• State “DONE” from “TODO” [2026-09-24 Thu 06:42]

I have recently published my blog, but have been writing for some time: study notes, snippets, tutorials, thoughts. My writing almost exclusively happens in emacs, specifically spacemacs. I use org-mode for writing and organizing my notes. I have been using spacemacs for years now and it feels like a second home to me. Funnily, since the advent if AI I use org-mode even more - turns out keeping things in plaintext is really cool (as we all have known for some time now, right?). Finally I have decided to publish my thoughts and ideas, more as a braindump and easily accessible archive than anything else. This post aims to describe the tools I use and my setup to publish to my blog.

Recently a malicious AUR package used a npm dependency (atomic-lockfile) to compromise systems. What was insidious about the attack was that it was more indirect than installing a simple backdoor: the PKGBUILD looked clean, instead the payload was in a transitive npm dependency.

That means it was very hard to detect (I certainly do not check all AUR dependencies) and it ran silently during the install phase. The incident was a good opportunity to have a closer look at my own setup.

The supply chain attacks on linux just keep coming: in June 2026, a malicious package was discovered in the Arch User Repository (AUR). I first read about this in ioctl.fail . Here is what happened in the short version (for long version go to ioctl.fail).

An attacker masked a binary by hiding it in the dependency tree of (the legitimate package) atomic-lockfile (v1.4.2). The hidden binary runs at install time via an npm hook. It is designed to steal credentials, installs a persistent systemd service and loads an eBPF rootkit to hide itself and exfiltrates everything over Tor. All silently - so this is pretty advanced stuff.

• State “DONE” from [2025-05-09 Fri 12:18]

Welcome back to the Linux CLI tools series. Today’s focus is on awk, a versatile text-processing tool, and how to use it to filter out events from a calendar file. This had a specific use case for me, because I wanted to filter out all events from an exported .ics file before a certain date. I needed to import the filtered events to a new calendar and want to avoid duplicating events. So, my main goal: Delete all calendar events before April 1, 2025, from a .ics file, using just the command line.

• State “DONE” from “TODO” [2025-03-27 Thu 14:44]

Natas teaches the basics of serverside web-security.

Each level of natas consists of its own website located at http://natasx.natas.labs.overthewire.org , where X is the level number. There is no SSH login. To access a level, enter the username for that level (e.g. natas0 for level 0) and its password.

Each level has access to the password of the next level. Your job is to somehow obtain that next password and level up. All passwords are also stored in etc/natas_webpass. E.g. the password for natas5 is stored in the file /etc/natas_webpass/natas5 and only readable by natas4 and natas5.

• State “DONE” from “TODO” [2025-03-27 Thu 14:43]

The Bandit wargame is aimed at absolute beginners. It will teach the basics needed to be able to play other wargames. If you notice something essential is missing or have ideas for new levels, please let us know!

Note for beginners This game, like most other games, is organised in levels. You start at Level 0 and try to “beat” or “finish” it. Finishing a level results in information on how to start the next level. The pages on this website for “Level <X>” contain information on how to start level X from the previous level. E.g. The page for Level 1 has information on how to gain access from Level 0 to Level 1. All levels in this game have a page on this website, and they are all linked to from the sidemenu on the left of this page.