The Goal I wanted to disable audio recording on one security camera. The RXCamView app could mute live playback, but that does not stop the recorder from saving audio. For that I needed the recorder’s web interface. Small problem: I did not know its IP address. I had only my Android phone on the same Wi-Fi network, while Hermes was running on a server somewhere else. That phone was already connected to my Tailscale network. Could Hermes use it as a remote nmap probe? ...
The Goal I run /e/OS on my phone. No Google services, and I’d like to keep it that way. I still need Microsoft Teams for work chats, though. But I don’t want the Teams app or Microsoft Authenticator on this phone. On my Linux laptop, Teams in the browser works perfectly. So surely a browser on Android can do the same? Well… not out of the box. The Catch Teams on the web officially supports Linux desktop browsers, but not mobile browsers. Open teams.cloud.microsoft on Android and you’re sent to the app store. ...
The Wake-Up Call A few days ago my hosting provider sent me a friendly message: “Warning: 500 emails have just been sent by your account.” Not what you want to read on a Saturday evening. My first thought: someone dropped a PHP shell on my WordPress blog and is using it as a spam cannon. I renamed PHPMailer as an emergency brake and started digging. What It Actually Was The good news: no shell. WordPress core and all plugins passed their checksum checks, and there were no unknown admin logins. The culprit was my own security plugin. Wordfence was blocking a brute-force wave of about 500 login attempts, and it was configured to send me an email for every single block, with no hourly limit. So the security plugin did its job and still got me an abuse warning. ...
The Goal PRTG has been my bread and butter for years. I do PRTG consultancy, hosting and training, so this post is not a “PRTG is bad” rant. It isn’t. It’s a very good product, and for a lot of customers it’s still the right choice. But I wanted to know what open source can do in 2026. I mean really free: no licence per sensor, no “community edition” with the good stuff behind a paywall. So I wrote down what PRTG does for me today and went shopping. ...
The Goal Our family is immigrating to Curaçao, and I wanted to see how many days were left at a glance. I had an Ulanzi TC001 pixel clock lying around, freshly flashed with AWTRIX 3. A 32×8 LED matrix that counts down to the beach. How hard can it be? The Catch AWTRIX 3 can store custom apps, but it can’t run any date logic on the device. A countdown means something else, like Home Assistant or a script, has to push a new value every second or minute over MQTT or HTTP. I don’t run home automation, and I didn’t want a PC on all the time just to feed a clock. ...
The Goal I run Hermes, an open-source AI agent, on my home server. I talk to it through Discord and Telegram. It ran on my OpenAI subscription, and I also pay for Claude Pro. So I wanted to use Claude as a model in Hermes too, and switch between the two per conversation. The Catch Hermes has a native Anthropic provider. But using a subscription there instead of a pay-per-use API key needs Claude Max plus extra usage credits. I have Pro, not Max. ...
The Goal The Dutch government is building its own Linux workplace. It’s called DAWO, short for Digitaal Autonome Werkomgeving Overheid (digitally autonomous government work environment). It’s developed within the Ministry of the Interior (BZK), and the code lives in DAWO-Core on Codeberg. It moved there from code.overheid.nl. Under the hood it’s a NixOS flake. I build KompassOS as a hobby: a KDE distro on Fedora Atomic, based on Aurora. So of course I wanted to know: what if DAWO were the foundation and KompassOS sat on top? I don’t know if this government project will take off. But if it does, it would be nice to be ready. ...
For educational and research purposes only - only test systems you own or have explicit permission to test. The Goal I want to clone a MIFARE Classic 1K card with my Flipper Zero. 24 of 32 keys unknown, no reader access. Card-only attack because I don’t want to go to the card reader to test ;-) The Rabbit Hole The tooling landscape is a graveyard: - FlipperNested - EOL since 2023 - HardnestedRecovery (PC) - silently skips every log line containing dist, which current firmware writes on all of them - FlipperNestedRecovery (PC) - old log format, crashes on heap corruption - MFKey FAP (on-device) - works, but slow and memory-hungry ...
If you manage Windows updates through WSUS, you’ve probably been there: a server is missing patches, you dig into it, and it turns out the product category was never enabled in WSUS. No warning, no report - it just silently never synced those updates. The frustrating part is that WSUS has no built-in way to tell you which product categories your clients actually need. You can see what’s subscribed, but not what you’re missing. It doesn’t know what’s installed on your clients unless you’ve already told it to care. ...
Somewhere over the Atlantic (on a plane heading to holiday) I had some spare battery so I was forced had to figure out something that had been bugging me for a while: when gaming on my Linux laptop, I never really knew whether Steam was using the NVIDIA GPU or the integrated Intel chip. No internet, but I did have a terminal. What follows is half an hour of trial and error at 10 kilometres altitude. ...