Recent content on Noah Bailey
In my career in technology, I’ve heard one specific term so many times that it’s lost all meaning.
The stack needs to be scalable. Our team needs to be scalable. Why aren’t we using a scalable database? That thing in particular, that thing over there, it’s not scalable enough!
And it’s not just that it’s meaningless, it’s that I find it entirely…
Over the past couple of years it’s been difficult to ignore stagnation of the world around us. Products have gotten smaller and quality has been reduced, roads have more potholes than ever, and food seems more bland and less nutritious than ever. Our software and services cost more than ever, but seem to constantly suffer from issues they never had before. Years of neglect seem to be…
I don’t like to cover “current events” very much, but the American government just revealed a truly bewildering policy effectively banning import of new consumer router models. This is ridiculous for many reasons, but if this does indeed come to pass it may be beneficial to learn how to “homebrew” a router.
Fortunately, you can make a router out of basically…
The following are emails I sent to my member of parliament. I encourage everybody to read, copy, and take inspiration from these.
March 13, 2026
Hi <MP Name>
I’m writing to you today about the upcoming vote on the “online harms” bill. I believe you think you are doing the right thing; protecting the youth from the horrible things that can happen on the web. However, this legislation…
A common usage of CI/CD tools today is to build and deploy a static website to a CDN.
This has many advantages over the old way (like running Wordpress), such as security, cost, and flexibility. Developers love the ability to use any crazy JavaScript library they want on the client side, Sysadmins love not having another PHP server to feed and water, and accountants love the bill!
However,…
I can’t count the number of times over the last decade I have heard the phrase, “Data is the new oil!”
I’m unsure who originally coined the phrase, but it’s been repeated so many times that surely everybody in the tech world, whether they work for an ad firm (oil=good), are a staunch privacy advocate (oil=bad), or believe in incrementally changing the status quo…
A key part of operating any safe and reliable system is ensuring that there is a way to recover deleted or lost data in a prompt and consistent way. One key part of that is to maintain automatic backups that are recoverable and verifiable.
This is a quick and easy way to accomplish that goal, by using existing pieces of infrastructure that are common in production networks. There are countless…
Like anybody, I’ve made my fair share of spelling mistakes in my life. It was never something I had a particular talent in, having never gotten a spelling bee medal myself. Red underlines have always been a simple fact of life for me.
But fortunately, I’ve never made a spelling mistake so consequential that it’s been broadcast at least 200 billion times every day!
This is…
In an absolutely perfect world, we’d never have to restart our server software ever, because it would be flawless. There would be no bugs, memory leaks, state locks, and we’d all get along with each other!
Unfortunately, we live in a much crappier world where our software is imperfect, and we don’t have enough time or resources to fix it properly.
In the olden days,…
You’ve got a new idea for a product, or a store, or maybe just a neat pun. So it’s time to buy a domain, isn’t it?
That’s the easy part. Put in your credit card info, add a reminder for next year so you remember to renew it, and you’re set. But that’s far from the end! There’s a lot of work to make sure everything is set up correctly, and the best time…
I recently had the pleasure of attending a community meeting. The purpose was to form a group to represent our neighbourhood at the municipal level, as a liaison, and as a check against the ward councillor. I expected, and hoped, there would be some lively discussion about issues at hand, solutions, and ideas.
What I got instead was an hour of bickering between different groups about who…
It was a cold, rainy November night in 2013, and I was hunched up over my desk trying to get my sound card working.
In my teenage years, I had taken on a keen interest in “Hackintoshing”, that is, installing Apple’s Mac OS (then OSX) on regular non-Apple PC hardware. While my box was fairly well behaved, it had two quirks that were eluding me. My sound card didn’t work…
I finally caved and bought one of the no-name 8" mini laptops from Aliexpress. I’ve had my eye on these for a long time. Really, since the days of my youth with the Sony Vaio P and other iconic UMPCs of the early 00’s. The game changer was the original GPD Pocket from a few years back. Now, there’s a cambrian explosion of cool tiny computers coming from China.
This particular…
Database recovery is tricky at the best of times, and it never seems to happen when and how you expect. In this case, my self-hosted Zoneminder server crashed hard and came up broken. It appears to be related to some index or table in the database getting corrupted, but I’m not enough of a “database surgeon” to say with any certainty.
When this crash happened, the first sign…
A neat feature of almost every modern digital camera is that every single photo you take includes detailed metadata, including all of the photo’s settings including shutter speed, aperture, sensitivity, and focal length.
The focal length, or simply the “zoomness” of your photo is of particular interest. All of the other settings are very easy to change by adjusting a dial (or…
Taking photos is fun and easy.
Just kidding, it’s a fractal of complexity, FOMO, and slowly realizing how little you actually know.
However, one nice thing is that using some simple Unix/Linux tools, it’s remarkably easy to mass produce good looking JPEG images from your raw photos, without having to actually learn Lightroom.
After a few days of fiddling with the settings,…
This is my phone. It’s a 2016 iPhone SE, and for the past seven years, it has been my main computing device and the centre of my digital life.
It’s outlived four laptops, three pairs of headphones, survived through dozens of trips away from home over three continents, a couple drops, and one close call with a broken umbrella in the fierce Ontario summer rain. It’s had two…
I’ve realized recently that I have to very carefully create boundaries around my hobbies to protect them.
I like to take pictures. Sometimes of my cats, other times of neat things I see while traveling or exploring, and always to document things that I find interesting in the physical world.
The encroachment of legitimacy It starts with a cheap sewing machine before spiraling into…
While there are plenty of IOT security cameras that promise privacy, none of them really do. Eufy recently got busted for secretly accessing peoples’ feeds, Unifi got breached, and literally every off-shore IOT device is slurping as much metadata (and regular data) off your devices as they possibly can. It’s not hard to understand a need for secure and private home security…
With Mastodon quickly becoming a refuge for former bird-site users fleeing the new regime, many are considering self-hosting their Fediverse instance. There’s many good reasons to do this, such as privacy, data ownership, or even maintaining consistent performance while larger communities struggle to on-board an influx of new users.
But, as always, self-hosting means new…
Anybody who runs an internet-facing webserver has seen their fair share of spammy scanners in the logs. It varies server to server, but some of mine get up to 15,000 scans per day.
Almost all of these are harmless network mappers, but they still annoy me. Many are compromised hosts or belong to hackers & organized crime rings. While it’s possible to create false positives, it’s…
Several admins and developers like automatically updating their servers with new builds as they become available. Commonly known as “CI/CD”, this process allows teams to iterate much faster and speed up product development.
Often, this is simply pulling from a repo and running a couple docker-compose commands, which is very easy to automate.
A bad way to do this is using a cron…
This guide is for an advanced Debian GNU/Linux installation using the ZFS storage system with an encrypted root volume for security and privacy. It will also be upgraded from the current Stable release (Bullseye) to the rolling-release Unstable version (Sid).
ZFS has long been considered the last word on advanced storage developments. With its advanced safety, efficiency, and performance…
If you’ve put Redis on the internet you’ve probably had your box hacked one way or another. Unfortunately, the service has very weak defaults with no authentication, encryption, or meaningful access control. While it’s true that redis is a back-end service that should only be used between servers, it’s often misused and abused.
For example, there are about 40,000 redis…
Since late 2018, I had been a full-time Arch Linux user. At that time, it was worth it for me to spend the extra time dealing with Arch’s quirks, meticulously updating my AUR software, fiddling with all-manual configuration, and manually migrating any software between major versions whenever Pacman updated them. It was both a great learning experience, and… well… A bit of a…
I have an odd fascination with radiation… Not to the point that I’m buying “Naturally Occurring Radioactive Materials” (or NORMs for short) on eBay, but certainly to the point that I own a digital geiger counter and regularly measure… things…
Recently, I discovered https://radmon.org, a site where users can connect a counter to their API and send data to…
Log aggregation systems are fantastic. As are time-series metrics databases. But that’s not what this post is about. These methods aren’t a replacement for those systems at all, but a basic way to implement the core basics of monitoring and alerting.
You see, the strength of a SIEM or log aggregation system is its numbers. It correlates data from hundreds or thousands of sources,…
I recently installed Debian Bullseye on an old Intel NUCCAY6H mini PC I had lying around. It’s a great little device for a home server, as it’s very cheap, fits 16G of memory, and with 4 mini-cores it’s no slouch.
The first install attempt didn’t go well, with missing firmware for the NIC causing hanging for a couple minutes during boot. This happens quite a bit with…
There are lots of “very correct” ways to make your server “very secure.” Most of them rely on paid services, complicated agent-manager topologies, and cool buzzwords like “zero trust”.
However, as they say, perfection is the enemy of progress. Many are discouraged by this absolutist approach to server safety, and forget the very basics. Obviously, the…
The latest announcements for Windows 11 have revealed that the next version of the Windows operating system will have very stringent hardware requirements. Some of them are, in my opinion, quite reasonable. For example, they’re finally dropping support for 32 bit X86 and legacy BIOS boot. These make sense, because almost every PC manufactured since 2011 has supported X64 and UEFI. It also…
Your brand new cars is loaded to the gills with neat new tech. The dash is basically a giant tablet full of games and apps. It’s the hottest new tech product.
But it does have one strange quirk. While your last car had one steering wheel, which is largely considered the correct amount, this one has two.
To be more specific, you originally sought out to buy a vehicle with no steering…
One day you’re asked to fortify your home in the name of ‘safety and security’.
Depending on your career, socio-economic, and cultural backgrounds, you may produce a very different result. And with no other context besides ‘safety and security’ that’s understandable.
Some may choose to upgrade their doors to thick steel ones, and fit wrought iron bars on…
There’s a little hotdog stand outside every shopping center, supermarket, mall, and street corner in the world. It looks run down and nasty, but somehow they’re still in business. You’ve never had one. Well, once. You spent the next day feeling sick so you never went back.
How on earth are they worth $300 Billion dollars, so much that nobody in the world can seem to nail an…
I have wanted to run Kubernetes at home for some time, but the main obstacle has been a reliable solution for providing load balancing for ingress or services, and the lack of a reasonable way to manage NAT transparently. While publicly routable IPv4 addresses are seemingly limitless* in the cloud, typically we only get one at home.
Similarly, there isn’t a straightforward way to build…
This is the story of the most awful SSL certificate I have ever made. This was done entirely for my own amusement, and for the minute possibility that I could make somebody I don’t like miserable.
Now, why on earth would I want to do this? Well, I don’t particularly respect scanner people. Their scanners are annoying, their tools always suck, and they create tonnes of noise in my…
Across the street from my apartment is a house which has been in a perpetual state of renovation for nearly six months. This past week, a for sale sign has popped out of the ground just in time for the spring rush.
It turns out, the man who bought the house did so about a year ago with the sole purpose of renovating and flipping it to make a quick buck.
There’s always been a kind of temptation from the proverbial ‘other side of the fence’ when it comes to Unix-like operating systems. This idea that there’s an entirely separate and similar, but entirely distinct system from what I’m used to is exactly what’s pulled me towards OpenBSD today. As somebody experienced with almost every mainstream Linux distro, I…
One of the worst parts of modern life is how unsatisfying it is to hang up on somebody. Tapping on the ‘End Call’ button on an iPhone or angrily clicking ‘Leave Meeting’ on Zoom just isn’t nearly as fun as slamming down the handset on a real phone.
This particular project was to breathe some life into the antique Northern Telecom phone from my grandparents’…
Similar to another post about WAN latency, this is a simple system to automate periodic internet speed tests. The two main components are speedtest-cli and ElasticSearch. These were chosen because I already had both set up and running, along with all the visualization and analytical software. To get a basic POC set up, just install ElasticSearch and Kibana with Docker. Once the node/cluster is…
This is a simple, ‘quick and dirty’ way to measure network latency over long periods of time. The only ‘complicated’ part is setting up InfluxDB, but I imagine that many folks already have it set up. To get started, check the official documentation.
Network latency will be measured with the good old ping command, then formatted with generic Unix tools. Then, statistics…
Back in August, I discovered novel cyberattacks targeting network infrastructure. Now, four months later, another botnet is targeting these devices again.
My original report is here: https://nbailey.ca/post/zeroshell-botnet
New attack The previous version of the zeroshell malware would leave logs with this…
I installed Gentoo Linux on my vintage Thinkpad. This particular device has a rather colourful history. In mid 2015 I recovered it from an e-waste pile at my workplace and brought it back to life. In the years since, it’s been a playground of sorts. In five years it’s had four editions of Windows, three versions of BSD, exotic operating systems like Redox and ReactOS, and of course…
Today I got yet another malware email. They just won’t leave me alone. I suspect it has to do with the upcoming US election, based on all the CISA alerts I’ve seen over the last couple days.
However, after going down the rabbit hole with this malware I do suspect that whatever is behind it is more sophisticated than a simple ransomware gang. I won’t speculate too much, but…
I recently started using a TP-Link C7 router to host a guest network at my house. I typically avoid consumer/prosumer gear for my network, sticking to either whitebox (homemade) or older enterprise gear. Alas, the price was right ($0). Every time I do encounter one of these devices I always manage to find something fun and interesting to poke…
Bad SSH server First red flag was the sshd…
About two weeks ago, I upgraded my single node ElasticSearch cluster from 6.8.6 to the latest 7.9 version. Last night, all hell broke loose…
The upgrade itself wasn’t perfect. There were some issues with my setup that the helpful “Upgrade Assistant” didn’t pick up before I had already committed. I was missing a few formerly optional parameters in my…
Starting a little less than two weeks ago, my IDS sensors have been detecting the spread of a new botnet. Unlike previous Mirai botnets, this appears to specifically target the GNU/Linux firewall distribution, “ZeroShell”. While it’s not especially dangerous as far as botnets are concerned, it does appear to be rather vigorous when it sends probes.
However, we got lucky this…
In my endless quest to essentially create a Cisco Firepower firewall for poor people, I found a bit of a gap in the open source security ecosystem. While we have great tools for detecting malicious network traffic patterns, we don’t have easy ways of detecting malicious files in transit. So, a bit of fiddling around later, and I have a fairly basic system for integrating Suricata’s…
The idea of this setup is to protect the Small Systems as well as we protect the Big Systems.
This solution uses a proven stack to protect webservers from modern threats. Using OSSEC, Suricata, and the built-in firewall capabilities of a modern Linux system it is possible to build a low maintenance and stable threat protection platform with relatively low performance impacts.
It’s…
This is a basic procedure for setting up a linux system my preferred way.
By no means is this a tutorial or a full guide to installing Linux. There are many parts that have been excluded, since this mainly focuses on the disk layout and partitioning.
Many parts are optional, and many partitions are not strictly required. For example, the ESP partition can be shared with the /boot…
Create a systemd user-level config directory:
mdkir -p .config/systemd/user/ Create the service unit file:
.config/systemd/user/ssh-agent.service
[Unit] Description=SSH key agent [Service] Type=simple Environment=SSH_AUTH_SOCK=%t/ssh-agent.socket ExecStart=/usr/bin/ssh-agent -D -a $SSH_AUTH_SOCK [Install] WantedBy=default.target Enable the unit.
systemctl --user enable --now…