slash blog

This week I was working on a QEMU-based integration test suite and needed to customize the base QCoW2 images shipped by the Ubuntu project for use in my test harness.

Previously I would have treated this in a similar manner to EC2 and AMIs: launching a VM, SSH’ing into it and applying tweaks, and cloning it to create our desired VM image.

Unsurprisingly there is a better way in the form of virt-customize which can modify disk images by installing packages, editing files, and other settings in place.

tl;dr Spilled! is the prototypical small, relaxing, cute game. You clean up ocean waste to reveal lovely pixelated landscapes and creatures below, accompanied by a wonderful soundtrack. Runs excellent on Steam Deck - well worth your $6 entry. Separately, check out the noclip_2 interview with the developer Lente on her life and journey to game dev (she developed Spilled! while living on a canal boat ⛵).

An unfortunate and unhealthy reality about the video games industry is that the number of games and journalists covering them have grown to be inversely related. Too many games exist to get the attention they deserve. Have you ever tried sorting by new on Steam? It’s a firehose and it was like this even before AI hit the scene.

Very briefly TIL that, if like me you happen to run Tailscale on your OpenWrt device, you can extend OpenWrt’s backup/restore script to include its Tailscale state allowing its identity to persist through upgrades or restore procedures.

To do so, add a new line with /etc/tailscale/ to /etc/sysupgrade.conf. This directs OpenWrt to include the contents of this directory in its backup.

NB: The OpenWrt backup will now contain Tailscale secrets that can be used to join your Tailnet from another device, so be sure to take suitable care when storing them.

In the last year I have developed a strong interest in simracing as a hobby. We are currently living in a golden age of simulated racing with many great titles to choose from, but my preferred one is iRacing.

Alongside iRacing’s official matchmaking races there exists a large and healthy ecosystem of community-operated league races. These leagues run the spectrum from extremely competitive to very, very casual. Toward the latter end of that spectrum is the 24 Hour of Lemons community, an iRacing league that accompanies the US-based motorsport series of the same name in which people race cars worth no more than $500 for as many laps as they can.

tl;dr Every Github Gist can be accessed as a Git repository over either HTTPS via their URL or via SSH using the keys you have registered with Github.

I enjoy using gists to share example code but when multiple files are necessary it can be very cumbersome to copy and paste them one at a time and re-create their metadata. Instead I create an otherwise empty gist, clone it locally, and then edit the files or git add them as I would any other repository before committing and sharing the contents.

I recently acquired a 50 series NVidia GPU and was unable to get DLSS 4 multi frame gen working in any of the supported titles before realizing that HAGS (Hardware-Accelerated GPU Scheduling) is required to be enabled for it to function. If you are having trouble getting DLSS 4 to work with a supported GPU make sure that you have not accidentally turned HAGS off in the past like me. Hopefully this saves someone a few hours.

While working on my blog I discovered that some of the image and link sources in different posts had become broken without me noticing. Outside of “hugo says OK” I don’t have any other validation running on my blog so I decided to look for something that could lint the rendered output for dead links and other issues.

I tried a number of different tools but ended up using htmltest. It runs after hugo renders the static output of my blog in a public/ directory in the project root.

Another short “today I learned” post from the analytics mines. If you have previous experience writing any form of data munging or analytics tasks then you have almost certainly encountered Python, Pandas, and AWS S3 in some combination.

These jobs usually follow the structure:

1. download the files from S3.
2. deserialize them into Python objects & create Pandas dataframes.
3. perform calculations over these dataframes.

Normally #1 and #2 would be wasted repetitive work that is left to the reader, but there is a better way.

I attended BSidesSF this year for the first time in a while and saw Aalaa Kamal Satti and Yuru Shao of Pinterest speak about their efforts on password security for both Pinterest’s consumer and business users. During their talk they spoke about implementing support for the /.well-known/change-password URI that allows websites to integrate with the password managers that ship within most modern browsers.

These password managers have had features like checking for compromised credentials via HaveIBeenPwned for a while but prior to the .well-known/change-password URI they all suffered one crucial limitation. The complete absence of any standards in website building meant that even if they could notify a user about a weak password, they couldn’t direct them to the settings page that they needed to change it. The inability to create a one-click navigation for password updates meant that only the most motivated users would successfully find their way through to completing the flow. This definitely rings true of my own experience of the internet. Could you reliably find the change password page on any website you’ve used within the last 18 months with only three clicks starting from the homepage? I couldn’t.