RSSAmplifier

Blog

die-welt.net

a broken world by Evgeni Golov

die-welt.netRSS feed ↗10 posts

Latest posts

Converting Dovecot password schemes on the fly without (too much) cursing

I finally upgraded my mail server to Debian 13 and, as expected, the Dovecot part was quite a ride. The configuration syntax changed between Dovecot 2.3 (Debian 12) and Dovecot 2.4 (Debian 13), so I started first with diffing my configuration against a vanilla Debian 12 one (this setup is slightly old) and then applied the same (logical) changes to a vanilla Debian 13 one. This mostly went well.…

Validating cloud-init configs without being root

Somehow this whole DevOps thing is all about generating the wildest things from some (usually equally wild) template. And today we're gonna generate YAML from ERB , what could possibly go wrong?! Well, actually, quite a lot , so one wants to validate the generated result before using it to break systems at scale. The YAML we generate is a cloud-init cloud-config , and while checking that we…

Home Assistant, Govee Lights Local, VLANs, Oh my!

We recently bought some Govee Glide Hexa Light Panels , because they have a local LAN API that is well integrated into Home Assistant . Or so we thought. Our network is not that complicated, but there is a dedicated VLAN for IOT devices. Home Assistant runs in a container (with network=host ) on a box in the basement, and that box has a NIC in the IOT VLAN so it can reach devices there easily. So…

Booting Vagrant boxes with UEFI on Fedora: Permission denied

If you're still using Vagrant (I am) and try to boot a box that uses UEFI (like boxen/debian-13 ), a simple vagrant init boxen/debian-13 and vagrant up will entertain you with a nice traceback: % vagrant up Bringing machine 'default' up with 'libvirt' provider... ==> default: Checking if box 'boxen/debian-13' version '2025.08.20.12' is up to date... ==> default: Creating image (snapshot of base…

Using LXCFS together with Podman

JP was puzzled that using podman run --memory=2G … would not result in the 2G limit being visible inside the container . While we were able to identify this as a visualization problem — tools like free(1) only look at /proc/meminfo and that is not virtualized inside a container, you'd have to look at /sys/fs/cgroup/memory.max and friends instead — I couldn't leave it at that. And then I remembered…

Arguing with an AI or how Evgeni tried to use CodeRabbit

Everybody is trying out AI assistants these days, so I figured I'd jump on that train and see how fast it derails. I went with CodeRabbit because I've seen it on YouTube — ads work, I guess. I am trying to answer the following questions: Did the AI find things that humans did not find (or didn't bother to mention) Did the AI output help the humans with the review (useful summary etc) Did the AI…

show your desk - 2025 edition

Back in 2020 I posted about my desk setup at home . Recently someone in our #remotees channel at work asked about WFH setups and given quite a few things changed in mine, I thought it's time to post an update. But first, a picture! (Yes, it's cleaner than usual, how could you tell?!) desk It's still the same Flexispot E5B, no change here. After 7 years (I bought mine in 2018) it still works fine.…

running modified containers with podman

Everybody (who runs containers) knows this situation: you've been running happycontainer:stable for a while and it's been great but now something external changed and you need to adjust the code while there is still no release with the patch. I've encountered exactly this when our Home-Assistant stopped showing the presence of our cat correctly , but we've also been discussing this at work…

naming things is hard

I got a new laptop (a Lenovo Thinkpad X1 Carbon Gen 12, more on that later) and as always with new pets, it needed a name. My naming scheme is roughly "short japanese words that somehow relate to the machine". The current (other) machines at home are (not all really in use): Thinkpad X1 Carbon G9 - tanso (炭素), means carbon Thinkpad T480s - yatsu (八), means 8, as it's a T4 8 0s Thinkpad X201s -…

Unauthenticated RCE in Grandstream HT802V2 and probably others using gs_test_server DHCP vendor option (CVE-2025-28177)

The Grandstream HT802V2 uses busybox' udhcpc for DHCP. When a DHCP event occurs, udhcpc calls a script ( /usr/share/udhcpc/default.script by default) to further process the received data. On the HT802V2 this is used to (among others) parse the data in DHCP option 43 (vendor) using the Grandstream-specific parser /sbin/parse_vendor . … [ - n "$vendor" ] && { VENDOR_TEST_SERVER = "`echo $vendor |…