Michael Stapelberg 🐧🐹😺

Mensch mit starkem Datendrang • Markdown Connaisseur • latenz-unverträglich • ::) • he/him

website: https://michael.stapelberg.ch

Public Key

npub1s050x4yvg6dfrffppghy02dhgdx5k5dk4shhyt2fpma6jt7dtttqx0tnkj

NIP-05 Address

zekjur_at_mas.to@momostr.pink

Profile Code

nprofile1qqsg868n2jxydx5355ss5tj84xm5xn2t2xm2ctmj94ysa7af9lx444sprpmhxue69uhhyetvv9ujumt0d4hhxarj9ecxjmntqyf8wumn8ghj7mmxve3ksctfdch8qatzqyv8wumn8ghj7un9d3shjtnndehhyapwwdhkx6tpds8xd8fk

Publishing to

relay.momostr.pink

offchain.pub

relay.snort.social

Author Public Key

npub1s050x4yvg6dfrffppghy02dhgdx5k5dk4shhyt2fpma6jt7dtttqx0tnkj

Show more details

Last Notes

2026-09-05 11:19:01 UTC

Paper: “Trusting-Trust Attack against an Entire Linux Distribution through Binary Manipulation”
"""
Ken Thompson's trusting-trust attack, in which a compromised compiler backdoors the programs it builds and reproduces the backdoor in subsequent rebuilds of itself, is widely regarded as a threat specific to compilers. We show that it is not. We construct a complete trusting-trust attack around GNU strip, an ordinary build utility that neither inspects nor generates source code, using only manipulations of finished ELF files. […] On a real nixpkgs revision, the attack builds a complete graphical installer without failures and backdoors almost every one of its binaries, enabling arbitrary malicious behavior of the subverted packages.
"""
https://arxiv.org/abs/2607.24888

2026-07-05 19:49:14 UTC

If you haven’t seen it:
> Bad Epoll (CVE-2026-46242) is a race-condition use-after-free in the #Linux kernel's epoll subsystem. This bug lets an unprivileged process become root, not only on Linux desktops and servers but also on Android devices.
https://github.com/J-jaeyoung/bad-epoll
Linux v7.1, v7.0.10+, v6.18.33+ are fixed (already running on my NixOS VMs, so I did not have to do any updates for this one)

2026-06-28 16:37:16 UTC

I just released https://github.com/gokrazy/rsync in version v0.3.4, which contains a couple of bug fixes 🥳
In case you’re unfamiliar: this library (and program) implements rsync client and server, which can send or receive files (upload, download, all directions supported). It’s implemented 100% in #Golang and can be embedded into your project.
---
I will say that there is as much activity in the #rsync space as I have not seen over many years: tridge rsync has an upcoming release actively in testing, kristaps is merging Apple’s changes into openrsync, which by the way seem to have been done by Klara, inc. (a BSD consultancy), so in total we have 3 (4?) active projects!
https://media.mas.to/media_attachments/files/116/828/690/718/040/369/original/370dfc74045c6c97.png
https://media.mas.to/media_attachments/files/116/828/707/593/015/331/original/fd92148964f4b998.png

2026-05-10 16:19:13 UTC

Amazing: #Debian is now shipping reproducible packages 💪
https://lists.debian.org/debian-devel-announce/2026/05/msg00001.html
Thanks to everyone who helped make this happen!
See https://reproducible-builds.org/ if you are not familiar with the topic

2026-05-04 06:20:33 UTC

- reply

It was a demo computer, so it auto-boots into a user account. It was the root password we were after, of course.

2026-05-03 08:09:22 UTC

Yesterday at the hackerspace, a friend had forgotten the password to their (demo / showcase) computer.
Luckily, the convenient new sysadmin tool “copy.fail” saved the day! With one line, we could get a root shell and set a new password 😂
Way easier than rebooting into init=/bin/bash. So convenient! 2026 is truly the year of Linux on the desktop :P

2026-03-21 09:11:50 UTC

Signal Boost: If you are willing to fix any of the #Wayland related issues I describe in https://michael.stapelberg.ch/posts/2026-01-04-wayland-sway-in-2026/, I am willing to sponsor the hardware you need for it, e.g. high-res monitor, GPU, PC, etc. and/or pay a bounty for the fix itself.
See https://lobste.rs/s/5pkjai/wayland_set_linux_desktop_back_by_10_years#c_4cpf8q for details and reach out; thanks in advance.
My goal is that #Linux works better, but I can’t do it alone. Let’s improve it together!
https://media.mas.to/media_attachments/files/116/266/379/413/548/327/original/ee262d828c256a14.png

2026-02-14 18:46:57 UTC

Nice! You can now turn off Pull Requests on GitHub (or restrict them to collaborators): https://github.blog/changelog/2026-02-13-new-repository-settings-for-configuring-pull-request-access/

2026-02-06 07:21:13 UTC

- reply

FWIW, git cherry-pick works as expected (at least)

2026-02-06 07:01:31 UTC

PSA: Did you know that it’s **unsafe** to put code diffs into your commit messages?
Like https://github.com/i3/i3/pull/6564 for example
Such diffs will be applied by patch(1) (also git-am(1)) as part of the code change!
This is how a sleep(1) made it into i3 4.25-2 in Debian unstable.
https://media.mas.to/media_attachments/files/116/022/383/654/117/984/original/793328e07ced65c1.png
https://media.mas.to/media_attachments/files/116/022/383/907/117/845/original/c482997f31768a94.png
https://media.mas.to/media_attachments/files/116/022/384/123/440/777/original/667f044c1653740e.png
https://media.mas.to/media_attachments/files/116/022/384/340/315/217/original/cfecebd9111a1c5b.png

2026-01-17 08:05:43 UTC

I recently had to deploy a change to #Debian Code Search to limit the amount of memory used during indexing a single package — because of #Firefox, which now ships as 388_859 files, totaling 1.78 GB! The resulting search index is 2.76 GB. Doing this entire indexing in one go is just too much for typical servers.
So now we flush into intermediate index files and merge them in the end: https://github.com/Debian/dcs/commit/8e76d5b9408cd12cfb6b728c1f1f3a96a9775310
The resulting drop in max heap usage is nicely visible on the graph by now :)
https://media.mas.to/media_attachments/files/115/909/378/264/977/321/original/cb85a5f9b29bbc43.png

2026-01-04 08:11:37 UTC

New blog post: Can I finally start using Wayland in 2026?
Wayland is the successor to the X server (X11, Xorg) to implement the graphics stack on Linux. […] I don’t want to be stuck on deprecated software, so I try to start using Wayland each year, and this articles outlines what keeps me from migrating to Wayland in 2026.
https://michael.stapelberg.ch/posts/2026-01-04-wayland-sway-in-2026/
#wayland #sway #i3wm #linux
https://media.mas.to/media_attachments/files/115/835/808/627/765/287/original/f01c95bc4f974034.jpg

2025-12-25 23:27:57 UTC

- reply

Are there specific changes you can think of that would make things better?
You could install the protobuf compiler through your Linux (?) distribution, or version it with your project (with a Nix flake, or similar), or use build system support (e.g. for Bazel). The Go Protobuf compiler plugin can be installed with the go tool, which seems like the natural choice to me when working with Go.
(Disclaimer: I’m the current Go Protobuf maintainer, but not part of the Protobuf team.)

2025-12-25 15:32:49 UTC

- reply

Hmm, by “shut up and calculate” what do you mean? I hear statements like “LLMs are just dumb next-token predictors” which might be true, but then you see Claude Code do things and you wonder: where does all the intelligence stuff enter the picture? That’s the part I’m interested in.

2025-12-25 11:01:49 UTC

Current LLMs have impressive quality (see e.g. https://mas.to/@zekjur/115775753642030596 for a recent example).
I thought this article was a good read regarding how human and machine intelligence / skills / cleverness relate: https://www.thealgorithmicbridge.com/p/the-shape-of-artificial-intelligence
If you know of other insightful articles or papers about this topic, please share
#note1q5k…ptv9

2025-12-24 17:36:43 UTC

- reply

Out of curiosity, I pointed Claude Code at the problem.
I provided it the backtrace of the crash and a clone of the screen repository.
This was sufficient for Claude to diagnose the issue by itself, provide steps to reproduce (which do indeed trigger the bug) and locate the corresponding upstream bug report.
(Before you ask: the upstream bug report was filed after Claude’s model cut-off date.)
The quality of this tool is transformative, especially in an Open Source environment!
https://media.mas.to/media_attachments/files/115/775/721/672/937/741/original/7067471f380f556b.png
https://media.mas.to/media_attachments/files/115/775/721/923/668/778/original/57d682d8608edac6.png
https://media.mas.to/media_attachments/files/115/775/722/145/558/964/original/2f1bce7b2ca3a0f1.png

2025-12-24 15:54:06 UTC

Found another new feature in screen 5 I do not like:
[screen caught a fatal signal. (core dumped)]
-.-

2025-11-17 18:09:52 UTC

Maybe I was just living under a rock, but in case you missed it, too: As an EU Citizen, you can use your eID on Linux, for example I used the following #NixOS config:
programs.ausweisapp = {
enable = true;
openFirewall = true;
};
…and then started “AusweisApp” to use my smartphone as a card reader in order to log my desktop into https://ec.europa.eu/info/law/better-regulation/ to make my voice heard regarding animal welfare regulation in the EU. Cool!

2025-09-21 07:48:00 UTC

New blog post: #NixCon 2025 Trip Report 🐝
NixCon 2025 happened in Switzerland this year, at the University Of Applied Sciences OST in Rapperswil, so I decided to go! In this trip report, I want to give you a rough impression of how I experienced this awesome conference :)
https://michael.stapelberg.ch/posts/2025-09-21-nixcon-2025-trip-report/
#nix #NixOS
https://media.mas.to/media_attachments/files/115/241/176/687/054/213/original/0f23eb03c470b048.jpg

2025-07-24 17:51:18 UTC

suddenly my screen went black and when SSH'ing in (which is good!), I see this message in dmesg, which is not a good sign for my GPU 😳
[42066.179639] NVRM: Xid (PCI:0000:01:00): 79, pid=5133, name=chrome, GPU has fallen off the bus.

2025-07-13 06:22:12 UTC

New blog post published 🥳
Migrating my NAS from CoreOS/Flatcar Linux to #NixOS
In this article, I want to show how to migrate an existing Linux server to NixOS — in my case the CoreOS/Flatcar Linux installation on my Network Attached Storage (NAS) PC.
→ Read the blog post at https://michael.stapelberg.ch/posts/2025-07-13-nixos-nas-network-storage-config/
https://media.mas.to/media_attachments/files/114/844/479/566/875/341/original/cc8722cce5092046.jpg

2025-07-09 16:20:52 UTC

When I couldn’t get CUDA to work immediately this morning to speed up my OCR job (≈17 000 scanned documents), I hedged my bets and started it on the CPU of this machine (not the GPU): https://michael.stapelberg.ch/posts/2025-05-15-my-2025-high-end-linux-pc/
Turns out that finished while I was at work (in ≈4 hours, consuming roughly 300W constantly, so 1.2kWh in total), so now I don’t have to figure out how to get CUDA to work to make this task any faster :P

2025-07-08 19:02:34 UTC

I spent literally hours trying to make https://layout-parser.readthedocs.io/en/latest/example/deep_layout_parsing/index.html work in virtualenv so that I can OCR text from newspaper article scans
Eventually, I got it to work (with lots of pinning) and thought: this will be a pain to productionize for my #NixOS server! …but ultimately I realized all packages I needed were actually already packaged in nixpkgs! 😅
Now with a flake.nix like https://gist.github.com/stapelberg/45bd82dec9d299fc1cf481c07f0c051d, I have a reproducible (stable!) way of running this program 🥳
https://media.mas.to/media_attachments/files/114/819/154/926/118/942/original/f60aa6208efdebcf.jpg

2025-06-27 06:50:20 UTC

- reply

I had multiple self-built tools over the years, too, but hugo is just so much better overall (even with the churn it imposes, which is manageable, tbh)

2025-06-27 06:27:38 UTC

In case it helps other hugo users, I recently upgraded from v116 to v148 and here are the commits I needed to keep my site identical: https://github.com/stapelberg/hugo/commits/master/

2025-06-17 20:02:50 UTC

Get it while it’s hot! #GopherconEU
The latest release (v0.2.10) of https://github.com/gokrazy/rsync includes fixes related to sub-directory handling, by new contributor f-luo (welcome!), as well as a couple other fixes.
gokrazy/rsync is rsync, natively implemented in #golang! implements client and server, which can send or receive files (upload, download, all directions supported).
Go forth and sync your data!
https://media.mas.to/media_attachments/files/114/700/471/553/592/490/original/c80461ec02c4319e.png

2025-06-06 15:49:54 UTC

- reply

The newly installed #NixOS system passed the “will it work in production?” test with new files successfully being saved by users (same IP address, same samba passwords) 🥳
Fun to see the CPU being, like, totally idle — I guess 20 MB files mean nothing to a modern computer anymore :)
This is on the Ryzen Mini PC, BTW: https://michael.stapelberg.ch/posts/2024-07-02-ryzen-7-mini-pc-low-power-proxmox-hypervisor/
(The software in the screenshot is called btop, before you ask.)
https://media.mas.to/media_attachments/files/114/637/192/750/029/160/original/6140a5eb92cdf1aa.jpg

2025-06-05 20:49:06 UTC

Couldn’t help myself and converted another VM to #NixOS 😅
This one used to be an OpenMediaVault samba appliance that later grew in scope and now runs a systemd service or two.
Converted it to NixOS before things escalate. The initial setup and samba config was done in about 30 minutes. The services took longer.
This was a good move as it made setting up vsftpd (for receiving scans over LAN from a network scanner) for testing purposes quite easy :)
Also sops-nix is cool (will blog about it!)
https://media.mas.to/media_attachments/files/114/632/711/621/678/250/original/b989d3b1cbf360de.jpg

2025-05-29 14:43:21 UTC

Someone expressed interest in using https://gokrazy.org/ on Windows, and it turns out we only needed to move two functions out of the way to make that kinda-sorta work.
If you’re into Windows, feel free to get in touch with other Windows users to push this over the finish line: https://github.com/gokrazy/tools/issues/89
Here’s a screenshot of testing my GOOS=windows build, and it will never not be weird to me to use cmd.exe like that 😝
https://media.mas.to/media_attachments/files/114/591/636/261/365/682/original/622a24df30ca1be6.jpg

2024-11-15 19:11:14 UTC

Spotted a Kinesis Advantage 2 😍
(Lincoln Lawyer S1 E4)
https://media.mas.to/media_attachments/files/113/488/544/191/997/025/original/7e1ff1fe0da4e245.png