full keyboard but it's not a good experience on mobile.

Previously

Notion

Offline: No
Editor implementation: Web/Electron
Mobile exp: ★★☆☆☆
Sync: N/A
Org: Hierarchical

I used to use Notion. Notion is organized around the idea of content blocks. Each block has a type; text, image, database etc.

Databases are probably the most distinguishing feature of Notion. They're an in-app implementation of a hybrid between a spreadsheet and a relational database. The nice thing about databases is that you can choose their display formats; for example, a database with a date column can be displayed as a calendar.

Notion's biggest strengths are databases and the ability to embed any type of content inline - images, pdfs, maps, calendars etc. It's got a very rich presentation and you can make some truly beautiful and functional notes with it. Databases are very powerful IF you are the type of person that is willing to spend large amounts of time curating structure for your notes.

My biggest issues with Notion are, in order:

Online only - you can't access your notes without internet
Clients are webpage-in-a-box type Electron apps, feels like a website both on desktop and mobile
The mobile app logs you out every few weeks. I cannot fucking stand mobile apps that log you out regularly. I reported this to Notion and they never fixed it, that was the final straw for me.

logseq

Offline: Yes
Editor implementation: Web/Electron
Mobile exp: N/A
Sync: Yes
Org: Sequential

Logseq is interesting. It's an outliner with a unique model for note taking. It's organized around the idea of a sequence of logs. The happy path for logseq is that each day you open up today's daily note, write whatever it is you are working on or thinking of, and attach identifiers to blocks of content. Later on, if you want to extend the notes you took on that content, you're supposed to synthesize a new note in today's journal page by transcluding the content you already wrote via its identifier. Then there's some hand wavey idea that “later” you'll pull all of those blocks into their own topic pages.

This probably works for some people but it's way too much effort writing notes to be useful for me.

oxygen_rebreather

Anonymous (anonymous@undisclosed.example.com) — 2024-05-31T20:45:11+00:00

oxygen rebreather

In late 2022 I purchased an oxygen diving rebreather. The specific unit is a salamander.

A rebreather is a device that allows users to breathe underwater. Unlike open circuit systems, where gas exhaled by the user is lost as bubbles into the water, a rebreather recycles that gas. This is accomplished by routing exhaled gas into a bag (called a “counterlung”). Along the way the gas is forced through a chemical filter to remove CO2 and the oxygen consumed by the body is replaced from a supply tank. The user then inhales from the bag on their next breath.

Because gas is recycled rebreathers typically have a much longer duration for a given gas volume than open circuit systems. Roughly speaking this means you can use much smaller cylinders to achieve the same dive, ignoring backup gas carried in case of a rebreather malfunction (“bailout”). The inhaled gas is also warm and humid since it was just inside the diver's body, in contrast to open circuit where the gas is supplied directly from a pressurized cylinder and is consequently cold and dry.

An oxygen rebreather is a special case of rebreather where the gas composition breathed by the user is nominally 100% oxygen. This is in contrast to a “mixed gas” rebreather which delivers a gas mixture such as nitrox (oxygen & nitrogen) or trimix (oxygen, nitrogen & helium). Those units require the use of a diluent gas in addition to an oxygen supply - the diluent and oxygen are mixed by the unit to produce the desired gas. This makes them very capable units, but much more complicated, large, and prone to failure. An oxygen rebreather is comparatively simple as it only has two jobs to do - replace the consumed oxygen and remove the CO2.

Here is mine:

why?

This question is most often asked by other divers. The funny thing is that the answer is usually obvious to non divers - it lets you breathe underwater! But when divers ask it, they mean something different. What they mean is “why would you buy a device with such limited utility?” I'll explain what they mean.

The thing about oxygen is that it's a highly reactive gas. This property is critical to human chemistry. However, in excess concentrations, oxygen becomes toxic. Therefore in a breathing gas you have to keep the oxygen concentration below a certain level in order to avoid poisoning the user. In diving, we do this by limiting the partial pressure of oxygen (ppO2). The “maximum” ppO2 generally accepted to be “safe” is 1.6 ATA. Oxygen partial pressure increases with depth. For pure oxygen, at the surface (where pressure is 1 ATA) your breathing gas is already at 1.0 ppO2. Every 33ft of freshwater adds another atmosphere of pressure, so for pure oxygen a ppO2 of 1.6 is reached at about 20ft. In short, you cannot safely dive an oxygen rebreather below 20ft. In some respects this is quite limiting; most dive sites are deeper than that.

So why would you want one of these things? Well, for starters, not *everything* worth diving is deeper than 20ft. There are some sites, like Blue Heron Bridge, that are considered world class and have plenty to see in an oxygen rebreather's depth range. Also, not every dive has to have an objective. You can have a very enjoyable dive and never go below 20ft! For dives like that, the oxygen rebreather is awesome, better than open circuit. Because exhaled gas is captured within the system instead of being exhaled as bubbles, bubble noise is eliminated and the unit is almost completely silent (you can still hear the sound of oxygen pushing through the breathing hoses, but it's very quiet). Consequently aquatic life is much less scared of you.

The unit is also very lightweight. Fully assembled and ready to dive it weighs 6kg (~13lb) including an oxygen bottle (and not counting ballast). Compared to a typical OC scuba system, where the most basic equipment configuration exceeds 40 pounds (not counting ballast), it is much easier to transport. It's also much smaller, both in storage and in the water. In the water it's as close as you can get to wearing nothing at all. This makes it very enjoyable to dive.

It's also cool. Oxygen rebreathers are very uncommon in sport diving (meaning non-military). Every time I've dived it people are curious about it because they've never seen one before.

I want to see

https://qtube.qlyoung.net/w/pVz795iyz4iahQ4aBTfsdA

https://qtube.qlyoung.net/w/48Vxq2jsP2FByVuk5nzHzE

https://www.youtube.com/watch?v=iJJ0QnZ_42E

I need more

Check out the oxygen rebreather page on therebreathersite.nl.

diving

password_management

Anonymous (anonymous@undisclosed.example.com) — 2025-10-06T03:07:52+00:00

password management

Credential management is a critical part of any personal infrastructure.

Current setup

I used to use pass. However, with the advent of passkeys this approach was becoming increasingly difficult.

For the record, I absolutely believe in PKC authentication but am highly skeptical of passkeys, to put it mildly. Perhaps another wiki page about that at some point.

Anyhow, in 2025 I switched to KeepassXC for credential management. In tandem with a sync solution to sync the credential database to all devices it works well enough. It supports passkeys, although not all websites (relying parties) will “allow” the particular “flavor” of passkeys (synced credentials) it “supports” (this is all security theater).

KeepassXC works on every computer I own and I use Keepassium on my phone.

I do wish it had the ability to use a GPG key as a primary key; instead the database is encrypted with a passphrase. Security keys and PGP challenge-response can be used, but only as secondary or tertiary factors to the passphrase.

Old setup

I use pass. This is a shell script that provides porcelain over a directory of plain text files encrypted with a gpg keypair.

The on disk format looks like this:

qlyoung@host ~> tree .password-store/
.password-store/
├── airlines
│   ├── volantis.gpg
│   ├── aerlingus.gpg
│   ├── aircanada.gpg
│   └── united.gpg
├── web
│   ├── twitch.tv.gpg
│   ├── github.gpg
│   ├── bandcamp.gpg
...

Copying a password to the clipboard looks like this:

qlyoung@host ~> pass -c web/github
<unlock gpg keypair>
Copied web/github to clipboard. Will clear in 45 seconds.

The “unlock gpg keypair” bit is some UX that asks for the key to unlock my GPG keypair. I use a OpenPGP card so this is a prompt to insert that and unlock it.

This directory is version controlled with git. Cross-device sync is accomplished with git push/pull.

It is a very simple and secure setup.

key management

This setup requires my GPG keypair to unlock the store. This means that the keypair has to be accessible to every device that needs access to passwords.

A GPG keypair is for practical purposes two files, one containing the public key and the other containing the private key. It's very important to the security of any system involving GPG that the private key file not be made public. For this reason it's usually encrypted with a symmetric password. If you use the conventional setup, this symmetric password effectively becomes the “master” password for the password store.

However, even though the keypair is itself encrypted, having it stored on disk isn't ideal from a security perspective - particularly on mobile devices, which are very exposed and historically very insecure. It's better if we don't store the key on disk at all. To accomplish this I store my keypair on a yubikey, which implements the OpenPGP card standard. This small, unobtrusive device lives on my keychain along with my car keys.

On my desktop and laptop, whenever I need a password, I'm prompted to plug in and unlock my yubikey with a 6 digit pin. The encrypted file containing the password is then sent, over USB, to the embedded processor on the yubikey. The yubikey decrypts it using the GPG private key and sends back the cleartext contents. The flow is the same on my phone, except that communication occurs over NFC so I am prompted to tap my yubikey on the device.

Using a smartcard means the GPG keypair itself is never on disk and thus cannot be stolen. Even if the yubikey is stolen, the key cannot be extracted from it, and it is still locked with a pin so it cannot be used to perform any operations.

porcelain

desktop

It would be inconvenient on desktop to open a terminal and type pass -c <password> every time I want a password. Fortunately there are various porcelain programs that wrap pass.

There are plugins that provide browser autofill which I used to use.

Currently I have a global system shortcut (^-alt-p) which launches rofi-pass. This is a floating launcher prompt, similar to Spotlight on a Mac. It allows me to type a few characters of the name of the password I want until it matches the correct one. Then I unlock the password store as previously described. Instead of copying the password to the clipboard, it then types it out using a virtual keyboard device. This is nice because it works everywhere - in the browser, in the terminal, and so on.

For git synchronization, pass automatically creates a new git commit whenever a password file is changed, and wraps git operations so that pass git push and pass git pull do the obvious things.

mobile

On my iPhone, I use this app, which handles the git operations and integrates with the iOS password management UX.

peak_sets

Anonymous (anonymous@undisclosed.example.com) — 2025-08-20T06:28:37+00:00

peak sets

these are not necessarily the most creative sets or the best by any measure of objective quality but just the ones i think SLAM

peak_tributes

Anonymous (anonymous@undisclosed.example.com) — 2025-07-17T20:56:15+00:00

peak tributes

my favorite tributes

personal_infrastructure

Anonymous (anonymous@undisclosed.example.com) — 2025-10-06T03:38:40+00:00

personal infrastructure

tldr - docker compose, isolated servers

Here I describe how my personal computing infrastructure is set up. These aren't rules or a framework or anything - just a description of how things have ended up.

Security

Seems like an odd place to start, but security considerations have dictated the biggest architectural decisions. My view of security contextualizes the rest of the setup.

I have some basic assumptions about software security, main ones relevant to my infra include:

Every application is vulnerable

Every time you stand up a service that can be reached from the public internet you're adding a huge amount of area to your attack surface. Even a single modern web application relies on so much software that it's reasonable to assume there's a security flaw in there somewhere. Stand up 10 of those and your surface area is quite large. For that reason I assume everything I run is vulnerable and can be hacked.

Docker based isolation isn't reliable

I use docker for everything, mostly for its ability to isolate software and the filesystem from the host. That said, I assume that the container sandbox can be broken out of. I choose to make the assumption that isolation begins at the VM level. VM sandbox escapes aren't in my threat model.

Can't break what you can't touch

Or, network isolation is a strong security measure.

All my compute infrastructure is organized into two separate spheres, public and private. The idea is that if my public infrastructure gets completely owned and everything in that sphere is exfiltrated or wiped, that would be annoying but would not be a disaster. I also make an effort to ensure that the public sphere is properly isolated, meaning you can't get to the private sphere from the public sphere.

Whenever I'm setting up a new piece of infrastructure, the first thing I think about is what sphere it goes in.

flowchart TD pub((public)) priv((private)) data{stores sensitive data?} onlyme{used only by me?} data --> |yes| priv data --> |no| onlyme onlyme --> |yes| priv onlyme --> |no| pub

There are other concerns but that's the general thought process.

Machines

Public

For the public sphere, I use cloud-based Linux VMs from one of the affordable providers. I run most of my stuff on a single shared CPU VM with 4 CPU cores, 4gb of RAM and 50gb of disk space (storage is a later section).

For things that need to be exposed in the internet I think cloud is the best choice. From a network isolation perspective serving things from your home means untrusted traffic will be flowing within your home network. Apart from security concerns there are other problems:

Serving things on a residential connection is sometimes outside of the TOS of your service provider
If your connection is asymmetric performance can be low, especially when serving large files
Bandwidth always inferior to cloud
Dynamic IP addresses makes access annoying
Advertising your home IP address is a mild security concern
- can be mitigated if you rent an ultra cheap VPS and use it as a gateway; I did this initially but realized I can run everything on a cheap vps to begin with
Weather / residential power outages impact uptime

The main advantages of hosting at home are that it's cheaper over the long run, you aren't subject to cloud provider TOS and pricing changes, and are unaffected by cloud outages. The overall balance is in cloud's favor for services that need to be served to the public internet.

Private

For my private sphere, I have a home server. This a normal mATX desktop computer although the board is a server board and supports ECC memory, which I use.

Build details:

Case: Fractal Node 804
Motherboard: Asrock RACK X570D4U
RAM: 128gb ECC memory (4x KSM32ED8/32ME)
Storage:
- 4x WD Blue 3.5“ 4tb HDD
- 4x Hitachi 3.5” 4tb HDD
- 1tb WD Black NVME
CPU: AMD Ryzen 7 3800X
GPU: RTX 3070
Cooling: That noctua air cooler everyone likes

Comments:

The system is headless, the graphics card is for GPGPU compute
Very pleased with the Asrock RACK board; good IPMI and the section display for status codes is extremely useful
Fractal Node build quality lives up to its rep, it's a great server case

8oz Red Bull for scale.

OS

On my home server, I run Proxmox. I don't have many VMs on it - in fact, like the public sphere, most of my services run on a single VM. Some of the reasons I use a hypervisor:

Much better control and monitoring of hardware resources
- Full suite of hardware monitoring tools built into a clean web interface; disk diagnostics, memory / CPU / network dashboards, etc.
- Ability to easily partition storage resources among VMs
- Ability to set fine grained memory and CPU resource limits
Full snapshots for tenant VMs
- Ability to snapshot the entire machine (VM) at the “hardware” level before making major changes is very valuable; makes risky operations like OS upgrades risk free
Ability to create new machines whenever I want to try something
- E.g. I have a Windows VM that runs some Windows-only server software
- I can spin up a VM with resources of my choosing to try out an operating system or run some experiment without worrying about damaging any infrastructure I rely on

Of course, you don't really need a dedicated hypervisor to do any of this; you can do it all with KVM on a traditional bare metal server OS. But it's much easier and more convenient in a hypervisor and in practice, there's very few downsides to the hypervisor.

The main downside is that hardware passthrough can be tricky. I pass through the RTX 3070 to the VM, and then into docker containers, in order to get accelerated encoding for media related services. KVM GPU passthrough is annoying.

The OS that applications run on (ignoring Docker) is always a recent Ubuntu Server LTS with automatic security upgrades enabled. I find the Debian-based platform familiar, comfortable and stable. Ubuntu Server also has a very wide install base which means most problems can be resolved with a web search. This helps keep the maintenance overhead as low as possible. I enjoy building my infrastructure, but I do rely on it and dislike being forced to fix it, so choices in system software tend to be on the less exotic side.

Storage

For public infrastructure I use cloud storage as detailed in the next section.

For private infrastructure I have an 8x4tb HDD array.

These drives form a ZFS pool-of-mirrors with two hot swappable spares:

  pool: tank
config:
	NAME                        STATE     READ WRITE CKSUM
	tank                        ONLINE       0     0     0
	  mirror-0                  ONLINE       0     0     0
	    wwn-0x50014ee266927a7d  ONLINE       0     0     0
	    wwn-0x5000cca22bca7cbb  ONLINE       0     0     0
	  mirror-1                  ONLINE       0     0     0
	    wwn-0x50014ee2113d2fa4  ONLINE       0     0     0
	    wwn-0x5000cca22be46d4b  ONLINE       0     0     0
	  mirror-2                  ONLINE       0     0     0
	    wwn-0x50014ee2bbe84236  ONLINE       0     0     0
	    wwn-0x5000cca23de171c4  ONLINE       0     0     0
	spares
	  wwn-0x50014ee2bf43a534    AVAIL
	  wwn-0x50014ee2bbe843cf    AVAIL

Total usable storage space is 12tb. One disk in each mirror pair can fail with no data loss.

I carve out virtual disks from this pool and attach them to VMs as needed.

Applications

Over time I've gravitated towards

web applications
running in Docker containers
served by nginx reverse proxy

flowchart TD subgraph VM nginx(nginx) subgraph Docker direction LR app1(piwigo) app2(akkoma) app3(peertube) appel(. . .) end end inet((network)) --> nginx --> app1 & app2 & app3 & appel

Most of the self-hostable software I use is web based. Containers offer a way to run applications without contaminating the host, with (usually) easy upgrades and good lifecycle management and without reliance on the OS packaging system, which makes them platform agnostic. Serving everything via nginx reverse proxy simplifies web server configuration and simplifies TLS. nginx has great performance and security and since nginx reverse proxy to docker is a popular choice now, many applications now provide example nginx reverse proxy configurations, making configuration even easier.

Docker Compose

Every single application I run is a docker compose project. Docker compose makes it very easy to manage complicated multipart services as a unit. Many of the applications I run are complex web applications with an application component, a separate database (eg mysql or postgres), and sometimes additional components. Putting everything in docker compose means that bringing up the simplest to the most complicated of these applications is done the exact same way:

docker compose up

All dependencies, environment variables, mounts, port bindings, application settings etc. are all completely specified either in the docker-compose.yml file, the .env file, and the persistent data files on disk, and all of these files are contained in a single directory.

Disk layout

On my machines, I have a directory called apps in my home directory. Within this apps directory, there is a directory for each application I run, and within that directory there is a docker-compose.yml, .env and sometimes data files.

The entire state of any application is contained within that application's directory. As long as I have that directory, I can bring the application back up with its previous state even if the host is completely destroyed.

On disk, the situation looks like this:

qlyoung@private ~> tree --prune -P "docker-compose.yml" -L 3 apps
apps
├── calibre-web
│   └── docker-compose.yml
├── gitea
│   └── docker-compose.yml
├── healthchecks
│   └── docker-compose.yml
├── invidious
│   └── docker-compose.yml
├── jellyfin
│   └── docker-compose.yml
├── linkding
│   └── docker-compose.yml
├── miniflux
│   └── docker-compose.yml
├── nextcloud
│   └── docker-compose.yml
├── onlyoffice
│   └── docker-compose.yml
├── photoprism
│   └── docker-compose.yml
├── quassel-core
│   └── docker-compose.yml
├── tandoor
│   └── docker-compose.yml
...

Data files and .env are omitted here but live alongside each docker-compose.yml.

I set things up so that I only need a given application's directory in order to completely restore its state. Consequently, I don't use docker volumes since these are stored in /var/lib/docker. I only use bind mounts. I think it might be possible to have local driver volumes be located in a custom directory, but since bind mounts have always worked well for me, I haven't tried it.

Application Storage

Private

Storage on my private infrastructure is easy. I have a 32tb ZFS pool in my home server; if my VM runs low on storage space, I just make the disk bigger. If 32tb is not enough, I will buy bigger disks.

Public

On my public infrastructure, disk space is constrained. My primary VM has 50gb of disk space. I used to have storage volumes provisioned in my cloud provder that were attached to the VM, with data files stored by applications symlinked to a location on the volume. However, while you can get as much storage as you want this way without needing to upgrade the VM instance size, cloud providers know that and thus tend to charge quite a lot for storage.

I use Backblaze B2 object storage, which is affordable and provides an S3 compatible API. When selecting applications to fill some infrastructure need that will need to run on my public infra, I only select applications that either have minimal disk requirements or support the S3 API. Each service has its own B2 bucket and its own access key that grants access only to that bucket.

flowchart TD subgraph VM akkoma piwigo peertube appel(. . .) end subgraph B2 qlyoung-pleroma(qlyoung-pleroma 4.2gb) qlyoung-piwigo(qlyoung-piwigo 6.9gb) qlyoung-peertube(qlyoung-peertube 32gb) qlyoung-foobar(. . .) end akkoma -- S3 API + akkoma key --> qlyoung-pleroma piwigo -- S3 API + piwigo key --> qlyoung-piwigo peertube -- S3 API + peertube key --> qlyoung-peertube appel -- S3 API + ... key --> qlyoung-foobar

If possible, I also configure applications so that users are served files directly from B2 rather than having them proxied through my VM, which improves performance both in terms of load time and bandwidth usage. When you watch a video on my Peertube server, your browser is downloading the video directly from B2, instead of B2 → VM → You.

DNS & HTTP & TLS

This is identical on both private and public. Grand overview:

flowchart TD subgraph VM nginx(nginx 0.0.0.0:443) subgraph Docker direction LR piwigo(piwigo 127.0.0.1:8000) akkoma(akkoma 127.0.0.1:8001) peertube(peertube 127.0.0.1:8002) appel(. . .) end end photos.qlyoung.net & social.qlyoung.net & qtube.qlyoung.net & el(. . .) -- CNAME --> qlyoung.net -- A --> VM nginx -- photos.qlyoung.net --> piwigo nginx -- social.qlyoung.net --> akkoma nginx -- qtube.qlyoung.net --> peertube nginx -- ... --> appel

DNS

Each service is on its own subdomain. All subdomains CNAME to the main domain name (qlyoung.net) which has an A pointing to the public IP of the VM. In my private infrastructure, the A record instead points to a Tailscale IP - but more on that in the networking section.

HTTP

nginx runs on the host and binds host ports 80 and 443. All docker containers bind to (127.0.0.1, P) where P is a host port number of my choosing. Each service has its own subdomain and a corresponding nginx configuration:

root@public /e/n/sites-available# ls | sort
birdcam.conf
maloja.conf
piwigo.conf
pleroma.conf
qlyoung.conf
qtube.conf
wiki.conf
...

Each of these looks more or less the same, and contains configuration to reverse proxy to the corresponding Docker container. For example, here is piwigo.conf. It reverse proxies requests to photos.qlyoung.net to 127.0.0.1:8090, which is where the container running Piwigo is bound:

server {
    server_name photos.qlyoung.net;
 
    location / {
         proxy_pass http://127.0.0.1:8090;
         proxy_set_header X-Forwarded-Host $server_name;
         proxy_set_header X-Forwarded-Proto https;
         proxy_set_header X-Forwarded-For $remote_addr;
    }
 
    listen [::]:443 ssl ipv6only=on;
    listen 443 ssl;
 
    <... tls details, misc settings omitted ...>
}

Note that Piwigo itself is bound to port 80 within the container, which is mapped to 8090 on the host:

qlyoung@public ~/a/piwigo> docker-compose ps
     Name                    Command               State                Ports
------------------------------------------------------------------------------------------
piwigo_mysql_1    docker-entrypoint.sh --def ...   Up      3306/tcp, 33060/tcp
piwigo_piwigo_1   /init                            Up      443/tcp, 127.0.0.1:8090->80/tcp

I find this setup to be clean and convenient. Service specific settings such as request body size are set in the nginx configuration and only need an nginx reload to be applied. Sites can be made accessible or not by enabling or disabling their nginx configurations without touching the application itself.

TLS

TLS is terminated by nginx. This makes TLS management very simple, since certificates can be issued and configured in nginx using Certbot with the nginx plugin. No container specific configuration is necessary. I think this is the correct separation of concerns - TLS configuration is a detail relevant to how services are exposed, but not to the services themselves. Having TLS configuration live in the web server with services unaware of it makes sense.

Certbot issues certificates using Let's Encrypt. Certbot automatically renews certificates so there is no maintenance overhead.

Networking

Public

Everything is served on public IP addresses. DNS is managed through my DNS provider (Namecheap).

Private

My home server and all my personal computers are part of a single Tailscale network (tailnet). The network topology is full mesh.

flowchart LR subgraph Tailnet laptop desktop server pihole(odroid ) el(. . .) laptop --- desktop & server & pihole & el desktop --- server & pihole & el server --- pihole & el pihole --- el end

For DNS, I have a small SBC odroid-xu4 running Pihole which is also part of the tailnet (odroid in the diagram above). The tailscale daemon on each device configures the device to use that DNS server when resolving *.qlyoung.net domains. Otherwise DNS is the same as previously described, except that the A record for the primary VM points to a Tailscale address.

flowchart TD subgraph VM tip(Tailscale IP) === nginx(nginx) end git.qlyoung.net & healthchecks.qlyoung.net & jf.qlyoung.net & links.qlyoung.net & el(. . .) -- CNAME --> private.qlyoung.net -- A --> tip

On the VM nginx is configured to only bind to the Tailscale address. This ensures applications are only accessible by devices explicitly joined to the tailnet, and not by e.g. a guest who has joined my home LAN.

Typical Deployment

1. Identify a need, e.g., “I want a personal recipe book and meal planner”

2. Search for Web-based projects that fill that need, select one based on presence of Docker support, features & community activity, e.g. Tandoor

3. Log into server, clone, configure, and start application (pseudocode)

   $ ssh server
   # set up directories
   $ mkdir -p apps/tandoor && cd apps/tandoor
   $ wget docker-compose.yml .env
   # make any changes; set port bindings, env variables to set credentials, etc
   $ vim docker-compose.yml .env
   # start service
   $ docker compose up -d

4. Set up new CNAME record; CNAME recipes.qlyoung.net → qlyoung.net 5. Configure nginx, request and install TLS certificate

   # create nginx configuration, usually by copying another one and tweaking it
   $ vim /etc/nginx/sites-available/tandoor.conf
   # enable nginx with chosen 
   $ ln -s /etc/nginx/sites-available/tandoor.conf /etc/nginx/sites-enabled/tandoor.conf
   # Log into namecheap, create new CNAME record (recipes.qlyoung.net)
   # Set up TLS
   $ certbot --nginx -d recipes.qlyoung.net

6. ???

7. Profit

The deployment process is identical for both internal and external services.

Backups

Everything, private and public, is backed up with restic to offsite locations. It runs daily on a cron job.

Cost

Private runs for the cost of electricity.

Public bill:

Compute: $24/mo
B2 Storage (~200gb): ~$2/mo
Total: ~$26/mo

from blog, technology

photo_management

Anonymous (anonymous@undisclosed.example.com) — 2025-11-04T03:19:37+00:00

photo management

Oh yeah. This is gonna be a big one. Stay tuned.

Rough outline for now:

technology, photography, self-hosting

possession_minimalism

Anonymous (anonymous@undisclosed.example.com) — 2024-07-02T21:58:15+00:00

possession minimalism

Earlier in my life, I conceptualized the ideal amount of possessions as the amount that I could load into a car. The idea was that this conferred maximal flexibility and mobility. If I didn't like where I was there were no barriers to picking up and leaving. This was pretty easy to do early on since I had no money and couldn't afford anything more than a plastic tub of clothes and a few small trinkets anyway.

Eventually though I did get some money, and after a few years of living in the same place and not using the mobility capability, I realized this self imposed prohibition was preventing me from doing things in life I wanted to do. For example, I couldn't scuba dive as much as I wanted to because while I had training, I wouldn't allow myself to buy gear - scuba gear, especially tanks, is bulky. Owning dive gear isn't amenable to maintaining mobility.

Put another way, maintaining mobility was, at that point, significantly limiting my personal growth. I decided it was no longer worth it. Starting with dive gear, I began allowing myself to accrue possessions in order to do what I was interested in.

Now I find myself approaching a big move and surrounded by many possessions. These are almost exclusively related to hobbies and sports - snowboards, skateboards, rackmount servers, firearms, diving equipment, climbing equipment, etc. I have quite a lot of things, and thinking about my past viewpoints, I've tentatively decided that moderate minimalism is probably the best policy for possessions. That is, keep around the minimum amount of stuff that allows you to do what you want to do, and no more.

I don't shoot much anymore so I'm selling my guns. I have an electronic keyboard, but while I would like to pretend I'm going to play it soon, it hasn't happened for a few years so I'm selling it. Anything I haven't used for a year is on the chopping block. I've found that unless I perform regular, aggressive purges eventually I build up so much crap that takes up space and weighs me down both physically and mentally. It's an axiom that moving is easier the less stuff you have, but for me, having less stuff also makes me tangibly happier. It's less to manage and maintain. I especially like selling or donating things because I'm not throwing them into a landfill, but making sure they end up with someone who will actually put them to use.

Another thought for this disorganized list: many people have a viewpoint that they shouldn't buy something expensive unless they know they're going to use it. It sounds right on the surface, but what I've found is that in many cases, items keep their resale value so well that it actually costs much less than you think to own expensive things that you end up not using. For example, in 2021 I got into flight simulation and was doing it for long enough that I decided to purchase a very nice HOTAS system costing around $500. I waited months to buy this, living with a $30 logitech joystick, because I wanted to be sure I was going to stick with the hobby before spending so much on equipment. As often happens, some months after getting the HOTAS I stopped flight simming and the system went back in its box for over a year. Finally in 2023 I admitted I wasn't getting back into it and sold the throttle - for $426. Owning an extremely premium throttle for 1 year 8 months cost me $75. Well worth it since it allowed me to explore flight simming completely without wondering if better equipment would enhance my experience! And now someone else has a like-new unit, at a discount, who is probably putting it to good use. Everyone wins.

humanity, philosophy

power_juice

Anonymous (anonymous@undisclosed.example.com) — 2025-12-23T18:46:28+00:00

1.5 cups orange juice, with pulp
1 tablespoon creatine
2 pumps liquid caffeine (appx 160mg)

stir to combine

quotes

Anonymous (anonymous@undisclosed.example.com) — 2025-12-19T00:15:30+00:00

quotes

Just some quotes I like. They don't necessarily represent my views on anything.

Fall in love with some activity, and do it! Nobody ever figures out what life is all about, and it doesn’t matter. Explore the world. Nearly everything is really interesting if you go into it deeply enough. Work as hard and as much as you want to on the things you like to do the best. Don’t think about what you want to be, but what you want to do. Keep up some kind of a minimum with other things so that society doesn’t stop you from doing anything at all. Richard Feynman

You can acquire infinite customers and create infinite revenue if you sell dollars for 85 cents. Uncredited

Mood? What's mood to do with it? You fight when the necessity arises, no matter the mood. Gurney Halleck

restaurants

Anonymous (anonymous@undisclosed.example.com) — 2025-10-10T20:20:04+00:00

restaurants

I'm a bit of a foodie and enjoy finding interesting places to eat. On this page is a list of notable ones, organized by region.

Roughly speaking, “notable” means a place I might bring up in a conversation about food in that region or about that particular cuisine.

USA

NC

Raleigh

Brodeto - Adriatic. Seafood and pasta. This one is truly special, by far the best food I have had in Raleigh and the best on the East coast outside of NYC. Interesting menu. The interior design is sleek and organic, wood and stone with white highlights.
Brewery Bhavana - dim sum and beer. Half of the restaurant is a brewery and the other half is dining, with a cafe-like space in the middle. Probably the best Asian food you can get in Raleigh and a thoughtful selection of beer. Not cheap but worth it.
Jolie - French bistro. Rooftop digs are worth advance booking, especially around sunset. Steak tartare is served 'deconstructed' style and if you like that dish, definitely get it. Duck confit is also highlight. This is by the same chef as Brodeto. I went here about a year before Brodeto and thought the food was good although the menu is somewhat boring.
Beasley's Chicken and Honey - Southern. My overall favorite chicken and waffle spot, although not far ahead of Tupelo. Probably the only Ashley Christensen restaurant that I would go to. I feel like the rest of them are trying to do fine cuisine with the same attitude you should make c&w with. Love their hot sauce.
Death & Taxes - upscale American? Not a fan of the food at all. Think $50 steak and pasta with the richness and palate of Carraba's fettucine alfredo - very rich, salty, fatty, filling, exactly the opposite of what I want in upscale dining. The most interesting dish I could find, and had, was pork and breaded onions. Salmon tartare with the fish drowned in sauce. This is quite similar to the other “upscale” Ashley Christensen restaurant I've been to (Poole's) and I think I'm seeing the formula. Overall did not like it, both as a matter of personal taste in the cuisine direction but also because the food was just bad. The bread was stale, parts of my dish were burnt. The service was quite good but the mediocre food made it feel like an average restaurant that watched a tv show about fine dining and copied what they saw.
Sitti - Lebanese food. Right next door to Gravy. First visit was for lunch and I did not like it at all. On a subsequent dinner visit, I found it excellent. Straightforward but delicious menu.
Caffe Luna - Italian. Well priced with a small menu. Only went once and it was good. I would absolutely go again if I wanted home cooked Italian.
Poole's - American. People say this is the best or one of the best around. I personally found the menu, while enjoyable, somewhat boring. Like D&T, the food is pretty basic fare, large portions. I kinda got the impression that the menu is optimized around Instagram compatibility.
Big Easy - Trash. More like the big suck, don't go here.
Gravy - Italian. Was (may still be) semi-upscale Italian. Went there many many times, but had one bad experience where the food was terrible and didn't return.
Hibernian - Irish pub. Honestly one of my favorite spots around for a casual bite. On a night with great weather the roof is one of my favorite spots to be. It's a pub, so the food is not really the draw, but the food is reliable and the place you eat them in is comfortable, cozy and tucked away from the chaos outside. Also the only place to get an authentic Irish breakfast around here, which I appreciated much more after visiting Ireland.
Whiskey Kitchen - American. Food is good and slightly overpriced. This is more of a whiskey bar than a restaurant. If you want to drink and also eat, this is a great spot.
Salsa Fresh - Mexican. This is an S tier lunch spot with simple Mexican fare and a very fresh, very delicious salsa bar. For whatever reason the Morrisville location is way better.
Sam Jones BBQ - BBQ. They have bar seating and I've had an interesting conversation with a stranger next to me. My buddy hated it.
Waraji - Sushi. Surprisingly good sushi as NC goes, in an unexpected location. If I want good sushi in Raleigh this is my goto.
Mulino - Italian. Me and my friend found the food overpriced and the service somewhat slow. Drinks were good.
Tonbo Ramen - Ramen. I was notably unimpressed and found the food bland.
Miso Ramen Bar - Ramen. There's three locations; I've been to the Raleigh location twice and liked my food each time. Solid ramen spot.
PRESS Coffee+Crepes - Crepes and a cocktail bar. I went there for a crepe and a flat white. It was OK but I couldn't stop thinking that for $25 I got a lukewarm crepe, a tiny flat white and no service when I'd get double the portions of both with better quality for like €8-10 anywhere in Europe. Unlikely to return.

Cary

Noodle Blvd - Ramen. The most reliable ramen spot in the Triangle that I have been to. I like their spicy seafood kimchi ramen best.

Durham

Saltbox Seafood Joint - Fresh seafood. Daily menu. Straightforward, delicious meals.
Thaiangle - Got green curry. It was ok, next time I want Thai I'll try somewhere else. Service was *too* attentive, interruption my meal to refill water, ask about the food multiple times etc.

Seattle

wa'z - Kaiseki - this ranks among the absolute best places I have ever eaten. It may be the best place I have ever eaten. I am surprised they do not have a star. Extremely delicious. Extremely expensive - but worth it.
Sushi Kashiba - Sushi - Also very good. It's high end sushi with matching service for about as much as you would expect.
Kamonegi - Japanese - My first experience with soba, not one to be forgotten. Can be a bit hard to get in here but worth it.

Denver

Tavernetta - It's hard to impress me with Italian but this place is very good. I particularly enjoyed their cheese selections.
Daughter Thai - I had khao soi for the first time here. On a later visit I had their lamb curry. Great food on both counts.

Los Angeles

Chiang Rai - Thai. Amazing street food.
Canter's Deli - Jewish deli. 24 hours and I have never been there without appreciating that. I love this place.
Roscoe's House of Chicken and Waffles - Chicken and waffles. Yep. If that's what you want, go to Roscoe's.

Chicago

It's funny, I've been to nice places in Chicago but the only one I can remember off hand is

Portillo's - Chicago dogs - good

New York City

Russ & Daughters - Mmmmm fish

food

sleep

Anonymous (anonymous@undisclosed.example.com) — 2025-10-10T20:07:28+00:00

sleep

It's funny to get older and finally learn lessons that have been drilled into me since I was old enough to listen; but that's life.

Sleep is very, very important. It determines baseline more than any other factor. Good sleep creates the possibility for a good day. Poor sleep almost guarantees a bad or at least difficult day.

Bryan Johnson, the nighttime erections guy, says:

Make sleep your #1 priority. Nothing influences your conscious existence more.

He's right. I don't agree with him on everything though.

For a long time I kept my room cold for sleeping - around 67-69 F - and that helped my sleep. Any warmer and I'd wake up hot. At some point I switched from a duvet filled with synthetic insulation to a weighted duvet filled with glass beads. I also moved to a newer place with more efficient cooling, keeping the temperature closer to its actual setting - so, cooler than my previous place.

After a while of not sleeping very well, I tried bumping the temperature up a few degrees. Almost instantly my sleep quality improved:

Sleeping HRV improved overnight. On the best nights I was reading ~40ms. After increasing the temp, I am regularly reading over 60ms.
Sleep quality as measured by my sleep tracker improved by around 20%

I am not sure how long this has been affecting my sleep but at minimum it was 6 months.

start

Anonymous (anonymous@undisclosed.example.com) — 2026-02-12T16:53:16+00:00

home page

this my wiki, here you will find many things i wish to write about.

Tag	Quantity
from blog	10
diving	4
technology	14
self-hosting	4
nature	2
making	1
networking	1
photography	1
programming	2
products	1
literature	1
humanity	6
pithy	1
stupid	1
food	1
philosophy	2
gambling	1
complaining	1
flexing	1
machine learning	1
geospatial	1

syncing

Anonymous (anonymous@undisclosed.example.com) — 2025-11-04T03:20:17+00:00

syncing

I work across multiple computers. My desktop is Arch, my main laptop is a Macbook, and I also have a Framework 13. Normally I use my desktop at home and take the mac for traveling. In all cases, I need access to my files.

I think about my data in terms of tiers. I have stuff I frequently access and stuff I rarely access. My head canon for the first tier is “working set”; that's my documents, music, and project files. The working set should be available and fast. Rarely accessed stuff can live on slow storage or offline.

So for my working set I need a way to reliably sync all that data across multiple devices. For that I use syncthing.

task_tracking

Anonymous (anonymous@undisclosed.example.com) — 2025-06-18T14:15:49+00:00

task tracking

When I was in my teens I used to keep all my tasks in my head. Occasionally if I had something with more details than I could remember I would write it down on a notepad. Around the second half of my 20s I started getting really into personal databases and task tracking. I'll write another page on notetaking solutions, but this one is focused on task tracking.

2025

As of 2025, I now do all task tracking using sticky notes on my refrigerator and computer monitor.

The fridge system is:

Left door - long term goals, thoughts. For example, places I want to travel this year, big ideas I want to pursue.
Right door - Short term tasks

These are organized in rows. For the right door, on the top row are smaller items that can be quickly knocked out or time sensitive items that need to happen soon. Items on lower rows are in roughly priority order. On the left door there's no real structure.

Things that ABSOLUTELY must happen tomorrow go on a sticky note on my computer monitor.

The problem with every other system, and especially all computerized systems, is that I have to remember to LOOK at the system. When I know I have a lot of items in there, anxiety prevents me from opening the app at all. Sticky notes on the fridge force me to look, which empirically results in execution.

Interesting corollary is that this only became viable when I moved this year into a place where the fridge is located in the main living area (big studio-style space). In my old place the fridge was in the kitchen, which I only ever went into for food and bev. So probably the main key is that the stickies are located somewhere you can't miss them.

notion

In 2019 I started using Notion extensively as a general notetaking tool. Notion also has a kanban implementation which I started using for task tracking. I had a single big kanban with four columns:

Todo
Doing
Done
Not doing

After a couple years, this kanban had hundreds and hundreds of items in it, but remained surprisingly usable. The nice thing about Notion's kanbans was that you could easily link them to notes elsewhere in the workspace; kanban cards with brief task descriptions could have outlinks to notes pages with context, or to databases with data related to the task, and so on.

obsidian tasks

In mid 2023 I moved off of Notion to Obsidian for various reasons. In the process I lost my notes-integrated kanban as well. I needed a new task-tracking solution, and having done that job in my notes app before, I resolved to try to do it in Obsidian.

When I switch to a new platform for anything, I like to try the Happy Path. In other words, I want to use the software according to what its users and developers consider to be its strengths. For task tracking in Obsidian, that is the Tasks plugin. This is fundamentally a plugin that adds a query and metadata layer on top of markdown checklists.

I tried hard to make this work for me but it really does not. The first major issue is that once I am done with a task, I want it hidden from view. But these tasks are Markdown checklists. You check them and they get strikethrough formatting, but they stay right where you defined them. I really don't like that. I get dopamine from eliminating the task and making the list closer to empty. When you tick the task and it stays there that doesn't give any dopamine.

Another problem with Tasks is that metadata associated with tasks - such as priority, due date, categories, etc - is added in plain text on the same line as the task description. I don't like this. It looks messy and unreadable, and on mobile it's completely untenable. Also, the way that you distinguish tasks from regular checkbox items is by adding a #task tag. This annoys me because it's like a noisy type annotation on a markdown checklist. it just doesn't feel good.

And speaking of mobile - the phone experience of Tasks is awful. On desktop I'm okay shuffling todos around with my keyboard using a mouse to click those small checkboxes. On mobile, it is really bad. The checklist box is hard to hit. There's a lot of friction to adding new tasks - navigate to wherever the task list is in your vault, scroll, scroll, type - on a phone keyboard - the following:

- [ ] task description #task

Doesn't seem too bad, right? But look at the amount of keypresses you actually need to type that:

img_0701.mp4

It's a lot. Typing - [ ] in particular sucks.

This is really annoying on a phone and it made me dread adding tasks. If I dread adding tasks, I either won't do it or I'll spend too much time doing it. The mobile experience for any task tracker is critical to me. I need to be able to jot down a task the moment I think of it, and then put my phone away. It shouldn't take more than ten seconds or so.

I looked into recreating my kanban solution in Obsidian, but the two kanban plugins I tried - this one and cardboard. Cardboard supposedly integrates with tasks, but unfortunately it insists on either organizing tasks by tag or by due date. I want to organize them by status (todo, doing, done etc) and it can't do that. The UX is also weird and again, it doesn't work well on mobile at all.

tl;dr bad mobile experience, vault littered with completed tasks, poor metadata support and high friction make every task solution I tried in Obsidian untenable. I began looking for something else.

2do, nextcloud tasks & caldav

I vaguely knew that calDAV has support for task synchronization. I already run Nextcloud as a calDAV server for calendaring. Nextcloud also has a Tasks application that allows you to edit these tasks. Normally I find that Nextcloud applications kind of suck, but this one has 5 stars, and they are well deserved. I tried that one and was pleased to find that it supports categories, due dates, subtasks, and generally sports a pleasant user interface. Now to find a mobile solution.

After a little searching I found 2do (note that as of writing, the TLS certificate expired on January 8th). This thing looked a bit aged but very capable, so I decided to give it a try. Imagine my surprise when I saw it was $10 on the app store. I think this is the most I have ever paid for a mobile app.

But oh man, is it worth it. This app rocks. It is designed around making adding and managing tasks as frictionless as possible. It supports categorizing and tagging tasks, grouping related tasks together, and subtasks. It has a few different overviews for tasks that allow you to view tasks by category (e.g. “all diving-related tasks”), and by due date (“all tasks due today across all categories”). The concept of 'smart lists' is also supported - set conditions on what tasks should appear in the list and they will be pulled into the list.

img_0705.mp4

And all of this syncs flawlessly with CalDAV. I can whip out my phone, type a task into the quick add bar, hit enter and put my phone away, and it'll be there in the task viewer on Nextcloud. Furthermore, since tasks with due dates are also calendar items, they appear on my calendar so I get an overview of everything I'm going to do just by looking at my calendar.

This all probably sounds very trivial, but I've never used a task tracking solution where all the pieces worked together so well. It's really slick.

tiered_storage

Anonymous (anonymous@undisclosed.example.com) — 2025-10-22T15:33:48+00:00

tiered storage

There are two schools of thought regarding storage. One prioritizes resource efficiency and consistency; data should be stored in one location, and the location made accessible to all clients. This maximizes total available storage space at the expense of availability and access speed. The other stores data where it is needed; this may be in multiple places, thus trading storage for availability and access speed, and introducing the potential for inconsistency in multihomed data.

For a long time I was firmly in the first school. Files live in one big beautiful cluster that you can access from any device. I see the appeal. You can focus all your efforts making that cluster as big and beautiful as you want, as resilient as you want. There's only one copy of data, so you never have inconsistencies. But after lots of time using a big beautiful cluster, I kept having the experience that I wanted some file and I just couldn't get to it. And when I could get to it the experience of browsing around, searching, transferring files all over a network just…sucks. After you buy into the paradigm, after a while you get used to it and forget that it doesn't have to be like that.

In the past my laptop didn't have enough space to store all my data. Small form factor drives just weren't big enough, and then they got big enough but they were so expensive that it only made sense to put them in a workstation (desktop). In 2025, annoyed by the downsides of network storage, I started thinking about how to improve the experience. I realized I have two tiers of data.

working set

I have a set of files I frequently access; my music, photos, documents, and projects. This is what I think of as my “working set”. It doesn't include stuff that falls in the bucket of “huge binary files” - movies, 300gb DNxHD Resolve projects, that sort of thing. Right now my working set is ~4tb.

other stuff

Some things are just too big to store on-device. At today's storage unit prices, storing 30tb of movies that you access once a year on your laptop doesn't make sense yet. Storing those things on a really big cluster accessed via the network is fine.

thoughts

After thinking about these tiers I realized:

My working set is ~4tb
m.2 NVMe drives can now accommodate that working set for a reasonable price
which means I can now have my working set completely stored on my laptop

My desktop already had 10tb of storage and my home server 12tb. Due for a laptop upgrade anyway, I got 8tb of storage on my new machine and then set about collating my working set into an organized directory tree to prepare it for syncing. I then engaged in a massive synchronization campaign that took about a week to settle out. With careful preparation there were almost no sync conflicts and my working set is now replicated on all devices.

At this point in time I exist in storage nirvana. I work on my desktop. Grab my laptop and catch an airplane; all the data I was working on is on my laptop and I pick up where I left off. No need to connect to airplane wifi. Get where I'm going, connect my laptop; it's syncing everything to my home server and desktop in the background.

special case: phone

I only have 1tb of storage on my phone, so it can't store everything; and even if I wanted to, syncthing on iOS basically doesn't work because of the lack of background services. This is completely fine though, because 1) I don't really do much work on my phone and 2) my phone is always online. If I need access to something from my phone, I can download it from my home server. If my phone is completely offline and I *really* need access to my data, it's on my laptop. And if my phone is offline and I don't have my laptop, well, I will do something else.

Further thoughts

As it turns out, this is one of the few concepts in computing that I didn't invent /s. From wikipedia, the free encylopedia:

HSM is a long-established concept, dating back to the beginnings of commercial data processing.

Hierarchical storage management

too_many_projects_too_little_time

Anonymous (anonymous@undisclosed.example.com) — 2024-07-02T21:56:23+00:00

too many projects too little time

There's so many projects, interests and activities I want to pursue, but their number and individual complexity has reached the point where I can't pursue all of them simply because I don't have enough time in each day to do so. Prioritizing is difficult because I am interested in all of them.

Lately this has lead to each day consisting of rapid switches between various things I want to pursue, making little progress on any of them. Work taking up the bulk of my time pushes project pursuits into the gutter of the day, where they then compete for my time with errands, finance management, interpersonal relationships, and personal hygiene. A younger me prioritized projects over all those things. This is evident in my Github history since most of my projects from that time were software projects. I remember that period as one of the most productive times of my life.

Additionally I have been traveling extensively over the past year, and sinking time into projects requires staying in one place. For me anyway. I need a stable environment to create the right conditions for doing deep work. Occasionally I can find a few hours to sink into flow while away, but that is limited to computerized pursuits, such opportunities are rare, and actually leveraging them into a flow state is even rarer. The upside to traveling is that because I know I can't do anything creative, that creates the perfect conditions to do reading. Normally I prioritize creating over consuming, and so I end up never reading books since my limited free time is spent on creative pursuits.

Now I am a much more balanced and well rounded person than I was when I spent the majority of my time on computer based projects, but my creative pursuits have suffered. You can't read a book and write one at the same time. Going to the gym regularly cuts out time for projects. Relationships cut out time for projects. Traveling cuts out time for projects. I love recreating but it doesn't produce anything, and as a person I derive a lot of my self worth from producing things, especially things other people use.

The obvious solution is to get so rich I don't have to work anymore, and then I can spend the bulk of each day working on things I want to pursue. But this is easier said than done.

I considered listing out the projects here in some kind of perverse flex, but that is best reserved for my personal notes.

complaining, flexing, humanity

underwater_videography_with_gopro

Anonymous (anonymous@undisclosed.example.com) — 2025-09-29T19:09:53+00:00

<!DOCTYPE markdown> # underwater videography with gopro

What I do to get decent results out of a GoPro when shooting underwater.

# Light

## Attenuation

Cameras are light gathering devices and perform better the more light is available, all else being equal. How much light is available in the water?

Attenuation of light in a medium is described by the [Beer-Lambert law](https://en.wikipedia.org/wiki/Beer%E2%80%93Lambert_law). In terms of water, light intensity decreases as a function of depth per

I(z) = I₀ e⁻ᵏᶻ

where *I₀* is the initial light intensity (at the surface), *I(z)* is the intensity at depth, *z*, and *k* is the absorption coefficient that varies depending on the medium characteristics (for water, things like clarity and particle content).

For air *k* is around 0.0001. For seawater *k* is more like 0.05. That gives us roughly the following:

Depth (m)	Depth (ft)	Light Intensity (%)
————	————	———————
0	0	100%
5	15	78%
10	35	61%
15	50	47%
20	65	37%
25	80	29%
30	100	22%
35	115	17%
40	130	14%
45	150	11%
50	165	8%

It's much more complicated than this - absorption is wavelength dependent, seawater is not uniform, there are scattering effects, etc - but this is a decent approximation for this discussion.

The upshot is that the diving environment is low light as far as cameras are concerned. This is why underwater photographers have kit that looks like this:

Notice that the camera itself is the smallest part of the whole setup, most of the bulk is dedicated to lighting to add back in light absorbed by the water.

## Sensor size

Generally speaking the larger the sensor, the more light it can collect and the better its dynamic range. Smaller sensors struggle more in low light.

To put in perspective how challenging it can be to use an action cam underwater:

A full frame camera sensor is roughly 36x24mm for an area of 864mm^2. The Hero 11 sensor is 6.74×5.05mm for a sensor area of 34.04 mm^2. That is ~25x smaller than full frame.

If you are wondering why 6.74×5.05mm does not correspond to the 1/1.9“ figure published by GoPro, that is because that figure is in optical format.

## Color

Water is blue because it preferentially absorbs wavelengths of light other than blue. The deeper you are the further light has to travel through water, the more red light is absorbed and the bluer the scene.

The only way to truly compensate for this is to add the missing red wavelengths back in with external light.

In camera you can adjust the white balance of the sensor to make it more sensitive to red wavelengths. Every sensor pixel has red, green and blue subpixels. The values from these pixels are combined to produce a single pixel color. Adjusting white balance biases the color information collected by subpixels to include more of the red channel. More on this in the Settings section.

### Filters

Red filters over a lens are stupid. Putting red plastic over a lens does not magically restore red wavelengths back into the scene. The filter is red because it absorbs blue light. As previously stated cameras perform better with more light, and most of the light we have at depth is blue. All you are doing with a red filter is deleting the precious light you do have.

Even if filters were good, since the scene spectrum varies by depth and filters are calibrated to one spectrum your filter will almost always be suboptimal.

You can tell when someone used a red filter because their video/picture looks like shit. Don't use filters.

## Framerate

Slower framerate allows for longer exposure times. Longer exposure allows more light and better picture, all else being equal.

However, not all else is equal. There is a tradeoff here. Slower shutters allow the camera to move further during each exposure. This produces motion blur. There is nothing inherently wrong with motion blur, it can even be desirable. However, if you digitally stabilize your footage, the camera motion will be cancelled but the motion blur produced by that movement will not be cancelled. The result is motion blur without apparent motion, producing a “vibrating” effect in the image. Read more here: https://docs.gyroflow.xyz/app/getting-started/common-filming-tips-and-issues

Diving is a slow sport, and the camera is usually not moving very fast, so there is limited motion blur. In such cases I prefer to shoot with a slower shutter speed. Personally I find it looks better. Fast, active subjects such as bait balls might benefit from 60fps with added motion blur in post. As a rule of thumb, start at 30 unless you plan to shoot something fast or want the action cam look, then consider bumping to 60 and potentially increasing ISO max to allow the camera a little more flexibility.

## ISO

In digital cameras ISO adjusts the electrical sensitivity of the sensor elements to incoming light. The tradeoff is that increased sensitivity results in lower SNR - i.e. higher ISO produces more noise. Fortunately denoising is very good these days, so if you are willing to denoise in post, you can get away with relatively high ISO.

I usually limit to 1600.

# Settings

GoPro publishes a firmware called [Labs](https://gopro.github.io/labs/) that unlocks a lot of power user software toggles, many of which are useful for underwater videography. Whoever is responsible for Labs does an amazing job.

### A little diversion about GoPro color

After first installing the Labs firmware, I spent a lot of time learning about color spaces, video grading, dynamic range etc. and subsequently shot a lot of underwater video with a custom logarithmic curve (LOGB=400) + Flat color profile for maximum dynamic range. I bought the [Leeming LUTs](https://www.leeminglutpro.com/) for these settings and applied them in Resolve. I was determined to squeeze every last drop of performance out of this tiny camera.

However, at some point I realized that the time required to grade the video I shot using these advanced settings meant that I never used that footage. The small selection of footage I did grade took an enormous amount of time and ultimately was not subjectively more pleasing to me than just using the Natural color settings. I simply do not have time to grade video properly.

I don't consider it to be a waste of time nor do I regret pursuing this. It was actually quite fun and informative, and I learned useful knowledge about color spaces, color correction, and so on. But I wouldn't recommend that you go this route unless you plan to make video editing a Primary Hobby.

## Basic settings

- Natural color

`Flat` or a custom log curve in theory grant you more flexibility for color correction in post. However, after editing underwater LOG footage I realized that I do not care and that natural looks completely fine to my eye, so I don't use it anymore.

- White balance auto

Spectrum is constantly varying with depth and other things, on the balance I've found I get the best result allowing the camera to handle it

- Wide lens

“Wide” is the native lens. “Narrow” crops it, “Hyperview” and “Superview” convert 8:7 and 4:3 video respectively to 16:9 using an in-camera distortion mapping. I prefer an output with minimal in-camera corrections so I use “Wide”.
Notably, if you are using Gyroflow and want 16:9 you should shoot in 8:7 and select 16:9 as an export option in Gyroflow instead of in the camera; that way Gyroflow benefits from the additional buffer space to perform corrections and then crops at the end. Gyroflow can stabilize Hyper/SuperView footage, but in order to do so it has to undo the Hyperview distortion first using a reverse-engineered distortion matrix and then re-apply it, so you may as well shoot without it to begin with

- 5.3k30 8:7

I personally find this to be the sweet spot. 5.3k 8:7 is the native sensor resolution, every single pixel. By keeping the entire frame, post processed stabilization has much more “buffer” space to crop into. In this resolution the maximum framerate is 30 - but as mentioned I almost always shoot 30fps in water, so this is fine.

- 4k60 8:7

If I want to shoot 60fps for some reason then I drop the resolution to 4k in order to keep the 8:7 aspect ratio. If you want the absolute highest resolution, you can drop to 16:9 which unlocks 5.3k60. Personally I prefer working in a consistent aspect ratio and think 4k subsampling looks good enough especially at high framerates.

- Hypersmooth off

Water or not, I prefer to stabilize in post with [Gyroflow](https://gyroflow.xyz/). The result is better and it allows more control over the stabilization parameters
Hypersmooth is calibrated for the refractive index of air and is only 70% effective in water; Gyroflow accounts for water if configured correctly
See the section on stabilization for more detail

- Bitrate high

Higher bitrate generally equals better quality video

- 10-bit on

More bit depth allows capturing finer grained color differences, which looks significantly better
Greater bit depth also reduces Color banding which is often a problem in underwater footage, which tends to have diffuse color gradients as the backdrop

- Shutter auto

The camera knows best

- ISO min 100

I don't understand why you would change this.

- ISO max 1600

This is a tough one to choose and varies based on the scene. 1600 seems to work well for most environments. I notice that in 30fps the camera will usually keep it around 800. In a cave or wreck with a torch beam it behaves similarly.

- Sharpness low

I sharpen in post as desired

- EV Comp 0

I don't know

enough to change this

## Labs

I like to set these with [QRControl](https://apps.apple.com/us/app/qrcontrol/id1518134202).

- `NR01=1`

GoPro's built in NR is too aggressive and softens the image too much. The underwater environment is inherently noisy, especially in the ocean where large portions of the frame are a very uniform blue that makes noise very visible
Noise reduction in post has much better results. See denoising for details.

- `BITR=120`

If you have a fast sdcard you can increase the maximum bitrate with this setting. However, it does cause some instability and lost footage on my specific camera so I think this is probably a wash.

On Hero 12/13, there is `DIVE=1` which enables the water distortion corrections I mention in Stabilization for Hypersmooth. As mentioned I don't use Hypersmooth, but if you do, you should probably enable this.

On 13 there is also `WBDV=1`, described as follows:

White Balance DiVe improvements. Rather than WARM for improving diving white balance, which effects WB the same at all depths, WBDV is more automatic – as the scene get more blue, the more the red channel is gain up.

I have a Hero 11 and haven't used either of these settings so I can't speak to how well they work.

# Praxis

## Flow & Vibe

I find that as soon as the camera is out, it takes me out of the dive and into the camera. I dive primarily for my own enjoyment and not to produce video, so taking video is usually a net negative for my overall dive experience. Operating the camera is task load that makes more important concerns such as spatial awareness, instrument scans, buddy tracking, navigation, gas management, light communication etc more difficult. That affects my whole dive team. Since I care about my buddies enjoying their dive with me, camera time is limited, and the “harder” the dive the less time I feel comfortable using a camera.

Aside from task loading and vibe, most of what happens on a dive is just not very interesting to watch. It's a lot of swimming. Sometimes swimming can be interesting if the environment is cool - wrecks and caves for example. But even then, on a swim dive the cave or wreck doesn't change much over the course of 2 minutes, which is a usual attention span. You can edit it to just show the highlights of course, but you end up taking away from your dive in order to shoot a lot of video that no one will see because it ultimately just isn't interesting to watch.

The upshot is that I try to think ahead, be intentional about what I'm shooting and what result I hope to achieve, and constantly reevaluate whether the final video is going to be worth the precious dive minutes I'm losing to shoot it.

## Case

I use the official GoPro case. If you dive deeper than 50m you need to use something else. Golem Gear used to make the best ones, they were acquired by SubGravity in 2022 and their cases can be found here: https://sub-gravity.com/product/gopro-hero-9-case/

I find it works best with a 3/4” or 1“ bolt snap attached like this:

During shooting I hold the camera itself. I have tried the floaty GoPro handle. It gets in the way when clipped off, doesn't really fit in a bellows pocket and it certainly doesn't fit in the smaller glue-on pockets on my wetsuits. In my experience it doesn't improve video stability compared to holding the camera body directly. Using a handle probably reduces rotational instability somewhat but with gyro-based stabilization in post this does not matter. A slightly more aggressive crop is acceptable to me in exchange for not having to manage the handle.

## Predive

Nothing sucks more than turning your GoPro on in 30m of water only to see that it is stuck in the wrong video mode. You cannot change this in the water (actually you can but more on that later).

Before every dive:

- Check and set the time/date

You can do this with QRControl or Quik

- Ensure the video and photo modes are in the preset you want

## During dive

### Settings There is a way to change settings while in the water. GoPros with the labs firmware can read QR codes. If you want, you can print out QR codes that do specific things and tape them into your wetnotes like this:

Then during the dive you flip to the right QR code and point the camera at it to change the setting.

You do carry wetnotes, right?

### Telemetry

You may want to cross reference points in the video with the dive profile your computer records. The easiest way to do this is to take a clear shot of your dive computer in the video. Get into the habit of pointing your camera at your computer for a few seconds at the start of filming to establish a reference point. I highly recommend doing this even if it does not seem useful right now.

# Post

Any computational operation you do on the camera itself is limited by the embedded CPU used on the camera, its thermal and battery constraints, and time. In post these constraints are far more favorable so you can potentially get much better results.

Video specific stuff is biased towards Resolve since that's what I use.

## Stabilization

Image stabilization is used to turn shaky handheld camera footage into nice smooth footage. Optical image stabilization, typically found in full size cameras, does this with motors that physically move the lens to cancel out shake and vibration.

Electronic image stabilization, which is used in small cameras with fixed lenses and in post processing workflows, stabilizes footage by calculating the camera motion and then applying transformations and warping to the frame to cancel out that motion. In the case of the GoPro the source of camera motion data is the gyroscope. Hypersmooth reads the gyroscope directly and postprocessing tools use the gyro data that is encoded alongside image data in the MP4 files that the GoPro records.

This result is usually cropped to eliminate the crazy warping borders. In EIS you sacrifice part of the frame for stability. The tradeoff is usually worth it.

### Distortion & Refractive Index

In order to know what transformations to apply, the EIS algorithm needs to know how a change in camera position is reflected in the image. This requires EIS to know the optical properties of the lens, which is why post-processed stabilization works best when calibrated for the specific camera model / lens being used.

One of the major optical properties of a lens is its relative refractive index. Light travels at different speeds in different media. When light traveling in one medium enters a different medium, it bends (refracts) and the degree of this bend is a function of the difference in the speed of light between the first and second medium. If you know the relative refractive index between the ambient media and the lens material (glass), when characterizing the overall scene distortion you can account for the distortion introduced by refraction.

Virtually all EIS systems assume air is the ambient media by default. This means that when using EIS on footage shot in water, the lens distortion matrix is incorrect. It needs to be adjusted to account for the difference in relative refractive index between water and the camera lens. Gyroflow [added](https://github.com/gyroflow/gyroflow/issues/398) this option in 1.6.0 and there is a Labs setting (`DIVE=1`) to enable it for Hypersmooth on Hero 12/13.

Without this adjustment stabilization will still work, just not as well. GoPro Labs docs say that without it, Hypersmooth is about 70% effective compared to shooting in air.

To get an idea for the difference, compare the results of distortion correction calibrated for air (left) versus water (right):

### GoPro specifics

GoPro is well known for its implementation of EIS which it calls Hypersmooth. Hypersmooth is pretty good as it goes but there's a few things to know about it:

- It produces “baked” videos; stabilization parameters cannot be changed in post and the original, uncropped frame cannot be recovered - It is performed on the camera CPU in real time and thus has hard compute limits to contend with - It does not know what will happen in the future and cannot benefit from the additional information; stabilization in post can view the entire gyro track and perform smoothing over a larger time window, improving results - As mentioned above, distortion correction is not calibrated for water by default, reducing stabilization quality

For these reasons I do not use Hypersmooth when shooting underwater.

Instead I use [Gyroflow](https://gyroflow.xyz/) with the following settings:

- Lens profile → Advanced → Lens is under water

This will adjust the distortion matrix to account for the refractive index of water, at once improving stabilization results and correcting for water-induced distortion in addition to the lens distortion.

- Export settings → Preserve other tracks - Stabilization params set to whatever I think looks good, usually the default

The reason for the second setting: GoPro MP4 files contain multiple data tracks. Example:

``` $ ffprobe -i <vid> <snip>

Duration: 00:12:48.77, start: 0.000000, bitrate: 117879 kb/s
Stream #0:0[0x1](eng): Video: hevc (Main) (hvc1 / 0x31637668), yuvj420p(pc, bt709), 4000x3000 [SAR 1:1 DAR 4:3], 117609 kb/s, 59.94 fps, 59.94 tbr, 60k tbn (default)
    Metadata:
      creation_time   : 2025-04-30T23:12:44.000000Z
      handler_name    : GoPro H.265
      vendor_id       : [0][0][0][0]
      encoder         : GoPro H.265 encoder
      timecode        : 19:11:34:59
Stream #0:1[0x2](eng): Audio: aac (LC) (mp4a / 0x6134706D), 48000 Hz, stereo, fltp, 189 kb/s (default)
    Metadata:
      creation_time   : 2025-04-30T23:12:44.000000Z
      handler_name    : GoPro AAC  
      vendor_id       : [0][0][0][0]
      timecode        : 19:11:34:59
Stream #0:2[0x3](eng): Data: none (tmcd / 0x64636D74) (default)
    Metadata:
      creation_time   : 2025-04-30T23:12:44.000000Z
      handler_name    : GoPro TCD  
      timecode        : 19:11:34:59
Stream #0:3[0x4](eng): Data: bin_data (gpmd / 0x646D7067), 56 kb/s (default)
    Metadata:
      creation_time   : 2025-04-30T23:12:44.000000Z
      handler_name    : GoPro MET

```

In the above example there's 4 tracks: - H265 video track - AAC audio track - TCD timecode track (empty) - A binary track containing gopro-specific metadata. This is where gyro, GPS and other metadata is stored.

By default, GyroFlow will drop the metadata tracks when producing a stabilized output. This metadata is valuable and other tools such as [Telemetry Overlay](https://goprotelemetryextractor.com/) rely on it to function, so you want to keep this track.

## Denoising

I use Resolve as my video editor and find these settings to work as a decent starting point for most underwater footage:

## Color correction

As I mentioned, I don't do color correction. It takes too long and Natural looks good enough to my eye.

If you want to, though, these are the things I have used: - https://www.leeminglutpro.com/

If you chose to shoot in FLAT or a LOG curve, these LUTs correct to Rec709

- https://xtremestuff.net/store/gp-tune-transform/

This does the same thing in an ACES plugin

vehicle_leases

Anonymous (anonymous@undisclosed.example.com) — 2025-02-15T19:11:31+00:00

vehicle leases

The other option to buying a car is to lease it. Leasing a car is basically renting it for a period of time (the term), usually 2 or 3 years (24 or 36 months).

Financing

Of course, a vehicle is an asset with a variable value. When you rent a car from Enterprise for a few days, its value doesn't change much, so you just pay for the service of renting the car. With a lease, you have the asset for years, and its fair market value can change substantially during that time, so financing becomes relevant.

A vehicle lease is financially structured like this. The y-axis is dollars.

                 ___ $ msrp
                ░
                ░___ $ adjusted capitalized cost
               ╏░
               ╏░
Depreciation -<╏░___ $ midpoint
   Cost        ╏░
               ╏░
               ╏░___ $ residual
                ▓
                ▓
                ▓
                ▓
                ▓
                ▓
                ▓
                ▓
                ▓
                ▓
                ▓
                ▓
                ▓
                ▓
                ▓
                ▓
                ▓___ $ 0

Start with the sticker price of the vehicle, that's MSRP. It's how much the vehicle is worth at the start of the lease.

Subtract any discounts & incentives and your down payment (if any). That is adjusted capitalized cost. Don't worry about why it's called this, just understand that is what that number means.

The residual is a prediction of the fair market value of the car at the end of the term. Cars are depreciating assets and lose value as a function of time, mileage, wear, etc.

The last number is the money factor. This is a small decimal like .00329 that determines how much you pay in rent to the lessor. If the number is bigger you pay more, smaller you pay less.

When you lease a car you pay the lessor for two things:

The depreciation of the vehicle over the time that you have it
Rent charges for the privilege of renting the vehicle

There's also taxes and insurance but we can ignore those for now.

To understand depreciation charges, first consider that the lessor still owns the vehicle that you're renting throughout the term. That's their asset. They could have sold it for cash (which does not depreciate), or used it for its useful purpose (and bore the depreciation cost themselves). Instead they're letting you use the asset during the term. During that time the fair market value of the car is decreasing. When they get their car back at the end of the term it will be worth less than it was at the start. Therefore it's only fair that they be compensated for that depreciation. The most fair way to do this would be to assess the fair market value of the car each month relative to the previous month, and charge you the difference. However, business is done with contracts and most people who want to lease cars would not be happy about a company getting to decide what to charge them each month on the fly. They want to agree in advance on what they will pay each month. Thus it is necessary for the lessor to make a prediction about how much the car will depreciate over the term and decide how much they think it will be worth at the end of the term - the residual. Once you understand that, calculating how much you pay in depreciation is easy. It's (adjusted capitalized cost - residual). In the graph this is represented as “depreciation cost.” Note that this is not equal to the actual depreciation of the vehicle! That would be (MSRP - residual). The incentives & down payment are working in your favor here.

The other part is the rent charge. This is charged to compensate the lessor for the privilege of using the vehicle. Basically this is the profit for the lessor. Calculating this quantity is where people usually get tripped up in lease math because it's not obvious why it is calculated the way that it is. To calculate how much you pay in rent in total, it's (adjusted cap cost + residual) x money factor x term. It's calculated this way because the money factor itself is defined as APR/(12*2). The 2 in the denominator of the money factor divides the sum of adjusted cap cost and residual to get the midpoint shown in the bar chart (the average between the residual and adjusted cap cost). Why is the money factor defined this way? Because the “principal” (to use loan terms - this is not a loan) of the asset - ie the car's value currently being held by the lessor - decreases from the adjusted cap cost down to the residual over the lifetime of the lease, and the intention is to charge rent on the total value of the asset currently being leased at any given time. That value is constantly changing over the term, but ends up being roughly the same as the midpoint. But returns are usually defined in percent. So they decided it was easier to take the APY they wanted, divide it by 12 to get monthly, then divide it again by 2 for reasons unknown to anyone. They could have clearly explained that rent is charged on the average of the adjusted cap cost and the residual, but instead they included the 1/2 factor in the definition of the money factor. The upshot of this is that the midpoint defines how much rent you pay - anything that lowers the midpoint will reduce the rent charges. Also the APR is the money factor * 2400, I have to say that because it's how every website “explains” what the money factor “is”. If you write anything about car leases you have to say that.

Obviously to get the total amount you pay over the lifetime of the lease, add the depreciation cost and rent charge. To get it monthly divide by the term (in months).

That's it. That's all there is to lease financing. It took way too long for me to figure this out. The math has numerous interesting consequences. Note that any discounts off the MSRP (and your down payment, if any) work double duty to reduce both the depreciation cost and the rent charge. Also note that the rent charge cannot be completely eliminated even if you prepay the entire lease.

Things about leases

The biggest difference between leasing and buying is that at the end of the term, you have two options:

Return the car to the lessor
Buy the car at a predetermined price (this price is almost always the same as the residual)

This sets up an interesting tradeoff. If at the end of the lease the FMV of the car is more than the residual, you can buy the vehicle and “make” money. So for example if the residual is $55k and at the end of the term the FMV of the car is actually $65k, you can buy the car at $55k. Now you have $10k of equity in the car. People tout this as a benefit of a lease. Of course, you need to decide the break even point; maybe you can make $5k of equity buying the car, but getting that $5k out of the car may not be worth the time and hassle of selling it.

On the other hand if the FMV of the car at the end of the term is less than the residual, it's in the lessee's best interest to return the car. At that point the lessee has compensated the lessor for the depreciation cost of the vehicle plus some amount of rent charges, but if the asset is worth substantially less than its predicted residual, it's possible the lessor makes little profit, no profit, or loses money on the whole lease. As you might imagine, lease contracts typically try to ensure this does not happen, either by setting a conservative residual or by charging a lot in rent (high money factor). In either case the lessor will usually sell the car as a certified pre-owned (the fate of most returned leases).

The nice thing about this is that it allows lessors to get a new vehicle every few years while the lessor takes the depreciation risk. The downside is that if you lease repeatedly you're constantly paying for the depreciation of new cars (plus rent), which is most rapid in the initial years of their existence, so in the long run it is substantially more expensive than buying a car and owning it for a long time. This is why the most sound financial advice is to purchase a vehicle that is likely to retain its value well (such as a Tacoma) rather than lease. However the benefits may be worth this cost to some people or in some situations.

As an example of such a situation, if there is a high risk of the vehicle being worth very significantly less than a normal car over a 2-3y time frame, it can make sense to lease that vehicle and pay a premium to the lessor in exchange for them shouldering the depreciation risk. Vehicles produced by new companies that could go out of business during the term, or using new and unproven technologies, are illustrative examples.

Another consideration is that car is usually covered by the manufacturer warranty during all or most of the term. By repeatedly leasing vehicles the lessee has a car that is always under warranty. This can free them up to drive cars that they may not otherwise buy for reliability reasons.

The final major thing to consider about leases is that they always have mileage limits. These are expressed in miles/year but they aren't evaluated on a yearly basis, just at the end of the term. Any overage on the allowed mileage is usually charged at a relatively high rate, commonly $.30/mile, although this is sometimes negotiable. These mileage allowances are always factored into the residual, since mileage is one of the factors affecting the value of a car. There's usually stipulations about excess wear and tear as well.

Other things to know about leases:

The lessor owns the vehicle throughout the lease period.
You insure the vehicle on your policy.
Down payments are not required.
If the vehicle is totaled during the lease period, you lose any down payment.

whole_foods_pre_seasoned_protein_tier_list

Anonymous (anonymous@undisclosed.example.com) — 2025-03-19T02:08:31+00:00

whole foods pre seasoned protein tier list

S

carne asada skirt steak

B

tandoori spiced chicken breast