Super Hexagon (by Terry Cavanagh) is one of my all-time favorite games. If you haven’t played it, here’s the trailer (from 13 years ago): It is a rhythm game with only two controls, and an official Linux port. The controls are circular (left and right rotate the player triangle around the screen) and ever since I got the Playdate, I’ve always thought that the crank on the playdate would make an…
This post is an expansion of what I wrote on r/archlinux as a proposal for AUR helpers. It is a call for every package manager to add support for global hooks . The packaging ecosystems that we all rely on have been under constant attacks. The most interesting countermeasures currently are: Dependency Cooldowns , and Dependency Policies . A third interesting one is Homebrew’s cooldown which is a 1…
Over the last decade, I’ve made a bunch of sites using some mix of data/content. The most popular of these is endoflife.date , but there’s also hackercouch.com , mf.captnemo.in and a bunch more. My preferred stack for such projects is Jekyll, now with custom plugins since GitHub Pages now runs on GitHub Actions with custom plugins by default. Simon Wilson’s “Baked Data” pattern is something I’ve…
My primary domain ( captnemo.in , where you’re reading this) was suspended by my registry ( .in ) for 3 hours last night (4th May 2026). I discovered the issue roughly 30 minutes after it happened, at around 22:45 CET and managed to get on chat with a Namecheap representative in the next 30 minutes, and both domains unsuspended in another 90 minutes or so. It took a lot of waiting for support to…
I recently published Kurbelfahrplan , a FOSDEM schedule app for the Playdate . This was the first project where I’ve been quite happy with using Claude Code for development, and used it much beyond Copilot autocomplete and came closer to vibe-coding. You can see the complete development transcript of my claude-code session. It was interesting as a 2-day greenfield project and I thought it might be…
Haven’t posted here in a while, but this is worth an update: I’m moving to Berlin . I’ve loved living in Bangalore for the last decade (I moved here just after the first HillHacks in May 2015), but it is time for an adventure. For the last couple of years, I’ve spent my time living in Indiranagar, building communities, helping underline.center, working on blr.today, organizing events, and really…
The Amazon US website allows you to export your Order History easily by visiting the “ Order History Reports ” page. No such option seems to exist for the Amazon websites for other countries. I was trying to write a simple scraper for the Amazon India Order History Page to get the same data, and discovered something interesting: Amazon encrypts the Order history page, and decrypts it using client…
“Fantastic Beasts and Where to Find Them” is a curious book: The in-universe book is written by Newt Scamander and was published in 1927. The first edition of the companion book was published in 2001. This is apparently the 52nd in-universe edition with a foreword from Dumbledore and was released to the muggle world for charity. The 2001 edition pretends to be Harry’s copy of the book as of the…
I recently did some work on analysing the Indian government cyberspace, thought I should document them somewhere outside of my Twitter 1 . List of GoI websites I’d made a list of Indian government websites in Jan 2019: I ran @18F /pulse on Indian Government websites to see how many of them support HTTPS. A quick summary: Total Websites: 14183 Total Live Websites: 11710 (82%) Websites with Valid…
I have a presentation I sometimes give about Monopoly being a terrible game 1 . I usually end it by pointing the audience to Monopoly Deal, which I introduce it as “the only Monopoly edition you can enjoy”. The advantages are obvious: Much shorter game length. No dice rolls. Even if you lose badly on luck, you’ve only lost 15 minutes. While it is better than Monopoly, that isn’t to say it is a…
A lot of companies have come up with the idea for reducing all your cards into a single piece of plastic. Here’s a summary of all the ones I could find, and their fate. Beware: this field is very much a startup graveyard. The only remaining survivor seems to be Curve 1 but it’s also the first one that’s attempting this outside of US. There seem to be a lot of challenges (regulatory, financial, and…
A long time ago, I tried to do a readthrough for Game of Thrones (Book 1) alongside the first season. I managed to reach Episode 5, before I sped through the rest of the book, but I tried. Trying something similar for His Dark Materials, which is a great series if you’re looking to watch something new. Instead of noting down Chapter/Book equivalence (like I tried last time), going to write down my…
I tweeted out my recommended viewing order for Star Wars recently 1 : Happy #StarWarsDay folks. If you've somehow managed to avoid watching Star Wars, here's my recommended viewing order (No Spoilers, 1/n) pic.twitter.com/K70O4ydCB7 — Nemo (@captn3m0) May 4, 2020 Thought I should expand a bit on the what and why. Spoilers towards the end (marked). I also went ahead and named it: The Beskar…
I upgraded my encryption setup recently, so I thought I should write about it, just in case it is helpful to someone else. As a security professional, I have a different threat model from most folks, and as such my setup does involve a bit more complexity than what I’d recommend to everyone. But if you are an at-risk individual (journalist, person holding hundreds of bitcoins or other digital…
Update : Apple is no longer signing iOS6 for the iPad 2, so this is no longer feasible. I own a iPad 2 (GSM), which is rarely used these days because it is too slow with the latest iOS 9 upgrades. It is a 8 year old device, but I can’t just install Linux on it and make it usable, which is what I do with most other devices. The next best thing was to downgrade the iOS version. The device is anyway…
The Google Purchase History feature has been doing rounds in the news recently. In case you missed it, go to https://myaccount.google.com/purchases right now and make sure you are logged in with your personal gmail account to see what all Google thinks you’ve bought. For me it lists purchases going as far back as 2013, which include: All of my Amazon Purchases (including Kindle and Audible)…
I’ve been running a personal DNSCrypt server in Bangalore for the last 2 years. When I set it up, it was just a compiled version of dnscrypt-wrapper , which was the bare minimum setup I could do. Since then, I’ve upgraded it to a distribution supported version, but recent changes in dnscrypt key rotation , I’ve been wanting to setup something automated as well. The easiest way was to switch to the…
Self-Guide for stripping the Audible DRM, in similar vein as my Kindle Self-Guide . Download the aax file from Audible website. Run the inAudible-NG Rainbrow crack table against the AAX file. Easiest way is via docker/podman: cd ~/Music/Audiobooks podman run -v $(pwd):/data ryanfb/inaudible@sha256:b66738d235be1007797e3a0a0ead115fa227e81e2ab5b7befb97d43f7712fac5 for i in "*.m4a"; do fix-audible-m4a…
I run a non-standard Kindle configuration: Jailbroken (because I want to own the device, not rent it) Runs KOReader (because I want to read EPUBs and PDFs with reflow.) DRM Stripping (because I want to own the book, not rent it) Since I don’t do any of these often enough to automate it, this is a self guide to help me follow these steps the next time I have to do any of this. No guarantees of this…
tl;dr : Check your disk usage v/s RAID capacity to ensure that you can remove a disk before trying. If you can connect a new disk without removing the old one, run a btrfs replace - it is much faster. My homeserver setup has a 4 disk setup: 128GB Samsung EVO 850 SSD as the primary disk (root volume) A 3 Disk btrfs RAID1 Array that I use for almost everything else. The 3 disks were: A…
The Vulnerability The UIDAI Resident Portal (with read access to entire Aadhaar Demographic data) is runing a vulnerable version of LifeRay software. It is running LifeRay 6.1, which was declared End-of-Life in Febrary 2016. This release includes multiple known vulnerabilities, including: A XSS issue, for which a PoC can be found at resident.uidai.gov.in (Picture Credits: @sanitarypanels )…
A few more changes since the last time I ran this . Update : An automatically updated version of this is available at https://captnemo.in/tld-a-record/ TLD IP Web ai 209.59.119.34 [ http ] [ https ] arab 127.0.53.53 [ http ] [ https ] bh 88.201.27.211 [ http ] [ https ] charity 127.0.53.53 [ http ] [ https ] cm 195.24.205.60 [ http ] [ https ] dk 193.163.102.58 [ http ] [ https ] gg 87.117.196.80…
A little while ago (Jan 2018), I ran a scan to see which all TLDs have an A record set (on the TLD). This is what lets you visit http://ai/ as a valid website on your browser, for eg. I ran the same scan as http://blog.towo.eu/a-records-on-top-level-domains/ (link is down, archived ) and the results are at https://captnemo.in/blog/2018/02/09/tld-a-records/ . Decided to re-run the scan today, and…
Next in the Home Server series, this post documents how I got the networking setup to serve content publicly from my under-the-tv server. Background My home server runs on a mix of Docker/Traefik orchestrated via Terraform. The source code is at https://git.captnemo.in/nemo/nebula (self-hosted, dogfooding FTW!) if you wanna take a look. The ISP is ACT Bangalore 1 . They offer decent bandwidth and…
Re-ran the same scan as http://blog.towo.eu/a-records-on-top-level-domains/ Scan run from AS9498 . Results: TLD IP ai 209.59.119.34 android 127.0.53.53 arab 127.0.53.53 cal 127.0.53.53 chrome 127.0.53.53 cm 195.24.205.60 dclk 127.0.53.53 dk 193.163.102.58 drive 127.0.53.53 etisalat 127.0.53.53 gg 87.117.196.80 gle 127.0.53.53 guge 127.0.53.53 hangout 127.0.53.53 je 87.117.196.80 nexus 127.0.53.53…
Contents Email Google Play Music Google Keep Phone microG Core UnifiedLP Maps Uber Calendar/Contacts Google Play Store LastPass GitHub As part of working on my home-server setup, I wanted to move off few online services to ones that I manage. This is a list of what all services I used and what I’ve migrated to . Why : I got frustrated with Google Play Music a few times. Synced songs would not show…
Learnings I forgot to do this on the last blog post, so here is the list: archlinux has official packages for intel-microcode-updates . wireguard is almost there. I’m running openvpn for now, waiting for the stable release. While traefik is great, I’m concerned about the security model it has for connecting to Docker (uses the docker unix socket over a docker mounted volume, which gives it root…
The last time I’d posted about my Home Server build in September, I’d just gotten it working. Since then, I’ve made a lot of progress. It is now running almost 10 services, up from just Kodi back then. Now it has a working copy of: Kodi I was running kodi-standalone-service , set to run on boot, as per the ArchLinux Wiki , but switched in favor of openbox to a simple autorun. Steam The current…
I’d been planning to run my own home server for a while, and this culminated in a mini-ITX build recently. The current build configuration is available at /setup/homeserver/ . In no particular order, here were the constraints: The case should be small (I preferred the Elite 110, but it was unavailable in India). Dual LAN, if possible (decided against it at the end). The plan was to run the entire…
Over the last couple of years, I’ve been involved with lots of side projects, both online and offline. Some of them, I’ve written about on the blog, like my music visualizer project . A few of them, got their own project page, like the website for my niece (but no blog post) while some didn’t even get a mention. I thought I’d write about the many-many side projects I’ve started (and abandoned).…
I made this as my animated wallpaper recently (Click to play/pause): above video has a audio component, click at your own peril . What follows is the story and the tech behind making this. The Wallpaper I have a long history of using custom wallpapers. This was my wallpaper from 2014-: When I asked Vikalp to design a new one, I knew I wanted something that was slightly more softer. This is what he…
I tweeted this a while back about my reading progress in 2016, and thought I’d do a post about what I read. Made a graph of my @goodreads reading progress in 2016. I only picked up the pace sometime in May, but managed to read ~10k pages this year. — Nemo (@captn3m0) January 13, 2017 Continuing with the review tradition from last year , here are the top 3 books that I read in 2016: The…
ACT, for those who don’t know is one of India’s most popular broadband providers. This is a very brief and concise summary. ACT has a mobile application That allows you to login and check your plan details, data usage etc I’ve been wanting to build a command line application that lets me check the balance easily I tried scripting their website, but it was too much javascript. The mobile app uses…
This is specifically about the contest held in 2011, 6 years ago. I’ve written about my experience during the contest on this blog . More specifically, Round 2 of the contest was a pentesting scenario where we were only provided with a VM image and asked to test it and report any vulnerabilities that we found. I recently found the VirtualBox images, and thought I’d share them as a easy intro to…
2015 was a good year for me. I accomplished a lot of things, and was happy for most part of the year. In no particular order, here are the things that stand out for me: Went to HillHacks , and made lots of friends. Helped organize the conference. Joined Razorpay in June Moved to Bangalore Announced my book, The Joy of Software Development Did lots of speaker things: Joy of Software Development…
I often get a lot of queries from people asking me about how to get started with software development, and how to get better at it. My replies are almost reaching stock-level worthy of copy-paste now, so I thought I might as well write about it publicly. What follows is a list of advice I’d give to any person who wants to write software for a living. A lot of it might apply across professions, and…
A little while back, I came across HillHacks , a conference in Dharamshala about “hacking and making in the Himalayas”. I was instantly hooked. It took a lot of scheduling troubles, but I decided to stay for the entire unconference, which started at 23rd May. Its hard to describe the HillHacks experience in a single blog post. I met so many amazing people from all over the world. Learned a lot of…
I have always wanted to be a writer. I think secretly us all reader-folk have that ambition. The joy of getting across your thoughts to another person without ever having met them is enormous. Most of my writing time these days is spent over email, chat or my not-so-frequent blog posts. I tend to do a lot of research while writing, and it takes up a lot of time. As such, my writing output tends to…
Update : Since I published this post, I have changed my opinion somewhat on the matter. This post is quite confrontational and I didn’t mean it to be that way. Medium is not wrong in this matter, but I still think we need to look for better solutions. I have since been working on a proposal/idea that would use machine learning to “solve” this problem, instead of side-stepping it. I call medium a “…
So I recently did a talk on Joy of Software Development. You can read more about the talk here (link includes slides and list of topics covered). This post is devoted to the references I’d promised to link to in the talk. Since it was an introductory talk, and I didn’t want to bore people to death, I decided to cover lots of topics at a shallow depth, instead of covering a few topics deeply. This…
I consider myself a UX enthusiast. I consider that term to aptly describe my interest in UX. As I’m deeply involved in many UX and design decisions, I try to be well read on design and UX principles. While reading a discussion about iPhone prototypes on HN in June ‘12, I came across this comment: Goes to show what it takes to achieve excellence: lots of trial and error. Produce at least 3…
February has been an interesting month for me. I haven’t been programming a lot, but have definitely been writing a lot. I have got a few more upcoming projects as well, which I’d love to announce soon. We recently held a short 8-hour CTF (scytheCTF) on Backdoor. I made two challenges for the CTF: SHITTY-OTP LOST-FOUND Both of these problems were rush jobs because of several reasons: We didn’t…
Source I am not a competitive programmer. I love programming, but more so I love building things. As a result, I rarely participate in coding contests. Even when I do, I try to use languages like Ruby and Python just to see if I can do it my way , so to speak. While trying a contest in Ruby, I realized that I could not use the ruby prime library. This is a standard library in Ruby for a long…
To start with, here’s a piece of art that is meant to offend you : The above is an artwork by MF Hussain. Its was sold as an untitled work by Hussain to a private collector, but was named Bharat Mata later when it was sold in an auction. Were you offended by looking at it? Maybe. Does it look vulgar and offensive to you? Perhaps. What should you do as a result? CLOSE THE TAB! Seriously, India. The…
As part of a pre job interview for a position as a security consultant, I was asked this question. The interviewer expanded the question further as : Given the choice between a luxurious journey in a passenger jetliner (flying business class) and a thrilling trip as a fighter pilot, which one would you choose? My immediate reply was (without a single doubt): “I’ll take the fighter jet, thanks.”…
I was eagerly awaiting the release of Yu Yureka, which has been widely hailed as a great budget phone by most reviews. I won’t go into the details of the phone, but rather the flash sale that took place on 13th Jan ‘15 (on amazon.in). Far from being a well-managed affair, the website was plagued with issues, and went down for everyone a couple of minutes before the sale. Still, a few lucky people…
I’m a lazy reader. I’ll often start books and leave them halfway, often juggling 3-4 books at the same time. I read in sprints, often spending a few days just finishing lots of books followed by reading nothing for the next few weeks, perhaps. But that doesn’t mean I don’t appreciate good books. This is the story of how I found my favorite writer, and how I discovered the wonderful books that I…
We recently participated in ECTF-14 and it was a great experience. Here’s a writeup to the web400 challenge: Problem Statement The chat feature was added to Facelook website and to test it, founder of the company had sent a message in chat to the admin. Admin reads all the chat messages, but does not reply to anyone. Try to get that chat message and earn the bounty. [Annoying Admin] The challenge…
If you’ve known me for a while, you might know me as a privacy conscious individual or perhaps as someone who leads a very public life. The truth is that I lead both these lives; and while that may sound oxymoronic to some, its perfectly clear to me. I’m a huge privacy advocate. I still remember the day I woke up and read about PRISM first thing in the morning. My reaction was a mix of disbelief,…
Note : This is cross-posted from Quora where I wrote this answer initially. The first project on GitHub was grit . How do I know this? Just some clever use of the search and API. Here’s a GitHub search to see the first 10 projects that were created on GitHub. The search uses the created keyword, and searches for projects created before 15 Jan 2008. They are (in order of creation) (numeric id of…