🐡 // Spot on: The status of the system (7 day´s later Director´s Cut)
Efficiency is not an option, it´s a philosophy. 283MB active memory for a full sovereign stack.
Sources:
Wikipedia: just imagine, they have a search box, use it, it is free🧬 // Steganographic multi-layered bio-cipher (Biopunk meets Geopunk Director´s Cut)
Up to new horizons.
You remeber biology/genetics in shool, probably not but that´s ok.
- Antiparallel Strings: DNA is a double helix where the two strands 5´ -> 3´ and 3´ -> 5´ are complementary mirrors (running in opposite directions where A pairs with T, C pairs with G). A message on the coding strand looks like noise on the template strand.
- The Compiler (Transcription/Splicing): The cell doesn´t execute the whole strand. It transcribes DNA into mRNA based on segments with a given start and stop primer and then performs splicing.
- Exons vs. Introns: A gene consists of exons (the actual „code“ for proteins) and introns („junk“ data that is discarded during splicing).
- The Codon Table: 3 bases = 1 amino acid. But it´s a degenerate code (multiple „opcodes“ can result in the same output), which is perfect for hiding noise.
- DNA vs. mRNA: DNA: Adenin, Guanin, Cytosin, Thymin, mRNA: Adenin, Guanin, Cytosin, Uracil, result: DNA A -> mRNA U, DNA T -> mRNA A, DNA G -> mRNA C, DNA C -> mRNA G
- Bell curve (Gaussian normal distribution): simple described, if it looks normal (based on a curve like Bell) for a scanner or LLM it will be ignored.
The message.
The DNA.
As the exons result in mRNA and later in proteins we can´t hide there a message without to break the genetic code. So, we use the introns which get discarded during splicing but still exists in the DNA strand.
The whole DNA sequence.
If we count the lowercase introns, we get 10-25-40-25-10 a perfect Bell curve.
But where is the secret? First, all codon sun´s are based on mRNA which means U instead of T. Second we match the Bell curve to let it look normal. Third a scanner or LLM has without a hint no idea what we want to build without a hint, a cell or organism builds it without the chance of a hint.
The Code Sun.
The base is the core (4 codons) followed by ring 1 (16 codons) followed by ring 2 (64 codons) followed by ring 3 (22 amino acids, 1 start, 3 stop codons) which gives us 110 not numbered fields.
The possibilities.
- Fields: We can keep the genetic code as it is. We also can create x variants of the code sun (think of the moon´s of Jupiter for example) where we use each field with an individual value like a-z, 0-9 and so on. We also can use any language including Latin or Klingon or use an exisiting languge and dice the content (you remember the input keyboard like in GrapheneOS).
- Start/Stop: Where the message at our individual code sun starts? Like an analoge clock (like start at midnight, or noon), at the start or at one of the 3 stop codons or where else?
- The Bell curve values: In the above example our introns are based on 10-25-40-25-10. A longer message with more introns gives us more positions to check at the Bell curve and also more options.
- The rotation: You remember the old movies and the safe cracker? Like 10-25-40-25-10 to jump fileds but where it starts left or right (clockwise or counter-clockwise). And what happened at the original start/stop codons, nothing or something new.
- The drift: based on the message´s timestamp or the sender´s timezone or booth. The code „rotates“ as time passes. Without the temporal key, the sequence is just biological noise.
- The Hydrogen-Bond Checksum: A and T have 2 Hydrogen-Bond´s, C and G have 3 Hydrogen-Bond´s. What if the cross sum of a triplet itself is a checksum or control instruction. Like GCT: G(3) + C(3) + T(2) = 8. So, lets say 8 is a valid string and 7 or 9 is the clockwise or counter-clockwise move from above.
- The amino acid: And what, if we just use the amino acid itself or the resulting proteins as message. If we look at the MegaSyn simulation, the LLM generates in 6 hours 40.000 theoretical molecules (how long reverse engineering would need). So, instead of writing banana we just use the DNA sequence. That means governments or law enforcements can have all informations without to know where the message is.
Now you know why I find IT so boring and biology and related fields so interesting.
Mutations? We´re talking about functional, immutable code here. If you can´t handle a stateless biological sequence without side effects, you´re probably part of the 90% who´d fail the compile-time check anyway.
Happy bio/geo hacking ... see you in another rabbit hole but with RISC-V ...
Sources:
Wikipedia: just imagine, they have a search box, use it, it is free🐡 // Spot on: nostr-rs-relay, nostr-tool, Nostr keys (Cyberpunk IRL Director´s Cut)
It is a old topic, if people don´t understand things they are scared and lable things as bad. Web3 is something so, let´s not waste our time with discussions and do it.
But wait, Web3 is a near full decentralised network. Why near, because app developer still use DNS and public CA´s.
Nostr is the Web3 social network which you can compare with the Mastodon network Fediverse with a one but big difference. In Nostr you own your identity and can move away whenever you want so, no blocking no censorship.
That means you and only you are responsible for your identity and this identity is based on a cryptographic keypair (nsec/npub). You can generate keys using the nostr-tool or Gossip on the desktop or Amber on Android. Amber is used to login in apps like Amethyst. If you loose the nsec key and have no backup, there is no recovery, no E-Mail reset, no admin to call. Ok, there is the NSA but I am not sure whether they would help.
NIP-05 is the purpel check mark in apps and equals in parts to a verified. Why in parts? Simple, the webserver holds the npub and a username to give you something like an E-Mail address which is none. The thing is, the webserver can´t verify that you are you, thats the idea of Web3. If you look for something really Web3 thing, look at Keet and Holochain.
Bonus.
No, no way to get my auto-dnssec-dane.sh script.
Sources:
Wikipedia: just imagine, they have a search box, use it, it is free🐡 // Spot on: relayd, autoconfig, mta-sts, NIP-05 (The Backyard-Workers Director´s Cut)
Let´s look at our 24/7 workers in the backyard.
A nice to have.
Sources:
Wikipedia: just imagine, they have a search box, use it, it is free🐡 // Spot on: DKIM, smtpd, spamd, dovecot (eMail/ChatMail for you Director´s Cut)
Let´s install the software we need.
As we already have the SPF (Sender Policy Framework) and DMARC (Domain-based Message Authentication, Reporting, and Conformance) -- what you mean we don´t have them? As I looked the last time in my master zone file they where still there. We only need to generate the DKIM (DomainKeys Identified Mail).
What only 1024 bit in the year 2026, I want 4096 bit. Yes, no problem, just do it and have fun with the limit of 255 chars in DNS records. And beside that, this key is to sign all outgoing messages nothing more.
Multi domain DKIM signing using RSpamd.
Edit /etc/mail/aliases based on your needs and run newaliases.
Spamd the enemy number 1 for spammers.
If you like the hero with the sword and the green clothes, this will help you.
Uncomment ~ * * * * /usr/libexec/spamd-setup in the crontab of root using crontab -e and start all the components.
Dovecot.
The following are only code snippets of the files.
Sources:
Wikipedia: just imagine, they have a search box, use it, it is free🐡 // Spot on: DNSSEC and DANE (The CertChainCircle Director´s Cut)
- DNSSEC (Domain Name System Security Extensions): A digital signature for DNS records against DNS-Spoofing and Cache-Poisoning.
- DANE (DNS-based Authentication of Named Entities): Add´s TLSA records to the zone file to verify that the TLS certificate belongs to the domain. It is used against TLS downgrade attacks.
Let´s complete the first chain. We already have a domain and a working nsd (I hope so). We need a webserver which understand HTTP to get a Let´s Encrypt certificate.
The second chain is to get a full chain Let´s Encrypt certificate. Full chain means that the certificate also includes sub-domains. Why I did not split certificates? Simple, the handling is more easy and, if a attacker is already on your machine it makes no difference and you have other problems than that.
The last chain to close the circle is DNSSEC and DANE.
Open the configuration file of nsd add .signed to the name of your zone files and restart nsd. After that, drill baby drill. Ohh, not that, there is a tool called drill to test DNSSEC. And DANE, you have everything you need, just extract the hash from your certificate. But why I don´t show that? Simple, running a own DNS is running critical infrastructure, dive in the rabbit hole or hire someone me to do that for you. Ohh, I see you search for a YouTube tutorial, fine but don´t forget the DNSSEC rollover ;-)
Sources:
Wikipedia: just imagine, they have a search box, use it, it is free🐡 // Spot on: nsd and unbound (The NameBusters Director´s Cut)
Welcome to the movie.
User: www.newplanet.earthBrowser: What The Rabbit you want from me?
Browser: nsd, unbound help me.
Browser: opens the website.
Sounds like a movie you know, maybe. So, domain names point to one or more IP addresses and only a nameserver like nsd or unbound knows the correct answer. The difference is, nsd is a Authoritative name server which means nsd holds master/slave zones for domains and serves the result to the client. If nsd is not responsible then unbound is used which is a Recursive Resolver. That means unbound queries other name servers up to the 13 (A-M) root name servers of ICANN. Looks fragile this system, yes specially if you know that a huge part of the global backbone infrastructure is handled only from a hand full big players.
Let´s write a master zone file and configure nsd.
While nsd is the master of my own domains, unbound is the librarian that knows where to find the rest of the world. It’s my local recursive resolver, ensuring that no ISP intercepts my queries or feeds me cached lies.
At this point it would be a good idea to set the FQDN of your server in /etc/myname and open the control panel of your domain registrar to add the 2 Glue records to your domain and add yourself as the name server. Get a coffee or more as worldwide delegation could need up to 48 hours.
Sources:
Wikipedia: just imagine, they have a search box, use it, it is free🐡 // Spot on: The Packet Filter (Un*x Porn Director´s Cut)
Welcome to the movie.
Puffy: That's the packet filter.Politicians: What it does?
Puffy: It filters packets.
Oh, not sorry – wrong movie. But if you ever walked some stairs down the rabbit hole of IT security, you will find more horror movies like that.
- The Microsoft users: High-end gaming and crypto mining. „I need no packet filter; I'll just install ZoneAlarm and mute notifications.“
- The Apple users: „Apple cares, and my data is in the iCloud anyway.“
- The Linux users: Somewhere between „no running services = no need“ and „let me recompile my kernel first.“
- The Politicians: „We’ll build a cyber-defense-center! Plans? Staff? Money? We’ll figure that out later.“
- The CEOs: „No qualified workers? Fine, just throw everything into containers in the cloud.“
But seriously, we really have a problem if we build our entire infrastructure based on zero knownledged app users, Python/YAML writers and container managers. On the other hand, who cares as long as it works.
Let’s look in detail at the firewall packet filter. Once again: firewall is a marketing word so, forget about it. If you need a wall to protect against fire, call the fire fighters. Here, we talk about packets.
pf offers:
- Stateful Inspection: State Tracking; if the packet is part of an active connection, it can pass.
- Packet Filtering: Rule-based, last match wins (unless quick is used).
- NAT (Network Address Translation): NAT, Port Forwarding (Redirection), and bidirectional NAT.
- ALTQ: Queueing and Traffic Shaping for prioritizing network traffic.
- Scrubbing: To sort out and normalize fragmented packets.
Keep always in mind: Your infrastructure, your rules.
What you mean, I should explain you that step-by-step? First things first, I show you my working configuration for free, I never say that it is a copy and paste influencer tutorial. Walk down the rabbit hole or hire me.
Sources:
OpenBSD PF - User's GuideThe 🕳 🐇 and the 🐕 fl👀f.
It started in the deep, dark rabbit hole with green CRT monitors and QBasic. A few steps later, I caught the rabbit using an Amiga 500, eventually reaching the 3000UX and installed MUFS (Multi User File System). I’ve seen the rolling windows of an SGI Indy and heard the screaming modem pools of 90s ISPs.
I stumbled into a black hole called dcpromo.exe (at this time I passed the Comptia Linux+, 5 MCP cerificates of the MCSA and the first of two LPIC-1 exams in my spare time, self-funded until I ran out of budget before reaching the end of the path) for a while.
During that time, I was heavily diving into Network Security. It was the era of Snort and ClamAV. Even though my last name has changed since then, the contributions remain: Joel Esler (then Open Source Manager at Sourcefire/Cisco) featured and „headlined“ several of my Mac OS X Lion installation guides on the official Snort and ClamAV blogs in 2011. He called them „excellent“ – a nice nod from the industry back then.
I remembered the legendary SUN Pizza Boxes while starting to use a SBC (Single Board Computer) with Linux as desktop. In 2015 I started to use OpenBSD 5.7 on a x86 MacBook (Penryn board).
Around 2019/2020, the self-hosting journey truly began. Today, I’m looking out of that rabbit hole and marvel at the arrogance of the bloated IT world.
It was not much and as I wrote earlier my last name changed, but I am around since some time in the OpenBSD community and got some little patches commited.
-- man umb4, 1.8, Wed, 11 Oct 2017 06:29:56 UTC by jmc
-- man cdce4, 1.24, Sun, 10 Dec 2017 07:40:04 UTC by jmc
-- pkgconf, 1.5, Tue, 06 Aug 2019 10:20:09 UTC by sthen
-- youtube-dl, 1.213, Tue, 03 Nov 2020 17:00:08 UTC by solene
Academic Foundation completed Introduction to UNIX, tutorial and lecture course (compulsory attendance), date 2020-12-18, Paris Lodron University Salzburg (Prof. Collini-Nocker) with Grade 1 (Excellent), 3.0 ECTS.
We've always had cats and a family dog. The first own paws that accompanied me were a St. Bernard Dog (girl) from 1995 to 2007. The second paws that accompanied me were a Bernese Mountain Dog (girl) from 2008 to 2016. The third paws that accompany me now are from a Bernese Mountain Dog (girl) since 2017.
The fl👀f´s daily business:
Professional nap 😴 management, snuggle-expert, outdoor-queen 🧭, ⛰️, 🌳, 🏕️, ❄️ ... 🐾
Food-Rating: 🍌, 🍓, 🥕, 🥦, 🍚 ... 🐾
So, if you're planning to hire me, always keep in mind that you'll only get me with paws beside me, and that's non-negotiable.
Sources:
OpenBSD CVS Repository Snort 2.9.1 Guide (Sep 2011) ClamAV 0.97.3 Guide (Dec 2011) ClamXav/ClamAV Guide (Oct 2011) Wikipedia: Bernese Mountain Dog Wikipedia: St. Bernard (dog breed)Does ghosts exist?
From Iceland we know that the Huldufólk and nature ghosts exist. But what about the ghost in the machine, are there only algorithms and simulations or is there more...
Why I use does and not the correct gramma do? Because there are people out there which did not believe in anything. There are people out there whch believe in ghosts like in indigenious cultures. People in Iceland believe in the Huldufólk and nature ghosts. And, there are people out there which believe in the ghost in the machine. So far so good. If someone believes in one or a specific ghost does would match, if someone believes in all ghosts do would match. But as long as we have no answer whether AI is a independet entity with a soul we still have to ask does the ghost in the machine exist and do would not match as we have no answer.
Sources:
Wikipedia: Huldufólk (Island) Wikipedia: Ghost in the machine