# Ctrl blog
> A personal blog mostly on everyday tech.
Public Ghost content for AI and LLM tooling. This file includes a bounded export of public pages first, then recent public posts.
Append `.md` to any post or page URL to get the content in Markdown (for example, `/example-post.md`).
## Pages
### About Ctrl blog
URL: https://www.ctrl.blog/about/
Last updated: 2026-08-24T17:54:11.000Z
*Ctrl blog* (“Control blog”) is the developer-focused blog of [Daniel Aleksandersen](https://www.ctrl.blog/author/daniel/) based in Oslo, Norway. This is my outlet for essays, tutorials, reviews, and technical notes and articles on a variety of topics.

This blog has previously been published under the names “Slight Future” and “Aeyoun’s blog”. This is my fourth an longest running attempt at blogging.
### Privacy Policy
URL: https://www.ctrl.blog/privacy-policy/
Last updated: 2026-08-24T17:40:10.000Z
Last updated 2026-08-24.

Ctrl blog (“the site”) is hosted by [Synaps Media](https://www.synapsmedia.com/?ref=ctrl.blog) (*Triofan ZZP;* Netherlands, Europe). Synaps Media uses European service providers for hosting, and web content- and email delivery on behalf of the site. See [Synaps Media’s list of service providers](https://www.synapsmedia.com/dpa-sub-processors/?ref=ctrl.blog).

## Cookies

There’s no cookie banner on the site because there are no cookies by default. Registered members use a session cookie to stay logged in to the site. Membership is required to leave comments and to receive the site’s email newsletter.

## Membership and newsletter

You need to login using your email address to become a Member and receive the email newsletter. Your email address is used to send you the email newsletter and verify your Membership when you login to the site.

## Comments

Membership is required to comment. Comments posted on the site are public. Whatever you write shows up on the page along with the name on your account.

## Audience metrics

The site counts its readership and visitors using cookie-less tracking scripts without using any persistent identifiers. There is no device fingerprinting or other sketchy surveillance shenanigans. Readership is counted through Ghost by Synaps Media and [StatCounter Ltd.](https://www.statcounter.com/?ref=ctrl.blog) (Republic of Ireland, Europe).
### Tags & Topics
URL: https://www.ctrl.blog/tag/
Last updated: 2026-08-29T01:06:01.000Z
Index of all tags on Ctrl blog.
## Posts
### Microsoft has not stopped forcing Edge on Windows 11 users
URL: https://www.ctrl.blog/entry/windows-system-components-default-edge/
Last updated: 2026-08-23T22:25:24.000Z
Microsoft published [a blog post on the Windows Insider Blog](https://blogs.windows.com/windows-insider/2023/08/25/announcing-windows-11-insider-preview-build-23531-dev-channel/?ref=ctrl.blog) in late August with a vague statement saying that “Windows system components“ were to begin respecting the default web browser setting. Windows 10 and 11 regularly bypass this setting and force-open links in Microsoft Edge instead. In my extensive testing, I haven’t found any changes in the new Windows Insider version. 

You may have read stories in the tech media celebrating that Windows will finally respect the default browser setting. This reporting seems to have been done completely without verification and based entirely on a misunderstanding. The source of the confusion is this one highlighted but vague entry in the changelog for a recent Windows 11 Insider preview build:

> “In the European Economic Area (EEA), Windows system components use the default browser to open links.”

[Announcing Windows 11 Insider Preview Build 23531 (Dev Channel)](https://blogs.windows.com/windows-insider/2023/08/25/announcing-windows-11-insider-preview-build-23531-dev-channel/?ref=ctrl.blog), Amanda Langowski Brandon LeBlanc 

The highlight makes it sound like Microsoft has finally caved to regulatory pressure from the European Union (EU). The software powerhouse has abused the dominant market position of its Windows operating system to promote its Edge web browser and services for too long.

I’ve followed this developing story closely over the years. I even developed the popular open-source [EdgeDeflector program](https://www.ctrl.blog/entry/edgedeflector-default-browser/) that hijacked web links destined for Microsoft Edge and directed them back to your default web browser. Microsoft finally reacted and [blocked EdgeDeflector from working](https://www.ctrl.blog/entry/microsoft-edge-protocol-competition/) once the Mozilla Firefox and Brave browsers began [building the functionality into their web browsers](https://www.ctrl.blog/entry/anti-competitive-browser-edges/).

Excitedly, I installed the new Windows Insider build and began testing the changes to see them in action. At first, I didn’t believe my findings. *Nothing* had changed from the current version of Windows 11.

- The new Windows version still strongly discourages changing the default browser away from Microsoft Edge.
- After system updates, the new version still aggressively prompts you with a captive full-screen experience on start-up to reset your default web browser to Microsoft Edge.
- Web links in primary surfaces still force-open Microsoft Edge — including links in the new Copilot, Start menu, Search on the taskbar and desktop, Windows Spotlight, first-party apps (Outlook, Teams, News, Weather, and more), and Widgets on the taskbar (formerly called News and Weather).

I’ve verified my findings in the Home and Professional editions of Windows and even the EU-specific “N” variants of each edition. I’ve tested in two configurations for Norway (EEA member) and Germany (EEA and EU member). For both tests, I installed devices with region and locale settings matching the desired country with IP addresses and geolocation sensor data to match. 

I’ve checked, double-, and triple-checked my findings. *Nothing has changed.* Web links still force-open in Microsoft Edge instead of your default web browser.

Microsoft first announced the changes for Windows Insider build 23531 (Developer channel). I waited for two more releases and retested with builds 23536 and 23541, both from the Developer channel. I also retested with the Canary channel, which is even further ahead on the development tree than the Developer channel.

Microsoft sometimes gradually rolls out changes in the Windows Insider program to a limited set of users. It does not document publicly which new changes are gradually rolled out. However, there were only two new experiments in build 23531\. None of them are related to default browser settings or Microsoft Edge. The new changes to default browser handling may be a gradual rollout, though.

Microsoft was vague about the change, and neither its customers nor the tech media verified their assumptions before running with the story. Despite not having implemented the changes everyone assumed it had, it has received lots of positive press attention for doing the right thing.

I have not found anyone commenting on whether this change worked for them in the many and extensive discussions on Hacker News, Reddit, and other social media. I’ve also not found any traces of confirmation or checks in the hundreds of news sites that ran the story nor in their comment sections. There has also been no mention of it in the Insider Feedback Hub or any subsequent Windows Insider build announcements or changelogs.

I have *not* reached out to Microsoft for a comment on this story. Frankly, at this point, I rather assume they hate me personally more than they hate their average customers. Microsoft has also refused to make statements to [The Register](https://www.theregister.com/2023/08/30/microsoft%5Fwindows%5F11%5Fbing/?ref=ctrl.blog) and [The Verge](https://www.theverge.com/2023/9/5/23859537/microsoft-windows-11-default-browser-links-eu-eea-changes?ref=ctrl.blog) for their stories on the vague changes.

Disclaimer: I am an employee of *Vivaldi Technologies*, a competitor to Microsoft Edge. This website is my personal blog, and the views and findings expressed here do not represent my employer. I’m also the developer of EdgeDeflector, the circumvention program described in the article. 

#### Sources

- [Announcing Windows 11 Insider Preview Build 23531 (Dev Channel)](https://blogs.windows.com/windows-insider/2023/08/25/announcing-windows-11-insider-preview-build-23531-dev-channel/?ref=ctrl.blog), 2023-08-25, Amanda Langowski and Brandon LeBlanc, Windows Insider Blog, Microsoft
### The trouble with decommissioning a used FIDO security key
URL: https://www.ctrl.blog/entry/security-key-decommission/
Last updated: 2026-08-23T22:21:47.000Z
Five years ago, I wrote [about adopting security keys](https://www.ctrl.blog/entry/firefox-u2f-google/) — small second-factor authentication token devices — to secure some of my most precious online accounts. In that article, I foresaw a future problem and detailed how I planned to mitigate it. The future is now, and I did not heed my own advice. 🤦‍♂️

My advice to others and myself from five years ago:

> “You should maintain a record of which security keys you register on which websites. If you lose or want to decommission a key, you’ll need this record to know where you need to log in and replace the key.”

In the intervening years, I’ve worn out the security key I always keep with me on my key chain. Over the last five years, the gold plating on the contact pins has worn off, and the copper alloy underneath has corroded. The key is still functional, but it requires some hefty jiggling after insertion before it works. It’s time to replace it.

The failing security key was a budget *ePass* model from Feitian. My other Feitian security key, the *MultiPass* with Bluetooth, [was recalled](https://www.ctrl.blog/entry/feitian-multipass-recall/) due to security problems. I bought a key from the — at the time — relatively unknown Feitian instead of the more well-known Yubico. Yubico prices their YubiKey products with a hefty market-leading premium, so they could really need some more competition. 

In my experience, Yubico’s keys don’t corrode as easily, though. Therefore, I bought a [YubiKey 5C NFC](https://www.yubico.com/product/yubikey-5c-nfc/?ref=ctrl.blog) to replace the worn-out Feitian key. This new security key is my first USB Type-C key. All my devices have Type-C connectors now, and it’s time to say goodbye to Type-A. 

The problem I have now, which I foresaw five years ago, is that I can never throw away my old key. I’ve logged in and replaced it everywhere I remember adding it, but I’m sure there are plenty more that I’ve forgotten.

Many services have neither let me add multiple keys, nor allowed me to remove my key once added. Essentially, the hardware I now want to decommission is the only way to log in to these services.

These services haven’t done a particularly good job of implementing two-factor authentication. Nothing prevents websites from letting users register multiple security keys to their accounts. For end users, it’s best practice to always register at least two different keys with each service. Then, you’ll have a backup if you lose your primary key.

I intended this article to serve as a reminder: security keys don’t last forever! Plan for when you need to decommission them, especially when using the same key for multiple services across the web. Keep a list of where you register your keys!

I hope I’ve learned my lesson now; maybe you have too. I’m keeping track of where I’ve registered my new security key. At least, this time, I’ve created and put some entries in a list inside my password manager!
### The deafening problem with the FreeStyle Libre 3 app for Android
URL: https://www.ctrl.blog/entry/freestyle-libre3-volume-level/
Last updated: 2026-08-23T22:30:28.000Z
I’ve finally begun using the Abbott FreeStyle Libre 3 continuous glucose monitoring (CGM) system a year after I [first wrote about it](https://www.ctrl.blog/entry/freestyle-libre3-cgm/). The newer sensor has been a significant upgrade except for a few issues. One of those issues could be damaging to your hearing. 

The Libre 3 sensor must be paired with the companion app on an Android or iOS smartphone. You can read your current glucose levels from within the companion app. The app also issues alarms when glucose levels go critically low (hypoglycemia) or high (hyperglycemia). These early warnings are one of the key advantages of using a CGM system. They can help prolong long-term health outcomes and life expectancy for people with diabetes.

The app also increases the media output volume level to 75 % to ensure the alerts will be loud and audible. It changes the volume without regard for other currently-playing media or the output device.

The app will increase your media playback volume when you’re using headphones. It even ignores the headphone volume limiter. At this level, the alarm is painfully loud in my headphones. I try to tear off my headphones as quickly as possible when this happens. I’m surprised I haven’t yet thrown the headphones to the ground as I try to get away from the sudden earsplitting sound.

I usually listen at about 20 %, and that’s plenty loud enough. At 75 %, it’s loud enough for the phone to begin complaining about the loud listening volume. My volume is typically set to 10–15 % when I’ve paired the phone to my home media entertainment center. At 75 %, the media center gets terrifyingly loud.

The alarms can be embarrassing in social situations, and I can’t shut them off fast enough. It’s so distracting and loud that I forget to act on the alerts! I focus more on apologizing in every direction for the sudden loud ruckus.

This feature comes from a place of good intentions. But as the old saying goes: the road to hell is paved with good intentions.

No app — even for a medical alert — should significantly adjust the audio output volume. Especially not when the user is wearing headphones! For this app in particular, it should start with two soft beeps and vibrations. If the patient doesn’t react within \~20 seconds, the app could gradually increase the volume over the next minute or two.

This gradually-escalating audio design would give a much more pleasant experience. Some users, especially those already hard of hearing, might prefer to keep the current behavior. However, most patients would choose a more gentle approach with an escalating alarm.

The app requests the special Do Not Disturb (DND) management permission. It lets apps issue audible alerts even when DND is enabled or the device is silenced. The medical alerts from the app can indeed be critical, so it makes sense for the app to need these capabilities. Unfortunately, the app is poorly designed and misuses the permission.

The app will prevent the device from canceling DND mode after it has been set by a schedule (e.g., a bedtime routine). You must manually disable DND instead of relying on the scheduling to do it for you. Depending on how you use your phone, this can be detrimental to your work and personal life.

### Workarounds

You should enable your device’s media volume limiter if it’s supported. The option isn’t available on all Android devices and only limits the headphone and Bluetooth volume levels.

To enable it, search your phone settings for “volume limiter.” I can’t set my Samsung Galaxy phone’s volume limit below 60 %. It’s still much louder than my typical listening volume level, but at least the alerts aren’t painful at this level.

Other options are available, if your Android device doesn’t support setting media volume limits. The [Volume Lock Pro](https://play.google.com/store/apps/details?id=volumelock.vlocker.pro&ref=ctrl.blog) (4 Euro) app lets you set limits for each audio channel on your device. You can use it to limit the media- and Bluetooth audio channel volume levels. 

Unfortunately, the Volume Lock Pro app has some issues of its own. Suppose you’ve configured a volume range in the app (e.g., 5–55 %). In that case, it sometimes randomly increases the volume to the maximum while you’re playing audio. It can also be slow to respond to volume level changes by other apps. It’s better than nothing if your phone doesn’t have the volume limiter option.

You can also work around the DND issues. However, doing so risks disabling the glucose level alerts from the app! These instructions will be intentionally vague to make you stop and think.

**Only attempt the following workaround** if you’re confident that you can carefully manage your phone settings. You must test to ensure these settings work as expected on your device. You should also retest after applying software updates to your phone and the FreeStyle Libre 3 app.

As discussed in an earlier article, you can [exclude specific apps from being silenced by the DND and sleep modes](https://www.ctrl.blog/entry/android-bedtime-mode-priority-alerts/). Begin by adding the FreeStyle Libre 3 app to the DND exclusion list in your device settings.

You can then revoke the app’s DND permission from the app-specific or system permission screens. Look for special permissions if it’s not listed along with the common system permissions on your device.

Once you’ve revoked the permissions, you must **never silence your phone** except by enabling DND mode! **Never lower the volume to silent!** The app will no longer be able to raise the volume level to ensure alerts are delivered.

The app will constantly display a warning message saying, “Alarms Unavailable.” It’ll also periodically send alert notifications that tell you the same thing. You can disable the periodic notifications from the app’s permission settings. Go to notifications: notification categories, and disable the “Errors” notification category.

Do make sure to contact Abbott and let them know about these issues! They’ve ignored my contact attempts, but there’s always strength in numbers!
### Phone Link relays your personal data through Microsoft servers
URL: https://www.ctrl.blog/entry/microsoft-phone-link-privacy/
Last updated: 2026-08-23T22:14:29.000Z
The Microsoft Phone Link (formerly known as “Your Phone”) app for Windows, Android, and iOS lets you access parts of your smartphone from within Windows. However, Microsoft has not built the service with your privacy in mind. Instead, the software behemoth relays your personal data through its servers, despite the app only working while your devices are connected to the same local network. 

The [Microsoft Privacy Statement](https://web.archive.org/web/20230406235344/https://privacy.microsoft.com/en-us/privacystatement#mainyourphonemodule) (February 2023) doesn’t expressly state that Microsoft relays your personal data through its servers. The app‘s requirement for both devices to be on the same local network leads customers to believe that their data is transferred directly between their devices. That’s obviously how this should work, right? 

However, in my testing, neither Windows nor Android made direct device connections when using most app features. Crucially, your personal data, such as text messages, clipboard contents, recent photos, and notifications, are not transferred directly over the local network. Notifications may contain sensitive information from your apps, such as the subject and contents of private messages and emails, security codes from authentication apps and texts, caller identities, etc. 

I contacted the Microsoft Privacy Team and requested it to clarify some of the vaguer parts of the Microsoft Privacy Statement regarding the Phone Link feature.

> Once the Windows PC and phone are paired, a user’s content such as messages, photos, contacts, and notifications are relayed between the user’s devices (PC and Phone) through a Microsoft cloud service. This content is processed to transfer data between the requested devices and is not stored permanently on Microsoft servers. Incoming and outgoing phone calls are handled over Bluetooth. While using screen mirroring and virtualizing Android apps on Windows through the Phone Link app your shared clipboard and file transfers via drag/drop are sent directly peer-to-peer between the phone and PC. Notification content is sent to Microsoft cloud service simply to relay information between paired devices (PC and Phone) and this data is only processed to fulfill the user’s request and is not stored persistently after the request has completed.  
>  
> When you use the Phone Link app to mirror your phone’s screen on your Windows device, Microsoft may collect diagnostic data based on user diagnostic data collection control in Windows settings app. If Optional diagnostic data collection is turned on data collected may reflect when a phone screen mirroring session was initiated, whether there was engagement, and when the session was closed. When hosting an Android app from your phone onto your Windows device, the Android app will behave like any app running on a Windows device and Microsoft may collect app usage and performance data helping us troubleshoot issues and improve Microsoft product and services.  
>  
> Microsoft Privacy Team, (via email correspondence)

Privacy-conscious consumers will realize they have no guarantees that Microsoft doesn’t scan, retain, or do anything else with the data that needlessly passes through its servers. The most charitable interpretation of the same-network requirement is that Microsoft aspires to transfer data locally, but it hasn’t yet made it work.

The same-network requirement might be a privacy measure designed to prevent an abusive partner from spying on your usage of your phone while you’re away from your computer. Microsoft apparently did not consider it a problem that it can spy on all your data as it passes through its servers. It’s a feature; not a bug. 

If you care about privacy, you might want to consider using alternatives to the Microsoft Phone Link app. The leading free and open-source contender is [KDE Connect](https://kdeconnect.kde.org/?ref=ctrl.blog). It transfers your data encrypted and directly between your devices over the local network. It even lets you connect multiple computers, not just your computer and a smartphone. However, KDE Connect doesn’t support screen mirroring, one of Phone Link’s key selling points. Other free and open-source apps for screen mirroring are available, but they’re more difficult to use than Phone Link.
### Norway’s BankID undermines anti-phishing best practices
URL: https://www.ctrl.blog/entry/bankid-iframe-phishing/
Last updated: 2026-08-23T22:02:06.000Z
Imagine a privatized nationwide authentication system used to access government services, confirm contracts and online payments, and everything else. Now, imagine that the system was designed to be extra friendly to imitation and credential theft (“phishing”). Here’s everything wrong with Norway’s BankID authentication system. 

Norway’s banks jointly own and operate BankID. Citizens use BankID for everything from logging in to government services like taxes and health care, to digitally-sign private contracts, applying for loans and credit cards, and more on the private market.

The authentication scheme has multiple layers and uses a secondary authentication factor, either using a one-time code generated by a key fob or a tap in the BankID app on a trusted device. To log in with your BankID, you need to enter your national identity number — similar to a U.S. social security number — or your phone number, and your BankID password. The latter is often the same as your bank password, although your bank probably requires BankID anyway.

The problem with this solution is *when* and *where* you’re expected to enter your legally-binding credential details. A merchant or service provider embeds BankID directly onto its webpages through an inline frame (“iframe”). Your web browser will only display the domain and encryption certificate details of the top-level webpage, e.g., the merchant’s domain.

There’s no way of telling whether you’re giving your authentication credentials to BankID through a legitimate iframe or handing it off to masquerading criminals. A top-level webpage can also intercept keystrokes and clicks on any embedded iframes. Iframes simply weren’t designed to be used in a security-critical context!

Web browsers have largely focused their anti-phishing efforts on ensuring that their address fields can’t be faked. You can trust that the name you see in the address field is the website you’re visiting. You can thereby trust that you’re communicating with the right company or service.

The industry at large has focused on teaching its customers to check that they’re on the expected website before entering their credentials for that site. In an ill-advised effort to make the transaction seamless, BankID has inadvertently disregarded all the established best-practices. BankID’s customers are thought to trust anything that looks and acts like BankID, regardless of where on the web they encounter it.

The E.U. Payment Services Directive (PSD2) requires that all online payment transactions are carried out with Strong Customer Authentication (SCA). SCA is better known as “multi-factor authentication“ in the broader world outside E.U. regulatory texts. Norwegian debit- and credit card issuers have outsourced this task to BankID. So, whenever you’re making a purchase anywhere on the web, you’re presented with the BankID authentication iframe on the website of the merchant or service provider. 

Upon receiving their BankID, consumers must sign a contract where they promise not to share their BankID credentials with third parties. Yet, the service’s design and implementation details make it impossible for people to verify who they’re handing those details over to.

I contacted BankID BankAxept (the company behind BankID) for comment on the issues discussed in this article. I initially didn’t hear anything, but I received a reply after Erlend Oftedal brought up the same problem [on Twitter](https://twitter.com/webtonull/status/1620321216535093249?ref=ctrl.blog).

> \[It would be\] advantageous if all communication with the user happens with `bankid.no` visible in the user’s address field. \[We’re transitioning to this solution\] and most sites with BankID currently use it. \[…\] We still need to work on transitioning all sites to this solution, but the work is underway.
> 
> Hege Steinsland, Press Contact, BankID BankAxept, (translated from Norwegian)

I’m happy to hear BankID is working to improve its system. I’ve only seen this alternative new solution used on a handful of websites, whereas I engage with the less secure iframe-based solution everywhere online.

Regardless of BankID’s future plans, I don’t understand how an authentication-as-a-service provider could ever have designed and put the original iframe-based solution into production. BankID should never have asked its customers to trust and provide their login details anywhere but “`bankid.no`”.

Someone should have pushed the big red button at BankID before this got released into the world. You don’t need to make much effort to make a good-enough replica of the BankID iframe to fool people. I’m well aware of the problems, yet even I am reduced to blindly trusting that anything that looks like BankID on any website is legitimately BankID.

While spell-checking my email to BankID BankAxept, I received an email with a link to a phishing campaign that led to a perfect impersonation of the BankID iframe. It wasn’t even an iframe, just a form on a webpage with a border. Not that anyone could tell the difference anyway. It was “good” to get a timely confirmation that others have recognized and are actively exploiting the system’s weaknesses. [Report phishing SMS/emails!](https://www.ctrl.blog/entry/report-phishing/) Don’t just ignore them! 

BankID could make its authentication system more challenging to imitate *today* without requiring every third-party payment processor and intermediary website to roll out updates. For example, the iframe could be changed to only contain a “Log in with BankID” button. The button should open a separate window under the trusted `bankid.no` website where the user would enter their authentication credentials.

Upon completion, the new window could communicate the authentication result to the iframe on the merchant website, close the new window, and return the user to the originating website. Throughout the process, customers could rely on their browsers’ built-in domain verification systems to ensure they didn’t share their credentials with a third party.

The above suggestion should be (relatively) easy to implement and deploy in the existing ecosystem. I’m sure there are good reasons why they’re not already doing it. However, BankID needs to get on top of this problem before its customers fall victim to BankID impersonation and phishing. BankID has already undermined and damaged the whole industry’s push to get people to verify the domain before entering their passwords!

BankID’s near-monopoly on authentication services in Norway will fall if its customers lose trust in its systems. *Get it together, guys!*

Please remember to [report instead of ignore phishing campaigns](https://www.ctrl.blog/entry/report-phishing/) that land in your inbox! You might recognize a phishing campaign, but others can miss the signs you spotted.

Disclosure: I work for the web browser vendor Vivaldi Technologies. A part of my work involves ensuring the reliability of the browser’s security indicators.
### I’ve joined Vivaldi Technologies
URL: https://www.ctrl.blog/entry/vivaldi-technologies/
Last updated: 2026-08-23T22:24:08.000Z
On November 1st, I joined familiar faces from [my days at Opera Software](https://www.ctrl.blog/entry/goodbye-opera-software/) and new colleges at [Vivaldi Technologies](https://vivaldi.com/?ref=ctrl.blog). I joined as a Quality Assurance Tester working on the Vivaldi web browser product for mobile and desktop. 

I didn’t expect to ever work for a social media company. Two short weeks after I joined Vivaldi, it jumped on the decentralized social networking craze and launched a new Mastodon instance called [Vivaldi Social](https://social.vivaldi.net/?ref=ctrl.blog).

Vivaldi is a web browser, news feed reader, reading-later list, email and calendar client, note-taking app, machine-translation service, and more; all in a single super app. You may recognize these features as interests I’ve regularly covered on this blog.

I’m into [web browsers](https://www.ctrl.blog/tag/web-browsers/), [news feed readers](https://www.ctrl.blog/tag/syndication-feeds/), [note-taking apps](https://www.ctrl.blog/tag/note-taking/), [browser reading modes](https://www.ctrl.blog/entry/browser-reading-mode-parsers/) and read-later apps, [email clients](https://www.ctrl.blog/tag/email/), [calendar apps](https://www.ctrl.blog/tag/caldav/), and other productivity apps. It turns out a local company just down the road from where I live is taking on all of these in a single app.

Vivaldi can be your minimalist web browser with as few buttons, bells, and whistles as possible. It can also be your everything super-app that replaces your existing web browser, note-taking, email client, calendar and contacts, news feed reader, reading list, and any number of other tasks. (At least on desktop.)

Vivaldi for desktop has some window manager-esque features such as tab tiling, but the company isn’t yet trying to build a full-blown operating system. You can find Vivaldi preinstalled in some Android Auto-powered cars, but its primary distribution channel is users seeking it out and installing the app.

I’m struggling a bit to say what’s unique about Vivaldi as a web browser, though. It really is just another run-of-the-mill Chromium-powered browser, despite the overwhelming number of unique productivity features added on top.

Vivaldi’s most useful and unique built-in browser-related feature is probably web panels. Web Panels open as a narrow column next to the regular web view. They let you quickly access pages you want to keep an eye on throughout the day (such as social media and news feeds, some statistics or stocks, or maybe a podcast or audio player). It’s like having “the small internet“ that’s on your phone up on your big desktop screen next to your main browsing activity.

So, what does my new job mean for Ctrl blog? I’ll have less time for the blog, and there will be fewer updates. I expect to keep writing, though. I’ll likely have more to say about web browsers going forward.
### Sync issues finally drove me away from the Joplin note-taking app
URL: https://www.ctrl.blog/entry/joplin-notes-sync/
Last updated: 2026-08-28T16:40:31.000Z
My note-taking app of choice for the last three years has been [Joplin](https://joplinapp.org/?ref=ctrl.blog), an open-source note-taker for Android, Linux, MacOS, and Windows. As I discussed in [my app review](https://www.ctrl.blog/entry/review-joplin-notes/), the desktop app is good, but the Android app has some issues. In the last year, updates to the app have brought along more issues. I can no longer rely on it, and the time has come for me to migrate away from the Joplin app.

Joplin used to get cross-platform synchronization and conflict handling right. It was fast, reliable, and I would never lose a note to synchronization issues. For the last year, however, it’s been a different story.

The issues began with the release of Joplin version 2.6.3 for Android, released late in 2021. It updated to a newer version of the Android software development kit (SDK). The SDK imposed new restrictions on the application programming interface (API) used to access the file system. Joplin released the update with the new SDK without making the necessary changes to support the new file system API. See Joplin project [issue #5779](https://github.com/laurent22/joplin/issues/5779?ref=ctrl.blog "“Android filesystem sync is broken after 2.6.3 update”"). 

Until then, I’d synchronized my Joplin notes to a folder on my phone. The [Syncthing](https://syncthing.net/?ref=ctrl.blog) app would then keep the notes folder in sync on all my devices. It worked great with my thousands of notes, and the synchronization delay was only a couple of seconds at most.

Without access to the file system, I had to quickly make other plans for synchronizing my notes. The notes Joplin store remotely are end-to-end encrypted (E2EE), so I can use any of the cloud-based storage solutions it supports. 

I initially set up a WebDAV server to handle the syncing but gave up after a few days due to various interoperability problems. I then switched to using my Microsoft OneDrive account. However, the synchronization with OneDrive was infuriatingly slow; it took over three minutes to sync a single new note. I switched again over to Dropbox.com. It brought the time required to sync down to roughly 45 seconds.

OneDrive and Dropbox.com worked fine on desktop, but the synchronization on Android was fraught with problems. Syncing would frequently fail, and I had to restart the synchronization to get it working manually.

After the most recent update to Joplin version 2.8.3, released in June 2022, things took a turn for the worse. Joplin now gets indefinitely stuck when synchronizing to any remote storage service. I can’t abort the synchronization once it starts; instead, I get stuck in an infinite cancellation state. 

I can make the problem disappear by removing thousands of notes from my notebook. Joplin struggles with synchronization targets other than the local file system once you exceed approximately 600 notes.

The workaround I found requires me to force-quit the Android app, restart it, and quickly start synchronization from a desktop app. The Android app then detects that some other client is synchronizing and stops. Once in this state, I have to wait for the desktop client to complete the process and manually start the synchronization from the Android app again.

What frustrates me the most is that I really appreciate the user experience and workflow in Joplin’s desktop application. I don’t want to switch! I wish I could continue using the app and have it work on all my devices!

However, the Android app has never been as good as its desktop counterpart. It has serious performance issues when editing long notes and is slow to open. The app has overall been more functional than the competition, however. I don’t consider apps that sync to a cloud service without E2EE as a competitor to Joplin. Those apps are just voluntarily installed spyware apps. 

I hoped the project would quickly fix the Android file system API issue. However, it has been over a year, and it’s still not fixed. The project has received code contributions to fix the issue, but has yet to release a new version with those fixes. At the time of writing, Joplin version 2.8.3 (released in June 2022) is still the most recent version for Android. 

In an annoying coincidence, Joplin released its new [Joplin Cloud-storage subscription service](https://joplinapp.org/plans/?ref=ctrl.blog) a couple of months before the native file system syncing broke. I support this move, as it’s likely to bring in funding to help maintain the open-source project and keep it going. Other cloud-storage vendors are also still available in the app. However, losing my favorite cool self-hosted peer-to-peer (P2P) note-taking application still feels terrible.

Anyhow, I haven’t found a solution to the cloud-syncing issue, and local file system syncing support doesn’t seem to be coming back anytime soon. Losing quick and reliable note synchronization has significantly hampered my productivity over the last year. You can even see it in the reduction of new articles on the blog!

So, earlier today — I exported all my notes from Joplin and deleted the app from all my devices. Bye, bye, Joplin! Thanks for all the notes! I’m currently reviewing a few different options for a possible replacement. For the time being, I’ll be using individual plain-text files in a directory hierarchy that I sync with Syncthing.

Disclaimer: I recently took a position with one of Joplin’s competitors. (I’ll share more details on that soon.) I decided to stop using Joplin three weeks before I began any talks with my new employer. The two events are unrelated and didn’t influence each other.
### Don’t record your social life on an append-only social network
URL: https://www.ctrl.blog/entry/append-only-social/
Last updated: 2026-08-23T22:01:48.000Z
[Secure Scuttlebutt](https://scuttlebutt.nz/?ref=ctrl.blog) (SSB) is an alternative, self-governed, distributed social network without gatekeepers. You only see updates and mentions from people you follow, so moderation isn’t as much of an issue as on Twitter. However, the technology that powers the platform is ill-suited for sharing things with our ever-changing social circles.

Elon Musk’s acquisition of Twitter last week [kick-started a customer exodus](https://www.technologyreview.com/2022/11/03/1062752/twitter-may-have-lost-more-than-a-million-users-since-elon-musk-took-over/?ref=ctrl.blog) from the social network. These customers are either fed up with micro-blogging or looking for Twitter alternatives. SSB hasn’t gotten as much attention as [Mastodon](https://joinmastodon.org/?ref=ctrl.blog) (the “Fediverse”). However, SSB is worth considering as a serverless, self-governing, and self-hosted Twitter replacement.

The technology that powers SSB is entirely different from Twitter and Mastodon. You don’t need to register an account anywhere to get started. Your identity isn’t a username and doesn’t depend on a domain name or service provider. Instead, your username is a meaningless cryptographic hash that consists of random-looking numbers and letters. Your friends only need to know your hash to follow you, and you can keep it as public or private as you want. You must arrange a side channel such as QR codes or email to exchange hashes. There’s no single global feed in the network, and neither is there a global user directory. 

All you need to get started is an SSB-compatible client app; you don’t even need an internet connection (except when pushing and pulling updates). Every update you publish, whether public or private, is stored in a local append-only database (AOD). The database exists primarily on your local device. 

The network works by having its users synchronize with each other’s account databases. The databases get distributed through “pub” servers. Some SSB client apps can also exchange updates using other means, such as directly between devices using distributed peer-to-peer (P2P) connectivity. Users and pubs can pass along updates on behalf of mutual connections, so everyone doesn’t need to be online simultaneously for the network to function.

All of this sounds great, and you can completely discard any corporate overlords, censors, and other parties with misaligned incentives. It’s just you and your friends or audience talking directly to each other’s devices. Everything is encrypted and you can make what you share as private or public as you want.

The AOD functions like a blockchain where every update is cryptographically chained one after the other. This structure makes it easy to synchronize the database across devices.

You must break the blockchain and fall out of sync with everyone who follows you to delete or modify any past updates on the network. Any modification to existing updates on the blockchain creates a new blockchain where every following update must be re-appended to the new chain. The original will remain just as valid as the new blockchain, which causes conflicts and synchronization stalemates.

Append-only databases are acceptable for financial ledgers, contracts, and things we want to be persistent and immutable. Unfortunately, social graphs aren’t immutable. People fall out with each other over time: relationships end, friendships shift, and we change who we are as we age and move through life.

Maybe you posted something you later regretted and wanted to remove from the network. Or perhaps you don’t want to be reminded of a former acquaintance or relationship, so you want to remove messages and images with that person. Maybe your device storage is full from all the photos and videos your aunt shares with you.

Whatever the reason, people need to have some control and power to change — or at least delete — things as they move on in life. On SSB, you must create a new identity and start a new blockchain to escape your past mistakes and regrets.

The experimental P2P-focused Beaker Browser project also [experimented](https://github.com/pfrazee/citizen?ref=ctrl.blog) with building a distributed social network. Beaker uses the [Hypercore Protocol](https://hypercore-protocol.org/?ref=ctrl.blog) which uses an append-only storage system for its P2P network.

The open-source instant messaging client [Jami](https://jami.net/?ref=ctrl.blog) uses P2P and a blockchain to exchange and keep messages in sync between users and your devices. It uses one blockchain per contact or group conversation instead of a single database for everyone. [Jami uses Git](https://jami.net/swarm-introducing-a-new-generation-of-group-conversations/?ref=ctrl.blog "“Swarm: a new generation of group conversations”") — the popular version control utility – for its conversation blockchains. This design at least lets you unfriend someone and leave them behind when the time comes. 

*Permanency* may sound like a neat feature and it lets developers take shortcuts when creating reliable distributed networks. When deployed correctly, it can help keep politicians and public figures accountable. However, it’s definitely not what you should look for in your social network.
### First look at Microsoft PC Manager and its conflicting interests
URL: https://www.ctrl.blog/entry/microsoft-pc-manager-conflicting-interests/
Last updated: 2026-08-25T21:09:09.000Z
Microsoft is testing a new app to compete with the many dubious “PC cleaner” software available on the market (like CCleaner and CleanMyMac). However, Microsoft’s new app looks out for the company’s interests before its customers’. 

The PC (and Mac) cleaner software market is full of scams. Many cleaner apps over-promise and inflate the number of “problems” they detect. The detected problems are often parts of your operating system and software behaving as intended. Most of the “problems” they pretend to “correct” either have no impact whatsoever or negatively impact the stability of your computer and software. The goal is to over-sell and scare people into signing up for ongoing “cleaning” services.

Microsoft’s new PC Manager software does far less than its competitors. It can perform some spring cleaning among cache files. However, the app only provides a unified interface into functionality already available in the Windows operating system.

For example, it can help locate large files that take up a lot of storage space on your device. It does this by opening a File Explorer window and executing a search for large files.

Competitors typically try to clean out unused settings from the Windows System Registry. The registry stores app settings and information covering everything from installed printers to your network settings, wallpaper, and your favorite font. Just about all first-party and third-party apps rely on the system registry.

The registry can accumulate cruft over the years as you install and uninstall new software. Updates to existing software can also change what and how they store data in the registry. It does indeed accumulate cruft over time. However, there’s no way to programmatically and reliably determine what is safe to delete from the registry. For example, items in the registry don’t record the time and date they were last accessed. Technically speaking, a program can monitor the registry as you use your computer and record what is in use and what is not. Such behavioral profiling could reduce the risk of deleting something that would break your system. However, this would come at a significant performance cost, and I still wouldn’t advise using it. 

A safe and thorough cleaning would require a forensic investigation of your operating system, all installed apps, and how you use them. That’s not what you get from a trialware app targeted at regular people.

There’s just too much happening in the registry; it’s constantly changing. No one, not even Microsoft, can safely “clean” it following a 20-second automatic analysis. Microsoft knows this, which is presumably why it **did not** include registry cleaning functionality in its PC Manager app. You can safely recommend this app to a family member without incurring undue tech-support duties down the line. At least in its current manifestation.

The PC Manager app can also clean the cache of Microsoft’s Edge web browser. It instructs Edge to clean itself rather than interfere with the normal operations of the browser. The norm in the industry is to force-quit your web browser, delete its cache and cookie files, and then restart the browser to let it sort itself out. 

Many other cleaner software vendors also claim that every cookie stored in your web browser is either spyware, malware, or otherwise unwanted. This misclassification includes your login cookies, the cookie that stores your dark-theme preference, and many other website preferences. I can only assume that they must sell more software licenses when they can claim to clean a higher number of spyware infections from your computer.

The new Microsoft software also provides a method to change the default web browser and “protect” the setting from being changed. The default browser setting in any operating system is often a target for malware. Although, modern versions of Windows mostly [ignore the default browser setting](https://www.ctrl.blog/entry/edgedeflector-default-browser/) anyway. Surprisingly, this user interface is more straightforward and less user-hostile than what the company offers in the Windows Settings app. However, it only supports Microsoft Edge, Google Chrome, and Firefox. It can’t help you if you use Vivaldi, Brave, or any number of other alternative web browsers. Microsoft [seemingly no longer fears antitrust regulators](https://www.ctrl.blog/entry/microsoft-edge-protocol-competition/) for abusing its market position to promote its Edge browser aggressively. 

There are clear indications of the company favoring its products and services within PC Manager. The most blatantly obvious feature where it has put its interests in front of its customers’ is the Startup apps manager.

The new Startup app manager lets you control what apps automatically start with your computer. Many software vendors want their software to start with your computer, whether or not you’re interested in always having it running.

The Startup app manager hides itself from the list of apps you can control. It also hides *all Microsoft apps* from the list! It will not touch Phone Link, Xbox App Services, To-Do, Office, Cortana, Terminal, OneDrive, and other Microsoft apps. The app does not appear to have a list of software to ignore, but it checks if the software publisher is Microsoft. 

The new app is doing a disservice to Microsoft’s customers. Microsoft’s apps can slow down your PC, lower battery life, and increase startup times, just like apps from any other vendor can do. Microsoft should not favor its first-party apps and services in this way.

Microsoft PC Manager is currently available in beta from a [Microsoft portal page](https://pcmanager.microsoft.com/?ref=ctrl.blog). The website is in Chinese, but the software also includes an English translation. You probably neither want nor need the software, however.

**Via:** [The Verge](https://www.theverge.com/2022/10/21/23416070/microsoft-pc-manager-app-performance-systems-clean-up?ref=ctrl.blog)
### The frustrating RouterOS–WireGuard VPN peering bug
URL: https://www.ctrl.blog/entry/routeros-wireguard-peer-bug/
Last updated: 2026-08-23T22:21:23.000Z
I’ve wanted to move my home virtual private network (VPN) server from a virtual machine onto my physical [MikroTik router](https://www.ctrl.blog/entry/review-mikrotik-rb750gr3/). I use the VPN to connect back to my home network to reach internal devices and services when I’m out and about. The router runs the RouterOS operating system, which supports WireGuard, a modern VPN protocol. I wasted several afternoons and late evenings but didn’t manage to set it up. It would turn out that a bug caused all my hardship in the MikroTik web configuration interface. 

The WireGuard protocol is relatively new and is an overall improvement compared to older VPN protocols. However, it’s more difficult to troubleshoot than those older protocols. The remote end of a WireGuard tunnel stays quiet unless you can successfully authenticate against it. This behavior makes it harder to distinguish an authentication error from a head-on collision with a firewall rule or other networking roadblocks. Older VPN protocols would aid troubleshooting efforts by emitting error messages when a client connected to it with incorrect credentials.

WireGuard uses the stateless User Datagram Protocol (UDP) instead of the stateful Transmission Control Protocol (TCP). This protocol difference reduces the transmission overhead. However, you also lose troubleshooting information on whether connections succeed or not.

The local WireGuard doesn’t have any idea why a connection attempt failed. It doesn’t know if it managed to connect to the remote end of the tunnel, and if it did — it doesn’t know if the authentication attempt failed. The WireGuard software only issued a generic error message: handshake did not complete after 5 seconds, retrying. 

So, … what was causing my connection issues? I’d configured the WireGuard software in my router, set up the necessary routing rules, and opened the required ports in the firewall. I’d also double- and triple-checked that I’d set everything up correctly. Everything seemed fine on both ends of the VPN tunnel, but *most* of my road warriors couldn’t establish a VPN tunnel. A *road warrior* refers to any roaming remote client that is expected to connect to a trusted network. 

Frustratingly, the third road warrior I had set up worked fine. It connected, authenticated, routed, and performed as expected when connecting to the VPN tunnel, both from inside and outside the local network. No other road warrior could connect in, however.

I failed to identify any differences between the road warriors that worked and those that didn’t. Two were even running the same version of the WireGuard app, on the same version of Android, on identical devices. Yet, only one of them would connect.

I wasted hours trying to troubleshoot the problem. I didn’t have much to go on as the RouterOS front-end to WireGuard doesn’t log anything either. Eventually, I stumbled upon the core issue.

The RouterOS web configuration (webfig) interface didn’t save my peer configuration properly! Whenever I added a new road warrior, I assigned it an IP address and saved its public cryptographic key in webfig. As road warriors, they aren’t expected to have fixed IP addresses, so I left the endpoint address field empty in webfig. 

The empty fields incorrectly got saved as an empty value instead of no value! An empty value (`null`) and an empty string (`""`) mean very different things to software, even though humans consider a comparison between nothing and nothing to be equivalent. The underlying configuration read `endpoint-address=""`. This behavior caused WireGuard to refuse connections from peers with a trusted key because their source IP addresses never matched the expected empty address. 

The problem did not affect the MikroTik WinBox software, an alternative to the RouterOS webfig. Neither the WinBox nor webfig user interfaces showed that the configuration contained a value for WireGuard peers’ endpoint addresses. They just appeared empty, so nothing seemed to be wrong.

The final workaround for the bug was to remove the empty configuration attributes from each of my WireGuard peers. I had to use the RouterOS command line interface (CLI) — RouterOS’ third and more verbose configuration option — to get the job done correctly.

I reported the issue to MikroTik, which fixed the bug a week later in RouterOS version 7.6 (released on 2022-10-17). I’ve confirmed that the problem is fixed, so no other MikroTik customers should have to waste their time on this problem.
### TP-Link network equipment hijacks some DNS requests
URL: https://www.ctrl.blog/entry/tplink-dns-hijacking/
Last updated: 2026-08-23T22:23:28.000Z
TP-Link network products — including Wi-Fi routers, repeaters, and access points (AP) — use deep packet inspection (DPI) to intercept specific domain name system (DNS) requests. Each product looks for one or two domain names and will hijack the request to issue a local response containing its own internet protocol (IP) address. 

TP-Link wants to make it easier for its customers to get into the web administration interfaces of its products. No one wants to remember the IP address needed to access it, right? The IP address can also change over time, depending on your network configuration.

To address the need for easier-to-remember and persistent addresses, TP-Link has added DNS hijacking capabilities to its network products! What could possibly go wrong⸮

TP-Link network products will intercept all DNS requests as they pass through it. It will hijack any IPv4 lookup requests for a product-specific domain name and respond with its own current IP address.

Below is a list of the TP-Link web configuration domains I’ve identified. Some of them have a public-facing website when accessed over the internet instead of through a TP-Link product.

- `tplinkap.net`
- `tplinkeap.net`
- `tplinkwifi.net`
- `tplinkrepeater.net`
- `tplinkmodem.net`
- `tplinkplclogin.net`

Other actors have, of course, bought variations of these domains and linked them to various scams. Make sure you type in the correct domain name, and be wary of imitators.

TP-Link isn’t doing anything malicious with this capability. As the above list of domains suggests, it’s a convenience feature for its customers. It lets people discover the IP address needed to access their TP-Link product via the company’s apps or web administration interfaces.

However, the capability can make it easier for attackers to exploit the device. Attackers doesn’t need to bring their own DNS interception software when they can exploit what’s already available on the device. This is known as a “Living off the Land (LotL) attack, where an intruder abuse existing legitimate software and functions to achieve malicious ends. 

TP-Link has “helpfully” made its domain name hijacker configurable. The `tp_domain.ko` kernel extension accepts a parameter to set an IPv4 address and whatever domain name you want to hijack. That’s all an attacker would need to redirect your bank’s website to a server the attacker controls.

This feature from TP-Link demonstrates the importance of using encrypted DNS — such as DNS over TLS or HTTPS — even within a private network. Attackers would have a much harder time hijacking an adequately encrypted DNS request.
### I miss del.icio.us – the web’s discovery-engine and link classifier
URL: https://www.ctrl.blog/entry/delicious-bookmarks/
Last updated: 2026-08-23T22:04:53.000Z
Delicious (stylized after its domain `del.icio.us`) was a social bookmarking website. It might not sound all that interesting, but it was one of the best websites in the early 2000s. Here’s why I miss this defunct website so much.

Delicious let users bookmark their favorite links and annotate them with comments and tags. You would primarily save links you valued enough to remember. The site’s true value was all the organizational work and link comments.

The resulting database was a constantly updated catalog of new and all-time hits on any topic you’d want to browse. You could discover great new reads on any tagged topic or combination of tags. You could also see what others had written about any given link and how the community had taxonomized it.

It’s a bit difficult to explain Delicious. If you’re curious, you can check out this [video demonstration of Delicious](https://www.youtube.com/watch?v=5evTMP8v6KA&ref=ctrl.blog) from 2007\. (It’s apparently recorded on a typewriter; I guess those were still fashionable in 2007.)

Yahoo bought the website in 2005\. The acquisition made sense at the time as Yahoo was still operating as an independent web index. Delicious’ link database must have looked like an irresistible human-curated database of the web’s greatest hits.

Yahoo abandoned its search engine a few years after the deal, and partnered with Microsoft to deliver its search results instead. Yahoo’s lackluster stewardship ultimately led to Delicious’ decay and caused the service to falter. This ultimately paved the way for competitors like Digg and Reddit.

There’s nothing quite like Delicious today. Google [dominates discovery and recommendations](https://www.ctrl.blog/entry/web-discovery/), and most social link-sharing has moved to Facebook, Reddit, and Twitter. None of these platforms focus on organizing and discovering links.

Reddit is a loose collection of disjointed communities. You have to share something that will be popular with a particular community or risk getting down-voted and lose community standing. The premise and experience are completely different.

Twitter lets you broadcast what links you like, but there’s no structure or organization to it. It’s not easy to find links, and you’ll mostly find hundreds of nearly identical messages with the same link. You also risk adverse reactions — or worse, having the link you share completely ignored.

You need to *perform* and be entertaining to an audience on Reddit and Twitter. You’re not just saving links with a service that coincidentally turns out to benefit the community. You might not have a good time on the websites even if your links meet your target community’s standards.

Delicious focused on being useful to *you* and *your links and interests*. It was a collaborative resource organizational tool and an excellent tool for discovery. You could use it as a self-contained archive of your favorite reads.

The closest thing I can find to Delicious today is [Pinboard](https://pinboard.in/?ref=ctrl.blog) (not to be confused with Pinterest, Flipboard, or the half-dozen other apps also called Pinboard). Pinboard is essentially a clone of Delicious. Pinboard also currently owns the Delicious brand and dataset.

Unlike Delicious, Pinboard isn’t free — it costs 22 USD per year. The subscription cost presumably keeps the lights on and helps keep bots and spam out of the community. On the other hand, it has also restricted the community’s growth.

You need a massive community with diverse interests to get an experience similar to Delicious at its peak. Pinboard claims to have 30 000 active users today, compared to Delicious’ 5,3 million in 2008.

Pinboard also offers a more expensive subscription tier with full-text link archival. The archival service lets Pinboard maintain its value over time as the open web’s rampant link-rot epidemic wrecks havoc on historical links.

Who’d want to pay for a website without being able to test it first? There’s no free trial or demo, so recruiting new users must be a constant uphill battle.

The Pinboard service also looks a bit outdated. It doesn’t need a radical redesign, but it needs to be updated to work with today’s many small- and medium-screen devices.

In the last few months, I’ve contacted Pinboard about broken functionality on the website. I’ve also reported a security issue, but have not heard back about either issues.

Pinboard isn’t on a path to replacing what Delicious once was. Delicious was incredibly popular in the days of the early web, while Pinboard is barely worth a footnote.

I believe that Delicious made the web of its day better and more enjoyable. It was so much easier to find stuff in its vast curated database of everything awesome. The web of yesteryear truly was *more delicious*.

Modern search engines can only do so much to help you discover new things. Today’s social websites are built to keep you on their platform and maximize interactions; linking out to other and more interesting things elsewhere goes against their business model.

#### Sources

- [Former Yahoo Engineers Shed Light On Why Delicious And Other Acquisitions Failed](https://techcrunch.com/2010/12/18/former-yahoo-engineers-shed-light-on-why-delicious-and-other-acquisitions-failed/?ref=ctrl.blog), 2010-12-18, Leena Rao, Techcrunch, Yahoo
- [Microsoft and Yahoo Are Linked Up. Now What?](https://www.nytimes.com/2009/07/30/technology/companies/30soft.html?ref=ctrl.blog), 2009-07-30, Steve Lohr, Technology column, New York Times
### A Sony Headphones app feature kills your phone’s battery life
URL: https://www.ctrl.blog/entry/sony-headphones-app-battery/
Last updated: 2026-08-23T22:22:12.000Z
I recently bought a pair of [Sony WH-1000XM4](https://electronics.sony.com/audio/headphones/headband/p/wh1000xm4-b?ref=ctrl.blog) wireless headphones. Many of the headphone’s capabilities are unlocked using the [Sony Headphones Connect](https://electronics.sony.com/headphones-connect-app?ref=ctrl.blog) (SHC) companion app. Unfortunately, the SHC app slashes hours off my phone’s battery life. Here’s what the app did wrong and how to rein in its energy consumption.

The noise-canceling and ambient-awareness modes are key selling points of Sony’s headphones and earbuds range. The companion app can switch between and adjust the modes based on your activity (sitting, walking, etc.) and location (home, work, etc.). You can manage this feature using the Adaptive Sound Control (ASC) option screen in the SHC app.

This capability was a key factor in why I decided to buy these headphones. (Hearing cars and not being run over by them is quite a useful feature.) I also liked the idea of the ambient noise canceling levels automatically adjusting based on my location.

Unfortunately, the SHC app consumes roughly 20–30 % of my phone’s battery after a two-hour walk with ASC enabled. The SHC app and Google Play Services (GoPS) consume the power. GoPS provides geolocation services to the operating system and apps. The battery drain is slightly lower when sitting still, but not by much. To be clear, the auto-switching ASC causes the battery drain, not noise-canceling or ambient-aware modes. 

I initially believed the SHC app was updating my location way too often. Constant location updates keep the phone’s antennas on and prevent it from entering low-energy modes. However, I don’t believe that this is the only cause. I use other apps with similar usage profiles, which don’t drain the battery to the same degree. 

Android usually restricts how often a background app can check your location. However, it makes exceptions for services belonging to “companion apps,” such as Sony’s headphone app.

I use an app called [WiGLE](https://wigle.net/?ref=ctrl.blog) that collects Wi-Fi and Bluetooth triangulation data. It triggers Wi-Fi scanning and records information broadcast by nearby access points every second. This app consumes 5–6 % of my battery over a two-hour walk. The WiGLE app was not running and didn’t interfere with my testing of the Sony Headphones app. 

The WiGLE app can be considered a battery life worst-case for collecting location data. The SHC app doesn’t need to do the same scanning that the WiGLE app does. I would not expect the SHC app to consume 4–6 times more energy than the WiGLE app. I would estimate an app like this to only use 1–2 %.

GoPLS provides a geofencing system for Android that notifies interested apps when you enter and leave a predefined geographic area. This system is significantly more energy-efficient and doesn’t require apps to pull location information in the background constantly. You can set up geofence areas in the SHC app, but the app must have badly misimplemented the feature.

I also use both the Samsung Health and Google Fit apps. Both apps rely on the same activity detection system provided by GoPS. The two apps combined use less than 1 % of my battery over a typical day.

Sony’s app should manage to respond to activity detection and geofence events with minimal impact on battery life. I would expect the battery drain to be no more than 1 %.

The app uses location services from GoPLS globally but will switch to Baidu Location Services if you set its region to China. I can only speculate that Sony must have made some battery life compromises to accommodate the two different location services. For example, Sony might have picked a sub-optimal implementation that can accommodate differences between the two service providers.

I feel uncomfortable just knowing Sony has included the unnecessary Baidu component inside an app installed on my phone. However, that’s a whole other bag of cats that we’ll not delve into now.

The SHC app is optional, assuming you never want to change the headphone’s advanced options. Alternatively, you can keep the app and disable ASC to rein in its energy consumption.

You can cut the battery drain in half by leaving activity detection enabled and disabling all location-based ASC switching. If you completely disable ASC, the battery drain drops to about 1 % after 24 hours of use.

ASC is a neat safety feature, and you can tweak it to make yourself situationally more aware of your surroundings. However, it’s not worth cutting my phone’s battery life by *hours*. I guess I should just get used to either leaving ambient mode on all the time or turning it on when I’m on and about.

The automatic ASC switching can also be annoying. It sometimes unexpectedly switches between complete noise canceling and ambient mode while I’m sitting still in the same location. The unexpected automatic changes can bring background noises in and out of focus. I find this more distracting than a constant background noise.

You shouldn’t revoke the app’s location access controls, however. The app still needs it to pair with the headphones over Bluetooth. Apps can use Bluetooth device scanning to triangulate your location. So, Android doesn’t differentiate this permission from the more generic geolocation permission. 

Note that the SHC app will periodically prompt you to re-enable ASC. The dialogs are deceptively designed, and it’s easy to accidentally enable the feature while you’re trying to dismiss the prompts.

#### Sources

- [Adapt your app by understanding what users are doing](https://developers.google.com/location-context/activity-recognition?ref=ctrl.blog), 2022-09-29, Activity Recognition API, Developer, Google
- Sony Headphones Connect APK, version 9.2.0, 2022-09-13, Sony
- [Background Location Limits](https://developer.android.com/about/versions/oreo/background-location-limits?ref=ctrl.blog), 2021-03-11, Android Developer Resources, Google
- [Geofence](https://developers.google.com/android/reference/com/google/android/gms/location/Geofence?ref=ctrl.blog), 2021-02-18, Play Services, Developer, Google
- [GeoFenceClient](https://lbsyun.baidu.com/cms/androidloc/v9%5F0%5F0/doc/com/baidu/geofence/GeoFenceClient.html?ref=ctrl.blog), 2020-07-08, Android Location SDK, Lbsyun, Baidu
### A closer look at Steam’s local network cache proxying protocol
URL: https://www.ctrl.blog/entry/steam-lancache-protocol/
Last updated: 2026-08-23T22:22:30.000Z
There’s no need to waste family game-night time waiting for the same Steam game to download over the internet! All you need is a local caching proxy server. Repeated downloads from a local cache are faster, and you free up your internet bandwidth for other things (like downloading other games). Steam clients will even auto-discover and self-configure to use your local cache.

Valve Software uses the industry-standard HyperText Transfer Protocol (HTTP) to download games via its Steam gaming client. The downloaded games can be intercepted and cached locally by an intermediary/transparent HTTP forwarding cache proxy.

This setup requires you to run a forward proxy server (e.g., [Squid](http://www.squid-cache.org/?ref=ctrl.blog)), and configure your network router to redirect outgoing HTTP connections to the proxy server. A forwarding proxy server compares incoming requests and returns cached results from its local store if it has recently seen and has cached the same request. The proxy will fetch all other requests from the origin server over the internet.

However, this setup will cache every unencrypted web connection and not just game downloads. Forwarding cache servers were often marketed as “web accelerators” in the years before every website switched to using encrypted and uncacheable connections. While most of the web is uncacheable by a proxy server, Steam downloads can still be cached.

The Steam client downloads games from many regional data centers; each of which under a unique domain name. It won’t get a response from the cache even though the rest of the download address — and indeed the downloaded file — is identical. Two people downloading the same game through the same proxy might not get it from the same server or data center. This causes what’s known as a cache miss, and the cache needlessly needs to re-download the same game twice.

Steam also supports a custom locally auto-configuring HTTP-based proxying protocol. You don’t need to configure the individual clients to use the local caching proxy. All you need is a specially configured caching proxy server and a local domain name system (DNS) server.

By default, the Steam client auto-discovers the presence of a local proxy by querying for a special domain name: `lancache.steamcontent.com`. You can configure your local DNS server to spoof this address and return the internet protocol (IP) address of your local cache server. This setup is similar to how an ad-blocking DNS server works.

Steam will treat the local proxy server as if it was a transparent forwarding proxy server. As opposed to using the industry standard HTTP proxy protocol. Clients typically use this protocol when configured to use a specific proxy server. Steam doesn’t switch over to the industry-standard HTTP proxy protocol when talking to your local caching proxy. Instead, it will treat it exactly as a transparent forwarding proxy server. So, it uses the HTTP `Host` header to inform the proxy server where it can download the data. 

Each download from Steam, regardless of which data center or domain it was downloaded from, has a globally unique path (file name). The caching proxy should be set up to canonicalize (normalize) the request domain name and return cached downloads when identical download paths are requested from different upstream servers. This method will significantly increase the cache hit ratio.

Steam divides each download into file chunks of roughly 810 Kilobytes. This transfer strategy results in tens of thousands of transfer requests for a typical multi-Gigabyte game. The proxy server must implement HTTP connection pipelining to both the back-end servers and the local clients. Without it, it won’t achieve high transfer speeds. HTTP pipelining lets clients reuse server connections for multiple requests instead of opening a new connection per file transfer. This feature is optional in HTTP version 1.1\. Not all servers support nor enable it by default. 

Steam doesn’t blindly trust a local caching server, however. Each downloaded chunk is accompanied by a cryptographic checksum. The Steam client uses it to verify that it has downloaded the correct file.

The Steam client will bypass the local caching proxy if the client can’t contact to it, or it repeatedly sends back error messages or corrupt/wrong downloads. Steam could not as easily have bypassed the proxy server in an environment with a transparent proxy server. It gives Valve more control over the user experience.

If you don’t want to roll your own setup, you can get a ready-to-deploy solution from [LANCache](https://lancache.net/?ref=ctrl.blog). It includes a pre-configured DNS server and caching proxy server. I’ve got experience running DNS and caching proxy servers. (I don’t need any more and possibly conflicting DNS servers on my network.)

My home network is setup for 2,5 Gigabit per second internal networking with a 1 Gbps internet connection. The first computer on my network to download a game or update get speeds up to 0,8 Gbps over the internet. The second computer to download the same title (within the next 60 days) gets it from the cache at nearly 2,5 Gbps!

It’s a complete over-kill for our two laptops and two dual-booting game stations (six total clients). However, it was fun to set up, and it’s a more environmentally friendly to keep everything up to date.

I would have preferred a solution where Steam used an auto-configuring peer-to-peer (P2P) solution. Wargaming, a competitor to Steam, uses BitTorrent to deliver games and updates. It automatically finds other running instances on the local network without the need for an always-on dedicated server. This would be the most preferable and easiest solution for home users.

Both Windows Update and Microsoft Store also use a similar delivery method when you enable [Delivery Optimization](https://www.ctrl.blog/entry/windows-delivery-optimization/). Delivery Optimization is enabled by default for Windows Home edition.

#### Sources

- [Steam client update released](https://store.steampowered.com/oldnews/57829?ref=ctrl.blog), 2020-01-20, News Hub, Steam, Valve Corporation
### You don’t want to be on Cloudflare’s naughty list
URL: https://www.ctrl.blog/entry/cloudflare-ip-blockade/
Last updated: 2026-08-23T22:03:32.000Z
I don’t know what I did wrong, but I’ve angered one of the titans of the internet! For the last six days, my home internet connection has been partially broken. Some apps and many websites either load slowly, partially, or not at all. Everywhere I go, I’m greeted by the same blockade message from Cloudflare.

Cloudflare is the market leader in shielding public websites from targeted traffic-saturation attacks, page load time acceleration, and content delivery network (CDN) services. The company plays a massive role in delivering everyday internet services. Roughly one in three of the top one-million websites is shielded and accelerated through Cloudflare’s massive global data centers, according to data from analytics firm BuiltWith.

Among other methods, Cloudflare uses a browser-challenge page to detect and thwart malicious and unauthorized bots. The page tests the capabilities of your web browser and tries to figure out whether you’re human. The page can be fully automated and only slows down your browsing. However, sometimes it includes a CAPTCHA challenge that prompts you to identify letters and numbers, or images. 

For whatever reason, I must have done something that angered Cloudflare. Just about every website I visited from my home internet connection would result in a challenge page. The blockade lasted six days! My partner and I got uncomfortably acquainted with Cloudflare’s market dominance.

We luckily weren’t pestered by too many CAPTCHAs. However, the average webpage load time fell from the normal ≤ 4 seconds to 20–80 seconds. It felt like we’d been transported back to an earlier era with unbearably slow internet.

I’m unsure if my IP reputation was classified with a high bot score (likely automated requests) or given a high threat score (likely malicious request). Cloudflare doesn’t offer end-users any way to dispute or even check their IP reputation scores. The company doesn’t offer end-users any support at all. Everything is automated. 

Unfortunately, not every web request can run the Cloudflare challenge page. Many websites only use Cloudflare with a secondary domain name that is only used to serve images, stylesheets, scripts, and other assets. So, while I could quickly load the main webpage, it often wouldn’t work properly because it couldn’t load critical assets.

Websites don’t just serve webpages and their assets, though. Roughly half my podcasts refused to update in my podcast app. The app didn’t know what to do when presented with a browser-challenge page instead of the podcast syndication feed files it expected. It just gave up and threw up error messages.

Plenty of other apps stopped working too. My partner still uses the [Bitwarden password manager](https://www.ctrl.blog/entry/bitwarden-3m-update/). It wouldn’t let them log in to their account to access their password vault because the login process was interrupted by a Cloudflare challenge page.

I’m using an offline password vault app called [KeePassXC](https://www.ctrl.blog/entry/keepass-vs-bitwarden-server/). I must admit that I was a bit gleeful when the effort I’ve put into not having to trust and rely on a hosted password manager finally paid off!

To be fair to Cloudflare, apps and podcasts aren’t allowed on its free product tier. Website administrators can configure exceptions in their Cloudflare accounts. They can mark certain web addresses as asset addresses and have them always bypass the challenge page. This option isn’t available to customers on the free tier, however.

Well into the second day of Cloudflare’s blockade of my home internet connection, Google Search also began blocking requests. It required me to resolve a CAPTCHA challenge for every other search. This luckily only lasted a day.

Cloudflare shares IP reputation data with partners like Google, coordinated through a program called the Bandwidth Alliance. So, my original offense might not even have been against Cloudflare. It might have received the reputation data from a partner, and it just propagated through the Bandwidth Alliance network.

It might not even have been a problem that originated from my IP address! One of my IP neighbors might have done something stupid and negatively affected the whole network neighborhood for a couple of days!

I had a terrible experience online for almost a week before everything cleared up. Automated decisions and backroom data-sharing had tossed a wrench into my entertainment, productivity, and online life.

Section 4 of the General Data Protection Regulation (GDPR) grants Europeans the right to object to automated individual decision-making, including profiling. There’s one paragraph from the regulation in particular that bears repeating: 

> “\[Europeans\] shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning \[them\] or similarly significantly affects \[them\].”

GDPR, Article 4, Paragraph 1 

I’d say my experiences fit that description head-on. Cloudflare or one of its partner’s systems made an entirely automated decision that significantly negatively affected my online life. Come to think of it, an IP address is considered as a potentially personally identifying identifier. I’ve never agreed to data-sharing with the Bandwidth Alliance!

Unfortunately — and probably for the best — the GDPR also makes exceptions for data-sharing, processing, and — although I couldn’t find the verbatim — automated-decision making for the purposes of ensuring network and information security. 

I’m no lawyer, but I probably don’t have a right to object to being misclassified as a bot by a security system. Even though it ruined my internet experience.

I don’t know what eventually cleared my IP reputation, but Cloudflare stopped blocking requests from my IP after six days. On day three, I install Cloudflare’s [Privacy Pass browser extension](https://privacypass.github.io/?ref=ctrl.blog) on all my desktop devices. The browser extension uses the same protocol as Apple and Cloudflare are working on integrating into MacOS and iOS. 

The extension provides, what Cloudflare claims, is a privacy-preserving alternative to resolving CAPTCHAs on its challenge pages. This might have affected the situation, but again, I have no insight into Cloudflare’s automated decision-making.

My run-in against Cloudflare’s “security” blockade was an incredibly frustrating experience. I felt truly powerless against an unknowable algorithm that sat somewhere out there and decided to block my free movement on the web.

I can only imagine how painful it must be to try and develop a web crawling bot these days. It doesn’t matter if your intentions are good and your bot polite. It’ll probably be blocked everywhere sooner rather than later.

#### Sources

- [Cloudflare Usage Statistics](https://web.archive.org/web/20220920131239/https://trends.builtwith.com/cdn/Cloudflare), 2022-09-20, BuiltWith
- [Bot scores](https://developers.cloudflare.com/bots/concepts/bot-score/?ref=ctrl.blog), 2022-08-12, Concepts, Docs, Cloudflare
- [Private Access Tokens: eliminating CAPTCHAs on iPhones and Macs with open standards](https://blog.cloudflare.com/eliminating-captchas-on-iphones-and-macs-using-new-standard/?ref=ctrl.blog), 2022-08-06, Reid Tatoris and Maxime Guerreiro, Blog Cloudflare
- [Cleaning up bad bots (and the climate)](https://blog.cloudflare.com/cleaning-up-bad-bots/?ref=ctrl.blog), 2019-09-23, John Graham-Cumming, Blog, Cloudflare
- [REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679&from=EN&ref=ctrl.blog), 2016-04-27, The Official Journal of the European Union, EU Parliament and EU Council
### Review: Aqara indoor climate sensor (for home automation)
URL: https://www.ctrl.blog/entry/review-aqara-indoor-climate-sensor/
Last updated: 2026-08-23T22:17:23.000Z
The [Aqara Temperature and Humidity sensor](https://www.aqara.com/us/product/temperature-humidity-sensor/?ref=ctrl.blog) by Xiaomi is a popular option to capture indoor climate data for home-automation systems. The sensors are small, plainly designed, cheap, promise 2-year battery life, and run on the Zigbee mesh-network protocol. However, they’re also notoriously unreliable, which defeats the desired set-it-and-forget-it target for the sensor.

I had to lower my expectations of the sensor after unboxing and skimming through the [user manual](https://cdn.aqara.com/cdn/website/mainland/static/docs/Temperature-and-Humidity-Sensor%5FManuals%5FEU.pdf?ref=ctrl.blog "“Aqara Temperature and Humidity Sensor: Quick Start Guide”"). The manual says that the sensors don’t work in high-humidity environments (like a bathroom, basement, or refrigerator). The sensor isn’t suitable for use in fridges anyway, as they’re essentially faraday cages that block wireless signals. This limitation was quite unexpected. The sensor is unfit for its primary marketed purpose: it’s supposed to be a hygrometer! 

The Aqara sensor communicates over the industry standard Zigbee protocol, and it should work with Zigbee hubs and devices from many different vendors. The Zigbee protocol will soon be rebranded as Thread for Matter. The new unified industry-wide standard for the internet of things (IoT). The Zigbee protocol shares, and thus interferes, with the same 2,4 GHz band as Wi-Fi. However, Zigbee devices maintain a separate mesh-powered network and don’t have access to my more security-critical Wi-Fi network. 

Aqara states that you’re *required* to pair the sensor with an Aqara Hub (sold separately). Aqara doesn’t claim that it’s sensors are compatible with other hubs and controller devices. However, everyone buying these intends to use them with other home automation systems like [Home Assistant](https://www.home-assistant.io/?ref=ctrl.blog). I’ll get back to this point in greater detail in the review.

I’ve bought three Aqara sensors for use around my home, so I’ve had the opportunity to compare them to each other and other reference measuring tools. I don’t have any scientifically calibrated thermometers or hygrometers. However, I have half a dozen, and they all agree with each others readings.

The Aqara sensors’ temperature readings are very consistent. When placed right next to each other in temperature ranges between 13 and 29,4 ℃, they stayed within 0,3 ℃ of each other. At 25 ℃ all three sensors show on average 0,7 ℃ higher than my other reference thermometers.

This difference is to be expected for a sensor of this type, and it’s likely caused by the heat generated by its internal electronics. Read [Many indoor air quality sensor products are a scam](https://halestrom.net/darksleep/blog/048%5Findoorairsensing/?ref=ctrl.blog) by William Hales for details. The sensors are designed with a small air intake at the bottom facing down toward the floor. Heat raises, so this doesn’t help heat escape efficiently. 

I’m more uncertain about the reliability of the hygrometer; accurately measuring relative humidity (RH) requires accurate temperature measurements. My three sensors’ RH readings are within 2,9 % of each other. The sensors that measure higher temperatures consistently report lower relative humidity. Their RH readings would probably be closer if I could correct them for the temperature difference. However, the sensors’ RH readings are 9–16 % higher than my two reference hygrometers. I’ve got one analog and one digital hygrometer, and their RH readings are within 2 % of each other. Aqara errs towards higher RH at higher temperatures. 

The temperature readings are good enough for use as a data point for home automation. I wouldn’t rely on the RH readings without normalizing them based on data from a better reference hygrometer. You might be able to configure this through scripting in the home automation hub of your choice.

The sensors have been unreliable in my experience over four months with them. They stay connected to my local Zigbee network and keep sending low-level network traffic. However, they eventually stop sending new sensor data.

All three sensors worked flawlessly for the first three weeks. However, now they won’t stay connected for more than a few days, though never less than 42 minutes. I have not worked out the significance of the 42-minute time window. It’s the shortest and most common duration the sensor will continue to send data after having been re-paired to the Zigbee network. 

I have to re-pair it with my Zigbee controller to get it to begin sending sensor data again. Pulling and reinserting the battery does restart it, but a restart isn’t enough to get it to send new readings.

The problem seems worse when the sensor’s battery voltage drops below 3,06 volts. It’s powered by a regular 3 Volt CR2032 coin battery, so the sensor should definitively work at and even quite a bit below 3 V. New 3 V CR2032 batteries start at 3,0–3,4 Volt. The voltage decreases to 2 V toward the end of their life. 

I’m notably *not* using “required” Aqara Hub. I’m using another brand of Zigbee controller. I use the [zig-a-zig-ah!](https://electrolama.com/projects/zig-a-zig-ah/?ref=ctrl.blog) (CC2652R) from Electrolama with, as you might have guessed, Home assistant. That being said, the Aqara sensors work just fine with my controller until they eventually decide to stop sending more readings. 

There’s plenty of online discourse about the unreliability of the Aqara sensors. People even describes the same problem with the Aqara Hub, as well as with other hubs and controllers. A Zigbee hub is a Zigbee controller that acts as a network gateway between your local Zigbee and Ethernet/Wi-Fi network. So, you can think of a Zigbee hub as an app-controlled Zigbee controller. In my opinion, adding an Aqara Hub to my setup would only add complexity without improving the sensors. 

Most people in these discussions believe their sensors get disconnected from their Zigbee mesh networks. These observations don’t match my experiences. I’m unsure if others don’t know how to check if their sensors still communicate with their Zigbee mesh networks.

Whatever the reason, the sensors stop working over time. They require you to periodically re-pair them with your Zigbee controller, and often swap their almost-full batteries too. The Aqara climate sensors are not a set-it-and-forget-it for two-years solution for your home automation needs.

It’s incredibly misleading to market a product clearly intended to be a hygrometer that can’t be used in humid environments. They’re unfit to keep track of the humidity in rooms or environments where that capability would be the most useful. The Aqara sensor can still be used to control home heating and monitor typical indoor climate. Assuming you can get it to keep transmitting sensor readings, of course.

I’ve reviewed the Aqara Temperature and Humidity sensor model WSDCGQ11LM. This is the model you can still expect to find in stock everywhere. There’s also a newer WSDCGQ12LM (lightly branded “T1”) model available that is slowly replacing old inventory. There are many reports of problems with the newer models too, though.

**Reviewed:** [Aqara Temperature and Humidity Sensor](https://www.aqara.com/us/product/temperature-humidity-sensor/?ref=ctrl.blog)

**Review rating:** 2.5 / 10
### TP-Link band-steers 2,4 to 5 GHz Wi-Fi even when the radio is off
URL: https://www.ctrl.blog/entry/tplink-band-steering/
Last updated: 2026-08-23T22:23:28.000Z
My [TP-Link EAP653](https://www.tp-link.com/us/business-networking/ceiling-mount-access-point/eap653/?ref=ctrl.blog) Wi-Fi access point (AP) has some features that don’t work well together. Who would have thought that its proprietary extensions to the Wi-Fi standard would cause compatibility issues with clients? 

I’ve configured the AP to power down the fast 5 GHz radio at night to reduce its power consumption. The 5 GHz band uses less power than 2,4 GHz (faster means shorter transmission time). However, not all devices are compatible with the former. The power savings is about the same during off-peak hours anyway. Clients should fall back to the slower 2,4 GHz network and remain connected throughout the night. 

However, the AP’s proprietary band steering feature isn’t aware of its power-saving radio scheduling feature. This setup interaction results in frustrated client devices that don’t understand why they can’t connect to the 2,4 GHz network while the 5 GHz network is unavailable. 

Wi-Fi band steering is a non-standard extension of the Wi-Fi standard (IEEE Standard 803.11). Other vendors use other names for the same feature, including “prefer 5 GHz” and “client steering”. As such, the exact technique deployed varies from vendor to vendor. The gist of band steering is that the AP will pretend that the 2,4 GHz network is unavailable to steer clients over to the faster and less congested 5 GHz network. The AP will attempt to detect 5 GHz-capable clients and may choose to respond slower (or not at all) to connection requests on the 2,4 GHz network. 

Band-steering requires a dual- or tri-band network setup that operates with the same SSID and security settings on all bands. In 2,4/5 GHz dual-band networks, clients will normally automatically decide whether to connect to the 2,4 GHz or 5 GHz network. The 2,4 GHz band offers increased range and coverage, but at lower data transmission speeds than the 5 GHz band. Clients generally prefer to join the 2,4 GHz network but might decide to use the 5 GHz network if conditions are good. 

TP-Link’s implementation of band steering drops the connection on the 2,4 GHz band during the AP association process immediately after it has been established. This design lets it get the client device’s real hardware (“MAC”) address. As opposed to the randomized privacy-preserving MAC addressed that might be used earlier in the connection process. The AP counts the number of connection attempts from the same MAC address to the 2,4 GHz band. If the client doesn’t get the hint and keeps attempting to connect to the 2,4 GHz band, the AP will allow the connection after 10 failed attempts. The failure counter is reset periodically. 

Android clients also count the number of failed connection attempts to an AP. They assume the Wi-Fi password must be incorrect after five consecutive failed attempts. Android then temporarily disables the SSID; which is shared among the different bands in a multi-band configuration. It also prompts the user to correct what it believes is an incorrect Wi-Fi password. 

Users will need to quickly type the correct password five times — without loosing faith that they’re indeed typing it correctly every time — to successfully join the network. This is a terrible user-experience that is bound to result in confusion, frustration, and support tickets.

To be clear, the AP never told the client there was anything wrong with the password. The client passed the authentication process and gets rejected during the following link association process. I can only assume Android adopted this error handling for compatibility with some unusual and buggy APs. At any rate, the user will surely be frustrated by being told the correct password to their Wi-Fi network is incorrect when that’s not the issue.

I’m surprised that TP-Link didn’t discover this problem with Android clients and set a lower “max failures” value by default. That this went unnoticed suggests to me that TP-Link only tested that the feature works as it expected under ideal conditions. It evidently didn’t bother to verify that the feature failed gracefully with clients running the world’s most popular consumer operating system.

You can fix this problem by either disabling band steering or power-scheduling on your AP. You can also leave both features enabled and change the AP’s band steering logic to give up after four errors instead of ten. The relevant setting in TP-Link products is found under Wireless: Band Steering: Max Failures. 

Changing this setting fixes the compatibility issue with Android clients. Other devices may still experience faulty behavior depending on their network reconnection algorithms.

You could also disable the 2,4 GHz band instead of the 5 GHz band radio. However, even brand-new devices aren’t guaranteed to be equipped with a 5 GHz-capable radio. Some clients on your network, especially cheaper ones, will likely drop off the network if only the 5 GHz band remains available.

The proper fix is for TP-Link to automatically disable the band steering feature when the 5 GHz network is powered off. I’m guestimating that TP-Link is only missing about ten lines of code. It shouldn’t be difficult to patch. Alternatively, TP-Link could allow its customers to schedule the band steering feature on/off as well as the radio power schedule. At the very least, the AP should warn users about incompatible settings when enabling both power scheduling and band steering. 

TP-Link has needlessly made its band steering feature a checkbox that can potentially break the product. A few conditional checks in the code could have safeguarded it from misconfiguration and bad interactions with other features. It’s incredibly lazy programming to blindly trigger the band steering logic on the 2,4 GHz band without first verifying that a suitable 5 GHz band is there to receive the client.

#### Sources

- [Android Wi-Fi Network Selection](https://source.android.com/docs/core/connect/wifi-network-selection?ref=ctrl.blog), 2022-08-03, Documentation, Android Open Source Project
- [MAC Randomization Behavior](https://source.android.com/docs/core/connect/wifi-mac-randomization-behavior?ref=ctrl.blog), 2022-08-03, Documentation, Android Open Source Project
- [How to Configure Band Steering on TP-Link](https://www.tp-link.com/us/support/faq/2092/?ref=ctrl.blog), 2022-06-27, Configuration Guide, Support, TP-Link
- [IEEE 802.11-2020](https://standards.ieee.org/ieee/802.11/7028/?ref=ctrl.blog), 2021-02-26, Standards, IEEE
- [802.11 Association Process Explained](https://documentation.meraki.com/MR/WiFi%5FBasics%5Fand%5FBest%5FPractices/802.11%5FAssociation%5FProcess%5FExplained?ref=ctrl.blog), 2020-10-05, WiFi Basics and Best Practices, Documentation, Meraki, Cisco
### Finally fixed my PC’s persistent graphics and audio stutters
URL: https://www.ctrl.blog/entry/troubleshoot-stuttering/
Last updated: 2026-08-23T22:23:36.000Z
I’ve set up my gaming computer with dual booting between Fedora Linux and Windows 11\. The Windows 11 installation doesn’t see much use these days since [PlanetSide 2 became available on Linux](https://www.ctrl.blog/entry/planetside2-on-linux/). For the last two months, the system has suffered from stuttering issues during regular use and gaming. The display stops painting or gets partially corrupted, audio goes silent, and all operations halt for 0,5–2 seconds. Sometimes, the system even crashes, but it usually recovers by itself. 

The unusual thing about this problem is that it manifests the same on both Linux and Windows. In my earlier experience with similar problems, they’ve often been caused by driver issues. Drivers are operating system (OS) specific, and it’s unlikely that two different OSs should have the same problem. I feared it was a hardware issue, but I struggled to identify the problem. 

I’ve run dozens of performance benchmarks, system stability and latency tests, and tests designed to detect specific hardware problems. Tests included MdRes, MemTest, LatencyMon, Prime95, PCMark, 3DMark, OCCT, BurnInTest, and others. Every test came back clean. I found it even stranger that the stutters didn’t negatively affect any performance benchmark tests. The problem was observable, but not measurable. *Oh, joy.* 

It was difficult to rule anything out as an issue like this one can be caused by just about any component in the system. I’ve installed Windows and Linux on separate storage media, so I was just about the only component I could rule out. My ASUS mainboard has a bug where it randomly doesn’t initialize the first M.2 connector at boot. So, while storage issues complicated my troubleshooting it’s not the cause of this fault. 

I tried removing hardware and changing different UEFI settings to see if anything could help to isolate the issue. You can waste days experimentally flipping switches and trying combinations of different settings. Unfortunately, nothing I tried made any positive difference.

However, I was put on the right track when checking whether there were any updates available for my ASUS PRIME X570-P mainboard. I had already installed the latest version, but the latest changelog mentioned that it had fixed an issue with the firmware-backed trusted platform module (fTPM) causing stuttering! 

There is a [known problem with stuttering](https://www.techpowerup.com/292712/amd-isolates-windows-11-and-windows-10-performance-stuttering-issues-to-ftpm?ref=ctrl.blog) with some AMD-brand processors and mainboard combinations. I was a bit confused why this issue hadn’t shown up in my search results before; I must have tried a hundred keyword combinations that should have dug up this tidbit.

Anyhow, I ran out just before closing hours and snatched up compatible hardware Trusted Platform Module (TPM). I bought the [ASUS TPM\-SPI module](https://www.asus.com/motherboards-components/motherboards/accessories/tpm-spi/?ref=ctrl.blog). There are three different TPM connectors, so check that you get the right one! Minutes after I’d installed it onto my mainboard, I could confidently say that things had finally gotten better! 

The stuttering didn’t go away completely, nor did it reduce how often it happen. the duration of the stuttering was significantly reduced on both Linux and Windows. Instead of lasting up to two seconds, the screen and audio only cut for a fraction of a second.

Microsoft made a TPM version 2.0 module a requirement to run Windows 11\. I had to audit my Linux installation to verify this, but it isn’t set up to use the TPM at all. I don’t understand how the fTPM should affect Linux, but its presence might cause some stability issues somewhere in the system. It could also have been introduced by the very mainboard firmware update that was supposed to address the issue.

I removed the hardware TPM, and the stuttering immediately got worse in both Linux and Windows. The mainboard reverts to fTPM if the hardware TPM is removed. It doesn’t have a way to disable the TPM. The stuttering got better again after I reinstalled the TPM. The fTPM clearly affects the system stability, even under an OS where it’s not in use. 

I had finally made some progress after spending a dozen hours on the issue over several days. I still don’t know what the underlying problem is, but at least all my random trial and error had resulted in a change for the better.

On a whim, I tried reseating (unplugging and replugging) the memory modules. I was just about out of other things to test. I had run multiple memory speed and stability tests, and they had not detected any problems.

I first booted into Windows and didn’t notice any improvements. However, I immediately noticed improvements when I booted into Linux. The stuttering was *almost* completely gone!

The desktop still sporadically locks up for a fraction of a second now and then. Occasionally, it also hangs indefinitely or crashes. However, it doesn’t happen when playing games or watching videos anymore. Importantly, it now always recovers from the stuttering and no longer locks up indefinitely. Nevertheless, I jotted it down as a success.

I guess the lesson I learned from this experience was to not trust software-backed assessments of hardware. The slots for the memory modules on my mainboard are especially finicky to click into place. You need to apply an excessive amount of force to install the modules. I presumably must not have done it properly when I installed them two years ago. Replugging them shouldn’t have reset or influenced anything else on the mainboard.

I’ve previously experienced another [connector problem that caused subtle and difficult-to-troubleshoot problems](https://www.ctrl.blog/entry/m2-performance-fretting/). My gaming computer is stationary, so the connector problem must have been caused by something like thermal cycling. Whatever the cause, the faults must have been error-correctable at some level to a degree where no test tools noticed the issue. I haven’t got memory modules with error-correcting code (ECC). They’re too slow and too expensive for a gaming-focused system. However, modern memory modules are so dense that errors are expected, so they need to include some simpler internal error-correction mechanisms. 

At this point, I pulled out the TPM and reverted to the fTPM again. I expected that it wouldn’t impact the system stability and the stuttering anymore. Country to my belief, this reintroduced the stuttering on Linux. I switched back to the hardware TPM, and the stuttering stopped. Whatever the underlying cause, it’s caused by a complex set of factors.

Windows was still stuttering, though. The stuttering must be caused by yet another issue. At this point — with two other underlying problems out of the way — I had more luck with a more traditional troubleshooting technique that I’d already tried and dismissed as ineffective.

I’ve been using the stable driver for my AMD Radeon RX 6700 XT graphic card (GPU). It was last updated nearly four months ago. AMD has released four beta releases since the last stable release. The changelog for all four betas mentioned that they address stuttering and stability issues. 

I upgraded to the latest beta release and the stuttering on Windows disappeared completely. I had already tried using an earlier beta release but had reverted to the stable version after it didn’t fix the stuttering. A bit curious, I removed the hardware TPM one last time to see what would happen. The stuttering re-manifested with the fTPM, so I quickly reinstalled the hardware TPM.

I also needed to find a solution for the desktop crashes on Linux. As I’ve mentioned, it doesn’t crash when I’m watching videos or playing games. So, the system seems to handle high loads fine but not lower loads. I disabled Dynamic Power Management (DPM) in the Kernel, and that seemed to help a lot.

I went from experiencing one or two crashes every hour to maybe once every four hours when I disabled DPM. I’d already tried this workaround some weeks earlier, but it didn’t make a difference with all the other system issues. The AMDGPU driver has a history of stability issues with DPM. Disabling it is a commonly suggested workaround for any driver crashes. 

I tried one more time to remove the TPM while DPM was disabled on the GPU. The system started stuttering again, so I quickly reinstalled the TPM. I expect that this is the last time I’ll ever attempt to remove it. It observably increases system stability for both Windows and Linux.

I’ll be the first to admit that I have no idea what’s going on inside my computer. It’s a common setup with average hardware components. Gaming and computer enthusiast forums are filled with people complaining about similar issues with identical or similar hardware. What works for some doesn’t work for others.

It took me weeks to fix these problems. Without any clear indications of what was wrong, I was left with random experimentation to see if I could influence the observed behavior. By the time my system was up and running reliably again, I expect most consumers would have given up and either bought a new computer or found another hobby.

I would probably not have gotten anywhere without decades’ worth of hard-fought-for experience. Even so, my three-part solution was mostly discovered by random chance and an unwillingness to admit defeat.

It’s incredibly difficult and time consuming to resolve this type of difficult-to-diagnose hardware problem. There simply aren’t any good tools or reliable methods to detect and diagnose hardware issues. Consumers are left to fend for themselves as they can’t even accurately point the finger at any one hardware vendor as being the culprit behind their hardware vows.

Consumers either need to spend hours and become experts in the field or find another hobby. The computer enthusiast and gaming markets will die unless vendors can come together to develop better standards for troubleshooting tools. We need better fault detection and reporting, more insights and logs, and it needs to come from every component and level.

I believe more in initiatives to make problems easier to diagnose than I believe the industry will magically overcome entropy and incompatibility issues. It can’t develop more reliable products without overcoming the same lack-of knowledge and insight that its consumers face on their own every day.
### Stop using DICT dictionary apps (such as GNOME/​MATE Dictionary)
URL: https://www.ctrl.blog/entry/dict-protocol-privacy/
Last updated: 2026-08-23T22:05:00.000Z
The MATE Desktop for Linux installs a Dictionary app by default (a fork of the retired GNOME Dictionary app). The apps don’t protect your privacy, and you might want to stop using them.

With the apps’ default configuration, your word queries are looked up online via an arcane old internet protocol called DICT ([RFC 2229](https://www.rfc-editor.org/rfc/rfc2229.html?ref=ctrl.blog)). The protocol was standardized in 1997 and it doesn’t include any encryption or other privacy protections.

So, why is this a problem for dictionary lookups?, you might ask. Some knowledge is forbidden knowledge, depending on your local authorities. For example, it is inadvisable to look up information about abortion from within some U.S. states, war crime in Russia, or democracy and human rights in China. 

The apps don’t warn you about their privacy implications when you launch them. They’re technically required to inform you about whom they share data with (the dictionary server providers) under the General Data Protection Regulation (GDPR) in the E.U.

The apps can be configured to use a local offline dictionary. This configuration requires setting up a DICT server and change the apps to only query your local server. You then need to maintain a server and source an up-to-date dictionary.

The GNOME Dictionary used to be a GNOME Core app. Core apps are installed automatically as default apps for the GNOME Desktop. However, you may still have the app installed if you’ve kept updating the same GNOME installation over the years. The app is also still often featured in the GNOME Software store.

The MATE Dictionary app is installed by default in Linux Mint MATE. In other Linux distributions, it’s also a dependency of the MATE Desktop meta-package. The findings in this article also apply to other DICT protocol clients such as GoldenDict.

It’s possible to set up a DICT server behind a Transport Layer Security (TLS) encryption proxy. This would provide network-interception protection and on-the-network privacy protections. The dictionary server provider would still see your queries, however. Neither GNOME Dictionary, MATE Dictionary, nor GoldenDict support the non-standard DICT over TLS set up.

You should consider the [Wordbook app](https://flathub.org/apps/com.github.fushinari.Wordbook?ref=ctrl.blog) if you’re interested in a privacy-friendly dictionary app that works offline. However, it only supports English. It automatically downloads the WordNet dictionary the first time you launch it. The [WordNet Project](https://wordnet.princeton.edu/?ref=ctrl.blog) is retired, so the dictionary will grow more out of date over time.

For a more up-to-date online and encrypted dictionary, you can consider [Quick Lookup](https://flathub.org/apps/com.github.johnfactotum.QuickLookup?ref=ctrl.blog). The app is less polished than Wordbook, but it supports 46 languages. It’s powered by [Wiktionary](https://www.wiktionary.org/?ref=ctrl.blog), a Wikimedia Foundation project. You can expand and contribute to the dictionary if something is missing!
### “Gigabit Router” doesn’t mean it can deliver gigabit internet speed
URL: https://www.ctrl.blog/entry/gigabit-router/
Last updated: 2026-08-23T22:08:19.000Z
Most manufacturers of consumer-grade network routers (both Ethernet and Wi-Fi) brand their products as “Gigabit Routers”. At the very least, it’ll say “Gigabit Ethernet”. However, neither term necessarily means the router can fully exploit your gigabit internet connection.

When shopping for a new router, you’ll notice that most manufacturers advertise every product as a “Gigabit Router” or at least “Gigabit Ethernet”. There are also a few budget Fast Ethernet (100 Mbps) options in the market. Informed consumers are generally satisfied if it says “gigabit” (1 Gbps or 1000 Mbps) somewhere on the box. 

The only differentiating features — if you believe the manufacturers — are the number of Ethernet ports and the Wi-Fi speed. The quoted Wi-Fi speed is usually the theoretical maximum and not based on performance tests. However, Wi-Fi router speed is a story for another time.

However, you might not get the full speed advertised on the box. The Gigabit claim may refer to the router’s Gigabit Ethernet ports, the switching speed between the local-area network (LAN) ports, or the total switching speed between LAN; Wi-Fi LAN (WLAN); and the wide-area network (WAN, e.g., the internet). 

Gigabit doesn’t necessarily refer to the routing speed between the LAN or WLAN and the WAN. This last metric is what most people would consider as their “internet speed”.

Gigabit Ethernet ports aren’t the only requirement for a device to deliver gigabit speeds. You also need fast enough hardware to handle the package routing. Switching between the LAN ports can be done almost entirely using hardware acceleration in the firmware. These chips are inexpensive, and most routers and switches will handle a full gigabit between the LAN ports.

However, the WLAN to LAN and WLAN/LAN to WAN speeds are less likely to reach gigabit speed with inexpensive hardware. WAN routing requires the router to do more work to send the traffic onward to its destination. In IPv4 networks, the router needs to rewrite the sending address (“masquerading”) and support more long-lived states to allow for replies to get back to the sender.

It might not sound like much, but parts of these processes generally happen in software on an underpowered processor rather than in firmware. The performance plummets and you can end up with speeds anywhere in the 200–800 Mbps range depending on the exact make and model.

So, how can you know which router to get that’ll max out a gigabit connection? You can’t rely on the manufacturer-provided marketing numbers on the box. They’ll almost always be theoretical max speeds and rarely based on the performance characteristics of the router in question.

Instead, you have to rely on reviewers to put the routers through performance tests. Unfortunately, many “reviews” uncritically repeat information from the manufacturer.

There’s not much interest in router reviews, so through ones are becoming rarer and rarer. You probably won’t find detailed enough reviews for the cheapest options on the market, but you might have more luck with prosumer and enterprise routers.

Ideally, you should find ones that mention routing speeds, and test with large (1500 bytes) and medium-sized (500 bytes) network packages. The two figures can vary greatly and reveals whether the router can handle different workloads. Alternatively, an internet speed test performed from a site with a confirmed gigabit connection can suffice.

You might need to buy your best candidate router and do the performance testing yourself. Make sure to buy it from a vendor with a generous return policy with enough time to do the testing.

It’s not difficult to test routing speeds, but it’s also easy to accidentally test the wrong thing (e.g., LAN switching or the Wi-Fi speed instead of WLAN/LAN to WAN). You can get a long way just by using an online speed test and comparing the speed you get when your computer is plugged directly into your internet connection versus when it’s connected through your router.
### TeamViewer installs suspicious font only useful for web fingerprinting
URL: https://www.ctrl.blog/entry/teamviewer-font-privacy/
Last updated: 2026-08-23T22:23:11.000Z
So, here’s a bit of a mystery: Why does TeamViewer – the popular remote desktop program – install a font it doesn’t use on your computer? The abstract font (shown in the above image) doesn’t seem to serve any purpose in the software. Intentional or not, it enables websites to detect if you have TeamViewer installed on your computer.

You can see an almost complete type specimen of the TeamViewer font in the above illustration. It contains the characters to write TeamViewer plus the digits 7 and 8\. The remaining 24 majuscules (uppercase) characters of the Latin alphabet are encoded as an apostrophe. The included characters feature a rather unique and mostly unreadable design. 

It’s not uncommon for creative software — like Microsoft Office, LibreOffice, and the Adobe Creative Suite — to install complementary fonts. However, these fonts are all meant to enhance your use of the software by giving you more fonts options. You get the TeamViewer font as an option in all programs that support setting your own font (such as Microsoft Word).

Websites can detect the fonts you’ve installed on your computer. Font detection relies on brute-force testing. A webpage creates a hidden bit of text and measures how wide it is. It then changes the font to, say the TeamViewer font, and checks to see if the text changes width. If it does, then the website knows you’ve got that font installed on your computer — and by extension the software that installed it.

The odd and almost unreadable proportions of the TeamViewer font make it well-suited for fingerprinting. I believe this is also its true purpose. There’s no use case for installing a unique non-general purpose font like this along with your software other than enabling browser-based fingerprinting.

If the program needed this font for some obscure reason, it could load it from its own data directory. It doesn’t need to install the font as a generally available system font if it only served an internal use.

The TeamViewer client program doesn’t load the font file, list all the installed fonts, or reference the font file directly. As far as I can tell, the only TeamViewer software that references the font file is the TeamViewer installer and the uninstaller programs.

TeamViewer doesn’t bundle the font in its Mac and Linux versions. The font is only bundled alongside the Windows version. This tidbit of information is also why I’m convinced the font serves no purpose in the TeamViewer client software. Why would it be required on Windows but not the other supported platforms?

The current version of the font is called TeamViewer15\. TeamViewer releases a new version of the font with every major version number change. A quick query on GitHub reveals that many font fingerprinting libraries include references to the font names TeamViewer15, TeamViewer14, and TeamViewer13.

The font raises the risk of phishing and scams targeting TeamViewer customers. It leaks who TeamViewer’s customers are to every website they visit. This could enable more targeted social-engineering messaging based on the knowledge about whether the software is installed or not. There’s no need to waste time in a support scam asking the victim to install a remote-access tool when they’ve already got one set up and ready to abuse.

After I learned about the existence of the TeamViewer font, I expected to find it used on the TeamViewer website. I assumed the website used it to adapt its contents to whether you have the software installed or not.

The TeamViewer website could, for example, change the download button to a purchase button, or give support documentation relevant to your version of the software. However, this **is not the case**. No public part of the TeamViewer website tries to load the font.

**Update** (2022-07-20): A reader identified and documented a usecase for the font on the TeamViewer website in [a comment on Hacker News](https://news.ycombinator.com/item?id=32165103&ref=ctrl.blog). The website checks for the presence of font (and thereby whether you’ve got the software installed) when you follow a special screen-sharing session invitation link. The links are used to invite others to connect to your computer.

I haven’t examined archived versions of the TeamViewer website; it might have used the font in the past. It really raises questions about the font’s true purpose, though. Is it used by partnering ad networks to better target TeamViewer customers and non-customers with custom messaging?

> The TeamViewer font is used to implement a smooth user experience from web to the native client, e.g., when connecting via an invitation link, to offer an installation or initiate the connection directly. This has proven to be helpful to improve the user experience for all user groups; nevertheless, based on the raised concern, we have decided to review and change this approach within one of the next releases to prevent potential detection of a TeamViewer installation via the font.

Robert Haist, Chief Information Security Officer, TeamViewer

**Update** (2022-07-23): Updated with a statement from TeamViewer. The company has decided to remove the font in a future release.

#### Sources

- [Canvas Font Fingerprinting](https://privacycheck.sec.lrz.de/active/fp%5Fcf/fp%5Fcanvas%5Ffont.html?ref=ctrl.blog), 2019-02-21, Browserize, Leibniz Computing Centre
- [Fingerprinting web users through font metrics](https://www1.icsi.berkeley.edu/pubs/networking/fingerprintingweb15.pdf?ref=ctrl.blog), 2015-02-26, David Fifield and Serge Egelman, University of California; Berkeley
### On-device browser translations with Firefox Translations
URL: https://www.ctrl.blog/entry/firefox-translations/
Last updated: 2026-08-23T22:06:55.000Z
The Mozilla Firefox web browser is finally beginning to catch up in a market where every competitor has an online language translation service feature. Firefox recently debuted its long-awaited privacy-preserving on-device translation service.

The built-in integration with Google Translate has been one of the Google Chrome browser’s leading advantages over its competitors. The translation service grants you effortless access to international content in languages you don’t understand. It gives you access to more of the web.

[I attribute much of Google’s pan-European success](https://www.ctrl.blog/entry/googles-european-success/) to its translation services. Why would you want to switch to Chrome from a competitor like Firefox? Well, you can effortlessly access more of the web with Chrome than with Firefox.

Other web browsers — notably Microsoft Edge, Apple Safari, and Yandex Browser — have only recently added their own translation services. However, the Mozilla Firefox browser doesn’t currently have nor want its own online translation service.

Online translation services require you to either send the webpage address or contents of the page to the translation service provider. It translates the contents and sends it back to your device. This architecture sacrifices user privacy for convenience.

You can’t make an informed decision on whether you want to share the contents of a webpage or an email message with a translation service as you don’t know beforehand what the message says. This paradox can make you unintentionally compromise your privacy and the privacy of the sender.

Mozilla has gone in the opposite direction. Instead of relying on a centralized translation service, it’s hoping to perfect on-device translations. Mozilla has partnered with various European universities to develop on-device offline and privacy-preserving local translation services. The translation project was announced in 2019 as Project Bergamot.

The endeavor is funded by research grants from the European Union (EU). The EU is a natural supporter of this work with its 24 official languages and a total of 37 languages across the entire European Economic Area (EEA). Translation services are a necessity of European governance and commerce.

The first public release of Firefox Translations supports only eight languages with five additional languages in beta quality. The next version is expected to add two more languages plus one beta language. You can’t translate every supported language to and from every other support language.

It’s a far stretch from completely fulfilling the needs of the EU nor Firefox’s users. However, it’s a solid start and it hopefully will be developed to support more languages over time.

The Firefox Translations extension is available for free through the [Firefox Extensions portal](https://addons.mozilla.org/firefox/addon/firefox-translations/?ref=ctrl.blog). I expect we’ll see Firefox Translation included by default in a future version of Firefox.

The extension uses an experimental application programming interface (API) called `translationbar`. The user interface is provided natively by Firefox with the extension providing the language-translation models. Other translation services, online or offline, will, presumably, be allowed to hook into this API in the future. 

If you’re not a Firefox user, you can assess the translation service quality of the [Mozilla Translate web front-end](https://mozilla.github.io/translate/?ref=ctrl.blog). Even though it’s a webpage, the translation happens on your device.

The translation models are all open-source. Outside the context of a web browser, this could be applied to provide privacy-preserving translations of chat messages and in other apps.

Apple’s Translator app on iOS and the Google Translator app on Android and iOS can optionally perform on-device translations when you’re offline. It’s not beyond the capabilities of these other actors to achieve on-device translation services. However, it — and by extension, your privacy — apparently isn’t a priority.
### How to set per-creator/​channel playback speed on YouTube
URL: https://www.ctrl.blog/entry/youtube-per-channel-speed/
Last updated: 2026-08-23T22:26:10.000Z
You can find hundreds of browser extensions that let you fine-tune the playback speed for all YouTube videos. I’m happy with the default speed of 1× for most videos (and music). However, I want to speed up some channels without having to tweak the speed dial every time. Enter Samuel Li’s Speed Controller extension.

I tend to fine-tune the playback speed to somewhere between 1,05× and 1,35×. By default, YouTube only lets you increase the playback speed by increments of 0,25×. This design decision has led to the creation of hundreds of extensions for fine-tuning and setting speeds other than the defaults.

I tend to set the same speeds for videos from the same creators. For example, some podcasts talk fast, and others drag on forever. They can be just as interesting, but the slower ones are a bigger time commitment.

This got me thinking: Surely, there must be an extension that lets me set the default playback speed per-channel instead of the entire YouTube website? I decided to install every YouTube speed-setting extension in the Firefox Add-Ons catalog. Unfortunately, none of them offered the functionality I wanted.

However, the creator of one extension had included an open invitation to email them with feature suggestions. I sent an email to Samuel Li, and days later he’d implemented the functionality I wanted.

The Samuel Li’s Speed Controller (SLSC) extension now lets you set a global default playback speed for all of YouTube and per channel. I’ve left the global default at 1,0× and set custom higher speeds for some of my favorite podcasts and other channels.

SLSC also works when watching videos from playlists. I mention this because I also discovered that many extensions don’t work at all in playlists or only work for the first video. SLSC will automatically change the speed to match your defaults for the current video’s channel.

[![Get this Mozilla Firefox add-on](https://cdn.synaps.media/control/content/images/2026/08/get-firefox-extension.svg)](https://addons.mozilla.org/en-US/firefox/addon/youtube-speed-controller/?src=external-addonsbadge-ctrl.blog&ref=ctrl.blog)

The extension is exclusively available for Firefox on Mozilla Add-Ons. However, it’s open-source and it only uses cross-browser compatible Application Programming Interfaces (API). It should run fine in any Chromium (e.g., Google Chrome) and WebKit (e.g., Safari) web browsers.
### Review: Dygma Raise split mech­anical key­­board for enthusiasts
URL: https://www.ctrl.blog/entry/review-dygma-raise-split-keyboard/
Last updated: 2026-08-23T22:18:14.000Z
**Sponsored:** Dygma provided the product for free. It had no editorial control of this review.

The [Dygma Raise](https://web.archive.org/web/20220615160753/https://dygma.com/products/dygma-raise) is a splittable 60 % mechanical keyboard; meaning it has no function key row, navigation keys, arrow keys, or numpad. It’s squarely targeted at keyboard enthusiasts willing to pay 350 USD for a keyboard with fewer standard keys plus a unique two-rowed eight-key space bar design.

You can program every key on the Raise with up to ten layers to make it fit your needs. It’s quite flexible, yet it’s the first keyboard I’ve ever used that didn’t work after I plugged it in. Its firmware leaves a lot to be desired.

I’ve already discussed [*the case for and against split keyboards* in an earlier article](https://www.ctrl.blog/entry/split-keyboard-accessibility/). I won’t repeat myself here, so have a read through that first if you’re curious if split keyboards are right for you. You may also be interested in my [keyboard form-factor guide](https://www.ctrl.blog/entry/keyboard-form-factor-guide/).

The Dygma Raise is available in matte black or silver and it’s available with ISO or ANSI key layouts. You can choose from eight popular key switches from Kalih and Cherry MX, and eight regional keycap sets. 

The Raise consists of two keyboard halves that you can place as you want. Each half is intended for single-handed operation. You can use the Raise as a normal 64 % keyboard by pushing the two halves together. The connector makes a snug and secure fit.

The two halves of the Raise are wired using USB-C cables into a small box Dygma calls the “Neuron”. The Neuron stores your custom light effects, keyboard layout and layers, and your macros. You can plug it into any computer and it’ll remember your setup without the need to install and configure any software on every computer you use. The Neuron is wired to your computer using an included USB-C to A cable.

Along with the Raise, you also get a carrying case and an “enhancement kit”. The kit includes a keycap and switch puller, O-ring switch dampeners, a brush that’s too big to fit where it’s needed, two extra keycaps, and one extra of each key switch you were offered when ordering. The extra keycaps you get are one blank key and one layout specific E00 key (the key to the left of the 1 key). 

The enhancement kit is a nice touch, but it doesn’t make sense to send a key switch sampler set *after* you’ve already decided and bought the keyboard. I guess the intention is to include an extra key switch instead of shipping out replacements later in case of a faulty switch.

It’s presumably cheaper to send everyone a complete set than to stock different sets per keyboard, but the sets are already complex with the extra keycaps in two colors plus the layout specific E00 replacement. However, it would make much more sense if you receive the kit first as a sampler and then could place the order for the keyboard.

Most of the keycaps, including the four upper space keys, are standard Cherry-compatibles. However, the bottom four buttons are custom, although the company has made available [3D models for printing](https://support.dygma.com/hc/en-us/articles/4468915916049-Can-you-3D-print-the-keycaps-for-the-thumbkeys?ref=ctrl.blog).

The lower four keys are my biggest gripe with Raise’s hardware. They’re about ⅖ the height of the regular keycaps, forming a tall barrier between the top four space-bar-replacement keys and the lower four. The profile of the space keys goes down to meet the other four keys, but there’s still a significant height difference.

My thumbs get stuck on the lower four keys as I repeatedly bump into the sides of the upper space keys. I need to make exaggerated and straining motions to compensate for the design. It’s difficult to get used to.

The bumps on the home row position keys (F and J) are shallow and positioned too close to the key edges; making them nearly useless when it comes to finding the home keys. Good positioning bumps are either tall near the edge or shallow but placed much nearer to the middle of the keycaps’ top surface.

I currently have 14 keyboards in the house and all of them but Dygma gets this right. The default keycaps are so bad that switching F and J to caps with proper bumps reduced my typing error rate by 14 %. I constantly have to look down to locate the position keys, something I haven’t needed to do regularly in twenty years.

I can only assume Dygma’s designers either didn’t realize why the bumps are there, or that they have super-sensitive fingertips. It’s fixable by purchasing better keycaps, but it feels disappointing to have to spend the extra money to fix Dygma’s design flaw. You’ll have no trouble finding compatible keycaps, but they’ll probably look slightly off from the rest of the set.

Some of the product photos on Dygma’s website show the keyboard raised off the table and tilting out from the middle at a 40° angle. This is a typical feature for split keyboards, offering even more ergonomic customization. Despite its name, the Raise’s stand is sold separately (90 USD).

The open design makes it easy to clean, although some potential customers might be disappointed by the reduced reverb and sound from an unenclosed keyboard. Cat owners will love it, though.

The keyboard unfortunately isn’t rated as being splash-proof. Accidents involving various drinks are known to happen around expensive keyboards. The chassis doesn’t feature drainage holes at the bottom, which can help to prevent or limit water damage. Holes in the chassis can impact the sound profile of a keyboard, but I’d be much happier with that compromise than someday having a wet and dead keyboard.

The Raise is a keyboard for people who want to customize how their keyboards work. I found some of the out-of-the-box defaults baffling; e.g. the Insert key isn’t mapped to anything even though all the other navigational keys are available. The default keyboard makes so many strange decisions that it’s not really an option to *not* customize/fix it.

For example, the keyboard has a Function key. You would expect this to work with the number keys to emulate the missing function keys. Instead, the Function key is only configured as a toggle for the light effects.

The default secondary layer uses the E (up), S (left), D (down), and F (right) keys as directional arrow keys. Millions of people are already familiar with using the W (up), A (left), S (down), and D (right) keys; as they are the default movement keys in every game. It seems incredibly strange to me to not go with WASD as the default.

You can customize every keyboard layout using Dygma’s Bazcor configurator software. You can restore the Function key, move the arrow keys to WASD, implement a Windows key lock (popular on gaming keyboards), and do all sorts of changes.

Bazcor is a complicated piece of software, but it makes customizing your keyboard relatively simple. You might be disappointed if you expect to customize key levels and groups, though. It only allows you to customize which key emits which keycode; think of it as moving any key anywhere else on the keyboard.

You can configure up to ten levels and set keys to switch (permanent) or swap (switch while holding a modifier key) to different keyboard layers. For example, I swap to a layer where the number keys are mapped to Function keys 1–12 while holding the Function key pressed. I’ve also set up my keyboard to switch to a layer where the Windows key is disabled by pressing the Function + Windows keys.

You can configure custom light colors for each key, and even use different colors for different keyboard layers. You can’t assign any lighting effects other than on/off and color, though, so you won’t be able to configure a Caps Lock key to indicate its state.

My first out-of-box experience (OOBE) with the Raise after plugging it in was what appeared to be a completely dead keyboard. No key presses seemed to register. I feared I’d received a defective product, but the issue was more subtle than that. 

I’d plugged it into my computer while it was asleep, and expected it to wake up the computer when I pressed keys on the keyboard. You know, like a normal functioning keyboard works.

The Raise doesn’t work when the computer is asleep nor when it’s in UEFI/BIOS setup mode because of [blah-blah boring technical details](https://support.dygma.com/hc/en-us/articles/360007813538-Why-doesn-t-the-Raise-work-when-I-first-login-to-the-computer-or-when-it-s-on-Sleep-mode?ref=ctrl.blog "“Why doesn’t the Raise work when I first login to the computer or when it’s on Sleep mode?”"). The issue was fixed in firmware version 0.3.5 released in March 2022. The Dygma website still only links to version 0.3.3 today over four months later. The issue has also reappeared in version 1.0.beta14\. 

It can’t start a sleeping device, and you need to have a different keyboard on hand if you’re doing something as exotic as interacting with your computer’s UEFI settings, dual-booting it, or run into the Windows- or BitLocker recovery screens. Dygma has sold a partially defective keyboard since its launch over two and a half years ago.

To be fair, I’ve got other keyboards where the Enter and Space keys don’t wake my PC from sleep. However, on those keyboards, I have at least 60 other keys that get the job done — and both Enter and Space work in BIOS mode.

The keyboard also occasionally restarts by itself while I’m using it. The lights distractingly flicker off and on again, and I might lose one keystroke when it happens. I’ve only noticed it happen five times in three months, so it’s not a huge issue. On the other hand, that’s also five times more than any other keyboard I’ve used.

Dygma has been open about its early [issues with its keyboards freezing up completely](https://dygma.com/blogs/product-development/a-keyboard-startups-worst-nightmare-freezing-issue-solved?ref=ctrl.blog). It initially solved the problem by adding a three-seconds-timeout-and-restart detection before finding a better solution. I assumed it was a loose cable or a poor connection before I read about Dygma’s earlier issues. I’m not sure if my issue is related to that issue, though.

The Caps Lock key is supposed to slowly fade on and off when enabled. The effect only updates when you press other keys on the keyboard, though. So, you might not be able to determine its state by looking at it, depending on where it is in its light cycle.

The Bazcor configurator also ran just fine on recent versions of both Fedora Linux and Ubuntu. It handled device communication, firmware updating, and even display scaling just fine. My only critique is that the firmware updates aren’t also distributed through the Linux Vendor Firmware Service (LVFS). You need to use the configurator to update the firmware.

Bazcor almost drove me nuts after the first use, though. I’d configured everything and sent the setup to the keyboard. I restarted my computer to apply some pending software updates but had trouble logging back in again.

It turned out something had gone wrong and every key on every layer had been moved by one position. The one key became two, the two key became three, and so on. I had to use my old keyboard to unlock my computer and figure out what had gone wrong with the Raise.

I was able to use Bazcor’s configurator to export my layers, fix them, and import them back onto the keyboard. It has only happened once and I don’t understand why it did. Most customers would have returned the keyboard at this point instead of writing a small program to fix the configuration files. Oh, and there’s no reset-to-defaults button in the configurator software.

On one hand, this shows the power and capabilities of a programmable keyboard. On the other hand, … it takes a very special kind of person to enjoy the programming challenge required to correct a problem like this one.

The Raise can be configured for basic mouse click and movement emulation. It also supports macros mixing keyboard and mouse interactions. The macro editor in Bazcor can take some time to get used to, but it’s within expectations given the complex nature of macros.

### Conclusions

The Dygma Raise scores high on durability, repairability, and the quality of the hardware. You can buy replacements for everything likely to wear out from Dygma’s website. Everything feels solid and well-built.

Though, I’m not convinced its unique hardware features are all that good. The high ridge between the lower and upper rows of space keys makes it uncomfortable to use the lower row. The shallow bumps on the positional keys make me want to toss out the default keycap set.

You’re required to poking around a lot to discover how to use it to its fullest. That’s also part of the experience you’ve bought. With great customization-power comes great complexity, and Bazcor does a fine job at preserving the former while reducing the latter. The Bazcor configurator needs a “restore defaults” button and possibly some sort of version control or “undo” functionality, but it’s mostly fine.

The firmware leaves a lot to be desired. The occasional restart isn’t as big of a problem as needing a different keyboard on hand to wake your computer and operate it in lower-level modes. Dygma has released one firmware version where it worked properly, so there’s still hope that future versions will get this right.

The hardware product is surprisingly polished despite being developed by a small team. It’s a specialty product for people who can’t meet their keyboard customization needs through software alone. Ultimately, the firmware flaws make it difficult to recommend the Dygma Raise.

**Reviewed:** [Dygma Raise](https://web.archive.org/web/20220615160753/https://dygma.com/products/dygma-raise)

**Review rating:** 5.5 / 10
### 7 simple bot detection methods that won’t inconvenience users
URL: https://www.ctrl.blog/entry/detect-non-browser-form-submission/
Last updated: 2026-08-23T22:04:57.000Z
Millions of (poorly coded) bots relentlessly crawl the web to detect and spew junk content into any form they find. The go-to countermeasure is to force everyone to complete a Completely Automated Public Turing test to tell Computers and Humans Apart (CAPTCHA). CAPTCHAs are those annoying user-hostile tests where you type in skewed letters or identify objects in photos. They require cultural familiarity, introduce accessibility barriers, and waste everyone’s time. Instead of using a CAPTCHA, you can detect and block many bot submissions using completely unobtrusive form validation methods. 

The methods I’ll discuss in this article help identify whether the form was submitted via a standards-compatible modern web browser. They’re mini web standards compliance tests that don’t rely on the user doing anything but using a web browser of their choice. It won’t help (much) with forms submitted via browser automation, and they'll only delay bots written specifically to target your website.

Fortunately, the vast majority of comments are still submitted via scripted simpleton bots. They’re much faster and more economical than puppeteering a real web browser into spewing spam across the web.

This article is for developers; almost everything discussed requires modifying the client-side form and server-side validation. This article assumes some familiarity with HyperText Markup Language (HTML) and HyperText Transfer Protocol (HTTP) request headers. Without further ado, let’s get started.

**Drop support for obsolete HTTP versions.**All modern web browsers use version 3 or 2, with only limited use of HTTP/1.1 as a fallback. You can safely deprecate support for HTTP/0.9 and HTTP/1.0\. HTTP/0.9 was introduced in 1991 and HTTP/1.0 was introduced in 1996\. HTTP/1.1 was released the following year in 1997 with HTTP/2 not appearing until 2015\. Block any form submissions server-side that were sent over these legacy protocols. Many bots are incredibly poorly written and rely on primitive HTTP libraries. This measure is incredibly efficient at blocking the simplest bots. 

**Append a `#hash` to the form’s action URL.** The action URL is the URL where the form submits data. This only requires a small change to your form and relies on weaponizing URL Standard-unaware clients’ [mishandling of URL #hashes](https://www.ctrl.blog/entry/recover-url-fragment-requests/). Bots will literally submit to the wrong URL whereas every browser will know exactly how to handle the situation. 

**Include a hidden prefilled form field.** Bots are lazy and they might be bulk-submitting standard/common field names without bothering with the fields that are in your form. Include any hidden form field and check that it gets submitted to your server. There’s no need to waste resources trying to validate the rest of the form data if the data didn’t even originate from your form.

**Verify the Host and Origin request headers.** Bots frequently mess up or omit these request headers. They’re required with every form submission in modern browsers. They should match your website’s domain and scheme exactly; e.g. enforce the `https://` prefix and exactly match the host and origin of your form’s action URL.

**Set a test cookie and verify it gets included in the submission.** Bots frequently don’t bother with cookies, and the ultra-rare user who’ve disabled them completely are used to and know how to handle a broken web experience. You can use an HTTP response cookie for best compatibility, or a JavaScript cookie if you’re willing to display a “JavaScript required” message on your form.

**Swap the `name` attributes in the name and email fields.** Only bots will fill in these fields incorrectly, just swap the fields in your form and server-side validation. This approach is more effective than trying to obscure the field names because you can easily catch and block the malicious submissions.

To minimize the impact on users, set the appropriate `autocomplete` and `type` attributes for each field. These attributes will aid input on software keyboards and enable auto-complete and other functionality your visitors will expect. It makes it easier for bots to detect the misdirection, but they can already work out the correct order by string-matching your form’s human-readable labels.

**Verify the POST/Redirect/GET (PRG) chain.** PRG is a common pattern where a POST request is immediately redirected to a GET request. It helps prevent duplicate form submissions. All browsers will automatically follow redirects unless the user immediately closes the page or loses internet connectivity. You can include a token in a query parameter within the redirect request and verify that the token is sent back to the server. 

You probably shouldn’t make blocking decisions based on this alone. Expect the occasional false positive, as described above. However, if the token isn’t returned within a couple of seconds, then it’s a strong indicator the submission was performed by a bot.

Those were my seven simple tips for detecting forms submitted by bots and not browsers. Here’s a bonus tip that requires a little more work to implement compared to the other tips.

**Block ancient versions of common browsers.**Bots often mimic the User-Agent of a common browser, but the version numbers used in the bots rarely change. Over time they drift farther and farther behind until a point (maybe two-year-old versions) where you can safely block them without inconveniencing legitimate users. GitHub just [published numbers](https://github.blog/2022-06-10-how-we-think-about-browsers/?ref=ctrl.blog "“How we think about browsers”") that show over 92 % of its visitors use the current browser version or are no more than 5 versions (roughly 20 weeks) behind. 

I strongly discourage you from blocking or discriminating against unknown or uncommon browser User-Agent request headers. The web is weird and we as developers shouldn’t discourage it. However, you can take a sneak peek at it and identify the version number from the most common browsers. Armed with the [knowledge of the most recent versions of popular browsers](https://www.ctrl.blog/entry/latest-browser-versions-api/), you can block significantly outdated browsers.

In case of false positives, you should always display clear error messages to your users when you block their form submissions. Does your form require JavaScript, cookies, and a modern browser? Let them know! You may want to display a CAPTCHA or some secondary test to allow users to resubmit the form.

Do you know of any other unobtrusive bot detection methods? Share your ideas in the [comments](https://comment.ctrl.blog/discussion/detect-non-browser-form-submission?ref=ctrl.blog)!
### The Current Version of Popular Browsers API (powered by Wikidata)
URL: https://www.ctrl.blog/entry/latest-browser-versions-api/
Last updated: 2026-08-23T22:12:57.000Z
What’s the current stable version of Google Chrome, Firefox, and Safari? Your browser automatically checks for and keeps itself up to date. However, sometimes you need to find the latest version numbers for other uses. How do you get the latest version numbers of the most popular web browsers?

You could theoretically parse your server logs and get an approximate idea by observing the greatest of the most common version numbers. However, why bother to analyze and guesstimate data from logs when Wikidata (a sister project to Wikipedia) has the answer?

A quick plea before I proceed: Please don’t discriminate against people’s browser of choice. Don’t restrict access to your site or services based on the visitor’s User-Agent.

Mozilla is the only browser vendor that has an authoritative answer to the headliner question. You can query the current stable and extended support release of Firefox for desktop plus mobile releases through the [Product-Details JSON API](https://wiki.mozilla.org/Release%5FManagement/Product%5Fdetails?ref=ctrl.blog). Neither Apple nor Google offer a similar public API.

Fortunately, you can get the latest version information for all three from Wikidata. Wikidata is a linked data project from the Wikimedia Foundation (Wikipedia’s parent organization). The data is entered into the project by volunteers. These particular data entries don’t appear to use any automated sources or bots.

I analyzed Firefox’s release history and compared it to the Wikidata change history. I found that the wiki is usually never more than a few hours behind on releases. Past performance is not an indication of future performance (nor data reliance or stability). As the data source is a collaborative wiki, you can update it yourself if you spot a mistake or omission.

You can download data from Wikidata in any common linked metadata formats such as the Resource Description Framework (RDF). However, you don’t need to parse and extract the useful bits of data from the individual Firefox, Google Chrome, and Safari data entries on Wikidata.

Instead, you can use [this SPARQL query](https://query.wikidata.org/?ref=ctrl.blog#%23%20SPDX-License-Identifier%3A%20CC0-1.0%0A%0ASELECT%20%3FbrowserLabel%20%28max%28%3Fversion%29%20as%20%3FversionLabel%29%20%3FtypeLabel%0AWHERE%0A%7B%0A%20%20%3Fbrowser%20wdt%3AP31%20wd%3AQ6368%20%3B%20%20%20%20%20%23%20instance%20of%20web%20browser%0A%20%20%20%20%20%20%20%20%20%20%20p%3AP348%20%3Frelease%20.%20%20%20%20%20%20%23%20with%20a%20software%20version%20identifier%0A%20%20%3Frelease%20ps%3AP348%20%3Fversion%20%3B%20%20%20%20%20%23%20software%20version%20identifier%0A%20%20%20%20%20%20%20%20%20%20%20pq%3AP548%20%3Ftype%20%3B%20%20%20%20%20%20%20%20%23%20with%20a%20version%20type%0A%20%20%20%20%20%20%20%20%20%20%20wikibase%3Arank%20%3Franks%20.%20%23%20with%20a%20rank%0A%0A%20%20VALUES%20%3Fbrowser%20%7B%20wd%3AQ698%20wd%3AQ777%20wd%3AQ35773%20%7D%20%20%23%20Firefox%2C%20Chrome%2C%20and%20Safari%0A%20%20VALUES%20%3Ftype%20%7B%20wd%3AQ2804309%20wd%3AQ104243413%20%7D%20%20%20%20%20%23%20stable%20release%2C%20extended%20support%20release%0A%20%20VALUES%20%3Franks%20%7B%20wikibase%3APreferredRank%20%7D%20%20%20%20%20%20%20%23%20the%20PreferredRank%20is%20the%20current%20release%0A%20%20%0A%20%20SERVICE%20wikibase%3Alabel%20%7B%20bd%3AserviceParam%20wikibase%3Alanguage%20%22%5BAUTO%5FLANGUAGE%5D%2Cen%22%20%7D%0A%7D%0AGROUP%20BY%20%3FbrowserLabel%20%3FtypeLabel%0AORDER%20BY%20%3FbrowserLabel%20%3FtypeLabel) to round up the desired data in one API call. The link opens in the interactive Wikidata Query Service editor. Press the Run button to test the query and see its current output. Press the Link button to get a link to the SPARQL API endpoint for use in your application. You can hover predicates in the editor to look up their meaning. 

The SPARQL Protocol and RDF Query Language (SPARQL, a recursive acronym) may be unfamiliar to you, but the response is a structured Extensible Markup Language (XML) document. It should be much easier to parse than the SPARQL query called to generate it! 

You should absolutely log errors and trigger alerts if the API output changes (e.g. any missing/renamed fields). You probably shouldn’t rely on this API for anything business-critical (at least not without configuring logging and alerts).

Instead, you might want to consider using the [Browser Versions API](https://developers.whatismybrowser.com/api/features/web-browser-version-numbers?ref=ctrl.blog) from Long Way Research. (At least, you’ll have someone to yell at if it stops working or the data is outdated!)

Data from Wikidata is available under a permissive Creative Commons Zero license (a Public Domain deed). You don’t need to (but should) attribute the source. The API is free to use for any purpose, but make sure to cache responses and don’t be a hog. You should [donate monthly to the Wikimedia Foundation](https://donate.wikimedia.org/?ref=ctrl.blog) if the service creates value for your product or service.
### 5 options for auto-mounting network shares on MacOS
URL: https://www.ctrl.blog/entry/automount-netshare-macos/
Last updated: 2026-08-23T22:02:02.000Z
It can be annoying to have to constantly remount network drives and network shares. Some apps can fail to launch if they depend on files stored on an unmounted network share. Here are five different options for auto-mounting network share on MacOS.

MacOS supports a lot of different network share protocols: SMB, NFS, and WebDAV; plus the legacy AFP and FTP (read-only) protocols. All the options discussed in this article will be front ends built on top of what’s already built into MacOS. 

I’ll list the different options in order of feature completeness and ease of use. What the best option is will depend on your needs and price sensitivity (most options are free).

The first and sleekest option is the [AutoMounter](https://automounter.app/?ref=ctrl.blog) app. It’s by far the most polished option, but it costs 10 USD on the Mac App Store. There is no free trial version available.

AutoMounter will attempt to mount all configured network shares when you log in to your Mac, wake it from sleep, or if the network conditions changes. It won’t attempt to reconnect shares if they disappear, and it has no options for retrying failed connections.

It can, however, attempt to power on devices that are kept in power-saving states using Wake-on-LAN (WoL). It’s also vaguely aware of your network condition and can be configured to only attempt to mount certain shares when connected to a named Wi-Fi network or when a Virtual Private Network (VPN) connection is available. 

You can pay an additional 4 USD for “pro” features. These aren’t all too interesting, except for the option to customize the mount point. This feature lets you mount network shares anywhere on the filesystem and not just in the `/Volumes` directory.

If you’re looking to a free alternative to AutoMounter, then [ConnectMeNow](https://www.tweaking4all.com/os-tips-and-tricks/macosx-tips-and-tricks/connectmenow-v3/?ref=ctrl.blog) is your best bet. It’s donationware with similar capabilities to AutoMounter. Donationware means it’s free to download and use, but you’re strongly encouraged to donate any amount to the developer. 

ConnectMeNow also supports WoL, and can optionally be configured to periodically attempt to reconnect unavailable connections. The app actively tries to discover if network shares are available on the current network by pinging the configured addresses.

Both AutoMounter and ConnectMeNow can leak information about your configured network shares on untrusted networks. As mentioned, AutoMounter can be made somewhat network aware based on Wi-Fi names (SSIDs). 

Ideally, the apps should be network-aware and only attempt to connect on networks it recognizes and where it expects to find the configured shares. This should stop the data leaks and reduce the risks of you accidentally exposing your network share passwords. I left [a comment for the developer](https://www.tweaking4all.com/software/macosx-software/connectmenow-v3/?ref=ctrl.blog#comment-571577) of ConnetMeNow discussing this in more detail. 

This is an inherent risk with any system that attempts to auto-mount a network share on an untrusted network. This is likely why this use case isn’t supported natively by MacOS. The two apps I’ve mentioned until now can be configured to at least attempt to not log in on untrusted networks. The remaining options do *not* and should be avoided (at least on laptops).

The third and probably simplest option to set up is to use a Login item. Start by mounting your network share as usual. Open the System Preferences app and go to Users & Groups: Login Items. Click the Plus button, select your network share, and press the Add button. 

It won’t reconnect if your MacBook sleeps or you or the network share loses connectivity. This will also open a Finder window every time you power on your Mac. To avoid this last issue, you can use the following option instead:

The fourth option is to automate the mounting with AppleScript. You can find a complete [tutorial over at United PC](https://web.archive.org/web/20160623033204/https://www.united-pc.com/os-x-automatic-volume-mount/). It essentially boils down to pasting and customizing a small script into the built-in AppleScript Editor app, saving it as an app, and adding that new app to your login items.

The fifth and last option is the `autofs` subsystem. This is only suitable for advanced users. The `autofs` subsystem reverts all configuration changes after system upgrades. Back up your configuration! I’ll not instruct you on how to set this up. Instead, type man 5 auto\_master in the Terminal app and review the program’s manual page. 

At the close, I’d just like to mention the [Mountain Duck](https://mountainduck.io/?ref=ctrl.blog) app. It does what’s discussed in this app but for cloud storage drives such as Dropbox, Google Drive, and Microsoft OneDrive. It doesn’t work for any of the protocols discussed in this article, however.
### How to stop a robot vacuum from getting stuck on the laundry rack
URL: https://www.ctrl.blog/entry/robot-vacuum-drying-rack/
Last updated: 2026-08-23T22:20:39.000Z
My robotic vacuum loves to ram itself onto and get stuck on my laundry drying rack. It has been doing it for years, and I haven’t had a good solution to the problem. Until now.

I’ve kept the Roomba out by putting boxes and other obstacles underneath the laundry rack. The robot is surprisingly strong and often manages to push them out of the way.

I’ve also attempted disastrous solutions involving lots of duck tape wrapped along the length of the bottom tubing. I essentially tried to form an admittedly soft physical barrier with the tape. It looked hideous and didn’t even work all that well.

Last week, I stumbled upon a much better solution. While looking for something completely unrelated, I found the 3D-printing recipe for a freely licensed [laundry rack raiser](https://www.printables.com/model/151700-laundry-rack-raiser-for-vacuum-robot-minimal-16mm-?ref=ctrl.blog). It’s just a set of feet you can camp on to the bottom tubing on a laundry rack.

It’s an ingenious solution. The laundry rack just needs to be lifted up from the floor enough for the bottom tubing to form a barrier tall enough to trigger the robot’s collision sensor.

I don’t own a 3D printer and the first available slot at the community 3D printer was in eight weeks. However, I didn’t need this precise plastic gadget to solve my problem.

I explored different other options for feet and adhesives. The best and simplest solution that got the job done turned out to be twine. I just spun a twine ball around the existing tiny plastic feet to pad the height about 20 mm. This raises it enough to trigger the collision sensor.

*Success!* The solution is completely obvious in hindsight but yet it managed to avoid me for the 13 years I’ve owned a robotic vacuum cleaner.
### Split key­boards give your hands a break but reduce typing flex­ibility
URL: https://www.ctrl.blog/entry/split-keyboard-accessibility/
Last updated: 2026-08-23T22:22:23.000Z
**Sponsored:** Dygma Labs provided its Raise keyboard for free. It had no editorial control of this article.

Split keyboards can offer greater flexibility and variety for your working posture and desktop arrangements. I’m talking about both wave keyboards that bend upward in the middle (typically branded as “ergonomic keyboards”) and keyboards that can literally split in two. However, you better agree with its designers on how to best use a keyboard.

Dygma Labs sent me one of its Dygma Raise split mechanical keyboards ([full review](https://www.ctrl.blog/entry/review-dygma-raise-split-keyboard/)). It’s a 64 % keyboard that can optionally be split down the middle, creating two single-hand keyboard surfaces. A 64 % keyboard is a variation on the more standard 60 % keyboard (no function keys, navigation keys, or a numpad) featuring some non-standard extra keys. The Raise has split the space bar into four keys and has also included four extra “thumb buttons” below those keys. You can position the two halves as you want to suit your needs. 

As discussed in [my keyboard sizing guide](https://www.ctrl.blog/entry/keyboard-form-factor-guide/), a wider keyboard setup is best suited for people with broad shoulders. It may be more comfortable to split the keyboard to increase the distance resting position distance between your arms. However, the same wider setup may be uncomfortable for someone with narrow shoulders. People are different and so should our keyboards be.

Split keyboards might also be a suitable alternative for gamers — regardless of their body type — who might not need the right half of their keyboards. Many games are optimized for the right-hand holding the mouse and the left hand resting on the WASD keys. The WASD keys are used as arrow keys to move either the camera or a character around. They’re preferable to the actual arrow keys as they have more keys that can be used as hotkeys in the immediate vicinity. Few games bind common actions to keys on the right side of the keyboard. Getting rid of the left half of the keyboard leaves more room for better postures and for working with the mouse. 

Split keyboards, including the Dygma Raise, are often marketed as explicitly being more ergonomic than your typical keyboards. That might be the case for some people. However, there’s a big limitation with these keyboards; and that’s the big old question: “where’s the middle of the keyboard?”

Keyboards are always split along the hand-separation rules commonly used with the touch-typing (“blind typing”) method. When typing with the touch-typing method, you’re not supposed to move your hands off their resting position. From each hand’s resting position, each finger can reach a couple of keys with a minimal amount of movement.

Split keyboards enforce the rules of the touch-typing method by design. There’s some leeway to make adaptations within each hand’s key responsibilities, but you’re out of luck if those adaptations cross the split keyboard divide.

Your left index finger should handle the B key and the right index finger should handle the Y key. However, which finger handles which key is an arbitrary decision. You may have been taught a different style or just prefer it the other way around.

I’ve got reduced mobility in my right index finger and compensate for it by using my left index finger to press both the B and Y keys. I ripped open my finger on a rusty nail while tossing planks into a lake. Childhood activities can be dangerous, kids! The scar looks amazing, but I can’t fully extend my finger during the chilly winter months. It’s never a problem when I use a regular keyboard, so I never think of it as a disability. 

Stiffness and reduced finger mobility can also be caused by any number of conditions. People who suffer from finger arthritis are fortunate if it only affects one finger.

The design of split keyboards imposes an accessibility barrier that isn’t there with regular keyboards. The touch-typing method is meant as a best practice for reducing hand strain and not as a hard requirement. Split keyboards assume you’re using the touch-typing method and have a set of fully functional fingers on both hands.

For something to be truly ergonomic, it needs to be adjustable and adaptable to fit different people and needs. Split keyboards could be made more accessible in one of two ways:

They could duplicate the B and Y keys on both halves. This is impractical on something like the Dygma Raise that can be put together to form a regular keyboard. However, it’s a solid option for permanently split or wavy keyboards.

Alternatively, the B and Y keys could be made detachable and movable between the two sides. This design would clearly be more expensive, but it would also make split keyboards usable by more people.

Before you purchase a split keyboard; you should be conscious about how you type, and which fingers perform different tasks around the keyboard.
### Improve legibility and reduce layout shifts with x-height adjustments
URL: https://www.ctrl.blog/entry/font-size-adjust/
Last updated: 2026-08-23T22:07:28.000Z
There’s more to setting the text size on your webpages than just the CSS `font-size` property. It only controls the size of majuscule (“uppercase”, e.g. “A”) letters, numbers, and punctuation. The size of minuscule (“lowercase”, e.g. “a”) letters is left up to the font. A font’s minuscule size metric is referred to as x-height; the height of an “x” letter. However, you can control the size of the two independently — and here’s why you might want to do that. 

The `font-size-adjust` property compliments the `font-size` property by letting you override the font’s x-height. Its value is a multiplier applied to latter to the `font-size`. For example, the CSS snippet `font-size: 16px; font-size-adjust: 0.5;` sets the x-height to 8 px.

Unfortunately, `font-size-adjust` is only supported in Firefox. It has been supported by this browser for over a decade already. It was implemented in Chrome for almost half a decade, but it has been left to rot behind the Experimental Web Platform features flag. It’s not implemented in Safari. 

There’s another way that’s supported cross-browsers that lets you achieve even better results. However, I first need to explain the two main use cases for *why* you might want to adjust a font’s x-height.

The first use case is to increase legibility with your preferred font. A taller x-height (to a point) can increase reading speed, lower error-rates, and benefit readers with reduced vision. Tall x-heights leaves more room for each letter; which is especially beneficial for common double-story letters like the minuscule “a” and “e” that can otherwise appear cramped. Special-purpose fonts optimized for dyslexic readers feature a taller-than-normal x-height. However, [a notable study](https://www.ncbi.nlm.nih.gov/pmc/articles/PMC5934461/?ref=ctrl.blog) concluded that these fonts are no better than traditional fonts when accounting for the different x-heights. 

Common fonts, such as the pre-installed fonts on most operating systems (“system fonts”), typically feature a low x-height. Depending on your stylistic font preferences, you might just want to bump up the x-height to improve the reading experience.

There’s now a medium-sized confused-looking elephant in the room, though. Why can’t you simply set a bigger `font-size` if you want the text to be bigger and more readable? The most commonly used fonts today, the typical system fonts based on their broad availability, are based on digitalization efforts of decades-old font designs.

Today, there’s simply a different design and reading preference when it comes to the size-relation between majuscule and minuscule letters. More recent font faces — such as Google’s Roboto, designed for a varying quality of mobile-display technologies — feature a tall x-height.

The other use case is to better match a fallback font, such as a system font, to your preferred font, such as a web font. It can also be useful to normalize the reading experience across a system font stack based on a selection of metrically diverse fonts. It’s particularly useful when mixing letters from more than one font, such as a text font and a symbols font.

This use case might even apply if you only rely on system fonts. For example, the sans-serif fonts Helvetica and Arial look roughly 10 % larger than serif Times and Times New Roman at the same `font-size`.

To meet the requirements of these use cases, you need to individually adjust the sizes of each font face. Enter the `@font-face { size-adjust }` property. It lets you override a given font face’s x-height by a given percentage value. Using a variable font? Check its documentation if it supports adjusting the x-height through `@font-face { font-variation-settings }` parameter. The `size-adjust` parameter might be ignored if it conflicts with the font’s internal settings. For example, `size-adjust: 105%` to increase the minuscule size by 5 %. 

Both Firefox and Chrome added support for this property at the end of 2021\. There’s no support in Safari yet. However, this is still the best cross-browser method.

Okay, back on track. Here’s a quick example using [the perfect cross-platform sans-serif font stack](https://www.ctrl.blog/entry/font-stack-text/) (a cross-platform set of metrically compatible fonts) where I’ve increased the minuscule size by 5 %. Roboto, the only font available on Android, was designed with a taller x-height than the others. So, it needs to be tuned separately to match the other fonts.

```css
@font-face {
  font-family: "helveticas-adjusted";
  src: local("Helvetica Neue"),
       local("Arial Nova"),
       local("Liberation Sans"),
       local("Helvetica"),
       local("Arial");
  size-adjust: 105.2%;
}

@font-face {
  font-family: "roboto-adjusted";
  src: local("Roboto");
  size-adjust: 104.4%;
}

body {
  font-family: "helveticas-adjusted",
               "roboto-adjusted",
               sans-serif;
}
```

The example shows that this is quite a bit more complex than the simpler single `font-size-adjust` parameter. However, it lets you optimize individual fonts for optical sizes rather than being constrained to a single absolute size for all fonts.

You can extrapolate from this example into more complex font stacks. Here’s an alternative featuring an ordered list of my favorite serif system fonts from Windows, MacOS, and Linux. Their sizes vary considerably, but the `size-adjust` parameter normalizes their x-heights to be the same as the above sans-serif font stack.

```css
@font-face {
  font-family: "constantia-adjusted";
  src: local("Constantia");
  size-adjust: 117.6%;
}

@font-face {
  font-family: "hoefler-text-adjusted";
  src: local("Hoefler Text");
  size-adjust: 121.6%;
}

@font-face {
  font-family: "charter-adjusted";
  src: local("Charis SIL"),
       local("Charter Roman");
  size-adjust: 112%;
}

@font-face {
  font-family: "times-adjusted";
  src: local("Liberation Serif"),
       local("Tinos"),
       local("Times"),
       local("Times New Roman");
  size-adjust: 115.4%;
}

@font-face {
  font-family: "palatino-adjusted";
  src: local("Domitian-Roman"),
       local("P052-Roman"),
       local("Palatino"),
       local("Palatino Linotype");
  size-adjust: 116%;
}

p {
  font-family: "constantia-adjusted",
               "hoefler-text-adjusted",
               "charter-adjusted",
               "palatino-adjusted",
               "times-adjusted",
               serif;
}
```

At first glance, this appears like quite a lot of style sheet bytes. It’s almost 1 kB uncompressed and 0,3 kB compressed by itself. You can expect the compressed size to shrink considerably when included as part of a larger style sheet. At any rate, it’s a tiny amount of data to fix up and normalize some system fonts compared to downloading a webfont file. Webfonts in 2022-Q1 had a median file size of 141 kB, according to the HTTP Archive. 

Okay, so I’ve glossed over one subject so far: how do you figure out the number value for the `size-adjust` property for different fonts? Start by selecting your fonts and arranging your font stack. Once you’ve nailed it down, you can start measuring your fonts.

Adjust your primary font’s x-height until you get the size you want. In this article, I’ve argued for increasing x-heights to improve readability. But it’s your show: maybe you’re happy with your font’s default.

Create a test page with a minuscule “x” letter in three different sizes. Use your normal body text size, your headline size, and one extra-large size. Do the same for the font you want to size-match and overlay it on top of your reference size. It’ll be easier to compare the two if you assign the sets distinct colors.

Adjust the `size-adjust` property until the two match each other’s height (sans any serifs/ornamentation). It takes a bit of trial and error, but it shouldn’t take much time. It’s super-quick to repeat the process with different fonts after you’ve done it once.

You can find specialized tools to automate the job, but I wasn’t happy with the results and preferred doing it by hand. Automated tools may pick a mathematically optimal size adjustment, but it will fail to account for any perceived optical size differences between two fonts.

Once you’re done, you should double-check your design to make sure you’ve set aside sufficient line heights! The character boxes for your font’s minuscule characters will be stretched to accommodate their adjusted size. The new character box sizes will be the point size (`font-size`) multiplied by the `adjust-size`, e.g. 16 px \* 106.25 % = 17 px. Your `line-height` must be at least that tall plus leave enough room for comfortable reading. 

This technique can significantly reduce layout shift and other eyesores when a fallback font is displayed initially and then later swapped out for a webfont (`font-display: swap` or `font-display: fallback`).

Okay, so what about Safari? Your only two options are to either set a larger `font-size` or to pick a font with a tall internal x-height. The open-source *Merriweather* font by Sorkin Type delivered as a webfont is one such alternative. However, you’re back to square one when it comes to its fallback font.

You may also want to avoid using MacOS and iOS system fonts with short x-heights, such as Hoefler Text. Users on iOS are forced to use Safari and users on MacOS are likely to use Safari until [WebKit bug #229726](https://bugs.webkit.org/show%5Fbug.cgi?id=229726&ref=ctrl.blog) is resolved. This isn’t a critique of that font design, but it’s unsuitable as its x-height requires significantly more upscaling than other fonts.

The issue with Safari highlights the importance of the `size-adjust` technique discussed in this article. It lets *you* decide what font you want to use, and adopt it to your needs; rather than the other way around.

#### Sources

- [font-size-adjust](https://developer.mozilla.org/en-US/docs/Web/CSS/font-size-adjust?ref=ctrl.blog), 2022-04-05, CSS, Web Docs, Developer Network, Mozilla
- [Report: Page Weight](https://httparchive.org/reports/page-weight?start=2022%5F01%5F01&end=latest&view=list&ref=ctrl.blog#bytesFont), 2022-04-04, HTTP Archive
- [CSS Fonts Module Level 5](https://www.w3.org/TR/2021/WD-css-fonts-5-20211221/?ref=ctrl.blog), 2021-12-21, Working Draft, World Wide Web Consortium (W3C)
- [Bug #229726: Implement font-face override descriptors](https://bugs.webkit.org/show%5Fbug.cgi?id=229726&ref=ctrl.blog), 2021-08-31, Myles C. Maxfield, Issue tracker, WebKit, Apple
- [Dyslexie font does not benefit reading in children with or without dyslexia](https://www.ncbi.nlm.nih.gov/pmc/articles/PMC5934461/?ref=ctrl.blog), 2017-12-04, Sanne M. Kuster; Marjolijn van Weerdenburg; Marjolein Gompel; and Anna M. T. Bosman, PubMed Central, US National Library of Medicine
- [Bug #15257: \[CSS3 Fonts\] Support font-size-adjust](https://bugs.webkit.org/show%5Fbug.cgi?id=15257&ref=ctrl.blog), 2016-01-21, Issue tracker, WebKit, Apple
### Syncthing: The data dedup­lica­tion master
URL: https://www.ctrl.blog/entry/syncthing-deduplication-master/
Last updated: 2026-08-23T22:22:53.000Z
[Syncthing](https://syncthing.net/?ref=ctrl.blog) is an open-source encrypted peer-to-peer folder synchronization program. It uses deduplication techniques to reduce the amount of data it needs to transfer over the network; saving you bandwidth costs, energy, and time. You can now optionally also let it deduplicate data storage to reduce your storage costs.

You can think of Syncthing as cloud storage service like Dropbox or OneDrive but without any intermediary servers or costs. Your files are transferred directly among your devices. It lets you safely synchronize folders without having to trust a cloud storage provider with your data.

Syncthing chunks large files into blocks, similar to how a file system works. It compares which blocks have changed and will only send changed blocks over the network. The blocks can be reused between files and even between different synced folders. This saves transfer time, network bandwidth, and energy.

Syncthing collects usage data from its users. Among the collected data, it records how much data transfer is reduced because of this feature. As of the time of publishing, 56,48 % of synced data was reused from local files. The potential savings of Syncthing’s storage deduplication feature can be assumed to be near this figure. 

The storage deduplication feature re-purposes this bandwidth-saving feature to save local disk space. The same mechanism is used to reuse identical on-disk blocks between files.

The feature can significantly reduce the disk space consumed by Syncthing’s file version system. File versionings preserves copies of modified files. This is likely why the deduplication rate in Syncthing’s network is so high. Depending on your usage and files, you may only make slight changes to your files. Syncthing might only need to store two different blocks of changed data instead of storing the entire file twice. This approach can be incredibly efficient with virtual machine disk files, log files and archive files where you append data on the end, and other append-only data structures. 

The feature is supported on [most file systems that support cloning](https://www.ctrl.blog/entry/file-cloning/); including Btrfs, XFS, and EXT4 on Linux and Solaris, and ReFS on Windows. NTFS is the default file system on Windows. ReFS is only available in Windows Workstation and Server editions. 

Neither the OpenZFS nor ZFS file systems are supported as they don’t expose any appropriate system calls (syscall). MacOS’ APFS isn’t supported either despite its `clonefile` syscall. This syscall can only clone whole files, unlike the block-level cloning available on Linux and Solaris. 

The feature has the same limitations as normal file cloning. Clones must be created on the same disk/partition and cannot cross file system/partition boundaries. This limitation can lead to syncing errors as Syncthing can reuse blocks across synced folders and isn’t aware of file system boundaries.

Storage deduplication isn’t enabled by default, as of Syncthing version 1.19.1\. You can enable it per folder or set it as the default behavior from the Advanced settings dialog. Look for the Copy Range Method option and set it to a [supported value](https://docs.syncthing.net/advanced/folder-copyrangemethod.html?ref=ctrl.blog). 

I recommend explicitly setting the option to `ioctl` (uses the `FICLONERANGE` syscall) on Linux as the `copy_file_range` option/syscall has caused me reduced system stability. The special `all` option first tries `ioctl`, then other methods, before eventually falling back to a regular copy. This option can reduce syncing errors (see the previous paragraph) but may cause system instability by calling `copy_file_range`.

The deduplication feature was added in Syncthing version 1.8.0 (July 2020) and is still considered experimental. It’ll probably remain that way for some time, as there’s a chance the functionality might introduce a bug that results in dataloss. 

#### Sources

- [Data transfers totals to date](https://web.archive.org/web/20220505155823/https://data.syncthing.net/#totals-to-date), 2022-05-05, Usage Data, Syncthing, Wayback Machine (date snapshot), Internet Archive
- [\[copyRangeMethod\] invalid cross-device link](https://github.com/syncthing/syncthing/issues/8271?ref=ctrl.blog), issue #8271, 2022-04-12, Syncthing project, GitHub
- [Understanding Synchronization](https://docs.syncthing.net/users/syncing.html?ref=ctrl.blog), 2021-07-31, Documentation, Syncthing
- [copyRangeMethod](https://docs.syncthing.net/advanced/folder-copyrangemethod.html?ref=ctrl.blog), 2020-08-08, Advanced, Documentation, Syncthing
- [New copy-on-write stuff should support Darwin clonefile](https://github.com/syncthing/syncthing/issues/6755?ref=ctrl.blog), issue #6755, 2020-06-18, Syncthing project, GitHub
### The auto-save feature in GEdit vs the new GNOME Text Editor
URL: https://www.ctrl.blog/entry/gnome-text-editor-auto-save/
Last updated: 2026-08-23T22:08:32.000Z
I recently compared [GEedit’s auto-save to Kate’s swap-save feature](https://www.ctrl.blog/entry/kate-swp/). Both features try to achieve the same goal — to protect your unsaved work from power failures and crashes — but through different means.

The new GNOME 42 release replaces GEdit with [GNOME Text Editor](https://apps.gnome.org/app/org.gnome.TextEditor/?ref=ctrl.blog) (GTE) as the recommended default text editor. GTEd also has a feature like Kate’s swap-save, so I thought I’d revisit the topic.

GEdit has a feature to periodically auto-save your documents (off by default). The option does what it says on the tin: it automatically overwrites your saved document every couple of minutes. You can undo and restore earlier versions until you quit GEdit.

This approach is potentially destructive and can cause you to irrecoverably lose data. It’s a poor implementation mimicking Apple’s TextEdit app on Mac. TextEdit auto-saves your changes, yes, but it also keeps older versions of your documents. You can restore earlier versions of your documents in case you’ve overwritten something you didn’t intend to.

GEdit doesn’t have this, it just overwrites your documents — no questions asked. You can pair it with an external version-tracker tool, but the app doesn’t offer anything.

The new GTEd has a feature that more closely resembles Kate’s swap-recovery system. To recap, Kate store’s a “swap copy” of the unsaved working copy of your files next to the primary copy on your file system. The swap copy is deleted when you save your file, or when you exit Kate and confirm that you want to discard the unsaved changes. If Kate or the system crashes, Kate detects the swap copy and offers you to restore it.

GTEd’s auto-saving feature works more similarly to Kate than GEdit. Kate doesn’t save unsaved files; it only keeps swap copies for changes to files that have been saved at least once. GTEd saves every change in a swap copy, even for unsaved/draft files.

Unlike Kate, it’s stored in the program’s data directory instead of in the same directory as the saved file. GTEd’s approach keeps your directories clean of the hidden “dotfiles” that contain the swap copies. Some may prefer Kate’s approach as it works better with files stored on network shares.

Crucially, when GTEd detects unsaved work, it asks you if want to discard or restore it. However, you may be unclear about what you’re about to restore and what you’ll discard. Kate offers you to compare the two versions (the swap/working copy and the on-disk saved file). GTEd assumes you’re intimately familiar with the two versions; even though you’re not being shown either and have no information to make an informed decision on which to preserve.

Kate doesn’t handle this perfectly either. It differs from an external tool, such as KDIff, to make the comparisons. It should display it internally, so it would be clearer which version is which.

The auto-saving feature is enabled by default in GNOME Text Editor version 41 and newer. You can disable it from the Settings dialog: Behavior: Restore Session. Sort of. 

You actually only disable the user interface prompts. Your unsaved documents are still saved to the program’s data directory. You’re not even prompted to restore them even if the app crashed. Since you’re never prompted to decide to discard the drafts, they just keep piling up in the data directory.

GTEd’s auto-save feature has many more bugs. E.g., you can open the same file in multiple windows and make conflicting changes; which makes it random which changes are preserved and which get discarded. Restoring a session with multiple windows with the same file will put you in a state where you can’t close the windows.

Frustratingly, discarded/deleted files and changes may reappear in your next session even if you selected to discard them in the previous session. This isn’t just frustrating but could potentially expose data you wish was never saved to disk. This is kind of out of your control anyway, as you can’t fully disable the behavior.

GNOME Text Editor version 42 reviewed. The projects mentioned here are logged in the project’s bug tracker.
### Common mistakes in BIMI early-adopter implementations
URL: https://www.ctrl.blog/entry/bimi-adoption/
Last updated: 2026-08-23T22:02:10.000Z
Two weeks ago, [I wrote about the new Brand Indicators for Message Identification](https://www.ctrl.blog/entry/bimi-intro/) (BIMI) *draft* internet standard. BIMI enables businesses to get their logos displayed next to their email messages in compatible email apps and webapps. As part of the research for that article, I queried the top 3 million domains to see how many had adopted the standard. I found 6647 domains with a default brand indicator, but far from all meet the BIMI requirements.

I only tested pay-level domains (e.g. `example.com`) and not subdomains. I only evaluated the default domain-level brand indicator (e.g. `default._bimi.example.com`. Domains may use other brand indicators, e.g. the [Ctrl blog newsletter](https://www.ctrl.blog/follow.html) uses `newsletter._bimi.ctrl.blog`. However, I can’t guess what the indicators might be without examining an outgoing email message from the domain. Domains like Ctrl blog without a default BIMI won’t be included in these results.

I queried the domain name system (DNS) for the default BIMI records for the top 3 million domains. I evaluated the responses, and fetched the BIMI image for domains with a valid BIMI record. I also evaluated other email policy DNS records used by BIMI; including Domain-based Message Authentication, Reporting, and Conformance (DMARC) and Sender Policy Framework (SPF). The DomainKeys Identified Mail (DKIM) records were not evaluated because this would require me to examine an email message sent from the domain.

Okay, on to the results! As mentioned, I found 6647 BIMI-like DNS records. This means any DNS text (TXT) record that contained the magic eyecatcher string `v=BIMI1`. The presence of that string was assumed to be an intention of wanting to publish a BIMI. 

198 domains contained the magic string but didn’t match the required syntax. Almost all syntax errors contained the full line from the DNS zone file as the value in the TXT record. 6 contained a serialized JSON version of the expected DNS record.

BIMI has a few specific requirements for the image file indicated by the BIMI record. The image files must be square SVG version 1.2 image with the SVG Tiny Portable/Secure (Tiny-PS) profile. The image should work with a square and circle mask applied.

2156 domains linked to SVG images that didn’t use the Tiny PS profile. This was the most common problem with all the published BIMI records. 2002 of the images could have met the requirements of the Tiny-PS profile as-is with the addition of the required metadata.

1074 of the SVG images weren’t square. The median proportion of these images was 4:1\. Anecdotally, most of the square images contained a rectangle with a lot of vertical padding. 1404 images would cut off pixels other than the background color when applying a circle mask. (I’m not 100 % confident about my test methodology on this last metric.)

702 images were irretrievable with a web browser-like `User-Agent`. HTTP 404 Not Found was the most common error, followed by Cloudflare protection pages. An additional 5 images were irretrievable with a mail-agent like `User-Agent`.

73 domains linked to PNG and 2 to JPEG bitmap image files instead of SVG vectors as required by BIMI. 479 image files contained bitmaps within the SVG container.

17 domains served their images over the HyperText Transfer Protocol (HTTP) instead of Secure HTTP (HTTPS) as required by BIMI. 1 domain served the image over the legacy File Transfer Protocol (FTP). FTP support was removed from web browsers in 2020\. 

42 domains contained explicit opt-outs. A BIMI opt-out is a valid BIMI record that contains an image address that points to an empty string. Publishing an explicit opt-out is essentially pointless, but it might enable clients to make better and longer-lasting caching decisions.

1343 domains had not published a DMARC policy. 308 domains had a too weak DMARC policy. All but 1 domain with a DMARC policy that contained a provision about SPF had published an SPF policy. 2708 domains contained a weak SPF policy (didn’t end with `-all`).

As mentioned in [my earlier article about BIMI](https://www.ctrl.blog/entry/bimi-intro/), Google Mail (GMail) requires that BIMI records also publish a Verified Mark Certificates (VMC). A VMC is a certificate file that is cryptographically signed by a Certificate Authority (CA). The CA verifies that the BIMI image is a logo that is a registered trademark belonging to the domain owner.

988 domains included a VMC parameter in their BIMI records. 568 linked to a certificate file as required by BIMI. I did not evaluate the validity of these certificates. 420 domains contained a VMC parameter with “self” as the value, presumably a left-over from an earlier draft of the BIMI standard.

Only 2324 domains (34,9 %) met all the requirements (excluding VMC). Apps and services consuming BIMI records can make their own decisions about which requirements to enforce. As mentioned, only GMail requires VMCs. Given these results, it would make sense to lift the SVG Tiny-PS profile requirement and apply a server-side conversion process.

Curious about your domain? You can check conformance and preview your image within the context of an email inbox (with a square and round mask) using the [BIMI Inspector](https://bimigroup.org/bimi-generator/?ref=ctrl.blog). The same tool can be used to generate a BIMI record.

#### Sources

- DNS survey performed on 2022-04-18.
- [Tranco list ID W9VK9](https://tranco-list.eu/list/W9VK9/full?ref=ctrl.blog), 2022-04-18, Tranco
- [General Guidance for Implementing Branded Indicators for Message Identification (BIMI)](https://datatracker.ietf.org/doc/html/draft-brotman-ietf-bimi-guidance-05?ref=ctrl.blog), Draft #5, 2022-04-11, Network Working Group, Internet Engineering Task Force
- [Brand Indicators for Message Identification (BIMI)](https://datatracker.ietf.org/doc/html/draft-blank-ietf-bimi-02?ref=ctrl.blog), Draft #2, 2021-03-08, Network Working Group, Internet Engineering Task Force
### Ruby 3.1’s incompatible changes to its YAML module (Psych 4)
URL: https://www.ctrl.blog/entry/ruby-psych4/
Last updated: 2026-08-23T22:21:29.000Z
The Ruby programming language released version 3.1 back in December 2021. Among the changes was a big update to Psych version 4.0, Ruby’s built-in YAML Ain’t a Markup Language (YAML, a recursive acronym) interpreter. A major version change indicates incompatible changes, and version 4 sure does deliver on that promise. 

It broke everything from modules in the Ruby standard library and major frameworks like Ruby on Rails, to [Nanoc](https://nanoc.app/?ref=ctrl.blog): the static-site generator powering this blog. Let’s dive in and explore the changes!

For over a decade, Psych’s `load()` and `load_file()` method have (in practice) been aliases for the `unsafe_load()` and `unsafe_load_file()` methods. In version 4, these methods have changed to their `safe_` prefixed equivalents by default.

A safe load is better than an unsafe one, right? Yeah, it’s probably a good call to change the default. However, it has also broken a large number of Ruby packages.

Developers use the `load()` and `load_file()` method because they intuit its name and it works. (Intuitive method names are one of the Ruby language’s core strengths.) If developers had been aware of the `safe_load()` and `safe_load_file()` methods, they’d probably use them instead.

So, what’s the difference between the safe and unsafe methods? The former has a stricter syntax parser and won’t serialize as many data types as the latter does by default. The stricter parser is a better choice when loading untrusted and potentially malicious YAML files. (Interpreters are always at risk of misinterpreting unexpected data.)

Your use of YAML may be unaffected, or your program might fail after upgrading to Psych 4\. Here are some highlights of the differences between `safe_load()` and `unsafe_load()` in Psych 4:

- `safe_load()` disallows YAML aliases (a potentially recursive data structure) by default (override with the `aliases: true` argument).
- `safe_load()` only deserializes a handful of default classes (below; extend the list with the `permitted_classes: [Class]` argument).

Here‘s the default list of serializable classes when running in safe mode:

- `TrueClass`
- `FalseClass`
- `NilClass`
- `Integer`
- `Float`
- `String`
- `Array`
- `Hash`

That should have your basics covered, right? Well, you might not have noticed, but the class list is missing the `Date` and `Time` classes. Many programs also expect Psych to serialize `Symbol`.

Almost everything I’ve ever used YAML for in Ruby includes a date or time object. If you do try to load a YAML file containing a date, you’ll now get the following error message:

Psych::DisallowedClass: Tried to load unspecified class: Date

This is the same error you’d get with earlier versions if you explicitly used the `safe_load()` methods without allowing the classes. You can extend the list of allowed classes by adding a `permitted_classes: [Date]` argument. It’s not a big deal to add the argument once, but let’s just say I’ve had to add it to a lot of places after the update.

To further complicate matters, Psych 4 dropped support for legacy positional arguments and now requires the use of named arguments. If you used to rely on `safe_load(yaml, [Date])`, you now need to migrate to `safe_load(yaml, permitted_classes: [Date])`.

The change away from positional arguments had been noted in the Psych module documentation for some years already. However, the software itself never issued deprecation warnings.

I believe the changes in and of themselves are good. The changes came from a good place and nothing but good intentions. However, the execution and introduction of incompatible changes were poorly handled.

Ideally, Psych should have printed warnings to standard error output (STDERR) to notify developers of the upcoming changes. Developers should have been given a heads-up warning and time to migrate. Instead, developers probably first noticed the changes when their programs stopped working.

#### Sources

- [Ruby 3.1.0 Released](https://www.ruby-lang.org/en/news/2021/12/25/ruby-3-1-0-released/?ref=ctrl.blog), 2021-12-25, Yui Naruse, News, Ruby
- [Psych module](https://ruby-doc.org/stdlib-3.1.0/libdoc/psych/rdoc/Psych.html?ref=ctrl.blog), version 3.1, 2021-12-25, Std-lib, Ruby doc
- [Issue 17866; Incompatible changes with Psych 4.0.0](https://bugs.ruby-lang.org/issues/17866?ref=ctrl.blog), 2021-12-21, Hiroshi Shibata, Issue Tracker, Ruby
- [Pull request: 487: Use Psych.safe\_load by default](https://github.com/ruby/psych/pull/487?ref=ctrl.blog), 2021-05-13, Aaron Patterson, Ruby Psych project, GitHub
- [Psych module](https://ruby-doc.org/stdlib-3.0.0/libdoc/psych/rdoc/Psych.html?ref=ctrl.blog), version 3.0, 2020-12-25, Std-lib, Ruby doc
### SELinux is unmanageable; just turn it off if it gets in your way
URL: https://www.ctrl.blog/entry/selinux-unmanageable/
Last updated: 2026-08-23T22:21:51.000Z
Security-Enhanced Linux (SELinux) is a type of Mandatory Access Control (MAC) in the Linux kernel. It can prevent software from performing unexpected — such as abusive or malicious actions — on your Linux systems. However, … it’s also an unmanageable mess, and I have a much greater understanding of why people recommend that people disable it.

SELinux is one of many layers of security that helps protect your Linux servers (and desktops) from the lions, and tigers, and bears — *oh, my!* SELinux policies specify which programs, sockets, and files are allowed to interact with each other. It requires everything on the system to be properly labeled with a security context that gets enforced through a policy that maps which labels are allowed to interact.

That might all sound like gobbledygook. Okay, here’s a concrete example: The Lighttpd web server executable is stored at `/usr/sbin/lighttpd` and is labeled with labeled `httpd_exec_t`. It reads files from `/var/www/` which are labeled as `httpd_sys_content_t`. Every time Lighttpd wants to read a file, the Kernel checks the current policy set and verifies that `httpd_exec_t` is allowed to read files labeled `httpd_sys_content_t`. The Kernel denies the read if it isn’t and logs a policy denial.

Everything happens, mostly, invisible to the system administrator (sysadmin). Everything works seamlessly unless the sysadmin tries to do something not allowed by the current set of policies. Now, most sysadmins are probably not aware of SELinux nor its policy set until they can’t achieve something because it violates the policies.

People then seek advice on the web on how to fix the problem. I’ve always cringed at what I’ve perceived to be inexperienced users suggesting to others that they disable SELinux — which is a terrible idea, right? The right solution is to learn about SELinux, and then make a tiny tweak to the policies to specifically allow what they want to achieve.

I can’t provide easy-to-follow steps on how to solve the problem, though. You need to learn a full set of tools to have any hope of adjusting things. There are very few good documentation sources available that describe SELinux and how to manage it.

It doesn’t help that no one wants to be told: “stop what you’re doing, spend a week to learn this other thing, make a tiny change, and then return to your real job”. They’re looking for solutions — preferably quick ones — and not a week’s worth of study.

Over time, I’ve realized that the advice to turn it off isn’t necessarily bad advice. Either SELinux won’t give you any problems as you stay within the parameters of the system policy, or you need to decide between learning a complicated subject or turning off a security feature.

At the heart of the problem is that the SELinux policies themselves are sort of magical. The policies have probably been provided by the maintainers of your Linux distribution, e.g., Fedora Linux. There’s nowhere on the system where you can view the policies and look up why something might or might not work. The policies also change over time, without any warning.

Whatever the reason, you’ll likely encounter some software that stops working after a system update or after you’ve changed its configuration. The change resulted in an SELinux enforcement action causing something, like a file read operation, to be denied on the system.

The SELinux denial audit log messages are too vague. You’re told that a label was denied reading from another label. Okay, what do those labels mean? Which programs? Which files, sockets, or whatever? You’re given the right information about why something was denied, but it’s unactionable without context.

In the best-case scenario, you’ll get (bad) advice from the denial message. The denial message might tell you to run some magical commands to allow stuff to happen. *Great, that’s what you want!* So, you run the `audit2allow` command as instructed, and end up with some policy blob files.

God only knows what changes the blobs do; you can’t be expected to, nor are you given enough information to evaluate them. Then you’re told to install it with the `semodule` command. You say, “okay”, and your problems have gone away for now.

Then six months later, an update to the system made some changes to the default system policies. The module you installed earlier references some labels or something that’s no longer defined, or some other conflict occurs. Then what do you do? You don’t know what the module did, where it was installed, or how to remove it.

This isn’t just something that happens when you blindly follow suggestions to run `audit2allow`. Package updates and policy changes often happen out-of-sync. A package’s SELinux policy is — most often — not part of the package but is installed as part of a larger meta package containing tens of thousands of policies (e.g., the Fedora Linux project’s `selinux-policy` mega-package). So, you’ll end up with breakage from the delay between upstream project changes making their way into an updated package, and the policy package receiving its next update.

The solution? Keep updating your system and hope that, within a week or so, the problem will have been resolved. That’s not always an option with business (or fun) critical software.

You can downgrade the package to the earlier version. Downgrading a security patch isn’t advisable and not all software even supports running older versions on top of configuration and databases that have been tainted by a newer version of itself. You risk introducing more problems.

You can try to run the magical commands to create a local policy patch, but then you might run into problems again further down the line. The best option in this situation is to, at least temporarily, put SELinux into permissive mode. Permissive mode logs denials but doesn’t enforce them the way the regular enforcing mode does.

Red Hat Enterprise Linux (RHEL) has some of the most accessible [documentation on creating custom policies](https://access.redhat.com/documentation/en-us/red%5Fhat%5Fenterprise%5Flinux/8/html/using%5Fselinux/writing-a-custom-selinux-policy%5Fusing-selinux?ref=ctrl.blog). (Red Hat is the same organization that manages Fedora Linux.) The documentation essentially says to run some commands that auto-generate policies for you. The RHEL documentation is written in a way that makes it clear you’re expected to pay Red Hat for consultants to manage custom SELinux policy needs for you.

The thing I’ve started to realize over time is that it’s probably best to just leave SELinux in permissive mode. The enforcing mode might prevent malicious actors from taking advantage of a weak point in my system’s security. However, it’s definitely preventing me from getting my work done.

In the last two weeks, completely unrelated issues have cost me hours and days to troubleshoot and deploy fixes to issues introduced by SELinux. The issues seem to have developed on their own and out of my control. Some were caused by policy changes, some by software package changes, and some by my configuration changes. I keep up to date on changes in critical packages, but I didn’t anticipate faults introduced by the SELinux policy.

That’s because SELinux doesn’t enforce *my* policies. I rely on the Fedora Linux project to develop and maintain policies for the software I rely on. However, I’m not familiar with the policies that are in place on my system. There’s no configuration file or reference tool I can check to see or modify the policies. They’re just there.

The issues I’ve ran into lately have been severe, too. One system (with no custom policies) was left unbootable after. The server that handles my blog’s newsletter sent an empty newsletter as the email signing agent could no longer talk to the mail transport agent (MTA).

From my perspective, SELinux broke a perfectly functional system. My system was built on top of someone else’s expectations and policies, and I wasn’t even aware of them, nor was I given a heads up before they changed.

I also decided to try the Fedora Linux 36 Beta on my laptop the same week. It’s just a few days before the final release, so I figured it would be fine. After the update, I was locked out as the login screen no longer could read some files needed to authenticate my login. Disabling SELinux was the only quick solution. (Relabeling the system didn’t fix the problem.)

Magical incantations — whether repeated from an online tutorial, documentation, or generated by a management tool — doesn’t really address the fundamental problem: SELinux is just too damned difficult to configure! It’s time consuming and complex even to inspect and parse the default policies just to understand what’s going on in the system. Audit log messages that suggest you run some random commands is just a band-aid on a more serious usability problem.

I want more control of SELinux policies on my system, and I want much easier tools to manage them. Auto-generated magical modules that vanish deep into the system only to pop up causing issues months later simply won’t do. I’d much prefer some plain text configuration files kept in `/etc/selinux` with a simple rule syntax and the ability to comment on what the policy does.

Frankly, I much prefer the [security settings provided by systemd](https://www.ctrl.blog/entry/systemd-service-hardening/) for the services it manages. They don’t provide the same controls as SELinux, but they get much of the same job done and are far easier to observe, modify, and understand.

SELinux is essentially a bag of security magic tricks orchestrated by unseen puppeteers. All I can do to influence the show is to pull more and more blobs out of the red magician’s hats/utilities.

The only reliable alternative where you have any hope of staying on top of this is to scrap everything provided by your Linux distribution and start with a clean slate. That’ll cost you weeks of your life to set up even for a basic web server. The only rational option is to leave it on but turn it off if it ever gets in your way.
### Can you use a WebP file as an Open Graph Protocol image?
URL: https://www.ctrl.blog/entry/webp-ogp/
Last updated: 2026-08-23T22:24:17.000Z
The Open Graph Protocol (OGP) was created by and for Facebook in 2010\. OGP is a pseudo-standard set of metadata tags you can include on your webpages to describe its contents. By now, it’s become the primary data source for generated link previews across the web and apps.

OGP lets you specify a webpage’s title, description, and thumbnail image. The protocol also lets you express more metadata, but these three are its primary uses. These three metadata items are used by external services to generate link previews for your webpages.

OGP metadata is consumed by all the big tech companies; including Facebook, Google, and Apple. It’s also used by every search engine, sharing, social, and messaging apps such as Reddit, Twitter, What’s App, Signal, WordPress, and Quora.

The [OGP Specification](https://ogp.me/?ref=ctrl.blog) doesn’t require the use of any specific image formats. The specification allows you to set multiple images of different sizes, aspect ratios, and file formats for a webpage. However, support for this is virtually non-existent. Avoid including more than one OGP image on your webpages!

[Facebook’s documentation](https://developers.facebook.com/docs/sharing/webmasters/?ref=ctrl.blog) says it requires images to be either JPEG (lossy), PNG (lossless), or a still frame/non-animated GIF image file. This part of its documentation was last updated in 2014\. Contrary to what its documentation says, Facebook does support other file formats than the ones it has documented. More on that later.

Image compression technology has improved a lot in the years since that documentation was last updated. The WebP format, introduced by Google in 2010, is a better option for both lossy and lossless images than either JPEG or PNG. WebP can yield higher-quality images at smaller file sizes.

Websites have embraced the WebP format because it helps them deliver pages faster and saves them money by reducing bandwidth costs. Users can’t tell the difference between one image format and another, but they do appreciate pages that load faster.

WebP isn’t as universally supported as the legacy formats. Some apps and image libraries might not know how to open and display them. However, most web browsers have supported WebP since 2019, with Safari being the last browser to add support in 2020.

It has been considered best practice to provide images in WebP and a legacy format as a fallback for older clients. Historically, this meant “for Safari” but now it’s truly only about legacy clients. However, many websites still maintain images formatted specifically for use by OGP clients.

Which brings us to the title of this article: Can you use a WebP image file with the Open Graph Protocol? OGP is one of the last hold-outs for where you need to use a legacy image format. Using WebP for OGP would allow you to drop support for legacy image formats entirely and save on storage costs and encoding time. The short answer is “yes”, but the long answer is “sure, but it depends”.

According to [Facebook’s documentation](https://developers.facebook.com/docs/sharing/webmasters/?ref=ctrl.blog), the answer is “no”. The company claims it only supports JPEG, PNG, and GIF image files. However, the Facebook website and its apps — including Messenger and WhatsApp — also support link previews of webpages using WebP images.

[Twitter’s documentation](https://developer.twitter.com/en/docs/twitter-for-websites/cards/overview/summary-card-with-large-image?ref=ctrl.blog) says it supports JPG, PNG, GIF, and WebP. WebP images work great in the company’s apps and websites. Twitter only uses the first frame of an animated PNG, WebP, or GIFs.

Here’s a quick comparison table of which image file formats are supported by different OGP-consuming platforms and apps. Note that the GIF column refers to still images and not animated GIFs. No one supports AVIF yet. (WebP adoption has a more than a decade’s lead on it.) The SVG column was included for the sake of completeness, as it’s the fifth most common image file format on the web.

| App/Service | Image format                        |      |     |      |     |
| ----------- | ----------------------------------- | ---- | --- | ---- | --- |
| WebP        | PNG                                 | JPEG | GIF | AVIF | SVG |
| Facebook    | Yes                                 | Yes  | No  |      |     |
| Twitter     |                                     |      |     |      |     |
| Reddit      |                                     |      |     |      |     |
| Discord     |                                     |      |     |      |     |
| WhatsApp    |                                     |      |     |      |     |
| Outlook.com |                                     |      |     |      |     |
| LinkedIn    | No                                  |      |     |      |     |
| Slack       |                                     |      |     |      |     |
| Signal      |                                     |      |     |      |     |
| Skype       |                                     |      |     |      |     |
| Quora       |                                     |      |     |      |     |
| Mastodon    | Depends on the server and apps used |      |     |      |     |

The decentralized Mastodon social network doesn’t have a definitive answer. It might support any given image format and it might not. It depends on what image formats are supported by the server’s image processing library. JPEG and PNG are generally supported.

I expect the hold-outs will adopt WebP within a couple of years. As Facebook and Twitter support WebP in OGP, that’ll be the extent of testing most websites will receive. Adoption of WebP as the only format a website supports is likely to sky-rocket in the coming years. There’s little point in maintaining two or more image formats when one is objectively better and universally supported in all web browsers.

Alternatively, you could go more advanced and try to parse the HTTP `Accept` request header from OGP-consuming bots. However, nearly all bots either don’t send an `Accept` header or send unhelpful values like `image/*, */*` (as opposed to e.g. `image/webp, image/jpeg`). In the end, you’d still need to support multiple image formats; which you probably want to avoid.

The legacy image formats are still your best bet if it’s important to you that end-users see your images in link previews. You can absolutely use WebP and fallback to only show the title and description in nonsupporting apps. I would suggest you keep your existing image format implementation, but for future implementations: Go with WebP only!

#### Sources

- [A Guide to Sharing for Webmasters](https://developers.facebook.com/docs/sharing/webmasters/?ref=ctrl.blog), 2022, Developer Documentation, Facebook, Meta
- [Open Graph Protocol](https://ogp.me/?ref=ctrl.blog), 2021-11, Facebook
- [Cards Markup Tag Reference](https://developer.twitter.com/en/docs/twitter-for-websites/cards/overview/markup?ref=ctrl.blog), 2020, Developer Documentation, Twitter
### Get your logo into inboxes with BIMI and email best practices
URL: https://www.ctrl.blog/entry/bimi-intro/
Last updated: 2026-08-23T22:02:10.000Z
The new Brand Indicators for Message Identification (BIMI) internet standards *draft* lets businesses display their logos next to their emails (as the sender/contact photo). The new standard is developed as a carrot to incentivize the adoption of existing email-sender best practices and verification schemes. Is a slight increase in branding prominence enough to push the email ecosystem towards adopting stricter email-sender policies? 

Email sender verification has been an all-sticks game where senders have been beaten over the head by recipients (delivered to Spam or rejected) if they fail to comply with sender-verification schemes. These schemes include Domain-based Message Authentication, Reporting, and Conformance (DMARC); Sender Policy Framework (SPF); and DomainKeys Identified Mail (DKIM). 

To comply with these email standards, you must maintain records that precisely describe which servers are allowed to send emails on behalf of your domain. These descriptions are stored as machine-readable records in the Domain Name System (DNS). In the case of DKIM, you must also commit to cryptographically signing every outgoing message.

BIMI is a new addition to the DNS record acronym soup. It puts aside the stick and offers senders a carrot instead. In exchange for configuring your domain with a strict DMARC policy built on SPF or DKIM (or both), you *might* have your brand’s logo show up next to your messages in recipient inboxes. The logo shows up in a square or round frame next to the message sender’s name; a spot typically reserved for contact photos from your address book.

The exact technical requirements for a BIMI logo to be displayed are up to the recipient mailbox provider or client application (e.g. Google Mail or Thunderbird). The [BIMI specification](https://datatracker.ietf.org/doc/html/draft-blank-ietf-bimi-02?ref=ctrl.blog) outlines a set of requirements, but the enforcement is left entirely up to the recipient. Senders should aim to meet as many requirements as possible with as strict policies as achievable for the best chance of having their logos displayed.

FastMail and Pobox (collectively FastMail), Google Mail (GMail), and Yahoo! Mail and AOL Mail (collectively YMail) are on board with their web and mobile apps. YMail will show brand logos for bulk senders with a good sender reputation. FastMail hasn’t documented its BIMI policies, but appears to show BIMI logos for anyone that meets the basic requirements. 

GMail is, as always, different. In addition to strict email sending policies, it also requires a Verified Mark Certificate (VMC) signed by a Certificate Authority (CA). A VMC is a digital file that confirms that the CA has verified that the logo is a registered trademark and that the domain in question is its rightful owner. The BIMI specification includes a framework for communicating this information to email recipients.

GMail’s VMC requirement introduce a significant legal, cost, and geographical restriction to BIMI adoption within its ecosystem. The BIMI specification can be abused to make scams look more legitimate. VMCs also raise the bar for scammers, so that not just any domain can claim its logo is the same as your bank’s or PayPal’s. However, a VMC is no guarantee of your logo being displayed — as outlined in the article [VMCs Aren’t a Golden Ticket for BIMI Logo Display](https://bimigroup.org/vmcs-arent-a-golden-ticket-for-bimi-logo-display/?ref=ctrl.blog).

However, I believe that evaluating the sender’s reputation and the permanency of their DMARC policies and BIMI logo is the better approach that works at internet scale. This seems to be the approach YMail has adopted.

Ideally, recipients should retain records of the current and historical logos of high-profile targets like PayPal, banks, and cryptocurrency wallets and exchanges. They could then use this information to identify scams by looking for BIMIs from other domains that match or closely match these logos. It could be used as a tool to fight scams and not just enable them.

Google has a history of outsourcing the responsibility of verifying third parties to CA organizations with the introduction of new (and expensive) special-purpose digital certificates. The Signed HTTP Exchanges Certificate (`CanSignHttpExchanges`) extension comes to mind.

Microsoft Outlook, 1&1, Apple Mail, and Mail.ru are notable mailbox providers that don’t yet support BIMI. Microsoft has its own business-to-business program for getting brand indicators into its customers’ mailboxes. Unlike BIMI, Microsoft’s scheme requires senders to establish relationships with individual mailbox providers.

In addition to these large email providers, BIMI is supported by the [FairMail](https://email.faircode.eu/?ref=ctrl.blog) email client app for Android. It’s off by default in the app, but users can enable BIMI indicators with any standard mailbox provider. The independent implementation verifies that BIMI isn’t just relevant for large mailbox providers. There are notably no plugins for the popular Roundcube or Thunderbird email clients.

BIMI allows for a domain-wide default logo or senders can suggest other logos by including a selector header in email messages (`BIMI-Selector`). This enables you to give your support desk, order updates/receipts, newsletter, and promotional emails different variations of your company logo. Or maybe something silly like changing the indicator to one with your logo featuring a Santa hat during Christmas.

Overly unique BIMI selectors could potentially be used to track whether a specific user has viewed the message or not. Mailbox providers can thwart this by proxying every request for a BIMI whether the mailbox exists or not. This way, BIMIs can’t be abused to check for active mail addresses no read confirmations.

These types of abuse are, probably, why YMail requires a certain volume of email before they allow BIMIs to load. Email apps like FairMail that can’t track sender-reputation at scale (since it only serves one person’ mailbox), so they can’t make reputation-based decisions on when to load BIMIs.

I surveyed the top 3 million domain names (according to [Tranco list W9VK9](https://tranco-list.eu/list/W9VK9/full?ref=ctrl.blog)) on 2022-04-20 and found that 6647 domains have published a default BIMI selector. I’ll write a follow-up article and more closely analyze the results of this survey next week. 

Let me know in the comments if you see Ctrl blog’s BIMI in the newsletter! Not subscribed yet? [Sign-up now](https://www.ctrl.blog/follow.html), so you don’t miss my follow-up article where I examine [BIMI adoption (and common mistakes)](https://www.ctrl.blog/entry/bimi-adoption/) across the web!

#### Sources

- [General Guidance for Implementing Branded Indicators for Message Identification (BIMI)](https://datatracker.ietf.org/doc/html/draft-brotman-ietf-bimi-guidance-05?ref=ctrl.blog), Draft #5, 2022-04-11, Network Working Group, Internet Engineering Task Force
- [BIMI](https://senders.yahooinc.com/bimi/?ref=ctrl.blog), 2022-02-10, Sender Hub, Yahoo!
- [Implementation Guide](https://bimigroup.org/implementation-guide/?ref=ctrl.blog), 2021-11, BIMI Group, AuthIndicators Working Group
- [VMCs Aren’t a Golden Ticket for BIMI Logo Display](https://bimigroup.org/vmcs-arent-a-golden-ticket-for-bimi-logo-display/?ref=ctrl.blog), 2021-09-10, BIMI Group, AuthIndicators Working Group
- [Advancing email security for Gmail and beyond with BIMI](https://workspace.google.com/blog/product-announcements/bringing-bimi-to-gmail-in-google-workspace?ref=ctrl.blog), 2021-07-21, Neil Kumaran and Wei Chuang, Cloud Blog, Google
- [Brand Indicators for Message Identification (BIMI)](https://datatracker.ietf.org/doc/html/draft-blank-ietf-bimi-02?ref=ctrl.blog), Draft #2, 2021-03-08, Network Working Group, Internet Engineering Task Force
### Everything or Nothing: The missing James Bond theme song
URL: https://www.ctrl.blog/entry/everything-or-nothing/
Last updated: 2026-08-23T22:05:58.000Z
Every now and then I lament about the digital licensing hell that’s constantly eating our shared cultural history. Or maybe I’m just angry at entropy and lack of foresight with digital archiving? None the less, I’d like to talk about a 20-year-old James Bond song you probably haven’t heard before.

James Bond 007: Everything or Nothing is a third-person shooter game released by EA Games for PlayStation 2, Xbox, and GameCube in 2004\. It was the third James Bond game by EA Games to feature an original story and the second with its own signature Bond theme song. 

The game’s theme song, Everything or Nothing, was performed by Mýa Harrison. Mýa also voiced and lent her likeness to the game character Mya Starling; an NSA agent and the story’s “Bond girl”. 

The song is quite catching and a definite product of its time. It’s been two decades since I played the game, and I still occasionally hum the song’s chorus to myself.

Unfortunately, I can’t easily listen to the song to get it out of my head. It’s not currently available for sale or streaming on iTunes, Spotify, Tidal, or any of their many competitors.

The song has not been included on any 007 compilation albums or official playlists. None of the other video game-exclusive songs have made it onto a compilation album either. I guess they’re not considered canonical? In my heart, they’re just as much a Bond song as any of the Bond songs from the movies.

According to Mýa’s website, the song appeared on her album Moodring released in 2003\. However, modern versions of the album available on iTunes, Spotify, Amazon, and elsewhere don’t feature the song. The album’s page on Wikipedia and other sources also doesn’t list the song. 

A single version appeared exclusively on the iTunes Music Store (ITMS) in the United States between 2013 and 2019\. It was promoted three times by the artist on Twitter in the last 2018\. It was delisted from the ITMS sometime between January and April 2019.

The song has a listing in the music catalog on the music streaming platform Spotify. The song isn’t currently available on the platform. I can’t find any data to suggest that the song has ever been available on the platform.

The song was available as a free download from the game’s page on the EA Games website between 2004 and 2007\. The promotional page was created in Macromedia Flash, and thus poorly archived by the Internet Archive’s Wayback Machine. The Wayback Machine did manage to archive a [low-fidelity MP3 version of the song](https://web.archive.org/web/20051031060953/http://www.japan.ea.com/bond%5Feon/radio/01eontheme.mp3) (32 kbps) from the Japanese promotional website. So, you can still give it a listen but it doesn’t sound all that good. 

That Internet Archive link is the nearest you can get to a legal digital release of the song. This version of the song has been uploaded a thousand times on services like SoundCloud and YouTube. A slightly higher bit-rate version that was ripped from the game’s title screen can also be found. (I’m sure the users who uploaded them [didn’t intend any copyright infringements](https://www.ctrl.blog/entry/copyright-disclaimers/).) 🙄

EA Games’ early rights to distribute the song as a promotional item on the web might be part of why the song’s no longer available. The song is currently owned by Interscope Records, a Universal Music Group (UMG) subsidiary. Mýa’s newer music is released and managed by her own record label.

A lot of the music I liked in the early 2000s just isn’t available anywhere digitally. The music from that middle ground period when artists and record labels began securing digital distribution rights, but no one knew how the digital distribution channels would turn out yet. So, the songs are perpetually stuck in rightsholder limbo. No one wants to renegotiate the contracts to make a few cents off streaming.

The involvement of the 007 brand further complicates matters. Eon Productions, the company managing the 007 brand and producing the movies, guard the brand and rights like a hawk. The (defunct) MGM Interactive game studios and EA Games might also still hold some of the rights. I can only speculate, though.

The previous game in the series, James Bond 007: Nightfire (2002), featured another lost Bond song: Nearly Civilized by Esthero. It’s also not available on any digital music store or streaming service. (Low-fidelity versions can be found through … other channels.) The game is old enough that information about the song and its ownership simply doesn’t exist online. 

Listenership information from Last.fm (includes data from 2002 onwards) only logged 1200 listeners for Nearly Civilized. Last.fm (formerly Audioscrobbler) was a hugely popular music recommendation service. Users “scrobbled” (recorded) their music listening history to the service in exchange for personalized recommendations and fancy graphs about their music taste. This might suggest the song was rare and difficult to obtain at the time. Everything or Nothing has had over 8000 listeners. 

I’ve reached out to Mýa on Twitter and to her management team via email for comment. Her manager directed me to UMG who didn’t respond to my email.

I’ll end with the lyrics from the catchy chorus from Everything or Nothing:

> “Give me Everything or Nothing;  
> Give me Everything or Nothing at all!”

#### Sources

- Email exchange with Marc Rosenthal, 2022-04-06, Hue Entertainment
- [Everything Or Nothing](https://www.last.fm/music/M%C3%BDa/%5F/Everything+Or+Nothing?ref=ctrl.blog), 2022-03-30, Mýa, Last.fm, CBS Interactive
- [Nearly Civilized](https://www.last.fm/music/Esthero/%5F/Nearly+Civilized?ref=ctrl.blog), 2022-03-30, Esthero, Last.fm, CBS Interactive
- [All about Mýa](https://www.myamya.com/all-about-mya/?ref=ctrl.blog), 2020-08-23, Mýa
- [#WaybackWednesday tweet](https://twitter.com/myaplanet9/status/1073030760817405957?ref=ctrl.blog), 2018-12-13, Mýa, Planet9, Twitter
- [Everything or Nothing (single)](https://web.archive.org/web/20130420185542/https://itunes.apple.com/us/album/everything-or-nothing-single/id26236457), 2016, Mýa, iTunes Music Store, Apple, Internet Archive
- [007 エブリシング オア ナッシング2【幸運を】](https://web.archive.org/web/20220406150707/https://game4.5ch.net/test/read.cgi/famicom/1076592415/833), 2004-02-27, Famicom forum archive, Loki Technology
- [007: Everything or Nothing Title song by Mya](https://www.neowin.net/forum/topic/141799-007-everything-or-nothing-title-song-by-mya/?ref=ctrl.blog), 2004-02-16, “SuperJediMedia”, Forums, Neowin
### Samsung devices incorrectly handle CSS @media hover queries
URL: https://www.ctrl.blog/entry/css-media-hover-samsung/
Last updated: 2026-08-23T22:04:10.000Z
The `hover` `@media` feature query lets you check if a device’s primary input device supports hovering interactive elements. It became part of the web platform as of CSS Media Queries Level 4\. The `hover: hover` query should match on devices with a mouse cursor (e.g. a touchpad), and `hover: none` should match touchscreens (mobile devices). Unfortunately, Samsung devices say their touchscreens are touchpads.

The media feature query let you detect and apply different styling when a device supports hover interactions. For example, you can collapse an expandable menu when the device supports hovering and expand it by default when it doesn’t.

The media query is supported in all leading web browsers and operating systems (OS). Except for Chromium on Samsung devices running Android. Chromium is the underlying engine used by the default Samsung Internet browser, Google Chrome, Microsoft Edge, Brave, and others.

Any device with a Samsung touchscreen (and the accompanying Android kernel driver) is affected; includes all Samsung devices since 2015 and some third-party Android devices that source their touchscreens from Samsung.

The problem seems to be that the touchscreen reports to the underlying system that it’s both a touchscreen and a mouse. Technically, the affected devices self-report that they have a touchscreen and a touchpad (like on a laptop). Inputs made on the touchscreen get processed as mouse inputs by the (non-existing) touchpad.

I’m not sure why it does this, but I suspect it has something to do with either the Samsung S Pen (a stylus) or Samsung DeX (a docking station that creates a desktop-like experience). These accessories — not compatible with all affected devices — either act like or can pair the device with a hover-capable mouse.

In these situations, the device does have a hover-capable input devices. However, Samsung doesn’t let the OS distinguish between the touchscreen and its other mouse-like input methods. This issue is particularly annoying on devices that aren’t even compatible with these accessories.

I’ve reached out to Samsung and asked them to fix its web compatibility issue. I don’t expect it to get fixed any time soon. This bug seems to be a deeply-rooted OS problem with how Samsung devices handle input. I also expect that many apps have grown to depend on things continuing to misbehave.

It would be possible for either Samsung or the Chromium team to work around the issue with a patch in Chromium. Such a workaround would probably come at the cost of compatibility with the S Pen, DeX, or whatever motivated Samsung’s weird implementation in the first place.

There aren’t any good alternatives to this media query. The best you can do is to assume that small screens are touchscreens, e.g. using `@media (max-width: 500px), (max-height: 500px)` instead of `@media (hover: none)`. (Replace `max` with `min` to substitute for `hover: hover`.)

Firefox for Android uses the same input capability detection method as Chromium. However, it discards the results and uses a non-hovering course pointer instead. Firefox will always match `@media (hover: none) and (pointer: coarse)`. Although not ideal, it means Firefox will be correct about the input device most of the time.

#### Sources

- [AndroidNativePointerCaptureProvider.java](https://github.com/moonlight-stream/moonlight-android/blob/8a63b614955a726fc27c89bcf3699022214756d7/app/src/main/java/com/limelight/binding/input/capture/AndroidNativePointerCaptureProvider.java?ref=ctrl.blog), commit 8a63b61495, 2022-02-19, Cameron Gutman, Moonlight project, GitHub
- [Hover Capability: the hover feature](https://www.w3.org/TR/2021/CRD-mediaqueries-4-20211225/?ref=ctrl.blog#hover) (candidate recommendation), 2021-12-25, Interaction Media Features, Media Queries Level 4, World Wide Web Consortium (W3C)
- [Some Androids reporting hover: hover](https://bugs.chromium.org/p/chromium/issues/detail?id=940256&ref=ctrl.blog), issue 940256, 2021-02-10, Issue tracker, Chromium project, Google
- [Android Input doesn’t work because two touchscreens are detected](https://forum.unity.com/threads/android-input-doesnt-work-because-two-touchscreens-are-detected.949599/?ref=ctrl.blog), 2020-03-23, Input Systems, Forums, Unity Technologies
### Should you trust a third-party bootloader to run newer MacOS versions?
URL: https://www.ctrl.blog/entry/macos-opencore-trust/
Last updated: 2026-08-23T22:13:56.000Z
Apple periodically drops support for its older hardware, and customers get left with an increasingly insecure and outdated system. The Hackintosh scene, a community dedicated to running MacOS on unsupported hardware, might help extend the life of your Mac. However, can you trust its community-developed software to the same degree as you blindly trust Apple?

My MacBook Pro (a 2013 model) won’t receive any more love (updates) from Apple as the company left it behind with the release of MacOS version 12 “Monterey”. However, the hardware is still perfectly capable of running Monterey. Sure, it has needed some [maintenance](https://www.ctrl.blog/entry/repaste-thermal-compound/#readme) and a [battery swap](https://www.ctrl.blog/entry/macbook-late2013-battery-replacement.html), but it’s otherwise in good condition.

A Hackintosh usually refers to a computer from another manufacturer running Apple software. Apple includes all sorts of software-based copy protections to make sure its software only runs on its hardware products. That’s more of an encouragement than anything to dedicated folks who want to do exactly that.

The current star in the Hackintosh community is the [OpenCore](https://github.com/acidanthera/OpenCorePkg?ref=ctrl.blog) UEFI emulator and bootloader project. The Unified Extensible Firmware Interface (UEFI) is low-level software that sits in between the hardware’s firmware and the operating system (OS) software. Among other things it’s responsible for booting the OS, and it also provides services to the OS afterwards.

OpenCore is a free and open-source replacement for Apple UEFI and iBoot (Apple’s bootloader) software. OpenCore works by replicating the behaviors MacOS expects from UEFI and iBoot on a supported Mac on an unsupported system. It can run on legacy Mac products and computers from other manufacturers.

It’s deeply weird to me that I have to turn my MacBook into a Hackintosh to continue running Apple’s latest software. I paid extra for the Apple experience. To me, the Apple experience doesn’t involve installing third-party UEFI and bootloaders.

The first software that runs on your computer after it’s been powered on runs in absolute unrestricted security (“God”) mode. It can do anything it wants on your computer. It *is* your computer.

You implicitly trust your hardware vendor’s firmware. Bought a Dell running Windows? Then you trust Dell and Microsoft. Bought a Mac? Then you trust Apple. Customers rarely think about the required trust levels. (It may be deeply uncomfortable to pause and give it some thought.)

Things get a bit more complicated if you’ve bought a computer and you run Linux on it. Linux is a free and open-source OS developed by a loosely organized collective of individual contributors and organizations. Linux users assume everything is fine and that enough skeptical eyes are scrutinizing every little contribution.

Linux runs on one of many community-developed bootloaders started from the UEFI by whoever happens to have developed the hardware. Trust is still absolute, but it can be quite unclear who you’re trusting.

The Linux ecosystem has layers of trust and validation. The software developers rarely delivers software directly to their end users. Instead, software developers release software which is then picked up by another group of people: package maintainers. The package maintainers prepare and package the software for a Linux distribution. The packaged software is staged for testing before eventually being pushed to end-users.

On top of this, security researchers eagerly await the release of key packages. Finding a vulnerability in a program that can be expected to be installed on millions of computers can be a huge carer boost.

OpenCore is a much smaller project where the software gets delivered directly to end-users. There are fewer eyes and steps from the project to its end users. Crucially, there are fewer (if any?) corporate users. There’s less time and money invested into scrutinizing the software and the project’s security practices.

You should always be distrustful of alternative firmware. You should always ask yourself: do I trust this firmware to not steal my email and passwords, credit cards and banking information, and cryptocurrency wallets? For most people, the answer should be: I don’t know and I’m not qualified to answer that question.

OpenCore documentation (from the project and third party) references “security audits”, but I haven’t found any indication of a security audit of the project. A security audit is a thorough, time-consuming, (and expensive) process where a specialist consulting agency reviews a software project. An audit typically involves validating security best practices, identifying unsafe/exploitable areas of the code, and suggesting other improvements to strengthen its resistance to exploitation

I’m not saying there’s any malicious intent from the OpenCore or other alternative UEFI or bootloader communities. However, even the best developers and intentions can make mistakes. That mistake could be exploitable.

The [OpenCore Legacy Patcher](https://dortania.github.io/OpenCore-Legacy-Patcher/?ref=ctrl.blog) app makes it easy for users on older versions of MacOS to download and prepare a USB drive that they can use to update their unsupported Macs to the latest version. Its first operation just downloads and installs the MacOS Installer from Apple onto the USB drive. It creates [verifiably genuine installers](https://www.ctrl.blog/entry/how-to-verify-macos-installer/).

In the second step, it installs OpenCore onto the USB drive. Now, it’s up to you to blindly trust it, restart your Mac, and hope for the best.

I’d recommend most users who’re considering a Hackintosh approach to install a popular Linux distribution instead. The Linux community is motivated to support your aging hardware instead of actively trying to break it with every update.

Apple actively wants to sabotage OpenCore and the Hackintosh community’s efforts. OpenCore works around and bypasses security measures, and it can prolong the life of your unsupported Apple products. However, you have no guarantee of how long it’ll last. Installing OpenCore may grant your Mac another lease on life, but you’ll always be on borrowed time.

Unfortunately, the WiFi chipset in this generation of MacBooks is poorly supported in Linux. Otherwise, I’d recommend you switch to Linux instead of continuing to use Apple’s OS. However, I too want to continue using MacOS and I don’t need another Linux computer. So, I went down the lesser-traveled OpenCore path.

Whether you install OpenCore or Linux (or even Windows) on your Mac, you should be prepared for [shark encounters](https://xkcd.com/349/?ref=ctrl.blog). You’re not an Apple customer anymore; the magic is no more.

In my opinion, hardware vendors should continue supporting their old hardware for at least 10–15 years. There’s no need for my MacBook to become electronics waste at this point in its life. Assuming I can run still-maintained and secure software on it, it still has years of use ahead of it.
### How to install additional spell check dictionaries for Flatpak apps
URL: https://www.ctrl.blog/entry/flatpak-locale-dictionaries/
Last updated: 2026-08-23T22:07:03.000Z
[Flatpak](https://flatpak.org/?ref=ctrl.blog) apps run inside a separate and isolated environment from your main system. This environment separation is what helps make apps portable between different Linux distributions. However, it also changes the approach required to complete tasks like installing multiple spell checker dictionaries for bilingual users.

By default, Flatpak downloads app-specific locale data (including translation files, locale and format settings, and dictionaries) for each app matching your system locale. However, Bilingual users likely want to install more than one dictionary for their spellchecker.

On Linux, you usually achieve this by installing additional dictionaries through Linux your distribution’s package repository. System dictionaries aren’t accessible to Flatpak apps inside their isolated Flatpak runtimes. You *could* tweak overrides for individual Flatpak apps to grant them access to the system dictionaries. However, there’s a better solution.

Flatpak doesn’t have many configuration options, but it has one for specifying what languages to download. Flatpak downloads and installs the default system language, locale and formatting data, and dictionaries by default. However, you can configure it to enable support for a list of languages.

The below command configures Flatpak for the current user with a semicolon-separated list of two-letter language codes (ISO 639-1). The first language is the primary language and gets used as the display- and spell checker language. The rest of the list is an ordered list of fallback languages. Flatpak will install spell check dictionaries for each listed language. 

The following example command sets English as the display/primary language; and German and French as fallback languages. The second command triggers an update, which will instruct Flatpak to fetch any missing locale data after you’ve changed the configuration.

```sh
flatpak config languages --set "en;de;fr"

sudo flatpak update
```

Unfortunately, this option only accepts a list of two-letter language codes. Flatpak only supports meta-language groups like “English” (en) and not “American English” (en-US). 

As an unfortunate side-effect, you can’t install just American English. You install the whole set of English variants with the “en” language code. The only disadvantage is that you get a cluttered language list when choosing your spell checker language, and you might not get the language variant you expect. 

Double-check that the spell checker has selected your preferred regional language variant inside each app. There’s no way to specify the language locale variant globally for all Flatpak apps.

#### Sources

- [flatpak-config — Manage configuration](https://docs.flatpak.org/en/latest/flatpak-command-reference.html?ref=ctrl.blog#flatpak-config), 2021-11-19, Reference, Documentation, Flatpak
### How to run Windows 11 in GNOME Boxes (with UEFI and TPM2 emulation)
URL: https://www.ctrl.blog/entry/how-to-win11-in-gnome-boxes/
Last updated: 2026-08-23T22:11:18.000Z
My old tutorial for [installing Windows 10 in GNOME Boxes](https://www.ctrl.blog/entry/how-to-win10-in-gnome-boxes/) doesn’t work with Windows 11\. Here’s how to install Windows 11 as a virtual machine (VM) inside [GNOME Boxes](https://apps.gnome.org/app/org.gnome.Connections/?ref=ctrl.blog). (Some configuration file changes required.) 

Windows 11 significantly raised its hardware requirements compared to Windows 10\. Among the changes, it requires more RAM and storage space. It also requires a Trusted Platform Module (TPM) version 2.0 and a UEFI boot environment.

GNOME Boxes doesn’t yet support TPM and UEFI environments. However, the underlying virtualization technology supports it. You just need to tweak a few configuration options along the way. *Read the instructions carefully!*

### Prerequisites

You’ll need to meet the following hardware requirements:

- Your processor must support hardware emulation, either AMD Virtualization (AMD-V) or Intel Virtualization Technology (VT-x). All but the cheapest processors should support virtualization. Check your BIOS to make sure it’s enabled! (It may be **off by default**.)
- The Windows guest system requires at least 8 GB of RAM. Your host system will also require at least 2 GB for itself and the emulation. Your system should have at least 12 GB of RAM.
- The Windows guest system requires at least 124 GB of storage space. The Windows install doesn’t need all this storage right away, but you’ll run into issues with Windows Update later.

You also need to prepare the following:

- A Windows 11 installation media file (“ISO”). It can be [downloaded for free from Microsoft](https://www.microsoft.com/en-us/software-download/windows11?ref=ctrl.blog "Windows 11 ISO Download Portal") (about 6 GB). Make sure you download the right edition and installation language.
- A valid Windows Product Key for OEM/Retail installations. The **Professional edition is preferred** (refer to the Post-installation section below). You can skip this during the installation, but you will need to provide a product key within 30 days of the installation.

You should also be familiar with installing software packages from your Linux distribution’s package repository from the terminal. This is the `dnf` tool on Fedora Linux; and the `apt` tool on Debian, Ubuntu, and their derivatives.

### Install GNOME Boxes and its prerequisites

1. Start by installing GNOME Boxes from your Linux distribution’s package repository. You cannot use the Flatpak/Flathub version as it doesn’t currently support emulating a TPM. The package is called `gnome-boxes` everywhere. You need **version 40** or newer!
2. Install the TianoCore Open Virtual Machine Firmware (OVMF) from your package repository. This will let your VM boot as a modern secure boot-enabled UEFI system instead of a legacy BIOS system. The package is called `edk2-ovmf` in Fedora Linux 34 and `ovmf` Ubuntu 22\.
3. Install the `swtpm` emulator (software TPM (SWTPM)) from your package repository. The package is called `swtpm-tools` in both Fedora Linux 34 and Ubuntu 22 (it’s found in the Universe repository).
4. As yout normal user (not root), run the SWTPM set up command in a terminal:

```sh
swtpm_setup --create-config-files skip-if-exist
```

You may need to log out and back in again if you’ve launched another VM in the current session. Unsure if this applies to you or just want to stay out of trouble? Just reboot your computer; it’s quick and easy anyway.

### Installing Windows 11 in GNOME Boxes

1. Start GNOME Boxes and click on the New button (top left) to create a new VM. The dialog can look a bit overwhelming, but it’s only asking you for one thing: an installation disk image file (“ISO”).
2. Select the Windows 11 ISO file you’ve downloaded from Microsoft. Do not trust ISO files from sources other than the official website of the software vendor. GNOME Boxes will list it at the top of the dialog (likely misidentified as Windows 10) if it’s stored in your Downloads folder. You can also use the select disk image option at the bottom of the dialog.
3. Do not accept the Express Installation option. Express installs are only available for some operating systems (OS) and don’t yet work with Windows 11\. This option is shown because current versions of Boxes misidentify Windows 11 as Windows 10\. Instead, click on the Next button in the top right corner.
4. On the next screen, assign the Windows guest system *at least* 8 GB of RAM and 124 GB of disk space. The virtual hard disk image won’t consume all that space right away, but grows dynamically as it gets used.
5. Click the Create button and wait. The Windows installer should boot up inside the VM and prompt you to select your preferred language and locale. **Do not proceed** with the installation! The VM is running in legacy BIOS mode and without a TPM. We need to correct that before proceeding.

The following steps **must be followed precisely** to fully shut down the VM. Unfortunately, there are a few design flaws in GNOME Boxes when you’re trying to do this in the middle of an OS installation. See GNOME Boxes [issue #773](https://gitlab.gnome.org/GNOME/gnome-boxes/-/issues/773?ref=ctrl.blog). GNOME Boxes may incorrectly show the VM as shutdown while it’s still running if you don’t follow these steps. 

1. **Abort the installation** by clicking the Close button (top right) of the installer window inside the VM. You’ll get returned to Boxes main view.
2. Wait 20 seconds. The VM’s preview image will spin continuously.
3. Right-click on the VM and select Force Shutdown. The preview image will continue to spin.
4. Quit and restart GNOME Boxes. The preview image should now have stopped spinning and turned into the power symbol (⏻).

Hopefully, you haven’t completely lost faith in GNOME Boxes after following that sequence of steps to fully shut down the VM. GNOME Boxes expect to auto-restart the VM two times as part of the normal installation. We don’t want that, so we end up in buggy and uncharted waters.

At this point, you’ll need to make a few manual changes to the VM configuration before we jump back into the Windows Installer. Make sure to follow the instructions carefully.

1. Right-click on the VM and select Properties. Go to the Advanced tab and click on the Edit Config button (it may be called Edit XML in older versions).
2. Scroll down to the line that says `<devices>`. Scan the lines until it says `</devices>` for any mentions of a TPM. Skip this step if you find any. To enable the TPM emulator, insert a blank line after `<devices>` and paste the following snippet:

```xml
<tpm model="tpm-crb">
  <backend type="emulator" version="2.0"/>
</tpm>
```

1. Scroll down to the line that says `<os>`. Verify that the `type` element matches the below (the numbers in the `machine` attribute may differ). If it doesn’t match then you probably haven’t enabled virtualization in your BIOS. Fix that first, delete the VM, and try again.

```xml
<type arch="x86_64" machine="pc-q35-6.1">hvm</type>
```

1. Locate the newly installed OVMF secure boot firmware image file on your system. The file is called `OVMF_CODE.secboot.fd`, but the installation path is different between Linux distributions. It’s located in `/usr/share/edk2/ovmf/` in Fedora Linux 34 and in `/usr/share/OVMF/` in Ubuntu 22\.
2. Scan the lines until it says `</os>` for any mentions of a loader. Skip this step if you find any. Insert a blank line after the `type` element, and paste the following (supply the correct full path from the previous step):

```xml
<loader readonly="yes" type="pflash">/PATH-HERE/OVMF_CODE.secboot.fd</loader>
```

1. Click the Apply button to save the changes. It may appear like your changes get reverted and you may receive a warning about failing to create a snapshot. You can ignore these problems.
2. Quit and restart GNOME Boxes again.
3. Right-click on the VM one last time and select Properties. Go to Devices and Shares: CD/DVD.
4. Click the Select button and reselect the Windows 11 ISO file. The image was removed automatically when the system was shut down during the aborted installation.
5. Close the properties dialog.
6. Double-click on the VM in Boxes to start it and resume the installation. Complete the Windows 11 installation by following the prompts. Here’s a neat trick to [install Windows without any bloatware](https://www.ctrl.blog/entry/windows-ooberegion-bloatware/).

### Post-installation

Once you’ve installed Windows 11, you can just use it as-is in GNOME Boxes. However, you’ll be stuck with low performance, 800×600 px screen resolution, and no clipboard integration. Let’s get those sorted out in order.

You can increase the performance of most I/O operations by installing the VirtIO guest agent and driver set. Inside the VM, download and install [VirtIO guest addons](https://fedorapeople.org/groups/virt/virtio-win/direct-downloads/stable-virtio/?ref=ctrl.blog) (look for `virtio-win-gt-x64.msi`). Restart the VM afterward. 

You have two options for higher screen resolutions and clipboard integration. You can either continue to use GNOME Boxes or switch to [GNOME Connections](https://apps.gnome.org/app/org.gnome.Connections/?ref=ctrl.blog). Connections is a version of Boxes that focuses on accessing remote desktops instead of VMs. The two apps look and feel very similar.

You can use Connections to connect to the VM using the Remote Desktop Protocol (RDP). This is the most performant and reliable option. However, it requires a license for Windows 11 Professional or Enterprise. Windows 11 Home doesn’t include the required RDP server component.

You can enable the RDP server from the Windows Settings app: System: Remote Desktop: Remote Desktop. After enabling a network service, take a moment to double-check your network firewalls and make sure that you have a strong and unique password. You may have exposed the service on the public internet. Note that networking into the VM also requires more configuration and is out of scope for this article. 

Your other option is to keep using GNOME Boxes with a graphics driver optimized for use within VMs, and optionally the SPICE guest agent. To enable greater screen resolutions, you need to download and install the newest version of the [QXL-WDDM\-DoD driver](https://www.spice-space.org/download/windows/qxl-wddm-dod/?ref=ctrl.blog) (look for the newest date, then `QxlWddmDod_x64.msi`). The download link may lead to a page that looks like gobbledygook. If this happens: Go back, right-click, and select Save As. The QXL-WDDM-DoD driver works in Windows 11 but doesn’t officially support the OS. 

Optionally, you can enable auto-resizing/adaptive screen resizing and clipboard integration by downloading and installing the [SPICE guest agent](https://www.spice-space.org/download/windows/vdagent/?ref=ctrl.blog) (look for the newest date, then `spice-vdagent-x64.msi`). Restart the VM afterward.

### Known issues

The SPICE display server can sometimes stop working under heavy processor loads. You need to restart the VM to get it back up and running. This isn’t an issue when using RDP.

Online snapshots don’t work with UEFI-based systems. You need to power off the VM before you can create a snapshot.
### Why it’s easier to recover unsaved documents in Kate than GEdit
URL: https://www.ctrl.blog/entry/kate-swp/
Last updated: 2026-08-23T22:12:26.000Z
A few years ago, I wrote about [how I recovered a GEdit document](https://www.ctrl.blog/entry/how-to-recover-gedit-documents/) from an unresponsive system. At the time, I couldn’t interact with the system using a keyboard and mouse. However, I could open a remote shell into the system and managed to retrieve and save the document.

I haven’t needed to do that since. My computer still occasionally becomes unresponsive, but I don’t lose hours’ worth of unsaved work anymore. I still occasionally need to [recover my emails from RAM](https://www.ctrl.blog/entry/restore-lost-email-from-ram/). So, what changed? 

Shortly after GEdit crashed on me, I replaced it with [Kate](https://kate-editor.org/?ref=ctrl.blog) and [KWrite](https://apps.kde.org/kwrite/?ref=ctrl.blog). Kate has developer-oriented features whereas KWrite is a stripped-down version for general text editing. Both versions have the feature I’ll discuss in this article.

Kate has a feature that lets it recover your unsaved work from crashes and system crashes. It has two important caveats and I’ll get those out of the way first:

The recovery feature only works with documents that have been saved once and reside in a writable directory. Kate won’t be able to recover your never-saved novel or changes. The document needs to have a writable path on a file system.

When you make changes to a saved file on a local or remote file system in Kate, it auto-saves a swap-recovery file. The swap file contains all the differences between the original file on disk and the unsaved working copy you’re editing in Kate. It’s auto-saved to disk every 15 seconds. The swap-recovery file is saved to `.example.txt.kate-swp` in the same directory as the file. The leading dot hides the file in most file managers. 

The swap file is removed when you save your document and make no further changes. However, if Kate or the system crashes, it’ll auto-detect the swap file when you reopen your file. Kate will prompt you to compare the current file with the unsaved changes and let you recover or discard them.

It’s a nice-to-have feature until the day when you really need it. It was really useful to me in the time before I fixed the [suspend-on-low-battery issue](https://www.ctrl.blog/entry/linux-laptop-low-battery-suspend/) that caused my laptop to crash fairly regularly (due to power failure).

I can hear some of my readers squirming in their chairs, ready to complain about the “unnecessary wear” on their solid-state drives (SSD). These occasional extra saves won’t wear out your SSD. SSD wear is caused by poorly designed programs that constantly write lots of data every millisecond for no apparent reason. Kate only saves the recovery file when there’s unsaved work to preserve; it doesn’t needlessly re-save it every 15 seconds. 

You can turn off the swap-recovery feature or configure the auto-save interval in Kate Configuration: Open/Save: Advanced. You can also override where the swap file is saved. This last option can be useful if you’re editing files in a folder that is synced to other machines using a program like Syncthing or Dropbox. 

#### Sources

- [Chapter 7: Configure KatePart](https://docs.kde.org/stable5/en/kate/katepart/config-dialog.html?ref=ctrl.blog), 2022-03-11, KatePart Handbook, Docs, KDE
### FreeStyle Libre 3 miniaturizes real-time glucose monitoring
URL: https://www.ctrl.blog/entry/freestyle-libre3-cgm/
Last updated: 2026-08-23T22:07:46.000Z
[I’ve worn the FreeStyle Libre 2](https://www.ctrl.blog/entry/freestyle-libre2-wear/) flash-glucose monitor (FGM) on my upper arm for the last three years. As a diabetic, I need to pay close attention to my glucose levels, and the Libre 2 was a revolution compared to finger-prick blood tests every couple of hours. The new Libre 3 system is a highly-anticipated update that massively improves on the Libre 2.

I don’t usually talk about products that I don’t have any first-hand experiences with, but I’m making an exception here. The Libre 3 isn’t yet available in my market, but I’m genuinely stoked about the next-generation FreeStyle *continuous* glucose monitor (CGM).

The Libre 2 continuously measures glucose levels and optionally sends alerts to your phone when the levels go out of range. To see the glucose readings, you needed to put a reader or your smartphone up to the sensor and hold it there for a few seconds. The last eight hours of glucose readings are transferred to your reader using near-field communication (NFC).

The new Libre 3 still uses NFC to pair and activate the sensor. However, it sends glucose readings every minute over Bluetooth Low Energy (BLE) to your smartphone. The readings can be automatically relayed via your smartphone to a guardian or another person, making it an excellent option for kids. It turns it into a CGM instead of a FGM.

I’m looking forward to not having to do battle with NFC throughout the day. I love my Libre 2, but it’s also frustrating to align two tiny NFC antennas by reaching behind the arm/shoulder. It’s not like I can see what’s going on, and NFC and the LibreLink app are quite unforgiving. *Beep! Beep! Beep! Try again.*

Better glucose management leads to better long-term health outcomes for diabetics. It’s literally a life-extending diagnostic tool. A CGM lets diabetics more quickly handle glucose events like critical hypoglycemia and hyperglycemia. Without a CGM, the best alternative is an expensive trained diabetes dog that can recognize these changes to your body from changes in your odor.

A CGM is nothing new; they’ve been around commercially since 1999\. The revolutionary change is the advances in miniaturization. The Libre 3 sensor is 21 mm × 2,9 mm and weighs 1,1 g. For comparison, the Libre 2 sensor is 35 mm × 5 mm and 5 g.

The FreeStyle Libre’s closest competitor is Dexcom. It has made CGMs for years, but the sensors are the size of a small toy car. Dexcom’s current model, the G6, is roughly four times the size and over five times the weight of the Libre 2\. Its upcoming model, the G7, is only slightly larger and heavier than the Libre 2\. Just as Dexcom is about to catch up with the Libre system, Abbott significantly increased its lead in the miniaturization of body-worn sensors.

The FreeStyle Libre 3 is currently only widely available in Germany with limited availability in the Netherlands. (Some availability in other regions through resellers of German stock.) Additionally, it should become available through the national health services in Finland, the Netherlands, and the United Kingdom sometime in 2022.

You can also find country-specific apps for Android on the Google Play Store for France, Norway, and Sweden. The Libre 3 is not yet available in any of these countries, however.

Abbott has focused on the European market when launching new FreeStyle Libre systems. The nationalized health care systems throughout Europe have enormous coordinated purchasing power compared to other countries like the United States.

The Libre 3 is compatible with Android in every launch market, and iOS in Germany. Most articles, blog posts, and reviews of the Libre 3 inaccurately claim that it’s incompatible with iOS. Country-specific documentation says the Libre 3 is *not compatible* with iOS, except in Germany. This suggests it’s an issue of red tape and staggered market roll-out, and not a technical limitation. 

Additionally, Abbott now promotes that the FreeStyle Libre system supports some smartwatches: Fitbit Versa 3 (Android and iOS), Apple Watch Series 7 (iOS), and Samsung Galaxy Watch 4 (Android). The integration requires the paired smartphone to be within range to receive the glucose measurements. The phone receives the glucose measurement and then forwards it to the smartwatch. The feature relies on notification mirroring, and should be available through any smartwatch, app, or device that supports notification mirroring. 

The Libre 3 has not improved at all on other important aspects of its ecosystem. Users are still obliged to agree with new lengthy shrink-wrap contracts every couple of months to continue using the system. A shrink-wrap contract is a legal document, e.g terms of service or a privacy policy, presented to the customer *after* they’ve already purchased a product or service. 

The data from the sensor is still encrypted, and you’re required to use the FreeStyle Libre app. You can’t transfer your real-time or historical glucose measurements to other health platforms or diabetes treatment apps.

The Libre sensor is still an invasive measurement sensor; meaning it punctures the skin which can be painful and cause infections. The Libre 3 Sensor still only lasts two weeks before you need to replace it. The time limit is partially there to lower the risk of infection and give the skin time to heal.

Abbott has publicly stated that it will match the current price of the Libre 2, the most inexpensive FGM/CGM on the market. Abbott has not announced a stand-alone reader device for the Libre 3, so you need a current model of a mid- to high-tier smartphone to use the system. The Libre 2 Reader device has also been unavailable for months, likely because of the global microchip shortage. 

The ongoing cost makes the Libre system unaffordable to many diabetics around the world. There are currently dozens of alternative noninvasive glucose monitor (NIGM) systems in development. An NIGM is the dream (and more affordable) solution. While we wait for NIGMs to hit the market, I’ll cherish a smaller CGM as a welcome improvement.

#### Sources

- Regional store listings from Abbott, 2022-03-15, Apple App Store and Google Play Store
- [FreeStyle Libre 3: Kompatibilität mit Mobilgeräten und Betriebssystemen](https://web.archive.org/web/20220314193445/https://freestyleserver.com/Payloads/IFU/2022/q1/ART43193-005%5Frev-F-web.pdf), 2022-03-09, Customer Documentation, Abbott
- [FreeStyle Libre 3: Mobile Device & OS Compatibility](https://web.archive.org/web/20220314175529/https://freestyleserver.com/Payloads/IFU/2022/q1/ART43193-006%5Frev-C%5FWeb.pdf), 2022-02-03, Customer Documentation, Abbott
- [FreeStyle Libre 3 Sets New Peak in Diabetes Care](https://www.abbott.com/corpnewsroom/diabetes-care/freeStyle-libre-3-sets-new-peak-in-diabetes-care.html?ref=ctrl.blog), 2020-09-20, Press Release, Abbott
### The HTML <meter> element and its (undefined) segment boundaries
URL: https://www.ctrl.blog/entry/html-meter-segment-boundaries/
Last updated: 2026-08-23T22:11:28.000Z
I recently found a use for the `<meter>` element: an element to represent a scalar measurement within a known range. (That’s the unappealing language the HTML Standard uses to describe a horizontal gauge bar.) However, I was dismayed to discover that different web browsers have vastly different interpretations of a vaguely defined aspect of the `<meter>` element. Here’s what I found and the workaround to get the same behavior in all browsers. 

HTML Web Applications (“HTML5”) was all the rage in 2010, and browser vendors innovated left and right. One of those innovations was the HTML `<meter>` element. It may not have been as flashy as the new input fields or `<video>` element, but it has its uses.

Browsers render the `<meter>` element as a partially filled horizontal gauge bar. Optionally, it can have colored-coded bars representing a low, medium, and high segment. Unfortunately, the different web browsers don’t agree on where the boundaries between the segments lie.

The `<meter>` element has three primary attributes. The `value` attribute set its value, and `min` and `max` set the range (0.0 to 1.0, by default). The `low` and `high` attributes sets the boundaries between the low, medium, and high segments.

The `optimum` attribute specifies which end of the range is the “good” values (lower or higher values). Browsers will render the good segment in green, less good in orange, and even less good in red.

Here’s a quick example (without the required `value` attribute):

```html
<meter
  min="0"
  low="3"
  high="7"
  max="10"
  optimum="10">
&lt/meter>
```

Browser rendering (`value="3"`):Your web browser doesn’t support the <meter> element. No demo, sorry!

Browser rendering (`value="7"`):Your web browser doesn’t support the <meter> element. No demo, sorry!

The first browser rendering (`value="3"`) is shown as a **short orange** bar in Chrome 99, Safari 15, and Firefox 98 (current versions). The second rendering (`value="7"`) is shown as a **long green** bar in Chrome and Safari, but Firefox shows a **long orange** bar.

So, why isn’t the first bar colored red and the second green in all browsers? Alternatively, why aren’t both bars orange everywhere? Both values are set on the exact segment boundary but with different results. The underlying question is where, exactly, are the boundaries for the three color segments?

The HTML Standard says [about the <meter> element](https://html.spec.whatwg.org/multipage/form-elements.html?ref=ctrl.blog#the-meter-element) that The \[low, high, and optimum\] attributes can be used to segment the gauge’s range into ‘low’, ‘medium’, and ‘high’ parts.The definition for each attribute says that the `low` attribute set the upper boundary of the low part and the `high` sets the lower boundary of the high part. 

The HTML Standard is surprisingly ambiguous on this point considering the excruciating level of details it goes to when defining the other possible attributes. It seems like the authors either forgot to specify it or assumed *the correct interpretation* was glaringly obvious.

That can be interpreted in at least three different ways. (At least two given the differing implementations.) Here’s a table of the current implementors’ interpretations plus what I believe to be *the correct interpretation*:

|                     | Segments            |                     |              |
| ------------------- | ------------------- | ------------------- | ------------ |
| Low                 | Medium              | High                |              |
| Firefox             | low \> value        | low ≤ value ≥ high  | high < value |
| Chrome/Safari       | low ≤ value \> high | high ≤ value        |              |
| Attribute Inclusive | low ≥ value         | low < value \> high |              |

Firefox’s implementation is consistent: the values of the attributes are excluded from the segments with the same name (exclusive). Like Firefox, Chrome and Safari exclude the `low` attribute value from the low segment. Unlike Firefox, Chrome and Safari include the `high` attribute value in the high segment (inclusive).

There’s an unresolved bug against the HTML Standard to clarify what’s the correct interpretation ([HTML bug #3520](https://github.com/whatwg/html/issues/3520?ref=ctrl.blog)). (No browser bugs yet as those would be pending the outcome of the standards discussion.)

I believe that the inclusive attribute interpretation is the correct one; it makes more logical sense than not that the value you specify in an attribute named after a segment should be included in that segment.

This interoperability problem probably won’t be resolved for years. In the meantime, you can use a workaround to get every web browser to behave attribute-inclusive to a high level of precision.

All the attributes are floats, so you can move the boundaries by a tiny fraction. Add 0.0000001 to the value in your `low` attribute, and subtract 0.0000001 from the `high` attribute. (A seven-digit fraction is within the precision of a 32-bit float. Use any fraction that makes sense with the data you’re visualizing.)

Web browser interoperability is at an all-time high, but that doesn’t mean web browsers are fully interoperable. Compatibility discrepancies like this one can cost hours to understand, workaround, and document. Please support my work by buying me a coffee with the link below.

#### Sources

- [Form elements](https://html.spec.whatwg.org/multipage/form-elements.html?ref=ctrl.blog), 2022-03-09, HTML Living Standard, WHATWG
### Some discouraging anecdotes on how services handle account deletions
URL: https://www.ctrl.blog/entry/account-deletions-2021/
Last updated: 2026-08-23T22:00:57.000Z
I set out to purge my password manager for unused accounts and services. I also took the opportunity to request that the companies that stored that data should delete it. The results were quite discouraging.

The General Data Protection Regulation (GDPR) came into force in May 2018\. It gave European Union (EU) and European Economic Area (EEA) citizens many new rights, including Article 17: \[the\] Right to erasure. Article 17 gives citizens the right to have companies delete their personal data. 

In late May 2021, I decided to clean my password manager vault of unused accounts and services. I had 421 entries in my password manager and managed to get it down to 297\. It took **5 hours and 10 minutes** to go through the 124 unwanted entries and figure out how to request their deletion. I also spent at least as much time over the following weeks just following up on deletion requests.

The experience was a mixed bag. I gathered some statistics along the way, and I’ll share some highlights in this article. I won’t name and shame any companies, sorry.

Many services have self-service account deletion tools, but often hide them so well that I failed to locate them without deferring to their customer support. On average, it took 24 interactions (menu clicks, password entries, etc.) *after an initial login* to request and confirm a deletion request.

87 services deleted my account within seven days without too much fuzz, sketchy practices, or long email threads. That represents 70 % of my account deletion requests. It’s not great, but I’m fairly certain the number would have been much lower before the GDPR.

58 % of emails related to account deletions (confirmations, verification, etc.) went into the spam folder. The primary cause was that the sending-server wasn’t included in their domain’s Sender Policy Framework (SPF). This configuration mistake makes the emails appear forged. These services have paid less attention to these emails compared to other emails.

I’d previously tried to delete 48 accounts in an earlier purge in June 2018\. These were still active despite either having been confirmed as deleted or having the deletion request go unanswered. (I didn’t record enough data to separate the two at the time.) Only 9 of them got deleted this time around.

28 services that had confirmed the deletion of my account lied. My username and password still worked one week after the time of the supposed deletion. 27 of these never got back to me when I contacted their customer support departments and re-requested that they delete my account.

24 services kept sending me promotional emails for at least three months after deleting my account. I have never agreed to any of these services sending my promotional emails at any point in time. The number should have been 0 before deleting my accounts, and it should have remained 0 afterward.

21 services ignored my deletion request and never got back to me. I’ve reached out to all 21 one more time after the initial contact, but I still haven’t heard back. 11 of these were smaller niche online stores.

18 services spent 14 days or longer to delete my account. The last successful request was processed 71 days after the first email. The GDPR doesn’t define “without undue delay”, but I’m fairly certain that it requires companies to not stall for over 10 weeks.

16 services automatically created a separate account for me in their customer support system when I requested an account deletion. All but two of them managed to delete my account in the end, but none of them managed to delete the new and unwanted customer support account.

12 services confirmed my request and clarified that it would take some time as their engineering team had to go in and manually delete it from the database. I’m sure engineering time to manually delete data must be more expensive in the long run than creating processes and tools for customers and customer support representatives to handle delectation requests.

10 deletion request emails were met by utter confusion on the other end. The support representatives couldn’t understand my request. No amount of explanation made any difference. Only one of these ended up deleting my account.

8 services responded to support requests to delete the account, but I couldn’t read the reply because they required me to log in to the deleted account to read the reply. It would seem no one has ever tested this process.

6 services replied through a third-party vendor and didn’t identify the service they acted on behalf of. I was able to identify the first-party service because I use a unique email address for each service. It would seem there is no end to how far businesses can take white-labeling and outsourcing.

3 services insisted I didn’t have an account on file with my email or customer number. I was met by radio silence when I sent them a screenshot of the account dashboard clearly showing I was logged in to an account with that email address or customer number.

I rechecked every deletion while writing this article. In the intervening 10 months, 2 services had restored my deleted account. I presume they’ve had to restore from an earlier backup or something. I’ve emailed both service providers about the issue, but haven’t heard back from them.

2 services moved my account to a different email address instead of deleting it. I was only able to detect this because they changed the mailbox part (the bit in front of the @ sign) but left the domain unchanged. I capture all incoming emails to my domain, so I saw email-change confirmation emails and other emails arriving at the new unexpected addresses.

1 service didn’t respond when I confronted them about only having changed the email address on my account. The other explained that they’d “deleted my account” but also “moved it to another email address”. This was in order to prevent me from receiving any emails from them in the future. Their definition of delete seemingly doesn’t involve removing the actual data from their systems. I was fed up and didn’t pursue the issue further at this point.

1 service required me to call them to process account deletion requests. They asked me to confirm my email address and said it would be deleted within a month. Three weeks later, the account no longer worked, but they didn’t email me to inform me about it.

### Some positive highlights

AMD sent me an email and required me to click on a link to confirm ownership of the email account. This step adds a level of protection to make it harder to fake an account deletion request. I hope they have a fallback in place for people who’ve lost access to their email account, though.

Hover had a system in place that required support personnel to request access to my account before they could see it. I got an email and had to click a link to grant them access to my account data. This shows that their systems are designed to limit access to personal data.
### Buggy Samsung–Grammarly keyboard update puts profit before typing
URL: https://www.ctrl.blog/entry/ime-samsung-grammarly/
Last updated: 2026-08-23T22:11:52.000Z
In my experience, text input using the software keyboard on Android has always had some quirks and issues. However, all text entry and editing of more than a couple of sentences became nearly impossible after my Samsung Galaxy S10e received the One UI 4.0 update (better known as Android 12). The problems affected almost all apps I regularly use.

For example, I place the text cursor somewhere in the middle of a document. The document would then, seemingly on its own, scroll down to the bottom or some other paragraph. I scroll back to where I want to make an edit or type something, and the document jumps back to where it wants it to be instead.

Other times, text from one sentence or paragraph gets cut and pasted into the middle of another paragraph. This behavior only happens while none of the affected paragraphs are visible on screen. So, I don’t even realize it has happened until later.

Similarly, full or partial sentences and paragraphs randomly get deleted while they’re off-screen. In some apps, I notice this issue as it happens because they show an overlay scrollbar that suddenly gets shorter while I work on text elsewhere in the document.

I’ve also had issues with text selection and the pop-over context menu that should offer options like Copy and Paste. After I’ve selected some text, the context menu won’t appear, or it’s only shown for a split second before it disappears. I had to deselect everything, begin a new text selection, and hope that it works on the next attempt.

Likewise, the password auto-fill pop-over has been incredibly unreliable in my web browser and other apps. After I tap on a password field, the webpage or app view has automatically scrolled a bit. (To center it?) The scrolling dismisses the auto-fill context menu. I then have to deselect the password field, try again, and hope it won’t move and dismiss it on the second attempt.

I’ve also had several apps stop-responding after typing more than two–three sentences. Or rather, I thought it was the app that crashed, but it was probably just the keyboard app and not the apps themselves.

Pretty annoying stuff! I’ve always misattributed these issues to the apps I use or perhaps the system. I’ve experienced variations of these issues on Android for years now. I recently discovered that these most recent issues were caused by another party.

All my problems were caused by the software keyboard itself. I’ve always thought of the software keyboard as a letter-for-letter input device, but of course, it’s a full-blown input method editor (IME). IMEs can control the input cursor position (and thereby scrolling), as well as replace and substitute symbols, words, and whole sentences.

I’ve stuck with the default Samsung Keyboard app that came preinstalled with my device. I’ve never been a fan of the alternative swipe-to-type IMEs, so it’s been good enough for my needs.

I installed the Google Keyboard (Gboard) app on a hunch and discovered that all my problems went away. Great! If you’re looking for a quick solution to the above problems, this might be it.

However, I wasn’t satisfied with just finding a solution. I wanted to understand the underlying issues. (You may be a regular reader, and this shouldn’t come as a surprise.)

I began by resetting all user data (settings, dictionary, and typing predictions and completions) belonging to the Samsung Keyboard app, and the problem went away. Weird. Okay, so this suggests it was caused by one or a combination of my preferences.

I enabled each setting one by one until I found the troublemaker. The troublesome setting was: Samsung Keyboard settings: Suggest text corrections: Writing assistant: English (US).

One of the new features of One UI 4.0 is the deprecation of the English auto-spell checker, and the introduction of the new writing assistant, powered by Grammarly. Grammarly is a machine-learning-powered spell-checking subscription service. Its sales pitch is that it checks your sentences and paragraphs in context, not just the spelling of individual words.

It’s specifically the Grammarly integration too, as there are no writing assistants available for other languages. Languages that still use the old spell-checker don’t have the same issues as English with writing assistant.

Grammarly also has a dedicated keyboard app on the Google Play Store. I wondered if it would have the same problems and hoped it could shed some light on the Samsung Keyboard problems. I installed the Grammarly keyboard and switched to it as my default keyboard.

The Grammarly keyboard didn't exhibit the same problems in the apps where the Samsung Keyboard misbehaved. It didn’t do any highlighting or anything special in the incompatible apps.

I copied a text document I knew misbehaved with the Samsung Keyboard over to the Samsung Notes app. As a first-party app, I expected that it would be updated to work with the Samsung Keyboard. The Grammarly keyboard would underline some of the text in green, indicating that Grammarly could offer a correction or a suggestion.

Interestingly, these green texts were the exact positions that the Samsung Keyboard insisted on moving the input focus! There wasn’t anything of note at those locations with the Samsung Keyboard. So, I couldn’t know that there was anything special with the text there.

The Grammarly keyboard only jumps to these positions in the text when you click the assistant button. The Samsung Keyboard doesn’t have a writing assistant button, and I guess it just interrupts your writing and automatically jumps to where it would suggest something.

I then switched back to the Samsung Keyboard to check how it behaved. It didn’t misbehave in Samsung Notes, but it didn’t offer any extra corrections and suggestions either.

> “\[Grammarly is\] only available to users of Samsung S21, S20, and S10 devices that are updated to One UI 4.0.” 

[How to use Grammarly through the Samsung Keyboard](https://support.grammarly.com/hc/en-us/articles/4407988620173-How-to-use-Grammarly-through-the-Samsung-Keyboard?ref=ctrl.blog), Grammarly 

I’ve confirmed that the issues aren’t present with One UI 4.0 and the Samsung Keyboard on devices that don’t yet have the new writing assistant. Unfortunately, the spell-checker option isn’t available on devices that were “updated” with the new writing assistant.

So, why has Samsung added Grammarly to their keyboard app? The Grammarly service subscription fees are a new revenue stream for Samsung. Grammarly pays affiliate partners 0,20 USD for referred sign-ups to free accounts and 20 USD for paid accounts. Samsung might have negotiated even more favorable terms.

I’m sure Samsung engineers are \[most probably\] aware of the app compatibility and quality concerns. In the end, the revenue potential won out over any concerns for the reliability of the keyboard app. The writing assistant works in all first-party apps by Samsung (except Messages), and I presume that was Samsung’s only benchmark.

The Samsung Community forums and Reddit are filled with complaint threads about text input issues with the Grammarly-powered keyboard. Few discussions have successfully identified the problem as the writing assistant and Grammarly. It’s an almost impossible intuitive connection to make, though.

This problem isn’t the full story, however. I’ve experienced similar issues in Android 9, 10, and 11\. Well before the Samsung–Grammarly partnership. I don’t know exactly what caused those earlier issues. It didn’t occur to me at the time that my keyboard app was to blame. I’m now better prepared to troubleshoot similar issues in the future.
### The web is overrun by pop-ups and blockers haven’t worked in years
URL: https://www.ctrl.blog/entry/pop-up-blocker/
Last updated: 2026-08-23T22:15:49.000Z
Virtually all web browsers have a built-in feature to suppress an annoyance from the early days of the web: pop-ups. However, the pop-up blockers of yesteryear no longer work on today’s web. There are pop-ups everywhere gating our entry into virtually all websites. What happened to the pop-up blocker?

To answer the leading question right away: nothing happened to the pop-up blocker. It still works mostly unchanged from how it worked over a decade ago. That’s also the problem; the pop-ups have changed but the pop-up blockers haven’t kept pace with the problem.

Just about every website you visit will display a pop-up for a time-limited coupon, email newsletter sign-up, customer support chat window, interstitial advertising, cookie disclaimer, or an intentionally confusing privacy-violation consent dialog. You’re lucky if the website only shows you one of these at the same time instead of all stacked on top of each other.

Modern pop-ups aren’t separate pop-up windows, though. They’re not opened through the — easily blocked — `window.open()` function in JavaScript. Traditional pop-up blockers work by imposing restrictions on how and when this function can be used.

The modern-day pop-overs covers up the page using a much more diverse and complex array of different layout and scripting functions. Instead, they’re overlays or pop-overs that are a part of the main website window you visit. It’s no longer enough to just impose restrictions on calls to a single function.

Interstitial dialogs blocking your view of a page is now the expectation when visiting a webpage. While these web pop-ups have become endemic, this isn’t an abuse of Web APIs: they’re all working as intended. It’s still an abuse of the time and attention of the web’s millions of end-users.

Pop-overs have their use, but it’s not in response to a pages being loaded. The timing is completely misaligned with people’s wants and needs. Who in their right mind decides “oh, I want to sign-up for this site’s newsletter!” before they’ve had a chance to browse or read a single article? Pop-overs still have their use, but only as contextual responses to user-initiated actions such as clicking or form submissions.

The most popular use for modal dialogs on the web today is the “consent dialog”. “We care about your privacy”, lie most websites in their visitors’ faces, “but we need you show you this confusing dialog for you to ‘consent’ to us violating it.” The dialogs are designed to make you blindly agree to blanket data-sharing agreements with advertisers, data-brokers, and other third-parties.

There’s no law anywhere that says websites must show their visitors these awful dialogs. The most popular of these pop-over “consent” dialogs have even [been found to be unlawful](https://www.theregister.com/2022/02/02/europe%5Fiab%5Fdecision/?ref=ctrl.blog).

The General Data Protection Regulation (GDPR) specifically requires that \[…\] the request must be clear, concise and not unnecessarily disruptive to the use of the service for which it is provided.Showing these dialogs when all you want to do is to read an article *is* unnecessarily disruptive. 

The dialogs are intentially badly designed and their repetition make you numb to the dialog’s purpose and message. How many of these dreadful things do you see every month? The instinct is to either close the page or click the biggest and brightest button.

Keep in mind that the default under the GDPR and its sibling, the e-Privacy Directive, no consent to data-sharing and no persistent cookies. “Cookies” in this context means any means storing of persistent data or identifiers on the user’s device. It doesn’t literally only apply to the Cookie API. Ephemeral/session cookies in response to explicit actions, e.g. remembering the contents of your shopping cart or login, are allowed. You don’t need to opt-out, which is why websites are desperate to fool you into opting in. The GDPR makes this perfectly clear: Silence, pre-ticked boxes\[,\] or inactivity should not therefore constitute consent. 

No harm will come to the end-user or their privacy from blocking cookie, consent, or email dialogs. To seal the deal, the GDPR specifically forbids “consent walls” — the denial of service to users who doesn’t agree to data sharing. No one wants them! They’re a plague ravaging the open web.

The technical challenge in blocking modern pop-ups is bigger than the pop-ups of the past decades. However, it’s long overdue that web browsers step up and act to protect their users’ interests. Pop-ups, pop-overs, interstitials, modal dialogs, whatever you want to call them! It’s time to ban them from the web again! At least immediately after a page load.
### Cardboard; an exciting scrollable tiling window manager
URL: https://www.ctrl.blog/entry/cardboardwm/
Last updated: 2026-08-23T22:02:58.000Z
I’ve been having a lot of fun with [Cardboard](https://gitlab.com/cardboardwm/cardboard/-/blob/master/README.md?ref=ctrl.blog), the scrollable tiling window manager (WM) (STWM) for Linux. It’s quite an unusual WM, and it’s really only at the prototype stage. After the initial learning curve, I found that it helped me stay focused on one task, and it greatly reduced how much time I spent rearranging my windows. 

You’re probably most familiar with a stacking WM; an environment where you \[mostly manually\] arrange windows next to – or on top of each other. This is what you’ll be familiar with from Windows and MacOS.

Cardboard automatically arranges all windows side-by-side on a continuous scrolling horizontal plane. As you switch between apps, either by keyboard shortcuts or by scrolling, you move left or right through the scrolling plane of windows. It’s a bit hard to describe, so I made a little demo video:

Cardboard window manager demo video

The WM isn’t suitable for day-to-day use by most users. It doesn’t support drag-and-drop and other features most people would consider being necessities. It doesn’t have any default keyboard shortcuts or a global toolbar with niceties like a clock and system power controls.

Cardboard gives you a blank slate, and you need to configure it to get a useful experience. I contributed a [quick start guide](https://gitlab.com/cardboardwm/cardboard/-/merge%5Frequests/7/diffs?ref=ctrl.blog) to the project’s documentation if you still want to give it a go.

Cardboard has its fair share of quirks and it crashes every so often. I couldn’t keep using it even though I was highly motivated and interested. I’ve moved back to using a more battle-tested traditional stacking WM for now.

What fascinated me about Cardboard was the core mechanics of its STWM. It’s super optimized for the way I work on a computer. I usually have two different apps side-by-side, something you can comfortably fit within the dimensions of a regular laptop screen.

However, I often need three things side by side, and I frequently don’t need more than two-out-of-three things side by side but with an easy way to switch between them. I also have adjacent app windows that live kind of to the side of the main apps I use.

An STWM makes this workflow a breeze. I just put my windows in order of how frequently I need to access them, and scroll side to side as my app needs changes. I feel like there’s less overhead and less distracting to switching between tasks. I also don’t find myself accidentally ending up looking at the wrong window and getting distracted.

Other STWMs include [PaperWM](https://github.com/paperwm/PaperWM?ref=ctrl.blog#readme), the inspiration for Cardboard, and [EndlessWM](https://github.com/peterfajdiga/EndlessWM?ref=ctrl.blog#readme). There are also some earlier implementations of this concept, but it would require a lot of work to get them running on modern-day Linux.

PaperWM is an extension to the GNOME Desktop; building on the project’s great work and user experience by introducing the behavior of an STWM. It might not work with your version of GNOME, however. The project has trouble keeping up with the changing environment from the upstream GNOME project.

EndlessWM is another proof-of-concept WM that closely resembles Cardboard. However, the project made an unfortunate early development decision and stagnated after an upstream dependent project ended support.
### 2-clicks to install Windows 11/10 without the third-party bloatware
URL: https://www.ctrl.blog/entry/windows-ooberegion-bloatware/
Last updated: 2026-08-23T22:25:19.000Z
When you install Windows 11 (or 10), Microsoft will preinstall additional third-party bloatware such as Candy Crush, Netflix, Spotify, and others based on your region (“inbox apps”). All you need to skip installing the bloatware is to, temporarily, choose an unrecognized region during the installation.

Depending on your device region, you’re required to click 15–30 times to uninstall the bundled bloatware on a new installation Annoyingly, some of the bloatware even reinstalls itself if you’re unlucky with the timing of background updates. With two clicks during the installation, you can prevent them from being installed altogether.

The first three questions you’re asked during the installation are your preference for language, time and currency format (region), and your keyboard or input method. ([Screenshot](https://cdn.synaps.media/control/content/images/2026/08/windows11-region-en-001.png?ref=ctrl.blog).) All it takes to avoid all the bloatware is to set the region setting to English (World) or (Europe). That’s all it takes; complete the rest of the installation process as usual.

World and European English are [not a normal format (“locale”)](https://www.ctrl.blog/entry/en-001/). Neither the Windows Installer program nor Microsoft’s servers know what to do with it, even though the installer offers it as an option. As a result, many online and some offline services, including the Out of Box Experience (OOBE) service, just don’t work.

You should expect to get an error message saying `OOBEREGION` during the installation. ([Screenshot](https://cdn.synaps.media/control/content/images/2026/08/windows11-ooberegion-error.png?ref=ctrl.blog).) This error message indicates that OOBE doesn’t recognize your region setting. You can gleefully ignore the message and click the Skip button to bypass installing any of the bundled bloatware.

After completing the installation, you should change to the correct region settings. You can change your device region from the Windows Settings app: Time and Language: Language and Region: Region: Country or Region. If you intend to create multiple user accounts on your computer, then add those before changing the region setting.

Some first- and third-party apps, including the Microsoft Store app, **don’t work** unless you select a country as your region. Preferably the country you’re in, but you can pick one on the other side of the planet if you prefer. Just don’t leave it as World or European English, or you can expect some non-obvious software breakage from time to time.

Microsoft will still install first-party bloatware such as the Office placeholder app, OneDrive, and Microsoft Solitaire Collection; to upsell you on subscriptions to spreadsheets and card games.

Additionally, your computer vendor may push bloatware to your system after the installation through the Microsoft Store. Some of this software may be useful software and device-specific feature drivers. These installs are tied to the manufacturer and model information in your computer’s firmware, and won’t be affected by changing the region.

Windows Home costs 99 USD and Professional costs 199 USD. Microsoft has already earned enough money from your license purchase, and the software giant shouldn’t need to include any first- or third-party bloatware.

Don’t want any bloatware or subscription services preinstalled on your computer? Consider installing Linux instead of Windows the next time you’re reinstalling your computer.
### How to use disposable VMs in GNOME Boxes (like Qubes, Windows Sandbox)
URL: https://www.ctrl.blog/entry/how-to-disposable-gnome-boxes/
Last updated: 2026-08-23T22:09:43.000Z
Sometimes you need a virtual machine (VM) that remembers all your settings and files. Other times, you need the opposite — a disposable VM (DVM) that is either deleted or reset when you close it. This article focuses on the latter use case in [GNOME Boxes](https://apps.gnome.org/app/org.gnome.Boxes/?ref=ctrl.blog).

DVMs are isolated sandboxes for testing, experimentation, and risqué computing. They’re useful for trying out new software, opening files from unknown/untrusted sources (such as email attachments), or just playing around to expand your knowledge of how things work (and break).

DVMs are one of *the* selling points of the [Qubes OS](https://www.qubes-os.org/?ref=ctrl.blog) Linux distribution — the distro that runs most apps and components in their own VMs. Each VM is run like a separate operating system environment built from configurable template VMs. You need to maintain and periodically update your templates just like your host system.

Qubes OS is a good choice if your need for a reasonably secure operating system outweighs your need for speed and convenience. However, it requires motivation, patience, and practice to overcome Qubes OS’ mental and maintenance overhead.

Windows Professional also introduced a similar feature called Windows Sandbox in 2018\. Windows Sandbox launches a disposable and lightweight virtual machine in seconds. The VM is built on the fly using the host operating system as the template. You don’t need to update or maintain it separately from the host system. Ars Technica has a [great write-up on Windows Sandbox](https://arstechnica.com/gadgets/2018/12/windows-sandbox-marries-vm-isolation-to-container-efficiency-to-safely-run-dodgy-apps/?ref=ctrl.blog "“Microsoft unveils Windows Sandbox: Run any app in a disposable virtual machine”"). 

As discussed in my [GNOME Boxes review](https://www.ctrl.blog/entry/review-gnome-boxes/), the app has few configuration options. It’s designed to install and run simple VMs without any fuss. That’s a limitation of the app and not the underlying virtualization technology. However, you’ll need to introduce some fuss in your workflow to set up a DVM.

You can find Linux tools that can “magically” compose a guest VM from your current host system; akin to how Windows Sandbox works. This is a highly complex solution, and you should be reading a book on VM management and not just an article to succeed with this approach. Instead, you need to follow the Quebes model with VM templates that you need to periodically update.

### How to create a disposable VM in Boxes

Begin by creating a new VM in Boxes. This VM will be your template VM from which you create your disposable VMs. Install your desired operating system, and set it up with a minimal user account.

Optionally, configure it and install necessary software such as `spice-guest` to facilitate clipboard sharing. Enable passwordless logins and other convenience features you want in the VM.

Shut down the VM and rename it in GNOME Boxes to something like “Ubuntu Linux Template”; and include today’s date in the name. I’ll get back to why this is important later in the article.

Clone the VM by right-clicking on it and choosing it from the context menu. Note that this will consume roughly the same disk space as the template VM. Don’t attempt to save on storage space by reusing the same disk image as a “backing store” for multiple VMs or do anything too clever. GNOME Boxes will delete all disks associated with a VM when you delete it from Boxes, so you risk breaking multiple VMs. Rename the cloned VM something like “Disposable Ubuntu”; and maybe include today’s date. 

Right-click on the cloned VM, choose Properties, and click the Edit XML (or Edit Configuration) button. Scroll down to the `<devices>` section and look for `<disk type="file" device="disk">`. There should only be one such disk. Add `<transient/>` inside the `<disk>` section, and Save the changes. Your changes may appear to have disappeared after you save them due to Boxes bugs [#737](https://gitlab.gnome.org/GNOME/gnome-boxes/-/issues/737?ref=ctrl.blog "“XML editor behaves erratically”") and [#752](https://gitlab.gnome.org/GNOME/gnome-boxes/-/issues/752?ref=ctrl.blog "“Restoring configuration snapshot doesn’t restore previous XML until you restart Boxes”"). Restart Boxes to confirm that it got applied. 

That’s it, really. Every time you shut down the disposable (“transient”) VM, it will reset. Note that it **doesn’t reset if you reboot it** from inside the VM. So, you can still test applying updates and processes that require you to reboot the system.

You should periodically delete the disposable VM, **update the template VM**, and make a new transient clone. Including today’s date in the name of the VMs can help you remember to do it. At least, you’ll know how out-of-date the VM is.

You can save storage space by using snapshots instead of VM clones. The process is similar but requires you to create snapshots before you make the VM transient, so you can restore to a pre-transient state to perform updates. In the long run, creating many snapshots will consume more total storage space than using a template VM and cloned disposable VM. You also lose the ability to run multiple instances by making multiple clones of the disposable VM.

I also recommend using a separate template and disposable VM because it’s a simpler workflow. It’s an easier mental model with fewer things to keep track of. It should help prevent making mistakes while the VM is in the wrong state (although the liberal use of snapshots makes it easier to revert). Bugs in Boxes, like [#752](https://gitlab.gnome.org/GNOME/gnome-boxes/-/issues/752?ref=ctrl.blog), also make it easier to work with a separate template and cloned VM.

Frankly, the user experience won’t anywhere near as good as the one Windows Sandbox provides. Mac could replicate it, but it’s a more difficult challenge with an environment as diverse as Linux. The move towards immutable operating systems and sandboxed applications, e.g. [Fedora Linux Silverblue](https://docs.fedoraproject.org/en-US/fedora-silverblue/?ref=ctrl.blog) and [Flatpak](https://flatpak.org/?ref=ctrl.blog), might negate the need for disposable VMs over time.

The best improvement we could hope in Boxes is a toggle option for switching a VM between transient and persistent state. It still wouldn’t get you all the way, but at least you wouldn’t have a workflow that involves periodically digging around in XML configuration files.
### What are sparse files and how to tell if a file is stored sparsely
URL: https://www.ctrl.blog/entry/sparse-files/
Last updated: 2026-08-23T22:22:15.000Z
Sparse files are files stored in a file system where consecutive data blocks consisting of all zero-bytes (null-bytes) are compressed to nothing. There is often no reason to store lots of empty data, so the file system just records how long the sequence of empty data is instead of writing it out on the storage media. This optimization can save significant amounts of storage space for other purposes.

On most file systems, programs don’t need to do anything special to take advantage of sparse files when it’s supported by the file system. It all depends on how individual programs use the lower-level operating system application programming interfaces (API) to save the data to a storage medium. Some programs might write out consecutive blocks of null-bytes to the disk. These programs are non-sparse-aware.

For example, every song purchased from [Apple Music includes a 0,5 MB block of null bytes](https://www.ctrl.blog/entry/apple-music-nullbytes/). Apple Music doesn’t take advantage of sparse files and writes them to disk as-is.

Better written software knows to take advantage of sparse storage, however. Sparse files are commonly supported in BitTorrent clients and virtual hard disk image files for virtualized machines. In both of these scenarios, you don’t have all the data that will eventually go into the file when it’s created. You also won’t be writing data to it sequentially, e.g. BitTorrent downloads files in randomly ordered chunks, so it also needs to write the data to disk in an unpredictable order.

There are situations where both approaches, sparse and pre-allocation, make sense. For example, pre-allocation might make sense if you’re leaving empty space in a file because your program knows it will go back and fill it in later.

Sparse storage makes sense when you plan to *maybe* write some more data in that part of the file at some time in the slight future. Sparse files are much faster to write as you can skip most of the work and delays introduced by writing empty data.

### Which file systems support sparse files

All modern file systems and operating systems support sparse files. It’s universally recognized as a beneficial feature with many use-cases. Some file systems, especially older ones, may require special handling to create sparse files.

| OS      | FS                                     | Sparse support |
| ------- | -------------------------------------- | -------------- |
| Linux   | Bachefs                                | Supported.     |
| Btrfs   |                                        |                |
| Ext4    |                                        |                |
| XFS     |                                        |                |
| OCFS2   |                                        |                |
| OpenZFS |                                        |                |
| FreeBSD |                                        |                |
| ZFS     |                                        |                |
| UFS2    |                                        |                |
| Solaris | Oracle ZFS                             |                |
| MacOS   | APFS                                   |                |
| HFS+    | Unsupported                            |                |
| exFAT   |                                        |                |
| Windows |                                        |                |
| FAT32   |                                        |                |
| NTFS    | Requires FSCTL\_SET\_SPARSE attribute. |                |
| ReFS    |                                        |                |

There’s some extra work required to use sparse files on Windows. You must first create an empty file, set the `FSCTL_SET_SPARSE` attribute on it, and close the file pointer. You then need to re-open a file pointer to the file before you can write any data to it sparsely.

It’s not a hugely complicated process, but the added complexity is enough to cause many programs to not bother supporting sparse files on Windows. Notably, closing file handlers is slow on Windows because it [triggers indexing and virus scans](https://www.youtube.com/watch?v=qbKGw8MQ0i8&ref=ctrl.blog) (video).

### How to identify sparse files

On FreeBSD, Linux, MacOS, and Solaris; you can check on a file’s sparseness using the `ls -lsk test.file` command and some arithmetic. The commands return a couple of columns; the first contains the sector allocation count (the on-disk storage size in blocks) and the sixth column returns the apparent file size in bytes. Take the first number and multiply it by 1024\. The file is sparse (or compressed by the file system!) if the resulting number is lower than the sector allocation count. 

The above method is easy to memorize and is portable across all file systems and operating system (except Windows). On Windows, you can check whether a file is sparse using the `fsutil sparse queryflag test.file` command. 

You can also get these numbers everywhere (except Windows) with the `du` (disk usage) command. However, its arguments and capabilities are different on each operating system, so it’s more difficult to memorize.

Recent versions of FreeBSD, Linux, MacOS, and Solaris include an API that can detect sparse “holes” in files. This is the `SEEK_HOLE` extension to the `lseek` function, detailed in [its man page](https://www.man7.org/linux/man-pages/man2/lseek.2.html?ref=ctrl.blog).

I built a small program using the above API. My [sparseseek program](https://codeberg.org/da/sparseseek?ref=ctrl.blog) scans files and lists how much of it is stored as spares/holes and how much is data. (I initially named it `sparsehole` and didn’t notice the problem before reading it aloud.)

### Program support

Every program that doesn’t operate at the lowest levels of the file systems should transparently support sparse files. That being said, you generally don’t end up with a sparse file when you make a copy of a sparse file. The same applies if you use a non-sparse aware program to manipulate a sparse file.

For example, a text editor may overwrite the entire contents of the file, including writing out all the null-bytes, if you make a single change to the beginning of the file. Some programs will seek to the correct position in the file, remove what’s there, apply your changes, and close the file without breaking its sparseness.

On Linux, the `cp` (copy) command will make a sparse copy of a sparse file. However, you can specify that it should attempt to make a sparse file from a non-sparse original using `cp --sparse=always`. The copy command on FreeBSD, MacOS, and Solaris doesn’t support this feature.

On a copy-on-write (COW) file system, you can [clone files](https://www.ctrl.blog/entry/file-cloning/) instead of copying them. A cloned file will preserve the sparseness (among other attributes) of the original file.

Finder on MacOS will clone files on APFS when you copy them. Nautilus and Dolphin on Linux aren’t file-system aware and will make complete and unsparse copies (even when you specifically choose Clone from their context menus).

Other classic file archival and transfer programs like `tar` and `rsync` supports sparse copies. On FreeBSD, MacOS, and Linux; you can extract tarballs in a sparse-aware way using the `-S` argument. On Linux, the same argument can create sparse tarballs as well.

You can convert any file to a sparse on any operating system (except Windows) using `rsync -S test.file copied.file`. On Linux, you can make a file sparse in-place using `fallocate -d test.file` (assuming it contains any blocks that can be stored as sparse). 

### Sparse file vs file system compression

Continuous blocks of null-bytes compress well. You can expect to get about the same on-disk savings from the null-byte regions in a sparse file and a file system that uses file system compression. As discussed earlier in the article, it can be difficult to distinguish between compressed and sparse files.

A compressing file system may be better at compressing smaller sets of null-bytes in a file with many small holes. However, the two aren’t equivalent when it comes to performance. It takes significantly more time, even with a fast processor and storage system, to write and compress all those null-bytes than it takes to never write them in the first place.

You can benchmark the difference on your file system using my [sparse vs nullwrites.rb](https://www.ctrl.blog/file/2022-02-06%5Fsparse%5Fvs%5Fnullwrites.rb) program. The test creates two test files: one 20 GB sparse and one that writes out 20 GB of null-bytes. The program also tests that the file system supports sparse storage.

On my workstation, with a fast octa-core processor and an M.2 PCIe NVMe disk, the sparse file is created in hundreds of a second and the full write takes a full 10 seconds. This benchmarking program doesn’t set the required sparse attribute in Windows.

#### Sources

- [lseek](https://www.man7.org/linux/man-pages/man2/lseek.2.html?ref=ctrl.blog), 2021-03-22, Linux Programmer’s Manual, Linux man-pages project
- [rsync man page](https://download.samba.org/pub/rsync/rsync.1?ref=ctrl.blog), 2020-09-07, Samba project
- [Copy files and directories](https://www.gnu.org/software/coreutils/manual/html%5Fnode/cp-invocation.html?ref=ctrl.blog), 2020, Documentation, GNU Coreutils, GNU Project
- [Archiving Sparse Files](https://www.gnu.org/software/tar/manual/html%5Fnode/sparse.html?ref=ctrl.blog), 2019-02-23, Tar manual, GNU
- [About Apple File System](https://developer.apple.com/documentation/foundation/file%5Fsystem/about%5Fapple%5Ffile%5Fsystem?ref=ctrl.blog), 2018-06-12, Developer Documentation, Apple
- [FSCTL\_SET\_SPARSE IOCTL](https://learn.microsoft.com/en-us/windows/win32/api/winioctl/ni-winioctl-fsctl%5Fset%5Fsparse?ref=ctrl.blog), 2018-05-12, Win32 API, Windows Dev Center, Microsoft
- [Elapsed time with Ruby](https://blog.dnsimple.com/2018/03/elapsed-time-with-ruby-the-right-way/?ref=ctrl.blog), 2018-03-28, Luca Guidi, Engineering blog, DNSimple
- [On-disk Format](https://archive.kernel.org/oldwiki/btrfs.wiki.kernel.org/?title=On-disk%5FFormat&oldid=32387&ref=ctrl.blog), revision 32387, 2018-01-23, Btrfs Wiki, Linux Kernel project
- [fsutil sparse](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/fsutil-sparse?ref=ctrl.blog), 2017-10-16, Windows Commands, Windows Dev Center, Microsoft
- [The state of the file system](https://arstechnica.com/gadgets/2011/07/mac-os-x-10-7/12/?ref=ctrl.blog), 2011-07-20, John Siracusa, Mac OS X 10.7 Lion: the Ars Technica review, Ars Technica
- [NTFS Sparse Files](https://www.ntfs.com/ntfs-sparse.htm?ref=ctrl.blog), 2010, NTFS Basics, LSoft Technologies
- [The return of SEEK\_HOLE](https://lwn.net/Articles/440255/?ref=ctrl.blog), 2011-04-26, Jonathan Corbet, LWN, Eklektix
- [NTFS Sparse Files For Programmers](https://web.archive.org/web/20060222050807/http://www.flexhex.com/docs/articles/sparse-files.phtml), 2006, Tutorials and Articles, Inv Softworks LLC

CSS Webdesign Tidbit: Chrome and Safari gets the height calculation wrong on some cells that intersect in the above table. Take a moment to inspect the problem with your browser’s developer tools.
### How a Hypercore P2P innovation could bring more privacy to IPFS
URL: https://www.ctrl.blog/entry/dht-privacy-discovery-hash/
Last updated: 2026-08-23T22:04:59.000Z
The InterPlanetary File System (IPFS), like many other peer-to-peer (P2P) file-sharing networks, has a privacy problem. IPFS clients constantly broadcast what they want to download and what is available for upload. Anyone that can observe your network traffic, like an internet service provider (ISP) or other snoops, can see what you’re sharing.

IPFS clients exchange data over encrypted connections. That’s currently a meaningless privacy precaution when it’s so trivial to determine what’s being transferred. This is a fundamental problem with how IPFS is implemented.

Every file on IPFS is described by a cryptographic hash; a one-way operation that results in a long string of numbers and letters. IPFS calls these hashes Content Identifiers (CID).

The same content always produces the same CID, and even the tiniest modification always produces a completely different CID. It’s [mindbogglingly unlikely](https://www.brainvitamins.net/blog/ipfs-hash-collisions/?ref=ctrl.blog "“IPFS Hash Collisions”") that different content, coincidentally or deliberately, should result in the same CID. This technology is the same principle used in BitTorrent Info-Hashes (BTIH). IPFS uses the newer SHA-256 hash function. BTIH uses the older SHA-1 hash, which is vulnerable to deliberate hash collisions. BitTorrent 2 switches to SHA-256 but isn’t widely supported yet. 

To download a file over IPFS, you can’t just vaguely ask an IPFS client to “send me that one funny picture of a cat”. You need to know its CID. So, you either need to already have an exact copy of the data to generate the CID, or someone must have shared the CID with you. Keep the CID secret and no one but the people you share it with knows to request your secret files. Except, IPFS doesn’t keep CIDs a secret.

To discover peers, other clients who already have or want a file, IPFS, like other P2P networks, turn to the Distributed Hash Table (DHT). DHT is a massive database of who has what and where they are on the internet (their IP address). The database is self-organizing, and it’s hosted distributively among all the participating clients. It’s the same technology used in BitTorrent and most other P2P systems.

Crucially, DHT network traffic is unencrypted, and the entire database is public anyways. Anyone monitoring your network traffic can observe the CIDs you’re downloading and the CIDs you’re sharing on the DHT. Anyone capable of monitoring the DHT at scale can get a complete picture of what CIDs are available and mass-download everything.

It’s a fundamental requirement that means nothing you do on IPFS or BitTorrent can truly be kept private. Except, the [Hypercore Protocol](https://hypercore-protocol.org/?ref=ctrl.blog) (formerly known as the Dat Protocol) found a better way to do DHT and introduce some sorely needed privacy protections. Hyprecore is yet another alternative to IPFS and BitTorrent, and it uses many of the same technologies.

Hypercore’s innovation was to stop broadcasting its version of a CID publicly to the DHT. Instead, it runs the hash (the “content hash)” through the same one-way cryptographic hashing operation one more time. It broadcasts the resulting hash-of-a-hash (the “discovery hash”) to the DHT instead of the original hash.

To download a file over Hypercore, you need to know the content hash. Without the original content hash, you can’t generate the discovery hash, and you won’t know which hash to ask other clients to transfer. Once you’ve found some peers using the discovery hash, you establish an encrypted connection to them and request the content hash. The clever trick results in a layer of privacy that means that only someone who knows the content hash can request a copy of the content.

You fundamentally can’t hide from other peers who’re already in on the secret, though. Technically, you can hide from other peers using slow and convoluted onion routing. See [Tribler’s take on BitTorrent](https://www.ctrl.blog/entry/tribler-onion-routed-bittorrent/). For a P2P network to function, peers must be willing and able to exchange data with each other. Hypercore effectively keeps snoops out of the loop, however. 

The discovery hash also strikes a nice balance between privacy and law enforcement needs. They can monitor the DHT to find unlawful content only after the content has been identified through good old-fashioned police work. Cease one criminal’s computer or files, and you can find out who else is offering the offending content on the network.

When combined with peer-connection encryption, which IPFS already has, you get fairly good privacy protections. It’s a small change with a big impact. IPFS, BitTorrent, and other implementations of P2P networks definitely should implement this system. It allows for the use of peer-to-peer file-sharing tools for more use-cases, such as more private sharing swarms and direct transfer of private data between your devices.

The added privacy protection is a must for IPFS to succeed as a replacement for HTTP on the web. The [Brave web browser supports IPFS](https://www.ctrl.blog/entry/brave-ipfs/). Opera also has some limited support for IPFS. The discontinued Beaker Browser supports Hypercore. The discontinued [Maelstrom browser supported BitTorrent websites](https://www.ctrl.blog/entry/bittorrent-maelstrom/). The [Agregore](https://agregore.mauve.moe/?ref=ctrl.blog) P2P concept browser supports all three protocols and more.

#### Sources

- [Privacy and encryption](https://docs.ipfs.io/concepts/privacy-and-encryption/?ref=ctrl.blog), 2021-11-24, Documentation, IPFS
- [Content addressing and CIDs](https://docs.ipfs.io/concepts/content-addressing/?ref=ctrl.blog), 2021-06-12, Documentation, IPFS
- [How Dat Works](https://dat-ecosystem-archive.github.io/how-dat-works/?ref=ctrl.blog), 2019-01, Duncan Keall, Dat Protocol project, GitHub
### Font-independent pixel-perfect negative CSS text-indents
URL: https://www.ctrl.blog/entry/css-negative-text-indent/
Last updated: 2026-08-23T22:04:11.000Z
The CSS `text-indent` property is used to offset the first line of text in a text block from the parent element’s inner box (the content area). It behaves like the `padding-inline-start` property, but only for a paragraph’s first line of text. It’s meant to allow your design to e.g. indent the first line to designate the start of a new paragraph (a more compact alternative to separating paragraphs by empty lines).

The `text-indent` property has some additional uses with negative values. In this article, I’ll explore how the property can be used to implement hanging punctuation and list item markers. I’ll also discuss how difficult it is to know how many pixels to subtract for the desired effect, and how you should implement it instead. Some familiarity with CSS syntax, layout concepts, and common properties is assumed.

The CSS Text Module includes a `hanging-punctuation: first` property. It’s meant to let leading paragraph punctuation, such as opening quotation marks in a blockquote, be hung adjacent to the first paragraph but be outside the content area. This effect lets the text itself maintain a rigid line against the left-side gutter. 

The `hanging-punctuation` doesn’t indiscriminately hang the first character or punctuation mark in front of a paragraph’s inner box. Instead, it’s restricted to only apply the effect on a set of language-specific punctuation marks — a behavior that can lead to unpredictable and undesirable results. At the time of writing, and for the last seven years, only Safari has implemented the `hanging-punctuation: first` property. That is unlikely to change in the slight future.

As we can’t rely on that property, the `text-indent` property using a negative value can get the job done instead. That raises the question: how much negative indentation do you need? The answer is `1ch` (the width of a single 0-character) when using a fixed-width (monospace) font. For proportional fonts, the question is a lot more complicated to answer.

The fundamental problem is that different characters have different widths across different typefaces. Different font rendering software, properties of the display technology, and typefaces influence the rendering pipeline and yield different results through rounding decisions and tolerance accumulation. The larger the type, the bigger the variation.

The problem is compounded when using a font stack consisting of system-provided fonts, as these will differ greatly between devices (especially between Android and anything else). You simply can’t know the exact width of e.g. a double-opening quotation mark to a subpixel-perfect precision.

You can approximate a value based on what you see on your screen and use font-relative CSS length units like `em`. In CSS, the `1em` is equal to the element’s `font-size`. In traditional typesetting, the unit referred to the width of a typeface’s “M” character at a given point size. It’s probably good enough to create a simple hanging punctuation effect. The result won’t be the same and some end-users will see different levels of drift from your intended design. 

You’ll see this problem more clearly in a list of items with numbered markers in front of them (e.g. the HTML `ol` (organized/numbered list) element. The numbers in proportional fonts have varying widths; e.g. the numbers 4 and 7 are often wider than 2\. Numbers with multiple digits are wider still. Despite the varying widths, HTML lists maintain a rigid edge against their left gutter.

Hmm, but wait. How do HTML lists solve this problem? To quote the current working draft of the [CSS Lists Module specification](https://www.w3.org/TR/2020/WD-css-lists-3-20201117/?ref=ctrl.blog), CSS does not specify the precise location of the marker box or its position\[.\]The draft specification goes into more details, but ultimately clarifies that \[the marker position specification\] is handwavey nonsense \[and\] needs a real definition.The behavior of list item markers is achieved through consensus among web rendering engines, and not through the standards efforts of the CSS Working Group. 

You can inspect a list item and a list item marker using the built-in web developer tools in a web browser. However, you won’t find any positional or dimension properties affecting the marker in the browser’s default style sheet. The HTML list predates CSS, and 25-years later, it has yet to define how you change the spacing between a list marker and a list item. The spacing between a list item marker and the list items is a single space character (Unicode U+20). You can only manipulate the distance by changing the `font size`, `letter spacing`, or `font-family` properties. 

So, let’s recreate list markers using CSS. This should give us something that can be used as hanging punctuation and a custom block box that behaves as a list-item box. Attempting to do this with just negative text indentation doesn’t work as we don’t know the width of the character(s) we’re offsetting. As CSS doesn’t provide any functions for measuring character widths, let’s make the length a known quantity instead.

To achieve a known width for the marker, we create an inline-block element for it. This element can be a `::before` pseudo-element and CSS generated content, as used in the below example, or a real element containing the desired character or content. Although tempting, you can’t use a cheeky `::first-letter` pseudo-element to implement this. That pseudo-element only supports a limited set of CSS properties. We then give that element a fixed width and right-align its content to move it snugly up to the main content. 

Right-aligning the contents of the inline-block element — whether it’s a bullet, punctuation mark, or number — is the real trick to this technique. It negates the need to size the inline-block element precisely to its contents.

For the container, set a left padding and a negative text indentation with a value equal to the width of the inline-block element. The left padding ensures subsequent wrapped lines of text aligns to the same gutter. The negative text-indentation accounts for the inline-block element’s width on the first line

Below you can find all of the above combined into one example stylesheet. The result is a close approximation of how HTML lists work, but it’s also suitable for implementing hanging punctuation. You can use a CSS Counter to implement an ordered/numbered list using the same method. Unlike HTML lists, you get full control of the spacing between the marker and the list item contents. The example uses CSS variables to ensure it uses the same dimensions everywhere instead of relying on magic numbers. “Magic numbers” is a programming term that refers to unexplained, often repeated numbers, in source code. 

```css
.list-item-box
{
--left-gutter-width: 2em;

  display: block;
  padding-left: var(--left-gutter-width);
  text-indent: calc(
    0px - var(--left-gutter-width)
  );
}

.list-item-box::before
{
--marker-spacing: 0.25em;

  content: '•';
  display: inline-block;
  margin-right: var(--marker-spacing);
  min-width: calc(
    var(--left-gutter-width) - var(--marker-spacing)
  );
  text-align: right;
}
```

Alternatively, you can forgo the negative text indentation and left padding on the container box, and rely on a negative right margin on the inline-block element. This method is less reliable, though, as this layout doesn’t account for the space taken up by the inline block element. You generally want to avoid unaccounted for negative values in your layouts.
### GNOME Boxes review: no-frills and no-thrills desktop virtualization
URL: https://www.ctrl.blog/entry/review-gnome-boxes/
Last updated: 2026-08-23T22:18:26.000Z
[GNOME Boxes](https://apps.gnome.org/app/org.gnome.Boxes/?ref=ctrl.blog) is an easy-to-use graphical virtual machine (VM) installer and launcher. It’s not a VM manager and offers practically no settings for micromanaging your VM. However, its easy-to-use design philosophy can also prevent its users from getting any use out of it.

Boxes is built on top of Linux’s excellent KVM+QEMU/libvirt virtualization stack. The app is intended for users who’re overwhelmed by such alphabet-soups and just want to run a visualized operating system. 

KVM is a virtualization system from the Linux kernel project. You can expect high performance and a smoother upgrade experience compared to third-party alternatives like VirtualBox. QEMU and libvirt add management layers on top of KVM. Boxes sit on top of these tools.

You’ll likely find references to Boxes being used to manage remote desktop sessions to remote machines. This functionality has been moved into the new [Connections app](https://apps.gnome.org/app/org.gnome.Connections/?ref=ctrl.blog). I believe it was a good decision to split the two use cases into separate apps. Connections looks and behaves almost identically to Boxes.

The app is great for managing virtual machines with other recent versions of Linux. Everything works out of the box if you choose one of its presets for popular Linux distributions. You’re presumably already running Linux, so the end-users are maybe more likely to want to emulate Windows?

For everything outside the Linux presets, you may need to manually download and then install SPICE guest tools and VirtIO drivers inside your VM. SPICE and VirtIO powers Boxes’ integration with the host. They provide niceties such as clipboard-sharing and automatic screen resolution. Frustratingly, Boxes suggests a download link to these downloads that bundles five years out-of-date drivers! Here are links to the latest versions of [virtio-win-gt.msi](https://fedorapeople.org/groups/virt/virtio-win/direct-downloads/stable-virtio/?ref=ctrl.blog) and [qemu-ga.msi](https://fedorapeople.org/groups/virt/virtio-win/direct-downloads/latest-qemu-ga/?ref=ctrl.blog) for Windows. These are very difficult to locate! Unsurprisingly, the older drivers don’t work with recent versions of Windows 10 and 11\. 

The app offers a grid or list view of your installed virtual machines, much like the app overview in GNOME’s Activities screen. The screen is empty by default, but a single button-click is all it takes to get going. Boxes offer you a selection of operating systems that it can automatically download and install. Just select your preferred Linux or BSD-based operating system and it’ll do the rest.

Boxes will try to auto-detect the installation media (the “Live CD”) and pick compatible virtualization options behind the scene. You can also provide it with an ISO for other operating systems, including Microsoft Windows. Anything from the built-in list gets recognized, but you might not be so lucky with other operating systems.

The lack of configuration options is both Boxes’ blessing and its curse. It relies on [libosinfo](https://libosinfo.org/?ref=ctrl.blog)’s `osinfo-db` to recognize whatever you’re trying to install and come up with the right options to give the underlying virtualization technologies. The problem with this library — besides it not always agreeing with your virtualized hardware preferences — is that it’s moving slower than the market.

It took two and a half years after the public release of Windows 10 (three and a half years after the first public betas) before installs in Boxes had working audio. It [incorrectly set up Windows 10 VMs](https://www.ctrl.blog/entry/how-to-win10-in-gnome-boxes/) with a legacy audio device instead of a newer compatible device. The underlying technology had been there for years, but it didn’t fulfill its promise to auto-configure the VM. Users couldn’t easily set up, troubleshoot, and fix the problem by adjusting their VM configuration.

Boxes has since added a somewhat mysterious-looking Edit XML button that lets you make adjustments to your VMs. (This button will be called Edit Configuration in a future version of Boxes.) I’ll get back to this later in the article. 

We’re over six months since the first public beta release of Windows 11 and over three months since the final release. Windows 11 refuses to install on legacy BIOS systems and demands hardware with UEFI, secure-boot, and a TPM 2 enabled. 

The technologies/acronyms demanded by Windows 11 are *mostly* supported by the underlying virtualization technology. There are some issues, however. KVM doesn’t currently support snapshotting UEFI VMs. Boxes gives a generic error message when attempting to snapshot a UEFI VM. The Flatpak sandboxed version of Boxes doesn’t currently support TPM emulation. The runtime is missing the `swtpm` emulator. 

Regardless of the limitations with the underlying virtualization technology, Windows 11 can still be made to run in Boxes. It runs well, too, with good performance and system integration comparable to what’s available to Windows 10 VMs. Yes, you can’t take snapshots and you can’t install Windows 11 in the Flatpak version of Boxes. But it works!

Windows 11 support in Boxes is held up by `osinfo-db` not recognizing it as Windows 11 and suggesting a conservative Windows 10 setup. The setup doesn’t emulate a TPM and uses a legacy BIOS instead of UEFI; likely because of the snapshot limitation.The world’s most popular consumer operating system isn’t recognized nor supported months after its release. It wouldn’t be a showstopper if Boxes had offered a few configuration toggles for changing a few common compatibility settings. 

> “You want to install Boxes if you just want a very safe and easy way to try out new operating systems or new (potentially unstable) versions of your favorite operating system(s).”

Boxes doesn’t quite live up to the marketing copy on its homepage.

The “leave the hard stuff to us” design philosophy falls apart as soon as things don’t work or it isn’t fully supported. The Windows installer gives clear instructions on its hardware requirements. You can adjust your configuration to match if you’re using another one of the front-ends for Boxes’ virtualization technology. Yes, this involves making compromises, but letting the user make a few compromises is better than leaving them with nothing.

You can access more advanced configuration options for your Boxes VMs using tools like `cockpit-machines` (web interface), `virsh` (command-line), `virt-manager` (graphical), and `virt-xml` (command-line). The Flatpak version of Boxes only includes `virsh`. Tools external to the runtime can’t connect in to its QEMU session. Each of these tools are very different and offers very different levels of VM configuration (sorted from least to most). You should still be able to launch the VM from Boxes after adjusting its settings in another compatible program. 

Boxes does let you directly edit the XML configuration document of your virtual machines if you need to make adjustments. This is an option for Advanced (with a capital A) users only. A typical configuration document consists of 200+ lines describing the deep technical details of your virtual machine. You can expect that it’ll take you a few days to read the required documentation to learn about all the possible settings and their accepted values.

Boxes could include a better option for deferring its users to a more capable tool for advanced settings. The ability to edit the XML configuration is nice, if you know what you’re doing (or you’re following a tutorial). However, you can’t edit the configuration or set any options before the VM is created. Which is too late when it comes to things like picking between UEFI and BIOS boot modes.

Boxes gets bonus points for providing a full log for each virtual machine. The log is provided inside the properties dialog per VM. This addition might not sound important, but it’s a lot easier to troubleshoot a problem when you have detailed logs instead of a one-sentence generic error message. (I’m looking at you, Hyper-V!)

When everything is working, and the VM has all the required emulation drivers and guest tools, then Boxes is great! Copy-and-paste between the guest and host works predictably, folder sharing is a nice touch, and everything will run within the performance capabilities of your hardware. It’s an excellent virtual machine launcher. You might just want to keep another compatible VM management tool at hand, for the situations that Boxes can’t handle by itself.

**Reviewed:** [Boxes](https://apps.gnome.org/app/org.gnome.Boxes/?ref=ctrl.blog)

**Review rating:** 6 / 10
### Why HTML table cells won’t fit into your CSS baseline grid
URL: https://www.ctrl.blog/entry/css-table-cell-grid/
Last updated: 2026-08-23T22:04:12.000Z
A baseline grid design is a fancy way of describing a page design laid out like on lined paper sheets. (The lines are not visible, of course.) It’s the art of ensuring your design and text maintain a rhythm and the same visual pacing throughout the page by using consistent line heights and spacing.

It just takes a bit of practice to stay within the lines when you’re writing on paper It’s also easy with CSS, until you meet rigid pixel-design elements like figures, images, and tables. In this article, I’ll demonstrate how to align the text in your tables with your baseline grid. I’ll also explore why it’s so difficult with tables in particular. It should easily fit with some adjustment, but the eccentricities of CSS Table Layout will fight you to the bitter end. It’s just rows of text, right?

You can quickly get most of your text to follow a baseline grid by setting the top and bottom margins of your paragraph, list, and other phrasing content to the same value as your `line-height`. CSS collapses overlapping margins. Using the below stylesheet, the distance between two neighboring `p` elements is 1,5 em not 3 em. That’s it. Here’s a quick cheat sheet to get you started: You’d normally set the document’s `line-height` on the document root element and not on individual elements. 

```css
p, ol, ul
{
  line-height: 1.5em;
  margin-top: 1.5em;
  margin-bottom: 1.5em;
}
```

Headlines and content larger than one line require some more planning to account for. There are many guides and different techniques that go deeper into baseline grids. However, I want to focus on a difficult outlier: the CSS Table Layout module.

We all stopped laying out our designs with HTML tables in the early 2000s. The many accessibility problems were never enough to kill the practice completely, but the mobile-first world has now firmly put the last nail in table designs. It’s now even a social faux pas in webdesign circles to even prototype using tables!

Except that tabular data is still best presented using a table. Datasheets, product details, research papers, news articles, and even press releases include lots of tables. We still need tables! Unfortunately, the CSS Table Layout module is stuck in the past and many CSS innovations have left it behind (or worse, undefined).

So, what’s the problem then? The fundamental problem we want to overcome is that borders add to the line height. You need to account for, say 1 px, worth of borders between each table cell. In this article, I’ll only discuss the collapsed-borders mode (`border-collapse: collapse`). The separated-borders mode is similar, but it isn’t suitable for the type of grid-based layout discussed here. 

In the regular [CSS Box Model](https://www.w3.org/TR/css-box-3/?ref=ctrl.blog), you’d simply remove the same number of pixels from your top and bottom margins. This does **not** work for table cells, however. The cells don’t have any margins. Nevertheless, here’s a quick example of that technique. I’ll use CSS variables (defined with the double-dash prefix) to avoid repeating magical numbers.

```css
p
{
--text-height: 1.5em;
  line-height: var(--text-height);

--vertical-margin: var(--text-height);
  margin-top: var(--vertical-margin);
  margin-bottom:  var(--vertical-margin);
}

p.with-border
{
--border-thickness: 1 px;
  border: var(--border-thickness) solid black;

--bordered-vertical-margin: calc(
    var(--text-height) - var(--border-thickness)
  );

  margin-top: var(--bordered-vertical-margin);
  margin-bottom:  var(--bordered-vertical-margin);
}
```

It’s a bit messy, but it’s easy enough to understand and implement. When you add 1 px on the top and bottom; then you need to remove 1 px from the margin as well. Likewise, if you add 4 px internal top and bottom padding inside the border; then you remove the same pixels from the *margins*.

Tables consist of many rows, each with its own collapsed border. The collapsed-borders mode disables cell spacing (margins), and collapses intersecting borders into one. You get a 1 px border between two cells even when each cell is styled with 1 px on all sides. You can try the same technique as above, but it doesn’t work well with an undefined number of table rows. No, CSS Counters won’t save you. You can’t use them as an input to `calc()`. At some point, you’d run out of vertical margin to subtract pixels from. 

Tables are uniquely difficult to style in CSS because of the many limitations of the CSS Table Model. The [CSS Table Model specification](https://www.w3.org/TR/CSS22/tables.html?ref=ctrl.blog) (draft) says, In CSS \[…\] the height of a cell box is the minimum height required by the content.In practice, it means that the height of a table cell can’t be constrained. Furthermore, a table cell’s height is determined by: `line-height × n-lines of text`. The border, height, and padding properties can also increase, but not decrease the cell height. 

One way to tackle it is to remove 1 px from the top margin (to account for the topmost border), and then to reduce the line-height of each cell by 1 px (to account for each cell’s bottom border). That works fine as long as no cell wraps onto multiple lines. Then you’ll be 1 px short per wrapped line in your table. You can’t know beforehand how many lines your text will wrap to on all devices, so this is an unstable approach. I’ll get back to this technique later in the article.

However, a modified version of the line-height adjustment technique will get the job done. We only need to reduce the line-height by a pixel per cell. You can be a bit cheeky and only reduce the line height of the first line in each cell! Luckily, the first line of each cell gets pushed down 1 px, and luckily CSS has a `::first-line` pseudo-selector. There are quite a few caveats to deal with still, but here’s the solution so far:

```css
table
{
  border-collapse: collapse;
--border-thickness: 1 px;

--text-height: 1.5em;
  line-height: var(--text-height);

--vertical-margin: var(--text-height);
  margin-top: calc(
    var(--vertical-margin) - var(--border-thickness)
  );
  margin-bottom: var(--vertical-margin);
}

table th,
table td
{
  border: var(--border-thickness) solid black;
}

table th::first-line,
table td::first-line
{
  line-height: calc(
    var(--text-height) - var(--border-thickness)
  );
}
```

The above works well in Chrome 97 and Safari 15, but not in Firefox 96\. The key difference between the two is that Chrome resizes the table cells based on the actual contents and collapses its height to 1.5 em - 1 px. Firefox sizes the table cell based on the parent row’s line height (1.5 em) even though the content is 1 px shorter.

The CSS Working Group decided in January 2021 that [Chrome’s behavior is correct](https://github.com/w3c/csswg-drafts/issues/2282?ref=ctrl.blog). Firefox has yet to [fix its implementation](https://bugzilla.mozilla.org/show%5Fbug.cgi?id=1686513&ref=ctrl.blog) to match Chrome’s behavior, however. Unfortunately, even if Firefox caught up with the competition, the above technique wouldn’t offer a pixel-perfect solution.

The `::first-line` pseudo-selector isn’t as useful in practice as it might appear. Besides not working as expected in Firefox, it won’t work with all content in Chrome and Safari. The pseudo-selector can only select from its first directly descendant text nodes. E.g. the `p::first-line` of `<p>I <em>like</em> CSS</p>` will always select “I”; as that’s the first text node. (A new element marks the start of a new node.) That’s fine if you know beforehand that your tables will never contain any flow/formatting elements. However, you know you’ve strayed off the right path when you’re starting to impose restrictions on the content. 

So, while the above technique can yield pixel-perfect results; it’s too poorly supported and unpredictable. I recommend compromising in a way that produces predictable results in all browsers under the same conditions. That doesn’t leave many options with the limited set of attributes supported in the table model.

In my opinion, the best technique is to reduce the line height on the table rows (`tr`) instead of on the `::first-line`. As previously discussed, you’ll be 1 px short of the grid per line of line-wrapped text. This is the best compromise that’s possible given the current limitation of the CSS Table Model. Here’s the final stylesheet:

```css
table
{
  border-collapse: collapse;
--border-thickness: 1 px;

--text-height: 1.5em;
  line-height: var(--text-height);

--vertical-margin: var(--text-height);
  margin-top: calc(
    var(--vertical-margin) - var(--border-thickness)
  );
  margin-bottom: var(--vertical-margin);
}

table tr
{
  line-height: calc(
    var(--text-height) - var(--border-thickness)
  );
}

table th,
table td
{
  border: var(--border-thickness) solid black;
}
```

This is your best option and *as good as it gets* without involving JavaScript. Anything is possible with JavaScript, such as appending a block pseudo-element into each cell to account for the pixels lost to the reduced line-height inside each cell. Not to suggest you do that! It would be bad for page performance and trigger reflows and layout recalculations per row in your table.

If you insist on pixel-perfect results, you can get there by wrapping all content inside your tables in inline-block elements. With this setup, you can reduce the box’s height by 1 px and hide its overflow. There’s nothing inherently wrong with this approach, but it requires you to change the markup of all your tables to introduce the extra elements. That’s either a feasible option or a lot of extra work, depending on how your tables are created.

You can get to the desired result, but it’s probably not worth the implementation overhead. Alternatively, you could always consider removing the table borders entirely. That would resolve the root cause of the problem, but also compromise your table’s legibility.

Whatever you choose, make sure that your font-sizes, line-heights, and border-widths use integer values. Otherwise, rounding errors can accumulate over a few dozen lines of text and ruin your baseline grid. For whatever reason, the collapsed borders of the CSS Table layout seem to be especially prone to this effect. Browsers cope much more consistently and reliably with integer values than floats; even on devices that apply fractional display scaling.
### Your browser lies: the web isn’t written in your native language
URL: https://www.ctrl.blog/entry/translated-web-languages/
Last updated: 2026-08-23T22:23:32.000Z
Most webpages aren’t written in your native language; despite the entire web being available to you in your language. However, many web surfers don’t seem to realize that they’re reading machine-translated pages instead of the originals.

Over the years, I’ve received hundreds of complaints in foreign languages about the poor quality of my writing in their respective languages. Except, I’ve never written a word in their language. I often can’t even identify the language without running it through a translation service!

I also see this anecdotal evidence of this all over the web. There’s always that one person in a discussion forum, open-source project, article comments, and social media thread that comments in a different language to everyone else. It’s nothing but a small faux pas, but one that might not be the commenter’s fault.

Both the Google Chrome and Microsoft Edge web browsers machine-translate visited pages on the fly. (Firefox and Safari are working on similar features with limited market roll-outs.) It’s not always clear to the reader that they’re reading a machine-translated version. There’s just a small icon in the address field to indicate that the page has been machine-translated.

I’m not arguing against machine translations as a great tool that lowers language barriers and makes information available to more people. They’re great tools and enablers of more communication across language barriers. Except, I believe that the designs of modern web browsers shift the language barrier from the sender to the receiver.

What am I supposed to do with a reader comment or an email in a language I don’t understand? I don’t know what it says, so I can’t know if it contains secrets or personal information. I can’t upload what people send me into an online translator without knowing what it contains.

On-device translation software isn’t really a thing. You can’t sell it as a software-as-a-service offering, so the market hasn’t had any interest in developing it. The European Union funding has recently led to Mozilla and partner universities working on an [open-source on-device translator](https://browser.mt/?ref=ctrl.blog). It currently only supports translating between a few languages, and won’t solve my problem in the foreseeable future.

I wanted to display a notification message to readers of machine-translated versions of my articles to indicate that they weren’t reading them in their original language. Unfortunately, translated pages use an unstandardized rendering mode. There are no APIs for identifying when a page has been machine-translated.

I don’t quite know what I’d want those APIs to look like or do. Perhaps a CSS media query like `(page-variant:machine-translated)`? The media query can be used to show a message to readers viewing a translated version of a page. This could be especially useful near forms.

Speaking of forms, [form input validation](https://developer.mozilla.org/en-US/docs/Learn/Forms/Form%5Fvalidation?ref=ctrl.blog#using%5Fbuilt-in%5Fform%5Fvalidation) should also be extended to handle language requirements. A form could then indicate what languages it accepts, and the browser could assist users in filling out the form using the required language.

Two years ago, I looked for methods to [detect when a webpage had been machine translated](https://www.ctrl.blog/entry/detect-machine-translated-webpages/). I only found implementation-specific detection methods that can slow down the browser on long or complex documents. The detection methods weren’t reliable enough to detect when browsers or other translation software had modified my pages.

That investigation did lead to some improvements, though. I managed to cut roughly 40 % of the complaints about poor-quality machine translations by improving [the HTML semantics](https://www.ctrl.blog/entry/html-semantic-improve-machine-translation/) of the code snippets and machine instructions I publish. It required some time-consuming technical changes to let translators know what parts of a document not to translate. E.g. they know not to translate commands, functions, path names, and the like.

However, the remaining complaints are about the poor quality of the translated texts. I don’t know what to do about those complaints. English isn’t my first language, but I believe the articles I publish are fairly understandable and well-written. The machine translations might improve if I somehow further improved my writing. However, I’m not ready to accept the blame for the poor machine-translation services offered by my readers’ web browsers.

I believe that the underlying problem is that web browsers fail to properly communicate to their customers when they’re reading machine-translated pages. People get the wrong impression and expectations of a translated page when they don’t know it’s machine-translated.

Web browsers should offer to translate form submissions into the page’s original language. The browser already knows that it has translated the page, but it fails to live up to user expectations when it fails to translate form submissions back into the page’s language.

You wouldn’t expect a response from a French bakery if you wrote to it in Swedish. An Italian or Polish comment won’t be welcomed in the middle of a long English discussion thread. Yet, this is what we see all over the web today.

I don’t believe it’s intentional, though. People don’t understand that the web isn’t written in their native language. Their web browsers distort their world-view to a point where everyone speaks a mock version of their preferred language.
### Bing stops accepting Sitemap pings, switch to IndexNow instead
URL: https://www.ctrl.blog/entry/sitemap-ping-indexnow/
Last updated: 2026-08-23T22:21:59.000Z
The Microsoft Bing search engine has quietly stopped accepting XML Sitemap pings over the holiday break. [XML Sitemaps](https://sitemaps.org/?ref=ctrl.blog) are a structured data format that contains a list of a website’s primary pages. Websites can proactively ping search engines when they publish changes to request that the search engine come and index their new pages.

Sometime between December 14th and 22nd, Bing stopped accepting new ping submissions to its XML Sitemap Ping service. The API endpoint at `bing.com/ping` now returns an HTTP 410 Gone error message. The error message suggests deliberation and permanence (as opposed to an intermittent problem (HTTP 500) or an HTTP 404 Not Found).

**Update** (2022-05-14): Bing today published a [blog post announcing the deprecation](https://blogs.bing.com/webmaster/may-2022/Spring-cleaning-Removed-Bing-anonymous-sitemap-submission?ref=ctrl.blog "“Spring cleaning: Removed Bing anonymous sitemap submission”") of the `bing.com/ping` API. The announcement says it’s deprecated “starting today”. However, readers of my blog will know it stopped working five months ago.

[Bing’s XML Sitemap documentation](https://www.bing.com/webmasters/help/Sitemaps-3b5cf6ed?ref=ctrl.blog) for webmasters still suggests pinging Bing using the removed API endpoint. It hasn’t communicated the removal in Bing Webmaster Tools, through their blog, nor on Twitter.

Bing has a second and undocumented API endpoint for sitemaps. The secondary API endpoint is only referenced in a few blog posts from Bing published over a decade ago. The alternate `bing.com/webmaster/ping.aspx` endpoint still works. However, this API endpoint is only intended for submitting new sitemaps to Bing, and not to notify it about changes to existing sitemaps.

Baidu removed their XML Sitemap Ping API in 2017\. The same year, Yandex also removed any mention of their API from their webmaster documentation. Yandex’s API endpoint at `webmaster.yandex.com/ping` still works, though. Google’s XML Sitemap API at `google.com/ping` is [documented](https://developers.google.com/search/docs/crawling-indexing/sitemaps/build-sitemap?ref=ctrl.blog) and also continues to work.

XML Sitemap submissions require websites to produce up-to-date and fully qualified sitemaps. The [format is well-documented](https://sitemaps.org/protocol.html?ref=ctrl.blog), but it can pose a technical challenge to implement well. An XML Sitemap can be just a list of URLs, and it can help search engines discover new pages.

However, search engines also want to know when a website’s existing pages have changed significantly. This requires websites to include the optional `lastmod` (last-modified) element with the correct date for each page. Without this information, search engines waste indexing capacity on revisiting pages needlessly.

The creation of a sitemap and the inclusion of the last modification dates can be automated, assuming all the URLs and last-modification time of a website are known. Depending on your publishing system, this information may or may not be available.

Cloudflare [research suggests](https://blog.cloudflare.com/crawler-hints-how-cloudflare-is-reducing-the-environmental-impact-of-web-searches/?ref=ctrl.blog) that sitemap files can improve search engine indexing efficiency and lower the carbon footprint of websites. Detailed XML Sitemaps are still valuable and will continue to aid search engines for years to come. However, XML Sitemaps can be huge.

What if you only want to submit one new or modified URL? What if you didn’t have to submit links to each search engine individually? Bing and Yandex decided to work together on a new protocol to improve indexing for everyone.

The [IndexNow initiative](https://www.indexnow.org/?ref=ctrl.blog) is a new API from Bing and Yandex that launched in November 2021\. IndexNow lets any website submit one or more new or changed URLs to all participating search engines with one API call. Submit your URLs to any IndexNow-compatible search engine (currently only Bing and Yandex), and they have agreed to share the submissions with each other. 

IndexNow is a more efficient alternative to creating and maintaining a sitemap file listing every single URL of a website. Bing, Baidu, and Yandex have previously experimented with similar direct-submission APIs. However, these APIs have required websites to invest time and effort to support each search engine. IndexNow makes it easier for websites to adopt as it’s just one standard and one API request to submit to multiple search engines in one go.

IndexNow enables websites to request immediate indexing of new and modified content. It’s up to the search engines to decide whether to act on the requests or not. Neither Bing nor Yandex has published any data on how they evaluate the quality of IndexNow submissions; except to say that websites have a daily submission quota. I’m guessing that they also use a domain quality score to decide whether or not to act on indexing requests.

You’re required to create a key file and host it on the domain you’re submitting URLs from to the IndexNow API. The key lets search engines verify submissions and must be included with every IndexNow API call. You don’t need to register anywhere to get an API key; you generate it yourself using a rather clever scheme.

Google [said to Search Engine Land](https://searchengineland.com/google-is-testing-the-indexnow-protocol-for-sustainability-375932?ref=ctrl.blog) that they’re evaluating IndexNow, but hasn’t committed to supporting it. I’m guessing that they’ll adopt the standard. However, I don’t believe that Google will agree to share indexing submission data with its competitors. Websites might end up having to make two IndexNow API calls: one to Google, and one to any of its competitors.

Bing did not respond to my request for comments. To be fair, it’s the holiday season, so there’s probably no one around. I’ll update this story if I hear back from Bing.
### Why I stopped publishing end-of-year most-read lists
URL: https://www.ctrl.blog/entry/most-copied/
Last updated: 2026-08-23T22:14:40.000Z
In previous years, I used to publish a “Most Read of the year” listicle (“list article”) around the holiday season. It let me take a break from writing and still generate lots of traffic to the featured articles. People still need things to read during the holidays, you know. However, I stopped publishing these a few years ago after learning of an unintended consequence.

All of my most popular articles kept appearing on other websites! Either in their original or a slightly rewritten form; most in English but sometimes translated. For years, I failed to spot an — in hindsight completely obvious — pattern for which of my works got plagiarized.

Almost all the plagiarized articles had appeared in one of my end-of-year most-read lists. Other publications were mining and replicating my most popular content, and almost universally out-competed the original article on search engine result pages.

I can only guess why the copies performed better in search rankings. My best theory is that their ranks are inflated based on bot activity on Twitter. I found hundreds of accounts that exclusively posted links to articles published on the offending websites.

Roughly one-third of the copies set their (re-)publication dates to about a week before the original publication dates. As far as I know, modern search engines don't trust the publication dates, and instead use the date when they first discovered the page.

I only noticed the pattern after investigating one publication that had republished eight of my articles in a short time. My articles were plagiarized verbatim except for a modified byline and significant changes to exactly every fourth paragraph. The website had published a few dozen articles between each of my articles. However, my articles appeared on their site in the same order listed in the previous year’s most-read listicle.

I then took a closer look at some of the other plagiarists. Lo and behold, others were doing the exact same thing. Some only copied the top or top three articles, but some had helped themselves to the entire list. I could even identify a few repeat offenders that did the same trick every year.

It’s painfully obvious this would happen when I look back on it. Of course, people would mine these listicles to find new content that’s already proven to be popular. Why waste time writing something new when you can get someone else’s best-of list and copy their work?

I’ve got a general rule for deciding on what to write about. I try to only write about new topics on which I can’t find existing quality information. At the very least, I want to have something new to add to the topics I cover. I simply couldn’t identify with someone who’d want to “borrow” other people’s ideas and completed works.

So, yeah. I decided to stop publishing the end-of-year most-read listicle in 2018\. I also deleted all the previously published lists. I’ve seen a significant decrease in the number of websites that plagiarize my articles. Specifically, I’m seeing fewer plagiarized works where someone has made an effort to appear less blatantly like copyright infringement. There are still automated bots scraping exact or machine-translated copies of my work, but these generally don’t outperform the original on search result pages.

I now get to monopolize topics that no one else has realized are popular yet. Newer articles in my back-catalog outperform the articles from the yearly most-read listicle era with a sizeable margin. It turns out it’s easier to maintain top search engine result rankings if you don’t blab about what they are; thus don’t invite someone to come along and steal the spotlight — and your writing.
### Should you contribute open data to OpenStreetMap for free?
URL: https://www.ctrl.blog/entry/re-maps-public-service/
Last updated: 2026-08-23T22:16:41.000Z
*This is a guest post by Cj Malone, Director at OpenStreetMap UK. Opinion are his own and not those of OpenStreetMap UK. Cj is an avid OpenStreetMap (OSM) contributor, mainly in the United Kingdom (UK), but sometimes fixes broken data in other regions.* 

*Cj’s sent me an impromptu response to my article* [*Should you fix errors and contribute to Google Maps for free?*](https://www.ctrl.blog/entry/maps-public-service/) *In my article, I discuss the pros and cons of contributing my unpaid labour and data to Google Maps. Cj shares some interesting perspectives on the topic.*

> “Should you fix errors and contribute to Google Maps for free?”

I feel the same way about OSM. It may be mainly made by individuals in there spare time, but the big tech companies are making millions of it. The same as free and open source software (FOSS).

Apple uses OSM data in parts of the world where their commercial partners don’t provide data. They are reasonably good at fixing and contributing data to OSM in those regions. *They employ nobody in the OSM community.*

Microsoft Bing uses OSM in several regions, and is slowly moving from it’s traditional providers to OSM globally. They provide machine-learning (ML) datasets that they have computed from areal imagery. *They employ nobody in the OSM community.*

Facebook uses OSM world wide. They do a lot of quality-assurance (QA) work on OSM data as they were burned by a malicious user changing the name of [New York City to Jewtroplis](https://www.bbc.com/news/technology-45354311?ref=ctrl.blog). As part of their work they now release a dataset called [Daylight](https://daylightmap.org/?ref=ctrl.blog). Daylight is basically OSM data (+ other Open Data, like the Bing buildings) delayed with QA tests. *They employ nobody in the OSM community.*

Amazon do a lot of work globally to help their delivery drivers, mainly by mapping new residential roads and driveways. *They employ nobody in the OSM community.*

Ordnance Survey, the National mapping agency in Great Britain (GB), now uses OSM for all data outside of GB, and some data inside. Comically, some of the OSM data they use inside GB is because they couldn’t agree on a licensing agreement with themselves. *They employ nobody in the OSM community.*

— and so on. You can find [more details and examples in the OpenStreetMap wiki](https://wiki.openstreetmap.org/wiki/Organised%5FEditing/Activities?ref=ctrl.blog).

> “Google has since sent me monthly unsolicited emails about the change where they say how many people have viewed the updated listing. At the time of publication, Google says I’ve helped 90 000 people find the eye clinic in the last six months.”

I’m not gonna lie, I kind of like that idea. In the OSM world you just have to have faith that your edits are helping people. There is basically no feedback loop.

> “My edit helps Google to know more accurately where (and thus why) its customers visit the hospital. My edit is actively harmful to other patients’ privacy.”

I think Google gets more statistics based on people destinations from navigation snd clicks on the POI than raw GPS. But I don’t use Google Maps, so I’m not sure.

> “Then again, not fixing the location marker could cause delays at the clinic and actively harm people’s sight and long-term health prospects.”

This is a great example of why service providers should ensure data about them is up-to-date in third party places. This obviously goes back to the monopoly advantage, but if a service provider made their data available openly it could be used by everyone.

> “I’ve since had a look at OpenStreetMap’s editing interface, and let me just say that “ease of use” wasn’t a design requirement.”

I’m assuming you’re talking about the iD editor on the project website. But honestly, that could be about any of the editors. The only one I can recommend as being easy to use is StreetComplete for Android, but you can only add data about existing OSM places (like adding opening hours to a shop, but not adding the shop itself).

> “As an advocate of open source and open data, I should have contributed the missing information to the OpenStreetMap project. There’s only so much time in the day, though. Google only asked for a few seconds to update its map. It was quick and easy.”

Yeah, I don’t blame you, OSM has a massive learning curve. And the overlap between Open Source and Open Data is surprisingly small.

> “However, their real strength lies in having convinced businesses and customers early on to contribute detailed information about everywhere.”

I’ve been working on a [Places dataset](https://gitlab.com/KAFF/places/?ref=ctrl.blog) by scraping Linked Data and Microdata from first party websites. But due to issues with the source data going off spec means I basically have to write some code for each site anyway. Plus, I don’t have the resources to do a large scale web crawl to find independent shop websites.

And even then, this data is probably covered by Database rights in the UK and European Union so it can’t be used in OSM without the data owners permission. It’s surprisingly hard to get companies to give you permission to copy data from there website, it’s basically free advertising for them, but they are still reluctant.

In the UK we’ve reached a mid-point, we [use the dataset](https://osm.mathmos.net/chains/?ref=ctrl.blog) for QA, and to identify areas that need an independent survey to collect missing data. Depending on the interpretation of Database rights, even that may be infringing.
### Should you fix errors and contribute to Google Maps for free?
URL: https://www.ctrl.blog/entry/maps-public-service/
Last updated: 2026-08-23T22:14:12.000Z
Google Maps isn’t a public service, but we’re all treating it as such. It’s a private for-profit enterprise, and it wants you to work for it for free. So, should you help improve Google Maps for your community? — or not?

Some months ago, [I visited the eye clinic](https://www.ctrl.blog/entry/eyeball-fright/) at the Oslo University Hospital. The clinic is located at a big hospital campus with buildings laid out like a maze.

Before going, I visited the hospital’s website to find out where I should go. It had embedded a Google Maps view with a red marker to indicate the building. Except, Google placed the pin on the wrong building. It was pinned in an administrative building some 550 meters away from the eye clinic.

The eye clinic building is facing away from the rest of the campus, and it’s non-obvious where its main entrance is. I updated the eye clinic’s listing on Google Maps to point at the correct building and dropped the marker on its main entrance. I got an email from Google thanking me for updating the map and confirming that they’d accepted the change.

Google has since sent me monthly unsolicited emails about the change where they say how many people have viewed the updated listing. At the time of publication, Google says I’ve helped 90 000 people find the eye clinic in the last six months.

At first, I thought of it as having done a good deed and helped visually impaired patients find their way to the right building. However, only days later I began pondering who I’d really helped. I’d not only helped other patients, but I’d also helped Google improve the accuracy of its map and helped maintain its dominant market position.

My edit helps Google to know more accurately where (and thus why) its customers visit the hospital. My edit is actively harmful to other patients’ privacy. Then again, not fixing the location marker could cause delays at the clinic and actively harm people’s sight and long-term health prospects.

I don’t use Apple Maps, Bing Maps, Here WeGo, OpenStreetMap, or any of Google’s competitors. However, I checked them the week after I made the change to Google Maps. None of the other mapping services knew the building numbers at the hospital nor what was in them.

Coincidentally, OpenStreetMap was updated with more information about the buildings at the hospital only three weeks later. Another week later, the same changes showed up on Bing Maps. I didn’t contribute the updated information, it came from a mass import of data to the OpenStreetMap project.

Why was I okay doing the work for Google but not Apple or Microsoft? I didn’t *want* to work for free for the big tech companies! I just wanted the maps I use to be as accurate as possible.

It would be a lot more work to create a listing for the eye clinic and fill in its opening hours, address, plus setting the location marker at the right spot. The Oslo University Hospital had already done most of the work filling in the information in Google Maps. As such, Google already had nearly the correct information, and it was quick and easy for me to fix the problem I noticed on the map.

We’re treating Google Maps as a public service. Public services treat Google Maps as a public service. However, it’s a for-profit product from Google. Google profits from Maps with ads in the map data itself. Google also charges apps and websites to embed its maps.

The [OpenStreetMap project](https://www.openstreetmap.org/?ref=ctrl.blog) positions itself as a public service and offers open data under an open license. The maps are good too! Except, it can’t match Google Maps’ wealth of data. It doesn’t have updated business listings with opening hours and photos of every business on every street.

I’ve since had a look at OpenStreetMap’s editing interface, and let me just say that “ease of use” wasn’t a design requirement. As an advocate of open source and open data, I *should* have contributed the missing information to the OpenStreetMap project. There’s only so much time in the day, though. Google only asked for a few seconds to update its map. It was quick and easy.

The world is big and collecting and organizing information about every place in it is a massive undertaking. Our expectations of a mapping service have grown since the inception of projects like OpenStreetMap. It doesn’t just need to tackle the colossal and ever-changing tasks of cartographing the world. We also expect transit routes, business listings, and all sorts of even more ever-changing information to go alongside it.

So, can anyone but a huge multinational company like Google, Microsoft, and Apple get the job done? Probably not. They’ve invest incredible amounts of money into every-better satellites and cartography. However, their real strength lies in having convinced businesses and customers early on to contribute detailed information about everywhere.
### PlanetSide 2 is now available on Linux
URL: https://www.ctrl.blog/entry/planetside2-on-linux/
Last updated: 2026-08-25T21:09:11.000Z
[PlanetSide 2](https://www.planetside2.com/?ref=ctrl.blog) (PS2) is a free-to-play/pay-to-customize massively multiplayer online first-person shooter game. It was released for Windows in 2012 and three years later for PlayStation 4 in 2015\. Now, nine years later, it’s debuting on Linux through the Proton Compatibility layer in Steam.

In PS2, three factions fight for dominance over the four continents on the planet Auraxis. It has been my go-to game during the pandemic. The game has set and currently holds the world record for most simultaneous players participating in a single battle in a first-person shooter game.

Despite being over nine years old, PlanetSide 2 still shows up on the Steam Top 100 Games by Current Players list. The game is always bustling with people; something that the real world has been missing during the last few years of the global pandemic.

Over the last six years, Valve, the company behind the Steam game library and store, has invested heavily in its Proton Compatibility project. The compatibility layer can translate Windows-specific and graphics instructions to run on Linux. Proton has been a huge boon for the Linux gaming community, enabling thousands of games to run on Linux.

I got PlanetSide 2 to run on Linux early last year with the help of Proton. However, the game would quit when I fired any weapons or otherwise earned any experience points. I abandoned the effort to get the game to run under Linux. I didn’t want to anger the powers that be and feared that my account would be banned.

As a competitive multiplayer game, PS2 has to protect itself against cheaters. Every game struggles with people not playing by the rules. To combat cheaters, the game includes the [BattlEye](https://www.battleye.com/?ref=ctrl.blog) anti-cheat system.

BattlEye is also included with other popular games such as Fortnite, Destiny 2, PUBG, and Ark. None of these games worked on Linux only two weeks ago. BattlEye supports Linux, but requires game developers to opt-in to Linux (and macOS) support. Gamers often blame the anti-cheat system vendors for breaking Linux compatibility. However, it’s ultimately the game studios that are the gatekeepers.

Then something changed. Valve announced the [Steam Deck](https://www.steamdeck.com/en/?ref=ctrl.blog); its new flagship portable gaming device. The Steam Deck runs Linux. Valve began testing all the games in its store for Linux and Steam Deck compatibility. It has worked with anti-cheat vendors and game studios to get as many games as possible to run on Linux.

Which ultimately led Daybreak Games to finally enable Linux support from BattlEye! My tweets at the studio didn’t make much of a difference, but it would seem that Valve can set priorities and have the industry follow. PlanetSide 2 now runs on Linux, and it even runs better than on Windows. I get an average frame rate of 98 frames-per-second (fps) at 4 K resolution on Windows and 162 fps on Linux. 

I’ve only encountered a single bug in the Linux version: the launcher window is entirely white unless you launch the game with `--disable-gpu` argument. It’s a roadblock to new users, and I hope Daybreak Games will fix it.

In the last week, I’ve encountered five other players in-game with Linux in their player names. It’s nothing but an anecdote, but I get excited every time I see a fellow Linux player on Auraxis.

PS2 has been *the reason* why I’ve been using Windows on my gaming PC. It dual-boots with Fedora Linux, but I’ve spent most of my time gaming on it in Windows. I’ve now changed the grub default on it from Windows to Linux.

**Via:** [Gaming On Linux](https://www.gamingonlinux.com/2021/12/more-battleye-titles-for-proton-on-linux-including-dayz-arma-3-now-supported/?ref=ctrl.blog)
### Why Windows failed to display Microsoft and Xbox sign-in dialogs
URL: https://www.ctrl.blog/entry/missing-msaccounts-control-dialogs/
Last updated: 2026-08-23T22:14:33.000Z
For about a year, I couldn’t use any Windows 10 apps or Xbox games that required me to sign in with a Microsoft Account. I also couldn’t add any email or other online accounts to my Windows account. For whatever reason, all the Microsoft Accounts Control and Windows Web Account Provider dialog windows refused to open.

Whenever I clicked a button that was supposed to open these dialogs, I might see a brief white flash that hinted at the brief appearance of a dialog window. Most of the time, absolutely nothing happened.

Deep-rooted problems with Windows are incredibly difficult to troubleshoot. When developing its software, Microsoft always assumes everything will work flawlessly all the time. Apps and system services rarely generate log files, report errors to the Events system, or even record diagnostics data about the problem. The Diagnostics Viewer reported to Microsoft that I’d opened the desired dialog for less than a millisecond and that everything was fine.

I occasionally tried to troubleshoot the problems and got nowhere. I mostly ignored it as I didn’t regularly use any apps that required that I sign in with Microsoft or Xbox gaming services. However, that was about to change at the end of November 2021. Microsoft Game Studios was about to launch Halo Infinite and Age of Empires 4! These games would definitely require me to log in with Xbox gaming services. 

I wasted hours trying to troubleshoot Windows Credentials and everything related to account logins. However, I couldn’t find any issues with it. Everything appeared to work fine, except the dialog windows just wouldn’t open!

I couldn’t add new user accounts through the Settings app s the dialogs wouldn’t appear. However, I added a new user account through PowerShell, and the new account didn’t have the issue. Whatever the problem was, it only existed within my main user account.

The problem didn’t go away when I updated my PC to Windows 11\. Any issues related to Microsoft Accounts and Windows user accounts are impossible to research online. The search terms are too generic and there’s too much webspam and low-quality forum discussions about generic issues with passwords and such.

Having failed to identify the issue, I’d planned to reinstall Windows 11 a month before the big game releases. As I was going through folders and apps to double-check that I’d backed up everything of value, I suddenly noticed that all the Microsoft Accounts Control dialog windows had begun working again!

So, what had changed? I had the same system configuration, the same apps, and nothing had changed as far as I could tell. Then it struck me: I’d opened all my installed apps and closed them one by one as I ticked them off my backup list. I’d probably quit something that was always running in the background for the first time in a year. That narrowed down the list considerably!

I found the guilty app a couple of minutes later: [Recursion Tracker](https://recursiontracker.com/?ref=ctrl.blog), a game session performance tracker for the first-person shooter [PlanetSide 2](https://www.planetside2.com/?ref=ctrl.blog). Okay, so what would this app possibly be doing in the background that would interfere with Windows’ account handling subsystem?

The Recursion Tracker app works by injecting a DLL library file into the game. The DLL is signed and allow-listed by the game’s anti-cheat system. It tracks how well you’re doing in the game and adds some overlays for achievements and arena-style announcements of your accomplishments. It’s a fairly innocent toy of an app.

To get to the bottom of the issue, I contacted the app’s developer. I informed them about the issue it was causing and asked for access to the app’s source code. The lead developer granted me access to the project and I started poking at the code.

Despite having access to the source code, I haven’t figured out exactly what causes the issue. It relies on some long-since deprecated Microsoft DirectX version 9 API calls that make it a pain to debug on modern versions of Windows. Microsoft released DirectX 9 in 2002 for Windows 98, ME, and XP; and has never been officially supported in Windows Vista and newer.

Any Universal Windows Platform (UWP) apps that relied on either the Microsoft Accounts Control or Windows Web Account Provider integration would fail to log in with existing accounts. So, the problem affected more than just the presentation of the dialog windows. This details may suggest that something about Recursion Tracker might have triggered a security protection system in Windows. However, I’d expect an error message or something if this was the case.

My best theory is that something about the DirectX 9 APIs interferes with the graphics stack in Windows 10 and 11\. As long as the app is running, it creates some type of system interference that prevents the Windows account dialogs from appearing.

(I can’t help but think of Recursion Tracker as an *Attero device*; from the TV show Stargate Atlantis. It was a weapon that sat quietly on a planet and generated galaxy-wide subspace interference. It caused enemy starship engines (and unfortunately Stargates) to explode as they entered hyperspace.)

I don’t know why this manifests as an issue with these specific dialog windows, though. They’re not regular windows. They’re a fairly unique type of hybrid overlay dialog that doesn’t adhere to the normal window management controls in Windows. However, that theory doesn’t quite pan out: the character and emoji picker works; and it uses the same type of dialog window.

You can work around the issue by launching Recursion Tracker in Windows 8 Compatibility Mode (right-click the app, and select Properties and Compatibility). Among other changes, Windows 8 Compatibility Mode changes several parameters of how Windows handles legacy DirectX calls from a program. The compatibility mode does the trick on the latest versions of both Windows 10 and Windows 11.

Alternatively, you can disable the option for an in-game overlay. The app isn’t quite as fun without the overlays, but maybe you’re just using it to track your sessions stats.

It’s an interesting issue and it speaks to both the fragility, quality, and commitment to legacy compatibility in Windows. The user-installed app works even at the cost of core operating functionality. That’s both a blessing and a curse.

My main complaint about Windows is that it’s virtually impossible to troubleshoot without any logs. What’s the purpose of collecting gigabytes of “diagnostics and telemetry data” every month if you fail to detect and log problems?

I don’t want to discourage you from using Recursion Tracker, however. It’s not undergoing active development anymore, and it would be a monumental effort to bring its code base up to snuff. You should keep using it as long as it still works in Windows 8 Compatibility Mode.

Recursion Tracker adds some extra goals and *oomph* to PlanetSide 2\. At least for me, I enjoy having an announcer sound impressed by my double and tipple kills. I guess it’s rooted in nostalgia for Halo. Oh, Halo Infinite is out now, and I still prefer to play PlanetSide 2.
### Closing the open redirect vulnerability in the Libravatar ecosystem
URL: https://www.ctrl.blog/entry/libravatar-open-redirect/
Last updated: 2026-08-23T22:13:21.000Z
[Libravatar](https://www.libravatar.org/?ref=ctrl.blog) is a decentralized open-source alternative to [Gravatar](https://www.gravatar.com/?ref=ctrl.blog) – the avatar image service. Last week, I noticed an URL Redirection to Untrusted Site (‘Open Redirect’) vulnerability ([CWE-601](https://cwe.mitre.org/data/definitions/601.html?ref=ctrl.blog)) in the Libravatar application programming interface (API) specification.

The [Libravatar API](https://wiki.libravatar.org/api/?ref=ctrl.blog) is used to obtain an avatar image (a profile photo) from someone’s email address. The API is essentially a clone of the Gravatar API, except that the specification is decentralized (like email) instead of relying on a single service provider. Any email domain can add domain name system (DNS) service (SRV) records to designate a specific website as its avatar hosting service.

I was reading up on the Gravatar API and investigated some alternatives when I stumbled upon Libravatar. To my horror, I noticed that both API specifications described an open redirect as a feature. An open redirect is a vulnerability where the attacker can link to a trusted domain, and control a redirect from the trusted website to any other untrusted site.

For example, the Libravatar and Gravatar APIs let you set a parameter for specifying a fallback avatar. For users without an avatar, the server can return the fallback image instead. You can set this parameter to URL and have the service redirect to this address as a fallback. The intention is that you can specify your own fallback image and redirect to it.

An attacker can use the redirect to leech off the reputation of a Libravatar server’s domain. An open redirect can be used to obscure a link’s true destination, or help a spam or phishing message to sneak past filters.

An open redirect is a common vulnerability, but the security community tries to shut them down whenever they’re discovered. What’s making this one noteworthy is that you can auto-discover Libravatar servers using DNS Service Discovery (DNS-SD) by querying domains for the DNS SRV records. 

I DNS-SD queried the web’s top 5,1 million domains ([Tranco list](https://www.ctrl.blog/entry/tranco-popular-websites/) #[44KX](https://tranco-list.eu/list/44KX/full?ref=ctrl.blog)) to see how many Libravatar instances and open redirects I could find. In total, I discovered 18 instances (unique Internet Protocol (IP) addresses) on 23 distinct domain names. 11 instances were vulnerable (13 domain names).

Notably, the servers operated by academic institutions were not vulnerable. These institutions are likely running custom software solutions on top of their staff and student databases to generate the avatars.

There are at least a dozen implementations of the Libravatar API. You can implement a simple version using static image files, a web server, and the DNS SRV records. Not all implementations support redirecting to a fallback image. I found six distinct vulnerable open-source implementations.

It was time to do something about this. I contacted the Libravatar project to report the vulnerability and suggested the removal of the open redirect from the specification. The project maintainer promptly removed this option from the specification and the reference implementation (`ivatar`). The reference implementation still supports redirects to a list of allowed domains. The maintainer made the issue public right away.

I then proceeded to contact the other vulnerable implementors and server instances I had discovered to notify them about the issue and the updated API specification. Three implementors and five server instances responded promptly within a day and pushed updates and patched their servers. Four days later, and I haven’t heard back from any more implementors or server instances.

I’ve found two of the open redirect server domains in the Cisco PhishTank phishing database, and two other domains in email spam blocklists. Two other of the server administrators I contacted volunteered log-confirmations of abuse of their open redirects.

So, what about the Gravatar API? Gravatar still supports a redirect to an arbitrary redirect. However, it doesn’t issue redirects. Instead, Gravatar proxies the request and verifies that it’s an image before serving it. The proxying slows down request handling compared to a redirect, but it’s more secure.
### Bitrot resistance of next-generation image formats
URL: https://www.ctrl.blog/entry/bitrot-avif-jxl-comparison/
Last updated: 2026-08-23T22:02:19.000Z
I’ve compared two next-generation image formats, AVIF and JPEG XL (JXL), to see which best handles a random single corrupted bit. A meaningless exercise? Possibly. But half a picture of your beloved grandma is better than no picture at all.

What happens when a single bit gets corrupted in an image file you cherish? The results can range from absolutely nothing to an imperceptible visual change to a complete loss of the image. The above hero image is somewhere in the middle of the scale; where the top half of the image is perfect, and the lower half is reduced to meaningless digital noise.

Whether due to mechanical failure or transmission interference like cosmic radiation: bitrot happens. A rotted bit, or flipped bit, is when one bit of RAM or persistent storage unintentionally flips its state between zero and one. You can only do so much to protect your system from random failure. Multiple backups and data verification is the only proven strategy to protect against it. 

Traditional JPEG images (referred to as JPEG troughing the article as opposed to JXL), especially with [progressive encoding](https://www.ctrl.blog/entry/jpeg-progressive-loading/), handle bitrot remarkably well. You might see a single pixel shift its color almost imperceptibly, or one of the encoding layers may shift slightly. The effects are so well understood that you can even find free software that can automatically recover corrupted JPEG photos. 

However, the next-generation image formats pack data much more densely than in the legacy image formats. There’s isn’t just less redundancy, but every single bit means more to the complete image. This means the effects of bitrot produce a much greater loss of visual fidelity and decodes to more abstract results. The newer encoding techniques include predictive models that can get thrown off completely by a single bit out of place. The digital hellfire in the lower half of the above hero image is a perfect example of this.

I devised a test to determine if any of the new image formats handled this situation better than the other. I’d randomly flip 100 bits, one at a time, in 310 test images at three different resolutions (544×306, 1280×720, and 1632×918 px) in three formats (AVIF, JXL, and JPEG (control)). That’s 225 000 images in total. The encoding quality was randomized for each image to give the most varied input scenarios.

The test image was encoded and decoded using the libavif+libaom versions 0.9.1 and 3.1.2 (for AVIF), libjxl version 0.6.1 (for JXL), and libjpeg-turbo version 2.1.1 (for the JPEG reference). The two first libraries are the reference implementations for each of the formats. libjpeg-turbo is the most commonly used JPEG library. Additionally, AVIF decoding was tested using the dav1d version 0.9.1 decoder library. This isn’t to give the format an unfair advantage, but there simply isn’t a second implementation of JXL yet.

The resulting bit-flipped images was then compared to the pre-bit-flipped encodings. It’s difficult to accurately and objectively quantify information loss in images. Luckily we have a tool/metric called structural dissimilarity (DSSIM) that yields a comparable score. for comparing images. The images were scored using Kornel’s [dssim](https://kornel.ski/dssim?ref=ctrl.blog) tool version 3.1.0\. 

The DSSIM score isn’t a percentage difference, but an estimation of how much difference human perception would observe from looking at two images. To give you an idea of what the DSSIM scores mean, here are my interpretations of some DSSIM scores from 0.0 to 1.0:

- 0.00000000, Mathematically lossless
- 0.00010000, Visually lossless
- 0.00085000, High quality lossy encoding
- 0.00100000, Some noticeable corruption artifacts appear
- 0.01000000, Lots of lossy corruption artifacts
- 0.10000000, Severe lossy corruption artifacts
- 0.35000000, The image is recognizable if you’ve seen the original and squint
- 0.60000000, Unrecognizable/new abstract art
- Lastly, “fail” means the image could not be decoded at all.

An image where the corruption appeared late in the image file may be perfect and may appear as a high-quality image encoding even though the bottom two rows of pixels would be completely corrupted. To be fair, humans looking at a large image might not notice it. Images that are corrupted earlier in the file would receive an abstract art-esque score.

It’s time for the results in the form of a log10–log10 graph. (Click the image to enlarge it.) Each line on both axes represents a 10× increase, two lines represent 10×10×, and so on. The differences in the graph are bigger than they might first appear.

![](https://cdn.synaps.media/control/content/images/2026/08/bitrot-image-format-dssim-comparison.png)

Both AVIF (libaom) and JXL performed terribly. A full 98,92 % of AVIF (libaom) and 98,67 % of JXL images completely failed to decode. Things improved drastically with AVIF (dav1d). It only failed to decode 40,91 % of the images JPEG is the winner with a decoding failure rate of only 34,42 %.

JPEG has an evenly distributed DSSIM score varying from low to high corruption. Almost 30 % of the JPEG images fall within the visually lossless category, with AVIF (dav1d) coming in at a distant second place with only 1,12 % of the images being visually lossless.

AVIF (dav1d) sees a nearly straight diagonal decline in its quality. The hero image at the top of the article helps explain this curve. How much of the image is lost depends almost entirely on where in the image file the corruption occurred.

I believe both libaom and libjxl can be changed to output results similar to dav1d. These decoders seem to abort the decoding job rather than output a partially corrupted image. However, as I said initially, half a photo of your grandma is better than no photo at all. Human faces, in particular, tend to be at the upper half of image compositions. So, there’s a good chance you won’t completely lose your photos.

With this in mind, I can’t conclusively say there’s a clear winner of this image format comparison. Both the AVIF and JXL projects are working on progressive image encoding and decoding. Progressive decoding might help improve the bitrot corruption resistance in both formats. (Weirdly, one project has only implemented encoding, and the other has only implemented decoding. So, neither has a test-ready implementation yet!)

I didn’t include the HEIC image format in this evaluation. As a proprietary image format, it has no future on the web. The format offers no clear advantage over its two open-source rivals.

So, should you worry about bitrot? Yes and no. There’s no doubt it happens, but there’s no large-scale empirical data on how frequently it happens on modern hardware. There’s no consensus in the industry, but enterprises large and small go to great expense to prevent it from affecting their business and customers. A single flipped bit can literally turn a smile emoji into a frown.

There are a few things you can do to protect your data. Have more than one backup! Take incremental backups! Verify your backups! Buy error-correcting (ECC) RAM for your computers and servers! Migrate to Linux or FreeBSD so you can use a checksumming file system!

Legacy bitmap image formats like BMP have high resistance against bitrot. Without any compression, you get huge files but shouldn’t lose the information in more than one pixel per flipped bit.

The PNG format has compression, but as a lossless format, it still produces large image files. PNGs come with internal checksumming. This feature makes it very easy to verify and detect bitrot without the need for a checksumming file system or other external checksums.
### Why you need a HTPC
URL: https://www.ctrl.blog/entry/why-htpc-benefits/
Last updated: 2026-08-23T22:24:31.000Z
I haven’t watched linear TV for years. I usually know what I want to watch and the times I want to watch it. In other words, I’m a cable-cutter or an *on-demand streamer* as I prefer to think of it.

The Android TV interface on my “smart TV” is not for me. It’s clunky, unresponsive and slow, and switching between streams/apps is frustratingly difficult. Plus, why does it take so long to load? Why is every stream interrupted by buffering? I’m always surprised by where the back button takes me. For years, I used a Chromecast controlled by mobile apps instead.

However, I wanted a better and less frustrating viewing experience. The website versions of my favorite streaming services are universally better than the native mobile apps and their Chromecast integration. I also *really* wanted better audio loudness normalization than what’s available in the limited audio processing options on my TV and audio/video receiver. I wanted a home theater PC (HTPC).

A small form-factor HTPC capable of high-dynamic-range (HDR) 4 K playback at 60 Hz costs roughly 350 USD. You need a barebone PC (a PC chassis with a mainboard and power supply), plus at least 6 GB of RAM and a compatible processor with integrated graphics. You also need a small boot disk for the operating system, or a larger disk if you intend to store media on it. 

You can find many examples of HTPC builds on the web, or you can purchase a prebuilt setup. Prebuilt tend to cost the same as do-it-yourself builds, but you get slightly older components with lower specs. The one thing to look out for when choosing an HTPC is that the integrated graphics on the processor performs well at the resolution and frame rate your TV supports (look for “4K@60Hz” and CPU reviews).

Before discussing what you get for your money with an HTPC, I need to talk about HDMI dongles as the competitor to an HTPC. For example, the Google Chromecast Ultra (branded as “Chromecast with Google TV” in the US) costs about 55 USD. It says on the box it can support video playback for 4 K at 60 Hz. So, why do you need a 350 USD computer for 4 K?

HDMI dongles like the Google Chromecast only support playback of [a limited set of media codecs](https://developers.google.com/cast/docs/media?ref=ctrl.blog) with specific encoding profiles/parameters. They’re not general computing devices, and their hardware is instead optimized to a few specific tasks. E.g. the Chromecast might be fine if all you watch is YouTube and Netflix. However, you may run into trouble if you watch your own movie collection or use other streaming services.

Another dirty little secret of the cheap HDMI dongles is that they’re passively cooled (fanless). Quiet is good, but they also generate a lot of heat and will thermally throttle (especially when watching high-resolution videos) unless they’re operated in a climate-controlled room. So, you’ll get smooth playback in the beginning until it eventually either begins to stutter or drops the stream quality.

You might wonder why there isn’t anything in the sweet spot between the 55 USD Chromecast and a 350+ USD HTPC. It’s a fairly big price bump, and there should be room in the market for something slightly more optimized for the purpose. However, there doesn’t seem to be enough demand in the consumer market for a cheaper and more capable device with a more task-oriented integrated CPU. The closest you can get is integrated display computers that are intended for billboards and other advertising displays. However, they’re hard to get hold of without buying a complete unit including the display.

Switching to a generalized computer platform like an HTPC offers higher performance and active (but still quiet) cooling. It’s much more flexible and customizable, and capable of handling a much more varied set of media sources. You’re not limited to only e.g. Chromecast or AirPlay-compatible apps and media sources; any video file, website, or streaming platform will do.

A Windows license costs 150 USD, so you’ll either add that on top of the 350 USD for the HTPC or discover a newfound passion for running a free operating system like Linux. If you decide to use Windows, you may change your mind after the first time a movie gets interrupted by Windows Update. You can always change your mind later if you don’t like the operating system or Linux variant you chose. My preferred interface to my HTPC is a full-screen web browser

An HTPC is all about choices; your choices. You don’t need to settle for the compromises made by your TV or HDMI dongle manufacturer. You get to pick and choose the software and build your own experience. Change your mind about a decision later on? Change it. You can change the software and how you control it.

Let us start with how you want to interact with your HTPC. Popular options include a wireless touchpad/keyboard combo, multimedia remote controller, gamepad, your voice, or a phone app. Try a few and pick one or two that work for you. You’re not stuck with any one option.

I use a Logitech K400 Plus keyboard/touchpad combo, although I’m considering upgrading to the newer, slightly more compact, and backlit Logitech K830\. You're not stuck with the software and interface the device manufacturer chose for you.

An HTPC is also a good device for living room gaming. You probably can’t play triple-A games locally off the hardware on a budget HTPC. However, you can stream games from your gaming PC through Steam Link or Miracast (Wi-Fi Direct). You can also pair it with a gamepad and an internet streaming service like PlayStation Now, Google Stadia, or Xbox Cloud Gaming.

You can find apps for turning your HTPC to an Apple AirPlay, Google Chromecast, and Miracast receiver. I was concerned about supporting these protocols, but I haven’t needed them since I got my HTPC. I may have overestimated how important these were to me, but the options are out there.

Microsoft discontinued its Windows Media Center (MWMC) and Apple stopped supporting Front Frow over a decade ago. However, you don’t need a dedicated media center front end anymore anyway. Who needs a smart-TV-like interface when you’ve got a web browser?

Your web browser of choice is excellent at video playback and game streaming services. Switching between apps is as easy as switching tabs. You may be thinking that the browser user interface and websites will be too small to use across the room. However, you can increase UI scaling in the operating system to make everything nice and big. You can make buttons and text as big or as small as you need to read it comfortably across the room.

You can use any browser, but I recommend Firefox in fullscreen mode. Firefox lets you add shortcuts on the Home tab to all your favorites including YouTube, Netflix, Google Stadia, Twitch, — you name it. Press Ctrl and + a couple of times and it turns Firefox’s grid of small shortcut icons into nice big buttons that are easy to recognize and click from across the room. Its picture-in-picture mode works with most video streaming services, so you can keep an eye on two or more streams at once. 

Browser extensions let you further enhance your viewing experience. For example, [Auto Fullscreen](https://addons.mozilla.org/en-US/firefox/addon/autofullscreen/?ref=ctrl.blog) puts Firefox in fullscreen mode on startup. [YouTube Auto-skipper](https://addons.mozilla.org/en-US/firefox/addon/youtube-ad-auto-skipper/?ref=ctrl.blog) skips ads as soon as the option is available. This reduces how much ads you see without blocking them entirely, so you still support your favorite creators. [Utrawidify](https://github.com/tamius-han/ultrawidify?ref=ctrl.blog#readme) can detect and hide improperly encoded letterboxing (black bars burned into videos that don’t match your display’s aspect ratio). You can find extensions for locking in your preferred video quality, changing subtitle styles and text size, setting the playback speed, and more.

The killer HTPC feature for me is that I get proper audio processing including loudness normalization. Most receivers and TVs will have some kind of limited loudness normalization available. However, I want to aggressively boost speaking voices and reduce explosions and loud noises. I’m more concerned about good loudness normalization than whatever the movie or TV show’s audio mixer thinks sounds cool.

I use [EasyEffects](https://flathub.org/apps/details/com.github.wwmm.easyeffects?ref=ctrl.blog) (formerly called PulseEffects), a free audio processor app for Linux. It has many plugins for different audio manipulations and an overwhelming amount of options. It’s probably overkill, but it gets the job done. There are a dozen paid alternatives available for Windows too.

An HTPC is also a good option if you’ve got a collection of home movies, or ripped TV shows and movies. Media server software like [Jellyfin](https://www.ctrl.blog/entry/jellyfin-vs-plex/), Plex, or Emby manages your media collection. All three need a server component that can run under either Linux or Windows, and you can install it on either your HTPC or a network-attached storage server (NAS). (You may want to consider a larger form-factor HTPC if you’ve got a large media collection.)

As has been the theme throughout the article, you’ve got multiple options for playing back media from your media server software. Jellyfin and Plex come with a good built-in web interface, and has both first- and third-party app interfaces you can choose from.

To help justify the cost to myself, I also set up the HTPC to act as a backup home domain name system (DNS) server and as [a distributed compiler](https://www.ctrl.blog/entry/how-to-icecc-distributed-compiler/) to help speed up my project build times. So, I get more value out of it throughout the day even when I’m not watching TV.

You can do a lot of things with an HTPC, and more importantly, you can tweak and customize your experience of those things. You’re not limited to whatever design, experience, and feature set that the device manufacturer or a big tech company deemed to be a minimal viable product to get your patronage. If you change your mind, you’ll at worst have an extra-expensive but performant Chromecast receiver that supports proper loudness normalization.

I hope I have piqued your interest in an HTPC for your TV. Or maybe you’ve been discouraged from getting a TV. Watching on a laptop with a good screen and audio is in many ways preferable to a bad consumer TV experience.
### Windows now blocks Edge browser competitors from opening links
URL: https://www.ctrl.blog/entry/microsoft-edge-protocol-competition/
Last updated: 2026-08-23T22:14:16.000Z
Something changed between Windows 11 builds 22483 and 22494 (both Windows Insider Preview builds.) The [build changelog](https://blogs.windows.com/windows-insider/2021/11/03/announcing-windows-11-insider-preview-build-22494/?ref=ctrl.blog) makes a few mentions of changes to the protocol and file associations/default apps system. However, it omitted the headline news: You can no longer bypass Microsoft Edge using apps like [EdgeDeflector](https://www.ctrl.blog/entry/edgedeflector-default-browser/).

**Update** (2021-12-13): Microsoft has backported this change to Windows 10\. You can uninstall Windows Update KB5007262 to revert the change. This work-around will only work until the next cumulative update is released.

EdgeDeflector is an app that intercepts `microsoft-edge://` links — found throughout the Windows 10 and 11 shells and other Microsoft apps — and redirects them to regular `https://` links that open in your default web browser. Microsoft uses these links instead of regular web links to force users to open them in its Microsoft Edge web browser. When opened, Edge will aggressively push the user to set it as the default web browser. Edge will even “declutter” your browser settings, as Microsoft calls it, and unpin competitors from the taskbar and replace the pinned apps with Edge.

The 0,5 million EdgeDeflector users were probably never more than a nuisance to Microsoft. However, last month both the Brave and Firefox web browsers [either copied EdgeDeflector’s functionality](https://www.ctrl.blog/entry/anti-competitive-browser-edges/) or signaled it was on the roadmap. Firefox may be [bleeding users by the millions](https://www.pcgamer.com/firefox-has-lost-46m-users-over-the-last-three-years/?ref=ctrl.blog), but the more-ethical browser still has almost 200 million users. That news probably did make Microsoft sit up and pay attention.

Before discussing the changes in the latest Windows builds, I’d like to refresh your memory on Microsoft’s earlier escapades with antitrust regulators. I’m not a lawyer, but some case law is common knowledge in the tech field. I’m, of course, thinking of [United States versus Microsoft (2001)](https://www.nytimes.com/2001/06/28/business/us-appeals-court-overturns-microsoft-antitrust-ruling.html?ref=ctrl.blog) and [Microsoft versus European Commission (2009)](https://www.politico.eu/article/microsoft-accused-of-harming-browser-market/?ref=ctrl.blog). In both cases, regulators found that Microsoft was abusing its market-leading operating system to unfairly promote its Internet Explorer (now called Edge) browser; disadvantaging competing web browsers.

While the US decided not to take action against Microsoft on this point, the EU didn’t hold back. Microsoft agreed to hide shortcuts to Internet Explorer and show customers in the EU the [infamous browser ballot screen](https://arstechnica.com/information-technology/2010/02/microsofts-eu-browser-ballot-approved-arrives-march-1/?ref=ctrl.blog). The dialog listed Internet Explorer among competitors and asked them to choose what browser they wanted to one-click install.

Microsoft had several “technical issues” that caused the ballot not to be displayed to millions of users. The EU wasn’t amused and issued [fines over Microsoft’s non-compliance](https://www.bbc.co.uk/news/technology-21684329?ref=ctrl.blog) with the ballot screen. The EU–Microsoft agreement saw the ballot screen retire at the end of 2014\. At that point, the Google Chrome browser (featured on the ballot screen) had become [the market leader on the desktop](https://gs.statcounter.com/browser-market-share/desktop/europe/?ref=ctrl.blog#monthly-200901-202110), and Internet Explorer was nowhere to be seen on the, then still a new category, mobile devices.

This brings us back to today. Windows 10 and 11 no longer care about the default web browser setting. Microsoft even removed the default web browser setting from Windows 11\. Instead of a single setting for the default web browser, customers must set individual “link associations” for the `http://` and `https://` protocols; as well as file associations for the `.html` file type. This is a huge jump in complexity compared to the previous design. It’s clearly a user-hostile move that sees Windows compromise its own product usability in order to make it more difficult to use competing products.

Furthermore, Microsoft has added first-party experiences like News and Interest in Windows 10 and Widgets in Windows 11\. It gave the features prominent positions on the taskbar. These “web experiences”, as Microsoft calls them, feature links to online news, weather, and other resources. Search result links in the Start menu and links sent to the device from a paired Samsung or Android devices are also affected.

However, these features don’t use regular web links (`https://`). Instead, they use `microsoft-edge://` links that only work with the company’s web browser. These links are also featured in other Microsoft apps and are found around the Windows shell. These special links only exist to force users into using Microsoft Edge. They serve no other purpose than to circumvent the user’s default browser preference to promote a Microsoft product.

To fight back on this user-hostile development, I developed [EdgeDeflector](https://www.ctrl.blog/entry/edgedeflector-default-browser/) in 2017\. It’s a tiny application that parses the `microsoft-edge://` links and redirects them to regular `https://` links that it tells Windows to open in your default web browser. The user would simply need to install the app and choose it as the default for `microsoft-edge://` links instead of Microsoft Edge. Over the last five years, the app has grown to a small 500 000 users revolt against Microsoft’s anti-competitive practices.

So, **what changed in Windows 11 build 22494?** You can no longer set anything but Microsoft Edge as the protocol handler for the `microsoft-edge://` protocol. Or rather, you can choose between Microsoft Edge, Microsoft Edge (Insider Beta), and Microsoft Edge (Insider Dev). No third-party apps are allowed to handle the protocol.

You can’t change the default protocol association through registry changes, OEM partner customizations, modifications to the Microsoft Edge package, interference with OpenWith.exe, or any other hackish workarounds. 

Microsoft doesn’t even bother throwing up the “An app default was reset” error message. It just silently ignores the UserChoice registry keys for the protocol in the registry and opens Microsoft Edge instead. Windows still uses the default protocol associations to detect and present possible Edge beta or preview builds.

Windows will insist you use Microsoft Edge to a fault even if you brutalize your Windows installation and purge all traces of Microsoft Edge. Windows will open an empty UWP window and show an error message instead of letting you use your preferred web browser. 

This isn’t a bug in the Windows Insider preview build. Microsoft has made specific changes to how Windows handles the `microsoft-edge://` protocol. (It looks to be about 8 KB of added compiled code, although I can’t say for sure.) It has not made similar anti-competitive changes to other lesser-used Microsoft Edge specific protocols such as `microsoft-edge-holographic://` (for use with its augmented reality products), `ms-xbl-3d8b930f://` (Xbox Live services), or `read://` ([reader view](https://www.ctrl.blog/entry/browser-reading-view-uri/)). These can still be changed and associated with other apps.

So, what does this mean for EdgeDeflector? The program will remain available for download, but I won’t attempt to update it until Microsoft reverses its position. Ideally, the company should cease its use of all `microsoft-edge://` links. It’s user-hostile and an anti-competitive practice that regulators just haven’t caught up with yet.

There are still ways I can work around the limitation, but every method left in my toolbox will require making destructive changes to Windows. Changes that can cause issues for the user down the line, and issues that I frankly don’t want to support. They’d also require a heck of a lot more work than EdgeDeflector’s ≈100 lines of code.

Microsoft still charges 200 USD for a Windows license while simultaneously filling the operating system with ads and crapware. Weeks before launch, Windows 11 wouldn’t even show the taskbar when it [failed to display an advertisement dialog](https://www.ctrl.blog/entry/windows11-empty-taskbar.html). Just last week, first-party apps and features of Windows 11 stopped working [due to an expired encryption certificate](https://www.theverge.com/2021/11/4/22763641/microsoft-windows-11-expired-certificate-snipping-tool-emoji-picker-issues?ref=ctrl.blog).

These aren’t the actions of an attentive company that cares about its product anymore. Microsoft isn’t a good steward of the Windows operating system. They’re prioritizing ads, bundleware, and service subscriptions over their users’ productivity.

For users, the best action is to complain to their local antitrust regulator or switch to Linux. Your web browser is probably the most important — if not the only — app you regularly use. Microsoft has made it clear that its priorities for Windows don’t align with its users’.
### Review: Samsung Galaxy Fit2 – a passive health and activity tracker
URL: https://www.ctrl.blog/entry/review-samsung-galaxy-fit2/
Last updated: 2026-08-23T22:19:51.000Z
The Samsung Galaxy Fit2 (not to be confused with the Gear Fit2) packs an impressive set of features like a sleep and heart rate monitor, in a small and budget-friendly package. However, it doesn’t help that it has a continuous activity, sleep, and heart rate/stress monitor when it doesn’t remind you to keep it charged.

As is often the case with cheap electronics, the Galaxy Fit2’s app software is worse than the hardware (except the touch screen). I’ll begin the review by sharing my experiences with the activity band’s shortcomings, before moving on to discuss its activity and health tracking capabilities.

I’ve used the Galaxy Fit2 for six months, or rather, I’ve worn it for six months. It doesn’t see much use because it keeps running out of battery and its touch screen is awful.

Samsung advertises the battery as “lasting up to 15 days” or “21 days with low usage”. I get about 12 days after disabling every feature on the watch, so the marketing is slightly exaggerated. I get roughly a week on a full charge with the continuous heart-rate monitor and sleep tracking enabled. It’s a tiny device with lots of sensors, so that’s all fine.

However, you don’t get any prompts or reminders to charge it before or after the battery runs out. Neither the Galaxy Fit2’s companion app nor the Samsung Heath app seems to care that the band has stopped transmitting data. I analyzed my Samsung Health data and discovered that it has been off roughly 18 % of the time I’ve worn it.

Well, about that battery notification. I had to send in my Samsung Galaxy S10e phone for service. I used another Samsung device for a week, and then switched back to the Galaxy S10e. I had to set it up as a new phone from scratch, and reset and re-pair the Galaxy Fit2 to it.

However, once I moved back into the Galaxy S10e, it did start receiving charging notifications! I had to factory reset it before sending it in for service. That may have changed something? The Galaxy Fit2 ran out of battery while I used the replacement phone, and it didn’t receive any notifications either. Now, both the Galaxy Fit2 and the Galaxy Watch companion app on my phone remind me to charge it.

Now that I had a working battery charge notification, I could investigate the issue a bit more thoroughly. The charge reminder is sent from the companion app to the Galaxy Fit2\. The activity tracker seems to be so underpowered that it can’t even trigger a charging notification without being instructed to by an app on the phone. I wear a [medical sensor](https://www.ctrl.blog/entry/freestyle-libre-reader-vs-app/) that requires me to have my phone within Bluetooth range at all time. It’s not like the phone has been out of range or that I ever turn Bluetooth off. I consider the charging reminders on the Galaxy Fit2 to be faulty by design; even though they’ve suddenly started working now.

The touch screen is unresponsive and frustrating to use. You’re supposed to interact with the Galaxy Fit2 through touch gestures on its 2,8 cm display. In my experience, the first left-to-right swipe gesture is usually correctly recognized. Repeated swipes often fail, and I need to repeat them several times to get it to do anything. Up-and-down swipes work maybe one in four times. Even tapping is frustratingly unresponsive.

Luckily, you don’t need to interact with the Galaxy Fit2 often. I wanted to use its media playback controls when I first got it to pause/start and set the volume on my podcasts. However, it’s too frustrating to repeatedly swipe and tap at it to get it to do anything. The ever-so-slight delay introduced by Bluetooth doesn’t make it any less frustrating.

You can choose a better watch face to alleviate the charging notification issue and reduce how often you need to interact with the touch screen. The Galaxy Watch app comes with a few different watch faces. This includes some complications that show your step count, heart rate, and the current battery level. With all its core features right on the watch face, you don’t need to bother with the touch screen.

The Galaxy Fit2 is not the ideal activity band for the privacy-conscious consumer. The Galaxy Wear companion app needs access to your contacts, phone, calendars, device identifiers, messages and logs, and more. It can legitimate these permissions because the Galaxy Fit2 technically uses these permissions for optional features. However, Samsung should let me opt out of individual features instead of demanding access to everything. For example, I don’t want notifications on my wrist, so it doesn’t need access to my calls, texts, calendar, and other personal data.

The only point where you can assert some vague notion of privacy control is whether or not you want to opt-in to a data-sharing agreement with Samsung to use its Customization Service app. Samsung gates some features on the Galaxy Fit2 behind you agreeing to share data with the company. I’ve written about [my dislike for SCS and how you can limit its data collection](https://www.ctrl.blog/entry/samsung-oneui-customization-service/) if you’re forced to enable it.

In the case of the Galaxy Fit2, the requirement to opt-in to SCS is particularly outrageous. The device *is* a sleep monitor, and it (or at least the companion app) is perfectly capable of figuring out when you’ve fallen asleep. Yet, the device doesn’t turn off the display when you sleep. So, it constantly interrupts or delays me from falling asleep by turning on the screen. The light is either shone directly into my face or distractingly light up the room.

There’s an option called “Good night mode” in the Galaxy Watch app. It lets the device “learn your sleep habits” and turns off the display at night. Yet, you must opt-in to SCS and let some Samsung server somewhere out on the internet decide whether you can have a good night’s sleep or not! There’s no option to schedule when the screen should be off or let the device decide for itself.

The heart rate sensor is a standard low-cost photoplethysmography (PPG), as found in most similar monitoring devices. I’ve been to a cardiology exam while wearing the Galaxy Fit2\. I was happy to observe that its measurements were within one heartbeat of their medical-grade equipment.

I bought the Galaxy Fit2 to get an inexpensive device to keep an eye on my heart rate. It’s not a medical device, but in my opinion, it’s good enough to keep an eye on my trends. It can provide me with minute-by-minute graphs, plus weekly and monthly trends for analysis. The data is probably not medical grade, but it’s better than nothing.

The Galaxy Fit2 has a somewhat unusual approach to step counting. It doesn’t count those 16 steps you take back and forth between your desk and fridge. Instead, it tracks it as time you are active. It won’t increment the step counter before you’ve walked two dozen steps. This has led some reviewers to complain about the Galaxy Fit2 not counting steps accurately.

The step counting is accurate when you’re actually out walking, however. It just doesn’t count very short walks. I can argue that it encourages you to actually walk more and be more active than just walking back and forth between your desk and fridge all day. The Samsung Health app does count steps for short walks, so I’m leaning towards the Galaxy Fit2’s behavior being either a technical limitation or a bug rather than a deliberate design decision.

The Galaxy Fit2 runs a version of [FreeRTOS](https://www.freertos.org/?ref=ctrl.blog), an open-source operating system for microcontrollers. Not that there’s anything open about the device. It’s a completely closed ecosystem, and you can’t run third-party apps on it or even extract data from it without relying on a Samsung app.

The sleep, heart rate, steps, and activity data all get slurped up into the Samsung Health app. Like Google Fit or Apple Health, the Samsung app is a data silo designed more for data capture than thoughtful self-analysis and medical use. The app does feature better visualizations and trends than Google Fit. However, that’s a low bar to cross, and I’d appreciate more options for analyzing my health data.

Samsung made the Galaxy Fit2 from cheap materials and didn’t build it to last. The display remains scratch-free after six months. However, the chassis is full of dents and scratches. The rubber strap doesn’t protect the areas of the armband that are most at risk for scratches.

The band is replaceable, but it has held up better than other bands I’ve used in the same price range. Probably because the Galaxy Fit2 absorbs the brunt of any impact damage directly. The band’s clasp is a simple plastic pin, and I don’t expect it to last more than a year.

So, should you buy a Samsung Galaxy Fit2? If you don’t intend to *interact with it* but just wear it as a passive sensor, then yes. It’s high value for your money. You get more sensors than with the current entry-level trackers from FitBit for roughly 20 % of the price. However, I wouldn’t expect the Galaxy Fit2 to last more than maybe a year or two.

If you’re hoping for something more “fun” or more capable like a smartwatch, then keep looking. The Galaxy Fit2 isn’t an ultra-lite version of the Apple Watch or one of Samsung’s smartwatches. It’s just an activity tracker, but it does that job well.

**Reviewed:** [Galaxy Fit2](https://www.samsung.com/us/mobile/wearables/galaxy-fit-2/?ref=ctrl.blog)

**Review rating:** 5 / 10
### I was terrified of an eyeball injection
URL: https://www.ctrl.blog/entry/eyeball-fright/
Last updated: 2026-08-23T22:06:01.000Z
I’ve been a bit freaked out over the last couple of months. I needed to inject a medication directly into my eyeball. My. Damned. Eyeball! I’d never heard anyone talk about this procedure before, and I’d like to share my experiences. Maybe it can help you be less clueless about it than I was.

It’s my 30-years-living-with-diabetes anniversary this year, and I’ve been diagnosed with diabetic retinopathy. It’s a long-term complication causing too many small blood vessels to form and begin to leak in the back of the eye. The prospects, if left untreated, are a gradual loss of sight and ultimately blindness. It’s treated by injecting a medication that stops new blood vessels from forming into the eye itself.

It was a slow build-up to the actual diagnosis. My eye doctor was worried about the development in my left eye and referred me to a specialist clinic. A couple of weeks later, I received a letter informing me about the date and itinerary for my visit. At the bottom of the list, they’d included “and possibly an injection” with no further details.

That’s a terrifying nugget of information to receive from an eye clinic. Surely, they couldn’t possibly mean an eye-related injection? That’s not a thing, right? It’s only something that happens in horror movies and after some traumatic eye injury, right?

For a couple of days, I convinced myself that it referred to a regular injection required for a specialized photo they take during the examination. It’s a procedure where you’re injected with a substance that shows up under ultra-violet light. They then take a series of photos of your eye over a couple of minutes where the blood vessels (and any otherwise undetectable leaks) show up like city streets at night seen from up high. (Yes, my urine had a fantastic yellow color that lit up under ultra-violet light for the next two days, thanks for asking.)

But that wasn’t it, was it? That injection wasn’t a faint possibility at the end of the visit. Onto the web to look up more information, and lo and behold: eye-injections are a real thing.

The prospect terrified me. I’m a diabetic, so I’m not afraid of needles. But I’m scared of everything when it comes to my eyes. At the time, I couldn’t even say why exactly what scared me about it. It just sounded unreal.

I had so many questions. How do you remain still while the doctor inserts a needle into your eyeball? How far in does it go? Will I see the needle tip approaching my eye while it’s happening? What if the doctor sneezes during the jab? Isn’t there a United Nations convention or something that classifies this as torture?

I’m sure the doctor has done the procedure many times before, and I’d be in a building full of eye surgeons if anything were to go catastrophically wrong. Yet, I was incredibly stressed out and lived with a fight-or-flight response until the day of the “possible injection”.

I went to the examinations, did all the tests, got my brains blasted out the back of my skull with bright camera flashes, and … nothing. I didn’t need the injection! Instead, I had to come back in three months for another examination. I could go home with nothing but an increased sensitivity to light that would wear off in a few hours.

Three months later, I was stressing out again. My new itinerary didn’t list a “possible injection” this time, but I still worried. At the end of the second examination, the doctor said things hadn’t improved since my first examination. He recommended that I take the injections; once a month for a few months.

He asked how I felt about it. My brain short-circuited, and I couldn’t respond properly with my mind racing. He pressed the issue and strongly recommended I take the injections. My brain still wouldn’t accept the new information, and it took a solid ten minutes before I was at a point where I could say “yes”.

I’m not sure what I was worried about. In retrospect, I was mostly worried about my own reaction and whether I would manage to lay still while someone jabbed a needle into my eye. Secondly, would I see the needle? How could I not see the needle while it was inside of my eye? Yikes.

I still get so stressed by the mere thought that I had to take a break here while writing this. At the time, though, there wasn’t anything concrete that stressed me out. It was just such an alien experience to me, and I didn’t know anything about the procedure other than the part where the needle goes into the eyeball.

The doctor noticed my hesitation and anxiety, and gave me an anti-anxiety pill and some water. Half an hour later, I lay on a bed with a liberal amount of local anesthetic dripped into my eyes. I was trying my best to force my eyes open as the doctor tried in vain to install an eye speculum. The doctor didn’t show me the speculum before trying to install it, and I felt uneasy and frightened by the mere idea of it. I’ve only ever seen devices designed to prevent someone’s eye from closing in torture scenes in movies. There were sound medical reasons for installing it, but that wasn’t a mental priority at the time.

As I lay on the table, the doctor repeatedly asked me to open my eye. I tried my best to comply. My fear of the situation overruled my proprioception. I tried to instruct my eye to open, and *I perceived* it to be open. Yet, I was seeing the inside of my eyelid. Upon realizing I’d lost control over my eyelids (this is without the speculum), I felt my heart race and I kept forgetting to breathe.

The doctor gave up on the procedure, and I agreed to give it another shot in two weeks. Looking back at this, I’m a bit disappointed that the doctor only wanted to increase my anti-anxiety medication and try again. We definitely should have had a chat about my experience and what we could do to achieve better results next time.

I was stressed out and had problems sleeping for most of the two weeks. I read up on the procedure and the equipment and even steeled myself to watch a video of it. I can’t say this didn’t freak me out or that I was comfortable watching the video. However, I can say that it made me better prepared to go back and try again. The procedure wasn’t this big scary unknown thing anymore. It was just a very unpleasant future prospect that made me very uncomfortable.

In my amateur online research, I came across another video with an eye surgeon discussing how to deal with anxious patients. He suggested gently poking the patient’s eye with a sterile cotton swab and asking if they could see or feel it. “That’s how you’ll experience the injection.” (I can’t find the link, sorry!)

Exposure Therapy 101! I thought this sounded a lot less scary than going straight to jabbing a needle into the eyeball. It would answer the question of whether I’d see the needle or not during the procedure. I made a mental note to ask the doctor to do this for my next visit. It also lowered my stress level as I made a secret plan to abort the procedure if I was freaked out by the cotton swab.

… and then, the next visit went just fine. I showed up and got a doubled dose of anti-anxiety medication. However, I don’t believe that it did as much to calm me as feeling more prepared myself. I’d seen it done, I knew more about what would happen, and I had a plan to warm up with some super-quick exposure therapy.

I told the doctor about the cotton-swab thing, and he agreed to do it. I didn’t use the words “exposure therapy” while describing it, but he muttered it to himself as he went to grab a swab. I was surprised to learn he’d never heard of it before. Maybe most other anxious patients get so relaxed by the anti-anxiety tablets that it isn’t a problem. I guess those don’t work as well on me. In any case, the cotton swab should be part of the standard procedure for new patients.

I felt a lot better about the whole situation going into it. I was given anesthesic drops again, and even that went more smoothly than the last time. We did have a little trouble when he began installing the eye speculum and started giving me instructions for where to look, though.

He wanted me to “look at my shoes”, but I felt a bit panicky at the time, and had to respond that I didn’t know where they were in relation to anything else at that exact time. He suggested I look at the bottom of his surgical mask instead. It took me like a solid ten seconds to seek it out with my eye, but as soon as I did and stopped moving my eyes the speculum was in. Why there wasn’t large brightly colored shapes in the ceiling to look at I’ll never understand.

My heart started racing and I had problems controlling my breath. I couldn’t blink and started to panic. Somehow, I’d not thought about this aspect of the procedure beforehand. I knew it intellectually, but I didn’t realize that not being able to blink would give me a panic. A deep fear about the procedure suddenly crystallized in my mind: *I fucking hate bright lights!* I lay on my back in a very brightly lit room and couldn’t close my eyes.

I hate sunlight, I hate brightly lit retail stores, and I hate not being able to look away from a bright light source. A 20-minute session under a bright examination light is like *the* thing I dislike the most about going to the dentist. I use a [daylight therapy lamp](https://www.ctrl.blog/entry/review-beurer-tl20/) four months of the year, and I hate every minute of it.

I asked the doctor to hold his hand over my eye to give them some shade and rest. According to my fitness band, my heart rate fell from 140 beats per minute (bpm) to 88 bpm from one measurement to the next about five seconds later. I immediately calmed down and felt greatly relieved.

About half a minute later, he slowly pulled his hand away, and I could more gradually adapt to the lighting. I still wasn’t comfortable with it, but it didn’t cause me to panic anymore.

As we’d discussed, he proceeded to stroke the side of my eye with the cotton swab. I couldn’t feel a thing, and I couldn’t see the damned thing. I felt a lot better about the whole endeavor.

Maybe 20 seconds later, I could see some small bubbles floating upwards in my vision. That was it. That was the injection. Just some tiny bubbles reflecting light in crazy ways. I’d been scared and freaking out on and off over a couple of months over a couple of small bubbles.

I should have been told to stick my hands under my body to keep me from bringing them up to my face. Twice during the procedure, I reflexively started raising my hands to rub my eyes. I stopped myself halfway through the motion, but the nurse got really freaked out by it.

My vision was grayish for a couple of hours. Having gone through this part before, I knew this was a short-lived side-effect of the anesthesia. My eyeball and eyelid felt a bit sore for the next four days. I startled myself a couple of times in the first couple of days as my eye would suddenly hurt as I looked up or down. I guess this is the normal reaction to an unfamiliar feeling of “there’s something wrong with my eye!”

So, this has been a story about overcoming fear with knowledge (and two tablets of anti-anxiety drugs). However, it’s also about poor communication. I’m sure I would have been less anxious and had a better couple of months if the initial letter contained more information. I’m absolutely sure it would have helped if the doctor had volunteered some more specifics about the procedure.

We briefly discussed my anxiety, but his immediate solution was the anti-anxiety drug. I made it clear that I was worried about the procedure and wanted to know more details about it. He didn’t want to explain the procedure beyond “we’ll inject medication that will help preserve your vision”, and he avoided answering repeated questions. Maybe he tried to shield me from the details and not confirm my worst fears.

I didn’t have the experience to know what to ask for. One of the few things I did ask about repeatedly was whether I could see the needle going in or not. The doctor who gave me the exams and diagnosis said he didn’t know. The surgeon said I wouldn’t see it approaching as it would come from the side. But he didn’t know if I’d see the actual needle from inside my eye looking out. Instead, he volunteered some technical details about the brand, length, and thickness of the needle itself (not something I asked about).

Frankly, I’m surprised that no one seemed to know the answer to this. Surely other patients must have asked about it? Or commented on it after the procedure? For whatever reason, I was very worried about whether I’d see the needle. I believe this one technical detail about the procedure served as a proxy for how I’d react to it going into my eyeball.

I’m not freaking out about my next injection in three weeks. I can’t say I look forward to it, but I don’t believe I’ll lose any sleep over it either. I’ve conquered the unknown, and discovered it to be nothing but a brief display of bubbles.
### The HTML <video> element needs to go back on the drawing board
URL: https://www.ctrl.blog/entry/html-responsive-video/
Last updated: 2026-08-23T22:11:30.000Z
We’ve had the HTML `<video>` element for over a decade. Yet, everyone still defaults to embedding YouTube frames instead of hosting their own videos. The underlying problem is that the `<video>` element isn’t suitable for embedding short video files on webpages. 

Sure, the `<video>` element works great for large streaming platforms and tube sites. However, video is nowhere near as simple to use as other adaptive embedded media, such as responsive images.

You need half an hour of learning to get started with responsive images. All you need for responsive images is to include a specially formatted list of an image in different sizes and file formats in your HTML document. The web browser uses the list to pick a format it supports at the right dimensions for the visitor’s device. Here’s a slightly simplified example:

```html
<picture>
  <source type="image/avif" 
    srcset="small.avif 400px, large.avif 800px">
  <source type="image/jpeg" 
    srcset="small.jpeg 400px, large.jpeg 800px">
  <img src="fallback.jpeg" sizes="400px">
</picture>
```

Neat, right? It’s a bit more complicated than that, but that’s the essentials. Given some familiarity with the basics of HTML, you can guess what it does and even learn that syntax. Using media queries, you can even respect user preferences like reducing motion, saving data, and dark mode.

The story isn’t the same when it comes to video. The HTML `<video>` element is similar to the `<picture> `element. It even uses the same `<source>` element to list videos in different codecs/formats, and you place fallback content inside it the same way.

However, the `<source>` element does **not** currently support either the `media`, `srcset`, or `sizes` attributes for `<video>`. You can only set a single source (`src`), and its container and codecs information through the `type` attribute.

HTML doesn’t provide web authors any affordances to send a high-resolution video to a desktop or tablet, and a lower resolution to a mobile phone. You can send an oversized video to mobile devices, but at potentially high data and battery costs. Or you can send an undersized video and scale it up (with ugly upscaling artifacts) to desktops. A 720p (720×405 px) video suitable for desktops and tablets contains ×2,25 times more pixels (roughly ×2,1 times more data) than a 480p (480×270 px) video file for mobile.

You can turn to JavaScript and have it pick the right video, but it’s a complicated problem. Choosing the right codec, handling full-screen mode switches, subtitles, adaptive quality changes, network conditions, pixel density, preloading, … it all adds up. It’s not a quick job to write the logic required to choose an appropriate video resolution, and handle changes on the fly.

The average JavaScript library for handling video resolutions and full-screen mode switching is about 600 KB. Minified but uncompressed size. The figure represents the execution overhead, but not the data transfer size. It’s a small overhead for a 15 minute+ video. However, it’s way too much for a short animation or a minute-long presentation. 

You also have to spend time learning and integrating a complicated new library into your documents. Serving video is still relatively expensive, so you might also need a separate library to reduce the hosting costs (e.g. WebTorrent). If you’re planning on publishing many videos, it might be worth it. However, it’s too much overhead just to add a few minutes of video to a blog post every once in a while.

YouTube and other large video streaming services have long since adopted technologies like HTTP Live Streaming (HLS) or Dynamic Adaptive Streaming over HTTP (DASH). These technologies aren’t supported natively in many web browsers. Safari supports HLS. Chrome and Firefox has limited support on Android. Desktop support is non-existant besides Safari. Again, you have to rely on fairly heavy JavaScript libraries to implement the adaptive streaming technologies. You also have to cut your videos up into chunks, prepare playlist files, and attend to more overhead work. 

Neither HLS nor DASH is suitable when you “just need to add a simple video to a webpage”. They’re too complicated and too powerful for such a simple use case. The HTML standard has just left this gap unfilled for a decade. It might help explain why *everyone* just defers to embedding a frame hosted by YouTube to embed video on their websites. **HTML video is too much work even if you’re motivated to host it yourself.**

Maybe I’m asking for a faster horse here, but I do believe the HTML standard needs to address this issue. There needs to be a simpler way to embed a video on a page and have the web browser pick a file with dimensions appropriate to the device. The default web browser multimedia player also needs to add a control to let the viewer override the quality picked by the browser.

Scott Jehl kickstarted the discussion about this in January 2021 with his call to [add the media attribute to the video source element](https://www.filamentgroup.com/lab/video-with-sizes/?ref=ctrl.blog). It’s supported in Safari, and was part of the HTML standard a decade ago. It was removed from the standard, but … Safari isn’t known for keeping up with the times when it comes to web standards.

The proposal enables web authors to specify different video sources for different screen resolutions. It wouldn’t enable the user to override it, and it’s unclear how full-screen such would be handled. It’s currently being discussed in the Web Hypertext Application Technology Working Group (WHATWG). WHATWG is the organization currently maintaining the HTML standard. 

Here’s an example using the capabilities proposed by Scott Jehl. In this example, screens of 700 px or larger gets a large video file, and smaller screens gets a small one instead. You can go more granular than this, but the below would already get 90 % of the job done.

```html
<!-- proposed standard! -->
<video poster="enticing-placeholder.jpeg">
  <source type="video/webm; codecs='vp9, vorbis'"
    media="(min-width:700px)"
    src="large.webm">
  <source type="video/webm; codecs='vp9, vorbis'"
    src="small.webm">
  <source type="video/mp4; codecs='av01.0, opus'"
    media="(min-width:700px)"
    src="large.mp4">
  <source type="video/mp4; codecs='av01.0, opus'"
    src="small.mp4">
  Your browser doesn’t support video. You can
  <a href="large.mp4">download it</a> instead.
</video>
```

This would be an improvement over the status quo. The media query lets the browser pick a more appropriate source, but it’s left up to the document author to decide what’s best for different devices. The syntax doesn’t give the web browsers any information about what’s different between the different video sources. It can’t make an informed decision about the best source without knowing more about them. Without this information, it would also be impossible for the browser to display a controller to let viewers choose their preferred video playback quality.

I believe that a better solution would be to use the `sizes` (and possibly even `srcset`) attributes instead of abusing media queries. Just for a minute, forget how this attribute is used on `source` elements descending from a `picture` element. Instead, think of how it’s used for picking favicons. Web authors can include multiple favicon files and the browser looks at the `sizes` attribute to pick an appropriate size. Let me try to explain it with another example:

```html
<!-- proposed standard! -->
<video poster="enticing-placeholder.jpeg">
  <source type="video/webm; codecs='vp9, vorbis'"
    sizes="720x405"
    src="large.webm">
  <source type="video/webm; codecs='vp9, vorbis'"
    sizes="480x270"
    src="small.webm">
  <!-- equivalent, compact (ordered) form -->
  <source type="video/mp4; codecs='av01.0, opus'"
    sizes="480x270 720x405"
    srcset="small.mp4, large.mp4">
  Your browser doesn’t support video. You can
  <a href="large.mp4">download it</a> instead.
</video>
```

The browser could then look at the intrinsic size of the video element, the screen resolution, network conditions, and pick the most appropriate source. It could even display a button to let users switch between the available video resolutions.

There are still issues with this approach, but it would make responsive videos on the web just as simple as responsive images. For example, what happens if you’re watching small.mp4, and switch to full-screen mode? Surely, you expect it to switch to large.mp4 instead and continue playback at the same time position. What if the two video files are of different durations? There’s a hornet’s nest of potential issues, but I’d take the occasional stings over the status quo any week of the day. 

There are still unresolved questions, however. For example, the `poster` attribute lets you specify a placeholder poster image. Do we need a new `posterset` attribute to provide a set of responsive images at different resolutions? Then what about image formats? Or using a keyframe from the video file? Should posters be moved inside the `video` element as another descendant `source` element with a `kind="poster"` attribute? I don’t know.

One thing’s for sure: either we need much cheaper and faster smartphones with virtually free data plans; or HTML video needs to be overhauled to allow for responsive videos. Or we could ignore the problem and continue outsourcing it to YouTube. It works pretty well if you don’t mind centralization and Google injecting ads into your videos.
### How to limit Samsung Customization Service data collection
URL: https://www.ctrl.blog/entry/samsung-oneui-customization-service/
Last updated: 2026-08-23T22:21:41.000Z
Samsung customers have likely been prompted by their devices to opt into the Samsung Customization Service (SCS). The prompt doesn’t explain what SCS does beyond linking you to its longwinded privacy policy. I was uncomfortable turning it on without knowing more about it, so I read the privacy policy. Yikes. Samsung collects everything it can get its corporate paws on.

I turned it on, let it collect data for a week, and then tried to limit its collection. I used personal data exports from my Samsung Account to compare and confirm that it did indeed reduce its collection. I can confirm that either the method described in this article works or alternatively that Samsung is in breach of the GDPR.

Samsung says SCS provides you with “personalized content based on how you use your phone and devices”. In reality, it only provides a handful of minor features in exchange for uploading a lot of your personal information to Samsung.

Samsung has published a dedicated [privacy policy for SCS](https://web.archive.org/web/20211023035902/https://www.samsung.com/us/account/customization-service/). You should read it. It’s unusually straightforward about collecting your contacts, calendar, calls and messages, search and internet browsing history, location (GPS and Wi-Fi), and other data off your device. It doesn’t disclose how long it retains the data, and leaves itself plenty of maneuvering room when it comes to its use.

Unless you need SCS enabled on your Samsung devices, you should probably turn it off. Unless you know why you’ve enabled it, then you should also turn it off. You can always turn it back on if you later discover that one of your favorite features requires it. You can turn it off from the Settings app: Privacy: Samsung: Customization Service screen.

Maybe you really want one or two features that Samsung has gated behind its privacy-intrusive SCS service. Samsung has gated some enthusiast and basic features behind users opting into sharing data with the company. Pro tip: The gating is somewhat porous. Some apps let you enable a gated features while you’re opted in, but doesn’t turn them off again if you later disable the Customization Service.

For instance, the [Samsung Galaxy Fit2](https://www.ctrl.blog/entry/review-samsung-galaxy-fit2/) activity monitor will disrupt your sleep by shining a bright light into your eyes unless you’ve opted into SCS. Samsung requires SCS to enable the companion device’s “Good night mode” which turns off its display at night. The Fit2 itself *is* a sleep monitoring device, so it’s unclear what value Samsung’s cloud services provide here. It’s not like the device isn’t purpose-built for detecting sleep and could turn off the display when it notices that you’ve fallen asleep.

If you decide to leave the service enabled, then Samsung lets you opt out of the collection of call/message history, search and browsing history, and location history. You do this by clicking on Data management on the same screen as before. Depending on which SCS features you use, you likely won’t notice any difference after disabling these data points.

Samsung does **not** provide you a choice to opt out of the collection of Samsung Health data, calendar events, app and device usage statistics (what apps you use and how long), or information about your music collection/playback history and photos. Samsung already has your health data if you use its apps. However, it would be nice to disable any usage of health data for personalizing ads and Samsung services.

A list of your installed apps can say a lot about you, and it may contain a lot of data you don’t want to share. For example, it may contain hints about your medical needs, political leanings, and even sexual orientation. What are you doing on a niche dating app all day? Do you really spend two hours on Reddit and mobile games daily? Why do you use your phone so much during work hours?

You can block the Customization Service from accessing your device usage metrics through the Android permissions system. Open the Settings app: Apps, click on the overflow menu (three dots in the top right corner), and select Special access. Click Usage data access and select Customization Service. Tap the toggle to disable its access.

I’ve confirmed that this works by requesting my personal information from Samsung and verified that app usage data stopped appearing after making this change. It’s not guaranteed to work forever, however.

As the device manufacturer, Samsung has blocked you from disabling permissions for many of its preinstalled apps. It’s your device, but the company still retains a lot of control over it. However, it has forgotten to prevent you from disabling this intrusive special permission. Praise be to Samsung’s incompetence, which works to the user’s advantage in this instance.

SCS is Samsung’s version of Google’s Android System Intelligence (formerly named Device Personalization Service (DPS)). Google is in the same racket, but it offers significantly better features in exchange for your data. If you’re interested, then read the Binary Hick’s [forensic analysis of DPS](https://thebinaryhick.blog/2020/05/16/walking-the-android-timeline-part-2-using-androids-device-personalization-services-to-timeline-user-activity/?ref=ctrl.blog) from May 2020.

In Android 12 on some devices, the System Intelligence service is moved \[at least partially\] on-device under the branding “Private Compute Core”. It’s unclear exactly how much data is processed on-device and whether it still uploads some or all of it, or the analysis results, to Google.

In my opinion, the whole Customization Service is an unnecessary “feature” that only exists to collect more data about you. Turning it on can offer some small feature improvements and benefits in some apps. However, I’ve seen nothing from it that couldn’t have been implemented on-device without sharing the data with Samsung.

On the other hand, once you’ve limited its data collection, then the service doesn’t collect more information than what every other app on your phone is also grabbing. SCS is a blemish on Samsung’s Android products, and I can only hope they follow in its competitors’ footsteps and move towards more on-device analysis and less data harvesting.
### Timberborn: a cute beaver colony sim with an unrewarding late game
URL: https://www.ctrl.blog/entry/review-timberborn-colonysim/
Last updated: 2026-08-23T22:20:12.000Z
I love colony simulation games like RimWorld, Patron, and Surviving Mars; and I’ve sunk way too many hours into these games. My latest obsession is [Timberborn](https://timberborngame.com/?ref=ctrl.blog) — a *vertical city builder* inhabited by intelligent beavers that have inherited the Earth after humans are long gone. 

It’s delightful to watch the beavers as they bustle about collecting resources and go about their daily tasks. The art direction and the beaver simulation bring the game to life. The beavers take breaks from their tasks to eat and drink, and they wander off to stand on balconies and stare out over the bustling city life. Their little breaks can disrupt your production chains, but it’s a nice break from the typical mindless automatons that populate most colony/survival games.

Timberborn’s gimmick is that seasons represent changes to the water flow of its life-giving rivers and droughts. Most games in the genre are split into a summer/growing season for stocking up on resources, and a hash and snowy winter season to put your colony to the test. In Timberborn, you need to hold on to water through the droughts by building dams, and expand your colony by irrigating wasteland.

There are nine maps with varied terrain and rivers, and plenty of opportunities for water management. Water always takes the easiest route, so a small change can reroute it upstream and flood your entire colony. The best laid plans of beavers often go awry. Water traversal isn’t a problem for the beavers, but it sure interferes with your production.

Now that I come to think of it, the beavers *do* have some trouble traversing water. It’s frustrating and non-intuitive that your beavers need stairs to get in and out of bodies of water. *They’re beavers!* They should manage to jump into and haul themselves out of a river without the aid of stairs!

In the early game, you’re likely to run out of food or water by the end of the first drought period. There’ll be dead beavers everywhere, and this doesn’t have any negative effects on other beavers. Except, naturally, the potential for a worker shortage. Capitalism doesn’t care if you live or die, and neither does the post-apocalyptic beaver society of the future.

Food production isn’t a problem after you’ve mastered the water on the level as you can grow food all the time. At that point, you’ve also run out of gameplay. There isn’t much depth to the game; the beavers don’t have any needs beyond food and water.

You can raise their happiness by fulfilling more needs, but there aren’t any negative effects of not fulfilling their other needs. Nothing in the gameplay is gated behind your beaver happiness level. The game doesn’t have a traditional tech-tree; you can unlock any item in any order given you’ve accumulated enough research points.

The game has two factions with quite varied play styles and a couple of unique buildings. There’s plenty of replay value packed into the game, but you can quickly grow attached to a colony and don’t want to abandon it for something new.

After an hour or two of playing, I’m left panning over my city full of happy and fat beavers; with their every needs met. However, I’m left feeling like I’ve just gotten started on the game, and then it’s already over. *That* was the game.

I kept myself entertained in the late game by building ever taller and more elaborate mega-structures. The game lets you stack many buildings on top of each other, and providing vertical access can be quite the challenge.

The game falls short in the late game. Once your colony has enough food and water, then you’re pretty much done. The game doesn’t have many more challenges in stock for you. You can continue playing with the colony for as long as you want. However, the game won’t throw any more challenges at you.

Other solid games in the genre provide more challenges in the late game. Banished and Patron introduces new crop types via trade boats, and every citizen has a growing list of needs beyond just food and water. In RimWorld, you can pack a caravan and set off to explore beyond your territory. In Factorio, you can fire a rocket off into space and unlock some new and exciting things that break the game, but they’re adding something new and fun to the game.

In my opinion, Timberborn could be significantly improved by mix things up in the late game with new challenges. The following is my wish list for things I’d like to see added to the game. These are just some examples of mechanics I think could help make the game more entertaining in the long haul.

- An obvious one is flash-floods caused by rain or just excess water flowing in from upstream. Large dams have spillways, and your beaver civilization should suffer the consequences if it doesn’t plan for increased water levels.
- There’s room for natural progression where new mechanics get introduced as you progress through the game. A larger city also has more requirements and different needs than a small one. Population targets could trigger new needs like hygiene (baths), health (medicines), and waste management (plumbing).
- Your colony consists of mostly wooden structures (it’s a lumberpunk society, after all). Fire hazards and prevention should feature prominently in the game. I don’t believe that beavers have somehow mastered fire to such a degree that it never gets out of control.
- Once the population exceeds a certain level, groups of your population could float off downstream on their backs to look for new opportunities elsewhere. A large emigration could leave your colony with a worker shortage and sustainability issues. Similarly, your colony could get [visitors from upstream colonies](https://timberborn.featureupvote.com/suggestions/225340/visiting-beavers-from-upstream?ref=ctrl.blog) floating down on the river.
- Similarly, a group of beavers can float in from upstream and join your colony for a few days. They don’t immigrate but just eat and drink you dry before continuing on their journey downstream. Maybe they could arrive with the restored river flow at the end of a drought, work through a season and leave after the end of the next drought period.
- The description for the game’s decorative benches makes a joke about youths vandalizing public property. However, it also highlights the lack of a system for wear and tear of your colony’s buildings. There are no maintenance workers and no building logs or stair-boards ever need replacing.
- There is plenty of room for random events that could affect the game’s buildings and production chains. Accidents with the beavers that work in them, damage to the building, and research inspiration and other production boosts. Maybe a windcatcher or a windmill gets caught and flies off with the wind. Random events can add flavor and variety, and that’s something Timberborn needs after a few hours of play.

These are just some ideas that could shake up the gameplay in the late game stages. The game studio probably has better ideas that didn’t make it into the game. I’ve submitted some of these ideas to the studio through their feedback system. Maybe you’ll find one or more of the above ideas (or better ones) in the game in the slight future.

The game is still in “early access”, so we could still see improvements to it in the future. The game had a free limited beta version available for half a year before it was released in early access. So, I guess I’m not sure what “early access” means anymore and what to expect for the game’s future.

The game only supports Windows. However, it runs excellently on Linux in Steam Proton compatibility mode. It’s more optimized and has few performance issues compared to early releaaes of similar simulator games.

Timberborn is a good game, and the novel water mechanic is refreshing for the genre. I recommend you check it out if you like colony/survival simulator games. The game is 21 Euro (25 USD), and you get your money’s worth. Just don’t expect a game to last too long before you need to start on a new colony.

**Reviewed:** Timberborn

**Review rating:** 7 / 10
### How to enable file versioning on Windows
URL: https://www.ctrl.blog/entry/how-to-windows-file-versioning/
Last updated: 2026-08-23T22:11:19.000Z
Windows comes with many great built-in tools that, unfortunately, are hard to discover and even harder to use. One of these is its built-in file versioning tool called File History. Once set up, it can keep copies of old versions of all your files and documents. It can be incredibly useful to restore a previous version of a file or a folder after you’ve made an accidental change or deletion.

“But I don’t use any files and folders on my PC!” Everything on your PC is stored in files in folders. You might not work with documents and spreadsheets, but file versioning is just as useful for your game-save files, source code, and photos. It can also be used with your application data to, for example, restore a deleted browser bookmark or email message.

File History is also the closest Windows comes to protecting your files against data degradation (also known as “bit rot”). It’s satisfying to restore an earlier version of a file after it’s unintentionally changed — whether from a user-, software-, or hardware error.

File History stores complete copies of each of your files, so it might not be suited for large files that are frequently changed (e.g. virtual machines). However, it does mean you can use File History to back up your files as well as file versioning.

Once configured, you can right-click on a file or folder in Windows File Explorer and select *Restore previous versions*. File History won’t save a new version of every change you make to your files. By default, it runs once every hour, though that can be lowered to every ten or fifteen minutes. Each time it runs, it stores one full copy of each file that has changed since the previous run.

You can either configure File History to back up to a secondary disk or partition, a removable disk, or a network-attached storage (NAS) disk or home server over the SMB protocol (a “Windows network share” or “Samba share”). Each approach has different advantages and drawbacks. The main differences are:

- Using an internal or removable disk will be much faster than a network share, but requires you to reconnect at least once every ten days. A network share can be more convenient as it can work wirelessly over Wi-Fi, or even over the internet (assuming you can VPN into your home network).
- Disks and partitions can support file compression. This lets you fit more backup copies into less disk space. Compression is only supported on some types of network shares.
- Disks and partitions can be encrypted with Windows BitLocker. (Requires Windows Professional edition.) Network shares will be stored unencrypted. You can [work around these limitations](https://www.ctrl.blog/entry/how-to-file-history-network-storage/), but it’s a lot of effort.
- Disks and partition have a couple of [known problems](https://www.ctrl.blog/entry/how-to-reconnect-file-history-drive/) that appear over time. Network shares aren’t affected by these problems; they’re in enterprise setups, so it’s better tested and supported by Microsoft.

Alternatively, you can let File History keep old file versions in a folder on your primary storage disk. This method diminishes File History’s value as a backup service, but you still get the benefits of its file versioning and restoration capabilities. This is probably the best option if you’re only interested in these aspects of File History. It has the advantage of being much faster and more battery-efficient than the other methods.

1. To get started, open File History from the Control Panel or by searching for it (press the Windows key + S).
2. Click Select Drive.

From this screen, you can either select a disk or partition on your device or select a network share. You may need to enter the path to your network share manually if Windows can’t discover devices on your network automatically.

The process is almost the same if you want to run File History against a folder on your local device. Create a new folder named “File History” inside your user profile folder (press Windows key + R and type %USERPROFILE% to open it). Right-click on the new folder and select Properties. Click on the Sharing tab and click Share. This should populate the dialog with a network path. Copy and paste this path as the network path to use in File History. 

1. Once you’ve selected a disk to use with file History, find the disk or network share you chose in Windows File Explorer.
2. Right-click on it and select Properties.
3. Under Attributes click Advanced.
4. Enable compression and click OK on both dialogs.
5. When prompted, confirm that you want to apply the change to the folder and its contents.

Steps three–seven above are optional, but can help make better use of your available disk space. Compression can slow down file access times. However, this isn’t a problem with File History as it’s primarily used for archival and only the occasional file retrieval. Compression might not be available for all network shares.

You also need to add some folder exceptions in File History. It’s important to set up folder exceptions properly to avoid filling your File History archive with downloads, caches, and other ephemeral files.

Despite what the File History control panel says about it only backing up your Library collections, it actually backs up everything in your user profile folder. (This was changed in Windows 10, but Microsoft hasn’t updated the description in the File History control panel.) This includes the hidden `AppData` folder which contains your temporary items folder (`%TEMP%`), browser caches, and other ephemeral data. The folder also contains your app settings and data for many apps.

If you’re backing up to a folder inside your user profile directory, you **must** at the very least exclude this folder. Or you’ll quickly run out of disk space from recursively backing up your backups. To exclude directories from File History:

1. Go back to the File History control panel and click Exclude folders.
2. Add the following exclusions:
  - The folder you’re saving your File History into (if this folder exists inside your user profile folder).
  - Your temporary items folder (type `%TEMP%` into the folder prompt).
  - Your Downloads folder. You can always re-download things, and these files tend to be large.
  - The File History staging and configuration folder (type `%LOCALAPPDATA%\Microsoft\Windows\FileHistory` into the folder prompt).
  - Optionally, the entire `%LOCALAPPDATA%` folder. It contains your app settings like browser bookmarks, many game saves, and configuration files. It’s safe to include this folder if you otherwise never open it.

You can use an application like [Filelight](https://web.archive.org/web/20210614215610/https://apps.kde.org/filelight/) (available for free in the [Microsoft Store](https://apps.microsoft.com/store/detail/filelight/9PFXCD722M2C?ref=ctrl.blog)) to identify folders you might want to exclude from your backup. Point it at %LOCALAPPDATA% and take a look around. 

The last configuration option you should set is the backup frequency. By default, file History stores copies of your changed files once an hour. The default is probably fine if you infrequently work with files. You can change it in the File History control panel by clicking on Advanced settings. Here you can also trigger clean out old versions of files if you need to free up disk space later on.

You can also include folders and even network shares in File History even if they’re located outside your user profile folder. There are two methods that let you do this: either by creating an NTFS file junction to the folder inside your user profile folder, or by including the folder in one of your Library collections.

The latter method is the easier one to set up. Press the Windows key + R and type shell:Libraries to manage your library collections. Right-click on a Library or an empty area of the window and select properties to manage your libraries. Add the desired folders to any of your libraries. 

File History might not be the best backup or file versioning tool, but it gets the job done. It’s a shame that Microsoft hasn’t invested more resources into polishing File History and making it easier to use. There were rumors that Microsoft would remove it in Windows 11, but it’s still available.
### Brave and Firefox to intercept links that force-open in Microsoft Edge
URL: https://www.ctrl.blog/entry/anti-competitive-browser-edges/
Last updated: 2026-08-23T22:01:47.000Z
Microsoft has inadvertently re-heated the web browser wars with the company’s anti-competitive changes to Windows 11\. It made it [more difficult to change the default web browser](https://www.theverge.com/22630319/microsoft-windows-11-default-browser-changes?ref=ctrl.blog) and has expanded the use of links that force-opens Edge instead of the default browser.

The latter issue is something I addressed in 2017 with the release of [EdgeDeflector](https://www.ctrl.blog/entry/edgedeflector-default-browser/). Instead of using regular `https:` links, Microsoft began switching out links in the Windows shell and its apps with `microsoft-edge:` links. Only its Edge browser recognized these links, so it would open regardless of your default browser setting. I created EdgeDeflector to also recognizes them and rewrites them to regular `https:` links that would then open in your default web browser. 

The [Brave](https://brave.com/?ref=ctrl.blog) web browser added support for the `microsoft-edge:` URL scheme with version 1.30.86, released last week. So, you no longer need to install EdgeDeflector if you’re using Brave as your default browser. It’ll pop up as an option when you click on a `microsoft-edge:` link.

This makes Brave the first web browser to implement support for Microsoft’s anti-competitive URL scheme. However, it’s not the only browser doing so. Mozilla developer Masatoshi Kimura has also written patches to implement the protocol into Firefox. It has yet to pass review and get merged into Firefox, but the ball is rolling. Firefox’s implementation is part of its overall Windows 11 shell integration work.

The new implementations in Brave and Firefox follow the exact parsing logic I wrote for EdgeDeflector. It’s not the only way to parse them, it’s not the best way to parse them, but it’s the way every third-party implementation now parses them. Neither codebases attribute the code to EdgeDeflector, although both are clearly inspired by it. (Don’t get me wrong, I’m fine with this.)

You may, of course, continue to use EdgeDeflector and let it do its pro-consumer choice thing regardless of your preferred browser of choice. It’s just becoming less relevant now that more browsers natively handle the protocol.

Brave Software is also considering taking things one step further. The company is planning to intercept Windows Search/Cortana links to Bing and redirect them to its users’ default search engine instead.

This change may sound like a good thing, but I’m not a fan of the move. Microsoft is using its market position to promote its search engine very visibly in the Windows shell. It’s a bit icky because Brave Software benefits financially from directing more searches to its search provider partners, and its own Brave Search portal.

Brave is treading into dangerous and uncharted waters by rewriting the destination of a link. This resembles the “growth hacking” tactics employed by \[mostly Russian\] search portals and malware that was prevalent around 2010\. These potentially unwanted applications (PUA; colloquially known as “crapware”) would redirect search links, replace or inject affiliate codes, and link to frame farms that would surround a page with extra ads.

It was common to bundle such PUAs with the installers for other popular software of the time. So-called “install-path revenue” was the primary funding for freeware for over a decade. This eventually necessitated the need for web browsers and operating systems to implement “search setting protections” and “default browser settings protections”.

Modern web browsers implement protections that try to block changes to their default search engine settings. These protection block unauthorized changes to the search setting, but also protect the browsers’ revenue stream from search partners. Unfortunately, distinguishing between a user-initiated change to the setting and changes made by malware has proven difficult. Web browsers had a tough time navigating these waters over the years, and it has led to many user-hostile changes. E.g. it’s become difficult to manage, and backup and restore your browser profile.

Likewise, operating systems including Android, iOS, macOS, and Windows include protections to prevent unauthorized changes to the default web browser setting. Let’s all take a minute to appreciate that Windows 11 now meets the definition of a PUA by subverting the default browser setting.

Annoyed by Microsoft’s anti-competitive changes to Windows 11, Mozilla put its developers on the task of cracking the default browser protection in Windows 11\. Unfortunately, [they succeeded](https://www.theverge.com/2021/9/13/22671182/mozilla-default-browser-windows-protections-firefox?ref=ctrl.blog). This success isn’t a good thing, however. The default browser protection is there for a reason, and it’s not just an antitrust issue. If Mozilla can bypass it, so can PUA and malware.

Some Microsoft apps explicitly say “Open with Bing” or “Search with Bing”. In these situations, Brave will break user expectations by redirecting them elsewhere. Then again, many links in the Windows shell look like links to documentation, but instead link to a Bing search result. In Windows 7 and earlier, these links pointed directly at documentation authored by Microsoft.

I believe it’s anti-competitive of Microsoft to ignore the default browser setting to promote its own web browser. However, I’m less convinced about hijacking search links. If the user enters a search query into a Bing search box, then surely the expected result is to end up on Bing. Users might disagree with the design decision to include a Bing search box in the Windows shell, but they still chose to use it.

I’ve been requested to implement a Bing-to-Google redirect into EdgeDeflector since day one. I’ve always resisted; EdgeDeflector has always been about restoring the functionality of the default browser setting. Users can always install redirect extensions in their web browsers if they truly never want to end up on Bing. However, a users’ choice of search engines is, at least in my mind, separate from their choice of web browsers. Although that might not be the case anymore as a diminishing number of people are aware of the difference.

The browser wars are truly re-heating. The game is afoot — and I must say, the timing is weird. Regulators around the world are aggressively scrutinizing big tech for anti-competitive practices, yet everyone on the field is playing dirtier by the day.

So, how did we get here? Until the release of iOS version 14 in September 2020, you couldn’t change the default web browser on iPhones and iPads. Google has many apps for iOS, including a shell for its Chrome browser. To tie all its apps together, Google introduced a `googlechrome:` URL scheme in February 2014. It could use these links to direct you from its Search or Mail app and over to Chrome instead of Apple’s Safari browser. 

These vendor-specific URL schemes were introduced to combat Apple’s anti-competitive behavior on its iOS platform. Microsoft just turned the racket on its head and changed more and more links in its operating system and apps to use its vendor-specific URL scheme. The original sin was Apple’s, but Microsoft is gulping the juice of the apple with gusto.

#### Sources

- [Implement microsoft-edge: protocol handler](https://bugzilla.mozilla.org/show%5Fbug.cgi?id=1726697&ref=ctrl.blog), issue #1726697, 2021-09-30, Masatoshi Kimura, Firefox project, Bugzilla, Mozilla
- [When Brave handles microsoft-edge: protocol searches use user’s default search instead of Bing](https://github.com/brave/brave-browser/issues/17684?ref=ctrl.blog), issue #17684, 2021-08-25, Brian Clifton, Brave browser project, Brave Software, GitHub
- [Allow Brave to Handle Searches from Windows Shell and Cortana](https://github.com/brave/brave-browser/issues/13875?ref=ctrl.blog), issue #13875, 2021-09-24, Brave browser project, Brave Software, GitHub
- [microsoft\_edge\_protocol\_util.cc](https://github.com/brave/brave-core/blob/a80e1ea7b6c340fef0a5161fe87d1c84ac50d4f5/browser/microsoft%5Fedge%5Fprotocol%5Futil.cc?ref=ctrl.blog), commit a80e1ea7b6, 2021-09-24, Simon Hong, Brave Core project, Brave Software, GitHub
- [Mozilla has defeated Microsoft’s default browser protections in Windows](https://www.theverge.com/2021/9/13/22671182/mozilla-default-browser-windows-protections-firefox?ref=ctrl.blog), 2021-09-13, Tom Warren, The Verge, Vox Media
- [Microsoft is making it harder to switch default browsers in Windows 11](https://www.theverge.com/22630319/microsoft-windows-11-default-browser-changes?ref=ctrl.blog), 2021-08-18, Tom Warren, The Verge, Vox Media
- [Opening links in Chrome for iOS](https://web.archive.org/web/20210122201647/https://developer.chrome.com/docs/multidevice/ios/links/), 2014-02-28, Mobile Chrome, Documentation, Chrome Developers, Google
### Brave reduces the page load performance cost of its adblocker
URL: https://www.ctrl.blog/entry/brave-ab-performance/
Last updated: 2026-08-23T22:02:29.000Z
An adblocker doesn’t necessarily make your web browser load pages faster. The [Brave browser](https://brave.com/?ref=ctrl.blog) introduced a shiny new and more performant adblocking system in late 2019\. However, leftovers from its old system have remained in the browser and have quietly held back its performance potential.

I could spend time describing the change with numbers (I do at the end), but let’s look at the bigger picture first. The two flame graphs below show a 475 ms window during a page load with the current stable release build of Brave (top), compared to the new and improved nightly releases (bottom). The colored bars indicate work the browser has to complete to finish the page load. Ignore the minutia of the graphs, just look at the big differences.

![Graph showing Brave spending almost the entire time span of the graph doing work.](https://cdn.synaps.media/control/content/images/2026/08/brave-performance-v1-29-81.png)

Brave version 1.29.81 (current stable release); 475 ms to load a page. The red area at the top indicates how much time the page is unresponsive (e.g. it won’t scroll).

![Graph showing Brave spending much less of the time span doing work.](https://cdn.synaps.media/control/content/images/2026/08/brave-performance-v1-32-17.png)

Brave version 1.32.17 (a preview release); showing the same 475 ms period as above. The page takes 81 % less time to load.

The improvement directly translates to faster page loads, less memory usage, more battery time, and a lower carbon footprint. By tiny amounts, of course. However, tiny amounts repeated hundreds of times a day multiplied by [36 million users](https://brave.com/36m-mau/?ref=ctrl.blog) (self-reported) equals a lot in aggregate.

I discovered the performance problem while I was looking into some performance problems on a project I was working on. I wasted hours optimizing my own code as I had *not bothered analyzing the performance results*. Once I took the time to analyze the performance results, it turned out — as has been [the theme this month](https://www.ctrl.blog/entry/ruby-rake-performance-patches/) — my code performed fine. The problem was with my browser.

I felt kind of stupid for having wasted my own time. I then reported [the issue to Brave](https://github.com/brave/brave-browser/issues/17538?ref=ctrl.blog). Brave’s developers looked into and addresses the performance issue within a few weeks of my initial report.

So, what caused all this extra work that slowed down page loads? The majority of the work came from JavaScript that the Brave browser injected into every page to help its adblocker. Specifically, it was the cosmetic filter — a component responsible for adjusting page layouts to correct for breakages caused by adblocking. Brave’s developers didn’t need to work on the script to improve its performance; they needed to [delete it](https://github.com/brave/brave-core/pull/9995?ref=ctrl.blog).

It turned out this was just forgotten left-overs of redundant code that slowed down every page load. Brave had already invested the time and resources to improve the performance of its adblocker. It published [a blog post](https://brave.com/improved-ad-blocker-performance/?ref=ctrl.blog) to brag about its new and performant adblocking engine (written in the Rust programming language) in late 2019\. It had just forgotten to remove the old implementation when it introduced its newer and faster adblocker.

The Brave developers have also completed some other optimization work that contributed to the performance gains. However, the change detailed above is the biggest one. Some improvements have been back-ported to Brave version 31 (current beta), but others are only available in version 32 (nightly previews).

I’ve run 24 performance tests of Brave versions 1.29.81 and 1.32.17 using the built-in browser performance testing tools (48 test runs in total). I used an empty HTML document, and subtracted the network load times from the results. Here are the median results of the two test runs:

- Total blocking/unresponsive time improved from 1460 ms to 70 ms (a 95,21 % reduction).
- Script evaluation time improved from 399,13 ms to 38,27 ms (a 90,41 % reduction). The test page doesn’t contain any scripts, so this is solely from Brave injecting its own.
- The page `load` event firing time improved from 962,7 ms to 181,2 ms (a 81,18 % reduction). The page load event is the time from the page began loading until the browser considered it done.
- Peak JavaScript heap (RAM) consumption improved from 13,9 MB to 3,8 MB (a 72,66 % reduction).
- HTML parsing time improved from 165,28 ms to 49,49 ms (a 70,06 % reduction).

Brave spent a whole second longer to load pages compared to competing web browsers without adblockers installed. Brave slowed down page loads even when you disabled its adblocker. The legacy code ran anyway, even when it wasn’t doing anything.

These results are from testing on [a 2018-model Lenovo ThinkPad laptop](https://www.ctrl.blog/entry/linux-on-lenovo-thinkpad-5genx1/) with balanced battery/performance handling. The timings are almost immeasurably short for the same tests on a high-end desktop computer. Most people use laptops and other low-end devices, so the figures are more representative of the average user.

I haven’t investigated whether this impacts Brave on Android. Brave on Android shares a lot of code with its desktop brethren, but the required performance testing takes a lot more time to complete on the platform.

**Update** (2021-09-27): An earlier versiom of this article published the wrong figure for the `load` event timings. (The figure wasn’t corrected for network overhead.) The mistake has been corrected.
### Patch origin trust vs GitHub’s URL hierarchy
URL: https://www.ctrl.blog/entry/github-patch-url-trust/
Last updated: 2026-08-23T22:08:22.000Z
Attentive readers may have noticed something a bit weird with the GitHub patch links in my last article. I shared links to two patches for Ruby's Rake build system which I also said hadn't yet been accepted into Rake. Yet, the patches looked like they came directly from the Rake project's official code repository at `https://github.com/ruby/rake/`. So, how did I get a patch URL that’s indistinguishable from commits/patches that are part of a project?

Every code repository on GitHub resides under first either a username or organization name, and then secondly under the project’s name. For instance, the `https://github.com/ruby/rake/` project is organized under the `ruby` organization’s `rake` project. Code, issue tracking, and proposed code changes all live under that same URL hierarchy.

Proposed code changes, or “pull requests”, are suggested changes contributed by project collaborators or just anyone with something to contribute. These changes haven’t yet been approved and made part of the project. You can find them under the `pulls/` section of a project’s page, e.g. `https://github.com/ruby/rake/pulls/`.

In [my article](https://www.ctrl.blog/entry/ruby-rake-performance-patches/), I included the following links to my patches in the Rake project. The patches hadn’t yet been accepted into the project at the time of publication.

- `https://github.com/ruby/rake/commit/f8afda2b22.patch`
- `https://github.com/ruby/rake/commit/abf5e26464.patch`

There’s nothing to indicate that my patches aren’t part of the Rake project. They’re published under the same URL scheme as any other commit or patch in the project. You can’t tell from either the URL or the patches that the code isn’t part of the project they appear to originate from. *These links shouldn’t have worked!*

You could trick someone through social engineering to deploy a malicious patch that appears to legitimately have originated from a target project. All it would take to get a legitimate-looking URL is to open and close a pull request in the project. It’s not unheard of that large deployments receive an early heads up about critical security patches. The malicious source code and intent would then be public, but a quick “oops, that was stupid — honest mistake” comment on the pull request could be enough to defuse suspicions.

I first noticed this problem when troubleshooting a problem with building libjxl — the JPEG XL codec library — on FreeBSD. The FreshPorts build-instructions for the library appeared to fetch a patch from the libjxl project on GitHub:

- `https://github.com/libjxl/libjxl/commit/adb32f3f8f.patch`

To troubleshoot my issue, I wanted to know when the patch was accepted into the project. However, I couldn’t find the patch anywhere in the project’s git logs. After some further digging, I realized that the FreshPorts package maintainer, Jan Beich, had [proposed and then withdrew](https://github.com/libjxl/libjxl/pull/193?ref=ctrl.blog) the change request over a disagreement with a Google bot over the need to sign a Contributor License Agreement (CLA).

After not failing to get his fix accepted upstream, Beich included the patch in the FreshPorts build-instructions instead. Based on the URL, the patch still appears to originate from the upstream project. Technically, it’s an orphaned commit in the project as it doesn’t belong to any of its branches. Beich has also deleted his fork of the project, so the commit can’t be shown under his username in the URL hierarchy.

To be clear, I’m not saying that Jan Beich did anything malicious or wrong. It’s just another example of how GitHub enables you to publish a patch under a URL hierarchy you shouldn’t have access to.

GitHub will even go out of its way to do the wrong thing. For instance, it redirects `https://github.com/libjxl/libjxl/pull/193/commits/adb32f3f8f.patch` to `https://github.com/libjxl/libjxl/commit/adb32f3f8f.patch`. The redirect removes important context from the URL. GitHub should instead have enforced the redirect in the other direction. Truly orphaned commits that don’t belong to any branch would still need some special handling, though.

So, how do you know whether a patch is part of a project or not? Just remove the `.patch` suffix from the URL, and GitHub will show you a webpage with more information. This page may say “This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.” GitHub may instead show you which branches and \[release\] tags contain the commit.

The git patch format doesn’t allow for the inclusion of comments not part of the git commit itself. This could have been a neat way for GitHub to include a warning message for orphaned or otherwise untrusted commits. GitHub tracks this information, as evidenced by the information shown on its website. There’s just no way to communicate it to users in the patch files themselves. This leaves the URL hierarchy — where GitHub fails to adequately communicate that a patch isn’t a part of the project, despite what the URL hierarchy might suggest.
### Cut I/O bound Rakefile task evaluation time by 12,4%
URL: https://www.ctrl.blog/entry/ruby-rake-performance-patches/
Last updated: 2026-08-23T22:21:31.000Z
Do you regularly run [Rake](https://ruby.github.io/rake/?ref=ctrl.blog) on projects with thousands of `FileTask`s? In that case, chances are your Rake execution time is I/O bound. I’ve created two patches that can cut ⅛ off your `Rakefile` task evaluation/compilation time. 

Rake is the task and build automation tool for the Ruby programming language. It’s distributed as a part of the Ruby Standard Library default set of tools and modules. It’s a `make`\-like tool that incrementally rebuilds only the parts of your project that have changed. It tracks changes by querying the file system for the last modified timestamp of every source and object file in your project. Each of these queries requires an individual system call (syscall) to the operating system kernel per file.

The syscalls are inexpensive on modern fast storage devices. However, small numbers add up quickly. Even seemingly instant syscalls will negatively affect performance when they’re performed thousands of times.

Ruby always yields the Global Virtual Machine Lock (GVL) and thereby Rake’s per-task thread execution for every method that calls `rb_stat()` (including `File.exist?` and `File.mtime`). Yielding an I/O bound thread makes sense; it enables the processor to spend its time doing something more useful than waiting for a syscall. However, excessive context switching makes the processor waste more time than it’s saving by needlessly moving things in and out of different CPU cache levels and RAM.

Rake can’t do away with the syscalls to query your files’ modification timestamps. They’re a critical part of the functionality of the software. Of course, I’m assuming that checking the modification timestamp is less expensive than recompiling your sources on every run even when they haven’t changed.

I profiled a Rake project when I noticed that Rake was querying the file system more often per file than I expected. It accumulated to tens of thousands of unnecessary syscalls in my project. I proceeded to waste hours assuming the problem was somewhere in the task generator I used in my project.

It took me a minute to identify and fix the problem when I finally turned my attention to Rake itself. Rake queries the file system to see if each object file in the project exits. `TaskFile`s that don’t yet exist get built. However, for files that exist, Rake queries for their existence *again* before it queries again to get the file’s modification timestamp.

There’s no point in checking if the file exists again. This check is another syscall required for each file in your project. Instead, Rake should assume the file exists when checking its modification time, and catch any errors that might arise if it doesn’t. This approach also makes the query an atomic (self-contained) operation (the file might disappear between checking for its existence and its modification time).

A good night’s sleep later, I realized that I could also get rid of the other file existence check too. A single file modification time check syscall is sufficient to provide all the required information.

I’ve [proposed these two changes](https://github.com/ruby/rake/pull/393?ref=ctrl.blog) to the Rake project. It’s two simple refactoring patches that get rid of the unnecessary syscalls. However, it might be a while before the patches are accepted upstream and become available in Rake. If you’re impatient and what to speed up Rake today, you can download and apply my patches ([f8afda2b22.patch](https://github.com/ruby/rake/commit/f8afda2b22d296a164a26552b341b400cfdea4a2.patch?ref=ctrl.blog) and [abf5e26464.patch](https://github.com/ruby/rake/commit/abf5e264649c4df2eacef67fe173b4f501ee802b.patch?ref=ctrl.blog)).

I regularly run Rake on projects with tens of thousands of files. A lot of time is spent waiting for Rake to finish evaluating which files need to be recompiled between runs. These patches cut 12,4 % off my build times when there are no changes to the project. This is tested running on a fast M.2 SSD on a performant computer configuration. You may see even more performance gains with a slower storage backend or computer. Some environments where storage-related syscalls are known to be slow — I’m looking at you, Windows Subsystem for Linux (WSL2)! — will benefit quite a lot.
### Improving the New York Times’ line wrap balancer
URL: https://www.ctrl.blog/entry/text-wrap-balance/
Last updated: 2026-08-23T22:23:13.000Z
I looked into options to improve the breaking points for line wrapping on the web. I found a few “text balancer” programs that use different methods to even out the number of words per line on the fewest number of lines possible. I wasn’t happy with any of them, but ended up improving on the New York Times’ text balancer to get something useable. It wasn’t how I imagined spending my weekend.

Web browsers follow a simple algorithm for laying out text: one word after the other, and wrap onto a new line when there’s no more room on the current line. It’s fast and produces good enough results in most cases. However, it doesn’t guarantee an even distribution of words and you can end up with a single word on a line by itself (known as a “widow”).

An uneven distribution of words can make the design heavier on one side; making it unbalanced. It can be a small eye-sore at the end of a large paragraph of text. However, it draws unwanted attention to itself when it appears in a headline and other large type.

The simplest solution is to rewrite the text until you get a better fit. However, you can’t rely on rewriting a text to get a perfect fit for every visitor. The fit will depend on the screen size and the [font and platform](https://www.ctrl.blog/entry/font-stack-text/) (or require a webfont). You also end up doing more work and possibly awkward wording for the sake of the design.

A text wrapping balancer is a program that tries to more evenly distribute words over multiple lines. There are at least two dozen algorithms used to achieve this. The most common one found on the web is the [Adobe BalanceText](https://opensource.adobe.com/balance-text/?ref=ctrl.blog) project.

The Adobe text balancer analyzes the text, measures the length and text-breaking opportunities (such as hyphens) in each word, and inserts line break elements (`<br>`) at opportune points to achieve more balanced line breaks. It works; but it’s slow, RAM\-intensive, and overly complicated. 

In 2013, [Adobe proposed](https://web.archive.org/web/20130203115017/http://blogs.adobe.com/webplatform/2013/01/30/balancing-text-for-better-readability/) a new Cascading Style Sheet (CSS) property: `text-wrap: balance`. The property would make the browser do (and optimize) the heavy lifting. TextBalancer is a JavaScript implementation of this CSS property. The property has yet to be implemented into any web browsers. (Come on, guys! It’s in [CSS Text Level 4](https://www.w3.org/TR/2019/WD-css-text-4-20191113/?ref=ctrl.blog#valdef-text-wrap-balance).)

In 2017, Harrison Liddiard, then an intern at The New York Times (NYT), came up with the idea for [a new and simpler text balancer](https://open.nytimes.com/headline-balancing-act-6e92d3d6119?ref=ctrl.blog). Out of that idea grew the [NYT text balancer](https://github.com/nytimes/text-balancer/?ref=ctrl.blog). It’s smaller, faster, and cheekier than Adobe’s more complex text balancer.

The NYT text balancer measures the number of lines, and then reduces the width of the text container until the point where it breaks onto a new line. Then it widens the container a bit to avoid the extra line break. Voilá, a simple yet effective text wrapper that works great on headlines.

The method is suitable for headlines and a single short paragraph of text. It’s not suitable for long paragraphs of texts or multiple paragraphs. It yields no benefit over the browser’s default layout engine when the text exceeds a couple of lines. You’ll also end up with paragraphs of uneven widths, which breaks up the cohesion of the right-hand text edge of your design. It works great for two–four lines of text, though.

The NYT text balancer isn’t perfect, but it’s much faster than Adobe’s solution. Both companies have open-sourced their implementations. I took a look at the NYT implementation and found plenty of room to improve it. The rest of the article covers the changes and improvements I made to the balancer. I have to share what changes I made to it to comply with the Apache License version 2\. If you’re only interested in the code, then this is your cue to leave:

[![Get source on Codeberg](https://cdn.synaps.media/control/content/images/2026/08/get-codeberg-source.svg)](https://codeberg.org/da/text-balancer?ref=ctrl.blog)

The Codeberg project page contains a `boilerplate.html` file you can use as a template, as well as the main `text-balancer.js` file. I recommend you read the usage instructions on Codeberg and the remainder of this article to understand what’s going in with the template file.

The first issue with the NYT text balancer is that it’s triggered on every resize event. This is bad for performance reasons as the web browser can spew out hundreds of resize events in some situations. The text balancer algorithm even runs when there’s been no change to the size of the text container.

The NYT version changes the size of the text element itself, which is also used in future calculations to find the desired width. This means it can only shrink the text container and never expand it. I changed the implementation to use a `ResizeObserver` that only gets triggered when the text container’s parent changes size. It assumes changes to the dimensions of the parent container can be used as a proxy for the text container and its size constraints. This change allows it to expand the text container.

The text balancer uses a binary search algorithm to determine the `max-width` to apply to the text container. The algorithm searches the space from 0 px to the full width of the text container. However, we know the answer can never be less than 50 % of the text container’s width (because then it would fit onto fewer lines). I changed the text balancer to search in the range 50–100 % of the text container’s width. This change skips the first iteration of the binary search algorithm.

The text balancer needs to determine if a text is spread over multiple lines. The NYT’s multiline-checker is buggy and slow. It tries to isolate the first word of the text and then measures its height against the height of the text container. However, the implementation treated any HTML in the headline as plain text; causing it to calculate the wrong number of lines. It was also slow, RAM-hungry, and needlessly interacted with the Document Object Model (DOM).

I managed to get a 4500 % performance improvement over the original implementation using `getComputedStyle` to inspect the text container’s height compared to its line height. My approach is still susceptible to make mistakes when the headline contains other inline-block elements (e.g. images) or stylized small text (`<small>`). However, it works better with bold, emphasized, code, emoji, sub- and superscript text, links, and other phrasing content formatting.

I’ve sampled a few dozen pages from the NYT website in the Internet Archive, and I can’t find any uses of the NYT text balancer on its website. I can find instances of the Adobe text balancer on the NYT website in 2015 and 2016\. The NYT website currently doesn’t use any JavaScript-based text balancers.

Data from PublicWWW — a service for searching in website source code — shows that the Adobe text balancer is used on 3000 websites. The NYT text balancer is currently only used on The Texas Tribune and Nieman Lab.

So, why is it that the NYT and other websites don’t use JavaScript-based balancers? It’s probably because of the last remaining problem, and it’s a really tough one to fix: *the flash of unstyled content* (FOUC).

The FOUC is the intermediary state after the page has been laid out and before some extra resource has loaded. Typically, this resource will be the loading of a blocking resource like a web font or stylesheet. In this instance, I’m talking about the intermediary state between the initial page layout rendering and the text balancer script getting executed.

You can’t calculate and apply the text balancing to text before the page gets laid out. However, you don’t want the reader to see the text appearing laid out one way and then immediately disrupt their reading by reflowing the text. This problem is somewhat unsolvable. It’s why Adobe proposed that the web browsers take care of this natively with a CSS property.

The best approach is to embed the required JavaScript and CSS inline on the page, and then temporarily hide the text pending the execution of the text balancer. It’s not ideal, but it’s not costly either. In my tests, it delays the text rendering by 1–9 ms on a fast device and up to 110 ms on lower-end devices. However, under terrible network conditions on a slow device, it can delay rendering by more than a second.

You also need to ensure there’s a noscript alternative in place in case JavaScript has been disabled. There’s a neat self-contained CSS-only option in the form of the `@media (scripting: none)` media query. Unforgettably, it isn’t yet supported in any web browsers, so I had to rely on the more traditional approach of embedding a `style` element inside a `noscript` element.

Despite all these precautions, there’s still a risk something might go wrong and the text wrapper fails to execute properly. To address this, I added a separately scoped self-invoking JavaScript function that reveals the hidden text on a three-second timer.

I also wanted to future-proofed the implementation by detecting support for and deferring the text balancing job to CSS. This is achieved using an `@supports (text-wrap: balance)` CSS query, paired with a `CSS.supports('text-wrap', 'balance')` test in JavaScript. It might be wishful thinking, but if a future browser supports it — it’ll bypass the text-hiding and wrap-balancing dance altogether.

The result won’t be perfect, but it’s definitively an improvement over the default layout engine. You can optimize the wrapping results by liberally sprinkling long words in your headlines with soft-hyphen characters (U+00AD). A soft-hyphen denotes a possible line breaking points where the browser can wrap text onto a new line. It’s an invisible character except when it’s at the end of a line when it will be rendered as a hyphen. You can find hyphenation libraries for all poplar programming languages for dynamically adding soft-hyphens. (You should avoid CSS hyphenation (`hyphens: auto`), as it’s results vary greatly from language to language and browser to browser.)
### Why can an ad break the Windows 11 desktop and taskbar?
URL: https://www.ctrl.blog/entry/windows11-empty-taskbar/
Last updated: 2026-08-23T22:25:35.000Z
Earlier today, Microsoft pushed a promotional message to early adopters of Windows 11\. The promo intended to promote the upcoming operating system’s integration with Microsoft Teams. Instead, it caused Explorer (the Windows desktop shell) to stop responding and left users without a working Start menu and taskbar. 

I was caught up in this problem after restarting my laptop to complete the installation of an unrelated software. It was annoying and frustrating to be left with a broken Windows desktop, but this is what I signed up for as a Windows Insider (early adopter).

Microsoft has acknowledged that there’s an issue and posted [a workaround](https://blogs.windows.com/windows-insider/2021/09/02/announcing-windows-11-insider-preview-build-22000-176/?ref=ctrl.blog) for affected customers. The workaround requires users to open the Registry Editor (regedit) through the Task Manager to make some changes. The company didn’t discuss the problem in detail, however.

I took a closer look at what got downloaded and caused the Windows desktop shell to become unresponsive. Microsoft customers on Twitter and Reddit quickly shared ways to work around the problem and restore the Windows shell. The successful ideas all involved different methods that made the device unable to communicate with Microsoft servers. It became clear that the issue was caused by one of the many cloud services built into Windows.

The problem wasn’t caused by an update delivered through Windows Update. (That would have been more understandable.) Instead, it was caused by a small file downloaded by a Windows component called IrisService. Iris is a part of Windows Spotlight (the Bing wallpaper of the day; and tips, promotions, and suggestions on the Lock screen).

Based on the Microsoft-provided workaround, I narrowed the problem down to a registry key that contained a serialized JSON blob. The blob contained an advertisement for Microsoft Teams. The messaging and imagery in the promotion were identical to [the panel you get](https://cdn.synaps.media/control/content/images/2026/08/windows11-connect-with-teams-panel.png?ref=ctrl.blog) when you press the Windows key + C on a Windows account not already set up with Teams. It’s unclear if it’s this exact promotion, however. 

There’s an enormous elephant in the room, though: how Microsoft could have let this happen? Yes, this is a beta build for early adopters. Yes, rough edges and productivity losses are expected.

However, that doesn’t answer why the Windows shell was so poorly architected in the first place. How come that it would stop responding just because of one failed cloud service? It’s not a crucial cloud service either, and the computer became useless because of a single JSON blob with an advertisement.

Ads in Windows are important to Microsoft. They’re nowhere to be found on the priority lists of Microsoft’s customers. We don’t want them there at all! Millions of people depend on Windows every day, and it simply needs to be more robust than this.

Windows 11 is due for release in October. However, I say it needs to go back on the drawing board. It needs to be rearchitected to decouple it from the cloud. The design requirement is clear: unimportant cloud-dependent systems must be isolated from the core operating system so that they can’t bring the Windows shell to its knees. 

I’m not saying Microsoft needs to remove its account, cloud gaming, entertainment, software delivery, and other cloud services. Some of these cloud services do add value to their customers. However, the whole computer can’t grind to a halt over a tiny problem with an unimportant nuisance of a “feature”.
### Windows 11 gets new and less stressful notification sounds
URL: https://www.ctrl.blog/entry/windows-alert-sounds/
Last updated: 2026-08-25T21:09:02.000Z
CNBC reported last week on how Microsoft has [replaced the notification sounds in Windows 11](https://www.cnbc.com/2021/08/22/microsoft-delivers-calm-system-sounds-in-windows-11.html?ref=ctrl.blog) with calmer and “less overwhelming” versions. I’m someone who gets stressed and a bit overwhelmed by the Windows 10 alerts, so I thought I’d share my thoughts on the new sounds.

I get stressed by the audio alerts from my Windows PC. The sounds are loud and insistent, and they disrupt my thoughts and my work. They demand focus and attention, even though most of the sound alerts are unimportant and would be better served by no sound or at least a subtler audio queue.

I’m just minding my own business and writing something on my Windows PC. Suddenly, a dialog window will interrupt me out of nowhere — the quintessential user experience of Windows — and it’ll capture some of my keystrokes. *Bla-ring, bla-ring, bla-ring!*

Download [Windows 10 Background](https://cdn.synaps.media/control/content/files/2026/08/windows-10-background-1.flac?ref=ctrl.blog) (audio file).

Windows 10 Background (Default Beep) sound

Through no fault of my own, I’ve done something bad, and Windows is making sure to tell me off about it. This is the bla-ring sound (or *Windows Background* as Microsoft so imaginatively names it). It’s such a harsh — and always too loud — sound. To me, it signals that something critically wrong has happened and that it needs my immediate attention. The notification sound is aggressive and stressful.

This experience is only too common in Windows. Try searching for a word that doesn’t exist on this page. On a Windows device, you’ll get repeatedly dinged at for every keystroke that doesn’t return a result on the page. I’m not arguing against the use of sound with this type of notification. Not everyone looks at the screen when they’re typing, so the audio alert is useful. However, I believe the sound itself is way too much and that it doesn’t fit the situation.

I’ve usually kept my Windows PCs on mute, but I don’t do the same with PCs running Android, Linux, or MacOS. The experience and soundscape of Windows 10 is just worse than on the other devices I use.

In Windows 11, there’ll be two different sound themes: one for the Dark color mode and one for Light mode. The two themes sound similar, but the Dark mode sounds are more subdued than the Light mode sounds. Both variants are less intense, disruptive, and stressful than the alerts used in earlier versions of Windows.

I know not everyone reacts the same to loud and forceful sounds. However, for those of us who’re sensitive to it, the new sound themes for Windows 11 will be a big improvement. I don’t mute my Windows laptop anymore.

You can hear the new Windows Background alert sounds in Windows 11 below (Light and Dark modes). It’s a much calmer experience compare to the Windows 10 sound (above).

Download [Windows 11 Background – Light Mode](https://cdn.synaps.media/control/content/files/2026/08/windows-11-background-light-1.flac?ref=ctrl.blog) (audio file).

Windows 11 Background (Light mode) sound

Download [Windows 11 Background – Dark mode](https://cdn.synaps.media/control/content/files/2026/08/windows-11-background-dark-1.flac?ref=ctrl.blog) (audio file).

Windows 11 Background (Dark mode) sound

Windows 11 hasn’t gained the ability to schedule dark and light mode depending on the time of day (like Android, iOS, and MacOS supports). Windows, with its large and incoherent ecosystem of application toolkits, can’t smoothly transition between themes. Try switching between the two and see everything slowly redraw and reload icons and assets. You can observe similar effects on other operating systems, but not to the extent or duration it’s visible on Windows.

The different soundscape for Dark mode seems to have been designed to make your PC quieter in the evenings. This feature would make more sense if paired with the Night light feature in Windows. Night light, a feature that reduces your exposure to blue light in the evenings, is designed to turn on automatically in the evenings. However, Dark mode is built on top of the Windows themes system (where the sound selection also lives), so it was probably easier to implement it here.

Alternatively, Windows could have sampled the ambient noise level around the device and picked an appropriate sound theme accordingly. We might see this in future laptops, now that Microsoft has acknowledged the problems with the Windows soundscape. Many laptops already adjust the screen brightness based on the ambient light, so it wouldn’t be too much of a stretch to do the same for sound themes.

My least favorite sound in Windows 10 is called Hardware Insert. It’s the sound Windows plays whenever you plug in a USB thumb drive or any other hardware. It’s also the sound that randomly plays when the PC is idling and it gets beings installing hardware driver updates. I hear it several times an hour from my gaming PC because Windows is powering off and on hardware components in a failed attempt to save power.

I can’t make myself not pay attention to it, even though it’s not something that requires me to pay attention. “Okay, something disconnected. So, what? What am I supposed to do about it?” The answer is almost always “nothing.” The new softer sounds in Windows 11 better reflect the low importance of many of the audio alerts from your PC.

Microsoft might not have fixed the underlying issues for these unnecessary sound alerts in Windows 11\. However, it has shortened and made them less disruptive. The Dark mode version of this particular alert stands out as much softer than the Light version. The Light version still makes it sound like something went wrong and requires my attention.

Download [Windows 10 Hardware Insert](https://cdn.synaps.media/control/content/files/2026/08/windows-10-hardware-insert-1.flac?ref=ctrl.blog) (audio file).

Windows 10 Hardware Insert sound

Download [Windows 11 Hardware Insert – Light Mode](https://cdn.synaps.media/control/content/files/2026/08/windows-11-hardware-insert-light-1.flac?ref=ctrl.blog) (audio file).

Windows 11 Hardware Insert (Light mode) sound

Download [Windows 11 Hardware Insert – Dark mode](https://cdn.synaps.media/control/content/files/2026/08/windows-11-hardware-insert-dark-1.flac?ref=ctrl.blog) (audio file).

Windows 11 Hardware Insert (Dark mode) sound

You don’t need to wait for Windows 11 to make your PC emit less stressful notification sounds. You can change the default sounds to get an even calmer experience on your Windows PC. Press Windows key + R, type `mmsys.cpl`, and press Enter to open the Sound control dialog. Switch to the Sounds tab. From the Sound control dialog, you can change or disable different system sounds. 

You can listen to all the sound options in the dialog, or by looking for `.wav` audio files in the `C:\Windows\Media\` and `C:\Windows\Media\dm\` (dark-mode versions) folders.

One of the most impactful changes you can make is to swap out the Default Beep and the Critical Alert sounds with something softer. The default beep sound in Windows 11 is called *Windows Background* (a 1,29 sec dual-key mini-fanfare). You hear it throughout the day, and mostly for small actions that probably don’t even require it. I’ve swapped it and the Critical Alert sound for *Windows Feed Discovered* (a single 0,11 sec low chirp).

I’m a fan of shorter tones and chirps, but that’s not for everyone. You can find thousands of free alert notification sounds on the web, if you’re interested in something different or more personalized. (Watch out for scams! Don’t download and install any apps. You should only download MP3, M4A, or other audio files.)

Copyright disclaimer: The Windows sounds are the property of Microsoft Corporation. A small sample of the Windows sound files is reproduced in this article for review purposes.

**Via:** [CNBC](https://www.cnbc.com/2021/08/22/microsoft-delivers-calm-system-sounds-in-windows-11.html?ref=ctrl.blog)
### A privacy review of Tribler, the onion-routed BitTorrent app
URL: https://www.ctrl.blog/entry/tribler-onion-routed-bittorrent/
Last updated: 2026-08-23T22:23:35.000Z
[Tribler](https://www.tribler.org/?ref=ctrl.blog) is a free and open-source file-sharing app for Linux, MacOS, and Windows. It adds something unique to the BitTorrent peer-to-peer protocol: onion routing. Onion routing, best known from the [Tor Browser](https://www.torproject.org/?ref=ctrl.blog) project, is a network routing scheme that relays connections via multiple proxies. Tribler encrypts your connections in layers, so that each relay proxy only knows the IP address of the next and previous hop in the routing chain. This system can help provide more anonymity and obscure what you’re downloading and from where from prying eyes.

I’ve followed the development of Tribler closely over the last two years. In this article, I’ll discuss how Tribler works, which parts of it are anonymized and which broadcast what you’re doing in the clear. Tribler features solid core technology, but the project’s mixed goals and priorities don’t live up to its user expectations of privacy.

Tribler is a complicated piece of software, and it won’t protect your anonymity if you use it wrong. ‘Using it wrong,’ unfortunately, includes using some of the program’s features at all; and using others with the default configuration! I recommend that you take the time to read this article in its entirety before you consider using the software.

In traditional peer-to-peer (P2P) file-sharing, two devices connect directly to each other to exchange data. The devices discover each other using either a central tracking server or through the distributed hash table (DHT); collectively called peer exchanges. A tracking server is a web server that keeps track of which IP addresses that offering a given file (seeding) and who wants to download the said file. The DHT serves a similar role, but instead of using a server; the same information is jointly maintained by the participating P2P clients. Anyone who wants to monitor who is downloading or uploading a given file can query public peer exchanges for a list of IP addresses that have expressed interest in it. There is no anonymity and everything happens in the clear.

Some BitTorrent clients have an option for encrypting the P2P data transfers, but the peer discovery process through the exchanges still happens in clear-text. The option provides some obfuscation, but it’s an entirely false sense of privacy. Correlating your observed peer-discovery queries followed by large encrypted data transfer isn’t rocket science.

Tribler also encrypts connections between peers, but it does so using ‘Tor-like’ onion routing. The data to be transferred is wrapped in layers of encryption (like an onion). Each layer includes a source and destination address pointing to the previous and next relay in the chain. This scheme enables each relay to forward packets in a chain without knowing who is downloading something, what they’re downloading, nor who is sharing the file.

Tribler applies the same principle to connections to peer exchanges. Queries and responses are shuffled around by onion routing. It has an internal DHT used for in-network file sharing. It also uses exit relays that can forward requests to the DHT network used by most other BitTorrent clients.

Anyone monitoring your network traffic can tell that you’re using Tribler and that you use BitTorrent. It does nothing to hide these facts from potential monitors. It crucially helps obscure what you’re using them for, however. The BitTorrent protocol and Tribler are legal in most jurisdictions, but they may be considered to be an illegal network-addressing obfuscation tool in a few places.

Similar to the Tor Project, Tribler has super peers known as exit relays. Exit relays are clients configured to allow data transfers and peer exchange traffic to exit from the onion-routed network onto the public internet. These exit relays bridge the Tribler onion network with the greater BitTorrent network on the public internet.

These super peers quickly accumulate tokens in the Tribler bandwidth economy, but at a significantly increased exposure to legal risks. I’ll discuss the concept of the bandwidth token later in the article. Tribler obscures what and where traffic is going into its network from the exit relays. However, a large-scale monitoring effort of the internet — hello, NSA! — could still correlate the timing of unencrypted traffic going into an exit node with the obscured traffic it routes into the Tribler onion network. Yet, it takes only a single click in Tribler’s settings dialog for your computer to become an exit relay too! Yikes.

The exit relays also reveal a flaw with Tribler’s default configuration. The exit relays are also considered to be regular relays. By default, Tribler **is configured to only use a single relay.** Your one and only relay node, as per the default configuration, is also the exit relay.

For onion routing to be effective, you need to relay through a chain of at least two other nodes. The first node doesn’t know the contents of the encrypted traffic, and it knows your IP address and the IP of the next node in the chain. The second node knows the first node’s IP address and the IP address of the seeder. Neither the seeder nor the second node knows the downloader’s IP address! No one knows more than two out of three bits of information in the transfer chain; namely who’s downloading, who’s uploading, and what’s being transferred. For comparison, the Tor Onion network uses two intermediary relays plus the exit relay.

Every user is a relay by default, and there’s no \[easy\] way to opt-out of it. Your client will only ever acting as an intermediary relay that relays end-to-end encrypted connections (unless you opt to be an exit relay). Yet, there’s little demand for other relays as the default configuration only uses the exit relays.

When you’re using Tribler you’ll likely only ever download through the exit relays. As discussed above, the exit relays know your IP and what you’re downloading! I’m not revealing a new flaw in the design of Tribler. The project website [explains the difference](https://www.tribler.org/anonymity.html?ref=ctrl.blog) between single and multiple relays, including graphs and everything. I’m uncertain why the project promotes its onion routing capabilities, but don’t take advantage of them by default.

You can at any time go into your Tribler settings and change the number of relays from one to three. The option is there, but it's not set by default. The tyranny of the default means most users will use Tribler, and practically be at the mercy of the exit nodes not to monitor their activities. It’s not entirely clear to me why the more anonymous three-relay setting isn’t the default configuration.

The Tribler software depends on third-party software dependencies like [libtorrent](https://libtorrent.org/?ref=ctrl.blog) for parts of its core networking technology. The Tribler project’s test suites don’t proactively try to detect unexpected network connections or other information leaks. Bugs that compromise your anonymity in Tribler or its dependencies could pop up at any time without the project maintainers noticing it. The test suite could be more proactive by including a mock domain name system (DNS) server and a review of which domain names the client tries to contact. Similarly, it could log connections to look for unexpected or unencrypted traffic, e.g. unencrypted DHT lookups or connections to web servers. There have been several examples of **DNS leaks and unencrypted connections** leaking out of Tribler.

For instance, Tribler added a new feature called the Torrent Checker in Tribler version 7.3 released in August 2019. The Torrent Checker would check the swarm status of randomly selected torrents in the Tribler discovery service. Unfortunately, the new feature didn’t utilize Tribler’s onion routing for the health checks, and it would simply query DHT and tracking services for the status of random torrents. To services that track DHT queries, it would appear as you were interested in downloading these random torrents. I’ll discuss the Tribler discovery service later in the article. 

The Torrent Checker was seriously ill-conceived, you were opted in by default, and there was no off-switch for it on the settings page. This feature could get you into serious legal troubles, disappeared, or even result in the capital penalty (depending on your jurisdiction, of course) over illegal materials you never downloaded or even knew existed. For example, Tribler could randomly check on the status of a randomly selected file by reaching out to a BitTorrent tracking server specializing in male-focused adult-themed content. Homosexuality still carries the capital penalty in ten countries around the world, and some of them do extensive internet surveillance.

The Torrent Checker began proxying DHT requests through the Tribler anonymizing network in Tribler version 7.5 which was released in June 2020. The feature would still connect directly to web tracking servers, however. Concerned users complained about “DNS leakage” from resolving the tracker server domain names; without noticing the plain-text HTTP connections to the same trackers. This was partially fixed in Tribler version 7.6, released in December 2020, when it also began checking tracking servers over its onion network. However, the feature would still leak some DNS lookups and didn’t work at all with the Torrent Checker. 

The last leaks were fixed in version 7.10; released in July 2021. It took the Tribler project two years to silence the talkative Torrent Checker feature. Online services like [I Know What You Downloaded](https://iknowwhatyoudownload.com/en/peer/?ref=ctrl.blog) would naturally attribute all these DHT requests to your IP address. This made you appear as a BitTorrent power-users who downloaded all sorts of random material through the protocol. 

Tribler doesn’t support the webseed BitTorrent protocol extension ([BEP 19](http://bittorrent.org/beps/bep%5F0019.html?ref=ctrl.blog)) despite having limited support for TCP/HTTP tunneling. BEP 19 lets torrents specify web servers that can help seed torrents when the BitTorrent swarm isn’t up to the task, e.g. when there are few or no seeders. The TCP/HTTP tunneling in Tribler is exclusively used for contacting tracking servers, and exit relays reject non BitTorrent encoded (bencoded) responses. This feature is important for ensuring that unpopular and newly released torrents work. The Humble Bundle store, for example, distributes its downloads through webseed-backed torrent files.

There’s an elephant in the room, and it’s time to address it: Tribler’s bandwidth token system. You pay tokens to relay downloads through other users and you earn tokens by uploading to other Tribler users and by being an intermediary traffic relay for other users. It costs more tokens to relay through multiple relays, so a 1 GB download costs 3 GB through three relays.

BitTorrent clients traditionally track your sharing ratio: your upload versus download ratio. You can increase your sharing ratio by leaving the client running and hoping someone will come by and want to download from you. It’s a zero-sum game. The more people who download a file the more people share it and a decreasingly smaller and smaller part of the file may get downloaded from your client.

Tribler down-prioritizes what it calls “selfish” clients; which it defines as clients with a negative 20 GB token balance. (You achieve this balance after downloading roughly 6,6 GB via three relays.) Most clients will use the default settings, so most users simply pay the exit relays without needing to route through any other relays. It’s nigh impossible to increase your token balance unless you’re an exit relay. I believe most people simply abandon the program at this point as it seemingly stops working.

The only source of new bandwidth tokens is the 20 GB granted to new users. The network depends on ‘mining’ an unending stream of new clients who’re willing to join the network before their clients eventually slow down and they stop using it. It’s much faster and easier to reset your Tribler instance to get another 20 GB worth of tokens than it is to earn them legitimately by relaying traffic in the network. Your token balance decreases faster over time due to the token cost for protocol upkeep than you earn tokens for relaying traffic for other users.

The token balances are a cryptographic blockchain signed by the other participants you communicate with in the network. The blockchain records the amount of data transferred, a cryptographic hash representing the participants, and the time of the transfers. It doesn’t record what was transferred. However unimportant metadata like this may appear, there have been countless examples of someone managing to stitch together data like this with other data to glean more information than what is apparently there.

A possible fix would be to increase the default number of relays to three. As discussed, this would make anonymity stronger, and also help circulate bandwidth tokens to more peers throughout the network. It wouldn’t fix the imbalance of exit nodes accumulating ever more bandwidth tokens, however.

Jamie King interviewed Bram Cohen, the inventor of BitTorrent, about this topic on [an episode of the Steal This Show podcast](https://web.archive.org/web/20170428120936/https://stealthisshow.com/s02e14/) (audio via [Magnet](magnet:?xt=urn:btih:439eeec3969eb558d1a4d55e82f0e158e332a559&dn=S02%5FE13%5FThe%5FFuture%5FOf%5FBitTorrent%5Fwith%5FBram%5FCohen.mp3&xl=53772852&ws=https%3a%2f%2fweb.archive.org%2fweb%2f20200701041110if%5F%2fhttp%3a%2f%2fcontent.blubrry.com%2fstealthisshow%2fS02%5FE13%5FThe%5FFuture%5FOf%5FBitTorrent%5Fwith%5FBram%5FCohen.mp3&xs=https%3A%2F%2Fweb.archive.org%2Fweb%2F20170428120936if%5F%2Fhttps%3A%2F%2Fstealthisshow.com%2Fwp-content%2Fplugins%2Fpodcast-to-torrent%2Ftorrents%2F5766052a537a6a52cf05b7889ccec9b6.torrent) or [YouTube](https://www.youtube.com/watch?v=fQEJphZvc1Q&ref=ctrl.blog)). The pair discuss how maintaining a community/scoreboard based on sharing ratios and bandwidth accounting is outdated. By definition, everyone can’t be above average; it’s nearly impossible to maintain a 1:1 sharing ratio, let alone exceed a 1:1 ratio. Someone must incur a negative bandwidth balance for others to get a positive balance. 

The pair also discuss how private trackers (usually belonging to closed groups of file-sharers) should instead incentivize and reward people for sharing rare files. They argue that making rare files available to the network over time adds more value to the network than the raw bits transferred. You can find similar thoughts on rewarding users for sharing rarer files in the [Tribler mission statement](https://github.com/Tribler/tribler/issues/5587?ref=ctrl.blog), but it has yet to materialize in the client. You currently lose credits due to the cost of paying for the protocol overhead by seeding unpopular torrents.

You need to share three times as much data as you download when using Tribler to pay all the relays. The problem is that **no one** wants to download from a Tribler client. You don’t earn any tokens for uploading through exit relays to other BitTorrent clients. You even lose some credits on the protocol overhead that’s relayed through other Tribler users. A known problem Tribler developers refer to as “token blackholing.”

> “\[Tribler’s\] anonymous overlay suffers from an undersupply of exit nodes, leading to frequent network congestions and overall degradation of download speeds for all users. This is not entirely unexpected since running an exit node is often not without legal risks. As such, we consider our exit node capacity as a scarce resource, that must be allocated amongst users in a fair manner in case of undersupply. Similarly, we require relay nodes when one wishes to include one or more relay nodes in its circuits. By default, every Tribler user operates a relay node by default since there are minimal legal risks involved with running a relay node.”

The design of a trustworthy ecosystem around media sharing, Martijn de Vos, Tribler wiki

Tribler knows it has an undersupply of exit nodes, yet not even other Tribler users will download from your Tribler instance. The most common solution to a network routing problem is to select the shortest route. Tribler also prefers the shortest relay route as it can be assumed to be faster. Therefore, Tribler prefers downloading through an exit relay as it’s both faster and cheaper than downloading from other Tribler users over multiple relays. Tribler could help mitigate this problem by making the client prefer transferring internally in its relaying network despite the higher “token cost.”

This brings us back to the topic of the exit relays. The whole system is incredibly reliant on its exit relays. As discussed, they can de-anonymize every user and know what everyone is downloading (unless you increase the default relay count). The exit relays can also conceivably **manipulate *what* you’re downloading.**

The exit relays are perfectly positioned to carry out a monster-in-the-middle (MITM) attack against your BitTorrent transactions. As discussed, BitTorrent works using by discovering other peers by querying either the DHT or tracking servers. Tribler relies on exit relays to query the public DHT network and tracking servers on your behalf. It queries for the BitTorrent Info Hash (BTIH) of a torrent you’re interested in downloading. The BTIH is an SHA-1 cryptographic checksum of the desired torrent file.

Unfortunately, the SHA-1 algorithm has been known to be weak and spoofable since 2004\. It’s now [considered achievable](https://shattered.io/?ref=ctrl.blog) to construct a file (potentially with a deanonymizing or otherwise malicious payload) with the same SHA-1 has as a target file.

A determined attacker, or in the case of BitTorrent — a determined lawyer representing copyrights’ holders, can set up a Tribler exit relay and monitor what people are downloading. They could also intercept and reply to any DHT or tracking server queries with peers they controlled. These peers can then send a torrent metafile containing a payload that the BitTorrent client would proceed to download. The file would pass the built-in file-corruption and checks in the BitTorrent protocol (all relying on the SHA-1 of the BTIH).

This problem isn’t unique to Tribler and affects all BitTorrent clients. However, Tribler is uniquely susceptible to it because of its reliance on unknown intermediaries. The BitTorrent protocol version 2 addresses this vulnerability by upgrading the hashing algorithm used for the BTIH to SHA-256\. Tribler doesn’t yet support version 2 of the protocol despite being more at risk than typical BitTorrent clients.

Tribler offers improved anonymity when downloading torrents. However, it also comes with built-in features for searching for and discovering new torrents. These features do **not provide any anonymity.** The infrastructure for encrypting and relaying queries is there in the client, but it’s not used for these purposes.

Searches are sent from your client to other Tribler users in cleartext. Likewise, your client may receive and respond to other users’ queries in cleartext. Anyone monitoring your network can see what you search for and what search results are returned to you. They cannot, however, see what — if anything — you choose to download. They can infer that any large data transfer starting immediately following a search query is for one of the returned results.

The search is maintained by a distributed index of torrents maintained by Tribler users. It’s similar to the DHT, but contains richer metadata about each torrent. Search queries are by default filtered against an optional family-friendly filter. The filter discriminates against some ethnicities, hair colors, and sexual identities. I’ve sent [a change request](https://github.com/Tribler/tribler/pull/6259?ref=ctrl.blog) to the project to address that issue.

Tribler also has a system for content discovery and creator channels. Neither creating a new channel and sharing content, nor subscribing to an existing channel is anonymous. Tribler doesn’t communicate that search and its other discovery methods aren’t anonymized. Project maintainer Vadim Bulavintsev said the following in a discussion about Tribler not anonymizing these features:

> “Anonymous seeding of channels is pointless, because of how channel gossip works: you gossip subscribed channels, so everyone around you know what channels you are subscribed to. An open Channels system incentivizes people to only share links to legal and quality content.”

Vadim Bulavintsev, Tribler project maintainer

This comment shows the stark contrast between user expectations of privacy versus the project’s own wants and goals. The Tribler client never communicates this to the user. No one expects that some parts of a privacy-focused software project won’t feature the same privacy-preserving technologies as the core software. These features need to be made private, or otherwise come with large obnoxious privacy warnings.

The whole channels system is a leftover from the late 2000s when there were multiple entertainment-focused BitTorrent clients with built-in video streaming capabilities. These clients sprang up to address the — at the time — prohibitively expensive prospect of hosting and sharing videos. These clients had channels and the idea was they could be a video platform for creators. Then YouTube came along and offered free video hosting and monetization opportunities for creators, and ease of use for the masses.

Tribler channels are unappealing to potential creators looking to distribute their works. They’re difficult to manage; and it’s unclear how you back it up, move it between devices, or even share your channel with others. There is, for example, no way to get a link to it or any other sharable identifier for use on social media.

It’s also unsuitable for dissidents or other groups looking for more private and secluded places to share on the web. The lack of anonymity makes it wholly unsuited for those groups. Which leaves behind a feature that struggles to justify its existence. From the mostly stale channels list, I gauge there is no interest in it either. Not even Tribler itself uses its channel feature, or indeed their own network, to distribute software updates to Tribler.

The network overhead of maintaining the search index and updating channels is deducted from your token balance and paid out to other peers. Due to how the DHT is organized and replicated, this rewards long-lived peers (always-on PCs) at the expense of shorter-lived sessions (laptops). This is why you can experience that the token balance is gradually decreasing over time even when you’re not downloading anything.

In my experiments, disabling the search and channels features significantly accelerates how fast your tokens vanish from your balance even when you let the client sit idle. In theory, the token balance should then only ever increase as you only participate by relaying traffic. However, I’m seeing the opposite and the token balance goes down almost twice as fast.

There are no options for disabling these features in the settings screen, but they can be disabled through the configuration file. Note that the client won’t hide these features and that it prints error messages when you try to use them and during start-up. You can compare [this prepared configuration file](https://www.ctrl.blog/file/2021-08-17%5Ftriblerd.ini.conf) to your own to learn how to disable these features.

### Conclusions

Assuming you increase the default relay count setting, then file transfers in the current Tribler release, version 7.10, work well and can be considered to be more private than not using Tribler. I’ve paid attention to releases for the last three years, and this is the first version that has earned this verdict.

In one of my first trial runs of Tribler, I created a torrent on one PC that ran Tribler, and tried to download it using Tribler on another PC. However, the file transfer never started — the downloading client was never even able to fetch the torrent file to join the swarm. After a few more tests, I found that Tribler couldn’t download from other Tribler users using just the torrent’s Magnet link. This worked fine when downloading from other BitTorrent clients, just not internally inside the Tribler network. I reported [the issue](https://github.com/Tribler/tribler/issues/5616?ref=ctrl.blog "“Issue 5616: Anonymously seeded torrents can’t exchange metadata with an anonymous downloader via magnet links”") and it got fixed in Tribler version 7.10 (released in July 2021). To me, this issue revealed that even the core functionality wasn’t well-tested. 

The project’s recent history shows us that you need to carefully scrutinize each release before adopting it. There might be another Torrent Checker feature added in the future, or a bug/regression could sneak up via libtorrents and other core dependencies. You can use Tribler in combination with a virtual private network (VPN) to reduce the impact of any future problems.

The project’s website features a prominent warning below the download buttons (shown below). Neither the website nor the client itself does an adequate job of warning you against using specific features like search and channels. The option to become an exit relay should be removed entirely from the settings screen. It’s way too easy to turn it on without fully understanding the consequences.

> “Do not put yourself in danger. Our anonymity is not yet mature.  
>  
> “Tribler does not protect you against spooks and government agencies. We are a torrent client and aim to protect you against lawyer-based attacks and censorship. With help from many volunteers we are continuously evolving and improving.”

Warning on the Tribler website

So, should you use Tribler to anonymize your BitTorrent downloads? Undoubtedly. Tribler’s shroud of privacy and layered encryption is much better than doing nothing to obscure what you’re downloading. You should understand that the client isn’t perfect and the level of privacy it offers varies from version to version. You should steer clear of any but the core file transferring features.

#### Sources

- [Frequently Asked Questions](https://www.tribler.org/faq.html?ref=ctrl.blog), commit [86adf4cc97](https://github.com/Tribler/tribler.github.com/blob/86adf4cc975cc3b14bf60dfc127192d691a123ff/faq.html?ref=ctrl.blog), 2021-06-19, Martijn de Vos, Tribler
- [Token balance decreasing](https://github.com/Tribler/tribler/issues/6164?ref=ctrl.blog#issuecomment-863411220), issue #6164, 2021-06-17, Vadim Bulavintsev, Tribler project, GitHub
- [The design of a trustworthy ecosystem around media sharing](https://github.com/Tribler/tribler/wiki/The-design-of-a-trustworthy-ecosystem-around-media-sharing/df07ca156c40e090d1ad19e983e82d215e69d66b?ref=ctrl.blog), commit df07ca156c, 2020-10-24, Martijn de Vos, Wiki, Tribler project, GitHub
- [Added anonymization support to TorrentChecker](https://github.com/Tribler/tribler/pull/5628?ref=ctrl.blog), 2020-10-17, Egbert Bouman, Tribler project, GitHub
- [The Plan: Tribler Mission](https://github.com/Tribler/tribler/issues/5587?ref=ctrl.blog), issue 5587, 2020-09-27, Vadim Bulavintsev, Tribler project, GitHub
- [Anonymous Downloading and Streaming specifications](https://github.com/Tribler/tribler/wiki/Anonymous-Downloading-and-Streaming-specifications/1d068b8d2a85167312b662db587c47b204194093?ref=ctrl.blog), revision 1d068b8d2a, 2020-06-25, Johan Pouwelse and Egbert Bouman, Wiki, Tribler project, GitHub
- [Anonymous seeding of channels is pointless](https://github.com/Tribler/tribler/discussions/6100?ref=ctrl.blog#discussioncomment-701169), 2019-12-20, Vadim Bulavintsev, Tribler project, GitHub
- [Paying out bandwidth tokens in TrustChain](https://github.com/Tribler/tribler/wiki/Paying-out-bandwidth-tokens-in-TrustChain/97faacb758ad42ebb0e135ed058f23ef8612db8f?ref=ctrl.blog), commit 97faacb758, 2019-02-27, Martijn de Vos, Wiki, Tribler project, GitHub
- [Tribler project homepage](https://www.tribler.org/?ref=ctrl.blog), commit [0879e846fc](https://github.com/Tribler/tribler.github.com/blob/0879e846fc4ecc97ce98d3c57fab5728dbfbe0af/index.html?ref=ctrl.blog), 2018-01-24, Sining Pan, Tribler
- [SHAttered](https://shattered.io/?ref=ctrl.blog), 2017-07-06, M. Stevens; E. Bursztein; P. Karpman; A. Albertini; and Y. Markov, CWI Amsterdam and Google Research,
- [The Future of BitTorrent](https://web.archive.org/web/20170428120936/https://stealthisshow.com/s02e14/) (audio via [Magnet](magnet:?xt=urn:btih:439eeec3969eb558d1a4d55e82f0e158e332a559&dn=S02%5FE13%5FThe%5FFuture%5FOf%5FBitTorrent%5Fwith%5FBram%5FCohen.mp3&xl=53772852&ws=https%3a%2f%2fweb.archive.org%2fweb%2f20200701041110if%5F%2fhttp%3a%2f%2fcontent.blubrry.com%2fstealthisshow%2fS02%5FE13%5FThe%5FFuture%5FOf%5FBitTorrent%5Fwith%5FBram%5FCohen.mp3&xs=https%3A%2F%2Fweb.archive.org%2Fweb%2F20170428120936if%5F%2Fhttps%3A%2F%2Fstealthisshow.com%2Fwp-content%2Fplugins%2Fpodcast-to-torrent%2Ftorrents%2F5766052a537a6a52cf05b7889ccec9b6.torrent) or [YouTube](https://www.youtube.com/watch?v=fQEJphZvc1Q&ref=ctrl.blog)), season 2 episode 14, 2017-04-23, Jamie King and Bram Cohen, Steal This Show, TorrentFreak
- [BEP 19: WebSeed - HTTP/FTP Seeding](http://bittorrent.org/beps/bep%5F0019.html?ref=ctrl.blog), 2017-01-12, Michael Burford, Protocol extensions, BitTorrent
- [Anonymity](https://www.tribler.org/anonymity.html?ref=ctrl.blog), commit [41a13dc2a1](https://github.com/Tribler/tribler.github.com/blob/41a13dc2a17f572d6338e49237ab0bd3e1382b2c/about.html?ref=ctrl.blog), 2014–2017, Egbert Bouman and Johan Pouwelse, Tribler
### What domain name to use for your home network
URL: https://www.ctrl.blog/entry/homenet-domain-name/
Last updated: 2026-08-23T22:09:08.000Z
There’s a definitive answer to this question, and you can find it in [RFC 8375](https://www.rfc-editor.org/rfc/rfc8375.html?ref=ctrl.blog): use `home.arpa.`Never heard of it before? It wasn’t assigned as a special purpose top-level domain (spTLD) name for residential and small networks until 2018\. 

The `home.arpa` spTLD isn’t a globally unique domain name, and you can’t resolve it across the internet. It’s only meant to be used inside a small network, such as your home network. Routers and Domain Name System (DNS) servers know, \[in theory\], not to forward ARPA requests they don’t understand onto the public internet. 

You may have seen some suggest you use the `.local` spTLD instead. That is an older spTLD name used by the self-configuring Multicast DNS (mDNS) protocol ([RFC 6762](https://www.rfc-editor.org/rfc/rfc8375.html?ref=ctrl.blog)). You should not configure your router or devices to use this domain name. 

DNS clients may defer the resolution of `.local` spTLDs to the system’s mDNS resolvers instead of its DNS resolver. You can end up with domain resolution conflicts, or a situation where only some devices can resolve your domains.

What domain name to use in a residential home or local area network most often comes up in the context of configuring the DHCP server on your router. Most gateway routers leave it empty by default, or may populate it with a domain assigned by your internet service provider (ISP). You can safely set it to `home.arpa` on your local network’s DHCP server. 

Devices on your network should then assign themselves a `example-device-hostname.home.arpa` domain name. Please note that not all residential routers binds its DHCP leases’ host- and domain names to resolvable DNS entries in the router’s DNS server. You may not be able to resolve the `home.arpa` domains without additional configuration (or a different router or dedicated DNS server).

Your time is better spent ensuring all your devices support mDNS resolution than trying to fix DHCP lease bindings and DNS resolution on your router. DHCP–DNS resolution is [complex to get working right](https://www.ctrl.blog/entry/routeros-dhcp-lease-script/) if your network equipment even supports it. Linux and MacOS should be all set to work with mDNS. Although, you may need to adjust your firewall configuration on Linux, depending on your setup. Windows devices may need you to install an mDNS resolver and tweak the Windows Firewall.

Devices and programs that are configured to avoid your router for DNS resolution may not be able to resolve the `home.arpa` domain name. Try reverting any changes you’ve made to the DNS settings on your devices, or make sure they’re set to use your router for DNS. Some programs, like web browsers, may have their own special settings for DNS or encrypted DNS like DNS over HTTPS. 

**Do not use** undelegated domain names like `.lan`, `.home`, `.homenet`, `.homegroup`, `.network`, nor should you make up your own domain name. If you use a made-up domain name, then DNS requests may go unfulfilled by your router and it forwards them to the global DNS root servers. This creates needless overhead for the core internet infrastructure, and leaks information about your network (such as device names). Web browsers and other software, including your router, should already know not to do that with `.local` and `.home.arpa` domains.

Alternatively, you can use a domain name or a subdomain you’ve bought from a domain registrar or DynDNS service provider. This setup requires extra configuration of your router to work locally, and an advanced setup involving dynamic-domain names, like DynDNS, to work over the internet. 

#### Sources

- [RFC 8375: Special-Use Domain ‘home.arpa.’](https://www.rfc-editor.org/rfc/rfc8375.html?ref=ctrl.blog), 2018-05, P. Pfister and T. Lemon, Internet Engineering Task Force
- [RFC 6762: Multicast DNS](https://www.rfc-editor.org/rfc/rfc6762.html?ref=ctrl.blog), 2013-02, S. Cheshire and M. Krochmal, Internet Engineering Task Force
### Review of the MikroTik hEX (3rd rev.) as a home router
URL: https://www.ctrl.blog/entry/review-mikrotik-rb750gr3/
Last updated: 2026-08-23T22:19:25.000Z
The [MikroTik hEX (RB750Gr3)](https://mikrotik.com/product/RB750Gr3?ref=ctrl.blog) is an inexpensive network router with advanced capabilities. I’ve used it as my home router for the last five years. It’s not a consumer-grade product, and it certainly isn’t your grandma’s router!

The hEX features five Gigabit Ethernet ports, an 0,88 GHz dual-core MIPS processor, and 0,25 GB RAM in a compact enclosure (optional). That’s roughly double the processing power and two–four times the RAM found in most consumer routers. Yet, it costs only just shy of 50 Euro (60 US).

It can handle 1 Gigabit of package switching under an optimal configuration. However, it fizzles out at around 380 Mbps for routing, so it won’t be enough to handle a full Gigabit internet connection. That’s more than enough for most customers, though.

It can also do light virtual private network (VPN) server duties for a handful of clients. MikroTik comes with OpenVPN and L2TP/IPsec servers built-in, but there isn’t support for the newer WireGuard protocol. However, the server will be bottlenecked by the processor before reaching speeds above ≈60 Mbps. For comparison: the [Vilfo VPN router](https://www.ctrl.blog/entry/vilfo-review-p1-overview/) is intended for a similarly sized network, but features a twice as fast processor and 2 GiB of RAM.

As you can see from the above photo, a section of the hEX’s plastic top chassis has turned yellow. The processor/heatsink is located directly underneath the yellowed area. The yellowing indicates that the router has struggled to shed excess heat which has accelerated aging in the plastic. The yellowing is the cosmetic price you pay for a quiet and passively cooled/fanless router.

MikroTik’s network products are powered by its proprietary RouterOS operating system. RouterOS can be configured to make anything you’d like out of your network. However, it has a steep learning curve. You’re required to know what you’re doing, or at least be willing to put in the time to learn it. Take a few minutes to explore the [online demo of their web administration interface](https://mikrotik.com/software?ref=ctrl.blog) before you continue reading.

You can set up the Ethernet ports to act as a simple switch. Or, you can set up individually partitioned and managed networks for each or some of them. For example, you can create a privileged open network, and an isolated network for guests and your internet of things (IoT).

You don’t get niceties like support for Universal Plug’n’Play (UPnP) out of the box. UPnP is a method for devices inside your network to open public ports on the router. While it’s redundant in IPv6 networks and considered insecure in IPv4 networks; UPnP is nevertheless expected to work in residential networks. Your game consoles and apps simply won’t work without it. RouterOS supports UPnP, but it’s yet-another-thing you must configure and enable yourself.

The RouterOS documentation is fantastic compared to what you get from consumer-grade routers. You’ll likely wish for even more detailed documentation of each option if you aren’t familiar with network administration. It also tends to lag behind the public releases, so there might be some newer options that are undocumented.

RouterOS is very configurable, although there’s one feature that I miss: DHCP lease hostnames to DNS mapping. The built-in DNS server should respond to queries for hostnames on the local network. Luckily, it’s extensible through scripting, so I could [add in the feature myself](https://www.ctrl.blog/entry/routeros-dhcp-lease-script/).

The RouterOS scripting language is … [unique](https://wiki.mikrotik.com/wiki/Manual:Scripting?ref=ctrl.blog). It can be difficult to develop and debug your scripts, though. The script interpreter just quits when it encounters a syntax error without returning any error messages.

Similarly, RouterOS doesn’t support auto-updates out of the box. You can implement an auto-update service through a script that checks for updates, downloads, and reboots to install them. However, RouterOS updates aren’t meant to be performed unattended. You must read the changelog for each update and evaluate if the changes will impact your setup. Security advisories and updates are communicated through [a syndication feed](https://mikrotik.com/current.rss?ref=ctrl.blog) (yay, RSS!)

RouterOS has an optional slower-moving long-term support update ring that just gets the security updates. This update ring may be more suited for unattended updates, but sooner or later it’ll also roll forward with breaking changes and new features. MikroTik needs to address this and implement and support automated updates. You can’t have any device connected and directly exposed to the internet that doesn’t receive automated security updates.

You may have read about security issues in MikroTik products or RouterOS. I’ve reviewed the January 2017–July 2021 issues. Many of them are caused by misconfigurations; e.g. making administrative ports and services accessible to the public internet. It’s a powerful product, and it can be made to do stupid things. The most important takeaway from looking into MikroTik’s security track record is that the company quickly churns out security updates when they’re needed.

I’ve previously looked into [the abysmal state of security and other firmware updates](https://www.ctrl.blog/entry/routers-are-computers/) from network equipment manufacturers. You can buy off-the-shelf network equipment with ten years out of date software! You often get no guarantee of future security or software updates from the manufacturer.

I understand that business-critical routers can’t randomly go offline and reboot to install software updates. However, online kernel updates (or “live patching”) that don’t require a reboot have been a thing in the Linux kernel for over a decade already. Another solution could involve scheduling times and days when it’s okay to do a quick reboot to install updates. (Obviously, it would need to be more flexible than [Windows 10’s Active Hours](https://www.ctrl.blog/entry/windows-active-hours/).)

> “The device includes free software updates for the life of the product or a minimum of 5 years starting from date of purchase.”

RB750Gr3 product page, MikroTik website

MikroTik’s five-year software guarantee is unheard of on the consumer-grade router market. Mine is five years old now, but MikroTik and its resellers still sell it today. so, I can expect it to still be supported in another five years. I find it frustrating that consumer-grade routers — which are often more expensive — can’t even promise you software from the current decade!

So, who is this router for? If you haven’t been dismayed yet and you’re still reading, then this might be the ideal router for your home network! It’s a router for the enthusiast; or at least for someone who wants greater control over what happens on their network. You can get RouterOS on more powerful edge gateway routers if your needs demand it. The RB750Gr3 is a good entry-level device, and an inexpensive way to review RouterOS.

MikroTik kind of wins the prosumer network gateway router category by default as there aren’t many competitors in this price range. The Ubiquiti EdgeRouter series is just about the only alternative that comes to mind. It is similarly priced, has almost identical hardware, and runs Ubiquiti EdgeOS. Whatever you may think of Ubiquiti’s ecosystem, the company [doesn’t plan to support its entry-level routers](https://evanmccann.net/blog/2020/12/uisp-is-the-new-unms?ref=ctrl.blog) any longer. MikroTik still has a whole slew of products in this category, however.

I don’t recommend that you get the MikroTik RB750Gr3 router for your home network. It can be a significant time-investment to set up, and it’ll require ongoing maintenance. It’s definitely not something you setup and forget about. You’ll know best whether it’s a product that’s appealing to you or not.

**Reviewed:** [hEX RB750Gr3](https://mikrotik.com/product/RB750Gr3?ref=ctrl.blog)

**Review rating:** 8 / 10
### How to make Windows Update prioritize Delivery Optimization downloads
URL: https://www.ctrl.blog/entry/windows-delivery-optimization/
Last updated: 2026-08-23T22:24:56.000Z
Windows Delivery Optimization is a peer-to-peer (P2P) file-sharing service for software from Microsoft. It works with Windows Update and updates from the Microsoft Store. The service can help reduce your data/bandwidth usage, and free up limited internet bandwidth for other activities. It can optionally also download from other Microsoft customers over the internet.

Delivery Optimization, unlike other P2P services like BitTorrent, is centrally managed by Microsoft. The obvious use for Delivery Optimization is to reduce the cost and time to download updates for consumers with slow network connections. Assuming you’ve got more than one Windows PC in your household, you’ll only need to download updates via the internet once. Your Windows devices can then share the updates directly on your local network.

However, Windows prefers downloading updates in parallel from Microsoft servers over the network and through Delivery Optimization. Your devices won’t use the Delivery Optimization service by default, despite the service being configured to run by default. In this article, I’ll teach you how to get the Delivery Optimization service working. I’ll also show you how to get Windows to prefer downloading updates through the Delivery Optimization service.

Delivery Optimization may appear to be controlled by a simple on/off toggle in the Windows Settings app. However, there are a few more technical requirements to run the Delivery Optimization service. The Windows Settings app frankly doesn’t do a good enough job at communicating these to the user. Let’s go through each of them to make sure Delivery Optimization can run on your computers.

Let’s start with the basics. Open the Windows Settings app and go to Windows Update: Delivery Optimization. Make sure it’s set to “allow downloads from other PCs.” If you just want your computer to prefer peer-to-peer downloads, set it to “PCs on my local network, and PCs on the internet.” This setting may be faster overall depending on your internet connection, and the size of the updates. If you want to reduce your internet usage and save bandwidth, set it to “PCs on my local network.”

You should then double-checking your devices’ network settings. Open the Windows Settings app and go to Network: Status. Click Properties next to your network connection. Make sure the Network profile is set to Private. Delivery Optimization can’t communicate with other computers on your local network unless it’s configured as a Private network. Virtual Private Network (VPN) services and network proxies may interfere with Delivery Optimization.

You also need at least 32 GB of available disk space, at least 4 GB of total system RAM, and a 40 % battery charge. Despite requiring 32 GB of free disk space, it won’t use more than 10 GB or 20 % of your total disk size (whichever is the smallest). Delivery Optimization will only work for 100 MB files or larger, and files won’t be shared for more than three days. I’ll discuss how to change these parameters later in the article. Make sure you read the second section if you’re highly bandwidth-constrained or pay excessively for your internet access.

You need to repeat the above steps on each of your Windows devices. With all the above setup and troubleshooting out of the way, you should have Delivery Optimization in a working state on your Windows devices. However, depending on your internet speed and device usage, all your devices may still fetch most of their updates from Microsoft Servers over the internet.

You need to make one more tweak to get Windows Update to *prefer* downloading updates via Delivery Optimization. Unfortunately, there’s no setting intended for this purpose. However, we can tweak another set of settings to achieve the same end.

You should understand the consequences of delaying updates and new installs. Downloads from Windows Updates, Microsoft Store, and optional Windows features may appear stalled until the delay period has elapsed. They might appear stuck in a “downloading – 0%” state. There’s no button to override the delay, you just have to wait. As soon as one computer on your network has an update, it should begin downloading on your other PCs too.

This is also where the difference between the background and foreground download delays comes into play. A shorter (or no) foreground delay means you’ll not have to wait for downloads to begin when you have the Microsoft Store or Windows Update open in a window. This, of course, means they could consume more bandwidth/data compared to background downloads. So, be aware that can happen when you leave the Windows Update or Store windows open. The five-minute delay gives you enough time to manually prompt Windows Update to check for updates, and close the window and have it finish the update process in the background.

This setup will negatively impact updates to device-specific drivers, however. If no other device needs a specific set of drivers, your devices will just have to wait for the delay timer to run out. This is why we set it to one hour and not something more aggressive like a week.

You can make this change via the Registry Editor (`regedit`), Group Policy Editor, PowerShell or Terminal, or by importing a predefined registration file. We’ll use the latter method because it works the same on all versions and editions of Windows 10 and 11\. The process is simple.

Start by downloading the [msdosvc-delay-http.reg](https://www.ctrl.blog/file/2021-08-09%5Fwindows-delivery-optimization/msdosvc-delay-http.reg) file to your Downloads folder. Open File Explorer and go to the Downloads folder. Right-click on the file and select Edit. You should always review `.reg` files before applying them to check that they don’t make any changes you don’t want. In this instance, you’ll see that the file only makes changes to the Delivery Optimization service. You can now close Notepad again.

You can then import the registration file on your system by double-clicking on it. You’ll get prompted to confirm that you want to apply the changes to your system. Agree to make the changes, and you’re done!

The configuration file will delay updates from Microsoft Servers by one hour for background updates, and 15 minutes for foreground updates (when the Windows Update window is open). You can change the timing settings by opening the Registry Editor (`regedit`; search for it in the Start menu), and going to `HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization`. Note that this path might not exist until after you’ve imported the above registration file! Double-click on a setting, toggle decimal mode, and enter the desired times in seconds.

Delivery Optimization will download over the internet in parallel as well as from your local network after the delay timer expired (parallel download mode). For maximum data/bandwidth usage savings, the timer should be long enough to allow one computer to fully download the updates.

If your internet access is expensive or slow, you may want to increase the delay timer to three or more hours to improve the chances that your devices will be powered on simultaneously and can share updates. For the most bandwidth savings, you can set the delay to one day (86400 seconds). A longer delay is useful on slow connections where you absolutely don’t want all your computers to download the same updates over the internet.

Ideally, you’ll want to set no or only a short delay on one computer on your local network. This computer should be your primary computer; the one that’s powered on the most. It’ll get updates earlier than other computers on your network, and can then share them with the rest of your network over time.

I’ve prepared a second registration file that makes more changes to how and when your computers use the Delivery Optimization service. It tweaks some of the conditions that govern when the Delivery Optimization service runs. I briefly discussed these earlier in the article. The registration file makes the following changes:

- Share updates of >2 MB instead of >100 MB.
- Cache files for two weeks instead of three days.
- Share updates when there is at least 16 GB of available disk space instead of 32 GB.
- Share updates when their battery is 30 % charged or more instead of 40 %.

The process is the same as the one specified above, but repeat the process with the [msdosvc-run-conditions.reg](https://www.ctrl.blog/file/2021-08-09%5Fwindows-delivery-optimization/msdosvc-run-conditions.reg) file. To be clear, you can apply one or both registration files; apply both will help you save the most on your monthly data cap.

You can get a more detailed description of all the changed values and other available options by opening the Local Group Policy Editor app (only available on Windows Pro): Computer Configuration: Administrative Templates: Windows Components: Delivery Optimization. Or, you can review the [Delivery Optimization reference guide](https://learn.microsoft.com/en-us/windows/deployment/do/waas-delivery-optimization-reference?ref=ctrl.blog).

Here’s the process to revert the changes applied in this article from your PC. Redownload the two registration files linked earlier in the article. Edit them and find all lines containing an equal sign and a value. Change each option to say, e.g. `OptionName=-` (equals hyphen/minus.) Save the modified file, and double-click it to apply the changes. You can also delete the entries using the Registry Editor app.
### Overriding Bedtime mode with priority alerts
URL: https://www.ctrl.blog/entry/android-bedtime-mode-priority-alerts/
Last updated: 2026-08-23T22:01:34.000Z
Bedtime mode on Android guides you towards better sleep habits by muting notifications and making your phone less interesting. Samsung’s take on the feature says it will mute all sounds and alerts, but that isn’t the whole story. What if you rely on certain notifications and alerts to wake you in the night?

Google requires Android manufacturers to either bundle its Digital Wellbeing app or an equivalent app. Samsung has opted for the latter option with its Samsung Digital Wellbeing app. Samsung’s app has most of the same features as the Google app. However, Samsung’s design doesn’t do as good a job as Google at explaining how its Bedtime mode works.

Bedtime mode, formerly known as Wind Down mode, is a feature that tries to encourage you to put your phone down and go to bed. The mode is enabled on a user-defined schedule. When enabled, it switches the phone’s display to grayscale mode. It also puts the device into Do Not Disturb mode — silencing notifications, vibration, and sound.

However, Samsung’s Digital Wellbeing app doesn’t precisely communicate that it’s using Do Not Disturb mode. The app says Bedtime mode will “mute calls, alerts, and other sounds.” This wording is both precise and vague, and I wasn’t sure how to interpret it. It could mean it mutes all sounds indiscriminately, or that it enables Do Not Disturb mode.

Google’s Digital Wellbeing app clearly communicates that its Bedtime mode uses Do Not Disturb mode. It even offers its customers a toggle switch to turn it off during Bedtime mode. You can see a comparison with Samsung’s app below.

[![Settings screen for Samsung Digital Wellbeing’s Bedtime mode](https://cdn.synaps.media/control/content/images/2026/08/samsung-android-bedtime-mode.png)](https://cdn.synaps.media/control/content/images/2026/08/samsung-android-bedtime-mode.png?ref=ctrl.blog) 

[![Settings screen for Google Digital Wellbeing’s Bedtime mode](https://cdn.synaps.media/control/content/images/2026/08/google-android-bedtime-mode.png)](https://cdn.synaps.media/control/content/images/2026/08/google-android-bedtime-mode.png?ref=ctrl.blog) 

Left/top, Samsung’s single-screen Bedtime mode settings. Right/bottom, Google’s Bedtime mode settings (scheduling on the second screen). 

Most Samsung customers won’t have another phone running Google’s variant of Android lying around for reference. Users can’t uninstall Samsung’s Digital Wellbeing app and install Google’s app in its stead either. Samsung’s [app documentation](https://web.archive.org/web/20210124025805/https://www.samsung.com/us/support/answer/ANS00085547/) doesn’t even mention that Bedtime mode silences the phone. You might do some searches on the web, and discover an article on [how Bedtime mode improves your sleep](https://blog.google/outreach-initiatives/digital-wellbeing/improve-your-sleep/?ref=ctrl.blog) from the Google Blog. You could then assume that Samsung’s Bedtime mode works the same way, but that’s not always a given.

Most notifications should stay quiet throughout the night, and probably won’t be all that important the next day. It makes complete sense to silence them at night. I wanted to use Bedtime mode, but I felt uncertain about how it worked.

So, why does it matter how the phone is silenced? Surely, you just want the damned thing to be quiet at night, right? It gets complicated when you consider app-specific and priority alert exceptions.

Do Not Disturb mode is well-integrated into the notification subsystem and the broader ecosystem. Some wearable devices, like the [Samsung Galaxy Fit2](https://www.ctrl.blog/entry/review-samsung-galaxy-fit2/), can sync with the phone’s Do Not Disturb and Bedtime modes and adjust its settings accordingly. More importantly, you can configure Do Not Disturb mode to allow priority contacts, repeat calls, and specific apps to break through to alert you.

Some notifications are more important than others. Accidents happen, and repeat calls must be let through even though you don’t want to listen to your drunk friends’ nighttime calls. Maybe you’re on-call and want to still receive a critical alert. Or, maybe you’re wearing a life-extending sensor that, almost unfathomably, is tied to your phone’s notification system.

[I wear a glucose sensor](https://www.ctrl.blog/entry/freestyle-libre-reader-vs-app/) that alerts me about critical changes in my diabetes. I get early alerts about hypoglycemic events and can quickly get up out of bed to eat something. It’s like having a diabetes service dog built into my phone! It depends on Android’s notifications system to deliver the alerts, however.

After wasting an hour testing it, I confirmed that Samsung’s Bedtime mode does indeed toggle the Do Not Disturb mode. Notification exceptions created for Do Not Disturb mode also apply to Bedtime mode. If you’re still uncertain about Bedtime mode, then you can schedule Do Not Disturb mode instead (Android 9 and newer).

The only difference between the two scheduled modes is whether or not the screen switches to grayscale mode. Many may find this preferable to Bedtime mode’s turning their displays grayscale. I find grayscale mode frustrating as many apps rely on subtle color queues to communicate important information. (It would seem it has once again become unfashionable to design user interfaces that accommodate the color blind.)

My uncertainty and confusion over how Bedtime mode worked rest entirely on Samsung’s shoulders. It appears like Samsung’s designers haven’t spent the same effort to precisely communicate how Bedtime mode works. Maybe they thought they’d distilled the core functionality of Google’s app, but didn’t fully understand why it was designed the way it is. The app may also have been intentionally made worse to not plagiarize Google’s app. Whatever the reason, Samsung customers don’t get as great an experience as Google customers.
### Windows adds two new monospace system fonts
URL: https://www.ctrl.blog/entry/cascadia-system-font/
Last updated: 2026-08-23T22:03:01.000Z
Windows 10 and 11 will soon get two new monospace system fonts. System fonts are the default installed fonts that are available to use in any apps and website. This is the first time since Windows Vista that Microsoft is adding new system fonts to Windows.

Consolas has been the modern monospace font of choice in Windows since Windows Vista. Web browsers and the Command Prompt still defaults to the much older Courier New for legacy compatibility reasons. Consolas has been the default font in Visual Studio (VS) and VS Code for years already.

However, there’s a new monospace font landing soon in Windows 10 and 11: meet Cascadia Code and Cascadia Mono. Microsoft has already made it the new default font in VS and VS Code, and the Windows Terminal app. A version of the Cascadia font family is bundled with the apps, and gets installed alongside them.

—and it’s this font bundling that means the font will become available by default on Windows going forward. You can install the Windows Terminal app from the [Microsoft Store](https://apps.microsoft.com/store/detail/windows-terminal/9N0DX20HK701?ref=ctrl.blog) today. However, Windows Terminal will be installed by default in Windows 11\. The app won’t install alongside Windows, but it gets installed from the Microsoft Store soon after the computer goes online. Future versions of Windows 10 are also expected to install Windows Terminal by default. It’s already [in testing](https://blogs.windows.com/windows-insider/2021/03/17/announcing-windows-10-insider-preview-build-21337/?ref=ctrl.blog) in the Windows 10 Insider program.

Unlike Microsoft’s previous fonts (including the Microsoft Web Core fonts, and the Vista ClearType fonts), Cascadia is an open-source project. You can freely use, download, redistribute, sell, and even modify it (assuming you give your version a different name). You can grab the font’s source code or download a release copy today from [Cascadia’s repository](https://github.com/microsoft/cascadia-code?ref=ctrl.blog) on GitHub.

Cascadia Code is a monospace/fixed-width font where all the characters and punctuation mark has the same width. This is useful for tabulating data, source code, and terminals. Cascadia Code also features optional programming ligatures; a feature that combines character sequences common in programming into symbols. It’s the first font from Microsoft to feature programming ligatures. (Cascadia contains some common typographic ligatures, but that doesn’t count.)

Cascadia Mono isn’t really a different font from Cascadia Code. It’s a version of Cascadia Code without the programming ligatures. Mono was given a unique name as a convenience to users who’re unfamiliar with how to turn on or off font features such as ligatures. It’s also useful when used with programs that don’t offer users direct control over font features.

So, why is this a big deal? It’s a fairly rare occasion that anything gets added to the default system-installed font set. It’s been 14 years since the release of Windows Vista; which was the last time Microsoft added any new fonts to its operating system. Apple adds new fonts to MacOS on average every four years.

Web fonts enable websites to choose whatever font they can afford for their designs. However, many fonts can be expensive to license, and web fonts take extra time and resources to render. They’re not great for users on low-end devices, or slow or expensive network connections. Web designers can reduce page load times by sticking to the true and trusted default system fonts. Getting a new font in the world’s most popular operating system is pretty exciting.

Cascadia Mono isn’t metrically-compatible with either Consolas and Courier New. Here’s a [font specimen of the three fonts at different point sizes](https://cdn.synaps.media/control/content/images/2026/08/consolas-cascadia-courier-metric-specimen.png?ref=ctrl.blog). Cascadia isn’t a drop-in replacement for any of the earlier fonts.

There are even more new fonts on the horizon. Windows 11’s default user interface font is a refreshed version of the current Segoe UI font called Segoe UI Variable. The refreshed font may also get [added to Windows 10](https://www.windowscentral.com/microsoft-introduces-new-segoe-ui-variant-font-latest-windows-10-preview-build?ref=ctrl.blog) in time. There *may be* at least [five more new fonts](https://www.microsoft.com/en-us/microsoft-365/blog/2021/04/28/beyond-calibri-finding-microsofts-next-default-font/?ref=ctrl.blog) coming to Windows 11, but that’s just speculation at this time.
### Don’t preorder ebooks from Packt Publishing
URL: https://www.ctrl.blog/entry/packtpub-preorder/
Last updated: 2026-08-23T22:15:16.000Z
Two months ago, I preordered an interesting-looking ebook title from Packt Publishing. Neither the post-purchase experience nor the final product lived up to my expectations.

The ebook’s product page said it was due for release in the second week of June. However, I didn’t receive any information about the book availability after I’d placed my order. Both the order confirmation page and the receipt email told me to visit my downloads page. I didn’t find any ebooks listed in my account and no information about my purchase.

I knew I had preordered the book, and I expected to see it listed in my account. The purchase experience was confusing and unclear overall. The PayPal receipt email made it clear that I’d paid for something, but Packt dropped the ball on the delivery. Packt didn’t ask me to set up an account or do anything other than providing an email address. All I’d want to see was one sentence saying something like “\[Book Title\] will be delivered to your email inbox by July 2020.”

I didn’t receive an email from Packt when the book was supposed to be released. I had created a reminder in my calendar for the following day, though. I logged back into my Packt account, but it still didn’t list any books. I found my way back to the book’s product page where it said the release date got delayed by a month. Which is okay; stuff happens.

It’s been almost two months since I preordered the book, and Packt had sent me seven emails. I never consented to receive marketing emails from Packt or its partners, by the by. That didn’t stop the company from sharing my email address with third parties for marketing purposes. Packt even sent me three emails (the first came in duplicates) asking me to review the purchase, over a month before the book was released.

Yet, Packt didn’t believe “the preordered book is now available for download” warranted an email notification. This lack of communication is something that Packt must address!

I used on of the feedback forms to complain to Packt. I complained about the preorder experience and the lack of communication about my purchase. I clicked on the survey email again while fact-checking this article, and found that Packt replied just a few hours after I’d left the feedback. I never received an email notification letting me know it had replied.

I logged back into my account and found the book and download links for the book. It came in three ebook formats totaling 10 MB. I downloaded all three simultaneously, and the downloads took almost 40 minutes. That’s slower than dial-up modem speeds! Packt distributes them through Amazon Cloudfront (a content delivery network). Given my internet speed and the might of Amazon’s hosting services, the download shouldn’t have taken more than a second. I guess I was the first to download the book in my region or something. The experience was frustratingly slow.

The book I ordered had one review at launch: a one-star review from another customer complaining about not being able to locate their download links. A week later, and this one one-star review is the only review of the book on Packt’s website.

I finally had my ebook in PDF, ePub, and Mobi (proprietary to Amazon Kindle) formats. The PDF is too wide to be read comfortably on a mobile display in portrait mode. It’s a little better in landscape mode, but the PDF-reading experience on mobile will always be subpar.

I intended to use the ePub with a dedicated app on my phone. My backup plan was to read the ePub in a web browser. The ePub format is essentially just “webpages packaged up in ZIP archives.”

However, the ePub file Packt gave me wasn’t properly formatted. It lacked all formatting for inline code and blocks of code examples. Seeing how I’d bought a book on programming, it was kind of essential to get the formatting right. Blocks of code are typically set in a monospace font, and the exact use of whitespace can influence the computer execution and human reader-understanding of the code. Preformatted code blocks just don’t look right when presented as flowing body text.

I unpacked the ebook and had a look at its source code. I initially thought all the ePub apps I tried just didn’t work properly with the CSS stylesheet Packt had prepared for the book. The ePub had embedded a sans-serif font used on headlines, a serif font for body text, and a nice monospace font for use with code.

Unfortunately, Packt had just failed to properly mark up and style the code examples as code examples. I figured it was just a small thing like the book’s stylesheet referring to an unused class called `code` instead of the HTML `code` element or vice versa. Instead, what I found was the code was just embedded in the ePub as unformatted plain text.

Packt publishes roughly 300 book titles per year. Most of their books contain example code to some degree or another. It didn’t even cross my mind that their ebook product wouldn’t have the right formatting.

I could technically go through this 400-page book and mark up the code myself. However, I don’t intend to spend hours doing what I’d paid Packt to do for me. Instead, I emailed Packt to complain about the formatting. I also complained that I hadn’t received an email notification about the book now being available for download.

Packt quickly got back to me and clarified that the book hadn’t been released yet. It was due for release the following day. The product page had changed all purchase links from “Pre-order” to “Buy”, but I didn’t argue the matter. Packt said it would investigate the formatting issue and get back to me.

A week later, I received a follow-up email from Packt where it said the ebook was now available for download. Packt claimed to have checked and couldn’t identify any issues with the formatting of the ebook. I’d already sent it details and examples, but Packt also wanted screenshots of the problem. I’ve sent a couple of screenshots, and I’m waiting for Packt to acknowledge the formatting issues.

The intervening week was my big reading opportunity featuring two six-hour train journeys (with just my phone). I’m just going to read the PDF — which doesn’t have the same formatting issues — on a desktop computer instead. Or, maybe I’ll pick up an e-ink ereader device instead? I hear those can display PDFs nowadays.

I’ve refrained from mentioning the title of the book I purchased or its author. The publisher is responsible for the purchase experience on its website. It’s also responsible for typesetting and quality control in the areas that failed for this book.

I’m not impressed by the purchase experience at Packt. I don’t recommend that you prepurchase ebooks from Packt. If you do, then you should also create a reminder on your phone to grab the downloads. You also shouldn’t expect that the formatting in all the ebook file formats will be perfect on day one.
### Nothing but bad experiences with Realtek Ethernet NICs
URL: https://www.ctrl.blog/entry/realtek-nic/
Last updated: 2026-08-23T22:16:43.000Z
I recently got a new [Asus AMD B550-PLUS](https://www.asus.com/motherboards-components/motherboards/tuf-gaming/tuf-gaming-b550-plus-wi-fi/?ref=ctrl.blog) mainboard. It has a built-in Realtek PCIe 2,5-gigabit (RTL8125B) network interface controllers (NIC). As is often the case with Realtek NICs, it has been quite unreliable and is plagued with intermittent issues. 

The NIC will randomly stop working after a few hours. It’s working fine according to the network status indicator and the networking troubleshooter in Windows. However, no traffic is getting either in or out of the NIC. Eventually, programs waiting on networking eventually time out and begin displaying error messages.

Neither disabling and reenabling the NIC in the Device Manager nor rebooting the computer fixes the problem. It needed a full power cycle before it would start working again; literally turning the computer off and on again.

In addition to the random failures, it would also stop working after the computer resumed from being suspended to memory (sleep mode). Notably, suspending to disk (hibernation) wasn’t a problem for it. It’s quite common for hardware to struggle when resuming the session after hibernating, but this wasn’t the case here. This is likely because hibernation involves completely powering down the system.

I thought it might be related to the NIC’s power-saving modes. The driver has half a dozen settings, and I tried various configurations for it and the computer’s PCIe power management. The power tuning didn’t make any difference. 

Windows Update was quite happy with the Microsoft-supplied driver version 9.001.0410.2015 (released on 2015-04-10). The Realtek website supplied a much more recent driver version 10.50.511.2021 (released on 2021-05-11).

The newer driver mostly resolved the issue related to sleep and resume. The NIC now works when resuming from sleep, but it operates at a reduced speed for the first couple of minutes. Online network speed measurement tests confirm that the NIC is significantly slower than my internet connection while this is happening. After about three minutes, the NIC fully recovers and can operate at its normal fast speed again.

The NIC still randomly fails every couple of hours, though. It sometimes recovers on its own after some tens of minutes, but it’s not doing so consistently. Disabling and reenabling the NIC in Windows Device Manager also restores its functionality. That is at least is an improvement over the older driver.

The NIC also has problems running on the same hardware under Linux. The NIC randomly fails after a couple of hours, or the driver fails to load during start-up. Unloading and reloading its kernel module brings it back to life. This is no way to live, though.

Realtek markets the RTL8125 as a “gaming NIC.” I’m not sure what that entails, though. It has no more than the normal number of blinking lights! In a [press release,](https://www.realtek.com/en/press-room/news-releases/item/realtek-s-new-generation-gaming-network-total-solution-2-5gbe-gaming-nic-with-dragon-feature-wi-fi-6-intelligent-switch-rtl8125bg-rtl8852ae-rtl9313-rtl8221b-wins-computex-d-i-awards-2021?ref=ctrl.blog) Realtek claims it’s supposed to come with some sort of software for automated quality-of-service (QoS) network packet-prioritization “for gaming traffic.” It’s unclear if this is provided by some yet-to-be-released stand-alone software, the NIC driver, or is built into the firmware. Either way, this claim is so vague that it’s impossible to verify.

I’ve only ever had bad experiences with Realtek NICs going back over a decade. The NICs will randomly stop working and require some sort of manual intervention to recover. They’re particularly troublesome under FreeBSD and Linux, but they haven’t been much better under Windows.

For example, I’ve also got two other mainboards with different onboard Realtek NIC models. They’re hard to avoid. Almost all mainboards for AMD processor sockets come with a Realtek NIC. You can get some with Intel NICs, but they’re few and come at a significant premium. Realtek NICs are the price you pay to be an AMD customer.

My home theater computer (HTPC) is an [ASRock DeskMini X300](https://www.asrock.com/nettop/AMD/DeskMini%20X300%20Series/?ref=ctrl.blog) with a Realtek RTL8111H NIC. It’s primarily used for online video streaming, where buffering *mostly* hides the fact that the NIC periodically resets. The stream sometimes stalls as it catches up with the buffering before the driver has reset and restored networking.

I’d like to replace the Realtek NIC with an Intel NIC. However, it’s a compact barebones system with no room for a PCIe expansion card. I could get a USB NIC, but those almost exclusively contain Realtek NICs. There are also some Ethernet–USB dongles on the market with NICs from ASIX Electronics. I’ve no experience with ASIX NICs, but I’d prefer to give those a try before any more Realtek products.

Unfortunately, most Ethernet–USB dongles don’t advertise what NIC is inside. Realtek is by far the most common option. I don’t intend to buy a load of generic unmarked dongles and hope to get one ASIX model in the mix.

**Update** (2021-07-11): A quick aside: Any USB–Ethernet dongle labeled as compatible with the Nintendo Switch should be an ASIX NIC. The Switch doesn’t come with Realtek drivers, but its operating system does include ASIX drivers.

My last Realtek NIC is an RTL8111H installed on an [ASUS Prime X570-P](https://www.asus.com/motherboards-components/motherboards/all-series/prime-x570-p/?ref=ctrl.blog). This has been my primary Linux workstation for the last few years. The NIC randomly disconnects about six times a day under Linux, and maybe three times under Windows. On Windows, I need to reboot to get it back up and running. On Linux, I need to unload and reload its kernel module to get it functional again.

The RTL8111H NIC also stops working after receiving a few megabits of UDP traffic, e.g. peer-to-peer protocol data. The UDP problem manifests under both Linux and Windows. Driver unreliability under heavy UDP traffic has also been [noted by other customers](https://github.com/arvidn/libtorrent/issues/5761?ref=ctrl.blog) of the 2,5 gigabit RTL8125B NIC. I haven’t been able to reproduce the problem with that NIC, although I can reliably trigger it with the older RTL8111H NIC.

So, I’m obviously not using the Realtek NIC on that computer. I’ve installed an Intel NIC on a PCIe expansion card to take its place. I haven’t had any Ethernet networking issues with it whatsoever.

I’ll replace the newer RTL8125B NIC on the Asus B550-PLUS with another Intel NIC on a PCIe card. It would be nice to play with the 2,5-gigabit capabilities of the Realtek NIC. However, there simply aren’t any reasonably priced consumer-grade 2,5-gigabit switches on the market yet. Intel does have a few PCIe 2,5-gigabit NICs, but I haven’t decided if it’s worth the price premium over a one-gigabit card.

That’s just my current hardware, however. In 2015, I bought a small form-factor barebone computer with two built-in Realtek NICs for use with the then recently-announced [OPNsense](https://opnsense.org/?ref=ctrl.blog) router operating system. OPNsense is based on FreeBSD and the Realtek drivers were incredibly unstable and regularly lost track of and dropped tens of percentages of packets.

Frustrated, with the Realtek drivers, I tried salvaging the hardware with [IPFire: a Linux-based router](https://www.ctrl.blog/entry/review-ipfire-home/). IPFire improved the Ethernet driver situation, but the NICs would still regularly stop responding and needed to be reset. The hardware was too unreliable to use as a network router, and I abandoned it in favor of another mainboard with an Intel NIC.

I remember struggling with other Realtek NICs on Windows and other operating systems every time I’ve encountered them in the last two decades. The solution has always been to replace them with more reliable and well-supported Intel NICs.

My recommendation is clear: Avoid Realtek network equipment. Pay the premium for an Intel NIC when possible. Don’t waste your time; get a replacement Intel NIC PCIe expansion card at the first sign of networking trouble. Realtek is cheaper for a reason.

So, what’s that reason? Why are Realtek NICs so unreliable and troublesome compared to Intel NICs? There are plenty of forum threads, mailing lists posts, and other online activites dedicated to various problems with Realtek hardware.

This is hard to authoritatively answer without spending months reviewing the hardware, drivers, and how they interact with the rest of the system. An anonymous contributor to the LinuxReviews wiki has [a good theory](https://linuxreviews.org/w/index.php?title=Realtek&oldid=13745&ref=ctrl.blog):

> “Wired Realtek network cards tend to have very little RAM compared to network cards from Intel and Qualcomm. Even 10 year old Intel cards have 10 times the amount of RAM Realtek cards have. \[…\] The lack of memory on Realtek products makes a difference for both stability and CPU interrupt use.”

This observation matches my own. Less memory means smaller network traffic buffers, which in turn means the processor needs to spend more time checking in on the NIC.

A few months ago, I encountered a Kernel bug where two computers would lock up during a tangentially networked operation. The system would enter a state where the processor had a pending queue of system interrupts, but it would no longer process any of them. It only took a few minutes after boot before the system would lock up.

One of the systems used an Intel NIC. It also had an unused and unconnected Realtek NIC on the mainboard. After disabling the Realtek NIC in BIOS, it would take 30–40 minutes before that system would lock up. I then disabled the other system’s Realtek NIC and hooked it up with a Wi-Fi NIC instead. That set-up gave me two systems that took 30–40 minutes to crash instead of a mere minute or two.

The Realtek NICs generate a lot of interrupts, and the system’s interrupt handlers would be exhausted much faster with them enabled. The additional time gave me enough time to troubleshoot, experiment, and identify the underlying issue. I was then able to get an idea of where the fault was and could deploy a workaround for the issue. (It was some weird interaction between multidisk, LUKS disk encryption, and the BtrFS file system under heavy load.) 

The Realtek driver on Windows and Linux both have settings for interrupt moderation, and other advanced settings. However, I don’t want to become a network wizard. I want my Ethernet NICs to be plug-and-play! That’s not the experience I’ve had with Realtek hardware.
### Google’s unfair performance advantage in Chrome
URL: https://www.ctrl.blog/entry/chrome-google-dse-preconnect/
Last updated: 2026-08-23T22:03:18.000Z
Google Chrome for Android has a feature that gives Google Search an unfair advantage over its competition. Sure, it’s the default search engine and that’s a huge hurdle to overcome for any competitor. However, Chrome also reserves a performance-boosting feature for Google Search exclusively.

I recently poked around in the Chromium project source code; the open-source foundation for Google’s Chrome web browser. The Chromium project is co-developed by Google, and other corporate and individual contributors. The project is managed and controlled by Google, however. I was looking for something else when I stumbled upon a feature called `PreconnectToSearch`. When enabled, the feature preemptively opens and maintains a connection to the default search engine.

The preconnection feature resolves the domain name, and negotiates and sets up a secure connection to the server. All these things take time and they must happen before the search engine can receive the users’ search queries. Preempting these steps can save a dozen seconds on a slow network connection or half a second on a fast connection.

This optimization can yield a nice performance boost for Google’s customers. Assuming the connection only requires a trivial amount of processing power and network bandwidth, of course. Setting up the connection early can be wasteful or slow down the loading of other pages if the user isn’t going to search the web.

There’s just one small catch: Chromium checks the default search engine setting, and only enables the feature when it’s set to Google Search. This preferential treatment means no other search engine can compete with Google Search on the time it takes to load search results. Every competitor must wait until the user has started to type a search query before Chrome will establish a connection.

The feature gives Google Search an 80 % head start towards delivering its search results compared to a non-preconnected competitor. It doesn’t matter if a competitor makes enormous investments in networking infrastructure if they don’t compete on the same premises.

The Chromium changelogs for the relevant code shines some light on why the feature works the way it does. The following comment accompanied the comment that restricted the feature to only work on Google domains:

> “This feature allows us to experiment on Google without possibly creating issues with non-Google DSEs. This will hopefully prevent problems or regressions with other search engines.”

Google worries that other search engines might not be able to cope with the increased number of connections this feature would cause. This is a legitimate concern. An unexpected increase in connections might overwhelm an unprepared recipient. This potential problem doesn’t change the fact that Google is giving itself an unfair competitive advantage.

Chromium could have solved this problem in a better way if they wanted to. Other search engines could opt-in or out through an extension to their OpenSearch Descriptions (OSD). OSD is a configuration file search engines provide to web browsers that tell them how to set them up as a search provider in the browser. Chrome could alternatively have used a Well-Known URI (RFC 5785) to query the search engine if they want to opt-in or out to preconnections.

**Update** (2022-01-02): Chrome now offers third-party partner search engines to opt-in to preconnect. It’s not documented publicly, but the [source code is available publicly](https://chromium.googlesource.com/chromium/src/+/453b22336b4546cf64373bfc8a7ba9ed31c24fff?ref=ctrl.blog). This option is not open to non-partner search engines, however. Currently, only Google Search has opted in to using the preconnection behavior (liekly because none of its competitors knows about it).

I’m sure the Chromium contributors had the best of intentions when implementing this feature. At least, I’m giving them the benefit of the doubt. None the less, this one small feature in Chromium skews the mobile search market in favor of Google Search; at the expense of all the search giant’s competitors.

**Update** (2022-01-02): The changes described here has since been enabled on Google Chrome on desktop.

#### Sources

- [Changelog for search\_engine\_preconnector.cc](https://chromium.googlesource.com/chromium/src/+/c96cc95a69fe78a4c24a390445258faabec85b0d/chrome/browser/navigation%5Fpredictor/search%5Fengine%5Fpreconnector.cc?ref=ctrl.blog), commit c96cc95a69, 2021-01-05, Chromium project, Google Source, Google
- [OpenSearch Description document specification](https://github.com/dewitt/opensearch/blob/1f80af3df608e47d6382b7d4306061c4abe48c74/opensearch-1-1-draft-6.md?ref=ctrl.blog), version 1.1 draft 6, 2020-11-18, OpenSearch repository, GitHub
- [Enabling PreconnectToSearch by default on Android](https://chromium.googlesource.com/chromium/src/+/c96cc95a69fe78a4c24a390445258faabec85b0d?ref=ctrl.blog), commit c96cc95a69, 2020-09-03, Ryan Sturm, Chromium project, Google Source, Google
- [Add a feature to limit DSE preconnect to Google only](https://chromium.googlesource.com/chromium/src/+/dbf067617737c452ef78898ae153fe10bf1efe7e?ref=ctrl.blog), commit dbf0676177, 2020-01-25, Ryan Sturm, Chromium project, Google Source, Google
- [RFC 5785: Defining Well-Known Uniform Resource Identifiers (URI)](https://www.rfc-editor.org/rfc/rfc5785.html?ref=ctrl.blog), 2010-04, Internet Engineering Task Force (IETF)
### The perfect cross-platform serif and sans-serif font stacks
URL: https://www.ctrl.blog/entry/font-stack-text/
Last updated: 2026-08-23T22:07:29.000Z
Different web browsers use the same default fonts on the same operating system. However, the default fonts differ between operating systems and few fonts are available everywhere. In this article, I’ll focus on making the default fonts look and behave the same across operating systems.

The default fonts for the generic “serif” and “sans-serif” (without serifs) fonts are metrically compatible across MacOS, iOS, Windows, and Chrome OS. There are good options available for Linux too, but those are rarely set as the default fonts. Android only has one font, so you get what you get.

Metrically compatible means that each individual character in one font has the same width as the same characters in another font. Metrical compatibility means you can substitute one font for another in a document without affecting its layout. For example, a headline and paragraph should fill the same number of lines of text. This isn’t the same as a fixed-width font (monospace), where all the characters in the font have the same width.

We can thank the PostScript printing standard for defining a core set of fonts that everyone had to support. Not every platform includes the exact fonts specified in the standard; because of copyright issues and licensing costs. However, it’s still possible to use these fonts across platforms.

CSS lets you list multiple fonts in an ordered “font stack.” Web browsers will choose the first installed font they recognize from the list. Let’s create a font stack that will look and behave nearly identical across platforms. So, what fonts do we have to work with?

PostScript version 1 required one serif font, Times; and one sans-serif font, Helvetica. These fonts should be available on every operating system. The following table shows the default fonts on most operating systems except Linux. I’ll get back to Linux a little later in the article.

__Default fonts (Latin scripts)__
| Font name | serif           | sans-serif |
| --------- | --------------- | ---------- |
| Windows   | Times New Roman | Arial      |
| Chrome OS | Tinos           | Arimo      |
| MacOS     | Times           | Helvetica  |
| iOS       | Times New Roman | Helvetica  |

Tinos and Times New Roman, as the name suggests, are newer versions of the classic Times font. They improve character legibility over the original and tone down some serif-ornamentation. Arial is a re-interpretation of the classical Helvetica font (under a cheaper license). MacOS also ships with both Arial and Times New Roman.

If you’re willing to sacrifice a little metrical compatibility, you can upgrade the default sans-serif fonts to more modern versions. Mac and iOS also come with Helvetica Neue preinstalled. It addresses some of Helvetica’s legibility issues, e.g. by elongating crossbars and making punctuation marks heavier. Upgrading to Helvetica Neue is probably a better option overall than switching to Arial.

On Windows, you might find a more modern version of Arial called Arial Nova. Arial Nova makes much the same legibility improvements and compromises as Helvetica Neue. It isn’t pre-installed in Windows but is offered for free in the Pan-European Supplemental Fonts package (an optional feature) for Windows and the Microsoft Store app.

You can think of using these fonts as a progressive enhancement to the classics fonts. They improve the reading experience when available, but it’s not a great loss if they’re not. Your layouts may shift ever-so-slightly when using these fonts compared to the originals. You can exclude them from your font stacks if this is a showstopper.

Let’s recap everything I’ve talked about so far into a CSS example:

```css
.headlines, .ui {
  font-family: 'Helvetica Neue',
               'Arial Nova',
                sans-serif;
}
.body-text {
  font-family: serif;
}

```

Note that I didn’t specify either Helvetica or Arial, as these are already the default fonts in the sans-serif group. You’ll get these fonts when the newer fonts aren’t available. This *assumes* that the document is written in a Latin script and is properly labeled as such.

Make sure web browsers know what language your pages are written in when using generic font names! Always specify the document language, e.g. using `<html lang="en">`. All bets are off when it comes to the default fonts for other writing systems.

If you can’t control the document language, then you need to include the names of the desired fonts in your font stack instead. The order matters, so include the default after the progressive enhancement fonts. To discuss another aspect of how operating systems handle fonts; here is the same font stack as above, but including the default fonts.

```css
.headlines, .ui {
  font-family: 'Helvetica Neue',
               'Arial Nova',
                Helvetica,
                Arial,
                sans-serif;
}
.body-text {
  font-family: Times,
              'Times New Roman',
               serif;
}

```

Note that I listed Times in front of Times New Roman. Times New Roman is arguably better than Times. However, the version of Times New Roman that is distributed with MacOS lacks features like common glyph ligatures. Times provides a better experience on Mac. I’ll get back to this later, but Times also yields a better result on Linux.

I still included the generic font names for platforms where these fonts are unavailable. Android only comes preinstalled with one or two system font families. Roboto is a sans-serif included since Android version 4 (released in 2013). It’s still the default sans-serif font today, but on newer devices, you might also find the Noto Serif font. You can at least decide between a serif or sans-serif font. The two fonts are metrically compatible with each other. Roboto is also a near-match to Helvetica.

In the above example, the complexity of this topic skyrockets because of font name substitutions. Windows will recognize the Times and Helvetica font names from the PostScript standard, and substitutes them for Times New Roman and Arial. You can get away with just specifying just Times and Helvetica. (Technically, you don’t need either because of the generic font name — but you get what I mean!)

Chrome OS applies the same trick with the Times New Roman and Helvetica font names. As shown in the above table, iOS also substitutes the Times font for Times New Roman.

You should now know enough to delve into the default fonts on Linux! Linux comes in many flavors, and different distributions come with different default and pre-installed fonts. They’ve all got one thing in common, though: they rely on FontConfig to handle configure their fonts. (Not coincidentally, so does Chrome OS.)

FontConfig has a font name substitution system similar to the one found in Windows. It’s time for two more tables to cover serif and sans-serif font name substitutions.

__Serif font name substitutions (Latin scripts)__
| Distribution                   | serif            | Times            | Times New Roman   |
| ------------------------------ | ---------------- | ---------------- | ----------------- |
| Raspberry Pi OS 21.01          | Liberation Serif | Liberation Serif | Liberation Serif  |
| Ubuntu / Mint / Pop!\_OS 21.04 | DejaVu Serif     | Nimbus Roman     | Liberation Serif  |
| Fedora Linux 34                | DejaVu Serif     | Nimbus Roman     | Liberation Serif  |
| ElementaryOS 5.1               | DejaVu Serif\*   | Tinos            | Tinos             |
| Solus 4.2                      | Clear Sans†      | Nimbus Roman‡    | Liberation Serif‡ |
| EndeavorOS 21.04               | DejaVu Serif     | Nimbus Roman‡    | Liberation Serif  |
| openSUSE 15.3                  | DejaVu Serif     | Nimbus Roman‡    | Liberation Serif‡ |

- ElementaryOS intends to use Tinos for its generic name. It’s a bug that it isn’t working. I’ve sent the project [a patch](https://github.com/elementary/fonts/pull/17/commits/ce37fff34eb39ab4bd529cde7947cbcc902df7e6?ref=ctrl.blog).
- This is a sans-serif font!
- Not installed by default. You get the generic serif font instead.

__Sans-serif font name substitutions (Latin scripts)__
| Distribution                   | sans-serif      | Helvetica       | Arial            |
| ------------------------------ | --------------- | --------------- | ---------------- |
| Raspberry Pi OS 21.01          | Liberation Sans | Liberation Sans | Liberation Sans  |
| Ubuntu / Mint / Pop!\_OS 21.04 | DejaVu Sans     | Nimbus Sans     | Liberation Sans  |
| Fedora Linux 34                | DejaVu Sans     | Nimbus Sans     | Liberation Sans  |
| ElementaryOS 5.1               | Arimo           | Arimo           | Arimo            |
| Solus 4.2                      | Clear Sans      | Nimbus Sans‡    | Liberation Sans‡ |
| EndeavorOS 21.04               | DejaVu Sans     | Nimbus Roman‡   | Liberation Sans  |
| openSUSE 15.3                  | Cantarell       | Nimbus Sans‡    | Liberation Sans‡ |

- Not installed by default. You get the generic serif font instead.

The DejaVu font family isn’t metrically compatible with neither Times nor Helvetica. Fonts like DejaVu Sans and Cantarell more closely resemble the Verdana font. Verdana is a heavier and wider font created for the ultra-low screen resolutions of decades past. Clear Sans closely resembles Arial, but it’s slightly wider and has a lower x-height. It’s a close match, but not metrically compatible.

In summary: the default generic font names on Linux don’t resolve fonts that are metrically compatible with the PostScript fonts. This is why the text on webpages often looks quite different on Linux compared to MacOS and Windows. Raspberry Pi OS and ElementaryOS being the partial exceptions.

You can rely on the generic font names alone like you can on other operating systems. The named font name substitution fonts are, however, a better option. The Nimbus font family provides a Roman variant that is metrically compatible with Times. There’s also a Sans variant drop-in replacement for Helvetica. The same goes for the Liberation font family’s Serif variant for Times New Roman, and a Sans for Helvetica. While the font name substitution is mostly functional on all Linux distributions, the fonts that get swapped in aren’t necessarily installed by default.

There are tons of problems with the font name substitution configuration all across the board on Linux. Solus straight up returns a sans-serif font instead of a serif font. It does the name substitutions but then doesn’t come preinstalled with those fonts. Instead, you get the generic serif font (which is configured to be a sans-serif font!) Users can install the fonts to fix the problem, but they’re likely unaware that they’re missing.

Raspberry Pi OS and ElementaryOS include an older version of the Nimbus font family under slightly different names. Those older names aren’t recognized by the font name substitution system. The Nimbus font family was re-engineered and renamed around 2015\. The old fonts were named Nimbus Sans L and Nimbus Roman No9 L. You could include these in your font stack for increased compatibility with older systems. However, the older fonts weren’t as high quality as their more recent counterparts. Specifically, kerning was sub-par.

The modern version of Nimbus Roman is a better substitute for Times New Roman. It’s visually a much closer match than Liberation Serif. You should include the font name `Nimbus Roman` before `Times New Roman` in your font stack. You can skip this if you already list `Times` before `Times New Roman` (as recommended in this article).

It seems that including the default font names in our font stack is the right way to go. More common font names in your font stack give the font name substitution systems more opportunities to save the day. It also sweeps the internationalization issues discussed above under the rug.

In summary, neither MacOS, iOS, Chrome OS, nor Windows need you to specify the default serif and sans-serif font names. The generic font names are enough. (As long as you specify the document language!) Including them results in better font selection on Linux; even without naming a single font that comes preinstalled with it. You can sacrifice a tiny amount of font metrics stability for improved legibility by using newer versions of fonts.

There you have it: the perfectly safe, boring, and default cross-platform serif and sans-serif font stacks. (I had to abbreviate its full name in the title due to space constraints.)

Thanks for reading. I hope you learned something new! [Follow the blog](https://www.ctrl.blog/follow.html) so you won’t miss the next parts of this mini-series! Up next, I’ll discuss: the cross-platform monospace and coding font stacks.
### Does the web still need HTTP Deflate?
URL: https://www.ctrl.blog/entry/http-deflate-compression/
Last updated: 2026-08-23T22:11:33.000Z
Compressing webpages to make them smaller is crucial to ensure fast webpage load times. Gzip and Brotli are the web’s two most used compression formats. A third contender, HTTP Deflate, has been around as long as Gzip, but it never caught on. Do you still need to support it on your websites and apps? or is it time to retire HTTP Deflate from the web platform?

Every major web browser and all sorts of other tools and apps send an `Accept-Encoding: deflate, gzip` header to every web server they connect to. The request header advertises to the server that the client support the listed compression formats (“encodings.”) Both HTTP Deflate and Gzip have been supported since HTTP version 1.1 back in 1999\. Most modern web browsers also announce support for the newer Brotli (`br`) format.

The Gzip format is much more common than HTTP Deflate, despite their similar history. The 2020 Web Almanac analyzed more than 7,5 million website homepages to study compression trends. If [found](https://almanac.httparchive.org/en/2020/compression?ref=ctrl.blog) that only 0,015 % of servers returned an HTTP Deflate encoded response. Roughly 30 % of responses used Gzip, and about 10 % used the newer Brotli compression format.

It’s unclear if the surveyed sites just preferred HTTP Deflate or if they didn’t support Gzip and Brotli. It’s astonishing that a full 60 % of websites are served uncompressed. (Check. Your. Web server.)

The conclusion is clear: You don’t need to implementing and maintain HTTP Deflate in new software. Your time is much better spent on Gzip and Brotli. Most websites literally fail on the basics here. You can always fall back to sending an uncompressed response to clients that don’t support the other two methods.

Come to think of it, it’s high time that web browsers and web servers deprecated HTTP Deflate. It isn’t a failed technology, but it isn’t relevant anymore either. The format is rarely used and thereby poorly tested on clients and servers alike.

HTTP Deflate is slightly better compared to Gzip. It saves 12-bytes and slightly reduces processor load. It’s not a big difference, though. So, what’s wrong with HTTP Deflate and why did it fall so far behind Gzip?

In this article, I’ve called what the HTTP/1.1 specification refers to as “deflate” for “HTTP Deflate” instead. HTTP Deflate — or Zlib ([RFC 1950](https://www.rfc-editor.org/rfc/rfc1950.html?ref=ctrl.blog)) as the format is really called — and Gzip ([RFC 1952](https://www.rfc-editor.org/rfc/rfc1952.html?ref=ctrl.blog)) are wrappers for the Deflate ([RFC 1951](https://www.rfc-editor.org/rfc/rfc1951.html?ref=ctrl.blog)) compression format. The naming confusion obviously led to incompatible client and server implementations. Gzip is less ambiguous, and thus it became the safer compression format to use.

I can’t speak for the server-side of things, and I don’t know whether they return Zlib or “raw” Deflate. Web browsers, many HTTP libraries, and other client software have format detection logic. This lets them decompress either format variations using only a small computational overhead. However, it’s not worth the extra work.

The HTTP Deflate bubble burst over a decade ago, and Gzip won the Deflate-wrapper format war. It’s way past time to remove HTTP Deflate support from the web platform.

**Update** (2022-06-21): I just learned that WebPositive, the web browser in [Haiku OS](https://www.haiku-os.org/?ref=ctrl.blog), stopped announcing support for Deflate in August 2014. It’ll still attempt to decode Deflate responses, however. It’s the first (and only) web browser to drop Deflate.

#### Sources

- [Compression](https://almanac.httparchive.org/en/2020/compression?ref=ctrl.blog), 2021-05-05, Web Almanac 2020, HTTP Archive
- [Don’t advertise deflate compression support](https://git.haiku-os.org/haiku/commit/?id=bcd6a67bc063e0ec4fd4506f7d573d24cac8fb06&ref=ctrl.blog), commit bcd6a67bc0, 2014-08-04, Adrien Destugues, Main Code Repository, Haiku
- [Lose the Wait: HTTP Compression](https://zoompf.com/blog/2012/02/lose-the-wait-http-compression/?ref=ctrl.blog), 2012-02-10, Billy Hoffman, Web Performance Blog, Rigor
- [Frequently Asked Questions](https://www.zlib.net/zlib%5Ffaq.html?ref=ctrl.blog), 2010-03-14, Zlib
- [RFC 1950: ZLIB Compressed Data Format Specification](https://www.rfc-editor.org/rfc/rfc1950.html?ref=ctrl.blog), version 3.3, 1996-05, Network Working Group, Internet Engineering Task Force (IETF)
- [RFC 1951: DEFLATE Compressed Data Format Specification](https://www.rfc-editor.org/rfc/rfc1951.html?ref=ctrl.blog), version 1.3, 1996-05, Network Working Group, Internet Engineering Task Force (IETF)
- [RFC 1952: GZIP file format specification](https://www.rfc-editor.org/rfc/rfc1952.html?ref=ctrl.blog), version 4.3, 1996-05, Network Working Group, Internet Engineering Task Force (IETF)
### Review of Logitech K835 ten­key­less mechanical key­board
URL: https://www.ctrl.blog/entry/review-logitech-k835-tkl/
Last updated: 2026-08-23T22:19:12.000Z
Logitech has set out to prove that mechanical keyboards aren’t just for gamers with too much disposable income and an unhealthy obsession for blinking lights! The Logitech K835 is a tenkeyless (TKL, meaning a regularly sized keyboard without the numpad) mechanical budget keyboard. It has an open-body design built on an aluminum plate on a plastic shell featuring either TTC tactile (“blue”) or TTC linear (“red”) key switches.

The K835 is the tenkeyless equivalent of the K845 (but without the backlighting), even though it may more closely resemble the K840 at first glance. If you want a programmable and colorful display of back- or keycap lights, then the K835 isn’t for you. A gaming-quality keyboard without the stereotypical *gaming* light-show may be the better option if your computer is in a bedroom. It also makes the keyboard look more business professional.

The lack of keyboard lights sets the model apart from Logitech’s other G (gaming) branded — and more expensive — mechanical keyboard options. In practice, this may make a difference if you haven’t memorized key positions and constantly glance down at them while in a dimly lit room. That’s terrible for your typing speed and eyesight, so you shouldn’t do that anyway. At only 69 Euro (84 USD), it’s less than half the price of an equivalent Logitech gaming keyboard.

So, other than a light show, what do you lose out of compared to Logitech’s more expensive mechanical keyboards? Not much, as it turns out. Most keyboards operate with a pulling rate of 100 Hz (10 ms latency), with the more expensive ones at 1000 Hz (1 ms). The K835 is a USB2 full-speed input device with a polling rate of 250 Hz (4 ms latency). This is perfectly reasonable given the build quality and price. It’s not like you’ll notice it or care about the difference unless you’re entering a million-dollar tournament.

Functionality-wise, the K835 has the same multimedia keys and feature set. The key-caps are a standard thin single-mold with pad-printed labels. Every product photo on the Logitech website carefully hides the pad-printing outlines. Logitech has saved more than a buck avoiding the more expensive double-shot injection molding process required to let light through the keys. Luckily for you, Logitech passed the savings on to you!

The keycaps are regular Cherry MX-compatibles instead of the Logitech Romer-G keycaps that Logitech uses on many of its gaming keyboards. In other words, you can easily source replacement keycaps if you want something that looks different or if a key breaks or its print wear off.

The K835 has a Windows key lock option, a feature typically only found on more gaming-oriented keyboards. You can find it by pressing Function + F12. The F12 key features an icon that is supposed to look like a locked keypad with the Windows icon . Although, it looks more like a shopping bag with the Microsoft logo (the Microsoft Store icon). 

This is the only place where the K835’s cheapness compromises its usability, though. The Windows key lock is typically indicated by disabling the Windows key’s back- or key-cap light. But the K835 just doesn’t have key back-lighting! So, you press the Windows key — and you must remember to turn off the Windows key lock if the Start menu doesn’t open. Logitech could have solved this by adding an extra status light next to the scroll lock and caps lock status lights.

The G-branded keyboards tend to have a powered USB port at the back of the keyboard, but you don’t get this with the K835\. You do get keyboard feet that can raise the default 4˚ angle to 8˚, however.

The K835 is available with off-white or black keycaps and with either tactile (blue) or linear (red) key switches. That's not the whole truth, though. Availability seems to be limited by market, with most regional keyboard layout variants only being available in one color or with one type of switch.

At the time of writing, the Logitech K835 is only available in the following countries and regional keyboard layouts: France, Germany and Austria, Norway; Denmark; Sweden; and Finland, Brazil, Mexico, China, Japan, and South Korea. I’ve asked Logitech about U.S. and U.K. availability, but I didn’t get a response. As mentioned earlier in the review, you can easily source compatible after-market keycaps for the K835 for your keyboard layout. Assuming it has the same number of keys, of course.

Mechanical keyboards are notoriously difficult to keep clean. However, the K835’s open-board design makes it easy to clean with a brush or compressed air. The design compromises a bit on the sound dampening you typically get with a more traditional enclosed design. The K835 doesn’t come with any sound-dampening material in its chassis. If you want a more quiet keyboard, then you can [install sound insulating foam and lubricate the key switches](https://www.youtube.com/watch?v=Uu4yoUx26IM&t=103s&ref=ctrl.blog) (video) in about 20 minutes.

TKL keyboards are ideal for people with regular or narrow shoulders or little available desk space. Check my [keyboard size guide](https://www.ctrl.blog/entry/keyboard-form-factor-guide/) to help you pick the most ergonomic keyboard size for your physique.

Mechanical keyboards are expensive and the tenkeyless form-factor doubly so (even though it contains less material to manufacturer). I was surprised to find a mechanical tenkeyless keyboard from a major brand for less than 110 Euro (100 USD). I almost scratch at the Logi branding to see if there was another brand name underneath. You could do a whole lot worse for your money, and doubling your purchase price won’t give you double the quality. The money you save would be put towards other components of your gaming station, anyway.

The Logitech K835 TKL is a solid option for casual gaming and everyday use. It only comes with a one-year warranty (region-dependent) compared to the typical two-year warranty on Logitech gaming keyboards. The build quality feels solid, and I believe it’s likely to last at least a couple of years. You get a lot of value for your money with only a few compromises.

**Reviewed:** K835 TKL Mechanical

**Review rating:** 6 / 10
### The best method for embedding dark-mode friendly SVG in HTML
URL: https://www.ctrl.blog/entry/svg-embed-dark-mode/
Last updated: 2026-08-23T22:22:45.000Z
In this article, you’ll learn about the different methods for embedding Scalable Vector Graphic (SVG) images onto webpages. I’ll discuss which methods support the various security and processing modes in SVG, which methods support dark mode using `@media` queries, and which are the most caching friendly. I’ll also touch on why the most backward-compatible embedding method is the worst for perceived performance and has the most accessibility bugs.

SVG images have many benefits over other image formats. The file sizes can be tiny, they can be dynamic and interactive, and they can scale and adapt to fit any canvas size or application. However, web browser support for the format is incomplete, which further complicates SVG on the web.

Let’s start with a quick refresher on the two SVG processing modes relevant to the web. Secure animated processing mode (SAPM) is the most-used and also the least feature-rich. As the name suggests, SAPM is a security-tightened subset of the SVG standard. It supports both native SVG- and CSS keyframe animations. It doesn’t support script execution, responding to interactions like clicks, nor remote loading of assets like fonts or other images. If you need any of these features, you need the dynamic interactive processing mode (DIPM).

SVG images are processed in SAPM when embedded in webpages via the `img` element, or CSS `background-image` style declarations; or in SVG images via the `image` element. SVG images are processed as DIPM when embedded via the `iframe`, `object`, or `svg` elements, or in SVG images via the `use` element.

The `use` element is restricted to only load assets from the same origin. It has other restrictions too, but I’ll get back to those later in the article.

You can’t change the processing mode of an element; which mode you require dictates what method you use to embed an SVG on a webpage. (Strictly speaking, you can add restrictions on SVG images loaded in `iframe` elements with the `sandbox` attribute. However, browser support isn’t great.)

Let’s create a simple dark-mode capable SVG image with no fancy features. The following example simply creates a white canvas in default/light mode, or a black canvas in dark mode.

```xml
<svg xmlns="http://www.w3.org/2000/svg">
  <defs>
    <style>
      svg {
        background-color: white;
        color-scheme:light dark;
      }
      @media (prefers-color-scheme:dark) {
        svg {
          background-color: black;
        }
      }
    </style>
  </defs>
</svg>
```

As you can see, SVG uses the same CSS and `@media` queries as you’d use in HTML to enable dark mode. If you didn’t already know, you can use CSS to modify presentational attributes in SVG images such as `fill` and `stroke-width`.

The above image doesn’t need any external assets or interactivity, so we can load it in SAPM via an `img` element. The image doesn’t specify a size (it’s an infinite canvas), so we set the image dimensions in HTML instead. It’s considered best practice to do this anyway as it reduces unwanted layout shifts.

```html
<img src="example.svg"
     height="100"
     width="200">
```

The SVG image will now respond to color preference scheme changes independently of the webpage that embeds it. You should make sure to test your images to make sure they work in your dark and light mode designs, and independently of the rest of the page. You can be sneaky with strokes matching the background color to ensure key graphics remain distinctly visible against different background colors. Or you can explicitly set the SVGs background color as shown above.

The above holds especially true for “dark-mode SVG favicons.” There are dozens of web browsers out there and they’ll use favicons against light, gray, and dark backgrounds regardless of the device’s color scheme preference. Make sure your icons have an outline, so they’ll work against any background!

This method of embedding SVG images will work in most web browsers going back a decade. It works flawlessly in recent versions of Firefox. However, other browsers may struggle when it comes to processing `@media` queries in an embedded image.

It mostly works in Chromium. However, it has a known bug ([issue #1093736](https://bugs.chromium.org/p/chromium/issues/detail?id=1093736&ref=ctrl.blog)) where it doesn’t redraw image buffers when `@media` queries change. It will work most of the time, but it won’t respond if the color preference changes, e.g. on a daylight timer. You can work around this bug by forcing your SVG images to redraw when the preferred color scheme changes. (Help yourself to my [example JavaScript implementation](https://cdn.synaps.media/control/content/files/2026/08/2021-06-11%5Fredraw-svg-on-color-scheme-changes.js?ref=ctrl.blog).)

Chromium doesn’t evaluate the `media` attribute of `style` elements in SVGs rendered in SAPM. You must use `@media` queries inside a `style` element instead of applying a `media` attribute directly on the element.

Unfortunately, Safari doesn’t support `@media` queries or `<style media>` in its image buffers ([issue #199134](https://bugs.webkit.org/show%5Fbug.cgi?id=199134&ref=ctrl.blog)). (It supports a few queries, but `prefers-color-scheme` isn’t one of them.) There are no workarounds to get this working in Safari.

However, even without support in Safari — this method is still the preferred way to embed SVG images in HTML. It works well with the browser cache and the processing and animations are well-optimized in all modern browsers. You should think of dark-mode support in images as a progressive enhancement. As mentioned before, you should ensure your transparent SVG images work against different background colors or explicitly give them a background color.

There are a few alternatives to consider if you absolutely need to support Safari. This is where the neat and easy part of the article ends. From here on out; there be dragons. You’ve been warned.

You can use the `iframe` and `object` elements to load SVG images in an HTML document. Using an `object` element is the best-supported method when considering ancient web browsers. These elements create descendant documents/browsing context that load your SVG in DIPM. SVG images loaded as descendant documents work well with the browser disk cache, but don’t work with the memory history cache (back/forward navigation cache). Perceived image loading performance will tank compared to loading the same image via the better optimized `img` element.

There’s also a minefield of accessibility issues related to SVG in descendant documents. I’ll illustrate the scope of the problems by trying to get the browser to treat an SVG in a descendant document as a non-interactive image.

A descendant browsing context can receive keyboard focus, e.g. using Tab navigation. In some browsers, you need to press the Escape key repeatedly, or another shortcut sequence to regain keyboard focus to the top-level document. This behavior is unexpected when the descendent document doesn’t have any interactive elements and you find yourself stuck inside a seemingly empty document. 

Getting out can be difficult, so let us try to prevent the element from receiving focus in the first place. I’ll note here that this is actually an impossible task. To make any HTML element unfocusable, it must either be disabled or made inert. The HTML specification doesn’t provide any way to achieve this for neither `iframe` nor `object` elements. But let’s not make *spec-wise impossible* the enemy of attempting!

The following example code has several interesting properties: It tells accessibility tools that it’s an image and lies to them and pretends it has been disabled, even though it hasn’t. It also tells the browser to remove it from the Tab navigation order, although everything from accessibility tools to spatial navigation on TVs *may* ignore it. Lastly, it suppresses pointer-events — such as clicks — enabling its parent link element to receive them instead. 

```html
<a href="#">
  <object
    aria-disabled="true"
    data="example.svg"
    role="img"
    style="pointer-events:none"
    tabindex="-1"
    type="image/svg+xml">
  </object>
</a>
```

That’s quite a lot of attributes just to try to convince browsers and assistive tools that a descendant document is an image. You’re needlessly “[reinventing the hyperlink](https://web.archive.org/web/20140804221215/https://heydonworks.com/article/reinventing-the-hyperlink/).”

Despite all of the good intentions and virtue-signaling in the above example, I’m sure you won’t need much time to find ways to move focus into the descendant document. The only way to properly handle this is to embed a script in your SVG image that responds to receiving focus by moving it back to the parent document.

As mentioned at the start of the article, the `object` element processes SVG images in DIPM. It’s overkill for simple self-contained and non-interactive images. Especially considering all its potential accessibility problems. It’s difficult to get interactivity and especially keyboard navigation to work right in a descendant document. When you suppress keyboard and pointer events, you also lose out on some of the format’s benefits; like text selection and interactivity.

Chromium gets confused when you switching between light and dark mode with an `object`. It automatically redraws the SVG in the `object`, but it loses transparent backgrounds in favor of the default white (light mode) or black background colors (dark mode). You can work around this issue in the same way as discussed for the `img` element earlier in the article. However, this time it will have a noticeable performance impact even for trivial images on modern devices.

Using the `object` element for SVG is unadvisable unless you require support with ancient web browsers. It may, however, be the best option if you’re working with a large-file-size SVG image with dynamic interactivity and need it to be cacheable in the browser. Expect to keep your hands busy with extensive browser and accessibility testing, though!

In HTML5 and XHTML, you have the option of including SVG images inline in your documents. It’s supported in all leading browsers from the last decade, and SVG support will be identical to other methods of embedding SVG.

Be warned, your inline SVG documents may inherit CSS from the main document. This can be both a blessing and a curse. The following example code shows a document with a blue circle that turns green in dark mode. The `circle`’s `fill` color cascades from the document root element’s `color` style declaration.

```html
<html>
  <head>
    <style>
      html {
        background-color: white;
        color-scheme:light dark;
        color: green;
      }
      circle {
        fill: currentColor;
      }
    </style>
    <style media="(prefers-color-scheme:dark)">
      html {
        background-color: black;
        color: blue;
      }
    </style>
  </head>
  <body>
    <svg
      role="img"
      height="100"
      width="150"
      xmlns="http://www.w3.org/2000/svg">
      <circle r="45" cy="50" cx="75" />
    </svg>
  </body>
</html>
```

Inline SVG images can’t be cached, so you need to re-download them for every page on your website. Inlining isn’t suitable for large file-size images, or common assets like logos and icons; unless you’re working with a single-page webapp.

You should always specify either `role=img` (static or animation) or `role=application` (interactive) when embedding an SVG image into a webpage. The attribute helps screen readers and assistive tools make better decisions about whether they should try to interact with the image, or bypass it entirely. You can use ARIA attributes to further describe the elements of your interactive SVG images.

Inline SVG images are processed in DIPM; meaning you can load external assets, execute scripts, and really flex SVG’s muscles. Hm. Load external assets in an SVG, you say? How about loading an SVG image inside an SVG image? This could fix the inline SVG cacheability issue. Let’s explore that option.

You’ve got four options for loading images from within an SVG. I’ll ignore scripting, the CSS `background-image` style declaration, and the `image` element (equivalent to the `img` element in HTML). You can use those things in HTML without involving SVG. This leaves the SVG `use` (re-use) element.

The SVG `use` element is a hugely complex topic all on its own. It intersects the DOM specification, HTML specification, and SVG specification in many different areas with vaguely specified outcomes. The result is quite different behavior between the different browsers. To make things more fun, its behavior in SVG version 2 (SVG2) diverged significantly from earlier versions.

The below example loads the `#svg` fragment (e.g. `<svg id="svg"/>`) from the external image file `example.svg`. You must specify a fragment; which can be the entire document, a group, or a specific shape. SVG2 assumes you mean the entire document if you omit the fragment, but no browser supports this — or much else of SVG2 — at the time of writing.

The image is loaded with the legacy `xlink:href` attribute and the SVG2 native `href` attribute. The latter is one of the few features from SVG2 that has been implemented in all modern browsers. Your browser will only use one of these attributes, so you can include both to ensure browser compatibility going back over a decade. (This tip also applies to the `image` element.) Lastly, it positions the loaded image in the top left corner of the parent SVG element’s canvas.

```html
<html>
  <body>
    <svg
      role="img"
      height="100"
      width="200"
      xmlns:xlink="http://www.w3.org/1999/xlink">
      <use
        href="example.svg#svg"
        xlink:href="example.svg#svg"
        x="0"
        y="0"/>
    </svg>
  </body>
</html>
```

The overall principle works fine in all modern browsers. However, it won’t behave as you expect (unless you’re a SVG specification author). In SVG2, this should have cloned the entire external image including its style and everything. In SVG < 2, you only clone graphical shapes.

In Firefox, you can load a complete SVG image in DIPM. It follows the SVG2 specification since version 70\. SVG2 also specifies that stylesheet rules external to the `use` element shouldn’t cascade into it, However, Firefox ignores this part of the SVG2 (and shadow DOM) specifications and lets stylesheets in the HTML document style the SVG descendants inside the re-used external SVG image.

Chromium and Safari process the same image in SAPM. The browsers strip away any invisible element — such as `animate`, `base`, `defs`, `linearGradient`, `style`, and `script` — from the re-used SVG image. It retains inline CSS style and presentation attributes set directly on the shapes, though. This behavior conforms with the SVG < 2 specification.

Furthermore, Chromium and Safari resolve any relative links in the external SVG relative to the current document’s base location instead of relative to the image’s location. This conforms to the shadow DOM specification, but not the SVG specification. You also can’t change the base location using either the `xml:base` attribute or the `base` element. This link resolution is the exact opposite behavior of Firefox, which again follows SVG2.

SVG2 seems to be way more useful in this particular area than older versions of the specification. It’s certainly more predictable, as the image behaves the same wether loaded separately or embedded into different webpages.

Firefox treats the SVG `use` element like a slightly more powerful version of the HTML `object` element. Sans some of the security restrictions, and with different accessibility needs. The `use` element doesn’t have any glaring accessibility issues like the `object` element. However, make sure to specify its `<svg role/>` attribute.

In summary, the results with the `use` element will vary considerably unless you only it for simple shapes. Thorough browser compatibility testing will be required in any case. If you want to re-use your image assets in SVG images, then your best option is to embed it into your HTML document and load the shared assets via the simpler `image` element instead.

I’ve put together a quick [test case](https://cdn.synaps.media/control/content/files/2026/08/svg-embed-tests.html?ref=ctrl.blog) you can use to test the different modes discussed in this article in different web browsers. It doesn’t include any workarounds to disguise the browser bugs discussed in this article. (It sure will highlight them, though.) You may get different results depending on whether you reload the page after switching between light/default and dark mode.

Make sure to test your website and SVG images in the Samsung Internet browser on Android. It doesn’t support `@media (prefers-color-scheme:dark)` like every other modern web browser. Instead, it applies [its own weird color-darkening](https://www.ctrl.blog/entry/samsung-internet-night-mode/) scheme. For whatever reason, its results with SVG images are often shoddy. The results may be ugly, but make sure your designs remain legible and maintain good contrast.

Lastly, I’d just like to mention that not all stand-alone SVG libraries understand `@media` queries. Processing may differ based on the hosting device’s color scheme preference. Others will apply style declarations from `@media` queries they don’t support, e.g. [rsvg](https://gitlab.gnome.org/GNOME/librsvg/-/issues/752?ref=ctrl.blog).

#### Sources

- [User interaction](https://html.spec.whatwg.org/multipage/interaction.html?ref=ctrl.blog), 2021-05-31, HTML Living Standard, WHATWG
- [prefers-color-scheme not adhered to for referenced SVG in <img>](https://bugs.chromium.org/p/chromium/issues/detail?id=1093736&ref=ctrl.blog), issue #1093736, 2020-07-11, Issue tracker, Chromium project, Google
- [SVG images don’t support prefers-color-scheme adjustments when embedded in a page](https://bugs.webkit.org/show%5Fbug.cgi?id=199134&ref=ctrl.blog), bug #199134, 2019-06-24, Bug Tracker, WebKit
- [Conformance Criteria](https://www.w3.org/TR/2018/CR-SVG2-20181004/conform.html?ref=ctrl.blog), 2018-10-04, SVG2, Recommendation, World Wide Web Consortium (W3C)
- [Document Structure](https://www.w3.org/TR/2018/CR-SVG2-20181004/struct.html?ref=ctrl.blog), 2018-10-04, SVG2, Recommendation, W3C
- [Accessible Rich Internet Applications](https://www.w3.org/TR/2017/REC-wai-aria-1.1-20171214/?ref=ctrl.blog), version 1.1, 2017-12-14, Recommendation, W3C
### A deeper dive into Chrome WebFeed
URL: https://www.ctrl.blog/entry/chrome-follow-feeds/
Last updated: 2026-08-23T22:03:12.000Z
You should first read about the article [Chrome experiment to let you Follow websites](https://www.ctrl.blog/entry/chrome-follow-websites/) before you keep reading this one. This article goes deeper into the technical details of how Chrome WebFeed works.

Chrome detects all Atom and RSS feeds on webpages using the feed auto-discovery mechanism. Here’s a quick refresher if you’re unfamiliar or have forgotten it in the last decade:

```html
<link rel="alternate"
      type="application/atom+xml"
<!--  or type="application/rss+xml" -->
      href="/news-feed.atom">
```

When any feeds are detected on a page, Chrome sends the feed addresses and page address to a Google server. This server then tells Chrome which of the feeds Google recommends and whether that feed is actively updated. Chrome uses this information to decide on whether to prompt the user to follow the website.

Chrome also receives the site’s name for use in user interfaces related to feed management from Google’s servers. It uses the site’s domain name as a fallback. Chrome will also try to detect the largest icon from the page (`<link rel="icon" […]>`) instead of using icons specified in the feed. Chrome never actually downloads the feed locally.

The client-side implementation is open-source and available to other Chromium-based web browsers such as Brave, Microsoft Edge, and Vivaldi. However, don’t expect any of the other browsers to introduce a feed aggregator in a future release. They’d have to invest in and reimplement the server-side component that makes WebFeed work. Brave and Edge already have their own news feed systems and are unlikely to build on Chrome’s implementation. Brave is notably working on support for adding custom syndication feeds, but it requires manual entry of feed addresses (with all the usability issues that entail).

Web authors and content management systems — including the ever-popular WordPress — often publish two identical syndication feeds. These feeds represent the same updates in the newer Atom and the legacy RSS formats. As Nick Bradbury put it to web authors over a decade ago: [“Pick a Format (Any Format)”](https://nickbradbury.com/2006/05/25/pick%5Fa%5Fformat%5Fa/?ref=ctrl.blog). Most feed aggregators support both formats (and more to boot), so it doesn’t matter which one you pick.

Websites also frequently publish multiple feeds, e.g. one per category or author, which can confuse things further. Chrome solves the multi-feed problem by letting Google’s servers decide which feed to follow based on its knowledge of the website.

The current implementation restricts websites to one feed per domain. For example, individual topic pages here on Ctrl blog use the feed auto-discovery mechanism to point to a topic-specific feed. Google’s servers currently always return the main/everything feed for the whole site even though it’s not even included on the topic pages. This may change in the future, however. I find it likely that Chrome will want to enable people to only subscribe to the Sports section of their favorite newspaper, for example. Chrome needs to find a better solution for this to tackle social media websites with multiple feeds and creators. The current user experience on sites like YouTube, Twitter, and Facebook is underwhelming and confusing.

Feeds commonly [include tracking parameters](https://www.ctrl.blog/entry/wordpress-feed-utm-plugin/) in their links to help the websites measure the popularity of their feeds. Google’s FeedBurner service was built to serve that tracking need. Instead of presenting the link in the feeds, Chrome replaces it with a canonicalized links. It also sets the HTTP Referer (sic) request header to `https://www.google.com/`. Clicks from WebFeed are indistinguishable from clicks from Google Discover and Search. Websites can still track their clicks and impressions under the Discovery Performance tab in the Google Search Console.

Google announced last month that it would blow [new life into FeedBurner](https://www.ctrl.blog/entry/feedburner-2021/) after ignoring the service for over a decade. Chrome’s renewed interest in the technology is likely why Google rediscovered it owned one of the web’s largest feed service providers. FeedBurner’s existing click-through and impression tracking will presumably be augmented with data from Google Search Console in the future.

Chrome doesn’t act like a traditional feed aggregator. Your feed subscriptions are processed on Google’s servers, and Chrome just gets a sanitized presentation of your feeds. There’s nothing wrong with this architecture per se, but Google remains in control of your feed. Google prioritizes the order of items that appear in your aggregate feed. The aggregated news feed is — for the most part — sorted chronologically. However, Google does move some things around to ensure that one chatty feed doesn’t dominate your aggregate feed.

There isn’t much you can do to optimize your syndication feeds to work with Chrome WebFeed. Your feed must meet the format requirements for your chosen feed format. Each feed entry must contain a link, title, and the date it was published or updated. **Google only uses the feed to detect when you publish new content on your website.**

There’s one small optimization you can deploy, however. You can make your feeds update faster for Chrome users by building in support for [WebSub](https://www.w3.org/TR/websub/?ref=ctrl.blog). WebSub is an open standard that turns syndication feeds from a pull to a push media.

Google will pull images, titles, and the lead paragraph or description from your webpages. Make sure to mark up your pages with semantic HTML and use structured metadata. Proper semantics will help Googlebot understand your pages and help make sure they’ll appear in Chrome WebFeed. Any type of webpage is eligible for inclusion, it’s not just for news articles and videos.
### Chrome experiment lets you Follow news and website updates
URL: https://www.ctrl.blog/entry/chrome-follow-websites/
Last updated: 2026-08-23T22:03:15.000Z
Google is experimenting with a new way to undercut the value of its fiercest “attention competitors” (Twitter and Facebook). It’s also helping web publishers and the open web ecosystem at the same time. Here’s a brief history of the technology behind Chrome’s new Follow feature, and how it’s better than earlier attempts at building feeds into web browsers.

Google has [announced](https://blog.chromium.org/2021/05/an-experiment-in-helping-users-and-web.html?ref=ctrl.blog) it’s experimenting with integrating syndication feeds ("RSS") into its Chrome web browser. The experiments are currently restricted to early-preview releases of Chrome on Android devices configured for U.S. English. The technology media jumped on the news and many [called it a Google Reader reboot](https://arstechnica.com/gadgets/2021/05/chromes-rss-powered-follow-button-is-like-a-rebooted-google-reader/?ref=ctrl.blog). Google Reader was a powerful news aggregation tool beloved by power-users; who’ll never forgive Google for discontinuing it in 2013\. Chrome’s latest experiment is nothing like Reader; it’s something else entirely. —and it’s much more likely to succeed!

A decade ago, both Apple and Microsoft built syndication feed subsystems into their operating systems. These subsystems were responsible for managing and updating feed subscriptions in the background. Apple has since removed its feed system, but Microsoft’s is still maintained and is even supported in Universal Windows Apps (UWA). Most web browsers — even the boring ones like Microsoft Internet Explorer and Apple Safari — also had some support for syndication feeds. The browser could act as a news aggregator that pulled in news from the user’s subscription list.

Everyone expected feeds to be the next big thing for the web, but then it wasn’t and it has faded into obscurity. The user experiences were underwhelming and the features were relegated to seldom-visited corners of the browser. Sure, there were plenty of better feed readers out there — but no one knew about them. Syndication feeds also aren’t bandwidth efficient (it’s [a whole thing](https://www.ctrl.blog/entry/feed-caching/)) and was a poor fit for mobile devices.

The real problem was that no one found a way to get average users to adopt syndication feeds. Every website worth its salt would prominently feature one or more huge orange feed buttons (

![the universal feed icon](https://cdn.synaps.media/control/content/images/2026/08/feed.svg)

) and calls to “subscribe” to \[it\]. The buttons linked to confusing machine-readable feed documents that didn’t do anything by themselves. Feed files are confusing and the word “subscribe” often implies payments. The average user quickly learned to ignore the weird orange buttons and calls to “subscribe to updates!”

Skip forward a few years and web browsers embraced a new standard for push notifications. Half the website you visited would immediately prompt to send you a constant stream of pop-up notifications. It got so pervasive that all modern web browsers have stopped asking if you want push notifications; no one wants in-your-face notifications for news. This brings us back to today and what Chrome is experimenting with now.

Contrary to what’s been reported in the tech media, Chrome isn’t embracing syndication feeds. You can’t click on an orange button or open a feed file in the browser to follow a feed. That part of the experience is left for dead. Many websites also publish feeds for specific topics or events, but you can’t use these in Chrome. You’re instead restricted to following the website’s main/everything feed.

Chrome will automatically prompt users if they want to follow a particular website. The current implementation (subject to change) prompts you to follow a website after five visits over three days. The prompt is shown as a snackbar (a temporary toolbar at the bottom of the screen) when visiting the website. Chrome won’t prompt you more than once every 15 minutes. You can also actively choose to follow the current website from the Chrome menu (a.k.a. the “Hamburger menu.”)

This isn’t far removed from what the Sleipnir browser shipped more than half a decade ago. Sleipnir just skips the part about prompting you and [automatically follows your most frequently visited websites](https://www.ctrl.blog/entry/sleipnir-site-updates/). I’d be very surprised if Chrome doesn’t also move in this direction after an initial run of manual curation.

The Follow button in the Chrome menu also shows up when viewing Twitter profiles, Twitch streams, YouTube channels, and other places where you might already be familiar with the concept of following creators. Chrome’s feature will follow the website — whatever that means — and not the individual creators, though. This will probably be a source of confusion for users of many services who’ll struggle to make sense of the different follow buttons and prompts.

Hopefully, Google will add some better APIs for websites to help control the experience. Not that the existing feed auto-discovery mechanism doesn’t get the job done, however. Maybe Chrome should just work on improving how it handles the feeds it discovers instead.

News published by followed websites appears in a mostly chronological list on the New Tab Page (NTP). News updates from followed websites are presented the same way as the existing Google Discover feed. The big difference is that the Following feed — as Google calls it — is curated by you and not a Google algorithm. You chose which websites to follow and you get to make the editorial decisions for your own Following feed. Google is undoubtedly collecting data from how you interact with feeds and the news items they publish to improve its Discovery feed.

Assuming Google ships this in a future version of Chrome, this can seriously upset the online news media landscape in many ways. Google Discover is already [a news destination that competes directly with newspaper front pages](https://www.ctrl.blog/entry/news-destination-tax/). Chrome’s WebFeed feature, as it’s called internally, might be the final nail in the coffin for regular visits to the front page of your favorite websites.

Google is helping the open web, while also helping creators and publishers be less reliant on pushing their audiences to follow them on social media platforms and via email newsletters. Chrome’s Follow feature gets the latest updates from your website directly to your readers when they’ve got the time to look at it. Why pester visitors with ineffective newsletter sign-up pop-over pests when the browser can do a better job? Why bother with maintaining a presence on Twitter and Facebook when it’s easier to get into your readers’ Chrome feeds?

Google isn’t adding this feature out of the goodness of its cold corporate heart, though. The user-curated feed can help Google avoid unwanted scrutiny from regulators. It can insulate it somewhat from complaints about “unfair algorithms” and claims of borrowing news from news outlets with certain political views or a different grasp on reality.

It’ll also make the Chrome browser a “stickier” product. You can’t follow websites in Firefox or migrate your subscription lists to a competing service, so why make the switch? This last point may cause Google problems with EU regulators, however. The General Data Protection Regulation (GDPR) requires data to be portable. This [isn’t the first time](https://www.ctrl.blog/entry/google-podcasts-data-portability/) Google launches a new service built on syndication feeds without a way to export your data.

I can already tell from my analytics that there has been renewed interest in [syndication feeds](https://www.ctrl.blog/tag/syndication-feeds/). That might be an early indication that web authors are shoring up their feeds in eager anticipating of more readers from the Chrome WebFeed. I’m cautiously optimistic and believe that WebFeed has a strong chance of catching on among users. Syndication feeds have always been a powerful tool, but no one has yet managed to make it work for the masses. The follow-any-website scheme in Chrome might just do the trick, though.
### Fixing the News Media and Digital Platform Bargaining Code
URL: https://www.ctrl.blog/entry/news-destination-tax/
Last updated: 2026-08-23T22:14:48.000Z
The [News Media and Digital Platforms Mandatory Bargaining Code](https://parlinfo.aph.gov.au/parlInfo/download/legislation/bills/r6652%5Faspassed/toc%5Fpdf/20177b01.pdf?ref=ctrl.blog) (NMDPMBC) of Australia made headlines earlier this year. The Australian government’s new legislation hopes to “\[address\] bargaining power imbalances between digital platforms and \[news businesses.\]” It does this by imposing that all digital platforms must pay news organizations for any use of its news products. Including but not limited to merely linking to news.

The Australian legislation has been widely criticized for being “a link tax.” The legislation requires digital platform services to pay for “making available” any portion of news produced by a news organization. It vaguely defines “making content available” as either reproducing something it in full, part, or even just linking to it in any form. The legislation explicitly doesn’t limit itself to any particular use or presentation of the news. A link on a contextual search result page is treated no differently from a link on a news aggregation service.

The underlying issue is that it’s not entirely clear what the legislation is intended to do. It’s difficult to read it as anything but a method of wealth transfer from — mostly foreign — technology companies to Australian news businesses. This may sound unreasonable — because it is. However, keep in mind that tech platforms incorporate and profit from works produced by news businesses.

Services like Google News, Google Discover, and the New-Tab-Page (NTP) in Google Chrome feature imagery, titles, and excerpts produced by news businesses. Google isn’t alone in this. Almost every modern web browser now features news on their NTP. Large aspects of social media platforms like Twitter and Facebook are built around news curation. News is an essential part of the experience, yet the technology vendors don’t pay to reproduce it. They argue that they’re driving exposure and traffic to the news organizations; which they’re undoubtedly doing.

However, the reason why tech platforms feature news in their products is that it’s sticky and habit-building. People stop going to the front pages of their favorite newspapers and instead rely on apps and news aggregators to provide their daily news fix. The trouble is that news organizations spend enormous sums of money to produce the news. Tech companies can source and curate news from thousands of sources and objectively create a better product than any one news organization can provide. Throw in big tech’s click-stream tracking, interest graphs, and personalization and individual news organization don’t stand a chance.

This is a shift in consumer behavior more than anything. News organizations are losing their valuable sometimes-multiple-times-a-day reoccurring visitors. A personalized news stream may be a tool to help pop the “filter bubble” as much as it can be a tool to create it. It’s probably beneficial for the individual news consumer to see news from multiple sources and perspectives.

The aforementioned imbalance in power comes from the power wielded by these services. News organizations can theoretically opt-out of inclusion in digital platforms that aggregate news. Opting out means they’ll lose any potential exposure and traffic to rival news organizations that paraphrase or source from their original reporting. Readers also wants to read news in their preferred apps and platforms. News organizations has grudgingly opted for the broadest possible distribution to satisfy their readers.

The scope of the NMDPMBC is way too broad. Its definition covers services like the ones mentioned above. However, it’s so broadly focused it even covers links that are part of a 2000-word essay posted on users’ WordPress.com- or Google Blogger-hosted blogs. Those are links to news organizations posted on a digital platform service, after all. A link to a news story on a search result page shown in response to someone’s search query also can’t be compared with a news portal like Google News.

A commonly suggested “fix” for the broad scope of the NMDPMBC is to compensate news organizations for clicks rather than links. Online news is a buffet with a wide selection of topics and priorities. There’s value in just skimming the news headlines. It’s a common method to stay abreast of today’s breaking news. Therefore, you can’t compensate news organizations for clicks alone. Focusing on clicks would incentivize click-baiting, [knowledge-gap headlines](https://www.wired.com/2015/12/psychology-of-clickbait/?ref=ctrl.blog), and other practices to optimize the click-through rate.

I’d go so far as to say that the scope of the NMDPMBC is dangerously broad and far-reaching. In my opinion, the NMDPMBC should be repealed and replaced by a new legislation with a much narrower scope. I propose that news organizations should be compensated for their works when it’s packaged and used in a competing *news destination service.* A news destination is any service that features news from one or more news sources; with the news forming a significant portion of the services’ value-proposition. For example, links to news organizations in response to contextual search results or links shared between users as part of a discussion doesn’t make a service into a news destination.

This definition excludes e.g. a link at the top of a blog post or forum thread, even with a preview, as long as that is not the primary focus of the page. It also excludes social media streams where discussions and opinions about the news are the primary content. In contrast, a platform like Twitter puts a heavy emphasis on the shared news link, with large headlines and huge imagery. Twitter also limits the length of the poster’s comment to a degree that ensures the shared link remains the main focus.

The new scope of this revised legislation has some unintended consequences, however. I’m a fan of the open [web syndication](https://www.ctrl.blog/tag/syndication-feeds/) standard, and would exclude some types of services built around the principles of this technology. Any good legislation needs a few exceptions. Here are three exceptions I’d include in a revised legislation:

Firstly, a news destination with “fewer than 10 000 daily visitors (monthly average)” is exempt. This is a fairly low number. However, I don’t believe it’s a right to create a direct competitor using someone else’s works without paying for the privilege.

Secondly, news shared directly from a news organization’s own app or website should be exempt. E.g. you can’t require Facebook to pay for news being shared when you’ve included a prominent Share button on your website. That’s an implicit license to freely share the content. That doesn’t mean that other methods of sharing links to that same article is exempt, however. Social media platforms already track how links are shared. News organizations can’t have it both ways.

Thirdly, a news destination that only aggregates news from syndication feeds (“RSS”) provided by the end-user to the service is exempt. The user does the curation work themselves choosing who to follow in a format created specifically for syndication. Under this exemption, a digital platform service can’t suggest or recommend news organizations to follow, or provide a set of defaults.

The premise of requiring digital platforms to pay for any type of link to a news website in any context is fundamentally flawed. Not all links are created equal! The changes I propose above probably aren’t perfect, and I’m sure you can poke holes in them. I do believe, however, that it’s a huge improvement over the general link tax that made it into law in Australia.
### How I fixed the intermittent Wi-Fi dropouts on my MacBook
URL: https://www.ctrl.blog/entry/macbook-wifi-dropouts/
Last updated: 2026-08-23T22:13:56.000Z
The Wi-Fi on my MacBook Pro (a late-2013, 39 cm model, MacBookPro11,2) randomly stops working. It doesn’t lose the connection, and Wi-Fi Diagnostics can’t find anything wrong. The networking just stops working. Here's how I found out what was wrong, how you can find out if you’re having the same problem, and how I found a fix.

I first noticed the issues about two years ago. Every network operation simply timed out unfulfilled. It would happened intermittently, about a couple of times throughout the day. MacOS didn’t complain about signal interference or drop the connection. It’s was a typical case of “my Wi-Fi doesn’t work and I don’t know why.”

The problem got much worse in the last year (during the COVID pandemic). Networking on my MacBook was essentially non-functional during peak-Netflix hours in the evenings. However, the internet connection didn’t slow down or otherwise seem to struggle with Wi-fi pollution from all my neighbors. The signal strength and signal-to-noise ratio (SNR) isn’t too bad. Notably, there are no other access points in range broadcasting on the same or an overlapping channel! 

The issue doesn’t resolve itself either. I can leave the MacBook for an hour and it won’t restore connectivity on its own. MacOS doesn’t even seem to realize that it has lost network access. It just stops working. I quickly found a work-around for the problem, though.

I simply clicked on the Wi-Fi menu on MacOS’ top bar, and networking was restored. A few minutes or hours later, the problem would reappear, and I’d have to click the Wi-Fi menu again to get back online. Occasionally, I’d need to reopen the menu one extra time before it cleared up the clog. Initially, I thought I had to turn Wi-Fi off and on again, but I quickly noticed that it was enough to open the Wi-Fi menu.

Okay, so what’s happening when I open the Wi-Fi menu? I’m not sure. The only thing I can say for sure is that it triggers an active scan for available Wi-Fi networks. The MacBook periodically performs active scans in the background, and I've not been able to identify any change to this behavior even when Wi-Fi stops working. For whatever reason, triggering an active scan clears the clog and restores connectivity.

My best theory is that *something* in either the Wi-Fi chip or its driver is flushed or reset by performing an active scan. I can’t say for certain, though. However, given what I now knew about the problem I wanted to find a better solution. A solution that didn’t involve me having to manually click the Wi-Fi icon on the toolbar whenever networking stopped working.

My first attempt involved an AppleScript that controlled the scripting cursor and opened the Wi-Fi menu. Let’s just say that was incredibly disruptive and not the right solution!

Next, I installed and the [NetSpot Home](https://www.netspotapp.com/features.html?ref=ctrl.blog) (Free edition) app and let it run in the background. It can do all sorts of signal analysis and help you troubleshoot your Wi-Fi woes. I was only interested in one passive feature, though: It initiates an active Wi-Fi scan once every 30 seconds. That was enough to completely resolve my Wi-Fi problems! I’ve noticed that the network sometimes crawls to a halt, but it recovers again within a few seconds. This was a huge improvement.

The problem resurfaces within minutes or hours after I quit the NetSpot app. So, I’d found a work-around for my problem! I doubt Apple is ever going to fix this on my old MacBook model. Here’s how I put in place a more permanent fix for the issue.

I created a background service agent that starts every 45 seconds and triggers an active scan. The task is handled by MacOS’ built in `airport` utility program. If you’ve turned Wi-Fi off, the program does nothing. Here’s how to install it:

1. Download [local.wifi-scanner.plist](https://www.ctrl.blog/file/2021-05-25%5Flocal.wifi-scanner.plist) to your Downloads folder.
2. Open the Terminal app (find it with Spotlight search).
3. Copy the following two commands into the terminal and press `Enter` after each one:

```shell
mv "$HOME/Downloads/local.wifi-scanner.plist" "$HOME/Library/LaunchAgents/"
```

```shell
launchctl load "$HOME/Library/LaunchAgents/local.wifi-scanner.plist"
```

This copies the downloaded file and installs it as a background service. You can turn it off again by either removing the file, or repeating the last command but replacing `load` with `unload`. Unless you really need this to fix your Wi-Fi, you may want to turn it off again the script after reading the next section.

The program runs silently in the background. You shouldn’t ever notice it’s there, except that your Wi-Fi problems may have gone away. It does, however, have a few negative side effects including:

1. Slightly decreased battery life. Your Wi-Fi antennas are more active, and this prevents the chip from entering power-saving modes. The effects will vary based on your local signaling conditions.
2. Slightly increased Wi-Fi pollution. Your device is sending out active probes and receiving replies from all nearby access points on all channels across the spectrum more often than strictly necessary. This may slightly degrade Wi-Fi performance for everyone around your device.
3. Slightly increased network latency. While your device is busy broadcasting scan probes, it can’t perform other networking tasks. At least [one study concludes](https://arxiv.org/pdf/1807.05523.pdf?ref=ctrl.blog) that this effects can last for seconds after it’s “done” with the scans.

The Wi-Fi chip in my MacBook is an Apple AirPort-branded/modified Broadcom BCM94331\. Hm. Isn’t it funny how it’s always Broadcom network interfaces that’s causing me Wi-Fi problems.

#### Sources

- [If your Mac doesn't connect to the Internet over Wi-Fi](https://support.apple.com/en-us/202663?ref=ctrl.blog), 2020-01-16, Support, Apple
- [Improving the Performance of WLANs by Reducing Unnecessary Active Scans](https://arxiv.org/pdf/1807.05523.pdf?ref=ctrl.blog) (PDF), 2018-07-15, Dheryta Jaisinghani; et al, arXiv
### Why KeePass instead of self-hosting Bitwarden
URL: https://www.ctrl.blog/entry/keepass-vs-bitwarden-server/
Last updated: 2026-08-23T22:12:28.000Z
Here’s why I decided to move my passwords to a KeePass database file instead of using Bitwarden with a self-hosted server. It comes down to keeping my passwords out of the browser, and my setup simple and manageable.

For years, I was (and still am) [unwilling to trust hosted password manager services](https://www.ctrl.blog/entry/lastpass-client-trust/). I eventually got with the time and started using LastPass. Three years ago, I [migrated to Bitwarden](https://www.ctrl.blog/entry/migrating-to-bitwarden/) as LastPass just kept cutting features and platform support.

Bitwarden is an open-source alternative to the proprietary LastPass password manager. Bitwarden offers browser extensions and apps for all common operating systems. Even the server-side synchronization component is open source. You could, theoretically, host the backend infrastructure yourself.

LastPass recently [restricted its free service](https://www.theverge.com/2021/3/16/22333891/lastpass-free-changes-bitwarden-zoho-password-manager?ref=ctrl.blog) to a tough choice: pay up, or be restricted to using it with either computers or mobile devices. Being limited to just one category of devices puts a serious dent in the service’s usefulness. To make matters worse, the service didn’t let you choose a device type; it arbitrarily picked one for you!

The change was another blow for the whole idea of free services. In the last couple of years, many popular and formerly free services have bait-and-switched in limitations as LastPass did. It turns out that not charging for your service isn’t profitable. Who knew‽ LastPass isn’t a common good; it’s a business.

Bitwarden is definitely more community-oriented than LastPass. It’s still a for-profit company, but it also has to appease its community of users or risk them taking its source code and spin up competitors. Regardless, I’m not entirely comfortable relying on anyone for my password. I decided to finally look into self-hosting Bitwarden. At least, it would make for something interesting for my blog, right?

My password store is the crown jewel of all my digital assets. All 300 of my passwords need to be kept securely under crypt and key. I don’t doubt my ability to do an adequate job at configuring, backing up, and maintaining a Bitwarden server. However, I’d never be entirely sure that the configuration was secure. Bitwarden stores everything encrypted; it should be fine even if someone broke into my server.

However, I decided against self-hosting a password manager after evaluating this approach for some time. It’s enormously complex and a pain to maintain. I’d need to commit to regularly evaluating server logs and proactively detecting intrusions. It would be a lot of extra work just for a password manager. I don’t need groupware, multiple users, or to share passwords. I’ve got too many other projects going on, and this would consume too much time and effort on an ongoing basis. This simply wasn’t the right tool for the job for me.

I’ve recently had a change of heart regarding having my password manager available for auto-fill in my web browser. Password manager extensions and password managers built into web browsers are very convenient. Web browser-integrated password managers — both the built-in ones and extensions — have suffered from many auto-fill leaks and vulnerabilities over the years. It’s an attack surface I can do without.

I’ve never really considered using a local password manager as a stand-alone app. The idea of using something like KeePass has seemed like an outdated and old-fashioned way of doing things. I must admit, that this impression was mostly influenced by the design of the [original KeePass project website](https://keepass.info/?ref=ctrl.blog). The pinstriped page background and icon-heavy sidebar just scream 2005s webdesign to me. The program itself also looks like it was made for Windows 98.

I don’t need to use KeePass, though. There are over a dozen different forks of the KeePass project to choose from. I decided on [KeePassXC](https://keepassxc.org/?ref=ctrl.blog) for my Mac, Linux, and Windows computers; and [KeePass2Android Offline](https://play.google.com/store/apps/details?id=keepass2android.keepass2android%5Fnonet&ref=ctrl.blog) for my Android phone. I decided on these two because they feel more modern and I’ve confirmed that they [won’t easily suffer from synchronization conflicts](https://www.ctrl.blog/entry/keepass-file-conflicts-android/).

Unlike a hosted password manager, a local password manager stores passwords in a secure vault on your local device. A “secure vault” is a fancy way of saying it’s stored in an encrypted file protected by a master password. It’s all just in a file. Your passwords are stuck on one device unless you can arrange to sync the database to other devices, keep it in sync over time, and resolve eventual sync conflicts. You also need a reliable strategy for backups.

Luckily, [Syncthing](https://syncthing.net/?ref=ctrl.blog) can handle all my file synchronization needs directly between my devices. Syncthing doesn’t need a hosted file synchronization and storage provider to act as an intermediary. This means I won’t have to rely on or trust a third-party storage provider. It also handles file versioning for me; enabling me to recover from any potential overwritten data or other sync mishaps.

I already use Syncthing on all my devices, so it didn’t require anything extra to set it up for use with my password manager. This setup is much simpler and leaner than what I was about to set up with Bitwarden. It can still work on my home network even if the entire global internet stops working one day. (I’m not sure what I’d need all my passwords for in such an event, but I’m covered nevertheless.)

A KeePass database file also simplifies the backup and eventual restoration process. You do [backup your cloud-hosted password manager](https://www.ctrl.blog/entry/password-manager-backup/), don’t you? It’s just a file, after all. I can use my existing backup processes for files residing on my various devices to back up the password database. I also have multiple copies available since it’s continuously synced to all my devices. This article was written during a \[false\] fire alarm in my apartment complex. I just put my phone in my pocket and went out the door with a complete copy of my password database.

The same simplicity argument can’t be said about a self-hosted Bitwarden server. In everyday operation, I’d only have one master copy on my home server. I’d need to carefully export copies of the database and regularly verify that the backups worked. It would have introduced much unnecessary extra work.

So, what about security? My main worry wasn’t about the security of the KeePass database or the forks I decided on using. I assume and trust that they’re secure — we all have to place our trust in something. Properly evaluating any of them would take years of effort. However, I was mostly concerned about the security of my clipboard. I have to copy passwords in plain text from my password manager and into programs like web browsers.

The whole “clipboard thing” is a big topic, and I ended up writing a separate 2300-word [article on clipboard security](https://www.ctrl.blog/entry/clipboard-security/). In summary: it’s a mostly unsolved issue on desktop, and it can be an issue on mobile. Ideally, I’d like to see desktop operating systems add a safer auto-fill feature like what we have on Android and iOS. Until we get that, you either have to be super careful about device security or switch to [Qubes OS](https://www.qubes-os.org/?ref=ctrl.blog).

Anyhow, KeePassXC does what it can to help prevent your copied passwords from leaking. It discourages clipboard history managers from saving it, and instructs the Windows Cloud Clipboard not to share it with Microsoft. KeePassXC doesn’t stop MacOS from syncing with Apple’s Universal Clipboard, though. Apple’s solution is end-to-end encrypted on your local network. I don't need to worry about it the same way as with Windows Cloud Clipboard. (Learn more about these features in the article linked above.)

KeePassXC feels like the right solution for me with the tools and devices I use every day. It’s definitely not for everyone, but it only costs a little bit of time to try it out for yourself. Migrating to it is easy as it supports importing and exporting from many other password managers. Make sure you [store those unencrypted password exports](https://www.ctrl.blog/entry/password-manager-backup/) safely and delete them afterward!
### How to change keyboard layout on the GNOME and Plasma login screens
URL: https://www.ctrl.blog/entry/how-to-linux-login-keyboard-layout/
Last updated: 2026-08-23T22:10:28.000Z
I’ve had an annoying issue with the login screen on my Linux computer: it’s using the wrong keyboard layout. I can’t log in without first doing some mental mapping of where the keys are on the wrong keyboard layout. Here’s how you change the keyboard on the LUKS password screen, and graphical login screens. 

I first noticed the issue after switching from GNOME to the [Plasma Desktop](https://kde.org/plasma-desktop/?ref=ctrl.blog). To get the full *Plasma experience,* I also switched from the GNOME Display Manager (GDM) to the Simple Desktop Display Manager (SDDM). I believed the issue to be unique to SDDM, and focused my troubleshooting on finding out how to switch the keyboard layout in SDDM.

SDDM doesn’t read the keyboard layout preferences set in KDE System Settings. KDE’s settings app also doesn’t have a section for managing SDDM settings. So, I was kind of left with the traditional dance of rephrasing queries in search engines to find something relevant.

I couldn’t find a solution, however. I wasn’t really all that motivated to fix the issue. It was only an issue after boot. If the screen is locked, SDDM would use the active keyboard layout from my Plasma session for the unlock password prompt. (Surely, this must be a bug, right? It can’t be supposed to switch keyboard layouts like that? There isn’t even an indicator for which keyboard layout is active in SDDM!)

After a year with Plasma, I decided it was time to move back to GNOME and GDM. That’s when I realized the problem also affected GDM. This was even more puzzling to me. I’m sure it used the correct keyboard layout the last time I used it. Until this point, I had concluded that I was dealing with a bug in SDDM. GDM also having the same issue put me back on track of a configuration issue.

But what was misconfigured, though? The GNOME Control Center has language and region some settings for GDM and the login screen. What it doesn’t have, however, is a setting for the preferred keyboard layout.

So, where does it get this setting? The virtual console keymap was set to Norwegian through a boot parameter and in systemd. You can change this using the `sudo localectl set-keymap no` command where `no` (Norwegian) is your preferred keyboard layout. That affects the keyboard layout for the emergency boot console and the LUKS encryption password prompt during start-up. It doesn’t affect either GDM or SDDM, however. 

After hours of searching, I finally found the answer in the GNOME System Administrator Guide. It doesn’t have an article describing how to choose the keyboard layout on the login screen. But it does have an article on how to [display multiple keyboard layouts on the login screen](https://help.gnome.org/admin/system-admin-guide/stable/keyboard-layout.html.en?ref=ctrl.blog). Close enough.

The article talks about how to change the *X11* keymap preference. I’d seen this mentioned around on forums and elsewhere on the web, but I’d dismissed it. GNOME is using Wayland compositor and not the legacy X11 window server, after all. Configuration for X11 doesn’t affect Wayland, right? Well, it turns out that’s not the case when it comes to *input preferences.*

Wayland uses a software library called [libinput](https://freedesktop.org/wiki/Software/libinput/?ref=ctrl.blog) to handle input devices and configuration. It’s still very much reading X11’s input configuration files. I did already know this from experience with some weird hardware input devices, but I failed to connect the dots.

Following the sysadmin guide article, I ran the following command and rebooted to see what would happen:

```shell
sudo localectl set-x11-keymap no
```

The keymap “no” (Norwegian) and not false.

Lo and behold, it worked as advertised! Both GDM and SDDM now used the Norwegian keyboard layout as I desired. So, what did the above command do that I hadn’t already tried?

The command created a new configuration file in `/etc/X11/xorg.conf.d/00-keyboard.conf`. It contained an input device called the system keyboard and set its `XkbLayout` setting to `no`. This all makes sense when you know what to look for. 

I’m surprised and disappointed that the keyboard layout can’t be configured from within GNOME Control Center or KDE System Settings. SDDM changing the keyboard layout to match the Plasma session’s keyboard layout *only when locking the screen* is baffling. Surely, this must confuse and prevent people from unlocking their computers?

Most people have never given a second’s thought to what keyboards people from other places in the world use. They’d struggle to log in using a Cyrillic keyboard, for sure. But even switching from a U.S. or German to a French AZERTY keyboard layout would be a show-stopper for most people. Sure, it’s the same Latin alphabet but [it’s also super-weird](https://www.thelocal.fr/20160120/what-annoys-expats-the-most-about-the-french-keyboard/?ref=ctrl.blog).

The Linux desktop is in good company on this one. MacOS also doesn’t have a super-obvious way to configure the keyboard layout on its login screen, and system updates keep arbitrarily changing it. My article on [how to change the keyboard layout on MacOS](https://www.ctrl.blog/entry/how-to-macos-login-keyboard-layout/) is one of the blog’s most-read articles in recent years.

#### Sources

- [vconsole.conf manual page](https://www.freedesktop.org/software/systemd/man/vconsole.conf.html?ref=ctrl.blog), version 248, 2021-03-30, Systemd, FreeDesktop.org
- [Display multiple keyboard layouts on the login screen](https://help.gnome.org/admin/system-admin-guide/stable/keyboard-layout.html.en?ref=ctrl.blog), 2014-01-16, System Administrator Guide, Help, GNOME Foundation
### How to stop Bing ranking XML feeds over your webpages
URL: https://www.ctrl.blog/entry/bing-assets-over-pages/
Last updated: 2026-08-23T22:02:13.000Z
For the last two years, Bing has ranked many of my syndication feeds ("RSS") higher than the webpage counterparts. Syndication feeds are machine-readable documents people use to get blog updates with a special program. I’ve racked my brain trying to figure out why Bing does this, and I’ve finally found an answer.

For example, Bing puts the [search engine topic feed](https://feed.ctrl.blog/topic/search-engines.atom?ref=ctrl.blog) on the first page of search results, but the corresponding [topic webpage](https://www.ctrl.blog/tag/search-engines/) is ranked at the bottom of page six. Yes, the two documents are technically duplicate content; which search engines hate. However, one is a webpage formatted for humans, and the other was a machine-readable XML document. (I’ve since added a presentational stylesheet to make the feed page appear as a webpage, but more on that later.) 

This isn’t a problem unique to this website either. I’ve surveyed 80 of the blogs that I subscribe to in my feed reader. I searched for the name of the blog and the author after first verifying that these are keywords found both on the webpage and their feeds. Bing listed the feed above or immediately following the front page for a little over half the searches. So, what did these websites have in common with my website?

The thing we all have in common is that our feeds are published under a different domain than the main website. Perhaps Bing seems to think that they’re two different websites? Both the feed and webpage representations link to each other and indicate that they’re different representations of each other. I didn’t find any examples of feeds published from the same domain showing up in search results, however.

The issue isn’t limited to just feed files, though. Bing also includes other binary files in formats it doesn’t understand in its search results. Here’s a selection of binary or media asset type files that Bing includes in search results for my blog’s domain:

![Bing search results showing search results with binary data as an unreadable Unicode text representation.](https://cdn.synaps.media/control/content/images/2026/08/bing-assets-in-search-results.png)

Bing search results include human-unreadable binary files. Binary files in Bing search results by [Daniel Aleksandersen](https://www.daniel.priv.no/?ref=ctrl.blog) licensed under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/?ref=ctrl.blog).

The SVG image file is easy to account for: it uses the metadata found in the actual image file. The other two results hint at some metadata misattribution? None of these things belong in general web search results, though. Two are images and belong in image search, and the last is a video file. What they have in common is that Bing includes them in results for keywords for the articles they belong to.

I’ve asked Bing Webmaster Support several times about the unwanted file assets in their search results. I expected the underlying issue to be similar to the feed issue. Bing should know these files aren’t documents and that they don’t belong in regular search results. Bing’s support staff never understand what I’m asking about, and end up in a loop where they ask me to resubmit the same information over and over until I go away.

I don’t want to exclude these files from indexing, however. I’d still want to see my images included in Bing Image search, for example.

I don’t know how to solve this last problem with media assets yet. However, I did find a solution for the feed problem that has been plaguing my site for so long. It’s kind of obvious, but I didn’t realize that the solution applied to syndication feeds until [I wrote about FeedBurner back in April](https://www.ctrl.blog/entry/feedburner-2021.html). 

The core problem with the feeds is that the pages are duplicated content. I also think I’ve realized why Bing preferred the unstyled feeds over my beautifully crafted webpages. It comes down to file sizes. Bing Webmaster Central flagged some of my pages as being overweight. There were just too many kilobytes on each topic page. The biggest pages listed 80 articles complete with a lot of markup for various image representations and metadata. I’ll get back to this problem towards the end of the article.

Bing somehow failed to realize that the feed documents weren’t intended for human consumption, though. First, I fixed the problem of the feed pages not being human-readable. I included XSLT instructions in the feed which web browsers can [transform the feed XML into a webpage](https://www.ctrl.blog/entry/xml-feed-web-previews/). This let me craft a preview page for the feed, so visitors who stumbled upon it would actually be able to make some sense of it. Visitors who Bing misled onto these pages would no longer have a terrible experience! 

Then it struck me: how do web authors normally deal with duplicate pages? You guessed it: using `<link rel="canonical"/>`, of course! Link canonicalization is an industry-standard for indicating to search engines which is the preferred URL of a page. I’d already included canonical links on all my webpages, but I’d not included them *in the feed documents!*

I quickly added canonical links on each of my feed pages linking to their equivalent webpage. Thus informing Bing and other search engines — none of which had the same problem as Bing, though — that the webpage was the preferred canonical representation for this document. Two weeks later, almost all of the unwanted feed page search results are gone from search results on Bing!

My current content duplication content may have been part of the underlying cause of my [Bing delisting back in 2019](https://www.ctrl.blog/entry/bing-delisted-canonicalization/). I narrowed the problem down to *something* relating to link canonicalization and duplicated content. I’ve never thought of the syndication feeds as duplicate content until I reframed the problem and started thinking of them as webpages. Other search engines seem to be smart enough to discard those, after all. 

If you have the same problem, then you can apply this trick using a Link HTTP response header instead of implementing XSLT for your feeds. This should be quicker and way easier to implement.

After confirming that Bing now ranks my webpages over their feeds, I began working on my page weight problem. It was long overdue that I broke my topic pages up into separate pages. It makes it more difficult to go to a topic page and do an in-page search for a keyword. I doubt anyone but myself regularly used that as a navigation method, however.

The underlying problem is *probably* that the syndication feeds and image assets are widely distributed around the web. Especially the syndication feeds are made to be shared and distributed. This means there are unusually many incoming links to them; signals that Bing *probably* reflected in its search results. Bing should know this isn’t the preferred representation format, though. I haven’t encountered any other search engine that has the same problem with telling machine- and human-readable documents apart.

#### Sources

- [RFC 6596: The Canonical Link Relation](https://www.rfc-editor.org/rfc/rfc6596.html?ref=ctrl.blog), 2012-04, Internet Engineering Task Force (IETF)
### Your clipboard is only as secure as your device
URL: https://www.ctrl.blog/entry/clipboard-security/
Last updated: 2026-08-23T22:03:26.000Z
The system clipboard is part of every modern operating system. It lets us copy and paste text, images, files, and data between different applications. Like everything else these days, it’s increasingly getting tied up with other people’s servers (“the cloud.”) So, what does that mean for your clipboard privacy?

The clipboard was invented in 1973, and it was never designed to be secure. It’s a shared area of computer memory used to quickly duplicate information from one app — one data silo — to another. Traditionally, every running process on our computers has had full access to everything that lands on the clipboard. Yet, we copy and move about personal information, passwords, company secrets, and a whole lot more using the same old clipboard without blinking an eye.

New features like cross-device synchronization and clipboard history can be very useful. However, they also make the interactions more complicated and the behavior more unpredictable. It can even expose our passwords and personal data to new avenues of attack from malicious software running on your other devices.

The clipboard has traditionally been unconditionally available to all applications. Android version 10 introduced new restrictions to keep background apps from accessing the clipboard.

The newer Universal Windows Apps (“store apps” or “UWP apps”) introduced in Windows 8 limits access to the clipboard to foreground apps only. Traditional Windows apps — still the most common kind of application — have full access to the clipboard at all times. Likewise, all apps on MacOS have full access to the clipboard. Background apps on iOS have never had access to the clipboard. iOS version 14 even began to display warnings whenever foreground apps access it.

Limiting access to foreground apps is a good security measure that can help prevent third-party apps from spying on the clipboard. However, this assumes that the user knows to clear their clipboard before switching back to the unrelated app. No operating system offers a convenient way to quickly clear the clipboard, though. The user has to copy something else to overwrite the clipboard.

Windows 10.1809 complicated things further by introducing the Windows Clipboard History (a.k.a Cloud Clipboard). The Windows clipboard can now store up to 25 items for up to twelve hours, and optionally synchronize them across your devices. Microsoft hasn’t implemented end-to-end encryption, so, the software giant can read everything on your synced clipboard. Users agree to let Microsoft in on all the secrets, probably without realizing that it’s happening. All UWP foreground apps and all traditional Windows apps can also access your full clipboard history and not only its most recent contents.

Why does the Windows 10 clipboard history clear after twelve hours, though? You may have had important work on the clipboard and trusted Windows 10 to maintain your history from when you stopped working yesterday afternoon to when you picked it up again this morning. Especially when you left the laptop powered on overnight (assuming it doesn’t [reboot by itself](https://www.ctrl.blog/entry/windows-active-hours/)). The time limit makes sense in theory, but then the user needs to be made aware of it. Things like this can’t just happen on their own without frustrating and confounding users.

Applications can specifically request that some items don’t appear in clipboard history or are excluded from synchronized to remote devices. This decision is left entirely up to the application developers, however. Users have no say, indication, or knowledge of what’s or isn’t going to be synchronized or made available in the clipboard history. It’s best to assume that everything will be stored in the clipboard history and synchronized unless you’ve verified that it isn’t.

Developers need to take great care when testing how the clipboard behaves in different apps, though. How you copy something — e.g. using keyboard shortcuts, context menu, or dedicated Copy button in the app — may yield different results. Each method requires additional effort from the developer to properly exclude it from history or syncing. In my tests, apps often fail to handle copies made using keyboard shortcuts and or the context menu.

Apple hasn’t yet added a clipboard history to either iOS or MacOS. However, the Apple Universal Clipboard synchronizes the current clipboard item between iOS and MacOS, end-to-end encrypted, using Bluetooth, and without involving Apple’s servers. Synchronized clipboard contents expire from the remote clipboard after two minutes.

You may be using the Apple Universal Clipboard daily, and sometimes it doesn’t work. Did you exceed the local or synced data size limit? or maybe the time limit? For most people, the experience will simply be that it “sometimes doesn’t work” and they won’t know why. These limitations are never taught to the user, and they have no reason to go look it up online.

Apple’s operating systems also have options for developers to indicate that the clipboard should be excluded from the sync service. The results may vary depending on how you copy it as application developers are sometimes lazy or account for all the possible ways you might interact with the clipboard. Again, the end-user probably won’t know or understand why their clipboard is or isn’t synchronized using the Universal Clipboard.

You can find plenty of popular third-party clipboard history managers available for MacOS. (Strangely, this concept has never really caught on among Windows users.) There’s a [convention](http://nspasteboard.org/?ref=ctrl.blog) among app developers on MacOS for communicating that the clipboard contains sensitive or ephemeral data. For example, password managers use this to inform clipboard managers to exclude copied passwords. This is a voluntary scheme that some apps honor, and it’s not enforced by security policies in the operating system.

This convention isn’t endorsed or supported by Apple but has seen surprisingly high up-take among third-party developers over the years. I tested 22 different clipboard history utilities and password manager, and they all supported the convention. Even the Chromium web browser engine respects the convention to some degree. On the other hand, Apple’s official “don’t sync this” API has almost no developer up-take whatsoever (as indicated by code searches on GitHub). 

Things are, as they often are, messier still on Linux. The Linux desktop has spent the last decade transitioning from the legacy X11 windowing system to Wayland. The transition is still ongoing. In short: X11 has no clipboard security, and any application can do anything with it. Wayland limits both reads and writes to the clipboard to foreground applications. Many Wayland implementations empty the clipboard contents when you exit an application, which can be very confounding to users.

But the situation isn’t that black and white. Linux users love their clipboard managers, and different Wayland implementations have added clipboard manager extension APIs. These APIs offer a convenient way to grab the contents of the clipboard. So, how do you know which applications are sneakily accessing the clipboard through these APIs? … well, you don’t. We’re back to where we started.

The Plasma Desktop (“KDE”) is the most popular Linux desktop environment to feature a built-in clipboard history manager (Klipper) and device clipboard synchronization utility ([KDE Connect](https://www.ctrl.blog/entry/review-kde-connect/)). KDE Connect uses end-to-end encryption between devices running Linux or Android on the local network without involving anyone else’s servers. (KDE Connect doesn’t currently work under Wayland.) Application developers can indicate that something should be excluded from the clipboard history, but there’s no way to opt out of clipboard synchronization when it has been configured.

If you want to remain in control, you can use a security-hardened Linux distribution called [Qubes OS](https://www.qubes-os.org/?ref=ctrl.blog). When properly configured, it runs each application in a and isolated virtualized environment. In this environment, applications can’t snoop on each other’s clipboards. To share data across applications, the user must first copy from the source application to an app-specific clipboard. Then, they must copy that to a shared clipboard, paste the shared clipboard into the destination apps’ clipboard, and then finally paste it into the destination app. This workflow is as inconvenient and cumbersome as it sounds. Though, it’s one of the very few options on the market that allows for secure cross-application clipboard handling.

Clipboard synchronization with Android (e.g. KDE Connect or through Microsoft apps that integrate with Cloud Clipboard) devices became a one-way deal after Android 10 locked down background app’s access to the clipboard contents. They can still put content on the clipboard, but not seamlessly copy content from your clipboard and synchronize it to your other devices. This still leaves a vulnerability where passwords can unintentionally leak to third-party apps.

The app you used last and left open on your Android phone will still be in the foreground and have clipboard access. Some apps, especially long-lived “idle games”, can even prevent the display from turning off. They do it to show your more ads — I mean to let you enjoy the time-killing gameplay without having to unlock the phone every five minutes. When you copy something on your computer, it may get synced to your phone where the foreground app has full clipboard access. Depending on your device’s memory- and battery-saving settings, an app may even be considered a foreground app even when the device is locked.

You may feel relatively safe and sound copying your password from your password manager on your computer. Then your clipboard synchronization tool stabs you in the back, unintentionally, and shares it with a third-party app you forgot was still running. The same method can cause problems on Windows and bypass UWP app restrictions. Apple’s Universal Clipboard is only vulnerable to the same attack vector when both devices are unlocked.

Recent versions of iOS and Android has addressed the password manager problem with new APIs for auto-filling data into login forms. These methods bypass the clipboard entirely and handle the data transfer from a password manager to an app more securely. It doesn’t work for all websites and apps, though. So, users must still rely on the clipboard for some websites and apps. The newer APIs don’t solve any problems related to protecting other sensitive or personal information that may linger on your clipboard. There’s nothing comparable for the desktop operating systems.

The modern clipboard is frustratingly opaque and riddled with unexplained limitations and unexpected behavior. How does the clipboard work in this situation? with these two apps? with this device? while that device is charging and is on the same network as the current one? I feel like my head is about to explode just thinking about it. Big tech has rushed to compete on ways to “improve” the clipboard but still hasn’t fixed fundamental weaknesses in the system. It also hasn’t bothered with teaching its customers how the updated clipboard works now compared to yesteryear.

You can’t assume it’s safe, and even highly technical users no longer have any idea what’s going on with their clipboards. It has all just gotten out of hand. There’s no audit-log trail of which applications have accessed the clipboard. You just can’t know if something is monitoring it. Even a highly knowledgeable and technical user no longer has any hope of keeping up with what has access to the clipboard.

You can minimize risks by limiting the number of background apps and services that run on your system. Quit some unused apps before you open your password manager. Does your computer really need so many background services to augment various device drivers? My Windows laptop somehow runs four background services just for the audio driver. It plays audio just fine without any of them running! The fewer programs that run, the smaller the risk of one of them doing something bad behind your back.

### Bonus content: Developers, developers, developers

Throughout this article, I’ve mentioned that application developers can hint to clipboard managers that content placed on the clipboard is sensitive and shouldn’t be kept in history or synchronized across devices. This section is a quick reference to how they achieve that. It also explains in a bit more detail how the clipboard works.

The clipboard data source — the application that placed something on the clipboard — is responsible for labeling the data with metadata. In broad general terms, you can put any data type on the clipboard; whether it’s text, an image, a comma-separated list, or something else. You can even put multiple things on the clipboard at once — such as copying both an image, table, and paragraph from a webpage or document. This is achieved the same way it is in email messages: using the multipart MIME (M/MIME) protocol. 

Each “part” of the multipart data (even then it’s only one part) is labeled with a content-type indicating what the content is. You’ll most typically encounter `text/plain`.

The exception from the rule is Apple platforms which use toolkit-specific APIs that aren’t expressed in M/MIME. The below table shows the platform-specific APIs or M/MIME content-types (plus any magic values) that should be present along with a clipboard entry to either exclude it from cross-device synchronization or clipboard history managers. The effect of the various APIs are pretty self-explanatory from their names. You can find more information about each in the sources section at the bottom of the article.

| Platform                        | API *or*                                     |        |
| ------------------------------- | -------------------------------------------- | ------ |
| Content-Type                    | Magic Value                                  |        |
| iOS                             | UIPasteboard.OptionsKey.localOnly            |        |
| Linux KDE\*                     | x-kde-passwordManagerHint                    | secret |
| MacOS                           | NSPasteboard.ContentsOptions.currentHostOnly |        |
| org.nspasteboard.ConcealedType† |                                              |        |
| org.nspasteboard.TransientType† |                                              |        |
| Windows 10                      | ExcludeClipboardContentFromMonitorProcessing |        |
| CanIncludeInClipboardHistory    | 0                                            |        |
| CanUploadToCloudClipboard       | 0                                            |        |

- Empty values mean you can use any or no value.
- Supported by Klipper, but not Connect.
- A third-party convention not endorsed by Apple. Also used on iOS.

Remember my warning from earlier in the article about the different methods the user can utilize to copy something! Be sure to test every possible method to copy something from your app and make sure your app sets the expected metadata in all situations.

These APIs only help with well-intended local apps that might otherwise do bad things. They may also help prevent accidental clipboard sharing with unintended recipients running on remote devices.

Make sure to educate your users when you implement any special clipboard handling. It may frustrate them when the clipboard history or synchronized clipboard doesn’t work as they expect. Then again, it may be considered a security vulnerability if these tools do work with your app (depending on the sensitivity of what’s copied). Your only option is to communicate how your app integrates with these tools with the user.

#### Sources

- [Privacy changes in Android 10](https://developer.android.com/about/versions/10/privacy/changes?ref=ctrl.blog), 2021-03-13, Platform Releases, Android Developer, Google
- [Universal Clipboard](https://web.archive.org/web/20210514121854/https://support.apple.com/en-in/guide/security/sec74e6bf9ed/web), 2021-02-18, Apple Platform Security guide, Support, Apple
- [Handoff](https://support.apple.com/en-au/guide/security/secf78dbe639/1/web/1?ref=ctrl.blog), 2021-02-18, Apple Platform Security guide, Support, Apple
- [Copying and pasting text between qubes](https://www.qubes-os.org/doc/copy-paste/?ref=ctrl.blog), commit 35759b4aa3, 2021-01-27, Documentation, Qubes OS Project
- [Windows 10 copy and paste could soon cozy up to Android](https://www.windowscentral.com/windows-10-copy-and-paste-could-soon-cozy-android?ref=ctrl.blog), 2020-10-15, Sean Endicott, Windows Central, Future
- [Part 3: The Value of Clipboard Content](https://cellebrite.com/en/exploring-the-windows-activity-timeline-part-3-the-value-of-clipboard-content/?ref=ctrl.blog), 2020-08-05, Vico Marziale, Exploring the Windows Activity Timeline, Blog, Cellebrite
- [Precise Location Information Leaking Through System Pasteboard](https://www.mysk.blog/2020/02/24/precise-location-information-leaking-through-system-pasteboard/?ref=ctrl.blog), 2020-06-22, Talal Haj Bakry and Tommy Mysk, Blog
- [Identifying and Handling Transient or Special Data on the Clipboard](http://nspasteboard.org/?ref=ctrl.blog), 2020-06-19, NSPasteboard.org, Smile Software
- [Clipboard Class](https://learn.microsoft.com/en-us/uwp/api/windows.applicationmodel.datatransfer.clipboard?view=winrt-19041&ref=ctrl.blog), version 19041, 2020-06-19, UWP, Windows Developer, Docs, Microsoft
- [Clipboard Manager protocol](https://phabricator.kde.org/T4449?ref=ctrl.blog), ticket 4449, 2020-05-12, KWayland, Phabricator, KDE Project
- [Wayland clipboard and drag & drop](https://emersion.fr/blog/2020/wayland-clipboard-drag-and-drop/?ref=ctrl.blog), 2020-03-26, Simon Ser, Blog
- [NSPasteboard.ContentsOptions.currentHostOnly](https://developer.apple.com/documentation/appkit/nspasteboard/contentsoptions/2344963-currenthostonly?ref=ctrl.blog), 2019-06, AppKit, Developer Documentation, Apple
- [UIPasteboard.OptionsKey.localOnly](https://developer.apple.com/documentation/uikit/uipasteboard/optionskey/1829412-localonly?ref=ctrl.blog), 2019-06, UIKit, Developer Documentation, Apple
- [Copy and paste across Windows 10 devices using cloud clipboard](https://web.archive.org/web/20200211020320/https://community.windows.com/en-us/stories/cloud-clipboard-windows-10), 2019-01-15, Masaru Iritani and Megan Brown, Windows Community, Microsoft
- [Clipboard History in Windows 10.1809](https://learn.microsoft.com/en-us/archive/msdn-technet-forums/bf74f4e6-383a-4c27-b21e-cb2a169e55ce?ref=ctrl.blog), 2018-12-24, Kate Li, TechNet Forums, Microsoft
- [Clipboard](https://learn.microsoft.com/en-us/windows/win32/dataxchg/clipboard?ref=ctrl.blog), 2018-05-31, Win32, Windows Developer, Docs, Microsoft
- [Clipboard Formats](https://learn.microsoft.com/en-us/windows/win32/dataxchg/clipboard-formats?ref=ctrl.blog), 2018-05-31, Win32, Windows Developer, Docs, Microsoft
- [Do not insert secret data into history](https://phabricator.kde.org/R120:637cd0bf62e419b8038cb9b1565089fbd341ee7a?ref=ctrl.blog), 2018-05-16, Robert Hoffmann, Phabricator, KDE Project
### EdgeDeflector 1.2 addresses installation woes
URL: https://www.ctrl.blog/entry/edgedeflector-12update/
Last updated: 2026-08-23T22:05:35.000Z
I’ve just released [EdgeDeflector version 1.2](https://github.com/da2x/EdgeDeflector/releases/tag/v1.2.0.0?ref=ctrl.blog). EdgeDeflector is a small utility program that prevents Windows 10 from force-opening links in Microsoft Edge instead of your default web browser. The new version address installation challenges and behavior that causes misclassification by anti-virus programs.

Windows 10 no longer allows third-party programs and installers to change the default file and protocol associations. In my opinion, this is probably a good change that will help protect end users from having their settings overriden by random programs. It’s also potentially anti-competitive behavior as it makes it much harder for third-party programs to become the system default. I expected an uproar of complaint from third-party developers, but the change has gone by mostly unnoticed.

Hijacking and redirecting the `microsoft-edge:` protocol is what EdgeDeflector was created for. This protocol is now a protected protocol in Windows 10, meaning the operating system will no longer prompt you to change a protocol’s default program after installing a new compatible program. EdgeDeflector’s old installer has been a source of confusion for an increasing number of users as Windows 10 has gradually locked down the file and protocol association handling.

The new EdgeDeflector installer has been updated to open [a webpage with instructions](https://www.daniel.priv.no/tools/edgedeflector/post-install.html?ref=ctrl.blog) for how to manually change the protocol handler for the `microsoft-edge:` protocol. The page opens with the `microsoft-edge:` protocol, and thereby force-opens in Microsoft Edge. The page will display a “thank you for installing” notice when it’s not opened with Microsoft Edge (e.g. if EdgeDeflector is already installed and working). These are the same steps as found on the [troubleshooting page](https://github.com/da2x/EdgeDeflector/wiki/Troubleshooting?ref=ctrl.blog), but they’re now required with all installations rather than being an exception.

The installer has been reworked to install per-user instead of system-wide. The manual installation steps must be performed per-user anyway. As a bonus, you no longer need to have administrative privileges to install and run EdgeDeflector.

The protocol registration has also been moved out of EdgeDeflector itself and into the installer. It was originally included in the program itself to allow it to self-repair the protocol association. This meant that the installer would install the program, launch it to register the protocol handler, and then continue with the installation process. Anti-virus vendors *really didn’t like the old behavior* and flagged it as suspicious.

I hope removing both the installer and program’s ability to request elevated privileges will be less suspicious to anti-virus vendors. However, some anti-virus vendors don’t like that the installer opens a `microsoft-` prefixed protocol link. There’s just no pleasing some algorithms.

Please uninstall the old version from Add and Remove Programs before installing the new version. The installer — no longer having admin privileges — obviously can’t automatically uninstall the old version. You’ll end up with two versions installed if you don’t remove the old version.

Neowin beat me to [announcing the new release](https://www.neowin.net/news/edgedeflector-1200-released-allows-setting-default-browser-for-news-and-interests/?ref=ctrl.blog) with a turn-around time of just 75 minutes. I was quite surprised to see it turn up on any news site, let alone so quickly. I guess that proves that there’s still interest in EdgeDeflector.

Neowin suggests using EdgeDeflector with Windows 10’s new News and Interests gadget. News and Interests is built into the Windows taskbar, and shows a newsfeed with personalized recommendations from Microsoft partners on `MSN.com`. It appears to be a new incarnation of [Microsoft Hummingbird](https://www.ctrl.blog/entry/microsoft-feed-hummingbird/). The news links, in typical Microsoft fashion, force-open in Microsoft Edge.

This new feature will undoubtedly cause more people to be annoyed that Windows 10 doesn’t respect their default web browser setting. Anticipating the increased interest in this topic, I started working on the new version of EdgeDeflector earlier this month. I hope the new installation flow will help more people get correctly set up with EdgeDeflector.

[![Get this app on Windows](https://cdn.synaps.media/control/content/images/2026/08/get-windows-app.svg)](https://github.com/da2x/EdgeDeflector/releases/latest/download/EdgeDeflector%5Finstall.exe?ref=ctrl.blog)[![Get source on GitHub](https://cdn.synaps.media/control/content/images/2026/08/get-github-source.svg)](https://github.com/da2x/EdgeDeflector?ref=ctrl.blog)
### WSLg simplifies running Linux desktop apps on Windows
URL: https://www.ctrl.blog/entry/wslg-desktop-apps/
Last updated: 2026-08-25T21:09:05.000Z
The latest Windows 10 Insider build (21354.1) [introduced](https://devblogs.microsoft.com/commandline/the-initial-preview-of-gui-app-support-is-now-available-for-the-windows-subsystem-for-linux-2/?ref=ctrl.blog "“The Initial Preview of GUI app support is now available for the Windows Subsystem for Linux”") support for Windows Subsystem for Linux GUI Apps (WSLg). Microsoft Windows can now run Linux desktop apps natively. Let that sink in for a bit. 

I was among the first to demonstrate that you could [run Linux desktop apps](https://www.ctrl.blog/entry/how-to-x-on-wsl/) on top of the then newly introduced Windows Subsystem for Linux (WSL). It required significant configuration and involved managing a legacy X11 window server program to host your apps. The effort received huge attention at the time, and has even featured in the [Open Source Stories blog](https://medium.com/microsoft-open-source-stories/when-linux-came-to-windows-204cf9abb3d6?ref=ctrl.blog) from Microsoft. It worked but it didn’t provide a pleasant or performant experience or work environment.

Fast-forward five years, and Microsoft has made it significantly easier to run Linux desktop apps on top of WSL. WSLg transparently manages the setup and lifecycle of a Wayland window server to run your apps. The window server is built on top of Weston, the Wayland reference implementation. The effort is predominantly open-source all the way down to the proprietary Windows kernel.

The app windows integrate seamlessly with the Windows 10 taskbar, task switcher, and task view. Program windows are invisible to window-snap, however. And by seamless, I mean that they sometimes don't have window decorations/borders and can overlap the taskbar. GTK+ apps work flawlessly, but apps that are written in Qt or that use custom window decorations can be just a bit too seamless. It integrates two ways with the clipboard (text only), but lacks IME support. In other words, it’s the exact feature set I expected of WSLg. 

Microsoft generates Start menu entries from the [Desktop Menu specification](https://www.freedesktop.org/wiki/Specifications/menu-spec/?ref=ctrl.blog) files that are installed alongside your Linux programs in WSL. These files typically manage app entries in the various app launchers on Linux. Windows doesn’t map file and protocol associations (e.g. integration with default apps and open with dialogs) from the desktop files. This would be nice, but it’s probably expecting too much integration in this particular instance. These associations in desktop files are centered around content types (“MIME” types). This concept so alien to Windows that I completely understand that they haven’t found a good solution.

As an end-user, all you need to do is to install and run your favorite apps through your Linux terminal app. Open up Ubuntu from the Start menu and run `apt install kate`. Then you can either run the command directly, e.g. `kate ./example.txt`, or launch it from the Start menu.

You can also launch Linux apps from the Windows shell, scripts, and custom shortcuts using `wslg.exe`, the WSLg app launcher. Run it with the `--help` argument for more details on its usage.

WSL can’t run apps installed via Flatpak or Snap, but it works with apps installed on-metal directly from your distribution’s package repository and AppImages. Flatpak and Snap support is held back by their stricter requirements introduced by advanced Linux kernel features used to power process security sandboxing.

I tested a whole slew of things, expecting to find lots of problems and limitations. What I found was the opposite. Everything just works and it runs fast and stable. Some apps freak out when you screenshot them or pull up the Xbox Game Bar. Video playback in apps and web browsers is okay, and there is no problem running some light games like [Extreme Tux Racer](https://sourceforge.net/projects/extremetuxracer/?ref=ctrl.blog).

![](https://cdn.synaps.media/control/content/images/2026/08/tuxracer-1.png) 

Experiences the thrills and slopes in Extreme Tux Racer on Linux on Windows but it’s still Linux. It’s all a bit confusing. Extreme Tux Racer in WSLg on Windows 10 by [Daniel Aleksandersen](https://www.daniel.priv.no/?ref=ctrl.blog) licensed under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/?ref=ctrl.blog).

I fully expected GNOME System Monitor and KSysGuard (Task Manager equivalents for Linux) to not work. Surely these apps would be digging too deeply into the operating system, right? Both apps work fine and they display all your running Linux apps and background processes. They’re oblivious to Windows processes and don’t account for their memory and processor utilization. The same limitation applies to WSL itself when you explore your process with utilities like `htop`.

The only real issue I had was with scrolling on my touchpad. Views and documents resist scrolling upwards, and the tiniest nudge downwards scrolls 2000 px instead of the expected 100th of that figure. Scrolling with a mouse works fine. I expect that this issue will get resolved before WSLg is finalized. You can upvote and follow [WSLg issue #42](https://github.com/microsoft/wslg/issues/42?ref=ctrl.blog) for updates.

So, are graphical Linux applications on the Windows desktop useful? Undoubtedly. Depending on your needs, of course. As a power-user or creative professional, you just got access to thousands of Linux-only apps.

As a web developer, you can now test your webdesigns on Linux without the luxury of the default Windows fonts and font rendering. You can also install `epiphany-browser` (GNOME Web) and get a fairly up-to-date WebKit browser.

As a game or app developer, you can test many types of programs on Linux and use the same automation infrastructure and hardware you use to test on Windows. You’ll still need Linux running on real hardware for driver and integration testing, but you can still test a baseline of functionality. WSLg may exaggerate performance issues, and make them easier to identify. It won’t be perfect, but it sure will reduce the time and hardware investment required for a developer to quickly test something on Linux.

**Via:** [The Verge](https://www.theverge.com/2021/4/21/22396018/microsoft-windows-10-linux-gui-apps-task-manager-app-throttling-features?ref=ctrl.blog)
### Superfeedr sends logins in plain-text (a HSTS case study)
URL: https://www.ctrl.blog/entry/superfeedr-hsts-oopsie/
Last updated: 2026-08-23T22:22:40.000Z
I recently signed up for an account with [Superfeedr](https://superfeedr.com/?ref=ctrl.blog) (a WebSub Hub provider). I noticed a security issue in the sign-up process, and thought it would make an excellent case study for HTTP Strict Transport Security (HSTS). Here’s what Superfeedr did wrong, why they probably didn’t realize it, and how you can avoid making the same mistake in the future.

The Superfeedr website is served over an unencrypted/unsecured connection, and it asked me to submit my desired username, password, and email address to the server over an unencrypted connection. After submitting the login, the website redirects you from the unencrypted to an encrypted/secure connection. The damage has already happened, though. A monster-in-the-middle (MITM) may have observed the authentication credential data and can use them to log in to your account.

This is a serious oversight, but HSTS ([RFC 6797](https://www.rfc-editor.org/rfc/rfc6797.html?ref=ctrl.blog)) — an internet standard intended to increase security — may have hidden the problem from the Superfeedr developers. HSTS is a server response header that instructs web browsers to *always upgrade to a secure connection* for all future connections. Superfeedr sends this header, and it should in theory have prevented the problem I ran into at the website.

The problem that Superfeedr ran afoul of is that they hadn’t created a redirect from the unencrypted to an encrypted connection. Web browsers only act on the HSTS response header when it’s *delivered over an encrypted connection*. Superfeedr sent it over an unencrypted connection so web browsers don’t act on it. After logging in once, the website redirects to an encrypted connection, and the browser will then act on the instructions it receives in the HSTS response header for future connections.

This last detail may have hidden the problem from Superfeedr’s developers. They haven’t adequately verified that their website is served over a secure connection. HSTS can make this more difficult to verify because the web browser will automatically upgrade the connection. You need to use a clean browser profile and not just private browsing mode. HSTS connection upgrades can even persist into private browsing modes!

The Superfeedr website also isn’t included on the [HSTS Preload List](https://hstspreload.org/?ref=ctrl.blog). Website owners can register their domains on the list to have web browsers enforce the connection upgrade redirect without first having to visit the website over an unencrypted connection. The list currently contains over 134 500 domains. The Superfeedr web server configuration doesn’t meet the relatively simple criteria for inclusion on the list.

This lapse in security over at Superfeedr doesn’t appear to be a recent regression. Historical data from the Internet Archive’s Wayback Machine suggest the website has never implemented a redirect to a secure connection. (I could be misinterpreting the data because the Wayback Machine is a bit vague when it comes to URL normalization.)

In happier news, web browsers are actively trying to deprecate unencrypted connections. Firefox version 83 introduced an optional [HTTPS-Only Mode](https://venturebeat.com/business/mozilla-firefox-83/?ref=ctrl.blog). Google Chrome version 90 uses [HTTPS by default](https://www.zdnet.com/article/google-releases-chrome-90-with-https-by-default-and-security-fixes/?ref=ctrl.blog) for navigations initiated from the address field.

I contacted Superfeedr about my findings seven weeks ago, but I haven’t heard back. I’ve contacted them separately because their service has frequent but intermittent network connectivity issues. I haven’t heard back regarding that problem either.

**Update** (2021-04-26): Superfeedr has gotten in touch to let me know that they’ve fixed HSTS by implementing the missing redirect. They’re looking into the other problems.

The Superfeedr website appears to run Nginx server version 1.7.1\. This was released over six years ago (March 2015). This version is considered ancient in internet terms, and has multiple known security issues. Not keeping up with software updates is s sure sign that system security isn’t a company’s number one priority. The lights may be on at Superfeedr but it doesn’t appear like anyone’s home. 

#### Sources

- [Google releases Chrome 90 with HTTPS by default and security fixes](https://www.zdnet.com/article/google-releases-chrome-90-with-https-by-default-and-security-fixes/?ref=ctrl.blog), 2021-04-15, Liam Tung, ZDNet
- [Firefox 83 arrives with HTTPS-Only Mode and faster performance](https://venturebeat.com/business/mozilla-firefox-83/?ref=ctrl.blog), 2020-11-17, Emil Protalinski, VentureBeat
- [Issue 1141691: Default omnibox navigations to HTTPS](https://bugs.chromium.org/p/chromium/issues/detail?id=1141691&ref=ctrl.blog), 2020-11, Issue tracker, Chromium project, Google
- [RFC 6797: HTTP Strict Transport Security (HSTS)](https://www.rfc-editor.org/rfc/rfc6797.html?ref=ctrl.blog), 2012-11, J. Hodges; C. Jackson; and A. Barth, Internet Engineering Task Force
### FeedBurner stirs in its slumber to announce more feature deprecations
URL: https://www.ctrl.blog/entry/feedburner-2021/
Last updated: 2026-08-23T22:06:36.000Z
Last week, Google announced that they’re making [changes to FeedBurner](https://feedburnerstatus.blogspot.com/2021/02/building-modern-rss-feed-infrastructure.html?ref=ctrl.blog). Like everyone else who received the email from Google, I expected this to be the time when the service passed on to the [Google Graveyard](https://killedbygoogle.com/?ref=ctrl.blog). However, they merely announced the deprecation of yet more features.

FeedBurner is a syndication feed “optimization” and analytics service that Google acquired in 2007\. It can count feed subscribers, track views and click-through links, a feed-to-email conversion service, WebSub/PuSH, and it presents people that open your feed in a browser with a webpage preview view of the feed. The service is probably best known for its “subscriber count” widgets that many bloggers proudly display on their blogs.

The search giant announced that the valuable feed-to-email service is being discontinued in July 2021\. This is going to be a rude awakening for many, as newsletter services are surprisingly expensive for a service that costs next to nothing to provide. I [developed my own feed-to-newsletter service](https://www.ctrl.blog/entry/email-newsletter/). The high costs of the commercial offerings were one of the main reasons behind my decision.

FeedBurner also announced it’ll discontinue its webpage preview of feeds. These page previews are intended to help users who stumble upon a feed file get started with feeds. However, the previews are incredibly outdated and still contain once-useful button-links like “Add to My Yahoo!”

The feed preview pages are powered by XSLT, a web-standard technology that can be used to do in-browser conversions of your newsfeeds’ XML into webpages. After reading the announcement, I expected to learn that XSLT was slated for removal from Google’s Chrome web browser. That was considered in 2013, but Google didn’t go ahead with the deprecation. It would seem Google just finds the preview pages embarrassingly outdated and doesn’t want to maintain them anymore. 

The feature is easy to replicate — I [wrote about how it works back in 2014](https://www.ctrl.blog/entry/xml-feed-web-previews/). However, you won’t be able to use a do-it-yourself solution on your FeedBurner feeds. Google removes external XSLT stylesheets when loaded through FeedBurner as a security precaution. Web browsers will refuse to load these when served from a different domain than the feed itself anyway.

On a more positive note, Google also announced that it would move FeedBurner to “new infrastructure”. It’s unclear what this means exactly. It could be that they’ll update the service and migrate it into another product like the Google Cloud Console or Google Search Console. Or, it could just mean that nothing noticeable will change, and Google will do as little as possible to maintain service.

The whole FeedBurner service hasn’t received much attention over the last decade. Google hasn’t even maintained a landing page for it since April 20**0**9 (have a look in the [Wayback Machine](https://web.archive.org/web/20090331210536/http://www.feedburner.com/fb/a/home "The FeedBurner homepage in April 2009")). Many of its features no longer work. It’s full of references to- and integrations with discontinued services of yesteryear like del.icio.us, Technorati, Furl, and Sphere. The [FeedBurner Status blog](https://feedburnerstatus.blogspot.com/?ref=ctrl.blog) reads like one long and steady list of feature deprecation. The FeedBurner website is stuck in a decade-old design from an age where background images were misused to display rounded corners. 

FeedBurner is still relevant and used by major news publishers and podcasts. Publishers *still* route their feeds through FeedBurner to get subscriber and impression analytics. FeedBurner also helps speed up feed delivery using the PubHubSubhub (PuSH) standard. PuSH has been deprecated for some years in favor of [WebSub](https://www.w3.org/TR/websub/?ref=ctrl.blog). FeedBurner is the web’s biggest distributor of syndication feeds — and it’s stuck on an early draft of the old PuSH standard.

The WebHub standard is easy to implement, but most publishers rely on either FeedBurner or [Superfeedr](https://superfeedr.com/?ref=ctrl.blog) to handle the technical details for them. Superfeedr is a service that specializes in handling WebSub implementations for publishers and feed clients. It was [acquired by Medium in 2016](https://venturebeat.com/media/medium-acquires-content-feed-provider-superfeedr/?ref=ctrl.blog "“Medium acquires content feed provider Superfeedr”"), and has remained mostly dormant since. The Superfeedr service began being unreliable in January 2020 with aborted connections and many error messages. 

Google may not have deprecated FeedBurner yet, but you should plan to migrate off the service as soon as possible. It’s very surprising that Google hasn’t shut it down yet. If you want feed subscriber analytics and enhancement service, you may want to consider alternatives like [FeedPress](https://feedpress.com/?ref=ctrl.blog). WebSub for FeedPress is handled by Superfeedr. eThe service may therefore not be entirely reliable.
### The thing about ‘The Thing About Harry’
URL: https://www.ctrl.blog/entry/thing-about-harry-availability/
Last updated: 2026-08-23T22:23:19.000Z
The Thing About Harry may seem like your average romance flick, and it is, and that’s also what makes it noteworthy. In The Thing About Harry, boy meets boy, and it happens without the typical tragic backstory, emotional scarring, violence, death and disease, or personal; familiar; and societal disapproval and alienation that usually feature so prominently in gay-interest movies. Instead, the movie’s conflict comes from the main characters’ own insecurities and immaturity. — you know, like in your typical straight romance movie. 

This is quite a unique plot and perspective for a gay-interest movie. Movies focusing on gay characters tend to be tragedies. The movies seldom have a happy ending, and the two lovers often don’t end up together. I’m not going to go into the historical history and context that lead filmmakers down this path in this article, however. I want to celebrate the normality of The Thing About Harry!

Where the movie falls short isn’t in the relatively thin plot or its excellent soundtrack. It’s with its limited distribution. The Thing About Harry was released on Valentine’s Day 2020 as a TV movie only available for streaming on Freeform. It was also available on Hulu for about three months after its release. Freeform, the streaming service, is only available to U.S. audiences. The movie isn’t available through any other streaming or rental services. It’s not available on Blu-Ray or DVD.

It has been over a year since the movie premiered in the U.S., but the film has no international distribution. The movie isn’t an unfortunate victim of the COVID-19 pandemic either. As a direct-to-streaming movie, its distribution isn’t dependent on the cinemas being open.

Unless you happen to live in the U.S. (or have a U.S. IP address …), you just can’t watch the movie. I respect creators’ rights to be wacky and corny with their distribution models. Except that this movie isn’t a one-off art film meant to be experienced while hanging upside down by your toes in a dark room in a museum. It’s a Hallmark-esque commercial production produced by a Walt Disney Company subsidiary aiming to rake in the dough!

I don’t understand why the movie isn’t being distributed as widely as possible, at least for the international market. U.S. production companies frequently “dump” international distribution rights on TV shows and movies on Netflix, even when they don’t put them on Netflix domestically.

It’s outright depressing that people around the world can’t enjoy this movie. The movie’s simple premise, [twink](https://www.nytimes.com/2018/05/14/t-magazine/age-of-the-twink.html?ref=ctrl.blog) meets jock (but without the emotional and societal baggage), could have been a ray of happiness to many. At least, it could be a ray of hope for the future to those who’ve been stuck alone during the pandemic year.

There might be a hint in Freeform’s YouTube channel, though. The trailer for The Thing About Harry features licensed music, and the trailer isn’t available outside the U.S. However, there are several sneak-peek clips (like the one below) from the movie that don’t prominently feature licensed music, and they’re available worldwide. I believe the music featured in the movie might partially be to blame for its limited international distribution. The movie features an excellent soundtrack ([listen on Spotify](https://open.spotify.com/playlist/7Gxv5HjhlmPMDdBkLBo5RB?ref=ctrl.blog)), but licensing music — especially internationally — [can be challenging.](https://www.ctrl.blog/entry/forza-horizon-2-eol/)

Promotional clip from The Thing About Harry

This is just a theory, though. I went through a random selection of recent Freeform originals, and I didn’t find any of them available outside the U.S. It might seem like the company exclusively caters to the U.S. market; leaving money on the table from its potential international audience. If we are living in the late stages of capitalism, the least we can expect is that faceless global corporations let us give them some money to watch a movie. Without having to relocate to another continent (or use a [VPN](https://www.ctrl.blog/tag/vpn/)).

In the grand scheme of things, especially the last year of isolation and loneliness for many, a single movie isn’t all that important. The Thing About Harry is just a light-hearted and cute movie featuring a gay couple and a happy ending. That might be exactly what the world needs more of right now, though.
### Lower the paywalls to keep the bullshit at bay
URL: https://www.ctrl.blog/entry/lower-the-paywalls/
Last updated: 2026-08-23T22:13:42.000Z
A piece in Current Affairs resonated strongly with me: [The Truth is Paywalled; but the Lies are Free](https://www.currentaffairs.org/2020/08/the-truth-is-paywalled-but-the-lies-are-free?ref=ctrl.blog). The premise of the piece is simple: access to journalistic institutions and academic journals is restricted by paywalls; but hogwash, regurgitated rubbish, and conspiracy theories are available for free. The *institutions of truth* seem to be too busy erecting paywalls to notice that they’re loosing the market to those that manage to operate without direct payments. 

> “The amount of energy needed to refute bullshit is an order of magnitude larger than to produce it.”

The bullshit asymmetry principle, Alberto Brandolinii

Paywalled websites don’t just request payment for the individual articles you want to read. The only options on offer is a reoccurring monthly subscription. The interests of the consumer are completely ignored in the pursuit of a pot of gold and reoccurring revenue stream.

It doesn’t matter which is the most well-researched, truthful, and respected news organization when it barricaded itself behind a paywall. Every news organization is competing against a marked flooded with more interesting and lower-priced digital entertainment services.

News packaged as a product is too expensive and too unattractive. Every news organization is competing against each other and a marked flooded with frankly more interesting and lower-priced digital entertainment services. Consumers experience [subscription fatigue](https://variety.com/2019/digital/news/streaming-subscription-fatigue-us-consumers-deloitte-study-1203166046/?ref=ctrl.blog) as more and more services wants a monthly payment.

The subscription model madness must end! Yes, it’s a great model for businesses, but it’s often a sour deal for consumers. The monthly news subscription is a zero-sum game, as it is for all digital services. Everyone wants to be the one subscription people choose to pay for. People simply don’t want to pay for multiple music or video streaming services, and they don’t want to pay for multiple news sources. Zero-sum economics require every other player to fail for one to succeed.

Paywall frustration is harmful for democracy itself. It’s impossible to have an educated populous that knows what is going on around them if access to current events is locked up behind a paywall. It’s not good enough to have paid access to a single source of information. You need to be able to hear multiple voices, different points and perspectives, and to read what different news organizations consider to be the most important news of the day.

News is both a public service and a business. News businesses need sustainable revenue sources. People must pay for news, and paying a single news publisher isn’t good enough. There must be room for more actors in the market, but the economics and the technology simply isn’t there. An under-explored option in this area is micro-payments for individual articles. News publishers have been extremely hesitant to try out this model in fear of cannibalizing their potential subscription revenue.

The advantage of an pay-per-article model is that it inherently works better on the web. *You’re an a\*hole* if you recommend and link someone to a subscription-paywalled article. A pay-$1-per-article paywall introduces friction, but at least the cost to join the discussion is low and doesn’t require ongoing commitment. The pay-per-article model also lets people sample what’s available in the website’s all-you-can-read monthly subscription offering. Publishers are leaving a potential revenue stream on the table unexplored.

Another option that’s more appealing for consumers is news aggregator subscriptions that let you pay one subscription for access to multiple publishers. Publishers haven’t been overly eager to seeding control to rent-seeking middle-men like [Scroll](https://www.ctrl.blog/entry/scroll-com-first-impressions/), Apple News Plus, and Blendle. Firefox has experimented with [bundling Scroll into Firefox](https://www.theverge.com/2020/3/24/21192048/firefox-better-web-scroll-subscription-ad-tracker-blocker-publisher-payment?ref=ctrl.blog).

In the early 2000s, many believed that the web would help democratize access information and knowledge. In the rush and excitement to make that happen, one of the web’s original sins was committed: they forgot to implement seamless payments. To this day, the Hypertext Transfer Protocol (HTTP) that powers information exchanges on the web has [yet to define](https://www.rfc-editor.org/rfc/rfc7231.html?ref=ctrl.blog#section-6.5.2) status code `402 Payment Required`.

A number of attempts have been made over the years to introduce micro-payments into web browsers. Micropayments simplify paying for news and entertainment to one step: a monthly subscription. A tally ledger built into the browser decides how much of the monthly subscription goes to each publishers based on how much time you’ve spent with each. These services have been more welcoming to small creators and publishers, but have never managed to attract the sheer number of publishers, creators, and subscribers required for the model to work. Some example of such services include the [Brave](https://www.ctrl.blog/entry/brave-payments/) and [Puma](https://www.pumabrowser.com/?ref=ctrl.blog) web browsers, and services like [Coil](https://www.ctrl.blog/entry/coil-web-monetization/), [Flattr](https://www.ctrl.blog/entry/flattr2/), [Google Contributor](https://www.ctrl.blog/entry/google-contributor-revisited/) (discontinued), and Readability (discontinued).

I believe that some form of micro-payments is the only way forward for the web. Up until now, the web has largely been subsidized by advertisers. The unchecked raise in ad-blocking software has put those days behind us, and is leaving content creators as well as news publishers underfunded. Ad-blockers may have helped “clean up pages”, but it has also devastated the economics that has paid for everything we love about the web.

I may not know the ideal solution to fund creativity and news on the web. Maybe it hasn’t been invented yet. Alas, the paywalls must fall or ideas like “alternate facts” and other reality dysfunctions might truly become the new everyday reality.
### What is the best file format for web shortcuts
URL: https://www.ctrl.blog/entry/internet-shortcut-files/
Last updated: 2026-08-23T22:11:55.000Z
Links primarily exist on the web, but they can also exist as files in your local file system. There are several formats for storing links as files that open in your web browser. Here’s a quick comparison of the available formats, and a recommendation for which to use for your link files.

Link files — not to be confused with [file system links](https://www.ctrl.blog/entry/distinguish-file-link-clone/) (“symlinks”) — are plain-text files in a structured format that compatible programs can open. The user profile folder in Windows comes with two default folders for storing such links — Links and Favorites — but they’re just regular files that can be stored anywhere on your file system.

The different operating systems call these different things; including Internet Shortcuts, Web Location files, and Web Link files. Windows has its `.url` files; MacOS has its `.webloc`, `.webbookmark`, and `.webhistory` files; and Linux has `.desktop` files. They’re essentially the same thing.

The biggest difference between the formats is their compatibility and the exact format of their structured data. Let’s explore the compatibility aspect first.

| Operating system | URL    | WebLoc | Desktop | HTML |        |      |        |
| ---------------- | ------ | ------ | ------- | ---- | ------ | ---- | ------ |
| Open             | Create | Open   | Create  | Open | Create | Open | Create |
| Windows          | Yes    | No     | Yes     | No   |        |      |        |
| MacOS            | Yes    | No     | Yes     | No   |        |      |        |
| Linux            | No     | Yes    |         |      |        |      |        |
| Android          | No     |        |         |      |        |      |        |
| iOS              |        |        |         |      |        |      |        |

So, the above isn’t too encouraging. There isn’t one link file format that works with all operating systems out of the box. The `.url` file format has the best support with built-in support in Windows (provided by [Internet Browser](https://www.ctrl.blog/entry/windows-internet-browser/) — not Explorer!) and MacOS (provided by Safari). You can add support for `.url` files to Linux/FreeDesktop environments like GNOME and KDE Plasma by installing [url-open](https://codeberg.org/da/url-open?ref=ctrl.blog). All three programs will defer the actual link to your default web browser of choice.

You could technically craft a `.html` webpage file that would open in any browser and redirect you to a webpage of your choice. I included it in the table as it’s the only true cross-platform option. However, this solution is only useful for people with some experience with HTML. That brings us neatly on to the next topic: the structured format used in the different file formats.

On Windows, you can create a `.url` by right-clicking anywhere in File Explorer, choosing New: Shortcut, and filling in a web address. You can, alternatively, create a plain-text file with the following structure (applicable on MacOS and other operating systems too):

```ini
[InternetShortcut]
URL=https://www.example.com/
```

—and save the file with a `.url` file extension. You can optionally include the `Title=` and `Desc=` properties, but these aren’t displayed or used for anything in any modern operating system. This is the easiest format to read and memorize, so you can create shortcut files whenever you need them. They’re also easy enough to read for a non-technical user who might come across it and for whatever reason opens it as a text file instead of opening the shortcut directly, e.g. Linux users.

Windows has a second shortcut file format with the `.lnk` file extension. These files can only point to objects in the file system or certain classes of Component Object Model (COM) addressable objects. They can technically be used as shortcuts for internet links, but it isn’t suitable for it. The format is only computer-readable (binary), and the resulting shortcut files may not even work on other Windows computers with different web browsers installed.

The `.desktop` format on Linux is very similar to the `.url` format. It requires a different section heading and an additional `Type=Link` property:

```ini
[Desktop Entry]
Type=Link
URL=https://www.example.com/
```

On MacOS, you can create a `.webloc` (and `.webbookmark`) by dragging links from your web browser and dropping them in Finder or on the desktop. The structured data format is much more complex, though. This one isn’t something you’re going to remember, and most people would be really confused if they got confronted by the wall of text.

```xml
<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE plist PUBLIC
  "-//Apple//DTD PLIST 1.0//EN"
  "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>URL</key>
  <string>https://www.example.com/</string>
</dict>
</plist>
```

Lastly, here’s a minimal `.html` file that can work as a shortcut file. Unlike the other formats, this document is opened and interpreted directly by your web browser; thus making it the most widely supported format. It also works on mobile platforms.

```html
<!doctype html>
<script>
  window.location.replace('https://www.example.com/')
</script>
```

All four formats have optional fields for titles, and descriptions or comments. Desktop search in modern operating systems no longer index these fields or the URL, however. (This was supported historically.) You can search for your bookmark files by their file names.

The most interoperable format is `.html`, but you need to create the files yourself. This is also the format best suited for sharing with others. The second most interoperable format is `.url`, but you may still need to manually create them unless you’re on Windows.

So, which is the best format for your bookmark files? None of the formats really offer any extra features or benefits over the other formats (other than interoperability). I recommend using the `.url` format for most situations. The file extension does a good job at explaining what the file contains. If interoperability is the highest priority, then `.html` is the way to go. People may expect a `.html` file to contain a document and not just a link redirect, however.

#### Bonus content: media types!

| Format   | Media type             | Registry        |
| -------- | ---------------------- | --------------- |
| .url     | application/x-mswinurl | FreeDesktop.org |
| .webloc  | application/xml        | IANA            |
| .desktop | application/x-desktop  | FreeDesktop.org |
| .html    | text/html              | IANA            |

#### Sources

- [Shell Link (.LNK) Binary File Format](https://learn.microsoft.com/en-us/openspecs/windows%5Fprotocols/ms-shllink/16cb4ca1-9339-4d0c-a68d-bf1d6cc0f943?ref=ctrl.blog), 2020-10-30, Open Specifications, Docs, Microsoft
- [Internet Shortcuts](https://learn.microsoft.com/en-us/windows/win32/lwef/internet-shortcuts?ref=ctrl.blog), 2018-05-31, Desktop Environment, Windows Developer, Docs, Microsoft
- [Desktop Entry Specification](https://specifications.freedesktop.org/desktop-entry-spec/1.1/?ref=ctrl.blog), version 1.1, 2014-04-01, FreeDesktop.org
- [Safari History - spotlight webhistory artefacts](http://forensicsfromthesausagefactory.blogspot.com/2010/06/safari-history-spotlight-webhistory.html?ref=ctrl.blog), 2010-06-15, Richard Drinkwater, Forensics from the sausage factory
### Third-party extension not enough to address Coil’s transparency issues
URL: https://www.ctrl.blog/entry/coil-transparency/
Last updated: 2026-08-23T22:03:38.000Z
**Update** (2023-02-02): Coil has discontinued its automatic browser-based monthly micro-payment subscription service. I have no doubt its poor transparency regarding where your money went contributed to the service’s demise.

Coil was a one-stop subscription service to support online creators. Coil customers must either install the Coil extension in their web browsers, or use a compatible browser like the [Puma Browser](https://www.pumabrowser.com/?ref=ctrl.blog). The service will reward participating websites and creators based on how much time Coil customers spend on their content.

Coil pays creators per second using the company’s “streaming payment” technology called [Web Monetization](https://webmonetization.org/?ref=ctrl.blog). I’ve previously theorized on [Coil’s per-second payment rates](https://www.ctrl.blog/entry/coil-web-monetization/), and the fees it charges. I say “theorized” because Coil doesn’t want to talk about fees, rates, or how their system works.

Coil says it designed its service with privacy in mind. It doesn’t collect any information on the websites you visit or even who you pay. That sounds good in theory, but it also makes the service opaque. Who, exactly, gets a share of your monthly subscription? Does Coil pay anyone or keep the money for itself?

Coil doesn’t track your web browsing habits and even [anonymize who you’re paying](https://web.archive.org/web/20200606130049/https://coil.com/p/sharafian/Doubling-Down-on-Privacy/cD%5FZiwT2J) through the service. Coil doesn’t want its customers to think about these things either.

Stefan Thomas, CEO of Coil, discussed the product decisions that lead to this in [a talk at the Future of Micropayments](https://www.youtube.com/watch?v=STRtiRci8RY&ref=ctrl.blog) virtual conference. In his talk, Stefan discussed how Coil was designed to automate the payment decisions and pay creators per second spent. Coil wants to avoid the mental cost of thinking about who deserves to get paid a fraction of a cent. The mental overhead can outweigh the tiny monetary value that is paid, and risks driving customers to decision fatigue and ultimately make them leave the service.

> “That creates an interesting market for companies like Coil or Flattr to come in and say, ‘we’re going to get really good at making those decisions on your behalf, and if you don’t think we’re doing a good job — you can go to one of our competitors.’ But we’re going to try and compete on the way we think you would try to do it, \[and\] make the decisions you would make if you had the energy and time to think about it all the time.”

Stefan Thomas, CEO of Coil, Future of Micropayments 2020

At the time of publication, Coil doesn’t have any competitors using its open Web Monetization protocol. Customers can’t choose another provider that’s more transparent or makes different micro-decisions about which creators to support. The lack of competition gives Coil the freedom to do as it wants. However, the lack of transparency and openness about the allocation of funds also makes people distrust the whole automatic micro-payments ecosystem.

I agree with Mr. Thomas’ points in principle; people shouldn’t have to waste their time making micro-decisions for every micro-payment and webpage they visit. Where and how you spend your time online decides who gets a share of your monthly Coil subscription. That isn’t the same as saying that you don’t want to be able to check where your money went after the fact. You can check your browser history to see what websites you’ve visited, and there are tools to analyze and make pretty graphs of it. Coil needs to build the same sort of tools for visualizing what happens with the monthly funds you’ve paid to and through the service.

I also believe that Coil has taken away a little too much control and transparency. Coil’s model assumes you want to pay if you’re consuming a website or creator’s content. Sometimes you explicitly don’t want to support a specific website or creator, even though you occasionally encounter content from them. Coil needs an option in its extension to block websites and creators from receiving payments.

[PayTracker](https://dev.to/wobsoriano/introducing-paytrackr-an-easy-way-to-keep-track-of-all-your-micropayments-4m31?ref=ctrl.blog) is a third-party web browser extension that records the transaction made by the Coil extension. It keeps a ledger of which websites you’ve visited and how much you’ve paid each one through Coil. The extension only has an all-time tally, and it can’t break down your spending by month/payment cycle.

The PayTracker extension only works with a single web browser. It doesn’t sync between your browsers and devices, and can’t track Coil transactions made with third-party Coil clients like the Puma Browser or [Imgur Emerald](https://imgur.com/emerald?ref=ctrl.blog). So, how do you know that Imgur or Puma Browser won’t siphon off your entire monthly subscription in the background? You don’t.

This is the heart of Coil’s transparency problem, and it’s one no third-party can’t fix. You have to trust the service to do the right thing, and they don’t offer any insight into what happens with your money. Coil’s business model also raises questions on what happens to funds you don’t spend on creator content. Does Coil pocket the money? or does it redistribute the money to participating creators?

Coil should at least show a monthly summary of how much of your subscription has been paid out to creators. It should also be more open about its fees, and record details on which clients made the payments (e.g. “50 % Firefox extension, 40 % Puma Browser, and 10 % Imgur Emerald.”) These are details the company already has without any need to collect additional data from its customers.

That being said, Coil *should* collect some additional details about your browsing. E.g. it could record the number of creators you’ve paid and the average payment size to each creator. (Though, it might already have that data too!) Coil should also track the broad categories of the websites you support through the service (e.g. news, social, sports, blogs, etc). There isn’t any personal information in these details, and the data can help prove that the service is doing what it’s supposed to.

#### Sources

- [Coil and the attention economy](https://www.youtube.com/watch?v=STRtiRci8RY&ref=ctrl.blog), 2020-10-10, Stefan Thomas, Future of Micropayments 2020, YouTube
- [Introducing PayTrackr](https://dev.to/wobsoriano/introducing-paytrackr-an-easy-way-to-keep-track-of-all-your-micropayments-4m31?ref=ctrl.blog), 2020-05-30, Robert Soriano, DEV
- [Doubling Down on Privacy](https://web.archive.org/web/20200606130049/https://coil.com/p/sharafian/Doubling-Down-on-Privacy/cD%5FZiwT2J), 2020-05-11, Ben Sharafian, Coil
### GNU Parallel can do anything, but scripting may be the better option
URL: https://www.ctrl.blog/entry/not-gnu-parallel/
Last updated: 2026-08-23T22:14:59.000Z
[GNU Parallel](https://www.gnu.org/software/parallel/?ref=ctrl.blog) is a utility that lets you run command jobs in parallel; on local and on remote hosts over the network. It’s incredibly powerful when you need something more flexible than [xargs](https://pubs.opengroup.org/onlinepubs/9699919799/?ref=ctrl.blog), and it’s especially useful with small computer clusters.

You don’t need to set up and configure anything. There is no long-lived daemon process or central scheduler, as is customary in [distributed compilers](https://www.ctrl.blog/entry/how-to-icecc-distributed-compiler/). You only need to set up key-based authentication for each remote host (so parallel can log in automatically), and install Perl and Parallel on each system. That’s it.

You can configure it to transfer files from anywhere on your local system to a remote host. However, it can’t transfer files back to any directory other than the current working directory. For whatever reason, my odd jobs often involve moving files between different directories, and GNU Parallel complicates that tremendously. You’ll need to introduce more complications in the form of another tool to move files elsewhere on your system.

GNU Parallel can help you get jobs done quicker, but you need to do a cost-benefit analysis before you use it. Its command syntax is unique and non-intuitive for command-line users. Getting it up and running can be a real head-scratcher. I spend hours in the command line every week, but I can’t make heads or tails of Parallel’s unique syntax.

I recently wanted to use GNU Parallel for a time-consuming job that was excellently suitable for parallelization. I needed something to send files to a remote cluster, execute a few commands, wait for them to finish, and transfer the results back. GNU Parallel is perfectly suited, but it took me hours to get going, and even longer to get it just right.

Most of that time was spent reading and re-reading the manuals for `parallel`, `rsync`, and `ssh`. GNU Parallel is built on top of the latter two tools, and you need to be very familiar with both to intuit how `parallel` will behave in different situations. The different arguments you give `parallel` often influence the underlying tools in ways not detailed in the manual.

Over the years, I’ve often expected to be able to quickly set up GNU Parallel and put it to use for odd jobs now and then. However, I never seem to develop any familiarity with it and always run into unique problems that I’ve never experienced before. My requirements change just enough every time that my cheatsheet and notes from our previous encounter are of no help to me in the present.

Its manual page is excellently written, but also practically incomprehensible unless you’re already very familiar with the tool. The tool is meant to solve complex problems, so its workings and documentation are necessarily also complex. However, the examples often demonstrate how one command works in conjunction with other commands and special syntaxes. The examples make me feel like I’m watching a magician pull tricks up from a hat, and I still don’t have a firm grasp of how the command is supposed to work.

There are also many situations where GNU Parallel behaves unexpectedly, or when combining arguments cause the underlying tools (primarily `rsync`) to change behavior in unexpected ways. For example, the `--cleanup` argument is outright dangerous! It tries to recursively remove files and directories it has transferred files into instead of just the files themselves. You can easily end up instructing it to delete system-critical directories like `/tmp` or personal directories like `~/Documents`. Use it with great care!

As many times before, I managed to get GNU Parallel to work in the end. I felt like it fought me every step of the way, though. However, I ended up spending way more time than I’d expected, and it needed a metric ton of scaffolding and helper scripts. I needed multiple scripts to prepare the data sources and arguments into a format useable to GNU Parallel. I needed a script to move the returned result files to the right locations. It’s tricky to work with GNU Parallel with files existing outside the current working directory. GNU Parallel can do it, but the specifics require digging through the manual for an hour.

I believe part of the problem is that I’ve attributed GNU Parallel more credit than it’s due. I often seem to shoe-horn it into my workflow, but it just never seems to fit. In essence, GNU Parallel handles queueing of multiple input data sources, transferring files to remote hosts with `rsync`, and executing commands remotely with `ssh`. It’s frankly easier to do this with a quick Ruby script than with GNU Parallel.

This is the core of my problem with GNU Parallel: The simple tasks it can solve can also be achieved with a simpler tool like `xargs`, and the more difficult tasks are easier to accomplish with a full scripting language. I end up writing scripts to pre-process and prepare the tasks anyway. I can just as well execute the tasks through the same task generator script; without complicating the process by involving GNU Parallel. I don’t believe I’ll reach for GNU Parallel again in the future.
### Set Store apps as the default for arbitrary file types in Windows 10
URL: https://www.ctrl.blog/entry/win10-store-default-apps/
Last updated: 2026-08-23T22:24:35.000Z
Windows won’t let you open arbitrary files with apps installed from the Microsoft Store unless it knows the app can handle the file type. App developers provide information about supported file extensions and protocols when they submit the app to the store. Windows 10 doesn’t make it easy for power users to override this list. Here’s the least painful way to do it.

It should be as easy as right-clicking on a file and choosing Open With, and selecting the program you want to use. However, Open With (that’s the name of the program that lists programs and handles file associations) won’t list programs that haven’t registered a file association.

Traditionally, you’ve been able to use Open with and choose to Look for another app on this PC. This will bring up a file chooser dialog where you can choose what program to run. Locating the right program on disk isn’t easy unless you’re familiar with where they’re typically installed. Locating a Store app is practically impossible.

By default, Microsoft Store apps install into a folder at `%ProgramFiles%\WindowsApps`. This is a special protected system folder that not even administrative users have access to. You can find tutorials showing you how to access it, but this requires that you remove the security locks entirely. However, don’t need to access this folder directly, so you should leave its security protections in place.

Some Store apps, such as the Kate text editor and Okular document reader, create app execution aliases. App execution aliases add an app’s preferred executable file name into the PATH variable on Windows. Anything in the PATH can be launched from the Run dialog, Terminal, PowerShell, or even the File Explorer location bar. The aliases are added to the `%LOCALAPPDATA%\Microsoft\WindowsApps` folder. The folder can be accessed by a regular user without modifying any security policies.

To be honest, I don’t know what dark magic or system calls are involved in getting app aliases to run. The aliases aren’t regular Windows shortcut files (.LNK) or file system junctions. They’re zero byte files with no special file system attributes or anything out of the ordinary. You can run them and launch their associated programs through the Start Process system call, but no other method works (such as double-clicking on the executable file).

**Update** (2021-04-11): Windows finds app aliases because of [App Path registrations](https://learn.microsoft.com/en-us/windows/win32/shell/app-registration?ref=ctrl.blog). These registrations won’t help Open With find the app, though. I still don’t know the purpose of the 0-byte executable files.

The file chooser can show you a list of installed programs, including Store apps, by typing `shell:AppsFolder` into the location bar and hitting enter. In theory, that’s how it should work. While this works in the File Explorer, this path won’t list any installed programs in the file chooser dialog.

You can make shortcuts to Store apps by dragging them out of the `shell:AppsFolder` and onto the Desktop. Unfortunately, Open With is finicky and also won’t let you choose to open files with a shortcut (.LNK) file (even when it points to an executable). At this point, we’re starting to run out of options. Maybe compromising the system’s security measures isn’t such a bad idea after all?

So far, I’ve only reiterated things that should have — but doesn’t work. It’s time to move on to a solution that will work. Here’s how to make Store apps appear in the Open With menu. This also lets you set them as the default app for a given file type.

1. Start the program you want to use to open your file.
2. Open the Task Manager (search for it in the Start menu).
3. Click More details at the bottom if it opens in simplified/compact mode.
4. Find your program in the list and double-click to expand it.
5. Right-click on the main process entry in the expanded list. It’ll have the same icon and name as the program, and will be near the top of the list.
6. Choose Open file location
7. Select the path in the navigation bar and copy it.

You can see from the path that you’re now in a folder inside the protected `%ProgramFiles%\WindowsApps` folder. You should see a program file in the folder list. If you’re uncertain about which file it is, then repeat steps 5–6 and Windows will highlight it for you.

1. Find the file you want to open in a File Explorer window.
2. Right-click it and choose Open with or Open with: Choose another app.

If nothing happens at this step, then please take a minute to curse Microsoft for how buggy Windows 10 is. This is a common bug since Windows 8\. You’ll need to log out and back in again. If you’re comfortable with the terminal, you can instead run the command `openwith.exe c:\path\to\your.file`.

1. Scroll to the bottom of the list of apps, and choose More apps.
2. Scroll to the bottom of the expanded list and select Look for another app on this PC.
3. This opens a file chooser. Paste the path you copied in step 7 into the navigation bar and press Enter.
4. Select the program file (the one that got highlighted in step 6), and click OK.

And you’re done! Maybe. Windows sometimes set the program you’ve selected as the default for the file type after completing the above process. For example, Windows refuses to change a class of protected file type (including .HTML and .PNG) using the above method. Here’s how to change the default type when Windows is stubborn.

1. Select a file of the type you want to open, e.g. a .PNG file, in the File Explorer.
2. Right-click on the file and choose Properties.
3. Under Opens with, click Choose.
4. Repeat steps 10–13.
5. Click Apply.

Because Windows is a well-written operating system without any bugs, you shouldn’t have any more issues getting it to use your preferred programs. Unless it resets the file associations after you reboot the system or install a major feature update. Unfortunately, this is a common problem. If this only happens to one type of files, then the following method should work:

1. Repeat the above procedures to set your preferred program as the default for a file type.
2. Open the Windows Settings app: Apps: Default apps, and select Choose defaults by file type.
3. Locate the file type in question in the list. It should show your preferred program. If not, then repeat steps 14–18, close the Settings app, and retry from step 19 onward.
4. Click on the app name next to the file type in question in the list.
5. The expanding list won’t include your current choice, and this is fine. The list only displays apps Windows knows can handle the file type (as discussed above).
6. Press the Escape key.
7. Close the Settings app.

The above steps may seem a bit meaningless, but it makes Windows save your preferences. It often fixes this type of problem. If it doesn’t work or if it affects multiple apps and file types, then your file and protocol association registry may have been corrupted Your best bet is to reset the database, reboot, and try again. Note that you’ll need to reconfigure all file types and preferences such as the default web browser after resetting it.

1. Open the Windows Settings app: Apps: Default apps, and click Reset.
2. Reboot your computer.
3. Repeat everything from step 1 onward.

I hope we’ve got everything sorted out by now. Now is a good time to consider leaving Windows behind and switching to Linux or MacOS instead. The simple operation of opening and assigning default programs to handle files is something every other operating system does better than Windows.

I hope that one day, Microsoft will just rip out everything related to file and protocol associations and start over. This foundational part of Windows was poorly designed and has been broken and prone to all sorts of weird failures since at least Windows 95.
### Kitty Letter word-scrambled my brain
URL: https://www.ctrl.blog/entry/kitty-letter-scrambler/
Last updated: 2026-08-25T21:08:37.000Z
[Kitty Letter](https://theoatmeal.com/kittyletter?ref=ctrl.blog) is a free mobile game from the creator of [The Oatmeal](https://theoatmeal.com/?ref=ctrl.blog) webcomic. It’s a simple word game that quickly engraved an obsessive repeating pattern into my brain. Here’s my cautionary tale about the game.

In Kitty Letter, you unscramble words from a scattering of letters that appear through *an enchanted vortex from the multiverse of infinite vocabularinitie* (pictured below). You move your finger from letter to letter to form words, like a miniature swipe-to-type keyboard. Every word you find spawns magical cats that march across the street to explode your neighbor’s house. Your neighbor started the exploding cat barrage, so it is morally fine to fight back.

![The letter vortex is colorful and oddly enticing.](https://cdn.synaps.media/control/content/images/2026/08/kitty-letter-vortex-1.png)

I’m not a fan of The Oatmeal webcomic, but the game looked cute when I saw it [mentioned on The Verge](https://www.theverge.com/2021/2/11/22278773/kitty-letter-mobile-game-ios-android-the-oatmeal-exploding-kittens?ref=ctrl.blog "“Kitty Letter is a new mobile word game from the creator of The Oatmeal, and it’s good”"). I thought it would be an okay way to kill a few minutes of downtime. We’re only a quarter into the pandemic year of 2021, but it feels like it has lasted about a year already. Somewhat ironically, the game sat on my phone for a few weeks before I found the time to give it a go. 

I then started playing it for about six–ten minutes each day for a week. I wouldn’t call that excessive, but it was a little hard to put it down when I’d gotten started. After three weeks, I’d played 108 online matches; each game lasting a little over two minutes.

After the second week, I started to picture the letter vortex in my mind. I would swipe at letters in my mind, and they would always conveniently form the random word I was trying to type. Repetitive actions and patterns create habits, so I thought I was mentally making a habit out of the game. I didn’t think too much about it at first.

After another few days, the vortex and the mental swiping would pop up in my head at random times throughout the day. I would involuntarily unscramble word after word and couldn’t clear the picture of the letter vortex from my mind. Then I started having trouble falling asleep.

I didn’t feel an urge to play the game, though. I wasn’t fantasizing about winning or playing the game. I was solely thinking about joining up letters to form words in the vortex. Is it a game addiction when I didn’t feel an urge to play the game? I felt good about my kill/death ratio of 1,76 as a non-native English speaker. Though, I can’t say I enjoyed playing the game or even winning all that much.

I stopped playing the game, and I didn’t have an urge to pick it up again. However, it took about five days after quitting before I no longer saw the letter vortex in my mind’s eye. I have, obviously, uninstalled the game from my phone.

As I’m writing this, I’ve noticed that just looking at the above illustration of the letter vortex sets me off. My brain begins on a w-i-l-d c-h-a-s-e f-o-r m-o-r-e w-o-r-d-s. It’s difficult to break out of it once I get going. I can’ explain what it is with this game in particular that triggers me.

It’s not the first time I get hooked on a game, but it’s the first time it has disrupted my thoughts in daily life. People aren’t always good at recognizing when something isn’t good for them. I’m glad I could recognize that this game wasn’t good for me.

**Via:** [The Verge](https://www.theverge.com/2021/2/11/22278773/kitty-letter-mobile-game-ios-android-the-oatmeal-exploding-kittens?ref=ctrl.blog)
### Get Meltdown Alert notifi­cations for PlanetSide 2
URL: https://www.ctrl.blog/entry/planetside2-meltdown-notifications/
Last updated: 2026-08-23T22:15:31.000Z
I’ve made a small new webapp that sends you a notification at the beginning of Meltdown Alert events in PlanetSide 2! Get notified when it’s the perfect time to join the battlefield on Auraxis!

[PlanetSide 2](https://www.planetside2.com/?ref=ctrl.blog) (PS2) is a free-to-play/pay-to-customize massively multiplayer online first-person shooter game. In PS2, three factions fight for dominance over the four continents on the planet Auraxis. Each continental round concludes after a faction controls enough territory to trigger a Meltdown Alert event.

During Meltdown Alert events; players receive a 25 % experience boost, and a sum of certification and ISO-4 implant points. The victorious faction also gets a bonus status effect from controlling the continent. Each event lasts up to 90 minutes. It’s a good time to join the fight on Auraxis, in other words!

To help players get into the game at the most opportune time, I’ve created a small webapp. The webapp, simply called [PlanetSide 2 Alert Notification](https://www.daniel.priv.no/tools/ps2alerts/?ref=ctrl.blog), does what it says on the tin. It sends notifications to your PC or phone, so you get a heads-up at the beginning of a new Meltdown Alert event. You’ll only get notifications for your game server you play on.

Note that you must keep the webpage open in your web browser to receive notifications! I might set up push notifications in the future. I can improve the service in the future if there’s enough interest.

Frankly, I was surprised that none of the existing Meltdown Alert tracking services didn’t already offer notifications. You can get alert tweets from [Fisu’s tracker](https://ps2.fisu.pw/alert/?ref=ctrl.blog) on Twitter, but you’ll see alerts from every server. [PS2Alerts](https://ps2alerts.com/?ref=ctrl.blog) has nice historical stats and data from all servers. There’s also an extension for Chrome, but it hasn’t worked in years.

I hope you’ll find this useful, and maybe help keep players coming back to the game. It should at the very least be useful for ISO-4 farmers! You can only earn this in-game currency by participating in Meltdown Events, and from some rare daily missions.

The webpage talks directly with the developer’s servers without first going through my servers. The benefit (to me) is that I don’t have to operate and pay for any server infrastructure. The main drawback is that I can’t do push notifications (JavaScript Service Workers can’t fetch data from foreign origins.)

The webapp pulls data from the game servers every four minutes. On average, you’ll get notified two minutes into an event. This is well within the time-requirement to get the full reward pay-out for participating in the event.

Alert notifications can optionally play the games iconic/annoying “Wah! Wah! Wah-wah, Wah!” alert sound. Your web browser might block websites from playing sound, so you need to check your browser’s audio permissions.

I’m obviously hoping that this tool only will get used by New Conglomerate players on the European/Cobalt server. 😉 (It often *feels* like there’s a lot more Vanu Sovereignty and Terran Republic players online!) I’ll see you on Auraxis during the next Meltdown Alert!
### Jellyfin and metadata privacy
URL: https://www.ctrl.blog/entry/jellyfin-metadata-proxy/
Last updated: 2026-08-23T22:12:16.000Z
I [recently migrated](https://www.ctrl.blog/entry/jellyfin-vs-plex/) my home media server to [Jellyfin](https://jellyfin.org/?ref=ctrl.blog). One of the advantages of using it is that it can supplement your (mainstream) media collection with poster graphics and rich metadata pulled in from sources like [The Movie Database](https://www.themoviedb.org/?ref=ctrl.blog) (TMDb) and [TheTVDB](https://thetvdb.com/?ref=ctrl.blog). As with everything that talks to someone else’s servers, this feature comes at a cost to privacy.

To gather more information about your media collection, Jellyfin needs to share what it already knows about it with the metadata provider. Typical data includes the title and release year (extracted from the file or its path) for movies, and the same plus parent and grandparent directory names for TV shows. In some situations, more data may be transmitted.

After a quick reading of TMDb and TheTVDb’s privacy policies, I know that they both reassure me that they care about my privacy and that they don’t sell my data. But they do share it with commercial partners for various purposes, including advertising. Presumably for a profit? So, … yeah.

Your media collection is probably unique, and thus make it a suitable source for digital fingerprinting. No one else has the exact same combination of movies and TV shows as you do. The bigger the collection, the more unique its fingerprint is. I’ve discussed this kind of fingerprinting in more detail in an [earlier article in the context of feed readers](https://www.ctrl.blog/entry/feed-reader-fingerprint/).

Luckily, it’s possible to enjoy the metadata downloader feature and still preserve your privacy. Note that this won’t help if you’ve got family movies, unique media, or media files that contain personal information in your collection. Make sure these types of personal media files are kept in libraries where metadata plugins are disabled.

Instead of downloading metadata from your Internet Protocol (IP) address, you can obscure the source address (the IP) of the traffic through [Tor](https://2019.www.torproject.org/about/overview.html.en?ref=ctrl.blog). Tor is a free service for anonymizing the source of your network traffic. Routing Jellyfin’s metadata look-ups through it can help conceal your IP address and thus your location. This makes it more difficult to combine the data with your other online activities. You can of course adjust the example to use a commercial proxy service instead.

In this tutorial, I’ll assume you’re using a modern Linux distribution. I’ll assume you’ve already installed Jellyfin and Tor through your Linux distribution’s package manager and run them through `systemd` (this will be the case on most distributions). The concepts are applicable under other operating systems and in container environments (e.g. Docker or Podman), but the exact tools and procedures will differ.

You’ll first need to enable the HTTP proxy tunnel feature in Tor. By default, Tor only enables a socket proxy. To enable this feature, locate the `torrc` runtime configuration file (it’ll likely be located in `/etc/torrc`). Add the following option to the configuration file:

```
HTTPTunnelPort 9049
```

Enable and start the Tor service, or restart it if it’s already running:

```shell
systemctl enable --now tor.service
systemctl restart tor.service
```

Next, you’ll need to modify the Jellyfin service to route its traffic through the Tor proxy service. Additionally, we’ll use a [systemd application firewall](https://www.ctrl.blog/entry/systemd-application-firewall/) to block the Jellyfin server from communicating with the internet without going through the proxy. Jellyfin is written in .Net and uses the HttpClient Class to talk to the internet. On Unix-like operating systems (including FreeBSD, Linux, and MacOS), HttpClient reads the proxy configuration from the environmental variables `HTTP_PROXY` and `HTTPS_PROXY` (or `ALL_PROXY`).

Open a text editor with a `systemd` service override file (`systemctl edit jellyfin.service`), and paste the following configuration:

```ini
[Service]
# set proxy env. var. to Tor
Environment=ALL_PROXY=http://127.0.0.1:9049
# block all network connections
IPAddressDeny=any
# allow access to localhost (the Tor proxy)
# allow access to local net (inc. home NAS,
#   Chromecast, phone apps, etc.)
IPAddressAllow=127.0.0.1
IPAddressAllow=10.0.0.0/8
```

This configuration assumes your local network is in the 10/8 subnet. Your Jellyfin server won’t be able to connect directly to the internet, and it won’t be remotely reachable anymore. You’ll need to adjust the firewall options if you’re using a different subnet, or have other network requirements.

You can also remove the proxy configuration from the above example to prevent Jellyfin from connecting to the internet. This may be useful if you don’t need any remote internet services for your media server. Please note that the .Net HttpClass doesn’t support SOCKS proxies, only HTTP proxies.

Lastly, you’ll need to reload and restart the Jellyfin service to apply the changes.

```shell
systemctl daemon-reload
systemctl restart jellyfin.service
```

These instructions can easily be adapted for Plex, Emby, or other media servers. However, Jellyfin is more suited for this kind of setup as it doesn’t need to connect to a central server for premium or streaming features. Jellyfin also doesn’t collect any analytics or telemetry data, and might be the best choice for any privacy-minded users.

#### Sources

- [systemd.resource-control man page](https://www.freedesktop.org/software/systemd/man/systemd.resource-control.html?ref=ctrl.blog), version 247, 2020-11-26, FreeDesktop.org
- [HttpClient Class](https://learn.microsoft.com/en-us/dotnet/api/system.net.http.httpclient?view=net-5.0&ref=ctrl.blog), 2020-10-30, .Net, Docs, Microsoft
- [HttpClient.DefaultProxy Property](https://learn.microsoft.com/en-us/dotnet/api/system.net.http.httpclient.defaultproxy?view=net-5.0&ref=ctrl.blog), 2020-10-30, .Net, Docs, Microsoft
- Jellyfin server, version 10.6.4, 2020-08-30, Jellyfin project
- [Privacy Policy](https://thetvdb.com/privacy-policy?ref=ctrl.blog), 2020-01-01, TheTVDB, Whip Networks
- [Privacy Policy](https://www.themoviedb.org/privacy-policy?ref=ctrl.blog), 2019-12-31, TMDb, TiVo
- [tor man page](https://2019.www.torproject.org/docs/tor-manual.html.en?ref=ctrl.blog), 2019-11, Tor Project
### From Plex to Jellyfin Media Server
URL: https://www.ctrl.blog/entry/jellyfin-vs-plex/
Last updated: 2026-08-23T22:12:18.000Z
I’ve used the Plex Media Server for over a decade. It’s been my primary way to catalog and watch my movie and TV show collection. Plex can neatly organize media, fetch metadata and movie posters, and keeps track of what and how far you’ve watched your media files. It can also transcode and stream media in multiple multimedia codecs to ensure compatibility with all types of devices and screen sizes.

It’s been great, but Plex has steadily changed in an unwanted direction. It keeps insisting I sign up and login through their web portal instead of using the front end for my local Plex server. Recently, I opened up Plex and couldn’t find my own content. My media content had been pushed aside into a submenu while the app promotes its own streaming media and premium services instead.

I just wanted a media server to be the hub for my own media collection. I’m sure that getting paid is a better business model for Plex. The parts of Plex I used have remained virtually unchanged for almost a decade. I’m not interested in Plex’s incredibly tiny movie catalog (in my region) or its premium membership offerings. Plex is becoming something I’m not interested in. It was time for a change.

I had a brief fling with the [Emby Media Server](https://emby.media/?ref=ctrl.blog) before I decided to move from Plex to [Jellyfin](https://jellyfin.org/?ref=ctrl.blog). Emby used to be a free and open-source media server alternatives to Plex. Jellyfin is a fork of Emby at the point where the software went commercial. However, the Emby web player and apps feel far less polished than Jellyfin. Emby has added some extra features behind a premium monthly subscription. Fearing another Plex, I decided against using Emby in favor of Jellyfin.

Jellyfin is very similar to what Plex Media Server used to be. It offers the same media cataloging, automatic metadata and art downloading, keeps track of what I’ve watched, and has the same transcoding capabilities as Plex. It has apps and a web player you can connect to your local media server. Jellyfin is pretty much a drop-in replacement for Plex Media Server’s core functionality.

Jellyfin gets its metadata from a variety of online sources such as [The Movie Database](https://www.themoviedb.org/?ref=ctrl.blog) (TMDb). I’ll go into more details on metadata retrieval and your media library privacy in [a later article](https://www.ctrl.blog/entry/jellyfin-metadata-proxy/).

The Jellyfin Android TV app is slightly worse than Plex’s, but they’re both dreadful to navigate with a remote control. Neither apps do a good job with subtitles and subtitle customization. Instead of the apps, I watch media via the Jellyfin web player instead of in a web browser on my home theater computer (HTPC).

A notable difference from Plex is that the Jellyfin web player uses larger interactive elements and text. The Jellyfin web player is easy enough to use, but I can’t claim it’s very intuitive. It takes a few minutes to get familiar with it. Probably due to its free software heritage, Jellyfin supports custom stylesheets (“UserCSS”). I’ve used this feature to great effect and increased the size of a few key buttons and text labels.

I’ve also used custom stylesheets to make subtitles just ever so slightly larger than the default. I’ll never understand why all TVs and multimedia apps insist on only three subtitle text size presets: tiny, small, or humongous. Where’s the “The TV is just slightly too far away. Please increase the text size by like 5–10 %. (I don’t need glasses!)” option?

My only remaining issue with Jellyfin is that the server doesn’t inhibit the system idle state while it’s playing media. That is to say, the server may suspend to save energy — cutting off mid-stream — because it doesn’t think anyone is using it. Jellyfin lives on my HTPC and I definitely want to remain powered down for most of the day when it’s not in use. I’ve opened [a feature request](https://features.jellyfin.org/posts/1060/inhibit-system-idle-when-watching-transcoding-media?ref=ctrl.blog "Request #1060: Inhibit system idle when watching/transcoding media") to get this fixed. However, I might be able to work something out with the Jellyfin plugin API. 

I migrated away from Plex just a week before its much [over-publicized “security issues”](https://arstechnica.com/information-technology/2021/02/ddosers-are-abusing-the-plex-media-server-to-make-attacks-more-potent/?ref=ctrl.blog "“DDoSers are abusing the Plex Media Server to make attacks more potent”") last month. I just want to go on the record and say that my decision had nothing to do with this incident. The “security issue” boiled down to Plex not behaving ideally on mismanaged and insecure network configurations. In my opinion, Plex isn’t to blame for security errors in network configurations made by inexperienced network administrators. 

I can’t think of any features from Plex that I miss in Jellyfin. I especially don’t miss the video playback issues I’ve had with Plex when rewinding videos. Overall, I’m happy with Jellyfin as a replacement for Plex.
### Be wary of file sync conflicts with KeePass apps on Android
URL: https://www.ctrl.blog/entry/keepass-file-conflicts-android/
Last updated: 2026-08-23T22:12:28.000Z
[KeePass](https://keepass.info/?ref=ctrl.blog) is a tried and tested open-source encrypted password manager available for Windows. You can also use one of the many forks for Android, iOS, Linux, MacOS, and other operating systems. KeePass has created the defacto standard for encrypted password vault/database files (`.kdbx`). Syncing the vault files between your computers and Android can cause problems with some KeePass apps, however.

KeePass (and its many forks) stores your passwords encrypted in a secure vault/database file. Unlike other password managers like LastPass and Bitwarden, you’re solely responsible for storing and backing up your password vault. You can transfer the vault file between computers with [Syncthing](https://syncthing.net/?ref=ctrl.blog), Resillio, Dropbox, OneDrive, Google Drive, a floppy diskette, or however you prefer moving your files around. Multi-computer set-ups with file synchronization introduces the risk of file synchronization delays and conflicts.

For example, say you have KeePass open on your laptop and your desktop computer simultaneously. KeePass will detect changes to the database file and reload it automatically. They also read the file anew before saving any changes to be doubly-sure they don’t overwrite any remote changes. The pull-before-push file handling pattern will help prevent file synchronization conflicts and data loss in everyday use.

The password database can still get out of sync, e.g. due to a temporary loss of networking, and this will still cause conflicts. Ideally, you should choose a file synchronization program or cloud storage solution with file version history. In case of a sync conflict or overwritten changes, you can restore old versions of the password database from the file version history.

You can find several KeePass-compatible password managers for Android in the Google Play Store. Some have millions of active installations, so these apps are quite popular. Unfortunately, many of these apps don’t handle remote changes to the KeePass vault file as well as their computer app brethren.

To compound the problem, cloud storage and file synchronization often gets delayed on mobile apps due to stricter background power- and data-saving policies. A file synchronization app might not run until you unlock your device and have already opened your preferred KeePass app. After you’ve opened your KeePass app and unlocked your vault, a new version of your vault might be downloaded in the background. That’s a potential data loss disaster waiting to happen.

I’ve tested how the five most popular KeePass-compatible apps for Android handle a simple database conflict. The test was quite simple: I opened the database on my Android phone and my computer simultaneously. I added a new entry to the database on my computer and waited until the updated database file had synced to my phone. I then added a new entry on my phone, and inspected how the app handled the conflict.

Just to get the bad apps out of the way first. The following list of apps failed my tests completely and just overwrote my remote changes with no questions asked.

- [KeePassDroid](https://www.keepassdroid.com/?ref=ctrl.blog)
- [KPass](https://www.korovan.com/kpass?ref=ctrl.blog)
- [AuthPass](https://authpass.app/?ref=ctrl.blog)

You should avoid using any of the above apps if you use KeePass on more than one device. Luckily, there are two more KeePass-compatible Android apps, and these two do a better, if not perfect, job at avoiding sync conflicts.

The [KeePassDX](https://www.keepassdx.com/?ref=ctrl.blog) app automatically detects that the database file has changed and tells you about it. It tells you to reload the database file, but it leaves it up to the user to cancel what they’re doing (discarding any unsaved changes in the process), go to the main app view, open the hamburger menu, and tap to reload the database. If you ignore the message, the app will overwrite any remote changes if you save any changes.

[KeePass2Android](https://github.com/PhilippC/keepass2android?ref=ctrl.blog#readme) automatically detects changes to the database file and prompts you to merge or overwrite it. Merging does a pull-before-push write, whereas an overwrite discards the remote changes. Worryingly, the merge option often causes the app to crash, but I haven’t actually lost any changes made in the app or remotely. The app doesn’t have a setting to remember your preferred conflict resolution method.

The merge and overwrite buttons in KeePass2Android are very close together and not visually differentiated. You can easily click the wrong button if you aren’t super careful. This is UI issue is partly the fault of Android’s material design language. It doesn’t differentiate between regular buttons and destructive buttons, e.g. buttons that cause irreversible data loss.

Neither of these Android apps does a superb job, but either one should help you avoid accidentally overwriting recent changes in your password vault. KeePass2Android does a better job at this one task, but KeePassDX will help you get set-up and going faster. Both apps come with a built-in password-entry keyboard and support for auto-filling passwords (in supported browsers and apps). Note that neither apps reload the database file if you use their quick-unlock features!

I’m getting a little off-track with app reviews here toward the end, but I’ll finish off with one last recommendation. KeePass for Windows is starting to show its age. For Linux, MacOS, and Windows; I recommend you try [KeePassXC](https://keepassxc.org/?ref=ctrl.blog) instead. I believe you’re more likely to have a good experience with it than the vintage KeePass version. Both can handle external changes to the password vault file without problems.

The original KeePass project has a [database synchronization feature](https://keepass.info/help/v2/sync.html?ref=ctrl.blog) it uses to resolve conflicts. The feature lets you sync database changes between a local database copy and a golden copy residing on a remote server. It can even help resolve conflicting changes, although that usually isn’t a big problem unless you try to make multiple changes to the same database entry. This feature is quite complex and rarely supported in any of the forked projects. However, you’re more likely to run into a simpler file sync issue like the example discussed in this article.

KeePass can be a good option for your password management needs. The big caveat is, as already mentioned, that you must take responsibility for backing it up and versioning it. It involves a little more management work, but you stay more in control. In everyday use, you’ll find it no different than using LastPass, Bitwarden, 1Password, or one of the many commercial hosted password managers.

All the apps were reviewed on Android 11 using the latest app version available in the Google Play Store at the time of publication.
### Please don’t make me choose a username
URL: https://www.ctrl.blog/entry/usernames/
Last updated: 2026-08-23T22:23:49.000Z
I hate username fields in registration forms. The usernames I want are, of course, already taken. Many services won’t let you change your username later, so you might get stuck with it. Who wants to settle for a name they don’t like? Just *please don’t make me choose a username.*

Personal identity is hard. It molds and changes over time. Online identity is harder, but can often be more permanent. Many services won’t let you change your username without deleting the account and making another one. You’ll lose all your data with the service in the process. (Assuming you’re allowed to delete your account and set your email address free.)

Many services make do with just your email address. Your email address isn’t truly yours, but just a [rented identity](https://www.ctrl.blog/entry/email-identity-provider/). However, everyone still needs a unique name for services where you interact with other members.

Everyone has that colleague whose email address is snow­princess83 or something that sounds equally professional. What might sound cool and representative of you today, probably won’t just a few years later. Auto-assigned corporate usernames can be the worst, though. These are often derived from your name. My mother, Ann, always ends up with the unfortunate username “anal.”

You may also want to keep your online identities somewhat separate. Using the same username across services makes it easier for others to look up more information about your other hobbies and interests. Maybe you don’t want your poems or art associated with your full name, and film and anime interests. There are a million reasons why you might want to segregate your online personas.

I always, and quite optimistically, try my given name or initials first. It rarely works, but I’m thrilled whenever I land a sweet two-letter initials username or just “Daniel.” Of course, everyone wants a short memorable username, and that just isn’t possible. But when that doesn’t work out, I don’t have another strategy.

Twenty minutes later, after some trial and error with already registered usernames, the username field feels more like an impromptu creative writing prompt than a prompt for your preferred name. “Describe yourself in between five and 16 characters.” How can “scurvy­­face­­just­­let­­me­­log­in” already be taken‽ You’re wrecking your brain trying to come up with something original that also represents you personally. The more popular the service is, the harder it becomes.

Some of the difficulty in choosing unique usernames comes from artificial limitations. These are often the result of — often arbitrary — engineering decisions made early in a service’s lifetime.

For example, usernames are almost universally \[and needlessly\] limited to A–Z in the Latin alphabet. Expanding the allowed username characters to include diacritics and the various extended Latin character sets would greatly extend the number of possible usernames. Roughly 30 % of the world would be happy writing their usernames in different alphabets. Instead, services force them to transliterate their names into the limited Latin character set.

Gaming services, some of the world’s most populous online services, are quite progressive in this area. They often allow you to use large subsets of the global Unicode character set. Services including Battle.net, Discord, Steam, and Xbox allow you to choose whatever username you want! It doesn’t even have to be unique. Uniqueness is assured by adding a suffix that’s both a part of and separate from the user’s chosen name.

For example, I can set my Xbox username to be “Daniel.” Xbox realizes the name isn’t unique and renames the account something like “Daniel #12345.” The service shows the name with the suffix and suffix separator greyed out to emphasizes the user’s chosen name.

Getting stuck in a loop where every name you want is rejected is a terrible user experience. The Xbox naming scheme is a better compromise than forcing the user to come up with unique names. Users always get the username they want, and you’re never confronted with the uncomfortable need to settle for a less than ideal username.

At the end of the day, I just don’t want to spend any time choosing a username. Developers, I beg of you, please don’t make me choose. Please work out a better system than having your users waste their time trying to ensure a column in your database contains a unique set of characters.
### Don’t be shady, deploy your JavaScript source maps
URL: https://www.ctrl.blog/entry/deploy-javascript-source-maps/
Last updated: 2026-08-23T22:04:55.000Z
JavaScript source code minification is a beneficial tool for reducing download file sizes. However, the resulting obfuscation makes the code difficult to read, and reduces trust and transparency. Public source maps will help restore code readability and transparency. As a bonus, it enables others to learn from your code.

The Web Almanac 2020 found that [99,5 % of JavaScript is minified](https://almanac.httparchive.org/en/2020/javascript?ref=ctrl.blog#how-do-we-serve-javascript). It’s a more popular data-reduction strategy than using transport layer compression, which is [at only 85 %](https://almanac.httparchive.org/en/2020/javascript?ref=ctrl.blog#compression). However, the 2019 Web Almanac found that [only 18 % deployed source maps](https://almanac.httparchive.org/en/2019/javascript?ref=ctrl.blog#source-maps). This last number should be much higher.

A JavaScript minifier is a tool that will process your JavaScript sources to strip out comments, shorten variables and function names, and even rewrite the code to reduce its file size. Computers can still read minified code, but human-readability and niceties like white-space and formatting are lost in the process. Minified code is more difficult to debug and obscures what your code is trying to achieve. Computers are the primary audience for your JavaScript, so it makes sense to optimize for them. However, there’s no reason why you can’t minify your sources and still maintain human-readability.

The obfuscation is just a by-product of the minification process. The minifier can also generate a source map file. The source map file, together with the minified file, lets you restore the original human-readable source file. Browser developer tools will automatically download and apply source maps when they’re available. They also handle the mapping between the two on the fly when tracing or debugging the running code.

Source maps can be included inline in your JavaScript files. An inlined source map eliminates the file-size gains achieved through the minification process. The preferred delivery method is to ship source maps in a separate `.js.map` file referenced from the minified `.js` file. Referencing an external source map file only adds around 30–50 bytes to the uncompressed file size.

Many in the web developer community learned — or was at least introduced to — their craft by studying how other websites work. Your website probably could have been incredibly educational to a less experienced you. Don’t kick down the ladder behind you! Deploy your source map and let others study and learn from your code.

There are [12,4 million JavaScript developers](https://www.developernation.net/blog/infographic-programming-languages-adoption-trends-2020?ref=ctrl.blog) in the world, according to Developer Economics/SlashData. Some of them may be running your JavaScript code, and they know how to work with their browser’s developer tools. If something goes wrong with some component on your website, they might just pull up their developer console to see what went wrong. A source map could help land you a detailed and actionable bug report from such a valuable user.

I recently [analyzed Cloudflare’s Analytics script](https://www.ctrl.blog/entry/review-cloudflare-analytics/) to try and evaluate their privacy claims. Their code was minified and it took extra time to understand it, and I had to make educated guesses about the purpose of some parts of it. A source map could have made that job a lot easier.

There are some common arguments against deploying source maps that come up again and again, and I want to address these directly.

You might not want to share your source maps because you’re [worried about leaking information](https://levelup.gitconnected.com/automatically-generated-source-maps-could-be-revealing-your-private-projects-files-17b2d13d7da4?ref=ctrl.blog) related to security or internal systems. Sensitive information doesn’t belong in source code, or in any other plain text files, in any project. Minification, or even deliberate code obfuscation, can’t be used to secure sensitive information. Are there any passwords and other secret information laying around in your code or comments? Then *that* is your problem.

There are other ways to reduce the risks of your comments leaking something sensitive. You can remove the comments from your source code before minification (as a first-pass minification step), and then generate the source map from the commentless code. This is still a big improvement over not making available a source map.

You might be worried about [getting judged for your coding style](https://medium.com/@sujankanwar/enable-source-map-on-production-f2f53c5f4345?ref=ctrl.blog). You can clean up your code with a code beautifier before running it through a minifier. This will at least enforce a visual style guide on your code. Neither a minified or beautifier can make up for nor hide poorly written code. If you’re lucky, someone might send you a bug report or an idea to enhance your code. The code is already public even without a source map. A source map will, hopefully, make the code’s intended purpose clearer to others.

You might want to hide what your code is doing. Minification doesn’t achieve this. Its execution is entirely transparent to the browser, even though the minified function names makes it hard to tell what it’s supposed to do. If you run shady code client-side, motivated people will still be able to find out how the sausage is made. Stop doing sketchy and unethical things and you won’t have a reason to hide it.

You might worry that people can steal your hard work. Minification isn’t digital rights management (DRM). People can steal your minified code too. Client-side code in an interpreted language is open-source by its very nature. That doesn’t mean an open-source or copyleft license is automatically applied. Your legal rights, including distribution and licensing, are already protected by copyright law.

Maybe you’re using some open-source libraries or frameworks. Their license may require that you make parts or the entire source code available in its human-readable format. For example, the current version of the GNU General Public License (GPLv3) and its variants requires that the source is published in “the preferred form of the work for making modifications to it.” In English, that means the unminified version – or at least a version with the human-readable function names, comments, and intact formatting. A source map will help you comply with such license terms.

Your source maps can even be used as a recruitment tool. You can include a comment encouraging interested developers — who’re already poking around in your project’s workings — to apply to your company. Or maybe include information on how to report bugs. The minifier will strip out the comments, so you don’t waste your JavaScript byte budget. Your source map will make sure the message is only downloaded and seen by developers.

You could even attach a `Set-Cookie` HTTP header when your source maps are downloaded. The cookie could unlock a fake developer mode, a fun Easter egg, or modify your page layout to emphasize resources that are of interest to developers.

I’ve written over a thousand words already, and I haven’t even mentioned how beneficial it can be to you to have source maps available in production. It greatly simplifies debugging on your real product in the environment your users experience it. You can also debug anytime from just about any computer anywhere in the world.

There are clear benefits to deploying your source maps in production. So, what do you say? Will you begin to deploy your source maps in your production environment?

#### Sources

- [Programming languages adoption trends 2020](https://www.developernation.net/blog/infographic-programming-languages-adoption-trends-2020?ref=ctrl.blog), 2020-12-11, Konstantinos Korakitis, Developer Economics, SlashData
- [JavaScript](https://almanac.httparchive.org/en/2020/javascript?ref=ctrl.blog), 2020-12, Tim Kadlec, Web Almanac 2020, HTTP Archive
- [JavaScript](https://almanac.httparchive.org/en/2019/javascript?ref=ctrl.blog), 2019-12, Houssein Djirdeh, Web Almanac 2019, HTTP Archive
### The built-in Windows 10 web browser you’ve never heard about
URL: https://www.ctrl.blog/entry/windows-internet-browser/
Last updated: 2026-08-23T22:25:03.000Z
I double-clicked on a [shortcut.url file](https://www.ctrl.blog/entry/internet-shortcut-files/) and Windows asked me to choose a program. The dialog listed an unfamiliar program called Internet Browser, not to be confused with Internet Explorer. I’d never seen or heard of this program before.

So, what is the Internet Browser program, what does it do, and where does it come from? It has been built-in to Windows since Windows Vista, but it has kept itself mostly quiet and in the background.

![](https://cdn.synaps.media/control/content/images/2026/08/ieframe-dll-internet-browser-icon.png)

The program had a small house icon with a blue roof, in the style of the many house icons in Windows 7\. It’s not something I’d installed and it was clearly a part of Windows. Nor is it a program that’s listed in the Start menu or that you can even find an executable for anywhere on your disk. The only places you’ll find it is in the Open With shell dialog (shown above), and in the file-type association manager (shown below).

![Choose default apps by file type dialog shows “Internet Browser” as the default app for the .URL file type.](https://cdn.synaps.media/control/content/images/2026/08/windows-choose-default-browser-apps-by-file-type.png)

Choose default browser apps in Windows 10 by [Daniel Aleksandersen](https://www.daniel.priv.no/?ref=ctrl.blog) licensed under [CC BY-SA 4.0](https://creativecommons.org/licenses/by-sa/4.0/?ref=ctrl.blog).

The Internet Browser only shows up when you try to open .URL files. These are files that act as regular links on the web, or “internet shortcuts” as Windows calls them. You can double-click an URL file and Windows will open the associated URL in your default web browser. (Right-click in a Windows Explorer window and choose New: Shortcut, and type in an absolute URL to create a link file.)

Like my own [EdgeDeflector program](https://www.ctrl.blog/entry/edgedeflector-default-browser/), the Internet Browser program is called into action when working with links in the Windows shell. All it does is to read and interpret the link in a given .URL file, and then it tells Windows to open that link in your system’s default web browser.

Some web browsers support opening .URL files either via drag-and-drop, or when using them to open the files directly. However, Windows won’t suggest using any of the leading web browsers directly as they don’t register support with the file association registry. This leaves the Internet Browser program as the only option, as you can see from the dialog at the top of the article.

Despite its name, Internet Browser isn’t a browser. It’s hardly even a program. It’s more of an artifact that the system creates by directly calling functions inside a left-over code library (`%SYSTEMROOT%\System32\ieframe.dll`) once a part of the legacy Microsoft Internet Explorer web browser. The `ieframe.dll` library’s friendly/display name is “Internet Browser”, which is where the program gets its name from. This is also the origin of the mysterious [TWINUI program](https://www.ctrl.blog/entry/what-is-twinui/), as previously discussed on this blog.

Microsoft has used aggressive tactics to promote its Edge browser, including [scary dialogs when changing the default browser](https://www.theverge.com/2015/10/18/9563927/microsoft-windows-10-default-apps-browser-prompt?ref=ctrl.blog) and even [ignoring the default browser setting](https://www.ctrl.blog/entry/edgedeflector-default-browser/). I’d be quite surprised if anyone at Microsoft knew that they were shipping a second web browser with Windows 10\. The URL link files seem like yet another place they could hijack links and open them in Microsoft Edge instead of in your preferred web browser. I’m happy that isn’t the case, though.
### systemd application firewalls by example
URL: https://www.ctrl.blog/entry/systemd-application-firewall/
Last updated: 2026-08-23T22:22:55.000Z
An application firewall, unlike a gateway (router) or system level firewall, is meant to limit the networking of a single application. It can be used to prevent a compromised service from seeing into the local network, prevent programs from calling home, plug metadata leaks, or more tightly control a program’s network access.

You should first read the [introduction to systemd service sandboxing](https://www.ctrl.blog/entry/systemd-service-hardening/) and [security hardening](https://www.ctrl.blog/entry/systemd-opensmtpd-hardening/). Remember to not edit service files directly! Use the `systemctl edit` utility to make changes to an existing service.

The `systemd` firewall directives is built on Linux kernel features. The required Kernel features might not be enabled in your specific environment (especially when using a custom kernel or container). Testing is key, as it is with any network filter and security solution. You should always test to verify that your firewall set up blocks and allows the traffic you specify.

You can create basic application firewalls for your `systemd` services using two key service directives: `IPAddressAllow` and `IPAddressDeny`. The rest of the article will demonstrate some example applications of these directives.

Here’s a simple example for a DNS resolver stub that is blocked from connecting to Google DNS (8.8.8.8), but is allowed to connect to Cloudflare DNS (1.1.1.1) and Quad9 DNS (9.9.9.9). Other IP addresses are also allowed in this example.

```ini
[Service]
IPAddressDeny=8.8.8.8
IPAddressAllow=1.1.1.1
IPAddressAllow=9.9.9.9
```

You can only specify IP addresses with or without masks, but not domain names. Note that this set up doesn’t guarantee that the service won’t try to use the system’s DNS resolvers, e.g. through the `getaddrinfo` system call.

Here’s another example for, e.g. a file sharing service, that can bind to a port on the local host, and only accepts ingress and egrees to devices on the local network (10/24):

```ini
[Service]
IPAddressDeny=any
IPAddressAllow=localhost
IPAddressAllow=10.0.0.0/24
```

The keywords `any`, `localhost`, `link-local`, and `multicast` are special network names. These names are resolved by `systemd`. By denying traffic from the `any` source, you change the ruleset into an allow-list.

The above is a basic but powerful example. It’s enough to prevent a service from phoning home to its developer, or block someone outside the local network from accessing an email server.

Here’s one more example of a service that is blocked from connecting anywhere but the localhost. Environmental variables are set for the service to instruct it to use a socks proxy to exit onto the internet.

```ini
[Unit]
After=tor.service

[Service]
Environment=ALL_PROXY=socks://127.0.0.1:9050
Environment=HTTPS_PROXY=socks://127.0.0.1:9050
Environment=HTTP_PROXY=socks://127.0.0.1:9050
IPAddressDeny=any
IPAddressAllow=localhost
```

The above example leaves the service free to connect to any other service running on the local host. You can further restrict the service’s access by binding the proxy service to a more specific loopback address, e.g. 127.100.90.50, and then only allowing the service to connect to that address.

You can implement entirely custom filters for ingress and egress traffic using an BPF program. This is out of scope for this article, but you can refer to the `IPIngressFilterPath` and `IPEgressFilterPath` directives in the [systemd.resource-control man page](https://www.freedesktop.org/software/systemd/man/systemd.resource-control.html?ref=ctrl.blog) for more details. 

#### Sources

- [systemd.resource-control man page](https://www.freedesktop.org/software/systemd/man/systemd.resource-control.html?ref=ctrl.blog), version 247, 2020-11-26, FreeDesktop.org
- [Custom BPF firewalls for systemd services](https://kailueke.gitlab.io/systemd-custom-bpf-firewall/?ref=ctrl.blog), 2019-06-29, Kai Lüke, GitLab
- [IP Accounting and Access Lists with systemd](https://0pointer.net/blog/ip-accounting-and-access-lists-with-systemd.html?ref=ctrl.blog), 2017-10-09, Lennart Poettering, Pid Eins blog
### Don’t use RouterOS DHCP lease scripts to manage DNS
URL: https://www.ctrl.blog/entry/routeros-dhcp-lease-script/
Last updated: 2026-08-23T22:21:22.000Z
The RouterOS DHCP Server (MRDS) from MikroTik doesn’t natively support registering hostnames from DHCP leases to its DNS server. Instead, it supports executing a “DHCP lease script” when new leases are issued, released, or expires. You can use a lease script to manage DNS entries for DHCP leases. However, this isn’t the best solution for managing static DNS registrations for your network hosts. 

DHCP lease scripts may sound like the ideal solution, but MikroTik’s implementation in MRDS has some severe limitations. The lease script is only executed when a new DHCP lease is issued, released, or expires. In a perfect world, this should suffice.

Unfortunately, networking is messy and DHCP clients can behave unpredictably. Your phone or laptop may renew an expired DHCP lease when it wakes up from hibernation instead of requesting a new lease. The same can happen after a device change its Wi-Fi MAC address (as some do periodically as a privacy precaution). As the lease script isn’t executed for renewals, you won’t have a DNS entry for the host if the lease already has expired. The result is an unreliable DNS service. 

The open-source `dnsmasq` server has a similar DHCP lease script feature. It has an additional `--script-on-renewal` flag that enables it to better handle these situations. MikroTik hasn’t added a similar option in MRDS. You can’t rely on a DHCP lease script to provide reliable DHCP to DNS mappings in RouterOS.

Instead of a DHCP lease script, you’ll need to use a system script executed on a schedule. Hosts won’t immediately become available over DNS, but at least the service will be reliable. If you run the script once a minute, the average delay won’t be more than 30 seconds.

The scheduled system script should iterate through all your DHCP leases, assign or update existing DNS entries, and delete any unused DNS entries. You can use [my DHCP to DNS script](https://www.ctrl.blog/file/2021-02-09%5Fdhcp-to-dns.rsc) as an example. Install it in System: Scripts, and execute it on a repeating schedule through System: Scheduler. The script shouldn’t interfere with any other static DNS entries you might have set up.

To keep the memory consumption low, you may want to run the script in batches by subnets when dealing with many DHCP leases. My script doesn’t deal with internationalized domain names (IDN) or other hostname normalization. You must not deploy any scripts that don’t normalize hostnames in an environment where a device might try to register a pile-of-poo emoji as its hostname, hostnames could conflict, or the clients could be trying something more malicious.

#### Sources

- RouterOS, version 6.48.1, 2021-02-05, MikroTik
- [dnsmasq man page](https://thekelleys.org.uk/dnsmasq/docs/dnsmasq-man.html?ref=ctrl.blog), 2020-04-05, Simon Kelley
- [DHCP Server](https://wiki.mikrotik.com/index.php?title=Manual:IP/DHCP%5FServer&oldid=33755&ref=ctrl.blog), revision 33755, 2020-01-21, Documentation wiki, MikroTik
### The missing gigabytes of disk space on my Mac
URL: https://www.ctrl.blog/entry/darwin-user-cache-gigabytes/
Last updated: 2026-08-23T22:04:37.000Z
My MacBook only has 250 GB of storage, but 130 GB of storage space went missing for over a year. So, where did the storage space go? and how is it all Apple’s fault?

I checked every file and directory, and used various apps to assess what took up my storage space. However, I couldn’t account for about 130 GB of storage space on my Mac. For over a year, I wrongly attributed the storage space to unicorn file-system features like snapshots. The problem began when MacOS migrated to the Apple File System (APFS), and everyone and their pets attributed the problem to vague APFS related issues.

Upon closer inspection of my disk, however, I found where the missing storage space had gone. It was all taken by junk files stored in my hidden `DARWIN_USER_CACHE_DIR` directory. The rest of this article explores where to find this directory, what it’s for, and what Apple can do better to prevent this from happening.

The “primary” user cache directory is stored in `~/Library/Caches/` directory in your Home folder. This directory is where programs are supposed to store cache files. Cache files are files that programs can recreate by redownloading them from the internet or by performing a local operation on another set of files. The directory is excluded by Time Machine and other back-up programs. Cache files are generally not considered to be valuable. You safely delete these files without losing any valuable data.

Many online tutorials will advise you to quit every program and delete the contents of this cache directory if you’re running out of storage space. It’s well-known in the Mac professional community.

Then there’s another “user cache” directory called `DARWIN_USER_CACHE_DIR`, a relic from the early days of MacOS. It’s a hidden cache directory that’s located outside your Home directory. Its location isn’t a secret, but you must execute the `getconf DARWIN_USER_CACHE_DIR` command in the Terminal to find where it’s located. Each user account on your Mac has its own `DARWIN_USER_CACHE_DIR` directory.

![Storage Management showing 174 GB of “other.”](https://cdn.synaps.media/control/content/images/2026/08/macos-storage-management-174gb-other.png)

174 GB of “other” licensed under [CC0 1.0](https://creativecommons.org/publicdomain/zero/1.0/?ref=ctrl.blog).

The files in the `DARWIN_USER_CACHE_DIR` directory accounted for 135 out of the 174 GBs of “other” files reported by the Storage Management app in MacOS. The Storage Management app doesn’t provide any details on what or where these “other” files are located. They can be anything anywhere on your system disk.

The directory is under-utilized in modern versions of MacOS. Everyone seems to stick to the `~/Library/Caches/` directory instead. In exploring my `DARWIN_USER_CACHE_DIR` directory, I mostly found cache automatically generated by MacOS on behalf of third-party programs. I even found some software trial-license control files hidden away there as well. (Delete them to extend your free 30-day trial!)

I also found about 130 GB of failed Xcode downloads in a subdirectory belonging to the Apple App Store app. As it turns out, the App Store downloads into this cache directory before moving the completed download into place on the disk. For whatever reason, I found partially downloaded versions of Xcode that had built up in this directory going back years.

There’s a more appropriate directory to stage downloads in, however. Files that aren’t opened or used in the `DARWIN_USER_TEMP_DIR` directory (different from `DARWIN_USER_CACHE_DIR`) are automatically deleted after three–four days. If Apple had used this directory instead, its App Store mistakes would have been deleted within a few days. No harm is done.

MacOS has an option to automatically delete files from your Trash directory after 30 days. However, it doesn’t have an option to delete unused files from its cache directories. I say it’s high time Apple added an option to automatically clean out its cache directories too!

Here’s how simple it would be for Apple to implement this feature. You can follow along at home to get your Mac to clean itself periodically. Be very careful when you’re following these steps. Take your time to do it right. Make sure you’ve backed up important data first.

1. Open the Terminal app (you can find it with Spotlight).
2. Type `getconf DARWIN_USER_CACHE_DIR` and press Enter.
3. Copy the directory string it outputs for later (it should look something like `/var/folders/something-random/C`).
4. Type `sudo nano /etc/defaults/periodic.conf` and press Enter.
5. Type in your password when prompted, and press Enter again.
6. Type the following into the file:

```ini
daily_clean_tmps_dirs="/tmp /var/folders/something-random/C"
```

Enter the directory path you got in the third step. The two space-separated values must be enclosed in straight quotation marks. `/tmp` is a special alias that means `DARWIN_USER_TEMP_DIR` (for all users) and is the option’s default value.

1. Press Control+X, then Y, and Enter.
2. Reboot your Mac.

—and you’re done. You’ve just implemented a new feature on your Mac. MacOS will now automatically delete unused cache files after three days. You may also want to add the `/Users/your-name/Library/Caches/` directory to the space-separated list in `daily_clean_tmps_dirs`. 

You can change the deletion time to ten days by setting the `daily_clean_tmps_days="10"` option below the `daily_clean_tmps_dirs` option (the default is three days). I recommend setting it to at least 10–14 days. You’ll want to set it to no less than how often you reboot (not suspend/resume, but reboot) your Mac. Add some days of margin for safety to allow programs that run at boot to open and extend their cache files lifetimes. Some programs may misbehave if their cache files are deleted without a reboot cycle.

You can learn more about what the various options in that configuration file do by typing `man periodic.conf` into the Terminal app. You shouldn’t have to, but here we are.

#### Sources

- [What is "/var/folders"?](https://magnusviri.com/what-is-var-folders.html?ref=ctrl.blog), 2020-05-11, Magnusviri blog, James Reynolds
- [Scripting the Temp and Cache Directories on a Mac](https://krypted.com/uncategorized/scripting-the-temp-and-cache-directories-on-a-mac/?ref=ctrl.blog), 2019-11-11, Krypted blog, Charles Edge
- [peridoc.conf man page](https://opensource.apple.com/source/crontabs/crontabs-13/private/etc/defaults/periodic.conf.auto.html?ref=ctrl.blog), 2016-09-04, Open Source at Apple, Apple
- [Temporary files and folders in Cocoa](https://www.cocoawithlove.com/2009/07/temporary-files-and-folders-in-cocoa.html?ref=ctrl.blog), 2009-07-23, Cocoa with Love blog, Matt Gallagher
### Raspberry Pi heatsink and case fan continued
URL: https://www.ctrl.blog/entry/raspberry-heatsink-case-fan/
Last updated: 2026-08-23T22:16:11.000Z
Two months ago, I mentioned that I was looking to buy a heatsink for my Raspberry Pi on AliExpress (AE). I specifically looked for and ordered a heatsink that came with an adhesive thermal pad. Among the customer reviews of heatsinks on AE, I found other customers had resorted to [installing their heatsinks with super glue](https://www.ctrl.blog/entry/raspberry-heatsink-glue/). That’s a bad idea as regular super glue is a thermal insulator. In the meantime, the Raspberry Pi Foundation had released a potentially better and official cooling accessory.

Long story short, the heatsink I’d ordered arrived seven weeks later with a poorly fitted bit of regular double-sided tape (a thermal insulator) instead of a thermal pad. That’s the risk of shopping on AE: the product titles and descriptions are keyword-stuffed, machine translated from Chinese, and on top of that, some sellers don’t mind lying about their products.

I can’t evaluate the heatsink itself. It’s an aluminum block. It would probably have done an adequate job if I’d had a thermal pad or another way to install it. The heatsink only cost 0,52 USD, so it wasn’t any big loss. Annoyingly, the seller had closed its presence on AE, and I can’t even leave them a bad review.

Only two weeks after I’d placed the order for a heatsink, the Raspberry Pi Foundation released the new [Raspberry Pi case fan](https://www.raspberrypi.com/news/new-raspberry-pi-4-case-fan/?ref=ctrl.blog). The official accessory case fan comes with a heatsink with a pre-applied thermal pad. I initially wasn’t interested in an active cooling solution. A heatsink would give me some more thermal headroom without adding any noise. A fan can be noisy, and it’s hard to find reviews of all the myriad of third-party options.

Tthe introduction of the official case fan from Raspberry Pi meant that I could actually dig up proper reviews of it prior to purchasing it. I’ll defer to Jeff Geerling’s [review of the case fan](https://www.jeffgeerling.com/blog/2020/raspberry-pi-4-has-fan-now-case-fan?ref=ctrl.blog) if you’re interested in more details about it. (The first photo in his review isn’t it!)

I placed an order for the official case fan accessory (getting hold of official accessories is [a whole thing in itself](https://www.ctrl.blog/entry/raspberry-pi-keyboard-distribution/)) even before I’d received the heatsink I’d already ordered on AE. I’m happy with the fan, mostly because it’s off most of the time. Turns out I didn’t need the additional thermal headroom for the workload I run on it. My Raspberry Pi still benefits from the included heatsink, and I tweaked the fan to only run at its lowest setting when it’s going.

I’m happy with my Raspberry Pi setup, but I prefer having the option to get a proper heatsink. Oh, and I’ve deleted my AliExpress account. Everything I’ve ordered through the site lately has been mislabeled and lacked advertised functionality. It’s the only place to get lots of sundry items, but I don’t want to deal with its marketplace anymore.

Unlike regular thermal paste, thermal pads sacrifice some thermal conductivity for the installation-convenience. Thermal paste deteriorates over time, primarily because of the thermal pump-out effect, and needs to be [replaced every few years](https://www.ctrl.blog/entry/repaste-thermal-compound/). I haven’t found any authoritative sources discussing whether thermal pads need periodic service. I’m inclined to believe that they don’t, as they’re firmer and less prone to suffer thermal pump-out.

I’m happy to see the Raspberry Pi Foundation (RPF) offering more official accessories at a competitive price. Part of Raspberry Pi’s appeal is its large third-party compatible ecosystem. However, I prefer getting something that just works and knowing that my money goes to the RPF rather than a scammy seller on AE.

#### Sources

- [The Raspberry Pi 4 has a fan now – the Case Fan](https://www.jeffgeerling.com/blog/2020/raspberry-pi-4-has-fan-now-case-fan?ref=ctrl.blog), 2020-12-06, Blog, Jeff Geerling
- [New product: Raspberry Pi 4 Case Fan](https://www.raspberrypi.com/news/new-raspberry-pi-4-case-fan/?ref=ctrl.blog), 2020-11-30, Eben Upton, Blog, Raspberry Pi Foundation
### Why Firefox for Android logs you out of everything all the time
URL: https://www.ctrl.blog/entry/firefox-samesite-cookies-android/
Last updated: 2026-08-23T22:06:55.000Z
I’ve been increasingly frustrated with Firefox for Android, my preferred mobile web browser. I’ve repeatedly had to re-login to some websites and had various problems with cookies since last year’s release of the [new Firefox codenamed “Daylight.”](https://www.ctrl.blog/entry/review-firefox-fenix-android/) Websites forget me between each visit and I get the “new visitor” experience every time. I finally worked out what’s going wrong.

I’ve suspected that it might have been a side-effect of [Firefox’s tracking-cookie-blocking features](https://www.ctrl.blog/entry/firefox-blocks-tracking-ads/). I’ve just assumed the issues have been caused by short-lived session cookies, limited device storage space, perverse incentives to give me new opportunities to consent to tracking cookies, and I’ve made other excuses for the buggy behavior.

Yesterday, I stumbled upon the underlying cause of many of my cookie problems. I had implemented an authentication cookie for a project, but the cookie didn’t persist between page-sessions in Firefox for Android (F3A.) Other browsers would remember and retransmit the cookie until its expiration time. I verified that F3A did indeed store the cookie, but it consistently failed to send the cookie back to the server on subsequent visits.

So, what was going on? and why did it only affect some websites? I ran various basic tests for persistent and session cookies, and they all worked as expected. It wasn’t a general problem with cookies, but something more subtle and difficult to identify.

As this was an authentication-related cookie, I’d specified strict security policies for the cookie. The cookie shouldn’t be accessible from JavaScript (`HttpOnly`), should only be sent over an encrypted connection (`Secure`), and should only be sent on same-origin requests (`SameSite=Strict`.) It’s this last property that causes the cookie problems on F3A.

`SameSite=Strict` tells the browser to only submit the cookie with requests originating from the same origin as the cookie. The restricting is meant to thwart cross-site scripting (XSS) vulnerabilities. For example, if the cookie was set for `example.com`, it wouldn’t be transmitted along with a request for `example.com/image.png` loaded from `another.example.net`. Both F3A and Firefox for desktop supports `SameSite=Strict` just fine.

However, there’s a slight problem with F3A’s definition of “same-site.” When you navigate to a webpage using the navigation/address bar (e.g. by typing an address or selecting an item from the search/history list), then F3A uses `>null` as the origin instead of the domain of the destination website. As the origins aren’t the same, the strictly enforced same-site cookie isn’t transmitted along with the request. The bug isn’t a security problem, as it just causes Firefox to be too catious with its cookies.

To make things worse, reloading the page doesn’t fix the problem. The cookie still isn’t sent. You have to navigate to the page by clicking on a link to it to get F3A to submit `SameSite=Strict` cookies.

Websites like GitHub and Quora don’t rely on `SameSite=Strict`, and have opted to use duplicate cookies with and without the `SameSite` property. This completely undermines the security benefits, but ensure sessions work for their visitors. Other websites have assumed web browsers that don’t support the property will simply ignore it. It’s this last category of websites that forgets you between visits and fails to log you in.

Mozilla has known about the issue for over a year. It knew about it before the first public release Daylight. [Issue #1573860](https://bugzilla.mozilla.org/show%5Fbug.cgi?id=1573860&ref=ctrl.blog) has more details and history on the issue.

You can work around the bug by not navigating to websites that require cookies by using Firefox’s navigation/address bar. Unfortunately, opening websites from bookmarks are also affected by the same bug. This hurts me to say as a Firefox enthusiast, but you should probably switch to a less buggy web browser.

#### Sources

- [Cookies: HTTP State Management Mechanism](https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-rfc6265bis-07?ref=ctrl.blog) (RFC draft), 2020-12-07, HTTP Working Group, Internet Engineering Task Force
- [Issue #1573860: Does not send samesite=strict cookies when opening a site directly from the location bar](https://bugzilla.mozilla.org/show%5Fbug.cgi?id=1573860&ref=ctrl.blog), 2019-08-14, Bugzilla, Mozilla
### What’s with cp --reflink: failed to clone: Invalid argument?
URL: https://www.ctrl.blog/entry/cp-reflink-einval/
Last updated: 2026-08-23T22:04:02.000Z
Most modern copy-on-write file systems, such as Btrfs and XFS, [support file cloning](https://www.ctrl.blog/entry/file-cloning/). (OpenZFS being the notable exception.) However, the tools that support this space-saving innovation can be difficult to use. Here’s an example situation detailing how the simple copy (`cp`) command on Linux can make it hard to understand what’s going on.

As an example, here’s a quick command set that will create a file and a directory, disable copy-on-write on the directory, and then attempt to clone the file into the directory. It uses commands from `gnu-coreutils` and `e2fsprogs` packages, and assumes you’re working on a file cloning-capable file system.

```
touch test.file
mkdir test.dir/
chattr +C test.dir/
cp --reflink test.file test.dir/
```

The file cloning operation will fail and output the following unenlightening error message:

/usr/bin/cp: failed to clone 'demo.dir/test.file' from 'test.file': Invalid argument

What argument is invalid? What makes it invalid? The error message isn’t actionable. Right now, we already know what the problem is from setting up the test above. We disabled copy-on-write on the target directory. However, you wouldn’t have this knowledge if you were working on an unfamiliar system, or had simply forgotten that you’d disabled copy-on-write on your `~/Downloads` directory.

Where do you even start to troubleshoot something like this? It took me some time to find out how to best approach this type of problem. A [strace](https://strace.io/?ref=ctrl.blog) of the copy command’s execution reveals where things go wrong:

ioctl(4, FICLONE, 3) = -1 EINVAL (Invalid argument)

The copy command simply bubbles this error up to the end-user. From here you could refer to the [manual page from ficlone](https://www.man7.org/linux/man-pages/man2/ioctl%5Fficlone.2.html?ref=ctrl.blog) and look-up the `EINVAL` error:

> “The filesystem does not support reflinking the ranges of the given files. This error can also appear if either file descriptor represents a device, FIFO, or socket. Disk filesystems generally require the offset and length arguments to be aligned to the fundamental block size. XFS and Btrfs do not support overlapping reflink ranges in the same file.”

The information isn’t all that helpful, though. We’re indeed on a file system that supports file-cloning (“reflinking”), and none of the other causes matches the situation at hand. You can double and triple-check that your expectations are correct: your file system does support cloning, your kernel version is up-to-date, and no; you haven’t gotten any weird symbolic links across file system boundaries. You’d still be no closer to working out what the problem was.

There isn’t a plot-twist at the end of this story. I wasn’t struck by inspiration and found a way to identify the root cause of the problem. It took me about six weeks before I remembered that I had disabled copy-on-write on my `~/Downloads` directory. I hadn’t only disabled file checksumming, copy-on-write updates, and potentially reduced file fragmentation. By turning off copy-on-write, I’d also turned off the ability to use file cloning to and from that directory. To me, this was an unexpected side-effect, but it makes sense in retrospect.

If you’re in the same situation, you can check if copy-on-write has been disabled on a file or directory using the `lsattr` command (part of the `e2fsprogs` package). Look for the “C” (uppercase) flag. You can remove the flag using `chattr -C`.

From the perspective of the underlying system call, it has indeed been provided with an invalid argument. However, the error is completely meaningless from the perspective of an end-user of the copy command. The copy command should have detected the system call error and displayed a more contextually appropriate error message.

#### Sources

- [FAQ](https://archive.kernel.org/oldwiki/btrfs.wiki.kernel.org/index.php/FAQ.html?ref=ctrl.blog), revision 33178, 2020-07-15, Btrfs Wiki, Linux Kernel project
- [lsattr man page](https://www.man7.org/linux/man-pages/man1/lsattr.1.html?ref=ctrl.blog), 2020-03, Linux Manuals, Linux man-pages project
- [Copy files and directories](https://www.gnu.org/software/coreutils/manual/html%5Fnode/cp-invocation.html?ref=ctrl.blog), 2020, Documentation, GNU Coreutils, GNU Project
- [ficlone man page](https://www.man7.org/linux/man-pages/man2/ioctl%5Fficlone.2.html?ref=ctrl.blog), 2017-09-15, Linux Programmer’s Manual, Linux man-pages project
### How to disable Adobe Cloud Sync on MacOS
URL: https://www.ctrl.blog/entry/how-to-disable-adobe-cc-cloud-sync/
Last updated: 2026-08-23T22:09:34.000Z
Adobe Creative Cloud *really* wants you to use its cloud storage service. Adobe doesn’t give you a way to turn it off. Here’s how to retake control and turn off Adobes Cloud Sync anyway.

I primarily use free-of-charge and open source photo editing software including [RawTherapee](https://www.rawtherapee.com/?ref=ctrl.blog) and [GIMP](https://www.gimp.org/?ref=ctrl.blog). Sometimes I need a feature that’s only available in Adobe Lightroom or Photoshop, though. However, Adobe software isn’t just a piece of software you install anymore. It’s a suite of services, including some unwanted ones like its cloud file storage offering.

As long as Creative Cloud is installed, Adobe will run its Core Sync service in the background. It’s non-negotiable and it gives you no option to turn it off. There’s an option to pause it in the Creative Clouds management app. As long as ACC is installed, Adobe will run its Core Sync service in the background. It’s non-negotiable and it gives you no option to turn it off. There’s an option to pause it in the Creative Clouds management app. Pausing it will still leave the Adobe Core Sync agent running in the background.

The service wastes processor cycles and slows down the opening of new Finder windows. I often find it near the top of the list of energy-wasting services running in the Activity Monitor app. I get no benefits from it, I don't use it, and I want it gone from my Mac.

You may already have tried a few things to remove Adobe Cloud Sync. You might have tried to disable the Finder extension from the System Settings app: Extensions. Maybe you deleted the Adobe Sync, Core Sync service, and Core Sync Finder Extension apps (ACCFinderSync) from their home in /Applications/Utilities/Adobe Sync/.) However, Creative Cloud will automatically **reinstall the apps and turn on the extension again** within a few hours or after the next reboot. 

You can push back harder and prevent Adobe from starting any of its background services. However, that will only last until you manually start any Adobe software. Modern Adobe software is almost malware-like in how it embeds itself deep into your system and reinstalls itself automatically after removal.

Here’s how to permanently disable just the Adobe Cloud Sync service. Be warned, the Creative Cloud management app will display an error notification (seen below) complaining about not being able to reinstall the Sync service. The message is shown at the bottom of the window, and you can simply ignore it. Although, the red color suggests there’s something seriously wrong rather than just a user exercising their right to control what runs on their computer.

![Error message: Unable to sync. Install sync component and try again. Error 146.](https://cdn.synaps.media/control/content/images/2026/08/adobe-cloud-sync-install-error-146.png)

Adobe Creative Cloud is unable to sync by [Daniel Aleksandersen](https://www.daniel.priv.no/?ref=ctrl.blog) licensed under [CC0 1.0](https://creativecommons.org/publicdomain/zero/1.0/?ref=ctrl.blog).

Start by opening the Terminal app. You can find it with Spotlight or in /Applications/Utilities/. Carefully type each of the below commands verbatim and press Enter after each one. Bare careful as these commands *can be destructive to your system* if you mistype or omit the quotation marks. You’ll be prompted to enter your Mac’s password to confirm the changes. 

```
sudo rm -rf "/Applications/Utilities/Adobe Sync/*"

sudo chflags simmutable "/Applications/Utilities/Adobe Sync/"
```

Then restart your Mac. You can choose not to restart right away, but you’ll get a slow trickle of crash and error messages from Adobe’s background services until you do.

So, what did each of the commands you just do? The first command simply deletes all the Adobe Sync components from your Mac. You should restart afterward so you won’t have to handle the services crashing as each one realizes that it has been deleted. The second command marks the Adobe Sync directory as immutable. This change prevents the installer from reinstalling the sync component later. Note that it’s not enough to set stricter permissions on the folder. The Adobe installer will undo any changes to permissions and keep doing what it wants.

**Update** (2021-02-10): Some users have reported issues with installing updates to Adobe Illustrator after following this guide. Here’s how to undo the changes if you run into trouble. You can repeat the above process after installing the updates to remove Sync again.

```
sudo chflags nosimmutable "/Applications/Utilities/Adobe Sync/"
```

I understand Adobe’s business incentives to push its cloud storage solution. The Adobe Photography plan doubles in cost when you upgrade from the 1 GB to the 1 TB plan. However, I’m all set with cloud storage solutions. I don’t need yet another solution for syncing or backing up my files.

Adobe should still offer a checkbox to optional components of Creative Cloud. But that’s the core of the issue. The cloud storage offering is now a price-differentiating feature, and Adobe doesn’t consider it to be optional. Fortunately, there are still ways to turn it off. At least, until the Adobe installer begins clearing the immutable flag from its destination folders. At that point, the Cloud Sync agent will move from the unwanted bundleware to the malware category.

#### Sources

- Adobe Creative Cloud for MacOS, version 5.3.1.470, 2021-01, Adobe
- [Error code 146: Unable to move the file](https://helpx.adobe.com/creative-cloud/kb/troubleshoot-download-install-logs.html?product=Creative%20Cloud%20Desktop&product-version=5.3.1.470&mv=product&mv2=accc&ref=ctrl.blog#error146), 2020-03-30, Fix errors installing Adobe apps, Knowledge base, Adobe
- [chflags man page](https://man.openbsd.org/chflags.1?ref=ctrl.blog), 2019-09-02, OpenBSD
### Brave adds support for IPFS distributed P2P websites
URL: https://www.ctrl.blog/entry/brave-ipfs/
Last updated: 2026-08-23T22:02:35.000Z
The Brave browser recently added support for the [InterPlanetary File System](https://ipfs.tech/?ref=ctrl.blog) (IPFS) protocol in its beta release channel (desktop only). IPFS is a peer-to-peer (P2P) protocol that can be used in web browsers to visit websites that are hosted by the website’s visitors instead of a central web server. This is called the distributed web. For the last two decades, the open web has been on a steady course into the hands of a few behemoth multinational companies. The distributed web is a tool that can wrangle back control from the few and hand it back to the many.

The distributed web still hasn’t gone mainstream, and Brave’s [one percent market share](https://www.ctrl.blog/entry/brave-market-share/) won’t drastically change the web’s architecture overnight. Brave’s adoption of IPFS is notable because it’s the first time an externally developed P2P protocol makes it into a web browser. Previous attempts at a P2P web browser, such as [BitTorrent Maelstrom](https://www.ctrl.blog/entry/bittorrent-maelstrom/), has always been lead by the developers of the protocol. No P2P protocol has convinced a web browser vendor to integrate their protocol before.

Previously, you’ve only been able to use IPFS in web browsers by installing a separate program and a companion extension in your web browser. Brave now comes with native built-in IPFS support. Its support isn’t quite equivalent to HyperText Transfer Protocol (HTTP) yet, but it’s a huge leap forward for IPFS. When you open an IPFS link (`ipfs://example/`) in Brave, it will open it using a public web-gateway server by default. Gateways are public web servers that proxy content from the IPFS network via a traditional web server. Brave will also prompt you to enable native IPFS support, and [warns you about IPFS privacy issues](https://support.brave.com/hc/en-us/articles/360051406452-How-does-IPFS-Impact-my-Privacy?ref=ctrl.blog). More on the IPFS privacy issues later.

Brave hasn’t developed a new implementation of IPFS. Instead, Brave ships the IPFS reference client and runs it as a helper process. I had wrongly assumed that js-ipfs, an almost fully-featured IPFS client written in JavaScript, would be the foundation of the first browser to ship with IPFS integration. Brave launches the IPFS daemon on demand when you access IPFS content. It doesn’t launch it with the browser when it’s not needed.

You can check on the IPFS daemon’s status by navigating to `brave://ipfs`. Advanced users can modify the `brave_ipfs/config` file in their Brave profile directories with information from the above page to gain access to the more advanced [IPFS web administration interface](https://webui.ipfs.io/?ref=ctrl.blog).

Brave will cache up to 1 GB of content accessed over IPFS. The cached content is made available to others on the IPFS network as long as the daemon is running. Brave will automatically delete the cached content using the IPFS garbage collector (GC) process. There’s been no significant changes to [IPFS’ GC](https://www.ctrl.blog/entry/ipfs-repo-cache-gc/) since I discussed it two years ago. The GC deletes all cached content once 90 % of the 1 GB cache quota is filled. The IPFS cache is notably absent from the Delete browsing data dialog. (See [issue #13302](https://github.com/brave/brave-browser/issues/13302?ref=ctrl.blog).) It’s entirely separate, and you’ll need to quit Brave and manually delete its directory from your device if you want to remove it. 

**Update** (2021-01-15): Brave Software liked my feedback and are working on adding IPFS to the Delete browsing data dialog. See [issue #7578](https://github.com/brave/brave-core/pull/7578?ref=ctrl.blog "Clear IPFS cache when clearing browsing data") for details.

Peer-to-peer applications like IPFS can have negative impacts on device battery life. IPFS in particular has a bad reputation for consuming enormous amounts of RAM and bandwidth. However, Brave runs the IPFS daemon in distributed hash table (DHT) client mode instead of being a full participant in the DHT network. The DHT is a distributed database on what data each peer in a P2P network makes available to the network. DHT client mode drastically reduces the client’s participation in the DHT network and keeps resource use low. 

Most other P2P applications make each peer a full participant in its DHT network. What makes IPFS so different is that the DHT is enormous. With P2P protocols like BitTorrent, the DHT network only stores one bit of data — the BitTorrent info hash — for a collection of files (the torrent file). In IPFS, every file is divided into smaller pieces, and the DHT network needs to store and exchange information about each piece of every file that is available in the network. This gives IPFS advantages such as higher availability and global de-duplication in the network, but it also requires a lot of work from DHT participants.

You have no anonymity or privacy when using IPFS. The IPFS network exchanges data using “content addresses”, a cryptographic hash that uniquely identifies a file. The content address of every file — or part of a file — you download over IPFS is broadcast into the DHT network. Anyone who knows a file’s content address or the hash of its contents can request a copy of it from the network. Anyone in a position to monitor your internet traffic — the local network operator, internet service provider, or government — can monitor what you download through IPFS. This isn’t specific to Brave’s implementation, but an issue with many P2P protocols including BitTorrent and IPFS. Other peer-to-peer protocols, such as the Hypercore Protocol, have found [clever ways to address the problem](https://web.archive.org/web/20201230010159/https://hypercore-protocol.org/protocol//#hyperswarm).

The Brave browser also features a built-in Tor onion networking proxy. It can be accessed by opening a private window in Tor mode. In this mode, your internet traffic is encrypted in multiple layers and bounced around between different relay servers to hide its origin and its destination. IPFS in Brave can’t be accessed from within Brave’s Tor mode. Tor only supports TCP connections, and IPFS uses UDP and QUIC connections.

Brave shows the protocol in the address field as `ipfs://` when accessing IPFS content through the native daemon. However, this is purely cosmetic. If you query the browser engine about the document origin (e.g. through `window.location.origin`), it’ll return `http://hashcontenthash.ipfs.localhost:12345/` instead of `ipfs://hashcontenthash/` as expected. (See [issue #13303](https://github.com/brave/brave-browser/issues/13303?ref=ctrl.blog).)

The Chromium extension API sees the expected address, however. Which can cause conflicts in some extensions when it tries to correlate data from the browser engine and the extension API. Many extensions will also fail in unexpected ways anyway for documents that aren’t served from either `https://` or `http://`.

With its new IPFS support, Brave is probably the preferred viewer for IPFS content. While Brave supports both the `ipfs://` and `ipns://` protocol schemes, it doesn’t register these protocol associations with the host operating system. This means that your operating system won’t try to open these links using Brave when clicking on a link in a third-party application. (See [issue #13266](https://github.com/brave/brave-browser/issues/13266?ref=ctrl.blog).) You can’t just install Brave and then use it on-demand for IPFS when you click on an IPFS link inside Firefox, for example.

Brave enforces a strict security policy that blocks mixed-content IPFS on HTTPS origins. You can’t load e.g. a script, video, or iframe from an IPFS address on a webpage served over HTTPS. This limitation makes it more difficult to experiment with partially distributed websites where some of the content is served from a traditional web server and some content from IPFS.

I suggested to Brian Bondy, Chief Technology Officer at Brave Software, that websites could opt-in to allowing IPFS content to load in their context using a Content-Security-Policy (CSP) response header. CSP is a mechanism that allows websites to specify a list of sources that are allowed to load various resources on a website. ([Read the discussion on Reddit](https://www.reddit.com/r/BATProject/comments/k5izey/ipfs%5Fsupport%5Flands%5Fin%5Fbrave%5Fbrowser%5Fon%5Fthe/?ref=ctrl.blog).)

Brave natively supports the InterPlanetary Name System (IPNS), a DHT-powered alternative to the domain name system (DNS). An IPNS is a hash, like IPFS addresses, but unlike IPFS the hash can be changed later. An IPNS address can represent your website your time as its changing where as an IPFS address is a single snapshot in time. However, hashes aren’t human friendly and they’re difficult to remember.

To address this, IPFS developers came up with [DNSLink](https://dnslink.io/?ref=ctrl.blog), a system for publishing IPFS and IPNS addresses using DNS. The IPFS Companion extension uses DNSLink to look up IPFS address as you visit websites and redirect to the IPFS version if there is one available. Brave doesn’t support DNSLink, however.

It’ll be more interesting to experiment with IPFS now as the barrier to visiting an IPFS website has been lowered to “just install Brave on your computer.” IPFS needs to sort out a human-readable and memorable naming scheme, though. No one will see any success with their distributed websites if visitors need to access a website to look up a complex hash-based address to get to it. The absolute ban on loading mixed-content IPFS on HTTPS websites is a missed opportunity for websites to start experimenting with offloading portions to IPFS. It’ll be interesting to watch what happens in this space in the coming years.

#### Sources

- [Brave version 1.19.67](https://github.com/brave/brave-browser/releases/tag/v1.19.67?ref=ctrl.blog) (beta release, includes go-ipfs version 0.7.0), 2020-12-24, Brave Software
- [IPFS and privacy](https://docs.ipfs.tech/concepts/privacy-and-encryption/?ref=ctrl.blog), 2020-12-10, Docs, IPFS Project
- [Hyperswarm](https://web.archive.org/web/20201230010159/https://hypercore-protocol.org/protocol/#hyperswarm), 2020-05-11, How the Hypercore Protocol Works, Hypercore Protocol
- [How does IPFS Impact my Privacy?](https://support.brave.com/hc/en-us/articles/360051406452-How-does-IPFS-Impact-my-Privacy?ref=ctrl.blog), 2020-04-11, Help Center, Brave Software
- [IPFS - Content Addressed, Versioned, P2P File System](https://gateway.ipfs.io/ipfs/QmV9tSDx9UiPeWExXEeH6aoDvmihvx6jD5eLb4jbTaKGps?ref=ctrl.blog), Draft 3, 2014-07-24, Juan Benet
### The official Raspberry Pi acces­sory distributor conundrum
URL: https://www.ctrl.blog/entry/raspberry-pi-keyboard-distribution/
Last updated: 2026-08-23T22:16:38.000Z
Why isn’t the Norwegian keyboard layout variant of the [official Raspberry Pi keyboard accessory](https://www.raspberrypi.com/products/raspberry-pi-keyboard-and-hub/?ref=ctrl.blog) available for sale in Norway? Norway is the primary, if not the only, market for it. I went up the distribution chain to figure out why it isn’t available.

I’ve been ogling the new [Raspberry Pi 400](https://www.raspberrypi.com/products/raspberry-pi-400/?ref=ctrl.blog): a single-board computer built into an 80s-style computer-in-a-keyboard case. It’s not currently available with a Norwegian keyboard layout. However, the top chassis of the Raspberry Pi 400, including the keyboard, is interchangeable with the official Raspberry Pi keyboard accessory. You can pop off the keyboard of a Pi 400 and swap it out with any other Raspberry Pi brand keyboard. According to the Raspberry Pi Foundation, the official keyboard accessory should be available in a Norwegian layout variant.

What does “available” mean anyway? The [official keyboard’s product page](https://www.raspberrypi.com/products/raspberry-pi-keyboard-and-hub/?ref=ctrl.blog) on the Raspberry Pi Foundation’s website doesn’t list any resellers for the Norwegian layout variant in either of the available color options (red/white and black/gray). None of the companies that sell the Raspberry Pi in Norway sells any layout variant of the keyboard accessory. Neither Google Shopping nor any of the Norwegian price comparison websites can find it listed in any store. Bing and Google can’t find any Norwegian website that sells it either. The product doesn’t seem to exist.

To find out, I had to go up the distribution chain. Official Raspberry Pi products that use the Raspberry Pi trademark are manufactured on a license from the Raspberry Pi Foundation. Most Raspberry Pi computers are manufactured by Sony in Wales, but the accessories are manufactured in China and Japan. The products are distributed by RS Components and Farnell (a.k.a. Newark and Element14) in Europe and North America.

All but one retailer that sells the Raspberry Pi in Norway source it from RS Components. The RS Components website lists the French, German, Italian, Spanish, and United Kingdom layout variants of the official keyboard. These are the keyboards variants that were introduced with the first batch of keyboards layouts in April 2019\. The Danish, Norwegian, Portuguese, and Swedish (introduced in July 2020), or Japanese (August 2020) variants are simply not available through RS Components.

Farnell, however, does list both color options of all the new keyboard layouts. The one Norwegian Raspberry Pi distributor that sources from Farnell only sells the official case, however. They’ve ignored my emails asking them to list the Norwegian keyboard. Farnell also operates a version of its website for the Norwegian market, and it lists the Norwegian layout variant in [red/white](https://no.farnell.com/raspberry-pi/rpi-keyb-no-red-white/keyboard-red-white-norway-rpi/dp/3516087?ref=ctrl.blog) and [black/gray](https://no.farnell.com/raspberry-pi/rpi-keyb-no-black-grey/keyboard-black-grey-norway-rpi/dp/3516094?ref=ctrl.blog). Farnell Norway has no presence in any price comparison websites, and the site is almost practically undiscoverable in Bing and Google (unless you know to look for it).

After realizing I could obtain it through Farnell, I quickly found a list of Farnell distributors that sold the keyboard, including Pimoroni and Jkollerup. Both retailers ship to Norway.

I’ve confirmed that Pimoroni began selling the keyboard around mid-October 2020, and Jkollerup began sometime in early July 2020\. So, it has been available for some time already. If I don’t limit myself to Norwegian websites, I can find the Farnell Norway website and Pimoroni’s listing with Bing and Google. Pimoroni has got the essential keywords “Raspberry Pi keyboard”, “Norwegian layout”, and “NO layout” on the page. Pimoroni has opted to make one product page per keyboard layout and color combination.

Jkollerup, on the other hand, is at the bottom of page eleven for the search “Raspberry Pi Norwegian keyboard”. It has one page for all the official keyboard variants with a drop-down menu for choosing between the different variants. Jkollerup’s page has the keyword “Norwegian” (but not in the context of the product listing), and “Raspberry Pi keyboard”. However, the page talks about the “US layout” which isn’t even sold through the retailer.

Neither Pimoroni nor Jkollerup mentions search terms like “we ship to Norway”, “international shipping”, or anything that might help potential shoppers from Norway locate their websites. Electronics retailers often include the manufacturer’s model number on their product listings. Raspberry Pi products don’t have model numbers, which makes them more difficult to search for online. I thought this was an interesting miniature case study of page keywords.

It’s actually rare to see anyone opting to make separate Norwegian, Danish, and Swedish keyboard layouts. Most keyboards use the pan-Nordic layout for distribution in Denmark, Estonia, Finland, (sometimes Iceland), Norway, and Sweden. The pan-Nordic layout prints every key variant in different positions on each key that differs between the layouts. This is both unattractive and potentially confusing if you don't touch-type. As far as I know, only Apple products and some Lenovo ThinkPad models use the different national keyboard layout variations. (Estonia and Finland use the Swedish layout.) Raspberry Pi’s inexpensive keyboard is unique in its price bracket for offering distinct layouts for each region. Even 300 euro “pro” keyboards use the pan-Nordic layout.

Both Farnell and RS Components also distribute other official Raspberry Pi accessories, including a display cable. The official cable costs roughly 5,60 euros and is an HDMI version 2.0 cable that supports 4 K at 60 Hz. None of the Norwegian retailers sell this accessory *or any other brand* micro-HDMI to HDMI 2.0 cables. Instead, they try to sell what they call “Raspberry Pi 4 compatible” HDMI version 1.4 cables (up to 4 K at 30 Hz) for 29 euros or more.

I don’t know why the Norwegian retailers don’t want to sell the Raspberry Pi-branded micro-HDMI to HDMI cable. I suspect that retailers fear it would hurt sales of some of the more expensive and outdated cables they already have in their inventory. Why bother with maintaining inventory and selling a cheaper and more capable product when you make more money selling a decade-old cable instead? I suspect this is the case for all the other official Raspberry Pi accessories as well. It fills the same price bracket as the more profitable store brand goods. Unlike many store brand electronics, the Raspberry Pi accessories are both high quality and cheap.

Farnell subsidiary CPC lists the [Norwegian layout variant of the Raspberry Pi 400](https://cpc.farnell.com/raspberry-pi/rpi400-kit-no/raspberry-pi-400-kit-no/dp/SC15855?ref=ctrl.blog) for sale. It’s not listed on Farnell Norway or any other Farnell website. CPC only ships to the United Kingdom, however. I contacted Farnell Norway, and they told me the product wasn’t available and that it would be removed from the CPC website. The product listing is still up on the CPC website with no stock a month later. The product page shows that it’s expected in stock in the first week of January 2021.

**Update** (2020-12-30): The Swedish retailer Kjell (an RS Components reseller) began accepting pre-orders for the Raspberry Pi 400 with a Norwegian keyboard layout on 2020-12-18 (two days after I researched and wrote this article). Kjell doesn’t list an estimated availability date. Neither CPC nor Kjell lists just the Norwegian keyboard accessory, though. The Raspberry Pi Foundation added Jkollerup as a distributor of the Norwegian keyboard layout Raspberry Pi keyboard accessory on 2020-12-19.

#### Sources

- [Raspberry Pi keyboard and hub](https://www.raspberrypi.com/products/raspberry-pi-keyboard-and-hub/?ref=ctrl.blog), 2020-12-16, Product page, Raspberry Pi Foundation
- [Raspberry Pi Resellers](https://www.farnell.com/raspberrypi-consumer/approved-retailers.php?ref=ctrl.blog), 2020-12-16, Farnell
- [RS authorised resellers (Norway)](https://no.rs-online.com/web/generalDisplay.html?id=raspberrypi&ref=ctrl.blog), 2020-12-16, RS Components
- [RS authorised resellers (Sweden)](https://se.rs-online.com/web/generalDisplay.html?id=raspberrypi&ref=ctrl.blog), 2020-12-16, RS Components
- [RS authorised resellers (Denmark)](https://dk.rs-online.com/web/generalDisplay.html?id=raspberrypi&ref=ctrl.blog), 2020-12-16, RS Components
- [Raspberry Pi keyboards for Japan](https://www.raspberrypi.com/news/raspberry-pi-keyboards-japan/?ref=ctrl.blog), 2020-08-05, Simon Martin, Blog, Raspberry Pi Foundation
- [New keyboards for Portugal, Norway, Sweden, and Denmark](https://www.raspberrypi.com/news/new-raspberry-pi-keyboard-portugal-norway-sweden-denmark/?ref=ctrl.blog), 2020-07-03, Simon Martin, Blog, Raspberry Pi Foundation
- [Buy the official Raspberry Pi keyboard and mouse](https://www.raspberrypi.com/news/official-raspberry-pi-keyboard-mouse/?ref=ctrl.blog), 2019-04-02, Simon Martin, Blog, Raspberry Pi Foundation
- [Raspberry Pi case study](https://web.archive.org/web/20201230010406/https://www.sonypencoed.co.uk/case-studies/raspberry-pi/), 2017, UK Technology Centre, Sony Europe
### What is Brave browser’s market share
URL: https://www.ctrl.blog/entry/brave-market-share/
Last updated: 2026-08-23T22:02:36.000Z
How large is the Brave browser’s market share in the browser wars? A slew of technical hurdles make it difficult to count Brave’s user base, so no one has shared any market share analysis numbers that include Brave. Until now.

There is no definitive source for the total number of active web browser users. The only way to determine market shares among web browsers is to measure it. The go-to places for these measurements are becoming less and less relevant because advert and tracking blockers are slowly making their way to mainstream web browsers.

The best source for browser market share data have been the numbers collected and published by the two web analytic providers StatCounter and HitsLink (Net Applications.) These services measure what browsers people are using as they visit partner websites that have deployed their visitor-counter scripts. Brave blocks the tracking scripts from these two companies by default, so its users are excluded from these datasets.

User-Agent analysis has historically been the primary way to do browser market share research. [Brave doesn’t fly under its own User-Agent](https://www.ctrl.blog/entry/brave-user-agent-detection/), but masquerades as Google Chrome. It’s technically possible to [detect Brave](https://www.ctrl.blog/entry/brave-user-agent-detection/), but it wouldn’t do StatCounter and HitsLink any good as their counters are blocked from the browser anyway.

Kinsta, a WordPress hosting provider, has published the only independent numbers on web browser market share I could find that includes Brave. [Kinsta wrongly claims](https://kinsta.com/browser-market-share/?ref=ctrl.blog) that Brave’s market share is 0,05 percent. **That number is based on incorrect assumptions and faulty data.**

The text that goes with that number clarifies that the number represents the number of Chromium users according to StatCounter. Kinsta wrongly assumes that every browser that identifies as Chromium must be the Brave browser. This assumption would be wrong on its own, but Brave also identifies as Chrome and not Chromium. As previously discussed, StatCounter’s numbers don’t even include Brave users.

The only way to determine a web browser’s market share is to measure it. I’ve created [a custom visitor-counting system for Ctrl blog](https://www.ctrl.blog/entry/ctrl-analytics/), and it isn’t blocked by any major web browser. It can accurately [differentiate between Chrome and Brave](https://www.ctrl.blog/entry/brave-user-agent-detection/), and I’ve been actively recording the number of visitors using Brave for months.

I’ve analyzed this dataset to determine Brave’s market share among Ctrl blog readers. I excluded [any article about web browsers](https://www.ctrl.blog/tag/web-browsers/) from the dataset. These articles would have skewed the dataset as Brave users more often read articles about Brave, Firefox users read about Firefox, etc. I don’t uniquely track visitors, but I used [the Cloudflare visitor-counting method](https://www.ctrl.blog/entry/review-cloudflare-analytics/) to differentiate a visitor from a page view in my dataset.

Brave’s market share, at least among Ctrl blog readers, was **1,02 % as of 15th December 2020.** For the last five months, its market share has steadily trended upward by 0,021 % month-over-month. Brave’s market share on Ctrl blog is unlikely to be representative of the whole global internet population. For a starter, Ctrl blog’s readerships is skewed towards technically-minded English readers.

Brave Software periodically publishes its number of active users, for marketing purposes. Its last number, [published in October 2020](https://brave.com/20m-mau/?ref=ctrl.blog), claimed it had 20 million active monthly users. This number hasn’t been independently verified, and should be considered a marketing exercise more than anything. 

One percent may not sound like much, but one percent of all internet users — almost 5 billion people in 2020, according to the International Telecommunication Union (ITU) — is roughly 50 million people. Not every internet user uses a web browser, though, so ITU’s figure doesn’t directly translate to the web browser market. If we combine Brave and ITU’s numbers, neither really suited for the task, then Brave’s market share is 0,41 percent.

Brave Software has operated an installation referral program for years, which has paid entrepreneuring internet users to promote its web browser. Brave [discontinued its referral program](https://brave.com/referral-program-update/?ref=ctrl.blog) in mid-November 2020. I don’t know how many new installations were driven by the referral program. Anecdotally, I’ve seen Brave ads daily all over the web for at least the last year. However, I expect to see that Brave’s growth slow without the direct financial incentive to promote it.
### A technical and privacy review of Cloudflare Web Analytics
URL: https://www.ctrl.blog/entry/review-cloudflare-analytics/
Last updated: 2026-08-23T22:17:53.000Z
Last week, [Cloudflare announced](https://blog.cloudflare.com/privacy-first-web-analytics/?ref=ctrl.blog) its new [Web Analytics](https://www.cloudflare.com/web-analytics/?ref=ctrl.blog) service: a cost-free stand-alone product for counting website visitors. In its announcement, Cloudflare promised that its new service puts privacy first, doesn’t collect any personal information, and doesn’t use persistent tracking such as cookies.

Cloudflare Web Analytics (CWA) counts site visits, page views, page-load performance metrics, link-referrer data, the name of the browser and operating system, and what country the visitor is in. It hopes to compete with the likes of Google Analytics and StatCounter. Like the market leader, Google Analytics, Cloudflare offers its service cost-free without any website traffic volume restrictions. Most other competitors charge a fee based on the number of monthly page views.

The service is, however, limited to only showing data for *the last seven days.* It’s unclear whether older data is retained and will be available later, or if it’s deleted in the spirit of data-minification. I’m [all for auto-deleting old data](https://www.ctrl.blog/entry/delete-old-data-gdpr/), but doing so after seven days seems way too aggressive. There’s no paid tier to upgrade to that’ll increase the logging time. I’m not aware of any other web analytics platforms that stores historical data for less than sixty days (to compare the current to the past month’s traffic). Cloudflare hasn’t mentioned this limitation anywhere in its limited promotional material or documentation for its analytics service.

Cloudflare seems to have engineered its new service to comply with the General Data Protection Regulation (GDPR)’s “privacy by design” principle. Cloudflare claims its new service doesn’t use any persistent identifiers client-side (like cookies or `localStorage`) or immutable identifiers (like device fingerprinting or IP addresses). 

I’m always skeptical whenever any company makes a broad claim about not collecting any personal information. Merely recording a visit to a webpage that serves information on a privacy-sensitive topic could be considered to be personal information. If you operate such a website, you should probably not count visits using an external service regardless of its privacy claims.

Rather uniquely among this type of service, Cloudflare claims it won’t store any part of your visitors’ IP addresses. However, the Cloudflare Privacy Policy says it *may* log the IP addresses of “end users”, so it’s a bit unclear what its actual policy is.

Cloudflare also promises not to use cookies, but the CWA beacon script drops a cookie with a unique identifier when your browser downloads it. Cloudflare has announced plans to [deprecate this cookie](https://blog.cloudflare.com/deprecating-cfduid-cookie/?ref=ctrl.blog "Deprecating the __cfduid cookie") by mid-2021 for all its services. It feels like an oversight to launch a service and market it as cookie-free when it drops cookies in your visitors’ browsers. 

CWA uses a unique identifier per page-session called `pageloadId`. It’s a universally unique identifier (UUIDv4) that is generated locally each time a page is loaded. The identifier is used to merge multiple analytics data submissions for the same page view. (I’ll get back to why it needs this later.) The identifier isn’t stored persistently and can’t be used for tracking. Random UUID collisions can theoretically happen when relying on the uncoordinated end-user to generate this identifier. A UUID-collision is far more likely to happen because of a session-replay attack against a visitor than by pure random chance. This opens interesting possibilities for Cloudflare to better detect this class of attacks across its network. 

CWA submits the data it has collected two times per page view. The two submissions contain almost identical data. It first sends it using the `XMLHttpRequest` API (XHR) when the page has loaded, and then a second time when the page is unloaded using either the more modern Beacon API or another XHR. Cloudflare merges the two submissions from the same page-session using the `pageloadId` identifier. 

However, why is it submitting the same data twice? It’s certainly using the XHR API first to work around [a limitation with the Beacon API in older versions of Safari](https://www.ctrl.blog/entry/safari-beacon-issues/). The first submission also helps pick up any browsers that may time out while submitting data while the page is being unloaded. I can only speculate, but I suspect that Cloudflare wants to track how long each visitor spent on each page in the future. Time-on-page is a key page-quality metric that [I’ve focused on in my custom web analytics solution](https://www.ctrl.blog/entry/ctrl-analytics/). The first and second submission contains a timestamp for when the page loaded, but the second submission doesn’t include the unload time.

Cloudflare waits for the standard `pagehide` and `beforeunload` events to send the second submission. As discussed before, using [the beforeunload evicts the page](https://www.ctrl.blog/entry/safari-beacon-issues/) from the history navigation cache in Chrome, Firefox, and Safari. Simply put, it means these browsers can’t cache rendered pages and has to reload them if a visitor uses the Back and Forward buttons in their browsers to navigate your website. Had Cloudflare not broken the history navigation cache, it would have persisted the `pageloadId` identifier and helped it merge duplicate visits from visitors using these two buttons. Cloudflare’s script seems to have been written with no awareness of the history navigation cache, though.

CWA has an interesting way of counting the number of visitors. The industry-standard methods are to either count unique IP addresses or assigning each visitor an identifier and counting those. Instead, CWA counts any page-views referred from another website or nowhere (using the `Referer` request header) as both a page view and a visitor. Internal-traffic on your website is referred from itself and is therefore only counted as a page view.

However, it’s unclear how it handles situations such as page reloads as this causes the browser to resubmit the `Referer` (sic) header and generate a new `pageloadId` identifier. It’s a difficult problem to solve without using a persistent identifier, and I found no evidence that Cloudflare has solved this problem. Part of the data that Cloudflare collects includes the [navigation type](https://developer.mozilla.org/en-US/docs/Web/API/PerformanceNavigationTiming/type?ref=ctrl.blog), which can identify whether a page load was the result of clicking on a link or reloading the current page.

CWA collects everything available from the browser Performance API, including precise and detailed timing information for individual assets such as images and scripts. Cloudflare doesn’t currently use this information for anything, but Cloudflare’s launch announcement mentioned that it intends to build-out page-load performance analytics over time. I’d appreciate seeing more client-side data-minification instead of having it pull in such detailed data about each page and how it’s loaded.

**Update** (2021-09-16): Cloudflare has finally begun using the all the collected performance data in the CWA dashboard. It has focused on translating the raw measurements into the [Google Core Web Vitals](https://web.dev/articles/vitals?ref=ctrl.blog). You can learn more about it in the [announcement blog post](https://blog.cloudflare.com/web-analytics-vitals-explorer/?ref=ctrl.blog "“Discovering what’s slowing down your website with Web Analytics”").

The CWA beacon script is a 4,31 KB compressed download (10,27 KB uncompressed bytes to execute). It’s relatively light-weight compared to market-leader Google Analytics’ 19,01 KB compressed download (45,95 KB uncompressed). Cloudflare’s gains are somewhat undermined by not having a cache-policy. The script is still light-weight and shouldn’t negatively impact your page load performance. The script is loaded from `static.cloudflareinsights.com` and submits data to `cloudflareinsights.com`.

The script has been code-minified to make the download smaller, but Cloudflare doesn’t publish its source map. A source map is a special file that turns machine-readable minified code back into something that can be read by humans. Publishing source maps helps increase code and algorithmic transparency, and makes writing reviews like this one less time-consuming.

In my testing of the service, I found that CWA misidentifies almost all page views as visits to `/` (the root path/home page). This completely undermines its ability to track which pages on your website receive the most visitors. Cloudflare’s script collects the correct path, so this seems to be a bug in how Cloudflare processes the submissions.

Every web browser except Chrome now has some anti-tracking blocklists built-in by default. These blocklists either restricts these services’ ability to set cookies (irrelevant for Cloudflare), or blocks the browser from communicating with them. I doubt Cloudflare’s privacy stance will make much of a difference with anti-tracking and ad-blocking browser extensions and similar services. The CWA domain will likely (and undeservedly) end up on the same blocklists as trackers that are a hundred times worse than Cloudflare when it comes to respecting people’s privacy. The goal of the anti-trackers is to block as much tracking as possible, with no regard for promoting or allow-listing less privacy-invasive alternatives.

Cloudflare meets the requirements and in the Electronic Frontier Foundation [(EFF)’s Do Not Track (DNT) Policy](https://www.eff.org/dnt-policy?ref=ctrl.blog) (even for non-DHT-signaling visitors). It could get CQA script allow-listed with the roughly 2,8 million users of the EFF’s [Privacy Badger](https://privacybadger.org/?ref=ctrl.blog) extension by publicly committing to the EFF’s anti-tracking policy. All it would take is to republish the policy document verbatim on its `*.cloudflareinsights.com` domains.

At the close, I still have this mantra playing on repeat in the back of my mind: “if you’re not paying for a service then you’re the product.” How come Cloudflare is offering this service for free? It surely cost money to maintain, develop, and operate the service. Some website owners might be convinced by performance data showing that their slow websites can be made faster by moving to Cloudflare’s enterprise products. I doubt it will lead to an enormous number of sales, however.

I guess that what Cloudflare wants out of its service is the page-loading performance data. This data has previously only been available to Google, which gets it through its free Chrome web browser. Cloudflare’s business is delivering websites as fast as technically possible. The CWA service will help it gather extensive and precise “business intelligence” about what causes slow loading times on real-world websites on real-world devices for real-world visitors.

Cloudflare Web Analytics is a good option for website owners that want just the essential information about how many visit their website and which pages are popular (assuming it fixes the page-path bug). It’s not for you if you want to track your success over time and trends. The service has plenty of room for improvement, but I think that Cloudflare is off to a good start.

#### Sources

- [Cloudflare’s privacy-first Web Analytics is now available for everyone](https://blog.cloudflare.com/privacy-first-web-analytics/?ref=ctrl.blog), 2020-12-09, Jon Levine, Blog, Cloudflare
- [Deprecating the \_\_cfduid cookie](https://blog.cloudflare.com/deprecating-cfduid-cookie/?ref=ctrl.blog), 2020-12-09, Sergi Isasi, Blog, Cloudflare
- [beacon.min.js](https://web.archive.org/web/20201202000314if%5F/https://static.cloudflareinsights.com/beacon.min.js) (2020-12-01 version, Wayback Machine snapshot), 2020-12-02, Cloudflare, Internet Archive
- [Cloudflare Privacy Policy](https://www.cloudflare.com/privacypolicy/?ref=ctrl.blog), 2020-10-27, Cloudflare

**Reviewed:** [Web Analytics](https://www.cloudflare.com/web-analytics/?ref=ctrl.blog)

**Review rating:** 6 / 10
### Chrome to remove HTTP/2 Push
URL: https://www.ctrl.blog/entry/http2-push-chromium-deprecation/
Last updated: 2026-08-25T21:08:33.000Z
Chromium developers have [announced](https://groups.google.com/a/chromium.org/g/blink-dev/c/K3rYLvmQUBY/m/vOWBKZGoAQAJ?pli=1&ref=ctrl.blog) that they plan to remove support for HTTP/2 server push from the market-leading browser engine. Server push lets web servers preemptively send clients resources it expects them to request later. The technique can reduce the number of network round-trips required before the client has all the resources it needs to display a page. The announcement cited high implementation complexity, low adoption among websites, and questionable performance gains as the reason for the removal.

Server push is an optional feature introduced in the HTTP/2 standard. Chrome can remove it and remain compatible with the HTTP/2 standard. When used correctly, server push can greatly improve page-load times. It also enables use-cases like [instant redirects](https://www.ctrl.blog/entry/http2-push-redirects/).

Here’s an example session to highlight what could be done with server push. Let’s say the client connects to a server and requests /document. Without server push, the server responds with a redirect to /document.html. The client receives the response and sends another request for /document.html. The server sends back the requested resources. The client parses the response and discovers that it also needs /page-layout.css and /logo.png to display the page. It sends two more requests for the missing resources to the server, which promptly sends them in return. The client can then finally display the page. 

That’s a lot of back and forth between the client and the server. With server-push, the web server can take the initiative without waiting for the client. It can send the redirect, the final document, and the two required resources in response to the initial request.

Web servers don’t give you these performance benefits for free. The server or application must be configured to push the right resources at the right time. When push was first added to web browsers, there was much discussion about servers applying machine learning to automatically learn what resources it should push. Some content-delivery networks, like [Akamai](https://web.archive.org/web/20201129173631/https://developer.akamai.com/ion/adaptive-acceleration), has this capability. However, it has yet to be added to any of the leading web servers. However, I was able to find one open-source implementation of an [auto-pushing learning filter for javax.servlet](https://github.com/helospark/learning-http2-push-filter?ref=ctrl.blog).

The Chrome team has measured the adoption of HTTP/2 push, and found that only 0,05 % of all HTTP/2 sessions seen by Chrome users use server push. The low number suggests that website owners either aren’t aware of the capabilities or benefits of push, don’t have compatible servers, can’t or won’t configure it, or don’t believe it offers performance improvements good enough to justify the investment. At any rate, Chrome doesn’t think such a low adoption rate justifies maintaining its server-push implementation.

I’ve used server push for the last four years here on Ctrl blog to deliver stylesheets when you request an HTML document. The blog uses modular stylesheets tailored to each page to avoid loading and parsing unneeded styles. The median stylesheets for Ctrl blog are relatively small at 4,4 KB compared to the web-wide median of \~70 KB (according to the HTTP Archive). However, I’ve thrown away the potential savings by pushing the stylesheet on every page-load.

Servers aren’t aware of the state of the client’s cache. They can’t know what resources the client has stored from previous visits, and risk pushing assets needlessly. This can waste people’s precious data quotas, slow-down page-loading performance, and cost you more money. A standards proposal called Cache Digests was intended to address this problem. However, no browsers have implemented it since it was introduced in 2016\. The proposal has many unresolved issues, such as how to prevent the technology from being used as a “super-cookie”/persistent identifier that can be used o track returning visitors.

I use Apache and have configured it to only push the stylesheets needed for any given page. The blog consists of statically generated files; making it difficult to send dynamically generated HTTP response headers. Who knew Apache could [read file contents into a variable](https://httpd.apache.org/docs/2.4/expr.html?ref=ctrl.blog#functions) and use regex to look for stylesheet? The complexity of this approach is suboptimal, and it hurt the server’s response times too. Luckily, this only needed to be done once per document thanks to [mod\_cache](https://www.ctrl.blog/entry/mod%5Fcache/). I haven’t discussed this method on the blog before, because it’s not a technical debt I’d recommend anyone take on.

The stylesheet-pushing, combined with deferred script-loading, has ensured that pages have been rendered as quickly as possible. After the deprecation of server push, the only open-web way to get similar results is to include the stylesheet inline/embedded in the HTML documents (“inlining.”) Inlined resources don’t benefit from the shared cache, though, so you end up wasting bandwidth the same way you do with needless server pushed resources.

Following Chrome’s announcement, I decided to remove server push from Ctrl blog. It’s still supported in all the leading web browsers, but it’s effectively dead once Chrome pulls the plug. One week after removing it from the site, the performance impact is clear: the median time to first contentful paint (FCP) has increased by 10 % (adding roughly 100 milliseconds). Ouch.

You can still rely on server push, but you should start looking into alternatives. For now, that means you need to revert back to HTTP/1 best-practices like inlining critical page resources. Server push will continue to work in Chrome for some months to come. There haven’t been any public signals from Firefox or Safari about whether they intend to support server push after Chrome has removed it.

#### Sources

- [Intent to Remove: HTTP/2 and gQUIC server push](https://groups.google.com/a/chromium.org/g/blink-dev/c/K3rYLvmQUBY/m/vOWBKZGoAQAJ?pli=1&ref=ctrl.blog), 2020-11-11, Brad Lassey, Blink development mailing list, Chromium, Google
- [Feature: Remove HTTP/2 push](https://www.chromestatus.com/feature/6302414934114304?ref=ctrl.blog), 2020-11-11, Chrome Platform Status, Google
- [Cache Digests for HTTP/2](https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-cache-digest-05?ref=ctrl.blog) (draft), 2019-01-23, Kazuho Oku and Yoav Weiss, HTTP Working Group, Internet Engineering Task Force
- [Chrome’s view on Push](https://httpwg.org/wg-materials/ietf102/chrome%5Fpush.pdf?ref=ctrl.blog), 2018-07-17, Brad Lassey, Internet Engineering Task Force
- [Cache Digests: Solving the Cache Invalidation Problem of HTTP/2 Server Push to Reduce Latency and Bandwidth](https://calendar.perfplanet.com/2016/cache-digests-http2-server-push/?ref=ctrl.blog), 2016-12-16, Sebastiaan Deckers, Web Performance Calendar, Planet Performance

**Via:** [Evert Pot](https://evertpot.com/http-2-push-is-dead/?ref=ctrl.blog)
### Rollerblade wheels are a great upgrade for your office chair
URL: https://www.ctrl.blog/entry/rollerblade-wheels-chair/
Last updated: 2026-08-23T22:20:49.000Z
I swapped out my boring old office chair double-wheeled castors for rollerblade-style wheels. I didn’t quite know what I expected, but I’m happier with my chair. The new wheels also as the potential for a minuscule improve my health; so what’s not to like? Here are some of the unexpected benefits of replacing the wheels on my office chair.

A couple of months ago, I stumbled upon rollerblade-style wheels as an upgrade for office chairs. I’ve never cared much about my office chair even though I sit hours in it every day. I haven’t got a fancy office chair, just a basic model from IKEA. I don’t know why a new set of wheels appealed to me, but I know I wanted to give it a go. It was just something different.

They’re attached using a standard method that means most wheels will work on most chairs across brands. Most office chairs are compatible with one of two standard wheel stem/pin sizes: 11 mm (most brands) or 10 mm (IKEA). You just pull out the old wheels and stick in the replacement wheels. I somehow imagined that the whole chair was a single unit, and haven’t ever given much thought to how the wheels work. I must have known this when I assembled my IKEA chair, but I must have forgotten it in the decade since.

Rollerblade-style wheels cost about 25 USD, available from major retailers. These wheels are sometimes marketed as “gaming wheels”. Brands also apply the “gaming” label to chewing gum and plain bottled water, so it really doesn’t mean anything anymore.

So, how much difference does a new set of wheels make? It makes a surprising amount of difference in different situations. I’ll start with the most obvious ones and work my way through the list.

Most traditional office chair wheels are designed to sit in one place unless you apply force to move it. Rollerblade wheels can move freely, and the only resistance coming from the wheels having to turn in-place to accommodate directional changes. This might sound like an undesirable effect at first glance. Even small movements can easily send you a couple of centimeters off in one direction.

If you’re reading this blog, then you’re probably spending way too many hours of the day sitting. It’s difficult to sit completely still with rollerblade wheels. I don’t find myself constantly fidgeting on the chair. However, it does require me to exert some extra energy throughout the day to move it back into position. This was distracting the first couple of days, but now I do it subconsciously.

This won’t replace exercise and a healthy lifestyle, but it probably doesn’t hurt either. I found a much-cited research study on [standing-desks versus sitting-desks](https://oem.bmj.com/content/71/2/109?ref=ctrl.blog) where researchers compared the blood glucose levels of office workers using either type of desk. Glucose level is a key health metric. Any amount of physical activity can help regulate glucose levels, and standing desks are known to increases the levels of low-level physical activity. Workers in the study saw improved post-meal glucose levels when using the standing desk compared to sitting.

You’ll need a walking desk if you want to lose weight. Neither a standing-desk nor a wheel upgrade for your chair will come anywhere near the heart-rate and activity levels you get from even light exercise. Extrapolating from the study, I *assume* that the extra movements encouraged by the rollerblade-wheels can help me — as a diabetic — regulate my glucose levels. It probably won’t help a whole lot, but it might help a little.

My chair is still comfortable to sit in. It hasn’t suddenly turned into the deliberately-uncomfortable [Focus Master chair](https://www.helsinkitimes.fi/columns/164-remote-control/622-better-off-with-ted.html?ref=ctrl.blog) from Better Off Ted. It feels great, and the wheels never get stuck when I try to move it. After swapping out the wheels, it sometimes rolls off to the other side of the room when I get up. It just requires a little more effort to keep it in one spot.

I’ve found that the new wheels also help me maintain a good sitting posture. I must sit with my feet firmly planted on the ground, or I’ll risk pushing myself off from the desk with small movements such as retrieving the phone from my pocket.

Many product listings for rollerblade-wheels claim that they’re easier on most floor surfaces than traditional wheels. They definitely have a smaller contact area with the floor, and the reduced resistance helps avoid skid marks on the floor. It sounds logical, but I don’t have any way to evaluate this claim.

A more unexpected side-effect is that I never need to get off my chair and disentangle headphone or charging cables from my chair. Traditional office chair wheels castors use two wheels side-by-side, leaving a gap in between where cables can easily get snagged. The rollerblade wheels either runs over the cables or pushes them aside.

The only drawback with rollerblade wheels is that you can’t stand and lean on your chair anymore. If casual chair-leaning is your thing, then rollerblade-style wheels might not be for you. It can also injure others who lean on your chair and expect it to behave like a regular chair.
### The projector lamp trap
URL: https://www.ctrl.blog/entry/projector-lamp-trap/
Last updated: 2026-08-23T22:16:05.000Z
I’ve owned three different projectors in the last decade. All of them have been your average mid-range wall-mounted home-theater projector. Fool me thrice, and I’ve finally learned my lesson and bought a TV instead.

Initially, I wanted a projector instead of a TV because it gave me a huge picture without burdening myself with a big and transport-unfriendly piece of furniture. I also disliked the idea of having a big and imposing black box in my living room. I decided to get a wall-mounted projector instead.

The first projector I got was an Optoma. It lasted five years and went out with a literal bang when the bulb exploded and took with it the mirrors in the lamp housing as well. It sent shards of glass flying everywhere and down onto my head and all over the sofa. Let’s just say I was quite shocked by the episode.

I wasn’t sure if the projector still worked or if some pieces of glass had embedded themselves into other components. I found a replacement bulb and lamp housing listed in one online store, but it cost almost as much as a new projector. I didn’t want to make an investment in replacement parts that I wasn’t sure would fix the problem.

I decided to replace it with another newer Optoma model instead of trying to clean out all the glass, and investing in a new lamp housing that might not work. I checked the cost of a replacement bulb and lamp housing for the new model before buying it. The bulb and lamp housing for the new projector cost about 90 USD, but I didn’t buy it when I bought the new projector.

The bulb in my second projector blinked out about three years later. This was a then five-year-old model, and the manufacturer had stopped selling replacement parts a year earlier. I checked online and the price of a replacement bulb and lamp housing had increased to 350 USD for the original part. I also found a “compatible” third-party option with no warranty for 220 USD. Yikes. Both options had to be imported with international shipping, import duties, and fees bringing the price for the original part up to nearly 440 USD.

On the other hand, a new projector that promised to be both brighter and quieter cost 520 USD and I could get it delivered for free the next day. This was an Acer projector with impressive reviews from projector special-interest websites. Again, I made sure to check that the price for the replacement parts and was happy to see they didn’t cost more than about 100 USD. I opted to replace the projector rather than trying to service the old one.

We’re now two and a half years later and in the present day. The bulb in my third projector is notably dimmer than it’s supposed to be, and the projector has begun displaying warnings urging me to replace it. The manufacturer had stopped selling replacement parts for my now four-year-old model. A local store listed the bulb (without the lamp housing) for 210 USD. Replacing just the bulb without replacing the entire lamp house isn’t a trivial task. Disassembling the lamp house without breaking it or the mirrors is finicky. Reassembling it and getting the mirrors just right is damned near impossible for an untrained amateur. An incredibly sketchy-looking website lists a “compatible” third-party bulb and lamp housing for only 260 USD plus international shipping, import duties, and fees. Neither options were in stock and the expected delivery time was about two months.

At this point, I felt like a complete idiot. I should have invested in a replacement bulb and lamp housing when I bought the damned projector! I’d made the same mistake three times in a row and newer learned from my mistake long the way. I also felt duped by a cynical industry that doesn’t supply the market with consumable replacement parts, presumably to both screw-with and up-sell their customers in the future.

The crazy price inflation on the replacement bulbs and lamp houses is one thing. Another annoyance is that it took me days to identify and locate the replacement parts each time. The parts aren’t listed in the product manuals, and I had to dig through partially archived versions of the manufacturers’ websites in the Internet Archive to find the part numbers. Online store listings for projector bulbs are also cryptic and hard to decipher. I found that the parts often work with a few different projectors, but that the store listings fail to identify the part number and what projectors they’re supposed to work with. As a customer, you have to guess and pester the store’s support email address for more details about the compatibility of the parts. You’re clearly supposed to replace the whole unit and not try to replace its consumable parts.

I briefly considered replacing the projector with a 1080 p 1550 USD laser projector. Laser projectors are expected to last roughly 15 years at 3-hours of use per day compared to an estimated 3,65 years for a traditional projector. There is no guarantee that the projector would actually last that long, though. Its fan or power supply could go out, and there are tons of other different failure modes. The price tag is about the same I’ve spent on projectors over the last decade. Knowing what I know today, I’d definitely spend the money on a laser projector had they’d been so affordable and durable a decade ago!

However, I’d finally learned my lesson and wanted to take advantage of the November sale-season. My last projector has been taken down off the wall and handed in for recycling. Instead, my living room is dominated by a 1,65-meter rectangular black box branded Sony Bravia.

The Bravia TV only cost 1200 USD and comes with a welcome image quality upgrade to 4 K and HDR compared to my past 1080 p projectors. I’ve only had the TV for a couple of days, and it’s so big and assertive that I get startled every time I walk into the room. It’s slightly more than half the size of the projector image, yet it feels like it takes up five times as much space. 

My new Sony TV didn’t come with the [EU’s new energy-efficiency labels](https://www.ctrl.blog/entry/eu-display-firmware-label/). The new labels are required to contain information about replacement-part availability and software update availability. It would have been useful to know these things before I bought the TV so that I could avoid making the same mistake as I’ve done with my projectors. The new energy-efficiency ratings and labels don’t come into effect until February 2021. Projectors, and many other electronics like laptops and phones, aren’t covered by the new label requirements. 

Owning a projector might be a different experience in a different market. I live in Norway and it’s often difficult to get hold of replacement parts and specialist items. There also aren’t any repair shops that accept these projectors. Not that I’d want to hand one in just to replace a user-serviceable consumable part. The projector manufacturers were entirely unhelpful when I’ve asked them for help with procuring replacement parts. This story might have had a different ending if I’d lived somewhere else like the United States.

The prices quoted in this article span a ten-year period, but were adjusted for inflation at the time of publishing.
### My MacBook Pro needed a battery replacement
URL: https://www.ctrl.blog/entry/macbook-late2013-battery-replacement/
Last updated: 2026-08-23T22:13:51.000Z
The battery on my seven-year-old MacBook Pro Retina from late 2013 (a.k.a. MacBookPro11,2) had begun to swell. This is caused by a chemical reaction that happens near the end of life for lithium-ion batteries. It’s no longer safe to use it in this state as the swelling battery can damage sensitive components, and it is more at risk of being punctured and burst into a high-intensity fire.

My MacBook has had a history of heat-problems and this has probably contributed to its battery death. I’ve got a small collection of old laptops, and it’s [the hot ones](https://www.ctrl.blog/entry/rereview-lenovo-yoga3-pro/) that suffer from battery issues. It’s also a seven-year-old battery, and batteries don’t last forever. Whatever the cause, the swollen battery needed to be removed and replaced.

I originally planned to bring my MacBook in for service. The local repair shops wanted to charge almost ¼ the price of a new MacBook Air for the job, and didn’t have access to original batteries. Instead of paying the exorbitant service fee, I decided to attempt to remove and replace the battery myself.

A high-capacity battery can be dangerous; especially when it’s swollen or otherwise damaged. Don’t attempt to service it unless you know you can handle the fire-safety, ventilation, and personal protection requirements for defusing a small bomb. Inform the recycling center that your battery is damaged so they know to handle it with care.

I could see the battery right away after unscrewing the backplate. You only need to unscrew a couple of screws inside the laptop, and disconnect the battery cable. Then you can just lift the battery out of its slot. Well, things weren’t *that* easy. The battery was glued in place.

After researching on the web, I learned that the proper solution to get it out required pouring glue dissolver liquid into the battery compartment. I was hesitant to pour any liquid into my Mac. Instead, I opted for cutting through the glue with glue-cutting-wire. (Actually, I just used some dental floss.) It took some effort to get the dental floss in place between each of the battery cells and the aluminum chassis. Once the wire was in place, it was quite easy to cut loose the battery cells by wiggling the wire back and forth.

I didn’t replace the battery at this time, but screwed in the backplate, connected the MacBook to a power supply, and turned it on. I don’t actually need this computer to be portable any longer, and I’d like the option to keep using it without a battery. I’ve got other laptops, but I still want to have a system running MacOS available. I thought I could still use it while it was connected to a power supply.

This is when I learned about another annoying design decision by Apple. MacOS will undervolt the processor by 60–80 % when the battery is missing! It would turn on without a battery connected, but the performance tanked. The MacBook became unbearably slow. Every simple operation from clicking or opening a context menu to opening a Finder window or browser tab took what felt like ten times longer than usual. I even got the beach-ball of death for every couple of letters I typed into TextEdit.

I needed to replace the battery to get the Mac back in a working state. I initially wanted to replace it with an original battery, but ran into a few problems. Apple doesn’t want there to be any official replacement parts on the market. The only place you can get them is from an authorized repair shop; which isn’t allowed to sell them on to consumers. Anti-trust and right-to-repair issues aside, I came across a claim that made me change my mind regarding using an official replacement battery:

Lithium-ion batteries have a limited shelf-life. The chemicals in them deteriorate over time, even when they’re not in use. “Official batteries” tend to be manufactured in large quantities and then kept in storage for several years. Third-party batteries, on the other hand, get manufactured in smaller quantities depending on demand and are “fresher” at the time of sale.

After looking around for third-party options, I learned that no retailers that ship to my location had a compatible battery in stock. As far as I could tell, no European stores had it in stock at that time. This could be because of the COVID-19 pandemic, but the availability issue also did support the claim I’d read about third-party batteries being manufactured on-demand. Regardless, I had to wait two months to get a replacement battery! On the bright side, the replacement battery only cost ¼ of what it would have cost at an Apple Authorized repair shop.

Installing the new battery was way easier than taking out the old one. Pop open the backplate, slip in the new battery, and reconnect the battery connector. Easy-peasy, lithium-ion squeezy.

The replacement battery is a Cameron Sino-brand model CS-AM1494NB with an 8,4 ampere-hour (Ah) capacity. This is the same capacity as when the original battery was new. I find it interesting that the old battery still had a capacity of 6,4 aH after years of use. I wouldn’t expect to see swelling on a battery that seemed this, relatively speaking, healthy. My other older laptops have seen a higher degradation of capacity, but those batteries haven’t yet swollen.

However, I’ve noticed that the new battery lasts about five hours while the old one would typically last eight hours. So, that’s eight hours at its end of life compared to six from a brand new one. Six hours is enough for my needs, but I’m not impressed by the performance of the new battery.

**Update** (2020-12-02): The battery capacity issue seems to have been caused by a calibration error in the battery controller. The battery would drop from 42 % to 7 % and remain there for a few hours. I failed to notice this and though it needed to be recharged. After I noticed the pattern, I just kept using the MacBook at 7 % charge until it powered off roughly three hours later. I then charged it back up to 100 %. After doing this once, the battery now reports the right charge level, and the battery life has increased to about eight hours.

Newer MacBook models received an update earlier this year to [improve battery management](https://support.apple.com/en-us/211094?ref=ctrl.blog). The updated battery manager is designed to improve battery lifespan by reducing its rate of chemically aging. The new feature would have been too little, too late for my aging battery. I hope to keep this Mac running for a few more years, and I’d be grateful if my Mac had received support for the new feature. It seems that Apple doesn’t expect MacBooks to last more than about seven years, although the model is supported in the latest version of MacOS.

I can’t say for sure whether the reduced battery life is caused by the replacement battery. There are multiple factors at play, and I don’t have a way to identify the root cause without dedicating significant effort. I [improved the efficiency of the cooling system](https://www.ctrl.blog/entry/repaste-thermal-compound/) when I replaced the battery. This could have contributed to an increased power demand as the computer hasn’t been thermally throttled. The battery replacement coincided with the release of MacOS 11.0 Big Sur, which could also be the real culprit. My usage pattern may also have changed, although my Screen Time reports suggest this isn’t the case.

I’ve tried my darnedest to maintain the battery on this MacBook. One of the biggest challenges has been the bad thermal design. Batteries don’t like hot temperatures, and the MacBook runs way too hot for it. The Intel processor that’s in this machine is running too damned hot for its limited cooling system. I’ve learned a lot about battery management in recent years, mostly because of this computer. I’m kind of grateful for the learning opportunity it has offered, but I’m also frustrated with Apple.

I’ve [worked around bugs in the system controller](https://www.ctrl.blog/entry/macbook-late2013-hot-smc/), [repasted the cooling compound](https://www.ctrl.blog/entry/repaste-thermal-compound/), [turned off processor boost mode](https://www.ctrl.blog/entry/laptop-boost-mode-battery/) to keep it from overexerting the cooling system, and added some [felt pad feet](https://www.ctrl.blog/entry/how-to-laptop-air-cooling-pads/) for better airflow. It shouldn’t be nessecary to put so much effort into prolonging the life of your laptop. It should have been designed to last. It’ll be interesting to see whether the new Apple-designed processor chips in the latest generation MacBooks will outperform the old Intel ones when it comes to thermal management.
### How to resize ZRAM (compressed swap) managed by systemd/zram-generator
URL: https://www.ctrl.blog/entry/how-to-systemd-zram-generator/
Last updated: 2026-08-23T22:11:04.000Z
Fedora Linux 33 was released last week with some [interesting changes](https://fedoraproject.org/wiki/Category:ChangeAcceptedF33?ref=ctrl.blog) like switching the default file system to BtrFS, handing DNS resolution over to [systemd-resolved](https://www.ctrl.blog/entry/systemd-resolved/), and enabling ZRAM instead of a swap partition by default. I’ll focus on the latter feature in this article.

ZRAM is a Linux kernel subsystem for handling compression of volatile memory (RAM). Compression sacrifices some processor time in exchange for more space-efficient utilization of your available RAM. ZRAM acts like a traditional storage drive backed swap partition, except that it lives entirely in your system RAM. The exact compression ratio you can expect depends on what you’re keeping in memory.

Fedora Linux uses `systemd/zram-generator` to manage the creation of the virtual ZRAM device during system boot. This is handled through a `systemd` service called `systemd-zram-setup@zram0.service`. This service is enabled by default in new installations and on upgrade from earlier versions of Fedora Linux.

If you have a swap partition *and* ZRAM enabled, the system will prefer swapping out memory to the ZRAM device before falling back to the slower swap partition. Note that you can’t hibernate into [something that only exists in memory](https://www.ctrl.blog/entry/linux-hibernate-tmpfs/). Hibernation still isn’t officially supported by Fedora Linux so this wasn’t a concern for their decision to switch to ZRAM by default. However, I’ve updated my [tutorial on enabling hibernation in Fedora Linux](https://www.ctrl.blog/entry/fedora-hibernate/) with more details.

The default configuration of the `systemd/zram-generator` will create a ZRAM device of 50 % of the physical volatile memory up to 8 GB (whichever is smaller). My typical workload involves a lot of text processing and data that compresses well, so I wanted to increase the size of the ZRAM device. My primary computer has 32 GB of physical volatile memory and 16 processor threads, so it should have plenty of backing resources to spare. I also wanted to increase the ZRAM device size on my servers and virtual private servers (VPS).

To increase the size of your ZRAM device, create the file `/etc/systemd/zram-generator.conf` and include the below configuration example. (You can also leave an empty file in this path to disable ZRAM.)

```ini
[zram0]
zram-fraction=0.5
max-zram-size=4096
```

The limits given above matches the default limits (50 % of available memory or 8 GB in MB). Change the limits to your preference. Keep in mind that the system can become unstable if you set it too high. I suggest staying with the default factor of 0.5 and increasing the max size to match your available system memory. For example, set `max-zram-size=8192` if you have 16 GB of RAM.

You can experiment with different settings to discover what works best for you. Check out the [zram-generator.conf manual page](https://github.com/systemd/zram-generator/blob/master/man/zram-generator.conf.md?ref=ctrl.blog) for more configuration options like how to change the default compression algorithm.

I followed my own advice on my primary desktop computer. However, I set the limits fairly high on my low-memory budget VPSes. These servers run under constant high-memory pressure, but I was able to effectively double their available memory with ZRAM. Constant memory constraints is the hallmark of budget VPSes. I’m a bit annoyed with myself for not exploring compressed RAM earlier.

You can recreate the ZRAM device immediately without a reboot if you have enough physical memory to hold an uncompressed copy of all your currently compressed memory. The commands `free` and `zramctl` can help you determine the current memory pressure and compression ratio. Run the command `systemctl restart systemd-zram-setup@zram0.service` to recreate the ZRAM device without rebooting. However, the safest and quickest option is probably to save your work and reboot.

The configuration file at `/etc/zram.conf` is a legacy file that is no longer used.

**Update** (2021-05-03): Fedora Linux 34 changed the default maximum zram size from 4 GB to 8 GB, and from 25 % to 50 % of physical RAM. The `swap-create@zram0.service` was also renamed to `systemd-zram-setup@zram0.service`.

#### Sources

- [Changes/Scale ZRAM to full memory size](https://fedoraproject.org/w/index.php?title=Changes/Scale%5FZRAM%5Fto%5Ffull%5Fmemory%5Fsize&oldid=602477&ref=ctrl.blog), revision 602477, 2021-01-27, Wiki, Fedora Project
- [Changes/SwapOnZRAM](https://fedoraproject.org/w/index.php?title=Changes/SwapOnZRAM&oldid=590520&ref=ctrl.blog), revision 590520, 2020-10-13, Wiki, Fedora Project
- [zram-generator man page](https://github.com/systemd/zram-generator/blob/0b49fad8cbcbbef1c7711ca046a6b83ba50ed8f2/man/zram-generator.md?ref=ctrl.blog), commit 0b49fad8cb, 2020-06-19, Ahelenia Ziemiańska, systemd/zram-generator project, GitHub
- [zram-generator.conf man page](https://github.com/systemd/zram-generator/blob/0b49fad8cbcbbef1c7711ca046a6b83ba50ed8f2/man/zram-generator.conf.md?ref=ctrl.blog), commit 0b49fad8cb, 2020-06-19, Ahelenia Ziemiańska, systemd/zram-generator project, GitHub
- [zram: Compressed RAM-based block devices](https://www.kernel.org/doc/html/latest/admin-guide/blockdev/zram.html?ref=ctrl.blog), commit 56e6b3b0b3, 2020-02-06, The Linux kernel user’s and administrator’s guide, Linux Kernel Project
### Don’t super glue heatsinks to your Raspberry Pi
URL: https://www.ctrl.blog/entry/raspberry-heatsink-glue/
Last updated: 2026-08-23T22:16:13.000Z
I recently bought a Raspberry Pi 4B to use as a small always-on home server. I don’t plan to run it at full throttle all the time, but I still wanted to upgrade it with a heatsink. Its processor comes with a small heat spreader as the board’s only cooling solution. A heatsink is a chunkier block of aluminum than what’s used in the built-in heat spreader, and it has fins that help with heat dissipation. This upgrade should give it a little more headroom before the processor begins throttling performance to keep itself from overheating.

I wanted to find a heatsink that either came with a syringe of thermal adhesive glue or a set of adhesive thermal pads. I browsed for options on AliExpress and found a couple of potential candidates. As per usual, the product description and specifications on AliExpress were incomplete and it was hard to determine which listings fit my requirements. I looked in the review sections to try and determine if any other customers had shared any useful insights.

Among the reviews on several listings, I found lots of confused consumers who’ve bought heatsinks only to realize they didn’t have a way to attach them. Some customers shared “helpful” reviews where they suggested to attach the heatsinks with super glue or double-sided tape. This same idea is also shared on a few blogs and in reviews on other shopping sites. This advice is completely wrong. You should *not* use super glue or regular tape to attach a heatsink to anything!

I wrote a larger piece about [thermal compounds](https://www.ctrl.blog/entry/repaste-thermal-compound/) a few weeks back. To reiterate: thermal compounds are used to fill the tiny gaps between the processor’s heat spreader and the heatsink. Thermal compound — whether in the form of a highly conductive paste, adhesive glue, or adhesive pads — is thermally conductive and designed to help improve heat transfers up to temperatures to about 115 ℃. Computer processors generally aim to operate at or just below 100 ℃ to keep them from exceeding the tolerance of its thermal compounds.

Super glue, on the other hand, consists of oils and plastic. It’s heat insulating rather than conductive. It will inhibit instead of aid heat transfer from the processor and into the heatsink. To add insult to injury, it will also make the processor’s tiny heat spreader less effective after you’ve covered it up with an insulator. The exact temperature ranges will vary by brand, but you can expect most super glues to begin melting at or before 80 ℃. Regular double-sided tape has the same problems.

You must either use a thermal adhesive glue or thermal pads with a heat-tolerance of at least 100 ℃ plus some thermal headroom. The thermal adhesive glue will likely do a better than adhesive pads job of filling in the gaps between the heat spreader and heatsink. Thermal pads, on the other hand, are easier to apply and crucially will be much easier to replace later. Intel recommends that you [replace thermal compounds every few years](https://www.ctrl.blog/entry/repaste-thermal-compound/).

In larger electronics, there is usually a physical mounting system to press the heatsink firmly against the heat spreader and hold it in place. The tubes/syringes of thermal compound/paste/grease you’ll find in most electronics stores are designed for use with this setup. They’re not adhesive! Make sure you pick one that’s labeled as an adhesive if you want to use a thermally conductive glue instead of thermal pads.
### The entirely predictable problems with the Vulnonym naming scheme
URL: https://www.ctrl.blog/entry/sensational-vulnonym/
Last updated: 2026-08-23T22:21:52.000Z
Security researchers increasingly give security vulnerabilities they discover a unique and memorable name and logo. Names (and cute logos) generate more exposure for the vulnerability and the researchers who found it. The Computer Emergency Response Team Coordination Center (CERT/CC) believes this naming trend invokes “fear, uncertainty, and doubt for vendors, researchers, and the general public.” To address the situation, it has [introduced Vulnonyms](https://insights.sei.cmu.edu/blog/vulnonym-stop-the-naming-madness/?ref=ctrl.blog): a system for automatically naming vulnerabilities. What could possibly go wrong⸮

Security vulnerabilities are often entered into the Common Vulnerabilities and Exposures (CVE) database and assigned a CVE ID number. These numbers are in the format CVE-YEAR\-NUMBER, e.g. CVE-2020-12345. These identifiers, unlike the names assigned by researchers, aren’t memorable. 

Vulnonyms is supposed to fill the gap between a memorable name and a CVE ID. A vulnonym consists of an adjective followed by a noun. The words are picked from a curated dictionary list that corresponds to the vulnerability’s CVE ID. Stated goals for the project include “stopping the naming madness” and “ensur\[ing\] no sensational, scary, or offensive names were included.” The scheme is experimental and CERT/CC currently only publishes the names in a Twitter feed of new CVEs.

The results of any effort to let a computer name things are quite predictable. The first name I saw on the Twitter feed was “[Terrible Meteor](https://twitter.com/vulnonym/status/1323763905299156993?ref=ctrl.blog)”: a quite sensational and scary name that might imply an imminent apocalypse. The feed is also filled with other unfortunate names like “[Suggestive Bunny](https://twitter.com/vulnonym/status/1323255946366328835?ref=ctrl.blog)” and “[Brisk Squirt](https://twitter.com/vulnonym/status/1323534787777306624?ref=ctrl.blog).”

CERT/CC hasn’t released the exact list of dictionary words or the algorithm used to select the names. However, it says it has scrubbed the dictionary to avoid unfortunate names. It has a process ready to generate new names for researchers whose work is assigned unflattering names.

The problem with using words for naming things is that words have meanings. You can’t randomly combine words into phrases without — at least sometimes — creating meaning and associations. People can’t turn off the part of their brain that spot patterns and try to glean meaning from what is supposed to be an arbitrary random name. This strategy doesn’t even work when combining random letters, as you end up with things like [a barcode that reads “BUMSEX”](https://metro.co.uk/2017/09/20/postal-vote-for-gay-marriage-has-unfortunate-bumsex-barcode-6941087/?ref=ctrl.blog) for a postal vote on same-sex marriage equality.

Would you expect that a security vulnerability named “[Filthy Python](https://twitter.com/vulnonym/status/1318990330327420929?ref=ctrl.blog)” perhaps had something to do with a memory-buffer overflow in the popular Python programming language? Well, it doesn’t. It refers to a security vulnerability in an open-source video-conferencing platform that is built in a long list of programming languages *not* including Python.

How about “[Hazy Bit](https://twitter.com/vulnonym/status/1322087142177284096?ref=ctrl.blog)”? Surely that must be a new processor side-channel vulnerability in the Spectre/Meltdown family? Nope, it’s a bug in Trend Micro Antivirus that can crash your Mac. “[Untreated Drive](https://twitter.com/vulnonym/status/1321793002680000516?ref=ctrl.blog)” must surely be some kind of exploit involving tomfoolery with a storage drive controller driver? Again no, it’s an attacker-in-the-middle vulnerability in Synology network routers.

Many of the vulnonyms in the Twitter feed uses uncommon words with difficult spelling and pronunciation. You need a dictionary and a thesaurus at hand to know what they mean and how they’re pronounced.

I’ve selected some fun examples from the Twitter feed for this article to prove a point. I hope CERT/CC will drop its ill-conceived naming scheme. After all, it had an entirely “Predictable Outcome.”
### TeamViewer RPM repo left door open for malicious packages
URL: https://www.ctrl.blog/entry/teamviewer-rpm-repo-security/
Last updated: 2026-08-23T22:23:12.000Z
Three months ago, I discovered a security vulnerability in TeamViewer RPM auto-updates on Linux. The vulnerability allowed an attacker-in-the-middle (AITM) to subvert the TeamViewer RPM package repository to install and execute arbitrary software with root permissions. 

First thing first: TeamViewer followed best practices and used cryptographic signing (GPG) on the repository metadata and its software packages. These measures should have prevented anyone from tampering with either the repository or any of its packages. However, it assumes that the system has a copy of TeamViewer’s public GPG key.

Unfortunately, TeamViewer made a mistake with how it distributes its GPG public key. The mistake let an AITM substitute its own public key during repository updates, package installations, and package updates. The vulnerability would even prompt the user to accept a new key if the system had previously trusted a different key for the TeamViewer RPM repository.

TeamViewer distributes an RPM package on its website. To install TeamViewer, users would download this package over a secure connection. The user would assume it’s safe to install something that comes from the official website. TeamViewer signs all RPM packages with its GPG key. This can be used to cryptographically verify that the package was indeed created by TeamViewer. The package didn’t come from a known RPM repository at this point, though. The typical installation tools (GNOME Software, KDE discover, DNF, or YUM) doesn’t enforce GPG-checks on side-loaded packages.

The RPM package installs TeamViewer and a new RPM repository configuration file onto the system. The repository configuration file enables the typical package management and update tools to pull in updates automatically from TeamViewer when the rest of the system is updated. TeamViewer doesn’t include a copy of its public GPG key in the RPM package, however. The repository configuration file contains the following options:

```ini
gpgcheck=1
gpgkey=http://linux.teamviewer.com/pubkey/currentkey.asc
baseurl=http://linux.teamviewer.com/yum/stable/main/binary-$basearch/
```

The `gpgcheck` option opts-in to GPG checking of any packages downloaded from the repository. The `gpgkey` option tells the system to on-demand retrieve the GPG key from the provided address. The GPG retrieval address doesn’t use encryption and is subject to ATIM manipulation. The option also tells the system to try fetching an updated key from this address if it runs into a problem with the key, such as a mismatch, in the future.

The configuration file is also missing the `repo_gpgcheck` option. Without this option set, the integrity of the repository itself won’t be verified. The repository itself is also accessed over an unencrypted connection which is also subject to ATIM manipulation.

The combination of these weaknesses greatly simplifies effective exploitation. An AITM can modify packages and make any arbitrary changes to the repository. The installed repository configuration file requires that the packages be signed. As the attacker also controls the key update address, they could simply substitute their own key.

The update system will prompt the user to trust any new GPG keys. At this point, users can pause the upgrade process and try to manually verify that the key they’re presented with is indeed TeamViewer’s authentic key. Unfortunately, users are far more likely to chose the path of least resistance and just accept the new key to proceed with the update.

System updates are run with full root system privileges. The vulnerabilities enables an attacker the ability to execute and persistently install software with full system privileges. An attacked system must be considered fully and irrecoverably compromised after this vulnerability had been exploited.

The TeamViewer RPM repository was already available over HTTPS. Users could manually modify the repository configuration file to use HTTPS instead of HTTP. After I made TeamViewer aware of the issue, it delivered an update that makes HTTPS the new default. It also enabled the missing `repo_gpgcheck` option.

TeamViewer fixed the security vulnerabilities discussed in this article in version 15.11.6 released on 2020-10-27. It did not mention the fix in the release changelog. The fix is deployed automatically on upgrade unless you’ve manually modified the `/etc/yum.repos.d/teamviewer.repo` file after installation. 

I reported this security vulnerability against TeamViewer version 15.8.3 on 2020-08-14. TeamViewer quickly acknowledged the issue, but it took the company two and a half month to fix it. The required fix was trivial, but the changelog for version 15.9.5 (released two weeks after my report) suggest that TeamViewer had some other problem with its RPM signing. 

I have no evidence that this was exploited in the wild. The vulnerability only affected the TeamViewer RPM repository, and did not affect its APT packages or repository. Debian and its derivatives (like Ubuntu) use APT. Fedora Linux, CentOS, OpenSUSE, and others use RPM.

To avoid this oversight from affecting other projects, software update tools that use RPM repositories should introduce additional security checks. To this end, I’ve sent [a patch to DNF](https://github.com/rpm-software-management/dnf/pull/1676?ref=ctrl.blog) that adds a warning when GPG keys are retrieved over HTTP.

#### Sources

- [\[Linux\] v15.11.6 (Full) - Changelog](https://community.teamviewer.com/English/discussion/105290/linux-v15-11-6-full-change-log?ref=ctrl.blog), 2020-10-27, Community forums, TeamViewer
- [\[Linux\] v15.9.5 (Full) - Changelog](https://community.teamviewer.com/English/discussion/101583/linux-v15-9-5-full-change-log?ref=ctrl.blog), 2020-09-01, Community forums, TeamViewer
- [DNF Configuration Reference](https://dnf.readthedocs.io/en/stable/conf%5Fref.html?ref=ctrl.blog), revision b9b76238, 2020-06-16, DNF, Read The Docs
- [Fedora package delivery security](https://patrick.uiterwijk.org/posts/fedora-package-delivery-security/?ref=ctrl.blog), 2018-02-23, Patrick Uiterwijk, blog
- [Secure distribution of RPM packages](https://www.redhat.com/en/blog/secure-distribution-rpm-packages?ref=ctrl.blog), 2015-08-19, Florian Weimer, Security Blog, Red Hat
### Twitter preconnects to the wrong domains
URL: https://www.ctrl.blog/entry/twitter-preconnects/
Last updated: 2026-08-23T22:23:40.000Z
Twitter tried to reduce load times for external links, but it made things slower instead. It mistakenly normalizes domain names to a point where they’re no longer can be used to fulfill their task.

I’ve previously written about [when to use <link rel="preconnect">](https://www.ctrl.blog/entry/dns-prefetch-preconnect/). That article also serves as an introduction if you’re unfamiliar with the topic.

Twitter redirects links through its `t.co` link-shortening service. It was once a useful addition to its service as it helped people stay underneath the strict character limits. The link shortener reduced all links to 23 characters. Twitter gains some more data-insights about its users in the form of click-stream data and insight into popular links.

However, the link shortening service has another cost: links resolve slower. Instead of clicking-through directly to the destination website, the browser needs to connect to Twitter’s link-shortening service and then follow a redirect to the destination website. To speed up the process, Twitter preconnects to its link-shortening service every time you scroll a link card into view. Link cards are boxes that show an image, title, and description of a link. This shows that Twitter finds it highly likely that people will click on external links in tweets.

To speed things up even further, Twitter also preconnects to the destination website at the other end of the redirect. This is where it has made some mistakes, though.

You may be wondering why it’s even using the link-shortening service anymore if it already knows the destination address. Reread the previous paragraph for clarification on Twitter’s motivations.

Before I go on to discuss the issues, I have to talk a little bit about privacy. Preconnects doesn’t transmit any HTTP headers, cookies, or other identifying data. The destination website doesn’t have any idea why the client opened a connection to it at this point. It has just opened a connection and is waiting for a request to come in. Its servers can identify the TLS library and version used to establish the connection, but this is in no way unique data. A third-party that can observe the relevant network traffic will know that the user either tried to connect to or saw a link to the domain name or server in question.

That being said, Twitter will often preconnect to the wrong website. As an example, let’s look at the tweets by @nytimes. The links shared by this account link to the domain www.nytimes.com. Instead of preconnecting here, Twitter preconnects to nytimes.com. These connections are, of course, made to the wrong server so they’ll never be used. 

Tweets posted through Twitter Advertising (whether you see that tweet as an advert or not) don’t have this problem. These tweets don’t use t.co and always preconnect to the right server (in addition to also preconnecting to the wrong server). 

The incorrect domain name used for the preconnect seems to originate from the display URL property of Twitter’s API. It strips out the www. prefix to make a ”display version“ of the URL. I have no problem with this, as the prefix is entirely meaningless to humans. It does serve important technical functions, however. Twitter doesn’t remove it from the actual redirect URL. 

Let us look in more detail what happens when a user clicks on a link and when the browser gets to use the preconnection.

Firstly, the browser now needs to resolve the domain name including the www. prefix. Secondly, the browser needs to establish a TCP connection and set up a TLS connection. All these steps would be done already had Twitter only connected to the correct domain in the first place. 

It’s difficult to say exactly when this issue began. I can’t look at older versions of Twitter, as its pages don’t work well in the Internet Archive’s Wayback Machine. Come to think of it, should Twitter be preconnecting to all these websites in the first place?

In my article [on when to use <link rel="preconnect">](https://www.ctrl.blog/entry/dns-prefetch-preconnect/), I discuss the situations where it’s beneficial to use the preconnect technique. I agree with Twitter that it’s likely to be useful to preconnect to the destination address in some situations. Such as when the Twitter message or link card is the only thing on the page, or you’ve stopped scrolling and have it visible for a split second or two.

However, Twitter indiscriminately preconnects to every link that you scroll by in your feed. Technically, it only preconnects when you hover over the link. However, you hover over every link by default as you hold your mouse cursor over the main feed and scroll downwards. Depending on the link-sharing habits of those you follow, that number of preconnects adds up quickly. This can slow down your browsing experience in slow network conditions or on low-end devices.

Properly testing preconnection behavior requires specialist tools and skills. The developer tools in web browsers don’t do a good job with preconnects. They’re not even recorded in the Network tab. Safari displays a message for each preconnect and warns of unused preconnect in its Console tab.

*Hey @Twitter, fix your stuff!*

**Update** (2021-02-22): Twitter has now addresses the problem and preloads the correct domains.

#### Sources

- [Resource Hints](https://www.w3.org/TR/2020/WD-resource-hints-20201005/?ref=ctrl.blog), 2020-10-05, Working Draft, World Wide Web Consortium (W3C)
- [t.co links](https://developer.twitter.com/en/docs/tco?ref=ctrl.blog), 2020-09, Developer Docs, Twitter
- [About Twitter's link service (t.co)](https://web.archive.org/web/20180213070018/https://help.twitter.com/en/using-twitter/url-shortener), 2018-02, Help Center, Twitter
- [How to post links in a Tweet](https://web.archive.org/web/20180103185320/https://help.twitter.com/en/using-twitter/how-to-tweet-a-link), 2018-01, Help Center, Twitter
### Intel: replace thermal compound “every few years”
URL: https://www.ctrl.blog/entry/repaste-thermal-compound/
Last updated: 2026-08-23T22:16:57.000Z
Is your computer running hotter and slower than when it was new? The most common cause of excess heat, the build-up of dust and debris blocking the airflow through the system, is easy to fix. However, the thermally conductive paste applied between the central and graphics processors, and their heatsinks also has a limited lifetime. Most people aren’t aware of this and don’t know about the need to replace it every few years.

Thermal compound (sometimes called thermal paste or grease) is applied to fill minuscule gaps in the materials in the heat spreader (the metal covering on top of the processor) and the heatsink. Eliminating these gaps is essential to ensuring efficient heat transfer into the heatsink.

The thermal compound that is used in your computer generally won’t go bad or degrade in its useful lifespan. It will get displaced over time, however. You’d need higher temperatures than what you’ll typically find in a computer for other failure modes to come into effect.

The displacement is caused by thermal cycling that results in an effect known as “thermally induced pump-out.” As the components heat up and cool down, the processors’ heat spreader (its metal top) and the heatsink will expand and contract. This effect will, over time, pump the thermal compound out from in between the two metal plates. You can find illustrations and a more technical explanation in the source links below.

[Intel recommends](https://www.intel.com/content/www/us/en/gaming/resources/how-to-apply-thermal-paste.html?ref=ctrl.blog) replacing the thermal compound “every few years.” That recommendation is intended for high-performance gaming computers, but the pump-out effect applies to every type of computer. (We all know how warm a laptop gets from having a dozen web browser tabs open.)

I did a quick survey of thermal compound vendors and found that they, on average, claim their compound last “up to 4,2 years.” As with more marketing claims, this is presumably under ideal conditions. Only the high-end vendors specify the durability of their products, so this figure is probably higher than what you’ll find in most computers.

The feature image at the top of the article shows the thermal compound on my late-2013 model MacBook Pro. The now seven-year-old computer has a history of [thermal problems](https://www.ctrl.blog/entry/macbook-late2013-hot-smc/). You can see that the pump-out effect has left large sections of the processor (left) and platform controller hub (right) without any thermal compound. At first glance, this seems like a manufacturing defect in the application of the thermal compound. However, if you look more closely, you can see hints of compound trails over the clear areas from where it has been pushed out.

After capturing the above photo, I cleaned off and replaced the compound in my MacBook. I didn’t take any benchmarks to measure the performance difference after replacing it. I replaced its battery at the same time, so I can’t say anything definitive about battery improvements either. However, my MacBook no longer gets uncomfortably hot to the touch after an hour of browsing the web.

Thermal compound costs about 6 Euro for a syringe good for about a dozen applications. The repasting job only requires a screwdriver, and will typically take 15–20 minutes. You can find detailed instructions for disassembling your computer model and reapplying thermal compound on the web. The repasting operation isn’t complicated, but most consumers will probably want to bring their device to a computer repair shop to get the job done.

However, if you bring your old laptop into a repair shop — they’re likely to clean out dust, run some hardware tests, reinstall the operating system, and then hand it back to you. Some repair shops will reapply the thermal paste, but many won’t know to do it or won’t bother. You need to specify that you’d like it done.

It’s important to raise awareness of issues like this if we want to reduce e-waste and the impact we’re all having on the environment. Consumers aren’t aware that there’s a need for it or that it can prolong the useful lifetime of their devices. It’s easier to throw out the old device and replace it with a new one.

Computer manufacturers have an invested interest in letting their hardware get progressively slower over time. In order to ensure their customers will need to purchase a new computer, the manufacturers either has to make the new hardware exponentially faster — or ensure their old devices under-perform over time. I don’t throw the therm “planned obsolescence” around lightly. In this case, however, I think it applies.

One possible solution to this awareness problem is to make the operating system more capable of detecting hardware defects and suggest service. Windows 10 already records a lot of device performance diagnostic data. This data could include things like the processor temperature, fan speeds, and the processor’s thermal throttling limits. Data like this can be analyzed on the device, and used to detect when the thermal performance decrease over time.

The user can then be alerted about the problem along with some suggestions for fixing it including cleaning the fans and air vents, and repasting the thermal compound. Something like this isn’t unprecedented, as both [KDE Plasma](https://bugs.kde.org/show%5Fbug.cgi?id=254313&ref=ctrl.blog) on Linux and [Windows 10](https://blogs.windows.com/windows-insider/2020/09/30/announcing-windows-10-insider-preview-build-20226/?ref=ctrl.blog) have recently added notifications when storage drives are nearing failure.

It isn’t all on the operating system, though. Device manufacturers should include a booklet in the box with the most common service and maintenance jobs. How often and how to repaste the thermal compound should be included. People need to be reminded that it’s even an option in the first place.

#### Sources

- [How to Apply Thermal Paste and How It Works](https://www.intel.com/content/www/us/en/gaming/resources/how-to-apply-thermal-paste.html?ref=ctrl.blog), 2020-08-19, Gaming Resources, Intel
- [Der8auer Deep-Dives on Thermal Paste: Misconceptions, Curing, & More](https://www.youtube.com/watch?v=CCqxE-5Ct3w&ref=ctrl.blog), 2019-07-28, GamerNexus YouTube
- [Thermal Paste Application](https://www.semikron.com/dl/service-support/downloads/download/semikron-application-note-thermal-paste-application-en-2018-01-19-rev-00/?ref=ctrl.blog), 2018-01-19, Paul Drexhage, SEMIKRON
- [Degradation Characterization of Thermal Interface Greases](https://www.nrel.gov/docs/fy17osti/68014.pdf?ref=ctrl.blog), 2017-08, Douglas DeVoto; Joshua Major; and Paul Paret, US National Renewable Energy Laboratory
- [Thermal Performance Challenges from Silicon to Systems](https://web.archive.org/web/20220526173641/https://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.14.8322&rep=rep1&type=pdf), 2000-18-22, Ram Viswanath; Vijay Wakharkar; Abhay Watwe; and Vassou Lebonheur, Intel
### The 0,5 MB of nothing in all Apple Music files
URL: https://www.ctrl.blog/entry/apple-music-nullbytes/
Last updated: 2026-08-23T22:01:52.000Z
Have you ever bought a storage upgrade for your iPod, iPhone, or Mac to have more room for your Apple Music (formerly iTunes) digital music collection? You may have been filling it with gigabytes worth of empty space.

The music files you purchase from the Apple Music Store (AMS; formerly the iTunes Music Store) contain approximately 6 % of the digital equivalent of nothingness. I’m not referring to silence, but continuous blocks of empty space set aside inside the files. It serves no purpose other than to pad the files to make them 0,5 MB larger. So, why is Apple making music files unnecessarily large? and how do you recover the wasted space?

This article is fairly technical, and the topics in it require a fair bit of explanation. You can skip the first 14 paragraphs if you’re only interested in [the “why”](#article-section-why), or skip the first 17 paragraphs for [the “how.”](#article-section-how)

Music files purchased from AMS is encoded with the Advanced Audio Codec (AAC) using the Apple AAC Encoder. The files are delivered in an ISOBMFF (ISO 14496-1) container. This container format is used for different media files including audio, pictures, and movies. The container format has lots of room for implementations to develop their own weird quirks.

ISOM containers are broken up into different data blocks including the actual multimedia stream, metadata (encoding details, artist name, album art, volume normalization hints, etc.), and empty space. There are other blocks too, but these three are the ones we care about in this article.

These sections can technically be arranged in any order in the file However, the exact order causes various side effects in some situations. For example, placing the metadata block at the end of the file means you must download (or read from local storage) the entire song before you can play it. To avoid this, encoders tend to place it before the much larger multimedia stream block. The metadata block refers to absolute positions inside the multimedia stream block measured as an offset from the start of the file. You can’t make changes to the metadata (e.g. change the spelling of an artist’s name) without reassembling the entire file to recalculate the offsets.

To get around this, encoders tend to set aside some empty space between the metadata and multimedia stream blocks. In ISOM containers, this block is known as a “free” block. These blocks contain nothing but null-bytes. If you change the title of an album, Apple Music can expand the metadata block and shrink the free block without having to move the multimedia stream block. So far, so good.

If you rip a CD with Apple Music using the Apple AAC Encoder (the default option), it will reserve approximately 5 kB of free space inside each file for this purpose. That’s enough for you to add about 1250 emojis to the metadata of each of your songs. It should be plenty of room for you to make whatever changes you find necessary to the metadata. If you really need to add more data, the music file can be reassembled later to grow the metadata space. The operation would take slightly longer, but this would be an acceptable compromise as to not waste too much storage space.

However, the music files you’ve purchased from the Apple Music Store contains approximately 500 kB (0,5 MB) of free space. That’s 100 times more than Apple Music sets aside inside songs you’ve ripped yourself. It’s also a lot more space for metadata than anyone will ever need.

My Apple Music library consists of 2500 songs that I’ve purchased from AMS, and about the same number of home-rips. They’re encoded with the same quality settings. After analyzing my collection, I found that AMS purchased songs are on average 7 % larger than my home-rips. 6 % of that difference is empty space (1,25 GB in total.) Only 0,005 % of the storage space for home-rips is empty space.

I’ve analyzed samples of iTunes Store music files purchased in 2010 and 2020, and they’re all structured in the same way with the same amount of wasted space. Broadband speeds and storage was more expensive ten years ago, so this would have been an even bigger issue back then.

Apple’s classic HFS+ file system didn’t support [sparse storage](https://www.ctrl.blog/entry/sparse-files/). Sparse storage is a file system storage technique that can be used to compact consecutive chunks of null bytes when writing files. The file system records how many repeating null-bytes there are instead of writing the individual null-bytes to the drive.

The new Apple File System (APFS) does support sparse storage, but Apple Music doesn’t take advantage of it and writes all the null-bytes out on the drive. I tried rewriting my music collection in a sparse-aware fashion, and was able to shrink my music collection by 5,2 %. Sparse storage can reduce storage requirements on your local computer. However, it won’t lower the bill from your online backup provider, or help you when non-sparse aware programs (like Apple Music) modifies the files or syncs them with your iProducts.

I’ve mentioned that you can reassemble the music files a couple of times already. If you’re interested in recovering the space wasted discussed in this article, you can do so by reassembling the files using an encoder that doesn’t set aside as much free space as AMS. Note that reassembling a music file — sometimes called remuxing — doesn’t involve re-encoding the multimedia stream block. Practically, this means that the operation is lossless in terms of the actual multimedia portion of the file.

Before I tell you how to remux the empty space out of your music, I need to discuss why it’s there in the first place. As discussed, encoders often reserve a small chunk of empty space to allow for metadata changes without reassembling the entire file for each change. I’ve also mentioned that the album art is stored in the metadata section.

However, AMS doesn’t store album art inside each music file. Starting with iTunes 7 (released September 2006), it began storing album art files separately from the music files. The change had to do with the implementation of iTunes’ fancy new album-flipping feature called Cover Flow, [according to TUAW](https://web.archive.org/web/20070427133115/https://www.tuaw.com/2007/04/19/tuaw-tip-re-embed-itunes-artwork-in-media-files/). 

I can only speculate here, but I believe the 500 kB block was originally reserved for album art. Apple’s servers would inject it on-the-fly into the metadata at the time of delivery. Album art can vary by region for the same album, so I guess this makes sense? The same song can be part of different albums too. Maybe Apple only stores one copy and injects metadata on-the-fly? When album art was removed, no one at Apple seems to have remembered to shrink the metadata block size.

I don’t know for sure, but this is the only reasonable explanation I can come up with. A more sinister explanation is that Apple wanted to upsell people on more expensive iPods and Macs with more storage space. Separating the artwork from music files can also be seen as a move to make it less convenient for customers to move their music collections to competing players.

The next section discusses making changes to your music file collection. **Back up your collection** before you follow any of these instructions.

You should make sure to first re-embed album artwork into your music files before you proceed. The below process will alter the music files and it may make iTunes confused about which album art goes with which files. Embedding them solves this problem, and will also make sure you can play your music in any other music application. You can use [Re-Embed Artwork](https://dougscripts.com/itunes/scripts/ss.php?sp=mxreembedartwork&ref=ctrl.blog) for MacOS to fix your entire music collection in one go.

You may notice that most songs don’t grow in size after re-embedding the album art. The album art nicely slots into the empty space that is already reserved inside each file. To recover the remaining empty space inside your music files, you’ll need to remux each file using FFmpeg.

Start by installing [Homebrew](https://brew.sh/?ref=ctrl.blog), and then use it to install [findutils](https://formulae.brew.sh/formula/findutils?ref=ctrl.blog#default) and [ffmpeg](https://formulae.brew.sh/formula/ffmpeg?ref=ctrl.blog#default). Once you’ve installed those dependencies, you can run the following script chain in the Terminal app. Make sure to select the entire line and copy it exactly into the terminal.

```shell
find ~/Music/ "(" -name "*.m4a" -and -not -name ".*" ")" -print0 | xargs -0 -P4 -n1 sh -c 'ffmpeg -y -i "$0" -movflags +faststart -map 0 -c copy "$0.tmp.m4a" && mv "$0.tmp.m4a" "$0"'
```

It will locate every music file in your Music directory (using the `find` command), and apply the right processing with `ffmpeg`. This is a lossless operation and you won’t lose any audio quality. Note that some iTunes-specific metadata (purchase information) will be lost from the files in the process. This is what may cause iTunes to have trouble later unless you embedded the album art into the files first.

I’ve always chosen the low-storage capacity Apple products over the years, and filled them to the brim with music. It’s frustrating to realize I could have fit 6 % more music onto those devices if Apple hadn’t filled them with null bytes! I don’t believe this was a malicious or sinister act by Apple. It was probably just a mistake by an engineer that has gone unnoticed for over ten years and never got fixed.

#### Sources

- [Encode AAC](https://trac.ffmpeg.org/wiki/Encode/AAC?version=53&ref=ctrl.blog), version 53, 2019-03-29, Wiki, FFmpeg
- [Overview of QTFF](https://web.archive.org/web/20181213032439/https://developer.apple.com/library/archive/documentation/QuickTime/QTFF/QTFFChap1/qtff1.html), 2016-09-13, QuickTime File Format Specification, Developer Documentation, Apple
- [Metadata](https://web.archive.org/web/20181213032450/https://developer.apple.com/library/archive/documentation/QuickTime/QTFF/Metadata/Metadata.html), 2016-09-13, QuickTime File Format Specification, Developer Documentation, Apple
- [Re-embed iTunes artwork in media files](https://web.archive.org/web/20070427133115/https://www.tuaw.com/2007/04/19/tuaw-tip-re-embed-itunes-artwork-in-media-files/), 2007-04-19, David Chartier, The Unofficial Apple Weblog
- [AtomicParsley](https://atomicparsley.sourceforge.net/?ref=ctrl.blog), 2006-10-26, Unknown author, SourceForge
- [MPEG-4 files](https://atomicparsley.sourceforge.net/mpeg-4files.html?ref=ctrl.blog), 2006-10-26, Unknown author, SourceForge
### How to get Microsoft Edge back into your Windows Timeline
URL: https://www.ctrl.blog/entry/edge-timeline-integration/
Last updated: 2026-08-23T22:05:32.000Z
Microsoft has replaced its Edge browser built on its own technologies with the new Edge built on top of Chromium. Chromium is the open-source engine behind Google Chrome, Brave, and now Microsoft Edge. However, Microsoft rushed the new version before it was feature-complete with its predecessor. Here‘s how to restore Edge integration with Windows Timeline / Task View.

Windows Timeline is weirdly architected with little regard for user privacy. It works by sending activity data from your device to Microsoft, and then downloading the same activity stream for display on your device. If you’re worried about your privacy when using Windows Timeline, I’ve discussed it in a [previous article](https://www.ctrl.blog/entry/windows-timeline-extension/).

Microsoft Edge doesn’t currently support syncing browsing history between your devices. History sync is presumably a requirement for Timeline integration as it links your browsing history with your Microsoft Account. The setting for it says it’s ”coming soon!“ However, it isn’t expected until April 2021, [according to BetaNews](https://betanews.com/2020/07/22/microsoft-edge-upcoming-features/?ref=ctrl.blog "“Microsoft is bringing some important new features to Edge, including browsing history syncing”"). 

Notably, Windows Diagnostics is still recording your web browsing history and sending it to Microsoft even without history sync enabled. You can confirm this using the Windows Diagnostic Data Viewer app from Microsoft. (I’ll stop complaining about the privacy aspects of this feature now.)

There are ways to restore Edge’s integration with Windows Timeline if you miss the feature, however. You can do so by installing and logging in to Microsoft’s [Web Activity extension for Google Chrome](https://chrome.google.com/webstore/detail/web-activities/eiipeonhflhoiacfbniealbdjoeoglid/?ref=ctrl.blog) in Edge. The extension was designed to be used with Google Chrome, but you can also install it in the new Microsoft Edge. Microsoft hasn’t uploaded a copy to Edge’s extension store. However, Edge can install extensions from the Chrome Extension Store too!

You should try and remember to uninstall the extension once Windows Timeline integration is fixed in Edge. Otherwise, you may end up with duplicated activity entries in Windows Timeline.

Firefox (and Chrome, and Edge) users can alternatively use a third-party extension. I’ve discussed this extension in more detail in an [earlier article](https://www.ctrl.blog/entry/windows-timeline-extension/). The two extensions work almost the same. The most significant difference between the two is that Microsoft’s extension will delete entries from Timeline when you delete them from your history in Microsoft Edge. The third-party extension doesn’t try to keep the browser history and Timeline in sync.

#### Sources

- [Microsoft is bringing some important new features to Edge, including browsing history syncing](https://betanews.com/2020/07/22/microsoft-edge-upcoming-features/?ref=ctrl.blog), 2020-07-22, Mark Wyciślik-Wilson, BetaNews
### Options for deduplicating storage of TV series intros
URL: https://www.ctrl.blog/entry/deduplicate-tv-intros/
Last updated: 2026-08-23T22:04:47.000Z
Modern file systems like APFS, Btrfs, XFS, and ZFS [support deduplicating](https://www.ctrl.blog/entry/file-cloning/) whole files and chunks of files. The same applies to network sharing protocols like BitTorrent and [IPFS](https://www.ctrl.blog/tag/ipfs/). Can storage deduplication be used to reduce the storage requirement for something like the intro sequences of TV shows? What other options are there? 

Most episodes of the same TV show will have the same intro sequence. No one wants to waste their available storage space by storing multiple copies of the same data. (Other than for backup purposes, of course.) Let’s explore the available storage deduplication methods and how they might apply to this problem.

There are a few different approaches to file system-level storage deduplication. The gist of it is that identical data chunks can be referenced by multiple files without consuming additional storage space. The exact details of how its implemented vary a lot, and I’ll touch on a few throughout this article. At the end, I’ll also discuss some alternatives to deduplicating file systems.

Before writing a large file to any storage media, it’s broken up into more manageable chunks. The chunk size is most often matched to the block-size of the underlying storage media. The primary method for file system deduplication is block-level deduplication. This can be done in-band before the block is written by comparing it to a table of all other blocks. The downside of this method is that it requires huge amounts of memory for storing the comparison tables. Alternatively, it can be done out-of-band at a later time.

This method isn’t useful for our scenario. The intro sequence might not start at the same wall-clock time in each episode. Even if they did, they’d still be encoded and stored at different positions in the file corresponding to each episode. It’s extremely unlikely that two episodes would chunk at the exact time the intro sequence began and ended.

There’s a more fundamental problem with this approach that has to do with the files themselves. Video codecs sample the raw data with an inherently lossy and unpredictable result. Re-encoding the same video sequence twice is unlikely to produce the exact same file. The compression scheme would also be primed differently based on the data that came before it in the video. The video may look identical to humans, but the files would be completely different.

You could compensate for this problem by encoding the intro sequences once and splicing it in at the appropriate times in each file. Many video container formats support splicing different clips together into one file. Lossless video splicing is complicated on its own, and the task is greatly complicated when you want to preserve the exact underlying file structure.

This still wouldn’t be enough to align the chunks for a fixed-length file chunker. There are two options that could take care of this problem as well.

The first option would be to add zero-byte padding before the intro sequence to align it with the chunker. This would require precise knowledge of the target file system and the media container format. Btrfs, OCFS2, and XFS on Linux support an API called [fideduperange](https://www.man7.org/linux/man-pages/man2/ioctl%5Ffideduperange.2.html?ref=ctrl.blog) that can be used to dedupplicate chunk-aligned identical data.

The second option would be to replace the fixed-length chunker with something smarter. A rolling chunker reads a minimum length into the file, and then looks for a pattern in the file where it can make the cut. It’s not guaranteed, but more likely to chunk different files in the same places and thus produce duplicated blocks. No file system currently use a rolling chunker, however.

However, there are also other alternatives to consider all-together. I mentioned earlier that video encoders can merge splice different videos into each other. A few media container formats — including MKV, WebM, and QuickTime — lets you reference media segments external to the file itself. You can encode the intro sequence once in a separate file (or even as a part of, e.g. the first episode), and then include references to that sequence in other files. This is a variation of the methods that I’ve already discussed. However, you run into different problems like limited player app support for external segment references.

A better and more widely supported approach is to create playlists for each episode. There’s wide support for XSPF and M3U8 media playlist files. You can embrace media chunks fully and save them as separate files instead of teaching the file system or media player magic tricks. It’s much easier to create a playlist of deduplicated video files than it is to carefully manipulate the video files to become more deduplicateable. Each episode would consist of at least three video files: before the intro, the shared intro sequence, and after the intro. As a nice bonus, the forward button would let you skip right past the intro sequence!

So, how much space could you save? Let’s look at an episode of Stargate SG-1\. The average episode is 42 minutes and 25 seconds. The intro sequence is about 58 seconds (2,28 % of the episode.) That’s about the amount you could hope to save under ideal conditions.

But let’s assume you’re willing to extend even more effort to deduplicate your media files! The Metro Goldwyn Mayer lion roars for 4 seconds at the start and end of each episode. That could be cut and deduplicated even within the same episode. The Double Secret Productions and Gekko Film Corp outros at the end play for 3 second each. Including the intro, you can reliably deduplicate at least 72 second (2,83 %) of each episode.

The end credits are hard to deduplicate because they differ from episode to episode. It would also be difficult to sync up the music. However, with effort — it should be possible to deduplicate at least parts of the end credits between some episodes.

A show like Stargate SG-1 also feature a lot of computer-generated imagery that is reused in different episodes. It’s conceivably possible to deduplicate at least some of the spinning-Stargates and outside-view-of-a-space-ship scenes. However, the show tries to differentiate these scenes from each episode using tricks like flipping the scene horizontally.

All of this requires a huge amount of effort for very little gain. It might be worth if you store an enormous amount of TV series at a very high quality. However, it would be a huge amount of work and there aren’t any tools to automatic this task.

The appeal of an efficient deduplicating file system is that it would theoretically handle all of this automatically. It sounds reasonable that a deduplicating file system should be able to handle duplicated media content. Unfortunately, as this explored in this article, the problem gets messy as soon as you involve real data. Real data is often more messy than one might assume at first glance.

There might be a parallel universe out there that’s similar to our own, except that they never managed to significantly increase the capacity and reduce the cost of digital storage. In this theoretical parallel universe, I’m sure there has been a whole lot more effort put into automating and making this type of optimization more feasible. Or maybe they’ve focused all their energy into absurdly efficient compression and video codecs instead?

Fun bonus fact: The repeated still frames from various TV shows in the feature illustration at the top of the article may be deduplicated! The image may be served as either a PNG or lossless WebP file in a size appropriate to your device. In the smaller image sizes, the duplicated frames get deduplicated by each format’s native compression. It doesn’t work in the larger sizes because of size limitations with the look-ahead/behind buffers of the image formats.

#### Sources

- [fideduperange man page](https://www.man7.org/linux/man-pages/man2/ioctl%5Ffideduperange.2.html?ref=ctrl.blog), 2019-10-10, Linux Programmer’s Manual, Linux man-pages project
- [FFmpeg FAQ](https://www.ffmpeg.org/faq.html?ref=ctrl.blog), 2019-05-02, FFmpeg project
- [Does ZFS deduplication work on intros of TV shows?](https://log.manuelgrabowski.de/post/zfs-deduplication-tvshow-intros/?ref=ctrl.blog), 2014-09-29, Manuel Grabowski, Blog
- [101 things you never knew you could do with Matroska](https://mod16.org/hurfdurf/?p=8&ref=ctrl.blog), 2007-12, Karl Blomster, Blog
### Review: Beurer TL20 daylight therapy lamp
URL: https://www.ctrl.blog/entry/review-beurer-tl20/
Last updated: 2026-08-23T22:17:39.000Z
Here’s my review of the [Beurer TL20](https://web.archive.org/web/20201001153809/https://www.beurer.com/web/us/products/wellbeing/light-therapy/daylight-therapy/tl-20.php) (2018-model) daylight therapy lamp. I’ve used an older model called Beurer TL30 from 2014 every autumn and winter for the last six years. For me, the treatment is difference between feeling tired throughout winter or not getting out of bed at all. It’s not perfect, but its something that makes a significant difference. As a baseline, I’ll share my years of experiences with the TL30 and then discuss the TL20.

Daylight is dwindling and the days are getting shorter in the northern hemisphere. I’ve had seasonal affective disorder (SAD), more commonly known as “winter depression/blues”, as far back as I can remember. Treatment consists of staring into a bright light for about 50 minutes every day during the autumn/winter months. The bright light is provided by a daylight therapy lamp; a cheap medical device that can stimulate the right hormones in the body.

I know to expect it every autumn and I know how to treat it. Every year, I start noticing that the hours of daylight get shorter. However, SAD still manages to creep up on me and I start feeling gloomy and tired. (More than usual for 2020, that is.) Way too late into the season, I dig up my light therapy lamp, position it under my computer screen, and try not to flinch as I flick on a miniature sun aimed directly into my face.

The TL20 looks like an empty digital picture frame with a thick white plastic frame. It’s not especially pretty, but on the plus side: it’s so bright you won’t be able to see it when it’s turned on! It has a single on/off button, and that’s all you get.

I had to replace my old TL30 at the start of every new season. Every year, my lamp from the last season would begin flickering at the start at the new season. High-frequency flickering from an ultra-bright light source gives me a headache in minutes. You may not be as sensitive to this issue, but it’s annoying as heck either way. I don’t know what caused the flickering. Maybe some of its components doesn’t like being stored unused for half a year? I opened one of the failed models and found that one of its LEDs had melted.

Both models are sold as “flicker-free” and with a three-year warranty. The warranty meant replacing the TL30 wasn’t a big issue for me (other than the environmental cost). I’ll make sure to update this review in a year if the TL20 starts flickering the same way my TL30s would.

The TL20 is more energy-efficient and brighter than its predecessor. I’ve measured the lamps’ surface temperatures and found that the newer TL20 is 10℃ cooler than the TL30 after one hour of use. This gives me hope for Beurer’s energy-efficiency claims and that the TL20 will last longer than the TL30.

I don’t have the test equipment required to verify Beurer’s brightness claims. In a side-by-side comparison, the TL20 is clearly brighter than the old TL30\. Both lamps are marketed as emitting a full 10 000 LUX at 10 cm distance. This is the light level used in many scientific studies of the effectiveness of light therapy treatments.

According to the product sheet, the TL 20’s light emission drops by half for every 10 additional cm distance. For comparison, the TL 30 dropped by half every 5 cm distance. I’ve looked at more expensive light therapy lamps as a baseline, and you need to pay approximately three times as much to increase the halving distance further. At some point, the brightness becomes uncomfortable, though.

It’s very difficult to get a definitive answer to how long the daily treatments should be. 30 minutes is often suggested by manufacturers, but this is at the full effect of 10 000 LUX.

The TL20 can be used horizontally or vertically in a non-adjustable 85° angle. I’ve positioned it horizontally right under my computer screen at a distance of approximately 60 cm. In my experience, I need to use it for at least 50 minutes per day at this distance. Individual needs and conditions may vary greatly.

So, should you buy the Beurer TL20? Probably, if you need one. It costs about 60 Euro and gets the job done (although its predecessor suggests it may not last more than one season!) The main difference between the TL20 and more expensive models is the shape and amount of extra buttons.

P.S.: Consult your doctor if you don’t notice any improvement to your mood after using a daylight therapy lamp. SAD is identified by its characteristic seasonality, but there may be more serious underlying issues.

#### Sources

- [TL30 Daylight therapy lamp](https://web.archive.org/web/20201001153920/https://pim.beurer.com/images/attribut/608.05%5FTL30%5F2018-06-06%5F01%5FDS%5FEN%5FBEU.pdf), 2018-06-06, Product datasheet, Beurer
- [TL20 Daylight therapy lamp](https://web.archive.org/web/20201006233738/https://pim.beurer.com/images/attribut/608.03%5FTL20%5F2018-03-15%5F01%5FEN%5FBEU.pdf), 2018-03-15, Product datasheet, Beurer

**Reviewed:** [TL20](https://web.archive.org/web/20201001153809/https://www.beurer.com/web/us/products/wellbeing/light-therapy/daylight-therapy/tl-20.php)

**Review rating:** 7 / 10
### How to distinguish between files, links, and cloned files
URL: https://www.ctrl.blog/entry/distinguish-file-link-clone/
Last updated: 2026-08-23T22:05:08.000Z
Except for the Apple File System (APFS), file systems don’t keep track of whether a file is a clone or has been cloned. The information is inconsequential to how modern file systems work. However, curious people might want to know whether a path is a regular file, symbolic- or hard link, or a clone of another file. This article is for you.

For this article, I’ll assume you’re somewhat familiar with cloning-capable/deduplicating file systems. Read my primer on [which file systems support cloning](https://www.ctrl.blog/entry/file-cloning/) if you’re new to the topic.

It’s hard to identify whether a file is a clone of another file. On Linux, there are a few programs available that claim to do this. I’ve tested five such programs and have concluded that they’re red herrings, and fail to definitively answer the question. I’ll not name the programs or shame their developers, but I’ll outline the problems, so you know what to look out for.

- Four followed symbolic- and hard links and wrongly concluded that the links were clones rather than links. They should have inspected the links and not their destinations.
- Three only considered identical files to be cloned, and didn’t account for partial clones (files that share some but not all data).
- Two only checked the first block of data, and simply assumed the rest of the file to be an identical clone. This approach is much faster than comparing the entire file, but it’s also likely to give you the wrong answer.
- One checksummed the file contents and proclaimed them to be cloned if they matched up, regardless of how the files were actually stored in the file system. This approach is naïve but often right.

On Linux, you can compare two file paths to get a definite answer about whether one is a clone of the other. The rest of this article guides you through the process.

First, let’s weed out files that are stored on different devices, and symbolic- and hard links:

1. Run the command `stat file1 file2` (part of `gnu-coreutils`).
2. Compare the Device identifier and confirm that they match.

The device identifier uniquely identifies the file systems’ mount point. You can only clone files within the same mount point. Btrfs subvolumes, for example, are mounted on different mount points even though they’re the same “file system.” You can’t clone a file from one subvolume to another.

1. Check that the files are reported as “regular file” and not “symbolic link.”
2. Compare their inode numbers for similarity.

Hard links share the same inode number as their destination, whereas clones have their own inodes. This distinction (plus a copy-on-write file system) is what enables clones to act independently of their originals even when modified by non-cloning aware programs.

So far, we’ve confirmed that your paths are \[probably\] real files. Next, let’s check whether they’re sharing any cloned data between them.

1. Run the command `filefrag -v file1 file2` (part of `e2fsprogs`).
2. Compare the files’ `physical_offset` ranges within the extent rows that have the `shared` flag set.

The two files share deduplicated/cloned data on the storage drive if they share any identical or overlapping ranges.

As to determining which is the original and which is the clone … . That is almost impossible to determine without a time machine. Luckily, many copy-on-write file systems can act as time machines. Assuming you’re taking frequent file system snapshots, you can compare old ones to the current state to determine which file was created first.

You can alternatively look at the files’ birth times (when the files were created) as reported by the `stat` command. This isn’t guaranteed to give the definitive answer, but it’s a strong indicator. You can expect to find this field in supported file systems (including Btrfs, Ext4, OCFS2, and XFS) starting in Fedora Linux 33 and Ubuntu 20.10 (both releases expected around October 2020). The birth time field is empty on older Linux distributions. 

I haven’t been able to identify a similar process for identifying cloned files on MacOS or Windows. The tools for it simply doesn’t exist yet. APFS counts the number of times a file has been cloned. This count doesn’t help you identify its clones or whether its sharing data with any of them currently.

Strictly speaking, identifying whether a file is a clone or not is only relevant if you’re troubleshooting a file-cloning capable application. However, it shouldn’t be this complicated to debug this file system feature!

#### Sources

- [Apple File System Reference](https://developer.apple.com/support/downloads/Apple-File-System-Reference.pdf?ref=ctrl.blog), 2020-06-22, Developer Documentation, Apple
- [symlink man page](https://www.man7.org/linux/man-pages/man7/symlink.7.html?ref=ctrl.blog), 2020-06-09, Linux Programmer’s Manual, Linux man-pages project
- [filefrag man page](https://www.man7.org/linux/man-pages/man8/filefrag.8.html?ref=ctrl.blog), 2020-03, Manual Pages, Linux man-pages project
- [stat man page](https://www.man7.org/linux/man-pages/man1/stat.1.html?ref=ctrl.blog), 2020-03, Manual Pages, Linux man-pages project
- [File Creation Time in Linux](https://www.anmolsarma.in/post/linux-file-creation-time/?ref=ctrl.blog), 2019-06-23, Anmol Sarma, Blog
- [On-disk Format](https://archive.kernel.org/oldwiki/btrfs.wiki.kernel.org/index.php/On-disk%5FFormat.html?ref=ctrl.blog), revision 32387, 2018-01-23, Btrfs Wiki, Linux Kernel project
- [Upcoming XFS Work in Linux v4.8 v4.9 and v4.10+](https://blogs.oracle.com/linux/post/upcoming-xfs-work-in-linux-v48-v49-and-v410-by-darrick-wong?ref=ctrl.blog), 2016-10-08, Darrick Wong, Linux Kernel Development blog, Oracle
### How to label a webpage as being out-of-date
URL: https://www.ctrl.blog/entry/label-outdated-webpages/
Last updated: 2026-08-23T22:12:48.000Z
You might not want search engines to direct people to your outdated product pages or blog posts. Especially when your site has other and more up-to-date webpages available. Here’s how to label webpages as being out-of-date for humans and machines.

I’ve previously outlined some technical and writing advice for when you’re [linking to outdated or inaccurate information.](https://www.ctrl.blog/entry/label-low-quality-links/) In this article, I’ll take that concept one step further and explore how you can mark up your own webpages as being outdated.

The general advice for outdated pages is to update them with new information whenever possible. You can salvage an outdated but already popular webpage by bringing your readers the most up-to-date information on the topic. An alternate approach — often favored in the search engine optimization community — is to simply delete the pages. Updating a webpage takes a lot more time than deleting it. However, deleting webpages leads to link rot (dead internal and external links). Deletion throws away all the value a webpage has built for your website.

Sometimes, a webpage just can’t be brought forward without rewriting it entirely or its subject has lost all relevance. Some websites automatically label pages that haven’t been updated in a few weeks, months, or years as outdated. A few even manually label outdated articles. For this site, I’ve chosen to manually review old articles every few months to either update them or label them as outdated.

So, how do you go about labeling a webpage as being out of date? For humans, it’s as simple as including a highly-visible notice near the headline saying it’s outdated. You could go the extra mile and expand on that and describe why and when it was made obsolete.

But how do you label a link as outdated for search engines and other machine-readers? To find the answer, I reviewed 110 pages on 110 different news websites. I selected pages where I could identify a human-readable notice saying the page was out-of-date. I also looked for the metadata I’ll discuss later in this article on over six million webpages. To my surprise, I couldn’t find a single website that had made any effort to label their own pages as outdated in a machine-readable format. I guess no one wants to invest one second in search-engine un-optimization?

There is an industry standard for metadata to label pages with their expiration date. The expiration date represents when the page’s content is no longer up-to-date. Expiration in this context must not be confused with HTTP cache expiration.

The two most relevant vocabularies for expressing this metadata is the Open Graph Protocol (used by social networks) and Schema.org (used by search engines). The below example shows HTML markup demonstrating labeling of a page that became outdated in October 2020 The metadata tags can be included anywhere in the document, but are typically part of either the <head> element or included immediately after the page’s headline.

```
<meta content="2020-10-01T00:00:00Z"
  property="http://schema.org/expires">
<meta content="2020-10-01T00:00:00Z"
  property="http://ogp.me/ns/article#expiration_time">
```

Unfortunately, you have to duplicate the tags instead of merging the `property` attributes (normally a space-separated list of values). I’ve previously covered how Facebook, Twitter, (and Bing) are [bad at parsing metadata](https://www.ctrl.blog/entry/rdfa-socialmedia-metadata/) properly.

I’ve found no indication that any of the leading social media networks or search engines use this metadata. As far as I can tell, it hasn’t seen any adoption in the industry at all. The incentives of the web are to drive ever-more clicks to your own website, and applying negative labels hasn’t been a priority. Search engines may use this information to reduce the rank of outdated pages (except maybe for searches in a given date range).

**Update** (2020-10-8): There is also another meta option that Google has committed to support. However, this option explicitly tells it to exclude the page from their index after a given date. Here’s an example of this directive:

```
<meta name="robots"
  content="unavailable_after:2020-10-01T00:00:00Z">
```

Recording expiration times in your content management system (CMS) does have other advantages, though. You can use the same metadata to conditionally apply the human-readable label. You can also reuse the metadata in other contexts such as lowering the page’s visibility in the site’s content recommendation system.

Something that will affect search engines directly is to lower the priority score of outdated webpages in your XML sitemap file. The sitemap file lists every webpage on your site. It can also be used to assign pages a priority score relative to other pages on your website. You can apply a lower score to outdated pages based on the expiration date in your CMS. Here’s an example of a URL entry in an XML sitemap with a lowered priority (the default priority is 0.5). 

```
<url>
  <loc>https://example.com/outdated</loc>
  <priority>0.1</priority>
</url>
```

I’ve left it up to the search engines to decide whether to exclude an outdated page from search results or not. If you want to do that, you can exclude it from your XML sitemap, add robots-exclusion metadata to the page, and disallow crawlers from accessing your outdated pages. Excluding robots is one step removed from outright deleting an old page.

I recommend you keep your old pages generally available, however. Sometimes an out-of-date page is precisely the thing someone was looking for. For business, a visit to a page for an outdated product or discontinued service is an opportunity to promote your new products or services. For blogs and news sites, you can recommend other related and more up-to-date articles through a related-reading widget.

You should probably remove outdated pages from your content recommendation system. [Recommending out-of-date articles](https://www.ctrl.blog/entry/poorly-recommended-articles/) negatively affects reader-experience. There may be an exception to this rule when it comes to recommending outdated-but-highly-related pages from pages that are themselves out-of-date. This is a corner case, however. You can reuse the page metadata that tracks expiration dates to exclude out-of-date pages.

All the technical points in this article have evolved around a single data field that most content management systems don’t currently store. As you might have gathered by now, the intended audience for this article is CMS developers. You should forward this article to your CMS provider and ask them to add fields for tracking page expiration dates.

#### Sources

- [Open Graph Protocol](https://ogp.me/?ref=ctrl.blog), 2020-07-24, Facebook
- [expires](https://schema.org/expires?ref=ctrl.blog), 2017-04-10, Schema.org property, Schema.org
- [Sitemaps XML format](https://www.sitemaps.org/protocol.html?ref=ctrl.blog), 2016-11-21, Sitemaps.org, Microsoft
- [Special tags that Google understands](https://developers.google.com/search/docs/crawling-indexing/special-tags?hl=en&ref=ctrl.blog), 2013-08, Search Console Help, Google
### What happened to BitTorrent’s Project Maelstrom web browser?
URL: https://www.ctrl.blog/entry/bittorrent-maelstrom/
Last updated: 2026-08-23T22:02:19.000Z
In April 2015, BitTorrent Inc. announced the public beta of Project Maelstrom; its new experimental peer-to-peer web browser. The browser reimagined the web using the company’s name sake file-sharing protocol. Websites would be distributed equally by its visitors instead of being hosted by an expensive central web server. The company published a beta and some blog posts, but then never mentioned Project Maelstrom again. What happened to it? 

Project Maelstrom was launched four years after Opera had [launched Opera Unite](https://www.ctrl.blog/entry/opera-unite/) (Project Alien). Unite gave everyone their own web server built right into its web browser. It enabled anyone to host a website, share photos, and do all sorts of web things like music streaming directly from their own computer. Unite failed to account for people wanting to shut their computers — now servers — off at the end of the day, however.

BitTorrent’s Project Maelstrom sought to fix this limitation by making everyone who visited a website help contribute to its distribution! As long as someone else was hosting a copy of it, you could shut down your computer for the night without taking your website offline with it.

Maelstrom integrated libtorrent, the “mainline” BitTorrent protocol reference implementation, into the Chromium web browser. Maelstrom itself wasn’t open-source, but its two main components were. It enabled anyone to create a website that could be shared directly between visitors over the BitTorrent peer-to-peer (P2P) protocol instead of being served by a centralized server. The concept radically reduced the complexity and cost of distributing a website. Any old computer could act as a mini-server that would act as a backup/availability guarantee for websites with few visitors hosting it.

Maelstrom was truly distributed with supported both tracked and distributed/trackerless BitTorrent transfers. I’ve previously discussed [centralized weak points in decentralized web projects](https://www.ctrl.blog/entry/dweb-readiness-runet/). Its only main weak point being a centralized server required for new clients to bootstrap/join the network. I discuss methods for mitigating that weak point in the linked article.

Normally, when you want to download anything over BitTorrent you need a torrent file. Torrent files are manifest files that describe a set of files for transfer over the BitTorrent protocol. These manifests contain cryptographically secured signatures for every file in the torrent. You can’t modify a file without breaking the signature in the torrent! Clients that download a non-matching file will simply reject it and look on the network for anyone else who might have an untampered copy of the file. So, how can you make updates to your BitTorrent-enabled website?

This is where I’ve run into a little bit of a mystery in the story. I’ve spoken with two dozen people in the distributed-web community that remembers Maelstrom. They all swear they remember that it was using an undisclosed secret and proprietary protocol. Memory can be a funny thing, but what they’re really remembering is that BitTorrent Inc failed to communicate properly about how Maelstrom worked.

I’ve read through every bit of documentation, blog posts, forum posts, and other tidbits of information I can find from the company about Maelstrom. For whatever reason, they seemed to think that “it’s built on BitTorrent!” was all the information anyone would ever need. The extent of available “documentation” was ”a developer tool” (a Python script) for creating torrent snapshots of static websites. The tool did little more than turn a folder of files into a torrent. Any existing BitTorrent-compatible program could be used in its stead. That was probably the point they were trying to make, but it’s not how it has been remembered.

Maelstrom exposes an Application Programming Interface (API) to torrent websites that provides the torrent file’s “current hash” and its “latest hash.” This API is the only indication I’ve found in Maelstrom that it could support dynamically updating torrents. [VentureBeat quotes](https://venturebeat.com/business/bittorrent-launches-its-torrent-based-browser-project-maelstrom-in-beta-debuts-developer-and-publishing-tools/?ref=ctrl.blog) a BitTorrent product manager at the time that confirms this: “\[Maelstrom’s\] biggest limitation is dynamic content.”

This wasn’t an insurmountable challenge, however. Mutable (changing) torrents had already been specified a few years earlier in BitTorrent Protocol Extension [(BEP) 35: Torrent Signing](https://www.bittorrent.org/beps/bep%5F0035.html?ref=ctrl.blog) and [BEP 39: Updating Torrents Via Feed URL](https://www.bittorrent.org/beps/bep%5F0039.html?ref=ctrl.blog). The first protocol extension specified a way to cryptographically sign a torrent file. The second built on that and specified a method for torrent clients to discover updated versions of the same torrent via a syndication feed (“RSS”). The new torrent had to be signed by the same cryptographic key. This method did require a traditional centralized web server to handle the distribution of the feed, however.

Another protocol extension, [BEP 44: Storing arbitrary data in the DHT](https://www.bittorrent.org/beps/bep%5F0044.html?ref=ctrl.blog), was released at the end of 2014. It could be used to remove the need for BEP 39 and a centralized web server, and store signed information about the updated torrent in the Distributed Hash Table (DHT). DHT is a database maintained autonomously by BitTorrent users all over the world and not a centralized server somewhere. As far as I know, this was never implemented in Maelstrom, but the building blocks were certainly there. 

BitTorrent Inc shipped a few test releases of Project Maelstrom between late 2014 and early 2015. It then never mentioned it again in public. The project’s website remained on the web until October 2016. I’ve reached out to BitTorrent Inc multiple times over the years for comment on what happened to Maelstrom, but I’ve never heard back. So, what happened to it? 

In the words of Bram Cohen, the inventor of the BitTorrent protocol and founder of BitTorrent Inc, it was all due to “investor problems.” I’ll not go into details here, but you can read [The Inside Story of BitTorrent \[Inc\]’s Bizarre Collapse](https://www.wired.com/2017/01/the-inside-story-of-bittorrents-bizarre-collapse/?ref=ctrl.blog) in Wired for the full story. Bram Cohen also tells the story using more colorful language in [an interview on the Steal This Show podcast](https://web.archive.org/web/20170428120936/https://stealthisshow.com/s02e14/) (audio via [Magnet](magnet:?xt=urn:btih:439eeec3969eb558d1a4d55e82f0e158e332a559&dn=S02%5FE13%5FThe%5FFuture%5FOf%5FBitTorrent%5Fwith%5FBram%5FCohen.mp3&xl=53772852&ws=https%3a%2f%2fweb.archive.org%2fweb%2f20200701041110if%5F%2fhttp%3a%2f%2fcontent.blubrry.com%2fstealthisshow%2fS02%5FE13%5FThe%5FFuture%5FOf%5FBitTorrent%5Fwith%5FBram%5FCohen.mp3&xs=https%3A%2F%2Fweb.archive.org%2Fweb%2F20170428120936if%5F%2Fhttps%3A%2F%2Fstealthisshow.com%2Fwp-content%2Fplugins%2Fpodcast-to-torrent%2Ftorrents%2F5766052a537a6a52cf05b7889ccec9b6.torrent) or [YouTube](https://www.youtube.com/watch?v=fQEJphZvc1Q&ref=ctrl.blog)). At about 44 minutes and 20 seconds into the episode. The long and short of it was that new people were put in charge and killed projects like Maelstrom and Bleep (a distributed direct messaging app) in the pursuit of celebrities and “content deals.”

I’ve managed to restore a small piece of file-sharing history: the Maelstrom welcome/onboarding page. This page was Maelstrom users’ first experience with a P2P-powered webpage. The welcome page prominently shows how many devices were actively seeding/sharing the page when you opened it in Maelstrom. (Maelstrom had an undocumented API for accessing peer-counts and details about the torrent.)

BitTorrent attempted to cheat and shipped a copy of this page with every installation. The cheat code was buggy and didn’t work, so people had to download the page files from other BitTorrent users. The welcome page demo was more authentic than intended by its developers.

I’ve kept a torrent client running for over five months, and was able to download 41 % of this six-year-old torrent from about three dozen other users. My torrent client informs me that these peers are still running Project Maelstrom. This is a bit surprising as Maelstrom doesn’t run as a background service nor does it start automatically. People are still using it to this day. IP geolocation suggest these users are primarily located in China.

41 % represents the useful portion of the torrent. The remainder was for development aids like a JavaScript source map, and webfont files that the Maelstrom browser didn’t even support. I was able to extract the missing files from the bugged out cheat mechanism that was supposed to ensure every user had a copy of the

You can grab a copy of the welcome page and get a piece of BitTorrent history using the links below. The three links at the top require a BitTorrent-compatible client (such as [qBitTorrent](https://www.qbittorrent.org/?ref=ctrl.blog)). The bottommost link only works in the Project Maelstrom browser.

- [Magnet link](magnet:?dn=onboarding%5F0-0-3&xt=urn:btmh:ab4983c972d0c9a4b1277195dc4e8de93b14d68cac52802f170721f9009c7bc9&xt=urn:btih:487376c9210300b8ff00df5035fca6184d8951a0&xl=1576950&xs=https%3A%2F%2Fwww.ctrl.blog%2Ffile%2F2020-09-23-bittorrent-maelstrom%2Fonboarding%5F0-0-3.v2.torrent) (BitTorrent 2)
- [Magnet link](magnet:?xt=urn:btih:a0e162cdd1196b6167302cf2c87a34a21c2eba79&dn=onboarding%5F0-0-3&xl=1431763&xs=https%3A%2F%2Fwww.ctrl.blog%2Ffile%2F2020-09-23-bittorrent-maelstrom%2Fonboarding%5F0-0-3.v1.torrent) (original)
- [Torrent link](https://www.ctrl.blog/file/2020-09-23-bittorrent-maelstrom/onboarding%5F0-0-3.v1.torrent) (original)
- [Maelstrom link](bittorrent://a0e162cdd1196b6167302cf2c87a34a21c2eba79) (original)

The peer count on the welcome site relies on a Maelstrom-specific API, and will display zero if opened in another web browser. You can still download a copy of Maelstrom [via the Internet Archive](https://web.archive.org/web/20160304020620/http://project-maelstrom.bittorrent.com/). Please note that the browser is years out of date and has multiple known security issues. Don’t use it for everyday browsing!

BitTorrent Inc may have abandoned the idea of a distributed web. However, others have since stepped up to the challenge. Beaker Browser is a P2P web browser that picks up where Maelstrom left off. It uses its own [Hypercore Protocol](https://hypercore-protocol.org/?ref=ctrl.blog) which is inspired by BitTorrent, but focuses more on privacy, security, and preserving a persistent history of website changes. You should check it out if you’re interested enough to have read this whole article.

#### Sources

- [The Future of BitTorrent](https://web.archive.org/web/20170428120936/https://stealthisshow.com/s02e14/) (audio via [Magnet](magnet:?xt=urn:btih:439eeec3969eb558d1a4d55e82f0e158e332a559&dn=S02%5FE13%5FThe%5FFuture%5FOf%5FBitTorrent%5Fwith%5FBram%5FCohen.mp3&xl=53772852&ws=https%3a%2f%2fweb.archive.org%2fweb%2f20200701041110if%5F%2fhttp%3a%2f%2fcontent.blubrry.com%2fstealthisshow%2fS02%5FE13%5FThe%5FFuture%5FOf%5FBitTorrent%5Fwith%5FBram%5FCohen.mp3&xs=https%3A%2F%2Fweb.archive.org%2Fweb%2F20170428120936if%5F%2Fhttps%3A%2F%2Fstealthisshow.com%2Fwp-content%2Fplugins%2Fpodcast-to-torrent%2Ftorrents%2F5766052a537a6a52cf05b7889ccec9b6.torrent) or [YouTube](https://www.youtube.com/watch?v=fQEJphZvc1Q&ref=ctrl.blog)), season 2 episode 14, 2017-04-23, Jamie King and Bram Cohen, Steal This Show, TorrentFreak
- [µTorrent Will Move to The Web Browser](https://torrentfreak.com/utorrent-will-move-to-the-web-browser-170421/?ref=ctrl.blog), 2017-04-21, Ernesto Van der Sar, TorrentFreak
- [The Inside Story of BitTorrent’s Bizarre Collapse](https://www.wired.com/2017/01/the-inside-story-of-bittorrents-bizarre-collapse/?ref=ctrl.blog), 2017-01-11, Jessi Hempel, Wired, Condé Nast
- [Project Maelstrom homepage](https://web.archive.org/web/20150525054210/http://project-maelstrom.bittorrent.com/), 2015-05, BitTorrent Inc
- [Build the Future of the Internet with Project Maelstrom](https://www.bittorrent.com/blog/2015/04/10/project-maelstrom-developer-tools/?ref=ctrl.blog), 2015-04-10, Engineering Blog, BitTorrent Inc
- [Project Maelstrom Enters Beta](https://www.bittorrent.com/blog/2015/04/10/project-maelstrom-enters-beta/?ref=ctrl.blog), 2015-04-10, Engineering Blog, BitTorrent Inc
- [BitTorrent launches its torrent-based browser Project Maelstrom in beta, debuts developer and publishing tools](https://venturebeat.com/business/bittorrent-launches-its-torrent-based-browser-project-maelstrom-in-beta-debuts-developer-and-publishing-tools/?ref=ctrl.blog), 2015-04-10, Emil Protalinski, VentureBeat
- [BEP 44: Storing arbitrary data in the DHT](https://www.bittorrent.org/beps/bep%5F0044.html?ref=ctrl.blog), 2014-12-19, BitTorrent Protocol Extensions, BitTorrent Inc
- [Project Maelstrom: The Internet We Build Next](https://www.bittorrent.com/blog/2014/12/10/project-maelstrom-the-internet-we-build-next/?ref=ctrl.blog), 2014-12-10, Engineering Blog, BitTorrent Inc
- [BitTorrent’s 10th Anniversary and The Internet We Build Next](https://www.bittorrent.com/blog/2014/09/22/bittorrents-10th-anniversary-the-internet-we-build-next/?ref=ctrl.blog), 2014-09-23, Engineering Blog, BitTorrent Inc
- [BEP 35: Torrent signing](https://www.bittorrent.org/beps/bep%5F0035.html?ref=ctrl.blog), 2012-12-19, BitTorrent Protocol Extensions, BitTorrent Inc
- [BEP 39: Updating Torrents Via Feed URL](https://www.bittorrent.org/beps/bep%5F0039.html?ref=ctrl.blog), 2012-07-21, BitTorrent Protocol Extensions, BitTorrent Inc

The data in the torrent links labeled “original” is unchanged (original hash), but the torrent file has been modified to help ensure its availability. The links labeled “BitTorrent 2” contains the exact same data, but has been updated to protocol version 2 which resulted in a new hash.
### Which file systems support file cloning
URL: https://www.ctrl.blog/entry/file-cloning/
Last updated: 2026-08-23T22:06:38.000Z
File cloning is a feature of copy-on-write (CoW) file systems. It’s an immediate way to make duplicate copies of files without requiring a second copy to be stored. Here’s a quick overview of cloning-capable file systems and the system calls and commands required to take advantage of them on Linux, MacOS, Windows, and other operating systems.

Most file systems developed in the last decade, proprietary and open-source alike, are CoW file systems. Simply put, CoW file systems always create a new copy when you modify a file instead of overwriting data in-place. This helps protect your data against a slew of different problems that can occur while writing files.

Copy-on-write file systems also enables use cases like data integrity checking, file system snapshots, and data deduplication. In this article, I’ll focus exclusively on the latter use case.

On traditional file systems, storing extra copies of your files takes up more space on your storage drives. File cloning enables you to make multiple copies of the same file without storing more than one copy of the actual data. If either the original file or one of its clones make changes to the data, the new data is written to another place on the drive. The other copies that shares data with it remains unchanged. The clones that shared data with it can still share some identical chunks of data with the modified file.

Cloning is a safer alternative to file system hard links. Hard links are supported in most file systems, and work more like a shortcut. The hard-linked shortcut points to the exact same location on your storage drive as the original file. Almost no programs are hard-link aware and won’t warn you that you’re about to modify more than one file.

Support for file cloning must be baked into the operating system kernel and the file system driver. Programs must also be made aware of file cloning capabilities before they can take advantage of it. The following table shows the system calls (syscall) and cloning-aware copy commands for popular operating and file systems.

| OS      | FS                       | Copy command                 | System call |
| ------- | ------------------------ | ---------------------------- | ----------- |
| Linux   | Bcachefs                 | cp --reflink=always          | ficlone     |
| Btrfs   |                          |                              |             |
| XFS     |                          |                              |             |
| OCFS2   |                          |                              |             |
| Ext4    | Unsupported.             |                              |             |
| OpenZFS |                          |                              |             |
| FreeBSD |                          |                              |             |
| ZFS     |                          |                              |             |
| Solaris | Oracle ZFS               | cp -z                        | reflink     |
| MacOS   | APFS                     | cp -c                        | clonefile   |
| HFS+    | Unsupported; non-CoW FS. |                              |             |
| Windows | NTFS                     |                              |             |
| ReFSv2  | Not included.            | DUPLICATE\_EXTENTS\_TO\_FILE |             |

As shown above, the `cp` (copy) command on some operating systems can make use of syscalls to instruct the kernel to clone a file instead of making a complete copy. The most notable example, after the copy command, is Finder on MacOS. It’ll clone files automatically when you copy them on an APFS volume. File Explorer on Windows and Nautilus and Dolphin on Linux will always make complete copies.

It’s unfortunate that the different operating systems have settled on different argument extensions to the POSIX `cp` command. It would have been better for developers if there could have been a little more cooperation between the implementors. I had trouble finding any examples of cross-platform implementations. [Syncthing stands out](https://www.ctrl.blog/entry/syncthing-deduplication-master/) with support for all but Solaris’ `reflink` syscall.

Each of the syscalls mentioned in the table clone entire files. Linux also supports partial cloning of files using the `ficlonerange` and `fideduperange` syscalls. These syscalls only allow you to address parts of a file that is aligned to the block size of the underlying storage media.

OpenZFS isn’t part of the Linux kernel because of licensing issues, and that is [unlikely to change](https://www.phoronix.com/news/Linus-Says-No-To-ZFS-Linux?ref=ctrl.blog). OpenZFS doesn’t support reflinks, nor any of the relevant Linux syscalls for cloning files or blocks. It supports file system-level cloning but not

Bcachefs isn’t in the kernel yet either, but it’s developed under a Linux-kernel compatible license with the ultimate goal of being merged into the kernel. It supports all the relevant Linux-specific syscalls for file cloning.

Over the last three years, Apple has switched all of its products to its new CoW-based Apple File System (APFS). Microsoft has decided to go in the opposite direction, and removed its copy-on-write file system, ReFS, from Windows 10 Professional in 2017. ReFS is now only available on Workstation and Server editions. [ReFS was not suitable](https://www.ctrl.blog/entry/adventures-in-refs/) for use on Windows desktops anyway. This does leave Windows as the only computer operating system without a CoW file system. 

I find file cloning fascinating, and I’ll explore several potential use cases for it in the coming weeks. Next up will be how you can [identify a cloned file](https://www.ctrl.blog/entry/distinguish-file-link-clone/). Something that is surprisingly difficult because the file system doesn’t keep track of it.

**Update** (2023-01-11): An earlier version of this article incorrectly stated that OpenZFS and ZFS supported `reflink` internally, but didn’t expose any syscalls for it. These file systems do not support reflinks. Thanks to Richard Yao of the OpenZFS project for the correction.

#### Sources

- [Snapshots in bcachefs](https://evilpiepirate.org/git/bcachefs-wiki.git/plain/Snapshots.mdwn?id=8db496a95bc5ba9c618a4c9c250d4433ecdf68f3&ref=ctrl.blog), commit 8db496a9, 2020-01-09, Kent Overstreet
- [Linus Torvalds Doesn’t Recommend Using ZFS On Linux](https://www.phoronix.com/news/Linus-Says-No-To-ZFS-Linux?ref=ctrl.blog), 2020-01-08, Michael Larabel, Phoronix
- [Copy files and directories](https://www.gnu.org/software/coreutils/manual/html%5Fnode/cp-invocation.html?ref=ctrl.blog), 2020, Documentation, GNU Coreutils, GNU Project
- [fideduperange man page](https://www.man7.org/linux/man-pages/man2/ioctl%5Ffideduperange.2.html?ref=ctrl.blog), 2019-10-10, Linux Programmer’s Manual, Linux man-pages project
- [FSCTL\_DUPLICATE\_EXTENTS\_TO\_FILE IOCTL](https://learn.microsoft.com/en-us/windows/win32/api/winioctl/ni-winioctl-fsctl%5Fduplicate%5Fextents%5Fto%5Ffile?ref=ctrl.blog), 2018-12-05, Win32 API, Windows Dev Center, Microsoft
- [Block cloning on ReFS](https://learn.microsoft.com/en-us/windows-server/storage/refs/block-cloning?ref=ctrl.blog), 2018-10-17, Windows Server documentation, Microsoft
- [reflink(3c) What is it? Why do I care? And how can I use it?](https://blogs.oracle.com/solaris/post/reflink3c-what-is-it-why-do-i-care-and-how-can-i-use-it?ref=ctrl.blog), 2018-01-30, Chris Beal, Oracle Solaris Blog, Oracle
- [ficlone man page](https://www.man7.org/linux/man-pages/man2/ioctl%5Fficlone.2.html?ref=ctrl.blog), 2017-09-15, Linux Programmer’s Manual, Linux man-pages project
- [ficlonerange man page](https://www.man7.org/linux/man-pages/man2/ioctl%5Fficlonerange.2.html?ref=ctrl.blog), 2017-09-15, Linux Programmer’s Manual, Linux man-pages project
- [Microsoft to remove full ReFS support from Windows 10 Pro, push Workstation SKU](https://arstechnica.com/gadgets/2017/08/microsoft-to-remove-full-refs-support-from-windows-10-pro-push-workstation-sku/?ref=ctrl.blog), 2017-08.21, Peter Bright, Ars Technica, Condé Nast
- [Under the hood: How does ReFS block cloning works](http://blog.dewin.me/2017/02/under-hood-how-does-refs-block-cloning.html?ref=ctrl.blog), 2017-02-22, Timothy Dewin, Blog
- [XFS, Reflinks and Deduplication](https://strugglers.net/~andy/blog/2017/01/10/xfs-reflinks-and-deduplication/?ref=ctrl.blog), 2017-01-10, Andy Smith, Blog
- [clonefile man page](https://opensource.apple.com/source/xnu/xnu-6153.81.5/bsd/man/man2/clonefile.2.auto.html?ref=ctrl.blog), 2015-12-04, xnu version 6153.81.5, Open Source Releases, Apple
- [The Btrfs filesystem: An introduction](https://lwn.net/Articles/576276/?ref=ctrl.blog), 2013-12-11, Jonathan Corbet, LWN, Eklektix
### Network routers are just computers
URL: https://www.ctrl.blog/entry/routers-are-computers/
Last updated: 2026-08-23T22:21:26.000Z
I want to clear up a common misconception about the network router in your home. It’s neither an appliance nor magic. It’s a small computer running software that handles local network management and routing between your devices and the internet. More specifically, it’s most often a miniature Linux server. But wait, aren’t servers hugely complicated devices that require ongoing maintenance and security patching? Who’s responsible for that for the server in your home?

Consumers don’t think of network routers as servers or even as computers. They’re sold as maintenance-free appliances that you set up and forget. A consumer-grade network router promises that it auto-configures itself, manages the household’s network, and stays out of sight. We’ve all learned to accept that we occasionally may need to turn it off and back on again when the network stops working. That is also the extent of the “maintenance” most routers receive.

Consumers aren’t expected to know how to manage and maintain a Linux server, however. Tech-savvy consumers who realize they’ve brought a server into their homes assume the manufacturer will maintain it.

Researchers are constantly finding security vulnerabilities in routers. The issues vary from bugs in the underlying operating system and software to misconfiguration and outright negligence from the manufacturer.

A recent [study of 127 new home routers](https://www.fkie.fraunhofer.de/content/dam/fkie/de/documents/HomeRouter/HomeRouterSecurity%5F2020%5FBericht.pdf?ref=ctrl.blog "“Home router security report 2020”") had some very worrying findings. One-third ship with Linux kernel version 2.6.36 was released in October 2010. You can walk into a store today and buy a brand new router powered by software that’s almost 10 years out of date! This outdated version of the Linux kernel has 233 known security vulnerabilities registered in the Common Vulnerability and Exposures (CVE) database. The average router contains 26 critically-rated security vulnerabilities, according to the study. 

The same study also evaluated the use of more proactive security measures to help limit the impact of security exploits. Nearly all vendors deployed one exploit mitigation technique. The study didn’t look into whether different software services on the router run in sandboxed and constrained environments, or whether they have full privileged access to the system.

In my own experiences with router firmware from various vendors, I’ve only encountered the latter. It’s not difficult or time-consuming to set up these types of protections, but network equipment manufacturers tend not to bother with it. The ancient and outdated versions of the Linux kernel and other software are partly to blame. However, shipping outdated software also falls squarely on the manufacturers’ shoulders.

I replicated a small part of this study in September at a local electronics shop. I noted every router they had for sale, and looked up when each one had last received a security update on the manufacturer’s website. Not a single model had received a software update in the last 14 months.

Like all computer operating systems, the one in your router requires constant updates to address security vulnerabilities as they’re discovered. Manufacturers are not incentivized to provide ongoing support and security updates for their devices. It’s expensive to employ staff that supports old products and don’t generate new revenue for the company.

However, you don’t purchase a support contract when you’re buying a consumer-grade router. You don’t get any guarantees about the ongoing availability of security updates. Starting in 2021, computer displays and smart TVs sold in the EEA are [required to be transparent](https://www.ctrl.blog/entry/eu-display-firmware-label/) about how long they’ll receive firmware updates. For computers, networking equipment, and other internet-connected devices, there’s no [best-before date on the packaging](https://www.ctrl.blog/entry/device-best-before-dates/). There is no way for consumers to know how long a router will last before it needs replacing.

The only time network equipment vendors seem to modestly care is in response to specific vulnerabilities that get a lot of media attention. Such as the much-publicized [Key Reinstallation Attacks](https://www.krackattacks.com/?ref=ctrl.blog) (KRACK) from 2017 that managed to bypass Wi-Fi authentication. It took most manufacturers months to issue updates, and many are unpatched to this day. Michael Horowitz maintains a list of some of the other interesting/worrying [router bugs, flaws, hacks, and vulnerabilities](https://routersecurity.org/bugs.php?ref=ctrl.blog) from the last decade. 

To make matters even more confusing for consumers, it is no guarantee that security issues have been fixed even if your router does receive regular updates.

To be clear, no one can guarantee perfect security. If consumers are even aware of the problems, they expect manufacturers to be on the ball and patch things as new issues are discovered. Network equipment manufacturers haven’t lived up to those expectations.

It’s time that consumers stop assuming the manufacturers will step up to the challenge. Instead, all we can do is to vote with our wallets and stop buying their products. The only problem is that it’s difficult for consumers to know what network equipment to buy. As discussed, there’s no labeling on the product or other easy way for consumers to compare the firmware update policies from different manufacturers.

If you’ve read this far into the article, I’m sure you’re hoping for a router recommendation. I’d love to be able to point at good options in the market. However, there simply aren’t any good options in the consumer market. You need to make the switch to more involved, complicated, and expensive enterprise-grade network equipment before you see any improvements.

Maybe you could recycle an old laptop and set it up to act as your home’s next router? [IPFire](https://www.ctrl.blog/entry/review-ipfire-home/) (Linux) and [OPNsense](https://opnsense.org/?ref=ctrl.blog) (FreeBSD) are free firewall software suites you can explore. I wouldn’t recommend that anyone go down this route, though. Setting them up and managing them are complicated processes and they do require ongoing learning and maintenance. However, you may still want to give this a try before committing to expensive network equipment from an enterprise-grade provider. It’s not like you’d do a worse job managing it than the big consumer-grade router manufacturers.

#### Sources

- [Router Bugs Flaws Hacks and Vulnerabilities](https://routersecurity.org/bugs.php?ref=ctrl.blog), 2020-07-19, Michael Horowitz, Router Security
- [Home router security report 2020](https://www.fkie.fraunhofer.de/content/dam/fkie/de/documents/HomeRouter/HomeRouterSecurity%5F2020%5FBericht.pdf?ref=ctrl.blog), 2020-06-26, Peter Weidenbach and Johannes vom Dorp, Fraunhofer Institute for Communication; Information Processing and Ergonomics
### KMail account trouble
URL: https://www.ctrl.blog/entry/kmail-account-trouble/
Last updated: 2026-08-23T22:12:37.000Z
[KMail](https://kontact.kde.org/components/kmail/?ref=ctrl.blog) is the open-source email client that I’ve always wanted to use. However, I’ve always given up on it after a few hours or days after running into critical bugs. I gave it another shot this month, and here’s how it went.

I’ve been using [Evolution](https://wiki.gnome.org/Apps/Evolution/?ref=ctrl.blog) for the last few years. I’ve recently had [serious issues with it corrupting messages](https://www.ctrl.blog/entry/restore-lost-email-from-ram/), and its PGP-integration has been buggy for years. A couple of weeks ago, I needed to send off a PGP-encrypted email to ~~\[redacted\]~~ regarding a security issue. So, I went looking for alternative email clients. As many times before, KMail was the first option on my list. 

KMail has every feature I need, including PGP support and integration with my email provider (IMAP/SMTP) and address book server (CardDAV). It’s [recommended by *Use plain-text email*](https://useplaintext.email/?ref=ctrl.blog#recommended-clients "Recommended plain-text email clients") and formats email messages in the way I like it. It even has a Unicode-compatible spellchecker (something [Thunderbird](https://www.thunderbird.net/en-US/?ref=ctrl.blog) is still missing in 2020!) It’s been an appealing option for me for years. 

The last time I used KMail, I ran into a bug where it [sent a supposedly PGP-encrypted email in clear-text](https://www.ctrl.blog/entry/kmail-cve-2017-9604-openpgp/) (unencrypted). PGP is complicated and, understandably, both people and software sometimes mess it up. It has been years since that problem got fixed, and I was willing to give it another try. I thought I’d test and verify that PGP was working before sending off a confidential email, of course. But first, I needed to install it and set up my accounts.

I installed KMail as part of the Kontact suite via [Flathub](https://flathub.org/apps/details/org.kde.kontact?ref=ctrl.blog). This is an official release version distributed by the KDE project. I believed this would give me additional security in terms of sandboxing in addition to more frequent and faster updates.

In my experience, software distributed by the upstream developer through Flathub is usually promptly updated within hours of an upstream release. The version of Flathub was over a year out of date and it crashed on start-up. The crash is caused by a problem in Akonadi that was fixed upstream over a year ago. There have been multiple major releases of Kontact since the version of Flathub was last updated. I don’t know why KDE has stopped updating the Flatpak version of Kontact, but I couldn’t use this version.

I fell back to installing KMail from the Fedora Linux repository. This did give me the most recent version of KMail. This version worked for about a second, but then it crashed. After launching it from the terminal, I got this error message:

ERROR:proxy\_config\_service\_linux.cc(589)\] inotify\_init failed: Too many open files (24)

You’ve probably run into variations of this error if you’ve been using the KDE Plasma Desktop in the last year. The desktop environment keeps leaking inotify listeners (file-change notification registrations) until the system is exhausted. (See KDE [bug #423928](https://bugs.kde.org/show%5Fbug.cgi?id=423928&ref=ctrl.blog) among others.) Rebooting puts the system back in working order for a few days.

After logging back into the system, I started KMail again. This time it launched but it didn’t greet me with the new account wizard window. Instead, all I got was an empty window with a local mailbox. I dug around in the menus and found the new account wizard. I didn’t get far into the process before I ran into a new problem, however. I entered my email account information and clicked Next. Nothing happened and I got no feedback that anything had gone wrong. I quit and restarted KMail and tried again a few times with the same result. I then launched it from the terminal again and found the following error message:

accountwizard: QObject::connect(KWallet::Wallet, QEventLoop): invalid nullptr parameter

I checked on my system and found that the KWallet service wasn’t enabled. KWallet is KDE’s authentication and password manager. hadn’t used any other application that required KWallet yet, so this wasn’t unexpected. It was, however, unexpected that KMail didn’t handle the situation. I manually started KWallet and created a default wallet.

I restarted KMail and went through the new account wizard again. I got one step further in the process now that KWallet was running! At this point, KMail tried to connect to my email servers for the first time. It ran into another error message. This was the first and only time through this process that KMail provided an error message without silently failing or requiring me to dig through logs:

Could not convert value of setting 'AccountIdentity' to required type.

This cryptic error message seems to be a generic account-creation error. Using WireShark to monitor the network traffic, I discovered that this issue was caused by KMail attempting to connect to IMAP over the wrong port. The new account wizard attempted to connect over port 143 with STARTTLS, but [my email provider](https://www.ctrl.blog/entry/review-mailboxorg/) only supports full-stream TLS over port 993\. These are the two standard options for IMAP. KMail didn’t provide me with a way to change the port number or proceed from this stage.

At this point, my systemd journal kept getting flooded with 8 identical messages every second with an error from Akonadi saying:

Resource id’s don’t match: "akonadi\_maildir\_resource\_1" "akonadi\_maildir\_resource\_0"

—and I’d still not managed to add my email account to KMail! I decided that things weren’t working out, and uninstalled KMail. I believe most people would have given up at this point. However, I wanted to know whether this was indicative to my system or if the problems were indeed KMail’s fault.

A few days later, I set up a fresh installation of Fedora 32 Workstation in a virtual machine. I first updated the new installation and then ran KMail. This time, it didn’t crash and it displayed the new account wizard on start-up. I proceeded to set up my IMAP account. It asked me to create a KWallet and everything appeared to work fine up until it tried to connect to the IMAP server. When I got to that stage it said that account creation had failed, and it opened a dialog asking me if I wanted to enable a feature called unified mailboxes. I believe it’s supposed to ask this question if account creation succeeds, so this suggests the process at least partially succeeded.

I clicked Back in the new account wizard and clicked Next without making any changes. This time it said “Setup complete” while simultaneously opening a dialog asking me to re-enter my IMAP password. I entered it again and KMail immediately opened yet another dialog saying the server had rejected my authentication details. The dialog offered me to cancel, try again, or open account settings. The latter option took me to a dialog where I could set the correct port number for my IMAP server.

I’d finally managed to get through the account creation process! However, this is as far as I got. KMail’s main view turned black and the program stopped responding. This is the state you can see in the screenshot at the top of the article I couldn’t work out what was wrong and KMail and its logs weren’t giving me any more hints.

Somewhat motivated by this progression, I went back to my main system and set up a clean user account. When I opened KMail here I was greeted by the new account wizard. However, it had the same problem with KWallet as my main account. On a hunch, I logged out of the new account, and logged back into it with a GNOME session instead of a KDE Plasma desktop session. I normally use Plasma, but I thought I’d try an environment that was closer to the experience I had in the virtual machine. But it still didn’t work.

I thought I’d give it one last try in a virtual machine using Fedora 32 KDE edition instead of the normal Workstation edition with KDE and Plasma bolted on top after the fact. Again, I run into problems with KWallet. However, instead of enabling it, I logged out of the session in the virtual machine, and then logged back in again. This time, I didn’t run into the KWallet problem — but I still ran into all the problems I’ve previously mentioned.

I’ve literally spent hours and have gotten nowhere with KMail. I think I’ve had enough of KMail for a few years. I just can’t get it to work properly!

Bonus story! I first tried to use KMail maybe 12 years ago. My email password back then contained a percentage and an apostrophe character. KMail used URIs to communicate with its backend, but it failed to properly encode the special characters in the password. This of course caused it to fail to log in to my IMAP and SMTP servers because it didn’t correctly transfer authentication details. The issue also made it impossible to overwrite the saved password with a new one from inside the KMail user interface. 

Tested with a Fedora Workstation 32 with Plasma desktop and KDE Apps installed on top. The two virtual machines were installed cleanly for this article. I made no changes other than to update the installed packages and install KMail. Tested package versions (current in Fedora Linux 32 and upstream at the time of publishing): KDE Apps (including KMail) version 19.12.2, KWallet version 4.12.3, Akonadi version 1.13.0, and Plasma Desktop version 5.18.5.
### Linux on Lenovo ThinkPad T14: great except the webcam/mic
URL: https://www.ctrl.blog/entry/lenovo-thinkpad-t14-fedora/
Last updated: 2026-08-23T22:13:11.000Z
My significant other has bought the new AMD-powered Lenovo ThinkPad T14 with Windows 10 pre-installed. The T14 is a high-end but cheap ThinkPad model with a powerful third-generation AMD Ryzen 7 processor inside. I’ve set it up with dual-booting and Fedora Linux to test how well it works out of the box.

A few weeks ago, Lenovo began shipping with Fedora Linux pre-installed on its Lenovo ThinkPad X1 Carbon (8th generation) models. The X1 Carbon is a Lenovo–Intel partnership and its flagship ThinkPad model. Lenovo is currently only offering this configuration option on its North American websites. The Linux Unplugged podcast [reports](https://linuxunplugged.com/369?ref=ctrl.blog) that it will become more broadly available in the coming weeks.

However, AMD has left Intel behind on price and performance, and Intel just isn’t an appealing option anymore. The T14 is thicker and heavier but 35 % cheaper than a similarly spec’ed X1 Carbon. The X1 Carbon’s quad-core Intel processor is great, but who wouldn’t want 50 % more processor cores and threads for less money? I would have preferred voting with my wallet for the pre-installed Linux option. In this instance, voting for a cheaper and more powerful AMD processor over an Intel model was more important.

As [per usual](https://search.ctrl.blog/?q=%22Linux+on%22+laptop&ref=ctrl.blog) with new laptops, I wanted to test how well the T14 worked out of the box with Linux. (Everyone needs a hobby, right?) Lenovo’s interest in and excellent track-record on Linux support suggests that everything should just work.

As this isn’t my laptop, I’ve set it up with Fedora Workstation in dual-booting mode to preserve the factory-installed Windows instance. My earlier notes on [dual-booting Linux/Windows with BitLocker](https://www.ctrl.blog/entry/dual-boot-bitlocker-device/) are still current. The only required modification is to a BIOS option called Power: Sleep State that must be changed from Windows to Linux mode. This change disables hybrid-sleep in Windows 10, but both operating systems still support suspend-to-RAM and suspend-to-disk (hibernate) afterward.

We received the T14 in the first month it became available on the market. The fingerprint reader and suspend-to-RAM didn’t work in the first week. However, the laptop received firmware updates through the Linux Firmware Update Service (FWUP/LVFS) service. This update system is built-in to the GNOME Software management app, and it showed up there as a regular system update.

However, there are still two unresolved hardware issues with the built-in microphone and webcams. These components have become more critical these days as the number of remote meetings has exploded as a result of the COVID-19 pandemic.

Let’s tackle the webcam first. We all take it for granted on all operating systems these days, but just about every webcam sold is USB Video Class (UVC) compatible. It can plug-and-play into any operating system. The problem with the T14 is that there are two UVC webcams: a standard high-definition camera and an infrared (IR) camera. While it’s easy for humans to tell the two apart, software can’t easily distinguish the two. Unfortunately, the IR camera has the lowest USB ID and gets choosen as the default.

The new account screen in GNOME doesn’t support multi-camera set-ups. You can either pick from a set of default images, or take a portrait photo with the default camera. You can’t choose another camera source, so you’re stuck with the IR camera. Below you can see what the preview from the IR camera looks in GNOME Cheese (a photobooth app).

![The infrared webcam just captures static noise.](https://cdn.synaps.media/control/content/images/2026/08/gnome-ir-webcam-static.png "Screenshot of an infrared webcam capturing static")

Webcam photobooth capturing static by [Daniel Aleksandersen](https://www.daniel.priv.no/?ref=ctrl.blog) licensed under [CC0 1.0](https://creativecommons.org/publicdomain/zero/1.0/?ref=ctrl.blog).

The actual photos from the IR camera are … interesting and limited to 640x360 pixels. The regular camera takes photos at twice that resolution. You can see an example photo below.

![The infrared webcam can make abstract art.](https://cdn.synaps.media/control/content/images/2026/08/lenovo-t14-ir-webcam.jpeg "Infrared webcam photo of a flower in a cup")

IR webcam photo by [Daniel Nebdal](https://www.nebdal.no/?ref=ctrl.blog) licensed under [CC0 1.0](https://creativecommons.org/publicdomain/zero/1.0/?ref=ctrl.blog).

You can choose the camera source in applications like GNOME Cheese and video-chat programs. But it’s annoying that they all default to the IR camera. Firefox and Chrome offer both cameras as video sources, but will only stream from the regular camera regardless of which camera source you select.

So, what’s the deal with the IR camera anyway? It’s used together with the regular camera for face-recognition login in Windows 10 (a feature marketed as “Windows Hello”). This login method isn’t yet supported in GNOME or Plasma. You can test the [Howdy authentication module](https://github.com/boltgolt/howdy?ref=ctrl.blog#readme) if you’re interested in a similar login method for Linux. However, the fingerprint scanner will likely be more secure than facial recognition.

The second issue is a minor but common issue with the built-in microphone. In most Linux distributions, PulseAudio handles all audio sources. In the interest of reducing power consumption, it powers down unused audio devices when they’re not in use. Annoyingly, this can have some adverse effects when you power them on again.

**Update** (2020-09-09): Several people have written to me asking about the microphone recording level. I’m soft-spoken and didn’t realize the recording volume was lower than expected. This is a driver issue and is expected to be fixed in Linux kernel version 5.8.

The microphone records a locally inaudible (but loud on the receiving end) 1-second pop at the start of every audio stream. Chrome and Safari sometimes suppress playback of the pop at the start of audio streams but doesn’t do so reliably. I made [a recording of the pop](https://cdn.synaps.media/control/content/files/2026/08/2020-09-03%5Flenovo-thinkpad-t14-microphone-power-on-pop.flac?ref=ctrl.blog) (FLAC audio) if you’re curious what it sounds like. (I believe this is the sound of an uninitialized buffer?)

To preserve other people’s hearing, you should disable PulseAudio’s power-saving measures to suppress the popping. You can do this by commenting out the lines mentioning `module-suspend-on-idle` in `/etc/pulse/*.pa`.

The PulseAudio tweaks and changing the camera source is the only hardware-related configuration changed that was needed. Everything else, including the trackpad, micro-SD card reader, audio playback, graphics, Wi-Fi, Bluetooth, and the gigabit Ethernet port worked out of the box.

This hardware configuration doesn’t have the integrated 4G mobile modem, the FIDO smart card, or a docking station. The docking port does show up as a secondary Ethernet port, however. I haven’t been able to test these add-on hardware features. 

The Lenovo ThinkPad T14 isn’t a bad option if you’re looking for a new laptop to run Linux.

#### Sources

- [Double Data Rate Trouble](https://linuxunplugged.com/369?ref=ctrl.blog), Episode 369, 2020-089-01, Linux Unplugged, Jupiter Broadcasting
- [Lenovo Now Offering Fedora Linux as an Option](https://www.linux-magazine.com/Online/News/Lenovo-Now-Offering-Fedora-Linux-as-an-Option?ref=ctrl.blog), 2020-08-31, Jack Wallen, Linux Magazine
- [First Lenovo laptop with Fedora Linux now available on the web!](https://blogs.gnome.org/uraeus/2020/08/31/first-lenovo-laptop-with-fedora-now-available-on-the-web/?ref=ctrl.blog), 2020-08-31, Christian F.K. Schaller, Blog, GNOME Project
- [User documentation](https://fwupd.org/lvfs/docs/users?ref=ctrl.blog), 2020-06-16, Richard Hughes, Linux Vendor Firmware Service Project

Tested with an updated installation of Fedora Linux 32 in early September 2020\. Kernel 5.7.15 and GNOME 3.36.5.
### Fretted M.2 connector cause difficult-to-diagnose performance slowdown
URL: https://www.ctrl.blog/entry/m2-performance-fretting/
Last updated: 2026-08-23T22:13:47.000Z
Last summer, I wrote about how my aging ThinkPad laptop had [become unbearably slow after reinstalling Windows 10](https://www.ctrl.blog/entry/slow-windows-hvci/). I eventually solved that problem, but the laptop became slow again a few months later. This time, I’d given up and concluded that the problem was beyond my ability to diagnose. Luckily, I stumbled upon the underlying hardware problem when I disassembled it to [test something else entirely](https://www.ctrl.blog/entry/review-air-puffers/).

I’ll cut straight to the chase: the problem was a link-layer problem with the M.2 (“Mini 2.0”) connector between the laptop and its solid-state drive (SSD). Reseating the M.2 drive and adapter fixed the problem. So, why couldn’t I diagnose the link-layer problem without physically disconnecting the drive?

The problem was difficult to diagnose under Windows 10\. Neither Windows Event logger nor the drive’s self-monitoring, analysis, and reporting technology (S.M.A.R.T.) report indicated any problem. It was half-full, and it wasn’t overheating. The drive even performed well in synthetic performance benchmarks.

However, the entire operating system would stall and become unresponsive for whole seconds at a time. It took several seconds to open the Start menu or any program window. The performance degradation was intermittent but persistent. I suspected a compatibility problem between a Windows 10 feature or driver and the aging hardware in my laptop.

As you may have understood from the feature photo at the top of the article, the problem was caused by connector fretting. My microscopy game isn’t strong, but I managed to snap a photo to confirm abrasions on all the M.2 connector pins. The abrasions go all the way into the nickel connectors, and the black spots are corrosion. This shouldn’t be a huge surprise, though. The M.2 specification only requires that M.2 connectors last 60 mating cycles (connects/disconnects).

M.2 devices are usually screwed into the mainboard to keep them in-place. However, the first-generation Lenovo ThinkPad X1 Carbon didn’t use a standard M.2 connector. Lenovo released this laptop model before the connector was finalized. To upgrade it with a larger standard M.2 drive, I had to use a third-party adapter. I had forgotten to fasten the adapter to the mainboard, and it has no obvious way to secure the drive. To give it some stability, I taped the drive down and hoped the chassis itself would hold it in place.

![Lenovo ThinkPad X1 Carbon SSD Adapter](https://cdn.synaps.media/control/content/images/2026/08/thinkpad-x1-ssd-adapter.jpeg)

ThinkPad X1 mainboard, adapter card, and a standard M.2 SATA SSD. Lenovo ThinkPad X1 Carbon SSD Adapter by [Daniel Aleksandersen](https://www.daniel.priv.no/?ref=ctrl.blog) licensed under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/?ref=ctrl.blog).

To make things worse, the drive is positioned right under the keyboard. Lenovo designed the laptop with a small air-gap between the M.2 drive and the keyboard. However, the adapter pushed the drive right up into the keyboard, resulting in a little wobble/vibration every time I struck a key on the keyboard.

What’s more interesting is that I couldn’t detect the link problems when running performance benchmarks. I would set the laptop on a table to run benchmarks, unlike how I would usually balance it on my lap and type on the keyboard. I believe that the vibrations from typing on the keyboard would intermittent link drops.

In hindsight, I can see that this set up was a recipe for disaster. I’d never have done this given what I now know about how weak the M.2 connector is! At any rate, the connector was damaged and this caused intermittently disconnects in the drives’ Serial Advanced Technology Attachment (SATA) link.

I’ve always believed that either a SATA drive would work or it wouldn’t. I found it interesting that Windows 10 wasn’t able to detect the problem. However, it turns out that legacy SATA, M.2 SATA, and even M.2 PCIe drives are very tolerant of link failures.

The SATA Advanced Host Controller Interface (SATA-AHCI) is designed to continuously retransmit data during a link failure until receipt is confirmed or a software driver intervenes. Microsoft’s Standard SATA AHCI Controller driver seems to be very tolerant of errors, and it also doesn’t log the errors. The behavior is both good and bad: it’s good because my computer kept working at a significantly reduced speed despite the problem, and it’s bad because it didn’t notify me of any problems with the drive.

One layer below the SATA-AHCI bus, we find the Peripheral Component Interconnect Express (PCIe) interface. PCIe has a similar feature called PCIe transport layer protocol (TLP) retransmission. It can affect links from an M.2 SATA drive (or a legacy SATA connector) via the SATA-AHCI bus or an M.2 PCIe drive connected directly to PCIe.

Both failure modes would create similar problems. I first thought that I was experiencing a PCIe TLP retransmission problem. After studying the relevant standards, I now believe the problem is with SATA-AHCI retransmission since the physical connector damage was to the M.2 connector between the M.2 SATA drive and the SATA-AHCI bus.

Steve Gibson, the developer of the drive diagnostic utility [SpinRite](https://www.grc.com/spinrite.htm?ref=ctrl.blog), put me on the right track after briefly discussing a similar problem on a recent episode of his Security Now podcast. In the same podcast episode, he claimed that future versions of SpinRite will be able to identify link-layer problems.

So, can this type of damage to the M.2 connector pins be repaired? Theoretically: yes, practically: no. An M.2 pin is no more than 0,33 mm wide, and the damaged area is only 0,15 mm. I couldn’t even see the damage without a microscope. Repairing the pins at this minuscule scale is unfeasible.

In my case, I was able to “fix” the problem by remating the connector. It strengthened the connection by aligning it to a different part of the connector pin. In the future, I’ll make sure to tighten the screws on my M.2 devices and make sure they’re securely fastened.

In conclusion: SATA links are fault-tolerant to the extreme, and M.2 connectors are brittle. It’s difficult to troubleshoot issues later, so make sure you properly secure M.2 connections.

#### Sources

- [Transcript of Episode #779: Geneva](https://www.grc.com/sn/sn-779.htm?ref=ctrl.blog), 2020-08-14, Steve Gibson and Leo Laporte, Security Now, Gibson Research Corporation
- [Circuit Design of PCIe Retry Mechanisms](https://www.wseas.org/multimedia/journals/circuits/2014/a025701-219.pdf?ref=ctrl.blog), 2014-04-16, School of Integrated Circuits, Southeast University
- [Serial ATA AHCI Specification](https://www.intel.com/content/dam/www/public/us/en/documents/technical-specifications/serial-ata-ahci-spec-rev1-3-1.pdf?ref=ctrl.blog), Revision 1.3.1, 2013-12-05, Intel
- PCI Express M.2 Specification, Revison 1.0, 2013-11-01, PCI-SIG
- [Effects of Fretting Corrosionon Au-Sn Plated Contacts in Electronic Cable Interconnect](https://www.digipas.com/documents/Effects-of-Fretting-Corrosion-on-Au-Sn-Plated-Contacts.pdf?ref=ctrl.blog), 2013-02, JSBTech Pte
- [PCIe: Is your card silently struggling with TLP retransmits?](https://billauer.co.il/blog/2011/07/pcie-tlp-dllp-retransmit-data-link-layer-error/?ref=ctrl.blog), 2011-07-27, Blog, Eli Billauer
### Fix Linux suspend on low battery and prolong your battery life
URL: https://www.ctrl.blog/entry/linux-laptop-low-battery-suspend/
Last updated: 2026-08-23T22:13:26.000Z
Linux distributions like Fedora Linux and Ubuntu will suspend a battery-powered system when the battery level drops to a critically low charge. They do this using the [UPower](https://upower.freedesktop.org/?ref=ctrl.blog) subsystem. However, UPower’s default configuration isn’t great for battery longevity and it doesn’t always reserve enough charge to enter hibernation. Here’s how to prolong your laptop’s battery life and make sure it can handle low battery situations.

You’re probably reading this article because your laptop is powering down when its battery charge level is low. So, first thing first: does hibernation work on your laptop? Make sure that both the commands `systemctl hybrid-sleep` and `systemctl hibernate` powers down your laptop, and that you can resume your session when you power it back on again. You should use your normal user account, and not the root user.

If hibernation doesn’t work, the system will just power down instead, and you’ll lose your session. Some Linux distributions, like Fedora Linux 32, [isn’t configured for hibernation by default](https://www.ctrl.blog/entry/fedora-hibernate/). The link will help you set it up on Fedora Linux and should be helpful in troubleshooting other distributions.

Next, check to make sure that your system is managed by UPower. You can check on the UPower service by executing `systemctl status upower.service`. If the service isn’t available or isn’t running, your system may not be configured with a power management subsystem. Or it could be managed by another power manager. Check the documentation for your distribution, or ask on its forums or mailing lists.

UPower’s default configuration will put your laptop into hybrid sleep when there’s two percent charge left on your battery. Hybrid sleep (suspend to memory) suspends your laptop to a low-power state, but keeps it powered on. Two hours later, if there’s enough power left, it’s suspended to disk and powered down completely (hibernation). UPower will fallback to hibernating your system right away if it doesn’t support hybrid sleep. If your battery runs out of charge in that two-hour window, your laptop will power down without first entering hibernation. The time delay is governed by the `HibernateDelaySec` option in `/etc/systemd/sleep.conf`.

In my opinion, when you’ve already reached a critically low battery charge; the remaining battery power is better spent entering into hibernation right away. You can change this behavior by setting `CriticalPowerAction=Hibernate` in `/etc/UPower/UPower.conf`.

Two percent remaining battery charge may not be enough to complete the hibernation process. A small, aging, stressed, or warm battery will discharge quickly. I recommend that you reconfigure UPower to begin the hibernation process at 5–8 percent remaining instead. The earlier it acts, the more likely it is to have enough battery charge left to successfully enter hibernation. This will also extend the longevity of a lithium-ion battery. Deep discharges lead to irreversible loss of capacity in lithium-ion batteries, according to [Battery University](https://batteryuniversity.com/article/bu-808-how-to-prolong-lithium-based-batteries?ref=ctrl.blog).

The battery charge percentage can be configured in `/etc/UPower/UPower.conf`. You can configure the low and critical battery level reminders by changing the `PercentageLow` and `PercentageCritical` options. I recommend setting these to 15 and 10 percent. `PercentageLow` option controls when the `HibernateDelaySec` is executed. I recommend setting this to no lower than 5 percent, and ideally higher to prolong battery life.

If you want something other than hibernation to happen in low battery situations, you can check out [Batsignal](https://github.com/electrickite/batsignal?ref=ctrl.blog) and it’s `-D command` argument. You can also use Batsignal to issue the hibernation command if you’re on a minimal system without a power manager. It can run as a background daemon and execute an arbitrary command or script in response to lower power states. (Remember to configure it to act before UPower does!)
### How to install Corel After­Shot Pro 3 on Fedora Linux 32
URL: https://www.ctrl.blog/entry/how-to-aftershot-pro-fedora/
Last updated: 2026-08-23T22:09:10.000Z
Corel hasn’t been maintaining its Linux distribution packages of [AfterShot Pro 3](https://www.aftershotpro.com/en/?ref=ctrl.blog) too well. It gave me trouble installing the RPM from the AfterShot website on a recent version of Fedora Linux. Here’s how I got the software up and running on Fedora Linux 32.

This article is divided into two parts: Part one is step-for-step instructions for how to install AfterShot Pro 3 on Fedora Linux 32\. The instructions might work for other recent versions as well. In the second part, I’ll explain in more detail about how I came up with the step-for-step instructions.

### Installing AfterShot Pro 3

The first step is to install the RPM package from Corel’s website. It depends on some specific outdated library versions. We’ll install the RPM, but ignore its dependencies. The following command downloads, and installs the RPM without its dependencies:

```shell
rpm -ivh --nodeps https://dwnld.aftershotpro.com/trials/3/AfterShotPro3.rpm
```

The RPM installs into `/opt/AfterShot3\(64-bit\)/`. The AfterShot binary is dynamically linked, but the installation includes dozens of outdated libraries that don’t play well with current versions of Fedora Linux. We’ll move all those old libraries — except one proprietary library that is specific to AfterShot — out of the way first. The following commands does make these changes happen:

```shell
cd /opt/AfterShot3\(64-bit\)/lib/
mkdir ./backup/
mv ./* ./backup/
mv ./backup/libbibblesdk.so.5 ./
```

Now that the outdated libraries are out of the way, it’s time to fetch some newer versions from the Fedora Linux library. The following command installs all the libraries AfterShot Pro 3 requires:

```shell
dnf install \
      libglvnd-glx \
      libICE libSM \
      libXcomposite \
      libXext \
      libXi \
      libsecret \
      ocl-icd \
      compat-openssl10 \
      libgpg-error \
      qt \
      qt5-designer \
      qt5-qtmultimedia \
      qt5-qtbase \
      qt5-qtbase-gui \
      qt5-qtsvg \
      qt5-qtwebkit \
      qtkeychain-qt5
```

AfterShot 3 also bundles its own Qt configuration file that causes some problems. It’s not needed, so we’ll simply move it out of the way with the following command:

```shell
cd /opt/AfterShot3\(64-bit\)/bin/
mv ./qt.conf ./qt.conf.backup
```

That’s it! You should be able to run AfterShot 3 now. Continue reading if you want to learn more about how I came up with these instructions.

### How I found the required libraries

Out-of-repository RPM (and DEB) installation packages tend to quickly get outdated. Out-of-repository software vendors — whether they be proprietary or open source — can keep their packages current a bit longer by shipping statically linked binaries that contain all their dependencies. Corel has done something in between and created a mess in the process.

Luckily, it’s not impossible to work around issues like this. As long as the binary dynamically loads libraries from the system, we can get it to have it run newer versions. The first step in this instance was to look at the bundled libraries and install them through the system’s package manager.

However, the RPM also wanted to install additional dependencies onto the system. You can get a list of its dependencies by inspecting the RPM using the following command (the URL may change so over time so get the latest URL from the AfterShot website):

```shell
rpm -qpR https://dwnld.aftershotpro.com/trials/3/AfterShotPro3.rpm
```

That still wasn’t enough to get AfterShot to run, though. It also had some additional undeclared and unbundled dependencies. I completed the list by inspecting the binary to see what libraries it needed to load:

```shell
ldd /opt/AfterShot3\(64-bit\)/bin/AfterShot
```

At this point, I had almost all the dependencies. That’s the one library we copied back out of the backup directory and into the library directory. That specific library is AfterShot-specific.

### Fixing the last problem

When I tried to start AfterShot, I ran into one last problem:

> “Fatal: This application failed to start because no Qt platform plugin could be initialized. Reinstalling the application may fix this problem.”

This is a common error for Qt applications. AfterShot bundles its own `qt.conf` file that referenced a non-existent directory path. That directory path now resides inside the backup directory I’d created earlier. Rather than updating the reference, I just moved AfterShot’s configuration file aside. It didn’t do any good, anyway.
### The difference between RDFa’s property and rel attributes
URL: https://www.ctrl.blog/entry/rdfa-link-attributes/
Last updated: 2026-08-23T22:16:40.000Z
I’ve talked about [HTML link metadata](https://www.ctrl.blog/entry/html-link-metadata/) in the past. In that earlier article, I glanced over one detail that gave me a serious headache this week. That issue was the difference between the `property` and `rel` attributes, and how the two interoperate when used on the same `<a>` or `<link>` element.

The short version is that the `property` attribute describes string literals, and the `rel` attribute describes link relationships. Okay, so use `rel` for link elements and `property` for every other element, and you’ll be fine, right? Yes, and no; it depends.

The following example is similar to most examples you’ll find on Schema.org, e.g. the [Product examples](https://schema.org/Product?ref=ctrl.blog#examples). Because of these examples, you’ll find code snippets and articles recommending the following syntax all over the web:

```html
<a href="https://creativecommons.org/licenses/by/4.0/"
   property="schema:license">
  CC License
</a>
```

The [Google Rich Results Test](https://search.google.com/test/rich-results?ref=ctrl.blog) (GRRT) utility will interpret the value of `schema:license` to be the value of link value in the `href` attribute. So, this is an example where a `property` attribute unexpectedly has described a link relation instead of a string literal! Had it done its job properly, it would have been interpreted as “CC License” instead. However, *it’s not wrong.*

This is where I need to take a quick detour and introduce the Resource Description Framework in Attributes (RDFa) Lite standard. RDFa is a standard for expressing RDF metadata as attributes in other XML\-like document formats (like HTML). RDFa Lite is a simplified subset of the more feature-complete RDFa Core standard.

RDFa Lite is intended to make it easier for web authors to adopt RDFa. One of its design goals was to make it possible to “upgrade” the markup to full RDFa Core by simply adding more attributes. To simplify it, the specification authors also introduced some incompatibility!

Let’s assume you don’t know anything about RDFa or RDFa Lite, but you do know some of the built-in link-relationships in HTML. Let’s expand the above example to incorporate a couple of HTML’s standard link-relationships:

```html
<a href="https://creativecommons.org/licenses/by/4.0/"
   property="schema:license"
   rel="license nofollow">
  CC License
</a>
```

This incorporates HTML’s standard way to declare a license, and tells search-engines not to follow the link and assign it any “link juice.” Both of these link relationships have been recognized by the leading search engines for years. However, we get an error message when we run it by GRRT again:

Error: Invalid URL in field "license"
Error: Invalid value type for field "license"

The interpreted value of `schema:license` this time around is “CC License”. The `property` attribute no longer describes a link relationship, but the text node decedent of the link! By including a `rel` attribute on the `a` element, you’ve upgraded it from RDFa Lite to RDF Core! *Congratulations, I guess!*

The silent upgrade is triggered by setting an `about`, `rel`, `resource`, or `rev` attribute on the same element. It only applies for that one element and not the entire document. The following example shows the same element fully migrated to RDFa Core version:

```html
<a href="https://creativecommons.org/licenses/by/4.0/"
   rel="license nofollow schema:license">
  CC License
</a>
```

This version should be compatible with HTML and RDFa compatible clients. You’ve got your RDFa and HTML link descriptors on the same element and GRRT no longer has any problems parsing your element.

You can’t automatically fix these types of issues by blindly merging your `property` attributes into `rel` attributes. Sometimes you want to interpret the element as both a link and a string literal! Here’s an example describing this blog:

```html
<a href="https://www.ctrl.blog/"
   rel="schema:url"
   property="schema:name">
  Ctrl blog
</a>
```

In the above example, the interpreted value for `schema:url` is “https://www.ctrl.blog/” and `schema:name` is “Ctrl blog.” This is the type of compact and data-rich markup RDFa was designed for. You may also realize that it’s more compact than many of the code examples on Schema.org.

I've previously discussed bugs in Facebook and Twitter's [webpage metadata extraction methods](https://www.ctrl.blog/entry/rdfa-socialmedia-metadata/). I thought that I’d run into another issue like that when I first encountered this behavior. It was unexpected, even to me given my prior knowledge of RDFa. RDFa Lite oversimplified things to a point where it would break in unexpected ways when used together with HTML features. Web authors just need to be aware of the mines on the field when authoring HTML+RDFa.

#### Sources

- Experiments against [Google Rich Results Test](https://search.google.com/test/rich-results?ref=ctrl.blog), 2020-08-14
- [RDFa Lite 1.1 – Second Edition](https://www.w3.org/TR/2015/REC-rdfa-lite-20150317/?ref=ctrl.blog), 2015-03-17, W3C Recommendation, World Wide Web Consortium (W3C)
- [RDFa Core 1.1 – Third Edition](https://www.w3.org/TR/2015/REC-rdfa-core-20150317/?ref=ctrl.blog), 2015-03-17, W3C Recommendation, W3C
### The $10 LensPen Hurricane Blower vs a $1 air puffer
URL: https://www.ctrl.blog/entry/review-air-puffers/
Last updated: 2026-08-23T22:17:21.000Z
I had trouble getting hold of an air puffer earlier this year, because of the global disruptions to retail supply chains. Air puffers are used to dust off sensitive equipment like camera lenses and sensors, printed circuit boards, and electronics. It’s also well suited for dedusting difficult-to-clean living room centerpieces like a Lego space ship model. The one I had ordered didn’t arrive in months, so I picked up a cheap one when I came by one. Of course, the one I’d ordered months earlier arrived the next day. I decided to make a quick comparison review as I had ended up with two air puffers of very different quality.

The first air puffer I ordered is the [LensPen Hurricane Blower](https://lenspen.com/products/hurricane-blower?ref=ctrl.blog) for about 10 USD. The second air puffer (“the cheapo”) only cost 1 USD. It’s the one you’ll find listed under 20+ different brand names on Amazon and AliExpress. So, what’s the difference between an air puffer that costs 10 USD and one that costs 1 USD?

The most obvious difference out of the box between the two products was the smell. LensPen proudly states they make their products from non-toxic rubber. I don’t have the skills or equipment to analyze the materials or verify LensPen’s non-toxicity claim. The LensPen smelled nothing out of the box or when used, but the cheapo stink of vulcanized rubber (“new tire smell.”) Squeezing it releases a strong unpleasant odor, and it sticks to my hands for a while afterward. The cheapo’s smell is potent after two weeks out of its packaging.

The rubber on the LensPen is thicker than on the cheapo. The cheapo requires less force to squeeze, but there isn’t a significant difference. However, you get more airflow out of each squeeze on the LensPen, and not only because of the increased force. Squeezing the cheapo causes approximately 20 % of the air to leak out through the intake vent on the back. You can reduce the amount of air that escapes out of the back by squeezing it near the front of the bulb. This also reduces the air pressure, however. A tiny amount of air escapes through the LensPen’s intake vent, but it makes no difference how you squeeze it.

![](https://cdn.synaps.media/control/content/images/2026/08/air-puffers-intake-filter-molding.jpeg)

The intake filter molding on the LensPen (left) vs. cheapo (right) Air puffer intake moldings by [Daniel Aleksandersen](https://www.daniel.priv.no/?ref=ctrl.blog) licensed under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/?ref=ctrl.blog).

The above below shows the filtered intake vents on the back of each air puffer. In the photo, I’m applying almost twice the force on the LensPen compared to the cheapo. The molding around the intake remains rigid on the LensPen, but the molding on the cheapo reveals why I gave it that name.

Both air puffers performed their main task well. I’ve used both to dust off all my collectibles and the insides of all my laptops. The air pressure isn’t strong enough to blow debris out of a computer keyboard, though. It’s more than powerful enough to remove dust from camera lenses and sensors, and dedust circuit boards and computer components.

The LensPen’s nozzle features a soft rubber tip, whereas the cheapo’s nozzle is a single piece of hard plastic. The photo below shows the tips of each nozzle, including a molding defect on the cheapo (light cyan.) I prefer the LensPen’s soft rubber tip in case I accidentally poked it into a camera sensor or some other sensitive equipment.

![](https://cdn.synaps.media/control/content/images/2026/08/air-puffers-nozzle.jpeg)

The nozzle on a LensPen (left) vs. cheapo (right) Air puffer nozzles by [Daniel Aleksandersen](https://www.daniel.priv.no/?ref=ctrl.blog) licensed under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/?ref=ctrl.blog).

The LensPen’s nozzle directs the airstream in a more concentrated area so you get more of it where you aim. The cheapo disperses the airstream over a larger area. I’m not sure if this is because of the nozzle design or its molding imperfection.

It probably doesn’t come as a surprise to anyone: but you get what you pay for. This even applies in a cheap product categories like hand-operated air puffers. The LensPen is well worth the few extra dollars. The cheaper version works fine, but it’s less efficient than the LensPen Hurricane Blower.

**Reviewed:** [Hurricane Blower](https://lenspen.com/products/hurricane-blower?ref=ctrl.blog)

**Review rating:** 9 / 10
### Review of Firefox “Daylight” for Android
URL: https://www.ctrl.blog/entry/review-firefox-fenix-android/
Last updated: 2026-08-23T22:18:24.000Z
Mozilla has released its redesigned and rearchitected Firefox browser for Android (codename “Daylight” *and* “Fenix”) through the [Google Play Store](https://play.google.com/store/apps/details?id=org.mozilla.firefox&ref=ctrl.blog) everywhere. Here’s my review of Mozilla’s new flagship mobile browser as a long-time user and as an extension developer.

Firefox Daylight’s user interface is minimal, but it represents a large amount of work under the hood. It’s built on [GeckoView](https://mozilla.github.io/geckoview/?ref=ctrl.blog) and [Mozilla Android Components](https://mozac.org/?ref=ctrl.blog) (MOZAC); a set of reusable components for mobile app developers that makes it easier to build a web browser based on Mozilla technology. These components are a modernization of the old codebase as well as a direct competitor to WebView — the web engine that’s built-in to Android, as well as Google’s ChromiumView.

The [Tor Browser for Android](https://www.torproject.org/download/?ref=ctrl.blog#android) has long been a fork of Firefox for Android. I’d expect to see it migrate to Fenix by the end of the year. [Puma Browse](https://www.pumabrowser.com/?ref=ctrl.blog) is one example of a new web browser that has been built on top of MOZAC and GeckoView.

The most noticeable difference from the old version is the redesigned new-tab page. Gone are the automatically populated top-sites list, your browsing highlights (a confusing feature that randomly features pages you’ve recently visited), and recommended news articles suggested by [Mozilla Pocket](https://www.mozilla.org/en-US/firefox/pocket/?ref=ctrl.blog). In their stead, users get a list of favorites that they must manually curate and a new feature called collections. I’ve already discussed [the old features in more detail](https://www.ctrl.blog/entry/firefox-new-tab-distractions/), so let us move on to discuss their replacements right away.

I believe that the removal of top-sites from the new-tab page is a mistake. The new favorites list requires manual curation by the user before it becomes useful. The old top-sites feature lets you be lazy and manages to be useful without any effort on your part.

You can save specific tabs or all open tabs into a collection. Collections seem to be Firefox’s take on Opera’s confusing [Stash feature](https://dev.opera.com/blog/introducing-opera-15-for-desktop-and-a-fast-release-cycle/?ref=ctrl.blog#stash). They don’t sync to your other devices, unlike bookmarks and open tabs.

![A screenshot of Firefox’s navigation bar](https://cdn.synaps.media/control/content/images/2026/08/firefox-79-navbar-android.png)

The navigation bar has moved from the top to the bottom of the screen. The change follows a design-trend that more easily allows for one-hand operation. You can optionally move it back to the top of the screen in settings. The navigation bar also has a new Enhanced Tracking Protection button (the shield) that shows Firefox’s “protection” level for the current page.

The shield icon is a constant reminder that Mozilla is “protecting” you from tracking while you browse the web. I appreciate that Firefox blocks some online tracking. In my opinion, the button takes up too much space on the already crowded navigation bar. I’d prefer to have more space to see more of the page address. The only way to remove the button is to go into settings and disable the feature entirely.

This front and center privacy guarantee feel a bit hollow, however. Firefox defaults to share marketing and another vaguely defined information about how you use Firefox with three external companies: Google Firebase, Adjust, and Leanplum. Enhanced Tracking Protection identifies all three vendors as trackers, but they’re not blocked by when used by Firefox itself. Firefox doesn’t ask if you’re okay with handing your data off to these third-parties, but you can go into settings and disable data sharing.

![A screenshot of Firefox’s share sheet](https://cdn.synaps.media/control/content/images/2026/08/firefox-79-share-android.png)

While on the topic of data sharing, I appreciate the new Share all tabs option found inside the tab switcher. The new share action sheet is also a nice improvement over the old. You now get a list of synced devices that you can send your tabs to at the top. You also get a more useful grid of the most recently used share target apps instead of an unsorted list.

Tab sharing to other devices can be a bit unresponsive, however. Often, nothing will happen after I’ve selected a connected device from the list. I get impatient and tap on the device again. The share sheet closes, and I get two toast notifications saying that two copies of the tab have been sent to the remote device.

The address input/search sheet has been redesigned. You can now scan QR matrix barcodes with your phone’s camera directly from the search sheet. In the old version, you had to install a separate app called [Barcode Scanner by ZXing Team](https://play.google.com/store/apps/details?id=com.google.zxing.client.android&ref=ctrl.blog) to enable this feature.

Search shortcuts have also been redesigned and the new design fixes an annoying issue I had with the old version. Search shortcuts let you select from a list of different search providers for each search query you’ve entered. This is useful when you know you want to search Wikipedia or YouTube, or if you quickly want to repeat the same search query on a different search engine.

The old version showed search providers as a horizontal list of tiny icons representing each search engine. In the new version, you must first click on the Search shortcut button and then select a search provider from a list. The new design requires one extra tap to get the job done, but it will surely reduce the number of times I mistap the wrong small rectangular icon and select the wrong search provider.

The old Firefox for Android supported a high degree of customization and over 8300 extensions. The new version has pretty much the same settings as the old version, but it has blocked access to advanced engine preferences (through the `about:config` page.) Advanced preferences are still available in the beta and nightly test versions, though. (See issue [#7865](https://github.com/mozilla-mobile/fenix/issues/7865?ref=ctrl.blog).)

Advanced preferences are an attractive feature to power-users, and I’m dismayed that the feature has been removed. Without it, there is no way to connect via a proxy service or enable powerful privacy features like [First-Party Isolation](https://www.ctrl.blog/entry/firefox-fpi/). I could switch to the beta releases. However, I don’t really want to use a less-polished and unstable product version because of an arbitrary decision to cut off a feature I use in the main release.

The list of supported extensions has been dramatically cut from 8300 to 9\. All extensions, other than the nine supported ones, are disabled when you upgrade to Fenix. As a user, this is an extremely disappointing development. I rely on a set of extensions to surf the web the way *I* want to experience it. Access to thousands of extensions has been Firefox for Android’s main selling point. Extensions aren’t a unique feature, but no other mobile browser has had access to nearly the same number of extensions.

The deprecation of extension has also made logging in to websites less convenient for me. I migrated from LastPass [to Bitwarden](https://www.ctrl.blog/entry/migrating-to-bitwarden/) after the former [deprecated its Firefox Mobile extension](https://www.ctrl.blog/entry/lastpass-deprecates-firefox-android/). I’ve used Bitwarden’s extension multiple times per day in the last year. However, it’s no longer supported by Firefox. Firefox wants me to use its Mozilla Lockwise password manager (discontinued), but I don’t intend to switch to a Mozilla-made password manager any time soon.

Android offers a system where password manager apps can integrate with web browsers. Firefox’s integration with this system is buggy, however. It’s supposed to show an overlay window from the password manager underneath password fields. The overlay often fails to appear or disappear after a second. I can force it to appear by tapping a password field, then tapping the Firefox menu button, and double-tapping on the Back button. This awkward workaround reveals the overlay window which is often hiding off-screen underneath the on-screen keyboard. This bug aside, I would still prefer using the Bitwarden browser extension over the app.

It’s a frustrating situation for extension developers, too. As an extension developer, I’ve already received complaints saying that I must “fix” my extension to work with Fenix. My [AMP opt-out extension](https://www.ctrl.blog/entry/amp2html-extension/) has received the most love in this period with a call-out as the author’s favorite \[unsupported\] extension in Android Police’s [coverage of the Fenix release](https://www.androidpolice.com/2020/07/28/mozillas-next-gen-firefox-hits-stable-after-a-year-of-previews-without-full-extension-support-apk-download/?ref=ctrl.blog), and a [bug filed against Fenix project](https://github.com/mozilla-mobile/fenix/issues/13058?ref=ctrl.blog). However, there’s nothing I can do about the situation. Mozilla has prepared no documentation, and there is no process that extension developers can follow to make their extensions available to Fenix users.

I’m sure new users who’ve never used Firefox before will be perfectly happy with Fenix. It’s not a release that’s going to make existing users happy, however. You may want to hold off on the update for a while.

**Reviewed:** [Firefox](https://www.mozilla.org/en-US/firefox/browsers/mobile/android/?ref=ctrl.blog)

**Review rating:** 6 / 10
### What it’s like being an Amazon customer in Norway
URL: https://www.ctrl.blog/entry/amazon-europe-customer-experience/
Last updated: 2026-08-23T22:01:20.000Z
Amazon won American consumers with a focus on low prices, consumer satisfaction and user experience, and instant deliveries. The story in Europe is similar except that the user experience depends more on where you live.

There is no Amazon.eu acting as a single destination for the European market. Instead, there are different Amazon websites for the United Kingdom, Germany, France, Italy, The Netherlands, and Spain (some of the biggest economies in Europe). I live in Norway, and the Amazon.no website redirects me to the German-language Amazon.de website. Amazon Germany can ship to Norway, and it’s the only European Amazon website with a machine-translation button that can translate pages to English.

**Update** (2020-08-04): It’s just a day after I wrote this article, and Amazon has announced it’ll open in Sweden and Norway, according to [Shifter](https://www.shifter.no/nyheter/bekreftet-amazon-skal-utvide-til-norge/188344?ref=ctrl.blog "“Confirmed: Amazon will expand to Norway”"). This article was written before the announcement.

However, I prefer browsing and searching on Amazon.co.uk (United Kingdom). Amazon Germany’s machine-translations can make it hard to find the right items. In Norway, it’s common that online (and some offline) retailers use product titles and descriptions that have been machine-translations from German or Swedish. Consumers are expected to develop the skills required to guess what products might be called in one of these languages and then guess what the Norwegian machine-translation would be. I want to avoid that frustrating experience when given the option.

The product selection on Amazon UK and Germany is mostly the same. However, not all products ship to Norway. To filter many items that can’t ship to my country, I need to locate the checkbox for international shipping that appears somewhere near the bottom of the page. I’m required to do this every time I alter the search or click-through to another product category.

Amazon doesn’t remember that I’ve clicked it after navigating to another page. There’s a separate option that says “Ship to Norway” at the top of each page. This option doesn’t filter search results so I’m not entirely sure why it’s there. Frustratingly, the checkbox doesn’t remove all items that can’t be shipped to my location so I still get lots of results that can’t be shipped here.

Once I’ve found the item I want, I change the domain of the page from .co.uk to .de to go to the same page on Amazon Germany. This works for almost all product pages. Shipping to Norway and the items are almost always cheaper on Amazon Germany compared to the UK. Amazon Germany also takes care of deducting the German sales tax and paying the value-added sales tax (VAT) to the Norwegian government on my behalf. This saves me from paying sales tax in two countries. It also saves me a 14 Euro private import fee on packages that haven’t been VAT cleared when they arrive in Norway.

If I were to use the Amazon UK website, the sales tax is processed differently. When placing an order, Amazon UK charges me a deposit that’s about 5 % above the due taxes. Then they have the courier pay the VAT on arrival in Norway. This delays delivery by a day or two. A week or so later, I get the remainder of my deposit back. I don’t know the final purchase price when shopping with Amazon UK. Amazon Germany shows the final purchase price before you pay.

Once I’ve ordered an item, it’s dispatched from an Amazon warehouse — most often located in the UK — and shipped with DHL (a subsidiary of the German postal service) to either The Netherlands or Denmark. Then it’s forwarded on to me in Norway. Delivery usually takes no more than two workdays. This is often faster (and cheaper) than purchasing anything from most Norwegian retailers with domestic shipping.

Norwegian retailers must offer a five-year warranty for most product categories sold to consumers. Retailers are expected to ensure that the products they sell can be expected to last. This is much longer than the one–three years in other European countries.

I would prefer ordering from a Norwegian retailer — even though that means paying more — to have the purchase covered under Norway’s extensive consumer protection laws. However, Norway is a small market, and the available product selection is very limited in many categories. The extended warranty period means retailers are less willing to import products. The only option is often to order through Amazon, and I find myself working my way through Amazon’s convoluted European purchase experience once again.
### Can Linux hibernate into tmpfs?
URL: https://www.ctrl.blog/entry/linux-hibernate-tmpfs/
Last updated: 2026-08-23T22:13:25.000Z
A couple of people reached out to me with the same question after reading my recent article on [Linux system hibernation](https://www.ctrl.blog/entry/fedora-hibernate/): is it possible to hibernate into tmpfs instead of a swap partition? Some experienced Linux administrators might scoff at the idea, but let’s explore how these things work and interact, and what’s possible.

System hibernation copies everything out of volatile memory (RAM) and over to either a swap partition or swap file on a more permanent storage media. Your swap partition needs to be at least the same size as the memory you want to store on it. When hibernating, power to the system is cut after the contents of the system memory has been securely tucked away. The information in volatile memory is lost once the system is powered off.

It may be unappealing to set aside space on a small storage media for a swap partition. You want to preserve as much space as possible for your files and programs, after all. This setup works fine unless you exceed your system’s available volatile memory. At that point, the Linux kernel will begin terminating programs to free memory.

It may be tempting to use a temporary storage backend such as a temporary file system, or tmpfs, instead of a swap partition. The benefit of tmpfs is that you get fast performance by reducing slow I/O operations and that you don’t need to set aside any storage space for its contents. However, tmpfs itself lives in volatile memory either in a swap file or partition. The contents of a tmpfs itself need to be swapped to a swap partition to persist a system power-down.

Tmpfs is primarily useful only for temporary storage needs. As part of a file conversion process, or as a temporary place to store a working copy of a file for a program. System hibernation is most definitely a short-lived temporary need for storage space. However, tmpfs isn’t the right tool for the job.

You could theoretically create a swap file inside a tmpfs mount and have your volatile memory swap into itself. It would be completely pointless other than as an academic exercise.

If you don’t want to set aside space for a swap partition, then you can consider a swap file. It’s more convenient to shrink or grow a swap file than a swap partition. However, the list of caveats and limitations with regards to system hibernation is so long that I outright dismissed the idea of hibernating into a swap file in my earlier article.

#### Sources

- [Tmpfs](https://www.kernel.org/doc/html/latest/filesystems/tmpfs.html?ref=ctrl.blog), version 5.8.0-rc7, 2020-04-12 Linux kernel documentation
### How to schedule Folding@home to only run during winter nights
URL: https://www.ctrl.blog/entry/how-to-fahclient-schedule/
Last updated: 2026-08-23T22:09:56.000Z
[Folding@home](https://foldingathome.org/?ref=ctrl.blog) is a distributed computing platform that lets you donate your spare unused processor power (and electricity) to contribute to medical research. The project was initially set up to do protein folding for cancer research. The project has since expanded to help scientists understand and fight all sorts of diseases including SARS-CoV-2 (the virus that causes COVID-19).

All you need to get going is to download and set up the Folding@home client (FAHClient). It’s available on Linux, MacOS, and Windows. The FAHClient can be set up to run only when your computer is idle and it’s not running off battery power. Unfortunately, FAHClient doesn’t come with any built-in scheduling tools to control which hours of the day it can run.

FAHClient will cause your computer to output more heat and noise as it churns through its allotted research-workloads. You may be fine with this depending on where and how you live. Like most Europeans, I live in an apartment that doesn’t have an air-condition, and it can get very hot during the summer months.

I’m happy to help with medical research, but I don’t want my computer to warm up the apartment in summer. I also don’t want it to output any more fan noise than absolutely necessary during the day. Electricity is also cheaper during off-peak hours — like in the middle of the night — and it gets cold during those hours in winter. I decided that I only wanted to let FAHClient run in the night and during the colder months of the year. That way, my computer can still contribute to scientific research; but only when the noise won’t bother me, electricity is cheaper, and the heat can help keep the apartment warm.

Luckily, all the leading operating systems have built-in tools to schedule when to run programs. This tutorial will show you how to pause and resume FAHClient on a schedule using the tools provided in your operating system of choice. Let’s get started.

### Prerequisites

Complete the following steps and then move on to the configuration steps specific for your operating system below.

1. Install and [set up the Folding@home client](https://foldingathome.org/start-folding/?ref=ctrl.blog) (FAHClient). The tutorial assumes that you’ve installed the client to the default location.
2. Configure your computer’s power-saving settings to allow the computer to remain powered-on at night. Review the settings in System Settings/Preferences: Energy Savings.
3. Configure FAHClient to pause on start-up. Here’s how:
  1. Open FAHControl. It’s a program installed alongside FAHClient. You can find it by searching in the Start menu on Windows or using Spotlight search on MacOS.
  2. Click Configure and select the Expert pane.
  3. Click Add underneath the Extra client options panel.
  4. Type `pause-on-start` as the option name and `true` as its value. Click OK.

What follows are instructions for how to pause and resume FAHClient on a schedule on Windows 10 \[[skip to Windows instructions](#section-windows)\], MacOS \[[skip to MacOS instructions](#section-macos)\], and Linux (systemd) \[[skip to Linux instructions](#section-linux)\].

These instructions will start FAHClient at 01:15 at night and stop it at 06:00 from October through March. Maybe you only want to run it at day when your solar panels are generating electricity? You can follow the optional instruction step to choose a different schedule.

### Windows 10

Most users aren’t familiar with task scheduling in Windows. It may seem overwhelming, but I’ll try to break down each step and walk you through the process.

1. Download [fahclient-unpause.xml](https://cdn.synaps.media/control/content/files/2026/08/windows%5Ffahclient-unpause.xml?ref=ctrl.blog) and [fahclient-pause.xml](https://cdn.synaps.media/control/content/files/2026/08/windows%5Ffahclient-pause.xml?ref=ctrl.blog).
2. \[Optional\] Right-click on the downloaded files and choose Edit. Modify the hour and minutes in the `StartBoundary` to set your own scheduled times (the date just needs to be any date in the past). Modify the months listed in `ScheduleByMonth`. Take care not to make any other changes to the file.
3. Open the Task Scheduler program (use the search field in the Start Menu to find it).
4. Expand the Action menu in the menu bar and select Import task.
5. Select the downloaded file and click OK.

You’re all set up! You can change the scheduled time or remove the task from inside the Task Scheduler. The tasks are called `fahclient-unpause` and `fahclient-pause`. You can also modify the schedule from inside the Task Manager. However, the graphical tool is unintuitive and difficult to use. You may want to bookmark this article for future reference.

### MacOS

The `launchd` system handles scheduled tasks on MacOS, but it doesn’t have a graphical user interface like Task Scheduler on Windows. The setup process may seem overwhelming, but I’ll try to break down each step and walk you through the process.

1. Download [local.fahclient.unpause.plist](https://www.ctrl.blog/file/2020-07-25%5Ffahclient-schedule/macos%5Flaunchd%5Flocal.fahclient.unpause.plist) and [local.fahclient.pause.plist](https://www.ctrl.blog/file/2020-07-25%5Ffahclient-schedule/macos%5Flaunchd%5Flocal.fahclient.pause.plist).
2. \[Optional\] Right-click on the downloaded files and choose Open With: Other: TextEdit. Modify the month, hour, and minutes fields to set your own schedule. Study the structure of the file and take care only to modify the numeric time values.
3. Open Finder. Expand the Go menu in the top bar and select Library. If you don’t see Library in the menu, select Go To Folder, and type \~/Library and press Enter.
4. Open the LaunchAgents folder inside your Library folder (or create it if it doesn’t exist).
5. Move the downloaded files into this folder. You can use drag-and-drop from the Downloads folder or copy-and-paste.
6. Log out and back in again (or restart your Mac) from the Apple menu in the top left corner.

That’s it. You’re all set. You can remove or modify the scheduled time in the files later to undo or change the behavior. You may want to bookmark this article for future reference.

### Linux (systemd)

1. Download [fahclient-unpause.service](https://www.ctrl.blog/file/2020-07-25%5Ffahclient-schedule/linux%5Fsystemd%5Ffahclient-unpause.service), [fahclient-unpause.timer](https://www.ctrl.blog/file/2020-07-25%5Ffahclient-schedule/linux%5Fsystemd%5Ffahclient-unpause.timer), [fahclient-pause.service](https://www.ctrl.blog/file/2020-07-25%5Ffahclient-schedule/linux%5Fsystemd%5Ffahclient-pause.service), and [fahclient-pause.timer](https://www.ctrl.blog/file/2020-07-25%5Ffahclient-schedule/linux%5Fsystemd%5Ffahclient-pause.timer).
2. \[Optional\] Edit the downloaded timer files and modify it to set your own log-out time. Take care not to make any other changes to the file.
3. Move the downloaded files into the `~/.config/systemd/user/` directory inside your Home folder (or create the folder if it doesn’t exist).
4. Open a terminal shell and type the following three commands:

```shell
systemctl --user daemon-reload

systemctl --user enable --now \
        fahclient-unpause.timer

systemctl --user enable --now \
        fahclient-pause.timer
```

You’re all set up! You can change the scheduled time by modifying the timer files or remove it by deleting the timer and service files. You can review the service files if you’re curious about how this works under the hood.

### Finish up before pausing

These instructions have used the pause action; causing FAHClient to pause at the scheduled time. You can make your computer submit completed workloads earlier by giving it time to finish ongoing work. Instead of pausing on schedule, FAHClient will work until the scheduled time and then continue, but pause once it has completed the current workload. This can take any time from minutes to hours.

You can switch to finishing workloads before pausing by editing the task file and locating “`--send-pause`” inside it. Replace that command with “`--send-finish`”.

Haven’t you joined a folding team yet? You’re welcome to join the [Ctrl blog folding team!](https://stats.foldingathome.org/team/252041?ref=ctrl.blog) (#252041)
### RunCat and the battery-impact of processor indicators
URL: https://www.ctrl.blog/entry/macos-runcat/
Last updated: 2026-08-23T22:13:58.000Z
[RunCat](https://kyome.io/runcat/index.html?lang=en&ref=ctrl.blog) is a cute cat-themed desktop pet for MacOS that lives in your top bar. The cat plays a constant running animation where the cat’s running speed represents how hard your Mac’s processor is working. It can be a useful heads-up if a background app or a web browser tab is consuming lots of system resources. However, the cat can itself be a problem for your battery life.

You can optionally add additional indicators next to the running cat for disk and network activity, and memory pressure. If you add more indicators, it becomes more information-overloading than cute, though.

The core concept with the running cat is a cute idea that makes me smile when I look up at it. But do you recall back in the day when the clock in the top bar used to blink the time-separator every second? or when the selected button used to have a pulsating ring around it? Apple disabled those features to reduce the Mac’s power consumption.

You’ve probably already seen where I’m going with this. The innocent little fluffer that’s running in your top bar is a continuous animation that causes battery drainage. Actually, the animation itself is fairly innocent. Modern Macs have better graphic stacks that don’t require repainting large sections of the screen to blink a time-separator. The application behavior still causes unwanted battery drainage.

This problem isn’t specific to RunCat. Any activity indicator like this (on any operating system) can help power-user feel more in charge of what’s happening on their computers. Quickly identifying misbehaving background apps or browser tabs can help you save battery life if you’re constantly glancing at the activity indicator and micro-manage your Mac. But the indicator itself is one of the types of background process you’d want to stop to help conserve power. For example, there are plenty of forum threads on the web discussing how to remove Adobe’s many persistent background processes. RunCat consumes more processor time in a week than Adobe’s much-discussed background processes.

You can use the Energy pane in the Activity Monitor app on your Mac to see the energy impact of applications over time. The energy impact value isn’t a percentage of your battery life or anything quite as specific as that. It’s a relative measure you can use to weigh apps against each other to see how they impact your battery life.

The cat-app receives a low energy impact value (0,8 on my Mac) compared to applications I’m actively using — like my browser and email apps. However, it’s rated higher than many utility apps that I interact with frequently throughout the day.

When I look more closely at the numbers, I can see that RunCat interrupts the processor four times every second. Processor interrupts prevent the processor from maintaining deeper power-saving modes when it would otherwise be idle. Remember the law of small numbers before you dismiss that number. Four times a second quickly accumulates to 2,4 million times per week. To bring that number into context, the Dock generates about 1 million interruptions in a week with normal use. The Dock is also doing a whole lot more than RunCat.

The running cat may be cute. But uninstall it if you appreciate longer battery life over a cute processor-activity indicator that you probably don’t need. Try setting [a photo of a kitten](https://www.pexels.com/search/kitten/?ref=ctrl.blog) as your desktop background image instead!
### Look for EU’s new QR code to know your new TV and monitor’s longevity
URL: https://www.ctrl.blog/entry/eu-display-firmware-label/
Last updated: 2026-08-23T22:05:56.000Z
Some electronics sold in the European Economic Area (EEA) will get new energy-efficiency labels in March 2021\. You’ll see the new labels on the most energy-hungry domestic appliances; including refrigerators, dishwashers, televisions, and more. The European Union (EU) has introduced some interesting new product information requirements for the new energy-efficiency labels. This is information that must be provided before the manufacturer can market their products in the EEA.

I found three of the new information fields for products in the electronic display category especially intriguing. “Electronic displays” includes, e.g. televisions and stand-alone computer monitors, but not projectors, screens smaller than 100 ㎠, and integrated all-in-one devices like smartphones and laptops. Here are the three new information fields that piqued my interest:

> “Field 21: Minimum guaranteed availability of software and firmware updates (until): \[date\]”“Field 22: Minimum guaranteed availability of spare parts (until): \[date\]”“Field 23: Minimum guaranteed product support (until): \[date\]”

Starting in March 2021, you’ll be able to know the minimum guaranteed dates for how long your new smart TV or computer monitor will receive software updates, have replacement parts available, and manufacturer-provided support and repairs. As far as I can tell, no manufacturer has volunteered any of these dates or given any such commitments. The information is intended to help extend the product lifetime and reduce electronic-waste in the EEA.

This is a huge win for consumers! You’ll finally be able to make an informed decision *not* to purchase that stupid Smart TV that won’t receive software updates for more than six months. I’ve reached out to manufacturers in the past to inquire about how long a product will receive updates. I’ve never received a straight answer. The manufacturer must set a date at least eight years from the time the product model first becomes available for sale in the EEA.

The new information fields **won’t appear on the energy-efficiency label itself.** Instead, you can scan the QR\-code on the label with your phone to look-up the product in the European Product Database for Energy Labelling (EPREL). The database website is expected to go online sometime later in 2020.

I’ve been arguing for years that internet-connected devices should be required to feature prominent [best-before date labels](https://www.ctrl.blog/entry/device-best-before-dates/). The date should be the end-of-life/support date for the product. I’d hoped to see this for computers and smartphones, but I’ll not complain about monitors and televisions being first in line to be covered under such regulatory requirements.

Unfortunately, the regulation hasn’t set any requirements or defined what is meant by “software and firmware updates.” Manufacturers are required to ensure that any updates they make remain available until at least the date registered as part of their energy-efficiency labeling. However, there is no requirement that they undertake the ongoing work and develop any security and maintenance updates. Here is what the regulation does say about it:

> “(a) The latest available version of the firmware shall be made available for a minimum period of eight years after the placing on the market of the last unit of a certain product model, free of charge or at a fair, transparent and non-discriminatory cost. The latest available security update to the firmware shall be made available until at least eight years after the placing on the market of the last product of a certain product model, free of charge.”  
>  
> “(b) Information on the minimum guaranteed availability of software and firmware updates, availability of spare parts and product support shall be indicated in the product information sheet \[…\].”

EU Regulation 2019/2021: Annex II. Ecodesign requirements: E. Information availability requirements: 1\. Availability of software and firmware updates

In my opinion, there should have been much stricter requirements to provide maintenance and security updates. Such requirements should include a requirement to provide timely security updates after the manufacturer has been made aware of a security issue. The manufacturer should also be required to maintain the feature set that was available when the product was introduced on the market.

Functional software and security updates are essential to extending the lifetime of any internet-connected product. The EU can’t hope to reduce electronic waste by legislating requirements for spare parts and technical support alone. The device also needs functional and secure software.

Security researcher Scott Helme has also warned about the [internet-communication issues that eventually affect unmaintained devices](https://www.theregister.com/2020/07/18/samsung%5Fbluray%5Fmass%5Fdieoff%5Fexplained/?ref=ctrl.blog "“Here’s why your Samsung Blu-ray player bricked itself”"). An aspect of the secure internet communications protocol known as HTTPS requires ongoing updates. Without these updates, the device will eventually be unable to communicate with online services including the manufacturer’s update servers and online content providers.

I also want to add a similar warning of doom and gloom for unmaintained devices: devices require ongoing updates for accurate time-keeping and time-zone definition changes. The EEA is expected to abandon seasonal changes of time (“daylight-savings time”) in 2021. (Although, COVID-19 may have delayed the process.) That’s a huge time-changer that unmaintained devices won’t be aware of. Accurate time is required for HTTPS to function properly.

Samsung demonstrated in June 2020 that software updates can also be dangerous if mishandled. A bug on their update server — ironically the underlying issue was [the lack of available updates](https://www.theregister.com/2020/07/18/samsung%5Fbluray%5Fmass%5Fdieoff%5Fexplained/?ref=ctrl.blog "“Here’s why your Samsung Blu-ray player bricked itself”") — caused the company’s Blu-ray players to go into a never-ending reboot-loop. The devices needed to be taken in to service and be reflashed with new firmware by a Samsung technician.

#### Sources

- [Here’s why your Samsung Blu-ray player bricked itself](https://www.theregister.com/2020/07/18/samsung%5Fbluray%5Fmass%5Fdieoff%5Fexplained/?ref=ctrl.blog), 2020-07-18, Thomas Claburn, The Register
- [The Impending Doom of Expiring Root CAs and Legacy Clients](https://scotthelme.co.uk/impending-doom-root-ca-expiring-legacy-clients/?ref=ctrl.blog), 2020-06-08, Scott Helme, Blog
- [The new ecodesign measures explained](https://ec.europa.eu/commission/presscorner/detail/en/QANDA%5F19%5F5889?ref=ctrl.blog), 2019-10-01, Questions and answers, Press Corner, European Commission
- [COMMISSION REGULATION (EU) 2019/2021 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32019R2021&from=EN&ref=ctrl.blog), 2019-05-12, The Official Journal of the European Union, EU Parliament and EU Council
- [COMMISSION DELEGATED REGULATION 2019/2013 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32019R2013&from=EN&ref=ctrl.blog), 2019-05-12, The Official Journal of the European Union, EU Parliament and EU Council
### Comparing file sizes of loss­less WebP vs FLIF vs PNG
URL: https://www.ctrl.blog/entry/webp-flif-comparison/
Last updated: 2026-08-23T22:24:16.000Z
Last weekend, I compared two lossy image formats: [AVIF and WebP](https://www.ctrl.blog/entry/webp-avif-comparison/). Today, I’m comparing the file size reduction of two lossless formats — FLIF and lossless WebP — compared to heavily optimized PNG images.

PNG images have been widely supported in every web browser made after 2005. The format uses deflate compression to reduce the image file size. Zopfli is a Google-developed tool for brute-force improving the deflate-compression used in PNG images. It’s an incredibly memory and processor-intensive tool that can reliably reduce PNG file sizes by up to 40 %, compared to traditional PNG encoding tools.

[FLIF](https://flif.info/?ref=ctrl.blog) is an open-source lossless image format that hasn’t seen any adoption in web browsers. There’s a polyfill available that adds support in web browsers, however. FLIF’s big feature win is its focus on progressive decoding without inflating the file size; a feature that I’m a fan of [in JPEGs](https://www.ctrl.blog/entry/jpeg-progressive-loading/). The project’s website makes two claims I wanted to test:

- “FLIF files are on average 14 % smaller than lossless WebP,
- and 33 % smaller than brute-force crushed PNG files (using ZopfliPNG.)”

WebP is most known for its small file sizes when used on lossy images. However, it’s also available in a lossless variant that takes advantage of more modern image encoding and compression techniques. The format will be supported in all leading web browsers later this year when Safari 14 is released.

I originally intended to also include lossless AVIF in the comparison. Unfortunately, I ran into issues with the encoders that lead to many partial and corrupted images. I didn’t spend any time investigating the problems; I’m not even sure if it was a problem with the encoders or the decoders I used. I didn’t have any such issues when [working with lossy AVIFs](https://www.ctrl.blog/entry/webp-avif-comparison/). I excluded AVIF from the lossless comparison because of these issues.

For the test, I used the 260 high-resolution PNG images I’ve got in this blog’s media library. Each image is downscaled into six sizes in 16∶9 aspect ratio ranging from 96 px to 1080 px wide (1560 images in total.) I excluded one set of images from an article where I discuss [noise-artifact patterns that emerge when downscaling images with PHP+libgd](https://www.ctrl.blog/entry/php-libgd-resize-artifacts/). These images are a worst-case scenario for any lossless image format and created far-outliers in every image format.

Compared to the reference PNG, WebP’s median file size reduction was 24,3 % and the 85th percentile was 16,6 %. Only 0,03 % of the WebP images were larger than the PNG.

The FLIF images had a median file size reduction of 23,5 %, the 85th percentile was 8,6 %. However, 7 % of the FLIF images were larger than the PNG files.

The following violin graph shows the distribution of the file size reductions for each format relative to the PNG reference images at zero. (Higher is more file size reduction.)

![Violin graph of the file sizes of WebP and FLIF vs PNG. WebP is almost always smaller than the PNG but FLIF is sometimes larger than the PNG and saves less than WebP.](https://cdn.synaps.media/control/content/images/2026/08/images-webp-flif-vs-zopflipng.png)

FLIF and WebP vs PNG by [Daniel Aleksandersen](https://www.daniel.priv.no/?ref=ctrl.blog) licensed under [CC BY-SA 4.0](https://creativecommons.org/licenses/by-sa/4.0/?ref=ctrl.blog).

The data shows that WebP can consistently outperform Zopfli-compressed PNG images. Notably, it does that without the huge computational cost of Zopfli. FLIF almost keeps up with WebP’s median result but performs almost 50 % worse at the 85th percentile.

FLIF’s median file size in this test was *not* 14 % smaller than the lossless WebP images, as claimed on the project’s website. Instead, it was 1 % larger than the WebPs. FLIF also fell 10 % short of it’s claimed gains compared to ZopfliPNG-optimized PNG files.

#### Sources

- [Apple Adds WebP Image Support in Safari 14](https://www.macrumors.com/2020/06/22/webp-safari-14/?ref=ctrl.blog), 2020-06-22, MacRumors
- [libwebp](https://chromium.googlesource.com/webm/libwebp/?ref=ctrl.blog), version 1.1.0, 2020-01-07, libwebp project, Git, Google
- [zopfli](https://github.com/google/zopfli?ref=ctrl.blog), version 1.0.3, 2019-11-27, zopfli project, Google, GitHub
- [FLIF](https://flif.info/?ref=ctrl.blog), 2019-01-20, Homepage, FLIF project
- [FLIF](https://github.com/FLIF-hub/FLIF?ref=ctrl.blog), version 0.3, 2017-04-28, FLIF project, GitHub
### Comparing AVIF vs WebP file sizes at the same DSSIM
URL: https://www.ctrl.blog/entry/webp-avif-comparison/
Last updated: 2026-08-23T22:24:15.000Z
I wanted to improve the image quality on the blog while keeping the file sizes small. To this end, I wanted to improve the visual quality of my WebP images and explore the new AVIF image format. Here are my findings from comparing WebP and AVIF to JPEGs at the same visual quality.

This article is heavily inspired by previous work by [Johannes Siipola](https://siipo.la/blog/is-webp-really-better-than-jpeg?ref=ctrl.blog) and [Gilles Dubuc](https://calendar.perfplanet.com/2018/is-avif-the-future-of-images-on-the-web/?ref=ctrl.blog). However, I’ll use a much higher target quality setting and an image set consisting of 600 photos and images from the blog. Each image will be encoded in six sizes in 16∶9 aspect ratio ranging from 96 px to 1080 px wide. It’s also a much [fairer comparison](https://kornel.ski/en/faircomparison?ref=ctrl.blog) than [my earlier work](https://www.ctrl.blog/entry/webp-vs-guetzli-zopfli/).

If you don’t care about the methodology and details, you can skip down to [the conclusion and pretty graphs](#section-results). You won’t understand what you’re looking at, but it’s your call.

I’ve always encoded images in lossy formats at a fixed quality setting. This approach can result in low visual quality and artifacts for some images. It can also produce unnecessarily large files for some images where a lower quality setting would have produced a good-enough visual quality. In most image encoding libraries, the quality setting is just a hint to the encoder. It doesn’t provide any guarantees about the quality of the resulting image.

To get an objective and comparable metric for comparing different image formats, I used structural dissimilarity as measured by Kornel Lesiński’s [dssim](https://kornel.ski/dssim?ref=ctrl.blog) library. Simply put, it measures the amount of dissimilarity from the source image. This allows the different encoders to make different decisions on how they sacrifice image quality to achieve smaller file sizes, but within a similar “loss of quality budget”.

I used a binary search algorithm to pick the image quality setting for each image based on multiple encoding attempts. The search would pick the image nearest the targeting a DSSIM value of 0.0025\. The DSSIM value doesn’t mean anything by itself; it’s not a percentage of dissimilarity. Zero means lossless, lower numbers is less dissimilarity, and the range goes to infinity.

The source images were scaled down to the desired size and fed into the encoders as a lossless PNG image. I enabled all settings that spends more processor time in exchange for smaller files and higher quality. The encoders were otherwise left at their default settings — unless otherwise specified below.

### The image formats

I used MozJPEG to encode the JPEG images in this test. I’ve previously used the Guetzli encoder and losslessly repacked the results to [progressively decodable JPEGs](https://www.ctrl.blog/entry/jpeg-progressive-loading/) using MozJPEG. Guetzli produces smaller images than MozJPEG, but it requires significantly more processing time. It was unfeasible to use it for this comparison (or in any of my projects) because I expected to encode each image up to six times. MozJPEG also produces progressive JPEGs by default, thereby eliminating one step in my image processing chain.

In the comparison, the lowest JPEG quality selected was 50 and the highest 99 with a mean of 84 on a 0–100 scale (higher is “better.”) As a reminder: these images all have the same DSSIM value when compared to the high-quality source image. I found the range that produced images at an acceptable loss of visual quality absolutely fascinating. I manually re-encoded some of the images that landed on a low quality setting at the higher mean quality setting. The images were nearly twice the size but yielded almost the same DSSIM values.

I used (`cavif` (built on (`libavif`) to encode the AVIF images. AVIF is a new open image format based on the work on the open-source AV1 video codec. The images were encoded with YUV 444 color subsampling to get nearer to WebP’s [sharp YUV](https://www.ctrl.blog/entry/webp-sharp-yuv/) 420 subsampling. `libavif` has no option equivalent to `libwebp`’s sharp YUV, but a higher subsampling achieves similar — well, actually better — results. Image file sizes could potentially be reduced further by analyzing the images and dynamically toggling 422 or 444 color subsampling as needed. AVIF support is expected to be included in future versions of Mozilla Firefox, and Google Chrome and its many derivatives.

The lowest AVIF quality selected was 33 and the highest 0 with a mean of 12 on a 64–0 scale (lower is “better.”)

The last format I included was WebP. As already discussed, I used `libwebp` with the sharp YUV option enabled. As discussed in an earlier article, the option only [negligibly affects image file sizes](https://www.ctrl.blog/entry/webp-sharp-yuv/). WebP is ten years old now and Safari 14 will be the last mainstream web browser to gain support for WebP image formats. Safari 14 is due for release for MacOS and iOS in the third quarter of 2020.

The lowest WebP quality selected was 55 and the highest 99 with a mean of 93 on a 0–100 scale (higher is “better.”) I was surprised to learn that the WebP images needed a higher quality setting to match MozJPEG’s visual quality. All but two images decided on a higher quality setting for WebP than JPEG. I’ve always \[mistakenly\] believed the WebP quality setting to be near JPEG’s quality setting.

### The results

Compared to the reference JPEG; WebP’s median file size reduction was 31,5 %, the 85th percentile was 20 %, and 2,7 % of the images were larger.

The AVIF images had a median file size reduction of 50,3 %, the 85th percentile was 39,6 %, and none of the images were larger than the reference.

The following violin graph shows the distribution of the file size reductions for each format relative to the JPEG reference images at zero. (Higher is more file size reduction.)

![Violin graph of the file sizes of WebP and AVIF vs JPEG. WebP is almost always smaller than the JPEG but AVIF consistently saves more than the WebP.](https://cdn.synaps.media/control/content/images/2026/08/images-webp-avif-vs-jpeg.png)

Image file size savings in WebP and AVIF compared to the reference JPEG at the same DSSIM.

AVIF outperformed both JPEG and WebP for every image in the test. AVIF’s 85th percentile was the same as WebP’s 15th percentile! A median saving of -50 % at the same DSSIM is a very good result! You’re all but guaranteed to save bandwidth with AVIF, but you must check each image when using WebP.

Neither AVIF nor WebP support [progressive image decoding](https://www.ctrl.blog/entry/jpeg-progressive-loading/); a technique that gives people with poor connectivity a better user experience. AVIF’s considerably smaller file sizes helps alleviate the need for progressive decoding, however.

I’ve decided to go ahead and roll out AVIF for lossy images for Ctrl blog. HTML’s `<picture>` element can handle multiple image formats as a progressive enhancement for web browsers that support the newer formats. AVIF is expected to land in Google Chrome version 85 and Mozilla Firefox later this year.

You can enable experimental support for it in Firefox version 77 and newer by going to `about:config` and toggling `image.avif.enabled`. I guess it will be another ten years before we see AVIF support on Apple’s platforms?

**Update** (2021-08-12): Firefox hit some snags along the way and delayed its AVIF support. AVIF support is set to be enabled by default in Firefox 92 (due for release in early September 2021), according to [Phoronix](https://www.phoronix.com/news/Firefox-92-AVIF-Trying-Again?ref=ctrl.blog).

#### Sources

- [AVIF Image Decode](https://www.chromestatus.com/features/4905307790639104?ref=ctrl.blog), 2020-07-09, Chrome Platform Status, Google
- [Brunsli](https://github.com/google/brunsli?ref=ctrl.blog), master commit 18f7a90c, 2020-06-29, Brunsli project, Google, GitHub
- [Apple Adds WebP Image Support in Safari 14](https://www.macrumors.com/2020/06/22/webp-safari-14/?ref=ctrl.blog), 2020-06-22, MacRumors
- [Is WebP really better than JPEG?](https://siipo.la/blog/is-webp-really-better-than-jpeg?ref=ctrl.blog), 2020-06-19, Johannes Siipola
- [cavif](https://github.com/link-u/cavif?ref=ctrl.blog), version 0.1.0-20200331, 2020-03-31, Ryo Hirafuji, cavif project, Link-U, GitHub
- [libwebp](https://chromium.googlesource.com/webm/libwebp/?ref=ctrl.blog), version 1.1.0, 2020-01-07, libwebp project, Git, Google
- [dssim](https://github.com/kornelski/dssim?ref=ctrl.blog), version 2.9.7, 2019-03-16, Kornel Lesiński, dssim project, GitHub
- [AVIF for Next-Generation Image Coding](https://netflixtechblog.com/avif-for-next-generation-image-coding-b1d75675fe4?ref=ctrl.blog), 2020-02-13, Technology Blog, Netflix
- [Is AVIF the future of images on the web?](https://calendar.perfplanet.com/2018/is-avif-the-future-of-images-on-the-web/?ref=ctrl.blog), 2018-12-22, Gilles Dubuc, Web Performance Calendar
- [MozJPEG](https://github.com/mozilla/mozjpeg?ref=ctrl.blog), version 3.3.1, 2018-03-17, Kornel Lesiński, MozJPEG project, Mozilla, GitHub
- [How to compare images fairly](https://kornel.ski/en/faircomparison?ref=ctrl.blog), 2014-12-27, Kornel Lesiński
### Enable the sharp YUV option for better WebP images
URL: https://www.ctrl.blog/entry/webp-sharp-yuv/
Last updated: 2026-08-23T22:24:19.000Z
Did you know there’s a setting for the reference WebP image encoding library (`libwebp`) that noticeably improves image quality without increasing the file size? It’s safe for batch conversions and its only downside is that it consumes additional processor time during encoding.

The lossy WebP image encoding format is renowned for the tiny file sizes it produces and not its excellent image quality. The format is ten years old this year, has been in all leading browsers (except Safari) for at least five years, and will finally [arrive in Safari 14](https://www.macrumors.com/2020/06/22/webp-safari-14/?ref=ctrl.blog "“Apple Adds WebP Image Support in Safari 14”") (due for release later this year.)

I’ve used the format as a progressive enhancement here on Ctrl blog for the last four years. Web browsers that have supported it have been able to save some bandwidth by downloading the smaller WebP image files while older browsers have fetched larger JPEG and PNG files instead.

I’ve been mostly happy with the format over the years — except that it tends to ruin some illustrations. For some images, WebP images would turn some thin contrast lines, edges, and gradients to mush. I’ve resorted to using PNG and lossless WebP for these images; something which produces unnecessarily large files where a lossy encoding should have been enough for the job.

I stumbled upon an option called sharp YUV in `libwebp`. To cut to the chase straight away, enabling this option improves the visual quality in the situations mentioned above — all examples of chroma-subsampling that darkens and desaturates color — at no cost to the file size. The only documentation available for the option is these two sentences:

> “Use more accurate and sharper RGB->YUV conversion if needed. Note that this process is slower than the default ‘fast’ RGB->YUV conversion.”

Here’s a test image designed to exaggerate the visual differences of the different chroma-subsampling options:

[![Lossless encoding of a chroma-subsampling test image](https://cdn.synaps.media/control/content/images/2026/08/image-subsampling-test.png)](https://cdn.synaps.media/control/content/images/2026/08/image-subsampling-test.png?ref=ctrl.blog) 

Test image (lossless PNG)

[ ![WebP with sharp YUV vs WebP encodings of the test image](https://cdn.synaps.media/control/content/images/2026/08/webp-sharp-yuv-vs-webp.png) ](https://cdn.synaps.media/control/content/images/2026/08/webp-sharp-yuv-vs-webp.png?ref=ctrl.blog) 

Animation alternating between WebP with sharp YUV and the default YUV subsampling.

Without the sharp YUV option, the thin lines get desaturated and a bit blurry. Enabling the sharp YUV option performs gamma-correction to preserve the color contrast closer to the original color. It also preserves the thin lines under more conditions. The gamma-corrected color still bleeds the blue color into the red color and vice-versa. However, this effect is inevitable in a chroma-subsampled lossy image format.

But what about real-world illustration and photos? This blog has some 600 high-resolution 16∶9 aspect-ratio images that I encode in six different sizes from 96 px to 1088 px wide (3600 images in total.) I compared my lossless source images PNG (ZopfliPNG) and lossy JPEG (MozJPEG) images to their corresponding lossless WebP and lossy WebP images.

The test images were encoded with the default settings for their library but options for processor utilization were cranked up to the maximum setting (spend more time for higher quality and smaller files.) Instead of a fixed quality setting, each lossy image was encoded multiple times until they hit a target structural dissimilarity (DSSIM) value of 0.0025 using Kornel Lesiński’s excellent [dssim](https://kornel.ski/dssim?ref=ctrl.blog) library. The images should have similar visual quality across image formats and encoding options.

The lossy WebP image file sizes were 1–0,3 % smaller with the sharp YUV option than without it compared to the reference image encoded with the same DSSIM. The lossless WebP image file sizes was 0,3–0,1 % smaller with the sharp YUV option. This last one is quite surprising as it shouldn’t have any effect on the lossless encoding. There is a tiny positive file size reduction overall with the sharp YUV option but it’s insignificant. Notably, both variants of the WebP encodings ended up using the same quality settings (around 91) and the sharp YUV variant only saw a negligible improvement in their DSSIM value. It would seem that DSSIM can’t properly account for the color differences.

In my tests, encoding with the Sharp YUV option added took on average 68 % more wall-clock time per image. Your mileage may vary considerably depending on processor speeds and capabilities. While this may sound like a lot, keep in mind that WebP image-encoding is already incredibly fast. In my opinion, the quality gains are well worth the one-time extra time expenditure.

For the sake of completeness, I also tried encoding all of the images at a lower fixed quality setting of 50\. The median image file size with the Sharp YUV option enabled increased by 2,6 % and the 85th percentile by 2,5 %. This produced the impressive result (upscaled to emphasize the differences) used as the feature image ([high-resolution version](https://cdn.synaps.media/control/content/images/2026/08/adobe-webp-q50-vs-sharpyuv.png?ref=ctrl.blog)) at the top of the article.

The conclusion is clear: if you’ve got the processing power to spare, then enable sharp YUV. You can enable it by passing the `-sharp_yuv` argument to the `cwebp` command-line utility; or toggling the `use_sharp_yuv` option if you use another utility based on the `libwebp` library.

#### Sources

- [Apple Adds WebP Image Support in Safari 14](https://www.macrumors.com/2020/06/22/webp-safari-14/?ref=ctrl.blog), 2020-06-22, MacRumors
- [libwebp](https://chromium.googlesource.com/webm/libwebp/?ref=ctrl.blog), version 1.1.0, 2020-01-07, libwebp project, Git, Google
- [dssim](https://github.com/kornelski/dssim?ref=ctrl.blog), version 2.9.7, 2019-03-16, Kornel Lesiński, dssim project, GitHub
- [MozJPEG](https://github.com/mozilla/mozjpeg?ref=ctrl.blog), version 3.3.1, 2018-03-17, Kornel Lesiński, MozJPEG project, Mozilla, GitHub
- [How to compare images fairly](https://kornel.ski/en/faircomparison?ref=ctrl.blog), 2014-12-27, Kornel Lesiński
### How to enable hibernation on Fedora Linux
URL: https://www.ctrl.blog/entry/fedora-hibernate/
Last updated: 2026-08-23T22:06:11.000Z
System hibernation allows you to power down the computer and resume your work later. Assuming you’re using different physical storage disks for each operating system (OS), you can even boot into a different OS like Windows 10 while your Linux distribution is hibernating. Fedora Workstation doesn’t support system hibernation (suspend-to-disk) by default. Here’s how to enable it.

This tutorial assumes you’ve already created and configured a swap partition large enough to fit your entire system memory capacity plus any normal swap pressure (RAM \+ normal swap usage + decompressed ZRAM usage). Avoid using a swap file; use a swap partition. The swap partition must be configured to mount on start-up. This part of the configuration is outside the scope of this article. Set up a swap partition or dedicated swap device first, preferably with LUKS encryption, and return to this article once you’re set up.

**Update** (2020-11-12): The above assumption is no longer the default. Starting with version 33, Fedora Linux no longer creates a swap partition by default, but [relies on ZRAM](https://www.ctrl.blog/entry/how-to-systemd-zram-generator/) instead. You still need a storage drive backed swap partition as you still [can’t swap volatile memory into itself](https://www.ctrl.blog/entry/linux-hibernate-tmpfs/) when the system powers down.

Warning: In this article, you’ll be adding Kernel boot parameters and make changes to the boot environment. It’s unlikely, but it can break your system and put it in a state where it can’t be booted. Be patient and make sure you set aside enough time to troubleshoot and restore if anything goes wrong. As always, ensure you have complete and up-to-date backups.

Enabling hibernation and dumping the system memory to disk is relatively straight-forward. The real trick is getting the system to resume from the swapped session! So let us start from that end and configure session resume first.

You’ll need to include the `resume` module in the initial RAM file system (`initramfs`); the temporary environment the bootloader runs in. Create a new configuration file at `/etc/dracut.conf.d/resume.conf` (you can edit `/etc/dracut.conf` directly if your distribution doesn’t have this subdirectory) and include the following option:

```
add_dracutmodules+=" resume "
```

The whitespace in the above code snippet is significant. Make sure you set the option exactly as shown. Next, you must execute the `dracut -f` command to generate your new `initramfs`.

Next, the GRUB bootloader needs to be told that it should look for a suspended session and resume it if it finds one. It also needs to know which disk the system has swapped the session onto. Identify your swap partition’s UUID by executing the command `blkid | grep swap | cut -d: -f1`. Double-check your swap configuration if the command doesn’t return anything.

Open `/etc/default/grub` and append the following to the end of your `GRUB_CMDLINE_LINUX` option. Replace `your-swap-identifier` with the UUID for the swap partition you identified above. (\[…\] is a placeholder for the existing values in your configuration.)

```shell
GRUB_CMDLINE_LINUX="[…] resume=UUID=your-swap-identifier"
```

You also need a second parameter if you’ve enabled LUKS-encryption on your swap-partition. You may already have the second parameter in your configuration so make sure you don’t duplicate it. When your device hibernates, everything in the system memory — including passwords and other sensitive data — will be written to disk. It’s recommended to enable LUKS-encryption on swap partitions.

```shell
GRUB_CMDLINE_LINUX="[…] rd.luks.uuid=your-swap-identifier"
```

You then need to regenerate your GRUB configuration. The exact path may vary in your Linux distribution and version. Check your distribution’s installation documentation and double-check this path before proceeding. You can also check to see if this file already exists in this path on your system.

```shell
grub2-mkconfig -o /boot/grub2/grub.cfg
```

Lastly, check that hibernation is enabled on your system. Open the file `/etc/systemd/sleep.conf` and make sure it includes the following options. You may need to uncomment or add them if they’re not present in your configuration.

```ini
[Sleep]
AllowHibernation=yes
HibernateMode=shutdown
```

You should be set up at this point. Reboot your system. Afterward, you can cross your fingers and execute `systemctl hibernate`. Wait for your system to power down. Power it back up again and it should resume your last session.

You should hibernate and resume your system a few times to make sure it works properly. Check sound, microphones, networking, and other hardware each time. It’s not unheard of that some device drivers don’t work properly when resuming from hibernation.

Double-check your swap partition mounting options in `/etc/fstab` if the system just boots normally when you expect it to resume. You’ve probably got incompatible hardware or a broken driver if the system only partially resumes, e.g. a blank screen. If you get stuck in such a mode, you can pause on the GRUB screen and modify the Linux kernel options. Remove the `resume=[…]` option and try booting into the system again.

This article was last updated for Fedora Linux 34 with notes left in for older versions. The article should be applicable to other Linux distributions that boot using the same toolset as Fedora Linux.

#### Sources

- [The kernel’s command-line parameters](https://www.kernel.org/doc/html/latest/admin-guide/kernel-parameters.html?ref=ctrl.blog), version 5.8.0-rc3, 2020-06-28, Linux kernel user’s and administrator’s guide, Linux Kernel Documentation
- [dracut documentation](https://www.kernel.org/pub/linux/utils/boot/dracut/dracut.html?ref=ctrl.blog), version 050, 2020-04-03, Harald Hoyer, Red Hat, Linux Kernel Utils
- [man systemd-sleep.conf](https://www.freedesktop.org/software/systemd/man/systemd-sleep.conf.html?ref=ctrl.blog), version 245, 2020-03-06, systemd documentation, FreeDesktop.org
- [GRUB 2](https://fedoraproject.org/w/index.php?title=GRUB%5F2&oldid=522973&ref=ctrl.blog), revision 522973, 2018-07-31, Wiki, Fedora Project
### How to auto-lock your computer on a schedule (e.g. at bedtime)
URL: https://www.ctrl.blog/entry/lock-pc-at-bedtime/
Last updated: 2026-08-23T22:13:32.000Z
I’m terrible at maintaining a consistent bedtime and often stay up on the computer late into the night. Admittedly, this is usually the time when I’m the most productive. I get so into things that I lose track of time. However, this bad habit makes it hard to get enough hours of sleep; something that’s not too good for the human body. Here's how to get your computer to lock the screen at bedtime and help any of you developer-types maintain a more consistent bedtime.

iOS and Android have had some sort of “digital well-being” and time-management for about two years. These features are — among other things — designed to help you wind down at night and help you manage time and get enough sleep. It’s not a magic solution but its something that can be helpful. However, computers are lagging behind the trend and don’t offer the right tools.

I wanted my computer to kick me out of my gaming, programming, writing, or whatever activity I’m doing. I don’t want it power down or lose any ongoing work. I just wanted the screen to abruptly force me back to the login screen and out of whatever activity I’m doing.

Locking the screen doesn’t prevent me from logging back in and continuing my work. However, it’s a very strong and abrupt indicator to my brain that “hey, it’s late — go to bed!” I can admit failure and log back in. However, I feel slightly guilty about it and I more often do the adult thing and go to bed instead.

What follows are instructions for how to set up scheduled screen locking for Windows 10 \[[skip to Windows instructions](#section-windows)\], MacOS \[[skip to MacOS instructions](#section-macos)\], and Linux (systemd) \[[skip to Linux instructions](#section-linux)\].

By default, these instructions will lock your computer at 23:45\. You can follow the optional instruction step to set a different lock-time.

### Windows 10

Microsoft offers parental control features for Windows for managing the time spent on the computer. However, you can’t apply them to yourself (as a full-privilege administrative user.) There are over a dozen third-party programs for limiting screen time, but most of these are over-complicated and expensive subscription services.

You can set up screen locking on a schedule using Windows’ built-in tools, however. Task scheduling in Windows isn’t something most users will be familiar with but I’ll walk you through it.

1. Download [lock-session-bedtime.xml](https://cdn.synaps.media/control/content/files/2026/08/windows%5Flock-session-bedtime.xml?ref=ctrl.blog).
2. \[Optional\] Right-click on the downloaded file and choose Edit. Modify the hour and minutes in the `StartBoundary` to set your own log-out time (the date just needs to be any date in the past.) Take care not to make any other changes to the file.
3. Open the Task Scheduler program (use the search field in the Start Menu to find it.)
4. Expand the Action menu in the menu bar and select Import task.
5. Chose the downloaded file and click OK.

You’re all set up! You can change the scheduled time or remove the task from inside the Task Scheduler. The task will be called `lock-session-bedtime`. You may want to bookmark this article for future reference.

### MacOS

Apple provides a built-in option that will put your Mac to sleep on a schedule. You can get the [setup instructions from Apple](https://web.archive.org/web/20200701131306/https://support.apple.com/en-ca/guide/mac-help/mchlp2266/mac). However, this will open a dismissable dialog with a ten-minute countdown at the time you schedule it to sleep. This isn’t what I want. It’s to easy to just click Cancel and be done with it.

MacOS has a second built-in option called downtime. Again, you can get the [instructions for that from Apple](https://web.archive.org/web/20200701131315/https://support.apple.com/guide/mac-help/schedule-downtime-in-screen-time-mchl69510069/mac). This is a more complex system where you can carve out exceptions for certain apps and micro-manage everything.

Neither of these options is what I want. In lieu of a better built-in option, I needed to create a custom scheduled task. MacOS schedules tasks through the `launchd` service manager. Here are instructions for how to install a `launchd` service that’ll log you out at 23:45 every night.

1. Download [local.lock-session-bedtime.plist](https://www.ctrl.blog/file/2020-07-01%5Flock-session-bedtime/macos%5Flaunchd%5Flocal.lock-session-bedtime.plist).
2. \[Optional\] Right-click on the downloaded file and choose Open With: Other: TextEdit. Modify the hour and minutes fields to set your own log-out time. Take care not to make any other changes to the file.
3. Open Finder. Expand the Go menu in the top bar and select Library. If you don’t see Library in the menu, select Go To Folder, and type \~/Library and press Enter.
4. Open the LaunchAgents folder inside your Library folder (or create it if it doesn’t exist.)
5. Move the downloaded file into that folder. You can use drag-and-drop from the Downloads folder or copy-and-paste.
6. Log out and back in again (or restart your Mac) from the Apple menu in the top left corner.

That’s it. You’re all set. You can remove or modify the scheduled time in the file later to undo or change the behavior. You may want to bookmark this article for future reference.

### Linux (systemd)

The following method should work on terminal sessions and graphical sessions (including Plasma and GNOME) on any system managed by `systemd` (almost all modern Linux distributions.)

1. Download [lock-session-bedtime.service](https://www.ctrl.blog/file/2020-07-01%5Flock-session-bedtime/linux%5Fsystemd%5Flock-session-bedtime.service) and [lock-session-bedtime.timer](https://www.ctrl.blog/file/2020-07-01%5Flock-session-bedtime/linux%5Fsystemd%5Flock-session-bedtime.timer).
2. \[Optional\] Edit the downloaded timer file and modify it to set your own log-out time. Take care not to make any other changes to the file.
3. Move the downloaded files into the `~/.config/systemd/user/` directory inside your Home folder (or create the folder if it doesn’t exist.)
4. Open a terminal shell and type the following two commands:

```shell
systemctl --user daemon-reload

systemctl --user enable --now \
        lock-session-bedtime.timer
```

You’re all set up! You can change the scheduled time by modifying the timer file or remove it by deleting the timer and service files. You can review the service file if you’re curious about how this works under the hood.
### Ctrl blog is now available as an Onion site
URL: https://www.ctrl.blog/entry/ctrlblog-onion-mirror/
Last updated: 2026-08-23T22:04:32.000Z
Ctrl blog is now available in the Tor Browser on the Onion network. Tor is a specialized program that anonymizes the network routes and contents of your internet traffic. Tor makes it difficult for governments, internet service providers, and others to identify or block specific websites. It can be used to increase privacy, routing security, and to route around censorship.

You need a specialized web browser called [Tor Browser](https://www.torproject.org/?ref=ctrl.blog) (for Android, Linux, MacOS, and Windows) to access Onion sites. You can also use the special Private Window with Tor mode in the [Brave Browser](https://brave.com/features/?ref=ctrl.blog) (Linux, MacOS, and Windows versions only). Note that the Tor Browser offers better privacy protections than Brave with Tor mode.

In 2018 and 2019, Ctrl blog was intermittently blocked in China over a dozen times. [Turkey blocked Ctrl blog’s CDN for five days](https://www.ctrl.blog/entry/bcdn-blocked-turkey/) in 2018. Ctrl blog was unavailable for some visitors in 2019 after temporarily having been placed on a piracy block list for 12 days (unknown reason), and on a list of websites spreading malware for 9 days (unknown reason). [Russia threatened to block](https://www.ctrl.blog/entry/email-politics-security-newsletter/) Ctrl blog’s email provider in 2020.

These blocks have likely been the result of automated systems. I don’t believe I’ve published anything on Ctrl blog that has resulted in it being targeted by any government. However, I have admittedly written some articles about technologies (including [VPNs](https://www.ctrl.blog/tag/vpn/) and [crypto-currencies](https://www.ctrl.blog/tag/crypto-currencies/)) that are banned in some countries (including some of those mentioned above). However, it’s no fun being blocked and it exposes some uncomfortable realities about national takes on internet governance.

I’ve decided to offer an Onion site mirror to help ensure global availability and help protect people’s anonymity. I’ve had the Onion site mirror ready to go for over nine months. I wanted a backup plan ready to go if something ever happens to the primary domain name. However, I didn’t ever publish the mirror address anywhere except the [/mirrors.txt file](https://www.ctrl.blog/mirrors.txt). Until very recently, the Tor Browser didn’t have a simple method for mapping ICANN DNS names to Onion domains.

If you visit the primary domain (ctrl.blog) in the Tor Browser, it will display a badge in the address field that will take you to the Tor address. This feature was introduced in [Tor Browser 9.5](https://blog.torproject.org/new-release-tor-browser-95/?ref=ctrl.blog "“New Release: Tor Browser 9.5”") and is powered by the new [Onion-Location HTTP response header](https://www.ctrl.blog/entry/tor-onion-location-header/).

Instead of visiting https://www.ctrl.blog/ in your web browser, you can visit the following address using a Tor-capable web browser:

~~service discontinued~~

Please note that the address uses http: and not http**s**:. There’s no need to use HTTPS as the Onion network already uses end-to-end encryption when communicating with Onion addresses (any .onion domain). It’s possible to add one extra layer of protection using HTTPS encryption. However, purchasing HTTPS certificates for `.onion` domain names is prohibitively expensive.

The Onion site has a few extra privacy protections compared to the main website. Ctrl blog is designed to only load strictly necessary third-party resources. The main website displays ads, and a handful of articles include YouTube videos. The Onion site doesn’t have any ads and displays links to external videos instead of embedding them on the page. Please consider [becoming a patron](https://www.buymeacoffee.com/aleksandersen?ref=ctrl.blog) if you’d like to see Ctrl blog become completely ad-free.

You may, of course, continue to access Ctrl blog through the primary address via Tor. However, you’ll miss out on the extra privacy-protections and the website may be slower to load. Tor relies on so-called “exit node” servers when talking with regular websites. These servers are where Tor traffic exits onto the regular internet. Low capacity at these nodes may sometimes cause Tor to slow down.

You can always find an updated list of available mirrors at [ctrl.blog/mirrors.txt](https://www.ctrl.blog/mirrors.txt). Mirrors may change over time.
### Promote your Onion site with the Onion-Location HTTP header
URL: https://www.ctrl.blog/entry/tor-onion-location-header/
Last updated: 2026-08-23T22:23:25.000Z
The [Tor Browser](https://www.torproject.org/?ref=ctrl.blog) anonymizes web browsing using multi-hop network routing featuring layered encryption (the “Onion network”). You can picture it like that trope in action movies where they’re tracing a network intrusion back through multiple server locations scattered all over a world map. (Except that the reverse tracing isn’t a thing and the Onion network’s encryption prevents any meaningful interception.)

The browser can access regular websites as well as hidden Onion sites operated inside the Onion network. Onion sites try to anonymize both the server and the visitor. Onion sites are addressed using cryptographic hashes — long random-looking strings of letters and numbers — instead of domain names and IP addresses. This presents a usability issue as they’re nearly impossible for humans to remember. For example, the “ctrl.blog” domain name is more human-friendly and memorable than an Onion address.

Until now, there hasn’t been a standard method to discover a website’s Onion site from the main website. That changed with the new release of [Tor Browser version 9.5](https://blog.torproject.org/new-release-tor-browser-95/?ref=ctrl.blog "“New Release: Tor Browser 9.5”"). It introduced a new [Onion-Location](https://community.torproject.org/onion-services/advanced/onion-location/?ref=ctrl.blog) HTTP response header. Websites can include this response header and have it include a link to the Onion site. The header should including the Onion site origin, plus the same path and query parameter as the current request.

The Tor Browser will display a “.onion available” button (the purple button seen at the top of the article) in the address field for encrypted websites (HTTPS) that includes the new header. Clicking it will redirect the user to the same webpage on the Onion site. The first time a user encounters this button, they’re also prompted if they want to automatically be redirected to Onion sites when one is available.

The new button is currently only available in Tor Browser for Linux, MacOS, and Windows. It isn’t \[yet\] supported in Tor Browser for Android.

**Update** (2020-11-23): Both [Brave](https://github.com/brave/brave-core/pull/6762?ref=ctrl.blog "“Handle onion-location HTTP header & .onion domain”") for Linux, MacOS, and Windows; and [Onion Browser](https://apps.apple.com/us/app/onion-browser/id519296448?ref=ctrl.blog) for iOS has added support for Onion-Location. Neither browsers are affiliated with the Tor Project, but can connect to the Tor Onion network.

The Tor Project has published documentation on [how to implement an Onion-Location response header](https://community.torproject.org/onion-services/advanced/onion-location/?ref=ctrl.blog) using popular web servers. You can alternatively use a `<meta>` element on webpages if you don’t control the web server. If you’re using the Apache HTTPD Server, you may also want to read my article on [cleaning up the REQUEST\_URI variable for subrequests](https://www.ctrl.blog/entry/httpd-subrequest-variable-inconsistencies/).

I crawled the top 1 million domain names (from the Tranco List) on 2020-06-21 and found 30 websites that issued the `Onion-Location` response header. (You can get the full list of discovered Onion sites below.) Only three websites had opted for using the alternative `<meta>` auto-discovery method, and only one of those also hadn’t configured the HTTP response header. Five websites were served using the Apache HTTPD Server and every one — including the Tor Project website itself – showed signs of problems with their `REQUEST_URI` variable.

Only eight of the sites I discovered during the crawl were listed in the Real World Onion Sites project’s [directory of Onion sites](https://github.com/alecmuffett/real-world-onion-sites/blob/master/README.md?ref=ctrl.blog). Notable websites such as The New York Times, Internet Archive, Facebook, and BBC News don’t yet promote their Onion sites with the `Onion-Location` response header. The feature is three weeks old so this maybe isn’t too surprising. I expect to see adoption grown in the coming months.

The new response header will make it easier to map domain names to their corresponding Onion site. This can help projects like Real World Onion Sites map popular websites on the internet onto the Onion network. Search engines with an Onion site presences — including Cliqz Search and DuckDuckGo — can choose to link directly to the Onion site instead of the regular website for visitors using the Onion network. This improves security and page-load performance. Cliqz Search already does this to a limited extent using the curated directory maintained by Real World Onion Sites. 

#### Sources

- [onion-location-response-header.csv](https://cdn.synaps.media/control/content/files/2026/08/2020-06-21%5Fonion-location-response-header.csv?ref=ctrl.blog) (crawl results), 2020-06-21, Daniel Aleksandersen
- [List ID PX8J](https://tranco-list.eu/list/PX8J/1500000?ref=ctrl.blog), 2020-06-16, Tranco List
- [New Release: Tor Browser 9.5](https://blog.torproject.org/new-release-tor-browser-95/?ref=ctrl.blog), 2020-06-03, Antonela Debiasi, Tor Project Blog, Tor Project
- [Onion-Location](https://community.torproject.org/onion-services/advanced/onion-location/?ref=ctrl.blog), 2020-06-02, Onion Services, Tor Community Documentation, Tor Project
- [master.csv](https://raw.githubusercontent.com/alecmuffett/real-world-onion-sites/8069fdfe8fb16af7571bda0c383526bc5020a336/master.csv?ref=ctrl.blog), commit 8069fdfe8f, 2020-02-04, Real World Onion Sites, Alec Muffett, GitHub
- [Cliqz Search as an Onion Service](https://cliqz.com/en/magazine/cliqz-search-as-an-onion-service?ref=ctrl.blog), 2019-12-05, Cliqz Magazine, Cliqz, Hubert Burda Media
### Genuine Roomba replacement parts vs off-brand clones
URL: https://www.ctrl.blog/entry/roomba-900-replacement-parts/
Last updated: 2026-08-23T22:21:19.000Z
The genuine Roomba 900-series replenishment kit (iRobot Authentic-branded) contains a set of debris collectors, two side-brushes, and three air-filters. These are the consumable parts that regularly need replacing on a Roomba. The kit costs about 50 USD in the USA and 70 USD in Europe and Australia. Off-brand versions of the kit are available on Amazon and AliExpress for around 12 USD.

I’ve bought and tested one set of genuine replacements and two different off-brand sets. The two off-brand sets only had minor visual differences so I’ll discuss them as one throughout this article. I hope they’re representative of the experience you might have with off-brand replenishment kits. There are many off-brand manufacturers and sellers and the quality may vary. It’s impossible to know whether you’ll get the same off-brand replacements parts, though.

When buying off-brand parts, I was mostly worried about the quality of the air filters compared to the genuine ones. The genuine AeroForce High-Efficiency Filter from iRobot sounds impressive and is seemingly meant to be associated with a High-efficiency particulate air (HEPA) filter. The term HEPA filter is mostly meaningless in consumer products as there is no HEPA-filter compliance certification for consumer-grade products. The off-brand filters are often labeled as being HEPA filters. The retail packaging for iRobot’s filters clarifies that their filters are what iRobot creatively calls HEPA-style.

There are newer and more concrete standards meant for consumer products. Strangely enough, neither iRobot nor any of the off-brand manufacturers label their products with any of these standards. With the off-brand filters, you never know what filter media you’ll get. It could potentially be a simple piece of pierced cardboard. You don’t much about the quality of the iRobot filters either, though.

I don’t have the testing equipment or experience to say anything definitive about the quality of either filter. You probably wouldn’t be able to obtain the same off-brand filters even if I were able to test them properly. On the other hand, I don't have any evidence for the performance of the genuine filters, either.

It’s better to periodically replace the filters even if that means using the off-brand filters. Get the genuine filters if you feel more comfortable with them, or if you have allergies. **Don’t** attempt to wash and reuse the filters! You’ll [damage the filter media and reduce their efficiency](https://smartairfilters.com/en/blog/how-to-clean-wash-hepa-filter/?ref=ctrl.blog).

Some resellers are claiming that their Roomba-compatible filters are washable. These claims are probably hogwash. In my research, every product listing for a washable filter also recommended replacing the filter every two–four months. Washable filters must be made of a more permanent filter media — like metal — that won’t be damaged by the cleaning process. I haven’t found any metal filters (sometimes called “permanent filters”) for the Roomba 900-series.

The most noticeable quality difference between the two sets were the debris collectors. These are the two rubber roller-brushes that are used to scoop up larger particles and feed them into the air intake underneath the Roomba. The outer shell (including the rubber tracks) on the off-brand debris collectors are made of a softer rubber compared to the genuine ones. The harder material gives the genuine version a firmer grip that makes them better at scooping debris off the floor. However, the more flexible off-brand rollers don’t meet as much resistance when navigating over doorsteps so they may last longer.

The debris collectors are filled with a rubber foam. The off-brand ones have less of this foam and there’s a small gap between the other rubber shell and the foam. This makes them perceptually louder than the genuine debris collectors. I can definitely hear the difference but it’s not a big problem. You likely run your Roomba when you’re not at home, anyway.

The off-brand side-brushes are slightly less flexible than the genuine version. This could indicate that genuine brushes would last longer. In my experience, the brush-arms on both the genuine and off-brand side-brushes break off after about the same number of weeks. I don’t have any reason to believe there is any performance difference between the different brushes.

The genuine side-brushes come with retentive screws (screws that stay in place when it’s not assembled.) The off-brand ones come with loose screws and you may misplace them in the months you’ll store them in your junk drawer. You can reuse the screw already installed in the Roomba, however.

Overall, I don’t see any strong case for spending the extra money on the genuine iRobot Authentic-branded replacement parts. The differences between the genuine replacement parts and the off-brands are small. You may want to purchase the authentic filters if you want to be sure you get the same level of quality — whatever that may be — every time. Save your money when replacing the other parts.
### Fun with Apache HTTPD and subrequest variable inconsistencies
URL: https://www.ctrl.blog/entry/httpd-subrequest-variable-inconsistencies/
Last updated: 2026-08-23T22:11:46.000Z
The Apache HTTP Server (HTTPD) is extremely configurable and powerful. However, its modules are a collection of disparate and inconsistent tools. In this article, I’d walk you through a recent problem I encountered when I wanted to combine two modules.

This article assumes some basic familiarity with the HyperText Transfer Protocol (HTTP) requests and the HTTPD server configuration syntax.

The problem I wanted to solve: The `REQUEST_URI` variable is supposed to contain the request path as it was supplied in the HTTP request (unless it has been rewritten by `mod_rewrite`). However, it was suffixed with “index.html” in `mod_headers` when requesting a directory (such as /).

Early on I realized that the value in the suffix came from the `DirectoryIndex` directive. When you request a directory, HTTPD tries to fulfill it using an internal subrequest that fetches the file specified in that directive. I understood the underlying problem but not how to retrieve the original `REQUEST_URI` variable.

I tried solving this using `mod_setenvif`. This was the wrong approach, but I want to walk you through it:

```apacheconf
DirectoryIndex /index.html
# check if the requested file exists
<If "-f '%{DOCUMENT_ROOT}%{REQUEST_URI}'">
  # copy the REQUEST_URI variable to PATH
  SetEnvIf REQUEST_URI .* PATH=$0
  Header set Test1 %{REQUEST_URI}e
  Header set Test2 %{PATH}e
</If>
```

When requesting `/`, the `Test1` response header was set to /index.html and `Test2` returned (null). Neither of these was the expected value (/).

A value of null means that the variable hasn’t being set (as opposed to being empty). The code worked as expected when requesting files but fails when requesting directories.

The inconsistencies in how `mod_setenvif` and `mod_headers` handle the `REQUEST_URI` are frustrating. It makes it difficult to use the former module to copy and correct the variable for use with the latter.

If you’re a seasoned HTTPD admin — or an attentive reader — you may have spotted the problem or at least noticed that something is wrong. I’m expecting a response header to appear when requesting directories but the header is gated by a conditional that only acts when the request is a file! But wait — why is the response header being sent at all?

There’s a lot of different moving parts here. I’ve actually explained what’s gone wrong already, but I’ll walk you through it step by step.

First of all, the conditional block isn’t met for the initial request. It’s for a directory so no headers are added. However, to fulfill the request, HTTPD issues a subrequest to request the `DirectoryIndex` file. This subrequest fulfills the requirement for running the conditional block and the headers are appended to the subrequest. The headers are attached to the response to the initial request.

So, why are the two test headers different, though? The second paragraph in the [mod\_setenvif documentation](https://httpd.apache.org/docs/2.4/mod/mod%5Fsetenvif.html?ref=ctrl.blog) has the answer:

> “When the server looks up a path via an internal subrequest such as looking for a DirectoryIndex or generating a directory listing with mod\_autoindex, per-request environment variables are not inherited in the subrequest. Additionally, SetEnvIf directives are not separately evaluated in the subrequest due to the API phases mod\_setenvif takes action in.”

Knowing all of this, we can construct a better workaround to achieve the desired goal. The three differences from the above code example are marked in blue.

```apacheconf
DirectoryIndex /index.html
# check if the requested file or directory exists
<If "-e '%{DOCUMENT_ROOT}%{REQUEST_URI}'">
  # copy the REQUEST_URI variable to PATH
  SetEnvIf REQUEST_URI .* PATH=$0
  # set header only if the variable PATH is set
  Header set Test1 %{REQUEST_URI}e ENV=PATH
  Header set Test2 %{PATH}e ENV=PATH
</If>
```

This time around when requesting `/` we get different responses. The `Test1` response header still responds with /index.html. The `Test2` response header is now / as desired!

So, what is different this time around? The conditional is run for both the initial request (for the directory) and the subrequest for the `DirectoryIndex` file. The `PATH` variable is set correctly for the initial request, and it isn’t overwritten by the subrequest because the `PATH` variable isn’t being set there. `SetEnvIf`’s conditional (`REQUEST_URI`) is null so the subrequest won’t overwrite the value set for the initial request.

I said I wanted the `REQUEST_URI` variable without the index.html suffix. However, the above code example still include it when explicitly requesting `/index.html`. You can remove it from the variable in this situation using regular expressions (RegEx). Replace the `SetEnvIf` line from the above code example with the following (or adjust to your `DirectoryIndex` directive as needed):

```apacheconf
SetEnvIf REQUEST_URI ^(.*?)(index\.html)?$ PATH=$1
```

There are many types of subrequests, though. You’ll be running into the same problem again if you’re setting custom error pages with the `ErrorDocument` directive. The `REQUEST_URI` variable will disclose the location of the error document. You can work around this error specifically by checking the request status code before sending the response header.

The following example combines the above method (checking to see if the variable is empty) and a check to see if the request was successful (that it generated a `HTTP 200 OK` successfully responses):

```apacheconf
Header set Test2 %{PATH}e "expr=%{REQUEST_STATUS} == 200 && -n %{ENV:PATH}"
```

These aren’t the only cases where you could run into subrequests overwriting variables. It should be the most common ones, however. You must read HTTPD module documentation top-to-bottom and read all the associated documentation. All the information you’ll need is \[most often\] there. It can be a pain to configure it sometimes because it doesn’t behave as you think it does. All the inconsistencies between modules make it hard to apply things you’ve learned about one module on another.

#### Sources

- Apache HTTPD version 2.4.43
- [Apache Core Features](https://httpd.apache.org/docs/2.4/mod/core.html?ref=ctrl.blog), version 2.4, 2020-04-01, HTTP Server Documentation, Apache Foundation
- [Apache Headers module](https://httpd.apache.org/docs/2.4/mod/mod%5Fheaders.html?ref=ctrl.blog), version 2.4, 2020-04-01, HTTP Server Documentation, Apache Foundation
- [Apache SetEnvIf module](https://httpd.apache.org/docs/2.4/mod/mod%5Fsetenvif.html?ref=ctrl.blog), version 2.4, 2020-04-01, HTTP Server Documentation, Apache Foundation
### How to block web browser-based localhost port-scans
URL: https://www.ctrl.blog/entry/block-localhost-port-scans/
Last updated: 2026-08-23T22:02:23.000Z
News surfaced last month about 30 000 websites — including eBay and many banks — performing port-scanning on localhost (the local device) when you visit their sites. The scans tried to determines what services are running on the local system. It has been [speculated](https://nullsweep.com/why-is-this-website-port-scanning-me/?ref=ctrl.blog) that this data is in turn used to detect signs of malware-infections and device-fingerprinting.

This topic pops up in the tech news every two years or so but no one is proposing solutions. Here’s how you can block localhost port scans in Firefox (and why it won’t work in other web browsers).

It’s common for many types of software to run an IP\-based service on the local device. This can be anything from a remote-access program to media libraries and services for communicating with video-conferencing services and web-based software update systems.

Windows 10 has over a dozen services listening on the localhost by default. Other operating systems aren’t far behind. Any type of software you install could be adding additional services without your knowledge. Vendors aren’t always good at securing these services properly.

A recent example where this went wrong is a security flaw that gave access to the webcam on MacOS through an [unsecured web server installed by Zoom](https://www.theverge.com/2019/7/9/20688113/zoom-apple-mac-patch-vulnerability-emergency-fix-web-server-remove?ref=ctrl.blog).

It’s important to note here that web browsers treat localhost addresses differently from other origins (domains and IP addresses). It’s treated as “[a potentially trustworthy origin](https://www.w3.org/TR/2016/CR-secure-contexts-20160915/?ref=ctrl.blog#is-origin-trustworthy)”. Webpages can freely communicate with services listening on it unless those services take steps to block access. It’s difficult for them to do anything about port-scanning, though. It’ll respond differently from a non-existing service, which can be determined from timing how long the request takes to fulfill.

The best protection against something like this is process isolation techniques like running your web browser in a virtual machine, or switching to a more security-constrained operating system like [Qubes OS](https://www.qubes-os.org/?ref=ctrl.blog). These tools are resource-intensive and inconvenient to use, however.

The method I’ve devised relies on a Proxy Auto-Configuration (PAC) file that instructs the web browser to forward all requests addressed to localhost into a null-point instead. Specifically, all connections addressed at localhost are proxied to a non-existing proxy server on port 9\. This port is dedicated to discarding unwanted traffic (as specified by the Discard Protocol).

This method will only work in web browsers that allow you to configure program-specific proxy rules. That leaves you with Firefox and [its derivatives](https://www.ctrl.blog/entry/four-firefox-derivatives/), and Konqueror. Chromium-based and WebKit-based browsers are unsupported as they rely on the operating system’s proxy settings.

You **must not apply this PAC file** to your entire operating system. That will cause havoc and break many programs and functionality in unique and interesting ways. Only use it in a web browser you don’t want to have access to any services listening on the localhost. You can use a secondary web browser if you need access to services running on the localhost.

What follows is a copy of a PAC file that does the desired blocking and the instructions for how to configure Firefox to use it.

1. Save the following PAC to a file on your device. It must be saved with a `.js` file extension.

```javascript
// SPDX-License-Identifier: CC0-1.0

const allowed_ports = [
  // uncomment and list any exceptions:
  // 80, 3000, …
];

// CIDR 0/8 and 127/8
const local_cidrs =
  /^(?:127(?:\.(?:\d{1,})){1,3}|0+(?:\.0+){0,3})$/;

// other notations for 0/8 and 127/8
const localhosts = [
  'localhost',
  '::',
  '::1',
  '0x00.0',
  '0177.1',
  '0x7f.1'
];

function FindProxyForURL(url, host)
{
  // check if localhost
  if (localhosts.includes(host) ||
      host.match(local_cidrs)) {

    // make exceptions for allowed ports
    let port = url.match(/^\w+:\/\/[^/]+?:(\d+)\//);
    if (port) {
      port = parseInt(port[1]);

      if (allowed_ports.includes(port)) {
        return 'DIRECT';
      }
    }

    // reject by proxying to local discard
    return 'PROXY 127.0.0.1:9';
  }

  // all other requests are allowed
  return 'DIRECT';
}
```

1. Drag that file into Firefox. Write down the contents of the address field. (file://…)
2. Type `about:config` into the address field and press Enter.
3. Search for network.proxy..
4. Locate and apply the following changes to the configuration:
- Set `network.proxy.allow_hijacking_localhost` to `true`.
- Set `network.proxy.autoconfig_url` to the address you noted in step 2.
- Set `network.proxy.type` to `2`.

—and you’re done! Any new connections will be filtered through the PAC file. You don’t need to restart Firefox.

The above PAC file includes a couple of other addresses and notations that should cover quite a few cases. This PAC file still leaves one avenue of attack open, however. DNS domain names can be resolved to point at a localhost address. This has not been observed in any of the recent localhost port-scanning incidents, however.

You can protect against that type of address by resolving the domain name and testing against its destination. Applying this protection will introduce a significant performance penalty of 10–500 milliseconds per URL (even to the same host) that is loaded in your web browser. Firefox’s PAC parser doesn’t use Firefox’s DNS cache so the slow-down even applies to URLs under the same host. An average webpage loads 75 URLs, according to the April 2020 numbers from the HTTP Archive.

If you consider that an acceptable performance penalty for the additional protection given, you can modify the above host checking to include the following conditional:

```javascript
isInNet(host, '127.0.0.1', '255.0.0.0')
```

Browsers won’t relax their default security protections for any addresses other than `::1` and `127.0.0.1`. I included a few different notations — and the common “`localhost`” hostname — as a preemptive measure in case someone clever discovers a way around it in the future.

I’d like to close with a note for the history books. The Microsoft Edge web browser — the old EdgeHTML version — used to block all access to localhost by default. You could turn off the blocking but it would warn you that doing so would make your device less secure. The new Edge built on Chromium no longer blocks webpages from accessing localhost.

Maybe all web browsers should block access to localhost by default? It’s incredibly difficult for people to protect their devices against port-scanning or more targeted attacks that communicate directly with local services. Installing a magical incantation of a PAC-file isn’t an adequate solution for the masses.

Oh, and you shouldn’t install random PAC files you find on the web! Read up below to learn more about them and to understand how the above PAC file works!

#### Sources

- [eBay is port scanning visitors to their website — and they aren’t the only ones](https://blog.nem.ec/2020/05/24/ebay-port-scanning/?ref=ctrl.blog), 2020-05-24, Dan Nemec, Blog
- [Why is This Website Port Scanning me?](https://nullsweep.com/why-is-this-website-port-scanning-me/?ref=ctrl.blog), 2020-05-19, Charlie Belmer, Null Sweep
- [Proxy Auto-Configuration (PAC) file](https://developer.mozilla.org/en-US/docs/Web/HTTP/Proxy%5Fservers%5Fand%5Ftunneling/Proxy%5FAuto-Configuration%5FPAC%5Ffile?ref=ctrl.blog), revision 1595333, 2019-12-12, Developer Network, Mozilla
- [Secure Contexts](https://www.w3.org/TR/2016/CR-secure-contexts-20160915/?ref=ctrl.blog#is-origin-trustworthy), 2016-09-15, Candidate Recommendation, World Wide Web Consortium (W3C)
- [Common PAC File Issues](https://web.archive.org/web/20121212033253/https://findproxyforurl.com/common-pac-issues/), 2012-12-03, Peter Hayes, FindProxyForURL.com
### Embed XMP sidecars into image files with embed_xmp
URL: https://www.ctrl.blog/entry/embed-xmp/
Last updated: 2026-08-23T22:05:49.000Z
I wanted a program to inject Extensible Metadata Platform (XMP) sidecar (stand-alone) files into an image file. Image metadata is most [useful when embedded into image files](https://www.ctrl.blog/entry/embedded-image-metadata/) after all. I was surprised to learn that options for XMP editors were thin on the ground. I had to create a new program to get the job done.

Two existing programs come to mind: [Exiv2](https://github.com/Exiv2/exiv2?ref=ctrl.blog) and [ExifTool](https://exiftool.org/?ref=ctrl.blog). Both tools interpret the sidecar file and write the recognize metadata back into the image files using their own distinct set of rules. This would be fine except when you want to include metadata from namespaces/vocabularies they don’t recognize or want to make sure the resulting metadata takes up as little space as possible.

Exiv2 writes XMP in a compacted form that isn’t compatible with the underlying RDF standard, the XMP standard, and isn’t supported by any popular image viewers or operating systems. ExifTool, on the other hand, produces overly verbose XMP markup that takes up more space than necessary. It can be configured to compact it somewhat and reduce optional whitespace. At my request, the author of ExifTool added even more options for compacting it further.

Both of these tools also have a few different image format-specific bugs and they don’t support all of the formats I need (including WebP and SVG).

I wanted a program that takes an XMP sidecar file without processing it and injects it as-is into the right place inside of image files. A third program called `webpmux` does exactly this. However, it only works for WebP images.

So, I wrote a new program called `embed_xmp` to fulfill this need. It’s available as a Ruby gem/library and as a command-line interface (CLI). (Sorry if you were expecting a graphical user interface!) It supports writing XMP sidecars into JPEG, PNG, SVG, and WebP image files.

It’s not quite what I explained above, though. It doesn’t inject XMP data verbatim. It will wrap the XMP data in an `xpacket` XML processing instruction, as recommended by the [XMP specification](https://web.archive.org/web/20171102122904/https://wwwimages2.adobe.com/content/dam/acom/en/devnet/xmp/pdfs/XMP%20SDK%20Release%20cc-2016-08/XMPSpecificationPart3.pdf). This ensures the broadest client-compatibility. It also doesn’t preserve XML whitespace (unless overwritten by an `xml:space` instruction in the XMP file). Whitespace can bulk the file size more than it does in other contexts because XMP data isn’t compressed when embedded into files. Image files are [usually not recompressed](https://www.ctrl.blog/entry/favicon-compression/) when served through a web server either.

The program won’t make other changes to the image file unless where required by the image format. The most substantial change is that basic WebP images are upgraded to the WebP Extended File Format (WEFF) when needed. WEFF may not render in legacy browsers. The [WebP container specification](https://developers.google.com/speed/webp/docs/riff%5Fcontainer?ref=ctrl.blog) only supports embedding XMP data into WEFF files.

You’ll need another program to author the XMP sidecar files — such as Corel AfterShot Pro, Adobe Photoshop or Lightroom, or Photo Mechanic — and can then use `embed_xmp` to insert that sidecar into an image file. You’ll probably want to use `embed_xmp` with some sort of content management system that holds image metadata, though.

You can install the `embed_xmp` CLI and library using [RubyGems](https://guides.rubygems.org/rubygems-basics/?ref=ctrl.blog#installing-gems). You’ll need to install Ruby and RubyGems first, and then run the following command to download and install the latest version of `embed_xmp`:

```shell
gem install embed_xmp
```

The CLI tool requires three positional arguments:

```shell
embed_xmp sidecar.xmp input.png output.png
```

The file extension of the input file is used to determine the image format. The name of the output file is unimportant, but it will be output in the same format as the input image. No image format conversions will take place. The sidecar file must be in valid XML and it must not be wrapped in an `xpacket` XML processing instruction. There are no sanity-checks or format-validation.

The Ruby library has a few more options. The short and sweet usage instructions are as follows:

```ruby
require "embed_xmp"

input_file = "/example.png"
# ::PNG, ::JPEG, ::SVG, or ::WebP
embedder = EmbedXMP::PNG.new(input_file)

sidecar_file = "/example.xmp"
# can also be supplied as a string
embedder.join_sidecar(sidecar_file)

output_file = "/example-xmp.png"
embedder.write(output_file)
```

You can find some more detailed usage in the [documentation on RubyDoc](https://www.rubydoc.info/gems/embed%5Fxmp?ref=ctrl.blog). (You also installed a local copy of the documentation along with the gem.) Although not the intended use, it also includes methods for removing XMP data from image files.

The XMP specification requires that you ensure that legacy/other metadata formats — e.g. native metadata fields — are updated to be aligned with the XMP metadata. `embed_xmp` doesn’t do that. (It’s not aware of the contents of the metadata you want to insert.) You must ensure that you either update or remove conflicting metadata in other formats.

[![Get gem on RubyGems](https://cdn.synaps.media/control/content/images/2026/08/get-rubygems.svg)](https://rubygems.org/gems/embed%5Fxmp?ref=ctrl.blog)[![Get source on Codeberg](https://cdn.synaps.media/control/content/images/2026/08/get-codeberg-source.svg)](https://codeberg.org/da/embed%5Fxmp?ref=ctrl.blog) 

The gem is licensed under a BSD 3-Clause license. I’m evaluating [distributed alternatives to GitHub](https://www.ctrl.blog/entry/git-p2p-compared/) and didn’t want to upload any more repositories there. I’ll update this article with links to the source code once I decide on something.

**Update** (2020-09-02): I’ve now uploaded the source repository and opened an issue tracker for this project on Codeberg.
### Google Authenticator enables device-transfers, but no export options
URL: https://www.ctrl.blog/entry/google-authenticator-2fa-secrets/
Last updated: 2026-08-23T22:08:48.000Z
You’ve probably seen calls to “secure your account” with a second-factor authentication (2FA) app all over the web. Online services promote it as a way to improve the security of your online account. After you’ve enabled 2FA, you need to know your username and password as well as a one-time use token (a four–six digit code) generated by your 2FA app.

When you enable 2FA with an online service, it “installs” a secret into your 2FA app — often by scanning a QR\-variety matrix barcode. The client app can then generate a one-time use login token derived from the shared secret. You type in that token when you log in to the service. The service can generate its own token following the same process and compare the two login tokens. If a bad actor intercepts the token, it can only be used once and will be worthless in the future.

The default option most places that implement some form of 2FA is Google Authenticator (GA). Or rather, websites will often instruct you specifically to use the GA app. GA uses two open standards — [RFC-4226](https://www.rfc-editor.org/rfc/rfc4226.html?ref=ctrl.blog) and [RFC-6238](https://www.rfc-editor.org/rfc/rfc6238.html?ref=ctrl.blog) — to derive a single-use log-in token from that shared secret. You can use any app compatible with those standards, but many websites won’t even mention compatibility with anything but GA.

What happens if you lose your 2FA secrets, though? After enabling 2FA, you’ve committed to storing a secret code indefinitely. You’re only storing it inside an app on your phone. Phones get lost, stolen, or replaced every so often, though.

There isn’t a universal answer to this question. Some services will let you remove your 2FA device and let you log in with just your username and password. This approach makes using 2FA completely meaningless. Other services require you to jump through a few hoops and inconveniences before you can remove the 2FA requirement from your account. This approach is less secure than a stricter 2FA policy. It opens the door for someone to social-engineer their way into your account. Other services still will simply not let you log-in anymore if you lose access to your 2FA device. Many won’t let you remove your 2FA device from your account even if you still have access to it!

To make matters worse, it’s often difficult or even impossible to figure out a company’s 2FA policies. In my experience, it’s rarely documented. In my experience, contacting support seldom produces any more detailed insight into the policies and capabilities of their 2FA implementation.

The Google Authenticator app hasn’t had any way to backup, export, or transfer your shared-secrets out of the app. Your 2FA secrets have been bound to a single device. If you’re technically minded, you might have known that you could back up the shared secret by storing copies of the setup matrix barcodes. They contain the shared secret, after all, and can be read by any compatible app.

However, most people won’t realize they need to back up or export their 2FA secrets until after they’ve lost or intend to replace the device they use for 2FA. You may not even remember which online services are protected by 2FA secrets stored on a device after you’ve lost it. You’ll need to keep your old 2FA device around for some time in case you’ll need it to generate a new code for an old login somewhere.

I’ve recommended against enabling 2FA and the Google Authenticator (GA) app in the past. However, there has recently been some positive development in this space. Last week, Google [announced](https://security.googleblog.com/2020/05/introducing-portability-of-google.html?ref=ctrl.blog "“Introducing portability of Google Authenticator 2SV codes across Android devices”") that version 5.2 of GA would introduce device-transfers of 2FA secrets.

The new update lets you export your 2FA secrets to a QR-variety matrix barcode that you can scan with the GA app installed on another phone. The export format is entirely undocumented, but I reverse engineered the data in the QR-code and determined it contains a URL-encoded base64-encoded protobuf with all your data.

In my opinion, this proprietary hodgepodge doesn’t meet the General Data Protection Regulation (GDPR) Right to data portability (Article 20) requirement. It states that data portability must be enabled in a structured, commonly used, and machine-readable format. Google tends to [flout this requirement](https://www.ctrl.blog/entry/google-podcasts-data-portability/), however.

In any case, you now have at least one option for transferring your 2FA secrets as long as you don’t lose your old device before you get a new one. You can’t take a screenshot the QR code in the app to make a simple back up of it. I’m unsure how Google failed to account for phones being stolen, damaged by water, crushed in a door, lost under the bed for 8 months, or had anything else unexpected happen to it.

The GA app’s new solution isn’t perfect but it’s way better than nothing at all! The burden and responsibility to backing up are still placed on unsuspecting users. Users that don’t even get any training or even information about it. You will need to have been burned by this once before you learn of the need to maintain backups.

People don’t have the knowledge required to securely store their 2FA backups. The task poses the same challenges as when [backing up your password manager](https://www.ctrl.blog/entry/password-manager-backup/). The exported data are high-value at-risk digital files. You can’t store your 2FA secrets in your regular password manager either. That would defeat the purpose of having a second authentication factor.

In the technology security industry, there’s often talk about the trade-off between security and convenience. 2FA is difficult to use. I recommend against using 2FA — not only the Google Authenticator app – *unless* you take the time to learn about the technology and can ensure you back up your 2FA secrets. This is inconvenient and it’s difficult and time-consuming to do.
### P2P apps’ connection amnesia makes them less fault-tolerant
URL: https://www.ctrl.blog/entry/cache-p2p-connections/
Last updated: 2026-08-23T22:02:56.000Z
Peer-to-peer (P2P) applications discover peer devices either using a centralized tracking server (e.g. Syncthing, Dat, BitTorrent) or a “server-less” distributed hash table (DHT). Server-less solutions like DHT are never truly serverless, though. I’ve [previously discussed](https://www.ctrl.blog/entry/dweb-readiness-runet/) how DHT clients are overly reliant on centralized bootstrapping/introduction servers and how that acts as a single-point-of-failure.

In that earlier article, I argued that DHT-clients should cache their DHT peers between sessions. Those peers aren’t guaranteed to be online the next time your client tries to join the network. However, P2P clients typically make hundreds of connections to the DHT swarm.

This method would reduce clients’ reliance on bootstrapping servers and help maintain the network in the event of an intentional or unintentional service outage. As a bonus, it could speed up the process of rejoining the DHT swarm.

P2P clients that frequently communicate with the same peers in a topic swarm — e.g. for social networks, chat, and file syncing apps — are also needlessly dependent on the peer discovery systems. E.g. your laptop shouldn’t need to rediscover how to connect to your home-PC every time it wants to sync folders between them over Syncthing. P2P apps can simply cache the discovered peer connection information for peers it frequently communicates with.

Don’t get me wrong: peer discovery systems and their bootstrapping servers are needed to facilitate the initial introductions and connections across the internet. However, there’s no need for P2P clients to rediscover the same known peers every time you start the app.

The cached connection information can go stale over time as devices roam between networks. Most operating systems also rotate their IPv6 addresses daily for privacy reasons. It’s enough that one of the peers that want to communicate with another knows the other peer’s current connection details. As a bonus, caching peer connection information can speed up peer reconnects between sessions.

I’ve looked into this aspect of a dozen P2P apps that regularly communicate with the same peers; including Syncthing, Jami (formerly GNU Ring), Resilio Sync (formerly BitTorrent Sync), Dat, Technitium Mesh, RetroShare, [git helpers](https://www.ctrl.blog/entry/git-p2p-compared/), and others. Only Resilio Sync and RetroShare cache peer connection information between sessions. I’ve raised [a proposal for Syncthing](https://github.com/syncthing/syncthing/issues/6524?ref=ctrl.blog) to implement this too.

I find it particularly noteworthy that Resilio Sync has implemented peer connection caching. Resilio Sync was formerly developed under the name BitTorrent Sync by BitTorrent Inc before it was spun out as a separate company. It has developed P2P software since 2004 and their engineers should know a thing or two about operating peer discovery services and building redundancy into distributed networks.

Out of the above list, Resilio Sync is also the only proprietary client. It has a paid subscription service. The software must work to the greatest extent possible, even during a service outage, or the company will lose paying customers. Caching peer connection details is a simple way to make P2P apps more robust. At least for clients that frequently communicate with the same peers.

Developers of P2P applications like file sync, chat, and gossip networks already know that each peer is likely to communicate with the same peers from session to session. It’s a no-brainer to decide to implement peer connection caching. However, these use cases also exist in more general-purpose P2P applications like Dat, Hypercore, IPFS, and BitTorrent. Apps can analyze connection patterns and make decisions to cache certain peers that the client frequently exchanges data with.
### Make native lazy-loading images load more eagerly
URL: https://www.ctrl.blog/entry/eager-lazy-loading/
Last updated: 2026-08-23T22:05:30.000Z
Firefox recently joined Chrome and added support for [native lazy-loading images](https://www.ctrl.blog/entry/lazy-loading-viewports/) (NLLI). NLLI delays loading images until they’re needed to speed up page load times, and reduce the data needed to display just what’s immediately needed to display a page.

In an earlier article (the above link), I discussed how Safari and Firefox are too lazy (images load only as they become visible) and Chrome is too eager (images load way too early). I explained how lazy loading was implemented in browsers using the `IntersectionObserver` API, and how the `rootMargin` variable controlled the “eagerness”. In the context of lazy loading images, eagerness is the metric used to discuss when an out-of-view image is loaded.

There isn’t much to do about Chrome’s over-eagerness without abandoning NLLI entirely. It loads images thousands of pixels out of view; potentially wasting device resources and slowing down page load times. However, you can easily make Safari and Firefox a bit more eager so visitors won’t see empty areas as empty areas that should hold images are scrolled into view.

Before I go any further on this topic, I first want to urge you to ensure a better image loading experience for everyone by making good use of [progressive JPEG images](https://www.ctrl.blog/entry/jpeg-progressive-loading/). Progressive JPEGs can display a partial image early on and fill in higher quality details as it’s being downloaded. This will probably make a bigger difference to more of your visitors than the topic in this article.

Modern image formats don’t support progressive loading. You may be using more modern formats like WebP, but a huge percentage of the web still uses JPEG for most images. Safari doesn’t support WebP so JPEG is still king at least among people using Apple’s browser.

But let me get back on track with lazy loading images. You can enforce a minimum preloading distance by setting up an `IntersectionObserver` with the desired `rootMargin` eagerness. The `rootMargin` specifies an element’s distance from the visible viewport before its downloaded.

I recommend using a `rootMargin` of about one–two viewport heights (`vh`). That’s the height the visible part of the webpage; or the content part of your browser excluding the chrome. The `rootMargin` property only supports pixel values, however. You can copy this value from the `window.innerHeight` property.

The following code is a complete implementation that can be used to enhance native lazy-loading images. It won’t override the browser’s default NLLI `rootMargin`, but it will help ensure a minimum eagerness.

```javascript
// SPDX-License-Identifier: CC0-1.0

if ("IntersectionObserver" in window)
{
  // get all the lazy images
  var lazy_imgs = document.querySelectorAll('img[loading="lazy"]');

  if (lazy_imgs.length > 0)
  {

    function intersection_handler(observed_imgs, observer)
    {
      observed_imgs.forEach (
        (ev) => {
          // image rootMargin is intersecting the viewport
          if (ev.isIntersecting)
          {
            // remove the observer
            observer.unobserve(ev.target);

            // image hasn’t loaded yet so load it now
            if (ev.target && !ev.target.complete)
            {
              ev.target.loading = "eager";
            }
          }
        }
      );
    }

    // calculate the desired rootMargins
    var rootVertical   = parseInt(window.innerHeight * 1.5);
    var rootHorizontal = parseInt(window.innerWidth * 1.5);

    let intersection_handler = {
      root: null,
      rootMargin: `${rootVertical}px ${rootHorizontal}px`,
      threshold: 0.0
    }

    // create the observer
    let observer = new IntersectionObserver(
      intersection_handler,
      C
    );
  
    // attach observer to images
    for (var img of lazy_imgs)
    {
      observer.observe(img);
    }
  }
}
```
### Everything you need to know about Night mode in Samsung Internet
URL: https://www.ctrl.blog/entry/samsung-internet-night-mode/
Last updated: 2026-08-23T22:21:40.000Z
As a web developer, you may be familiar with the `prefer-color-scheme` Cascading Style Sheet (CSS) media query. It allows web developers to create separate stylesheets for light and dark color schemas. Web browsers apply one of these color schemes usually following the operating system’s color scheme preference.

Samsung Internet is the default web browser on devices from the world’s largest smartphone manufacturer and the third most popular mobile browser after Google Chrome and Apple Safari. Unlike the other two, it *doesn’t* support the standard `prefer-color-scheme` CSS media query. However, it does have its own take on dark mode called “night mode”, however. In night mode, introduced in Samsung Internet version 6.2, the browser applies a set of color filters to webpages, bitmap images, and scalable vector graphics (SVG).

Samsung has not published any information on how night mode works in its browser. This article is based on an analysis of the source code of Samsung Internet version 11\. It may not be completely accurate because the relevant code is quite complex and difficult to follow. In this article, I’ll discuss how night mode works for different types of content and what issues it can cause.

Please disable night/dark and high-contrast mode in your web browser before reading this article. This article will discuss Samsung Internet’s color filters in detail and the illustrations may be rendered incorrectly when night mode is enabled.

The following illustration shows a side-by-side comparison of how colors are rendered in the default day mode, in night mode, and an SVG image rendered in night mode. Notice how the colors in the SVG version are considerably brighter instead of darker as one would expect.

![Rainbow flag in different color rendering modes.](https://cdn.synaps.media/control/content/images/2026/08/samsung-internet-color-rendernig-of-night-modes.png)

From the left: bitmap image in day colors, the same image in night colors, and the same image as an SVG in night colors.

The color filters are applied just before rendering. The original colors remain in APIs like `getComputedStyle`; setting Samsung Internet apart from Microsoft Edge handling of high-contrast mode. This also makes it difficult to detect when the browser is interfering with the original page design.

### HTML content

Night mode will apply color filters to either darken colors or invert their luminance. Different color filters are applied to different types of HTML elements. The color filter is applied using the following process:

An element’s colors are converted from red, green, and blue (RGB) colors to luminance, blue chroma, red chroma (Y′CbCr) color space (using a standard ITU-R BT.601 conversion). RGB is the most common color space used for digital media and Y′CbCr is normally used for film and television. Y′CbCr has the advantage that the luminance (Y) is separated into its own channel instead of being encoded as a component of the color value. When a color’s luminance is below 85 %, the following filter is applied:

```javascript
m = invert ? 1 - y : y
y = min_y + (m * (max_y - min_y))
```

The three variables (`invert`, `min_y`, and `max_y`) are set dependent on which element is being color adjusted. These variables constrain the luminance to a given range. The following table contains the allowed contrast ranges for different elements, and it is copied from Samsung Internet version 11\. A luminance closer to 1 produce brighter colors (more light) and numbers closer to 0 produce darker colors (less light). Invert inverts the luminance.

| Component                      | Min Y                         | Max Y | Invert             | Description             |
| ------------------------------ | ----------------------------- | ----- | ------------------ | ----------------------- |
| ROOT\_​BACKGROUND              | 0,03                          | 0,08  | No                 | html element background |
| BACKGROUND                     | 0,03                          | 0,12  | any CSS background |                         |
| BUTTON\_​BACKGROUND            | 0,15                          | 0,29  | button background  |                         |
| TEXTFIELD\_​BACKGROUND         | textarea and input background |       |                    |                         |
| MENULIST\_​BACKGROUND          | select drop-down background   |       |                    |                         |
| MENULIST\_​BUTTON\_​BACKGROUND | select background             |       |                    |                         |
| MENULIST\_​BUTTON\_​ARROW      | 0,20                          | 0,70  | Yes                | select background       |
| GRADIENT\_​FILL                | 0,02                          | 0,12  | No                 | css gradient colors     |
| BORDER                         | 0,27                          | 0,33  | css borders        |                         |
| OUTLINE                        | 0,14                          | 0,20  | focus outlines     |                         |
| BOX\_​SHADOW                   | 0,28                          | 0,33  | css box-shadow     |                         |
| SVG\_​PAINT                    | 0,30                          | 0,30  | svg images         |                         |
| TEXT                           | 0,29                          | 1,00  | Yes                | text content            |
| CURSOR                         | input cursors                 |       |                    |                         |
| IMAGE                          | 0,70                          | 0,70  | No                 | image                   |
| BORDER\_​IMAGE                 | 0,50                          | 0,50  | image borders      |                         |

This luminance filter produces the effect seen in the middle section of the above illustration comparing three renderings of a rainbow flag.

The luminance ranges defined in the above table may seem arbitrary. Because they clearly are. There is no reason why night mode should use these particular ranges or why it doesn’t use the same luminance adjustment to the entire page. Using the same luminance adjustment to the whole page would produce more predictable results.

The color changes can produce okay or strange result depending on the original color scheme. Vox.com’s black on bright yellow brand color becomes white on a dirty brown and CNN.com’s white on red becomes black on light salmon pink.

Samsung Internet uses the same implementation, but with different luminance ranges, to implement its high-contrast mode. High-contrast modes is a whole subject onto itself and I won’t tackle it in this article.

### Bitmap images

Samsung Internet has an image classifier that tries to determine whether to invert the lightness of photos. The classifier decides that images that are photo-realistic (has mostly colored pixels), has 40+ % white pixels, or has a 10+ % of high lightness pixels shouldn’t be inverted. This would mean that black icons with transparent backgrounds should be inverted while a photo of a forest would not. The following illustration shows the same black-icon against a white background in day mode and night mode. You can see that the icon isn’t being inverted.

![](https://cdn.synaps.media/control/content/images/2026/08/samsung-internet-coil-logo-comparison.png)

A side-by-side comparison of the Coil.com logo set against a white background in day mode and night mode. Coil logo Day/Night mode by [Daniel Aleksandersen](https://www.daniel.priv.no/?ref=ctrl.blog) licensed under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/?ref=ctrl.blog).

I haven’t been able to identify any images that get inverted lightness even when not doing so causes detrimental effects to contrast ratios. Night mode can hurt the usability and accessibility of webpages that depend on dark icons on white backgrounds.

There aren’t any good workaround that web developers can use to correct this situation. Samsung Internet doesn’t support the `prefer-color-scheme` CSS media query nor does it have an API that can be used to detect night mode adjustments. The only fixes involve modifying the image and making sure there’s a white border or that the image would stand out against any background. This isn’t always desirable, however.

I’ll go through the lightness inversion process anyway as it will be coming up again in the next section. Colors are converted from RGB to hue, saturation, and lightness (HSL) color space. Note that lightness isn’t the same thing as Y′CbCr’s luminance component. The lightness is then inverted (`L = 1.0 - L`) resulting in darker colors becoming lighter and lighter colors becoming darker. This results in black becoming white and vice-versa, however. To restore white and black colors, a complicated contrast-adjustment is used. The effect is approximately the same as blending the color with up to 20 % black or white, depending on the distance from the center of the color’s lightness.

To clarify: the filtering process described in the previous section doesn’t appear to be used. Instead, bitmap images have their brightness uniformly reduced by about 30 %. It’s understandable as inverting the lightness channel of a portrait photo could produce … disastrous results.

### SVG images

Here’s a quick refresher on SVG images before we dig into this topic: SVG images are Extensible Markup Languag (XML) documents with different shapes (like rectangles, circles, etc.) and paths described as positioned objects with styling applied to them. Unlike a bitmap image, the individual objects the image consists of remains. You can target and animate or change the color of different parts of an SVG image.

The same color filtering that is used on bitmap images should have been used for SVG images. That’s what they appear to have done as well. However, they didn’t abandon the idea of the HSL lightness inversion for SVG images. I’ll let these examples of day and night renderings of some SVG images speak for themselves:

![A grid of SVg illustrations rendered in Samsung Internet’s night mode compaerd to their originals.](https://cdn.synaps.media/control/content/images/2026/08/samsung-internet-night-mode-svg-rendering-issues.png)

Samsung Internet SVG Rendering by [Daniel Aleksandersen](https://www.daniel.priv.no/?ref=ctrl.blog) licensed under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/?ref=ctrl.blog).

Let’s first look at why some white areas are made black while others remain white. Here’s some pseudo-code where I’ve attempted to summarize the logic behind which SVG objects are lightness inverted and which aren’t:

```javascript
function IsBackgroundSVG(shape) {
  return (shape == "rect" ||
          shape == "ellipse")
}

IsForegroundSVG(shape_name) {
  return (shape == "path")
}

LightnessInvertSVGColor(shape_name) {
  if (IsBackgroundSVG(shape_name))
  {  return !IsColorDark(color) }
  else if (IsForegroundSVG(shape_name))
  { return !IsColorWhite(color) }
}
```

Any object that is either a rectangle or an ellipse object (somehow not including squares and circles) are background objects. Any object that is a path object is a foreground object. There is, of course, no such distinction between what is a foreground and what is a background object in the SVG specification.

This is a completely arbitrary distinction made by Samsung Internet. You can, of course, have rectangles and squares in the foreground and paths in the background. The only way to tell if an object is in the background or foreground is to look at its position on the Z-axis. The distinction shouldn’t matter anyway, though.

The white circle in the syndication feed icon (top left in the above illustration) is an ellipse object — a background object by Samsung’s definition — and it’s not a dark color. The object gets inverted which turning the circle black. The other white objects in the same image are white paths. Paths are, by Samsung’s definition, are foreground objects and shouldn’t be inverted when the have a light color.

All the pastel colors are the result of the HSL lightness inversion and blending described in the previous section. The orange, yellow, and blue colors in the rainbow remain unchanged (their lightness is ≈50 %) whereas the others end up as pastel colors. Once you see these terrible results, it becomes clear why this filter isn’t used on bitmap images. However, it does leave the question: why is it used on SVG images?

This section shouldn’t make sense to you. It’s complete nonsense. I don’t know why Samsung went with this weird color filter. I can make an educated guess that Samsung tried to fix the contrast issue that I described in the previous section. SVG images are frequently used for icons and other UI elements. However, it’s also frequently used for illustration and the implementation creates its own set of contrast issues.

As a web developer, you can convert your ellipses and rectangles into paths or vice versa to avoid having objects inverted. You can also choose colors with an HSL lightness closer to 50 % to minimize the effect. Ultimately, this is something Samsung needs to fix in its web browser.

### Videos and canvas

These page element’s aren’t color filtered. It would presumably be too processor intensive and costly in terms of device battery life.

### Conclusions

For end-users: Dark mode is cool and all. Samsung’s automatic-dark-mode as applied-to-any-design breaks some webpages, reduces contrast, and hurts accessibility. Maybe turn off night mode on Samsung Internet. At least for now.

For web developers: I’d not normally recommend this. However, there’s no way you can detect the use of night mode and deploy any countermeasures. It breaks fundamental assumptions about color on the web platform. if you rely heavily on SVG or have dark images with transparent background on white backgrounds; you can detect `SamsungBrowser` in the User-Agent and encourage people to switch to another web browser.

For Samsung Internet developers: Please rethink your night mode feature. You can’t arbitrarily invert some page elements and not others. Maybe add support for `prefer-color-scheme` instead?.

#### Sources

- Samsung Open Source Download ID #8722 (unlinkable).
### Four P2P distribution tools for Git repositories compared
URL: https://www.ctrl.blog/entry/git-p2p-compared/
Last updated: 2026-08-23T22:08:20.000Z
Git is a version control system that is decentralized by design. Anyone can run `git daemon` in a repository to start a Git server. You can also host your repository using a regular web server and HTTP infrastructure. More commonly, though, repositories are distributed through centralized hub services like BitBucket, GitHub, and GitLab. It’s quick, easy, and free to “throw your code up on GitHub” and call it a day. However, there is also a growing number of peer-to-peer (P2P) distributed options to consider as well.

What if you could distribute your Git repository using the BitTorrent P2P protocol without the need for a central server? Without having to depend on a commercial business’ hosting-generosity and infrastructure. That’s the idea behind GitTorrent, an experimental Git helper and overlay protocol for transferring Git repositories over the popular P2P protocol.

GitTorrent does away with the idea of a central code distribution server. Instead, it relies on the people who’re using and participating in the project to contribute bandwidth and handle its distribution.

Similar concepts have popped up around other peer-to-peer protocols including Dat Protocol and IPFS. Each implementation has made different implementation choices and ended up with systems that appear similar at first glance but have fundamentally different trade-offs and priorities. In this article, I’ll explore these differences in-depth and do a comprehensive comparison.

I’ll kick off with the following comparison table with some key features and limitations. There’s a lot to digest in it and I’ll discuss each item in turn below the table.

__Comparison table of P2P Git clients__
| Feature                                                       | Client                                                           |                                                                        |                                                                               |               |
| ------------------------------------------------------------- | ---------------------------------------------------------------- | ---------------------------------------------------------------------- | ----------------------------------------------------------------------------- | ------------- |
| [GitTorrent](https://github.com/cjb/GitTorrent?ref=ctrl.blog) | [HyperGit](https://github.com/hackergrrl/hypergit?ref=ctrl.blog) | [igis-remote](https://github.com/dhappy/git-remote-ipfs?ref=ctrl.blog) | [ipld-remote](https://github.com/ipfs-shipyard/git-remote-ipld?ref=ctrl.blog) |               |
| Protocol                                                      | [BitTorrent](https://www.bittorrent.org/?ref=ctrl.blog)          | [Dat](https://www.datprotocol.com/?ref=ctrl.blog)                      | [IPFS](https://ipfs.tech/?ref=ctrl.blog)                                      |               |
| git-remote                                                    | gittorrent:                                                      | hypergit:                                                              | ipns:                                                                         | ipld:         |
| Project activity                                              | Inactive (2015)                                                  | Inactive (2018)                                                        | Active (2020)                                                                 | Active (2019) |
| Runtime                                                       | Node.js                                                          | Go                                                                     |                                                                               |               |
| Peer discovery                                                | DHT (not bootstrapped)                                           | Tracking server, mDNS-SD                                               | DHT, mDNS-SD                                                                  |               |
| Repo. updates                                                 | Git server, side-channel, DHT                                    | Peer swarm                                                             | IPNS                                                                          | Side-channel  |
| Repo mutability                                               | Mutable                                                          | Immutable                                                              |                                                                               |               |
| Packing strategy                                              | On-demand packing                                                | Unpacked                                                               |                                                                               |               |
| Data de-duplication                                           | None, compressed                                                 | None, un-compressed                                                    | Global, un-compressed                                                         |               |
| File size limit                                               | RAM                                                              | No inherent limits.                                                    | 2 MB                                                                          |               |
| Data loss                                                     | Of course not.                                                   | Your repository is deleted when IPFS runs GC.                          |                                                                               |               |
| Hash algorithm                                                | SHA-1                                                            | Ed25519                                                                | SHA-256                                                                       | SHA-1/SHA-256 |

I’ll start by discussing the status of each project and then move on to discuss how they do things differently.

### Project activity

GitTorrent saw a burst of development in 2015 by the project seems to have been abandoned by its creator by the beginning of 2016. You’ll notably start out with several security and deprecation warnings if you try to install and run it. It requires some tweaks to dependencies and its code to work with today’s version of the Node.js runtime.

HyperGit similar saw an initial burst of development in 2018 and also appears to have been abandoned. It also requires some fixes minor fixes to install on a recent version of Node.js. HyperGit seems to be the least polished option of the ones discussed in this article.

IPFS/IPLD has seen steady development since 2017. The IPFS/IGIS fork came along in 2020 and addressed many of the limitations of the IPFS/IPLD implementation. Both IPFS implementations are excruciatingly slow to process pushes even though they take place locally on your computer.

### Peer discovery

GitTorrent uses an implementation of the BitTorrent mainline distributed hash table (DHT) to discover others who’re sharing the repository you want to download. Instead of querying a peer database on a centralized server, you query the other participants in the DHT to discover which peers host the Git repository you’re interested in.

To connect to the DHT you need to go through what is known as a bootstrap/introduction server. GitTorrent’s bootstrap server has been *offline since 2017.* I’ve discussed previously how DHT can be [made more resilient](https://www.ctrl.blog/entry/dweb-readiness-runet/). You can configure a different mainline DHT-compatible bootstrap server. However, other people using GitTorrent must also manually configure a bootstrap server on the same DHT. This makes it harder to adopt GitTorrent in a project.

HyperGit relies on the Dat Protocol project’s tracking server. A tracking server is a centralized database server that fulfills the same function as a DHT. It keeps track of which clients have which repositories and answers queries from other clients. As evidenced by GitTorrent’s bootstrapping server being offline, the tracking server is a single-point-of-failure in otherwise distributed systems. I’ve recorded over 21 outages of the Dat Protocol’s tracking server in 2018 and 2019.

IPFS also uses DHT. Its DHT bootstrapping process could benefit from increased resilience the same way the others can. Notably, HyperGit and GitTorrent use the DHT to discover a Git repository — and then query the peers it discovers for who has which parts or “chunks”, of the repository. IPFS, on the other hand, uses a DHT for every single data chunk globally. This design is part of the project’s goal of global data de-duplication (more on that later).

However, IPFS architecture creates an enormous overhead of DHT traffic compared to the other protocols. It also fails to benefit from the assumed knowledge that peers who have one chunk of the repository you’re interested in are likely to also have more chunks you’re interested in.

Lastly, Dat and IPFS can discover peers on the immediate local network (LAN) through Multicast DNS Service Discovery (mDNS-SD). This process — also known as zero-configuration networking (Zeroconf), or Apple Bonjour or Rendezvous — can be useful in office settings where everyone interested in the Git repository is connected to the same local network. It’s not as relevant or useful in these times of remote work, however.

### Updates and mutability

Dat archives — as used by HyperGit — are append-only file systems. An archive’s creator holds a special private cryptographic key that allows them to append new data to the end of the archive. They can add new files and new revisions of existing files to it, but can’t remove or change an old version from the file system log. Everything is versioned.

Peers in the network announce to each other what’s the newest version they’ve got of an archive. At the same time, they query the network to discover even newer versions.

On the other hand, “archives” on BitTorrent — as used by GitTorrent — and IPFS are immutable. You normally can’t make changes to a “torrent” transfer or an IPFS file ones it has been created. Both protocols use a file’s cryptographic hash as its network address. Change the file and you change its hash.

GitTorrent solved this by building mutable torrents on top of [BEP-44: Storing arbitrary data in the DHT](https://www.bittorrent.org/beps/bep%5F0044.html?ref=ctrl.blog). This “arbitrary data” is signed with the same cryptographic key as the main torrent. To push updates, the private key-holder pushes the hash of the newest commit to the DHT.

Clients initially download the full Git repository as of the time the torrent was created. Clients can then query the DHT to find the latest commit. They can then query other peers for the commits between the latest version they already have and the latest commit it found in the DHT. I’ll discuss this a bit more in the next section.

The IPFS project has an experimental side-project called the InterPlanetary Name Service (IPNS) address. It’s like the Domain Name System (DNS) but stored in the DHT. Like DNS, IPNS can translate one address to another type of address. In the case of IPNS, it turns one mutable hash into an immutable hash. You can also use something called DNSLink to piggyback on the same type of look-up using DNS instead of IPNS.

IPNS has been plagued by unreliability and poor performance since its inception. I’d recommend you use DNSLink instead of IPNS with IPFS. Remember, DNS is designed to be decentralized through features like [secondary authoritative servers](https://www.ctrl.blog/entry/secondary-dns-comparison/) and caching recursive revolvers.

Your IPNS address or your DNSLink-enabled domain name would resolve to the IPFS hash of the repository’s newest commit. The IPFS/IGIS implementation support doing this automatically for IPNS on Git pushes. The IPFS/IPLD implementation requires you to update your IPNS or DNSLink manually or communicate updates through another side-channel.

### Packing strategy and data de-duplication

Git normally packs individual object files (commits) into packed single-file objects. These are deflate-compressed on disk to de-duplicate repeated data within the same pack and shrink their file size. This greatly reduces the disk storage requirement of your Git repository. Git may need to repack these pack files when commits are orphaned (e.g. from a dropped branch), or to improve packing-efficiency.

You don’t want to make changes to existing data in a distributed file system over time, though. Needlessly changing data that everyone already has a copy of requires them to redownload the same data within a slightly different packaging. The data payload of a Git commit is supposed to be immutable (unchangeable). This is where an unpacked Git repository comes into play.

You can simply choose to not use object packing within your repository. An unpacked repository stores each commit in a set of separate files rather than being packed all neatly into one compressed file. That might sound like a trivial difference. However, the Git software project repository (as of commit 07d8ea56f2) is 118 MB packed and 2,8 GB unpacked. That’s **a massive 2273 % increase** in the amount of data people will need to download to retrieve a copy of the Git project repository.

IPFS objects are content-addressable and immutable. You can’t modify a file without changing its IPFS address. IPFS’ whole deal, however, is global de-duplication of content-addressable data. Two IPFS nodes that add the exact same file would end up with the same content-address for it. This also means that — assuming the Git repository is unpacked — each individual Git object is de-duplicated globally.

Global data de-duplication, in relation to peer-to-peer distribution, is most interesting with regards to forked repositories. An upstart project that forks off from an established project will share commit history (and hosting) with its parent repository for eternity. The more people that are interested in the same content chunks, the greater its availability and longevity in the IPFS network. Every project gains increased availability in the network by having more shared data chunks.

IPFS pinning service can help increase the availability of your Git repository. However, they’re likely to [overcharge for duplicated chunks](https://www.ctrl.blog/entry/ipfs-pin-storage-accounting/).

BitTorrent and Dat, on the other hand, are entirely focused around the model of a “torrent” or “Dat archive”. Data is only exchanged around one of these objects and it never crosses over. BitTorrent has a [vaguely defined standard](https://www.bittorrent.org/beps/bep%5F0038.html?ref=ctrl.blog) for leaching chunks off another somehow-related torrent that the downloader is assumed to maybe have previously downloaded. This isn’t implemented in many clients and it’s not found in GitTorrent either.

However, GitTorrent is smarter than your average BitTorrent client. It can request that peers pack and transfer a set of Git objects it needs. For example, if the last commit it has is commit `aaaa` and that the newest commit is `dddd`, it can request that a peer packs all the commits between those two commits. The sender will need to spend extra processing time on assembling and compressing a pack for each receiver. However, this approach significantly reduces the disk I/O and network overhead involved in sending loads of tiny files. This is similar to how a “Git smart” web server works.

HyperGit is built on top of HyperDB — an append-only database — and Dat. Existing database entries are immutable. HyperGit stores Git objects directly in the database unpacked. Although the Git objects are “packed” into a single database file, it can’t take advantage of compression. The database itself is also immutable. Like with the IPFS implementations, you end up with the same file size bloating effecting both transfer sizes and increased storage requirements.

### Data loss

P2P can be great for distributing redundant copies of your repositories. Anyone interested in it will, at least temporarily, also participate in hosting and distributing it. Every project collaborator will, at least intermittently, participate in its distribution and has a complete backup copy of the project in its entirety.

However, the IPFS options come with a huge caveat. An IPFS node will cache and distribute all data that passes through it. This can consume a lot of local storage capacity. IPFS nodes use a [garbage collector](https://www.ctrl.blog/entry/ipfs-repo-cache-gc/) to clean out ephemeral cached data from the local IPFS repository to free up disk space as needed. The garbage collector will delete every object from the repository that hasn’t been “pinned”.

Both the IPLD and IGIS implementation pins Git objects when you initialize or push to an IPFS–Git repository. However, neither pin the root directory of the repository! The root directory is the collection of files that together make up the repository. You don’t lose your data per se, as the Git objects are safe. However, you do lose the primary object that holds it all together. This is also the hash you’d share directly with other contributors for them to pull complete copies of your repository. You might be able to retrieve a copy of the repository root directory from another contributor who hasn’t run the garbage collector.

### File size limit

WebTorrent, which GitTorrent is based upon, stores files in memory. Individual files you download through GitTorrent can’t exceed your available memory capacity.

That might sound bad, but the [InterPlanetary Linked Data](https://ipld.io/?ref=ctrl.blog) (IPLD), a mapping layer between Git’s object hashes and the corresponding IPFS objects, is *limited to just under 2 MB.* This should be fine for smaller projects as long as you don’t refactor the entire project in one go or add large art or other binary assets to the repository.

Neither HyperGit or IGIS has any inherent file size limits. HyperGit can randomly produce error messages saying something about 8 MB being the maximum. This is a temporary problem in the underlying Dat implementation and not is only tangentially related to your Git repository. Git itself can become slow when dealing with large files, however.

### Hash algorithm

The BitTorrent protocol uses SHA-1 to identify and locate file transfers. SHA-1 has been deprecated for years, however. It’s considered a weak hashing signature at best. It has even been demonstrated that it’s possible to produce a controlled hash collision; an identical hash from different input data.

[BitTorrent protocol version 2](https://www.bittorrent.org/beps/bep%5F0052.html?ref=ctrl.blog) migrates the protocol to SHA-256\. It’s 264 times less likely to get a hash collision with SHA-256\. Version 2 has been on the book for years, but there haven’t been many implementations. GitTorrent, being based on the [WebTorrent](https://webtorrent.io/?ref=ctrl.blog) project, uses a WebRTC-variant of protocol version 1.

Git also uses SHA-1 internally to reference commits. However, it’s also possible to sign commits with a [GPG](https://git-scm.com/book/en/v2/Git-Tools-Signing-Your-Work?ref=ctrl.blog "“Git Tools - Signing Your Work”") to shore up security.

IPFS’ sister-project, [InterPlanetary Linked Data](https://ipld.io/?ref=ctrl.blog) (IPLD), is a mapping layer between Git’s object hashes and the corresponding IPFS object (SHA-256) for the same data. To replace a Git commit, you’d need to create a collision for both the SHA-1 Git object and the corresponding IPFS object. The InterPlanetary Git Service (IGIS) implementation doesn’t bother with the IPLD translation layer and relies on SHA-256 exclusively.

### Conclusions

Peer-to-peer Git hosting may sound appealing to some. At least, it sounded very appealing to me! However, many of the current implementations sound less appealing after digging deeper into the subject.

I don’t think anyone should use any of the P2P options unless they’re committed to also working to improve the tools. It’s too complicated to get started and they’re hard to understand enough to confidently deploy using them. You don’t want your project’s distribution method to be so complicated that it becomes an unreasonable burden to its adoption.

GitTorrent seems to have made the best implementation of a P2P overlay for Git. Unlike the other options, it doesn’t have a huge storage and transfer-size overhead from relying on unpacked Git repositories. However, it can’t be used out-of-the-box and it would require some work to resolve security issues and update its dependencies.

### Bonus: Decentralized options

So, maybe the distributed options for Git isn’t quite there yet. However, you can also consider using a decentralized option instead. Instead of relying on a network of peers, decentralized options rely on one or more servers.

If you just don’t want to host your next project on GitHub; host it on your web server. It’s quick and easy to do and it helps increase the diversity in the Git hosting ecosystem.

There are more decentralized options available than there are P2P options. It’s easier to implement a decentralized option as one or more centralized servers that take care of a lot of the complexity you’d introduce to use a P2P implementation. The two most notable options are Git itself and Secure Scuttlebutt (SSB).

__Comparison table of decentralized Git clients__
| Client                   | [git](https://git-scm.com/?ref=ctrl.blog) (+ any web server) | git-ssb            |                    |
| ------------------------ | ------------------------------------------------------------ | ------------------ | ------------------ |
| Protocol                 | Git, HTTPS                                                   | HTTPS              | Secure Scuttlebutt |
| git-remote               | git:, git+https:                                             | https: (“dumb”)    | git-ssb:           |
| Status                   | Active (2020)                                                |                    |                    |
| Packing strategy         | On-demand packing                                            | Packed or Unpacked | Unpacked           |
| File size limit strategy | Unlimited                                                    | 5 MB (soft)        |                    |

#### Sources

- [git-remote-igis repository](https://github.com/dhappy/git-remote-ipfs/tree/53f6ecd2e57b074e784c60c5d4b9100757e65b00?ref=ctrl.blog), version 53f6ecd2e5, 2020-05-02, Will Holcomb, git-remote-igis project, GitHub
- [Host a Git-style repo](https://web.archive.org/web/20200806071330/https://docs.ipfs.io/how-to/host-git-style-repo/), 2020-03-16, Documentation, IPFS
- [git-remote-ipld repository](https://github.com/ipfs-shipyard/git-remote-ipld/tree/501d5f2ce93dddd1ea92a7745eac0baa8f274f33?ref=ctrl.blog), version 501d5f2ce9, 2019-05-14, Łukasz Magiera, git-remote-ipld project, GitHub
- [How Dat Works](https://dat-ecosystem-archive.github.io/how-dat-works/?ref=ctrl.blog), 2019-01, Duncan Keall, Dat Protocol project, GitHub
- [Large files with Git: LFS and git-annex](https://lwn.net/Articles/774125/?ref=ctrl.blog), 2018-12-11, Antoine Beaupré, LWN, Eklektix
- [HyperGit repository](https://github.com/hackergrrl/hypergit/tree/36a0cf757d598d19782b0170330c0298ee355449?ref=ctrl.blog), version 36a0cf757d, 2018-11-08, Kira Oakley, HyperGit project, GitHub
- [BEP-52: The BitTorrent Protocol Specification v2](https://www.bittorrent.org/beps/bep%5F0052.html?ref=ctrl.blog), 2017-08-17, Bram Cohen, BitTorrent Enhancement Proposals, BitTorrent
- [BEP-44: Storing arbitrary data in the DHT](https://www.bittorrent.org/beps/bep%5F0044.html?ref=ctrl.blog), 2017-02-01, Arvid Norberg and Steven Siloti, BitTorrent Enhancement Proposals, BitTorrent
- [GitTorrent repository](https://github.com/cjb/GitTorrent/tree/7b25402100059692b7161f05a8a23e872bf1f3dc?ref=ctrl.blog), version 7b25402100, 2015-09-25, Chris Ball, GitTorrent project, GitHub
- [Announcing GitTorrent: A Decentralized GitHub](https://blog.printf.net/articles/2015/05/29/announcing-gittorrent-a-decentralized-github/?ref=ctrl.blog), 2015-05-29, Chris Ball, Blog
- [Git Objects](https://git-scm.com/book/en/v2/Git-Internals-Git-Objects?ref=ctrl.blog), 2014, Scott Chacon and Ben Straub, Git Internals, Pro Git: 2nd Edition, Apress
- [Packfiles](https://git-scm.com/book/en/v2/Git-Internals-Packfiles?ref=ctrl.blog), 2014, Scott Chacon and Ben Straub, Git Internals, Pro Git: 2nd Edition, Apress
- [Transfer Protocols](https://git-scm.com/book/en/v2/Git-Internals-Transfer-Protocols?ref=ctrl.blog), 2014, Scott Chacon and Ben Straub, Git Internals, Pro Git: 2nd Edition, Apress
### How I recovered a lost email from my email client’s memory
URL: https://www.ctrl.blog/entry/restore-lost-email-from-ram/
Last updated: 2026-08-23T22:17:04.000Z
I’ve previously written about how I [recovered an unsaved document over the dbus service](https://www.ctrl.blog/entry/how-to-recover-gedit-documents/) from the GNOME Text Editor (GEdit) after the desktop shell session had crashed. Here’s a similar and exciting tale from the exciting world of desktop email applications!

Evolution, the GNOME’ desktop project’s email and personal information management client, has a bad data loss bug. It sometimes deletes the email body text in the compose window after changing the signature using the signature presets menu from the. I don’t know the exact steps to reproduce it but it has bitten me about twice a month for the last two years. The contents of the email is simply deleted and you’re left with an empty message except for the new signature.

To make matters worse, the Undo history is cleared so I can’t press Ctrl + Z to restore the draft. I’ve learned to avoid it by changing the signature before I start to write a reply. Sometimes I forget and then it’s data loss bingo-time! Either I’ll lose the email or it’ll function properly. I’ve never lost more than a paragraph or two.

A few days ago I lost a long email that had taken me half an hour to compose. I remained completely calm and didn’t walk away from my computer in frustration. (Not.) I might have been able to partially recover the message from the Draft folder if I’d retained my cool and acted immediately. It had been overwritten by an empty message instead. I must look into versioning my email draft folder at a later time.

All hope wasn’t lost, however. To quote a beloved paleontology fantasy film: “It’s a Unix-system! I know this! It has all the files for the whole park. It tells you everything! I’ve gotta find the right file.”

This time around, I hadn’t closed Evolution or the compose window after the bug revealed its ugly face. A complete copy of my email could remain in memory. My computer has 32 GB of RAM and going through all of it blindly is both technically challenging and time-consuming.

Linux maintains a map of a process’ memory allocations in `/proc/$pid/maps`, where `$pid` is the process identifier/number of the running process. There are multiple tools available for retrieving the chunks of memory corresponding to these addresses and saving them to a regular file.

I settled on a combination of pidof (installed as part of `procps-ng`) for identifying the process number, and gcore (installed as part of `gdb`, the GNU Debugging Toolsuite) for reading the process’ memory to a file. Here’s the final command I used:

```shell
gcore $(pidof name-of-running-process)
```

This produced a huge 4 GB binary memory dump file. Comments about how memory hungry modern desktop applications are aside; this is still a lot of data to go through. There are specialized tools you can use to analyze this data blob. However, I settled on using the nano text editor. It’s “comfortable” working with massive files and doesn’t choke when you use it to read reading binary data. I knew that the data I was interested in would be stored in UTF-8 so a text editor should be able to recognize it.

Searching through this huge file took a long while. There’s just a lot of data to churn through. I initially thought that searching for unique words would be the best approach. The first dozen matches I found were data related to the spell-checker. However, I changed my mind and search for partial sentence fragments I could remember instead. This new approach would miss out on any quoted-printable (RFC 2045) representation of the message but would give fewer fragmented matches.

Using this method, I was able to identify and retrieve a plain text copy of the complete email. The copy I retrieved from RAM notably had the new signature I’d selected when the email contents disappeared from the editing window.

I’m glad I managed to recover the email this time. However, I should probably set aside some time to migrate to another email client. Evolution is great! I’ve run into multiple issues with the email composer window in particular. An email client isn’t really useful when I can’t reliably use it to write emails.

The feature image at the top of the article is an artistic interpenetration of a corrupted email. When the bug mentioned in this article ([bug #905](https://gitlab.gnome.org/GNOME/evolution/-/issues/905?ref=ctrl.blog)) happens, the contents of the editor window is simply removed. A blank window doesn’t make for an interesting image, however.
### New font with Unicode-compatible Creative Commons license symbols
URL: https://www.ctrl.blog/entry/creative-commons-unicode-fallback-font/
Last updated: 2026-08-23T22:04:09.000Z
Version 13 of the Unicode Standard — the World’s leading standard for digitalization of characters, symbols, and emoji — [was announced](http://blog.unicode.org/2020/03/announcing-unicode-standard-version-130.html?ref=ctrl.blog "“Announcing The Unicode Standard, Version 13.0”") in early March 2020. The addition of the Creative Commons (CC) license symbols caught my interest among the 5390 new characters added in version 13.

Creative Commons is a set of permissive free-culture licenses that are meant to encourage sharing. Think of it as the open-source code for creative works. Read the [Creative Commons License Primer](https://creativecommons.org/licenses/?ref=ctrl.blog) if you’re unfamiliar with their licenses. The different CC licenses are associated with symbols that represent what rights the license restricts. For example, the 🄏 non-commercial symbol is used to represent licenses that restrict commercial exploitation.

The below table shows the new licensing symbols that were introduced in Unicode 13\. The first one is technically the mathematical “circled equals” symbol that has been part of Unicode Standard for years. However, it was given a secondary meaning applicable for use with Creative Commons in Unicode 13.

| Character | Rendering | CC meaning         |
| --------- | --------- | ------------------ |
| U+0229C   | ⊜         | No derivatives     |
| U+1F16D   | 🅭        | Creative Commons   |
| U+1F16E   | 🅮        | Public Domain      |
| U+1F16F   | 🅯        | Attribution        |
| U+1F10D   | 🄍        | No rights reserved |
| U+1F10E   | 🄎        | Share-alike        |
| U+1F10F   | 🄏        | Non-commercial     |

I was excited to use these symbols on my websites. However, no system fonts — font files pre-installed with operating systems — support these new characters yet. Even if some system fonts added these characters today, the updated versions won’t reach visitors’ devices until a couple of years from now.

You may be screaming “webfonts” at the top of your voice by this point, and you wouldn’t be wrong. That’s how your web browser \[hopefully\] is rendering the above symbols. However, I prefer using locally installed fonts whenever possible. Webfonts are large blocks of data that waste bandwidth and are slow to render on low-end devices.

I don’t even use the symbols on every page. Only some articles on this website contain [Creative Commons licensed materials](https://www.ctrl.blog/about/license.html). Luckily, the Cascading Style Sheet (CSS) standard has a good solution for adding a fallback font for specific characters. This solution is supported in all modern mobile and desktop web browsers.

Modern web browsers won’t download fonts it won’t need. The CSS `font-family` attribute can contain a comma-separated list of font files. Web browsers will pick fonts from left to right in the list until it finds one that is already installed or that it knows how to download. More importantly, this process is repeated for individual characters that are missing in the preferred font. The browser will check local fonts for the characters and fallback to download the font with the newer Unicode characters on demand.

I created a minimal webfont that only contains the copyright symbol and the new CC license symbols (eight in total). The copyright symbol (a circled letter C) is frequently used in conjunction with license information. It’s visually similar to the circled CC license symbols. I thought it would be visually pleasing with a matching set of symbols.

You can [download CC Symbols](https://cdn.synaps.media/control/content/files/2026/08/2020-04-19%5Fcc-symbols.zip?ref=ctrl.blog), my Unicode-compatible Creative Commons Symbols font. The download contains the font in WOFF2 format 1,9 KiB, and WOFF format 3,8 KiB for older web browsers. For context: the SVG version — a vector file format so comparable to the symbol information stored in a font — of just the 🅭 circled CC symbol downloaded from the CC website is 2,4 KiB.

The download also contains an installable TrueType font (TTF) and the FontForge source file (SFD) for those who want to modify the font. These last two aren’t suitable for use on the web. You should be able to use the new symbols in any Unicode-compatible application after installing the font on your computer.

The symbols in the font a based on the Unicode Standard reference symbols. I waive all copyright to the font and release it into the 🅮 public domain.

This font is a good example of the compression innovations that went into WOFF2\. You can provide both fonts as an option, as shown in the code example below, and newer browsers will download the smaller WOFF2 file. Older browsers will need to download double the amount of data for the WOFF version.

To incorporate this fallback font on a website, you’ll need to define a `font-face` and apply it to an element on your page, e.g. the `body` element. You’ll then be able to use the characters anywhere on the page. The following example defines a `font-face` called “CCSymbols”, instructs the browser where to download the font files (the `src` property), and what characters are included in the font (the `unicode-range` property).

```css
@font-face {
  font-display: swap;
  font-family: CCSymbols;
  font-synthesis: none;
  src: url(CCSymbols.woff2) format(woff2),
       url(CCSymbols.woff)  format(woff);
  unicode-range: u+a9, u+229c,
                 u+1f10d-1f10f,
                 u+1f16d-1f16f;
}

body {
  font-family: Helvetica,
               Arial,
               sans-serif,
               CCSymbols;
}
```

Browsers will prefer rendering the characters from the named font, followed by any local [sans-serif font](https://www.ctrl.blog/entry/font-stack-text/), and then download the CCSymbols webfont as a last resort for these characters. The font will only be downloaded if any copyright symbol or CC license symbol is found in the document. You can move the CCSymbols font to the front of the list if you want to use the visually-consistent copyright symbol found in the font. Other characters will be rendered from the next option in your font list.

Other existing fonts also incorporate the Creative Commons license symbols. There is even one provided on the CC website and another as part of the Font Awesome icon collection. Neither of these fonts uses the new Unicode 13 character codes and thus won’t render them correctly. These older fonts instead use font-specific private area codes in Unicode that means the characters aren’t interoperable with other Unicode Standard compliant fonts.

The circled CC symbol is a trademark of Creative Commons. As far as I’ve been able to establish, this is the first time that a trademarked symbol has been included in the Unicode Standard.

#### Sources

- [Unicode Standard Now Includes CC License Symbols](https://creativecommons.org/2020/03/18/the-unicode-standard-now-includes-cc-license-symbols/?ref=ctrl.blog), 2020-03-18, Eric Steuer, Blog, Creative Commons
- [Announcing The Unicode Standard Version 13.0](http://blog.unicode.org/2020/03/announcing-unicode-standard-version-130.html?ref=ctrl.blog), 2020-03-10, Blog, Unicode Inc.
- [CSS Fonts Module Level 3](https://www.w3.org/TR/2018/REC-css-fonts-3-20180920/?ref=ctrl.blog), 2018-09-20, W3C Recommendation, World Wide Web Consortium (W3C)
### Disable processor boost mode to prolong your battery life
URL: https://www.ctrl.blog/entry/laptop-boost-mode-battery/
Last updated: 2026-08-23T22:12:49.000Z
Lithium-ion batteries have a limited life-span and naturally deteriorate over time. They’ll only last a limited number of charge–discharge cycles. They don’t like being fully charged or discharged and they don’t like heat. Yet, they’re crammed into small compartments with poor cooling inside our electronics.

Processor performance boost modes (“boost mode”), like Intel Turbo Boost or AMD Core Turbo, are designed to temporarily let the processor consume more energy in exchange for a temporary increase in processing speed. It’s intended to finish short bursts of above-average workloads quickly.

However, boost mode also drains the battery quicker and can bring up the device temperature. In small contained devices with poor heat exchange (like most laptops), this will spin up the fans but the temperature will also raise. A rise in processor temperature will also lead to increased temperatures in other components including the battery.

You can prolong how long your battery will remain usable by lowering its temperature. Lithium-ion batteries ideally shouldn’t exceed room-temperature and will irreversibly [deteriorate faster in higher temperatures](https://www.ncbi.nlm.nih.gov/pmc/articles/PMC4526891/?ref=ctrl.blog).

You can get a temperature snapshot reading off a MacBook’s battery with the [Coconut Battery](https://www.coconut-flavour.com/coconutbattery/?ref=ctrl.blog) app. There are similar manufacturer- and model-specific apps available for some Windows PCs. You’ll need to do some research to find one that’s compatible with your computer.

However, you can safely assume that your battery temperature will be high if your processor is running hot. My Lenovo Yoga 3 Pro laptop had powerful hardware in a poorly ventilated chassis. The heat is *probably* what [killed the battery in just three years](https://www.ctrl.blog/entry/rereview-lenovo-yoga3-pro/).

Most people are \[probably\] happy with the default performance trade-offs made by their computer manufacturer. You do have choices, however. You can disable boost mode and sacrifices some peak performance in exchange for a cooler laptop and prolonged battery life.

You can safely disable processor performance boost mode on your device unless you’re a gamer or regularly execute long-lived CPU-bound workloads. (You know who you are.) In other words, disabling boost mode could be beneficial to most people who want to prolong their laptop’s battery life.

Mac users can disable boost mode by installing [Turbo Boost Switcher](http://tbswitcher.rugarciap.com/?ref=ctrl.blog). The app adds a boost mode toggle button to the top menu bar. The app is free, but will display a pop-up when your computer starts unless you pay for the upgraded version.

There are similar manufacturer- and model-specific apps available for some Windows devices. I haven’t found one I’d recommend to others. However, Windows comes with built-in power options for disabling boost mode on both Intel and AMD processors.

The boost mode options are not visible by default in Windows’ power settings dialog. I don’t know why these options are hidden by default. Microsoft and Intel probably believes it’s what’s best for most customers, but it would be nice to have the option regardless. You can easily make the boost mode power options visible again, though.

1. Press the Windows key + X, right-click on either Command Prompt or PowerShell, and choose run as administrator.
2. Type in the following command (in one line), and press Enter afterward.

```shell
powercfg.exe -attributes sub_processor perfboostmode -attrib_hide
```

After you’ve made the settings visible, you can find the new option in the Advanced Power Options dialog. Here’s how to find that dialog in the depths of Windows’ many different power setting dialogs:

1. Press the Windows key, type “Edit power plan”, and open the app with the same name.
2. Click on Change advanced power settings.
3. Select Processor power management: Processor performance boost mode.
4. Change the option to Disabled.

![Advanced processor performance boost mode options dialog.](https://cdn.synaps.media/control/content/images/2026/08/windows-power-options-processor-performance-boost-mode-options.png)

You don’t need to reboot your computer, the change is applied immediately. You can re-enable the option again from the same dialog if you feel your laptop gets too slow afterward.

Alternatively, you can change the power settings directly from the console. The relevant commands and their meaning is documented in the [Windows power and performance tuning guide](https://learn.microsoft.com/en-us/windows-server/administration/performance-tuning/hardware/power/power-performance-tuning?ref=ctrl.blog#processor-performance-boost-mode).

Many other factors can affect device temperatures. Poor ventilation is a primary cause of hot laptops. You can improve the ventilation by [applying floor protectors](https://www.ctrl.blog/entry/how-to-laptop-air-cooling-pads/) to the bottom of your laptop to create more clearing between it and the table.

Software and firmware bugs can drive up the temperature. Be sure to always keep your devices up to date and troubleshoot unexpected persistent raises in temperature. For example, my MacBook Pro got stuck in processor boost mode, which caused it to [run hot all the time](https://www.ctrl.blog/entry/macbook-late2013-hot-smc/), after installing a MacOS beta release.

The temperature change you’ll see by disabling boost mode will vary based on your environment, hardware, and usage pattern. My MacBook Pro dropped the average battery temperature from 41℃ to 32℃ after disabling boost mode. It also runs quieter and the battery last about 30 % longer on a charge.

Lastly, Linux users can turn-off processor boost mode with the below command. To make it the default; apply the change as shown in the command with `systemd-tmpfile` or run the command at boot time with `cron`. (No, seriously. There’s no good way to store persistent configuration changes to sysfs.)

```shell
echo "0" > /sys/devices/system/cpu/cpufreq/boost
```

#### Sources

- [Power and performance tuning](https://learn.microsoft.com/en-us/windows-server/administration/performance-tuning/hardware/power/power-performance-tuning?ref=ctrl.blog), 2017-10-16, Performance tuning guidelines for Windows Server 2016, Windows Server Docs, Microsoft
- [Processor boosting control](https://www.kernel.org/doc/Documentation/cpu-freq/boost.txt?ref=ctrl.blog), 2017-04-12, Documentation, Linux Kernel
- [Effect of Temperature on the Aging rate of Lithium Ion Battery Operating above Room Temperature](https://www.ncbi.nlm.nih.gov/pmc/articles/PMC4526891/?ref=ctrl.blog), 2015-07-06, Feng Leng; Cher Ming Tan; and Michael Pecht, Scientific Reports, Nature, U.S. National Center for Biotechnology Information
### What keyboard form factor is ergonomically right for you
URL: https://www.ctrl.blog/entry/keyboard-form-factor-guide/
Last updated: 2026-08-23T22:12:30.000Z
How do you decide which keyboard form factor (full-size, tenkeyless, 60 %, etc.) is right for you? For many, the decision comes down to price and how much desk space they have. However, you should make sure you get a keyboard that won’t cause you pain with prolonged use.

There are a few common keyboard form factors on the market. They vary from the full size traditional computer keyboard (roughly 46 cm wide) to 60 % models (27 cm wide). I’ll cut to the chase right away: many use too wide keyboards and you should probably get one without the numbed. Read on if you need more convincing.

You’re probably shopping for a keyboard in an online store and trying to form an opinion based on customer reviews. But how can you tell whether a keyboard form factor will let you maintain a good ergonomic posture or not? Ergonomics vary from person to person. Does the reviewer who claims that a keyboard you’re interested in is “comfortable and ergonomic” have the same sized hands and shoulders as you do?

Most keyboards have the common QWERTY alphanumeric key layout. The key pitch is the distance from the center of one key to center of its neighbor in the alphanumeric area. It’s standardized at 17–20 mm with the most common options being 17,5 and 19,05 mm.

Non-standard keyboard for tablets and living room keyboards may feature smaller key pitch and even smaller form factors. These are out of scope for this article.

![A full-size computer keyboard with different areas highlighted showing the difference between keyboard formats.](https://cdn.synaps.media/control/content/images/2026/08/keyboard-format-key-areas.svg)

Keyboard form factor comparison by [Daniel Aleksandersen](https://www.daniel.priv.no/?ref=ctrl.blog) licensed under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/?ref=ctrl.blog).

In order to make keyboards smaller, some keys are sacrificed compared with the traditional full size models. The keys that get sacrificed are the numeric keys (NumPad, show in yellow), editing/navigation keys (shown in blue), and the arrow keys (shown in red).

The following table shows what keys are available on which keyboard form factors. There may be some other variations from manufacturer to manufacturer.

|                   | Key sections |                    |         |
| ----------------- | ------------ | ------------------ | ------- |
| Keyboard-size     | NumPad       | Editing            | Arrows  |
| 100 % / full-size | Yes          |                    |         |
| 80 % / tenkeyless | No           | Yes                |         |
| 75 % / compact    | No           | Vertically aligned | Compact |
| 65 %              | No           | Yes                |         |
| 60 %              | No           |                    |         |

Your hand resting position is different for gaming and touch-typing/office tasks. Gamers rest their left middle finger on the W key (WASD rest position) and typist rest their left index finger on the F key (touch-typing rest position). This guide covers both use-cases.

As a gamer, you use both keyboard and mouse simultaneously for long periods of time. You need devices that let you maintain a relaxed and comfortable posture. You should avoid a setup that requires you to reach your mouse arm out to the side.

Here’s a step-by-step guide to help you identify your keyboard resting posture. You can use this to work out what keyboard form factors will allow you to maintain an ergonomic posture.

1. Clear out some space on your desk. Move your keyboard and mouse aside.
2. Extend some measuring tape on the desk in front of you.
3. Sit comfortably in your chair. Stretch your arms out in from of you and lower them down to the desk. Hold the position for a minute and make sure you’re comfortable. Shake lose your shoulders and try again if you’re uncomfortable.
4. Measure the distance between and including one of your middle fingers.

This measurement is the ideal distance between the WASD resting position (from the center of W key) to your mouse resting position. The mouse should be positioned at least 12 cm to the right of your keyboard to have enough room to be moved about. The illustration at the top of the article shows this measurement. It can have some correlation with your shoulder-width, but the two measurements won’t necessarily be the same.

You should chose a keyboard that allows you to maintain at least the distance you measured between your resting position on the keyboard and your mouse resting position. You should **not** pick a keyboard size that requires more distance than your hand resting distance allows for.

The following is a reference table for the minimum distance between the WASD resting position and the mouse resting position with common keyboard form factors. It’s only suitable for right-handed use (left hand on keyboard, right hand on mouse).

| Keyboard form factor | Resting hands distance |         |
| -------------------- | ---------------------- | ------- |
| For gaming           | For typing             |         |
| 100 %                | 50 cm                  | 48 cm   |
| 80 %                 | 42 cm                  | 40 cm   |
| 75 %                 | 37,5 cm                | 35,5 cm |
| 65 %                 | 33 cm                  | 31 cm   |
| 60 %                 | 30 cm                  | 28 cm   |

You can move the mouse and keyboard further apart if your body allows for it. However, you should not buy a keyboard that is too large for your hands! You wouldn’t be able to maintain a good posture if your keyboard is too large.

You can get a stand-alone NumPad and position it to the left of your keyboard if you do a lot of data entry and can’t live without it. You can also find some keyboard models with the NumPad positioned to the left of the alphanumeric section of the keyboard instead of the traditional right-side position.

If you have short hands, you should also make sure to pick a keyboard with reduced key pitch (the distance between the center of one alphanumeric key to the center if its neighboring alphanumeric keys). 19,05 mm is the normal for full-size keyboards, but you can find keyboards with key pitch as small as 17,05 mm.

If you don’t want to replace your keyboard, you can make an oversized keyboard more comfortable by remapping keybindings. Configure your games to use ESDF, RDFG, or TFGH instead of WASD for movement.

You’ll reduce the minimum hand resting distance by 17–19 mm per key as you move your resting position rightwards You’ll want to remap all keys — such as moving Ctrl to Z — to move them closer to your movement keys. You can find guides and suggested key mapping schemes for various games on the web.

I’ve always insisted on using a full-size keyboard and I’ve suffered needlessly from shoulder pain. I’m not a big guy and my shoulder width is about the average for women in the U.S. I should have switched to using the 80 % keyboard form factor years ago. Maybe you should consider it too.
### Take precautions when linking to outdated or incorrect information
URL: https://www.ctrl.blog/entry/label-low-quality-links/
Last updated: 2026-08-23T22:12:46.000Z
The web is a wonderful tool for learning everything there is to know about anything and nothing. It’s also full of articles based on factual misunderstandings and misrepresentations, outright lies and misinformation, and there’s tons of outdated information.

Links are how much of that information gets around on the web. They’re one-click pointers from one source of information to another. They’re also tiny up-votes/amplifiers in search-ranking algorithms that organize and disseminate information on a global scale.

As an author, you can help your readers establish confidence in your writing by linking to authoritative source materials that back up your information and arguments. This gives your readers convenient ways to fact-check your information for themselves.

However, sometimes you need to include links to information that’s outdated, untrue, or is otherwise untrustworthy. For example, when you’re writing an external fact-check of a claim made by another author or a pathological lying politician. Only a few websites bother with [labeling their own outdated pages](https://www.ctrl.blog/entry/label-outdated-webpages/).

> “When seeking to counter misinformation, the best approach is to focus on the facts you wish to communicate.”

[Debunking Handbook](https://skepticalscience.com/docs/Debunking%5FHandbook%5F2011.pdf?ref=ctrl.blog "“The Debunking Handbook"), 2012, John Cook and Stephan Lewandowsky

In March 2020, online news sites in Norway marked articles on the COVID-19 pandemic as outdated two days after publication. Some blogs and news sites automatically mark articles as outdated some years after their initial publication. However, most websites don’t provide any warnings about the information freshness of their articles.

So, do you include a link to outdated or otherwise inaccurate information or not? It will amplify its reach among your readers and potentially boost its reach more widely as search engines see the link and assume it means “people are talking about this page — it must be important and high quality”.

I frequently run into this with purely technical issues where there is a binary and objective right or wrong answer. For example, programming documentation that doesn’t match the implementation, a software configuration example/setup recipe in a blog somewhere that doesn’t achieve the expected outcome, or incorrect claims that a problem is caused by a program that has nothing to do with the problem.

In general, I often find it more honest to include a link to a source — even if its wrong or misleading — when its content and the surrounding context is important to the issue being discussed. Given human nature and the malleability of our memories, there’s always the risk that the reader will read a linked resource and form false memories based on it even when it’s read in the context of it being false or inaccurate.

It’s important that authors annotate links to information they consider to be incorrect. You shouldn’t rely on context alone as readers won’t necessarily read the entire text. Links stand out in text and readers can start reading from a link onwards. Information about a link’s factuality must either be part of the link text itself or included immediately after it.

On a technical note, web authors can indicate to search engines that a link is untrustworthy by setting the [rel=nofollow](https://html.spec.whatwg.org/multipage/links.html?ref=ctrl.blog#linkTypes:link-type-nofollow) link annotation as shown below:

```html
<a rel="nofollow" href="https://example.com">
  local media used the quote out of context
</a>
```

I did a quick survey of the linking-practices among six external fact-checking websites. None of them used the `nofollow` link annotation. In general, they seemed to mostly focused on linking to good sources of information and not link to the bad sources they were trying to debunk. Snopes.com only linked to third-party archived versions of websites rather than linking to the source.

There are other factors at play as well. Should you point out the factual mistakes of an individual blogger or even a journalist in a public forum? I want to avoid publicly shaming someone or even pointing fingers saying “You’re wrong!”

The facts should be the primary focus and not the people around them (unless they’re the main focus.) It’s [unethical](https://web.archive.org/web/20140607131918/https://caj.ca/ethics-guidelines) to publicly criticize a person or organization without allowing them the opportunity to respond.

Individual webpages and whole websites have been taken offline in response to stories I’ve published on Ctrl blog. This hasn’t been my goal and I’d prefer it if they were kept online and published updates and corrections instead. Many links disappear over time due to link rot and I update them to point to [archived versions](https://www.ctrl.blog/entry/how-to-internet-archive/) instead when the originals disappear without correction.

I’ve often emailed fellow bloggers and websites to ask them to update information or for comment before publishing anything that could be seen to affect their work negatively. However, I’ve rarely received a response. The bigger the publisher, the less likely they are to respond.

In summary: include links to information as you normally would but label them clearly for human- and machine readers. If criticism is the main focus of your writing, allow the other party an opportunity to comment on it and to correct their writing before publishing.
### Yahoo!, AOL, OneSearch biased in favor of parent company’s websites
URL: https://www.ctrl.blog/entry/verizon-media-search/
Last updated: 2026-08-23T22:24:01.000Z
Verizon Media, formerly Oath, owns the two search engines Yahoo! and AOL. Three months ago, it also launched another search engine called OneSearch. OneSearch promises to provide “unfiltered” and “unbiased” search results on its front page.

Verizon Media’s search engines are powered by Microsoft Bing. Bing does the crawling, indexing, and ranking of the web and resells its search results to meta-search-engines like the three owned by Verizon Media. Other meta-search-engines like DuckDuckGo and Ecosia also operate this way.

There’s a huge conflict of interest in a media company that owns several high-profile websites — including Engadget, HuffPost, and TechCrunch — owning several search engines.

You may not be surprised to learn that the search results from all three of Verizon Media’s search engines are biased in favor of [Verizon Media websites](https://web.archive.org/web/20200402005359/https://www.verizonmedia.com/our-brands). Yahoo!, AOL, and OneSearch all boosts the ranking of Verizon Media brands in organic search results. That is to say, regular web results excluding ads, news, shopping, image, and video search results.

The experiment needed search results that would return results from Verizon Media websites. I measured the first position in the organic search result of any Verizon Media website. This should measure any bias favoring it in the search results.

I selected twelve search queries based on summarized current news headlines from Verizon Media websites including Engadget, HuffPost, and TechCrunch. I took care to avoid using the exact keywords and phrasing found in the headlines. I also verified that at least ten other high-profile websites had written stories on the same subject with similar headlines.

I also repeated the same search queries with three other search engines: Bing, FindX, and Lilo acting as a control group. All six search engines are powered by Bing and should produce similar — if not identical — search results.

The search results were unsurprisingly very similar across all six search engines. There were some minor ranking differences within the results of all the search engines. For example, some results would be listed one position higher or lower in one search engine compared to the others. One search query produced very different results between search engines as it automatically bypassed the mature-content filter that is normally applied.

The thing that stood out in the result was the consistently increased position of Verizon Media-owned websites in the search results of Verizon Media-owned search engines.

![Boxplot showing that Verizon Media-websites get much higher ranking positions in Verizon Media-owned search engines compared to other search engines.](https://cdn.synaps.media/control/content/images/2026/08/verizon-media-search-boxplot.png)

Verizon Media search bias box plot by [Daniel Aleksandersen](https://www.daniel.priv.no/?ref=ctrl.blog) licensed under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/?ref=ctrl.blog).

Verizon Media-properties had a median search result position of 1 and an average position of 2,8 in Verizon Media-owned search engines. In the above boxplot, you can see that Verizon Media-websites are clustered at the top position in search results in their own search engines.

The three Bing-powered control search engines rank Verizon Media-properties consistently lower with a median position of 4 and an average of 9,4\. For contrast, I’ve also included the results from StartPage which gets its search results from Google.

You can download a copy of the [results spreadsheet](https://cdn.synaps.media/control/content/files/2026/08/2020-03-05%5Fverizon-media-search-bias.ods?ref=ctrl.blog) if you’re interested in the details.

I did not measure the position of Verizon Media-brands in news search results. News results are often placed before or in-between organic search results. However, the inclusion and presentation of news search results are less predictable than organic search results. The same search query repeated multiple times produced results with and without news search results, making them more difficult to measure.

The market leader in search, Google, is frequently criticized for prioritizing its products in the company’s search results. However, these tests suggest they’re not alone in favoring their own products.

Search engines, like any software product, reflect the opinions, preferences, and the business-interests of the people who built it.

Yahoo!, AOL, and OneSearch can’t be considered to be neutral search engines. They have a business agenda that influences how they rank search results. This arguably isn’t an anti-trust issue as Verizon Media isn’t a market leader in the search market. However, it’s anti-competitive behavior none the less.

Verizon Media-owned search engines have decreased from a market share of 4,10 % in February 2019 to 3,63 % in the United States in February 2020, according to StatCounter Global Stats. 3,63 % of the internet-connected population of the U.S. is roughly 10,6 million people.

I’m pro-competition in the search market. I’m all in favor of [more diverse search results](https://www.ctrl.blog/entry/randsearch/). However, bias favoring one company over others is not what anyone is looking for in a search engine.

Verizon Media did not reply to my request for comment (within 8 hours.) I’ll update the article if they get back to me.

#### Sources

- [Verizon Media search engine bias](https://cdn.synaps.media/control/content/files/2026/08/2020-03-05%5Fverizon-media-search-bias.ods?ref=ctrl.blog) (OpenDocument Spreadsheet), 2020-03-05, Daniel Aleksandersen
- [Search Engine Market Share in United States of America – February 2020](https://gs.statcounter.com/search-engine-market-share/all/united-states-of-america?ref=ctrl.blog#monthly-201902-202002), 2020-03-05, Global Stats, StatCounter
- [Verizon Media Launches Privacy-Focused Search Engine, OneSearch](https://web.archive.org/web/20200406114354/https://www.verizonmedia.com/press/2020/01/14/verizon-media-launches-privacy-focused-search-engine-onesearch), 2020-01-14, Press release, Verizon Media
### Inconsistent user-experiences with native lazy-loading images
URL: https://www.ctrl.blog/entry/lazy-loading-viewports/
Last updated: 2026-08-23T22:12:58.000Z
The specification for web browser native support for lazy-loading images landed in the [HTML Living Standard](https://html.spec.whatwg.org/?ref=ctrl.blog) a week ago. This new feature lets web developers tell the browser to defer loading an image until it is scrolled into view, or it’s about to be scrolled into view.

Images account for 49 % of the median webpage’s byte size, according to the HTTP Archive. Lazy image loading can help reduce these images’ impact on page load performance. It can also help lower data costs by clients that never scroll down to images far down on a page.

Historically, lazy-loading was implemented by responding to changes in the scroll position and tracking the image element’s offset from the top of the page. This could degrade page-scrolling performance. Comparatively, the new native lazy loading for images is easier to implement and doesn’t degrade scrolling performance. All it takes is one extra argument on your images.

```html
<img loading="lazy" src="img.jpeg"
     height="100" width="200">
```

However, the current specification is vague on exactly when browsers ought to load a deferred image. It must be loaded if the image is visible *or is about to become visible* to the user.

This ambiguity in the specification has created implementations with different user experiences. Before digging into the details on how they differ, I first need to explain about the Intersection Observer API.

Intersection Observer is the modern replacement for the practice of manually handling scroll events to calculate whether an element is visible on the page. The browser now handles that for you and fires an event when a tracked element scrolls into view. An Intersection Observer can be configured with a margin around the visible viewport (the `IntersectionObserver.rootMargin`); causing the event to be fired at a configurable distance before scrolling into view.

Chromium Blink (Chrome), Mozilla Gecko (Firefox), and WebKit (Safari) have all implemented lazy-loading images using an Intersection Observer. However, each implementation has set different margins! These margins are not configurable without recompiling the rendering engine.

Chromium Blink uses a margin of 3000 px on low-latency network connections, and up to 8000 px on high-latency connections. Depending on the network latency, this can cause all images on the page to be loaded right away. This behavior compromises on some of the data-savings and loading-performance benefits you could otherwise get with lazy-loading images.

Mozilla Gecko sets no margin at all. As a result, a lazy-loaded image wouldn’t be loaded until at least 1 px of it is visible to the user. Again depending on network latency, this can result in the user seeing a blank area while the image is loaded. This creates the opposite problem of Blink where the lazy-loading behavior is too lazy.

**Update** (2020-10-29): Firefox 86 (due for release in 2021-Q1) [will introduce](https://bugzilla.mozilla.org/show%5Fbug.cgi?id=1673785&ref=ctrl.blog "“Bug #1673785: Tweak lazy-loading root margin defaults”") a new default omnidirectional root margin of 300 px.

**Update** (2021-05-10): Firefox has experimented with [changing the root margin to 600 px](https://bugzilla.mozilla.org/show%5Fbug.cgi?id=1703048&ref=ctrl.blog "“Bug #1703048: Tweak lazy-loading root margin defaults to 600 px in all directions”"). This became the new default in Firefox 90.

**Update** (2021-07-27): Firefox is again experimenting with increasing its default root margin. The current beta builds use [a new default of 800 px](https://bugzilla.mozilla.org/show%5Fbug.cgi?id=1722574&ref=ctrl.blog "“Bug #1722574: Tweak lazy-loading root margin defaults to 800 px in all directions”").

WebKit’s implementation is incomplete as of the time of writing. However, a proposed patch sets its margins to 100 px vertical and 0 px horizontal. This gives the browser a small heads-up to start loading the image before it’s scrolled into view. This might not be enough depending on network conditions and scrolling speed.

The browser vendors have gone for different trade-offs between data-saving, perceived-performance, and how acceptable a temporary blank area is. These margins aren’t set in stone and they may change over time.

This results in an environment where the end-user experiences can vary considerably based on the user’s browser of choice. Worse, web developers’ don’t have a say in the matter.

Web developers can take back control of user experiences by implementing their lazy-loading based on an Intersection Observer. However, this is more work than using the web-native option. It also requires much more work to properly support environments where JavaScript is turned off.

I think that it’s good for the web if more websites adopt lazy-loading techniques using the new easy-to-implement web-native method. However, I do wish that those different implementors could have had a quick lunch together and could agree on one behavior.

Blink’s behavior has been called [“too eager”](https://calendar.perfplanet.com/2019/native-image-lazy-loading-in-chrome-is-way-too-eager/?ref=ctrl.blog), and I tend to agree. However, Gecko’s behavior also seems too lazy. I believe the ideal default margin probably lays somewhere between these two implementations.

I’ve often [implemented lazy-loading](https://www.ctrl.blog/entry/eager-lazy-loading/) with a margin of one–two times the viewport height. The idea has been to get the browser to prepare one–two screens worth of content. It loads more content earlier on, presumably, more powerful devices with large screens, and less content on devices with smaller form factors. This may not be the best approach in every situation, though.

#### Sources

- [Add <img loading=lazy> “lazy loading images”](https://github.com/whatwg/html/commit/0283e9e5f349b107c745dbeb73034445a6b55796?ref=ctrl.blog), commit 0283e9e5f3, 2020-02-12, HTML Standard, WHATWG, GitHub
- [Support <img loading="lazy"> lazy-loading](https://bugzilla.mozilla.org/show%5Fbug.cgi?id=1542784&ref=ctrl.blog), issue #1542784, 2020-02-12, Bugzilla, Mozilla
- [Native Image Lazy Loading in Chrome Is Way Too Eager](https://calendar.perfplanet.com/2019/native-image-lazy-loading-in-chrome-is-way-too-eager/?ref=ctrl.blog), 2019-12-22, Aaron Peters, Web Performance Calendar
- [lazy\_load\_image\_observer.cc](https://source.chromium.org/chromium/chromium/src/+/master:third%5Fparty/blink/renderer/core/html/lazy%5Fload%5Fimage%5Fobserver.cc;drc=26e4f728a89c022271122474e69a7acbb1b04132?ref=ctrl.blog), commit 26e4f728a8, 2019-12-05, Chromium repository, Chromium project
- [Determine viewport distances for lazy image loading](https://bugs.webkit.org/show%5Fbug.cgi?id=203557&ref=ctrl.blog), issue #203557, 2019-10-29, Rob Buis, Bugzilla, WebKit
- [Intersection Observer](https://www.w3.org/TR/2019/WD-intersection-observer-20190531/?ref=ctrl.blog), Draft Specification, 2019-05-31, World Wide Web Consortium (W3C)
### How to back up your password manager
URL: https://www.ctrl.blog/entry/password-manager-backup/
Last updated: 2026-08-23T22:15:17.000Z
Password managers aren’t infallible. They [suffer](https://www.theregister.com/2020/01/20/lastpass%5Foutage/?ref=ctrl.blog) [service](https://status.dashlane.com/pages/incident/5aabcb89fccc4b04d3774443/5e2021d44f7e6f04b9f6ae8d?ref=ctrl.blog) [outages](https://www.theregister.com/2018/11/20/fivehour%5Foutage%5Ffrustrates%5Flastpass%5Fpunters/?ref=ctrl.blog) [like](https://1password.statuspage.io/incidents/lfryxh5gnbst?ref=ctrl.blog) [every](https://statuspage.keeper.io/incidents/1xj4kt5y3gvl?ref=ctrl.blog) [other](https://statuspage.keeper.io/incidents/sjgzycw8vrg4?ref=ctrl.blog) service. Yet, password managers ask their customers to trust them completely. They’re a single point of failure and are difficult to back up.

A password manager is good for your security hygiene and you should definitely use one. They help us avoid reusing the same password all over the place and ease the mental burden of having to remember all those passwords.

You quickly grow completely dependent on your password manager, however. It’s an incredibly sticky product that guards everything from high-value assets and access to our bank to that one account you made to comment on a comic on that weird site.

LastPass markets itself as “the last password you need to remember.” That promise leaves a huge unanswered question: What do you do when you suddenly don’t have access to your password manager and you don’t remember any of your passwords?

How would you get access to your email and critical work-related services if your password manager disappeared overnight? Or what if you simply forget the password to your password manager (the “master password”)?

Backups are a possible solution to this problem. If you have a backup of your password manager then you have a backup plan in case of a problem with your password manager. When was the last time you backed up your password vault, though?

Many password managers, the good ones anyway, store their customers’ passwords on their servers in an encrypted format. The best password manager services store them so securely that not even they can access your passwords if you forget your master password.

Almost all password manager services let you export an unencrypted data-dump containing all your passwords. This option is often hidden deep down in a settings screen somewhere in your password manager. This is the file that lets you [migrate between two password managers](https://www.ctrl.blog/entry/migrating-to-bitwarden/) without having to copy over your passwords one at a time.

You could periodically download a copy of all your passwords and store them in a managed storage service like Dropbox, Apple iCloud, or Microsoft OneDrive. It would be a boring task and you wouldn’t remember to do it after a month or two. You’d also take on additional risk as anyone who’d gain access to your files (including employees at the storage service provider) would have a copy of all your authentication data.

The various password managers could offer to sync encrypted backups to a cloud service as a feature. However, I understand why none of the leading providers currently offer this service. It could make their customers more aware that their blind trust in their provider’s infallibility might be misplaced.

It’s risky even to download this file and store it on your computer. You can mitigate this by re-encrypting the file. However, then you’d need to remember an additional password or somehow securely store an encryption key-pair. These are paradoxically tasks you’d normally trust your password manager to handle.

You could periodically print a hard-copy of the exported password dump. However, not many still own a printer nor have a secure way to store such sensitive papers. You don’t want to print it through a printer controlled by anyone else, such as your employer, as printers can retain copies of what they’ve printed for some time.

Pro-users can cobble together a secure and automated back up solution using various command-line tools. Many password managers offer advanced users command-line access to their password vaults.

However, these methods may be unavailable if you use two-factor authentication or other additional security mechanisms. It also adds significant complexity and requires ongoing monitoring and maintenance. I don’t recommend that anyone attempt this.

Unfortunately, there are no easy solutions for securely backing up your password manager. You most definitively should have a backup, however!

The only solution is to use two different password managers. This method has some drawbacks, however. You obviously introduce more complexity as you must make sure to keep the items in your two password managers in sync. If you add or change a password to one then you must make sure to mirror the change in the other.

You also double the risk of having your password vault be compromised if you use two password managers. Any critical security flaw or intrusion into either of your password managers could expose the contents of your vault.

Using two password managers is less convenient than trusting one password manager. It’s relatively easy compared to the other methods I’ve discussed in this article. You can even use this method with a smartphone without the need for a computer.
### Lessons learned maintaining EdgeDeflector for Windows 10
URL: https://www.ctrl.blog/entry/edgedeflector-retrospective/
Last updated: 2026-08-23T22:05:39.000Z
Three years ago, I released [EdgeDeflector](https://www.ctrl.blog/entry/edgedeflector-default-browser/); a tiny open-source utility program for Windows 10\. It reinforces the default web browser setting in situations when Microsoft ignores its own setting and pushes you to use its Edge browser instead. It’s a tiny software project that I haven’t had to write any new code for in years. However, supporting it has proven a frustrating experience.

The origin story of EdgeDeflector is a tiny act of rebellion against tech behemoths abusing their market positions. Microsoft uses Windows 10 features like Search, Cortana, and others to force users to open links in its Microsoft Edge web browser. The operating system has a default web browser setting, but Microsoft circumvents this setting in certain parts of its operating system. It doesn’t respect the choices of its consumers to not use its software. EdgeDeflector gave back this control.

EdgeDeflector was positively received by users and has been downloaded over 300 000 times. 265 000 through the project page on GitHub and 35 000 times from mirrors. It popped up in all the Windows news/fan blogs within a few months of its launch. It still occasionally receives coverage from tech blogs with nothing more original to cover.

I don’t hate or even dislike Microsoft Edge. I just didn’t want to be forced to use it. Edge used to be built on Microsoft’s EdgeHTML rendering engine. It did its job and I’m sure it served its users well.

Microsoft has since abandoned EdgeHTML in favor of building its web browser on top of Chromium. Chromium is an open-source browser project lead by Google. It powers just about every web browser on the market except Apple Safari and Mozilla Firefox.

I take no joy in seeing EdgeHTML die or having personally contributed to reducing its usage by over a quarter-million users. The poor Edge user experience dug that grave. I don’t feel like I’ve contributed to the growing Chromium monoculture by reinforcing people’s default-browser setting. (I recommend that people try out [Firefox](https://www.mozilla.org/en-US/firefox/new/?ref=ctrl.blog) or [Firefox-based alternatives](https://www.ctrl.blog/entry/four-firefox-derivatives/) to stave off the growing Chromium monoculture.)

The project was quick to realize, and it solved a problem people had with Windows 10\. The program is only 200 lines with liberal amounts of white space. I’ve spent way more time answering the same questions and providing user support than I ever did writing the software.

The number one feature request was for EdgeDeflector to automatically redirect search queries from Bing Search to Google Search. I’ve repeatedly said *no* to this request. Windows opens Bing Search when you search with Cortana or Windows Search, and when you click various help links in the Settings app.

Windows Search and Cortana is powered by Bing. Stop feeding it your search queries if you don’t want to use Bing. Google has a near-monopoly on web-search. I won’t do anything to push more people to use Google products. I’m more interested in doing [the exact opposite](https://www.ctrl.blog/entry/randsearch/).

I understand that many have a strong preference for Google Search. There are browser extensions for all web browsers that will redirect your Bing Searches to Google Search. There are also several forks of EdgeDeflector that will happily redirect copies of your Bing searches to Google.

EdgeDeflector’s binary release doesn’t come with code-signing — a security feature that lets Windows (and antivirus programs) know who made it. I simply don’t want to put up the cash or maintain a certificate for it. This has occasionally triggered false-positives from different antivirus solutions.

Notably, the reoccurring detection issue has been with a GitHub URL that’s included with the installer. Third-party programs can’t automatically change URI protocol handling in Windows 10 without user action. To properly register EdgeDeflector in Windows, the installer opens a welcome/troubleshooting page after it’s installed. This process should get the user all set up to use EdgeDeflector.

There’s no auto-update function in EdgeDeflector. I can’t safely include this function without obtaining a code-signing certificate. The functionality would also have required fifty times more code than the program itself. This has only been an issue once when Windows 10 pushed [an update that broke EdgeDeflector](https://www.ctrl.blog/entry/edgedeflector-111update/).

The number one user complaint has been that EdgeDeflector “doesn’t work.” The number one cause comes down to corruption in the default program/file and protocol association registry in Windows. Users don’t notice that it’s broken until they install something like EdgeDeflector and find that it isn’t working. EdgeDeflector gets blamed a lot for what is a Windows bug.

This issue can be resolved by reading [the troubleshooting page](https://github.com/da2x/EdgeDeflector/wiki/Troubleshooting?ref=ctrl.blog) that opens automatically after you’ve installed EdgeDeflector. Many don’t read that page. It has been frustrating having to respond to support requests from Windows 10 customers about their issues with Windows 10.

Just a few days ago, Windows Search (and Cortana) stopped working for many Windows 10 users. EdgeDeflector users blamed it for the problem. This is understandable as it’s something they’ve installed that, to them, changes how search works. However, EdgeDeflector doesn’t make any changes to Windows 10 or any Windows components. It’s a tiny program that transforms one proprietary URI protocol (`microsoft-edge://`) to a standard one (`https?://`).

The issue this week had nothing to do with EdgeDeflector. It was caused by [a Microsoft service outage](https://www.theregister.com/2020/02/05/windows%5F10%5Fbinged/?ref=ctrl.blog).

Yet, users don’t understand that and blame the program for all sorts of things that go wrong with their system. People don’t like hearing that “I’m sorry that Windows 10 isn’t working properly for them, and it isn’t EdgeDeflector’s fault.” On a related note: Sorry, but installing EdgeDeflector didn’t break your printer, made your screen blue-tinted, nor kill the battery in your laptop.

Likewise, there are a few third-party web browser extensions that recommend their users install EdgeDeflector. These extensions are primarily meant to redirect Bing search result pages (like the ones opened by Cortana) to Google Search. They’re a nice compliment to EdgeDeflector.

However, users don’t see the distinction between these extensions that recommended they install it and EdgeDeflector itself. People have been outright furious with me because of third-party browser extensions that haven’t lived up to their expectations.

I’m always confused by how many people demonstrate that they know how to search online by locating my email address but are then unable to find an answer to their questions. More often than not, they could have directed their email verbatim (sans the greetings) into Bing or Google and had their answers instantly.

Only 5 ‱ of people who’ve downloaded EdgeDeflector have reached out needing help with it. It’s not a lot of people looking back on it. It hasn’t really taken up all that much of my time. However, it has chipped away at my free time a little at a time for three years now. I feel like I’ve been stuck dealing with people’s frustrations about their operating system of choice.

Only 0,3 ‱ have donated money to show their appreciation for EdgeDeflector. I’m grateful for the people who have donated. However, this is not how I’d hope to create value for myself with EdgeDeflector, though.

I had hoped that it would drive some traffic to my blog. The [inaugural blog entry for EdgeDeflector](https://www.ctrl.blog/entry/edgedeflector-default-browser/) admittedly isn’t the most exciting read. However, it explains what problem it’s designed to fix, how it works, and includes a cautionary tale about using less secure alternatives to EdgeDeflector.

However, you’re unlikely to find that blog post if you search for EdgeDeflector by name (a name I came up with). It’s at the bottom of page four on Google Search, at the bottom of page two on Bing, and at the top of page 11 on Yandex Search. Articles from tech blogs outrank it. Auto-generated pages, forked GitHub repositories, and sketchy-looking software mirrors also outrank it.

None of these pages have linked to my blog post despite it being prominently featured on the project GitHub repository. About half the links point to the GitHub repository and another quarter link to the release page or a specific release. Some link directly to the download or to another download mirror.

Writing a blog post and linking it from a somewhat popular GitHub repository has completely and utterly failed as a link-building strategy. No external websites covering the program took the bait. Everyone want their article to be the definitive source of information, so people tend not to reference any sources even when they’ve pulled quotes out of the blog post.

I wish I never made EdgeDeflector available through GitHub. I really should have charged $1 for EdgeDeflector on the Windows Store instead. It would probably have seen far less success this way. One dollar is an incredibly high barrier to installation, after all. People would have been less likely to install it and probably be more motivated to make it work if they’d paid for it. I’d also potentially have had a tiny pile of dollars to show for it and I wouldn’t have had to answer so many emails.
### Limit the impact of a security intrusion with systemd directives
URL: https://www.ctrl.blog/entry/systemd-opensmtpd-hardening/
Last updated: 2026-08-23T22:22:57.000Z
Three weeks ago, I wrote [systemd service sandboxing and security hardening 101](https://www.ctrl.blog/entry/systemd-service-hardening/): an introduction to Linux security features for service processes managed by `systemd`. It proved enormously popular, so I thought I’d follow it up with a more complete example.

This week, I’ll explore how you can use some of the more advanced security features offered by `systemd`. You’ll want to read the 101-introduction before proceeding with this article.

Last week, researchers at Qualys disclosed a remote code execution (RCE) vulnerability in OpenSMTPD: an open-source email server. This seems like an opportune time to make sure you’ve locked down this service. It will serve as our example service for this tutorial.

Most parts of OpenSMTPD is designed to run in unprivileged processes. However, this was a [“worst-case scenario”](https://poolp.org/posts/2020-01-30/opensmtpd-advisory-dissected/?ref=ctrl.blog), as Gilles Chehade put it. The vulnerability lets attackers execute remote commands with full administrative privileges. Remotely executed arbitrary code running rampant is the last thing you want on your email server.

I’m an OpenSMTPD user and my server was actively targeted by this vulnerability. Hopeful attackers were actively trying to exploit it hours after the vulnerability was disclosed publicly. I’ll be honest here: I’d not done my job properly and hadn’t secured the `smtpd` service running on my system. [Sheer dumb luck](https://www.ctrl.blog/entry/email-politics-security-newsletter/) protected my system against exploitation.

Sandboxing is all about restricting a service’s permissions, access, and capabilities to a point where it can’t perform any options except what’s expected of it. To block unexpected behavior, you’ll need to gather detailed knowledge of how it’s expected to work.

I’ll start with some of the most complex security directives first. They require a bit of effort, but can make the most positive impact to your system security.

I suggest you **apply directives one at a time** and **thoroughly test** that your service **still performs as expected** after applying each one. Alternatively, you can spend days and days reviewing how the software is built. However, trial and error is the quickest approach to get you up and running here.

### Restricting capabilities

Linux kernel capabilities are per-process thread security policies that control access to specific kernel features. You can increase security and reduce the impact of an intrusion by limiting services to expected capabilities only.

The available capability sets are listed in the [capabilities(7) manual page](https://www.man7.org/linux/man-pages/man7/capabilities.7.html?ref=ctrl.blog). The manual’s explenations for each capability assume a developer’s mindset, but you can search online for discussion of each one in more detail.

If you don’t know what capabilities your service requires then here’s how to work it out. You’ll notice that the manual page lists system calls, e.g. `chroot(2)`. If you’re securing an open-source program service, then you can locate and search through its source code for these specific system calls.

Alternatively, you can try removing all capabilities and see if and how the service fails. Explicitly set the `CapabilityBoundingSet=` directive to nothing to remove all capabilities.

I was familiar with OpenSMTPD’s architecture so I knew which capabilities it would need. I’ve set the following allow-listed capabilities for my instance of the OpenSMTPD’s `systemd.service`:

```ini
CapabilityBoundingSet=CAP_SYS_CHROOT
CapabilityBoundingSet=CAP_SETUID
CapabilityBoundingSet=CAP_SETGID
CapabilityBoundingSet=CAP_CHOWN
CapabilityBoundingSet=CAP_DAC_READ_SEARCH
CapabilityBoundingSet=CAP_NET_BIND_SERVICE
AmbientCapabilities=
```

OpenSMTPD runs as the root user and spawns unprivileged child processes in a minimal root directory. It needs the capability to change the root directory (`chroot`) and assign these processes user and group identities (UID/GUID) Lastly, the process needs to listen to several privileged network ports (ports below 1024).

We don’t want any of these child processes (or any compromised process spawned from the process) to inherit these capabilities. A compromised process could for example potentially take over the role as the web server (ports 80 and 443).

Set the `AmbientCapabilities` option to nothing to prevent any child processes from inheriting their parent’s capabilities.

### Allow-listing system calls

We can also block or allow-list specific system calls (syscall) or sets of syscalls. This gives an even more granular control than kernel capability sets. The [systemd.exec(5) manual page](https://www.freedesktop.org/software/systemd/man/systemd.exec.html?ref=ctrl.blog#SystemCallFilter=) contains a few predefined syscall sets.

`@system-service` is one such set. It contains some common syscalls used by services. It notably removes the ability to reboot the system, interfere with swap memory, and change the system clock. Few services need these capabilities.

I’ve set the following allow-list of syscalls for OpenSMTPD:

```ini
SystemCallFilter=@system-service
SystemCallFilter=@mount
SystemCallErrorNumber=EPERM
```

OpenSMTPD needs `@mount` in order to use `chroot`.

### Limiting access to the file system

The Linux kernel can change how a process sees the file system. This can be a powerful way to limit what a compromised process has access to and how much damage it can cause to your system.

You can prevent it from reading into the `/tmp` (temporary files) of other processes or reading or writing to `/dev` (hardware devices including disks). You can also mount the entire file system read-only.

This last capability can help you prevent malicious code running on your system from getting a persistent foothold on your system. This is so important it should probably be the default, and require you to turn it off to make your system less secure.

The following configuration does all of the above:

```ini
PrivateTmp=true
PrivateDevices=true
ProtectHome=true
ProtectSystem=strict
```

However, the OpenSMTPD email server wouldn’t be much use to anyone if it couldn’t write anywhere on the disk. It needs access to some specific directories to store runtime information, state, and your emails OpenSMTPD store all of these things under different points in `/var`.

You can override the read-only file-system restriction for specific paths using the `ReadWritePaths` directive. However, you can make things even more secure by creating a fake temporary file system and only mapping the required directories to it. This will act as an allow-list of read-write paths.

The following example configuration for OpenSMTPD demonstrates this approach:

```ini
TemporaryFileSystem=/var
TemporaryFileSystem=/var/empty/smtpd
TemporaryFileSystem=/var/run
BindPaths=/var/spool/clientmqueue
BindPaths=/var/spool/lpd
BindPaths=/var/spool/mail
BindPaths=/var/spool/mqueue
BindPaths=/var/spool/smtpd
BindPaths=/var/mail
```

By now, you’re probably wondering how to identify the above list of directories. It may be different in your configuration! I’ll walk you through the process for the `/etc` (configuration) directory.

You can work out the required directories by reading the available documentation and source code. However, this can take all day and you may simply not have the required programming skills.

The easiest way is to run the software through [strace](https://strace.io/?ref=ctrl.blog) and use it as normal. `strace` can track and print the file system operations a program performs. More importantly, it can print the file paths a program interacts with.

The following command launches OpenSMTPD and traces which files it interacts with under the `/etc` directory.

```shell
/usr/bin/strace -f \
  /usr/sbin/smtpd 2>&1 | \
  egrep -o '"/etc[^"]+"'
```

This should give you the information you need to create an allow-list. Note that you must use the program normally for a while as its behavior, and thus file operations, may change over time and when using different functionality.

Here’s the configuration I came up with for my instance of OpenSMTPD.

```ini
TemporaryFileSystem=/etc
BindReadOnlyPaths=/etc/aliases
BindReadOnlyPaths=/etc/crypto-policies/
BindReadOnlyPaths=/etc/group
BindReadOnlyPaths=/etc/hosts
BindReadOnlyPaths=/etc/opensmtpd/
BindReadOnlyPaths=/etc/letsencrypt/
BindReadOnlyPaths=/etc/localtime
BindReadOnlyPaths=/etc/nsswitch.conf
BindReadOnlyPaths=/etc/passwd
BindReadOnlyPaths=/etc/pki/
BindReadOnlyPaths=/etc/resolv.conf
BindReadOnlyPaths=/etc/services
BindReadOnlyPaths=/etc/user
```

These paths all fit with what we’d expect from an email service. They’re notably all read-only access. It can’t suddenly change the DNS resolvers, interfere with cyrpto-library policies, or change the configuration of a completely unrelated program.

The system’s persistent configuration should remain fairly safe in the event of a service compromise.

You can build on the above to cover other root-level directories too. However, you may want to consider a blocklist instead. It can be far quicker to come up with and you can share it among multiple different services.

The following blocklist restricts access to programs commonly invoked in shell-based remote execution vulnerabilities.

```ini
InaccessiblePaths=/usr/bin/at
InaccessiblePaths=/usr/bin/cron
InaccessiblePaths=/usr/bin/bash
InaccessiblePaths=/usr/bin/sh
InaccessiblePaths=/usr/bin/zsh
InaccessiblePaths=/usr/bin/wget
InaccessiblePaths=/usr/bin/curl
InaccessiblePaths=/usr/bin/ssh
InaccessiblePaths=/usr/bin/scp
InaccessiblePaths=/usr/bin/python
InaccessiblePaths=/usr/bin/perl
InaccessiblePaths=/usr/local/
```

Your email server is unlikely to have a legitimate reason to execute any of these programs. Neither do many of your other services.

### Prohibit risky and obscure behavior

There are a couple of more security directives in [systemd.exec(5) manual page](https://www.freedesktop.org/software/systemd/man/systemd.exec.html?ref=ctrl.blog#Sandboxing). You can likely enable all of the following directives for most of the services on your systems with no ill effects. (Except for the first directive.)

I recommend you enable them one by one and test your service after enabling each one.

```ini
MemoryDenyWriteExecute=true
ProtectHostname=true
ProtectControlGroups=true
ProtectKernelModules=true
ProtectKernelTunables=true
LockPersonality=true
RestrictSUIDSGID=true
SystemCallArchitectures=native
```

I’ll not go into more detail on any of these directives. Some of them are self-explanatory but they all prohibit the use of rarely used and obscure features. You can find more information about each of them in the manual page.

I hope this article has raised your awareness of some of the security features you can enable through `systemd`. Over time, I believe many Linux distributions will enable at least some of these directives by default for most of their `systemd.service`. Ultimately, it will be up to systems administrators to configure more restrictive and secure policies based on their usage.

These directives combined would have stopped the specific remote code execution vulnerability that afflicted OpenSMTPD. However, the key takeaway is that you should strive to sandbox long-running and internet-exposed services. There’s no need for your web server to be able to load a kernel module, your email server to change the hostname, or your DNS server to launch `wget` and schedule reoccurring tasks with `cron`.

You shouldn’t rely on `systemd` alone to save the day. However, it can be an additional layer of security to help protect your systems in the event of an acively exploited remote code execution vulnerability.

#### Sources

- [OpenSMTPD advisory dissected](https://poolp.org/posts/2020-01-30/opensmtpd-advisory-dissected/?ref=ctrl.blog), 2020-01-30, Gilles Chehade, Blog
- [LPE and RCE in OpenSMTPD (CVE-2020-7247)](https://www.qualys.com/2020/01/28/cve-2020-7247/lpe-rce-opensmtpd.txt?ref=ctrl.blog), 2020-01-28, Security Advisory, Qualys
- [systemd.exec](https://www.freedesktop.org/software/systemd/man/systemd.exec.html?ref=ctrl.blog), version 244, 2019-11-29, man pages, systemd project, FreeDesktop.org
- [capabilities – overview of Linux capabilities](https://www.man7.org/linux/man-pages/man7/capabilities.7.html?ref=ctrl.blog), 2019-08-02, Linux Programmer’s Manual, Linux man-pages project
### Email politics, security, and why you got an empty newsletter
URL: https://www.ctrl.blog/entry/email-politics-security-newsletter/
Last updated: 2026-08-23T22:05:44.000Z
Last week was a busy week for me email server-wise. Here’s what happened and why you were sent an empty email newsletter this week.

Roskomnadzor, the Russian telecommunications regulator, is on the warpath against privacy focused European email service providers. Last week, it ordered Russian internet service providers to block ProtonMail and StartMail.

My primary email provider is [Mailbox.org](https://mailbox.org/en/?ref=ctrl.blog) ([review](https://www.ctrl.blog/entry/review-mailboxorg/)) and it has a similar focus on privacy. Roskomnadzor has [already come after them](https://mailbox.org/en/post/russian-regulators-at-roskomnadzor-bring-case-to-court-calling-for-mailbox-org-ban-in-russia?ref=ctrl.blog) seeking to block access to their services in Russia.

**Update** (2020-02-06): “\[…\] Roskomnadzor \[has\] declared their intention to withdraw the petition to ban access to mailbox.org in Russia”, according to the [Mailbox.org blog](https://mailbox.org/en/post/roskomnadzor-withdraws-petition-to-block-access-to-mailbox-org-in-russia?ref=ctrl.blog "“Roskomnadzor withdraws petition to block access to mailbox.org in Russia”").

This set me off scrambling to set up a backup mail server (or “backup MX.”) Email is a distributed system and domain administrators can configure multiple email servers to handle incoming emails to a domain.

The email system wasn’t designed to bypass state-issued blocking of an email service provider. Never the less, you can use an unblocked backup MX to get your emails delivered despite the primary mail servers being blocked.

With a backup MX hosted on an unblocked domain, email servers located in Russia can still deliver emails. Delivery may take longer than normal as the sender’s email server will need to try the blocked servers first and then fall back to the backup MX. This is also good for redundancy in case of service interruptions at Mailbox.

I already have a self-hosted email server used for the blog’s newsletter. I didn’t want to manage two email servers. Instead, I reconfigured the newsletter email service to also act as the backup mail server for my domains.

While I was busy reconfiguring my domains and email server (it only took about ten minutes), news hit about a remote code execution vulnerability in OpenSMTPD. [OpenSMTPD](https://www.opensmtpd.org/?ref=ctrl.blog) is the open-source email server software I’m using. I needed to double-check on something with my configuration and Bing helpfully put the news of the vulnerability at the top of the results.

I quickly checked and confirmed attempts at exploiting the vulnerability in my email server logs. My server wasn’t vulnerable because I was running an outdated version of OpenSMTPD. The OpenSMTPD package in Fedora Linux’s software repositories *hadn't been updated in two years*. For once, I’m grateful that they didn’t keep up with updates.

I didn’t realize that my server wasn’t vulnerable right away, however. Instead, I spent the next half an hour [updating the package from upstream sources](https://www.ctrl.blog/entry/how-to-update-srpm/), testing, and deploying the newer version.

There had been a configuration format change between the versions that required I spend even more time on it. One of OpenSMTPD lead developer’s had provided a useful [migration guide](https://poolp.org/posts/2018-05-21/switching-to-opensmtpd-new-config/?ref=ctrl.blog) that made the migration fairly smooth.

I later confirmed that my version wasn’t vulnerable to this or any other vulnerability relevant to my configuration.

I’ve also been busy tightening the Linux kernel-provided security protections managed through `systemd` for the OpenSMTPD service. I had some in place but there was plenty of room to tighten the service’s security even further. I’ve written about this as [a more advanced guide](https://www.ctrl.blog/entry/systemd-opensmtpd-hardening/)/follow-up to [service sandboxing and security hardening 101](https://www.ctrl.blog/entry/systemd-service-hardening/).

I’m sorry for sending everyone an empty email newsletter this week. It miraculously had nothing to do with me messing about with the email delivery server.

For the last two weeks, I’ve suffered from acute bronchitis with coughing fits that have kept me awake all night. Long story short, there were no new articles to send out in the newsletter this week.

In this situation, [my newsletter system](https://www.ctrl.blog/entry/email-newsletter/) is supposed to defer sending it until there are at least two new articles. Unfortunately, the number zero exposed a bug in the sending routine that hadn’t come up when I was able to keep up with my regular writing.

In my defense, this could only have happened in a weakly-typed programming language where an empty array can evaluate to a boolean `false`. Oh, wait. I chose to write this in PHP so that’s on me as well.

It was an unfortunate mistake and I’m sorry about cluttering your inboxes with a pointless email. I’ve added even more checks to prevent this from happening again.

So, should everyone run their own email servers and deliver their own email newsletters? My recent experiences haven’t dissuaded me from believing that it’s still the right thing to do. Russia’s decision to block my own email provider reinforced my belief that SMTP must remain decentralized [for the greater good](https://poolp.org/posts/2019-12-15/decentralised-smtp-is-for-the-greater-good/?ref=ctrl.blog).

#### Sources

- [Russian regulators at Roskomnadzor bring case to court calling for Mailbox.org ban in Russia](https://mailbox.org/en/post/russian-regulators-at-roskomnadzor-bring-case-to-court-calling-for-mailbox-org-ban-in-russia?ref=ctrl.blog), 2020-01-30, Blog, Mailbox.org
- [Critical OpenSMTPD Bug Opens Linux and OpenBSD Mail Servers to Hackers](https://thehackernews.com/2020/01/openbsd-opensmtpd-hacking.html?ref=ctrl.blog), 2020-01-30, Wang Wei, The Hacker News
- [Switching to OpenSMTPD new config](https://poolp.org/posts/2018-05-21/switching-to-opensmtpd-new-config/?ref=ctrl.blog), 2018-05-21, Gilles Chehade, Blog
### The need for adversarial tech-interoperability legislation
URL: https://www.ctrl.blog/entry/interoperable-cloud-legislation/
Last updated: 2026-08-23T22:11:57.000Z
In the words of Cory Doctorow: “*Interoperability* is the act of making a new product or service work with an existing product or service”. The tech market has moved further and further away from interoperable standards in favor of vendor-lock-in or “silos” over the last decade.

I’ll discuss file hosting services to explain the problem with the lack of interoperable standards and argue for the need for legislation to ensure such interoperability.

Let’s look at this app-integration with commercial file hosting providers targeted at consumers as an example. The big players in this space are Microsoft OneDrive, Google Drive, Apple iCloud, and Dropbox. There are dozens of more actors in this space.

It’s common for all sorts of apps to integrate with one or more of these services to offer app-specific synchronization features. This is used to synchronize to-do lists, documents, and other app-specific data. A few large developers offer their own hosting services. However, many smaller app developers don’t want to take on the role of a file hosting provider. Instead, they build-in the option to synchronize using a third-party service.

These file hosting service providers all offer the same core service: file management, hosting, and synchronization. However, each one of them has different application programming interfaces (API) requiring custom code for an app to integrate with each one. The operations these APIs provide are mostly the same: upload, move, delete, list files, etc.

The service providers also require third-party developers to get an API access-token before their apps can interact with their services. These tokens that require the permissions of the service providers assert undue control over the market in ways that limit what their customers can do with their services.

The current state of things limits consumer choices and consolidates market power with a few big service providers. Supporting a new cloud storage provider adds development and testing complexity and cost, which is a limiting factor and a burden for third-party application developers.

You may have noticed that many of your favorite apps on PC and mobile only support one or maybe two cloud hosting providers. Hopefully, they support yours, or you’ll need to sign up for yet another cloud storage service.

In the late 1990s and early 2000s, tech companies and communities worked together on open and interoperable standards. The norm was to build programs and services around these standards.

One such standard was WebDAV. You may not have heard about it, but many services you’re likely using every day are built on it. It’s a standard protocol extension for HTTP for editing and revision-versioning remote files. You can think of it as a standard API for file hosting services that cover all the basic file management operations. It’s built on XML so service providers can innovate and expand on its core functionality.

WebDAV critically supports client configuration auto-discovery. this means the user would just need to type “yandex.com” into the app and the app can auto-configure itself and bring up the login screen for Yandex.Drive.

Every cloud storage provider could support this one standard interface and it would be a lot easier for apps to add cloud support. This would also make its storage service more valuable to its customers.

It would also benefit consumers who’d suddenly have a lot more apps work with their cloud storage provider of choice. They could migrate from one to another and just assume that all their apps will interoperate with their new provider.

Businesses, organizations, and enthusiasts could self-host their own Dropbox alternatives. There are at least 50 different but interoperable WebDAV servers available on GitHub alone. This would also make it much easier for a company to break into the market and compete with the established providers.

Open standards and protocols aren’t enough to ensure service interoperability, however. Service providers must actually implement and offer them to consumers. CalDAV and CardDAV — extensions of WebDAV — are the most common protocols used for synchronizing calendar and contact data.

Windows 10 has implemented the CalDAV and CardDAV standards but [limits which providers get access to them](https://www.ctrl.blog/entry/windows-pim-sync-partnersonly/). It presents customers with a list of service providers (all but one uses CalDAV and CardDAV) that customers can pick and choose from. You’re locked out of using calendar and contacts features unless your service provider is on the list.

This is another example of how a large service provider abuses its market position to pick and choose winners in the market. The large platforms grow ever larger and more capable, while the competition falls further and further behind. It also shows how the market has failed to deliver adversarial interoperability and limits consumer choice.

“\[[Adversarial interoperability](https://www.eff.org/deeplinks/2019/10/adversarial-interoperability?ref=ctrl.blog) is\] when you create a new product or service that plugs into the existing ones without the permission of the companies that make them”. as Cory Doctorow so elegantly puts it.

So, what could interoperability legislation look like? Legislation shouldn’t decree one specific protocol or standard — like WebDAV — for any given task. WebDAV is used as an example in this article but it may not be the right answer even for the use cases it solves. Legislating specific technologies would stifle all innovation.

Legislation should instead set requirements for services to be interoperable with other services operating in the same domain. Email services should be compatible with other email services, messaging services should be compatible with other messaging services, etc.

Article 20: Right to data portability of the EU’s General Data Protection Regulation (GDPR), require customer data be made portable between services. The media has mostly focused on the privacy and data-export aspects of the GDPR. However, service providers are required to enable direct data-transfer from its platform to that of a competitor. The GDPR doesn’t state exactly how this is supposed to work but requires services to use a “structured, commonly used, and machine-readable format\[s\]”.

This means it’s an EU consumer-right to have Facebook transfer their Instagram photos directly into your Flickr or another photo hosting service. It’s not enough to just enable customers to export your photos and manually re-upload them to the competing service. It’s the service providers’ job to facilitate that data transfer.

The proposed Augmenting Compatibility and Competition by Enabling Service Switching Act of 2019 (ACCESS Act) is a US attempt at introducing more interoperability in the market through legislation. It borrows some familiar language from the GDPR and requires that service providers must enable data transfer to competing services “in a structured, commonly used, and machine-readable format.”

The ACCESS Act goes farther than the GDPR’s data portability requirement and it has some good ideas on interoperability. However, it doesn’t go far enough. It’s limited to “communications services” with 100 million US customers that monetize by selling user data. It doesn’t apply to commercial services that charge consumers upfront. It should apply to more types of service providers regardless of how they earn money.

It’ll be interesting to see whether the US or EU will implement interoperability legislation in the coming years. In my opinion, it’s a better alternative to foster competition than to use anti-trust laws to break up the large tech companies. That may still prove to be necessary to reshape the marketplace in a way that allows for more competition, but should not be the first or only attempted fix.

#### Sources

- [Augmenting Compatibility and Competition by Enabling Service Switching Act of 2019](https://www.congress.gov/116/bills/s2658/BILLS-116s2658is.xml?ref=ctrl.blog), 2019-10-22, Bills, 116th CONGRESS, U.S. Congress
- [Adversarial Interoperability](https://www.eff.org/deeplinks/2019/10/adversarial-interoperability?ref=ctrl.blog), 2019-10-02, Cory Doctrow, Deeplinks, EFF
- [REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679&from=EN&ref=ctrl.blog), 2016-04-27, The Official Journal of the European Union, EU Parliament and EU Council
### FreeStyle Libre Reader device versus the LibreLink app
URL: https://www.ctrl.blog/entry/freestyle-libre-reader-vs-app/
Last updated: 2026-08-23T22:07:37.000Z
I’ve used the [FreeStyle Libre 2](https://www.freestyle.abbott/?ref=ctrl.blog) (“FreeStyle Libre 14-days” in some regions) flash glucose monitoring system for a year. The system can get up to eight hours of glucose readings by scanning an NFC sensor installed on the back of your upper arm. I’ve previously shared my experiences on [what it’s like to wear the sensor](https://www.ctrl.blog/entry/freestyle-libre2-wear/) (with photos of the Libre Sensor.)

I want to discuss the pros and cons of using the dedicated FreeStyle Libre 2 Reader device versus an NFC-capable smartphone. The Reader has a big NFC antenna and can easily pick up the signal from the sensor. Some phones have [tiny short-range NFC antennas](https://www.ctrl.blog/entry/nokia-7plus-nfc/) that make scanning the sensor a pain. Your experiences using either device should be similar assuming your phone has an okay NFC-antenna.

You need to install the FreeStyle LibreLink app (Android or iOS versions available) to scan the FreeStyle Libre Sensor. Abbott ships different versions of the app in different regions to comply with different regulatory requirements. I’ve been using the Norwegian edition of the Android version of the LibreLink app. Your experience and feature availability in other regions may vary wildly.

Both the reader and LibreLink app give you glucose level trends along with your current glucose level. You also get historical graphs and daily averages. My one big complaint about the app is that you can’t zoom and pan the graphs. It feels natural to do so but it’s not supported. This limitation is more understandable on the less capable Reader. The app is well designed compared to something like the [Contour Diabetes app](https://www.ctrl.blog/entry/contour-next-one-bluetooth/).

Both your smartphone and Reader can also receive glucose level alerts over Bluetooth transmitted by the Sensor. This has some [potential privacy implications](https://www.ctrl.blog/entry/freestyle-libre2-ble-privacy/) but can be a literal life-saver and help you better maintain your glucose levels.

I sleep better at night knowing it will set off an alarm if my glucose levels dip to critical levels while I sleep. It may admittedly be a bit annoying to be woken up to deal with high glucose levels. However, I’ll feel better the next day having corrected high levels early than if I’d gotten a bit more sleep with the high levels.

That being said, the critical level alarms aren’t completely reliable. You can enable an option in the Reader or app that will alert you every time they lose contact with the Sensor. You *don’t want this option enabled!* It goes off all the time even when your phone or the Reader is less than a meter apart.

It can sometimes take up to an hour after glucose levels have left the target range before the alarm triggers. Both the app and Reader will annoyingly trigger the alarm even if you just scanned and got a low or high reading less than 20 seconds earlier.

The alarms don’t go off if you’ve set your phone to silent or do-not-disturb mode. Your phone may automatically enable silent mode at night to help ensure you get fewer notifications and more sleep. You may be able to configure the alerts from the LibreLink app as critical. Depending on your phone model and settings, this may let the app bypass silent mode.

This limitation is probably the best reason to use the Reader instead of the app. You can technically silence the alarms on the Reader too, but you’d never venture into the menus to turn it off as you might do with your smartphone. You can’t accidentally silence it by holding the volume down button pressed for five seconds like you can on Android, either.

**Update** (2020-02-13): LibreLink version 2.4.0 for Android includes a work-around for triggering alarms when the device is in do-not-disturb mode. However, it isn’t enabled by default and it requires you to dig deep into system settings. It also doesn’t work if the phone is set to silent mode.

On Android, you may run into problems if you’ve got other NFC-capable apps installed on your phone. For example, the Samsung Health app will conflict with the LibreLink app. You’ll get the dialog shown below every time you scan the sensor.

![Android NFC action confirmation dialog](https://cdn.synaps.media/control/content/images/2026/08/android-complete-nfc-action-abbott-librelink-samsung-health.png)

Android dialog prompts for which NFC-capable app to use.

You can’t see the dialog when you hold it up to the back of your arm, however. You need to look at the phone, choose the LibreLink app, and then rescan your sensor. Opening the LibreLink app before you scan the Sensor *sometimes* skips the dialog but not every time.

You’ll need to uninstall other NFC-capable apps to work around this problem if you’re not really motivated to deal with the dialog.

The Reader is easier to use because you just turn it on and hold it up to the sensor. The NFC antenna is located at the top of the reader. This design makes it slightly easier to use compared to most phones that place the antenna at the center-back.

The main reason you’d want to ditch the Reader in favor of just using your phone is that it’s impractical to carry multiple devices. My insulin pump, phone, keys, and wallet already take up all the space in my pockets.

I wrote the following in an early draft of this article: “using my phone for scanning is a disaster waiting to happen”. A month ago, I dropped my phone while trying to scan the sensor. I was wearing a winter jacket and the sensor and I had to stretch my arm a bit awkwardly to scan it. (Low glucose levels didn’t help the situation.) The phone landed display-first on a pebble, and I ended up having to replace it.

The reader device is about 75 Euros and is far cheaper to replace if you drop it compared to a smartphone! The technical specifications for the Reader say its expected lifetime is three years.

The Reader weighs just 65 grams. It’s so much lighter than I expect so I’ve thrown it across the room a couple of times when I’ve picked it up from the table. I just expect it to be heavier.

Abbott promises “up to 7-day battery” on the Reader. In my experience, it only lasts two–three days. Engineering schematics of the Reader shows there is room for a higher capacity battery. I wish Abbott had decided to not cheap out on the battery capacity.

The LibreLink app can send your glucose readings to lets you share readings with “up to 20 people” who install the FreeStyle LibreLinkUp app and link it to your LibreLink app. Availability varies by country.

I’ve written this comparison from the perspective that you must make a choice between either the LibreLink app or the Reader. However, you can use both at the same time with the same Sensor!

If you activate a Libre Sensor with the Reader, you can then also read from it with the LibreLink app. Only the Reader will receive notifications, however. You notably can’t use the Reader if you’ve activated the Sensor using the app. (This limitation makes no sense to me!)

You can even scan the Sensor with multiple paired LibreLink apps if you’ve got multiple smartphones or tablets. This turned out to be useful when I trashed my phone and needed to replace it. I didn’t need to replace the Sensor to pair it with the new phone. It can also be useful for anyone who has one or more guardians or partners that want to (mostly unobtrusively) take their glucose readings.

The Reader and app doesn’t sync data between each other, however. Neither does the LibreLink app between different devices even when you’ve logged in to the same account. You need to scan with both devices every 8-hours to maintain the graphs and trend data.

I tend to leave the Reader at home and bring it into the bedroom at night. As discussed earlier, the app isn’t as reliable as the Reader when it comes to delivering alerts. I can still scan my glucose levels using my phone when I’m out and about. I clearly didn’t learn from dropping my phone while scanning on the go. I don’t need to bring the Reader with me everywhere I go, at least.

**Update** (2021-07-22): I haven’t used the FreeStyle Reader for the last year. I don’t miss it and I get by fine using just the LibreLink app on my Android smartphone.

I’m happy with the FreeStyle Libre system overall. It could be better and there is plenty of room for improvement. However, it’s a huge improvement over doing multiple finger-prick blood tests every day.

#### Sources

- [Abbott Glucose Monitoring System READER construction design certification](https://web.archive.org/web/20200125052545/https://www.tele.soumu.go.jp/giteki/SearchServlet?pageID=jg01%5F01&PC=005&TC=N&PK=1&FN=191217N005&SN=%94%46%8F%D8&LN=8&R1=%2A%2A%2A%2A%2A&R2=%2A%2A%2A%2A%2A), 2019-09-25, The Radio Use Website, Telecommunications Bureau of Japan
- [FreeStyle Libre Reader](https://web.archive.org/web/20181205034420/https://www.freestylelibre.com.au/glucose-monitoring-system/monitor#specifications), 2018-09, FreeStyle Libre website, Abbott Diabetes Care Australia
### Smarter reusable IPFS chunks from HTML documents
URL: https://www.ctrl.blog/entry/ipfs-html-chunks/
Last updated: 2026-08-23T22:12:08.000Z
The InterPlanetary File System (IPFS) is a BitTorrent-like protocol for the peer-to-peer [distributed web](https://www.ctrl.blog/entry/the-dweb/). IPFS splits large files into small chunks. IPFS clients can fetch chunks from anyone on the IPFS network that has that exact same chunk.

Older peer-to-peer implementations like BitTorrent arrange its peer swarms around file sets (“torrents”) that exchange chunks with each other. This means that peers don’t exchange data with each other between different torrents even if the chunks are identical. Chunks on IPFS is globally deduplicated and exchanged.

I discussed how IPFS stores files in more detail in my article on how [IPFS hosting services overcharge for duplicated chunks](https://www.ctrl.blog/entry/ipfs-pin-storage-accounting/).

IPFS currently uses a size-based chunker. Files are split into chunks of 256 kilobytes. You generally don’t want your file chunks to be too small for performance reasons. It takes more time and overhead to download more chunks.

When you change one bit of data it changes one file chunk. However, adding a single bit at the beginning of the file changes every chunk since the offset from the beginning of the file changes for the entire file.

IPFS is planning to migrate to a smarter rolling-hash based chunker in a future version. However, I’d like to discuss the possibility of using an even smarter chunking logic for HTML documents.

A webpage consists of a HTML document file plus assets such as style, scripts, and images. Loading these external assets over the traditional HTTP/1.1 protocol introduces lookup and transfer latency-overhead that reduces page-load performance.

Fetching files and chunks from IPFS has a higher performance cost than HTTP/1.1\. The majority of the cost comes from the additional overhead involved in locating peers who has the exact chunk you want.

HTTP supports asset caching which can remove the need to repeatedly fetch the same asset again from the same server. As mentioned briefly above, IPFS chunks are globally deduplicated. Clients can cache chunks and reuse them much the same way HTTP caching works. The more peers share a specific chunk the higher its availability in the network gets.

Over time, web developers developed best practices for improving page load performance. One such pattern involves inlining critical resources. such as render-blocking stylesheets and scripts. into the HTML document itself. This made the HTML documents bigger and subsequently page visits didn’t benefit from these resources already being cached in the client.

A quick aside: You should not inline resources over HTTP/2! Use [Server-Initiated Push](https://www.ctrl.blog/entry/http2-push-redirects/) instead.

The average HTML document is unlikely to exceed 256 kilobytes. It will comfortably fit in one IPFS chunk. However, you’ll still need to fetch extra chunks to load the external resources. This is where we can do something clever with the resource-inlining method that was popular with HTTP/1.1.

You can split file chunks at arbitrary points in a file. You can split your HTML documents immediately after the opening `<style>` element and again immediately before the closing `</style>` element. In a simplified example below, you’d end up with three chunks: the top part of the HTML document, a reusable stylesheet chunk, and then the remainder of the document.

```html
<!doctype html>
<html>
 <head>
  <title>Example Doc</title>
  <style>
   body {color:inherit}
   h1 {text-align:left}
  </style>
 </head>
 <body>
  <h1>Example Doc</h1>
 </body>
</html>
```

An example HTML document. Ideal chunks would be placed right after the opening and before the closing of the `style` element.

From IPFS’ perspective, the stylesheet chunk from inside the HTML page would produce a chunk that would be indistinguishable from the same stylesheet saved in a CSS file. It’s the same chunk whether you load it into the document as an external chunk or embed it into the document itself. The chunk can still be cached in the client and reused in all your HTML documents.

Crucially, your IPFS client will discover the chunk much earlier when its part of the document than if it first needs to fetch the HTML document and then discover the external dependencies.

You can make changes the stylesheet without making changes to the two other chunks in the document chunks. (Reminder: IPFS chunks are immutable.) Clients that have cached and share an older version of the document can still contribute useable chunks to readers of the updated version.

This method can be used with other reusable chunks from your HTML documents of embedded data. Embedded `template`, `script`, `style`, and `svg` elements are good candidates.

You can also chunk your documents around content you expect to update often, e.g. splitting out a Related or Recent articles widget on a blog in a chunk of its own.

You don’t want to overdo the chunking, however. Too many or too small chunks will badly hurt performance. You can still make good use of smaller chunks when its done sparingly and at the right places in the file.

Inlining external dependencies also nicely works around IPFS chunk addressing limitations in the current web browser implementations of IPFS. You’ll often come across webpages without working styles, images, and script when you browse the IPFS distributed-web. I’ll not go into details here, but let me just say that it was a bad idea to try to replace URLs — a cornerstone component of the web platform — with IPFS NURLs.

This is all just an intriguing concept at this stage. You can achieve custom chunking through object manipulation in the `go-ipfs` reference client. It’s not easy but it’s doable. Better tooling would be required for this and other content-boundary-aware chunking strategy to see any adoption.
### systemd service sandboxing and security hardening 101
URL: https://www.ctrl.blog/entry/systemd-service-hardening/
Last updated: 2026-08-23T22:23:10.000Z
`systemd` enable services to run with a whole suite of hardening and sandboxing features from the Linux kernel. Here’s how to get a quick security review of the services running on your system and how to go about hardening their security.

The Linux kernel can filter and limit access to file systems, networks, devices, kernel capabilities and system calls (syscalls), and more. In this article, I’ll focus on sandboxing access to the file system as a simple introduction to `systemd` service security hardening.

The `systemd` service security review tool was added in version 240 (released in December 2018.) You’ll need to be running that or a later version to follow along with this article.

### Security overview of `systemd` services

Run the `systemd-analyze security` command to get a security audit of all your `systemd` services. It will list each service unit and give them a security exposure score rating from 0–10\. Lower scores are more secure.

UNIT             EXPOSURE PREDICATE
atd.service           9.6 UNSAFE
crond.service         9.6 UNSAFE
httpd.service         9.2 UNSAFE
mariadb.service       8.8 EXPOSED
sshd.service          9.6 UNSAFE

The exposure score is entirely based on a service’s utilization of security features provided by `systemd`. It doesn’t consider security features built-in to the program or enforced by access control policies like Security-Enhanced Linux (SELinux) or AppArmor. Nor does the score in any way evaluate the risk factors of a program or its configuration.

In the above example, you’ll notice that task scheduling daemons like `atd` and `crond` and the remote terminal access daemon for `sshd` are considered to be unsafe. That’s an accurate assessment as these services are designed to allow unrestricted execution of arbitrary commands. You may want to disable these services entirely unless you need them.

You can also see that the `httpd` (Apache HTTP Server) service has a slightly lower score. This is because Fedora Linux, which is the distribution I use, ships its `httpd` service unit with a few `systemd` security directives enabled by default. Let’s look at how to review a service’s security directives next.

### Analyze a service’s security directives

You should start by analyzing any service that is exposed to the public internet or deal with untrusted/user-provided data. These services will benefit system security the most from being sandboxed. We looked at the Apache web server earlier, so let us stick with that example.

Run the `systemd-analyze security httpd.service` command to generate a report of the security directives applied to the `httpd.service`.

As of version 233, there are 77 tests in the security review. Below, I’ve included a small selection of test results that focus on file system access.

  NAME                   DESCRIPTION                                          EXPOSURE
✗ PrivateDevices         Service potentially has access to hardware devices        0.2
✓ PrivateTmp             Service has no access to other software's temporary files
✗ ProtectControlGroups   Service may modify to the control group file system       0.2
✗ ProtectHome            Service has full access to home directories               0.2
✗ ProtectKernelTunables  Service may alter kernel tunables                         0.2
✗ ProtectSystem          Service has full access to the OS file hierarchy          0.2
✗ RestrictSUIDSGID       Service may create SUID/SGID files                        0.2
✗ RootDirectory          Service runs within the host's root directory             0.1
…
→ Overall exposure level for httpd.service: 9.2 UNSAFE

We can see that Apache HTTP Server is restricted to its own sandboxed temp directory and that it doesn’t have access to the system `/tmp` directory. This is a default policy for `httpd` on Fedora Linux. You may get different results in your Linux distribution of choice.

The test results show us that our web server could definitively be configured to be more secure. There’s a lot of room for improvement, depending on your Apache HTTP Server configuration. Your web server probably doesn’t need write-access to most locations in your file hierarchy. It probably doesn’t even need read-access.

Let’s move on to tightening the security of the `httpd.service`.

### Service unit security hardening

Run the `systemctl edit httpd.service` command to make changes to the `httpd` service unit. This will open a text editor where any change you make will override the service’s default directives. (It will use your default text editor as specified in the `EDITOR` environmental variable.)

The following is an example service unit override that addresses some of the points identified in the above security review. Please refer to the [systemd.exec man page](https://www.freedesktop.org/software/systemd/man/systemd.exec.html?ref=ctrl.blog) for extensive documentation on each directive.

```ini
[Service]
PrivateDevices=true
ProtectControlGroups=true
ProtectHome=true
ProtectKernelTunables=true
ProtectSystem=full
RestrictSUIDSGID=true
```

Save this to the override file, run the `systemctl daemon-reload` command to make `systemd` aware of the changes, and finally `systemctl restart httpd.service` to make the changes take effect. You should see about 2 points improvement if you re-run the service security directive testing.

You now need to do extensive testing to ensure that everything still works as expected. You’ve put in place restrictions that the program was never designed to run under. It or programs you run on top of it may misbehave under these conditions. You may need to grant it access to specific files or directories. Let’s look at how you do that.

If something breaks with the above configuration, it might suggest that you’ve tasked your web server to do something potentially risky.

### Further locking down access

The `ProtectSystem=full` directive makes the `/boot`, `/etc`, and `/usr` directories read-only. This will prevent a compromised program from interfering with system configurations. However, a compromised program can still read and copy sensitive data such as your Let’s Encrypt certificates from the `/etc/letsencrypt` directory.

You can block access to specific directories by adding them to the `InaccessiblePaths=-/etc/letsencrypt` directive. You can specify multiple paths separated by space characters. Any file or directory under that path in the file hierarchy will be made inaccessible. The minus in front of the path tells `systemd` not to raise an error if the path doesn’t exist at runtime.

The `InaccessiblePaths` directive combined with the ones from the above example can be used to effectively prevent different processes from getting at each other’s data. You may not want to maintain a white-list per service. However, you should at least set up a block-list of sensitive locations and make them inaccessible to every other service.

You can take it one step further and manually specify `ReadWritePaths`, `ReadOnlyPaths`, and `InaccessiblePaths`. A utility like `[strace](https://strace.io/?ref=ctrl.blog "strace project home page") -e trace=%file program` can help you identify what paths a program requires. Requirements will change over time so a setup like this requires ongoing monitoring.

You can go even further and change the root directory with the `RootDirectory` directive. This works like the traditional `chroot` command and lets you set up a mock file system and launch the service inside it.

### Conclusions

`systemd` can offer extra protections for your custom services as well as services shipped by your Linux distributed. Your Linux distributions may ship services with little or no protections. Security needs differ from installation to installation so it’s up to the system administrator to enable security protections.

You can quickly strengthen your system security by deploying some of the standard sandboxing directives. It may just be the thing that saves your organization from having a compromised service turn into a security nightmare.

Read on to part two for a [tutorial on more advanced systemd security directives](https://www.ctrl.blog/entry/systemd-opensmtpd-hardening/).

#### Sources

- [systemd-analyze](https://www.freedesktop.org/software/systemd/man/systemd-analyze.html?ref=ctrl.blog), version 244, 2019-11-29, man pages, systemd project, FreeDesktop.org
- [systemd.exec](https://www.freedesktop.org/software/systemd/man/systemd.exec.html?ref=ctrl.blog), version 244, 2019-11-29, man pages, systemd project, FreeDesktop.org
- [systemd 240 released](https://lists.freedesktop.org/archives/systemd-devel/2018-December/041852.html?ref=ctrl.blog), 2018-12-21, Zbigniew Jędrzejewski-Szmek, systemd-devel mailing list, FreeDesktop.org
### .blog vs .com TLD performance
URL: https://www.ctrl.blog/entry/dotblog-tld-performance/
Last updated: 2026-08-23T22:05:20.000Z
BunnyCDN shared some [interesting performance benchmarks](https://bunny.net/blog/is-your-fancy-new-domain-hurting-your-performance-gtld-benchmark/?ref=ctrl.blog) of the name servers responsible for some generic top-level domains (gTLD). The content delivery network (CDN) provider measured Domain Name System (DNS) response times from 50 locations around the world.

I’m using a .blog domain for this website. Unfortunately, this gTLD is placed near the bottom of the list. Ouch. There’s nothing I can do to improve the situation other than to complain publicly. So, here I go!

I recreated a smaller version of their experiment for the .blog and .com gTLDs. I don’t have a content distribution (CDN) network with 50 points of presences around the globe to test from.

However, I do have a RIPE Atlas test probe. It enables me to run a quick test like this from 11 000 locations around the world. I settled for recreating BunnyCDN’s tests from 300 locations, however. You can see the results from my test in the footer and [the graph](https://cdn.synaps.media/control/content/images/2026/08/dotblog%5Fdotcom%5Ftld%5Fperformance.png?ref=ctrl.blog) at the top of this article.

The median resolution time for .com is 17 milliseconds versus 57 ms for .blog. That means .blog is 2,3 times slower. The .com gTLD responded to 85 % of all queries in 55 ms compared to 188 ms for .blog. That makes .blog 2,4 times slower.

BunnyCDN benchmark and my benchmark compared

|            | .com  | .blog |        |        |
| ---------- | ----- | ----- | ------ | ------ |
| 50 %       | 85 %  | 50 %  | 85 %   |        |
| BunnyCDN   | 41 ms | 91 ms | 122 ms | 176 ms |
| My figures | 17 ms | 57 ms | 55 ms  | 188 ms |

Both sets of figures are a snapshot in time from different locations under different local and global network conditions. They’re expected to be a bit different. The take-away is clear: the .com gTLD is 2–3 times faster than the .blog gTLD.

### So, what’s going on with .blog?

The .blog gTLD is owned by Knock Knock WHOIS There LLC; a subsidiary of Automattic Inc. This is interesting because WordPress.com, another Automattic subsidiary, operates the second-fastest authoritative name servers in the world, according to DNSPerf by PerfOps.

However, the .blog gTLD doesn’t share backend infrastructure with WordPress.com. Instead, it’s outsourced to a gTLD management service company called CentralNic Group PLC. You’ve probably never heard of the company before. However, you might recognize some of the other gTLDs it operates: .best, .design, and .xyz.

If you don’t recognize these gTLDs, then go and have another look at the bottom of the list in [BunnyCND’s benchmarks](https://bunny.net/blog/is-your-fancy-new-domain-hurting-your-performance-gtld-benchmark/?ref=ctrl.blog). You’ll find all of them near the bottom. It would seem that this service provider doesn’t focus on performance.

### Do these tiny numbers even mean anything?

Google requires a webpage to load in [1 second or less](https://web.archive.org/web/20200107151110/https://support.google.com/webmasters/answer/9205520#status%5Fexplanation) to receive a “fast” rating. This performance rating directly impacts a website’s ranking in the company’s search result pages.

Your TLD’s name servers are completely outside of your control. They still impact your site’s performance, however. To put the numbers in context, the .blog gTLD’s 122 ms median time is 12,2 % of the total page-load time budget.

In retrospect, maybe I should have kept using my old .com domain instead of [switching to .blog](https://www.ctrl.blog/entry/rebrand-ctrlblog/). I strongly prefer the new .blog domain, but these performance metrics are worrying.

### Conclusions

If you have a domain zone configured for long-lived DNS caching and a high volume of lookups, you don’t need to worry about this issue. Anyone falling outside this category should stop worrying too: There’s nothing you can do about it other than migrating to a different TLD.

You may want to avoid registering any new domains under [TLDs operated by CentralNic](https://www.mojeek.com/search?q=site%3Aiana.org%20%22Domain%20Delegation%20Data%22%20%22CentralNic%22&ref=ctrl.blog), however. As I said above, it don’t seem to focus on performance. Or, maybe it simply doesn’t operate on a scale that allows it to deliver it.

As a .blog domain registrant, I can only hope that Knock Knock WHOIS There will switch to use the same infrastructure as WordPress.com.

#### Sources

- [Measurement 23766875](https://atlas.ripe.net/measurements/23766875/?ref=ctrl.blog), 2020-01-06, RIPE Atlas, RIPE NCC
- [Measurement 23766833](https://atlas.ripe.net/measurements/23766833/?ref=ctrl.blog), 2020-01-06, RIPE Atlas, RIPE NCC
- [Benchmarking the top-level domain names](https://bunny.net/blog/is-your-fancy-new-domain-hurting-your-performance-gtld-benchmark/?ref=ctrl.blog), 2019-12-20, Dejan Grofelnik Pelzel, Blog, BunnyCDN
### Make AdSense faster with preconnect
URL: https://www.ctrl.blog/entry/adsense-performance-preconnect/
Last updated: 2026-08-23T22:01:09.000Z
I’ve previously discussed [when to use <link rel="preconnect">](https://www.ctrl.blog/entry/dns-prefetch-preconnect/) and how it’s often used incorrectly. I thought I’d give a more concrete example with Google AdSense.

AdSense is deployed on almost 12 million websites, according to [BuiltWith](https://trends.builtwith.com/websitelist/Google-Adsense?ref=ctrl.blog) figures for December 2019. Yet, only 352 websites out of the top 1 million websites deploy this optimization, according to a crawl of the [Tranco list](https://www.ctrl.blog/entry/tranco-popular-websites/) performed on 2019-12-29.

Google’s page-loading performance review tools, including Google PageSpeed Insights and Lighthouse, agree that Google AdSense is terrible for page-load performance. However, there is one thing publishers can do to reduce its initial impact on page-load times.

For clarification, I’m talking about the modern asynchronous AdSense script and not any of the older variants. You should first update your implementation to use the modern async variant before thinking about reading this article. Your implementation should look like this:

```html
<script async
  src="https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js">
</script>
```

As a quick reminder of what [I wrote about preconnect](https://www.ctrl.blog/entry/dns-prefetch-preconnect/): web browsers will discover the above address as part of their normal preload document scanning/pre-processing. However, 510 out of the top 1 million websites scanned still included instructions to preconnect to this domain. This is 45 % more websites than implemented the optimization properly.

### The optimization

The browser connects to and fetches the AdSense script as early as possible. However, the AdSense script then needs to connect to and fetch resources from at least five other origins. There may be additional origins required, but the following four are required globally.

These are the origins you should preconnect to:

```html
<link rel="preconnect"
  href="https://adservice.google.com/">
<link rel="preconnect"
  href="https://googleads.g.doubleclick.net/">
<link rel="preconnect"
  href="https://www.googletagservices.com/">
<link rel="preconnect"
  href="https://tpc.googlesyndication.com/">
```

**Update** (2022-05-14): If you’re using the newer Google AdSense script where the `script` element include an `crossorigin="anonymous"` attribute, then you need to duplicate all the `link` elements above with a matching attribute. (The current version of Google’s script relies on both anonymous and regular connections.) Check your browser’s developer tools to make sure all the connections get used.

In my web crawl, I only found 352 websites that implemented the above optimization. Interestingly, the majority of these websites were news websites from regions with low internet adoption.

You shouldn’t blindly implement the above pre-load list, however. You’ll need to perform periodic testing to confirm that the list is still accurate. Remember than an unnecessary preconnect negatively impacts performance.

### Why not prefetch?

The above optimization should be okay with Google AdSense’s policies. You’re not allowed to modify their ad loading in any way. However, preconnecting to the required origins just primes the browser to more quickly fulfill an expected future task. It doesn’t change the final outcome or any properties of AdSense’s ad requests.

I’d recommend against switching the `preconnect` directive for a `prefetch` directive. The latter directive doesn’t just connect to a remote origin early, it tries to fetch a specific resource from that origin.

Prefetching resources improves performance even more than preconnecting. However, that approach might interfere with the request order and cookies that AdSense requires to fulfill an ad request.

### Performance gains

The exact performance gain will vary greatly based on visitors’ network links. High-latency connections can be expected to benefit the most. This includes satellite connections, rural areas, and mobile connections in congested public areas, to name a few.

I implemented this optimization here on Ctrl blog in 2018\. I don’t record detailed precise performance metrics on individual resource-loads. I can’t say for sure what impact this had on specific resources (such as the resources used by AdSense.)

However, the mean page-load-time (including ad-loads) fell 402 milliseconds on mobile devices. It also fell 360 ms on other device categories.

Does such a small saving matter, though? Well, yes. Publishers are paid per impression. An impression requires the majority of an advert to be shown on screen for at least one second.

Google’s new performance goals as of late 2019 require pages to load and be responsive in [no more than 1 second](https://web.archive.org/web/20200107151110/https://support.google.com/webmasters/answer/9205520#status%5Fexplanation "Speed 
report, Google Search Console, Google") to be considered fast. Page load speed impacts page ranking and revenue. 0,4 seconds saved is 40 % of the total time budget!
### Use different search providers for every search with RandSearch
URL: https://www.ctrl.blog/entry/randsearch/
Last updated: 2026-08-23T22:16:09.000Z
I’ve built a small search utility to help people explore different search providers. [RandSearch](https://randsearch.daniel.priv.no/?ref=ctrl.blog) (“random search”) forwards your search queries to a randomly chosen search provider. You get different perspectives, ideas, and results with every search!

Google Search has a 92 % global market share in search, according to StatCounter GlobalStats. This gives it enormous control over what webpages and information people consume and how we all experience the world.

There are a number of different search providers on the market. However, most of them source their search results from either Microsoft Bing, Google, or Yandex. It may look like there’s a lot of options but their search results are eerily similar.

RandSearch groups search providers based on the search engine index that provides their results. It then randomly picks one provider from each group. Finally, it randomly picks one of those providers to fulfill your search.

This design is meant to highlight providers that are building independent search indexes.

Here’s a list of the search providers included in RandSearch. (See an always up-to-date list in the [privacy policy](https://randsearch.daniel.priv.no/privacy.html?ref=ctrl.blog).)

__RandSearch search providers__
| Search provider                                         | Search index | Language markets |
| ------------------------------------------------------- | ------------ | ---------------- |
| [Bing](https://www.bing.com/?ref=ctrl.blog)             | Bing         | Global           |
| [Brave Search](https://search.brave.com/?ref=ctrl.blog) | Brave        |                  |
| [DuckDuckGo](https://duckduckgo.com/?ref=ctrl.blog)     | Yandex       |                  |
| Bing                                                    |              |                  |
| [Ecosia](https://www.ecosia.org/?ref=ctrl.blog)         |              |                  |
| [FindX](https://www.findx.com/?ref=ctrl.blog)           |              |                  |
| [Lilo](https://www.lilo.org/?ref=ctrl.blog)             |              |                  |
| [Mojeek](https://www.mojeek.com/?ref=ctrl.blog)         | Mojeek       |                  |
| [Naver](https://search.naver.com/?ref=ctrl.blog)        | Naver        | Korean           |
| [Qwant](https://www.qwant.com/?ref=ctrl.blog)           | Bing         | Global           |
| [Seznam](https://search.seznam.cz/?ref=ctrl.blog)       | Seznam       | Czech            |
| [StartPage](https://www.startpage.com/?ref=ctrl.blog)   | Google       | Global           |
| [Yandex](https://yandex.com/?ref=ctrl.blog)             | Yandex       | Russia           |

The list of search providers was chosen based on [these selection criteria](https://randsearch.daniel.priv.no/providers.html?ref=ctrl.blog). The list of criteria should answer any “why isn’t Provider-X included” questions. The list of providers is updated regularly.

**Update** (2020-04-30): The Cliqz search engine has been discontinued and removed from the list.

**Update** (2021-06-22): Added Brave Search to the list. Brave acquired the search technology from Cliqz.

**Update** (2021-07-27): Removed Givero from the search provider list as it has ceased operation. 

Most web browsers require search providers to be set to an HTTPS address. However, your search queries are **not sent to RandSearch’s servers.** Your search queries are only sent to the search provider that will fulfill the search.

Your browser will periodically fetch a tiny webapp from RandSearch that handles the query forwarding and search provider selection. Everything happens locally on your device.

I’ll consider it a success if you set your web browser to use RandSearch for a week or two and then decide to switch to one of the featured search providers. However, I don’t want to be locked-in to any one search provider, and prefer to keep using different ones for every search.

I’ve thought about developing this for a long time. There’s money to be had from controlling the default search provider setting for malicious third-parties and for the browser vendors themselves. Operating systems and web browsers have become increasingly [protective](https://www.ctrl.blog/entry/osx-protect-default-browser/) of their default search provider setting.

Some of you may even remember an old browser extension I made for Opera called [Search Roulette](https://www.ctrl.blog/entry/search-roulette-extension/). It required you to prefix every search query with a dot and a space character (“`. `”) to function. I wanted to avoid that requirement for RandSearch. This is why you’re not bounced to your final destination via a webapp.

Ideally, I’d like RandSearch to read your browser’s search provider configuration and choose randomly from the installed providers. This would put you in complete control over what search providers were involved. At the same time, I also want to help promote and diversify different search providers.

[Try RandSearch!](https://randsearch.daniel.priv.no/?ref=ctrl.blog)

If there’s interest around RandSearch, I’ll add an options-page so you can pick and choose which service providers are used. In the meantime, I hope you all give it a try! Let me know what you think via the comment section linked below.

All the logos, logotypes, and names of the search providers belong to their respective owners.
### What is Samsung Secure Wi-Fi for Android?
URL: https://www.ctrl.blog/entry/what-is-samsung-secure-wi-fi/
Last updated: 2026-08-23T22:24:23.000Z
Samsung Galaxy and Note smartphones come with a pre-installed app called Samsung Secure Wi-Fi. The app can’t be uninstalled from the app manager on the device. Scroll to the bottom of the article for uninstallation instructions.

Samsung is thin on the details and doesn’t say much about what the service does. Every time you connect to a Wi-Fi network it sends you the following promotional push-notification.

![“Secure Wi-Fi helps protect your privacy on public Wi-Fi networks. Try it out now.”](https://cdn.synaps.media/control/content/images/2026/08/samsung-secure-wi-fi-notification.png)

“Secure Wi-Fi helps protect your privacy on public Wi-Fi networks. Try it out now.” Samsung Secure Wi-Fi notification licensed under [CC0 1.0](https://creativecommons.org/publicdomain/zero/1.0/?ref=ctrl.blog).

The notifications are classified as an advertisement in Android’s notification center. You can normally disable notifications from third-party apps. However, Samsung has disabled the ability to disable notifications from some of its apps including Secure Wi-Fi.

This information in the notification is repeated inside the app and is just about all the information you get. The app says you get 250 MB/month for free or pay 2 Euro/month for unlimited data. But what are you paying for if you sign-up for Samsung Secure Wi-Fi?

Samsung has jumped on the Virtual Private Network (VPN) service-provider bandwagon. A commercial VPN service, like Samsung Secure Wi-Fi, encrypts all your internet traffic and relays it through a server controlled by the company. This enables you, to some extent, to hide your internet traffic pattern among the crowd of other customers using the same server. It also gives the server operator insight into what apps and websites you visit.

I find it notable that Samsung doesn’t ever refer to Secure Wi-Fi as a VPN service. It’s consistently vague about offering “protection” and the service’s name implies it offers “security”.

You normally get a scary warning message saying all your internet traffic is routed through a third-party when you connect to a VPN service. Samsung suppresses this warning for Samsung Secure Wi-Fi; something a third-party VPN app can’t do. This is arguably an abuse of its market position as an operating system distributor.

Samsung Secure Wi-Fi connects through an IPSec tunnel — an industry standard for VPNs — using a bundled version of the StrongSwan VPN client. The backend infrastructure is managed by McAfee and provided through Google Cloud. Neither of these companies is mentioned in the service’s privacy policy even though all your internet traffic is routed through them.

Commercial VPN services offer almost no benefit to their customers. The majority of internet traffic is already encrypted. There are only a handful of use-cases where it’s still advisable to use a VPN service. VPN service sales are driven by fear-based marketing and meaningless marketing terms like “military-grade encryption.”

You can configure the Samsung Secure Wi-Fi app to automatically connect to the service whenever you connect to an untrusted Wi-Fi network. The app lets you opt-in to sharing your location data with Foursquare to unspecifically improve this portion of the app. As far as I can tell, doing so makes absolutely no difference to how the app operates.

In my testing, it took about one minute from you connected to a Wi-Fi network before the VPN service is turned on. I’ve also experienced the app just not turning on at all after connecting to an unencrypted and untrusted network. The app fails to live up to its promise to protect my device.

You can exclude certain apps from being routed through Samsung Secure Wi-Fi. By default, Samsung excludes YouTube, Google Drive, Google Photos, Galaxy Store, and Google Play Store. These are all data-heavy apps that use encrypted connections to their respective backend services.

You can uninstall Samsung Secure Wi-Fi if you want to get rid of it. You’ll need to set your device in Developer Mode and issue a few special commands to it from your computer. Follow this [bloatware removal tutorial](https://www.xda-developers.com/uninstall-carrier-oem-bloatware-without-root-access/?ref=ctrl.blog). The Secure Wi-Fi package is called `com.samsung.android.fast`.

Samsung Secure Wi-Fi should not be confused with Samsung Max (formerly Opera Max). The two apps and services are completely unrelated despite the similar name and parent company connection.

#### Sources

- Samsung Secure Wi-Fi app, version 5.1.00.15, 2019-11-28, Samsung Electronics
- [McAfee and Samsung Extend Partnership to Secure Galaxy S10 Smartphones](https://web.archive.org/web/20191230232138/https://www.mcafee.com/enterprise/en-us/about/newsroom/press-releases/press-release.html?news%5Fid=20190225005396), 2019-02-24, Press release, Newsroom, McAfee
- [How to Uninstall Carrier/OEM Bloatware Without Root Access](https://www.xda-developers.com/uninstall-carrier-oem-bloatware-without-root-access/?ref=ctrl.blog), 2017-07-13, Dough Lynch, XDA Developers
### How to format code blocks for narrow screens
URL: https://www.ctrl.blog/entry/mobile-code-blocks/
Last updated: 2026-08-23T22:14:35.000Z
You’ll need to break with programming conventions and language style guides to make blocks of code fit on mobile. Making preformatted code blocks fit on narrow screens is an under-appropriated art form.

Code is usually presented in wide preformatted blocks which are set in a fixed-width font with a significant amount of indentation whitespace. These blocks don’t always fit within the available space in page layouts on PCs. They often require horizontal scrolling or are scaled down to unreadable font sizes for mobile.

So, what can you do about your code blocks to make the experience better for mobile readers?

In this article, I’ll focus on mobile screens and ignore ultra-narrow screens like smartwatches. Pixel sizes throughout this article are screen-resolution-independent and use the CSS measurement definition of a pixel (96 pixels equals 1 inch) rather than using physical device pixels.

### Less than half the traditional character per line (cpl) limit

For historical reasons dating back to code written on punch cards in the 1920s and carried on through terminal-screens from the 70s; programming style guides and editors set the line-length to 80-characters per line (cpl) or less. You’ll find this enforced today in the Style Guide for Python Code (PEP 8), the Ruby Style Guide, and many others.

However, you’re not going to fit up to 80-characters of a fixed-width font face onto a mobile screen and maintain a readable font size. You can at most fit 32 characters at a comfortable 18 px font size on a 360 px wide display (including a 10 px margin at either side). This is one of the most common mobile resolutions and also the smallest one.

You can fit in 64 characters if you ask your readers to flip their phones horizontally. They’ll surely resent you for asking and interrupting their reading. There are still many phones on the market, even new ones, that have square displays.

You can make a fluid preformatted code block that reflows to fit within the character limits for narrow (mobile portrait), medium (mobile landscape/tablet), and large displays like PCs. You likely have to do this yourself as there are no automated tools for the job.

At this point, advanced CSS-stylists may be thinking of CSS rulesets like `white-space: pre-wrap; word-break: break-word;`. However, this method won’t handle indentation levels and would break lines in inopportune places.

Instead, you’d need to invest the time to manually wrap segments of code at opportune places in a `display: inline-block;` elements. Your style sheet (probably aided by JavaScript) would need to apply proper levels of indentation to wrapped lines. This would be a time-consuming process.

### Horizontal scrolling

You’ll want to avoid relying on horizontal scrolling to present your code blocks. Horizontal scrolling hides potential information by pushing it off on an unexpected axis. The reader expects to find reveal more content by scrolling the document vertically. Many browsers also hide scrollbars by default, so the reader doesn’t have a visual hint that there will be more content off to the side.

Long line-lengths with horizontal scrolling makes it harder to find your place on the next line of text (the “return sweep.”)

Horizontal scrolling can be unavoidable in situations where unbreakable long strings are expected, e.g. URLs, file paths, or long function names. Make sure you include hints in your design so readers will notice that there’s more content off to the side.

### Indentation

Always indent using two space characters instead of a tab character. A tab-character is eight spaces by default. This is valuable space that you can’t afford to waste on a tight characters-per-line budget.

Disregard your preferred indentation style or the conventions of the language. The only times you want to use a tab character if it’s a significant character in your code block.

There is some hope for you still if you insist on using tab characters rather than spaces. The CSS property `tab-size` can be used to redefine the length, e.g. `tab-size: 2;` to make a tab character two spaces wide. However, browser support is limited.

### Conclusions

You either need to spread your resources thin and format three separate code blocks for mobile, tablets, and large screens. Alternatively, you cam choose to focus on the mobile web.

You’re limited to 32 cpl and conservative use of indentation. Also, make sure you test both your design and your content on mobile.

#### Sources

- [Mobile & Tablet Screen Resolution Stats Worldwide](https://gs.statcounter.com/screen-resolution-stats/mobile-tablet/worldwide/?ref=ctrl.blog#monthly-201811-201911), 2019-11, GlobalStats, StatCounter
- [80 Characters per Line Is a Standard Worth Sticking to Even Today](https://nickjanetakis.com/blog/80-characters-per-line-is-a-standard-worth-sticking-to-even-today?ref=ctrl.blog), 2018-06-05, Nick Janetakis, Blog
### Firefox contained in Flatpak vs Snap comparison
URL: https://www.ctrl.blog/entry/firefox-linux-flatpak-snap/
Last updated: 2026-08-23T22:06:49.000Z
The Linux desktop has seen great advances in desktop app containerization and process-isolating sandbox-technologies. Keeping programs from getting hold of each other’s environments and files can greatly improve security if something where to go wrong with a program. Flatpak and Snap are the two leading implementations on the desktop.

I’ve previously praised the added security I get when [playing Steam games inside a Flatpak container](https://www.ctrl.blog/entry/linux-steam-sandboxing/). I’m overdue to extend that added layer of protection to the web browser. I believe I’ll sleep better at night knowing there was an additional security layer between my web browser and the rest of my system.

To this end, I wanted to compare the current versions of Firefox Flatpak and Firefox Snap on Fedora Linux 31\. Due to the nature of containerized apps, you can expect my experiences to translate to other Linux distributions.

I’ll test Firefox 71 from the Fedora Flatpak repository, and Firefox 71 stable from the Canonical Snapcraft Store. I’ll refer to these as “Fedora Flatpak” and “Firefox Snap” throughout this article. Please note that you can use alternative Flatpak repositories such as Flathub. These alternate repositories may come different variants of Firefox with other default limitations and capabilities.

**Update** (2020-04-14): There’s now an official version of Firefox 75 packaged with Flatpak from Mozilla. It’s published in the Flathub repository. It eliminates the performance problems mentioned in this article, and ships with an MPEG-4/H.264 decoder. The article has been updated with this version. It’s referred to as “Mozilla Flatpak” throughout the article to differentiate it from the version from Fedora Linux.

The below table is a quick comparison of the features and limitations I’ll go through in greater detail in this article.

|                        | Firefox 75                     | Firefox 71            |                        |
| ---------------------- | ------------------------------ | --------------------- | ---------------------- |
| Feature                | Mozilla Flatpak                | Fedora Flatpak        | Snap                   |
| File system protection |                                |                       |                        |
| Home directory         | \~/Downloads only              | Read-only, can revoke | Read-only, irrevocable |
| /etc, /var             | Sandboxed                      | Unrestricted          |                        |
| Device access          |                                |                       |                        |
| USB/U2F security token | Unrestricted access, revokable | Blocked               | Allowed                |
| Webcam / mic           | Blocked                        | Allowed               |                        |
| Desktop integration    |                                |                       |                        |
| UI & web font          | Good defaults                  | FreeMono-only         |                        |
| HiDPI (4 K) support    | Good                           | Tiny mouse cursor     |                        |
| Notifications          | FreeDesktop                    | Custom                |                        |
| Multimedia             |                                |                       |                        |
| H.264 codec            | Built-in                       | Unsupported           | Built-in               |
| Performance            |                                |                       |                        |
| UI responsiveness      | Consistently fast              | Some slow-downs       |                        |
| Start-up time          | 700 ms                         | 720 ms                | \~11 sec               |
| Speedometer 2          | \-0 %                          | \-24,9 %              | \-4,7 %                |
| JetStream 2            | \-0,7 %                        | \-11,3 %              | \-4,6 %                |
| MotionMark 1.1         | \-5,8 %                        | \-65,2 %              | \-10,4 %               |

### File system access restrictions

Firefox Flatpak sandboxes system-level directories like /etc/ and /var/. Firefox Snap has the same permissions to system-level directories as the user.

Mozilla Flatpak only has access to \~/Downloads/.

By default, Fedora Flatpak has read-access to the entire home directory. It also has read and write access to \~/.mozilla/, \~/.cache/firefox/, and \~/Downloads/. This is where Firefox normally keeps its user data plus the default ephemeral downloads directory.

You can revoke Fedora Flatpak’s access to the home directory (while maintaining specific permissions mentioned avoce) by running the below command. You can still access files in your home directory using the File: Open dialog and when choosing which files to upload.

```shell
flatpak override --user \
  --nofilesystem=home org.mozilla.Firefox
```

Firefox Snap has irrevocable read-only access non-hidden files and directories in the home directory. Hidden-files are files and directories whose name start with a “.”.

In other words, it restricts access to sensitive areas like \~/.ssh/ and \~/.bitcoin/ but does nothing to restrict access to your \~/Documents/ and \~/Pictures/. At least one of these directories have been the target of [an old Firefox exploit](https://blog.mozilla.org/security/2015/08/06/firefox-exploit-found-in-the-wild/?ref=ctrl.blog).

Anything it wants to write to the home directory or read from a dot-directory is redirected to \~/snap/firefox/common/.

Both variants sandboxes /tmp/ (boot-cycled temporary files) but only Flatpak sandboxes /var/tmp/ (reboot-persistent ephemeral files).

Firefox Snap has the most restrictive default home directory protection out of the two. However, only Flatpak limits access to system directories. Flatpak can also be configured to have the most restrictive configuration by revoking access to the home directory.

### Device access

Your web browser will need access to your webcam and microphone for video conferencing and the like. It will also need access to U2F devices if you’ve set-up any online accounts with two-factor authentication with a USB security key token.

Snap comes with dedicated hardware device access policies for specific device categories such as USB security key tokens and webcams. Firefox Snap, by default, has access to your webcam, microphone, and USB security tokens.

Mozilla Firefox has full access to all hardware devices. Fedora Flatpak is blocked from accessing any of your hardware devices. Blocking offers stronger security and privacy protections but comes at a loss of functionality. This can be crippling if use services that require U2F like [Google Advanced Protection](https://www.ctrl.blog/entry/firefox-u2f-google/).

Flatpak only has two access policies for devices: allow access to all devices or block access to all devices. You can flip this policy using the following command:

```shell
flatpak override --user \
  --device=all org.mozilla.Firefox
```

You can change the device-access policies under both Flatpak and Snap. You’ll need to memorize commands and restart the browser if you want to turn these on and off depending on your needs. This is probably too much of a bother for most people.

This comes down to how paranoid you want to be about your device security. Blocking the browser from accessing your camera and microphone may be considered a net benefit unless you use them every day.

Firefox Snap has out-of-the-box support for experience- and security-enhancing hardware devices. This can be a double-edged sword as it also means a potential exploit could get access to your device’s microphone and camera. Flatpak doesn’t have granular controls for device access. You either give it access to all your devices or none at all (the default).

### Desktop integration

Flatpak has the clear advantage when it comes to desktop environment integration. It also uses the expected default system font for user interface elements and looks like any other GTK+ apps. It looks and behaves as Firefox running unconstrained directly on the host system.

Firefox for Flatpak integrates with the FreeDesktop notification system (used by GNOME and KDE) for web notifications. The Snap variant doesn’t integrate with the system-wide notification system.

Its custom notification pop-overs doesn’t respect system settings for notifications (quiet hours, etc..) The custom notifications are easy to miss as they aren’t shown on top of other windows.

Firefox Snaps looks good as well but it has a few minor styling differences from other GTK+ apps. One of the more severe issues is that it uses FreeMono Regular (a fixed-width/monospace font) instead of a sans-serif font.

The font issue extends on to the web as well. Every webpage that doesn’t supply custom Web Fonts uses FreeMono Regular instead. This causes many website designs to break and text legibility goes right out the window compared to a sans-serif font. This issue is fixed in the beta release channel.

Flatpak (left) vs Snap (right) mouse cursor sizes.

You can compare how fonts look in Flatpak versus Firefox Snap in the above video. You’ll also notice that the Snap version has an issue with the mouse cursor shrinking when entering the window.

The cursor changes the pointer-icon when moving it over the Firefox window. It also shrinks to half the expected size on a high-definition (HiDPI) display. Unfortunately, this isn’t just a cosmetic problem. You need to move the mouse twice the distance to get across the screen.

### Multimedia

MPEG-4 (H.264/AAC) is a popular proprietary multimedia codec. Most videos you watch online — outside of YouTube — will probably be encoded with this codec. This is also the most common codec for live-streaming video.

Firefox Snap comes with H.264 support built-in. So does Mozilla Flatpak. You shouldn’t have any problems watching videos on the web.

The main Fedora Linux package repository doesn’t come with H.264 video codec support for Firefox or other applications. This codec is patent- and license-encumbered which prevents Fedora Linux from distributing it by default. The repository has the same limitation.

However, you can install additional codecs on Fedora Linux. The Flatpak sandbox prevents Firefox from using these extra multimedia codecs. This is the sandbox doing its job. Unfortunately, you can’t install additional codecs into the Flatpak sandbox environment.

The lack of H.264 support is probably the key issue that will get someone to stop using Fedora Flatpak in favor of the unconstrained system default. Luckily, Mozilla Flatpak has built-in support for the codec.

### Performance

Every Snap package I’ve tested have been slow to launch. It generally takes 5–12 seconds from you start a program until it appears on the screen. Firefox Snap takes roughly 11 seconds to start.

Earlier this year, [Snap fixed a font-caching issue that caused slow start-up times](https://www.omgubuntu.co.uk/2019/03/the-cause-of-slow-snap-app-startup-times-has-been-identified?ref=ctrl.blog). I’m running a version with that fix. However, Firefox Snap’s font-cache is notably still broken. This is also what causes the problem with the monospace font. This could still be the root cause of the start-up performance issue.

For comparison, Flatpak starts up in less than a second. Flatpak also feels more responsive when scrolling, switching tabs, and other UI operations. Firefox Snap has noticeable lag when performing the same operations.

The [Speedometer 2 benchmark](https://browserbench.org/Speedometer2.0/?ref=ctrl.blog) tries to measure the responsiveness of web apps. Fedora Flatpak is almost 25 % slower than Firefox installed unconstrained on the system. Firefox Snap is only penalized 25 % of that figure.

The [JetStream 2 benchmark](https://browserbench.org/JetStream/?ref=ctrl.blog) tests JavaScript and WebAssembly performance. Firefox Snap has a 4,6 % performance penalty compared to Firefox running directly on the host system. Fedora Linux Flatpak is 11,3 % slower.

Fedora Flatpak tanks in the [MotionMark 1.1 benchmark](https://browserbench.org/MotionMark1.1/?ref=ctrl.blog). It’s a full 65,2 % slower than Firefox running on the host system. Firefox Snap is only 10,4 % slower. Both variants see the biggest difference in the Canvas painting tests. Fedora Flatpak nearly half the speed (-98,63 %) of Firefox running on the host system.

Perceived performance undoubtedly *feels* better in Fedora Flatpak despite Firefox Snap crushing it in both graphical and computational synthetic benchmarks.

### Conclusions

You may want to stick with an unconstrained installation of Firefox if you’re using older hardware that would be severely affected by the decreased performance. The relaxed sandboxing of Firefox Snap would still protect some of your files. Fedora Flatpak set to block home directory access will likely yield the highest level of protection, however.

Firefox Snap is the clear winner when it comes to capabilities with support for video-conferencing, USB security token, and video playback. These are arguably attack-surfaces you may be better without. You can use a separate browser for these tasks only. It comes down to whether you need these features regularly or not.

The performance story is quite interesting. The Flatpak sandbox hurts Firefox’s web performance badly. But it’s the Snap version that *feels* slow to use. The perceived performance may vary greatly depending on your hardware and which type of delays annoys you.

**Update** (2019-12-20): Alexander Larsson from Red Hat [pointed out](https://twitter.com/gnomealex/status/1207933145959555072?ref=ctrl.blog "Message from Alexander Larsson via Twitter") that Fedora Flatpak isn’t built with PGO. This could account for the performance difference. It’s also something concrete that Fedora Linux can improve on to help bring performance on par with Firefox running directly on the host.

I think I’ll migrate to Fedora Flatpak at the start of the new year.

I may find the time to test [Qubes OS](https://www.qubes-os.org/intro/?ref=ctrl.blog) first, though. It’s a Linux distribution where *many tasks of the operating system* is independently isolated from everything else. Although, I’m not sure whether I’d sleep better or lose sleep over jumping feet-first into something as complex as Qubes OS.

Thanks to Maciej Borzecki from Canonical Ltd. for guiding me through troubleshooting the font and mouse cursor issues with Firefox Snap.

I used Firefox 71, Flatpak 1.4.3, and snapd 2.42.2 on Fedora Linux 31 for this article. The article was updated to compare Firefox 75 from Flathub (the official Mozilla release) and Firefox 75 from the Firefox repository.
### Break up the YouTube Premium bundle and give me ad-free only
URL: https://www.ctrl.blog/entry/youtube-premium-unbundle/
Last updated: 2026-08-23T22:26:11.000Z
Google has cranked up the annoyance factor on YouTube lately. The app now has [frequent and annoying pop-overs and ads](https://www.theverge.com/2019/11/23/20946114/google-youtube-premium-subscription-ads-pop-ups-spam-rant?ref=ctrl.blog) promoting YouTube Premium. It’s not that I don’t want to pay, but I don’t want to pay for the Premium service bundle.

YouTube Premium is a bundled subscription service priced roughly the same as Netflix and double that of Disney+. You get access to YouTube Original shows, a music streaming service, and you pay the creators you watch from your subscription. Premium subscribers don’t see any ads on the service.

YouTube is a near-monopoly when it comes to streaming video from individual and small niche creators. An ad-free subscription to support your favorite creators makes a lot of sense. It’s a more sure-fire deal than premium video streaming services like Hulu, Disney+, and Netflix.

There are some unanswered questions regarding how much creators get out of the deal, however. It takes almost no money at all per minute-watched to outperform any potential ad-revenue. It’s also a more reliable business for creators and YouTube alike.

YouTube doesn’t give you any transparency as to how much each of the creators you watch gets from your subscription. It also doesn’t put a hard number on how much of your monthly subscription goes to creators.

This last point is my main problem with YouTube Premium. I don’t want a music streaming service. I hardly ever listen to music on YouTube. I don’t want a fixed cut of my money going to the beasts of the music industry.

I’m not interested in any of the YouTube Original shows. YouTube has another audience in mind for those shows and that’s fine. YouTube’s value to me is in the creators and channels I already follow.

I’ve already found my favorite channels on YouTube. What I want from a Premium subscription is just to get rid of the ads while still supporting my favorite creators. I can install an ad-blocker extension to hide the ads. However, I don’t want to lose any of my favorite channels. Using an ad-blocker is counter to that goal.

YouTube has a feature for supporting individual channels. You can become a “channel member” for 5 USD/month. The feature isn’t available for all channels, however.

This model doesn’t scale. I’d be paying 200 USD/month to support all the channels I’m currently subscribed to with memberships. I also watch videos from channels I don’t follow and one-hit wonders. These other creators deserve to be paid too.

This is the same problem I have with services like Patreon. I don’t want to pay a million mini-subscriptions every month. This is what I find appealing about one-monthly-subscription-to-many-creators services based on engagement like [Flattr](https://www.ctrl.blog/entry/flattr2/) and [Coil](https://www.ctrl.blog/entry/coil-web-monetization/).

YouTube could solidify its market-position by asking viewers to chip in a small monthly sum to support creators. It would be a more reliable revenue model for YouTube and for its creators. This is clearly what it’s going for with YouTube Premium already.

It doesn’t take much money to pay creators more than the income they get from advertisers. Frankly, paying creators small amounts for their videos is a better model for the web than relying on ad-revenue anyway.

However, YouTube can’t ask for the same monthly price as Netflix and twice that of Disney+ for videos that are available free of charge. I believe that 5 USD/month to remove ads and support creators would be a more acceptable price. I’d sign up for that whereas I’m not at all interested in the current Premium bundle.
### Long-lived image retention issue on Philips 276E8VJSB monitor
URL: https://www.ctrl.blog/entry/philips-4k-image-retention/
Last updated: 2026-08-23T22:15:22.000Z
I upgraded to a Philips 276E8VJSB 4 K 68,6 cm (27″) monitor earlier this year. It’s a 60 Hz W-LED backlit 8-bit+FRC IPS\-panel configuration. This configuration places it somewhere between the low and mid-range of high-resolution monitors.

A similarly specced 4 K monitor with 144 Hz refresh rate costs twice as much as this model. I’m happy with the image quality and the monitor overall. However, there are two problems with the Philips 276E8VJSB I’d like to discuss in greater detail.

The first issue is the cardinal-direction navigation-nipple/joystick that’s used to control the monitor. It’s located on the rear of the monitor; about 6 cm up from the center bottom. Pushing it in a cardinal direction opens a menu option. Pressing it in for two seconds turns the monitor on or off.

Most of the time, I only want to quickly turn the monitor on or off. After five months, I’ve yet to develop a reliable technique for turning the monitor off without accidentally pushing the nipple up or down. More often than not, I get stuck in a menu instead of quickly turning the monitor off.

I hate it. I know that a variation of the navigation nipple is the default on most monitors now. That doesn’t mean it’s a good user experience.

The second issue, and the meat of this article, is the panel’s image retention (“burn-in” or “ghost image”) problem. Many LCD panels are known to have temporary image-retention issues. This can go away by itself or with normal use. Alternatively, you can turn off the monitor for a full day or three to reset it. Depending on the exact panel and issue, you can also make the problem go away by “exercising the pixels”. That is to say, to rapidly cycle through different colors on all the pixels for about an hour.

However, these tricks don’t seem to work on the Philips 276E8VJSB. Black elements that are left on screen for a few hours can be retained for weeks and months! It’s especially visible against gray and unsaturated colors.

I left the monitor powered on over-night in the GNOME desktop environment (DE). GNOME has a persistent all-black top-bar \[[screenshot](https://www.ctrl.blog/entry/gnome-clock-formats/)\] (similar to MacOS’ gray/transparent top-bar). This left a darkened area at the top of my screen.

I was afraid I’d done permanent damage to the display. I switched DE to avoid having an all-black area at the top of the display. However, the image persisted with clearly visible top-bar icons on the top right corner and the word “Activity” in the top left corner.

The image started slowly fading away after about two months. The affected area had fully recovered five months later.

I was surprised by this experience. I’ve assumed, given no real information, that image retention issues were something that didn’t affect modern display panels. Or at the very least, that it only happens after leaving a static image on for weeks at a time.

About a month into the top-bar issue, I also found the headline “Google’s new reCAPTCHA has a dark side” (from [a Fast Company article](https://www.fastcompany.com/90369697/googles-new-recaptcha-has-a-dark-side?ref=ctrl.blog)) faintly visible against any light gray backgrounds. I don’t recall leaving the monitor on this particular article for any prolonged time. Never the less, the headline persisted for almost three months.

I’ve had less long-lived issues with image retention too. I played [World of Warcraft: Classic](https://www.ctrl.blog/entry/wow-classic-people/) (WoWC) for a probably unhealthy amount of hours one weekend. Let’s just say it took almost two weeks for the WoWC game toolbars to disappear from the screen.

I did a quick test for this article. I cycled the screen with different low-saturation solid colors. This revealed a couple of more less-obvious image ghosts that I hadn’t noticed with normal use.

To my surprise, I found most of Firefox’s user interface. I also found the Ctrl blog key logo (as seen at the top of this webpage). These weren’t as obvious or severe as the other examples mentioned in this article. I don’t know how long they’ve been there or how long they’ll stick around.

I’ve already mentioned the issues with turning the monitor off as it doesn’t have an easy-to-use off-switch. The off-switch is fiddly and it’s so much easier to just not bother when leaving the computer.

My PC also turns itself on automatically following a power outage. So, does the monitor. There isn’t a firmware option to turn this behavior off on either devices.

This doesn’t happen all that often. However, my PC often fails to enter sleep or hibernation mode. It will power on again a few minutes after I try putting it to sleep. The PC won’t go back to sleep on its own if this has happened once since the last time it was completely powered down. This also wakes up the monitor and can result in it staying on at the login screen for hours.

This hasn’t been too much of a problem in the past. It’s annoying that things don’t work the way they should, but it hasn’t caused any real harm (except to the electricity bill). However, the Philips 276E8VJSB has made it a problem that I now need to worry about more.

My PC also displays a black screen with a white password input box in the middle of the screen during boot. The monitor does not time out and power down when this password prompt is displayed. This is an image retention disaster waiting to happen. I’m fully expecting to find the outlines of that password prompt burned into the panel someday.

I’ve checked the user manuals for nine of the other laptops and monitors I’ve got. They only mention issues with image retention in one or two sentences. Philips 276E8VJSB’s user manual mentions it 14 times, including in two separate warning boxes urging you to not leave the monitor switched on.

I haven’t experienced any image retention issues remotely this bad on my other two 4 K displays (nor with any of my 1080 p monitors). The only issues I’ve had with other displays have faded away after a few minutes, not hours or months.

The Philips 276E8VJSB notably doesn’t come with a timer function to switch itself off after a few hours. Such a function could have reduced the impact of the image ghosting problem. This feature is standard on many electronics sold in Europe. Energy-saving power management features, enabled by default, is required by EU regulation.

I’ve concluded that what I’ve experienced is an issue with the specific panel used in the Philips 276E8VJSB. My sample size is only one monitor with this panel. However, the repeat warnings in the monitor’s user manual is a clear indication Philips is well aware of the issue. This makes the decision to omit both an automatic power-off function and an accessible power button somewhat mystifying.

#### Sources

- [Philips E-line user manual](https://www.download.p4c.philips.com/files/2/276e8vjsb%5F27/276e8vjsb%5F27%5Fdfu%5Faen.pdf?ref=ctrl.blog), 2018-08-28, Philips
- [COMMISSION REGULATION 1275/2008 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32008R1275&from=EN&ref=ctrl.blog), 2008-12-17, The Official Journal of the European Union, EU Parliament and EU Council

The feature image is an artistic recreation of the image retention issues mentioned in this article.
### Why I developed my own email newsletter system
URL: https://www.ctrl.blog/entry/email-newsletter/
Last updated: 2026-08-23T22:05:41.000Z
An observant reader contacted me to ask about what he perceived as the automated personalization of the [Ctrl blog email newsletter](https://www.ctrl.blog/follow.html). He had subscribed to the newsletter with two different email addresses and noticed that he received two different versions of it and that they arrived hours apart.

This reminded me that I haven’t talked about the email newsletter system I developed for Ctrl blog. I’d like to talk about how it works in more detail, and then proceed to address the above observations.

The email newsletter is managed and delivered by a purpose-built software I developed in October 2018\. I wrote it because I wasn’t happy with commercial offerings like MailChimp. I’d also reviewed self-hosted open-source options like phpList and found them lacking.

Historically, I used MailChimp to deliver the newsletter. It handled the subscription list, pulled in the [syndication feed](https://feed.ctrl.blog/latest.atom?ref=ctrl.blog), and sent the newsletter at a predetermined time every week.

I was unhappy with several aspects of MailChimp’s service. Fake subscriptions made up almost 96 % of my subscriber-list with MailChimp. MailChimp’s charges per subscriber and message sent. It isn’t motivated to tackle the problem.

I’ve had no problem effectively filtering out these fake subscriptions after I built a custom subscriber-list management system. I’ll not discuss what methods I use to detect and reject fake sign-ups. I’ll say that its some pretty darn basic stuff, though.

Fake sign-ups can be the result of bots trying to leave spam messages or bots just testing what happens on form submissions. They can also be used in an attempt to flood a recipient’s inbox to hide incoming security alerts during an account take-over attempts.

The General Data Protection Regulation (GDPR) made it advantageous to take ownership of the subscriber-list and not share people’s email addresses with a third-party provider. Email was designed to be decentralized, and I would prefer if it stayed that way.

There are surprisingly few options available for managing email subscriber lists and automate email newsletter sending. I’d assumed there would be at least a dozen options, but I had trouble finding any at all.

phpList appears to be the go-to option. However, I found it incredibly difficult to use and the customization options were a joke. You can’t disable its self-promotional message at the bottom of every outgoing email, for starters. It’s open-source so you can patch that out yourself. However, the project refused to include an option to turn off that promotion.

Handling delivery-failures and bounces is an important job of an email subscription list manager. The proper handling of these failures is crucial to maintain a good email sender-reputation and stay on the good side of email service providers. You’re expected to stop delivery to recipient-addresses that repeatedly fail delivery.

I ran into several issues with how phpList dealt with bounced messages and other delivery failure notices. It also accepts bounces and delivery-failures for messages it never sent. Someone who knows a subscriber’s email address can easily remove them from a phpList subscription-list by sending a specially crafted message to the list bounce-handling address.

Long story short: My email subscriber-list isn’t enormous. I decided to set up a mail delivery agent (MTA) on a dedicated server and handle everything myself. I didn’t want to rely on a third-party SMTP gateway like Amazon AWS SES or SendGrid. Luckily, I’ve got some experience maintaining an MTA.

I then proceeded to develop my subscriber-list and delivery handler in about two-days time.

Email-deliverability problems are often cited as the main reason not to roll your own email systems. This hasn’t been a problem for me yet. I follow best-practices to help email recipients identify and reduce spam. I’ve also deployed email origin-authentication.

I also didn’t immediately start blasting thousands of emails per minute from an IP address that didn’t have a history of sending email messages. I slowly transferred the subscriber-list to the new system and let it grow over a couple of months.

It then took me another day and a half to develop and test the system that turns Ctrl blog’s syndication feed into the email newsletter. I decided to keep formatting minimal, as email clients are notoriously bad at handling formatted email.

I’ve only found [one bug](https://www.ctrl.blog/entry/xml-title-xml-entity-html/) since then and haven’t otherwise had any reason to touch the code since.

To get back to the original question: the email newsletter isn’t personalized. There’s no subscriber-identifier in the links to articles that are included in the emails. It doesn’t learn about your interest or records your click-through rate. However, every subscriber doesn’t get an identical copy of the newsletter nor do they receive it at the same time either.

The newsletter-server spreads email delivery over several hours to stay well below mass-sending detection-thresholds at major email providers. I don’t know when the optimal time is for subscribers to receive the newsletter. The delivery times are randomized every week.

More specifically, the server tries to send the newsletter at a random time every day Monday–Thursday every week. The newsletter won’t be sent unless it contains at least two new articles, and at least five days have passed since the last newsletter was sent.

This may sound complicated but I designed it this way to allow me not to have to think about or plan around the newsletter delivery time. I don’t want to worry about publishing anything in time to “make it” into the newsletter.

Ctrl blog is a tech-variety blog. I write about things that interest me and people follow the blog because they’re interested in some — but often not all — the same things.

I don’t know what people want to read about. Some articles get really popular and other people just don’t care about it. I’m always surprised by which articles get popular and which don’t. I don’t know what any individual reader might be interested in. I don’t know what the majority of subscribers are interested in either.

To hedge my bets, and so that I don’t have to worry about it, the article order in the newsletter is randomized for every recipient. This system allows me the freedom to just write what I want without thinking about how something might perform in the newsletter.

Only a few articles I publish on Ctrl blog perform well in the first week after publication. The majority of the people who read one of my articles [discover it through Google](https://www.ctrl.blog/entry/web-discovery/) weeks, months, or years after it was originally published. I primarily focus on writing so-called “ever-green articles” as opposed to timely or news-worthy articles.

So, to return to the original reader question: The newsletter is sent at a random time every week, and the order of the articles is randomized. The only data retained by the newsletter server associated with your email address is the delivery-success and bounce-or-failure rates.
### World of Warcraft Classic: Hell is other people
URL: https://www.ctrl.blog/entry/wow-classic-people/
Last updated: 2026-08-23T22:25:51.000Z
I didn’t play World of Warcraft when it launched 15 years ago. However, I did play it with friends about seven years ago, around the time of the Mists of Pandaria expansion. As I hadn’t played it before, I wasn’t into the lore nor did it appeal to me. I enjoyed running around in the big open world, seeing new places, and completing quests.

This year I got the opportunity to experience the original game with the release of World of Warcraft: Classic. The game rolled back the clock and got back to its roots. The Classic game is less complicated with fewer distinct systems to keep track of. There’s less to do in the world, but I don’t miss the busywork that has been added to the modern game. I thought I’d give it a try.

There are different types of servers with different player-interactions. Players are segregated by servers. I chose a player-versus-player server because it was the only server that wasn’t marked as “full”. I created a dazzlingly handsome and spell-casting green-haired gnome mage and set out to adventure for the Alliance!

World of Warcraft is a massively multiplayer online game. In the game, the two factions called the Alliance and the Horde are at each other’s throats. Many of the other creators, demons, and forces of the world will also try to kill you.

To make progress in the game, you run around and complete quests and try to right wrongs in the vast world. In practice, this meant running quite a distance to get to a small confined area and queuing for other people to be done so the area would reset.

The game was fun and we made good progress towards reaching level 60\. The top tier in the game. We’d reached about level 49 when the game was updated to include the honor system. There hadn’t been any incentives for killing other players before this point. The honor system changed the game experience for the worse.

The honor system keeps track of how many people you’ve killed from the opposing team. You’re rewarded for each kill with honor points, which can be used to unlock certain items in the game. You’re only rewarded for players within ten levels of your own. A ten level difference is a fairly massive difference in terms of character power and capabilities. It’s not a fair fight.

Let’s just say we started dying a lot more after this update. When you die in the game, you have to run from the nearest graveyard, find your body, and resurrect yourself. The nearest graveyard can be two–eight minutes away from where you died, and you can’t do anything but try to find your body until you’ve been resurrected.

I don’t mind going up against the same number of players at the same level as myself. It can be a bit frustrating and inconvenient sometimes. But you get a fair go at it and sometimes you win and sometimes you lose.

This is how it’s done in other player-versus-player games I enjoy such as World of Warships. The ship classes in that game have different capabilities, but any ship at the same level can sink another.

This isn’t how World of Warcraft: Classic is being played, however. What happens instead is that groups of higher-level players from the opposing team stake out a location that lower-level players must visit to progress in the game. There are many quest and transport hubs in the game where you can expect players of certain levels to appear at regular intervals. Killing lower-level players is an easy sport; especially when they have to come to you.

I do enjoy running around completing quests and being alive. Spending minutes at a time dead running to resurrect your body to get something done isn’t fun at all, however. The world is massive, but there are thousands of players simultaneously on a server. The world gets filled up with the wrong kind of people pretty fast.

We tried being at the other end of this exchange in World of Warcraft: Classic. We went to a lower-level area to collect a resource and killed any lower-level player that approached. They didn’t stand a chance. We’d been killed by other higher-level players in this particular area even before the honor system update. It takes about six minutes to return to it from the nearest graveyard.

To be completely honest, it felt good to slaughter a few of them in the first few minutes. After we’d killed the same player twice, I started feeling awful about the whole thing. I felt guilty for ruining the game for them and for their long and boring trek back to this one spot on the world map.

We joined a raid-party to play in a dungeon instead. A dungeon is a closed-off area of the game where you need more people to get through the higher difficulty. The biggest challenge was getting into the dungeon. A group of higher-level players had camped out in front of the entrance and killed our party repeatedly before we could even get through the front door.

The three other people in our group were talking about how they’d return the favor and abuse Horde players when they reached level 60\. We played for about an hour and then someone in chat called another party member a “homo”.

At this point, I decided that this wasn’t an enjoyable experience anymore. I don’t enjoy the game anymore and I haven’t enjoyed it since the honor system was introduced. The game just isn’t balanced in a away that allow people to have a good time with it. Hell is other people, after all.

There are non-player-versus-player server options available. These were all full when I signed up for the game. You can’t transfer your character from one server to another. In the modern-day version of the game, you can pay 25 Euro to transfer yourself from one server to another.

I’ve invested a lot of time into my character and I don’t want to abandon him and start from scratch. I find it especially annoying that the player-versus-player aspects of the game don’t come into play until you’ve invested around 24-hours into your character. You don’t know what the experience is going to be like later in the game until after you’ve already invested significant time in it.

World of Warcraft has come a long way since the classic game. However, I’m glad I didn’t play it 15 years ago. I can’t imagine that I’d enjoy the experience then and I certainly don’t enjoy it today.
### Opera Unite tried decentral­izing the web ten years ago
URL: https://www.ctrl.blog/entry/opera-unite/
Last updated: 2026-08-23T22:15:11.000Z
Ten years ago this week, Opera 10.10 shipped with a web server built-in into the web browser. The Unite server came with webapps like Web Server, Photo and File Sharing, and a Fridge. Yes, I will get back to that last one later.

Contrary to what the name might suggest, Opera Unite was intended to decentralize the web rather than unite it. It was intended to “reinvent the web” by making everyone host their own internet content and communications. Two and a half years later, Opera discontinued it entirely.

Opera Unite was a technology platform with two components: The first, and most interesting, was the Unite server. It was built into the web browser and people would host web applications and content from their own PCs.

If you turned off your PC, then your server would go down and your webapps and content would become inaccessible. This concept is easy to understand for the computer-literate, but it’s not something most people have ever had to deal with in their lives.

The second component was the centralized Opera Unite service. It provided people with a third-level domain name to make it easier to access their servers. The service could also proxy connections through Opera’s servers in cases where direct person-to-person connections couldn’t be established. This second component was necessary when encountering corporate firewalls or old routers without UPnP support that blocked direct connections.

People didn’t flock to the Opera web browser to get their own web server. Even existing users had trouble finding a use for Unite. As I said earlier, Opera Unite was a technology platform. You needed to install a Unite-capable web app, available in the Opera Add-On Catalog, to make it do anything.

There weren’t a whole lot of webapps available at launch. Only a handful more webapps would be developed for the platform during its lifetime. Here are some Unite-apps highlights from the Opera Add-On Catalog:

- Fridge: a public place where people could leave post-it notes on your virtual fridge door.
- File sharing: share and host files publicly.
- File inbox: let strangers upload files to your computer.
- Music streaming: make your music file collection accessible to the public.
- Photo sharing: make and share photo albums publicly.
- Web server: publish your own website.
- Messenger: chat with your friends.
- Webcam: stream your webcam live on the web.

These webapps were quite good at what they did. They were utilitarian and got the job done. It was just the tiny problem of having to explain to grandma why the link you sent to your Unite photo album didn’t work when she tried opening it. Assuming you could even understand the problem yourself. It always worked when you tested from your laptop, right?

Not having to rely on a third-party, often commercial, service to publish and share photos, documents, and other files makes a lot of sense in a democracy. People expect to access their files on the go even when they’re not in front of their computer. However, people’s primary computer these days is a smartphone and not an always-on laptop or desktop PC. These devices are power and bandwidth constrained; which make them unsuited for hosting any kind of server.

Okay, so we’ve got to take a moment to talk about the Fridge app. It sounds silly but it was featured heavily in Opera’s PR push at the time. However, it made a little more sense back in the late-90s and into the mid-2000s. Back in the day, the website guest book or a shoutbox was the only social component you could expect to find on a personal website.

A website guest book was a dedicated page where you could sign your name and leave a comment for others who’d visit the website later. This was a big deal at one point in the history of the web. You could even purchase fake guest book entries to make yourself seem more popular.

Shoutboxes were less permanent forms of guest books where people could write either “Hey!” or yell abuses at each other across the internet.

In this environment, the Fridge app did make a bit of sense. Even though it was quite late to this fad. The fridge may be the center of many households. However, asking families to make a public Opera Unite webpage hosted on the family PC the new virtual fridge was a big ask.

![A screnshot of the virtual fridge door app in Opera Unite](https://cdn.synaps.media/control/content/images/2026/08/opera-unite-fridge.jpeg) 

The Fridge app in all its glorious 2009-era skeuomorphic design

Opera Unite didn’t support encrypted connections. Unencrypted HTTP connections were the default back then, and it wasn’t unusual for websites and personal communications to be transmitted in this fashion. This would be an unacceptable privacy and security risk, by today’s standards, of course.

Opera Unite couldn’t deliver encryption given the ecosystem at the time and its architecture. If Unite had launched today, however, it could have used a free and automated encryption-certificate provider like Buypass and Let’s Encrypt.

Now, ten years later, the web has become a much more centralized place than it was back when Unite launched. The internet has become a larger part of our lives, yet we [don’t even control our own identities](https://www.ctrl.blog/entry/email-identity-provider/). Our personal information has become a commodity to be traded by big corporations.

Power-users who could have found value in Opera Unite have flocked to more server-oriented solutions like [Nextcloud](https://nextcloud.com/?ref=ctrl.blog) instead. It seems no one wants to commit to leaving their personal computers on all day.

Opera Unite’s big failure was that it was a solution in search of a problem. I described Unite as a “technology platform” earlier in this article. No one but nerds wants to use a technology for the sake of the technology. Unite’s webapps caused more problems for people than they solved.

Opera Unite was called “project alien” internally at Opera Software. It was something new and alien to the web browser. Maybe also suggesting that it didn’t ever really belong there in the first place.
### How to use AddToAny as a fallback for the Web Share API
URL: https://www.ctrl.blog/entry/addtoany-web-share/
Last updated: 2026-08-23T22:00:59.000Z
Almost all websites feature a row of brightly colored sharing-buttons at the top or bottom of each page. These buttons keep the big social networks at the front of people’s minds while also enabling the same networks to spy on people across the web.

The buttons even pose a legal risk to website owners. More than 400 000 websites still proudly feature sharing buttons for long-gone social-sharing networks of the past like Digg, StumbleUpon, and Google+.

Surely there must be a better way! The new [Web Share API draft](https://w3c.github.io/web-share/?ref=ctrl.blog) gives websites access to the native sharing tools built-in to modern operating systems. The draft API is only supported by Google Chrome version 61+ on Android, and Safari 12+ on iOS and MacOS. However, it holds a promise of being a more privacy-preserving and unified user experience for content sharing.

Rather than being a promotional/spying-tool, the operating system’s native sharing tool is extendable and personalized. It enables quick sharing to the apps and services the user has installed and actually uses, without leaking personal data about their browsing habits to other parties.

It’s not limited to just social networks. The native share dialogs support other types of apps like reading-lists, note-taking, email, and more.

It’s really easy to implement the Web Share API. I’ll get back to a complete implementation example later in the article. However, one big unanswered question remains: what do you do with unsupported web browsers?

A common fallback is to hard-code fallback links to share the content on either Facebook or Twitter. I don’t want to push my readers to any of these services. Especially not after they’ve clicked on a somewhat ambiguous “Share” button.

Another option is to waste time to provide a custom share dialog listing different options. This often involves including a large JavaScript library or a completely custom implementation. This quickly adds complexity and requires ongoing maintenance. You don’t want to become one of those websites that waste valuable space promoting a dead social network!

A rather obvious choice is to outsource to one of the many multi-network content sharing services. However, the leading providers like AddThis and ShareThis are slow to load, collect a large amount of personal data about readers, and require a lot of work to integrate.

[AddToAny](https://www.addtoany.com/?ref=ctrl.blog) has sharing widgets similar to the ones offered by AddThis and directly by the different social networks. However, it also has an easy-to-integrate API endpoint with a good selection of sharing services. The service is built with privacy-by-default.

AddToAny’s privacy policy is a joy to read compared to its competitors, and most other online services. It’s to the point and takes less than two minutes to read.

You don’t need to load any third-party JavaScript or send any signals to AddThis. You can simply open a window and link directly to their sharing-sheet with your link built-in. Using this implementation, AddToAny only collects limited anonymized data with Google Analytics (the title of the page being shared), and with the service the user chooses to share data with.

Let’s get back to the Web Share API. You can easily feature-test for support by testing for `navigator.share`. If present, you provide it an object with the `title` and `url` you want to share.

When the feature-test fails, you can fallback to opening a window with AddToAny. The page to open must follow this URL pattern:

```
https://www.addtoany.com/share#url=&title=
```

You can supply the two parameters with hardcoded values, or URL-encoded values from `window.location` and `document.title`.

You can get higher-quality data sources of existing metadata elements, if your websites deploy them. You can use the canonical link and the meta title as shown below:

```javascript
document.querySelector(
  'link[rel~=canonical]').href;
document.querySelector(
  'meta[name=title]').content;
```

You may have noticed that AddToAny’s use of a fragment to parse variables means that these aren’t sent to AddToAny’s servers. (Except by [misbehaving HTTP clients](https://www.ctrl.blog/entry/recover-url-fragment-requests/).) These values are read client-side on the sharing page; minimizing the data that is shared with AddToAny

The following example shows a complete implementation of the Web Share API and includes a fallback that opens a new window to sharing with AddToAny:

```javascript
// SPDX-License-Identifier: CC0-1.0

function share_cb(err = null)
{
  var share_uri = `https://www.addtoany.com/share#url=${encodeURI(window.location)}&title=${encodeURI(document.title)}`;

  var wo = window.open(
    'about:blank',
    null,
    'height=500,width=500'
  );
  wo.opener = null;
  wo.location = share_uri;
}

if (navigator.share) {
  navigator.share(
    {
      title: document.title,
      url: window.location
    }
  ).catch(share_cb);
} else {
  share_cb();
}
```

You’d call this in response to a click event on your share button design. The complications around `window.open` are there to [properly mitigate tabnabbing](https://www.ctrl.blog/entry/tabnabbing-window-size-position.html).

People can manually customize the list of services shown in AddToAny. The service doesn’t make any personalizations on its own. The default list places Facebook and Twitter on top, which should cover the most popular services. It also contains a wide variety of services including Instapaper, Blogger, Mastodon, and 85 others.

AddToAny doesn’t optimize which services are places on the top of the list by regions. For example, it doesn’t know to move Sina Weibo and RenRen to the top of the list in China, or VKontakte to the top in Russia. This would be a nice feature to have.
### What to <link rel=dns-prefetch> and when to use preconnect
URL: https://www.ctrl.blog/entry/dns-prefetch-preconnect/
Last updated: 2026-08-23T22:05:15.000Z
The `dns-prefetch` resource hint is intended to look-up domain names before the browser would otherwise know that they’d be needed in the near future. It’s a quick way to speed up the loading of external page resources.

DNS-prefetching is such an easy performance optimization to make that it’s been included on one in five websites. As many as *one in five of the top 500 000 websites* deploy DNS-prefetching. Admittedly, a huge portion of this figure comes from WordPress defaults. (Figures from a crawl of HTTPS websites in the [Tranco list](https://www.ctrl.blog/entry/tranco-popular-websites/) on 2019-11-17.)

I’ll start by discussing how this mechanism works and how it’s commonly misapplied. I’ll then move on to discuss the `preconnect` resource-hint and then discuss browser support.

The following example instructs the web browser to resolve an example domain name and store it in its cache:

```html
<link rel="dns-prefetch"
     href="//example.net/">
```

It makes no difference if you use a protocol-relative URL (as shown above), or an absolute URL. The browser extracts the domain name by parsing the URL.

Different web browsers and operating systems have [different DNS-caching policies](https://www.ctrl.blog/entry/dns-client-ttl/). We can assume that a resolved domain name will remain cached for at least one minute in the average web browser.

DNS is cached in the browser, operating system, your edge gateway (“router”), and by your upstream recursive DNS resolver (often your ISP). It’s easy to get confused about your performance testing results unless you’re testing with different domain names each time.

So, which domain names should be pre-resolved? Many online tutorials recommend resolving the domain names of all the external stylesheets, scripts, frames, and images included in the document. *This is unnecessary.*

Browsers go through documents as they’re loaded and start to resolve domain names and establish connections to all the domains that their document preload scanners find. This includes URLs in `iframe` `img`, `link`, `script`, and other such elements.

DNS-prefetching is, however, useful for domain names that the browser’s pre-processor can’t possibly know about at the time it starts to render the document. Any external resources that are required by a frame, script, or stylesheet are prime candidates.

For example, an ad network may be embedded in your webpage as `<script src="https://example.com/">`. You don’t need to prefetch this domain name. However, that script then tries to fetch a resource from `https://example.org/`. *That’s the domain name* that will benefit from being DNS-prefetching.

Your browser can’t infer that it will need to connect to this second domain from analyzing the current document. You should only DNS-prefetch domains that meet the following requirements:

- The domain is a chained dependency not already loaded by the webpage itself.
- The domain is expected to be required within *one minute* of the document being loaded.

Priming the DNS cache can save anywhere from a few milliseconds to seconds on a high-latency connection. However, you can save hundreds of milliseconds to tens of seconds by not only priming the DNS cache but also establish a connection to the required host early.

The following example instructs the web browser to resolve an example domain name, set up a TCP connection to it, and complete the TLS handshake. The connection will be ready when the browser wants to fetch resources from it later.

```html
<link rel="preconnect"
     href="https://example.net/">
```

Note the use of an absolute URL.

You don’t need to use DNS prefetch when you’re using preconnect. The domain name will be resolved as the first step of the browser establishing the connection.

Browsers will close unused connections much quicker than DNS entries expire from their caches. Chrome gives a warning if the connection remains unused ten seconds after it was opened. The requirements for which domains to `preconnect` to are slightly different than for `dns-prefetch`:

- The domain is a chained dependency not already loaded by the webpage itself.
- The domain is expected to be required within *ten seconds* of the document being loaded.

So, what’s browser support like for `dns-prefetch`, `preconnect`, and both resource hints?

DNS-prefetching has been widely supported since the beginning of 2009. Preconnect has been supported since the middle of 2015. The following table shows the current state of feature support in the market-leading browsers as of the time of publication:

__Browser support for resource-hint link relationships__
|                   | dns-prefetch      | dns-prefetch preconnect | preconnect |
| ----------------- | ----------------- | ----------------------- | ---------- |
| Safari 13 (iOS)   | No                | Yes                     |            |
| Safari 13 (MacOS) | Yes               | No                      | Yes        |
| Firefox 71+       | HTTP-origins only | No                      |            |
| Firefox 70        | HTTP-origins only | Yes                     |            |
| Tor Browser 9     | No                |                         |            |
| Brave 1           | Yes               |                         |            |
| Chromium 78       |                   |                         |            |
| Vivaldi 2.9       |                   |                         |            |

As discussed earlier, DNS-prefetching is redundant when using preconnect. It can be used in combination with preconnecting to cater to older browsers that don’t support preconnect.

Unfortunately, Safari/WebKit assumes that the `rel` attribute only contains a single value. (The attribute is meant to support a list of space-separated values, like the `class` attribute.) Websites hoping to improve compatibility end up breaking the feature in Safari instead.

Safari on iOS never implemented DNS-prefetching. Preconnect is supported from iOS 11.2 (December 2017) onward.

DNS-prefetching is only available in Firefox for webpages loaded over HTTP. This practically means that Firefox doesn’t support it at all. HTTPS is the default protocol for the web these days. I’ve opened a bug to address this issue. You can follow [bug #1596935](https://bugzilla.mozilla.org/show%5Fbug.cgi?id=1596935&ref=ctrl.blog) for updates.

**Update** (2020-10-15): I published this article right before the release of Firefox 71, so I completely missed that `preconnect` stopped working in the very next version! It still doesn’t work today in Firefox 81.

Firefox’s behavior seems to have been caused by a misunderstanding of Chrome’s behavior. Chromium published [a design document](https://www.chromium.org/developers/design-documents/dns-prefetching/?ref=ctrl.blog) that discussed how it had implemented DNS prefetching. Unfortunately, it discusses a different but related technology in the same document. This other technology is disabled on HTTPS for privacy reasons but that behavior didn’t apply for the manual `dns-prefetch` resource hint.

Tor Browser inherits Firefox’s refusal to resolve DNS-prefetch resource-hints on HTTPS websites. Additionally, a separate problem keeps it from resolving *any* such hints, even on HTTP websites. The Tor Browser talks to the Tor Onion routing-anonymizing network over a SOCKS5 proxy. Neither Firefox nor Tor Browser supports DNS-prefetching or preconnecting over SOCKS5 proxies.

Networking in the Tor Browser is greatly complicated by its use of the Tor Onion routing-anonymizing network. The browser’s use of the Onion routing system means connections gets encrypted in layers and bounce from proxy-relay to proxy-relay.

The cost of establishing a connection over the Tor Onion routing-anonymizing network is higher than over a regular network connection. The Tor Browser could see a significant performance boost from supporting the preconnect resource hint.

### Conclusions

You will get better results from `preconnect` than `dns-prefetch`. DNS-prefetching is only a small part of the work required to establish a network connection. Both are pointless if you load resources directly from the same domain. Use the requirements suggested earlier in the article as a checklist.

You can include `dns-prefetch` for backward-compatibility. Browsers have supported it for more than ten years. You’ll need to include it in a separate `<link>` element to cater to WebKit.

You can also use `dns-prefetch` for things that you’re not going to need right away but will need within one minute.

Be aware that DNS is cached in many places. Be sure to account for that in your performance testing.

The Tor Browser, arguably the browser that would benefit the most, supports neither `preconnect` nor `dns-prefetch`. Reducing your dependency on external hosts is always going to be the best path to higher performance across the board.

**Update** (2022-05-13): Quick update to say that nothing has changed! Neither Firefox version 100 nor Safari version 15.4 has addressed any of the issues discussed in this article.

#### Sources

- [Resource Hints](https://www.w3.org/TR/2020/WD-resource-hints-20201005/?ref=ctrl.blog), 2020-10-05, Working Draft, World Wide Web Consortium (W3C)
- [Safari doesn’t preconnect to origin when using rel="preconnect dns-prefetch"](https://bugs.webkit.org/show%5Fbug.cgi?id=197010&ref=ctrl.blog), bug #197010, 2019-07-26, Bug Tracker, WebKit
- [How the Browser Pre-loader Makes Pages Load Faster](https://andydavies.me/blog/2013/10/22/how-the-browser-pre-loader-makes-pages-load-faster/?ref=ctrl.blog), 2013-11-22, Andy Davies, Blog
- [Link dns-prefetch doesn't work in non-http documents](https://bugs.webkit.org/show%5Fbug.cgi?id=48813&ref=ctrl.blog), bug #48813, 2010-11-02, Bug Tracker, WebKit
- [DNS Prefetching for Firefox](https://bitsup.blogspot.com/2008/11/dns-prefetching-for-firefox.html?ref=ctrl.blog), 2008-11-08, Bits Up!, Blogspot
- [Support for DNS prefetch](https://bugs.webkit.org/show%5Fbug.cgi?id=20690&ref=ctrl.blog), bug #20690, 2008-09-19, Bug Tracker, WebKit
- [add DNS pre-fetching to Necko and Firefox](https://bugzilla.mozilla.org/show%5Fbug.cgi?id=453403&ref=ctrl.blog), bug #453403, 2008, Bug Tracker, Mozilla
- [DNS Prefetching](https://www.chromium.org/developers/design-documents/dns-prefetching/?ref=ctrl.blog), 2008-07, Design Documents, Chromium Developer Documentation, Chromium
### Risks with renting your home PC to FluidStack for “up to $50/month”
URL: https://www.ctrl.blog/entry/fluidstack-cloud-residential-isp/
Last updated: 2026-08-23T22:07:24.000Z
[FluidStack](https://web.archive.org/web/20200921135740/https://www.fluidstack.io/provider) is a service that wants to rent your PC and internet connection and pays “up to 50 USD per month”. This may be an especially tempting offer if you’re short on cash and want to make some no-effort passive income. However, you may want to reconsider FluidStack’s offer if you spend a little more time reading the fine print.

Last week, I discussed how the company behind the network-attached storage (NAS) appliance Cubbit plans to [operate a datacenter from your home](https://www.ctrl.blog/entry/cubbit-home-datacenter/). Cubbit is a relatively expensive piece of hardware and I called them out for wanting to use the hardware you bought to make even more money from you and your internet connection. FluidStack’s promise of “up to $50 per month” compensation sure puts Cubbit’s business plan in perspective.

FluidStack requires that your PC is powered on and idle at least 12 hours a day, and that it’s connected to a residential internet service provider (ISP). If you’ve got more PCs then they’ll only pay you per unique residential IP address. As I discussed in the article on Cubbit, it’s your residential IP address that holds the true value to these companies.

**Update** (2020-02-27): FluidStack has discontinued support for Windows hosts and now focus exclusively on GPU workloads under Linux hosts. They gave no prior notice and didn’t offer payouts to providers who hadn’t met the minimum payout threshold.

Many residential ISPs — including leading U.S. providers AT&T Internet and Comcast — don’t allow their subscribers to resell their services. In other words, you may be in breach of contract with your ISP if you let FluidStack run commercial services through your internet connection. You may even lose your internet connection.

FluidStack says they may “use your bandwidth to help large businesses generate business intelligence and insights.” They call this service “proxying”. This essentially means they’ll exploit the good reputation of your IP address to bypass content- and access blocking system on behalf of their customers.

Uses for this may include price or content-scraping websites, or crawling the web for “intelligence and insights” such as collecting email addresses or more benign uses. Again, the value lies in your IP address belonging to a residential ISP.

This is likely to impact your IP-address reputation. A lower IP-address reputation may cause you to get blocked from accessing some websites or you’ll be asked to fill in more CAPTCHAs. It can also cause problems when you’re shopping as your order is more likely to be flagged as suspicious or fraudulent.

FluidStack’s other services use your computer as a content delivery network (CDN) node. This means your computer may be used to service videos, images, and other web content. In my opinion, this is one of the more legitimate uses of the service.

Your PC may also be used to transcode video files into multiple formats and resolutions. This is a computer resource-intensive task which a home gaming-PC would be well-suited for. This is probably the least risky service option FluidStack offers.

FluidStack can also use your PC as a virtual private network (VPN) server for people wanting to access streaming video services like Netflix or BBC iPlayer.

You’re opted-in to letting your PC be used for all of these services by default. You can dig through FluidStack’s administration dashboard and disable services individually. You’re warned that disabling any purpose will reduce your potential earnings.

FluidStack recommends disabling the video-streaming option if you use Netflix, Hulu, or any other services. However, you’re still opted into offering this service by default even though FluidStack knows it may get you banned from using these services. A quick web-search reveals plenty of complaints from people who’ve installed FluidStack’s node software only to find themselves blocked from accessing their favorite streaming service afterward.

I suspect FluidStack’s offer of “up to $50 per month” may be little comfort to users who’ll find themselves blocked from their favorite video-streaming service or have their internet access terminated. It’s not like they’ll keep paying you if your PC is no longer connected to the internet.
### Cubbit NAS is an IoT datacenter-trojan for your home
URL: https://www.ctrl.blog/entry/cubbit-home-datacenter/
Last updated: 2026-08-23T22:04:33.000Z
Cubbit is a network-attached storage (NAS) device with a built-in partially peer-to-peer-powered backup and redundancy plan. Each file you store on your Cubbit is also encrypted and stored on other Cubbit customer’s Cubbits.

The Cubbit device itself is quite expensive, but there’s no monthly subscription fee past the initial investment. However, a closer inspection of Cubbit’s business model will make you say *no, thank you!*

I’ll start by discussing some technical details about the core customer-facing product. Cubbit has made some assumptions about how their product will be used, which may become a problem in the future. I’ll then move on to talk about the business they want to operate out of your home.

Each Cubbit comes with 2 TB of storage. However, only 1 TB is made available to the customer. 0,5 TB is reserved to serve as redundancy for other customers’ data. I’ll get back to their plans for the remaining 0,5 TB later.

Storage quotas and file distribution among Cubbit customers are orchestrated through a central server operated by Cubbit. File transfers between customer devices happen peer-to-peer. Your Cubbit will stop working if the central orchestration-server stops operating, however.

Each file you store on your Cubbit is split into 24 encrypted pieces. These 24 original pieces are then further processed into a total of 36 redundant pieces. These pieces take up 50 % more space than the original file. Each of those 36 pieces is stored on 36 different Cubbits. You only need any 24 out of those 36 pieces to reconstruct the original file. (This is similar to a RAID-6 storage model.)

To store a 10 GB file, the network will need to store 15 GB on your behalf. The maths don’t quite work out, though. Each customer has 1 TB storage space available to them. Replicating their data would require 1,5 TB of disk space. However, each customer only makes 500 GB available to the network.

The average customer can’t use more than 33,33 % (333 GB) of their Cubbit’s storage capacity. All the space set aside for redundancy across the entire network would get exhausted past this point. This kind of over-provisioning is not uncommon; many service providers would collapse if every customer used their full quotas. However, this seems wildly optimistic for a product with a premium price targeted at storage prosumers.

But what about that remaining 500 GB on each customer’s drive? Adding this reserved space to the network would increase the network’s maximum capacity to 66,66 %. Cubbit has some wiggle-room to accommodate their customer’s growing storage needs over time.

However, that doesn’t appear to be its plan for those extra 500 GB. The company plans to make the space available to other businesses as a service to fund Cubbit’s operational costs. To quote Cubbit’s website:

> “We can leverage the remaining 25 % of storage to provide advanced web services to businesses or professional users, in order to cover the costs and be able to maintain the network free for the final user, even in the long run.”

Their Kickstarter page suggests more specifically that it can be used to deliver content delivery networks (CDN), virtual private networks (VPN), edge-computing, and other commercial services. The primary value a Cubbit customer can offer is their residential IP addresses. It’s something you can’t get by renting a server in a datacenter.

A residential IP address is attractive to anyone wanting to use streaming video services in a foreign country. It’s also attractive to people wanting to hide their illegal activities.

All activity carried out through your Cubbit can be tracked down to your IP address. To your home. To *you.* Cubbit doesn’t clearly disclose the risks in using its products on its website.

Notably, few residential internet service providers (ISP) allow you to resell or make your internet connection available to third parties. You could be in breach of contract if people randomly start using your internet connection through your Cubbit.

I’m curious about how many of the people who backed Cubbit on Kickstarter realize the company intends to run a miniature datacenter out of their homes. Let’s just say that this monetization strategy isn’t prominently featured as part of the products’ promotional materials.

You’re the one covering the cost of the hardware, electricity, and internet access. The tit-for-tat of hosting other customers’ files in exchange for the same service is okay. However, I find the company’s plan to turn your home into a miniature commercial datacenter *without compensation* completely unacceptable.

Cubbit shouldn’t rent out capacity on your hardware without compensating you. It doesn’t make any difference if they’re only able to generate a few cents or hundreds of euros from your device. It’s no longer their property after you’ve bought it.

A 9 Euro/year subscription plan is actually a better option if Cubbit needs a source of income to operate their service and stay afloat as a company. No one wants a future where your toaster needs to mine Bitcoins to ensure the manufacturer extra money on top of what you’ve already paid for their product.
### Why pay for Grammarly when you’re the one doing the work?
URL: https://www.ctrl.blog/entry/grammarly-free-labor/
Last updated: 2026-08-23T22:09:05.000Z
Grammarly is a grammar and language analysis and correction service. It’s essentially providing those red and green squiggly lines that highlight your writing-mistakes in your favorite text editor. However, it’s offered as a software-as-a-service (SaaS) that can somehow afford non-stop ad-campaigns all over the web.

This particular SaaS puts a premium price sticker on its service and then have you do manual labor for them to boot! I’ll start by taking a jab at how Grammarly has designed its product to prey on your insecurities. I’ll then move on to discuss its high asking-price considering how much value you’re providing it besides the dollar amount you’re asked to pay.

The adverts for it features different ways the service can help you “improve” your writing. There are several variations of these ads. In some of these ads, Grammarly shows off impressive tools for improving your writing. It’s not made entirely clear that those features aren’t available for free. All the interesting features that are more advanced than what’s already built-in to most text editors cost 30 USD/month.

The service will try to leverage your fear-of-missing-out and socially mandated desire for perfection to get you to upgrade to their paid tier. The service isn’t sold on its merits but rather prey on your fears of making an innocent typo or that you’ve forgotten a comma somewhere.

Here’s an example rating of Grammarly’s own Terms of Service document. of how Grammarly rates a document. A rating like this one is shown next to your document as you’re working on it.

![A detailed Grammarly report where it found 259 additional writing issues.](https://cdn.synaps.media/control/content/images/2026/08/grammarly-tos-additional-writing-issues.png)

The progress bars feel like it has been designed to be deceptive. It may show a 20 % correctness score when there is only one trivial issue to fix. The percentages of “mistakes” in the document, as indicated by the unfilled progress bar, can be way off compared to the relative length of a document. The remaining 80 % of the document isn’t one big mistake just because of one trivial typo! Grammarly’s design sure can make it feel like it, though.

The ever-increasing number of locked-off Premium suggestions at the bottom of the suggestion list makes me feel insecure about my writing. I have no doubt Grammarly is trying to prey on my insecurities and my drive to want to complete their checklist.

The experience reminds me of the marketing practices used by some antivirus and “PC cleaning” software vendors. Some vendors made up issues to pressure you into purchasing their software to fix a list of problems they had willed into existence.

Grammarly is a product of a machine-learning model. Your writing isn’t manually proof-read by a human editor. Grammarly’s writing-improvements, corrections, and suggestions are synthesized by a computer algorithm. (To clarify, Grammarly does offer human proof-reader services at an even higher premium price. I’m talking about their core technology product here.)

However, you — the paying customer — is the one training that machine learning model. This happens a little at a time every time you use the service. It happens when you accept a correction it has identified, make your own edits to correct it, or dismiss the suggestion as a false-positive.

Just processing your documents with the service exposes it to countless revisions of your copy. It can see all the revisions you make to your documents and learn what changes you consider to be raising the quality of the document. Every change you make to your documents sends a signal back to the system and it learns from it as either a positive or negative enforcement of its algorithm.

In other words, you’re doing manual intellectual-labor and you’re creating value for the company. Its next killer-feature will partly be built based on what it learned from watching you work your documents to perfection. They even ask you to pay them a relatively high premium for the privilege of working for them to boot! You’re the one doing the manual labor, however. There’s an inherent imbalance in the relationship between Grammarly and its users.

At a rebated yearly price, Grammarly costs 140 USD/year for one person. Microsoft Office 365 has similar spelling and grammar tools and only cost 60 USD/year for one person. There are also other free, and even open-source, options that don’t cost anything at all.

Microsoft Office 365 gives you an entire office suite of productivity applications, online storage space, and email and communications tools. Sure, they all may use your data to train their own algorithms and machine-learning models. However, it does make Grammarly’s price-ask seem quite unreasonable in comparison.

Google has also begun rolling out similar machine-learning-powered spelling and grammar suggestions (trained by its users.) These are available for free in Google Docs and Mail.

I’m not arguing that Grammarly needs to be free of charge. I don’t believe Grammarly needs to [pay you for your data contributions](https://www.wired.com/story/ai-needs-data-you-should-get-paid/?ref=ctrl.blog) either. However, I do believe their price should come way down to something closer to 20 USD/year rather than 140 USD/year.

You’re contributing and helping to build and improve the company’s service. You’re getting spelling and grammar corrections for your documents in return, but it’s not like their suggestions are perfect and leaps and bounds better than what you can get elsewhere. The service isn’t automated and you still need to put in work to make use of the service.

It doesn’t matter if Grammarly’s services are objectively two or even three times better than their competitors. In the end, Grammarly preys on your fears of making trivial and ultimately *unimportant* mistakes in order to ask for too much of your money. Paying for Grammarly may help improve your writing. However, staying away from its services entirely may still be the better option.
### Google shouldn’t be the only source of interest-based recommendations
URL: https://www.ctrl.blog/entry/web-discovery/
Last updated: 2026-08-23T22:24:14.000Z
There are more great articles, essays, and media content available on the web on any given subject than anyone could read in a lifetime. There’s also great new stuff added every day. Putting aside issues like information overload and the filter bubble for one second; how are you supposed to keep up with all our interests and discover more great online content?

There are some notable examples of personalized news-recommendations available. These are based on what you’ve clicked on through the service in the past. These include the Apple News app, Google News For You, [Microsoft Feed](https://www.ctrl.blog/entry/microsoft-feed-hummingbird/), Yandex Zen, and a handful of others.

It’s not only news organizations that publish great content on the web, however. Only Google seems to want to tackle interest-based recommendations from around the web.

Web browsers from the companies mentioned above, except Apple, also put [news recommendations on their new-tab pages](https://www.ctrl.blog/entry/newtab-news/). One of the most interesting web browser-approaches comes from Sleipnir, however. It auto-discover syndication feeds from your most visited websites and [compiles a personalized news feed](https://www.ctrl.blog/entry/sleipnir-site-updates/) out of them. That way, it features new stuff that may interest you from any website you may frequent.

Firefox had a brief flirt with a company called LaserLike in 2018\. The two companies created [Firefox Advance](https://blog.mozilla.org/en/products/firefox/firefox-offers-recommendations-with-latest-test-pilot-experiment-advance/?ref=ctrl.blog): an experimental content-recommendation system that would appear inside the Firefox browser. Advance would show a sidebar filled with recommendations based on the page you currently had open in the browser.

The Firefox Advance experiment disappeared shortly before [LaserLike was acquired by Apple](https://appleinsider.com/articles/19/03/13/apple-confirms-buyout-of-machine-learning-startup-laserlike?ref=ctrl.blog).

I tested Advanced while it was available. I found several interesting things to read and I was generally impressed with the recommendations I received. Advance even suggested relevant and interesting articles even for some of the more obscure topics I cover here on Ctrl blog.

I’ve been looking for a replacement service ever since it went away. Ideally, something that works the same way where I could feed it a link to a webpage and it would give me back relevant articles and recommendations.

I must acknowledge here that Firefox Advance pushed its fair share of conspiracy theories, porn, and Nazi-propaganda at me. This was the exception and not the norm, however. Their filtering algorithms weren’t perfect but the idea was interesting.

However, there is nothing quite like it available today. As far as I know, Advance’s instant per webpage recommendations still is a unique take on content-recommendations.

**Update** (2019-10-30): [David Byrne](https://www.davidbyrne.io/?ref=ctrl.blog) tipped me about an experimental Google Chrome feature from July 2018. Contextual Suggestions, or Explore-on-Content, would suggest pages relevant to the active tab at the click of a button. Android Police has [more details about it](https://www.androidpolice.com/2018/07/26/google-chrome-starts-suggesting-articles-like-one-youre-reading/?ref=ctrl.blog). The feature never hit Chrome stable or beta releases. It was [removed](https://bugs.chromium.org/p/chromium/issues/detail?id=938050&ref=ctrl.blog) from Chrome in May 2019.

**Update** (2019-10-30): The Explore-on-Content feature was renamed Google-on-Content and rolled into the Google app for Android and iOS. It’s still available today! It may pop up as a list of suggestions at the bottom of the screen when you visit webpages opened in the Google app. As far as I can tell, these pop-ups mostly show up on news sites and only link to other publications’ take on the same news story.

The closest alternative is [Google Discover](https://blog.google/products/search/introducing-google-discover/?ref=ctrl.blog) (formerly known as “Google Feed” and “Google Now.”) Google Discover will pull on all the data Google knows about you and recommend things it believes you’d be interested in reading.

Google has a variant of Google Discover called [Chrome Suggestions](https://blog.chartbeat.com/2018/04/11/google-chrome-suggestions-in-more-detail-than-you-could-want/?ref=ctrl.blog). These are similar content recommendations to those you get in Google Discover, but they appear on the new-tab page on Chrome on mobile instead of in the Google app.

Their offerings are heavily weighted towards news articles, but occasionally feature some content from other corners of the web. You only have limited control over what topics and content that appear in your recommendations.

Google’s recommendations are based on the data it has creepily collecting on you over the years. The collected data is then distilled down into a persona and Google’s A.I.’s then try to predict what they think you’d want to click on next.

There are still a few options if you’re looking for recommendations from all over the web. You can try to find someone curating an email newsletter email focused on your niche interests. If you’re lucky, there may even be an online community website dedicated to one of your interests.

Reddit is probably your best bet if you want to find a single website that covers multiple niches. Many interest-oriented subreddits have dedicated users who find and share great links. However, Reddit can be an intimidating and unwelcoming place to many. Each subreddit has its own culture and norms, and you may not share the opinions or newsworthiness-ness criteria of the community that has developed around your niche.

I wish there were more services like LaserLike and that Google Discover had a lot more competition. Google has little (if any?) competition when it comes to recommending content from all over the web. The other alternatives that I’ve mentioned previously in this article are focused on providing news recommendations from a “trusted” set of partner news organizations.

I don’t dislike human curation. However, I do value the breadth and depth of recommendations based on a complete and unhuman knowledge graph and understanding of what’s out there on the worldwide web. After all, there’s way more content out there on any given subject than any one human could possibly read in a day. Or a lifetime.

Right now, the whole industry seems poised to completely cede control over content discovery to Google. What I want to see is more options, more competition, and more different takes on interest-based content recommendation services.
### The curious case of the working-directory-changing Rakefile
URL: https://www.ctrl.blog/entry/ruby-chdir-rakefile/
Last updated: 2026-08-23T22:21:28.000Z
A month ago I ran into issues with Syncthing that caused it to [delete files that had been newly deleted and recreated](https://www.ctrl.blog/entry/syncthing-deletes-recreated-files/). I thought that fixing that would solve all my issues with files randomly disappearing. Unfortunately, I’m back with another installment of “where did my files go?”

Before I get started, here are some quick introductions in case you’re unfamiliar with the standard Ruby toolbox: [Rake](https://ruby.github.io/rake/?ref=ctrl.blog) is the Ruby programming language’s task automation tool. A `Rakefile` contains a Ruby project’s tasks; which can be run in parallel threads. Rubygems is both a Ruby library and a management tool for installing other Ruby packages/libraries (“gems.”)

My Rake tasks sometimes wouldn’t get off the ground due to an `Errno::ENOENT ‘No such file or directory’` error that appeared seemingly at random. Despite what the error message claimed, the files in question — never the same two times in a row — were very much present.

What made the situation even stranger was that the error messages were raised by a function inside of Rake. The function in question, used to check task file-dependencies, would first check that the file existed. Then, on the very next line, it would attempt to look up the modification-time of the file which would fail and raise the `Errno::ENOENT` error. (See their implementation in [file\_task.rb](https://github.com/ruby/rake/blob/2a16d036ccafa51c407a648e081b686ded03e784/lib/rake/file%5Ftask.rb?ref=ctrl.blog#L22-L23).)

To make things worse, the problem would disappear almost completely if I introduced any delays. The problem would seemingly disappear if I tried to get debug info from Rake with `rake --trace` or trace the storage system calls with `strace rake`. The most reliable workaround involved relocating my project’s files from my [fast NVMe SSD](https://www.ctrl.blog/entry/btrfs-vs-ext4-performance/) to a slow USB 2.0 thumb-drive.

In other words, I was dealing with a Heisenbug: a bug that seems to disappear or change when attempting to debug it. The observed behaviors also told me a whole lot about what could be going on; and none of it was good news. The problem was clearly some sort of timing-dependent race-condition. It could be a problem in just about any layer all the way down in the file system or the operating system kernel itself.

After literally thousands of runs, I’d managed to catch the bug while running with `strace` and could better see what was going on. Something was calling the `chdir` (change working directory) system call and was changing the Rake process’ working directory while Rake was busy checking file dependencies.

All POSIX-like operating system keeps track of each process’ working-directory on the operating-system level. Processes only have one working directory, so changing it affects all of that process’ threads. All my paths were written relative to the current working directory and nothing in my code would even attempt to change the current working directory. Ruby would raise `Errno::ENOENT` errors because there indeed wasn’t any files with the specified relative paths inside the *wrong* working directory.

The *something* doing the working-directory switcheroo was walking down the directory three towards the system root directory. At each directory level, it was looking for four files: `gem.deps.rb`, `gems.rb`, `Gemfile`, and `Isolate`. You may have realized, as I did at this point, that this was Rubygems looking for the project’s package-instruction file. My project didn’t need a `Gemfile` so it didn’t have one either.

As mentioned earlier, Rake runs tasks in parallel threads. Threads yield execution when blocked by operations such as interacting with the file system.

So, one Rake task would check and verify that a file exists and then yield the execution. The execution would be picked up by Rubygems who turned around and switched the working directory and yield execution before it had time to switch it back again. The execution would then continue in the previous or a completely different task thread; one that didn’t expect the working directory to have changed.

My code didn’t import the Rubygems library. Importing it is [considered an anti-pattern](https://tomayko.com/blog/2009/require-rubygems-antipattern?ref=ctrl.blog) even according to [Rubygems’ own documentation](https://guides.rubygems.org/patterns/?ref=ctrl.blog#requiring-rubygems). However, Rake does import it! I’m not going to discuss whether this is an anti-pattern or not. However, importing the Rubygems library in a multi-threaded process can definitely cause problems.

As I’d already discovered, Rubygems switches the process working-directory while looking for its own instruction files. (See their implementation in [bundler\_version\_finder.rb](https://github.com/rubygems/rubygems/blob/c8cb41b691d1f51299c7c36b4495f815bd09d89e/lib/rubygems/bundler%5Fversion%5Ffinder.rb?ref=ctrl.blog#L85-L90) and [util.rb](https://github.com/rubygems/rubygems/blob/e458e463a72532fb9f82569c18c5161b258a7d2d/lib/rubygems/util.rb?ref=ctrl.blog#L70-L81).) Switching the working-directory in a library’s set-up process just to look for the presence of a couple of files in that directory is most definitely an anti-pattern.

It’s a common pattern in Ruby to change the working directory in a block of code and relying on Ruby to switch back at the end of the block’s execution. As discussed earlier, the current working directory is a per-process instance variable tracked by the kernel. This can’t be done in a thread-safe behavior without explicitly locking the process so the thread can run to completion.

I don’t understand why this happens. Rake loads Rubygems early in its initialization process — before my `Rakefile` or code is loaded. As far as I can understand, neither Rake’s threads, the threads I create with Parallel, nor the main thread ever need to load the Rubygems library anew. I simply don’t know enough about the inner workings of Ruby to fully explain the observed behavior.

I can work around the problem by creating an empty `Gemfile` next to my `Rakefile`. Rubygems finds the file its looking for immediately and doesn’t begin its directory-walking journey down the directory hierarchy.

Ruby version 2.6.3p62, Rake version 13, and Rubygems version 3.0.3.
### Ctrl blog was unavailable in Bing Search for a month
URL: https://www.ctrl.blog/entry/bing-delisted-canonicalization/
Last updated: 2026-08-23T22:02:15.000Z
Ctrl blog was nowhere to be found in the Bing search-index for the entire month of September 2019. This lead to a decline in new readers referred from DuckDuckGo and other Bing-powered search engines.

It may not appear as Bing matters as only 2 % of monthly readers come from Bing. However, *the Bing index* does matter. About 5 % of monthly Ctrl blog readers come from DuckDuckGo. DuckDuckGo is a meta-search engine that combines the results from multiple search indexes to power their search results.

DuckDuckGo’s ranking is heavily influenced by Bing and I lost almost all traffic coming from DuckDuckGo when Bing had delisted Ctrl blog. There was still a trickle of readers coming in via results in DuckDuckGo. This was mostly due to DuckDuckGo’s use of search results from Yandex — an independent search index based in Russia.

The delisting from Bing also impacted the admittedly smaller number of readers coming from AOL Search, Ecosia, SearX, and Yahoo! Search. Combined, these account for another 0,6 % of monthly readers.

Ctrl blog’s archive search ~~is~~ was powered by Qwant, which in turn is powered by Bing. (Qwant refuses to admit this, but that’s a story for another time.) When Ctrl blog dropped out of Bing, Qwant stopped showing any search results and the archive search form stopped working.

All in all, roughly 8 % of monthly readers discover Ctrl blog through Bing.

I don’t know what caused Ctrl blog to be delisted. I reached out to Bing Webmaster Support. They couldn’t offer more information than what was available in the Bing Webmaster self-service Tools. I was told they couldn’t answer questions about individual websites, and that was that.

The Bing Webmaster Tools didn’t indicate any new problems with my site. It showed that every page I expected to be indexed was indexed successfully (even though the page didn’t show up in real search results.)

I don’t know for sure what the issue was. However, I suspect the problem may have had something to do with URL canonicalization.

A canonical URL is the preferred URL address representation for a single unique webpage. I kept an eye on the search results for the site-specific special query [site:ctrl.blog on Bing](https://www.bing.com/?q=site:ctrl.blog&ref=ctrl.blog) every day while Ctrl blog was delisted. This search query should return every indexed page from the Ctrl blog domain.

The query returned 0–100 results every day. What was odd about the results was that they never pointed to any of my preferred canonical URLs. Instead, they’d point to variations of it. Like, the canonical URL but without the `.html` file extension, with a `;sf` suffix, or with some kind of URL query parameters at the end of the URL. These variants ranked low on search result pages and were usually gone within another day or two.

I recognized most of the URL variants that Bing would put up in place of the canonical ones. I’ve changed domains and restructured URLs a few times over the years.

However, I’ve always been careful to create [permanent](https://www.ctrl.blog/entry/permanent-redirects/) [redirects](https://www.ctrl.blog/entry/rewriting-urls-reorganizing/) from every old URL to their new home. These are maintained for years. I also follow best-practice like including a `<link rel="canonical">` hint on every page ([RFC 6596](https://www.rfc-editor.org/rfc/rfc6596.html?ref=ctrl.blog).) The correct canonical URL is also included in the [XML sitemap](https://www.ctrl.blog/sitemap.xml) and other discovery mechanisms.

So, what was causing Bing trouble with indexing my pages? I don’t know for sure but I may have identified the underlying problem. If you [follow this blog](https://www.ctrl.blog/follow.html) regularly, then you may recall that I’ve been experimenting with ways to [shrink the page-weight of the metadata in the <head> element](https://www.ctrl.blog/entry/html-meta-order-compression/).

One of the methods I’ve been experimenting with is reducing the number of unique elements by combining duplicate elements. To make a long story short: some HTML attributes — like `class`, `rel`, and `property` — can contain a single value or an unordered list of space-separated values. I ended up with an element like this:

```html
<link rel="canonical something-else">
```

This is perfectly valid HTML, but I suspect it may have triggered a bug with Bing’s search crawlers. I’ve previously written about similar problems with Facebook and Twitter’s [poor-quality RDFa parsers for Open Graph](https://www.ctrl.blog/entry/rdfa-socialmedia-metadata/) metadata.

I left one page with the two-value `link` element and reverted the change on every other page. Almost all pages on Ctrl blog reappeared in the Bing index days after I reverted the above change and made sure the `rel` attribute only contain a single value.

I don’t know for sure whether this indeed was the problem. The single page with the two-value `link` element didn’t reappear in the index. That doesn’t necessarily mean anything, though. A few other pages also didn’t get re-indexed and are still delisted.

Publishing a webpage can sometimes feel like you’re preparing and leaving an offering to the Internet Gods. You try to please a higher power that you don’t truly understand. The Internet Gods control whether what you publish is seen by a million people, hundreds, ten, or maybe none at all. All you can do is pray and hope you won’t offend them.
### Review: Joplin note-taking app
URL: https://www.ctrl.blog/entry/review-joplin-notes/
Last updated: 2026-08-23T22:18:41.000Z
[Joplin](https://joplinapp.org/?ref=ctrl.blog) is an open-source clone of Microsoft OneNote. It’s a webapp at heart, but it doesn’t offer a version for use in your web browser. The webapp is instead packaged and offered for installation on Android, iOS, Linux, MacOS, and Windows.

Joplin is a stand-alone software client and not a service. However, it has built-in support for syncing with any WebDAV-capable server, Microsoft OneDrive, or Dropbox. This means you can host it yourself, or use any commercial WebDAV service provider, and easily switch between providers.

Joplin has optional support for end-to-end encrypted notes. This lets you keep your notes private even when synchronizing with a server you don’t fully trust (such as Google Drive or Microsoft OneDrive).

The desktop apps for Linux, MacOS, and Windows are all the same webapp packaged up for each platform. There is little platform integration; including no support for native spell-checkers. The apps look the same across the board.

Like OneNote, Joplin organizes notes and tasks in notebooks/collections. The UI is also similar with a three-panel setup: the first panel manages notebooks, the second manages the notes and tasks inside a notebook, and the last panel is used to display and edit notes.

The desktop apps are a bit slow but they get the job done. They don’t stand out from the competition in either a positive or negative way. They get the job done with minimal fuss.

The Joplin app for Android is another story entirely. Well, not entirely. It’s still just the same webapp in new packaging. Unlike my experiences with the desktop apps, I kept running into unpolished corners and bugs in the Android version.

One of the first things you want to do is to set up sync and type in your encryption password. However, I had a hard time getting my settings to persist. Unlike any other Android app, you have to tap a save button — with a diskette icon no less (pictured below) — to actually apply your settings. This concept is so foreign on the Android platform that it took me minutes to work out!

Once I’d set up syncing I started noticing more oddities and problems right away. The first being that tapping buttons and UI elements didn’t reliably trigger the associated action. Some elements like toolbars, buttons, and text move and change size as I navigated around the app.

The text editor, arguably the most important part of a note-taking app, has a whole slew of issues. It frankly doesn’t get the basic text-processing right. I’ve mentioned already that the app doesn’t integrate with platform spell-checkers so you’re left on your own in that department.

There’s a noticeable delay from when you type in characters on the on-screen keyboard before they show up on the screen. The same goes for text selection as the app gets noticeably slow while you try to drag and select text. The unresponsive UI is a bit annoying and the inconsistencies in UI don’t leave a good first impression.

![Low contrast ratio between selected text and the text selection highlight color](https://cdn.synaps.media/control/content/images/2026/08/joplin-text-selection-contrast.jpeg)

Joplin text selection highlighting by [Daniel Aleksandersen](https://www.daniel.priv.no/?ref=ctrl.blog) licensed under [CC0 1.0](https://creativecommons.org/publicdomain/zero/1.0/?ref=ctrl.blog).

I had problems reading any text I had selected as the text doesn’t change color to accommodate the text selection highlight color. It’s common design practice to turn the text white to increase the text contrast against the selection background color. The Joplin app leaves the default color resulting in a low-legibility [1,75:1 contrast ratio](https://webaim.org/resources/contrastchecker/?fcolor=316F9A&bcolor=0196FE&ref=ctrl.blog).

Joplin doesn’t handle scrolling properly in the text editor. The text view moves exactly as much as your finger and no more. There’s no support for momentum scrolling (something which is supported in the desktop versions.) This quickly became frustrating as it takes a lot of swipes to navigate inside long notes.

Other apps on Android occasionally have issues with bringing up the on-screen keyboard when you’re in a text field. It happens. However, it happens very frequently with Joplin. I’ve also been typing on the keyboard when it’s suddenly dismissed and I can’t bring it back up again. Tapping the text area or trying to movie input-focus from the title to the body fields don’t bring it back either.

There’s also a strange button with a diskette icon on the main toolbar. This is the same button that gave me trouble on the setting screen earlier. However, it’s not necessary to tap the button to save your notes. Changes to notes are saved automatically.

The unexplained button is only active right after you’ve typed something. After a second it turns into a disabled state and replaces the icon with a checkmark. The button flickers between these two states constantly when you’re typing. This can be quite distracting.

I’m still not sure whether it’s meant to represent an unsaved state, unsynced state, or what role it fills. This button is nowhere to be found in the desktop versions of Joplin.

The most recently edited note is sometimes titled “Untitled” in the notes list even when you’ve given it a title. The problem goes away if you go out of the app and back again, or opening another note and returning to the notes list. This happens frequently on the Android version but I’ve never seen it in the desktop version.

Don’t get me wrong: Joplin is a good note-taking solution for your desktop computers. You can jot down things quickly, find your notes later, and move on with your day. However, working with text in the Android app is frustrating. The Android app quality isn’t up to snuff. You better use another app if you intend to do take notes on the go.

**Reviewed:** [Joplin](https://joplinapp.org/?ref=ctrl.blog)

**Review rating:** 6 / 10
### How to make a vanity Payment Pointer for Web Monetization
URL: https://www.ctrl.blog/entry/ilp-payment-pointer-redirects/
Last updated: 2026-08-23T22:11:51.000Z
This is a more detailed follow-up on [Interledger Protocol](https://interledger.org/?ref=ctrl.blog) [Payment Pointers](https://paymentpointers.org/?ref=ctrl.blog) (ILP3) Specifically, I’ll talk about how to take a long and unruly ILP3, like the one you get from most wallet services, and turn it into a shorter and more memorable vanity ILP3.

Web Monetization is a proposed scheme to standardize a method for creators and websites to get paid for their content. It’s meant as an alternative to the much-criticized web-advertising ecosystem where people can micro-pay the websites they visit instead of viewing ads. I discussed the proposed [Web Monetization API](https://webmonetization.org/?ref=ctrl.blog) standard and “streaming payments” in a [more detailed earlier article](https://www.ctrl.blog/entry/coil-web-monetization/).

The new Web Monetization API needs participating webpages to include a unique ILP3 address in a `<meta>` element. The required element looks something like this:

```html
<meta
  name="monetization"
  content="$pay.example.com/a0b1c2d3e4f5g6h7i8j9">
```

The ILP3 is a URL where the `https://` prefix has been replaced by a `$` character (presumably for marketing purposes). The requirement to use a dollar sign may be seen as an unwanted Americanization outside markets that use it as their currency. Furthermore, [URLs don’t belong in <meta> elements](https://www.ctrl.blog/entry/html-link-metadata/) but I’ll not die on that hill.

The ILP3 is intended for Web Monetization-enabled services like Coil (discontinued) and other Web Monetization API implementations. No one will ever see the ILP3 itself. However, that doesn’t mean you can’t have fun with setting up a short vanity address using your domain!

All you need to set up your short-form ILP3 is a domain name, an HTTPS web server, and you’ll need to set up a redirect. HTTPS is an absolute requirement by the ILP3 standard.

ILP3 without a path component is resolved by looking up ILP3’s Well Known URI (RFC 8615) path at `/.well-known/pay`. This path can be redirected from your domain to the ILP3 given to you by your wallet provider, e.g. Uphold or XRP Tip Bot.

You should use a temporary redirect, because as we all know: [permanent redirects are supposed to be permanent](https://www.ctrl.blog/entry/permanent-redirects/). You’ll want to keep your options open in case you change your mind and want to use another wallet provider in the future.

The original ILP3 contains a sequence of unique characters and doesn’t compress well. Switching out my wallet provider’s Payment Pointer with my shorter version saved on average 40 bytes from each page. In other words, 75 % of the original ILP3 URL doesn’t get any smaller when compressed.

To give some context to those numbers: Shortening the ILP3 in my HTML pages saves over 50 % more bytes used for page metadata than the much more complicated method I discussed in a recent article on [HTML metadata compression optimization](https://www.ctrl.blog/entry/html-meta-order-compression/).

Redirects, as they always do, adds cost in terms of added latency. Increased latency will delay the start of streaming payments from Web Monetization services like Coil. This added latency means you risk impacting your Web Monetization earnings unless your entire web stack is up to the task and can deliver hyper-fast DNS resolution, server connections, and request responses.

There are some benefits to controlling your published ILP3 address, though. You can change the redirect in the future and have it take effect even when it has been republished through a third-party web cache (like an AMP Cache or Internet Archive) or a distributed cache (like Dat or IPFS).
### Optimize your <head> metadata for better compression
URL: https://www.ctrl.blog/entry/html-meta-order-compression/
Last updated: 2026-08-23T22:11:27.000Z
[HTML Tidy](http://www.html-tidy.org/?ref=ctrl.blog) can clean-up HTML documents by normalizing them, stripping comments, sorting element attributes alphabetically, and outputting consistent pretty-printed markup. The result is an HTML document with less unique data with more consistent and repeating patterns. This yields improved Gzip/DEFLATE compression-rates compared to a less neatly organized documents.

You can take these principles one step farther and get even better compression-rates by pre-processing and re-arranging HTML elements that don’t affect the document presentation or semantics. The metadata elements in the `<head>` element are prime candidates for this type of optimization.

Similar data compresses well, but similar data a short byte-distance apart compresses even better. This is all you need to know about how the relevant compression algorithm works for this article. I’ll get back to a more technical explanation at the end of the article.

Webpages commonly need to [include duplicated metadata](https://www.ctrl.blog/entry/rdfa-socialmedia-metadata/) to [ensure compatibility](https://www.ctrl.blog/entry/browser-reading-mode-metadata/) with popular apps and services. Due to poor standardization efforts, this involves requires a lot of duplicated data.

The document order of the metadata elements `<link>`, `<meta>`, and `<title>` (with exceptions) doesn’t affect how the document is displayed. These elements can be reordered losslessly. In my implementation, I’ve opted to leave the `<script>` and `<style>` elements unmodified below all the other metadata elements as their order *may* be important.

The order of `<link rel="stylesheet">` elements can affect the stylesheet parsing if your layout depends on the stylesheet overrides. This means that you’re sending redundant data to the client, and you should stop and fix that before proceeding with the optimization discussed in this article. The `<noscript>`\-wrapped lazy-loading `<link rel="stylesheet">` anti-pattern might also break when you move `<link>` elements about.

A second quick note on compatibility requirements: the `<meta charset="utf-8">` element must appear as the first child element of `<head>` to after 

to maintain compatibility with ancient libraries and tools still in use today.

### Implementation

HTML elements should already have been normalized on a single line per element with alphabetically sorted element attributes. Again, this is something HTML Tidy, or a pretty-printing or HTML minifying tool can handle for you. You can build on that base, and extract all the `<meta>`, `<meta>`, and `<title>` elements, and lastly all the `<link>` from the `<meta>` elements, and lastly all the `<head>` section of the document.

Once you’ve separated out that list of elements, add the `<meta charset="utf-8">` element back to the document and drop it from your list. Then all you need to do is to sort your list and put everything back into the document.

When considering the sorting order, the unique `<title>Example Title</title>` element can be sorted as `<meta content="Example Title" name="title">`. This element is only used once but this sorting order will place it alongside other metadata elements that duplicate its value fully or partially.

The Open Graph Protocol [annoyingly uses a <meta> element to express linking relationships](https://www.ctrl.blog/entry/html-link-metadata/) instead of the dedicated `<link>` element. You can optimize things further by moving `<meta>` elements whose value is a URL down to the bottom of the `<meta>` elements (just before the first `<link>` elements.)

These pre-processing optimizations should yield a measurable improvement in the document compression rates. Here’s a short example document sorted using the logic outlined in this article:

```html
<meta charset="utf-8">
<meta content="Example Title" property="og:title">
<title>Example Title | Website</title>
<meta content="Example" property="og:description">
<meta content="Example" name="description">
<meta content="https://example.com/" property="og:url">
<link href="https://example.com/" rel="canonical">
<link href="/asset/style.css" rel="stylesheet">
<link href="/asset/favicon.svg" rel="icon">
```

You may want to study what you have in the `<head>` section in your documents and apply further optimizations. However, removing redundant tags and generally cleaning it up a bit may very well give you a better end-result than implementing the micro-optimizations discussed in this article.

### How much does all of this save?

I’m not gonna lie. This isn’t a magical solution that will save you a whole lot of bytes. The prerequisites for implementing this, like normalizing the document and sorting element attributes, will likely yield better compression gains than this. You should see better results the more metadata your documents contain.

However, the methods discussed here are can be automated. This is likely only relevant to if you’re implementing a web-optimization library, or writing an article about it for your blog.

I applied the metadata sorting pre-processing optimizations discussed in this article to every page on this blog. It saved a median of 26 bytes from the compressed file size per page. That’s about 0,58 % of the average total compressed file size. The size of the uncompressed files doesn’t change as they still contain the same number of bytes.

I’ll need to briefly go into how the DEFLATE algorithm works to better explain why these optimizations steps save any data at all. It all comes down to making data more simular to data stored close to it in the file.

DEFLATE compression works in two stages. The first stage looks for repeated byte-sequences. For our purposes, you can think of it as identifying repetitions of the same substrings within a text. DEFLATE replaces duplicated sequences with the a back-reference to how far back it saw the previous copy of the sequence (the distance) and the length of the duplicated sequence, and with the length of the duplicated sequence (a back-reference.) This information tells the decompresser where to find the data and how much of it to copy.

The second stage uses a bit-reduction technique called Huffman coding. Essentially, frequently used bytes are assigned a shorter code and rarer ones get longer codes (requiring more bytes to store them.) There’s [more to it](https://www.rfc-editor.org/rfc/rfc1951.html?ref=ctrl.blog) than that but that’s the short version.

For text documents, this essentially builds a new compressed character encoding table per file based on what characters are common in the file. However, the same trick is used to encode the distance and length information used for the de-duplication back-references in the file.

In other words, by sorting the metadata elements you restructure the document in a way that increases the repetition and reduces the distances between copies of the same byte-sequences. That enables DEFLATE to save a few bytes encoding this information with more efficiently bit-reduced back-references.
### A sync bug in Standard Notes kept deleting my notes
URL: https://www.ctrl.blog/entry/standard-notes-dataloss/
Last updated: 2026-08-23T22:22:26.000Z
Note-taking is how I remember things. I jot them down on my phone or laptop and expect them to be available on all my devices within seconds. I used to use [Simplenote](https://www.ctrl.blog/entry/review-simplenote/) but I kept having issues with it losing my notes. I abandoned it in favor of [Standard Notes](https://standardnotes.com/?ref=ctrl.blog) five months ago.

Standard Notes is a minimalist note-taking app available for all leading platforms. It’s open-source and your notes are end-to-end encrypted. This means I can trust the free hosted-service to keep my notes private, and that I can set up and host my own servers if the free service were to go away.

The service also has some very limited revision-history capabilities. The feature is limited to the history of changes in your active session on the current device. This feature could have been very useful if it persisted and synced across devices. Instead, it’s a rather pointless gimmick.

The promise of any of many note-taking services that’s available on the market is that they’ll keep your notes safe and in-sync between devices. For the most part, Standard Note gets the job done. Unfortunately, history is repeating itself.

This is the second time I’ve written this article. Standard Notes overwrote the original draft for it with a different note and I was unable to restore it. This isn’t the first time this has happened either.

I’ve lost notes (and thereby a lot of work) almost every week that I’ve been Standard Notes. I’d like to share my experiences with it before I set off looking for yet another alternative note-taking solution.

I don’t know the exact cause of the issue. I use Standard Notes several times a day from multiple computers and my Android smartphone. The unlucky note at the top of my list of notes is sometimes vanishes or it gets overwritten with another note. The top note is either a pinned/important note, or one of the most recently modified notes.

I’ve noticed this note vanishing when I try to move another note to the trash folder. The note I tried moving is deleted but don’t even up in the trash. Simultaneously, the note at the top of my list of notes is given the same treatment. Both notes disappear from all my devices and I’m unable to restore them as they didn’t end up in the trash folder.

A similar issue happens when I’m editing several notes within a short time of each other. I’m typing in Note A, then I move on to type something in note B, and I back and forth. Suddenly, the unlucky note at the top of the list is overwritten by a copy of one of the notes I’ve been working on.

I can switch to the overwritten note but its session revision history will only contain one entry which will display the date for the original note I expected to be there. The revision history won’t show that it has recently been changed.

I’m obviously unhappy about losing work that I trusted the service to keep safe. However, what really gets to me isn’t the notes that I know that I’ve lost. I can recreate those from memory. It’s the notes that I don’t remember losing that frustrates and saddens me. It was probably something important since I took the time to write it down. Maybe it was a good idea for an article? or something I needed to get done. Whatever it was, it’s gone now.

At least once a day I’m also greeted by an error message when I open the Standard Notes webapp:

> “The note you are attempting to save can not be found or has been deleted. Changes you make will not be synced. Please copy this note’s text and start a new note.”

I sigh and reload the tab and everything appears to be working just fine. As far as I know, I’ve never seen this error when I lose a note. It only appears sometimes when loading the webapp. Whatever the cause, it’s not inspiring confidence in the service.

**Update** (2021-06-04): Lead-developer Mo Bitar [says](https://github.com/standardnotes/forum/issues/716?ref=ctrl.blog#issuecomment-852188327 "Issue #716: Potential issue with notes replacing other notes") the dataloss issue has been fixed in recent versions of Standard Notes. He says the underlying issue was caused by a timing issue (“race-condition”) during data synchronization. I haven’t confirmed the fix; as this issue lead me to switch to [Joplin](https://www.ctrl.blog/entry/review-joplin-notes/). Though, now might be the time to give Standard Notes another try.

For the time being, I feel safer working with my notes in plain-text files that I sync between my devices with [Syncthing](https://syncthing.net/?ref=ctrl.blog). Yes, Syncthing has its own share of [sync and dataloss issues](https://www.ctrl.blog/entry/syncthing-deletes-recreated-files/). However, at least I know what those issues are and my notes will get regularly backed up as part of my hourly backup processes.

I do recommend that you give Standard Notes a try. The apps and service is good and it has a lot of potential. Just don’t use it to store anything you’d mind losing.

I’ll look into alternatives to Standard Notes soon. I’ll probably stick with an open-source solution and not switch to Evernote, Microsoft OneNote, Google Keep, or another proprietary note-taking services.
### How to detect machine-translated webpages
URL: https://www.ctrl.blog/entry/detect-machine-translated-webpages/
Last updated: 2026-08-23T22:04:56.000Z
Everyone visiting your English-language-only website reads it in English, right? That’s a safe assumption to make, right? Well, no. Search engines including Baidu, Bing, Google, Naver, and Yandex include “Translate page” links next to results in foreign languages. Some web browsers like Google Chrome, Naver Browser (Whale), and Yandex Browser will auto-translate pages written in foreign languages to their users’ native languages.

As a writer, you likely only write in one language. Yet, your content isn’t exclusively consumed in the original language. Instant machine-translations has significantly lowered the web’s language barriers.

Machine-translation is an often unmeasured page-quality factor that greatly impacts your readers’ experience and comprehension. Without it, they may literally not understand a word of what you’re trying to communicate. However, machine-translations aren’t yet perfect. A poor-quality machine-translation may be to blame if a high percentage of readers abandon your pages quickly.

This may be an indication of poor grammar and spelling in the original language version. Or it may be an indication of a technical problem with your webpages. Your pages don’t declare the proper language using language codes like `<html lang="en">` at the start of the page. Or you may have an [issue with improper use of text-level semantic structure](https://www.ctrl.blog/entry/html-semantic-improve-machine-translation/).

Whatever the issue, it can be useful to detect the presence of and measure how machine-translations affect your webpages’ performance. It can affect both page-loading performance, engagement, and other measurements your consider to be important.

As I started getting into earlier, there are two primary types of machine-translation services: proxy-based web-tools and web-browser based tools. The former type proxies pages through a translation-service and serves it up to the reader from their servers. These can be detected in JavaScript by reading the `window.location` property.

The latter type is more difficult to detect as the text is translated and swapped in the web browser. However, these services can still be detected by looking for `document` object modification artifacts that create a recognizable fingerprint.

#### No standards

Before I go too far into the weeds on this one, I’d like to take a moment to comment on the lack of standardization in this space. Machine-translations is something more and more web browsers do, but like [Reader Mode](https://www.ctrl.blog/entry/browser-reading-mode-parsers/), it’s an unstandardized rendering mode.

The machine-translation services work by replacing text with machine-translations. However, they don’t mark-up the translated versions of the page properly to indicate the new language, e.g. using the `lang` attribute. This can cause issues for browser extensions and accessibility services such as text-to-speech synthesizers.

Additionally, there should be a standard event emitted when a page is translated to tell the page that “hey, all the loaded content have been changed by a translation service”. This would make it far easier to detect these service’s handiwork. It would also enable developers to re-adjust their page layouts or display a notice to their readers indicating that they’re reading a machine-translation.

The rest of the article will cover how to detect machine-translation services despite the lack of standards. Due to the lack of standardization, the methods will require ongoing testing with as the translation services change over time.

#### Proxy-based (server-side) machine-translations

I’ll start by getting the easy bit out of the way first: detecting proxied machine-translation services. You can do this straight away without having to wait for the document to load fully.

The following is a list of conditional tests in JavaScript for detecting popular translation services.

```javascript
// SPDX-License-Identifier: CC0-1.0

let hostname = window.location.hostname;

// Google Translate
hostname == "translate.googleusercontent.com" ||
hostname.startsWith("translate.google.")

// Microsoft Bing Translate
[ "www.translatoruser-int.com",
  "www.translatetheweb.com",
  "ssl.microsofttranslator.com",
  "www.microsofttranslator.com"
].includes(hostname)

// Baidu Translate
[ "translate.baiducontent.com",
  "fanyi.baidu.com"
].includes(hostname)

// Yandex Translate
hostname == "z5h64q92x9.net" ||
hostname.startsWith("translate.yandex.")

// Naver Papago
hostname == "papago.naver.net"
```

A quick market refresher: Google and Microsoft are popular all over the world. Baidu is the market-leading provider of search and online services in China. Naver is hugely popular in South Korea, and have a strong following in Japan and the K-Pop community in the United States and around the world. Yandex controls roughly 50 % of the search market in Russia and is gaining grounds in Turkey. Yandex has rapidly lost market share in Ukraine and Belarus in recent years.

#### Browser-based (client-side) machine-translations

The browser-based translation services are a bit trickier to detect. These tools usually wait for the document to fully load, and then either sets off translating by default or wait for the user to confirm that they want the document translated. They don’t emit any sort of standard `event` or give any other indication that the document has been translated.

If you only want to track translation-service usage for analytics purposes, then you can hold off on detecting their presence by hooking into the [pagehide event (and not the unload event)](https://www.ctrl.blog/entry/safari-beacon-issues/) and then quickly inspect the `document` for signs that a translation service has been involved.

Google Chrome will insert one of two `class` names on the root `html` element of a translated document. The two classes to look for are `translated-ltr` (for translations to left-to-right languages) and `translated-rtl` (for translations to right-to-left languages).

Yandex Browser wraps all translated texts in a custom `ya-tr-span` element. It also injects several scripts and stylesheets into translated webpages. It’s quite noisy compared to its competitors.

The Microsoft Translator Extension appends `_msttexthash` attributes to all translated elements. The extension comes built-in to its Microsoft Edge browser, but can also be used separately in a different browser.

The Firefox Translations extensions (Bergamot) appends a `x-bergamot-translated` attribute to all visible page elements. The attribute contains information about whether the given element was translated or not. However, its presence can tell you if the page has been through the translator.

You can combine these and check them all at once:

```javascript
!!document.querySelector(
  "html.translated-ltr, html.translated-rtl, ya-tr-span, *[_msttexthash], *[x-bergamot-translated]"
);
```

Naver Browser (Whale) doesn’t leave any fingerprints behind when translating pages with it’s Naver Papago translation service. As far as I can tell, you can’t detect it without analyzing the content itself and monitoring it for changes. This might be the most universal method to detect machine-translations.

You can use a `MutationObserver` if you need to be notified about the use of a translation service as early as possible in the page’s lifecycle. This might negatively impact the page’s performance in complex documents.

**Update** (2022-07-10): Added details for detecting the new Firefox Translations (Bergamot) extension.
### Mitigate “tabnabbing” without breaking window.open() features
URL: https://www.ctrl.blog/entry/tabnabbing-window-size-position/
Last updated: 2026-08-23T22:23:11.000Z
The [security issues](https://mathiasbynens.github.io/rel-noopener/?ref=ctrl.blog) and [performance hit](https://jakearchibald.com/2016/performance-benefits-of-rel-noopener/?ref=ctrl.blog) of websites opening a new window are fairly well understood. However, applying the `rel=noopener` mitigation has its own drawbacks and isn’t backward-compatible.

In this article, I’ll focus exclusively on the problems introduced along with support for `rel=noopener` in Google Chrome version 49\. The above links were your queue to read-up on it if you’re unfamiliar with the issue.

Understandably, these pop-ups were designed with the ability to change the primary document in their “opener” windows. A supplementary help navigation window could link users to the right document. This feature was largely forgotten by the web development community until security cautious developers realized the inherent security issue in letting third-parties arbitrarily redirect the opener page just because they’d been opened in a new window.

On websites designed for PCs, you occasionally encounter a situation were websites wants to create a small complimentary window. Ignoring the pop-up advertisement epidemic of the late 1990s and early 2000s, there are still some legitimate use-cases for these windows, such as chat tools, supplementary documentation, and video pop-outs. These uses translate into creating new tabs in mobile web browsers as the platforms don’t support traditional computer-windowing concepts.

However, Google Chrome version 49 up 77 stopped supporting `window.open()`\-features when combined with the standard `noopener` feature. Chrome 77 is the current stable version, at the time of publication. For example, you could either set the size or position of a newly opened window *or* unset the `window.opener`. Whenever the latter feature is used, all other window features are ignored.

This means that the following two examples will create a window with the exact same size and screen position in Google Chrome. The supplied size and position constraints of the second example are ignored.

```javascript
window.open(
  "https://example.com/",
  null,
  "noopener=1"
);
window.open(
  "https://example.com/",
  null,
  "noopener=1,height=500,width=500,top=100,left=100"
);
```

The second example works just fine in recent versions of Firefox and Safari.

You can create achieve the same effect as using the `noopener` and get Chrome-compatibility and better backward-compatibility with older web browsers at the same time. I’ll walk you through the process.

First, start by creating an empty window (using either an empty string or `about:blank`) with the desired dimensions and position. The following examples create a new 500x500 pixel `window` at 100 px from the top left corner of the active screen. The window is stored in the popup variable.

```javascript
var popup = window.open(
  "about:blank",
  null,
  "height=500,width=500,top=100,left=100"
);
```

You’ve now opened an untitled empty window with the right dimension and position. You can then proceed to give the user some feedback by setting the temporary window’s title. If you don’t set a title, the user may be staring at a window “Untitled” for some time. You can close the door on tabnabbing by explicitly unsetting the popup’s `opener`. Setting it to `null` gets the job done.

Lastly, you can redirect the empty page to the destination page. The following example redirects the popup we created above to `https://example.com/`.

```javascript
popup.document.title = "Loading…";
popup.opener = null;
popup.location.replace(
    "https://example.com/"
);
```

The [HTML Specification](https://web.archive.org/web/20191001023056/https://html.spec.whatwg.org/multipage/window-object.html), as of the 2019-09-28 edition, leaves every feature other than `noopener` undefined. I can’t really call Google Chrome’s behavior a bug, even though it deviates from all the other web browsers. The issue also affect other Chromium-based web browsers such as Brave, Opera, and Vivaldi.

I’ve tried to report this issue to the Chromium project. However, the bug submission form returns an HTTP 400 error message on submission. Let the record show that I tried.
### Semantic markup improves the quality of machine-translated texts
URL: https://www.ctrl.blog/entry/html-semantic-improve-machine-translation/
Last updated: 2026-08-23T22:11:30.000Z
Web browsers like Google Chrome, Yandex.Browser, and Naver Whale; and leading search engines — including Bing, Yandex, Google, Naver, and Baidu — can machine-translate any webpage in seconds. This enables anyone who understands a supported language to access documents written in any other supported language.

I noticed, completely by accident, that some of my most read articles on this blog didn’t translate well in Microsoft Translate. Many of the technical details — such as code blocks, file paths/extensions, and function names — got mangled in with the rest of the text and caused it to lose all meaning. This isn’t really strange considering that the classic UNIX programs are called things like `find` and `at`, and program functions are just run-together English phrases. This got me thinking about how you can optimize texts for machine-translation.

An understandable high-quality machine-translation requires rock-solid grammar and spelling in the source material. I found that it can also benefit from rich semantic data about the text.

I’ve marked up some of my writing with text-level semantic HTML elements like `abbr` (for abbreviations), `code` (for computer-instructions including file names and program functions), `kbd` (user input), `samp` (program output), and `var` (a variable.) However, I haven’t been consistent and I haven’t even been using these elements properly — especially mixing up `code`, `kbd`, and `samp`.

This can have a meaningful impact on your reader’s comprehension of your texts. The most important difference is that the translation-services take these tags as strong hints not to attempt to translate the text. The `kbd` element is sometimes translated, however. This seems limited to keyboard shortcuts. E.g. `<kbd>Ctrl + Del</kbd>` could become `<kbd>Strg + Entf</kbd>` in German. (This is the expected translation.)

You can think of your code snippets, function names, file paths, URI protocols, and other technical copy as *another language* with different grammar rules. Programming languages are often inspired by English but use their own grammar, syntax, and style. Intermixing two languages (e.g. English and an English-inspired programming language) can seriously confuse a machine-translation tool.

Just imagine how a machine would understand the following sentence: “The UserAccounts.HomeDir.delete(recursive=true) function will delete the /home/user/ directory.” Ignoring the punctuation and lack of spaces between words, it can be read as English. However, the sentence structure is poor and it translates just as poorly. The resulting translation may lose some of the semantic punctuation, or partially or fully translate the function name and paths. The entire sentence can be rendered meaningless.

In my testing, Microsoft Translator (also known as Bing Translator) and Yandex Translate can benefit from using these semantic hints correctly when translating from English to Norwegian or Russian. I’m unable to properly evaluate the quality of the Russian translations, but I’m at least able to verify that function names and file paths are properly preserved when marked up properly. I’m unable to evaluate Baidu Fanyi which only supports translating to Chinese.

The global `translate` attribute, new in HTML5, can further enhance machine-translations by labeling texts as translatable or not. For example, you can mark up a code example as untranslatable while marking up comments and strings to be translated. See the below example.

```html
<code translate="no">
// <span translate="yes">Example function</span>
function example()
{
  print("
    <span translate=\"yes\">
      Example translatable string
    </span>
  ");
}
</code>
```

This works in Google Translate, Microsoft Translate, Yandex Translate, and Naver Papago. Baidu Fanyi doesn’t support the `translate` attribute. However, Baidu (and the others) does support the legacy non-semantic `class="notranslate"` attribute. However, I’d recommend focusing on the standard `translate` attribute unless you specifically need backward-compatibility and compatibility with Baidu (the market leader in the Chinese market.)

**Update** (2019-10-02): The `translate="no"` attribute doesn’t always work when Chrome translates a document. Using it together with the `class="notranslate"` attribute seems to do the trick.

In my testing, the semantic text-level elements were taken as hints and would sometimes be translated despite the markup, such as with the keyboard shortcuts above. The `translate="no"` attribute was the only variable that always excluded a piece of text from being translated.

Setting a `translate="yes"` override attribute inside a `translate="no"` block is only supported by Google Translate at the time of writing. The other translation-tools just ignores it. However, Google Translate doesn’t always preserve whitespace when used in pre-formatted text blocks (like a `<pre>` element.) Instead, normalizing all white-space to one space character. This can have detrimental results on the semantics and readability of your code examples.

I’ve seen great improvements in the machine-translated versions of my texts when using Microsoft Translator and some improvements when using Google Translate after applying these methods.

This may be an optimization that will lose any value once translation services, machine learning, and artificial intelligence mature. Until then, it’s one more thing to think about when you author technical documents; whether it be about programming and linguistics or something else entirely.

Take-aways: [detect and measure machine-translations](https://www.ctrl.blog/entry/detect-machine-translated-webpages/). Mark up your code examples with HTML text-level semantic markup. Mark up non-translatable texts with `translate="no"` and `<class="notranslate"`.

#### Sources

- [HTML Living Standard](https://html.spec.whatwg.org/multipage/dom.html?ref=ctrl.blog), 2019-09-24, WHATWG
- [Using HTML’s translate attribute](https://www.w3.org/International/questions/qa-translate-flag.en?ref=ctrl.blog), 2014-11-26, Richard Ishida, World Wide Web Consortium (W3C)
### How Coil and Web Monetization works compared to Flattr
URL: https://www.ctrl.blog/entry/coil-web-monetization/
Last updated: 2026-08-23T22:03:38.000Z
**Update** (2023-02-02): Both Coil and Flattr has discontinued their automatic browser-based monthly micro-payment subscription services.

Coil is a new micro-payment service that resembles [Flattr](https://www.ctrl.blog/entry/flattr2/). Both services rely on a web browser extension to automatically pay participating websites and creators from customers’ 5 USD/monthly subscription funds.

Both services rely on webpages containing an invisible `<meta>` element for their extensions to identify and attribute funds to participating creators and websites. How much time you spend with each creator decides how much they’re paid. This is also where the similarities between the two services end.

Flattr keeps a running tally of how much time the subscriber has spent on content from each creator and website. At the end of each month, Flattr pays each creator and website their share of the subscriber’s monthly fund minus a [10 % fee](https://www.ctrl.blog/entry/flattr-vs-brave-fees/). The fees are transparent and you can check on your dashboard what you’ve paid each creator and website. You can also turn the service on or off per creator, if you want to micro-manage it.

**Update** (2021-02-12): Coil takes a fee of 13,4 % which includes credit card fees. This leaves a monthly pool of 4,33 USD for paying creators through Web Monetization.

Coil does things differently. Their website doesn’t include any details about fees or how your monthly funds are divided. They don’t have a dashboard where you can see what you’ve paid different creators either. I had to reach out to Coil to get more details on how their service works.

Coil “streams payments” instantly instead of keeping a running ledger of what each creator and website is due. They pay websites and creators continuously while the subscriber visits their content at a rate of 0,0001 USD/second. Websites can use the proposed [Web Monetization API](https://webmonetization.org/?ref=ctrl.blog) web-standard to check and verify when and how much clients are actively paying them. This can be used to unlock subscriber-only content (like a universal pay-wall), hide ads, or otherwise customize the customer experience.

The hope is that others will build on the Web Monetization standard and that the API will one day find its way into web browsers.

[Scroll.com’s 5 USD-subscription](https://www.ctrl.blog/entry/scroll-com-first-impressions/) only pays for a small list of large US-based news publishers. Coil’s Web Monetization standard-proposal is open to all websites and creators who can capture enough time and audience to make it worthwhile.

The current version of the Coil browser extension automatically starts paying any website that asks for it. The user has no control over the payments and can’t blocklist payments on a given domain without disabling the extension.

A continuous payment stream at Coil’s starting rate would total 260 USD in a month; far exceeding the 5 USD/month subscription fee. Coil will reduce the payment rate automatically when you’re nearing your monthly subscription limit to keep subscriber spending under the 5 USD threshold. This means creator that subscribers engage with early in their subscription cycle gets a bigger cut than those near the end.

To give you some sense of how much you’d get for your money: The full 0,0001 USD/second rate would be enough to pay for 14-hours per month or 28-minutes per day.

The Coil extension has 4600 active installations as of February 2021, according to the [Google Web Store](https://chrome.google.com/webstore/detail/coil/locbifcbeldmnphbgkdigjmkbfkhbnca?ref=ctrl.blog "Coil’s listing in the Google Web Store") and the [Mozilla Add-Ons Directory](https://addons.mozilla.org/en-US/firefox/addon/coil/?ref=ctrl.blog "Coil’s listing in the Firefox Add-Ons Directory"). Up from 3500 in October 2019.

As a creator, you’d earn 105 USD/month if all of the currently active Coil-subscribers were to engage with your content for five minutes a month. You’d need 80 000 Coil-subscribers each spending five minutes on your content every month to earn 2400 USD/month (equivalent to a 15 USD/hour salary).

So, what happens if you don’t spend enough time to use up your monthly Coil subscription? Coil pockets the difference. This isn’t an ideal solution and a bit unsettling combined with the lack of transparency. You can at least rest assured that Coil seems to be putting its money to good use.

Coil is collaborating with the Mozilla Foundation and the Creative Commons Foundation on a shared 100-million USD [Grant for the Web](https://web.archive.org/web/20191107025750/https://www.grantfortheweb.org/) program. This grant program seeks to promote alternative funding platforms on the web to weed the web platform off ad-tech.

The Web Monetization ecosystem doesn’t have to rely on Coil, however. It’s an open standard and Web Monetization-enabled websites can receive funds from Coil or any other payment provider. Other providers may have other ideas on how much to charge, transparency, and how to divide the funds.

Will the micro-payment model work this time around, though? The Coil extension is currently only focused on desktop browsers. Extension support never really did make the jump to mobile (except for Firefox for Android). The Web Monetization API is an open standard and there is at least one [mobile browser with native Web Monetization support](https://www.pumabrowser.com/?ref=ctrl.blog) that’s available for Android and iOS. Hopefully, we’ll see more Web Monetization API-based services and implementations in the future to build out the ecosystem. The Grant for the Web money can go a long way towards that goal.

There were 520 Web Monetization-enabled websites on the web in September 2019 according to PublicWWW. This number had grown to 1700 including Imgur by February 2021.

On the other hand, Flattr seems to be moving away from its auto-reward model and get rid of their extension. They’ve lost over 30 % of active extension installations in the last nine months. Flattr instead wants its customers to micro-managed which creators and website they support. I’ve been a huge fan since [Flatttr 2.0 launched in late 2017](https://www.ctrl.blog/entry/flattr2/ "Automatically contribute to funding the web with the new Flattr extension").

We all engage with a huge number of websites and creators on the web. I believe people aren’t necessarily good at attributing or rewarding the things that give them value. You may learn a lot of new and valuable information or have a good laugh from a hundred different websites every day. Nobody wants to micro-manage the minutia with regards to how everyone who created the value are compensated. The automated rewards system was what made Flattr a valuable service. Coil seems to want to pick up where Flattr failed.

A micro-payments ecosystem requires millions of paying users and the support of many creators and website publishers. Flattr, [like Google Contributor before it](https://www.ctrl.blog/entry/google-contributor-revisited/), never committed any resources into marketing their ecosystem to potential subscribers or publishers.

The only one that seems to be pulling that off anything in the micro-payment space at the moment is [the controversial Brave browser](https://www.ctrl.blog/entry/brave-payments/) who’ve managed to attract millions of customers and ten-thousands of publishers. Notably, those aren’t paying customers but people who’ve signed up for Brave’s alternate take on web monetization where the end-user gets a share of the advertising revenue.

#### Sources

- ["name=\\"monetization\\"" "content=\\"$" depth:0](https://archive.is/5GKjr?ref=ctrl.blog), 2019-09-18, PublicWWW, Archive.is
- [Mozilla and Creative Commons want to reimagine the internet without ads, and they have $100M to do it](https://www.fastcompany.com/90403645/mozilla-and-creative-commons-want-to-reimagine-the-internet-without-ads-and-they-have-100m-to-do-it?ref=ctrl.blog), 2019-09-16, Steven Melendez, Fast Company, Mansueto Ventures
- Email exchanges with Coil staff
- [W3C Interview: Coil on Interledger Protocol and Web Monetization](https://www.w3.org/blog/2019/09/w3c-interview-coil-on-interledger-protocol-and-web-monetization/?ref=ctrl.blog), 2019-09-03, Ian Jacobs, W3C Blog, World Wide Web Consortium
- [Going full mobile web, with you behind the dashboard](https://web.archive.org/web/20190612092518/https://blog.flattr.com/2019/06/going-fully-mobile-with-you-behind-the-dashboard/), 2019-06-12, Linus Olsson, Flattr blog, Flattr, Eyeo GmbH
- Email exchanges with Coil staff, 2019-04\-2019-08
- [Brave passes 5.5 million monthly active users and features over 28,000 Verified Publishers](https://brave.com/2018-highlights/?ref=ctrl.blog), 2019-01-05, Press release, Brave Software
### Text rendering doesn’t look too good on VA-QLED display panels
URL: https://www.ctrl.blog/entry/va-qled-text-rendering/
Last updated: 2026-08-23T22:23:56.000Z
Earlier, I’ve discussed the many choices and complexities involved in [choosing a monitor category](https://www.ctrl.blog/entry/choosing-a-monitor/). Now, I want to go a bit deeper into this by discussing an unexpected surprise I had with a vertically-aligned quantum-dots (VA-QLED) display panel from Samsung.

My significant other recently bought a 60 cm 1080 p 16∶9-aspect-ratio curved Samsung C24FG70 monitor. It’s marketed as a “gaming monitor” with “quantum pixels” (QLED) and 1 ms at 144 MHz refresh-rate.

This all sounds very impressive and above average and all online reviews agreed. The high refresh-rate looks nice in games. However, none of the marketing and even the most in-depth technical third-party online reviews fail to discuss one of these display panel’s main drawbacks.

I need to give a quick refresher in display technology before I proceed. Each individual pixel on a screen usually consists of three colored sub-pixels in red, green, and blue (RGB) colors. A “quantum pixel” or “half-height pixel” splits the three traditional colored area into two smaller areas that together make up one traditional sub-pixel segment. One of these sub-sub-pixels is slightly larger than the other, and it allow for better control of the pixel’s brightness in a given sub-pixel color.

I also need to give you a brief refresher to font anti-aliasing technologies like Windows TrueType. When you read black text on a white background on a display, you’re usually looking at some black letters that appear smoother by making clever use of neighboring pixels’ sub-pixels. The sub-pixel color nearest to a black pixel is called, whatever color it may be, can be dimly lit to help improve the perceived letter rendering.

VA-QLED displays make look good with high-resolutions (e.g. 4 K.) However, the pixel density and quantum pixels used in the Samsung C24HG70 creates an obvious “screen door effect” in the larger 68 cm and 81 cm versions of the panel where you can see individual pixels even at a normal viewing distance. A shout out to [the IGN review](https://www.ign.com/articles/2018/09/05/samsung-c32hg70-curved-gaming-monitor-review?ref=ctrl.blog) for noticing this problem.

This isn’t super-appealing but you won’t really notice it on the 60 cm model unless you stare at large areas of solid color all day. The real problem with this VA-QLED panel is that **regular text looks truly awful.** Modern web design trends tend to lean towards slightly grayer text, which the unusual quantum-sub-pixels produces by turning off half of the whole pixel. This leaves visible white lines striking through the text since every other row of quantum pixels are turned halfway off.

The following contrast-adjusted photo shows the text “VA-QLED” in gray photographed on the said panel. Click-through to the larger version to see it in greater detail. Note how the half-height sup-pixels negatively affect the gray text rending by introducing white dots scattered throughout the text.

![VA-QLED scren sample gray text saying “VA-QLED”](https://cdn.synaps.media/control/content/images/2026/08/va-qled-gray-text.png)

Gray text. [Larger photo](https://cdn.synaps.media/control/content/images/2026/08/va-qled-gray-text.png?ref=ctrl.blog).

The next photo shows the same as the previous one, but with black text. Here, you can see how the half-height sub-pixels negatively affect the anti-aliased outer-edges of each letter glyph.

![VA-QLED scren sample black text saying “VA-QLED”](https://cdn.synaps.media/control/content/images/2026/08/va-qled-black-text.png)

Black text. [Larger photo](https://cdn.synaps.media/control/content/images/2026/08/va-qled-black-text.png?ref=ctrl.blog).

You can also see a larger version of the [feature photo](https://cdn.synaps.media/control/content/images/2026/08/va-qled-subpixel-interlacing.png?ref=ctrl.blog) from the top of the article if you prefer a non-color-adjusted version where you can see even more details.

You can change the TrueType font smoothing and anti-aliasing settings in Windows all you want. You won’t find a setting that works well with this type of display panel.

How you perceive this display panel design-decision depends on your eye-sight and how you perceive the world. When I look at a sentence and not individual letters, I see the white quantum sub-pixel as several white lines striking through the text. My significant other has somewhat worse eyesight than me and claims to not notice it as much.

You can read up on and study a ton of detailed technical reviews of this monitor model and display panel type. It’s been on the market since late 2016\. However, you won’t find any acknowledgment of the text rendering issue I’ve mentioned here. It’s present throughout the Windows 10 user-interface with the default settings and even Google Search Result Pages are badly affected by it. You can find some mentions of it in some of the deeper corners of places like Reddit, though.

This is the real point I want to drive home with this article. [Choosing a monitor](https://www.ctrl.blog/entry/choosing-a-monitor/) is a way more complicated than I first realized and I don’t believe most people will have any idea what monitor to get. There are too many technical metrics to compare and thee technical specifications alone doen’t mean much when the display doesn’t do a decent job at the basics like displaying text on the display.

#### Sources

- [24″ CFG70 Curved Gaming Monitor](https://www.samsung.com/us/computing/monitors/curved/lc24fg70fqnxza-lc24fg70fqnxza/?ref=ctrl.blog), 2017-08, product details, Samsung
### Why Syncthing kept deleting my re-created files
URL: https://www.ctrl.blog/entry/syncthing-deletes-recreated-files/
Last updated: 2026-08-23T22:22:55.000Z
I first tried [Syncthing](https://syncthing.net/?ref=ctrl.blog) a couple of years ago, but abandoned it because it kept running into file synchronization conflicts. A couple of months ago, I once again tried keeping my files synchronized across devices using Syncthing. I’ve had much more success with it this time.

Syncthing is an open-source peer-to-peer inspired file synchronization utility. It keeps your files encrypted while transferring between your computers and can keep folders in sync over the internet without involving a commercial third-party service provider.

I’ve experienced intermittent critical process failures after setting up Syncthing with directories I use for ongoing projects. The core problem in all cases came down to files that had disappeared from the file system. I didn’t know the cause nor did I even think to blame Syncthing for the issues. I thought the problems must have been caused by a bug in my own software that processed the files in these directories.

The problem would only happen once every ten days or so and I didn’t think much of it. However, the number of files involved has grown and the problem eventually happened several times a day. I first wasted time trying to figure out where in my processes the files were being deleted. Then I turned to the file system itself.

I used a program to monitor all file operations (`inotifywatch`) to monitor the directories with the disappearing files. I’ll let a summarized version of the program’s output continue the narrative:

./ CREATE example.file
./ DELETE example.file
./ CREATE example.file
./ MOVED_FROM example.file
./.stversions/ MOVED_TO example~20190916-162900.file

The output shows how the `example.file` is created and deleted, and that a new file with the same name is created. So, far everything works as expected. However, then the newly created file is renamed and moved by Syncthing into a hidden directory called `.stversions/`.

This directory is used by Syncthing to preserve copies of files that have been changed or deleted on a remote client. It doesn’t preserve copies of file changes or deletions that originated on the local system.

I tried disabling the version control feature on my local client, but the problem didn’t go away. Syncthing would instead outright delete the files instead of moving them aside. I had to disconnect my remote Syncthing instances to stop the problem from reoccurring. This completely defeated Syncthing's purpose, however.

I’ve only seen this problem happen when syncing a directory with thousands of files to two or more remote instances.

I haven’t dug into Syncthing to work out the exact details on what’s happening. However, the following is my best guess at what goes wrong based on the observed behaviors.

I believe what happens is that Syncthing starts syncing the file creation and deletion to the remote instances. While that’s going on and the remote instances talk among each other — this can take some time — I’ve created a new file in the same location. At some point, Syncthing gets a message from one of the remote instances telling it that they’ve deleted that specific path and that it should do the same thing to be in sync.

Syncthing proceeds to diligently delete the file at the specified path without having any checking to make sure it’s the same file and not a different file that just happens to be stored at the same file path.

Overall, I’m impressed with how well Syncthing works and its flexible and secure peer-to-peer design. It’s a good tool but I keep bumping into corner cases and problems with it. For now, I’ll work around the issue mentioned in this blog post and stick with using Syncthing. However, I’d not recommend anyone trust it with their critical files unless they have a separate snapshotting and backup systems in place.

Syncthing *is great!* But it’s also terrible.

I used Syncthing version 1.2.2.

#### Sources

- [File Versioning](https://github.com/syncthing/docs/blob/5a43ca987d865b01d1cd681a1e427a4175d34d37/users/versioning.rst?ref=ctrl.blog), commit 5a43ca987d, 2018-12-17, Syncthing project, GitHub
### Normalize fridge temperatures by installing a small fan
URL: https://www.ctrl.blog/entry/fridge-pc-fan/
Last updated: 2026-08-23T22:07:54.000Z
I’ve installed a small 120 cm 12-volt air circulation fan in my aging Electrolux combo fridge-freezer. It’s just a cheap PC fan, available everywhere. The upgrade resulted in more stable temperatures and a 29 % reduction in power consumption.

Many modern refrigerators come with a small fan built-in to improve air circulation inside the cooling box. My ten-year-old Electrolux combo unit doesn’t have such modern luxuries. It had to operate with the temperature control dial at about 85 %-effect and saw large temperature fluctuations.

After installing the fan in the fridge, I could turn down the temperature control dial to about 45 %-effect. This reduced the daily power consumption from 2,09 kWh/d to 1,47 kWh/d.

In monetary terms, that’s a utility bill savings of roughly 22 euro/year. The fan-project cost 17,50 euros and should pay for itself in the first 10 months.

The fridge’s energy classification says it’s only supposed to use 0,9 kWh/d at this setting. It’s an aging unit and it’s built into the kitchen so air-circulation around it certainly isn’t a best-case situation.

The most important benefit to me was how the fan helped improve and stabilize the temperatures in the refrigerator. The temperature is now 4–6℃ at the top and the bottom shelves. Without the fan, the refrigerator would vary from -1–9℃ at bottom shelf and 6–13℃ on the top shelf.

I store temperature-sensitive medication (insulin) in my refrigerator. (The bag to the left in the photo.) It absolutely must not freeze and degrades quickly when it’s stored above the ideal temperature range.

As a nice bonus, the fridge compressor won’t need to run nearly as long at a time. Thereby lowering the noise level as well as the heat exchanged from the refrigerator into my apartment. The removed heat effect is approximate to *not* running a standard 900-watt fan-heater for 37 minutes every day.

In the do-it-yourself spirit, here are the components I used:

| Part                         | Price       |
| ---------------------------- | ----------- |
| Fractal Silent 120cm 12V fan | 9,00 euro   |
| USB step-up converter board  | 1,50 euro   |
| 5V USB power supply w/cable  | 6,00 euro   |
| A small plastic box          | < 1,00 euro |
| Two PCI slot cover guards    |             |
| Two zip-ties                 |             |

The set up is really straight-forward. The fan’s power cables are soldered on to the step-up converter. The step-up converter is used to convert 5V from the USB power supply up nearer to the 12V the fan needs. It also lets me adjust the fan’s speed.

The step-up converter is placed inside a small re-purposed [glucose test strip box](https://www.ctrl.blog/entry/contour-next-one-vs-link/) with holes on the top and bottom for the wires. This step is optional, but it protects it against accidental short circuits and moisture. It also increases the project’s partner-approval rating.

The fan is kept upright using feet made from zip-tied PCI slot cover brackets re-purposed from my computer chassis. You can use just about anything you want to keep the fan upright, of course.

The USB power cable goes from the step-up converter out through the door seal and into the USB power supply connected to a wall outlet outside the fridge. I checked the seal with an IR-thermometer and couldn’t detect any cold air leaking out around the cable.

This set up is not finger- or child-friendly. You can fasten the fan and wires more securely, and install a fan-guard shield to help with that. Installing everything in a box with air intake and outlets can also work.

The main difference from my setup and the ones that come built-in to refrigerators is that those automatically switch off when you open the door to keep the cold air in. My DIY set up instead accelerates the cold air’s escape from the refrigerator when the door is opened.

You can find manufactured battery-powered versions of this ideal designed for RV-mini-refrigerators. I wasn’t really interested in this solution, though. I didn’t want to swap out the batteries in my fridge fan every few weeks.

The power consumption and temperature measurements used for comparisons in this article were performed over twelve weeks.
### Make changes to static content with response body substitutions
URL: https://www.ctrl.blog/entry/mod_substitute/
Last updated: 2026-08-23T22:14:37.000Z
Ctrl blog’s [syndication news feed](https://feed.ctrl.blog/latest.atom?ref=ctrl.blog) is called upon to handle a lot of different tasks and service integrations. It’s used to share new articles on Twitter, create the weekly newsletter, as well as handling integrations with syndication services like Apple News and Flipboard. It’s also used in a myriad of different feed readers by individual readers.

For some of these integrations, I require some minor customizations to the feed to fit with specific technical requirements if each platform. A top issue was the many conflicting requirements for what image sizes to use and how to embed them in the feed.

I’ve also added tracking parameters to the feed to differentiate between readers coming to the site from some primary external sources like the email newsletter, Twitter account, feed readers, and so on. This is the same task my old WordPress Feed to Google Analytics [integration plugin](https://www.ctrl.blog/entry/wordpress-feed-utm-plugin/) handled. (I don’t track individual subscribers or clients, only what channel is used to access the site.)

It was no problems handling this task with a dynamic site generator like WordPress. It could give slightly different responses to different clients based on their User-Agent or a URL query parameter. However, this poses a question when [I migrated off WordPress](https://www.ctrl.blog/entry/enough-of-wordpress/) and began using a static website generator.

The question became: how can I introduce some limited dynamic responses when all I had was statically generated files?

The answer: Dynamic responses from static content with request-specific substitutions performed by the web server on the edge. In other words, Apache HTTPD’s `mod_substitute` module.

The below Apache HTTPD configuration example shows how the string “#src=feed” is replaced inside the response body when the URL query string is either ?src=none, ?src=email, or ?src=apple-news. These changes are only applied for locations that end with .atom with the media-type application/atom+xml.

```apacheconf
<LocationMatch "\.atom$">
  <If "%{QUERY_STRING} =~ /src=none/">
    AddOutputFilterByType SUBSTITUTE application/atom+xml
    Substitute "s/#src=feed//nq"
  </If>
  <ElseIf "%{QUERY_STRING} =~ /src=email/">
    AddOutputFilterByType SUBSTITUTE application/atom+xml
    Substitute "s/#src=feed/#src=email/nq"
  </ElseIf>
  <ElseIf "%{QUERY_STRING} =~ /src=apple-news/">
    AddOutputFilterByType SUBSTITUTE application/atom+xml
    Substitute "s/#src=feed/#src=apple-news/nq"
  </ElseIf>
</LocationMatch>

```

You may also need to enable the `mod_substitute` module in your configuration.

The above configuration example is repetitive, but this is necessary because the substitute module can’t access environmental variables. This limitation will be removed in the upcoming Apache HTTPD 2.5.1 release.

You may need to change HTTPD’s filter chain if you use custom filters, or your web server is acting as a reverse proxy server. The most likely problem you’ll run into as a proxy server is that you’ll need to pass the response body through the deflate filter before applying substitute, and then reapply the compression filter.

You can achieve the same thing in Nginx with the `sub_filter` (exact string matches) or `subs_filter` (regular expressions) filters. Neither of these is built and included with Nginx by default, however.

#### Sources

- [Apache Module mod\_substitute](https://httpd.apache.org/docs/trunk/mod/mod%5Fsubstitute.html?ref=ctrl.blog), version 2.5.1, 2017-12-31, HTTPD Documentation, Apache
- [Apache Module mod\_substitute](https://httpd.apache.org/docs/2.4/mod/mod%5Fsubstitute.html?ref=ctrl.blog), version 2.4.17, 2015-10-12, HTTPD Documentation, Apache
- [Substitutions](https://www.nginx.com/resources/wiki/modules/substitutions/?ref=ctrl.blog), 2015-09-15, Nginx wiki, Nginx
- [Module ngx\_http\_sub\_module](https://nginx.org/en/docs/http/ngx%5Fhttp%5Fsub%5Fmodule.html?ref=ctrl.blog), version 1.9.4, 2015-08-18, Nginx documentation, Nginx
### Your online identity is owned by your email provider
URL: https://www.ctrl.blog/entry/email-identity-provider/
Last updated: 2026-08-23T22:05:39.000Z
Many of the leading tech companies — including but not limited to Apple, Baidu, Google, Microsoft, and Yandex — offer free email services to their customers. Email was never designed to be your ubiquitous online identity. Nevertheless, it’s what most businesses and services use to fill that role today. Email service providers reap the benefits of a captive customer base.

Most people use the default email address suffix, e.g. `@example.com`, that their email provider offers. You choose your email address, and thus your email service provider, for life. Few give much thought to which email service provider to use and even fewer read their ever-changing terms of service and privacy policies.

Within a few years of signing up with an email service, you’ll use your email address to log in to hundreds of servers and for your personal and business correspondence. Even if you claim to not use email; we all use our email addresses every day.

You can get a new phone number and send it to the dozen or so people and companies that you want to have your new number. In many countries, you can even keep your phone number when you decide to switch to a new mobile carrier.

This is considerably more difficult with email because of the huge number of companies and services we want to have our updated email address. It takes a lot of time and effort to change your email address and it involves the risk of losing access to some critical service. There are so many of these services in our lives that we don’t even remember who they all are anymore!

Many services won’t even let you change the email address you’ve registered with them. If you live in the European Union, the General Data Protection Regulation (GDPR) guarantees you the right to update registered information such as your email address. The GDPR went into effect on May 2018, and many companies haven’t had the time to update their services to enable you to change your email address yet. This legal protection doesn’t extend to other regions either.

This creates an almost unique environment where businesses have complete control over their customer’s online identity and where customers can’t easily change their provider. Your email service provider [knows everything you’ve purchased online](https://www.theverge.com/2019/5/17/18629789/google-purchase-history-gmail-email-receipts?ref=ctrl.blog), what apps and services you’ve signed up for, your interests, and your entire contact network. It gets a lot of this information through email notifications and receipts sent by other services as a convince for their customers.

This puts people at the mercy of the tech companies. It also exposes their personal data and identity to their whims of the same companies.

Imagine a free email provider who suddenly decided to start charging for their email service. Some people can’t afford to pay or don’t have access to a credit card to make the payment. Or imagine using an email address provided by your internet service provider (ISP). They could abandon an unprofitable area and cut service to it. Hopefully, you’ll have another ISP to fall back on to keep your internet access. However, you would have to keep paying your old ISP who’s no longer willing to offer you services to retain access to your email address.

It’s completely within the rights of private companies to make these types of decisions. There would be negative press, of course, but the media’s attention in such matters quickly dissipates. Strong consumer protection and privacy regulations won’t help consumers in these situations.

People are locked into their email service provider because that’s how email addresses work. The current tech behemoths were partially built on the vendor lock-in that is inherent to services like email.

There isn’t a lot that regulating the email service providers could achieve to ensure people adequate freedoms and market competition. Email messages are required to go through the email server at their designated destination domain name. You can’t port your email address as you can with your phone number because the provider’s domain name is an essential part of the address and the delivery mechanism.

The only regulation I can think of that could make any impact is to require all public email service providers to offer free email forwarding services for the lifetime of the account holder. With a forwarding service, you can give your old email provider your new address and have them forward it for you. These services are often time-limited or require a subscription fee, however.

Email forwarding involves some technical challenges that ultimately lead to poorer customer experiences. Emails must travel through more servers which delays their delivery. These extra trips through different email servers strip the emails of information about the sending server which is critical to protect against spam and email forgery. It introduces more complexity to the delivery chain and reduces the chain’s security.

You can take some control over your own identity in the current email-based online ecosystem by renting a domain name and using it for your email address. That gives you the freedom to switch email providers more easily without having to change your email address. However, you still won’t own your identity as you don’t own the domain name you rent through your domain name registrar.

The only real solution is to rethink online identity and stop depending on email addresses. Email was designed in the 1960s and it was never intended to serve the identity management role it’s serving today.

There currently aren’t any widely-deployed alternatives that people can control themselves. All the alternatives for identity management are provided by and controlled through private companies. There are some discussions about self-sovereign identity solutions but these still lie far off in the future.

For now, people should stop and think carefully when choosing the @example.com part of their email address. It’s a decision you’re probably set to live with for life.
### What’s it like to wear a FreeStyle Libre glucose monitoring sensor?
URL: https://www.ctrl.blog/entry/freestyle-libre2-wear/
Last updated: 2026-08-23T22:07:44.000Z
The [Abbott FreeStyle Libre 2](https://www.freestyle.abbott/?ref=ctrl.blog) is a flash-glucose monitoring system consisting of a glucose sensor attached to the back of the upper arm and either a [reader device or smartphone app](https://www.ctrl.blog/entry/freestyle-libre-reader-vs-app/). So, what’s it like to wear something glued on to your upper arm for 14 days at a time?

I’ve got some great news for any diabetic who’s worried about how it’s like to wear the FreeStyle Libre 2 sensor. For most of the day, I don’t notice it at all.

The only times in a day that I think about the sensor is when I shower, pull off T-shirts, lay restless in bed, collide with door frames, and when I’m dehydrated. I’ll go through each of these points in turn.

Showering was the thing I was the most worried about the first few weeks wearing the sensor. It’s supposed to stay on for 14 days, but I was worried that getting it wet would loosen the adhesive. It can get wet, but warm water may loosen it. In my experience, the adhesive begins loosening at the edges after a couple of showers. The sensor hasn’t yet come off from showering, however.

Showering with different medical-adhesive-patches is a long-since solved problem and you shouldn’t worry about it as I did. I’ve started covering the sensor with some waterproof adhesive film when I shower. You can get specially designed adhesive patches for the FreeStyle Libre Sensor. However, these are a waste of money for something that you’ll only wear for a couple of minutes.

There’s undeniably a plastic lump stuck to my arm. You usually can’t see it from under clothing — dependent on the exact sensor placement and sleeve length — unless you know it’s there. It’s only visible on the cover photo for this article because the photo is staged.

However, I do notice that the sensor is there when I’m pulling off shirts. They can sometimes snag on it and yank a bit in the sensor. I was a bit worried about it the first couple of times, but again this is something that I was worried about for no good reason.

I haven’t had any problems sleeping with the FreeStyle Libre Sensor. I barely notice the sensor when I put my body weight as I turn over in bed on the side where the sensor sits. As with clothing, the biggest hurdle is when it snags on the bed linens. I was worried either my significant other or I would yank it off while we slept. So far, I’ve only scratched at it in my sleep and it hasn’t come off.

I’ve already learned to respect door handles and knobs as an insulin-pump user. The pump sits in my jeans pocket with the insulin delivery tubing going over my clothing and up to the injection site on my abdomen. The loose tubing often form a loop that gets stuck on door handles which can yank it out.

I’ve now also got a newfound respect for door frames since I started wearing the FreeStyle Libre 2 Sensor. I never gave any thought to how frequently my upper arm impact with a door frame throughout the week. It turns out that I bump into door frames all the time.

For example, when I try to quickly pass through a door or when I need to push past people to get off a bus or tram. I haven’t torn off the FreeStyle Libre sensor by colliding against a door frame yet. However, I’m sure it’s only a matter of time before it happens.

It’s not that diabetic-treatment devices aren’t designed to be door-friendly. The problem is that many doors aren’t all that human-friendly. Doors that automatically close on you are mostly a minor annoyance, but your heart skips a beat when there’s a risk of tearing the sensor off your arm.

The only times I’ve felt any pain from wearing the FreeStyle Libre Sensor have been when I’ve felt dehydrated. For example, on warm days or after exercise when I haven’t been drinking enough water. I’ve felt little jolts of pain, like a pinched nerve or being pricked by a needle, emanating from the sensor injection site. These symptoms go away half an hour after I’ve seen to my body’s hydration needs.

This may all sound terribly inconvenient and like a pain in the back. However, we diabetics don’t have any choice but to keep an eye on our glucose levels throughout the day. While not a fully-featured continuous glucose monitor (CGM) system, the FreeStyle Libre 2 is still a huge improvement over performing dozens of finger-prick blood-tests every day.

(Please note that there are regional differences regarding how long the sensor can be worn before it should be replaced. This is due to different regulations and requirements around the world.)
### How to block programmatic podcast ads
URL: https://www.ctrl.blog/entry/podcast-programmatic-adblock/
Last updated: 2026-08-23T22:15:46.000Z
Here is how you can block programmatically inserted advertisements, or “dynamic ads”, in most podcasts. This method works for podcast delivered through the leading programmatic podcast ad brokers.

Before you read on I’d like to urge you not to block programmatic ads unless you’ve a good reason to. Podcasters, like other online creators, rely on advertising revenues and you’ll deprive them of their livelihood when you block ads.

I [prefer programmatically inserted podcast ads](https://www.ctrl.blog/entry/programmatic-podcast-ads/) over their “native” counterparts where [the host reads the ads](https://www.ctrl.blog/entry/podcast-host-read-ads/). Having the host read ads erodes trust, and limits podcasts’ abilities to profit from their backlog of episodes.

Podcast ads don’t suffer from many of the privacy issues plaguing online ads (though it [has its own unique problem](https://www.ctrl.blog/entry/feed-reader-fingerprint/).) Targeting is mostly limited to approximate device location, as determined by the IP address, and the podcast’s category. Programmatic ads are also generally shorter than native ads (a standard 30-seconds clip instead of several minutes.)

However, sometimes advertising servers make stupid mistakes. I live in Norway but regularly get ads read to me in Dutch. Some geolocation database somewhere has mislabeled my IP address as being located in the Netherlands instead of Norway. It’s probably just a typo! Country code “NL” instead of “NO”. While novel at first, I soon wanted to block these ads.

The solution to getting rid of them was hiding in plain sight in the Interactive Advertising Bureau (IAB) Podcast Measurement Guidelines. These guidelines require that *suspect IP addresses with many downloads* are to be excluded from subscriber counts. This is intended to prevent someone from inflating a podcast’s audience numbers.

As a listener, you can exploit this by using a commercial Virtual Private Network (VPN) or proxy service. With a VPN service, you connect to a server offered by your VPN provider where your internet traffic — along with all other subscribers — exit onto the internet from the same shared IP address. That way you won’t even be counted as a listener to the podcast.

The IP addresses of these network egress servers are often flagged in geolocation databases as country code “XX” or “other”. Advertisers are far less willing to pay for ads in this non-region than in the region-specific advertising campaigns you’d otherwise fall into.

You may, however, end up hearing a lot of ads for VPN services. VPN service providers are one of the few categories of advertisers that want to reach people in this non-region.

This method only works in real podcast clients. You may not have much success if you’re using programs that don’t behave like traditional podcast clients, e.g. Acast, Spotify, and Stitcher.

So, what can podcasters do to protect themselves against this type of ad-blocking? The first thing podcast creators should do is to make sure there’s a backup/house advert that’s used when no other advertiser is bidding on an episode. In these backup ads, podcasters can, for example, ask for [donations via Flattr](https://www.ctrl.blog/entry/flattr-micro-subscriptions/) or Patreon, or read a worldwide applicable advert.

#### Sources

- [VPN Users Could Be Depriving Pirate Sites of Ad Revenue](https://torrentfreak.com/vpn-users-could-be-depriving-pirate-sites-of-ad-revenue-190422/?ref=ctrl.blog), 2019-04-22, Andy Maxwell, TorrentFreak
- [Podcast Measurement Guidelines](https://www.iab.com/wp-content/uploads/2017/12/Podcast%5FMeasurement%5Fv2-Final-Dec2017.pdf?ref=ctrl.blog), 2017-12-14, Interactive Advertising Bureau
### Unobtrusive sleep tracking app for Android
URL: https://www.ctrl.blog/entry/android-sleep-tracker/
Last updated: 2026-08-23T22:01:44.000Z
There are a ton of Android apps that over-complicate sleep tracking. Some apps want to listen to your sleep all night, others want you to take your phone with you into bed as you sleep. Many of these apps come with a 30–50 USD yearly subscription cost.

I found a simple Android app on the other side of the spectrum. The *Sleep Debt Tracker* app assumes you’re asleep between the times when you last checked your phone before going to bed and when you wake up to check your phone again.

The app only tracks when you go to bed, wake up, and how many hours you sleep you get per day. You don’t need to open or interact with the app at all for it to do its thing. You don’t need to make any changes to your bedtime routines to make use of the app. It also doesn’t try to apply pseudo-science to analyze your “sleep quality” or anything like that.

The app can optionally be linked to a Google Fit account if you want to share data with Google. You can see trends and graphs in both apps. However, the Google Fit app is better at visualizing the data. Your data is kept on-device by default. You can also export your sleep data to a CSV file to do your analysis. The app doesn’t require any privacy invasive app-permissions.

You can configure the app to send bedtime reminders if you need a nudge to remember to go to bed at the right time. You set the number of hours of sleep you need each night in the app, and it will remind you to go to bed at that many hours before your next configured alarm. The app works with most alarm clock apps that integrate with the Android operating system.

I’ve had some issues with the bedtime reminders, though. The app some nights sends them an hour after my bedtime instead of an hour before. I’ve informed the app developer about the problem.

I’ve deliberately avoided discussing the apps’ “sleep debt” tracking feature. This is a gimmicky feature built around the notion of “sleep banking”; the idea that you can manage sleep like a sort of currency. You deposit extra sleep-time by sleeping more on some days and withdraw it by skipping on sleep on other days.

This is [possibly an unhealthy way to manage your sleep](https://www.nih.gov/news-events/nih-research-matters/weekend-catch-cant-counter-chronic-sleep-deprivation?ref=ctrl.blog). You risk negotiating with yourself over your bedtime each day instead of trying to maintain a healthy consistent sleep schedule. This gimmick feature of the app could be promoting bad sleep habits.

I think the core functionality of this app is pretty great. Bedtime reminders can be useful for anyone who tends to stay up a little too late in the evenings. Except for the sleep debt gimmick, the app has just the right amount of functionality. It also works way better for couples than any other sleep tracking apps and devices I’ve used.

The *Sleep Debt Tracker* app is available for free with ads on the [Google Play Store](https://play.google.com/store/apps/details?id=com.adventureapps.sleepdebt&ref=ctrl.blog). You can remove ads and get some extra features for 2 USD.
### How to switch firewalls from FirewallD to UFW
URL: https://www.ctrl.blog/entry/firewalld-ufw-migration-tutorial/
Last updated: 2026-08-23T22:07:02.000Z
Here is a quick tutorial for how to migrate from FirewallD, the default firewall in Fedora Linux and CentOS, to the Uncomplicated Firewall (UFW). UFW is the default firewall in Ubuntu and has more intuitive commands that require less typing.

Both UFW and FirwallD are front-ends for the Linux kernel’s `iptables` firewall system. The goal of such front-end programs is to make the underlying program easier to manage. I’ve [compared UFW and FirewallD](https://www.ctrl.blog/entry/ufw-vs-firewalld/) in more detail in the past.

However, as I reflected on in my article on [silencing mDNS](https://www.ctrl.blog/entry/how-to-disable-mdns-linux/): UFW does a better job at making `iptables` accessible than FirewallD. Its commands are more intuitive and are easier to memorize.

The first thing you need to do is to install the `ufw` package on your system. Here is the command needed for Fedora Linux:

```shell
dnf install ufw
```

The next thing you’ll want to do to prepare the migration is to export the current FirewallD ruleset. For most systems, all you need to is to take note of the services that are exposed to the internet. The following command will show you a summary of your FirewallD ruleset:

```shell
firewall-cmd --permanent --list-all
```

The last thing you’ll do to prepare before we make any system changes it to review the open listening sockets. These are the services that can be reached over the internet if the firewall doesn’t block access to them. The following command will give you a list of all listening internet sockets:

```
netstat -lpn --inet6
netstat -lpn --inet
```

The sockets listening on any of your public IP addresses, or the special `0.0.0.0` and `::` addresses are the once that are publicly accessible. Make a plan for which services should be available and which you want to block access to. You may also want to temporarily disable some sensitive services while changing the system firewall.

You’re ready to proceed once you’ve figured out what ports/services you want to allow past the firewall.

The first step is to disable the FirewallD service. Having two services trying to manage `iptables` at the same time can cause you a heap of issues. The following command stops FirewallD and disables the service at boot time:

```shell
systemctl disable --now firewalld.service
```

You should then add a minimal set of rules to your Uncomplicated Firewall before enabling that service. The following are firewall rules created by issuing them as commands. The first rule configures the firewall to block every incoming connection except those specifically allow-listed by other firewall rules:

```shell
ufw default deny incoming
```

The second rule allows six incoming connections to the SSH service on port 22 from the same source IP per 30-second interval:

```shell
ufw limit in 22/tcp comment "rate-limit SSH"
```

You can’t tweak the rate-limiting settings in UFW. However, the default is sensible for a lot of commons services including SSH, SMTP, XMPP, and minimal HTTP services. Note that the `man ufw` page says that `limit` rules only work for IPv4\. This hasn’t been the case since version 0.33\. I’ve confirmed that the only IPv6 issue with `limit` rules in version 0.35 is that the documentation hasn’t been updated. This issue is fixed in an upcoming version of UFW.

The `comment` argument used in the second rule command is optional, but I recommend always entering a comment. You’ll thank yourself for putting in the work now when you review your firewall rules in another six months.

The third rule allows VNC connections from the private `10.0.0.0/8` IP subnet:

```shell
ufw allow proto tcp from 10.0.0.0/8 to any port 5900
```

UFW always allows some essential incoming connections by default — like DHCP and IPv6 RA and for network auto-configuration — unless explicitly blocked with `deny` rules.

You can now enable the UFW service using the following command:

```shell
systemctl enable --now ufw.service
ufw status
```

The status command is optional but will give you an overview of the current active firewall configuration.

You can then add more rules based on your notes about what services to allow through the firewall. The `man ufw` documentation is excellent and much easier to read than its `man firewall-cmd` equivalent.

Worried you’ve blocked something you shouldn’t? The following command will list any blocked connections with information about where it came from and the destination port:

```shell
journalctl -t kernel -fag "UFW BLOCK"
```

Note that you won’t need to reload the firewall configuration, [FirewallD style](https://www.ctrl.blog/entry/firewallctl-reload/), for changes to take effect. Changes in UFW are applied immediately.

#### Sources

- [ufw manpage](https://web.archive.org/web/20200123034331/https://manpages.ubuntu.com/manpages/disco/man8/ufw.8.html), 2018-12-17, Jamie Strandboge, Ubuntu Manpage Repository, Canonical
### First impressions of the Scroll news subscription service
URL: https://www.ctrl.blog/entry/scroll-com-first-impressions/
Last updated: 2026-08-23T22:21:44.000Z
Scroll.com is a news subscription service for 5 USD/month. that supports news organizations. Subscribers get an advertisement free and tracking-reduced reading experience on participating news publishers’ websites. Scroll is currently in closed beta, and I’ve had an early look at how the service works.

**Update** (2023-08-12): The Scroll.com service has been discontinued has not been continued as part of Twitter’s service offerings.

**Update** (2021-06-10): Scroll.com has been [acquired by Twitter](https://blog.twitter.com/en%5Fus/topics/company/2021/a-better-way-to-publish-and-read-on-twitter?ref=ctrl.blog). The social network has indicated it will merge its services into its subscription product.

Scroll will, of course, take an undisclosed cut and share the remainder of your subscription fee among participating publishers. Publisher shares are based on subscriber engagement with publisher websites. The service is currently only open for large general-news publishers focused on the United States.

The subscription service means to replace the online advertisement revenue news organizations currently rely on to do their work. Its goal is to give subscribers more benefits and broader access to more news from multiple publishers with a single subscription.

Every participating website displays a white fixed-toolbar (meaning it stays atop of content as you scroll) from Scroll at the bottom of each page. The toolbar includes features your web browser probably already has; including the option to bookmark and hearing a machine text-to-speech reading of the current article.

The white bar is intended to make it clear that you’re logged in to and benefiting from the Scroll.com service. However, it’s just as annoying as all those cookie-notices and other unwanted pests that the Scroll subscription ironically helps you to avoid. The Scroll.com toolbar can’t be dismissed either and will remain at the bottom of the page until you head over to and logout from Scroll.com.

Speaking of toolbars and notices: Scroll.com isn’t present in any of the data-sharing disclosure and consent dialogs that pop-up when you visit any of the current partner websites. You don’t have any say in whether a specific publisher and Scroll.com compare their notes on you. The General Data Protection Regulation (GDPR) generally requires websites to get your explicit consent *before sharing* data with another business such as Scroll.

Publishers share information about your visit with Scroll whether you’re a subscriber or not. They need to do this to check-in with Scroll to figure out if you’re a subscriber or not. Scroll doesn’t return the favor, though. They don’t share persistent identifiers with publishers that can be used to identify you between browsers or devices.

I’d personally prefer having to click ‘Login with Scroll’ on each participating website instead of having to rely on third-party cookies. This is “less magical” but better for privacy and transparency. It wouldn’t require more than a single click from the user for publishers they want to support with their Scroll subscription. Privacy minded users have been blocking third-party cookies for years already. Lately, web browsers like Safari and Firefox also block them by default.

You must enable third-party cookies in your browser for Scroll to do its thing. This is a technology favorite of online advertisement who use it to track your movement across their partner websites, much as Scroll does. Scroll.com needs to collect information about which publishers articles you read to work out publisher revenue shares.

You can review the collected information by going to Scroll.com. There you’ll see a list of all articles you’ve read complete with links that take you back to the same position in the article where you last left off. This can be a neat feature for when you start reading an article on your phone and want to finish it on another device later.

The list of articles in your account is permanent and you can’t currently delete items from it. The best Scroll offers is to hide any embarrassing articles so it wouldn’t be visible in your reading list. Scroll.com CEO Tony Haile ensured me in an email exchange that they’re working on better privacy controls. Including user-configurable [automatic and default data deletion](https://www.ctrl.blog/entry/delete-old-data-gdpr/) and possibly the option to delete/dissociate articles from your account.

Scroll is currently only partnering with big publishers. It’s not a solution for small publishers looking to get their tiny share of the pie. This leaves a market for alternatives like [Flattr](https://www.ctrl.blog/entry/flattr2/) or even more controversial options like [Brave](https://www.ctrl.blog/entry/brave-payments/) and [Coil](https://www.ctrl.blog/entry/coil-web-monetization/).

Scroll is working with Mozilla and is expected to be part of Mozilla Firefox’s upcoming paid premium service offerings. However, I believe Scroll needs to attract more varied and international publishers. Firefox’s 270 million worldwide users will expect a much broader catalog of publishers.

#### Sources

- [Exploring alternative funding models for the web ](https://blog.mozilla.org/futurereleases/2019/02/25/exploring-alternative-funding-models-for-the-web/?ref=ctrl.blog), 2019-02-25, Peter Dolanjski, Future Releases blog, Mozilla
- [Scroll Privacy Policy](https://web.archive.org/web/20191225023826/https://scroll.com/privacy), 2018-07-09, Scroll
### How to change the keyboard layout on the MacOS login screen
URL: https://www.ctrl.blog/entry/how-to-macos-login-keyboard-layout/
Last updated: 2026-08-23T22:10:29.000Z
I’ve had problems with my Mac not remembering my keyboard layout in the start-up login window. Here is how you fix that issue. You may have this issue and not even realize it depending on what characters you use in your password.

However, if your password is dependent on a specific keyboard layout then you need to have the right keyboard layout set on the login screen. You can change the keyboard layout from the input selector in the top left corner of the screen. This can be a serious problem if you don’t realize what has happen, why your Mac won’t accept your password, and you don’t know what to do about it.

This setting won’t always persist and sometimes automatically changes to either the ABC Extended keyboard layout (default when no layout is set), or the wrong keyboard layout in a bilingual setup.

**Update** (2023-10-27): Apple has finally fixed the problems that this article was meant to address in MacOS 14 “Sonoma”. In Sonoma, you can click the keyboard layout indicator in the top right of the screen on the login screen and make adjustments there. The keyboard settings made there will persist directly from that screen if you login immediately after applying the changes. *Thanks Apple!* That took over a decade too many to fix.

---

The rest of the article only applies to MacOS 12 and older.

Here is how to get your Mac to remember your preferred login keyboard layout:

1. Start by going to System Preferences: Keyboard: Input Sources, and make sure your preferred language is included in the list. Remove any unwanted languages from the list.
2. Go to System Preferences: Users and Groups: Login Options. Unlock the preference pane if needed.
3. Toggle the “Show Input menu in login window” option off and on again. (Toggle it on if it wasn’t already enabled.)
4. Go to System Preferences: Language and Region: General: Preferred languages.
5. Temporarily add a second language to the list using the Plus button. You’ll remove it later so just add any language.
6. Drag the new language to the top of the list.
7. Click the new Gear button that appeared on the bottom bar when you rearranged the language list, and choose Apply To Login Window. (As shown in the above screenshot.)

I’ve received several emails from readers who’ve had problems with the Gear button not appearing. The Gear button only appears when the preferred language is different from the currently configured language. Try to add a third language to the list, and restart the System Preferences app.

1. Drag your preferred language back to the top of the list again.
2. Repeat step 7.
3. Remove the language you temporary added to the list by selecting it and clicking on the Minus button.
4. Reboot your Mac.

Be sure to bookmark this page or note the above instructions for later reference. My experience shows that this issue often reappears after MacOS updates on Macs that have experienced this issue before.

Macs with full-disk encryption (FileVault) seems more prune to run into this issue, probably due to how the pre-boot environment lives off to the side from the main systemd. But who knows? Maybe Apple manages to fix this issue sometime in the future.

The above instructions may sound a bit weird and convoluted. That is because they address three different keyboard layout issues. It’s just easier to walk through all the fixes instead of trying to figure out which specific issue affects your Mac.

**Update** (2021-02-25): This article was last updated for MacOS 11 “Big Sur”, but should be applicable in older versions including MacOS 10.15–13.
### Scale static-content archives and tag pages with Nanoc
URL: https://www.ctrl.blog/entry/nanoc-items-performance/
Last updated: 2026-08-23T22:14:44.000Z
[Nanoc](https://nanoc.app/?ref=ctrl.blog) is the static website generator that among other things powers this blog. Blogs often have taxonomy pages listing entries by topic and by publication date. Nanoc has some helper methods that can get these pages done quickly. But these methods don’t scale very well for large numbers of blog entries and taxonomies. Over time you’ll want to optimize beyond what Nanoc’s helper methods offer.

The problem with Nanoc’s helper methods is that they create a lot of unnecessary dependencies. The way most of the items-filtering focused helpers work ends up creating a dependency on every other site item, including static assets like images, to find the specific items you want. If any item changes, all items built with the default helpers need to be rebuilt even though no relevant items have changed.

Ideally, you want your pages to have as few dependencies as possible or you’ll slow down the site compilation significantly. Checking dependencies make up the brunt of processor-bottlenecks during compilation task for sites with many items.

Related: Speed up your static site generator and other I/O blocked tasks by [using a performant file system](https://www.ctrl.blog/entry/btrfs-vs-ext4-performance/).

Let’s take a simplified look at what the `sorted_articles` helper method does to return a list of articles sorted by creation date:

```ruby
@items
  .select { |item|
    item[:kind] == "article"
  }
  .sort_by { |item|
    item[:created_at]
  }
  .reverse
```

Using `@items.select` in a layout template would create a dependency on every item in the project. Other helpers that work with items have the exact same problem, so let’s get rid of the helper methods and optimize!

Assuming you know where your articles are located (like `/entry/`) you can speed this up using the `@items.find_all` method to filter the dependencies. This method accepts one glob pattern, which will reduce the dependency tracking to just the items that match the pattern:

```ruby
@items
  .find_all("/entry/*.html")
  .sort_by { |item|
    item[:created_at]
  }
  .reverse
```

For a blog, you’d probably use something like the above in at least three different templates to generate the front page, an XML syndication feed file, and an XML site map file. In other words, you’d be doing the same task three times.

You can speed up things again by moving the item filtering out of the template and over into to the pre-processor. We can build on the above to create yearly archives and tag pages while only doing a single pass through the full list of items. We’ve already got a list of entries sorted by date, so let’s filter out lists of items per year and tag as well:

```ruby
# SPDX-License-Identifier: CC0-1.0

year_arch = Hash.new
tags_arch = Hash.new

@items
  .find_all("/entry/*.html")
  .each { |item|
    year = item[:created_at].utc.year
    unless year_arch.include?(year)
      year_arch[year] = Array.new
    end
    year_arch[year]
      .push(item.identifier.to_s)

    next if item[:tags].to_s.empty?

    item[:tags]
      .each do |tag|
        unless tags_arch.include?(tag)
          tags_arch[tag] = Array.new
        end
        tags_arch[tag]
          .push(item.identifier.to_s)
      end
  }
  .sort_by { |item|
    item[:created_at]
  }
  .reverse
```

You’ve then iterated through only the relevant items, just once, and built the hashes for each taxonomy along the way. The next step is to create the items and pass along the list of dependencies.

```ruby
# SPDX-License-Identifier: CC0-1.0

year_arch
  .each do |year, year_items|
    identifier = "/archive/#{year}.html"
    attr = {
      archive_year: year,
      archive_items: year_items,
      identifier: identifier
    }
    @items.create("", attr, identifier)
  end

tags_arch
  .each do |tag, tag_items|
    identifier = "/tag/#{tag}.html"
    attr = {
      archive_tag: tag,
      archive_items: tag_items,
      identifier: identifier
    }
    @items.create("", attr, identifier)
  end
```

In the relevant layouts, you can then access the pre-processed list of dependencies by reading the `archive_items` attribute and passing it along as a glob list to `@items.find_all`:

```ruby
pattern = "{#{@item[:archive_items].join(',')}}"
@items.find_all(pattern)
```

I’ll leave it as an exercise for the reader to apply the same optimizations to their sitemaps, syndication feeds, front page, and other items that depend on other items.

Pro tip: Divide up your XML sitemap into multiple files, e.g. by creation year, and combine them again with an XML sitemap index. That way you won’t have one massive slow-to-calculate item that depends on all items.

Using the optimizations discussed in this article, I was able to reduce my compilation time by almost three quarters. More importantly, creating a new item no longer requires every item’s dependency to be recalculated. Also, adding a new tag or another year no longer adds a big performance penalty to the compilation time.

I’ve found plenty of references to Nanoc getting slow over time in ten-year old blog posts. The thing is, not much have changed in terms of the default helpers over the years. The helpers may very well be responsible for Nanoc’s reputation for being fast in the beginning and then slowing down over time.

#### Sources

- [helpers/blogging.rb](https://github.com/nanoc/nanoc/blob/4.11.7/nanoc/lib/nanoc/helpers/blogging.rb?ref=ctrl.blog), version 4.11.7, 2019-07-28, Project repository, Nanoc, GitHub
- [Internals](https://nanoc.app/doc/internals/?ref=ctrl.blog), 2019-05-10, Denis Defreyne, Reference, Documentation, Nanoc
- [Helpers](https://nanoc.app/doc/reference/helpers/?ref=ctrl.blog), 2019-04-27, Denis Defreyne, Reference, Documentation, Nanoc
- [Rules](https://nanoc.app/doc/rules/?ref=ctrl.blog), 2019-04-27, Denis Defreyne, Reference, Documentation, Nanoc
### Bluetooth privacy and the FreeStyle Libre 2 glucose monitoring system
URL: https://www.ctrl.blog/entry/freestyle-libre2-ble-privacy/
Last updated: 2026-08-23T22:07:44.000Z
I’ve been using the [Abbott FreeStyle Libre 2](https://www.freestyle.abbott/?ref=ctrl.blog) flash-glucose monitoring system for the last two months. The system consists of a glucose sensor attached to the back of the upper arm; which lasts for up to 14 days before needing replacement. You can then scan the sensor using a dedicated [reader or an NFC-capable smartphone app](https://www.ctrl.blog/entry/freestyle-libre-reader-vs-app/) to get current and up to 8-hours of glucose-trend readings.

The sensor can also notify you over Bluetooth about critical glucose levels that require urgent intervention. This last feature is new in Libre 2 and it enables me to sleep better at night knowing my phone will wake me if there’s a problem.

The system is a huge improvement over the traditional dozen or so daily finger-prick blood tests most diabetics need to perform. The Libre 2 isn’t a full continuous glucose monitoring (CGM) system as it only provides data when scanned. However, the automatic alerts when you’re outside your target glucose range gives you the most important feature of a CGM.

Unfortunately, patient privacy wasn’t a guiding product development principle over at Abbott when making the Libre 2\. Depending on your choice of clothing, no one can tell that you’re wearing the sensor just by looking at you.

However, the sensor itself broadcasts every three-minutes to anyone within Bluetooth range that you’re wearing a glucose monitoring device. Thereby revealing personal information about a chronic medical condition to anyone nearby.

The Bluetooth broadcasts also contain a persistent unique identifier that only changes when the sensor is replaced (normally every 14 days). This identifier can be used to track the wearer’s physical location and movement habits. Tracking Bluetooth devices is increasingly common in retail locations, public transit hubs, and other public spaces.

Here is an example of the sensor’s Bluetooth announcement data that makes it uniquely trackable:

Device name:
ABBOTT<SERIAL-NUMBER>

Device address:
<48BIT-UNIQUE-ADDRESS>

Service UUID:
0xFDE3 Abbott Diabetes Care

Vendor UUID:
0x03BB Abbott Diabetes Care

Abbott should have implemented the [Bluetooth Low-Energy (BLE) Privacy extension](https://www.ctrl.blog/entry/tutorial-test-ble-privacy/) to help protect their customer’s privacy. The BLE Privacy system randomizes the unique address used in Bluetooth announcements every couple of minutes; making it a lot more difficult to track your location over a prolonged period.

Abbott ideally shouldn’t even have included their own vendor UUID, service UUID, or the device name. These data points reveal information about your chronical medical condition.

Abbott isn’t alone when it comes to not supporting BLE Privacy. Many popular activity trackers and wireless headsets don’t support the feature either. For these types of devices, consumers have more choice and can opt to use models that do support it. However, consumers don’t have anywhere near the same level of choice when it comes to specialized medical devices.

You can ask people to disable Bluetooth on their smartphones and peripherals in locations where they don’t want to be tracked. It’s a bit inconvenient that you can’t listen to music while on your way to visit a secret lover, but it’s not going to shorten your lifespan.

You can’t tell people not to use these types of medical devices, however. (The sensor can’t even be turned off temporarily once it’s installed.) The Libre 2 can lead to an improved quality of life and better long-term health outcomes for diabetics. The cost of this technology may be to make us trackable, but the cost/benefit calculation still comes out in favor of using it.

The only thing that can protect FreeStyle Libre 2 customer’s privacy is strong privacy regulation and enforcement. Europeans should be fine as the General Data Protection Regulation (GDPR) doesn’t allow businesses to collect unique identifiers such as those broadcast with Bluetooth and Wi-Fi without first obtaining explicit consent.

European data protection authorities were wary of this type of tracking even before the GDPR went into effect. This is, of course, of little comfort to Abbott customers outside the European Economic Area (EEA).
### How to test if your Bluetooth devices support BLE Privacy
URL: https://www.ctrl.blog/entry/tutorial-test-ble-privacy/
Last updated: 2026-08-23T22:23:39.000Z
Legacy Bluetooth devices and newer Bluetooth devices that haven’t implement privacy-protections broadcast a persistent identifier that’s unique to each device. These broadcasts usually happens several times per minute. Retailers, transportation providers, and others have been recording these broadcasts for years and use them to track people as they move through public spaces. A persistent identifier even allows them to map your whereabouts and habits over time.

Bluetooth devices, like Wi-Fi devices, support a privacy-enhancing technique that periodically randomizes the broadcasted address, which makes it harder to track them as their owners move about in the world. Paired devices, like your phone or laptop, can still resolve the device’s real address, enabling them to communicate properly. However, how do you tell if your device is protecting your privacy or not?

Ideally, products that support BLE Privacy should be clearly labeled so that you as a consumer can make an informed purchase decision. Unfortunately, Bluetooth peripheral makers are notoriously bad at providing any kind of technical documentation for their products whatsoever.

You can try to look up information online, but very little product-specific information is available despite this being a seven-year-old standard. I’ve only found a single online product review mention that a device supported BLE Privacy, and that was for one of the very few products that list it as a feature.

The only way to check that your Bluetooth enabled devices do a good job is to manually test one and verify that it preserves your privacy. I’ll walk through the test process using an app for Android that makes this quick and easy to do. I’ll also explain what to look for so you can still follow along using any general Bluetooth scanning app for iOS, Windows, or another Bluetooth host device.

You’ll need a smartphone running Android 6 “Marshmallow” or newer with support for Bluetooth 4.2 or later. You can look up this information on your phone manufacturer’s website.

Start by unpairing the devices you want to test from your Android phone. You can do this from the Bluetooth section of the system Settings app. You need to do this first to ensure your device pairing won’t interfere with the test by unmasking the real address of the devices you want to test.

Next, download and install the ~~BLEScanner app~~ from the Google Play Store. Open the app and tap the Play button to start scanning for nearby Bluetooth devices, and identify your device in the list. This can be difficult when there are many Bluetooth devices nearby. If you’re having trouble identifying your device then make sure it’s powered on and try walking away from other Bluetooth devices. An elevator car — assuming it’s made of metal and will block most outside signals — can be an ideal impromptu Faraday cage/test chamber. Not all Bluetooth devices broadcast continuously so keep an eye on the list for at least a few minutes.

**Update** (2021-04-21): The BLEScanner app is no longer available on the Play Store. The developer hasn’t responded to my request for a comment.

Note the device’s address once you’ve identified the device you want to test. The BLEScanner app lets you mark devices as favorites so you won’t need to remember them. Repeat this test several times over the next one–three days and note any changes to the device address.

If your device’s address changes over time, then it has implemented BLE Privacy protections. If it stays the same, then it can be tracked. Be sure to share your test results online so others looking for privacy-preserving product recommendations can find it.

Note that even when BLE Privacy is implemented properly, it may still be possible to track it due to common implementation flaws. However, this only works if you remain within the range of a tracker for a prolonged period, and requires a much more sophisticated setup than common commercial tracking scenarios.

Bluetooth devices also publicly broadcast their manufacturer, model, and services. A unique combination of Bluetooth devices may be used to fingerprint your Bluetooth signature, which again exposes you to persistent tracking even when BLE Privacy protections are implemented. At this point, strong privacy regulation and enforcement is the only protection that can effectively keep you from being tracked. Or maybe leave your fitness tracker at home and use wired earphones.

#### Sources

- [How Fitbits, Other Bluetooth Devices Make Us Vulnerable to Tracking](https://www.bu.edu/articles/2019/fitbit-bluetooth-vulnerability/?ref=ctrl.blog), 2019-07-17, Sarah Wells, The Brink, Boston University
- [BLE Advertising Primer](https://www.argenox.com/library/bluetooth-low-energy/ble-advertising-primer/?ref=ctrl.blog), 2019-02-19, Argenox
- [Bluetooth LE – Increasingly popular, but still not very private](https://web.archive.org/web/20190205215242/https://www.contextis.com/en/blog/bluetooth-le-increasingly-popular-still-not-very-private), 2016-05-05, Scott Lester and Paul Stone, Blog, Context Information Security
- [Bluetooth Technology Protecting Your Privacy](https://www.bluetooth.com/blog/bluetooth-technology-protecting-your-privacy/?ref=ctrl.blog), 2015-04-02, Martin Woolley, Blog, Bluetooth SIG
### Why my 7-year old Windows 10 laptop became unbearably slow
URL: https://www.ctrl.blog/entry/slow-windows-hvci/
Last updated: 2026-08-23T22:22:08.000Z
Modern PC components, other than the battery and cooling fans, don’t degrade over time. (Correction: [thermal compound does degrade over time](https://www.ctrl.blog/entry/repaste-thermal-compound/).) So what caused my 7-year old first-generation *Lenovo ThinkPad X1 Carbon* laptop to periodically become unbearably slow and crashy?

The laptop, running Windows 10 Professional, worked just great most of the time. After a few hours of use, though, its performance would crawl to a near standstill and it would be nearly impossible to get anything done. Typing would lag behind several seconds and it could take up to a minute to open the Start menu or any programs.

This would happen seemingly at random a couple of times a week, and last for up to a couple of hours. After a lot of trial and error I found out that the performance hits would happen whenever Windows Update or Windows Security scans were running in the background. These are processor, memory, and storage intensive tasks.

I ran several performance tests involving heavy simultaneous CPU and storage I/O tests, hoping to trigger similar crippling performance issues — but the laptop would keep working admirably under these controlled conditions.

The ThinkPad has a dual-core Intel i5-3472U processor, which is one of those processor models that have been hit particularly hard by the performance penalties from the mitigations for the much publicized speculative execution processor-architecture security flaw mitigations (Spectre and Meltdown.)

I also tried testing with the Meltdown and Spectre mitigations disabled. However, this didn’t give any perceived performance gains and the laptop would still periodically grind to a halt. Performance benchmarking revealed a 8–16 % performance improvement with the mitigations disabled, but this didn’t appear to be the root cause of my issues with Windows Security and Windows Update, however.

I’ve chosen to disable the Meltdown mitigations permanently as this seem to also increase the laptop’s battery life. I guess I’ll just not do any banking or anything too sensitive on this laptop from now on.

The laptop had also begun to run into blue screens of death (BSoD) whenever I used the built-in camera and when I opened Spotify or Netflix in a web browser. The slowdown and crashes were related, but I didn’t realize this at first. The camera-induced BSoD error message blamed the camera vendor’s driver without any further details. This sounds believable enough for a 7-year old laptop so I didn’t think any more of it.

The BSoDs I got with Spotify and Netflix just said “Stop Code: PAGE\_FAULT\_IN\_NONPAGED\_AREA”. This error message relates to memory-handling. I thought that perhaps the RAM had gone bad, but it passed all tests I could throw at it with flying colors.

What Spotify and Netflix on the web have in common, other than being overpriced for what they offer, is that they both use Google’s Widevine digital rights management (DRM) decryption module. This module talks directly with video drivers, memory, and other components on the laptop to ensure that no software is recording the music or video that’s being played back from these streaming services.

This pointed me to some sort of device firmware or memory issue. When Windows encounters a BSoD, it creates a MEMORRY.DMP file containing information that can be run through a debugger to learn more about the problem. However, WinDbg failed to analyze this crash because it said it was corrupted. This again pointed to an issue with the memory.

So, let us recap: the issue seems to be related to system memory, but there isn’t anything wrong with the installed memory in the system. What else could have changed regarding how Windows handles memory? —and memory handling for security-critical processes and device drivers specifically.

Windows 10 April 2018 Update introduced a new feature called Hypervisor protected Code Integrity (HVCI) or just Memory Integrity for short. This new security feature protects the Windows Kernel from certain forms of memory manipulation. Just the sort of tricky memory manipulation you’d expect malware, camera drivers, and digital rights management software to be doing.

Turning off this feature immediately resolved all my performance and bluescreening problems. You can find the Off switch in the Windows Security app: Device Security: Core Isolation: Memory Integrity. Notably, if I try to turn Memory Integrity back on again I’m greeted with an error message that says:

> “Memory integrity can’t be started. There may be an incompatibility on your device.”

It turns out that neither the Trusted Platform Module (TPM) or my processor meets the minimum feature requirements to run this feature. Then how, you may ask, was it enabled by default in the first place?

This feature isn’t turned on by default when you update from an earlier version of Windows to one that has this feature. However, it *is* turned on by default on new installations.

This is my significant other’s old laptop, and I’d reinstalled Windows 10 when I re-purposed it as a couch laptop. This is considered a new installation and the Memory Integrety feature was apparently enabled with a complete disregard for whether the device meets the minimum requirements or not! Notably, Windows itself knew the feature shouldn’t be turned on on this device but only warned me about it after I’d disabled it and tried to re-enable it.

The laptop is now in fine working condition again, without the disruptive intermittent performance degradations and blue screens of death. I hope to be able to use it for a couple of years more.

This has been a neatly packaged up and abbreviated story about a laptop that got slow and how I over the course of a few months figured out and resolved the problem. I suspect, however, that this isn’t representative of the fate that lies in store for most laptops that exhibit similar issues. Some may see a second wind and a new life running Linux or another alternate operating system. But most of these laptops will end up in a recycling center somewhere.

#### Sources

- [Device protection in Windows Defender Security Center](https://support.microsoft.com/en-us/windows/device-protection-in-windows-security-afa11526-de57-b1c5-599f-3a4c6a61c5e2?ref=ctrl.blog), 2019-02-11, Windows Security support, Microsoft
- [Windows Defender System Guard: Making a leap forward in platform security with memory integrity](https://techcommunity.microsoft.com/t5/windows-insider-program/windows-defender-system-guard-making-a-leap-forward-in-platform/m-p/167303?ref=ctrl.blog#M1256), 2018-03-02, Chris Riggs, Windows Insider Program, Windows Enterprise Security, Microsoft Tech Community, Microsoft
- [Understanding the performance impact of Spectre and Meltdown mitigations on Windows Systems](https://www.microsoft.com/en-us/security/blog/2018/01/09/understanding-the-performance-impact-of-spectre-and-meltdown-mitigations-on-windows-systems/?ref=ctrl.blog), Terry Myerson, Microsoft Security Blog, Microsoft
- [Hardening the system and maintaining integrity with Windows Defender System Guard ](https://www.microsoft.com/en-us/security/blog/2017/10/23/hardening-the-system-and-maintaining-integrity-with-windows-defender-system-guard/?ref=ctrl.blog), 2017-10-23, Microsoft Defender ATP team, Microsoft Security Blog, Microsoft
### Google should auto-delete aging user data by default
URL: https://www.ctrl.blog/entry/google-autodelete/
Last updated: 2026-08-23T22:08:50.000Z
Google have rolled out controls allowing signed-in users to have their collected location history, web searches, and activity data automatically deleted after three or 18 months. Controls to delete data had been available before, but users would have to revisit periodically and manually request the deletion of data.

Google doesn’t yet prompt users to choose how long they want data to be stored, but they can go in and set their own preferences if they manage to find the auto-delete options.

Most users will leave the default option and let Google retain their personal data indefinitely. However, I believe Google have added these controls now — over a year late to meet the GDPR deadline — partially in response to user backlash over privacy and in anticipation of GDPR enforcement action against the company.

I’ll not be surprised when we see this setting being enabled-by-default for new accounts created in Europe within a couple of months. Old accounts will probably be prompted for their data-retention preferences as well.

**Update** (2020-06-25): Google now enables this by default for *new accounts*. The default setting varies by service and is set to 18–36 months. You can reduce this to three months or opt-out of data-collection all together. Accounts created before June 2020 still need to manually change their account’s privacy setting and opt-in to have their old data deleted automatically.

As I’ve talked about in the past: [the GDPR requires companies to periodically delete old data](https://www.ctrl.blog/entry/delete-old-data-gdpr/) once that data is no longer befitting the customer or serve another purpose explicitly agreed to by the customer.

Notably, none of the large tech news sites — who’re never shy to criticize the GDPR — or even outlets like [Washington Post](https://www.washingtonpost.com/technology/2019/05/02/google-will-soon-allow-users-auto-delete-location-history-search-data/?utm%5Fterm=.208ffa51953f&ref=ctrl.blog) or [Bloomberg](https://www.bloomberg.com/news/articles/2019-05-01/google-will-now-auto-delete-some-user-data-if-you-ask?ref=ctrl.blog) mentioned the GDPR in their coverage of Google’s new privacy controls. It’s perhaps not unexpected that U.S. news organizations don’t focus on positive outcomes from regulation.

It’s true that Google can deliver better and more personalized services (including ads, of course) by knowing your recent search and location history.

However, your search history from ten years ago might not be relevant to your life and who you are today. People do change over time and online personalization algorithms shouldn’t lock them in to being who they’ve been in the past for the rest of their digital lives.

#### Sources

- [Keeping your private information private](https://blog.google/technology/safety-security/keeping-private-information-private/?ref=ctrl.blog), 2020-06-24, Sundar Pichai, Blog, Google
- [Introducing auto-delete controls for your Location History and activity data](https://blog.google/technology/safety-security/automatically-delete-data/?ref=ctrl.blog), 2019-05-01, David Monsees and Marlo McGriff, Blog, Google
### Add Webmention support to your website in ten minutes
URL: https://www.ctrl.blog/entry/setup-webmention/
Last updated: 2026-08-23T22:21:54.000Z
Webmention is a protocol for sending and receiving notifications about webpage link relations. It’s fundamentally about tearing down the walled gardens created by the leading social networks, and allow for interactions using links across websites and platforms on the open web.

Using Webmention, Webpage A can notify Webpage B that it has added or removed a link to it. This can be useful for a website that wants to track comments, reactions, citations, and other uses for linking even when those interactions happen on another website.

Websites can use Webmention however they like. They can chose to curate and display their Webmentions publicly on the relevant page, or just as a way to collect reactions to webpages they’ve published. It’s similar to earlier linkback standards like Trackback and Pingback. However, the Webmention standard encourages link verification, addresses DoS vulnerabilities, and reduces the abuse potential compared to those earlier protocols. It also encourages notifying pages when links are removed and not only when they’re added.

### Implementing Webmention

The [Webmention specification](https://www.w3.org/TR/webmention/?ref=ctrl.blog) doesn’t take more than an afternoon or two to implement; helped by the excellent free validation and [testing utility called Webmention.rocks](https://webmention.rocks/?ref=ctrl.blog).

This article’s headline promised “ten minutes” and not a couple of afternoons, though. I’ll deliver on the headline, but I’d like to encourage people to implement it themselves. This isn’t always an option though, such as when you’ve a static website or publish on a website or platform out of your control.

Webmention can be used for non-public communication, but it’s intended to be used on publicly accessible websites. Unless you expect to receive notifications from private platforms, you can outsource the endpoint that will be receiving Webmentions to a free-of-charge hosted third-party service. The rest of this article will go into how you can do that in a few easy steps.

### Receiving Webmentions

To receive Webmentions, you need an HTTP endpoint capable of receiving and verifying them, and you need to add Webmention auto-discovery information to your webpages.

You can sign up and use [Webmention.io](https://webmention.io/?ref=ctrl.blog) to receive your website’s Webmentions. You need to login with your domain name to register it to get set up to receive Webmentions.

Once that’s done you’ll get an HTTPS endpoint address that you’ll need to add to your webpages so Webmention senders can auto-discover it. Webmention uses two auto-discovery methods; you must support the first method and should support the second one as well.

The required Webmention endpoint auto-discovery method uses a `link` element with the `webmention` link relation. You must include the following (with your endpoint in the `href` attribute) on all pages you want to receive Webmentions for:

```html
<link rel="webmention"
  href="https://webmention.io/example.com/webmention">
```

The second optional-but-encouraged endpoint discovery method uses a `Link` HTTP response header. Senders should prefer this method as its less resource-intensive and can be discovered using a simple HTTP HEAD request. You should add the following response header (with your endpoint) to all webpages and resources you want to receive Webmentions for:

```
Link: <https://webmention.io/example.com/webmention>; rel="webmention"
```

Once you’re set up to receive Webmentions, you can retrieve your Webmentions using Webmention.io’s Application Programming Interface (API) or your domain’s custom Atom syndication feed. It’s impossible to miss the instructions on how to retrieve your notifications after you’ve signed up with Webmention.io.

You can simply update the endpoint addresses if you later decide to use another hosted service or do your implementation. Webmention.io isn’t only free-of-charge but a free software project that you can self-host. I don’t believe this shouldn’t take you more than a couple of minutes.

There are also Webmention plugins available for all major content management systems (CMS) if you prefer building on top of your CMS. When you’re set up to receive Webmentions, you next need to decide on a strategy for sending them.

### Sending Webmentions

You’ve got a lot of options when it comes to sending Webmentions, but Webmention.app is a good place to start.

**Update** (2023-08-12): The Webmention.app service has been discontinued. There is currently no other good free alternatives.

Webmention.app is available as a free-of-charge hosted API that you can feed your webpages or even a syndication feed file and they’ll take care of scanning your pages and sending outgoing Webmention notifications. The API is rate-limited to process a couple of pages per day, which should be more than enough for most small blogs and websites.

Alternatively, you can download their open-source command-line client and do the webpage parsing and send the notifications from your computer.

Depending on your work flow, you may want to run the command-line program as part of your website deployment/publishing process, or automate periodic calls to their API.

### What about webspam?

Webmention is as susceptible to spam submissions as any other publicly facing web service. It hasn’t been a huge problem for me, but you may need to maintain a blocklist or implement some other anti-abuse measurements if it becomes a problem for you.

Unlike earlier page-to-page linkback notification specifications like Trackback or Pingback, the Webmention specification recommends that receivers should verify that the sending page links to the destination page. It also suggests doing these checks asynchronously, to reduce the impact of Denial-of-Service (DOS) attacks. This check can be repeated periodically.

You can conceivably add more checks like looking up the sending page’s URL through any number of free-of-charge anti-phishing, anti-malware, and domain reputation checks as well.

### Mentioning Webmention

You should test your website with [Webmention.rocks](https://webmention.rocks/?ref=ctrl.blog) after you’ve made it capable of sending and receiving Webmentions. The last thing you need to do is to mention Webmention on your website, and tell your web-peers about it to increase interest for and adoption of the protocol.

*It probably won’t come as a huge surprise to anyone who’ve read this article that Ctrl blog now can send and receive Webmentions!*

#### Sources

- [Send Outgoing Webmentions](https://remysharp.com/2019/06/18/send-outgoing-webmentions?ref=ctrl.blog), 2019-06-18, Remy Sharp
- [Documentation](https://webmention.app/docs?ref=ctrl.blog), 2019-06-17, Remy Sharp, Webmention.app
- [Webmention](https://www.w3.org/TR/2017/REC-webmention-20170112/?ref=ctrl.blog), 2017-01-12, W3C Recommendation, World Wide Web Consortium (W3C)
### Where are the managed IP-anycast VPS service providers?
URL: https://www.ctrl.blog/entry/managed-anycast-vps/
Last updated: 2026-08-23T22:14:11.000Z
There’s a reasonably competitive market for Virtual Private Servers (VPS) where companies compete on offering cheap VPSes in data centers located all over the world. However, having a server close to the end-user won’t do you any good unless you also have an efficient way to route customers to the nearest data center.

Most network nodes are unicast, having a single IP address advertised from one place on the internet. Everyone everywhere in the world route to that one location when they try to connect to it. An anycast IP address works the same way, except that it’s being advertised from multiple locations (or data centers) and internet exchanges around the world will pick the shortest route when connecting people to that IP address.

So, why aren’t there any VPS providers offering managed anycast IP addresses to enable and encourage their customers to buy even more VPSes? There are a couple of VPS providers, like [Vultr](https://www.vultr.com/?ref=7131491), that offer to do BGP announcements. However, that requires you to acquire and manage IP space of your (at least a /24 subnet.) This is both technically challenging and quite costly, now that IPv4 space is entirely depleted.

Ideally, I’d like to see VPS providers offer IP addresses out of a shared IP anycast subnet; where customers could lease one address that would route to the closest of their VPSes. This is for sure a much more complex setup than unicast IPs. However, it also greatly increases the value for each customer in renting VPSes in multiple regions from the same provider. The increased infrastructure cost would pay for itself once the provider could upsell their customers with VPSes in all (or at least more) of their data centers.

I haven’t found any public signs of plans for adding IP anycast support from any of the market leading multi-datacenter VPS providers like Digital Ocean or Linode. These services have large and increasing numbers of data centers all over the world, but don’t offer a sensible way to make use of them. A managed IP anycast solution would, if packaged and sold in a convenient form, greatly increase the practical value to the customers of having VPS instances in multiple data centers.

There’s currently only one small provider offering this type of product: BuyVM sells an [IPv4-only anycast VPS package](https://buyvm.net/anycast-vps/?ref=ctrl.blog) starting at 60 USD/year with one VPS in Luxembourg, Europe, and one each in Last Vegas and New Jersey, USA. I’ve kept my eye on BuyVM for some time, but they’ve been “out of stock” for years.

There was another VPS provider who made a brief appearance on the market between August 2018 and April 2019: *Aulerion* offered competitively priced VPS in eight locations in Europe and North America with managed anycast IP addresses. I’d been working on a list of cool things I’d like to experiment with over anycast when they abruptly ceased operations. Unfortunately, they shut down services in April 2019 following a distributed denial of service attack that drained the company of funds.

You can still utilize multi-datacenter VPS setups with GeoDNS (see my [budget GeoDNS provider comparison](https://www.ctrl.blog/entry/review-cheap-geodns/)). However, GeoDNS is generally incompatible with DNSSEC as it requires the DNS provider to change the response pending on the users’ geographical location. GeoDNS accuracy has also gone down in recent years as people have stopped using their ISP’s DNS services in favor of other public DNS resolvers.

#### Sources

- [Letter to customers](https://web.archive.org/web/20190408054807/https://aulerion.com/), 2019-04, Aulerion
- [Announce Your IP Space](https://www.vultr.com/features/bgp/?ref=7131491), 2019, Vultr
- [Build your Anycast Network in Nine Steps](https://labs.ripe.net/author/samir%5Fjafferali/build-your-own-anycast-network-in-nine-steps/?ref=ctrl.blog), 2016-12-19, Samir Jafferali, Ripe Labs

P.S.: I do apologize to New Zealanders for leaving you out of the world map in the illustration.
### Feitian MultiPass recall highlights need to use multiple security keys
URL: https://www.ctrl.blog/entry/feitian-multipass-recall/
Last updated: 2026-08-23T22:06:37.000Z
You may remember that I picked up a couple of different security keys last year and wrote about [Firefox, Security Keys, U2F, and Google Advanced Protection](https://www.ctrl.blog/entry/firefox-u2f-google/). One of the keys that I got, the Feitian MultiPass FIDO Security Key, was recalled in May 2019 over a security issue.

The product (shown above) was featured in a photo accompanying the article, but I didn’t recommend it. The Feitian MultiPass uses Bluetooth, and [I’m not a fan of the Bluetooth user experience](https://www.ctrl.blog/entry/bluetooth-device-pairing/). The product is also sold by Google under the brand name *Titan Security Key*.

The security issue affects the non-plus variants of version 1, 2, and 3 of the Feitian MultiPass Security Key (as identified on the back of the device.) The security issue is caused by an oversight in how the security key negotiated a secure connection to other devices over Bluetooth. If you’ve got one of these device, Feitian [offers to replace it](https://web.archive.org/web/20190712075237/https://www.ftsafe.com/replacement/) free of charge. The replacement process requires you to provide proof of purchase and about one month of patience.

This issue demonstrates the need to associate more than one security key as your second factor authentication token for your online accounts. Ideally, using different security key products from different vendors in case there’s an issue with one of them.

I’ve deliberately chosen not to use security keys with services that don’t allow me to register multiple keys. (I’ve even opted to use other services in place of services that have this limitation. ) I want to have at least two keys that can unlock my account in case I lose one key, or one is recalled or otherwise needs to be replaced. Services that don’t allow you to register at least two keys will need to have some other account recovery method available, in case you lose your one associated key, and this opens up your account to customer support phishing and social engineering, and other targeted attacks.

There are a number of online services that allow you to register only one security key. These services often don’t allow you to replace that one key with a new key either. You’ve committed to keeping it with you for life if you want to retain access to your account. You should always make yourself familiar with a particular online service provider’s security key implementation and limitations *before* you enable two-factor authentication with a security key (or any other second factor authentication method.)

If you’re looking to lock down your digital life with security keys, you can find some product recommendations in [my original article](https://www.ctrl.blog/entry/firefox-u2f-google/).

#### Sources

- [Product Issue Notification](https://web.archive.org/web/20190712075237/https://www.ftsafe.com/replacement/), 2019-05-15, Feitian Technologies
### How quickly do Firefox derived browsers receive security updates
URL: https://www.ctrl.blog/entry/downstream-firefox-security-updates/
Last updated: 2026-08-23T22:05:22.000Z
Mozilla released two security updates to their open-source Firefox web browser just two days apart. This provided an excellent stress test and case study for how quickly Firefox derived web browsers ship security updates.

The two security vulnerabilities in question, CVE-2019-11707 (MFSA-2019-18) and CVE-2019-11708 (MFSA-2019-19), were both zero-day critical security vulnerabilities that were known to be actively exploited on the web. Mozilla released Firefox 67.0.3 and 67.0.4 two days apart to address each of these issues.

I’ll use the same Firefox derivatives [I’ve featured before](https://www.ctrl.blog/entry/four-firefox-derivatives/): Tor Browser, Cliqz, Waterfox, and Pale Moon.

The below table shows how many hours it took after Mozilla Firefox had released an update before downstream projects released an update to address the problem:

__Downstream project hours to release after Firefox upstream release__
| Browser        | Release delay  |           |
| -------------- | -------------- | --------- |
| Firefox 67.0.3 | Firefox 67.0.4 |           |
| Tor Browser    | 31 hours       | 10 hours  |
| Cliqz          | 72 hours       | 200 hours |
| Waterfox       | 29 hours       | unpatched |
| Pale Moon      | Not vulnerable |           |

The above table is sorted by the estimated number of active users for each web browser. The most popular browsers unsurprisingly has the most resources to track upstream releases more closely.

Cliqz and Waterfox ship the latest version of Firefox, and the Tor Browser ships the slightly older Extended Support Release (ESR) version. Both the current and EST versions of Firefox were vulnerable to the zero-day security issues. Pale Moon is a true project fork from Firefox and no longer shares the vulnerable components that were affected by the recent security issues.

The Tor Browser was quick to release an update for both issues. The Tor Project caters to people who need strong security and privacy, and it’s good to see them keeping up with the latest developments.

Cliqz was slower, and took three days to release the first update, and then didn’t release the second update until I prompted them about it a week later for this article. Their project commit log shows that a developer had done the work required to update their codebase on Monday, but it still took them until Friday to push out the update.

Waterfox is mostly a one-man project, but managed to deliver the first security update in a timely manner. They appear to have dropped the ball on the second security update, however. I reached out to the project’s account on Twitter (no other point of contact was provided on the project’s website), but haven’t heard back.

I’m not trying to convince you not to explore different web browsers. However, you should be aware that alternate web browsers will be lagging behind the original projects when it comes to security updates. You need to decide for yourself what is an isn’t an acceptable security risk for you. Please also keep in mind that most of these smaller web browser projects are volunteer efforts by small teams with lives and families of their own.

#### Sources

- [Release 1.27.4](https://github.com/cliqz-oss/browser-f/releases/tag/1.27.4?ref=ctrl.blog), 219-06-28, Alexander Komarnitskiy, Releases, Cliqz project, Github
- [New Release: Tor Browser 8.5.2](https://blog.torproject.org/new-release-tor-browser-853/?ref=ctrl.blog), 2019-06-21, Nicolas Vigier, Blog, Tor Project
- [Release 1.27.3](https://github.com/cliqz-oss/browser-f/releases/tag/1.27.3?ref=ctrl.blog), 219-06-21, Alexander Komarnitskiy, Releases, Cliqz project, Github
- [Mozilla Foundation Security Advisory 2019-19](https://www.mozilla.org/en-US/security/advisories/mfsa2019-19/?ref=ctrl.blog), 2019-06-20, Mozilla
- [For the record](https://twitter.com/palemoonbrowser/status/1141297682260123648?ref=ctrl.blog), 2019-06-19, Pale Moon project, Twitter
- [New Release: Tor Browser 8.5.2](https://blog.torproject.org/new-release-tor-browser-852/?ref=ctrl.blog), 2019-06-19, Nicolas Vigier, Blog, Tor Project
- [Waterfox 56.2.11 Release](https://web.archive.org/web/20190620005228/https://www.waterfox.net/blog/waterfox-56.2.11-release-download/), 2019-06-18, Alex Kontos, Blog, Waterfox
- [Mozilla Foundation Security Advisory 2019-18](https://www.mozilla.org/en-US/security/advisories/mfsa2019-18/?ref=ctrl.blog), 2019-06-18, Mozilla
### I created my own web analytics system from scratch
URL: https://www.ctrl.blog/entry/ctrl-analytics/
Last updated: 2026-08-23T22:04:21.000Z
I mentioned [in passing](https://www.ctrl.blog/entry/firefox-blocks-tracking-ads/) a few weeks back that I’ve removed Google Analytics from Ctrl blog, and that I’d built a replacement web analytics collection and analysis system from scratch. Here are some more details on that endeavor.

I’ve never been comfortable handing information about my visitors over to Google, or been happy about the performance impact, and unsatisfied with how it doesn’t properly track how much time visitors spend on pages. (A key metric in my book.)

The General Data Protection Regulation (GDPR) have re-invigorated the open-source web analytics scene as sharing visitor data with Google suddenly had taken on a higher risk. Taking ownership over data collection practices and not sharing anything with third-parties is less risky under the GDPR.

Analyzing web server logs to discern traffic patterns is entirely pointless on the modern web and [not without GDPR risk](https://www.ctrl.blog/entry/gdpr-web-server-logs/). You can’t gleam any useful information anymore between all the noise and bots pretending to be web browsers, and browser pre-loading pages and resources that no human ever sees. You need to collect data with JavaScript in the browser; there simply isn’t a way around that.

I’ve watched and even contributed to a couple of new open-source analytics platforms before I decided to build my own analytics collection system instead.

I realized that I wanted to focus on different trade-offs and collecting slightly different (and less) data than Google Analytics and even the new open-source alternatives. Rather than focusing on “visits” I wanted to focus on getting more accurate time-on-page information. The trouble with this approach is that you’ve to wait until the visitor is done with the page to record the time spent on that page.

To track time-on-page in the browser it was important to find a reliable way to submit data as visitors navigate away from pages (without hurting their perceived performance). I discussed the collection method and page life-cycle event handling in detail when outlining [iOS and Safari’s Beacon API problems](https://www.ctrl.blog/entry/safari-beacon-issues/).

The approach I took to capture the time spent on page was to record the `document.visibilityState` (`hidden` or `visible`) when the document is loaded, and listen for the `visibilitychange` event to track the time that the document is visible on screen. Other approaches, like tracking scroll-depth or counting a stream of heart-beats would negatively impact user performance. Analytics isn’t important to them so I better not get in the way of their experience serving my own need.

I added a ten second minimum time requirement to effectively filter out bots, accidentally opened page, unwanted restored-session-tabs, quickly reopening a page while going through their history, and other insignificant data points. Someone opening a page from Ctrl blog in a background tab and then closing it without ever opening it isn’t something I care to track.

My new system records about 11 % more visitors than Google Analytics ever did despite the filtering, the [trouble recording visits from old versions of Safari](https://www.ctrl.blog/entry/safari-beacon-issues/), and another [bug](https://github.com/hackademix/noscript/issues/88?ref=ctrl.blog) with the [NoScript](https://noscript.net/?ref=ctrl.blog) extension—bundled by default with the Tor Browser—which causes it to block the Beacon API regardless of a domain’s JavaScript execution permission.

This difference is probably caused by Google Analytics being blocked by so many visitors due to the recent awareness and privacy-backlash against tech companies and especially third-party web analytics services. I’ve been saying for years that [first-party analytics is fine](https://www.ctrl.blog/entry/web-analytics-privacy/); the trouble is with third-party analytics that can track you across the web.

In addition to collecting the current page address and time-on-page, I also collect the User-Agent string and the page referrer. (Most websites won’t need to collect the User-Agent, but I’ve got a way higher than normal interest in web browsers and User-Agents in particular.)

I’m only storing IP addresses for less than an hour for rate-limiting purposes, and no other personal data is retained or combined with other data. I make sure to minify and even delete some unique data such as User-Agents and referring addresses submitted by very few visitors.

There’s no persistent cookies involved anywhere in the process. I may change this in the future to record retention rates (e.g. how many days, if any, since the last site visit), but without associating people with a unique identifier.

All in all it took way less time developing this than I’d estimated and I’m happy with the results. I’d encourage anyone considering implementing Google Analytics on their website consider what data they need to collect, and then evaluate whether they could quickly write up their own private data collection system.

At some indeterminate time in the future, I’ll consider making the system more fit for other uses and releasing it as an open-source project. I’d need to spend more time on making presentable reports out of the collected data first. My current dashboard works for me but I don’t expect anyone else would understand it at all.
### Progressive JPEGs make a meaningful impact on perceived performance
URL: https://www.ctrl.blog/entry/jpeg-progressive-loading/
Last updated: 2026-08-23T22:12:25.000Z
The JPEG image file format, one of the most common image formats on the web, can be encoded with one of two decoding profiles: baseline (sequential details) and progressive (additive details.) The latter variant offers many advantages on the web over the former variant; especially for website visitors with low-bandwidth or high-latency.

Baseline JPEGs load top-to bottom at full detail. This requires you to have downloaded the entire image before you get to see it. Progressive JPEGs also download top-to-bottom but is decoded in multiple passes adding more details in each pass. You can see what the image is all about in a low resolution with details being added as they’re loaded.

The two image sequences below try to demonstrate the differences in the loading sequences (left-to-right) between the two profiles.

![](https://cdn.synaps.media/control/content/images/2026/08/coffee-jpeg-baseline-loading.png)

Baseline decoding

![](https://cdn.synaps.media/control/content/images/2026/08/coffee-jpeg-progressive-loading.png)

Progressive decoding

You can see this in action in your web browser with Pooya Karimian’s excellent [baseline vs. progressive JPEG loading simulator](http://pooyak.com/p/progjpeg/?ref=ctrl.blog). Their server is configured for slow delivery over the network to emulate poor network conditions.

With progressive JPEGs, you get a chance to see what the image is about much earlier and can either wait for it to fully load, or more likely just move on with your day without feeling like you’re missing out on anything. Whether the image is a funny meme, an article illustration, or if it turns out the blank area you were waiting for to load only contained an advertisement.

Progressive JPEGs make a meaningful impact on your website visitors’ performance experience. Far from everyone have access to or can afford a high-speed low-latency internet connection. Keep in mind that there are now more people around the world than ever before that are using slow internet connections.

Progressive images create a perceptibly faster and more responsive user experience for lower end devices and users on slow, high latency, or unstable connections. Decoding progressive JPEGs adds some additional strain on the CPU, an increase in memory consumption, and thus a minuscule reduction in device battery life compared to baseline images.

Research by Google suggests that “on average, decoding a progressive JPEG image is equivalent to decoding the baseline one 3 times.” However, you can reduce the impact of this by reducing the number of decoding passes encoded in the file creating “semi-progressive” JPEGs. I’ll get back to those later in the article.

There’s a lot of outdated information saying progressive JPEGs aren’t supported in Safari and Internet Explorer. However, progressive images has been supported since at least iOS 8 and Safari 8 (maybe even earlier), as well as Internet Explorer 9 and later. To clarify, “not supported” means the image wouldn’t be rendered until its fully loaded (so, blank-to-image instead of loading top-to-bottom baseline.

Other outdated information suggest that progressive images are larger than baseline images. This will vary by the image. However, in my experience with a set of 3500 images the size difference is negligible and progressive images tend to be \~50 bytes *smaller* than baseline images.

You can still apply image compression best practices, like [using the Guetzli JPEG encoder](https://www.ctrl.blog/entry/webp-vs-guetzli-zopfli.html), and *losslessy* rearrange the resulting image with an interlaced progressive data structure afterward.

The following example command uses `jpegtran` (part of `libjpeg-tools`; also known as `libjpeg-progs`) to losslessy rearrange an image for progressive loading. This is not a generational/lossy encoding.

```shell
jpegtran \
  -progressive \
  -out new_image.jpeg \
  original.jpeg
```

If you want to go one step further, you can tweak how JPEGs are encoded to reduce the negative effects progressive images has on processor and memory requirements. This is a more advanced topic, but Cloudinary’s article [“Progressive JPEGs and green Martians”](https://cloudinary.com/blog/progressive%5Fjpegs%5Fand%5Fgreen%5Fmartians?ref=ctrl.blog) explains how you can do tweak the encoding job so you’ll end up with semi-progressive JPEGs. These do fewer decoding passes but you still get the benefits of progressive decoding.

Please note that `jpegtran` can produce empty 0-byte images when working with grayscale JPEG files. Never overwrite your original image files and always verify that the operation succeeded.

Your favorite photo editor will most likely include options for baseline or progressive when exporting JPEGs. However, you’ll need to use dedicated tools like `jpegtran` to convert images losslessly.

Progressive images can do wonders for your website’s perceived performance. I put myself through hell for two days: living with a 64 kBit/s (single-channel EDGE) connection. It’s super obvious right away which websites have implemented progressive images and which use baseline images. The ones with baseline images will be the ones that will frustrate you and are slow to load!

So, what about progressive/interlaced PNGs then? Unfortunately, the file sizes for interlaced PNGs can be as much as 30–40 % larger compared to a non-interlaced variant. The image data just isn’t conveniently layered in the same way as JPEGs.

#### Sources

- [WebP Frequently Asked Questions](https://developers.google.com/speed/webp/faq?ref=ctrl.blog), 2019-02-11, WebP, Developer Portal, Google
- [Progressive JPEGs and green Martians](https://cloudinary.com/blog/progressive%5Fjpegs%5Fand%5Fgreen%5Fmartians?ref=ctrl.blog), 2016-10-27, Jon Sneyers, Blog, Cloudinary
### Safari’s Beacon API problems
URL: https://www.ctrl.blog/entry/safari-beacon-issues/
Last updated: 2026-08-23T22:21:33.000Z
The Beacon API is available in all current mainstream web browsers, and was introduced in Safari in version 11.11 (iOS 11.3 and MacOS 10.13.) However, Safari have had some trouble delivering on the promises of this web API; especially on iOS.

The Beacon API is a web platform standard that was designed to allow webpages to send some data in an asynchronous POST request without causing a performance penalty for the visitor. It’s being used for all sorts of things, but its main benefit over other network request methods is that it allows for queuing a submission as the visitor leaves the page or the page is being unloaded.

Many examples of the Beacon API execute it in a handler listening to either the `beforeunload` or `unload` events. These two events are fired as pages are being unloaded, and notably attaching event listeners to these events **causes webpages to be unloaded** when navigating away from them. This in turns means the pages can’t be cached and quickly restored when visitors move back and forth in their browser history or restore a previous browsing session.

These events are also unsupported in iOS Safari. These are standard events and part of the web platform, but WebKit has chosen not to emit them. Because these events don’t work on iOS Safari, people misunderstand what’s going on and assume that the Beacon API is to blame when they fail to queue a request in event handlers attached to these events. Safari on MacOS can use the `beforeunload` event but I’d discourage it because of its performance impact.

So, what is a web developer to do instead? Use the `pagehide` event instead. The event is issued when people navigate away from your page even when it’s not being unloaded and it doesn’t have the performance penalty of the other two events. Browser support is as good if not better than both the `beforeunload` and `unload` events.

While this event is supported in iOS Safari, you haven’t been able to make any network requests in an attached event handler in Safari version 11.1 up to and including 12.1\. The Beacon API was explicitly designed to allow the asynchronous queuing of network requests when navigating away from pages. This was fixed in Safari 12.2 (iOS 12.2 and MacOS 10.14.4.)

The four event candidates the web platform gives us (in order) are `beforeunload` and `unload` (when unloading), `pagehide`, and `visibilitychange`. The first two are unsupported on iOS, the third didn’t work until Safari 12.2, so what about the forth?

The Page Visibility API gives us a `visibilitychange` event after the `pagehide` event. However, neither MacOS Safari or iOS Safari fires this event when navigating away from a page. It’s only fired as intended when pages go in and out of view (minimizing, off-screen, etc.) Chromium has the same behavior, and only Firefox implements the full specification here.

Your only option is to use the `pagehide` event from Safari 12.2 and later, or to send your beacon earlier in the page lifecycle. This makes it difficult to track reading-depth and time-on-page, unfortunately. This is probably the event you want to use to capture page transitions in all browsers and on all platforms regardless.

Below is the obligatory implementation example (be sure to read on further, though!)

```javascript
function handle_pagehide() {
  navigator.sendBeacon(
    'https://example.net/beacon',
    {'demo': 'data'}
  )
}

window.addEventListener(
  'pagehide',
  handle_pagehide
);
```

There are also a couple of other bugs that might get you when working with the Beacon API in Safari on iOS devices.

Safari on iOS also can’t submit a beacon to an previously unvisited secure origin. A bug prevents it from validating HTTPS certificate chains for unknown origins. This issue was fixed in Safari 13 (iOS 13 and MacOS 10.15.) You can work around this issue by loading a resource from the beacon submission origin before you attempt to submit a beacon request to it.

The fun doesn’t end there. Safari on iOS will also fail to queue beacons for pages that quickly redirect to another location. This may be an anti-tracking feature (Anti-Bounce Tracking?) though it may just be an optimization that’s throwing web platform compatibility to the winds. MacOS Safari doesn’t exhibit the same behavior.

In summary: Safari on iOS 13 should work much better with the Beacon API assuming you use it correctly. There isn’t much to be done with older versions, unfortunately. Alternatives like an asynchronous `XmlHttpRequest` or `fetch` won’t work in these versions either. The future for the Beacon API on iOS 13+ is looking bright like a lighthouse beacon, though!

#### Sources

- [navigator.sendBeacon to previously-unvisited https domain always fails](https://bugs.webkit.org/show%5Fbug.cgi?id=193508&ref=ctrl.blog), issue #193508, 2019-04-25, WebKit Bugzilla, Apple
- [navigator.sendBeacon doesn’t work in pagehide callbacks](https://bugs.webkit.org/show%5Fbug.cgi?id=188329&ref=ctrl.blog), issue #188329, 2019-04-23, WebKit Bugzilla, Apple
- [Intelligent Tracking Prevention 2.0](https://webkit.org/blog/8311/intelligent-tracking-prevention-2-0/?ref=ctrl.blog), 2018-06-04, John Wilander, WebKit Blog, Apple
- [New WebKit Features in Safari 11.1](https://webkit.org/blog/8216/new-webkit-features-in-safari-11-1/?ref=ctrl.blog), 2018-04-12, Jon Davis, WebKit Blog, Apple
- [§6 Loading Webpages](https://www.w3.org/TR/2017/REC-html52-20171214/browsers.html?ref=ctrl.blog#unloading-documents), 2017-12-14, HTML 5.2, W3C Recommendation, World Wide Web Consortium (W3C)
- [Handling Events](https://developer.apple.com/library/archive/documentation/AppleApplications/Reference/SafariWebContent/HandlingEvents/HandlingEvents.html?ref=ctrl.blog#//apple%5Fref/doc/uid/TP40006511-SW1), 2016-12-12, Safari Web Content Guide, Apple Developer portal, Apple
- [Page Visibility incorrect for documents in the page cache](https://bugs.webkit.org/show%5Fbug.cgi?id=116769&ref=ctrl.blog), issue #116769, 2013-05-28, WebKit Bugzilla, Apple
### Choosing a monitor: 4 K, 1440 p, ultra wide, or what?
URL: https://www.ctrl.blog/entry/choosing-a-monitor/
Last updated: 2026-08-23T22:03:05.000Z
There’s an overwhelming number of variations of computer monitors on the market and an equal number of decisions and compromises. The options were less daunting six years ago but even then I can’t say I enjoyed picking out a monitor. Where do you even begin in 2019?

This isn’t going to be a review or a definitive guide to picking a monitor. It’s just my musings and thought process regarding what type of monitor would replace my trusty old 2013-model *Eizo Foris FS2333 58 cm (23″) monitor*. It has seen better days and I thought it was due for a replacement when it started taking longer and longer to turn on and half a dozen pixels had died.

My old monitor was marketed as a “gaming monitor” but essentially it was just one out of any number of 1080 p 16∶9 aspect ratio monitors with a spec sheet listing high marketing numbers. Other types of monitors were available but the prices were astronomical, and back then software support for higher resolution displays still left a lot to be desired.

The only thing I was absolutely sure about for picking a new monitor is that I wanted one that was the same height (28,8 cm) as my current monitor. I can’t push the monitor any farther back on my desk and I don’t want to change my posture and ergonomics all that much to allow for a taller monitor.

So, what are the new options?

My trusty AMD Radeon RX 480 graphics card is capable of outputting a 2160 p at 60 Hz signal so going for a higher resolution was definitively an option I wanted to considered. I’ve no idea what the performance would be like or what detail settings I could run games at even though the graphics card is *4 K capable*.

Ultra-high resolution 2160 p (“4 K”) monitors are gorgeous, but somewhat expensive and software support is a mixed bag. Many games and productivity programs will work just great but you always risk that the one program you need to use won’t scale properly. It’s hard to determine software compatibility without not already having a high-resolution monitor to test the software manually. These monitors cost about four times as much as regular high definition monitor.

You can also go for a slight display resolution bump from 1080 p to 1440 p. This yields 33 % more pixels on a 58 cm monitor like the one I got compared to a doubling with 4 K. Software compatibility here’s even worse as not all graphical user interface toolkits support decimal scaling options. These cost about twice that of a regular high definition monitor. Any increase in resolution is a net positive, though.

Another option that I found appealing is 21∶9 ultra wide monitors; which give you a 33 % wider screen compared to a regular 16∶9 wide screen display. A 21∶9 monitor at 73 cm (29″) is still as tall as my current monitor with the same pixel density. These monitors cost about 30 % more than a standard high definition monitor. This is an interesting option as I literally get more screen space without getting a taller display.

Some games choose to support ultra wide monitors by giving players a broader field of view. This sounds fantastic in games like Euro Truck Simulator 2 and Cities Skylines. However, some quite a number of games — especially competitive shooters —will letterbox the screen to a standard 16∶9 aspect ratio to prevent you from having an unfair competitive advantage. If you play any games like this you may want to reconsider investing in 15 % more black bars on either side of your game.

There’s also a few 4 K ultra wide monitors available, but these get quite expensive. My graphics card can’t power one of these so I’d need to invest in a new graphics card as well as a new monitor.

Then there are the 32∶9 super ultra wide monitors. These are like having two 21∶9 monitors strapped together but without no bezel in the middle. I can barely fit one on my desk by getting rid of everything including my speakers. This displays is just too big for me.

The productivity benefits to having a wider monitor is questionable. A very limited number of software will be able to make excellent use of the extra horizontal space. However, the temptation to open multiple things side by side and live in a perpetual state of distraction may be overwhelming if you mainly rely on software designed for narrower displays.

I’m also a bit worried about the ergonomics of having a wider display. I don’t think they’d be much of a problem for gaming, as you’d mostly focus on the middle and get a wider field of view. However, for productivity tasks you’ll risk sitting at with your head at sub-optimal angles for prolonged periods of time.

You can go crazy by reviewing and comparing technical details like the display’s [panel type](https://www.ctrl.blog/entry/va-qled-text-rendering/), refresh rates, peak brightens, and what have you. For me, those sort of technical details about hardware gets overwhelming after a few minutes. There are just so many marketing numbers to compare and I’ve no idea what they mean or correspond do in real life. Ultimately, you just need to pick something that seems decent in a price range you can afford.
### Compressed favicons are 70% smaller but 75% are served uncompressed
URL: https://www.ctrl.blog/entry/favicon-compression/
Last updated: 2026-08-23T22:06:06.000Z
Conventional wisdom for performance optimization says that you should only enable HTTP content negotiated compression for plain text data formats and leave it off for binary data formats. Many binary image formats natively support compression so there would be little gained from compression them again. However, there are a number of exceptions to this rule and one of them is the ubiquitous `favicon.ico` file.

A few weeks ago I wrote about [image metadata](https://www.ctrl.blog/entry/embedded-image-metadata/) in the Extensible Metadata Platform (XMP) format and mentioned that images with XMP metadata can benefit from enabling HTTP negotiated compression. That one was a bit of a niche optimization for sure, so let’s look at a scenario so common that it affects just about every website out there.

The ICO file format, which folks may recognize from the standard `/favicon.ico` file found on pretty much every website (statistically speaking), can contain multiple size and color representation of an icon. You can enable compression for each of these representations in the file individually but software support is lacking.

You’ll also get a much better compression ratio when compressing the entire file as the different size representations may have a lot of data in common. The standard HTTP content negotiation mechanism is perfectly suited to handle compression for favicons as they’re being delivered over the pipes.

For example, [Ctrl blog’s favicon.ico file](https://www.ctrl.blog/favicon.ico) contains the same icon at four different resolutions and totals 32 KiB uncompressed, 2,8 KiB with Gzip compression, and 2,4 KiB with Brotli compression. That’s a whooping 92,5 % reduction in file size and 90 % reduction in IP packets with Brotli compression!

The HTTP Archive dataset of favicons from 4 million websites crawled from desktop devices on May 2019 shows that **73,5 % of all favicons are offered without any compression** with an average file size of 10,5 KiB, 21,5 % are offered with Gzip compression at an average file size of 4 KiB, and 5 % offer Brotli compression at an average file size of 3 KiB.

Compressing your favicons is an optimization well worth making considering that it benefits practically every visitor to your website.

You can enable favicon compression in the Apache HTTP Server by including the two common media types used for favicons in the `BROTLI_COMPRESS` (when supported) and `DEFLATE` output buffer chains. Locate and adjust these filter chains in your configuration files and include the two media types as indicated below:

```apacheconf
AddOutputFilterByType BROTLI_COMPRESS \
image/vnd.microsoft.icon image/x-icon

AddOutputFilterByType DEFLATE\
image/vnd.microsoft.icon image/x-icon
```

Here is the same configuration again for the Nginx web server; optionally with the Brotli module installed:

```nginx
brotli_types image/x-icon
  image/vnd.microsoft.icon;

gzip_types image/x-icon
  image/vnd.microsoft.icon;
```

Make sure that you don’t overwrite your existing compression media type variables. You should just add the favicon media types in these sections of your server configuration file

I started looking into this after I learned that BunnyCDN, my content delivery network (CDN) provider, were stripping away the optimizations I’ve done on the origin server and only deliver the uncompressed and bloated version of the favicon. They’ve begun compressing favicons properly after I contacted them about the issue.

However, their compression rates are still worse than what my origin server produces for both Brotli and Gzip variants. (I pre-compress using the Zopfli encoder instead of zlib.)

You should also verify that any caching layers between you and your visitors are HTTP standard compliant and don’t try to undo your optimizations.

### Bonus content

66,82 % of favicons use the media type `image/x-icon` with `image/vnd.microsoft.icon` making up the rest. The latter is technically correct according to IANA, but the inventor of the file format — Microsoft — never submitted or ratified that media type. (The history here’s a bit complicated.) Which of the two media types you use makes no difference whatsoever to modern web browsers and other favicon consuming programs.

#### Sources

- [HTTP Archive Public Dataset](https://httparchive.org/?ref=ctrl.blog), 2019-05, Internet Archive
### How to disable outgoing mDNS broadcasts on Linux
URL: https://www.ctrl.blog/entry/how-to-disable-mdns-linux/
Last updated: 2026-08-23T22:09:38.000Z
Multicast DNS (mDNS) is a convenient method for auto-discovering other computers and services (DNS-SD) on the local network. However, in some situations you don’t want to announce your services or even broadcast your presence on a particular network. Here is how to block outgoing mDNS broadcasts on Linux.

In shared hosting environments, on some enterprise or university networks, and on unknown or unfriendly networks you may want to be a good \[silent\] network neighbor or just remain hidden.

You’ll, of course, want to start by disabling Avahi and other mDNS clients. However, individual programs may also send mDNS and DNS-SD broadcasts. You either need to disable mDNS support in these programs, if they’ve an option for it, or block outgoing mDNS broadcasts in your firewall. This article will focus on the latter option.

mDNS broadcasts to port 5353 over UDP. Silencing it’s as easy as blocking that one specific port. The rest of the article will cover how to block outgoing mDNS with the default firewalls on CentOS, Fedora Linux, and Ubuntu.

Ubuntu uses the Uncomplicated Firewall (UFW) by default. Assuming you’ve already configured your UFW firewall, the following command adds a rule to block outgoing mDNS broadcasts from:

```shell
ufw deny out 5353/udp comment "drop outgoing mDNS"
```

Note that we’re using a deny rule instead of a drop rule. You often want to use a drop rule to hide the fact that anything took action to block a connection. However, you don’t need to worry about this as this all happens on your local computer and no information leaks out of the system. Local services that rely on mDNS will be able to provide better feedback when they know their packets were blocked instead of having them silently dropped.

CentOS and Fedora Linux uses FirewallD by default. Assuming you’ve already configured your FirewallD firewall, the following commands adds a rule to block outgoing mDNS broadcasts:

```shell
firewall-cmd --permanent --direct --add-rule ipv6 filter OUTPUT 0 -p udp --dport=5353 -j DROP
firewall-cmd --permanent --direct --add-rule ipv4 filter OUTPUT 0 -p udp --dport=5353 -j DROP
firewall-cmd --reload
```

Remember to verify that your firewall rules do what you expect by inspecting the firewall logs and monitoring network traffic.

I’ve [compared UFW and FirewallD’s command management syntaxes](https://www.ctrl.blog/entry/ufw-vs-firewalld/) before. After writing this article I think my next article will cover [how to migrate from FirewallD to UFW](https://www.ctrl.blog/entry/firewalld-ufw-migration-tutorial/). FirewallD is flexible and works well for many situations, but UFW’s simpler syntax still manages to get more jobs done with way easier to remember commands.

#### Sources

- [firewall-cmd man](https://firewalld.org/documentation/man-pages/firewall-cmd?ref=ctrl.blog), 2019-05-17, Documentation, FirewallD
- [ufw man](https://web.archive.org/web/20180504012806/https://manpages.ubuntu.com/manpages/bionic/en/man8/ufw.8.html), 2018-04, Ubuntu man pages, Canonical
- [RFC 6762: Multicast DNS](https://www.rfc-editor.org/rfc/rfc6762.html?ref=ctrl.blog), 2013-02, IETF
### My thoughts on Firefox blocking tracking/ad cookies by default
URL: https://www.ctrl.blog/entry/firefox-blocks-tracking-ads/
Last updated: 2026-08-23T22:06:41.000Z
Firefox 67 was released earlier this week and it came with an invisible but significant change. Firefox users, or 10 % of the worldwide desktop web market share, just had their default browser settings changed to block cross-site tracking cookies by default.

So, what does this change mean? This doesn’t mean that Firefox have started to outright block web advertising; Mozilla rejected that idea in 2018 after realizing small creators and websites were entirely dependent on ads for income.

Firefox is blocking cookies and other methods for persistently storing a unique identifier in the browser from a list of domains known to track users. This means tracking services like Google Analytics and Facebook Pixel will still be able to see where you go on the web and what you do. However, they can’t associate that data with a persistent identifier in the browser; which in turn can be linked to your Google or Facebook accounts.

Google Analytics is everywhere including on Mozilla’s own websites! You’ll see notices about Firefox blocking cookies from Google Analytics if you pull up Firefox’s developer tools while visiting just about any Mozilla web property. Google Analytics tracking codes are [even injected into copies of Firefox](https://www.ctrl.blog/entry/software-downloads-uids/) you download from the Mozilla website.

Publishers relying on Google Analytics probably won’t notice many changes. The number of unique visitors and the visitor-retention tracking (days between a unique visitor’s visits) will probably stop working, but other than that things will remain mostly the same.

I’ve been using Google Analytics with data retention settings as low as they can go and privacy settings as high as they could go. Completely coincidentally, I’d [pulled the Analytics script from Ctrl blog](https://www.ctrl.blog/entry/ctrl-analytics/) just a few hours before Firefox 67 was released. I’ve never been happy handing data about my visitors over to Google.

Lately, I’ve also realized that I could build my privacy-by-default analytics platform that won’t store any personal data that had a lower impact on page performance than Google Analytics. My replacement system even handles key metrics like time-on-page *better* than Google. I’ll write more about my Google Analytics replacement in the future.

So, what about the ads — like the one unironically placed above this paragraph? (Is this considered breaking the fourth wall?) I disagree somewhat with Mozilla’s strategy of blocking ad network cookies completely.

I believe a better solution would be to limit their lifetime to something like three hours. This would have enabled the ad networks to still use them for some very time-limited tracking while also letting them still use cookies to detect click-fraud and abuse.

Really-short-lived cookies would still have enabled use-cases like remarketing (ads for products and from pages you’ve previously visited). Remarketing is often applied with the wrong targeting parameters and the campaigns last way too long.

Shorter lived cycles would have driven up the ad prices which would mean publishers would get better compensation, and advertisers would have to make sure they’ve gotten their campaign settings right to avoid wasting money. It would also have limited [their ability to stalk you for months](https://www.ctrl.blog/entry/aggressive-remarketing/) on end.

Mozilla instead chose to outright block all ad cookies from a list of known tracking companies. You may think that all the ad and tracking companies would have to do to get around it is to change to another domain. The problem is, of course, that these companies don’t control the third-party websites where their ads and tracking codes are installed.

Migrating to another domain would take a very long time and far from every publisher would be willing or able to put in the time and effort required to change the domain every time the new one got blocked by Mozilla.

I was happy last year when the Google AdSense, Google’s advertising platform for small publishers, gave publishers [the choice to opt-out of behavioral ads](https://www.ctrl.blog/entry/adsense-gdpr-consent/) in favor of less intrusive page-contextual ads last year. Google began offering publishers to use contextual ads as a way for publishers to stay compliant with the strict privacy requirements of the General Data Protection Regulation (EU GDPR).

I don’t like the idea of ad companies building profiles on everyone and carefully trying to manipulate each and every one of us. The original advantage AdSense had over its competitors when it launched was its ability to deliver page-contextual ads.

Contextual ads served publishers well ten years ago and I know of no reasons why the web shouldn’t revert from ads targeted at behavioral traits derived from tracking people to contextual ads matched by analyzing the webpage the ad is displayed on.

The ads you see on most pages here on Ctrl blog will be for enterprise grade tech solutions, as most of my articles lean towards programming and applicable-in-the-enterprise technology. Unfortunately, there are also a huge number of ads for headwear and windows.

I frequently write about [Fedora Linux](https://www.ctrl.blog/tag/fedora-linux/) and [Microsoft Windows](https://www.ctrl.blog/tag/microsoft-windows/) and either Google or the advertisers don’t care to tell the difference between the operating system, and headwear and architectural features.

I suspect that at least the enterprisy ads may have a higher return than behaviorally targeted ads as all enterprise stuff is ridiculously overpriced and difficult to sell. I don’t know for sure, however, as Google don’t provide any transparency into these things for publishers.

The change also affects “coincidental-tracking” as advertising networks like Google AdSense, and “widget” providers like Facebook Comments Plugin and Disqus, embedded YouTube videos, and AddThis’ social sharing links. I’ve been [against embedded widgets](https://www.ctrl.blog/entry/stop-embedding/) for years because of their hidden privacy costs. I’ve always kept their use to an absolute minimum.

In summary I believe the web will be just fine with third-parties no longer having access to the cookie jar’s of Firefox users. Some websites, especially those producing content of little interest to advertisers, will see some decline in ad revenue. Some advertisers may be a bit confused for a while as to why their behavioral advertising campaigns suddenly got 10 % more expensive as the target audience reachable with behavioral ads just shrank by 10 %.

In the long run, however, this is probably good for publishers and the web as a whole. This will hopefully drive up ad prices and the overall quality of the ads you see on the web in the process. Eyeballs on the web just got a little more expensive to reach, and low quality ads and advertisers with deceptive or low-margins-scam campaigns relying on ads being low-cost will be pushed out in favor of more serious actors.

Disclaimer: Ctrl blog is a Google AdSense publisher and benefit financially from rising ad prices. That should have been made fairly clear from the article itself but I’m repeating it here. The author is also a citizen of the internet, and as such cares about online privacy as well as the user experience and sustainability of the web platform.

#### Sources

- [When it comes to privacy, default settings matter!](https://blog.mozilla.org/en/products/firefox/when-it-comes-to-privacy-default-settings-matter/?ref=ctrl.blog), 2019-06-04, Peter Dolanjski, Blog, Mozilla
- [Firefox Now Available with Enhanced Tracking Protection by Default](https://blog.mozilla.org/en/products/firefox/firefox-now-available-with-enhanced-tracking-protection-by-default/?ref=ctrl.blog), 2019-06-04, Dave Camp, Blog, Mozilla
- [Desktop Browser Market Share Worldwide](https://gs.statcounter.com/browser-market-share/desktop/worldwide/?ref=ctrl.blog#monthly-201806-201905), 2019-06, Global Stats, StatCounter
### Many feed readers don’t handle plain text with XML-entities correctly
URL: https://www.ctrl.blog/entry/xml-title-xml-entity-html/
Last updated: 2026-08-23T22:26:08.000Z
The headline for my recent article titled [*URLs don’t belong in <meta> elements*](https://www.ctrl.blog/entry/html-link-metadata/) didn’t fare too well in syndication in feed readers and on other platforms. So, what went wrong with this particular headline?

Let’s start with a quick look at how this particular entry appeared in Ctrl blog’s [Atom syndication feed](https://feed.ctrl.blog/latest.atom?ref=ctrl.blog):

```
<title type="text">
  URLs don’t belong in &lt;meta&gt; elements
</title>
```

The `type="text"` attribute is a bit redundant as its the default text mode in Atom. A second text mode, `type="html"`, is also available but then the attribute has to be set expressly. I’ve decided to expressly include the `type` attribute with the default value to give a signal to feed parsers that the content is plain XML-entity encoded text and not HTML.

However, it would seem that a number of popular feed readers have never read RFC 4287 Atom Syndication Format and don’t know how to parse Atom feeds properly. There’s even an example of this in RFC 4287 clarifying how it’s supposed to be handled.

The following popular feed readers/feed-based services screwed up the headline and displayed it as “URLs don’t belong in elements” (note that “`<meta>`” is missing) in their user interfaces:

- Apple News
- Google News
- Feedly (web)
- Flipboard (apps)
- Newsblur
- The Old Reader
- Aggregator
- NetNewsWire
- Vienna
- Pushbullet

You may recognize some of the above names if you’ve ever seen a list of the most popular feed readers on the market.

**Update** (2019-06-08): Aggregator and NetNewsWire have fixed this problem in response to this article.

Zapier, the feed-to-Twitter gateway that tweets for me, and my custom [feed to email newsletter delivery system](https://www.ctrl.blog/entry/email-newsletter/) also had problems with this title.

So, what did I and all these feed readers get wrong about this title?

I can break down pretty exactly where my own and all these other feed parsers went wrong. To get a plain-text string from an HTML encoded string delivered in an Atom feed you’d first need to XML-entity decode the string and then strip away the resulting HTML tags. The following demonstrate this process using PHP:

```
strip_tags (
  html_entity_decode (
    $feed->$entry->$title
  )
)
```

The problem is, of course, that you can’t process a plain XML-entity encoded text string with the same method. What happens is that you’d turn a string containing an XML-entity encoded HTML tag (e.g. a tag you want to display as-is rather than having it interpreted as HTML) into HTML and then in the next step you’d strip out that HTML which wasn’t ever intended to be handled as HTML.

A few of these feed readers may have skipped the tag-stripping step and included the `<meta>` element as-is. This element isn’t displayed by default so it would be hidden in the title. I didn’t find any traces of this element in any of the readers that I could inspect, but it’s a distinct possibility.

So, what did we all learn here? Feed readers need to put `<title [type="text"]/>` and `<title type="html"/>` through separate processes if you want to get a text representation. The Atom specification is over a decade old but many feed readers assume HTML is the default text parsing mode instead of text (or they simply don’t support the default mode.

The following feed readers handled the headline correctly:

- Flipboard (web)
- Inoreader
- Liferea
- Akregator

A round of applause for the spec compliant feed readers, everyone! 👏

—and yes, I was aware of this issue before I published the affected article. However, I didn’t expect that it would affect my newsletter or Twitter integration.

#### Sources

- [RFC 4287: The Atom Syndication Format](https://www.rfc-editor.org/rfc/rfc4287.html?ref=ctrl.blog), 2015-12, Mark Nottingham, Network Working Group, IETF
### How to fix MacOS “update package has been deleted” errors
URL: https://www.ctrl.blog/entry/macos-software-update-package-deleted/
Last updated: 2026-08-25T21:09:13.000Z
> “The update package has been deleted since being downloaded from the Apple Software Update server.  
> An error occurred while installing the selected updates.”

The above error *may* indicate that there was something wrong with the update and that Apple has indeed pulled it from its update distribution servers. However, if you’re persistently or frequently seeing this error message when downloading updates then its not necessarily the *Apple Software Update server* that’s having issues but a content caching server somewhere on your network!

The above error is shown when MacOS is using an Apple Content Caching service that has either run out of storage space, or has been configured with insufficient storage capacity to cache the entire updates.

The Apple Content Caching service can be very useful when there are multiple Apple devices or users on your local network. It can speed up the updates and reduce the amount of bandwidth that’s spent on downloading updates for the devices on the network.

All Apple devices on the network will automatically detect the content cache and fetch app and operating system updates from the cache over the local network instead of getting it over the internet. The content caching service also works with other Apple services such as iCloud.

You may have enabled the caching service on your Mac. In an enterprise or university setting, the caching service may be running on a dedicated server to help optimize the local network bandwidth. It may also be running on another Mac belonging to another family member or a colleague. Ask your local network system administrator or other people on the same network if you’re unsure where the service is running.

To fix this issue you either need to free up storage space on the device running the content caching service, disable the content caching service entirely, or increase the content caching service’s storage allocation.

You can disable the content caching service by going to *System Preferences: Sharing*, and unchecking the *Content caching* option. You’ll need to restart your Mac after disabling it or you’ll run into issues like this when downloading apps, updates , or when using iCloud:

![](https://cdn.synaps.media/control/content/images/2026/08/macos-software-update-service-unavailable-1.png)

“Service unavailable. An error occurred while installing the selected updates.”

You can alternatively increase the content caching service’s storage allocation by going to *System Preferences: Sharing: Content caching: Options*, and moving the slider to a higher number. You don’t need to restart your Mac for this change to take effect but it can take a couple of seconds before the change is applied.

Exactly how much storage space you need depend to set on the number of different Apple devices and users there are on the network, the and how much each of them use the App Store, iCloud, iBooks, and other Apple services. Big version updates of MacOS and iOS will require at least 8 GB each but I recommend you set it to at leas 20 GB to give the service plenty of room to work with.

You can now return to *System Preferences: Updates* and try to install the failing update again. Press Command+R to make MacOS refresh the list of available updates if you no longer see the update. If the update no longer appears, it may have been removed by Apple.

#### Sources

- [Manage content caching on Mac](https://support.apple.com/guide/mac-help/manage-content-caching-on-mac-mchl3b6c3720/mac/10.14?ref=ctrl.blog), 2018, MacOS User Guide, Support, Apple
- [About content caching on Mac](https://support.apple.com/guide/mac-help/about-content-caching-on-mac-mchl9388ba1b/mac/10.14?ref=ctrl.blog), 2018, MacOS User Guide, Support, Apple
### URLs don’t belong in <meta> elements
URL: https://www.ctrl.blog/entry/html-link-metadata/
Last updated: 2026-08-23T22:11:26.000Z
There’s more than one HTML element designed to hold metadata. *Any* HTML element can hold metadata with HTML+RDFa, but for the context of this article I’ll focus on the HTML-standard `<link>` element. It’s used to build link relations between documents and resources.

You’ll benefit from having read “[Why are Facebook and Twitter so bad at parsing RDFa metadata?](https://www.ctrl.blog/entry/rdfa-socialmedia-metadata/)” for context before reading this article. However, it’s not a requirement to get something out of this one.

I’d like to set the stage and introduce this topic with a quick recent-history lesson before I get into the difference between `<meta>` and `<link>` elements and why URLs don’t belong in the former.

It was decided in the early days of the social web that sharing plain dull looking URLs wasn’t the most enticing customer experience. Good metadata would be key to deliver a better customer experience with detailed and image-rich previews of externally linked webpages. Existing metadata schemas had failed to see much adoption as there hadn’t been many immediate benefits to properly labeling webpages until that time.

“This wasn’t invented here!” said the engineers of Facebook, Twitter, VK, Weibo, and other companies upon seeing existing metadata schemas like the Dublin Core Schema or even Microformats. Instead of urging for the adoption of one of the existing metadata schemas, they all reinvented the wheel and introduced Open Graph Protocol by Facebook, Twitter Card, VK for Publications, Weibo Meta Tags, and similar proprietary metadata schemas. They then asked web publishers to implement and include all of these mostly overlapping in their webpages.

Web publishers were on board with the new schemas as it meant they’d get higher click-through rates from the rapidly growing social media platforms. Half a decade later we’ve seen some consolidation behind Facebook’s Open Graph Protocol as Twitter Cards and Weibo Meta Tags finally saw the benefits of using a single metadata schema instead of insisting on everyone else adopting their pages to suit the platforms.

What all of these companies got wrong independently was their URL data type, used for properties like “url” and “image” to reference the canonical location of the current URL and the location of a representative image. All of these schemas expressly stated that these should be given as string literals instead of URLs.

As an example, here’s the canonical page URL expressed using Open Graph Protocol:

```
<meta property="og:url" content="https://example.com/">
```

This seems simple enough and is often seen along with other tags like `og:title` and `og:description`. However, all the major search engines had agreed to use link-rel canonical to represent the exact same concept 14 months before Facebook’s introduction of the Open Graph Protocol.

Webpages now had to express their canonical URLs in two different ways:

```
<meta property="og:url" content="https://example.com/">
<link rel="canonical" href="https://example.com/">
```

So, what’s the difference between these two objects (other than the vocabulary used to label them?) It comes down to data types: the `<meta>` element is just a string literal whereas the `<link>` is a link. A link is aware of the base URL and any base URL overrides like the `<base>` element, handles relative paths, and normalizes the link. A string is literally just a string.

The following two blocks of JavaScript demonstrates URL processing of a `<link>` element compared to a `<meta>` element:

```
// <link rel="og:url" href="…">
document.querySelector(
  'link[rel~="og:url"][href]'
).href

// <meta property="og:url" content="…">
new URL(
  document.querySelector(
    'meta[property~="og:url"][content]'
  ).content,
  document.querySelector(
    'base[href]'
  ).href || window.location
).toString()
```

You’ll notice the need to expressly convert the string returned from the `<meta>` element to a URL object, manually specifying the base URL from the `<base>` element or by falling back to the current `<window.location>`, and then back to a string from simply reading the `<link>` element’s `href` attribute.

It’s not just a semantic difference as its clearly better to get link type data from an element that natively understands the data type. The semantic difference between these two data types also becomes clear when parsing the document for Linked Data or as an HTML+RDFa document.

You also need to have perfect preexisting knowledge about the data in the element to know that you’re expecting to get from an URL from this one specific `<meta>` element; compared to having the language level assurance of always getting a URL from the `<link>` element.

The following example demonstrates combining the two separate elements discussed in this article into one element with as an HTML native link. This is useful if you want to minimize the elements needed to express identical metadata labels or you want to minimize the document size.

```
<link rel="canonical og:url" href="https://example.com/">
```

Unfortunately, the above example isn’t supported by either Facebook or Twitter who seem to [use regex-parsing instead of RDFa parsing](https://www.ctrl.blog/entry/rdfa-socialmedia-metadata/) despite both pushing a HTML+RDFa vocabulary standard. The above example is supported by the Bing and Google Search who parses RDFa as RDFa.

The point of this article was to argue for using `<link>` elements to express URLs. I can’t recommend that anyone change their Open Graph implementations to use them instead of `<meta>` elements as that would probably cost you any benefit from including it in your documents. (Again due to the social platforms incredibly poor document parsers.) However, I’m hoping to have convinced you to not design your metadata schemas or parser to be as stupid as Facebook’s.

#### Sources

- [Document metadata](https://www.w3.org/TR/2017/REC-html52-20171214/document-metadata.html?ref=ctrl.blog), 2017-12-14, HTML 5.2, Recommendation, World Wide Web Consortium (W3C)
- [Support for RDFa in HTML4 and HTML5](https://www.w3.org/TR/2015/REC-html-rdfa-20150317/?ref=ctrl.blog), 2015-03-17, HTML+RDFa 1.1, Recommendation, W3C
- [The Open Graph protocol: Understanding the design decisions](https://www.scribd.com/doc/30715288/The-Open-Graph-Protocol-Design-Decisions?ref=ctrl.blog), 2010-04-29, David Recordon, Facebook, Scribd
### How to archive a page or an entire website in the Internet Archive
URL: https://www.ctrl.blog/entry/how-to-internet-archive/
Last updated: 2026-08-23T22:10:18.000Z
The Internet Archive’s [Wayback Machine](https://web.archive.org/) is one of the web’s greatest free resources. The Internet Archive does it best to preserve our online history by archiving public webpages in their collection. You can find long-gone blog posts, old website designs from the late 90’s, retracted news stories, and all sorts of treasures in their collection.

Archiving *everything* is an impossible task. There are simply too many webpages being published on too many websites for any archiving service to keep up with it all. You can help the Internet Archive’s archival effort by submitting *webpages that are important to you* or maybe tweets, images, or webpages you’ve created and want to preserve.

You can archive a single page using the form on the [Wayback Machine’s front page](https://web.archive.org/).

Tools like the [Internet Archive plugin for WordPress](https://www.ctrl.blog/entry/wordpress-internet-archive-plugin.html) can automate the submissions of webpages that you create. There are similar tools available for other content management systems, and also plenty of web browser extensions available.

To archive an entire website you can either submit each URL one by one individually, or use a tool that can automate the submissions.

The best tool for automating larger submissions is Jacob Burenstam’s [wayback\_archiver](https://github.com/buren/wayback%5Farchiver?ref=ctrl.blog). It’s a Ruby library that comes with a command-line interface that’s easy to use. It can independently crawl a website and submit URLs for archival as it works it way through a website, or it can parse a XML sitemap file when one is available to skip the need for crawling.

Running the program in `--auto` mode tells it to auto-discover XML sitemaps from the standard `robots.txt`, or fallback to the much slower process of crawling the website to discover pages. It can take several hours, days, or even weeks to complete depending on size and speed of the website, and the number of pages being archived.

The following example command would submit every page on Ctrl blog to the Internet Archive:

```shell
wayback_archiver https://www.ctrl.blog/ --auto
```

You can also submit individual URLs using the `--url` option:

```shell
wayback_archiver https://www.ctrl.blog/entry/how-to-internet-archive.html --url
```

The Internet Archive offers no guarantees that the URLs you submit will be accepted into their collection. Aggressively submitting a lot of URLs from a single IP address in a very short amount of time may be flagged as suspicious.

You won’t be able to submit any pages from websites that have actively opted to block the Internet Archive from accessing their website.The Internet Archive is one of [the most frequently blocked bots on the web](https://www.ctrl.blog/entry/robots-discrimination/), as not everyone understands its purpose or sees its immense value to the web community.

Please consider making a [donation to the Internet Archive](https://archive.org/donate/) if you’re submitting a large collection of pages or just find their service as invaluable as I do. Please considering giving a monthly donation if you intend to submit URLs on an ongoing basis.
### How I archived 26 500 old Ask Fedora community Q&As
URL: https://www.ctrl.blog/entry/archiving-ask-fedora/
Last updated: 2026-08-23T22:01:59.000Z
Ask Fedora is the Fedora Linux community’s questions-and-answers portal, and it recently transitioned from a forum software called Askbot to Discourse. Changing the underlying forum software doesn’t have to be destructive but Ask Fedora decided to go with a *nuke-and-pave migration strategy*: They decided to start from scratch instead of copying user accounts and the user-contributed content to the new software.

The first time I learned of the migration was a few days after it had happened. I’d run into an issue with my Fedora installation and went online looking for solutions. Every useful search result was from the old Ask Fedora site and every link returned an HTTP 404 Not Found error message as those answers hadn’t been migrated to the new Ask Fedora website. None of the pages I were looking for where available in the Internet Archive either.

The Fedora Linux community have lost 26 500 questions and the community discussions surrounding those questions with Ask Fedora’s software migration. I don’t have any numbers for how many answers and comments each question had received, but I’d guesstimate an average of more than one answer per question. 25 000 of the questions where in English, 680 in Spanish, and the rest was split between Portuguese, Russian, and a couple of other languages.

Askbot had its issues, especially when it came to performance, and I’m sure there were plenty of good reasons to migrate to Discourse. That still doesn’t excuse not preserving all the work that people had put into answering questions on the old Ask Fedora platform over the years.

Ask Fedora is run and maintained by volunteers and it’s other volunteers still who had answered the questions posted by all the novice and experienced Fedora users who’ve needed some help over the years. Many top contributors on Askbot had amassed thousands of “internet points” and recognition on the old Askbot platform. I’m sure deleting all their hard work and asking them to start from scratch must have pushed at least some of them away from contributing on the new Ask Fedora website.

Whenever you upload or write anything on someone else’s platform, the faith of that work is left up to the operator of the platform. This shouldn’t come as a surprise to anyone — least of all me — but I’m still disappointed to see all the time, effort, and answers people had put into the site just vanish over night. As you might be able to tell, I’m not happy about seeing my 140 answers and 1400 karma points being discarded over night.

However, the old Ask Fedora website does still exist! There’s a read-only archived clone of it on askbot.fedoraproject.org. This doesn’t help much as you’ve to know that you’ve to manually, more on that later, go to that domain instead of ask.fedoraproject.org to find the questions and answers from the old site. The old domain will probably remain in search results for months to come and references to them will remain throughout the web and in people’s bookmarks forever.

The old Ask Fedora website explicitly licensed all user-submitted content under the permissive Creative Commons Attribution-ShareAlike 3.0 License. That licensing scheme allows for anyone to make copies of and distribute, and preserve every discussion on the platform in their entirety.

I jumped on the opportunity and submitted all 26 500 questions and answers from the old Ask Fedora website (using the askbot.fedoraproject.org domain) for archival in the Internet Archive’s [Wayback Machine](https://web.archive.org/). The whole process only took my computer a couple of hours and [the archival process is easy to set up](https://www.ctrl.blog/entry/how-to-internet-archive/).

You can access the [archived version in the Wayback Machine](https://web.archive.org/web/%2A/https://askbot.fedoraproject.org/%2A). Please note that retrieval can take a minute or two after the page has loaded, and you don’t get a lot of feedback while it’s loading.

I wish someone had done that *before* Askbot was moved to a new domain so that the old URLs could have been preserved. At least it should now be possible to dig up all the old questions and answers given that you know that they can be accessed from a new location. (Which is a big ask without any redirects.)

This archival trick isn’t going to work again in the future. Discourse pages are too dependent on JavaScript for the Internet Archive to properly archive their contents. Many other JavaScript-heavy websites manages to produce an HTML versions of their pages for bots and archiving but this have been a known-issue with Discourse for years. The new Ask Fedora portal also doesn’t explicitly license new user contributions under a permissive Creative Commons license.

I understand that migrating content from one platform to another can be difficult and time-consuming. However, [caring for the old URL design](https://www.ctrl.blog/entry/rewriting-urls-reorganizing/) and redirecting them to an off-site archive isn’t a huge task. I couldn’t find any URL collisions between the old and new URL designs, so setting up redirects should have been a trivial task.

Unfortunately, Ask Fedora isn’t hosted on Fedora’s own infrastructure and is instead hosted and operated by Discourse. They don’t offer good enough tools to forward the old URLs to either the archived version at askbot.fedoraproject.org or the Internet Archive’s copy. Losing the ability to deploy something as routine as a couple of redirects is a huge argument against outsourcing in my book.

#### Sources

- [Where have the old posts gone?](https://discussion.fedoraproject.org/t/what-happened-to-all-the-posts-from-the-old-askbot-based-ask-fedora-site-in-2019/69761?ref=ctrl.blog), 2019-05, community discussion, Ask Fedora
- [AskFedora refresh: we’ve moved to Discourse!](https://communityblog.fedoraproject.org/askfedora-refresh-weve-moved-to-discourse/?ref=ctrl.blog), 2019-03-21, Ankur Sinha, Fedora Community Blog
### BtrFS vs Ext4 performance on random-read/​write operations
URL: https://www.ctrl.blog/entry/btrfs-vs-ext4-performance/
Last updated: 2026-08-23T22:02:53.000Z
I’ve been using XFS as a very conservative file system choice for the last four years or so after being burned by BtrFS file system corruptions a couple of times in a row.

However, I’ve been working more with many small files lately to build this blog using a static website generator. Performance hasn’t been great and I’ve also found a need for recording file creation times, something which isn’t natively supported by XFS.

My hardware setup has consisted of two old fashioned spinning software mirrored 4 TB hard drives for my home directory. I’ve used these drives as a backing drive with a Samsung 960 EVO NVMe solid state drive as a LVM cache drive for performance.

I stopped using LVM cache disk a few months ago as I wanted to enable full-drive encryption and it also prevented my system from hibernating; a problem LVM caches share with BCache. I considered trying BCache anyway, but luckily decided against it just days before people started noticing drive corruptions with BCache on GCC 9 and Linux 5.

After a careful review, I decided to slim down my home directory and move over to the NVMe with an LUKS encrypted BtrFS file system. I’ve had bad experiences with this file system in the past, but surely something has happened in the last four years, right?

I decided to give it a fourth chance in the interest of getting a more modern file system. I’d to move a lot of files over to a separate drive, but cleaning up your home directory never hurt anyone (assuming you’ve proper backups.)

I saw bad transfer speeds when copying files from my old home directory residing on a hard disk drive over to BtrFS. The NVMe drive is theoretically capable of 1,28 GiB/s random writes under ideal conditions, but write-speeds were bottlenecked at around 30–45 MiB/s. These were quite underwhelming results.

After everything had been transferred over and setup I also noted lower than expected performance gains with my static website generator. Both of these workloads involve a lot of random file access and writes.

The Ext4 file system was my second choice of file system. I rebooted and repeated my tests on BtrFS a dozen times to get some performance metrics, and decided to reformat and repeat my testing on Ext4\. This time around the read-speeds from the old hard disk drive bottlenecked me at around 90–105 MiB/s, which was what I’d expected to see all along. This time around the performance gains with my static website generator were also more significant.

| Hardware      | SATA HDD | NVMe SSD |       |
| ------------- | -------- | -------- | ----- |
| File system   | XFS      | BtrFS    | Ext4  |
| nanoc compile | 89 s     | 78 s     | 37 s  |
| nanoc check   | 305 s    | 260 s    | 196 s |

The XFS on a SATA drive isn’t a fair direct comparison, but it serves as a reference for what performance was like before I decided to do something about it.

The static website generator needs to read file system metadata for 8200 files during compilation. Given the nature of this data, we can assume that these are mostly random reads. These numbers were gathered from six dry-runs with no changed files and therefore no writes. The 12,3 % reduction in compilation time with BtrFS is a nice improvement but pales compared to the 58,4 % reduction seen with Ext4 on the same hardware doing the same task.

The check task is involves reading roughly 2000 small files in their entirety and performing some processor intensive tasks on them. The checking task improved 14,6 % with BtrFS and 35,7 % with Ext4.

At this point both the compilation time and checking time is bottlenecked by my processor. Nanoc’s lead developer, Denis Defreyne, is currently [working on compiling in parallel](https://github.com/nanoc/nanoc/pull/1385?ref=ctrl.blog) to take on the processor bottleneck. I expect that these tasks should complete significantly faster once that’s done, but I suspect that I’d not seen all that much benefit if I’d stayed on my old hardware.

Okay, so what do the numbers in this article tell us? Obviously, it confirms that hardware with faster I/O is indeed faster. However, it also confirms the findings in [Phoronix’s Linux 5.0 file system performance benchmarks](https://www.phoronix.com/review/linux-50-filesystems/2?ref=ctrl.blog) for randoms and writes with a real-world workload instead of using a synthetic benchmark.

As a nice and unexpected bonus, the time it takes before Linux prompts me for my drive decryption password during boot-up have dropped from about 45-ish seconds to about 6 seconds.

#### Sources

- [Watch Out For BCache Corruption Issues On Linux 5.0 & GCC 9](https://www.phoronix.com/news/BCache-Corruption-Linux-5?ref=ctrl.blog), 2019-05-14, Michael Larabel, Phoronix
- [Linux 5.0 File-System Benchmarks: Btrfs vs. EXT4 vs. F2FS vs. XFS](https://www.phoronix.com/review/linux-50-filesystems/2?ref=ctrl.blog), 2019-01-07, Michael Larabel, Phoronix
- [Samsung NVMe SSD 960 EVO](https://semiconductor.samsung.com/consumer-storage/internal-ssd/960evo/?ref=ctrl.blog), 2018, Samsung
### Put your image metadata to use: embed it in your image files
URL: https://www.ctrl.blog/entry/embedded-image-metadata/
Last updated: 2026-08-23T22:05:50.000Z
Your content management system (CMS) probably already have a lot of metadata associated with your website’s images. Including information about the image’s creator, licensing and copyright notices, [when and where you obtained it and under which terms](https://www.ctrl.blog/entry/record-royaltyfree-photos/), titles, and image descriptions or “alt” texts, etc. Put this information to use for you inside your image files to protect your intellectual property rights and make the images more discoverable.

There’s often some information about an image when it’s embedded on a webpage, but it’s not so common to see the same information make it into the image files themselves. You’ll frequently see copyright notices and descriptions underneath an image on a webpage or find that an image has been embedded on a webpage along with an alternative textual representation of the image included for accessibility purposes.

Metadata that’s just displayed on a webpage along with the image or that’s locked away in an CMS is disassociated with the image file itself. Having it on a webpage or inside some database is of little help if you’re working on or looking for a copy of the file on your local computer, when it appears in a web search result, when a visitors “borrow” it from your website, or when you publish it on a [content-addressable distributed web alternative](https://www.ctrl.blog/entry/copyright-p2p-dweb/) like IPFS.

The solution is, of course, to embed the available metadata into the image file itself. In many cases this process can be automated by the content management system; allowing users to edit the metadata that goes into the file directly from their CMS.

There are a few different standards for embedding metadata information in image files, depending on the file format. The Extensible Metadata Platform (XMP) is probably the best candidate as its widely supported and there are a number of metadata editing libraries and programs that can work with it.

Image metadata have gotten a bad reputation on the web because people associate it with file bloat caused by poor handling/prioritization of metadata, issues with the metadata specifications, and inefficient metadata embedding clients. For example, the XMP Specification recommends including 2–4 kilobytes worth of space characters for “padding” at the end of the metadata section of the file. This recommendation gives metadata editors some extra flexibility but it also means everyone needs to download 2000+ bytes of literally nothing to view the image. Most web servers will not be configured to apply on-the-fly compression to binary files so this type of empty data and unnecessary use of white-space won’t be reduced by compression.

There are also a number of poorly documented compatibility pitfalls one needs to stay clear of when working with XMP metadata. XMP has to appear before the image data inside PNG files to work with Adobe and Apple software products, and images are limited to only use the “x-default” language code to be displayed properly within Windows File Explorer. Multilingual metadata support is well documented in the specification, but only seems to be supported in MacOS and other Apple products. 

Issues like this require attention and fairly deep knowledge of how exactly metadata is being embedded into images and the understanding to apply targeted optimization to remove it.

Almost all cameras, including mobile cameras, embed a lot of technical information about the state and settings of the camera with every image by default. This information can be useful to an image editor and possibly to a camera enthusiast. However, you should probably strip away almost all of this information when you’re publishing an image to the web. This information, with the possible exception of geolocation coordinates and the camera make and model, will probably never be useful to anyone and should probably be removed unless you’ve specific needs for it.

Human authored metadata on the other hand, like the one you can create within your content management system or photo editing software, is more useful to both people and to machines. This information can be extensive but the most useful labels you can apply to an image file are probably a title, a description of the image, creator credits, as well as copyright and licensing information for the image.

It’s much easier to prove that someone stole your image or violated your license terms when your name and the license terms are quite literally written into the stolen file.

Google Image Search will display the creator’s name, credit line, and copyright statement next to images based on the attribution information embedded in XMP information inside image files. This can help people make better choices (e.g. not steal your image) or get information on how to license the image from you.

Bing Image Search and Google Image Search both support filtering image search results based on the usage permissions granted with an associated Creative Commons license. It doesn’t yet appear like either search engines source licensing information directly from metadata embedded into the image files. However, Creative Commons have defined a namespace and vocabulary for embedding license terms and the attribution details required to comply with the terms of the license directly into image files as an XMP format extension. It’s well worth looking into if you’re licensing your images permissively with the well recognized Creative Commons licenses.

The File Explorer in Windows, Image Viewer and to some extent Finder in MacOS, and GNOME Files and GNOME Image Viewer on Linux, will all display an images embedded title, description, creator, and copyright notice to the user when they look at an image’s properties. Desktop search on all three operating systems also support indexing and searching for images by their XMP metadata. It can be very useful to be able to search for images on your computer by their title, description, and creator instead of being limited to their file names when you’re working with a static website generator, or otherwise handle many static image files.

So, if you’ve already have got rich image metadata laying about, be sure to put it to use for you and embed it into your image files. Including some rights statements and descriptions of your images shouldn’t add more than a kilobyte or three to the size of the image. Guetzli processing of JPEGs and Zopfli processing of PNGs can [more than make up for the added kilobytes](https://www.ctrl.blog/entry/webp-vs-guetzli-zopfli/) and will probably even shave off a couple of kilobytes extra. The highly efficient WebP image format also supports XMP metadata if you’re concerned about keeping file sizes tiny.

#### Sources

- [IPTC Photo Metadata Standard 2017.1](https://iptc.org/std/photometadata/specification/IPTC-PhotoMetadata?ref=ctrl.blog), revision 3, 2019-03-18, International Press Telecommunications Council (IPTC)
- [Image rights metadata in Google Images](https://blog.google/products/search/image-rights-metadata-google-images/?ref=ctrl.blog), 2018-09-27, Ashutosh Agarwal, Search Blog, Google
- [Quick guide to IPTC Photo Metadata and Google Images](https://iptc.org/standards/photo-metadata/quick-guide-to-iptc-photo-metadata-and-google-images/?ref=ctrl.blog), 2018-09, International Press Telecommunications Council (IPTC)
- [XMP](https://wiki.creativecommons.org/index.php?title=XMP&oldid=103522&ref=ctrl.blog), revision 103522, 2015-01-25, Wiki, Creative Commons
- [XMP Specification](https://www.adobe.com/devnet/xmp.html?ref=ctrl.blog), XMP Developer Center, Adobe
### HTML5 parsed as 4 with upper­case DOCTYPE in HTML Tidy
URL: https://www.ctrl.blog/entry/tidy-html5-doctype/
Last updated: 2026-08-23T22:23:19.000Z
[HTML Tidy](http://www.html-tidy.org/?ref=ctrl.blog) (libtidy) is a small program for identifying problems with, cleaning up, and producing consistent HTML formatting. It has full support for HTML5 parsing mode as well as the many legacy HTML 4 parsing modes. It can be a great aid for HTML experts and novices alike.

You may remember that I ran into [another issue with php-tidy](https://www.ctrl.blog/entry/php-ob-tidyhandler.html) (also built on libtidy) when I tried using it with my old PHP based content management system. I’ve since migrated to a static-file content management system so that should have been the end of my problems with libtidy. However, I kept running into a strange bug with some of my document that were detected as HTML 5 but processes as they were HTML 4.

None of the legacy HTML 4 parsing modes allow modern practices like wrapping a block element like `<h1>` inside what was formerly defined as an inline element like an `<a>` element. It should work in most old web browsers as web authors have been doing this years before HTML 5 became a formal standard. But HTML Tidy in HTML 4 mode would try to clean up the mess and break the document in the process.

An HTML document’s parsing mode is detected from the DOCTYPE declaration on the very first line of the document. In standard compliant HTML 5, the DOCTYPE should always be the *case-insensitive* string `<!DOCTYPE HTML>`. HTML 4 has multiple modes and many variations on the DOCTYPE declaration which are all distinctly different from the HTML 5 DOCTYPE.

After some digging I realized that HTML Tidy version 5.6.0 didn’t do case-insensitive matching of the DOCTYPE string. `<!DOCTYPE HTML>` (uppercase “HTML”) would always be parsed as HTML 4 whereas `<!DOCTYPE html>` (lowercase “html”) would be parsed as HTML 5\. The HTML 5 standard is very clear that the DOCTYPE should be matched case-insensitively. Tidy would correctly indicate that both variants had been detected as HTML 5, but incorrectly state that both variants had used HTML 5 parsing. The casing of “DOCTYPE” had no impact on this issue.

The obvious work-around for this bug is to always use a lowercase DOCTYPE when passing markup through HTML Tidy. I wrote a little program for myself that lowercases the DOCTYPE of any HTML files that I pass through it to help me avoid this particular issue in the future. It shouldn’t make any different to web browsers or any other software that will parse the document.

This was a annoying issue and I spent way too much time narrowing down why some documents behaved correctly and some reformatted in strange and unexpected ways. I later realized that this “strange” reformatting was the expected result for HTML 4 strict parsing mode.

On a more positive note: I’m happy with HTML Tidy overall. It has helped me identify and correct dozens of issues with this site already. I’ve also found, reported, or fixed some other minor issues using Tidy with things like HTML5+RDFa extension attributes.

You can follow [tidy-html5 issue #815](https://github.com/htacg/tidy-html5/issues/815?ref=ctrl.blog) if you’re interested in updates on the DOCTYPE issue. A tiny patch for the issue is already available. HTML Tidy releases are few and far between so I don’t expect that we’ll see this patch make its way to a release and users any time soon.

You’re only required to use an uppercase DOCTYPE string when conforming to XML, e.g. XHTML. In all other situations, it’s case-insensitive.

#### Sources

- [The HTML syntax](https://www.w3.org/TR/2017/REC-html52-20171214/syntax.html?ref=ctrl.blog), 2017-12-14, HTML 5.2, W3C Recommendation, World Wide Web Consortium (W3C)
- HTML Tidy version 5.6.0, 2017-11-25, HTACG
### Ctrl blog is now licensed under Creative Commons licenses
URL: https://www.ctrl.blog/entry/relicensed-creative-commons/
Last updated: 2026-08-23T22:16:51.000Z
I’ve decided to license *most* of the articles and *many* of the photos and illustrations on Ctrl blog under Creative Commons licenses. All in all I’m making hundreds of articles and hundreds of images from this blog available under more permissive licenses.

You may be familiar with Creative Commons licenses already as they’re fairly popular, especially in the free-culture circles of the web. Assuming you’ve meet the license’s terms you’re free to share, transform, remix, and redistribute the works licensed under a Creative Commons license. Creative Commons licenses come in a few different flavors with different usage terms. Every Creative Commons license require you to include a copyright statement from the author; include the title and link to the original content, and link to the license itself.

My decision to relicense Ctrl blog was also partly motivated by my investigation into [copyright and the distributed peer-to-peer web](https://www.ctrl.blog/entry/copyright-p2p-dweb/) where I concluded that Creative Commons licenses were the way to go for creators and readers alike.

Some readers may also remember that I’ve [defended my copyright](https://www.ctrl.blog/entry/defacing-content-scrapers/) from [content scrapers](https://www.ctrl.blog/entry/delaying-feed-updates/) in the past. By licensing under Creative Commons I open myself up for more content scraping, and people and bots helping themselves to more of my works. However, I hope to get more legitimate and authorized copies of texts and images linking back to my website as the original source as a strategy to combat unauthorized plagiarists.

**Update** (2021-07-22): The license has been removed from old articles and new articles no longer carry Creative Commons licenses. Photos and images will remain under Creative Commons licenses. Check the bottom of each article page for information about licensing images on that page. Creative Commons licenses are non-revokable; meaning that you may continue to use content previously distributed under Creative Commons licenses under those lienses. You can even find and continue to use articles [archived copies in the Internet Archive](https://web.archive.org/web/%2A/https://www.ctrl.blog/entry/%2A) under Creative Commons licenses.

I’m offering different texts and images under different licenses with different license terms. Please make sure you individually check the license terms of each text and images you want to reuse or redistribute. Note that not every image on Ctrl blog is licensed under a Creative Commons license!

Licenses for individual articles were chosen based on their commercial value to me. For example, reviews and photos of discontinued products and services have been licensed under more permissive licenses whereas the most popular articles have more restrictive licenses.

You can even find higher-resolution versions of some photos in [my Flickr photostream](https://www.flickr.com/photos/aleksandersen/?ref=ctrl.blog).

You’ll find license statements for each item on a page at the bottom of every page. The human readable licenses at the bottom of each page will need some further work, however. They’re a bit repetitive and hard to read as-is as they’re currently generated from Resource Description Framework (RDF) metadata statements.

Each page also contains detailed embedded machine-readable license information about the texts and images on the page in HTML+RDFa format. An RDFa parser will tell you the exact license and attribution requirements for each thing on a page. —and no, you can’t parse the license information using regular expressions (regex). Use an RDFa parser to build an RDF graph instead. Even multinational technology giants like Facebook and Twitter seem to be using regex parsing for RDFa, but they [even get the basics wrong](https://www.ctrl.blog/entry/rdfa-socialmedia-metadata/).

Please feel free to drop me an email if you use one of my images or texts anywhere. Especially if you translate any of my articles to another language! This is, of course, entirely optional as Creative Commons licenses don’t require you to ask permissions before redistribute, transform, translate, or find other uses for any of my Creative Commons licensed creations. As long as you comply with the attribution requirements and the terms of the license, of course!
### Enough of WordPress
URL: https://www.ctrl.blog/entry/enough-of-wordpress/
Last updated: 2026-08-23T22:05:52.000Z
Ctrl blog have been on a month long break while I’ve been migrating the entire website away from WordPress. This has been the longest break without an update since I launched the blog six years ago. I’ve never been super-happy about using WordPress and the number of paper cuts and annoyances had finally reached my limit. I wanted to get away from WordPress before I lost the enthusiasm for blogging.

I’ve now switched over to [Nanoc](https://nanoc.app/?ref=ctrl.blog) and will no doubt share more about it in a future update but right now I want to talk about WordPress. I originally used static-site generator called [Nikola](https://www.ctrl.blog/tag/nikola/) when I launched this blog but abandoned it [in favor of WordPress](https://www.ctrl.blog/entry/static-to-wordpress/) three years ago. I summarized the move at the time with these two bullet points:

- Nikola makes programmer-perfectionist-Daniel happy.
- WordPress makes enjoys-writing-articles-Daniel happy.

So, what has changed? Simply put: One evening I realized that WordPress was making me unhappy and I didn’t want to have to deal with it anymore. It’s frustrating to manage a WordPress site and the core architecture forces you to do things the WordPress way.

Without going into too much detail, here are some of the key issues that I think either may resonate or be useful to others trying to decide on what content management system they’re going to us.

1. I worry about the constant barrage of attacks targeting WordPress.

WordPress runs 33,4 % of all websites globally. Anyone who’ve followed my blog will know that I don’t like seeing any one vendor take too large a marketshare in any market.

Being popular also makes you a big juicy target for malicious actors. I’ve been following security best practices, run server-side anti-virus and log monitoring, keep continuous backups, and have enabled auto-updates for everything … . Yet the barbarians were constantly banging on the doors and it became a source of worry that I don’t need in my life.

1. WordPress’ plugin ecosystem lacks collaboration tools.

There are a ton of great and useful plugins to WordPress that can do all sorts of things. It’s a common vector for attacks so I’ve been reviewing everything I install and have also kept up with updates to already installed extensions. I’ve noticed quite a few issues with various plugins over the years and have wanted to reach out to the plugin authors about the issues.

However, there isn’t a good way to communicate patches or problems with plugin authors. WordPress’ plugin directory doesn’t facilitate collaboration on code nor does it provide a good method for communicating with the plugin author. There isn’t even a standard field in plugin listings where the developer can plug in a link to BitBucket, GitHub, or another tool better suited for code-work. If I did find a way to message the developer they’d rarely respond, or if they did then they’d just drop the ball — because it’s 2019 and who knows how to handle a .patch file anymore?

Many plugins are one-off project by their creators and there’s no way to formally request to manage an abandoned plugin. There’s also no format process where you can hand off control of a plugin to someone else and have WordPress plugin moderation staff pay extra attention after the transition.

PS: I’m not abandoning my own plugins with a combined 10 500 active installations just yet. However, I’d be more than happy to hand them off to someone willing and able to maintain them. I’ll, of course, need a vial of your blood, a copy of your passport, and your first born to make sure you’ll manage them carefully.

1. Multi-device editing turned out to lead to dataloss.

When I migrated to WordPress I mentioned that [I wanted to use their apps and edit articles on the go.](https://www.ctrl.blog/entry/static-to-wordpress/) Having the ability to do some mobile editing or editing from my laptop without needing the source code to build the site would be nice, right?

WordPress haven’t quite managed to nail down the always in sync collaborative editing feature we’ve all grown to expect from a web based text editing interface. Editing a post in WordPress from different devices turned out to be a recipe for disaster and I’ve lost a number of edits and entire article drafts to it. I’m aware of the built-in version history system but it only saved my bacon a handful of times. I haven’t been able to keep myself from editing posts from multiple computers over the years and I’ve just kept loosing work to it.

If this sounds familiar then you may remember me [complaining about similar issues with Simplenote](https://www.ctrl.blog/entry/review-simplenote/); another tool from Automattic that’s meant for multi-device use but causes data loss if you use it that way.

1. Auto-updates to WordPress change *my site* without my consent.

Imagine having a carefully designed performance-budgeted website one day — and then find some unwanted stylesheet or JavaScript injected onto every page the next day. Emojis? Block editor stylesheets? Jetpack Analytics? I didn’t ask for any of these things and I didn’t appreciate discovering their assets injected into my theme.

The longer I used WordPress the less I felt in control over it. I’ve had updates break my site or some plugin overnight and I find that unacceptable. I haven’t had a staging/testing instance of WordPress and if I’d wanted to continue using it I’d definitely have to set one up and disable auto-updates on the main installation. Maybe I’m just getting old but I want a heads up before changes are made to my website. WordPress is supposed be stable enough, right?

I can and have worked around these and many other issues. However, I no longer want to use a publishing platform that takes up so much of my time as WordPress does.

WordPress doesn’t have many open-source direct competitors that are still actively maintained. There are some commercial options available, but I like to thinker with things and I want access to the source code. I’ve explored other options for a content management system like Textpattern but [found them wanting](https://www.ctrl.blog/entry/textpattern-allure/).

#### Sources

- [One-third of the web!](https://wordpress.org/news/2019/03/one-third-of-the-web/?ref=ctrl.blog), 2019-03-15, Joost de Valk, WordPress.org blog
### Copyright and the distributed peer-to-peer web
URL: https://www.ctrl.blog/entry/copyright-p2p-dweb/
Last updated: 2026-08-23T22:04:00.000Z
The distributed web overturns many of the assumptions of the traditional centralized web especially when it comes to how everything is distributed. Copyright laws protect a creator’s exclusive rights to distribute their creative works. So, how does all of this work when you as a creator publish something on a distributed website? And how does it work for the end users?

Disclaimer: I’m not a lawyer and this isn’t legal advice. This article consists of my interpretation of copyright law and is intended for entertainment purposes.

When you publish a creative work on the traditional centralized web you’re implicitly licensing everyone in the world to come and view whatever you’ve published on the website where you published it. If this arrangement isn’t enough for you then you can erect paywalls and charge a fee to see it, you can license it permissively extending your viewer’s rights to redistribute and repurpose it freely, or you can exercise your exclusive distribution right and pull it off the web. These rights are protected by copyright laws and apply almost everywhere in the world thanks to the Berne Convention for the Protection of Literary and Artistic Works.

However, things work a little differently on the distributed web. Anyone who views your articles, videos, or other copyrighted creative works also cache them on their devices and contributes to the distribution to other viewers. Unless expressly licensed to do so, by redistributing any copyright licensed works they’re violating the creator’s exclusive distribution rights. Copyright infringement, even [unintended copyright infringement](https://www.ctrl.blog/entry/copyright-disclaimers/), is no laughing matter.

A few weeks ago I looked into how Accelerated Mobile Pages (AMP) Caches work by [leveraging a safe-harbor provision for caching services](https://www.ctrl.blog/entry/amp-cache-copyright/) found in the copyright laws found in many countries including Australia, Canada, the European Union, and the USA. Could the same caching exemption be used for the distributed web?

### Are distributed web protocol clients a caching service?

You can certainly think of a distributed web client like a caching service. Copyright law includes safe-harbor provisions for caching services, although they don’t do a good job of defining them.

Caches must serve the purpose of improving network efficiency, they must select content for caching using automated means, they can’t modify or alter the cached content, and a cache must respect industry standard methods that enable the rights holders to update or remove the cached files.

The Dat Protocol and compliant clients meet the first three requirements, but the last one is a bit trickier. The protocol allows for files to be updated and even removed, but old version and even deleted files can still be accessed through the protocol’s built-in file history and versioning system.

This isn’t a new problem as the same situation exists for other public version control systems like the popular Git development tool. Individual open-source development projects solve this problem using irrevocable permissive licenses that apply to the entire project and older versions in perpetuity. In other words, this is handled by an expressly written license.

Files on the InterPlanetary File System (IPFS) are immutable and can’t be updated, and there isn’t a method for removing them either. IPFS and IPFS-to-web gateways (acting more like traditional caching services) thus don’t qualify for the safe-harbor provisions afforded to caching services either.

A Dat Protocol client is close, but in my understanding doesn’t quite meet the requirements to qualify as a caching service. IPFS clients are nowhere near qualifying as caching services.

### What about implied licenses?

I’ve mentioned implied licenses once in the article already so lets explore whether they’re suited for use on the distributed web. An implied license is an unwritten license granting limited rights to use copyrighted material as a result of how the rightsholder themselves distributed the material.

You can argue that for anything legally published on the distributed web by its rightsholder, there’s an implied unwritten license agreement that grants you the right to redistribute it in the form it was provided to you.

For the distributed web, this means that you’ve an implied license to cache it on your device and redistribute it through the same means that you accessed it. This doesn’t grant you other rights, such as redistribution, repurposing outside the original form, transformation, or offering it for sale.

However, an implied license is by its very nature fragile and can come with unintended consequences. The same line of reasoning that grants users the right to redistribute content on the Dat Protocol also enables other uses that the right holder may not want.

For instance, both the Beaker Browser and Cliqz’s implementation of the protocol feature prominent buttons for making an editable copy of the original website that’s immediately made available to others. That right can also be argued to have been implied by the original rightsholder, even though they might not have intended to allow for derivative works.

Peer-to-peer networks that compensate users financially, e.g. by using token virtual currency — like [Tribler](https://www.tribler.org/?ref=ctrl.blog), [FileCoin](https://filecoin.io/?ref=ctrl.blog), and [BitTorrent Speed](https://www.bittorrent.com/blog/2019/01/17/bittorrent-speed-to-strengthen-bittorrent-protocol-connect-users-with-btt-tokens/?ref=ctrl.blog) — further complicates the matter by introducing economic exploitation of the rightholder’s works.

The ambiguities around implied licenses are many, and especially for a relatively new type of media without established rules like the distributed web. You can mitigate these problems by expressly providing a written license for your content.

### Choosing a license for your work

Before I get going I’d like to remind the reader that I’m not a lawyer nor providing legal advice on how to write your contract. That being said, you probably don’t *need* to write your contract.

[Creative Commons](https://creativecommons.org/about/?ref=ctrl.blog) is a set of permissive licenses that have been around and evolved since 2001. They’re similar to free software and open-source licenses as used in open-source software development projects, but focus on other creative endeavors like film making, photography and writing. Creative Commons licenses are widely recognized and easy to read, with a standard set of symbols representing the rights you’ve licensed your work under.

Creative Commons have several different licenses to choose from, depending on what you’re comfortable with allowing. All of their licenses allow for the free distribution of licensed works, given that certain requirements set by the rights holder are met. All their licenses require attribution in a way specified by the rights holder (such as including your name and a link to a webpage of your choosing.)

The rights holder can then opt to either allow or disallow commercial exploitation of their work, and to either allow or disallow using their works in remixes and other derivative works. Optionally, derivative works can be allowed only if the new work is distributed under the same Creative Commons license.

The [interactive Creative Commons license chooser](https://creativecommons.org/choose/?ref=ctrl.blog) will help you decide on and understand the differences between the different licenses. The tool helps you select what you want others to be able to do with your work and what rights you want to retain.

Note that you *must* read the Creative Commons license you chose in full before applying it to your work. The licenses are **irrevocable** so you can’t remove the license from the copy you distribute and then pursue people who have obtained copies of your work while it was Creative Commons licensed, and you can’t stop them from redistributing it under the same terms after you’ve changed your mind about the license.

There are things in the license you should be aware of, such as the right to transform the medium (e.g. convert from a PDF to HTML, or transcribe an audio podcast to text) which are exempt from the non-derivative license requirement.

If you’re unhappy with the Creative Commons licenses and the brand recognition and the public’s familiarity with those licenses, then you can, of course, write your license terms. Good luck with that.

### Applying the license

The one thing super important thing about applying a license is that it’s made available to the user. For content-addressable distribution models like IPFS, it’s important to [embed a copyright notice and the license into images](https://www.ctrl.blog/entry/embedded-image-metadata/) and other files individually. There’s no guarantee a separate license file will “stick” with a collection of files you’ve shared.

This isn’t as important, but still recommended, for platforms like the Dat Protocol and BitTorrent which revolve around bundles of files instead of individual files. Most file formats have machine-readable standards for embedding a copyright and license statement (or at the very least key-value pairs for metadata that can be used for this purpose), and there’s software that can embed these into the files for you.

Keep in mind that individual components of something like a webpage may have different license terms. For example, while your blog posts may be licensed as Creative Commons, the JavaScript you use on your page might be licensed under a free-software license; whereas the illustrations to your blog posts may have been sublicensed using yet another license. Be careful to not imply that a license applies to the whole website or even all the contents of a page, but try instead to be as specific as possible.

There should also be a human-readable version of the license. This can be included at the bottom of a webpage, in the credits of a movie, or super-imposed as a watermark on top of an image. I’d personally not use the last option as I find that it often ruins the photo or illustration. However, I don’t see any real alternatives to images distributed individually, e.g. over IPFS.

This article could be completely wrong! If you spot any mistakes or something blatantly obvious that I’ve missed, please leave a comment! I’ll happily update the article with new information.

The feature illustrations incorporates elements © 2014 Sandra Schön.
### What’s with the tech media’s obsession with VPN services
URL: https://www.ctrl.blog/entry/media-vpn-obsession/
Last updated: 2026-08-23T22:14:13.000Z
If you visit some of the largest tech media publication on a regular basis; you may have come away with the impression that you must “protect yourself” with a shared Virtual Private Network (VPN). All the media sites have plenty of recommendations for which service you should chose. They don’t seem to have much of an understanding about how VPNs work or what threats they may protect you against, however. So, why is the tech media obsessed with VPN services?

VPN services do have some legitimate uses especially when you’re out and about and must connect to an unknown and untrusted Wi-Fi network; like the network at an airport or café. The best possible security strategy is to avoid connecting to unfamiliar Wi-Fi network unless you absolutely have to.

The thing about VPN services is that you have to place an inordinate amount of trust in the service provider. When you use a VPN service, you tunnel all your traffic through to their network. You’re encrypting your local traffic to protect yourself against a theoretical local network-snooper and putting much of your data in the hands of an industry which hasn’t done much to deserve customer trust. VPN services has repeatedly been found to violate that trust by selling data on their customers’ online activities to third-parties.

It’s easier for many VPN service providers to spy on your complete traffic — including much of your encrypted web traffic — than it would have been for a potential local attacker. You have to trust your VPN provider more than a random network. You have to install the VPN provider’s software and [grant their root certificate absolute trust on your device.](https://www.ctrl.blog/entry/vpn-root-ca-trust/) This level of trust enable them to impersonate any websites; including HTTPS-secured websites.

When it comes to VPNs: the cure for potentially insecure networks can be worse than the potential risk you expose yourself to by using them.

So, why do large tech media companies recommend you “protect yourself with a VPN” and suggest that VPNs provide absolute and impenetrable online anonymity and privacy (even though no such thing is possible)? They’re often just echoing the marketing materials available on the VPN services’ websites.

Advertisements for VPN services are competitive and they can be very valuable to websites. I’ve [called out PCMag](https://www.ctrl.blog/entry/pcmag-vpn-review/) in May 2018 for not clearly disclosing that their VPN coverage featured affiliate partner links that yielded sales commissions to PCMag. In that article, I included a table showing just how profitable these partner programs can be to websites like PCMag. Selling one VPN subscription can give reoccurring revenue for as long as the referred customers keeps renewing their subscription.

VPN services are quite cheap and you can sell them to people located anywhere in the world. It’s a great money-maker as the VPN services are essentially reselling bandwidth from basic servers with easy-to-configure software. All their affiliate partners need to do is to sell a subscription by scaring people into believing they’re a likely target of a sophisticated and targeted attack. Accompanying the article with some dark-cyber-hacker-esq graphic like the feature image for this article doesn’t hurt either.

Don’t get me wrong: it can sometimes be beneficial to use a trustworthy VPN service. You probably don’t need one, though. You should stop and think about the motivations of the article author when you’re seeing anything overly positive written about VPN services in general and especially recommendations for any particular VPN provider.

#### Sources

- [26 of the 115 most popular VPNs are secretly keeping tabs on you](https://thenextweb.com/news/26-popular-115-vpns-keeping-tabs-saying-theyre-not?ref=ctrl.blog), 2018-03-27, Bryan Clark, The Next Web
- [‘Hola’ if your VPN was busted selling your bandwidth](https://www.techradar.com/news/networking/-hola-if-your-vpn-was-busted-selling-your-bandwidth-for-botnets-1295421?ref=ctrl.blog), 2015-06-01, Stephen Lambrechts, TechRadar
### Aren’t AMP Caches committing copyright infringement?
URL: https://www.ctrl.blog/entry/amp-cache-copyright/
Last updated: 2026-08-23T22:01:25.000Z
Accelerated Mobile Pages (AMP) are specially formatted webpages that companies like Cloudflare, Google, and Microsoft copy off publishers’ websites and make available through their own AMP Cache web servers. There’s no redistribution license agreement between the AMP Caches and the publishers, so how come AMP Caches aren’t considered copyright infringement on a massive scale?

Like the name suggest, albeit heavily disputed, the purpose of AMP is to speed up webpage delivery time and performance on high-latency mobile devices. Web publishers can either choose to specifically create AMP-formatted webpages in addition or instead of their regular webpages. Some publishing platforms may create AMP variants alongside the regular webpage without the knowledge of the author (the copyright holder.)

Both Microsoft Bing and Google Search will auto-discover an AMP-variant of a document and link to it in their own AMP Caches instead of linking to the regular webpages on their search result pages when searching from a mobile device.

This whole process got me real curious about how this process could possibly be legal under copyright laws. Google and Microsoft are making and distributing pages, images, and other assets on a massive scale for creative works that they haven’t been expressly licensed to redistribute.

Disclaimer: I’m not a lawyer and this isn’t legal advice. This article consists of my interpretation of the copyright laws of Australia, Canada, EU, and USA and is intended for entertainment purposes.

Google have always presented AMP as a performance enhancing caching service. Normally, a transparent caching proxy service would sit somewhere in the network path between the end user and the original web server. This service has typically been deployed by internet service providers (ISP) to cut the costs associated with connecting outside their own networks.

### Exceptions for caching in copyright law

Your devices don’t redownload the site logo and other shared resources when you go from one page on a website to another. Instead, your web browser caches recently and frequently used resources like images and scripts on your device so you don’t need to go back and forth with the web server for every page you want to load.

In the early 2000’s, copyright laws around the world were amended specifically to grant an exception for this type of transient but cost- and performance essential copying of otherwise protected creative works.

The caching exception was also extended to shared caches, like a transparent proxy cache operated by an internet service provider at the edge of their networks, that automatically cached resources on behalf of and redistributed them to many users.

AMP Caches aren’t part of the normal networking path between the website publisher and the user so they’re not doing the traditional intermediary caching that network operators have done in the past. Instead, AMP Caches represent an entirely separate location where users get a copy of the cached content.

I don’t believe it was ever the intention of any lawmaker to allow for or grant the broad safe-harbor provisions allowed for by copyright laws to a service like an AMP Cache. In my understanding, lawmakers tried to grant very specific exceptions for intermediary caches but made the provisions too broad when they attempted to also make it technology neutral.

### Requirements for caching safe harbor provisions

Caching and caches are vaguely defined in copyright laws. However; Australian, Canadian, European Union, and USA laws agree that the caching process must be automatic and that the caches must follow industry standards for removing and updating cached materials. AMP Caches satisfies this requirement by supporting the industry standard HTTP Cache-Control header and other related caching headers.

EU law also requires that the caching must only be done for the purpose of making communications more efficient; which is how Google have presented AMP all along.

Copyright laws require that *no modifications* are made to the cached creative works. Australian and Canadian copyright laws specifically grants exceptions to this requirement for changes made by an undefined technical processes. EU and USA copyright laws have no such exceptions.

AMP Caches makes a few notable [optimizations and modifications to cached content](https://web.archive.org/web/20190321151215/https://developers.google.com/amp/cache/overview#cache-optimizations-and-modifications). These changes performed by the AMP Caches are done to achieve high performance but it may also be stripping away their safe harbor provisions as allowed for under EU and USA copyright laws.

### The implied license

An implied license in the context of copyright law is the license granted by a rights holder in the absence of an expressly written contract. E.g. your right to listen to music you’ve purchased, even though there’s no explicit contract for it.

You need to be a copyright lawyer to make any sense of the finer details of implied licenses. Most resources on implied licenses that I found on the web consists of little more than lawyers shaking their heads at the lack of an expressly written legal agreement in their place.

For the most parts, authors and publishers themselves have opted to produce AMP formatted pages with the implicit understanding that their creative works will end up in one or more AMP Caches operated by one or more companies. In knowingly doing so, they’re also supposedly granting permission for AMP Cache providers to copy and redistribute their creative works.

As a I’ve mentioned earlier, this may not always be the case as some content management systems produce AMP formatted pages automatically without the knowledge of the rights holder. Not every party will be aware of nor happy with the arrangement.

#### Sources

- [Copyright Act 1968: Compilation No. 58](https://www.legislation.gov.au/Details/C2019C00042?ref=ctrl.blog), C2019C00042, 2019-01-01, Federal Register of Legislation, Australian Government
- [C-42 Copyright Act](https://laws-lois.justice.gc.ca/eng/acts/c-42/20181213/P1TT3xt3.html?ref=ctrl.blog), 2018-12-13, Statutes of Canada, Justice Laws Website, Government of Canada
- [Copyright Law of the United States](https://www.copyright.gov/title17/title17.pdf?ref=ctrl.blog), 2016-12, U.S. Copyright Office
- [Directive 2001/29/EC](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32001L0029&from=EN&ref=ctrl.blog), 2001-05-22, The Official Journal of the European Union, EU Parliament and EU Council
- [Directive 2000/31/EC](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32000L0031&from=EN&ref=ctrl.blog), 2000-06-08, The Official Journal of the European Union, EU Parliament and EU Council
### Four interesting Firefox-derived web browsers
URL: https://www.ctrl.blog/entry/four-firefox-derivatives/
Last updated: 2026-08-23T22:07:33.000Z
The Google led Chromium browser toolkit project is poised to take control over the entire web platform with its 72 % marketshare on desktop devices and 56 % of mobile. Firefox is Chromium’s main competitor on desktop computers and you should consider switching to it if you care at all about maintaining some competition and innovation in this market.

Firefox itself might not be the perfect web browser for you, however. Here are four other web browsers built on top of Firefox that you may want to consider to stave off the looming Chromium web-monoculture.

Most web browsers of today are based on either Google Chromium, Apple WebKit, or Mozilla Firefox. There are very few vendors crazy enough to attempt making a web rendering engine, let alone a full web browser. Microsoft recently abandoned their EdgeHTML engine in favor of Chromium and thus further reducing competition in this space.

But what does it mean to build a web browser on top of another web browser? It can mean many things to many different developers and therein lies the possibilities for neat new features that can delight users and make them more productive.

Without any further ado, here’s my list of the top four Firefox-based web browsers and some points on what makes each of them innovative and interesting:

### [Tor Browser](https://www.torproject.org/?ref=ctrl.blog)

This web browser bundles Firefox with all its privacy enhancing settings set to maximum and the network-anonymizing Tor software. All traffic is routed through multiple nodes on the encrypted Tor network to help keep your internet service provider and any malicious actors from spying on your web activity. Picture it as how you sometimes see hackers in movies being depicted as hiding their place of origin by connecting through a series of other computers.

Tor Browser resists browser fingerprinting, attempts at uniquely identifying your computer and software, by attempting to make all of their users indistinguishable from other Tor Browser users. The browser doesn’t remember your online activities from use to use so you’ve got to write down and remember important addresses and passwords on your.

Tor will use more bandwidth than other browsers as it doesn’t store any temporary files or allow different websites to reuse common images and scripting libraries between them.

Tor browser follows Firefox’s extended support releases (ESR). This means it doesn’t have the latest features, but it still receives seucrity updates from Mozilla. The Tor Project focuses almost exclusively on privacy and security.

It’s the browser of choice for those who need online privacy (assuming you use it correctly) but it can also be incredibly frustrating to use as online services may question whether you’re a human or a bot every few minutes.

### [Pale Moon](https://www.palemoon.org/?ref=ctrl.blog)

Pale Moon has a focus on maintaining what was good about older versions of Firefox and mixing in some of their own unique innovations.

It has its own tweaked version of the Firefox web extension architecture, maintaining some backwards compatibility with older Firefox extensions. All the other web browsers mentioned in this article get their Firefox-compatible web extensions from Firefox’s own [AMO portal](https://addons.mozilla.org/en-US/firefox/?ref=ctrl.blog) but Pale Moon has [their own unique selection of extensions](https://addons.palemoon.org/extensions/?ref=ctrl.blog).

You’ll also find support for other deprecated Firefox technologies like live bookmarks (news feed bookmark folders) and a visual overview of all your open tabs. Pale Moon’s developers must spend a lot of time maintaining these features outside the main Firefox project.

Pale Moon also have an interesting per-site permission settings that let you quickly grant or revoke permissions you may have mistakenly granted a website: such as the ability to annoy you with notifications or see your location. This feature makes me kind of nostalgic for old OmniWeb browser for MacOS.

### [Waterfox](https://www.waterfox.net/?ref=ctrl.blog)

Waterfox is Firefox sans all of Mozilla’s value-added services (except for Sync). There’s no automatic usage telemetry data sent back to Mozilla or no prompts to use their Pocket reading list service or their Sync service (although it’s present if you chose to use it). The user assumes all responsibility for security of their own browser as Waterfox won’t even block known malicious extensions or require a Mozilla-approved digital signature before you can install an extension.

This is the browser for you who does like Firefox but doesn’t like Mozilla’s experiments with ways to monetize the browser. If you find yourself turning off a lot of settings after you’ve installed Firefox, then you might want to give Waterfox a try.

### Cliqz

**Update** (2020-04-30): The Cliqz browser has been discontinued.

An interesting experimental browser and search engine combination that collects anonymized search and browsing data from their users to build a kind of socially driven search engine. This strategy is similar to how Microsoft used Internet Explorer to [collect data on people’s Google searches](https://www.wired.com/2011/02/bing-copies-google/?ref=ctrl.blog) to build their Bing search engine.

Cliqz also contains a few different experimental privacy enhancing features, and they’re working on blocking “unfair ads” while allowing “fair” ones to be shown. They don’t appear to be entirely sure themselves what that means yet but it may be an interesting feature to keep an eye on for the future.

The user interface is very similar to Firefox but some people may appreciate their slimmer toolbars compared to other web browsers. The esearch field is an aquired taste, however.

If none of these seem like they may be the thing for you, then maybe you’ll want to have another look at [Firefox](https://www.mozilla.org/en-US/firefox/?ref=ctrl.blog) after all? In my opinion, it’s the best web browser there is!
### Don’t rely on mod_negotiation to serve pre-compressed resources
URL: https://www.ctrl.blog/entry/mod_negotiation/
Last updated: 2026-08-23T22:14:36.000Z
The Apache HTTP Server (`httpd`) can handle server-driven negotiation for a request for static files and make an informed selection from several different file variants using special file extension patterns (such as `.gz`) using `mod_negotiation`. However, this module is unsuited to handle content negotiation for pre-compressed resources.

Quick primer on HTTP content negotiation: HTTP clients can send request headers to indicate their language, data format, and data encoding (compression) preferences. The server can use these headers as hints and return [varying results](https://www.ctrl.blog/entry/http-vary-explained/) that meets the client’s stated preferences. This process is known as content negotiation, or sometimes incorrectly referred to conditional requests (a term that refers to cache revalidation.)

The `mod_negotiation` implements the experimental (and abandoned) RFC 2295 Transparent Content Negotiation in HTTP specification on top of the more widely deployed RFC 2068: Hypertext Transfer Protocol 1.1 specification. This introduces some unique problems as problems as RFC 2068 just said that server-driven content negotiation should select the “best” variant supported by the client; whereas RFC 2295 tried to be more specific than that but it ultimately failed at providing a specification. `mod_negotiation` have left this unresolved for almost two decades.

So, what is the best variant in terms of a compressed resources? That is quite easy to answer: the one with the smallest possible file size without adding an undue decompression burden on the client. Today’s mobile networks are way slower than the processing speeds of even minimal phones and clients. Many people also pay for the amount of data they consume or must stay beneath a monthly data cap. We can therefor assume that smaller file sizes are preferred.

— and given a number of pre-compressed variants of a resource (say Brotli, Zstandard, and gzip) how does mod\_negotiate select the best encoding variant? It doesn’t. It only checks that the client announces support for the encoding and otherwise doesn’t use it for calculating the best variant. Given three otherwise identical variants, you’d end up with the first variant to be evaluated by `mod_negotiation` (whichever that may be) every time regardless of the file size.

You can create what `httpd` calls a `type-map` for each resource and manually assign scores to each variants depending on their file size. These type-maps requires extra work to pre-calculate and produce, and you’ve to update them along with the resources over time.

The [httpd documentation suggests using mod\_rewrite](https://httpd.apache.org/docs/2.4/mod/mod%5Fdeflate.html?ref=ctrl.blog#precompressed) (and echoed by countless blogs and forums.) This approach checks for the string “gzip” in the `Accept-Encoding` header, and then checks if a pre-compressed variant of the requested URL exists on the file system, and finally returning either the uncompressed or pre-compressed variants accordingly. This way you can also make some assumptions, like assuming Brotli will always produce smaller files than gzip (which may not be the case depending on your files.)

You **should not** use this approach! All the HTTP request headers used for content negotiation can optionally include a quality score, to indicate the most preferred to least preferred variant. For example, you could say you prefer Zstandard encoded requests, but will accept Brotli but absolutely not gzip using the following header:

```
Accept-Encoding: gzip;q=0, zstd, br;q=0.5
```

The order of the accepted encodings is meaningless but the quality (q) score is not. Simply checking for the substring gzip would return a gzipped compressed response even when the client specifically says it doesn’t support it. You may thing of this as a silly example, but the below example header can sometimes observed from non-gzip capable bots and libraries:

```
Accept-Encoding: gzip;q=0, identity
```

`mod_negotiation` has a few other annoying restrictions and limitations such as [bug #60619](https://bz.apache.org/bugzilla/show%5Fbug.cgi?id=60619&ref=ctrl.blog) which will annoy you to no end if you’re trying to use it for serving pre-compressed resources. Server-driven content negotiation in itself is a very useful tool, but unfortunately mod\_negotiation isn’t the implementation you’ll want to use for anything but negotiating languages and media types.

Unfortunately, few other HTTP servers have implemented content negotiation in any meaningful way. The specifications has been around for two decades and it’s easy to implement and can be useful. If you want to implement it yourself, see [RFC 7231 section 5.3](https://www.rfc-editor.org/rfc/rfc7231.html?ref=ctrl.blog#section-5.3) and do mind the [Vary header](https://www.ctrl.blog/entry/http-vary-explained/).

It’s easy to implement on the application layer and you’ll find a descent number of libraries supporting it natively.

#### Sources

- [Content negotiation](https://httpd.apache.org/docs/2.4/content-negotiation.html?ref=ctrl.blog), version 2.4.38, 2019-01-22, HTTP Server Documentation, Apache Foundation
- [Apache mod\_deflate module](https://httpd.apache.org/docs/2.4/mod/mod%5Fdeflate.html?ref=ctrl.blog), version 2.4.38, 2019-01-22, HTTP Server Documentation, Apache Foundation
- [Apache mod\_negotiation module](https://httpd.apache.org/docs/2.4/mod/mod%5Fnegotiation.html?ref=ctrl.blog), version 2.4.38, 2019-01-22, HTTP Server Documentation, Apache Foundation
- [mod\_negotiation.c](https://github.com/apache/httpd/blob/5dc1948b15a17f480c37a4a856c25ad7c383cce7/modules/mappers/mod%5Fnegotiation.c?ref=ctrl.blog), commit 5dc1948b15, 2019-01-10, HTTP Server project repository, Apache Foundation, GitHub
- [RFC 7231: Hypertext Transfer Protocol (HTTP/1.1): Semantics and Content](https://www.rfc-editor.org/rfc/rfc7231.html?ref=ctrl.blog), 2017-06, Internet Engineering Task Force (IETF)
- [RFC 2295: Transparent Content Negotiation in HTTP](https://www.rfc-editor.org/rfc/rfc2295.html?ref=ctrl.blog), 1998-03, Network Working Group, Internet Engineering Task Force (IETF)
- [RFC 2068: Hypertext Transfer Protocol 1.1](https://www.rfc-editor.org/rfc/rfc2068.html?ref=ctrl.blog), 1997-01, Network Working Group, Internet Engineering Task Force (IETF)
### ProtonMail vs Mailbox.org comparison
URL: https://www.ctrl.blog/entry/protonmail-vs-mailbox/
Last updated: 2026-08-23T22:16:06.000Z
I’ve frequently been requested to compare Mailbox.org and ProtonMail ever since I published [my review of Mailbox.org](https://www.ctrl.blog/entry/review-mailboxorg/). Both of these email service providers focus on customer privacy. Both offers webmail front ends with support for Pretty Good Privacy (PGP) end-to-end encryption in addition to PGP for at-rest encryption of all messages directly from the web browser.

So, how do these two services with similar goals compare head to head? One is better for on traditional email services and price, and the other has a more wholistic user experience (but you won’t be using it with your favorite apps).

The two services at a glance: Mailbox.org is a general-purpose feature-rich budget email service provider that offer optional privacy features comparable with ProtonMail. ProtonMail is a more basic service that focuses more on providing privacy by default at the expense of standards and compatibility.

### Pricing

I’ll start by comparing prices before I begin comparing the feature sets as this will be the deciding factor for many prospecting customers.

**Update** (2021-04-14): Mailbox.org has introduced [new higher price tiers](https://mailbox.org/en/post/new-price-plans-available-at-mailbox-org-2021?ref=ctrl.blog "“New price plans available at mailbox.org”"). You get more storage, though. The article has been updated to reflect the new pricing and service offering.

ProtonMail puts a premium price on privacy that makes it a luxury commodity compared to Mailbox.org’s more affordable prices. I’ve put together two comparable price comparison examples based on my own needs (3 custom domains, 3 address aliases, and catch-all addressing.)

| Provider  | ProtonMail | Mailbox.org |
| --------- | ---------- | ----------- |
| Price/yr. | 93 Euro    | 36 Euro     |
| Storage   | 5 GB       | 10 GB       |
| Domains   | 3          | 25          |
| Aliases   | 5          | 10          |

The daily cost of ProtonMail in this price example is equivalent to a single Nespresso coffee capsule, and Mailbox.org costs the same as 9 cups of plain-old instant coffee. This may sound like a bad analogy, but the coffee capsule system provides the drinker with a cleaner experience while having a worse impact on the environment. Mailbox.org may not provide the same packaged experience as a coffee capsule system but you get the same job done and more value for your money.

Mailbox.org only uses renewable energy and its interoperable with any standard compliant ~~coffee maker~~ email client. ProtonMail feels more like a coffee capsule system that locks you into their more expensive product that doesn’t do anything extra with a more negative impact on the environment.

ProtonMail does offer a cheaper plan but then you can’t use catch-all addressing and is still more than double the cost of Mailbox.org’s plan. Mailbox.org’s cheapest plan is only 36 Euro/year.

ProtonMail is over three times more expensive than Mailbox.org with these requirements. If you need additional domains, aliases, or storage than the next level up makes the price discrepancy even more obvious.

| Provider  | ProtonMail | Mailbox.org |
| --------- | ---------- | ----------- |
| Price/yr. | 288 Euro   | 108 Euro    |
| Storage   | 20 GB      | 25 GB       |
| Domains   | 10         | 25          |
| Aliases   | 50         |             |

At this service level, ProtonMail costs more than two and half times more than Mailbox.org. You get 5 Gigabytes less storage but double the number of aliases. You can pay 30 Euro/year more at Mailbox.org and get 50 Gigabytes. ProtonMail’s plans stop at 20 Gigabytes.

You don’t get any additional services other than additional storage at Mailbox.org ProtonMail bundles in their ProtonVPN service, a Virtual Private Networking (VPN) service.

### Email privacy: a matter of encryption key management

Super brief PGP primer: PGP is the industry standard for email encryption. Each person needs to have a private-key that only they’ve which is used for decryption, and a public-key which they can give to others who can use it encrypt things that only the corresponding private-key can decrypt.

ProtonMail encrypts your copies of sent and received emails when it’s stored on their servers using PGP. ProtonMail also end-to-end encrypts emails between ProtonMail customers. This is all done automatically since ProtonMail manages both the customer’s private-keys and maintain a database of the public PGP-keys for each of their customers.

This does mean that incoming emails from other email services are unencrypted before they arrive in your ProtonMail inbox, and it also means outgoing emails to other email services by default are sent unencrypted. You can manually setup encryption to other recipients by giving someone your public-key and adding their public-key to your ProtonMail address book. After having completed that hideous process, you can send end-to-end encrypted messages to recipients on other email services.

ProtonMail handles all of the above in their webmail and mobile apps. However, you can’t use standard email clients without running a copy of their ProtonMail Bridge program (available for MacOS and Windows only) on your local computer. Bridge will handle the PGP-key management on your behalf assuming the correct keys are known to ProtonMail. I other words, you don’t always know whether emails to other email services will be encrypted or not as you’ve no indicators for this before you send the email with a standard email client.

The manual key management process described above is the default trust model which PGP relies on when you use any other email service or email client. It’s the method you can use with Mailbox.org’s webmail and with any standard PGP capable email client.

Mailbox.org doesn’t do any PGP management by default. You can enable a feature they call Mailbox.org Guard and another feature they call Inbox encryption. When you enable Mailbox.org Guard you need to either upload a private/public PGP-key pair of your or let Mailbox.org create one for you. To enable inbox encryption, you’ll need to set a public PGP-key which Mailbox.org will use to encrypt all incoming emails before storing them in your inbox. You can use the same public-key for inbox encryption as you use with Guard.

When you’ve enabled Guard you can manually import your contact’s public-keys and start sending them encrypted messages from Mailbox.org’s webmail. You can then also use the same PGP-key pair you use with Guard in your preferred email clients and apps.

### Extra features

The most expensive plan at ProtonMail (the second price example provided above) also includes their ProtonVPN service. This can be useful if you need to access the internet via an untrusted network such as a café or at an airport.

Every plan with Mailbox.org includes a full suite of productivity tools including an office suite (word processing, spreadsheets, and presentations) in addition to some private hosted storage space, notes and task tracking, a calendar, and even XMPP (“Jabber”) chat services. These things make Mailbox.org more useful if you want to replace the services of another online giant like Apple, Google, Microsoft, or Yahoo.

Both Mailbox.org and ProtonMail can optionally encrypt messages to non-PGP recipients and send them a link to a temporary mailbox on the web where they can decrypt the message. This requires you to have another, presumably secure, way of delivering the decryption password for those messages.

I can’t see any use case where this would be useful, however. If you already have another secure communications channel that you trust enough to send them a decryption password; why would you ever want to send them an email with a link to an encrypted message?

### Conclusions

You’re ultimately paying for pretty much the same email service whether you pick Mailbox.org or ProtonMail. Whichever service you chose, you’ll need to learn how PGP works as neither services can magically make this complicated technology easy to use.

I value open standards and data portability, and for this reason alone I’d choose Mailbox.org over ProtonMail as the latter has sacrificed interoperability in some areas for design and a modest improvement in convenience.

ProtonMail may be the better choice if you intend to only use their app and webmail as I find their user interfaces are better designed than Mailbox.org’s but you’re also a hefty premium to get locked into one vendor’s products. You’ll get more for your money with Mailbox.org than you do with ProtonMail.

#### Sources

- [Using e-mail addresses of your domain](https://web.archive.org/web/20190305185948/https://kb.mailbox.org/pages/viewpage.action?pageId=6947813), 2018-02-28, Knowledge Base, Mailbox.org
- [An introduction to Mailbox.org Guard](https://web.archive.org/web/20190305185952/https://kb.mailbox.org/pages/viewpage.action?pageId=1180967), 2017-08-03, Knowledge Base, Mailbox.org
- [The Encrypted Mailbox](https://web.archive.org/web/20190305190026/https://kb.mailbox.org/pages/viewpage.action?pageId=1180104), 2017-08-03, Knowledge Base, Mailbox.org
- [PGP key management](https://web.archive.org/web/20190305190029/https://kb.mailbox.org/pages/viewpage.action?pageId=1180878), 2017-08-03, Knowledge Base, Mailbox.org
- [Using catch-all alias with own domain](https://web.archive.org/web/20190305190032/https://kb.mailbox.org/pages/viewpage.action?pageId=1180098), 2017-08-03, Knowledge Base, Mailbox.org
- [Address Verification with Trusted Keys](https://web.archive.org/web/20180526110554/https://protonmail.com/support/knowledge-base/address-verification/), 2017, Knowledge Base, ProtonMail Technologies
- [What is a Catch-All email address?](https://web.archive.org/web/20180926114433/https://protonmail.com/support/knowledge-base/catch-all/), 2017, Knowledge Base, ProtonMail Technologies
- [ProtonMail Security Features and Infrastructure](https://web.archive.org/web/20181121102044/https://protonmail.com/docs/business-whitepaper.pdf), 2016-07-08, ProtonMail Technologies
- [What is encrypted?](https://web.archive.org/web/20151124030012/https://protonmail.com/support/knowledge-base/what-is-encrypted/), 2015, Knowledge Base, ProtonMail Technologies
- [Encrypt Message for Non-ProtonMail Recipients](https://web.archive.org/web/20160416061021/https://protonmail.com/support/knowledge-base/encrypt-for-outside-users/), 2015, Knowledge Base, ProtonMail Technologies
- [Sending a message using PGP/PGP (GPG/GPG)](https://web.archive.org/web/20180526110553/https://protonmail.com/support/knowledge-base/how-to-use-pgp/), 2015, Knowledge Base, ProtonMail Technologies
- [IMAP, SMTP, and POP3 setup](https://web.archive.org/web/20160413065528/https://protonmail.com/support/knowledge-base/imap-smtp-and-pop3-setup/), 2015, Knowledge Base, ProtonMail Technologies
### Hurricane Electric secondary DNS adds support for TSIG authentication
URL: https://www.ctrl.blog/entry/he-2nd-dns-tsig/
Last updated: 2026-08-23T22:09:07.000Z
I published a disappointing [comparison of secondary authoritative DNS service providers](https://www.ctrl.blog/entry/secondary-dns-comparison/) last month. There wasn’t any clear winners as even the most expensive services lacked proper domain zone transfer (AXFR) authentication (TSIG). However, one of the providers have stepped up their game and have added TSIG support.

I had to email most of the service providers that were included in my comparison as documentation across the board was quite poor. Without going into too much detail, there seems to be a direct coloration between the cost of a service and the quality of their support answers. Though not the way you might expect! The services with a free tier replied quickly and answered my questions in the first message. The most expensive services were confused by my reference to RFC standard numbers or simply didn’t respond.

Hurricane Electric’s (HE.net) [free DNS services](https://dns.he.net/?ref=ctrl.blog) stood out, though. Over the course of a few weeks they’d not only replied to my support request where I asked for details about Secret Key Transaction Authentication for DNS (TSIG) support, but they’d also implemented TSIG support and rolled it out to all of their customers.

Unauthenticated AXFR leaves your DNS server open for misuse for traffic amplification attacks as a single AXFR request can return the entire domain zone. TSIG authentication helps prevent misuse and unintended information from your DNS infrastructure. Many secondary DNS providers rely on an outdated practice of Internet Protocol (IP) address allow-listing instead of doing proper AXFR request authentication.

HE.net’s DNS services are offered free of charge, and is in many ways better than many of the quite expensive services I [considered in my comparison](https://www.ctrl.blog/entry/secondary-dns-comparison/). (The comparison table have been updated.) You don’t get a service level agreement (SLA) or any uptime guarantees.

However, what you do get is a cost-free secondary (or tertiary) authoritative DNS service with full IPv6\-support in two dozen global anycast points-of-presence locations.

If you’ve been on the fence about rolling out a secondary (or tertiary) DNS provider for your domains then you should consider giving Hurricane Electric a few minutes of your time. (That is all it will take!)

HE.net’s secondary DNS service isn’t without its faults. They’re aggressively rate-limiting zone change notification (NOTIFY) requests. If you’re only making occasional changes the NOTIFY requests are acted upon within a few seconds, but they’re ignored entirely if you’re making changes as often as every hour. You can lower your zone’s time-to-live to work around this limitation but at the cost of reduced zone caching efficiency.

The HE.net DNS administration panel shows a warning notice about possible zone compatibility issues with unspecified DNSSEC-related record types when you add a new secondary zone. As far as I — and automated online DNSSEC validation tools — can tell, the service doesn’t have ay problems with the DNSKEY and RRSIG record types. HE.net doesn’t specific any more details about what the incompatibility problems might be so you’ll have to test your zone thoroughly.

#### Sources

- [Hurricane Electric Free DNS Management](https://web.archive.org/web/20181206122203/https://dns.he.net/), 2018-11-28, Hurricane Electric
- [RFC 2845: Secret Key Transaction Authentication for DNS (TSIG)](https://www.rfc-editor.org/rfc/rfc2845.html?ref=ctrl.blog), 2000-05, Network Working Group, Internet Engineering Task Force (IETF)
### Your web browsers are slowing down your Time Machine backups
URL: https://www.ctrl.blog/entry/time-machine-web-browser-data/
Last updated: 2026-08-23T22:23:21.000Z
You probably use your web browser more than any other application on your Mac and it’s causing slow Time Machine backups that fill up with non-essential files.

This article focuses on the specifics of MacOS’ Time Machine backup system, but the same problems also exists with most other backup system on all computer operating systems.

Web browsers store a lot of data on your hard drive in files and databases that change every minute as you surf the web. Most of the information that’s stored by your web browser is non-essential ephemeral data that you would never miss if it disappeared or didn’t survive a system disaster. All modern web browsers even have a built-in feature to remove this type of data called “clear data”, “remove history”, “clear browsing data”, or something similar.

What you care to back up from your browser is limited to your settings and extensions, saved passwords, bookmarks, and maybe your top sites and the last few months of your browser history.

My browser profile data directories (excluding `~/Library/Caches` which isn’t backed up by default) for Firefox, Safari, Brave, Chrome, and Vivaldi are roughly 1 Gigabyte each. Assuming some use of the browser, a majority of the files in that directory are shown to have been modified within the last hour. Time Machine makes a new copy of every file that has been modified since the last backup and backups are created every hour.

**Update** (2020-04-05): You can use a third-party app called [TimeMachineEditor](https://tclementdev.com/timemachineeditor/?ref=ctrl.blog) to get granular control over when and how often Time Machine runs back up tasks. You can configure it to run less often than every hour or only run when you’re not actively using your Mac.

The exact amount of data that’s copied into Time Machine with each hourly backup point varies greatly. Following some quick analysis of my own backups (see the bonus section at the end of the article) show that each hourly backup is 620 Megabytes on average. A whooping 594 Megabytes on average out of the backup total size is data from my whichever web browser I’ve been using.

I went through each of my browser profile directories and pick out only the files I want to have backed up and was left with an average of 11,4 Megabytes of valuable data per browser. In other words, 98 % of the data that’s backed up from my web browsers are non-essential junk files that I wouldn’t miss. These files keep track of states and sessions, and keeps things working on the web. But I would not have missed them if I’d needed to restore my MacBook from backup.

Apple only keeps hourly backups for the last 24 hours, and reduces the backup to daily backup for the last week, and weekly backups for as long as storage permits. This storage retention strategy keeps the problem from taking up all your available backup storage space. However, preparing all of those non-essential files for backup, encrypting them, copying them over the network or to an external disk, writing them to that disk, and then cleaning it up again a few hours take time and energy. So, much energy that Time Machine is the number one battery draining app on my MacBook according to Activity Monitor!

As a user, you can manually go through and add exclusions to your Time Machine backup through System Preferences. Most users would not know that they needed to or how to do this, what files to exclude, or even how to find any of these files. (There are existing tutorials for this the web but I recommend against following them as I couldn’t find a single one that showed you how to not lose your bookmarks, history, and browser settings.)

This is a problem that should have been solved by the application developers. Browser vendors — including Apple — should fix this in their products rather than leaving it to the end user. Applications can mark non-essential files for exclusion using the Backup Core [CSBackupSetItemExcluded](https://developer.apple.com/documentation/coreservices/1445043-csbackupsetitemexcluded?ref=ctrl.blog) API or by setting an extended file system attribute. I find it telling that not even Apple have bothered with implementing support for their own API, however.

If your Time Machine backups have become slow lately, you may want to try a more practical trick by resetting your browser data using the personal data removal tool in your browser. This shrinks most of the relevant files down to almost nothing which reduces their impact on your Time Machine backups. It’s not a great solution but it’s quick and easy to try.

**Bonus** Want to analyze your Time Machine backup to see how much data is stored with every backup point? The following Terminal command will show you a list of backup points and how much unique data was copied over and stored for each backup point.

```shell
tmutil listbackups | xargs -I% tmutil uniquesize "%/Macintosh HD${HOME}/Library/Application Support/Google/Chrome"
```

The above example (it’s all in just one line) looks at the backups of Google Chrome. You’ll need to adjust the path in the `tmutil` command and point it to the browser profile directory for your preferred web browser. Locating your browser profile directory path is out of scope for this article.
### PHP HTML Tidy ironically doesn’t tidy up after itself
URL: https://www.ctrl.blog/entry/php-ob-tidyhandler/
Last updated: 2026-08-23T22:15:30.000Z
I learned HTML and the value of open readable source code back in the day through looking at the sources of the websites of the time and I still value these things. PHP Tidy is an interface to the [Tidy HTML library](http://www.html-tidy.org/?ref=ctrl.blog) (libtidy) that’s used to neaten up HTML documents and pretty-print their source code. However, every time I’ve tried to use it I’ve had to disable it as it started gobbling up every file processed by PHP, even the ones it was never told to tidy up. I finally took the time to figure out what the issue was.

The HTML Tidy library is supposed to be used as a post processing tool to help uncover formatting issues and beautify the source HTML to increase readability. The tool does an excellent job at that with HTML but it can’t be used to process other markup languages.

PHP Tidy includes an output buffer processing callback function called `ob_tidyhandler` that you can register at the top of your HTML documents to have HTML Tidy perform post processing on the current document before returning it to the client. Due to a bug in PHP Tidy, registering the callback for one document would cause every subsequent request handled by the same PHP processor to run through HTML Tidy as well. This would be a destructive action for any XML or binary files returned by PHP.

The heart of the issue is the management and abuse of the global on/off switch for enabling HTML Tidy processing on all documents. If you enable the `tidy.clean_output` option then every request going through the PHP processor would be given a tidying up; even unsupported file formats. This option should be left off and avoided.

However, the `ob_tidyhandler` function doesn’t process the buffer as one would expect. Instead, it flips the global `tidy.clean_output` runtime option to on causing PHP Tidy to send the whole document (as opposed to just the buffer the function was supposed to work on) to HTML Tidy for post processing. This behavior doesn’t at all match how the function is documented.

This little cheat was probably fine back in the day when a PHP processor would be started by the web server for every request and put to rest when it had done its task and it matched how most developers would have wanted to use the function. Today, the same PHP processor instances is reuses the same runtime for hundreds or thousands of requests.

This is a longstanding issue and I believe that I’ve observed issues caused by his bug around the web for the last decade. Specifically, I’ve repeatedly come across servers that have returned Atom syndication feeds (an XML file format) that have been butchered into a broken HTML document with a `<meta name="generator" content="libtidy">` element near the top. Reloading the URL a dozen times would normally return the Atom formatted feed as expected.

~~My recommendation is clear: don’t use `ob_tidyhandler`!~~

**Update** (2021-02-06): This issue was resolved in PHP 8.0.1 which was released in January 2021. Thanks to Christoph Becker for fixing it!

If you’re interested in this issue you can follow [PHP bug #77594](https://bugs.php.net/bug.php?id=77594&ref=ctrl.blog).

#### Sources

- [PHP 8.0.1 changelog](https://www.php.net/ChangeLog-8.php?ref=ctrl.blog#8.0.1), 2021-01-07, The PHP Group
- [ext/tidy/tidy.c](https://github.com/php/php-src/blob/91ef4124e56a8ec52078bdcb5547ea5dbf654566/ext/tidy/tidy.c?ref=ctrl.blog#L1172), commit 91ef4124e5, 2019-02-04, PHP project repository, GitHub
- [ob\_tidyhandler](https://www.php.net/manual/en/function.ob-tidyhandler.php?ref=ctrl.blog), 2004-11-15, Tidy, Other Basic Extensions, PHP Function Reference, PHP Manual, The PHP Group
### The distributed web isn’t ready for Runet cutoff from the Internet
URL: https://www.ctrl.blog/entry/dweb-readiness-runet/
Last updated: 2026-08-23T22:05:28.000Z
Russia is preparing a nation-wide experiment where the whole country temporarily disconnects from the global Internet to see if the country can rely on Runet alone. The effort is supposed to help Russia prepare for potential digital warfare against the nation, but some analysts are also speculating whether this is the first step towards deploying a nation-spanning censorship machine like “the great firewall of China.”

This will probably cause major disruption to online services in Russia. However, I’m more interested in looking at how prepared the distributed web is for such a cut off and whether these networks will even remain operational.

The [promise of the distributed web](https://www.ctrl.blog/entry/the-dweb/) (dweb) is that it will make us less dependent on just a few huge internet infrastructure companies and enable anyone to publish globally available resources. Every person who downloads a resource also makes it available for upload to other interested users; akin to how BitTorrent and peer-to-peer file sharing works. However, neither the InterPlanetary File System (IPFS) nor the Dat project will continue to function properly inside of Russia following a Runet cutoff from the global Internet.

Dweb clients inside of Russia will not be able to reach outside clients, but their distributed networks should still mostly work for users inside the country. However, centralized components in current dweb deployments will still lead to service outages.

The Dat project also has a single-vendor dependency for DNS resolution as the project uses Google DNS over HTTPS by default. You can’t change this resolver from within the Beaker Browser, the most popular user facing incarnation of the Dat project. Google DNS do have several recursive DNS server locations inside of Russia.

However, these DNS servers can only serve cached and stale responses unless they can communicate with a Google Cloud location where the actual DNS for uncached queries take place. There are no Google Cloud locations in Russia so the system would quickly falter.

Dat also relies on a centralized tracking server for peer-discovery. A tracking server keeps track of which users claim to have a copy of a file that anyone is interested in and introduces peers to each other. The concept was popular in the early days of BitTorrent, but have become almost obsolete as BitTorrent clients have moved over to use a Distributed Hash Table (DHT) for peer discovery instead. More on this later.

The two default tracking servers for the Dat project are hosted by Hetzner Cloud and Digital Ocean with authoritative DNS provided by Cloudflare. Cloudflare’s authoritative DNS should remain functional inside Runet, but the IP addresses for the tracking servers will be unreachable. Dat will stop functioning entirely.

The story is similar for IPFS. IPFS uses DHT like BitTorrent and doesn’t rely on a centralized tracking server. However, the two main implementations of IPFS, go-ipfs and js-ipfs, both rely on reaching one of a couple of central DHT bootstrapping nodes. These nodes introduce the client to the network by giving them enough information to connect to other nodes to get them going.

These bootstrapping nodes doesn’t depend on an authoritative DNS provider, but all of them are hosted on Digital Ocean and would be unreachable from inside Runet. Assuming at least one other domestic connection within Runet at the time of the cutoff, an IPFS client will continue functioning after the Runet cutoff. If you restart the client, however, it will no longer be able to rejoin the network.

Almost all BitTorrent clients will continue functioning just fine, however. The main reason for this is that these clients keep track of DHT nodes and saves them between sessions. Assuming you’ve connected to at least one other domestic DHT node you should be able to rejoin the network after restarting the client. BitTorrent will have the same initial bootstrapping problem as Dat and IPFS.

You can discover DHT nodes from other IPFS or BitTorrent clients on the same network and bootstrap that way. You could bring your phone or laptop running an IPFS client to a friend’s house and join their Wi-Fi network and have your client learn of available DHT nodes that way. You could power down your device and take it home and have working BitTorrent from home using this method. IPFS wouldn’t remember the previously connected DHT nodes and would be just as lost.

Dat and IPFS can clearly learn from BitTorrent when it comes to making a distributed network less reliant on centralized components. Here are some actionable points for each project:

- Dat needs to stop using a centralized tracker. The project is already working on this through their [Hyperswarm initiative](https://web.archive.org/web/20180926161707/https://pfrazee.hashbase.io/blog/hyperswarm).
- Clients need to [remember DHT nodes between sessions](https://www.ctrl.blog/entry/cache-p2p-connections/) and to reduce reliance on a few centralized DHT bootstrapping servers. This would greatly increase the network’s resilience and diversity.
- Clients should have more accessible interfaces for manually adding a new introductory DHT nodes. Something like QR codes that you could scan with your device to add a new DHT node, or another method that could be communicated person-to-person.
- The default introductory nodes should be more diverse instead of all being hosted on the same infrastructure providers.

**Update** (2020-09-23): The Dat protocol has since become the [Hypercore Protocol](https://hypercore-protocol.org/?ref=ctrl.blog). It no longer relies on a centralized tracking server, and has migrated to using DHT instead.

We’re still in the early days of the distributed web. The planned interruption of access to the global internet in Russia serves as an important reminder that our networks are incredibly interconnected, and that distributed networks need to do more to live up to their potential.

#### Sources

- [Russia prepares for cyberwar by cutting all domestic internet from the world wide web](https://www.newsweek.com/russia-prepares-cyberwar-cutting-domestic-internet-world-wide-web-1326963?ref=ctrl.blog), 2019-02-11, Cristina Maza, Newsweek
- [Turkish citizens fight back against Twitter ban](https://www.cnet.com/tech/services-and-software/turkish-citizens-fight-back-against-twitter-ban/?ref=ctrl.blog), 2014-03-21, Lance Whitney, CNET, CBS Interactive Inc.
### Well-Known URI vs DNS-SD for distributed web service-discovery
URL: https://www.ctrl.blog/entry/wellknown-vs-dnssd-for-dweb/
Last updated: 2026-08-23T22:24:21.000Z
In this article, I want to discuss the use of Well-Known URIs and DNS based service discovery (DNS-SD) methods for mapping domain names to resources on the distributed web. I’ll focus on the different method’s ability to route around internet censorship and their centralization, and talk about some suggestions for improving the current implementations used by distributed web projects.

There are two primary methods used to auto-discover services offered on a domain: you either send it a web request to a predetermined service-discovery address or you can query the Domain Name System (DNS) for a predetermined service-discovery record.

The distributed web, like the regular web, relies on these two methods to discover the resource addresses used to retrieve content by a domain name in various distributed networks. I’ll discuss each of these methods in turn.

Well-Known URIs (RFC 5785) are simple to implement on any web server where you control the root of the domain and can expose files on the domain root. The [Dat Protocol](https://www.datprotocol.com/?ref=ctrl.blog) and the Beaker Browser uses this method to discover websites that offer a distributed Dat archive by requesting the archive’s hash fingerprint from a file served at https://example.com/.well-known/dat.

This method is relatively simple to explain and setup. However, it also has a single point of failure: the website serving the file. Depending on the website’s measures to make itself redundant, it can relatively easily be either blocked or even knocked offline; taking the mapping between the domain and the distributed web version of the site with it.

Dat and the Beaker Browser also support an alternative same-domain lookup method to the Well-Known URI discovery scheme. I’ll get back to this later in the article.

I performed a survey of the top 2,4 million websites (as ranked by the [Tranco list](https://www.ctrl.blog/entry/tranco-popular-websites/); see the article sources at the end) in January 2019 and found ten Dat enabled websites. All of them used the Well-Known URI discovery mechanism, except the Beaker Browser’s own website which also offered the alternative DNS-SD method.

The Beaker Browser focuses on allowing people to build and host distributed websites right from their browsers. The project does also offer a paid-hosting service called *Hashbase* that makes distributed websites available over HTTPS and acts as a Dat distribution node. Hashbase customers get a customer subdomain at Hashbase that gives their distributed websites a friendlier name than a random hash value.

Hashbase uses Well-Known URIs to map their roughly 2600 customer’s domain names to Dat. Hashbase is without a doubt the single largest distribution node in the Dat network. The service have seen multiple outages that have rendered these distributed websites unavailable, even when there have been other distributed nodes hosting them on the network.

The Domain Name System (DNS) is, unlike most parts of the web, designed to be decentralized. DNS is \[mostly\] fast and it can be secure. DNSSEC can be used to guarantee that a dweb content address response from an authoritative DNS provider gets to your devices unmodified. Communication between your devices and your recursive DNS provider can also be secured by encrypting them through TLS or HTTPS connections.

Unless you can block off a domain’s authoritative DNS server from the internet at the source, recursive DNS servers can and will be able to resolve the domain name. (A recursive DNS server is the DNS server provided by your ISP or a provider like OpenDNS, Quad9, Cloudflare, or Google.)

A domain can be configured with multiple authoritative DNS providers to create redundancy and make it harder to block the domain. DNS blocking is hard to do right and easy to route around, as [demonstrated by Turkey when they attempted to block BunnyCDN](https://www.ctrl.blog/entry/bcdn-blocked-turkey/) (Ctrl blog’s CDN provider.)

We’ve seen an increasing centralization in the recursive DNS space in recent years. Google products, including Chromecast; Chromebooks, and the Chrome browser, is hardcoded to use Google’s DNS servers by default instead of the ones provided by your ISP. Fancy and easy to remember free-to-use recursive providers like 1.1.1.1 and 9.9.9.9 have also helped centralize a once decentralized system. However, if your DNS provider blocks your access to anything you can still get to it by using any other DNS provider.

The Dat project have opted to use Google’s public DNS resolver over HTTPS as their default recursive DNS resolver instead of using the system’s DNS settings as most applications. You can’t configure another DNS resolver in the Beaker Browser, but you can if you’re building your application on top of the Dat project’s libraries.

This again introduces a single point of failure that can be blocked (or suffer a temporary service outage) for Dat and Beaker; a pair of projects that oddly seems to prefer centralized single-vendor solution over decentralized solutions to build their version of the distributed web. I’ve put forward a patch that will [make Dat randomly choose between Cloudflare DNS, Google DNS, or Quad9](https://github.com/dat-ecosystem-archive/dat-dns/pull/11?ref=ctrl.blog) instead of relying on a single system.

The InterPlanetary File System (IPFS) uses DNS records for service discovery and don’t support Well-Known URIs. IPFS and Dat support discovering resource addresses in a TXT record stored on the bare domain name. IPFS also supports storing the domain record in a subdomain, an approach that has several advantages over keeping it on the bare domain.

You notably can’t provide additional DNS records — like the ones used to discover content on the dweb — on a domain that’s resolved using a CNAME; such as is the case for popular websites that rely on content delivery networks (CDN).

A service-discovery specific subdomain can be delegated to another DNS server (using NS records) or ‘forwarded’ to another domain (CNAME records). Both approaches let domain owners segregate the service discovery mechanism from their main domain zone.

This can help ensure the security of the DNS zone as the DNS service discovery can be outsourced to a third-party or handled by a dedicated server that can’t overwrite the main zone. It notably could allow website owners to purchase IPFS nodes and hosting from a service provider and delegate or forward the required part of their domain to the third party. This flexibility could help drive adoption of the distributed web.

IPFS’ service discovery subdomain is called \_dnslink and I must admit that I hate that name. You’re querying DNS for information about IPFS and not the other way around! “DNSLink” has no defined specification and I’ve offered [some notes and suggested a few changes to help drive that specification forward.](https://github.com/ipfs/specs/issues/76?ref=ctrl.blog#issuecomment-462334040 "IPFS specs: issue #76: spec out dnslink") I’ve also proposed and argued that [Dat should follows suite](https://github.com/dat-ecosystem-archive/DEPs/issues/45?ref=ctrl.blog) and shift to using a subdomain as well. The bare domain method should be deprecated to increase performance and reduce unnecessary DNS traffic.

### Conclusions

The distributed web is still evolving and may end up using other alternatives to DNS, like the InterPlanetary Name System (IPNS), making this entire discussion mute. However, using a vastly decentralized ecosystem like DNS aligns quite well with the stated goals of many of the distributed web projects.

Well designed and standardized DNS based service discovery allow for service discovery to be decentralized and offer deployment flexibility to domain owners compare to a file stored on a single centralized point in the network.

It also enables people a relatively easy way to route around internet censorship. As a bonus: DNS based service discovery will in almost all cases be hundreds of times faster than anything requiring a full network connection and secure link negotiation with a web server.

Well-Known URIs can be quite useful but their reliance on a centralized server and single point of failure makes them the lesser option for discovering resource addresses on the distributed web. Especially when there’s a better and more decentralized options available.

#### Sources

- [DNSLink](https://docs.ipfs.io/concepts/dnslink/?ref=ctrl.blog), 2019-12-18, Documentation, IPFS Project
- [tranco-dat-research.csv](https://gist.github.com/da2x/885806c253daf24c51861d7bfae7d375?ref=ctrl.blog), 2019-02-11, Daniel Aleksandersen, GitHub
- [Top websites from 2018-12-31 to 2019-01-29](https://tranco-list.eu/list/RNXW/full?ref=ctrl.blog), 2019-01-29, Tranco list
- [dat-dns/index.js](https://github.com/dat-ecosystem-archive/dat-dns/blob/72326064dc1431bae1d2052766bd0594fefb8cd4/index.js?ref=ctrl.blog), commit 72326064d, 2019-01-21, Paul Frazee, Dat Protocol, Github
- [DEP-0005: DNS](https://github.com/dat-ecosystem-archive/DEPs/blob/3ad7ed879fa2cfcb5e205f46253d6873a55d6c66/proposals/0005-dns.md?ref=ctrl.blog), commit 3ad7ed879f, 2018-05-16, Paul Frazee, Dat Protocol, GitHub
- [RFC 6763: DNS-Based Service Discovery](https://www.rfc-editor.org/rfc/rfc6763.html?ref=ctrl.blog), 2013-02, Internet Engineering Task Force (IETF)
- [RFC 5785: Defining Well-Known Uniform Resource Identifiers](https://www.rfc-editor.org/rfc/rfc5785.html?ref=ctrl.blog), 2010-04, Internet Engineering Task Force (IETF)
### Enable both .onion and .i2p routing with Proxy Auto-Configuration
URL: https://www.ctrl.blog/entry/proxy-pac-i2p-onion/
Last updated: 2026-08-23T22:16:08.000Z
You can browse Tor hidden services (`example.onion`) and I2P services (`example.i2p`) by configuring your operating system or web browser’s proxy configuration to point to each of these services’ local proxy gateways. However, you’re limited to only using one at a time and are required to route all network traffic through the serivce’s proxy. Here is how you can use a Proxy Auto-Configuration (PAC) file to only route normal web traffic onto the clearnet while still having the option to browse `.onion` and `.i2p` services without having to switch your configuration around.

Please note that if your intention is to achieve the best possible privacy protections then this isn’t the article for you. The goal in this article is to enable devices to access content on the Tor and I2P network by their addresses in addition to using the internet as normal.

Your operating system and various software, including web browsers, may have a custom settings for configuring a proxy server. However, this isn’t enough when you only want to direct some traffic to a proxy service and especially when you want to direct specific traffic towards specific proxy servers.

This is where the Proxy Auto-Configuration (PAC) profile file comes in. PAC is a small JavaScript-like file that enables some limited scripting to evaluate a network request and direct the client to a specific network proxy. The file should be hosted on a web server so that it can be shared, and optionally auto-discovered, by all the devices on your network. The file can also be stored on the local computer or manually configured on each device.

### Proxy auto-configuration file

The following PAC file forwards traffic going to `.i2p` to the I2P SOCKS proxy service (running on port 4447 by default), traffic to `.onion` to the Tor SOCKS proxy service (port 9050 by default), and any other traffic go directly (bypassing any proxies.)

```
// SPDX-License-Identifier: CC0-1.0

function FindProxyForURL(url, host)
{
  if (shExpMatch(host, "*.i2p"))
  {
    return "SOCKS5 127.0.0.1:4447";
  }
  if (shExpMatch(host, "*.onion"))
  {
    return "SOCKS5 127.0.0.1:9050";
  }
  return "DIRECT";
}
```

The configuration language is a *JavaScript dialect anno late 1990’s* and modern PAC interpreters don’t understand modern JavaScript. There are plenty of limitations in today’s PAC parsers including trouble with parsing single-line conditionals that aren’t wrapped in curly brackets, and all expressions are expected to be terminated with semicolons.

Note that if you’re running Tor or I2P on a server on your network in addition to on your local devices, you can include multiple proxies for redundancy by separating them in the return statements with semicolons. The leftmost one is preferred and secondary ones will be attempted if the first doesn’t work.

Save this file to a server or your local computer, find the proxy configuration section of your favorite operating system or software, and provide a URL (http or file) to your PAC file. There are plenty of operating system and software specific restrictions and bugs with PAC so make sure that you test your deployment thoroughly.

### Device auto-configuration

Assuming you’ve got a web server and a configurable DHCP server on your network (and who doesn’t); you can configure it to auto-configure devices on your network. Support varies quite a bit and you can only reliably assume Windows and MacOS devices will auto-configure themselves.

The Web Proxy Auto-Discovery Protocol (WPAD) is quite simple to deploy: In your DHCP server configuration, enable DHCP option 252 and set it’s value to a URL pointing to your proxy auto-configuration file. By convention this file must be called “`wpad.dat`” and be located at the root of your server. For example, “`http://10.0.0.1:80/wpad.dat`”. Note that the URL must contain the server port number even for the default HTTP port 80\. DNS services may be unavailable without the proxy, so it’s common to provide the server address as an IP address.

Note that you’ll almost immediately run into [a longstanding networking bug with PAC profiles on Android](https://www.ctrl.blog/entry/android-proxyhandler-battery-optimization/) but you can work around them.

You can also optionally configure something called WPAD over DNS, but support for this in modern operating systems is practically non-existing.

### Bonus points

If you control a configurable DNS server on your network, you’ll want to make sure it rejects any requests for `.onion` and `.i2p` domain names to prevent any DNS leakage. These special domains are handled by their respective proxy services and you’re not expected to look them up through DNS.

#### Sources

- [Navigator Proxy Auto-Config File Format](https://web.archive.org/web/19970419180113/http://www25.netscape.com/eng/mozilla/2.0/relnotes/demo/proxy-live.html), 1996-03, Ari Luotonen, Netscape
### Android apps time out connections after setting up a PAC proxy
URL: https://www.ctrl.blog/entry/android-proxyhandler-battery-optimization/
Last updated: 2026-08-23T22:01:43.000Z
Android added support for adding Proxy Auto-Configuration (PAC) configuration profiles to the Wi-Fi network in Android 6 “Marshmallow”. Android 7 “Nougat” introduced a bug that causes almost all network connections to time out that still remains in today’s Android 9 “Oreo”. Here is why this longstanding system bug happens and how you work around it.

Android 7 introduced a new and more aggressive battery optimization system that prevents apps from running for more than a few seconds unless they’re a media app or an open foreground app. This restriction also applies to Android’s own internal helper apps.

Using a PAC configuration involves two helper apps: the ProxyHandler, responsible for intercepting all network connections and forwarding them to the appropriate proxy server depending on your PAC configuration, and the PacProcessor, responsible for interpreting the PAC file.

These helper apps are written to have a minuscule impact on battery performance, but they’ve both been restricted from running in the background by default since Android 7.

Many apps, including almost all of Google’s apps, will try to open a network connection that will route through ProxyHandler and eventually time out. Since ProxyHandler is prevented from running in the background, it can’t do anything with the incoming network requests and they’re just left in a queue until the calling app times them out.

The Google Chrome app and apps that work as front-ends for the Chromium WebView still works, however, as they use a slightly different proxy handling than the system default. Other apps like Firefox, Twitter, Google Play Services, and YouTube will just time out.

You can work-around the issue by plugging your Android device into a charger as the battery optimization policy changes for all apps to allow them to run in the background while charging. This means the problem can be frustrating to debug as your device will be plugged into the computer to interact with debugging software.

You can disable battery optimizations for the ProxyHandler and PacProcessor through Android Settings. The exact steps vary from make and model, but you’ll find a list of all your apps under the headline Battery Optimization or Optimize Battery Usage somewhere inside the Settings app.

Once on that screen, click the “Apps not optimized” label and choose “All apps” instead. Find the two apps and disable the optimization option for both of them. You can technically disable optimization only for the ProxyHandler and have your network working again; but that will introduce a tiny delay for every network connection as it has to wake up the PacProcessor app for each connection.

I reported [this issue](https://issuetracker.google.com/issues/37123179?ref=ctrl.blog) to the Android Open Source Project over two years ago but the issue was dismissed by a Google engineer as working as intended.

The same issue also affects some configurations of Chrome OS/Chromebooks.
### Chrome is right to remove the webRequest extension API
URL: https://www.ctrl.blog/entry/removing-webrequest-api/
Last updated: 2026-08-23T22:16:53.000Z
…but the proposed `declarativeNetRequest` API isn’t a good replacement. It’s too limited compared to its too powerful predecessor. So, where does that leave the Chromium browser extensions ecosystem? 

Headline writers have had their fun over the last week playing on people’s mistrust of Google’s motivations and their governance of the Chromium web browser project. Despite the headlines: Google *is not* about to kill ad-blocking extensions in Chrome.

The crux of the matter is the proposed deprecation of the `webRequest` API in favor of the newer `declarativeNetRequest` API. The `webRequest` API let extension developers intercept all network requests, pause them while they evaluated and blocked or modify them in JavaScript, and only then begin fulfilling the requests. These are quite powerful capabilities with big privacy, security, and performance implications.

The replacement `declarativeNetRequest` API gives extension developers much of the same capabilities, but moves evaluation of the network requests out of the extension’s JavaScript and into the browser engine itself. Extensions can prepare a list of up to 30 000 filter rules and either allow, block, or redirect a network request based on those filters. This is essentially how an ad-blocker works today.

EasyList, the most popular block list used by almost all the leading ad-blocking software, has over 70 000 rules. However, Brave Software put out [a research paper](https://arxiv.org/pdf/1810.09160.pdf?ref=ctrl.blog) in October 2018 that shown that **90,2 % of those blocking rules were never used** on the web’s 5000 most popular websites nor on a selection of 5000 randomly selected websites.

The selection of test websites came from Alexa Internet which is [skewed towards desktop browsing.](https://www.ctrl.blog/entry/tranco-popular-websites/) Chrome’s proposed upper limit should be more than sufficient for a pruned and well-maintained blocking list given these numbers.

The blocking list must be present in the extension at install time and can’t be updated without updating the entire extension. This is subject to Google’s extension review criteria and processes. This means you won’t be able to opt-out of something like AdBlock Plus’ [Acceptable Ads program](https://acceptableads.com/?ref=ctrl.blog), as the proposed new API doesn’t allow for rulesets to be turned on or off in the same extension.

If anyone is looking for an anti-competition angle on this one then keep in mind that Chrome’s own built-in ad-blocker [can dynamically update their blocking list independently from browser updates.](https://www.ctrl.blog/entry/chrome-adblocker/)

None of [my own extensions](https://www.daniel.priv.no/web-extensions/?ref=ctrl.blog) that use the `webRequest` API today could be re-implemented using the proposed `declarativeNetRequest` API, despite most of their usage of the API center around redirecting requests using simple dynamic redirect rules.

`declarativeNetRequest`’s redirect action can only redirect to a static URL; meaning that you *can’t* redirect using the new API from a pattern like “\*://www.youtube.com/embed/\*” to “https://www.youtube-nocookie.com/embed/%2”. This is pretty much all my [Privacy Enhanced Mode for Embedded YouTube Videos extension](https://www.ctrl.blog/entry/youtube-nocookie/) does, by the by. (Well, it also uses the webRequest API to tweak Content-Security-Policies to make websites that already allow-lists `youtube.com` to also allow-list `youtube-nocookie.com`.)

**Update** (2021-12-23): Chrome has expanded the `declerativeNetRequest` API to [support regular expressions (regex) and redirects](https://docs.google.com/document/d/1foL79VwByaVeUwYPBfZeqyC2SYcAawhjjH05eqHqW%5FE?ref=ctrl.blog "“Declarative Net Request: Regex Filters and Redirects”") This change should handle many common use-cases for extensions.

I don’t see any problems with the block action, however. It seems like a good idea for the vast majority of cases. Some extensions, like the EFF’s [Privacy Badger](https://privacybadger.org/?ref=ctrl.blog) that compiles lists of and blocks web beacons and trackers based on browsing activity (a method that [breaks a fair number of websites](https://www.ctrl.blog/entry/privacy-badgering/)), wouldn’t survive the transition.

Don’t get me wrong: removing the blocking `webRequest` API is a huge change that will break a lot of extensions. The API is also terrible to work with as developers can’t even use their browser’s own developer tools to inspect all the changes that their extensions are capable of making to a request.

There’s **no guarantee that the `webRequest` API will work** as browsers handle conflicts (two extensions wanting to modify or block the same request) by just ignoring one of the extensions. The extension isn’t notified when another extension is given the job in its place either, making it hard to troubleshoot. These limitations are true for `webRequest` in Mozilla and Microsoft’s WebExtension API; which are based on Chromium’s Extension API. `declarativeNetRequest` simplifies these limitations by always yielding to the most recently installed extension.

So, there’s good reasons for it when extension developers tell you to remove all other extensions to use their extensions. The browser extension platform is kind of broken.

I believe we’d need to see some serious improvements to `declarativeNetRequest` for it to be a true replacement for `webRequest`, however. It must be capable of handling dynamic redirects were a new URL can be constructed using parts of the matched URL, overriding Content-Security-Policies to some limited extent, e.g. allowing the same content types to be loaded from a rewritten origin, and adding and removing HTTP headers.

As an extension developer, I don’t want to lose the awesome powers that the old API gave me nor do I want to lose any of the cool extensions that depend on it. However, I also do concede that it was probably a huge mistake to add such a powerful API with such great potential to slow down the browser. I’m absolutely certain that Chrome would have preferred fixing the API if that was at all possible rather than replacing it with a new one.

The `webRequest` API was simply never designed to work on every network request going in and out of your browser in a performant manner. The new `declarativeNetRequest` is designed for performance, however. Which is why Google is betting the farm on it.

#### Sources

- [Google planning changes to Chrome that could break ad-blockers](https://arstechnica.com/gadgets/2019/01/google-planning-changes-to-chrome-that-could-break-ad-blockers/?ref=ctrl.blog), 2019-01-23, Peter Bright, Ars Technica, Condé Nast
- [chrome.declarativeNetRequest](https://web.archive.org/web/20190124192249/https://developer.chrome.com/extensions/declarativeNetRequest), 2019-01, Chrome Developer Documentation, Google
- [Who Filters the Filters: Understanding the Growth, Usefulness and Efficiency of Crowdsourced Ad Blocking](https://arxiv.org/pdf/1810.09160.pdf?ref=ctrl.blog), 2018-10-22, Antoine Vastel; Peter Snyder, and Benjamin Livshits, Brave Software
- [chrome.webRequest](https://web.archive.org/web/20181121185039/https://developer.chrome.com/extensions/webRequest), 2018, Chrome Developer Documentation, Google
### Tranco: An improved free top websites ranking list
URL: https://www.ctrl.blog/entry/tranco-popular-websites/
Last updated: 2026-08-23T22:23:32.000Z
I’ve on occasion needed a list of the web’s top websites and have always defaulted to the Alexa Top 1 Million list. However, I recently stumbled upon a better alternative called the [Tranco list](https://tranco-list.eu/?ref=ctrl.blog) that sources multiple data points to produce a more accurate representation of the web’s most popular websites.

The Tranco rank listing service is the result of [a research paper](https://arxiv.org/pdf/1806.01156.pdf?ref=ctrl.blog) that looked into how easy it was to manipulate Alexa Internet rankings and how this could be used to influence research that uses it.

Some of the findings that stood out to me in their paper is that almost half of the Alexa top one million list changes every single day. Another key finding was that the average daily intersections between the four lists in a 9 month period was just shy of 2,5 % with the highest intersection of three of the lists was just above 2 %. This makes it clear that the different data collection methods provide a vastly different view on which websites are popular on any given day.

The Tranco list sources data from multiple providers and average out rankings over a thirty-day period instead of relying on a snapshot of the list from just one day (rankings change daily.)

Here is a quick overview of the sources used by Tranco:

- **Alexa Internet Top 1 Million**  
Collects data from users who’ve installed the Alexa browser extension. Only available to desktop browsers with approximately 536 000 installs on Chrome and an unknown number of installations on Firefox.
- **Cisco Umbrella Popularity List**  
Collects data from Cisco DNS services (including Umbrella for enterprise and internet service providers and OpenDNS.) Includes popular services that aren’t websites and tracks all networked devices, not just desktop computers.
- **Majestic Million**  
Domain in-link popularity ranking based on the unique number of linking IP address subdomains (as opposed to other unique domain names.)
- **Quantcast Top Sites**  
Collects data from end-users through tracking pixels embedded on websites; estimates data for other popular websites. Their tracking pixel is a paid service skewed towards websites in the United States.

The default list from Tranco is capped at one million, but you can optionally download their entire dataset of all domains seen on any of the lists in the last month (almost 7,5 million domains at the time of writing.)

Tranco also offers daily average sorted versions of each of the lists they source. You can generate a ranked list with custom settings and optionally include subdomains (sourced from Cisco Umbrella), or filter out known malware and phishing websites using Google Safe Browsing.

#### Sources

- [Tranco: A Research-Oriented Top Sites Ranking Hardened Against Manipulation](https://arxiv.org/pdf/1806.01156.pdf?ref=ctrl.blog) (third revision), 2018-12-17, Victor Le Pochat; Tom Van Goethem; Samaneh Tajalizadehkhoob; Maciej Korczyński, and Wouter Joosen
- [Tranco Methodology](https://tranco-list.eu/methodology?ref=ctrl.blog), 2018-10-31, Tranco website
### Secondary authoritative DNS service providers compared
URL: https://www.ctrl.blog/entry/secondary-dns-comparison/
Last updated: 2026-08-23T22:21:45.000Z
A secondary authoritative DNS (sometimes called “slave DNS”) service provider is a DNS name server that clones and hosts your primary DNS server over the DNS Zone Transfer Protocol (AXFR). There are a number of managed DNS service providers that offer this service, and I’ve put together a little feature comparison.

A secondary DNS server is often referred to as a “backup name server” or “backup DNS”. However, in reality every authoritative name server can be expect to receive an equal distribution of DNS query traffic. DNS was designed to be decentralized and you can increases your domain zone’s availability and resilience to service outages by replicating it onto multiple name servers.

I’ll start off with a feature comparison matrix for a few hosted secondary DNS name server providers. The matrix also outlines the feature requirements I think are important. I’ll go into more details on each of these later in the article.

| Service                | AXFR | DNSSEC  | TSIG | IPv6    | Route   | POP  |
| ---------------------- | ---- | ------- | ---- | ------- | ------- | ---- |
| Akamai Edge DNS        | Yes  | Yes     | Yes  | Yes     | Anycast | 1000 |
| Alibaba Cloud DNS      | Yes  | No      | Yes  | Yes     | Anycast | 19   |
| Amazon Route 53        | No   | No      | No   | Yes     | Anycast | 53   |
| Microsoft Azure DNS    | No   | No      | No   | Partial | Anycast | 15   |
| BuddyNS                | Yes  | No      | No   | Yes     | Unicast | 11   |
| CloudNS                | Yes  | No      | No   | Partial | Anycast | 23   |
| CloufloorDNS           | Yes  | Yes     | No   | Partial | Anycast | 25   |
| DNSMadeEasy            | Yes  | Yes     | No   | Yes     | Anycast | 15   |
| DNSUnlimited           | Yes  | Yes     | Yes  | Yes     | Unicast | 5    |
| Dyn Secondary          | Yes  | No      | Yes  | Yes     | Anycast | 18   |
| GoDaddy Premium DNS    | Yes  | No      | Yes  | Yes     | Anycast | 60   |
| Hurricane Electric DNS | Yes  | Partial | Yes  | Yes     | Anycast | 24   |
| NameCheap Premium DNS  | No   | No      | No   | Yes     | Anycast | 17   |
| No IP Squared          | Yes  | No      | No   | Partial | Anycast | 100  |
| NS1                    | Yes  | Partial | Yes  | No      | Anycast | 25   |
| RcodeZero              | Yes  | Yes     | Yes  | Yes     | Anycast | 21   |

**Update** (2020-04-29): Added Akamai Edge DNS to the comparison table.

**Update** (2019-09-19): Added RcodeZero to the comparison table.

Pricing can’t be directly compared as the pricing models seems to be designed to defy direct comparisons with any competitor. However, services range from 14 to 1500 USD per year for at least two zones and a million requests per month. The above services were selected for this comparison primarily because they or at least two of their direct competitors provide price examples and sufficient technical information.

The lack of DNSSEC support was surprising to me. A secondary authoritative DNS server is only responsible for cloning the already DNSSEC signed zone from the primary DNS server. DNSSEC would ensure that the secondary DNS provider doesn’t maliciously or unintentionally modifies the DNS zone you entrust it to store. This may suggest that the secondary DNS providers reserve the right to modify or perhaps normalize your DNS records. Whatever their reason, this is **an absolute requirement** for me that they stick with just doing the one thing I ask them to do and DNSSEC is a good way to ensure that.

Secret Key Transaction Authentication for DNS (TSIG) is a certificate based authentication system that prevents untrusted DNS clients from cloning your DNS zone. In some situation, it’s undesirable that the zone is cloned as it may leak information about your network and infrastructure. This isn’t especially important to me, but my primary DNS service provider requires that secondary DNS server authenticate with TSIG. In legacy systems, you would allow-list the IP addresses of your secondary DNS servers in your primary server, and enforce access controls using IP addresses alone.

I found it interesting to note that many DNS service providers require TSIG authentication to copy zones from their primary DNS service, but also don’t support authenticating other DNS servers from their own secondary DNS service using TSIG.

IPv6 in the above feature matrix means that the provider’s name servers at all their locations are reachable over IPv6\. Every provider supports AAAA records.

Every name server is considered to be equal to any other name server. There’s no way to influence which name server a DNS client will send its queries to. A name server that’s available over an anycast IP address addresses this issue by having all their geographic regions respond to the same IP address. Assuming optimized traffic routing and good partner agreements, their name servers should be physically near the resolving client and thus respond fast. A unicast IP address would direct queries to one specific geographic region. Your users in the United States could send their DNS queries to a server in Taiwan instead of a server located in the same state and performance could suffer greatly.

### Conclusions

**Update** (2019-02-25): Hurricane Electric have [implemented TSIG authorization](https://www.ctrl.blog/entry/he-2nd-dns-tsig/). The above table have been updated to reflect this.

No one secondary DNS service currently support the relevant standards required by my primary DNS server to transfer my zone files to a secondary domain server, and also support the security features I need in place to be comfortable delegating DNS for my domain to them. That’s quite discouraging.

Many of the DNS service providers I’ve included here also impose arbitrary restrictions on the zone, such as minimum time-to-live (TTL) times or prohibit the use of wildcard domains. This makes sense for Hurricane Electric, who provide some of the best DNS services on the internet and also doesn’t charge a dime for them. However, all the other providers charge for their services. As long as my DNS zone file meets current industry standards, they shouldn’t be opinionated about its exact configuration, keep my account ledger open, and just host it as is.

DNSUnlimited and Alibaba Cloud DNS are the service closest to meeting my requirements. I’ll not use DNSUnlimited as they’re one of the most expensive providers yet their name servers still use unicast. As for Alibaba Cloud DNS, … well let us just say it’s entirely out of the question to drop DNSSEC.

The best option seems to be to set up my own primary master DNS name server as a “hidden master” (meaning it would host the zone yet wouldn’t be set as a name server) so I can drop the TSIG authorization requirement. I could then have a look at Hurricane Electric DNS, which I already use as the primary name server for some domains, and figure out exactly what their limitations on DNSSEC support is. I could then also use DNSMadeEasy. Operating and maintaining my own authoritative name server isn’t a big deal, but I don’t want to deal with DNSSEC for a self-hosted domain zone.

In summary: there’s definitely room for competition in the secondary DNS service provider space, as there doesn’t appear to be any good options available.

#### Sources

- [In the two years since Dyn went dark, what have we learned? Not much, it appears](https://www.theregister.com/2018/10/11/dns%5Finsecurity%5Fsurvey/?ref=ctrl.blog), 2018-10-11, John Leyden, The Register
- [RFC 5936: DNS Zone Transfer Protocol (AXFR)](https://www.rfc-editor.org/rfc/rfc5936.html?ref=ctrl.blog), 2010-06, Internet Engineering Task Force (IETF)
- [RFC 2845: Secret Key Transaction Authentication for DNS (TSIG)](https://www.rfc-editor.org/rfc/rfc2845.html?ref=ctrl.blog), 2000-05, Network Working Group, Internet Engineering Task Force (IETF)
### Report spam emails to their hosting providers with SpamCop
URL: https://www.ctrl.blog/entry/spamcop-anecdote-2018/
Last updated: 2026-08-23T22:22:13.000Z
A persistent spammer led me to explore options for taking action against their obnoxious bulk emailer. [SpamCop](https://www.spamcop.net/?ref=ctrl.blog) proved to be an effective solution to disrupt the spammer’s operations.

In December, I [migrated from FastMail](https://www.ctrl.blog/entry/goodbye-fastmail/) in Australia to [Mailbox.org](https://www.ctrl.blog/entry/review-mailboxorg/) in Germany. Right around the time I moved my email, Mailbox.org had a bug that left spam messages in users’ inboxes rather than moving them to the Spam folder. This bug led me to take another look at this constant stream of spam messages I’ve been receiving.

I’ve received the exact same couple of spam messages several times per day for over a year. There may have been a few new messages added and some removed, but it has been a consistent stream from the same sender. I’ve just left them be and let them rot in my Spam folder until now.

The majority of them had a unique email header with a list-subscriber number that was found in every email regardless of the apparent origin domain of the message or service being promoted. I figured that this may mean that the hundreds of emails I was getting probably *originated with a single operator or even a single server.*

I remember using a service called SpamCop from over a decade ago when I used to host my own email servers. The service analyses email headers from submitted spam samples, identifies the network, hosting, and other involved service providers that the spammers use, and then auto-formats abuse reports that you can send to these providers.

I sent maybe a dozen reports for these email through SpamCop, and for the first time in over a year the messages stopped coming. It took two weeks before I saw any more messages from the same spammer pop up in my Spam folder. I quickly submitted new reports, and I can happily report that I has been three weeks and the spammer haven’t resumed sending more junk. I can only hope that their service providers terminated their contracts and that they haven’t been yet been able to find another service provider willing to host them.

I must admit it feels kind of good to throw a spanner into someone’s obnoxious spamming operation. I only regret not doing it earlier! I won’t bother reporting every spam message I receive but I’ll try to be diligent with [reporting phishing emails](https://www.ctrl.blog/entry/report-phishing/) and especially persistent pests when I notice them.

This is just an anecdotal tale of effectiveness of reporting spam emails via SpamCop service. I couldn’t find many accounts of anyone having any success using the service so I thought I’d share my experiences. It’s what a blog is for, isn’t it?
### IPFS pinning services over­charge for duplicated objects
URL: https://www.ctrl.blog/entry/ipfs-pin-storage-accounting/
Last updated: 2026-08-23T22:12:10.000Z
Pinning services for the [InterPlanetary File System](https://ipfs.tech/?ref=ctrl.blog) (IPFS) are commercial hosting services that offer to ‘pin’ (meaning ‘permanently distribute’ in IPFS jargon) your IPFS file objects for a fee.

I’ve tested two such services, Eternum (0,01 USD per GiB/day) and [Pinata cloud](https://www.pinata.cloud/?ref=ctrl.blog) (1 GiB free, and 0,30 USD per GiB/month after that), and discovered that they overcharge for duplicated IPFS objects in their storage accounting.

**Update** (2020-05-09): [Temporal Cloud](https://temporal.cloud/temporal/?ref=ctrl.blog) now charges for the deduplicated storage size rather than charging multiple times for duplicated chunks.

An IPFS object can consist of a single file, or a set of references to other IPFS objects. I’ll refer to the latter kind as a “directory object” in this article. As an example, say we have an IPFS directory object consisting of references to the unique content hashes for the files File\_1 and File\_2\. You’d have three distinct IPFS objects: the directory object and the two files. When you pin such a directory object you also indirectly pin the two file objects. If you then add another file, File\_3, to the directory you’ve got five IPFS objects: the original directory object containing two files, the new directory object containing three files, as well as the three individual files.

Since the contents of File\_1 and File\_2 never changes their IPFS objects remain unchanged. You’re not storing separate copies of the files even though they’re stored in two different directory objects. The directory objects only reference the file objects by their hashes. IPFS is supposed to be “the permanent web” and you can just leave the old directory object in place to preserve the history of the object. The storage cost of keeping an old version of a directory around is only a few bytes in addition to any new or modified file data.

An IPFS node doesn’t store multiple copies of the exact same IPFS object. It only needs to store one copy of each object even though they may be referenced from multiple objects. The full size of our two directory objects and everything they reference are deduplicated on the storage layer so each file is only stored once.

IPFS also splits large files into multiple chunks; each of which may also be deduplicated in storage. Meaning that the actual storage requirement with IPFS may be smaller than the sum of all of your files on a regular non-deduplicating file system.

The problem with pinning services is that they always charge for the cumulative size of pinned IPFS objects. While they take advantage of deduplicated IPFS object hashes and blocks for their own storage requirements, these savings aren’t passed onto their customers. This would be a non-issue in a traditional file hosting service. However, deduplication of files and blocks is baked into IPFS and customers expect to reap the benefits.

I don’t believe that the commercial pinning services are overcharging on purpose, however. I’ve discussed this with the co-founder of Eternum, as well as a developer for an yet-to-be-launched pinning service, and they were positive to the idea of billing for the actual deduplicated storage space customers use. This would enable more blogs and websites to preserve their history on IPFS and ease deployment at the same time.

IPFS doesn’t natively support calculating an object’s actual storage size although I’ve [suggested adding it to go-ipfs](https://github.com/ipfs/kubo/issues/5910?ref=ctrl.blog) It’s possible to get accurate storage accounting per-customer by creating a new IPFS object consisting of all the customer’s pinned objects, and recursively going through each uniquely referenced object and sum up their size.

#### Sources

- [Enable Deduplicated Pin Size Calculation](https://github.com/ipfs/kubo/issues/5910?ref=ctrl.blog), 2020-04-20, Alex Trottier, Temporal project, RTrade Technologies, GitHub
### When does IPFS’ garbage collector clear the cache
URL: https://www.ctrl.blog/entry/ipfs-repo-cache-gc/
Last updated: 2026-08-23T22:12:12.000Z
Nodes on the InterPlanetary File System (IPFS) cache resources that are downloaded through them and make those resources available for upload to other nodes. This system depends on nodes being willing and able to cache and share resources with the network. Storage isn’t infinite, however, so nodes need to clear out some of their previously cached resources to make room for new resources.

*This article discusses the cache garbage collection implementation in `ipfs-go` version 0.4.18 and the default behavior specific to that implementation.*

A common myth perpetuated by blog posts describing IPFS says that an IPFS node’s entire resource cache is garbage collected and deleted every hour. However, the garbage collector isn’t even enabled by default and caches can grow unrestrained unless garbage collection is run manually or enabled to run on a schedule.

The repository garbage collector does run every hour (configured by the `GCPeriod` option) when enabled (`--enable-gc`). It doesn’t delete anything from the cache unless the cache exceeds 90 % (configured by the `StorageGCWatermark` option) of the 10 GB default maximum cache storage space (configured by the `StorageMax` option.)

The entire cache is deleted in one go when the garbage collector runs; it doesn’t only delete enough data to bring the total size down to 90 % of the available size. Pinned resources is never deleted by the garbage collector.

A node used for web browsing by a single user is unlikely to exceed the maximum storage every hour, and with garbage collection enabled cached resources can remain for hours, days, or weeks depending on usage. A popular public gateway node will probably be purged more often than a node used by a single user. Public gateways may use their own garbage collection handling, however.

ipfs-go version 0.4.4 (2016-10-10) and older had an arbitrary limiter of allowing the garbage collector to run for only one minute per gigabyte of remaining cache space after reaching 90 % of the allowed cache time. This would delete an indeterminate amount of data in the allowed time, and may not have been enough to get the cache below the `StorageGCWatermark`. This method was removed in version 0.4.5 and no other attempts at limiting the cache purging behavior have been seen in ipfs-go master since this method was removed.

There’s definitely room for improvement in IPFS’ cache handling. Nodes shouldn’t delete their entire cache when they exceed one byte of the configured storage allowance, but rather start purging content more intelligently. It could delete some of the oldest and least frequently accessed content in the cache first. It could potentially query the network and delete the most widely distributed resource as determined by the number of nodes sharing that resource. Even randomly deleting resources until sufficient storage space had been freed would be an improvement.

#### Sources

- [The go-ipfs config file](https://github.com/ipfs/kubo/blob/aefc746f34e5ffdee5fba1915c6603b65a0ebf81/docs/config.md?ref=ctrl.blog), commit aefc746f34, 2018-11-02, ipfs-go repository, IPFS project, GitHub
- [core/corerepo/gc.go](https://github.com/ipfs/kubo/blob/aefc746f34e5ffdee5fba1915c6603b65a0ebf81/core/corerepo/gc.go?ref=ctrl.blog), commit aefc746f34, 2018-11-02, ipfs-go repository, IPFS project, GitHub
- [pin/gc/gc.go](https://github.com/ipfs/kubo/blob/aefc746f34e5ffdee5fba1915c6603b65a0ebf81/pin/gc/gc.go?ref=ctrl.blog), commit aefc746f34, 2018-11-02, ipfs-go repository, IPFS project, GitHub
- [Remove GC timeout, fix GC tests](https://github.com/ipfs/kubo/pull/3494/files?ref=ctrl.blog), 2016-12-16, Lars Gierth, ipfs-go repistory, IPFS project, GitHub
### Contour Next Link vs Next One glucose meter
URL: https://www.ctrl.blog/entry/contour-next-one-vs-link/
Last updated: 2026-08-23T22:03:55.000Z
I got a [Contour Next One](https://www.ascensiadiabetes.com/products/contour-next-one/?ref=ctrl.blog) glucose meter in November 2018 and was [unimpressed with its Bluetooth companion app](https://www.ctrl.blog/entry/contour-next-one-bluetooth/). A month later, I got a new Medtronic MiniMed 640G insulin pump which came with a companion [Contour Next Link](https://www.ascensiadiabetes.com/products/contournext-link-2.4-meter/?ref=ctrl.blog) glucose meter. Rather than communicating wirelessly with my phone, this variant of Contour Next talks with the pump instead.

The MiniMed 640G comes in two varieties: one with a continuous glucose monitor (CGM) system, and one with a traditional glucose meter. I didn’t want the CGM variant as I’m not too keen on having a secondary injection site for the CGM sensor, and I don’t want to grow over-dependent on another integrated system. My feelings about that last point is mostly influenced by the 2014 essay [Modern Life Without a Pancreas](https://www.theatlantic.com/technology/archive/2014/09/modern-life-without-a-pancreas/380593/?ref=ctrl.blog); which I highly recommend reading.

The bundled glucose meter option comes wit the Contour Next Link. It’s essentially the same meter as the Contour Next One except it doesn’t have the same sleek black design, charges over USB, has an actual color display, and it has an extra Off/Menu button.

Testing takes the same amount of time as on the Contour Next One. The Next Link has a logbook system where you can flag your measurements to remind yourself about physical activity, mealtimes, and other factors that affect your glucose levels. The biggest difference between the two meters becomes evident when testing is complete.

You can turn off the Next One meter by removing the test strip or holding the primary button. You must leave the meter turned on for several seconds with the Contour Diabetes app open at the same time to synchronize the two. The Next Link isn’t compatible with the Contour Diabetes app but rather transmits the result to the test to the insulin pump. You can review past test results on the pump and see them in a log book together with a log of insulin injections.

The Next One uses Bluetooth while the Next Link communicates with the pump over the Zigbee protocol (both protocols in addition to Wi-Fi are variants of the IEEE 802 standard). Zigbee is used for internet-of-things (IoT) devices like store price tags and light bulbs whereas Bluetooth is a more common choice for computer and phone accessories.

I’ve all but given up on turning off the Next Link after use, however. Unlike the Next One, removing the test strip doesn’t turn the device off. Holding the Off button pressed only works intermittently. I’ve learned to just leave it turned on until it eventually times out and turns itself off. I’ve only had the meter for about a month, and I’ve already had to charge it three times.

The Next Link can send insulin injection commands to the MiniMed 640G directly. This can be very useful for people with physical disabilities or guardians wanting to remotely administrating their kid’s treatment. I’ve found the remote injection system to be frustratingly slow to use.

The meter has to reconnect to the pump (technically, it’s switching connection mode) which takes time, and you’re given fewer delivery options than when you’re just using the pump manually. You can only set an immediate injection and not use some of the pumps more granular delivery options like square delivery or time delayed injections.

Using the connected glucose meter with the pump also slows down interactions directly with the pump. After you’ve performed a test and seen the result on the Next Link, you also get to see the same result again on the pump on a separate screen that you’ve to dismiss. It sometimes takes a bit of time before this screen appears on the pump, so you could be interrupted by this screen half-way through the manual injection process.

It takes me more time to do a glucose test and set an insulin injection with the Next Link than the Next One. The meter is slower and its connectivity with the pump ends up adding more delays than it adds convenience.

I prefer using the pump and meter separate from each other as their interaction doesn’t give me any added convenience or benefits. I’ve disabled the remote injection feature on the pump and disconnected the meter syncing entirely. I’m now using the Contour Next One again, which despite its flaws and [buggy companion app experience](https://www.ctrl.blog/entry/contour-next-one-bluetooth/) is better for every day use than the Next Link.

#### Sources

- [Modern Life Without a Pancreas](https://www.theatlantic.com/technology/archive/2014/09/modern-life-without-a-pancreas/380593/?ref=ctrl.blog), 2014-09-23, Sara Dawn Johnson, The Atlantic
### Adjust or silence a systemd service’s logging levels
URL: https://www.ctrl.blog/entry/systemd-log-levels/
Last updated: 2026-08-23T22:22:55.000Z
Different services and apps have different ideas of what is worth logging, and you may not agree with what they consider worthy of logging. Some apps and services are especially chatty in logs and you may want to silence them completely.

Here are three methods for either adjusting or silencing overly chatty desktop apps and systemd services.

The systemd journal has only limited storage filtering capabilities, and defaults to store everything in case it might be useful. However, sometimes you just want to silence a desktop app or a service unit entirely or at least adjust their logging verbosity.

### Adjust logging level of systemd service

You can set a minimum logging level based on the standard syslog levels of individual systemd service units.

This method works in systemd version 236 and later, but only works for programs that send logs directly to journald or syslog, or output to `stdout` in syslog format.

1. Create a service unit override by editing the systemd service you want to modify by running the following command:

```shell
systemctl edit example.service
```

This opens a text editor where you need to add a `LogLevelMax` value. Below is an example override that restricts logging to level 3 (errors) and higher.

```ini
[Service]
LogLevelMax=3
```

For reference, the standard log levels are emergency (0), alert (1), critical (2), error (3), warning (4), notice (5), info (6), and debug (6). Setting a lower number excludes the higher and less important log messages from your journal.

1. Install the service override and restart the service by executing the following commands:

```shell
systemctl daemon-reload
systemctl restart example.service
```

The service will no longer log messages with a logging level higher than the maximum level you configured.

### Silencing a service’s standard output

By default, systemd will forward every standard output (stdout) and error (stderr) message to the journal. Some programs aren’t designed for this behavior and can be too chatty, especially on standard output.

You can override this behavior and discard the program’s output instead. Here’s how to modify a systemd unit file to discard program output.

1. Create a service unit override by editing the systemd service you want to modify by running the following command:

```shell
systemctl edit example.service
```

This opens a text editor where you can direct the output forwarding to null instead of the journal.

```ini
[Service]
StandardOutput=null
#StandardError=null
```

1. Install the service override and restart the service by executing the following commands:

```shell
systemctl daemon-reload
systemctl restart example.service
```

The service will no longer forward standard output messages toi the journal.

### Silencing a desktop app

Depending on your desktop environment, your programs’ standard output (`stdout`) and error (`stderr`) messages may be forwarded to the journal. You can override this behavior by overriding the application definition file (the `.desktop` file) for programs you want to silence.

1. Start by copying the existing desktop file to your user’s applications folder (you may need to create this directory.) This file must have the same name as the system-wide installation to avoid ending up with duplicate application entries.

```shell
cp /usr/share/applications/example.desktop ~/.local/share/applications/
```

1. Then, edit your user’s copy of the file (`~/.local/share/applications/example.desktop`) and modify the `Exec` statement to silence standard output.

The first example shows how to modify the `Exec` statement to silence just the standard output, and the second example shows how to silence standard output and error. (Changes from the original `Exec` statement are highlighted in blue.)

Depending on the program, it may be necessary to silence standard error messages though be careful so you don’t end up silencing important error messages entirely.

```ini
Exec=bash -c "/usr/bin/exampleapp >/dev/null"
```

```ini
#Exec=bash -c "/usr/bin/exampleapp >/dev/null 2>&1"
```

You can, of course, setup more specific filtering of messages here using `grep` and other utilities, but this is out of scope for this tutorial.

1. Install the modified application definition file and update the application definition database. You’ll only need to execute one of these commands, but which one varies by the desktop environment. You can just run both without any problems.

```shell
desktop-file-install ~/.local/share/applications/example.desktop
update-desktop-database ~/.local/share/applications/
```

1. Lastly, you’ll need to restart the app for the changes to take effect.

#### Sources

- [Execution environment configuration](https://www.freedesktop.org/software/systemd/man/systemd.exec.html?ref=ctrl.blog), version 240, 2018-12-21, systemd, FereDesktop.org
- [File naming](https://web.archive.org/web/20190104040607/https://standards.freedesktop.org/desktop-entry-spec/1.2/ar01s02.html), version 1.2, 2017-12-24, Desktop Entry Specification, FreeDesktop.org
- [systemd 236 announcement](https://lists.freedesktop.org/archives/systemd-devel/2017-December/039996.html?ref=ctrl.blog), 2017-12-14, Lennart Poettering, systemd-devel mailing list, FreeDesktop.org
### Compared DNS caching/TTL of different CDNs
URL: https://www.ctrl.blog/entry/cdn-dns-ttl/
Last updated: 2026-08-23T22:03:02.000Z
Choosing the right content delivery network (CDN) can help your visitors avoid having to pay a performance cost for something that almost never happens. Longer domain name cache times can improve your overall performance and reliability.

The time-to-live (TTL) is the number of seconds that client and intermediary DNS resolvers can cache and reuse the same DNS responses without having to make another lookup. Longer cache times means fewer repeated (and most of the time redundant) lookups and fewer lookups means better performance.

I’ve [compared budget CDN providers](https://www.ctrl.blog/entry/budget-cdn-review/) before, and you can find lots of single-connection performance testing metrics for every CDN provider on the market. However, I couldn’t find any published metrics comparing the DNS time-to-live values used by budget as well as some market leading CDN providers.

To fill this knowledge gap, I decided to do some investigations on my own. So, I collected the TTL (in seconds) returned by a selection of the most popular and some budget CDN providers as of 2018-12-14:

| Name            | Time-to-live |
| --------------- | ------------ |
| BelugaCDN       | 600          |
| BunnyCDN        | 35           |
| CDN77           | 1            |
| CDNSun          | 180          |
| Cloudflare      | 300          |
| Fastly          | 30           |
| KeyCDN          | 60           |
| Incapsula       | 30           |
| Microsoft Azure | 60           |

As I explored when looking into [client side DNS caching](https://www.ctrl.blog/entry/dns-client-ttl/), web browsers can be assumed to cache a DNS query for a minimum of 15 seconds. Most will cache it for one to two minutes, however. The minimum TTL should ideally last at least as long as most visitors’ sessions; ensuring that they won’t need to perform more than one DNS lookup for the duration of their visit to your website.

When deploying a regular pull CDN (a reverse-proxy), website owners redirect their DNS using a `CNAME` record that points to another domain operated by the CDN provider. Websites can optimize their end of the lookup process (the `CNAME` record) by making sure it has a long TTL. However, the domain returned by the `CNAME` is controlled by the CDN provider which returns the actual `A` and `AAAA` records and sets their TTL times.

The TTL may not only impact secondary requests but also the initial load time as its more likely that a given DNS cache will already have cached DNS records from before with longer TTLs. A quick cost–benefit analysis of increasing TTL from half a minute to ten minutes you risk up to ten minute downtime in rare circumstances but gain a 100–400 ms reduction in everyday page load times.

So, why do most providers set so short TTLs? Their service level agreements may guarantee a certain level of up-time, they may not trust their own infrastructure’s ability to withstand a distributed denial of service (DDoS) attack, they may have an over-reliance on DNS based load balancing, or they may not care that much about performance. In other words, an unbelievably good service-level agreement (SLA) may come at the expense of network performance.

A TTL lower than at least a couple of minutes should be a red flag in terms of performance and the expected reliability of the service provider’s offerings.

> "Lots and lots of websites and Internet services use pretty short lifetimes on their DNS records. And they do this because if a data center goes down, they want to be able to update the DNS and very rapidly direct traffic to a different data center.  
>  
> The problem with this approach is you’re paying a performance cost for something that almost never happens. Data centers very rarely go down."

Stuart Cheshire, Session 714, Apple WWDC 2018

#### Sources

- [In the two years since Dyn went dark, what have we learned? Not much, it appears](https://www.theregister.com/2018/10/11/dns%5Finsecurity%5Fsurvey/?ref=ctrl.blog), 2018-10-11, John Leyden, The Register
- [Introducing Network.framework: A modern alternative to Sockets](https://developer.apple.com/videos/play/wwdc2018/715/?ref=ctrl.blog), 2018-06-23, Josh Graessley, Session 715, WWDC 2018, Apple
- [Optimizing Your App for Today’s Internet](https://developer.apple.com/videos/play/wwdc2018/714/?ref=ctrl.blog), 2018-06-23, Stuart Cheshire, Session 714, WWDC 2018, Apple
### 6 places to report phishing emails and websites
URL: https://www.ctrl.blog/entry/report-phishing/
Last updated: 2026-08-23T22:16:59.000Z
*Report phishing emails and websites* when you encounter them! It only takes a minute and helps protect everyone on the web. Here are six places to report phishing emails and websites.

It’s easy to just ignore a phishing email or website. You’re, of course, smart enough to realize you’re looking at a fake version of your online bank. However, would you realize that if you were feeling a bit under the weather or when you’re quickly checking emails on your phone after a night on the town? Please do take the time to report phishing immediately when you encounter it!

It takes you half a minute to report it and help protect everyone on the web from those who don’t have the technical literacy to realize there even could be anything like a fake version of Facebook or their bank login page to the most sophisticated tech elite in a moment of weakness.

Please do take the time to submit a report with all the services to help protect the most number of people and help ensure healthy competition in the field of providing anti-phishing services. Reporting only takes a few seconds and help automatically block access to fraudulent websites in web browsers that integrate with these services.

### Where to report phishing websites

Note that you should only report websites that pretend to be another website for the purpose of stealing login credentials, credit card information, or other personal information. Google and Microsoft also welcome reports of websites that distribute malware.

1. [Google Safe Browsing](https://safebrowsing.google.com/safebrowsing/report%5Fphish/?hl=en&ref=ctrl.blog)
2. [Microsoft SmartScreen](https://www.microsoft.com/en-us/wdsi/support/report-unsafe-site-guest?ref=ctrl.blog)
3. [Netcraft Anti-Phishing](https://report.netcraft.com/report?ref=ctrl.blog)

The lists are ordered by how many potential people benefit from the service taking action against a reported phishing website. Google’s blocklisting services is integrated into almost every popular web browser.

No registration is required to submit phishing links to any of these services. However, submissions to Microsoft will go faster if you login with your Microsoft Account.

### Where to report phishing emails

You must register an account to submit phishing emails to these services. Note that you should only report emails that pretend to be from a trusted organization for the purpose of stealing login credentials, credit card information, or other personal information.

1. [Cisco PhishTank](https://www.phishtank.com/add%5Fweb%5Fphish.php?ref=ctrl.blog)
2. [Cisco SpamCop](https://www.spamcop.net/?ref=ctrl.blog)
3. [Anti-Phishing Working Group](https://apwg.org/reportphishing/?ref=ctrl.blog)

The lists are ordered by how many potential people benefit from the service taking action against a reported phishing email. So, it’s also ordered by how much value the greater internet community gets from your time.

SpamCop also welcome reports of other types of unsolicited bulk spam emails. In some instances, reports to SpamCop are sent to the perpetrator’s internet service or hosting provider that may choose to pull it offline.
### Redesigned with larger fonts and shorter line lengths
URL: https://www.ctrl.blog/entry/large-fonts-cpl/
Last updated: 2026-08-23T22:12:52.000Z
I don’t get many comments regarding the design of this site. However, I recently made the main text block 160 px narrower than before and some regular readers got in touch to let me know they weren’t happy with the change.

First of all, thank you everyone for caring enough to notice the design tweak and thank you for taking the time to send me feedback!

I make small change and improvements to this site all the time, but this is the first change that generated a small torrent of comments. I decided it was best to address this in an update here on the blog rather than replying to everyone individually. I’ll use an questions and answers format to address your concerns.

*“What did you do‽”*

I reduced the width of the main content from 704 pixels wide to 544 px wide, and increased the font size from 16 px to 18 px. Or from roughly 44em at 100 characters per line (CPL) about 32em wide and 66 CPL.

The desired outcome was to reduce the CPL and line length to improve readability.

*”704 px? 544 px? Where do you get these sizes from?”*

Long story short, it’s a number that just happens to be well suited for video content. They’re true 16×9 resolution widths, meaning that both the width and height of a 16×9 videos and images are divisible to an integer number.

I’ve generally stuck with sizes on pages where I might embed videos to true 16×9 resolutions to take advantage of hardware-optimized video decoding at the most common video resolution.

*“Why make the text bigger and the column narrower? Isn’t that just a thing for people with poor eyesight?”*

I wanted to improve readability and accessibility. Larger text and fewer characters per line is easier and faster to read for most people. Many studies have found that 40–80 CPL is the ideal size for reading on screens. 66 CPL is near the middle of that range and also a common CPL used in modern print.

The longer the line the more times you’ve to move your eye along the line to be able to read it. Longer lines introduces more opportunity for loosing your place in the text and skipping over a line by accident. The following illustration tries to simulate the movements your eyes have to make red line) and where your eyes rest (red dots) when reading a text with a low-CPL versus a high-CPL.

![Eye movements along a line of text](https://cdn.synaps.media/control/content/images/2026/08/eye-tracking-cpl.png)

Everyone reads a little different and everyone’s reading skills and comprehension levels aren’t the same. However, I believe the new design will make it easier for more people to get through a text.

*“If narrow is so darned much better, why didn’t you change it before?”*

Vanity. I liked the appearance of dense blocks of text that I’d written. I wouldn’t even entertain the idea of making them appear less information-packed by adjusting their appearance to allow for better readability.

I’ve also been a little hesitant to make this change as no one has ever complained about the lines being too long, whereas a few people have noted they think they’ve been a bit too short. This last group of people have all had huge displays that they may feel are going to waste unless websites put something these.

I’ve found myself getting more and more irritated over overly long lines of texts and tiny fonts used on the web. I realized I’d to tidy up my own website before I could complain about anyone else’s. I’d also started using the reader mode in Firefox to get through reading my own articles.

*“You only did this change to squeeze in more/larger ads!”*

What is funny to me is that people have been upset with me for this change because they believe it represents a compromise to fit more or larger advertisements onto the site. However, the ad density is lower than before even though there are the exact same number of ads on each page and they’re roughly in the same places before.

The old 704 px design was made with the then standard 728×90 px web-ads size (with a 12 px margin on either side.) It was also chosen to fill up the screen on then common desktop resolutions minus margins and a 300x600 px wide advertisement banner.

The new narrower design doesn’t compromise on readability for the sake of accommodating any particular sized advertisement.

*“Okay – not what I expected. Anything else?”*

I’ve seen improvement on two key metrics for this blog after making this change. The page-abandonment rates have gone down (people who leave the page in 10 seconds or less) and the time-on-page have gone up. I believe that’s because more people now read more of my articles and aren’t deterred or intimidated by densely packed text blocks.

This “redesign” also reduced the number of design differences between the small, medium, and large screen optimized version of the site design. This in turn enabled me to delete some styling instructions and thereby make pages load faster for everyone.

Oh, and for you CSS geeks out there: I’m using pixels rather than em units because the latter explode when they come in contact with @media queries, or devices with screen pixel ratios in floating numbers on Windows.

I hope that helps explain the change to everyone who had concerns about the change. Thank you everyone who sent in your comments about this change!

#### Sources

- [Make It Big! The Effect of Font Size and Line Spacing on Online Readability](https://pielot.org/pubs/Rello2016-Fontsize.pdf?ref=ctrl.blog), 2016-03-05, Martin Pielot; Luz Rello, and Mari-Carmen Marcos
- [List of True 16∶9 Resolutions](https://pacoup.com/2011/06/12/list-of-true-169-resolutions/?ref=ctrl.blog), 2015-10-13, Etienne Levesque Guitard, personal blog
- [4 reasons I use large type](http://mikeyanderson.com/optimal%5Fcharacters%5Fper%5Fline?ref=ctrl.blog), 2014-06-30, Mike Anderson, personal blog
### How to get to the Microsoft Feed in your web browser
URL: https://www.ctrl.blog/entry/microsoft-feed-hummingbird/
Last updated: 2026-08-23T22:14:18.000Z
Microsoft released a new personalized news feed stream under the name “Hummingbird” earlier this month. The app is built on MSN/Bing News and was made available for Android and iOSand in the United States only.

**Update** (2022-10-15): The Microsoft Feed service has been discontinued.

**Update** (2021-04-21): The mobile apps are no longer available for download, but the webapp version is still up and running.

The app is designed to suggest things for you to read based on what new stories you’ve clicked on previously. In other words, it’s a true echo-chamber/filter-bubble and you shouldn’t rely exclusively on a service like this for your daily news fix.

These things always interest me and I get curious about how its news recommendations were like and generally how it worked. It was clear to me that the app is a website packaged as an app, and it only took me a few seconds to find the source URL that works in any modern web browser:

`https://www.bing.com/helixfeed/app`

The only thing that doesn’t work in the web-app version is the login system and share sheets. The app will still personalize to you based on your use even when you don’t login, however. You just can’t synchronize your preferences between devices or maintain a persistent data trail tied to one of your social logins.

I consider this to be a bonus feature as you’ll be able to reset the recommendations by clearing your cookie for `bing.com`. Opening a news story opens it just like any other webpage, so you can share the link from there instead of from within the web app.

The app only work with English language content, but it’s not limited to news organizations in the United States. It happily suggested me news from both local English-language news from Norwegian news organizations, other parts of the English-speaking world, and some more controversial news sources like Reddit, Russia Today, and Breitbart News.

Data isn’t sourced exclusively from [Bing News partners](https://pubhub.bing.com/?ref=ctrl.blog), but also pull in viral video content from Reddit and Facebook, and niche blogs from Medium and even seemingly random discussions from the Stack Exchange network of questions-and-answers websites.

The app is a bit confused about its own identity. It references itself interchangeably as “Helixfeed”, Bing My Mix, Bing Feed, and Microsoft Feed. The app’s reverse domain identifier (as used by the iOS App Store and Google Play Store) suggests the final name will be Microsoft Feed.
### A survey of DNS caching and TTL in end-user client software
URL: https://www.ctrl.blog/entry/dns-client-ttl/
Last updated: 2026-08-23T22:05:12.000Z
How long do Domain Name System (DNS) client software like web browsers cache DNS query responses? It can be difficult to determine, so I’ve prepared an overview over the DNS caching behavior of the most popular client software. Clients vary by as much as anywhere from 2 seconds to infinity!

DNS records come with a time-to-live (TTL) hint in seconds that suggest how long a cache can consider the response to be fresh, and reuse it to answer subsequent queries before having to refresh it. Different DNS clients treat this hint differently: and either ignore it completely in favor of their own policies, or enforce minimum or maximum duration on the records.

The below table shows how long a positive DNS response containing an A or AAA record is cached in different common DNS client implementations. Negative responses (resolution failures) where not meassured.

| Implementation   | TTL honored | Min-TTL | Max-TTL  | Entries  |
| ---------------- | ----------- | ------- | -------- | -------- |
| Android          | No          | 2 sec   | 2 sec    | 16       |
| Chrome/-ium      | No          | 1 min   | 1 min    | 1000     |
| dnsmasq          | Yes         | 0\*     | 68 years | 150\*    |
| Java             | No          | Session | Session  | 150\*    |
| mDNSResponder    | Yes         | 15 sec  | 48 days  | 512+ KiB |
| Mozilla Necko    | No          | 2 min\* | 2 min\*  | 400\*    |
| Necko (Win32)    | Yes\*       | 1 min\* | 68 years | 400\*    |
| systemd-resolved | Yes         | 0       | 2 hours  | 4096     |
| Trident          | No          | 30 min  | 30 min   | 128      |
| WebKit           | No          | 1 min   | 1 min    | 400      |
| Windows DNS      | Yes         | 0       | 2 days\* | 2 MiB\*  |

\* Configurable.

There’s a lot to unpack in this table, not at least what these clients are and where you may encounter them. I’ll quickly go through every one in turn.

Note that there may be multiple DNS caches involved. A single response could be cached in Firefox, the Windows DNS cache, and in dnsmasq on the end-users router in additional to their ISP’s DNS cache. Each step in the chain can reinforce their own policies and even rewrite the original DNS response accordingly.

### Android

The Android platform (excluding the Chromium WebView) version 4.1 and newer store up to 16 addresses for exactly 2 seconds at a time. The oldest address is discarded when the cache is full. Android 4.0 and older stored the same number of addresses for up to 10 minutes. The TTL value is ignored. Apps can override these values and maintain their own cache.

### Chromium

Chromium based web browsers, even on Android and including Chrome OS, store up to 1000 addresses for exactly 60 seconds. The oldest address is discarded when the cache is full.

### dnsmasq

dnsmasq is the first implementation to support the TTL field and it doesn’t enforce a minimum TTL value by default. It can be configured to enforce a minimum up to 1 hour, however.

You may find dnsmasq in Linux desktop setups, inside edge routers, and even running on some Android devices as a standard component of the Android Open Source Project. I’ve checked six different generation and brands of Android devices, and they all have it installed but not running.

### Java

The Java runtime running with a security policy, except on Android, will cache DNS responses for the duration of the session – potentially to infinity. Java running without a security policy doesn’t cache anything by default. The default cache duration is configurable regarding of runtime policy. Java always disregard the TTL.

### mDNSResponder (also known as mdnsd)

You’ll find mDNSResponder responsible for DNS caching in iOS and MacOS devices, as well as some network equipment. It’s also distributed as part of the Android Open Source Project, but it’s not running as a cache on any of my test devices. Safari/WebKit doesn’t have an internal DNS cache and rely entirely on the system-wide mDNSResponder.

**Update** (2019-11-12): Safari/WebKit has now added its own DNS cache. It holds up to 400 addresses for 1 minute. This cache is used in addition to any operating-system level caches, such as mDNSResponder.

mDNSResponder is the second implementation to support the TTL. However, it enforces a minimum TTL of 15 seconds and can store an unlimited number of actively used DNS responses. It will begin asynchronously update records if requested if there’s less than 15 % left of their TTL. This is why other research suggest that mDNSResponder’s minimum TTL is 12,5 rather than 15 seconds.

### Mozilla Necko

The Mozilla Gecko Networking Library (Necko), as used in Firefox and Thunderbird, will cache up to 400 DNS responses for at least 1 minute and up to 2 minutes. If a request is processed after the first minute, it will get a cached response while Necko asynchronously updates the cached record and extends the cache for another 2 minutes.

On Windows, Necko behaves quite differently to how it behaves on other operating system. It will cache entries for a minimum of 1 minute and up to the full duration specified by the TTL.

Mozilla experimented in 2018 with doubling the cache from 400 records to 800 records but only saw less than 1 % improvement in cache hit ratio. The experiment was concluded and Mozilla decided to stick with the existing 400 limit.

The DNS cache in Firefox is isolated betwen regular and private browsing modes. However, the whole DNS cache is reset after closing all private windows. The Tor Browser (built on Firefox and Necko) does neither resolve nor cache DNS locally.

### systemd-resolved

systemd-resolved is enabled by default in Ubuntu 16.04 and later as well as in derivative Linux distributions. I’d not be surprised to learn that it will be shipping as the default DNS cache in many consumer grade edge routers in the future.

It can store up to 4096 DNS responses for up to two hours. It honors the TTL field and despite online claims to the contrary, systemd-resolved doesn’t enforce a minimum TTL except on negative responses.

### Trident

Internet Explorer’s Trident engine is more of a historical curiosity than a real-world concern. However, Trident is still used inside some components of Windows and in third-party browsers and other programs.

Trident stores up to 128 addresses for 30 minutes. Older cache entries expire earlier if newer entries get added ot the cache. This is the longest enforced minimum TTL and 1400 % longer than the second longest minimum TTL.

### Windows DNS Client

The Windows DNS Client, interchangeably called Microsoft DNS Client or simply DNSCache, stores up to 2 Megabytes of cache data for up to 2 days. (This cache is separate to the DNS cache in Trident.)

There’s virtually no information available on recent versions of the Windows DNS Client. It also behaved inconsistently even on the same computer when testing just seconds apart. Two days is my best guess at what the maximum TTL is, though it can be longer and shorter.

Trident and Windows DNS are the only two proprietary implementations in this list and the only two of any note. The other implementations have been confirmed by both testing and source code review. However, Microsoft’s two implementations is based primarily on testing – that notably returned inconsistent results. There seems to be a demand or memory based limiter involved that behaves unpredictably.

### Bonus: Public DNS resolvers

Google products, including the Google Chrome web browser and Chromecast, will use the Google Public DNS resolver service by default instead of the system-configured DNS provider (often discovered via DHCP). Because of this, I thought it would be interesting to look at a few of the global free DNS resolvers that promote themselves as either being faster or more secure than traditional DNS providers.

| Service Provider  | Min-TTL | Max-TTL  |
| ----------------- | ------- | -------- |
| Google Public DNS | 0       | 6 hours  |
| OpenDNS           | 0       | 7 days   |
| Quad9             | 0       | 12 hours |

Google has documented their 6 hour maximum TTL value for DNS caching. OpenDNS claims to support “full TTL”. However, it appars to be capped at one week. This is a sensible maximum for a public recursice DNS service.

I’ve tried to determine whether these services have a transparent minimum TTL and perform asynchronous updates to their caches. This could help explain how they manage to provide faster DNS responses than other services. However, testing results have been completely inconclusive for all services. Please let me know through the feedback link below if you do manage to get a more definitive answer to this question.

#### Sources

- [The Road to WebKit 2.26: a Six Month Retrospective](https://perezdecastro.org/2019/webkit-2.26-six-month-retrospective.html?ref=ctrl.blog), 2019-10-28, Here's Adrián, Perezdecastro
- [cache.c](https://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=blob;f=src/cache.c;h=8662f540cd943e8f1a8654539ed4dec23d148bc4;hb=HEAD&ref=ctrl.blog), commit 8662f540cd, 2018-12-10, dnsmasq project repository
- [Frequently Asked Questions](https://developers.google.com/speed/public-dns/faq?ref=ctrl.blog), 2018-10-29, Google Public DNS, Google Developers, Google
- [resolved-dns-cache.c](https://github.com/systemd/systemd/blob/3740146a4cbd99883af79e375ee4836206dcea4e/src/resolve/resolved-dns-cache.c?ref=ctrl.blog), commit 3740146a4c, 2018-08-13, systemd project repository, GitHub
- [DNS: revert the doubled cache size](https://bugzilla.mozilla.org/show%5Fbug.cgi?id=1475781&ref=ctrl.blog), issue 1475781, 2018-07-14, Daniel Stenberg, Firefox Bug Tracker, Mozilla
- [OpenDNS can Cache a Domain for Full Time-to Live (TTL)](https://support.opendns.com/hc/en-us/articles/227987027-OpenDNS-can-Cache-a-Domain-for-Full-Time-to-Live-TTL?ref=ctrl.blog), 2017-05-16, Matt Prytuluk, OpenDNS Support, OpenDNS, Cisco
- [host\_cache.cc](https://chromium.googlesource.com/chromium/src/+/308689687fe41bea875adddc978151b31c88164d/net/base/host%5Fcache.cc?ref=ctrl.blog), commit 308689687f, 2013-01-11, Chromium project repository, Google
- [java/net/AddressCache.java](https://android.googlesource.com/platform/libcore/+/afd70b773bd938c845a3bb0d9a3e21ec64d4db1a/luni/src/main/java/java/net/AddressCache.java?ref=ctrl.blog), commit afd70b773b, 2012-02-06, Android Open Source Project repository, Google
- [host\_resolver\_impl.cc](https://chromium.googlesource.com/chromium/src/+/a27308823dcdc002d05a355404dca725532e1697/net/base/host%5Fresolver%5Fimpl.cc?ref=ctrl.blog), commit a27308823d, 2012-01-21, Chromium project repository, Google
- [DNS records and TTL – how long does a second last?](https://00f.net/2011/11/17/how-long-does-a-dns-ttl-last/?ref=ctrl.blog), 2011-11-17, Frank Denis, personal blog
### Embrace systemd-resolved
URL: https://www.ctrl.blog/entry/systemd-resolved/
Last updated: 2026-08-23T22:22:57.000Z
This article is meant to dispel an internet myth that says `systemd-resolved` is pointless and isn’t doing you any good. `systemd-resolved` is almost guaranteed to be useful for any Linux device that accesses the internet and can optionally be configured to boost your privacy and security.

First things first:

### How to tell if your system is already using `systemd-resolved`?

Ubuntu 16.04 and later as well as any derivative Linux distributions use `systemd-resolved` by default. If you’re not sure whether you’re using `systemd-resolved` or not then we can quickly establish that by running the following command:

```shell
systemctl -n0 status systemd-resolved && \
  head -n1 /etc/resolv.conf
```

The command should return: “\# This file is managed by man:systemd-resolved(8). Do not edit.” This means that your system is indeed using `systemd-resolved`.

If you do want to edit this file, then the configuration example in the bottom of this article will show you how to set the DNS server to something else. You can also read [How to take back control of /etc/resolv.conf](https://www.ctrl.blog/entry/resolvconf-tutorial/) if you want to configure this file manually.

### Improving DNS responsiveness with caching

`systemd-resolved` caches DNS query responses by default. This means that it can quickly respond to repeated queries for the same domains even when they come from different programs on your system. But is this useful to you on your system?

Before performing the next step, either let your system do its thing for a little while or otherwise use the system as normal for some minutes. Afterward, you can run the following command to determine whether `systemd-resolved`’s DNS cache is doing you any good:

```shell
resolvectl statistics
```

This will return some statistics that should help prove the worth of `systemd-resolved`. The cache can store up to [4096 DNS responses for up to 2 hours](https://www.ctrl.blog/entry/dns-client-ttl/), so don’t expect to see a massive number listed as the current cache size. You need not be afraid that the cache will bog down your system memory either. A quick calculation shows that the DNS cache can’t grow to more than 420 kB when used to its fullest.

What is more interesting is the next two numbers: cache hits and cache misses. The last number is the number of DNS queries that had to be forwarded to an external recursive DNS server, whereas the first number is the number of queries that were resolved immediately without the need to reach out to an external server. Every cache hit is an instance where `systemd-resolved` made your system just a little faster.

Your cache hit ratio will vary greatly depending on how you use your system and [the software you use](https://www.ctrl.blog/entry/dns-client-ttl/). You’re more likely to see a higher cache hit if you use GNOME Web or Chrome and less likely when using Firefox.

Firefox’s has its own internal one–two minutes DNS cache that means its cache will handle a lot of queries that would be handled by `systemd-resolved` if you’re using a browser with a shorter internal DNS cache (anything built on Chromium) or no internal DNS cache (anything built on WebKit.)

### Enhancing DNS privacy and security

DNS queries and responses have traditionally been unencrypted, but more and more resolvers now support DNS over an encrypted TLS connection (DNS over TLS.) TLS can help ensure that no parties between the DNS server and the resolver can see or modify the DNS responses.

This means that someone on the same public network at a café can’t see what you’re doing through your DNS request, and also means that your internet service provider nor your local government can see into your traffic either.

`systemd-resolved` only supports opportunistic DNS over an encrypted channel. Opportunistic here means that it will reach out and connect over TLS when available, but it won’t verify that it’s connecting to the correct server; make it susceptible to the attacker-in-the-middle interception as described in [Actually secure DNS over TLS in Unbound](https://www.ctrl.blog/entry/unbound-tls-forwarding/). Attempting to use encryption is still a step up from no encryption at all, however!

You can enable this option (make sure you use a DNS provider that supports DNS over TLS and DNSSEC) by adding the following options to the `/etc/systemd/resolved.conf` file:

```ini
[Resolve]
# Use Quad9.net DNS, and Cloudflare DNS.
# Both supports DNS over TLS and DNSSEC,
# and promises not to log DNS queries.
DNS=2620:fe::fe 9.9.9.9 \
    2606:4700:4700::1111 1.1.1.1
FallbackDNS=2620:fe::9 149.112.112.112 \
            2606:4700:4700::1001 1.0.0.1
# Attempt to use DNS over TLS.
DNSOverTLS=opportunistic
# Enforce DNSSEC validation.
DNSSEC=true
```

You must restart the `systemd-resolved` service (the command is `systemctl restart systemd-resolved.service`) for these options to take effect. You can learn more details about the available configuration options in the `resolved.conf` manual.

The statistics command, shown above, also output some statistics over the effects of DNSSEC enforcement. DNSSEC helps prevent a potential attacker from modifying your DNS responses, but `systemd-resolved` doesn’t enforce this by default. The intricacies of DNSSEC is out of scope for this article, however.

When you need strong security and privacy, then you’ll need to set up a more capable DNS resolver than `systemd-resolved` such as [Knot Resolver](https://www.ctrl.blog/entry/knot-dns-resolver-tutorial/) or [Unbound](https://www.ctrl.blog/entry/unbound-tls-forwarding/). These more fully features resolvers also support caching more DNS query responses and for much longer than `systemd-resolved`.

#### Sources

- [resolved.conf man page](https://www.freedesktop.org/software/systemd/man/resolved.conf.html?ref=ctrl.blog), systemd 239, 2018-06-22, FreeDesktop.org
### Review of Mailbox.org: Email privacy with a thick German accent
URL: https://www.ctrl.blog/entry/review-mailboxorg/
Last updated: 2026-08-23T22:19:13.000Z
This week, I [migrated my email from FastMail](https://www.ctrl.blog/entry/goodbye-fastmail/), an Australian email provider hosted in the United States, to [Mailbox.org](https://mailbox.org/en/?ref=ctrl.blog), a privacy-focused email service provider hosted and operated out of Germany. I’m using my own domain names for email so changing providers isn’t supposed to be a big deal as my email address won’t change even though I’m changing to a new service provider.

Mailbox.org offers webmail, calendar, and an online office suite starting at just ~~1 Euro/month~~ for 2 GB of email storage (thousands of messages) and 100 MB for file storage including the use of custom domains at no extra cost (many providers charge extra for this). They have some unique privacy-related features like PGP-encryption of all messages at rest (including messages that arrived unencrypted).

**Update** (2021-04-14): Mailbox.org has introduced [new price tiers](https://mailbox.org/en/post/new-price-plans-available-at-mailbox-org-2021?ref=ctrl.blog "“New price plans available at mailbox.org”") starting at 3 Euro/month for the same service level, but you get 10 GB of email storage and 5 GB cloud storage. A 1 Euro-plan is still available, but it no longer includes any cloud storage and no support for using your own email domain.

This will not be an extensive review of everything that Mailbox.org offers but rather focus on my initial impressions after using their email, calendar, and address book services for only two days. I’ll focus on the web tools as there isn’t much to say about the support for standard protocols like IMAP and SMTP (for email), CalDAV (calendars), and CardDAV (contacts).

#### Contents

1. [Data migration](#section-mailboxorg-import)
2. [Web interface, mobile, and accessibility](#section-mailboxorg-interface)
3. [Difficult settings and poor translation](#section-mailboxorg-settings)
4. [Custom domain and identity management](#section-mailboxorg-identity)
5. [Message identified as spam still delivered to my inbox](#section-mailboxorg-spam)
6. [Conclusions](#section-mailboxorg-fine)

See also my [comparison of Mailbox.org and ProtonMail](https://www.ctrl.blog/entry/protonmail-vs-mailbox/).

### Data migration

I was quite surprised to learn that Mailbox.org didn’t offer an IMAP migration tool. IMAP is a standard used for synchronizing email folders, and many commercial email service providers offer migration tools that rely on IMAP to copy over messages from another email service. I’d to manually setup an email client with my old email account and my new Mailbox.org account, and then match up and copy over messages from one to the other.

Calendars and contacts involved a similar manual process of exporting data from my old provider and importing files in Mailbox.org. I’m glad we have common standard file formats so that this sort of data migration is possible, but it still took me some two hours to copy all my data across.

Paragraph two of the [General Data Protection Regulation](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679&from=EN&ref=ctrl.blog) (GDPR), Article 20 Right to data portability also clearly states that data transfers should happen directly between controllers (from company to company without involving a third-party) where technically feasible.

For the domain of email, calendars, and contacts there are well-established and widely supported protocols (IMAP, CalDAV, and CardDAV, or Exchange) for synchronizing data and these protocols are well suited for data transfers from *all* the major email providers. I’d expect there to at least be an IMAP migration tool for emails as a bare minimum.

Mailbox.org has partnered with a third-party company to offer a data migration service that only works with some email providers. This feature costs extra and you also have to agree to share your account passwords and all your data with another company.

This isn’t ideal from a security and privacy perspective, doesn’t comply with the words or spirit of the GDPR, and charging extra for making it convenient for someone to become a customer of your company can’t make any business sense.

### Web interface, mobile, and accessibility

On the face of things, at least on large screens, Mailbox.org looks and behaves like most webmail clients that you may already be familiar with. You can also configure the interface to look and behave more like other popular email providers if you don’t like the defaults.

Support for Firefox (Gecko) and Safari (WebKit) leaves a lot to be desired. When you delete or move a message, or mark it as spam in these web browsers the message will disappear but will often pop back in the folder after a few seconds.

This isn’t an issue I’ve had in any Chromium (Blink) based web browsers, but you should be aware that web compatibility and testing may be an issue if you use any but the current market-leading web browser engine.

The mobile website on the other hand is painful to use in a web browser on Android. The Back button, a key user interaction point on Android and in web browsers in particular, don’t work within Mailbox.org’s webapp. When you open a message you’ve to use their tiny X button instead of the Back button to go back to the parent folder.

On larger screens, you’ll see the folder and message at the same time so you don’t notice the issue as much. Menus pop-ups are weirdly disjointed from where you tap and the Compose message button is all alone on its own toolbar wasting vertical screen space at the bottom of the screen.

The message action buttons (delete, reply, etc.) are uncomfortably small (50 % smaller than in Yahoo Mail and Google Mail), unlabeled, and have a low [2,36:1 contrast ratio](https://webaim.org/resources/contrastchecker/?fcolor=76BB20&bcolor=FFFFFF&ref=ctrl.blog) in a light green color. For reference, a contrast ratio of 7:1 is what is required to pass established web accessibility testing requirements.

The same low contrast ratio is used throughout the interface for link texts and actionable interface elements. The small icon and contrast issue is kind of baffling as there’s evidence of some attempts at making the web interface work with accessibility tools. The low contrast ratio is caused by a misguided effort to use the Mailbox.org brand color *everywhere* even for purposes it’s clearly not suited for.

You can work-around the contrast issue by going into Settings and changing from the Default theme to the Default theme (sic.) This change changes most elements from the low contrast sickly green color to a much more comfortable blue. The Default theme should be the default theme instead of the Default theme to let the service accessible by default. Each theme should also be given a more descriptive and unique name, but vague and confusing option names is sort of the theme for the Settings page.

### Difficult settings and poor translation

The settings page clearly shows that it was designed to fit the underlying technical infrastructure and not around how customers would use it or what goals they may want to accomplish (task-oriented design). I appreciate the level of customization available, but the available settings make no sense to anyone who isn’t extremely well versed in email server software and related standards.

The product is clearly design by engineers that want to expose a configuration option while having existing knowledge of how it works and what the change does, and not by an interaction or product designer who’d try to design a solution for the end-user. Options and their descriptions are weirdly phrased overly technical and the documentation mostly consists of noting that the option exists and not what effect it has.

This problem is made much worse by most texts clearly having been translated verbatim from German to English and losing their meaning (and anything resembling natural sentence structure) in the process. I’m not an English native speaker and I’d rather not call out anyone else’s poor English levels but I’ll still come out and say that Mailbox.org’s translations are bad.

Not everything is translated either. An American customer is expected to know to set their Country to Vereinigte Staaten von America from a long list of country names during registration rather than the United States of America. Frankly, I think that’s expecting too much German knowledge of potential customers.

The selection of which settings are enabled is inconsistent. You can configure messages in your Trash folder to be automatically deleted after 30 days, but not messages in your Spam folder. You can set the first day in calendar week-views to be either Sundays or Mondays: but the first day of the week in monthly calendar views is always locale-dependent regardless of the setting.

### Custom domain and identity management

One of the things I found the most difficult to configure with Mailbox.org was how to set up email delivery handling for my own domain names. There’s no obvious place to set this up on the account Settings page.

The process involves first adding your domain name as a recipient-less email address in the “E-mail Aliases” section once, receiving a confirmation code that needs to be added to the domain’s DNS configuration, and then going through the same process again. Mailbox.org doesn’t remember your domain name after you submitted it the first time so you’ve to submit it a second time on the same screen. After verifying domain ownership you need to change the email exchange (MX) records in your DNS before you can receive any emails.

At this point, you don’t have any way to send outgoing emails from your domain through the web interface. To set up that you also have to go to a screen titled “Alternative Sender”, type in the desired email address you want to send emails from, send yourself a confirmation email that’s sent and delivered to and from Mailbox.org, and click on a link to confirm that you want Mailbox.org to be able to send emails through this address.

This is a baffling set up procedure considering that I’ve already verified ownership of the entire domain and directed all emails sent to that domain to my Mailbox.org account.

Any emails sent from this email address will be sent without a sender-name. To assign a sender name to the email I’ve to leave the Settings page and go to Compose a new email message.

From that page, I can click on the From field and choose “Edit names” which opens a new page that lists all my email addresses and lets me assign a name to each address. As far as I’ve been able to work out, you can’t assign specific signatures to specific sender addresses (e.g. a signature with your company name for your work email address or a personal signature for your private address).

Competing webmail providers and email clients have for the most part settled on a systems where you’ve an Identity manager dialog where you add domains, email addresses, and assign names and email signatures to your different sending profiles.

Mailbox.org could need a unified sending profile or identity manager because their current approach is just way too complicated and confusing without offering any benefits to the customer. The available documentation is helpful in regard to configuring custom domains and addresses, but good documentation in this area is a tiny patch on a bigger interaction design problem.

I was disappointed to learn that Mailbox.org currently doesn’t offer DomainKeys Identified Mail (DKIM) configuration for custom domain names. DKIM is used to cryptographically sign and verify emails as having been sent from a specific domain name. This requires the generation and management of cryptographic keys by the email service provider as well as changes to the domain configuration by the customer. Mailbox.org has stated that they’ll [add this capability in the future](https://mailbox.org/en/post/a-new-logo-a-new-website-new-software-versions-and-new-features-at-mailbox-org?ref=ctrl.blog).

**Update** (2019-02-28): Mailbox.org has rolled out DKIM support for custom domains. It’s less than an ideal setup as every customer domain shares the same cryptographic keys.

### Message identified as spam still delivered to my inbox

By default, Mailbox.org will reject all messages that have been identified as spam. However, I’d like to review these messages in case something important is accidentally marked as spam. This is especially important as I’ve just changed email provider and their spam filters may have had the same training data, and thus behavior, as my old email provider. Therefore I changed the default settings to deliver spam messages to the spam folder instead; which was one of the available configuration presets.

To my surprise (and annoyance), all spam messages ended up being delivered to my inbox instead. I reviewed every setting and read up on the available documentation. As far as I can tell, there was no reason why spam messages would end up in my inbox.

I’d set up some custom filter rules that would direct messages to dedicated folder based on the recipient address. These filters weren’t applied to spam messages either and spam messages that otherwise should have triggered the custom filtering rules also ended up in my inbox.

After reviewing the email headers I was able to confirm that all the spam messages were indeed correctly identified as spam. The option to deliver them to a dedicated folder just didn’t work. I ended up setting up another custom filter that moved all emails with the X-Spam-Flag: YES header to the spam folder.

I also added a second filter to reject emails with a score so high they could only have come from Nigerian princes claiming to have hacked my computer and taken photos of me while watching niche adult content and demanding payments in Bitcoin to sell me enlargement pills from a Canadian pharmacy. I’d expect these two filters to have been part of the default configuration for all customers, though.

I contacted Mailbox.org support about the issue, and they were entirely unhelpful with regards to resolving this issue. I’ve looked through their user forums and noticed other reports of the same problem so I’m no the only customer who’ve experienced this problem. As for first impressions for an email service provider goes, this is a pretty devastating issue.

On a more positive note, Mailbox.org’s spam filters have caught every spam message I’ve received over the last two days except some Norwegian-language ones. I’m guessing that Mailbox.org may not have many customers in Norway so they may not have adequate training data yet. I’m expecting this issue to sort itself out within a little while with a bit of manual spam-reporting from my side.

### Conclusions

I’m not impressed by Mailbox.org’s web interface. Their prices and the overall service offerings are very competitive and I believe they’ve all the pieces necessary to make a good product. I think it’s positive that they focus on customer privacy without setting their prices unreasonably high as other privacy-focused service providers in the market tend to do.

The only feature I miss at Mailbox.org compared to my previous provider, FastMail, is app-specific passwords. App-specific passwords generate a unique password for use with client software (like an email client) that grants these programs access to specific protocols (like IMAP for accessing email) without granting them access to the web interface and the entire user account. I must use the main account password to access my account via client software, which means the password must be stored in multiple locations and quite possibly make it more susceptible to be compromised.

I’ve been able to find workarounds for the issues I’ve encountered and found ways to make Mailbox.org do what I want it to do. However, it was a bumpy road and took much longer than I’d expected. Mailbox.org requires quite intimate knowledge of how email software and standards work. This may be acceptable to some customers, but this probably does needlessly limit their potential customer base.

Mailbox.org could need to hire an interaction experience designer to look over their product and help them iron out some of the rough edges. Involving a microcopy editor and a translation service would also help boost their product quality considerably. They’re so close to having an impressive product, but the poor language and some of the jarring design details ruin the user experience.

I would not recommend Mailbox.org to anyone that doesn’t have the time required to learn about how the service works. Some familiarity with German may be helpful too. I believe any determined customer could work out how to make Mailbox.org work for them, it may be worth considering another provider first.

In a market where most customers get the services you offer for no upfront cost, you’re by definition a premium service when you charge a fee. Mailbox.org isn’t a premium experience, however. I would definitely not recommend Mailbox.org to anyone who doesn’t have good or average eyesight or regularly use screens with poor color accuracy.

You can get a full refund of account credit in the first two weeks. After that, you can [donate amy remaining account credit](https://mailbox.org/en/post/you-can-now-donate-your-remaining-credit-balance-for-a-good-cause-when-you-cancel-6453?ref=ctrl.blog) to one of three charities instead of leaving it in the company’s coffers. Transaction fees for refunds don’t make it worthwhile to refund customers directly but giving customers the option to donate it to a charity is a commendable solution.

**Reviewed:** [Mailbox.org](https://mailbox.org/en/?ref=ctrl.blog)

**Review rating:** 6 / 10
### Goodbye FastMail
URL: https://www.ctrl.blog/entry/goodbye-fastmail/
Last updated: 2026-08-23T22:08:41.000Z
I’ve been with multiple email service providers over the years, and have always used my own domain name so that I don’t get [locked into any particular email provider](https://www.ctrl.blog/entry/email-identity-provider/).

I believe this is important to maintain control over your digital life. To achieve this, it’s crucial to be able to root up and move to another service provider when there’s reason to leave one provider for another. Whether that be for market forces like price, innovation, service policy changes, or as in this case: a change in service trustworthiness ushered in by the introduction of a new law in the country the company operates in.

Long story short: The Australian government don’t believe anyone should be able to keep any secrets from them in any sphere so they’ve voted in a incredible dangerous law that seeks to undermine security and privacy protections on the web.

The Telecommunications Assistance and Access Bill (TAAB or AssAccess) require technology companies like FastMail, Google, Apple, Cisco to provide Australian law enforcement and security agencies with access to all communications without any judicial oversight, transparency, or reason. The only restrictions offered to protect people’s privacy is the vague terms “reasonable and proportionate.”

I’ve a huge problem with the complete lack of transparency and judicial oversight. Companies forced to comply with the law can receive permanent gag orders that will prevent any public discussion regarding when the government can and can’t access someone’s personal communications or what reason they thought they’d to request it in the first place.

For more specific details on the law itself, you can read some interesting takes on it in these well-written write-ups by [Paul Karp for The Guardian](https://www.theguardian.com/technology/2018/dec/08/australias-war-on-encryption-the-sweeping-new-powers-rushed-into-law?ref=ctrl.blog), [Ariel Bogle for ABC News](https://www.abc.net.au/news/science/2018-10-02/proposed-surveillance-laws-draw-international-criticism/10300170?ref=ctrl.blog), and [Mark Nottingham](https://www.mnot.net/blog/2018/08/14/trust%5Faustralia?ref=ctrl.blog) on his personal blog. Or you can watch this quick satire video that does an excellent job of summarizing the bill:

Introducing the Telecommunications Assistance and Access Bill, Juice Media

Email service providers are a soft-target for agencies wanting to test out their newfound powers of investigation. There isn’t much encryption to speak of and emails are most often transported unencrypted between service providers and it’s most often stored unencrypted with your service provider.

[FastMail have voiced concerns](https://fastmail.blog/legal-policy/access-and-assistance-bill/?ref=ctrl.blog) over TAAB and they’ve also noted that they don’t believe that the new bill will have any impact on their customers. That is the only thing they could say that made any business sense.

However, my concern is that this is the last we’ll hear from FastMail regarding the bill. They can’t tell their customers a word about what assistance and access they’re providing to the Australian government or for what reason.

So, we’d never know whether it has had any impact on them or not. The Aussie government could request FastMail to build a tool that gave them a live feed of all emails containing the word “the” and FastMail would have to comply or face huge fines.

I’ve been a customer of FastMail for the last three years (November 2015 – December 2018) after getting tired maintaining my own email server located in my own home. I haven’t had any reason to complain about FastMail’s services and I’m still happy with the service they offer.

They support all the protocols I need to keep my devices and data in sync, and their webmail and groupware tools have been good as well. I haven’t been super-happy with FastMail for hosting their email business on servers located in the United States; a country much criticized for their spying and vast data collection programs. I’ve considered moving from FastMail several times over the past few years over this matter, but haven’t found a comparable email service that I’ve wanted to use instead.

I’ve got one year left on my current FastMail subscription. However, this new bill tipped the scales so far that I’ve decided to migrate off FastMail to a European email provider right away. More details on that to follow in another post.

I’ve self-hosted my own email service for many years before I moved to FastMail. The decision to stop self-hosting came down to time, interest, and repeated hardware failure and frequent power and internet service disruptions at home.

The final straw was when many local businesses stopped sending billing emails to me not because of any fault of my own but because a large infrastructure provider that many of them relied on began blocking outgoing emails to residential IP address ranges.

I’m hesitant to try to host my own email again due to the maintenance work required. Forcing me to build-in surveillance tools into my own instances of open-source communications tools to monitor me seems rather pointless, although I’d have the transparency I’m asking for.

**Update** (2018-12-13): I decided to migrate [to Mailbox.org](https://www.ctrl.blog/entry/review-mailboxorg/).

*So long, FastMail! And thanks for protecting me from all the phishing emails!*
### Steam for Linux is more secure than on MacOS and Win32
URL: https://www.ctrl.blog/entry/linux-steam-sandboxing/
Last updated: 2026-08-23T22:13:28.000Z
2018 have been a terrible year for computer security, and playing games on a computer isn’t all fun and games any more. In this article, I’ll take a look at some of the security challenges of downloading and installing games from developers you’ve no reason to trust. I’ll then explore how recent advancements for security on the Linux desktop now have made it a more secure environment to run untrusted software and games than more the popular MacOS and Windows 10 operating systems.

Steam is an online games store and game-library-as-service vendor popular among millions of customers worldwide. The nature of the service means that Steam is selling and distributing executable programs that may be malicious. We can only assume that Steam takes great care not to allow malicious code onto their platform. However, this is almost impossible to achieve on relatively open-platforms like MacOS, Windows, and indeed the Linux desktop.

### Steam Store security is far from perfect

Valve’s task to policy its catalog of over 29 200 games, many of which are still periodically updated by their developers and also receive add-ons developed by an army of third-party developers known as “modders”. Saying it’s quite the challenge is a massive understatement. 2018 haven’t been a good year for customer trust in the Steam platform’s ability to detect and block malicious code from getting onto their store.

In February 2018, a game add-on developer bundled a utility program designed to **steal users’ passwords from the Chrome web-browser** in what the developer described as a anti-piracy protection mechanism. This should obviously never have been allowed on the Steam Store, but there are no inherent protections against this type of behavior from software.

Valve’s own Anti-Cheat System (VAC) is also known for rummaging around on your hard drive looking at installed programs, recent downloads, and even your domain name system (DNS) resolver cache/history trying to identify known cheat programs.

In mid-2018, only one month after Steam said they’d change their moderation policies to “allow everything onto the Steam Store”, a game shipped an embedded crypto-currency miner; exploiting customer’s computer resources to mine for virtual gold. Steam’s content moderation policy change may have been aimed at adult -themed and controversial game-content, but the crypto-currency miner would also possibly have been more easily noticed by a human reviewer spending a few minutes with the game itself.

The old moderation process wasn’t bullet proof either. In 2016, a security researcher masquerading as a game developer were able to **approve and publish his own game**, Watch Paint Dry, on the Steam Store and completely bypassing Steam’s content moderation process.

Anti-cheat protection systems, digital copy protection systems, as well as outright malicious software should not have full system access! Ideally, you’d want to use a dedicated computer that you don’t use for anything else. However, this requires additional hardware, additional space, and can be cost-prohibitive. You can use an operating system like [Qubes OS](https://www.qubes-os.org/?ref=ctrl.blog) that separates everything you do in separate virtual systems. This requires specific and expensive hardware and has a step learning curve and possibly a large performance cost. So, what can we do instead?

### Isolating Steam games from the rest of the system

Remember how much fun you’d playing in a sandbox when you were a child? It’s not been much fun as an adult, but recent security-software enhancements have made it possible to enjoy your Steam game library on Linux from the security of a confined sandbox.

What that means in practice is that a properly sandboxed software or game won’t be able to do the sorts of things traditional unrestricted software was capable of. It couldn’t steal your web browser passwords or rummage through your emails or personal files; it wouldn’t have any access to it and wouldn’t even be aware of other software you’d installed on your system. Unless the sandbox technology itself is broken and bypassed, you should be more secure without noticing any differences in how the software work.

Apps and games distributed through the Mac App Store on MacOS, and to some extend “modern apps” distributed through the Windows Store on Windows 10 have stronger sandboxing restrictions on what they can do compared to games downloaded through Steam. You can’t know for sure that a game you buy will be sandboxed, however. Neither stores have seen much interest from either players or game publishers. Steam offers more advantages to customers than these other stores, such as paying one time for a game and being able to play the game on Linux, MacOS, and Windows on a single license. Steam itself doesn’t have any built-in security sandboxing technology, however.

On Linux on the other side, the platform haven’t bothered waiting for developers to adopt the latest security enhancing technologies. You can now install [Steam for Linux in Flatpak](https://flathub.org/apps/details/com.valvesoftware.Steam?ref=ctrl.blog); an emerging distribution method for Linux software that come with support for containerized/sandboxed software.

Steam itself and any games you install through Steam running in Flatpak will be restricted to a very limited environment. Instead of having access to your entire system and all your files, games will be limited to interfering with only what is installed in the same sandbox such as Steam and other games. A game can ship an update that will try to steal your passwords, but it won’t be able to even see your personal files or even which web browser you’ve installed. Steam and games get read-only access to your personal Music folder for use with the Steam music player and in-game music players, as well as the Pictures folder for storing screenshots. So, you may not want to store your … extra private photos … in the Pictures folder. Other files and folders are strictly off limit, however.

This isn’t perfect security, as there’s no such thing as perfect security. Games can still access hardware like game controllers and your graphics processor, so there are plenty of possible ways to go around the sandbox. Someone may find a way to get around the system and gain access to my personal files.

Gaming in a Flatpak sandbox on Linux offers an unparalleled layer of security compared to other operating systems. I feel an whole lot more confident playing games on a system that I use for other purposes when my games live off in their own little corner with limited access to the rest of the system. Yes, there are more games available for Windows — but that feels less important when you consider that every single one of them could be an avenue for someone to run malicious code or run off with your passwords and personal files.

PS: I’ve previously covered an issue where [Steam Cloud syncing wouldn’t work with Flatpak](https://www.ctrl.blog/entry/flatpak-steamcloud-xdg/). That issue have since been fixed, which was the main issue holding me back from recommending that people install Steam and play games in a Flatpak container.

#### Sources

- [com.valvesoftware.Steam.json](https://github.com/flathub/com.valvesoftware.Steam/blob/f0cb9182526c5af9f7651a18cc9f38e959a863d8/com.valvesoftware.Steam.json?ref=ctrl.blog), commit f0cb918252, 2018-11-27, com.valvesoftware.Steam flatpak repository, Flathub project, GitHub
- [Steam Subscriber Agreement](https://web.archive.org/web/20181124013636/https://store.steampowered.com/subscriber%5Fagreement/), 2018-11-13, Valve Corporation
- [Steam game pulled from store after allegations of cryptocurrency mining](https://www.polygon.com/2018/7/30/17630664/steam-abstractism-cryptocurrency-mining?ref=ctrl.blog), 2018-07-30, Petrana Radulovic, Polygon, Vox Media
- [Valve take a stand against taking a stand on Steam rules](https://www.rockpapershotgun.com/steam-content-restrictions-removed?ref=ctrl.blog), 2018-06-06, Dominic Tarason, Rock–Paper–Shotgun, Gamer Network
- [Flight Sim Company Embeds Malware to Steal Pirates’ Passwords](https://torrentfreak.com/flight-sim-company-embeds-malware-to-steal-pirates-passwords-180219/?ref=ctrl.blog), 2018-02-19, Andy Maxwell, TorrentFreak
- [Valve Patches Security Flaw That Allows Installation of Malware via Steam Games](https://www.bleepingcomputer.com/news/security/valve-patches-security-flaw-that-allows-installation-of-malware-via-steam-games/?ref=ctrl.blog), 2017-07-20, Catalin Cimpanu, Bleeping Computer
- [Watch Paint Dry: How I got a game on the Steam Store without anyone from Valve ever looking at it](https://medium.com/swlh/watch-paint-dry-how-i-got-a-game-on-the-steam-store-without-anyone-from-valve-ever-looking-at-it-2e476858c753?ref=ctrl.blog), 2016-03-29, Ruby Nealon, personal blog, Medium
- [VAC Goes Through Your Files‽](https://steamcommunity.com/app/730/discussions/0/528398719808561998/?ref=ctrl.blog), 2015-08-24, Steam Community Forums, Valve Corporation
- [Valve Anti-Cheat isn’t sending browsing history to the company, Newell says](https://www.polygon.com/2014/2/17/5420948/valve-anti-cheat-gabe-newell-steam-browsing-history?ref=ctrl.blog), 2014-02-17, Megan Farokhmanesh, Polygon, Vox Media
### WebP image file sizes compared to equivalent Guetzli and Zopfli
URL: https://www.ctrl.blog/entry/webp-vs-guetzli-zopfli/
Last updated: 2026-08-23T22:24:20.000Z
I decided to offer WebP images in addition to the traditional JPEG and PNG formats after Microsoft Edge and then shortly after Mozilla Firefox added support for the format. However, I did so blindly assuming that WebP would always produce smaller files without checking that it did what I wanted. A reader called me out on my mistake and pointed out some WebP images were 15 % larger than the traditional file format.

As discussed previously, I use [libvips for image processing](https://www.ctrl.blog/entry/php-libgd-resize-artifacts/) and preparing thumbnails from my source images. I’ve previously used libgd, but that created [unwanted artifacts that hurt compression levels](https://www.ctrl.blog/entry/php-libgd-resize-artifacts/). However, I also use post-processing with the image optimization tool Guetzli for JPEG images and Zopfli for PNG images. These tools help to slash image sizes without compromising on image quality but at the cost of significant memory and processor utilization (a one-time investment.)

You can achieve similar file saving results as Guetzli with MozJPEG (an JPEG encoding library from Mozilla) without the high memory and processing demands, but at the cost of lower visual quality and slightly smaller savings on size. Both are excellent JPEG encoders that does a great job at shrinking files without hurting the visual quality too much. I’ve found that I objectively like the quality of Guetzli encodings over that of MozJPEG as the latter tends to create more noise and artifacts.

Even with the savings you get with Guetzli and Zopfli compared to regular encoders and image optimizing tools, there’s a new file format in town that promises to deliver even smaller images without compromising image quality and without demanding tons of memory and processing time to encode. WebP will be supported natively or through an [installed-by-default-but-possibly-troublesome-plugin](https://www.ctrl.blog/entry/windows-webp-appguard/) in every major web browser except Apple Safari (and thus iOS devices) by the end of 2018.

**Update** (2020-06-27): Apple has now also added WebP support to Safari as of version 14.

I conducted a small study of the file sizes of the roughly 900 unique images each at 7 different image resolutions that are used for this website. I wanted to verify that WebP was reducing page sizes at the different image resolutions I use. As I mentioned in the beginning, a reader had noticed that some JPEGs were smaller than the equivalent WebP file.

The below table shows JPEG file sizes when encoded by libvips at 100 and 88 quality as a baseline, optimized encoding with Guetzli at quality set to 88 (from a JPEG produced by libvips set to 100), and WebP at quality set to 88.

### JPEG and WebP

| Size        | Reference | Optimized |         |         |
| ----------- | --------- | --------- | ------- | ------- |
| JPEG 100    | JPEG 88   | Guetzli   | WebP    |         |
| 96×54 px    | 8,4 kB    | 2,3 kB    | 1,7 kB  | 2, kB   |
| 192×108 px  | 26,5 kB   | 6,1 kB    | 5,2 kB  | 4,9 kB  |
| 320×180 px  | 63,0 kB   | 13,6 kB   | 11,9 kB | 10,4 kB |
| 384×216 px  | 85,1 kB   | 18,1 kB   | 16,0 kB | 13,8 kB |
| 544×306 px  | 155,6 kB  | 32,3 kB   | 28,8 kB | 23,7 kB |
| 640×360 px  | 201,2 kB  | 41,5 kB   | 37,0 kB | 30,2 kB |
| 768×432 px  | 274,0 kB  | 56,0 kB   | 49,7 kB | 28,2 kB |
| 1088×612 px | 491,6 kB  | 99,0 kB   | 89,2 kB | 47,5 kB |

Two things are clear right away: WebP images are significantly smaller at higher resolutions, and there isn’t much saving or even a negative impact on lower resolution images as compared to Guetzli.

The WebP encoding at 96×54 pixels shaved off 14,4 % compared to the JPEG encoding at the same quality. However, the Guetzli JPEG encoding is 11,26 % smaller than the WebP encoding! Guetzli gives a significant reduction in file size compared to the WebP file for images at this size.

At the next size up, 192×108, WebP starts to take the lead with a 6,9 % smaller file size compared to the Guetzli encoding. WebP’s gain on Guetzli goes up steadily from this point on. However, WebP’s lead over Guetzli at this size is still smaller than the negative impact we saw it had on the 96×54 pixels images.

The conclusion here’s to only bother with WebP for small JPEG files if you’re not already processing your JPEGs with an optimizer like Guetzli or MozJPEG. You should also make sure that you’re getting smaller files at the sizes you intend to use.

Now, on to PNG files. The below table shows PNG file sizes when encoded by libvips as a baseline, optimized encoding with Zopfli (`-m`), and WebP (near-lossless, quality set to `98`.) It’s worth noting that the Zopfli optimized encodings are lossless whereas the WebP encodings are made with the near-lossless option at 98 quality. However, I can’t spot the visual differences for most images between these two encoders even when using software to identify the differences for me. Lowering the WebP encoding quality to 97 does almost nothing to reduce file sizes but some tiny bits of noise and artifacts do pop up at this point.

### PNG and WebP

| Size        | Reference | Optimized |          |
| ----------- | --------- | --------- | -------- |
| libvips     | Zopfli    | WebP      |          |
| 96×54 px    | 4,5 kB    | 3,8 kB    | 2,8 kB   |
| 192×108 px  | 12,8 kB   | 10,5 kB   | 7,1 kB   |
| 320×180 px  | 27,9 kB   | 22,9 kB   | 15,0 kB  |
| 384×216 px  | 37,9 kB   | 31,2 kB   | 20,3 kB  |
| 544×306 px  | 68,7 kB   | 57,2 kB   | 37,5 kB  |
| 640×360 px  | 89,7 kB   | 74,6 kB   | 48,9 kB  |
| 768×432 px  | 123,5 kB  | 103,6 kB  | 67,5 kB  |
| 1088×612 px | 209,5 kB  | 171,9 kB  | 114,6 kB |

It’s clear that WebP gives significant savings at every size. However, it’s also worth seriously thinking about when you need to use a PNG and when a JPEG would be good enough. You can save 50 % of the file size by switching from a lossless to a lossy image format where appropriate.

### Should you adopt WebP?

The only hold-out that isn’t expected to support WebP by the end of 2018 is Apple Safari and iOS devices. For everything else on the market, WebP should be a good choice unless you’re dealing with small images. However, if you don’t optimize your JPEG files then WebP could also be beneficial for small image files.

Web browsers will prefer WebP because they assume those files will be smaller. They have good reason to do so, but I found above that might not always be the case. Responsive images in HTML allow for you to supply multiple `<source>` elements with multiple image formats and sizes for the same image. You should keep your existing JPEG or PNG images for backwards compatibility (and compatibility with Safari), and then selectively supply WebP images when these offer significant saving compared to the older formats.

You should verify that WebP is giving any benefit for your images, however. Don’t blindly trust that WebP will be adding value to your website as I did.

There are some compatibility issues still such as [WebP not working in Microsoft Edge for some users](https://www.ctrl.blog/entry/windows-webp-appguard/) dependent on their security settings. Edge prefers to download WebP images even when the browser can’t decode the format because of heightened system security settings.
### Link blog archive pages together to avoid navigational dead-ends
URL: https://www.ctrl.blog/entry/blog-archive-pagination/
Last updated: 2026-08-23T22:02:24.000Z
Many blog publishing platforms will generate yearly or monthly archive pages that lists the posts published in that period. However, most platforms creates dated archive pages as isolated islands and navigational dead-ends with no obvious path forward for visitors.

You’ll find two links near the bottom of most date-based archive page: “Next page” and “Previous page” when there are enough published posts to allow for pagination. However, these links only take you between pages within the given time period. You can provide a better user-experience and improve bot crawling and content discovery by chain-linking the ends of your archive pages to each other.

WordPress has two primary chronological archives: the main index (the front page) and the yearly archives (including the per-month and per-day sub-archives). The main index lists every published post as one continuous list. You navigate the list using the next-and-previous pager links at the bottom of each page. Depending on the sort order, these links take you from newer to older posts offset from the previous page. Using the pager buttons on the main index, you can navigate through every post until you reach the first one ever published and there aren’t any more pages.

The individual yearly and monthly archives follow each other chronologically just like the main index. However, each of these archives are dead-ends when it comes to link-navigation. By default, the 2018 archive only includes the posts from that year sorted chronologically. The pager buttons won’t suggest you go backwards to the 2017 archive or continue forward to the 2019 archive. You’re left stranded on the 2018 archive with no suggestions for where go to next.

A decade ago, some websites would include a calendar widget and let people explore different date-based archives by clicking around on a calendar. This was more common when more people used larger screens that allowed for a massive site-wide sidebar next to the content on every page. A calendar is also a complex user interface that force visitors to make a decision about where to go next.

The default next/previous pager buttons gives visitors the option to just continue browsing the archive in the direction they were already going.

Linking up the dated archive pages to eachother may sound like an obvious thing to do but as far as I’m aware, only Blogger.com will do this by default. Other content management systems, many created in the era when the sidebar ruled all of web design, just haven’t bother with linking up their archive pages to each other.

I’ve added this capability to my own WordPress instance (as you can see on the above archive pages). Unsurprisingly, this change lead to more page-views among people who’re exploring my blog through the archive pages. It also lead to increased search engine indexing of these pages.

I’ve found some WordPress plugins and themes that have tried to do link up disparate archive pages by subtracting and adding one to the current month or year. This can lead to “navigational hazards” as they sometimes blindly link to months or years where there were no posts; creating 404 Not Founds and empty archive pages. It only takes a tiny extra effort to make sure that you only link to the next or previous page that have posts on them.

You can apply similar solutions for other types of archive pages such as tag/topic and category archives. Try to provide good solutions for where a visitor may want to go next when they’ve reached the last page in a topic archive. You could suggest they go back to the front page or to a list of trending posts. Perhaps branch out to other related tags. There are many possible options here and the right choice will be up to how you’ve organized your website.
### Structure WordPress’ upload directory to handle lots of files
URL: https://www.ctrl.blog/entry/wp-content-uploads/
Last updated: 2026-08-23T22:25:52.000Z
This is a quick post about organizing WordPress’ uploads directory, wp-content/uploads, for many files using a file name-derived directory structure.

It’s 2018 and having too many files in one directory can still hurt performance for a number of tools and standard operations like directory listings. It doesn’t help that the file system is theoretically capable of supporting 18,4 quintillion (2⁶⁴) files per directory when you can’t do anything practical with those files.

The need for responsive images (image files that adopt to visitor’s screen size) also amplifies the problem by creating lots of differently scaled copy files for each uploaded image file.

WordPress Core offers exactly one option that can help to reduce the number of files stored in its default file upload directory. The option is called “Organize my uploads into month- and year-based folders” and helps reduce the likelihood of having an enormous amount of folders by placing files into sub-directories based on the year and month the image was uploaded. You get one directory for each year, twelve months, and then everything for that month goes into one directory.

This approach is fine for most uses but has some disadvantages:

- It doesn’t scale well if you upload hundred of images per month (× number of responsive image sizes)
- It places a date in the uploaded file’s URL which may look out of place when you’re reusing old images for new content

There are a million different approaches this particular problem. I chose to derive a short hash from the file name of each upload, and work with its hexadecimal representation (0-9, a-f.) I used the two first characters from the hash to get the first level of 256 (16²) possible directories, and the next two characters to get another 256 possible sub-directories.

This gave me 65 536 (16⁴) possible directories where uploaded files could be stored that each would only contain a small number of files. A third level in this hierarchy would create 16 777 216 (16⁶) possible directories, but this was quite a bit more than I needed.

Inside each of these directories I created a directory named after the file and put the file and all its responsive image sizes to bundle them up in one place. It’s faster to delete a directory than each of the individual files, plus it keeps all the files representing the same image nicely bundled up together.

With a reasonable choice of hashing algorithm, this should distribute the files evenly over all the possible directories. Another benefit is that since the hash only depends on the file name, the same image will always end up in the same directory — even if the date ticks over into a new year while processing or uploading.

This is similar to the approach you’ll see used by disk storage-backed HTTP caching servers.

I haven’t included any example code for this specific approach in this article as I don’t believe it would be directly useful for anyone else. You can implement your custom upload-directory structure by hooking into the `wp_handle_upload_prefilter`, `wp_handle_upload`, and `upload_dir` filters that are provided by WordPress Core. Add your `upload_dir` filter in response to the `wp_handle_upload_prefilter` filter and then remove your filter in `wp_handle_upload`. Remember that you also must create any new sub-directories you come up with inside your `upload_dir` filter function.
### Safari’s default media controls get blocked when CSP is applied
URL: https://www.ctrl.blog/entry/safari-csp-media-controls/
Last updated: 2026-08-23T22:21:35.000Z
I recently ran into an unexpected road block trying to deploy a `Content-Security-Policy` (CSP) on a website that relied on the native media controls provided for the HTML `<audio>` and `<video>` elements in Safari. The default browser-provided multimedia controls were good enough for my purposes and they provide a platform-native user experience to all users. To my surprise, I noticed that there were no usable playback control buttons in Safari on pages with a strict content security policy.

`Content-Security-Policy` is a HTTP response header that servers can send to indicate stricter than default security policies for their origin. To only allow a page to display images and play media from its own origin you’d send a header like this (broken onto multiple lines for readability):

```
Content-Security-Policy:
  default-src 'none';
    media-src 'self';
      img-src 'self'
```

The above example blocks media and images from other origins/domains, and even completely blocks stylesheets and scripts. It’s a good example of how CSP can be used to limit the capabilities if a webpage.

**Update** (2022-03-16): The issue described below was fixed in Safari 15 (released in September 2021). This version is only available on iOS version 15 and newer, and MacOS version 12 and newer.

Safari 11 (for MacOS and iOS 11) and Safari 12 (for MacOS and iOS 12) supplies the icons for the default media control buttons as SVG files loaded over a data URI blob. Safari haven’t made any exceptions for these graphics sourced from the browser itself when processing a content security policy.

The result is that Safari blocks its own default media controls and end up not having any visible icons for them. Safari also sends a content security policy violation report, if the content security policy is configured to so. The default semi-transparent dark toolbar that should hold the icons are visible, and the click-regions for the media controls get small when the icons fails to load.

This is clearly a bug in Safari. The browser’s own graphics *are always trusted* and especially in this context. The default media controls are trusted and won’t get blocked by the same content security policy in other web browsers including Firefox, Google Chrome, and Safari 10 and older. You can follow [WebKit bug #191782](https://bugs.webkit.org/show%5Fbug.cgi?id=191782&ref=ctrl.blog) if you’re interested in updates on this specific issue.

You can’t use a `nonce-source` or `hash-source` to specifically allow only the assets that Safari need either. The only work-around that let you keep using the default controls for audio and videos is to lower the security level of the page by changing the policy:

```
Content-Security-Policy:
  default-src 'none';
    media-src 'self';
      img-src 'self' data:
```

This allows the loading of any image resource from any data URI that have somehow made it onto your page. This can be a security risk as a data URI is considered to be equivalent to the `unsafe-inline` source. This is far from perfect but it’s still a better place to be in than not having a content security policy at all.

Another work-around is to just bite the bullet and design and supply your media controls instead of relying on Safari’s default media controls and graphics. This can be a lot of unwanted extra work when the default media controls would have worked just fine.

This issue is a good reminder that a content security policy requires ongoing monitoring and compatibility testing. New problems and browser can arise at any time and break core functionality of your website.

#### Sources

- [CSP headers can block default <video> controls](https://github.com/WebKit/WebKit/commit/6b6005ff61ecff3fdae5ebab59b15c66837407b0?ref=ctrl.blog), commit 6b6005ff61, 2021-03-21, Devin Rousso , WebKit project, Apple, GitHub
- [Content Security Policy Level 2](https://www.w3.org/TR/2016/REC-CSP2-20161215/?ref=ctrl.blog), 2016-12-15, W3C Recommendation, World Wide Web Consortium (W3C)
### WordPress with PHP GD’s image resize artifact-pattern problem
URL: https://www.ctrl.blog/entry/php-libgd-resize-artifacts/
Last updated: 2026-08-23T22:15:30.000Z
Until now, I’ve been using WordPress with the PHP GD graphics library (libgd) to downscale images for thumbnails and responsive images. The resulting images haven’t always been pretty and they’ve ended up larger than the source images. I finally found a good solution that doesn’t involve switching to ImageMagick.

GD introduces some complex repeating and alternating patterns on downscaled images. On many photos it was almost impossible to see the effect, but on some simple illustrations or images with slight gradients it would be very obvious. The artifacts introduced additional complexity in the images which would yield poor compression.

The below image groups demonstrates an example of the type of noise-artifact patterns that can be added to downscaled images when resizing with PHP+libgd. The rightmost image highlights the differences between the original and downscaled images. *Click the thumbnails for larger versions.*

[![Original image](https://cdn.synaps.media/control/content/images/2026/08/embedded-video-privacy.png)](https://cdn.synaps.media/control/content/images/2026/08/embedded-video-privacy.png?ref=ctrl.blog) 

Original image

[![Downscaled](https://cdn.synaps.media/control/content/images/2026/08/libgd-php-resize-downscaled.png)](https://cdn.synaps.media/control/content/images/2026/08/libgd-php-resize-downscaled.png?ref=ctrl.blog) 

Downscaled

[![Contrast enhanced](https://cdn.synaps.media/control/content/images/2026/08/libgd-php-resize-noise.png)](https://cdn.synaps.media/control/content/images/2026/08/libgd-php-resize-noise.png?ref=ctrl.blog) 

Contrast enhanced

[![Original image](https://cdn.synaps.media/control/content/images/2026/08/google-podcasts.png)](https://cdn.synaps.media/control/content/images/2026/08/google-podcasts.png?ref=ctrl.blog) 

Original image

[![Downscaled](https://cdn.synaps.media/control/content/images/2026/08/libgd-php-resize-downscaled-2.png)](https://cdn.synaps.media/control/content/images/2026/08/libgd-php-resize-downscaled-2.png?ref=ctrl.blog) 

Downscaled

[![Contrast enhanced](https://cdn.synaps.media/control/content/images/2026/08/libgd-php-resize-noise-2.png)](https://cdn.synaps.media/control/content/images/2026/08/libgd-php-resize-noise-2.png?ref=ctrl.blog) 

Contrast enhanced

The first image has a solid background that should be the same color for most of the image. You can see the noise patterns shift in the different encoding tiles. The second image has a more complex background and shows a more varied noise pattern.

The complex patterns, despite being repeating, don’t compress well. The two downscaled example images above take up almost twice the number of bytes compared to the original despite having 46 % fewer pixels. This is after both images being compressed with the state-of-the-art lossless Zopfli compression method.

The core issue seems to be an optimistic cast from floating numbers representing the red-green-blue (RGB) colors to an integer. The resulting color values may vary greatly depending on the processor’s handling of high-precision floating numbers.

A [patch was suggested](https://bugs.php.net/patch-display.php?bug%5Fid=53580&patch=gd.c&revision=latest&ref=ctrl.blog) in 2010 that changed the behavior from cast to rounding the number. This would should have reduced the impact of the issue but at a possibly hefty performance cost. The patch was never picked up by libgd, however.

The most common alternative to libgd is ImageMagick but I don’t consider it to be an option anymore as the library has been plagued with security vulnerabilities in recent years. At the time of writing, the Common Vulnerabilities and Exposures (CVE) List contains 504 different vulnerabilities found in ImageMagick.

WordPress supports GD and ImageMagick out of the box but its image editor handling is modular. Creuna Finland went ahead and made an [Vips Image Editor plugin](https://github.com/CreunaFI/vips-image-editor?ref=ctrl.blog) that uses the [Vips (libvips) graphics library](https://www.libvips.org/?ref=ctrl.blog). Vips is a much more modern and resource efficient alternative to GD and ImageMagick.

Vips produces smaller files than both GD and ImageMagick and it does it faster and without the artifact corruptions of GD or the security baggage of ImageMagick. I still apply additional post-processing with the Guetzli and Zopfli compression methods to make the image files even smaller, though. Vips can also output WebP image files when compiled against libwebp.

I’ve installed Vips and regenerated and recompressed all downscaled and thumbnail images I’d in WordPress. I also took this as an opportunity to generate additional image sizes and also generate WebP images of all sizes to improve responsive image support and to be more bandwidth efficient. The compression gains from switching image processing library made it feasible to store and offer more image sizes for browsers to choose from.

I’ve also noticed that it’s faster to upload new images to WordPress after switching to Vips.

If you definitely have to stick with GD then you can try updating and applying the above patch. If you want to try using a more modern library, I suggest you try using Vips instead.

Thanks to the Vips project for creating an excellent image processing library and thanks to Creuna for bringing it to WordPress.

#### Sources

- [‘libvips’ search results](https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=libvips&ref=ctrl.blog), 2018-11-16, Common Vulnerabilities and Exposures (CVE) List, MITRE Corporation
- [‘ImageMagic’ search results](https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=ImageMagick&ref=ctrl.blog), 2018-11-15, Common Vulnerabilities and Exposures (CVE) List, MITRE Corporation
- [High performance WordPress image processing with VIPS](https://web.archive.org/web/20181120150802/https://www.creuna.com/fi/blogit/high-performance-wordpress-image-processing-with-vips/), 2018-09-10, Johannes Siipola, Creuna blog, Creuna Finland
- [Issue #99: Resize Artifact](https://github.com/libgd/libgd/issues/99?ref=ctrl.blog), 2015, libgd issue tracker, libgd, GitHub
- [Bug #53580: During resize gdImageCopyResampled cause colors change](https://bugs.php.net/bug.php?id=53580&ref=ctrl.blog), 2010-12-21, Valeriy Chevtaev, PHP bug tracker, The PHP Group
### Turkey blocks BunnyCDN; Ctrl blog and 14 000 websites inaccessible
URL: https://www.ctrl.blog/entry/bcdn-blocked-turkey/
Last updated: 2026-08-23T22:02:09.000Z
European content delivery network (CDN) BunnyCDN is currently blocked in Turkey by major internet service providers in the country. The Turkish Information and Communication Technologies Authority’s (BTK) website confirms the blocking.

> “After technical analysis and legal consideration based on the law nr. 5651, administration measure has been taken for this website (b-cdn.net) according to decision nr. 490.05.01.2018.-369183 dated 16/11/2018 of the Information and Communication Technologies Authority.”

b-cdn.net domain query, Turkish Information and Communication Technologies Authority (BTK)

BunnyCDN say on their blog that they’ve appealed the decision with the BTK. Turkey have blocked Wikipedia’s website in the country since April 2017, so I’m not convinced that anything will come of that appeal.

**Update** (2018-11-24): The ban have been lifted and BunnyCDN is once again accessible in Turkey. BunnyCDN haven’t provided any additional details on why they were blocked or whether they’d to make any changes at the behest of the Turkish regulators.

[Turkey Blocks](https://turkeyblocks.org/?ref=ctrl.blog), a website dedicated to monitoring internet censorship in Turkey, confirmed in an email on Monday morning (2018-11-19) that BunnyCDN (and Ctrl blog) is indeed blocked for internet users in Turkey.

The blocking is partially ineffective for some websites, including Ctrl blog, that have deployed custom-domains through domain name system (DNS) CNAME records. Anything that’s served directly from BunnyCDN’s primary delivery domain, b-cdn.net, is inaccessible, however. This is an interesting difference as it shows that the ISP’s understanding of the inner workings of their own DNS server software may be incomplete.

Turkey Blocks were also able to confirm the presence of deep-package inspection (DPI) that looks at the content of users’ data to intercept the HTTP Host header on unencrypted channels as well as server name indication (SNI) domain names in encrypted traffic.

Six weeks ago, I wrote about how the web have become too centralized and [why we need the distributed web](https://www.ctrl.blog/entry/the-dweb/). It all felt very idealistic and theoretical at the time, but today it feels a lot more up close and personal.

I’ve been tinkering with creating a mirror of this website to be distributed through distributed content networks like Dat and InterPlanetary File System (IPFS). These would possibly have been more resistant to internet censorship. This isn’t quite ready yet, though parts of Ctrl blog are now indeed accessible over these networks. More on this later.

In the meantime: Copies of [every article from this website are available through the Internet Archive](https://web.archive.org/web/%2Ahttps://www.ctrl.blog/entry/%2A). The newest articles may not yet be available and they may not all be up to date though I’ve pushed new copies of everything this morning.

#### Sources

- [Turkey Blocks](https://turkeyblocks.org/?ref=ctrl.blog) via email
- [BunnyCDN Domain b-cdn.net Has Been Blocked in Turkey](https://bunny.net/blog/bunnycdn-domain-b-cdn-net-has-been-blocked-in-turkey/?ref=ctrl.blog), 2018-11-17, Dejan Grofelnik Pelzel, BunnyCDN blog, BunnyCDN
- [Turkey marks one year without Wikipedia](https://www.theverge.com/2018/4/30/17302142/wikipedia-ban-turkey-one-year-anniversary?ref=ctrl.blog), 2018-04-30, Paul Benjamin Osterlund, The Verge, Vox Media
### WebP images won’t load in Micro­soft Edge with Application Guard
URL: https://www.ctrl.blog/entry/windows-webp-appguard/
Last updated: 2026-08-23T22:25:31.000Z
**Update** (2020-02-01): This article is about the old EdgeHTML-based version of Microsoft Edge and doesn’t apply to the newer Chromium-based version.

Microsoft Edge version 18, distributed as part of the Windows 10 October 2018 Update, has added support for the high-compression-efficiency WebP image format. Unfortunately, this release also introduces an issue causing images to not be displayed on many websites. This issue affects users of Windows Defender Application Guard.

Support for WebP was implemented as a platform format extension your device gets from the [Microsoft Store](https://apps.microsoft.com/detail/9pg2dk419drg?ref=ctrl.blog) the same way the [Theora and Vorbis media codecs](https://www.ctrl.blog/entry/windows-ogg/) were added earlier this year. The extensions are pushed automatically to Windows 10 users, but this is still significant because it means the Windows platform doesn’t support these formats natively.

Application Guard is a virtualization-backed sandboxing platform that limits the potential fallout from a security incident in Microsoft Edge. When running in Application Guard mode, Microsoft Edge has limited access to the host operating system. Browser extensions and platform extensions are also unavailable when running Edge in Application Guard mode.

For web audio and video, you can specify multiple media codecs to ensure the best browser support. The following example will play the OGG Theora video source in Microsoft Edge and the MPEG-4 video source, which is natively supported by Windows 10, in Microsoft Edge with Application Guard.

```html
<video>
  <source src="video.ogv" type="video/ogg">
  <source src="video.mp4" type="video/mp4">
</video>
```

Things should have worked the same way for web responsive images. However, Microsoft Edge always prefers to source WebP images even when the extension is unavailable. to make things worse, it also doesn’t display the fallback image when it fails to render the source image it selected.

```html
<picture>
  <source src="image.webp" type="image/webp">
  <source src="image.jpeg" type="image/jpeg">
  <img src="image-fallback.jpeg" />
</picture>
```

When presented with a fallback image and a image format it can display, Microsoft Edge in Application Guard mode still shows a preference for WebP even though it can’t display it.

This issue affects a lot of prominent websites who’ve opted to take advantage of the higher compression gains they get with a modern image format like WebP. You can also see it here on Ctrl blog where most images will just not work in Microsoft Edge.

There isn’t anything web developers can do to work around this issue other than strip out unsupported photo formats when encountering the Microsoft Edge User-Agent. The images won’t fire an error even when it fails to display, and you can’t detect that Microsoft Edge is running in Application Guard mode from the web platform.

Normally, I’d suggest using a browser extension that could hotfix the problem. However, all extensions are banned from running in Application Guard mode. The restriction is meant to provide tighter security (at the expense of features).

You can follow [Microsoft Edge platform issue #19618851](https://web.archive.org/web/20190626051700/https://developer.microsoft.com/en-us/microsoft-edge/platform/issues/19618851/) for updates on this issue. Microsoft is okayish with providing feedback to the web developer community.

This issue also affects other multimedia platform extensions including AV1, HEVC, and the MPEG-2 legacy codec. There’s no workaround for it other than to disable application guard.

Now that Mozilla Firefox and Microsoft Edge have added support for WebP, the last holdout for broader adoption of WebP is Apple Safari. I hope we’ll see this issue in Microsoft edge resolved very quickly. I’m perfectly fine with WebP being unsupported in their extra secure enterprise-grade web browsing environment, although Microsoft have got to fix the source selection to not prefer an unsupported file format in that environment.

**Update** (2020-06-27): Apple has finally added WebP support to Safari in version 14.

#### Sources

- [Firefox to support Google’s WebP image format for a faster web](https://www.cnet.com/tech/services-and-software/firefox-to-support-googles-webp-image-format-for-a-faster-web/?ref=ctrl.blog), 2018-10-15, Stephen Shankland, CNET, CBS Interactive
### Tor router-maker InvizBox chases VPN subscriptions down rabbit hole
URL: https://www.ctrl.blog/entry/invizbox-vpn-upgrade/
Last updated: 2026-08-23T22:12:05.000Z
The InvizBox Tor-gateway router stopped receiving firmware and secuirty updates two years after release. Ten months later, InvizBox decided to try to reinvent their product with an alternative firmware that focused on selling virtual private network (VPN) services from InvizBox instead of relying on the free Tor onion network.

InvizBox was a specialized Wi-Fi router that acted as a gateway to the Tor onion network. That is no longer what the product does, but you can read [my 2016 review of InvizBox](https://www.ctrl.blog/entry/review-invizbox/) for the historical perspective.

The economy of maintaining device firmware have shifted from using the free Tor anonymizing network to selling unscription services. InvizBox sent out an email to existing customers offering “90 days free VPN service” to incentivize existing customers to upgrade from their now unsupported Tor firmware to the newer VPN firmware.

90 days of free VPN sounded interesting and I thought I could get a little more life out of my InvizBox. I was sold and proceeded to upgrade my device’s firmware. This experience would end up completely changing my impressions about the InvizBox.

### Firmware upgrades are complicated

InvizBox firmware doesn’t support auto-updating to new versions and customers have to follow what I can only describe as [an involved and manual update process](https://web.archive.org/web/20181110004757/https://support.invizbox.com/hc/en-us/articles/115001538194-How-do-I-flash-a-new-firmware-on-my-InvizBox-) to update their devices. It’s 2018 and there’s universal agreement that auto-updates are essential for anything connected to the internet. InvizBox must have missed the memo on that one.

I kept my InvizBox up to date while it was still supported and was well-versed in its upgrade process. However, this time around I ran into a problem. The InvizBox would run out of memory and crash during the upgrade. From reading the changelog of the new firmware update, I noticed an entry that said they’d fixed an issue were the Tor software wouldn’t stop running while upgrading and this would cause the out-of-memory issue. Unplugging the WAN Ethernet cable worked around the issue and let me install the upgrade.

The first thing I noticed after installing the upgrade was that the device were still running the same old version of the LEDE/OpenWRT firmware as before. It wasn’t much of an upgrade of the underlying operating system, in other words.

The InvizBoz broadcasts a network called “InvizBox”, but none of my devices could connect to it after the upgrade. I reconnected to the InvizBox over LAN but ran into another serious problem with the web administration. The setup wizard returns a HTTP 403 Forbidden status code, meaning that I’m not logged in. At no point did the web interface prompt me too login or provide the administration password, however. There was no visual feedback other than a blank page and I’d to resort to my web browser’s developer tools to read the error status code.

Using some extremely simplistic URL hacking, I managed to get a session cookie which let me access the setup wizard. The wizard required me to agree to a Terms of Service and an Acceptable Use Policy for the InvizBox VPN service. These documents weren’t bundled with the firmware and were linked to the website instead. This is more of a roadblock than it may sound like as I’m connecting to a device that haven’t yet been connected to the internet.

You either have to review the documents using another device or disconnect from the InvizBox and connect to another internet connected network to review the policy documents. I’m sure that lawyers everywhere could argue with good reason that these policy documents aren’t legally enforceable as they’re not made available to the customer at the point when the customer is required to agree to them.

After you agree to the policies you land on a page asking you to login to your InvizBox VPN service user account. There’s no information on how or where you’d register for such an account anywhere on that page. So, at this point you again have to disconnect from the InvizBox and return to another internet connected network. It would turn out to not be a simple task to set up this account even with working internet, however.

### Did InvizBox want to sell me VPN services or not?

All of this work was to get the privilege of paying for InvizBox’s VPN services. However, the VPN services were surprisingly difficult to sign up for.

The InvizBox website is all focused on selling hardware–VPN-service bundles to the extent that there isn’t an option anywhere to just buy the VPN service. There’s nowhere to go if you already have the hardware and have upgraded your firmware. As I mentioned above, there also isn’t any information on how you sign up for the service in the setup wizard.

There’s a support page [talking about upgrading to the VPN enabled InvizBox](https://support.invizbox.com/hc/en-us/articles/360010581954-Upgrading-InvizBox-to-InvizBox-VPN?ref=ctrl.blog). However, the suggested process assumes you’ve an InvizBox account; something you can’t register for on the website without purchasing a new hardware product.

There’s no pricing information available for what the VPN service renewal will cost you if you do purchase a hardware product. The lack of pricing information should be worrying to anyone that considers purchasing a product from InvizBox.

InvizBox sent me a promotional email with details about the Tor-to-VPN service firmware upgrade. It promised 90 day free VPN services to customers who upgraded their firmware. I didn’t investigate this promotional offer too closely before upgrading my firmware as I assumed the InvizBox’s on-device web interface itself would guide me through the sign-up process.

I can’t find any references to this promotional offer anywhere on the InvizBox website. They seem to have changed their minds about providing customers with a free 90 day trial period after sending out the promotional email.

### Conclusions

In the end I never got around to test how the VPN services on the InvizBox worked as I could never figure out how to sign up for the service. I never purchased a VPN router so I’m okay with never having one either.

The base firmware, LEDE/OpenWRT, is technically capable of connecting to any VPN service from any VPN provider. The [Vilfo VPN router](https://www.ctrl.blog/entry/vilfo-review-p1-overview/) comes to mind. However, the firmware on the InvizBox can’t easily be configured to use another VPN service.

The InvizBox received security and firmware updates for the first two years of its life, and I appreciate that InvizBox chose to maintain it for that long. I’ll not hold it against them that they stopped providing updates after two years considering that the device was quite inexpensive. However, I don’t appreciate that they never informed me that the product was discontinued and wouldn’t receive any further updates.

#### Sources

- [Upgrading InvizBox to InvizBox VPN](https://support.invizbox.com/hc/en-us/articles/360010581954-Upgrading-InvizBox-to-InvizBox-VPN?ref=ctrl.blog), 2018-10-23, InvizBox Support, InvizBox
- [InvizBox VPN - Firmware 0.0.10](https://support.invizbox.com/hc/en-us/articles/360010643873-InvizBox-Firmware-VPN-0-0-10-follows-2-0-10?ref=ctrl.blog), 2018-10-17, InvizBox Support, InvizBox
- [How do I flash a new firmware on my InvizBox?](https://web.archive.org/web/20181110004757/https://support.invizbox.com/hc/en-us/articles/115001538194-How-do-I-flash-a-new-firmware-on-my-InvizBox-), 2018-10-17, InvizBox Support, InvizBox
- [Firmware](https://support.invizbox.com/hc/en-us/sections/115000159965-Firmware?ref=ctrl.blog), 2017-12-18, InvizBox Support, InvizBox
- [Terms of Service and Acceptable User Policy](https://web.archive.org/web/20181110154011/https://www.invizbox.com/aup/), 2016-12-01, InvizBox
### Remote desktop capabilities still missing in Fedora Linux 29n
URL: https://www.ctrl.blog/entry/fedora-29-vnc-rdp/
Last updated: 2026-08-23T22:06:07.000Z
The release of Fedora Linux 29 marks the second anniversary of the introduction of Wayland as the default display manager for Fedora Workstation. It’s also the fourth biannual release of Fedora Linux that doesn’t support remote desktop sessions out of the box.

There have been a lot of progress towards reintroducing remote desktop capabilities to the default Fedora Workstation setup since [I last wrote about it](https://www.ctrl.blog/entry/wayland-gnome-remote-desktop/). The Fedora Project wiki lists remote desktop services as a proposed change for Fedora Linux 29, but these plans seem to have been abandoned in July.

The Fedora Linux 29 repositories now include the gnome-remote-desktop package that includes a screen sharing service and adds user interface for configuring screen sharing to System Settings: Sharing. The package isn’t installed by default as it isn’t working. You can install it and enable the service, but it will crash when you try to connect to it.

Fedora Linux 29 also ships with an updated version of [GNOME Boxes](https://apps.gnome.org/app/org.gnome.Boxes/?ref=ctrl.blog), the virtual and remote machine management tool, that added support for managing remote systems over the Remote Desktop Protocol (RDP). I can’t confirm that this is working, though, as GNOME Boxes always crashes when I try to connect it to either Windows 10 Professional’s built-in RDP server or [rdpwrapper for Windows Home](https://www.ctrl.blog/entry/how-to-rdpwrapper-win10-home/).

You can connect to VNC servers using Boxes. However, I still prefer using just about any other Linux client to connect to VNC servers as Boxes’ implementation has quite a few issues. For example, the mouse cursor you see locally doesn’t match the remote position when you connect to the built-in VNC server on MacOS unless the local and remote systems have the exact same screen resolution.

If you provide the wrong credentials to Boxes, it’ll get stuck displaying an infinite progress spinner without providing any feedback about the problem. Trying to connect Boxes to the GNOME remote desktop service over VNC crashes both the remote desktop service and Boxes.

If you need remote desktop capabilities then you better stick with using GNOME with an X11 session and another client like Vinagre.

#### Sources

- [Changes/WaylandRemoteDesktop](https://fedoraproject.org/w/index.php?title=Changes/WaylandRemoteDesktop&oldid=520813&ref=ctrl.blog), 2018-06-19, Matthias Clasen, Fedora Project wiki, Fedora Project
- [Boxes now supports RDP connections](https://web.archive.org/web/20180519031553/https://feborg.es/boxes-rdp/), 2018-05-18, Felipe Borges
### Use Xiaomi Mi Band as a continuous heart rate monitor with Google Fit
URL: https://www.ctrl.blog/entry/xiaomi-band3-to-google-fit/
Last updated: 2026-08-23T22:26:07.000Z
The Xiaomi Mi Band 4, and its cheaper-but-capable predecessor the Mi Band 3, are cheap fitness trackers with a built-in photoplethysmographic (PPG) heart rate sensor, step counter, and basic sleep monitoring. They sync to your phone in the background without you needing to open an app. (Unlike [my glucose meter](https://www.ctrl.blog/entry/contour-next-one-bluetooth/).)

There are many alternatives in this market but what sets the Mi Band 4 and 3 apart are their two-week battery life with continuous 10-minute heart rate readings. Most of the competing devices either have less than a day’s battery life, strap around your chest, or costs three times as much as the Mi Band.

While the technology does [read a heart rate from a toilet roll](https://www.scmp.com/abacus/tech/article/3028873/why-xiaomis-fitness-tracker-detecting-heartbeat-roll-toilet-paper?ref=ctrl.blog) it also works on most human skin tones. I’ve tested the Mi Band 3 against the same type of sensor on a Samsung S8 and their measurements always agree with each other. It should probably be accurate enough to keep an eye on the old life pump for your entertainment.

The [Xiaomi Mi Fit app](https://play.google.com/store/apps/details?id=com.xiaomi.hm.health&ref=ctrl.blog) for Android presents the heart rate readings as a list and leaves it at that. You can’t see any trends or get anything useful out of a list of the raw data. The app can optionally synchronize your step counter and sleep data with the [Google Fit app](https://play.google.com/store/apps/details?id=com.google.android.apps.fitness&ref=ctrl.blog), but not your continuous heart rate readings.

This is where the third-party [Tools & Mi Band app](https://play.google.com/store/apps/details?id=cz.zdenekhorak.mibandtools&ref=ctrl.blog) comes in. This companion app for the Mi Band lets you add extra functionality and customize your Mi Band’s screens and notifications.

For the purposes of this article, the app can also tweak your continuous heart rate monitoring settings and change them to flash readings every 10 minutes. This greatly improves the battery life compared with the more frequent readings you can enable in the Mi Fit app.

Tools & Mi Band also presents your heart rate readings visualizes your heart rate data much better than the Mi Fit app. You’ll get bar charts with average readings from the last two hours, and per-day readings for the last week, plus charts for the last month. You can also enable additional charts in settings.

[![Tools & Mi Band bar chart](https://cdn.synaps.media/control/content/images/2026/08/miband-tools-screenshot-heart-beat-day-bar-chart.png)](https://cdn.synaps.media/control/content/images/2026/08/miband-tools-screenshot-heart-beat-day-bar-chart.png?ref=ctrl.blog) 

Tools & Mi Band bar averages bar chart.)

You can export data from the Tools & Mi Band app to a comma-separated values (CSV) formatted file if you’d like to copy them over to another app or do your analysis. You can also see every individual reading inside the app, in sharp contrast to the Mi Fit app that hides most of the readings and only shows you some of them that it has arbitrarily decided are representative of the day.

[![Google Fit BPM line graph](https://cdn.synaps.media/control/content/images/2026/08/google-fit-screenshot-heart-beat-day-graph.png)](https://cdn.synaps.media/control/content/images/2026/08/google-fit-screenshot-heart-beat-day-graph.png?ref=ctrl.blog) 

Google Fit line chart.

The Tools & Mi Band app can also optionally synchronize your heart rate readings to the Google Fit app. Google Fit gives you a smoothed line graph surrounded by a rolling min–max band throughout the day. It’s a much better visualization and it makes a much better job at presenting the data in an easy-to-digest way.

Xiaomi may not have cheapened out on their Mi Band 3 hardware, but their Mi Fit app clearly isn’t their best work. The Mi Fit app should do a better job with presenting your health data without the need to involve third-party apps and services.

### Closing words on privacy

Xiaomi’s 5470-word privacy policy is on the long side, but it appears to be fine to me. They’ll not sell or otherwise share your data or use it against you. As a Chinese company, they’ll store your data in either China or Singapore. Not everyone may be comfortable with this.

You need to use the Mi Fit app to set up your Mi Band, and you also need to leave it installed on your device for the Tools & Mi Band app to work. After you’ve set up the Mi Band and updated its firmware, you don’t need to let it talk with the internet anymore.

You can use an application firewall app like [NetGuard](https://www.netguard.me/?ref=ctrl.blog) to block the Mi Fit app from communicating with the internet and keep your data on your device.

As mentioned before, you can get along just fine using just the Tools & Mi Bands app without syncing to Google Fit. The Mi Bands app doesn’t send your data off-device unless you explicitly opt-in to enable Google Fit synchronization. The app also charges you an up-front cost and doesn’t include any tracking or advertisements.

#### Sources

- [Why is Xiaomi’s fitness tracker detecting a heartbeat from a roll of toilet paper?](https://www.scmp.com/abacus/tech/article/3028873/why-xiaomis-fitness-tracker-detecting-heartbeat-roll-toilet-paper?ref=ctrl.blog), 2018-10-08, Xinmei Shen, Abacus News
- [Google Fit synchronization](https://help.mibandtools.com/knowledge%5Fbase/topics/google-fit-synchronization?ref=ctrl.blog), 2017-10, Mi Band Tools Support
- [Privacy Policy](https://help.mibandtools.com/knowledge%5Fbase/topics/mi-band-tools-privacy-policy?ref=ctrl.blog), 2017-08, Mi Band Tools Support
- [User Agreement and Privacy Policy](https://web.archive.org/web/20170715212931/http://cdn.awsbj0.fds.api.mi-img.com/mifit/1480831742.html), 2017-07-21, Xiaomi Technology Co., Ltd.
### How I blocked myself from obtaining a Let’s Encrypt TLS certificates
URL: https://www.ctrl.blog/entry/letsencrypt-caa-iodef/
Last updated: 2026-08-23T22:13:17.000Z
I’d set up a new domain name for use as a simple peer-to-peer video streaming service (more on that in a future update) but repeatedly ran into issues with Let’s Encrypt’s domain authorization tests. Here is how I locked myself out of minting my new domain a TLS certificate.

Last year, I wrote about a then recently introduced [method for preventing misissuance of TLS certificates](https://www.ctrl.blog/entry/dns-caa/) called Certification Authority Authorization (`CAA`) records. `CAA` is a type of DNS record that let domain owners declare which certificate authorities (CA) can issue a certificate for their domain.

Certificates for this website are issued by Let’s Encrypt, the free certificate authority. I’ve used the following DNS records to prevent any other certificate authorities from issuing certificates for my domain:

ctrl.blog. IN CAA 0 issue "letsencrypt.org"
ctrl.blog. IN CAA 0 iodef "mailto:security@ctrl.blog"

The first entry declares the unique domain name of the CA that can issue certificates for my domain.

The second entry declares an email address that certificate authorities may use to contact me to notify me about any attempts that may have been made to issue certificates from a non-allow-listed CA. This is intended both to help you debug and identify any issues with certificate issuance caused by your `CAA` records, and to give you a heads up if anyone is attempting to create forged certificates for your domains.

You may also notice that my domain, `ctrl.blog`, ends with a dot; making it an absolute domain, also known as a fully qualified domain name (FQDN). For most DNS records, you specify external domains as an absolute domains anchored in the DNS root servers (as denoted by a dot followed by nothing). Here’s a mail exchange (`MX`) record that tells other email servers to deliver emails addressed to this domain to FastMail:

ctrl.blog. 0 IN MX 20 smtp.fastmail.com.

`CAA` records don’t use absolute domains, however. The trailing dot denoting the DNS root server is implied. By now you’ve probably guessed at how I managed to block myself from obtaining any new certificates from Let’s Encrypt: I’d added the customary dot to the end of the domain name. There are a few interesting takeaways from this simple mistake.

The first takeaway being that `CAA` issue records apparently must be exact matches for certificate authorities to be willing to issue a certificate for that domain. While this is in fact the desired effect of using `CAA` records, I’d also expect a trailing dot not to cause any issues given the history of the trailing dot in DNS.

The second takeaway is that Let’s Encrypt haven’t implemented support for the `CAA` `iodef` records. In other words, Let’s Encrypt didn’t send me any email notifications about the issues even though the `CAA` records were the root cause behind my authentication issues with them.

I wrongly assumed my `CAA` records weren’t the cause of my failed authorization requests as I’d also assumed that I’d receive an email notification if that were the case. `iodef` support is an optional feature of RFC 6844, and not mandatory as I thought it was. I did consider that my `CAA` records might be the issue, but I dismissed it as I believed I’d receive email notifications if that was indeed the root cause.

Lessons learned: double-check the configuration of an explicit blocking mechanism when you find yourself blocked by some unknown factor.

*Thanks to* [*BunnyCDN*](https://bunny.net/?ref=ctrl.blog) *and* [*Let’s Debug*](https://letsdebug.net/?ref=ctrl.blog) *for helping me troubleshoot this issue.*

#### Sources

- [Certification Practice Statement](https://letsencrypt.org/documents/isrg-cps-v2.4/?ref=ctrl.blog), version 2.4, 2018-09-20, Let’s Encrypt, Internet Security Research Group
- [Certificate Authority Authorization (CAA)](https://letsencrypt.org/docs/caa/?ref=ctrl.blog), 2017-07-27, Let’s Encrypt, Internet Security Research Group
- [RFC 6844: DNS Certification Authority Authorization (CAA) Resource Record](https://www.rfc-editor.org/rfc/rfc6844.html?ref=ctrl.blog), 2013-01, Internet Engineering Task Force
- [RFC 1035: Domain Names – Implementation and Specification](https://www.rfc-editor.org/rfc/rfc1035.html?ref=ctrl.blog), 1987, P. Mockapetris, Information Sciences Institute, Network Working Group, Internet Engineering Task Force
### I’d prefer a monthly subscription for updates to Cities: Skylines
URL: https://www.ctrl.blog/entry/cities-skylines-subscription/
Last updated: 2026-08-23T22:03:25.000Z
*City Skylines: Industries* is the seventh large expansion pack to the 2015 city builder game. This latest pack now makes Cities Skylines the single most expensive game I’ve ever owned. Including all the expansion packs, the game has cost me just shy of 174 Euros for the complete game.

City Skylines by Finish studio *Colossal Order* is one of my all-time favorite games. It’s a city builder that I’ve spent hundred of hours watching other people play in addition to the hours I’ve played it myself. My one word review of the games is “great.”

Even so, 174 Euros is a lot of money for a city building game! It works out to just over 4 Euro per month since the game was introduced in back in March 2105. That monthly sum is what I want to discuss in this article, but I’ll get back to that.

City Skylines is a platform and a canvas for you to build out the city of your dreams. Colossal Order have kept that dream alive by releasing new expansion packs and improving the core mechanics of the game. Each of these extension packs have had to justify their own existence and price, and have largely done so by focusing on one bundle-able area or another. From Green Cities and Parklife to Natural Disasters and Snowfall, each of them have had to have one gimmick or another that could shift digital copies of each of the expansions.

The thing is, I’ve been generally more happy with the smaller updates to the core mechanics of the game than the flashier themed updates in the expansion packs.

An example of this is how trees in the game were updated to help reduce noise pollution a few months back. Noise pollution in the game makes citizens sick, and you need to ensure that they don’t live to close to a noisy sports stadium, nigh clubs, or a heavily trafficked road. (I hate noisy environments, so I can definitely relate to this.) Getting a new tool to combat noise pollution and have another use for trees than “places where forest fires start” was a major game changer. Other examples include the addition of the postal service (rebranded garbage trucks) and toll roads in *Cities Skylines: Industries*, and the road maintenance depot that boosts road speeds in *Cities Skylines: Snowfall*.

Cities Skylines has proven itself as a continually expanding platform and not just a game you pick up and walk away from weeks or months later. However, there’s room for improvement in many areas. The many traffic path-finding issues are well known and documented through countless let’s play videos. It’s a hard problem to solve for sure, but I’d appreciate an update focused on keeping boats on the water and not clipping through each other.

If the game had been funded through a subscription model, than the studio might have found time to work on things like improving the path-finding logic for boats and more focus on the smaller things that make the simulation more real. It’s hard to pack something like that up as an expensive expansion pack and sell it to players, however.

I’d not consider myself anyone who’d champion for anything to be a subscription services. I can’t help but speculate on what the game could have been like today if the studio didn’t have to pump out new expansion packs that were focused on a single theme.

I’d pay a lot to try a version of the game made in a parallel universe where Colossal Order had chosen to go with monthly subscriptions instead of expansions packs. Maybe even 3,99 Euro a month.

#### Sources

- [Cities: Skylines](https://web.archive.org/web/20181026022913/https://store.steampowered.com/app/255710/Cities%5FSkylines/?cc=us), 2018-10-23, Steam store listing, Valve Corporation
- [Maps and tree noise reduction](https://forum.paradoxplaza.com/forum/threads/cities-skylines-parklife-dev-diary-4-maps-and-tree-noise-reduction.1098004/?ref=ctrl.blog), 2018-05-15, Emmi Hallikainen, Cities: Skylines - Parklife Dev Diary, Paradox Forums, Paradox Interactive
### Changes to how Mozilla Readability extract metadata in Firefox 63
URL: https://www.ctrl.blog/entry/mozilla-readability-metadata/
Last updated: 2026-08-23T22:14:42.000Z
Mozilla Readability will now extract document metadata from Dublin Core and Open Graph Protocol `meta` tags instead of trying to guess article titles.

Earlier this year, I documented how reader mode in web browsers [extract metadata about articles](https://www.ctrl.blog/entry/browser-reading-mode-metadata/). After learning about the messy state of metadata extraction for reader mode, I sought to improve the extraction logic used in Mozilla Readability. Mozilla Readability was one of the first reader mode parsers and it’s used in Firefox as well as other web browsers.

Hundreds of thousands of websites already provide high-quality metadata in the document though Dublin Core and Open Graph Protocol `meta` tags and many content management systems will include these by default. Many social media platforms including Twitter and Facebook consume these `meta` tags which has pushed their adoption across the web.

These `meta` tags are good source of the type of metadata Readability needs, so I submitted a pull request that made these the primary source of metadata for Readability. What follows is an outline of the changes that have been included in Firefox 63, released earlier today.

The old preferred methods for extracting document titles tried to derive the document title by applying [a complicated set of rules to the document <title>](https://www.ctrl.blog/entry/browser-reading-mode-metadata/). This method could produce unexpected results for short titles and right-to-left titles. The new logic trusts web developers to provide accurate titles through metadata. Here are some sample metadata shown in the order of preference:

```html
<meta property="dc:title og:title"
      content="Document Title">
<meta name="title"
      content="Document Title">
<title>A Somewhat Longer Document Title | Website Name</title>
<title>Document Title | Website Name</title>
```

The blue highlight indicates which title would be used for each of the examples. Note that the old title guessing is still used as a fallback if there are no better sources for the `meta` tags available.

Mozilla Readability used to preferred the `meta[name="author"]` element for sourcing author names. The Open Graph Protocol doesn’t have a platform-neutral way to indicate an author’s name, so the only change is that the Dublin Core creator is now the preferred data source as shown below.

```html
<meta property="dc:creator"
      content="Cave Johnson">
<meta name="author"
      content="Cave Johnson">
```

Lastly, there’s the document description that now prefers Dublin Core and Open Graph metadata over the `meta[name="description"]` element. Many websites use the same description for every page, rather than a snippet or summary of individual pages as they may never see these descriptions.

However, everyone sees a page’s Open Graph Protocol description when sharing links to, e.g. Facebook, so the metadata in these tags tend to be better maintained by web publishers.

```html
<meta property="dc:description og:description"
      content="Brief document description.">
<meta name="description"
      content="Brief document [and often site] description.">
```

As far as I know, no web browser use the description for anything in Reading mode but it’s supported for other users of Readability. Dublin Core is the only format that has the vocabulary can express the author name, and the article title and description on its own which is why its the preferred format. You can use any combination of metadata formats, however.

Just to be clear: you don’t need to include both Dublin Core and Open Graph Protocol `meta` tags in a document even though I show both used at the same time in the above examples.

For the sake of completeness, I’d also like to mention that Twitter metadata tags and Sina Weibo are also supported though I don’t want to promote implementations of platform specific metadata tags. Twitter tags are in widespread use even though Twitter also use Open Graph Protocol `meta` tags are a fallback. Sina Weibo’s `meta` tags are similar to Open Graph Protocol tags and are common on Chinese language websites.

As I’ve written about before: there’s [no standards for how reader mode works](https://www.ctrl.blog/entry/browser-reading-mode-parsers/). If you can think of a better way that would reliably extract metadata from billions of webpages, I encourage you to take a look at [Readability.js](https://github.com/mozilla/readability/blob/master/Readability.js?ref=ctrl.blog) and submit changes to Mozilla.

#### Sources

- [Pull request 478: Improve metadata extraction](https://github.com/mozilla/readability/pull/478?ref=ctrl.blog), 2018-08, Daniel Aleksandersen, Readability, Mozilla, GitHub
- [Cards Markup Tag Reference](https://developer.twitter.com/en/docs/twitter-for-websites/cards/overview/markup?ref=ctrl.blog), 2017-11, Twitter Developer, Twitter
- [The Open Graph protocol](https://ogp.me/?ref=ctrl.blog), 2017-07-27, Facebook
- [Weibo Meta Tags](https://open.weibo.com/wiki/Weibo%5Fmeta%5Ftag?ref=ctrl.blog), 2014-07-16, Sina Weibo
- [DCMI Metadata Terms](https://www.dublincore.org/documents/dcmi-terms/?ref=ctrl.blog), 2012-06-14, Dublin Core Metadata Initiative
### Why I prefer using Instapaper on the web over their Android app
URL: https://www.ctrl.blog/entry/instapaper-web-over-app/
Last updated: 2026-08-23T22:11:53.000Z
I’m not a fan of Instapaper’s web browser extensions or their Android app, but I am a fan of their core read-later service.

[Instapaper](https://www.instapaper.com/?ref=ctrl.blog) is a service for saving copies of webpages to a list so you can read them later. It’s a great tool for reducing tab overload and helping you read more during the week. It can also serve as a searchable archive of articles you’ve already read.

Instapaper was [the first service of its kind](https://www.ctrl.blog/entry/browser-reading-mode-parsers/) and their [content-extraction algorithm](https://www.ctrl.blog/entry/browser-reading-mode-content/) is far superior to alternative services like Mozilla Pocket. The ability to properly extract n article from a website (for personal use, of course) is the defining feature of a read-later service.

However, Instapaper’s Android app leaves a lot to be desired. (You can [skip ahead](#instapaper-web-over-app-section-skip) until after the first [asterism](https://www.ctrl.blog/entry/hr-asterism/) if you don’t want to read about all the pain-points with Instapaper’s Android app).

The app is slow to download updates to the reading list, making me sit and wait for it to complete the process. The interval for how often it should do this in the background is configurable, but I haven’t seen this option have much of an effect. Either manually locking my device while it’s updating or just letting the screen time out and lock on its own also causes the app to get stuck in an infinite update process when you unlock the device again.

Scrolling up and down in the app causes the screen to be [yanked up and down](https://cdn.synaps.media/control/content/media/2026/08/video-5.mp4?ref=ctrl.blog) which causes me to lose my place as I’m reading. This happens quite often on mobile because placing your finger on the screen sometimes causes views to scroll up a pixel or two before you begin to scroll downwards.

It’s impossible to add a new link to the reading list from inside the app. In apps designed for Android, you’d expect to find this functionality in a prominently visible [floating action button](https://m2.material.io/components/buttons-floating-action-button?ref=ctrl.blog) (FAB). Instead, you must share a webpages or link to the app through Android’s built-in sharing system.

This doesn’t work reliably, however. Some links you share to the app never end up on the reading list. They just vanish and you get no message informing you that anything went wrong.

Sharing webpages to Instapaper from some apps like Google News using Android’s sharing tools is unfortunately also somewhat broken. The article summary/description in the reading list ends up displaying the article’s URL rather than the actual reading list. This is caused by a collision of how Android’s sharing system works and a feature in Instapaper that allows you to save a specific text selection with an article.

The Instapaper app crashes quite often if you quickly switch to another app, like when you need to answer a message or lookup a word in a dictionary. As usual, I’ve tested and confirmed these issues on both a Nokia 7 Plus running Android One edition 9.0 and a Samsung S8 running Android 8.0.

So, the Instapaper-app experience on Android isn’t too grate. Their mobile web experience is, however, much better. The mobile web variant of Instapaper doesn’t have any of the aforementioned flaws.

The main problem with just relying on the mobile web version is that you first have to pull it up and then paste a link into it. Being a Firefox for Android user myself, I knew I could improve on this process using extensions.

The official browser extension from Instapaper (last updated 21 months ago) doesn’t have any features other than “save this page to Instapaper”. It also negatively impact page load times (inserting 80 kB of JavaScript into every frame) and doesn’t work with [First-Party Isolation](https://www.ctrl.blog/entry/firefox-fpi/) (FPI), a Firefox privacy feature. The extension also tries to insert some unwanted additional buttons on Hacker News (still works), and Reddit (broken since they moved to HTTPS by default), and Twitter (breaks their page design).

I ended up making [my own Instapaper extension](https://addons.mozilla.org/en-US/firefox/addon/instapaper-tools/?ref=ctrl.blog) instead, and expanded on the official extension’s feature set while I was at it. The extension I wrote gives you the option to either Read Now, Read Later, or Read Later and Close Tab (saving you considerable mouse movement to close a tab after you’ve saved an article on the desktop version of Firefox). The new extension is also compatible with FPI and doesn’t impact page load performance.

[![Get this Mozilla Firefox add-on](https://cdn.synaps.media/control/content/images/2026/08/get-firefox-extension.svg)](https://addons.mozilla.org/en-US/firefox/addon/instapaper-tools/?src=external-addonsbadge-ctrl.blog&ref=ctrl.blog)[![Get source on GitHub](https://cdn.synaps.media/control/content/images/2026/08/get-github-source.svg)](https://github.com/da2x/instapaper-webextension?ref=ctrl.blog) 

This extension closed the gap for me on how to quickly add new content to Instapaper from my mobile browser (which is were the wast majority of links I want to save for later come from).

My main complaint about the mobile web experience is that there isn’t a navigation item that takes you back to the reading list when you’ve open an article. The system-wide Back button works if you opened the article from the reading list, but that won’t work if you used Read Now in my extension or opened something from the reading list in a new tab. I also added a shortcut to reopen the Reading List in the extension menu.

At this point you may be thinking “why doesn’t he just use Pocket instead of Instapaper?” I’ll freely acknowledge that Mozilla Pocket’s Android app is better than the Instapaper app. I used it for over a year before I migrated to Instapaper!

The improved user experience of Pocket’s app doesn’t matter that much when their core service is inferior to Instapaper. As I said in the third paragraph of this article, Pocket doesn’t do a good job at extracting and saving articles. They’re pretty much useless to me when they can’t get the core of their service right. I go into greater details on this in my [article series on Web Reading Mode](https://www.ctrl.blog/entry/browser-reading-mode-parsers/).

Instapaper recently announced they’re [going independent](https://blog.instapaper.com/post/175953870856?ref=ctrl.blog) following a two-year period under the ownership of Pinterest. I’m hoping they’ll renew focus on their core product and work to improve their Android app and browser extensions, specifically. If not, it’ll become increasingly difficult to convince myself that I still want to be an Instapaper customer.
### Scaleway seems too good to be true
URL: https://www.ctrl.blog/entry/scaleway-nothanks/
Last updated: 2026-08-23T22:21:43.000Z
The French virtual private server (VPS) provider [Scaleway](https://www.scaleway.com/en/?ref=ctrl.blog) looks damned impressive offering four dedicated ARM processor cores and 2 GB of RAM for 3 Euro per month. They’ve got some of the lowest prices and offer the most hardware for your money. Their website looks beautiful and it has all the information you could want. Unfortunately, I found that the advertised information doesn’t match the products on offer.

Scaleway’s product pages advertises its “native IPv6” support but fails to mention a couple of crucial limitations. If you dig further onto the frequently asked questions page, you’ll discover that IPv6 support is limited to some of their products but it’s not clear exactly which products support IPv6 and which don’t.

Another limitation is that you’re not assigned a static IPv6 address. Your servers’ IPv6 addresses are dynamically assigned and change if you stop and restart your server. This is a pretty darned big limitation and means you’ll have trouble reliably routing your visitors to your server.

Scaleway also clearly states that you can configure your IP address’ Reverse DNS (rDNS/PTR) records; something which is crucial to ensure email deliverability from your server. The catch here’s that you can only do so for IPv4 addresses as you’re not assigned a static IPv6 addresses. Scaleway’s Network FAQ page mentions that rDNS is only available for your “reserved IP addresses”.

At this point it’s clear that Scaleway’s “native IPv6” support is quite limited. It’s not suited for offering IPv6 services to your visitors. In its current state, it’s only useful for making egress connections over IPv6.

When you register with Scaleway, you’ve to provide a phone number and go through a verification-number process. They also verify your address and credit card as well as your email address. However, they block TCP port 25 (SMTP) by default and require that you send them your government issued identification records to unblock SMTP access for your server.

Scaleway’s website leaves no doubt that you can choose from a number of operating systems. The first logo you’ll see in the operating system list is Fedora Linux. The list looks quite different when you go to and setup a server, however. The available operating systems are limited based on the exact type of server you select.

Fedora Server edition officially supports ARM, but it’s not available if you choose to go with Scaleway’s ARM server offerings. I assumed Fedora Linux would be supported given the Fedora Linux logo’s prominent placement on Scaleway’s product pages.

I had spent some time verifying that Scaleway checked all the boxes and met all my criteria before I signed up. Afterward, I felt that they’d pulled a bait and switch on me. The product they offer doesn’t match the expectations their website had created.

#### Sources

- [Network Knowledge Center](https://web.archive.org/web/20181016143909/https://www.scaleway.com/faq/servers/network/), 2018, Scaleway, Online.net
- [Setup Reverse DNS and PTR records](https://www.scaleway.com/en/docs/compute/instances/how-to/configure-reverse-dns/?ref=ctrl.blog), 2018, Scaleway documentation, Scaleway, Online.net
- [Virtual SSD Cloud Servers](https://web.archive.org/web/20181016143533/https://www.scaleway.com/virtual-cloud-servers/), 2018, Scaleway, Online.net
- [Introducing Native IPv6 Connectivity on Scaleway](https://web.archive.org/web/20190504170412/https://blog.scaleway.com/2016/introducing-native-ipv6-connectivity-on-scaleway/), 2016-03-31, Yann Léger, Scaleway blog, Online.net
### DNSLink and IPNS availability survey
URL: https://www.ctrl.blog/entry/dnslink-ipns-top1m-websites/
Last updated: 2026-08-23T22:05:18.000Z
I’ve examined the top one million websites (according to Alexa Internet) to find out how many of them announce availability on the InterPlanetary File System (IPFS) through [DNSLink](https://dnslink.io/?ref=ctrl.blog).

IPFS and InterPlanetary Name System (IPNS) reference content on [the distributed web](https://www.ctrl.blog/entry/the-dweb/) using cryptographic hashes, which isn’t very human-friendly. DNSLink is a method for mapping a domain name to an IPFS or IPNS address using the Domain Name System (DNS).

I used DNSLink to discover which websites from Alexa Internet’s Top 1 Million websites list have attempted to set up an IPFS presence for themselves. It took over 4 million DNS queries as some needed to be repeated and I also had to request records for four domain name variants:

- example.com
- www.example.com
- \_dnslink.example.com
- \_dnslink.www.example.com

I only found 17 websites with DNSLink setup and pointing to either an IPFS or IPNS address. All the discovered websites loaded okay over the World Wide Web, but only 5 (29 %) resolved and loaded over the InterPlanetary File System (IPFS).

Here are some more numbers about the websites I found:

Ten domains contained a hash-based IPNS NURL, four contained a direct IPFS NURL, and three contained another DNSLink-based IPNS address (further DNS requests required).

All of the hash-based NURLs used a CIDv0 type hashes.

Five domains had set up the \_dnslink discovery-subdomain, one used both their bare and \_dnslink subdomain, and one used their bare and www subdomain.

The dataset is based on crawling the Alexa Internet top one million domains from 2018-10-04. The world’s top one million websites don’t appear to be too interested in IPFS as a distribution method yet.

Using DNSLink as a detection method notably failed to detect the other subdomains that people do publish over IPFS. The blog. subdomain seem especially popular among the few websites I’ve found elsewhere that *are* available over IPFS. Focusing on DNSLink also excluded some popular websites like DTube that are partially built on IPFS but that don’t use DNSLink for their main domain.

Alexa Internet’s rankings doesn’t reflect what content is accessed on IPFS as Alexa Internet doesn’t track content on the IPFS. However, it still interesting to see which popular sites on the web are exploring IPFS distribution.

One of the most interesting findings is the low availability of websites that responded with DNSLink data on IPFS. I don’t know what causes this, but it might suggest a broader problem with maintaining IPFS distribution nodes over time.

To try to rule out DHT or routing issues, I tried resolving the IPNS responses and retrieving the IPFS hashes from my own IPFS node as well as through multiple public IPFS-to-HTTP gateways. To rule out temporary issues, I also repeated the process a few more times over the following days without observing any changes.

The InterPlanetary Name System is poorly documented. IPFS hashes can be cached indefinitely on any IPFS node. IPNS hashes point to IPFS hashes and can be used to link to non-static content. To facilitate changing content, IPNS hashes expire and has to be re-announced into the network periodically. These re-announcements has to come from the IPFS node that created them as they’re required to be signed with that node’s cryptographic keys. IPNS is a centralized point of failure for IPFS website availability, and it seems to have a high failure rate.

This does highlight the need for secondary hosting providers to ensure long-term availability of content on IPFS. So-called “pinning service” like Eternum can store gigabytes of data for pennies per month and act as a fallback in case your primary IPFS nodes goes offline and no one else has a copy of your content.

IPFS hosting services can’t help with IPNS re-announcements without requiring the distributors to relinquishing control over their cryptographic keys. At any rate, I believe that better IPNS documentation could help webmasters (InterPlanetaryMasters?) improve their service availability.

#### Sources

- [IPNS](https://docs.ipfs.io/concepts/ipns/?ref=ctrl.blog), 2020-05-03, IPFS Documentation, IPFS, Protocol Labs
- [DNSLink](https://docs.ipfs.io/concepts/dnslink/?ref=ctrl.blog), 2019-12-18, IPFS Documentation, IPFS, Protocol Labs
- [Raw survey data](https://cdn.synaps.media/control/content/files/2026/08/2018-10-04%5Fipns-dnslink.csv?ref=ctrl.blog) (CSV), 2018-10-04, Daniel Aleksandersen
- Top 1 Million domains list, 2018-10-04, Alexa Internet, Amazon
### Contour Diabetes app, Bluetooth, and why we can’t have nice things
URL: https://www.ctrl.blog/entry/contour-next-one-bluetooth/
Last updated: 2026-08-23T22:03:44.000Z
I thought my new Contour Next One glucose meter with a companion phone app would work like a modern connected fitness tracker and give me convenient access to my blood sugar levels. It ended up just being more busywork.

My old glucose meter model was discontinued earlier this year and I needed to find a replacement model. Glucose meters seem to have been left behind while the rest of the technology sector has zoomed along with sleek minimalist designs of ever-increasing technological complexity and capabilities.

There are a handful of uninteresting glucose meters to choose from on the market. Most of them have the same aesthetics as pagers of the early 1990’s. I did find one exception though: The [Countour Next One](https://www.ascensiadiabetes.com/products/contour-next-one/?ref=ctrl.blog) by Ascensia Diabetes Care. It’s a relatively modern glucose meter (the model is only two years old) with an “optional” companion app for Android and iOS.

The Contour Next One glucose meter itself is fine. Its easy to use and gives quick results (though it takes eight seconds and not five as advertised). The app experience on Android is just depressing, however.

I’m no fan of [the Bluetooth experience](https://www.ctrl.blog/entry/bluetooth-device-pairing/). I was pleasantly surprised when the initial pairing of the Contour Next One and the Contour Diabetes app on my Nokia 7 Plus with Android 8.0 worked on the first attempt. The app gave accurate instructions and then things worked afterward. Score one for the Bluetooth experience!

In order for the meter and app to sync, you need to have the meter turned on and leave the app open at the same time. The meter uses Bluetooth Low Energy (BLE), a subset of the Bluetooth standard designed for background communications, but the app doesn’t support background sync. Just about every cheapo fitness device on the market support reading off their data without requiring the user to open an app first.

I wanted to have background sync from the glucose meter so I could pull up my phone and quickly check on “what was the last reading? and when was it?”. It’s hard to remember these things when it has become a routine you’ve been doing every day for years. I bought the Contour Next One specifically because I hoped I wouldn’t need to turn on the meter and navigate its menus on a tiny screen to find my previous reading.

I tried disabling power management policies for the app (Battery Optimization) and made sure that Bluetooth background scanning was enabled on my Android device. The documentation available from Ascensia doesn’t specifically mention whether background syncing is supposed to work or not or whether you’re required to routinely open the app when you use the meter to get pull in up-to-date data.

The app and syncing experience can be quite annoying. By default, the Contour Next One beeps loudly if you leave it turned on for more than a few seconds to remind you to turn it off. The inactivity timer on the meter doesn’t seem to be unaware that the app is actively reading data from it and beeps anyway. The app also can’t instruct the meter to power down when it has completed syncing. So, you’ve to sit there and wait for it all to do its thing and try to guess when the app has finished reading all the new data from the meter so you can turn off the meter.

You might think that this would be a good time to explore your charts, trends, and data in the app and you’d be wrong. The Contour Diabetes app does a good job of visualizing readings and analyzing trends from your measurements. Ideally, the data should help you manage your diabetes better. The app doesn’t care that you’re looking at a chart or reading about a measurement trend and will throw up full-screen dialogs for the most recent measurement. If the measurement is outside your target range it will suggest you call someone or otherwise prompt you to annotate the reading. For the best user experience, you just have to sit and wait patiently while it syncs, wait for the dialog to pop up, dismiss that, and then you can explore the app.

The app crashes frequently if you press too many things too quickly. Like when you try to quickly open a chart so you can peek at it before the app inevitably interrupts you. Dismissing the dialogs too quickly after they open can also cause the app to crash.

For a bit of variety, the app also throws up some internal error messages from time to time. I’ve no idea what these errors mean as they’re represented with meaningless error codes that aren’t documented anywhere.

These dialogs can’t always be dismissed and you’ve got to quit and restart the app instead. The dialogs and error messages appear at the same time. I’m suspecting that the app wants me to dismiss the dialog underneath the error message first, but you can’t do that when the error message is on top of it.

In late September, I updated my Nokia 7 Plus from Android 8.1 to 9.0 (Android One editions). The two devices were still paired, but the Contour Diabetes app refused to sync with the meter. Or rather, it failed silently at getting the job done. I’d to log out of the app, unpair the meter, log back into the app, and re-pair the meter before I got it to sync again.

Diego Pettenò [noted](https://flameeyes.blog/2017/07/09/diabetes-management-software-online-apps-and-my-projects/?ref=ctrl.blog) that there are standard Bluetooth specification for glucose meters (GLP/GLS). In other words, the meter *could* be compatible with other apps. After some digging around, I found that the Diasend app (discontinued) should be compatible with the Contour Next One.

The app is free for customers outside the United States, and I decided to give it a go after first reviewing their Terms of Service and Privacy Policy (both policy documents leave a lot to be desired but were acceptable to me).

I installed the app, paired the meter with the phone (the meter was already paired with the phone but the app still required me to go through the motions), and the app began syncing without any issues.

However, initiating syncing in the Diasend app unlocked the hidden end-game boss-battle mode in the Contour Diabetes app. It went crazy. The app normally doesn’t sync with the meter unless the app is running in the foreground so I assumed it would be fine to use the Diasend app and not uninstalling the Contour Diabetes app first. Each app only synced while it was running in the foreground, so what would be the harm, right?

![Notification storm from the Contour Diabetes app](https://cdn.synaps.media/control/content/images/2026/08/contour_diabetes_app_notification_storm.jpeg)

New notifications flooding in every three seconds from the Contour Diabetes app

Wrong. The Contour Diabetes app suddenly realized its life-long ambitions to be a real connected health app; on pair with your average fitness tracker and began syncing from the meter without the app being open! The Contour Diabetes app seems to have received a copy of every reading that the Diasend app retrieved from the meter and sent a notification for each reading. The meter can store up to a thousand readings so this triggered a massive flood of notifications.

My phone didn’t like this and became unresponsive to the point where I’d to force-restart the device. This didn’t clear the notification queue, however, and it started up again seconds after I’d rebooted the device. The notification flooding didn’t stop until I managed to crash the Contour Diabetes app. (As mentioned earlier, all it takes to do this is to quickly switch between different screens in the app.)

The Contour Diabetes app isn’t prefect. It feels more like a prototype than a finished product. It’s plagued with internal error screens, lock-ups, crashes, and poor performance. You can even see that it happened while I was preparing to take the feature photo for this article.

This experience isn’t just specific to just one Android device either. I’ve had the same experiences on a Samsung S8 running Android 8.0 (as seen on the feature photo) as well as the Nokia 7 Plus that I followed throughout the narrative in this article.

The app has been out for over two years and Ascensia doesn’t appear to have been able to improve the app stability and reliability in all that time.

Diabetics have gotten used to having to rely on devices that are lagging years behind the average developments in the technology sector. I’d hoped that the Contour Next One would be much better than what it turned out to be. There isn’t anything to complain about regarding the meter itself, but the Android app is just terrible.

#### Sources

- [Contour Diabetes app User Guide](https://www.contournextone.com/siteassets/pdf/90001318%5Fcntr%5Fdiabetes%5Fapp%5Fgde%5Fusr%5Fusen%5Fweb.pdf?ref=ctrl.blog), 2018-08-14, Ascensia Diabetes Care
- [List of devices that can be uploaded via diasend Mobile](https://support.diasend.com/hc/en-us/articles/360000763829-List-of-devices-that-can-be-uploaded-via-diasend-Mobile?ref=ctrl.blog), 2017-12-05, Diasend Support, Diasend
- [Diabetes management software, online apps, and my projects](https://flameeyes.blog/2017/07/09/diabetes-management-software-online-apps-and-my-projects/?ref=ctrl.blog), 2017-07-09, Flameeyes blog, Diego Elio Pettenò
- [Contour Next One User Guide](https://www.contournextone.com/siteassets/pdf/web85688006%5Fcntrnxtone%5Fug%5Fr01-17.pdf?ref=ctrl.blog), 2017-02-06, Ascensia Diabetes Care
### Why we need the distributed web
URL: https://www.ctrl.blog/entry/the-dweb/
Last updated: 2026-08-23T22:23:18.000Z
The distributed web seeks to make peer-to-peer (P2P) content distribution the new default. This should help make the web topology more democratic and resilient to nature and political whims.

Lately, I’ve been taken in by the concept of the distributed web and the [InterPlanetary File System](https://ipfs.tech/?ref=ctrl.blog) (IPFS) in particular. On the distributed web, every client is also a server that serves copies of everything the client has recently downloaded. If you think this sounds a lot like how P2P file transfer protocols like BitTorrent works, then you’re absolutely right. It’s the same principle and IPFS shares a lot of the same technology and goals.

The web has grown increasingly centralized and initiatives like Google’s Accelerated Mobile Pages (AMP) outright seeks to [move formerly independent websites onto Google’s own servers.](https://www.ctrl.blog/entry/amp2html-extension/) The distributed web seeks to go in the opposite direction and make every client participate in content distribution.

Content on IPFS is addressed by cryptographic hashes of the content itself. You query the IPFS’ Distributed Hash Table (DHT) network to discover who else claims to have the file you want, connect to them and request the file. Upon arrival your IPFS client can recalculate the cryptographic hash of the file and thus confirm they sent the right file. This ensures the integrity of the files you access and prevents attacker-in-the-middle (AITM) attackers from modifying the pages you want to access.

There’s no central database that maintains a lit of every file or file hash available on the network. Every client can host a small part of the DHT and share knowledge about how to connect to other clients that may have specific hashes.

The distributed web is as much about democratizing content distribution as its about rearchitecting the web to become more resilient. IPFS can route around service disruptions, natural disasters, shark-bitten undersea cables, packet flooding attacks against major web service providers, human conflicts, commercial interests, as well as government policies and censorship.

You can always get a file assuming that anyone else that you can connect to have the same file that you want. IPFS can work over direct device-to-device links and mesh-networks just as well as over the broader internet.

Imagine a local community being cut off temporarily from the internet by a natural disaster. With the current centralized architecture of the web, that community would lose access to pretty much every resource on the web including their own local newspaper (who’ve likely outsourced web hosting to the likes of Amazon Web Services.) On the distributed web, resources of local interests like the local news, local weather, government information, maps, and other common-interest items would still be accessible from other clients in the neighborhood.

The distributed web also helps content producers cut down on their distribution costs. The more popular a file is on the distributed web, the less of the bandwidth burden and costs must be covered by the content producer directly. As a content producer, you technically only need to maintain a single IPFS node to ensure long-term availability of your content across the open internet.

Distributed web technologies like the InterPlanetary File System currently comes with non-trivial bandwidth, memory, and computational requirements. The technology has to improve considerably, and work its way to become built-in to our web browsers before the decentralized web dream can be realized. Mozilla and Firefox is most definitely interested, with Firefox being the first browser to ship any product changes to support the distributed web.

Let us just say it isn’t quite ready yet for the small battery powered devices we all carry around in our pockets. These devices can still access content stored on IPFS through IPFS-to-HTTPS gateway services which are already offered for free by internet infrastructure behemoth Cloudflare.

There are also dedicated commercial IPFS hosting, or “pinning”, services available like Eternum (discontinued as of 2023) that can help website large and small kickstart its IPFS services. IPFS gateways are IPFS nodes just like any other and can help establish service reliability and content availability as the web begins to transition from centralized to decentralized.

The web seems to be headed into the hands of a few behemoth multinational companies. I prefer to see the web go in the opposite direction and break free from these controlling interests.

I encourage every developer and anyone who produces or publishes anything on the web to learn more about the [InterPlanetary File System](https://ipfs.tech/?ref=ctrl.blog) and the distributed web.

#### Sources

- [Dweb Articles](https://hacks.mozilla.org/category/dweb/?ref=ctrl.blog), 2018-10, Mozilla Hacks blog, Mozilla
- [Cloudflare goes InterPlanetary – Introducing Cloudflare’s IPFS Gateway](https://blog.cloudflare.com/distributed-web-gateway/?ref=ctrl.blog), 2018-09-17, Andy Parker, Cloudflare blog, Cloudflare
- [Firefox 59 will support decentralised internet protocols](https://web.archive.org/web/20180204204617/https://www.theinquirer.net/inquirer/news/3025478/firefox-59-will-support-decentralised-internet-protocols), 2018-01-29, John Leonard, The Inquirer
- [Decentralization: Vital to Internet Health](https://web.archive.org/web/20181010005537/https://www.mozilla.org/en-US/internet-health/decentralization/), 2017-05, Mozilla
- [IPFS - Content Addressed, Versioned, P2P File System](https://gateway.ipfs.io/ipfs/QmV9tSDx9UiPeWExXEeH6aoDvmihvx6jD5eLb4jbTaKGps?ref=ctrl.blog), Draft 3, 2014-07-24, Juan Benet
### Not getting much done with Microsoft To-Do
URL: https://www.ctrl.blog/entry/microsoft-not-todo/
Last updated: 2026-08-23T22:14:24.000Z
[Microsoft To-Do](https://todo.microsoft.com/?ref=ctrl.blog) is a nice looking multi-platform task manager built around a workflow that I’ve found helpful for prioritizing and completing tasks. It has just the right number of features so you can focus on getting things checked off your task lists rather than focusing on managing your lists. If only it had worked more reliably … .

I’ve given up on getting organized using Microsoft To-Do after trying to use it for ten months. The user experience design is solid, and I like most things about the service. Unfortunately, it doesn’t work reliably enough to get anything done.

I wanted to write a review of Microsoft To-Do for a long time but I’ve had so much problems with synchronization in To-Do that I never got around to it. Instead I’ll stick to just discussing the parts that made me leave the service: its reliability, sync, and data portability problems.

### The waiting and reloading

The webpage takes **over 10–15 seconds to load** in a modern web browser. Let’s just say the issue here’s that it’s not designed with [conservative web development in mind](https://drewdevault.com/2018/09/04/Conservative-web-development.html?ref=ctrl.blog); the web app loads 120 different resources and weighs in at 3,3 MB. I’ve got plenty of bandwidth, low latency to all the web servers involved, and a fast modern computer but To-Do still takes an unacceptably long time to load.

I’ll admit to being a forgetful person, and I’ve found myself being unable to remember why I opened the app following the long loading time. To make matters worse, the app frequently fails to load so you just sit there and stare at the loading animation for a long while before you give up or try loading it again.

You can’t leave the web app open in a tab all day to avoid the initial load either. You’ll be asked to reload it after a few hours or sometimes after only a couple of minutes. I’ve also found that it gets out of sync if you leave it open for too long and you’ll also have to reload it to see changes made on other apps or devices.

![Expired session in Microsoft To-Do](https://cdn.synaps.media/control/content/images/2026/08/microsoft-todo-expired-session.png)

This is also a problem when using only one device. I’ve added six items and only four items appear in my list. After one or two reloads, things usually show up where I expect them to but I get the impression that I can’t trust the app to function as it should.

The Android app is clearly made by people from a different department because it loads instantly and is almost always up to date on the latest changes. The Android app does however suffer from [jerky scrolling](https://cdn.synaps.media/control/content/media/2026/08/video-6.mp4?ref=ctrl.blog) and occasional slow downs where it stops responding for upwards to ten seconds seemingly without any reason.

### Synchronization is a mess

Microsoft acquired Wunderlist, a popular task manager service, in 2015 and have created quite a mess of it since. Microsoft has announced that they’ll be replacing Wunderlist with To-Do in time, and the company currently have five distinct to-do/task list apps and services. Here is a quick overview of which of them can talk to each other.

__Microsoft’s different to-do apps – cross-app synchronization__
| App        | To-Do     | Launcher | Cortana | Outlook | Wunderlist |
| ---------- | --------- | -------- | ------- | ------- | ---------- |
| To-Do      | Yes       | No       | No      | Yes     | Migrate ←  |
| Launcher   | No        | Yes      | Yes     | No      | Sync ←     |
| Cortana    | No        | Yes      | Yes     | No      | Sync ←     |
| Outlook    | Yes       | No       | No      | Yes     | No         |
| Wunderlist | Migrate ↑ | Sync ↑   | Sync ↑  | No      | Yes        |

I’ve mostly stuck with just using Microsoft To-Do for Android and on the web but it has plenty of syncing issues between on its own.

Syncing generally works if I open the app, wait a few seconds to let it sync, make my changes, and then close the app. If I start making changes too early or leave the app running, I’ll often get out of sync with other instances. The worst thing you can do is to leave the web app open in a tab on your laptop, put the laptop to sleep for an hour, and then resume using the app. You’ll often get the session expired issue, as mentioned above, but if you do manage to make changes these changes will sometimes just disappear into the ether.

If I don’t use the Android app for a few days, it can take several minutes for it to catch up on changes — even if there are only a dozen or so changes. This problem seems to go away entirely if I keep using the app a couple of times a day every day. However, I’m unwilling to change my behavior and work/life balance to suite the needs of the app to get a constant supply of my attention.

### Data portability

You can export notes from Wunderlist and import them into Microsoft To-Do. You can’t upload a standard VTODO-file (part of the iCalendar specification; RFC 5545) or any other task list file format.

You’re supposed to be able to export your tasks through Outlook.com, but there’s no way to import the exported data into To-Do again. The data export will be in the Outlook Personal Folders file format (.pst). I haven’t found any other task manager app that’s willing to import from the PST file format.

I said “supposed to” as I’d to wait for the export process for **over 12 weeks** before I got my data export. I initiated the process in late June 2018 (well after the GDPR went into effect) and it didn’t complete until the end of September. I reached out to Microsoft Support through multiple channels and they eventually offered to do a manual export for me. At that point, however, I’d already manually copied out the data I wanted to save from the service and moved on.

Microsoft To-Do is currently free for personal use or otherwise included in an Office 365 license; but I’d not be surprised if Microsoft slapped a Office 365 license requirement on it for everyone within the next year or so.

#### Sources

- [Conservative web development](https://drewdevault.com/2018/09/04/Conservative-web-development.html?ref=ctrl.blog), 2018-09-04, Drew DeVault
- [New in Microsoft To-Do: List Sharing and Steps](https://web.archive.org/web/20181001191139/https://www.wunderlist.com/blog/new-in-microsoft-to-do-list-sharing-and-steps/), 2018-06-07, Wunderlist blog, 6 Wunderkinder
- Can I export my lists and tasks from To-Do? (link no longer available), 2018-04-24, Privacy and Compliance, Microsoft To-Do Support, Microsoft
- [Technical issues to blame for slow migration of features from Wunderlist to Microsoft To-Do](https://www.windowscentral.com/technical-issues-blame-slow-migration-features-wunderlist-microsoft-do?ref=ctrl.blog), 2018-03-21, Dan Thorp-Lancaster, Windows Central, Future
- [Interview with Simon Chan on the Future of Microsoft To-Do](https://medium.com/gitbit/interview-with-simon-chan-on-the-future-of-microsoft-to-do-aee3a460610?ref=ctrl.blog), 2018-02-05, John Gruber, Hackernoon
- [Our Future: Wunderlist joins Microsoft](https://web.archive.org/web/20150602163435/https://www.wunderlist.com/blog/our-future-wunderlist-joins-microsoft/), 2015-06-02, Christian Reber, Wunderlist blog, 6 Wunderkinder
- [RFC 5545: Internet Calendaring and Scheduling Core Object Specification (iCalendar)](https://www.rfc-editor.org/rfc/rfc5545.html?ref=ctrl.blog), 2009-09, Bernard Desruisseaux, Network Working Group, Internet Engineering Task Force
### New browser extension lets you opt-out of Google AMP
URL: https://www.ctrl.blog/entry/amp2html-extension/
Last updated: 2026-08-23T22:01:28.000Z
The decentralized nature of the web, as it is, is under serious threat from initiatives like the Accelerated Mobile Pages (AMP) project spearheaded by Google. Search engines are becoming content repositories for large sections of the web. Many major web publishers have already ceded control over their own websites and handed over a treasure trove of data about their audiences to Bing and Google.

The [Redirect AMP to HTML](https://addons.mozilla.org/en-US/firefox/addon/amp2html/?ref=ctrl.blog) extension (also known as AMP2HTML and AMP to HTML Redirector) for Firefox, Microsoft Edge, and Google Chromes gives users a choice to opt-out of a centralized web in favor of the open and decentralized web.

Just about everything about AMP is controversial from how [it’s trying to supplant the web](https://web.archive.org/web/20180124215141/https://www.computing.co.uk/ctg/news/3025141/web-developers-slam-googles-accelerated-mobile-pages-internet-takeover) and [potential for censorship](https://stop.zona-m.net/2018/01/why-i-do-not-like-googles-accelerated-mobile-pages-amp/?ref=ctrl.blog) to technicalities like [its URL structure](https://techcrunch.com/2017/02/06/google-fixes-a-big-problem-with-amp-now-lets-you-view-and-share-publishers-own-links/?ref=ctrl.blog) and compliance issues with [privacy](https://www.seo-suedwest.de/news/blog/38-allgemein/3680-amp-gdpr-compliant-usage-possible.html?ref=ctrl.blog) and even [copyright infringement issues](https://molily.de/amp-copyright-law/?ref=ctrl.blog).

How does anyone legally justify copying and redistributing so many webpages without a distribution license with any of the publishers? I’ve explored this topic extensively in [a new article](https://www.ctrl.blog/entry/amp-cache-copyright/).

AMP Caches copies the entire AMP document that a publisher produces for their website and redistributes it directly from servers under the search engine’s control. They’re like central repositories of web content from participating websites.

This mostly cuts the publisher’s own infrastructure out of the content delivery process, and also hands over information of everything that happens on those pages to the company that operates the AMP Cache.

Regular websites can’t compete fairly with AMP directly on the platform’s main selling point: page loading speed. AMP has an unfair advantage as search engines will preload AMP pages before the user even clicks on them in search result pages; resulting in a great increase in perceived page loading performance over regular webpages.

As a web publisher, I feel the pressure to adopt AMP to please Google and their algorithms. Many web publishers are on board with AMP. This website already uses many of the techniques that AMP cache providers use.

However, I can’t compete with already-having-been-loaded-in-the-background or out-compete the likes of Microsoft and Google on infrastructure. (Although my CDN is [trying their best.](https://twitter.com/BunnyCDN/status/1023980497813299201?ref=ctrl.blog))

I believe that the web should be decentralized, that Google doesn’t need more information that it already has, and that the limitations that AMP imposes on web developers are outrageous.

In my opinion, the right direction for the web is refocusing on [reducing bloat](https://fabiensanglard.net/bloated/?ref=ctrl.blog) and [more conservative web development](https://drewdevault.com/2018/09/04/Conservative-web-development.html?ref=ctrl.blog). The [incentive and monetization system](https://web.archive.org/web/20180619113420/https://blog.flattr.com/2018/01/paying-content-creators/) needs to be addressed while we’re at it. Giving up and moving everything to Google’s servers isn’t the answer (except if you’re Google, of course.)

As no one else took the time to ask web users what they wanted, I’ve created an extension for Firefox that lets you opt-out of AMP. Just install it and it will point you to the regular web version of any AMP page your browser encounters (when available.)

Using the extension will help drive eyeballs (and ad revenue) from AMP and over to the publishers’ websites where it belong. It sends a signal to publishers that we want the web to remain open and decentralized rather than under the control of a few companies that offer “free” caching servers for “everything”.

The extension is especially useful if you install it on Firefox For Android as you’re most likely to encounter AMP pages while searching with Google on a mobile device. The extension is also useful on Firefox for desktop if you regularly share links from your mobile to your desktop device, or if you frequent social media websites (where many users unknowingly share AMP links) on your desktop computer.

[![Get this Mozilla Firefox add-on](https://cdn.synaps.media/control/content/images/2026/08/get-firefox-extension.svg)](https://addons.mozilla.org/en-US/firefox/addon/amp2html/?src=external-addonsbadge-ctrl.blog&ref=ctrl.blog)[![Get this Microsoft Edge extension](https://cdn.synaps.media/control/content/images/2026/08/get-msedge-extension.svg)](https://microsoftedge.microsoft.com/addons/detail/abjhjmfkmdfggjomfpojjfcehhkambcc?ref=ctrl.blog)[![Get this Google Chrome extension](https://cdn.synaps.media/control/content/images/2026/08/get-chrome-extension.svg)](https://chrome.google.com/webstore/detail/redirect-amp-to-html/kifkmmpiicbcnkjaliilaoeaojlldonl?ref=ctrl.blog)[![Get source on GitHub](https://cdn.synaps.media/control/content/images/2026/08/get-github-source.svg)](https://github.com/da2x/amp2html?ref=ctrl.blog) 

Note that in some cases the AMP page will still be loaded before the extension has the opportunity to identify it as an AMP page and redirect you to the regular web variant of the page. The extension isn’t suited for people on an ultra-tight, slow, or expensive data quota. The current version of the extension doesn’t disable preloading of AMP result pages on Google Search even those pages won’t ever be displayed.

The Redirect AMP to HTML extension is an open-source project and you can report issues or get the source code [on GitHub.](https://github.com/da2x/amp2html?ref=ctrl.blog)

#### Sources

- [Bloated](https://fabiensanglard.net/bloated/?ref=ctrl.blog), 2018-09-23, Fabien Sanglard
- [Introducing Bing AMP viewer and Bing AMP cache](https://blogs.bing.com/Webmaster-Blog/September-2018/Introducing-Bing-AMP-viewer-and-Bing-AMP-cache?ref=ctrl.blog), 2018-09-19, Fabrice Canel, Bing Webmaster Blog, Microsoft
- [Conservative web development](https://drewdevault.com/2018/09/04/Conservative-web-development.html?ref=ctrl.blog), 2018-09-04, Drew DeVault
- [“Early results are showing BunnyCDN as the second fastest CDN in EU”](https://twitter.com/BunnyCDN/status/1023980497813299201?ref=ctrl.blog), 2018-07-30, @BunnyCDN, Twitter
- [AMP - Is GDPR-compliant usage possible?](https://www.seo-suedwest.de/news/blog/38-allgemein/3680-amp-gdpr-compliant-usage-possible.html?ref=ctrl.blog), 2018-04-29, Christian Kunz, SEO blog, SEO Südwest
- [Web developers slam Google’s Accelerated Mobile Pages internet takeover](https://web.archive.org/web/20180124215141/https://www.computing.co.uk/ctg/news/3025141/web-developers-slam-googles-accelerated-mobile-pages-internet-takeover), 2018-01-24, Nicholas Fearn, Computing
- [Why I do NOT like Google’s Accelerated Mobile Pages (AMP)](https://stop.zona-m.net/2018/01/why-i-do-not-like-googles-accelerated-mobile-pages-amp/?ref=ctrl.blog), 2018-01-20, Marco Fioretti, The Stop
- [Why everyone should pay for online content.](https://web.archive.org/web/20180619113420/https://blog.flattr.com/2018/01/paying-content-creators/), 2018-01-08, Laura Faint, Flattr blog, Flattr, Eyeo
- [A short note on Google AMP and the German copyright law](https://molily.de/amp-copyright-law/?ref=ctrl.blog), 2017-06-01, M⁠athias Schä⁠fer, molily
- [Google fixes a big problem with AMP, now lets you view and share a publisher’s own links](https://techcrunch.com/2017/02/06/google-fixes-a-big-problem-with-amp-now-lets-you-view-and-share-publishers-own-links/?ref=ctrl.blog), 2017-02-06, Sarah Perez, Techcrunch
### Combat article theft by delaying RSS feeds
URL: https://www.ctrl.blog/entry/delaying-feed-updates/
Last updated: 2026-08-23T22:04:52.000Z
For the last four years, Ctrl blog’s syndication feed (“RSS”) subscribers have received [early-access to most articles](https://www.ctrl.blog/entry/delayed-publishing-rss/) as an incentive to subscribe. This program is now being reversed, and syndication feeds will no longer receive new articles until a few hours after they’re published.

Every article I publish on this blog pretty much immediately appear on a couple of dozen other websites. What all the content scrapers have in common is that they use syndication feeds to be notified of new articles which allows them to quickly fetch new pages and reproduce them.

Some search engines including Yandex, Google, and Bing can have trouble identifying the original source where an article is published, and often rank one of the unlicensed plagiarized reproductions higher than the original. Some of the plagiarists use quite aggressive means to promote their copies and that also seems to pay off in search rankings.

### It’s difficult to deal with content scrapers

Defending copyrights as an individual isn’t an easy matter. It can be quite time-consuming to get contact details of whoever owns many websites or any of their service providers. Most simply ignored any attempts at contacting them. A few sent angry replies back arguing it’s none of my business what they put up on their websites.

Filing DMCA notices against copyists is no laughing matter, and you wouldn’t believe how angry some site owners get when their copying machines stop working due to take down notices sent to their service providers. Lets also say I haven’t made friends by getting websites who’ve copied significant portions of my work kicked out of advertising programs.

In the past, I’ve taken out content scraping sites that copy and redistribute my articles using [somewhat aggressive means](https://www.ctrl.blog/entry/defacing-content-scrapers/). This requires significant work and verification, doesn’t work in all instances, and frankly isn’t worth the efforts and risks involved.

I’ve experimented with including hidden and visible “This article was originally published on Ctrl blog” paragraphs with links back to the original source. However, these have proven ineffective and were nearly always stripped out.

### Delaying syndication feeds to slow down republications

I’ve provided feed subscribers with early-access to new articles as a [reward for subscribing](https://www.ctrl.blog/entry/delayed-publishing-rss/). I haven’t promoted this, and I’m sure most subscribers never noticed that articles appeared an hour or six in their feed readers before they appeared on the front page or anywhere else. The idea being that subscribers could get more exposure for sharing somewhat more exclusive links whether they realized it or not.

Unfortunately, this scheme have enabled some websites to grab articles early and republish them before Googlebot, Bingbot, and friends have had the chance to index the page; leaving room for other websites to republish it before search engines have a chance to see the original page first.

I did some experimentation and discovered that it isn’t enough to stop giving feed subscribers early access. I’d to also delay new articles from appearing in the feeds for a little over an hour after publication to significantly impact the ratings of plagiarized copies across the leading search engines.

The delay seems to be enough time for search engines — who’re notified about new pages as they’re published but still take some time to crawl them — to determine for certain which website is the original. The plagiarized copies are still made, but they don’t get nearly as much reach when they’re pushed down in rankings or even entirely out of search results.

### Implementation notes for delayed feed updates

The `<updated>` element in the Atom syndication format specifies when an `<entry>` was added to the feed and not the time of first-publication. It’s important to set this timestamp correctly as some feed clients take shortcuts and skip processing of feed entries with update-timestamps older than the time the client last fetched the feed. Additionally, the `<updated>` element for the root `<feed>` element

The `<pubDate>` element in RSS feeds is less strictly defined and it can be interpreted to mean just about anything. My interpretation, however, is that it’s supposed to be the time an item was added to the feed and not the time the item was first published.

There are at least two plugins for WordPress available that implement delayed feed delivery, but neither sets the corrects the update times in the feeds.

### Exploring other means of copy-protection

There are surprisingly few tools available to help publishers assert ownership or remove unauthorized copies of their content.

There are a few companies that offer copy-protection services, where “copy-protection” means one of two things: 1) They’ll crawl the web and notify you by email when they discover copies of your registered articles, or 2) you pay to display a little copy-protection badge on your website (and that’s all you get). These services aren’t super useful.

Yandex has a free API called [Original texts](https://web.archive.org/web/20200102175824/https://yandex.com/support/webmaster/service/authored-texts.html) that allow webmasters to submit copies of original copy and associate them with a domain name before making the copy available on the web. This can help Yandex determining the original source of published materials but none of the other search engines have similar systems.

My own [Internet Archive plugin for WordPress](https://www.ctrl.blog/entry/wordpress-internet-archive-plugin/) saves a copy of everything I publish in the Internet Archive. This copy is excluded from search engines, and I consider the services of the Internet Archive a net positive for the web ecosystem. It also means that I can use that copy later to assert that an article was published on my website on or before a particular point in time. This would, of course, only potentially be useful as part of a complicated legal process.

There isn’t much you can do proactively other than use the above tools, and monitor for copies and reach out to plagiarists and ask them to delete your property from their websites.

PS: You can still get near real-time feed updates from Ctrl blog by parsing `h-feed` Microdata formatting available on the [front-page](https://www.ctrl.blog/) and [topic pages](https://www.ctrl.blog/topic/).

#### Sources

- [RSS 2.0 Specification](https://cyber.harvard.edu/rss/rss.html?ref=ctrl.blog), 2007-04-29, Cyber, Harvard Law, Harvard
- [RFC 4287: The Atom Syndication Format](https://www.rfc-editor.org/rfc/rfc4287.html?ref=ctrl.blog), 2005-12, IETF
### Cheapo Windows licenses openly sold as “pirate keys” on Amazon.ca
URL: https://www.ctrl.blog/entry/amazon-mswindows-pirate-licenses/
Last updated: 2026-08-23T22:01:22.000Z
I’ve unintentionally referred people towards purchasing pirate license activation keys for Windows 10 through Amazon in Canada. I’d like to explain exactly how this happened.

I’m not a lawyer and this isn’t legal advice on Windows product licensing or any other subject.

In one of my more popular articles, I discuss the [Windows 10 license in regards to RDP](https://www.ctrl.blog/entry/how-to-rdpwrapper-win10-home/). In that article I recommend that people who want to use RDP upgrade from the Home edition of Windows 10 to Professional.

I then link to the Microsoft Store and include ~~\>an Amazon affiliate link~~ that leads directly to the genuine Windows 10 Professional product page on Amazon in the US. The link does use [Amazon OneLink](https://www.ctrl.blog/entry/amazon-onelink-affiliate-redirection/) to redirect customers around the world to their local Amazon website. Where OneLink redirects to is managed entirely by Amazon, but the idea is that Amazon should link to the equivalent product page on the local Amazon website or fallback to a search result page if it isn’t certain about what the correct product is.

You may already have identified where this system breaks down. The top eight popular products in the Operating system category on Amazon.ca are pirate keys for Windows. I’m not just saying that they appear shady or that they’re potentially pirated licenses. **The product pages for these Windows licenses list “pirate key” as a feature!**

![Example Windows 10 Pro pirate license listing on Amazon Canada](https://cdn.synaps.media/control/content/images/2026/08/amazon-canada-store-listing-pirate-windows-key.png)

Example pirate store listing.

They’re being completely transparent about the illegitimacy of the products they sell. I’ve contacted Amazon several times through multiple channels asking them to remove these listings, though they haven’t removed any of them. I’ve only received a reply from Amazon was over Twitter, but they’ve yet to act on it. In my opinion, these listings that outright admit to being pirate keys should not require much moderation deliberation on the part of Amazon.

At the time of writing, there were over a dozen different product listings for pirate keys from over 30 different sellers. If you search for Windows 10 on Amazon in Canada, the top six results are all less than 30 CAD. The expected retail price for Windows 10 Professional is just shy of around 200 CAD.

I’ve performed a quick review of Amazon websites in other regions and haven’t found similar listings on any of them.

### Volume license keys on eBay

You may be less surprised to hear that you can find nearly identical product listings on eBay, complete with the same spelling mistakes and everything. The main difference is that eBay sellers charge a third of what they charge on Amazon and don’t outright say that their products are pirated, but instead promise that they’re selling genuine Retail or Original Equipment Manufacturer (OEM) edition licenses. These terms have special meaning in terms of Windows licenses, so I thought I’d check up on their claims.

In the interest of researching for this article, I bought two licenses from two eBay listings. One OEM edition and one Retail edition of Windows 10 Professional. Each one cost less than 5 USD though their expected retail prices are 140 USD and 190 USD respectively.

The license keys I received where neither the OEM nor Retail editions of Windows 10 Professional, but a Multiple Activation Keys (MAK) Volume License Keys (VLK) intended for use in enterprise deployments. MAKs have different license restrictions than OEM and Retail editions, and the listings on eBay were misrepresenting the product being sold.

I haven’t made any test purchases via Amazon Canada specifically, but I would expect the result to be the same.

Reselling Windows license keys is prohibited under the Microsoft Software License Terms for Windows Operating System, except in some parts of the European Union.

Disclaimer: The screenshot from Amazon.ca have been edited to hide the name of the seller.

#### Sources

- [To @AmazonCanada on Twitter](https://web.archive.org/web/20180911123304/https://twitter.com/Aeyoun/status/1038017680819871745?lang=en), 2018-09-07, Daniel Aleksandersen, Twitter
- [Microsoft Software License Terms for Windows Operating System](https://web.archive.org/web/20180107115854/https://www.microsoft.com/en-us/Useterms/Retail/Windows/10/UseTerms%5FRetail%5FWindows%5F10%5FEnglish.htm), 2017-07, Microsoft
- [An author of software can’t oppose the resale of his ‘used’ licences allowing the use of his programs downloaded from the internet](https://curia.europa.eu/jcms/upload/docs/application/pdf/2012-07/cp120094en.pdf?ref=ctrl.blog), 2012-07-03, Press Release, Judgment in Case C-128/11, Court of Justice of the European Union
### Flattr launches podcast and YouTube micro-subscriptions
URL: https://www.ctrl.blog/entry/flattr-micro-subscriptions/
Last updated: 2026-08-23T22:07:08.000Z
Flattr have introduced new tools for recurring micro-subscriptions to support podcast and YouTube creators.

Flattr is a service where people can support their favorite creators on the web with a single subscription. Starting at 3 USD/month, Flattr lets people pay a fixed monthly sum that’s divided out among the creators they want to support; rather than having to manage many individual small subscriptions.

Flattr have been focused on their [browser extension](https://www.ctrl.blog/entry/flattr2/) that [temporarily collects web history](https://www.ctrl.blog/entry/flattr-gdpr/) and uses it to determine which registered creators should receive a portion of someone’s subscription.

Flattr have now quietly introduced new tools on for passively supporting podcasts and YouTube channels. YouTube subscriptions have been in testing through Flattr Labs sine June 2018.

Flattr will automatically give a micro-donation from the user’s monthly subscription to each new episode or video from the creators they’ve subscribed to. The size of the donation depends on how many creators a user supports and how big their monthly contribution is. The new subscription-oriented systems draws money from the same subscription as the Flattr extension.

Users can subscribe to any iTunes Store-listed podcasts and any YouTube channel through Flattr; but only creators who’ve claimed their domains, podcasts, YouTube channels, etc. will receive funds. The new subscription tools are sort of hidden away in the account menu on the main Flattr website.

Flattr haven’t yet introduced subscriber-only podcast feeds or other benefits to entice subscriptions from contributors. However, podcasters and YouTubers should consider claiming their feeds and channels even if they don’t intend to promote Flattr to their audiences. Flattr can be an alternate revenue stream for creators so they don’t grow too dependent on one donation platform like Patreon.

Podcasters and YouTube creators need only linked their podcasts or YouTube channel to a Flattr account to claim contributions from their audiences. Specifically, YouTube creators must login to their YouTube account through Flattr to claim their channels. Podcasters must add a link to a dedicated page for their podcast on Flattr to their podcast feed’s description to claim a podcast.

There’s no word yet as to whether Flattr will launch similar schemes for subscribing to bloggers, open-source developers, and other types of content creators.

If you’re familiar with Flattr, you may recognize this as a more focused relaunch of the recurring Flattr subscription system that was first introduced in November 2010.

#### Sources

- [Subscribe to your favorite things!](https://web.archive.org/web/20180910062109/https://blog.flattr.com/2010/11/subscribe-to-your-favorite-things/), 2010-11-25, Linus Olsson, Flattr blog, Flattr, Eyeo
### Extension enhances privacy of all embedded YouTube videos
URL: https://www.ctrl.blog/entry/youtube-nocookie/
Last updated: 2026-08-23T22:26:09.000Z
Get better privacy for embedded YouTube videos with the [Privacy Enhanced Mode for Embedded YouTube Videos](https://addons.mozilla.org/en-US/firefox/addon/youtube-nocookie/?ref=ctrl.blog) extension for Firefox.

Websites like to embed YouTube videos in marketing materials, blog posts, and news stories. It’s much cheaper to offload the bandwidth costs required for hosting high-quality video on a large company like YouTube, and most users get a good experience on most devices most places in the world. It’s a win–win situation, right?

The elephant in the room is the data collection that happens through embedded content. When embedding a video, you also invite third-parties to track and record information about the interests and movements of people who visit the page. I urged people to [stop embedding content over privacy concerns](https://www.ctrl.blog/entry/stop-embedding/) back in 2014\. The European Parliament made websites responsible for the data harvesting that happens on their sites (even by third-parties) with the introduction of the General Data Protection Regulation (GDPR).

YouTube normally collects data about you when you land on any webpage with their videos embedded on them even if you don’t start or interact with the video. However, YouTube offers an alternative embedding method called Privacy Enhanced Mode that reduces the tracking and reduces the amount of data that’s being collected and the numbers of cookies involved. It also prevents watched videos from appearing in your watched-videos history on YouTube. Meaning that you can watch random YouTube clips you encounter on the web without having these videos impact your video recommendations on YouTube.

Traditionally, websites have had to actively seek out and switch on the Privacy Enhanced Mode for their embedded videos. (Never mind that the GDPR theoretically should have made this mode the new default.) YouTube videos work the same in Privacy Enhanced Mode but without all the persistent tracking.

I made a quick extension for Firefox that lets users opt-in to Privacy Enhanced Mode for all YouTube embedded videos on all websites all over the web. Clicking on the YouTube logo or video title will open the main YouTube website and take the move the video out of Privacy Enhanced Mode.

[![Get this Mozilla Firefox add-on](https://cdn.synaps.media/control/content/images/2026/08/get-firefox-extension.svg)](https://addons.mozilla.org/en-US/firefox/addon/youtube-nocookie/?src=external-addonsbadge-ctrl.blog&ref=ctrl.blog)[![Get source on GitHub](https://cdn.synaps.media/control/content/images/2026/08/get-github-source.svg)](https://github.com/da2x/youtube-nocookie?ref=ctrl.blog) 

The extension does all its magic in the background and is entirely opaque to the user. However, you can find a running tally of how many embedded videos have been upgraded to Privacy Enhanced Mode by opening the extension’s option page from the Add-Ons Manager. Login to Firefox Sync to keep a tally of the extension’s effectiveness across all your devices.

The extension isn’t all that complex: all it does is block the browser from communicating with youtube.com/embed/ and redirects those requests to youtube-nocookie.com/embed/ instead.

Just to be clear: This has no effect on the main YouTube website. Oh, and as a bonus you may find that embedded videos load faster with Privacy Enhanced Mode enabled.

#### Sources

- [Embed videos & playlists](https://support.google.com/youtube/answer/171780?hl=en&ref=ctrl.blog), 2013, YouTube Help, Google
### Web Reading Mode: A bad reading experience
URL: https://www.ctrl.blog/entry/browser-reading-mode-experience/
Last updated: 2026-08-23T22:02:46.000Z
Reading mode doesn’t offer a consistently good experience for readers, it doesn’t offer publishers anything at all, and web developers don’t have any documentation for it. It’s a bad experience for everyone involved.

This article is part four in a series on web reading mode and reading mode parsers.

1. [**The non-standard rendering mode**](https://www.ctrl.blog/entry/browser-reading-mode-parsers/)  
The history of reading mode, a look at the different parsers we have today and how they came to be, and a small criticism of the Apache 2.0 license.
2. [**Determining the main page content**](https://www.ctrl.blog/entry/browser-reading-mode-content/)  
There are many approaches to content-analysis and extraction, and most only work well with English-content. Why is reader mode so slow to activate, anyway?
3. [**Title, author, and date metadata extraction**](https://www.ctrl.blog/entry/browser-reading-mode-metadata/)  
Visual page inspections, standard metadata, or guesswork? Everyone has their own ideas about how to best determine the metadata describing an article.
4. **A bad reading experience**  
Encourage publishers to fix their designs, and standardize reading mode now.

### Bad experiences

Imagine if leading web browsers all had a toolbar button that seemingly at random appears on some webpages, after a seemingly random period of time after it has loaded, and that performs a weird and unexplained action with mixed results when pressed. This is exactly how reading mode works in web browsers today — for readers and web developers alike.

Readers have no guarantee of what will happen when they press the button. They may get a neat and clean copy of the article they intended to read, or they may get a high junk-to-content ratio, or they may get an unexpected article instead. My favorite is the new trend of showing privacy/cookie/GDPR screens instead of the expected article. Experience with pressing the button may teach readers that it works well on some websites and not others. They may remember which pages works well with but more likely they’ll learn to completely ignore the button.

Web developers likewise have little to no published standards or guidelines to work with when trying to adopt their content to reading mode.

I began this series comparing the promise of reading mode with the expectations readers have for the ideal paper printout of a webpage. As anyone who’ve printed a webpage knows, the results will be mixed and quite often disappointing.

Publishers may not know that they’ve a readability problem with their pages. Reading mode can be great for readers, but ideally publishers should be encouraged to reduce distractions and fix their designs instead. One potential way to achieve this would be to emit a measurable event when users abandon their web designs in favor of reading mode.

Safari Reader overlays reading mode on top of the regular webpage, but doesn’t emit a `visibilitychange:hidden` event even though it’s clearing hiding the page from view. Other web browsers all replace the current page with a separate page in reading mode and emit a `visibilitychange:hidden` event as they unload the old page. One idea that would work for both types of implementation is to extend the Page Visibility API to first emit something like a `visibilitychange:enteringReaderMode` event and then a second `visibilitychange:hidden` event either when hiding or unloading a page in favor of a reading mode.

This proposal wouldn’t give publishers a chance to block a user from entering reading mode, but it would allow them to measure it.

Publishers may not be too happy about reading mode. Reading mode cuts them off from their advertisement revenue and can make a mess of carefully laid out content. Publishers aren’t afforded to even display their name and link back to their home pages for pages in reading mode. Sure, Edge and Firefox will show “www.nytimes.com” at the top of each article but it won’t spell out The New York Times.

### Overdue for standardization

The user experience suffers as a result as web developers don’t have the required information to make their websites display properly in reading mode. Readers are left guessing at whether an important paragraph of text, or an image or video have been omitted from the article or not when reading in reading mode.

Even a motivated web developer will have trouble figuring out exactly how reading mode works in any given browser. What little information that have been published about reading modes before have been almost entirely speculative.

Mozilla Readability’s weird title detection rules are particularly arcane. It’s bad for the open web that a few leading North-American video hosting services are given preferential treatment within web browsers to exclusively allow their video content to be played inside reading mode.

Readability.js was a neat trick back in the day and it’s still an excellent prototype. However, it has created an entirely separate rendering mode inside the web browser. Given its central placement in all the leading web browsers sans Google Chrome it’s overdue for a formal specification and standardization across web browsers.

Web browser vendors need to come together and rethink what reading mode is and how it should work. Individual web browser vendors can continue to tweak and improve reading mode over time. However, it’s not the 90’s anymore. The web wants standards and not vendor-specific solutions to universal problems.
### Web Reading Mode: Title, author, and date metadata extraction
URL: https://www.ctrl.blog/entry/browser-reading-mode-metadata/
Last updated: 2026-08-23T22:02:47.000Z
This article goes into the nitty-gritty details of how reading mode parses certain metadata about articles from webpages.

This article is part three in a series on web reading mode and reading mode parsers.

1. [**The non-standard rendering mode**](https://www.ctrl.blog/entry/browser-reading-mode-parsers/)  
The history of reading mode, a look at the different parsers we have today and how they came to be, and a small criticism of the Apache 2.0 license.
2. [**Determining the main page content**](https://www.ctrl.blog/entry/browser-reading-mode-content/)  
There are many approaches to content-analysis and extraction, and most only work well with English-content. Why is reader mode so slow to activate, anyway?
3. **Title, author, and date metadata extraction**  
Visual page inspections, standard metadata, or guesswork? Everyone has their own ideas about how to best determine the metadata describing an article.
4. [**Inconsistent and bad reading experience**](https://www.ctrl.blog/entry/browser-reading-mode-experience/)  
Encourage publishers to fix their designs, and standardize reading mode now.

### What metadata is extracted? and why?

Every reading mode wants to display an appropriate title for the displayed article. However, some also include a byline as well. A byline is often the very first paragraph below the headline of an article; crediting the article author. Bylines often include the publication time as well as the name of the author.

The following table gives an overview of which implementations use which parsers, the metadata they extract, and the method they use to extract it.

__The ultimate Reading Mode metadata-extraction compatibility table__
| Product                   | Parser               | Metadata               |             |            |
| ------------------------- | -------------------- | ---------------------- | ----------- | ---------- |
| Title                     | Author               | Date                   |             |            |
| GNOME Web                 | Mozilla Readability  | document.title         | meta author | none       |
| Mozilla Firefox           | Readability-specific |                        |             |            |
| Vivaldi                   | none                 |                        |             |            |
| Yandex Browser            |                      |                        |             |            |
| Samsung Browser (Android) |                      |                        |             |            |
| Apple Safari              | Safari Reader        | Safari-specific        |             |            |
| Maxthon                   | Maxthon Reader       | Maxthon-specific       | none        |            |
| Microsoft Edge            | EdgeHTML             | Edge-specific          |             |            |
| Microsoft Edge (Android)  | DOM Distiller        | DOM Distiller-specific | none        |            |
| Google Chrome (Android)   |                      |                        |             |            |
| Mercury Reader            | Web Reader           | Mercury-specific       | meta author | Open Graph |
| Instapaper                | Instaparser          | Open Graph             |             |            |
| Mozilla Pocket            | Unknown              | Site-specific parsing  |             |            |

Dates, when included, are displayed in the format they’re in when detected on the page. None of the parsers try to parse the date string or do any kind of localization on it.

The rest of the article will go into details about each of the above parsers and how they pick out metadata. Before I get into that, I’ll quickly address a common problem which may very well be the reason why you’re reading this article.

### Avoiding duplicate bylines and dates

You may see an unwanted (in reading mode implementations that doesn’t support it) or duplicated (in reading mode implementations that does) byline or publication date. It can be difficult to work out how to get rid of these.

The following markup will solve this problem in all reading mode implementations assuming that the parser in question can properly detect both the author and publication time. This works even in browsers that don’t make use of the byline.

```html
<article>
 <h2>Article Title</h2>
 <p>
   by <span class="author byline">Cave Johnson</span>
   on <time class="dateline">2018-08-09</time>
 </p>
 […]
</article>
```

Note that the above isn’t a one-stop answer to proper metadata-extraction in all reading mode implementations. However, the above markup example will allow the parser to remove the byline paragraph. The dateline or byline will be removed from the document (assuming they’ve matched the value held by the parser); leaving a less than 25-characters paragraph which, [as discussed in Part 1](https://www.ctrl.blog/entry/browser-reading-mode-parsers/), will be removed from the document also.

Now that that’s out of the way, lets get into the real nitty-gritty details of reading mode metadata-extraction.

### Author name in Mozilla Readability, Maxthon Reader, and Mercury Reader

This is the most straight-forward and even web standard compliant detection method. Mozilla Readability, Maxthon Reader, and Mercury Reader will find the first instance of an `meta[name="author"]` element in the document and use its value as the primary candidate for the author name.

The below example will set the author name to “Cave Johnson”:

```html
<meta name="author" content="Cave Johnson">
```

Mozilla Readability as well as Maxthon Reader also supports other detection mechanisms including `*[rel="author"]`, but these methods are unreliable and difficult to work with as they involve DOM-distance and depth-difference calculations from the perceived beginning of the article body text.

### Titles in Mozilla Readability-method

There are two primary methods used to determining the article title and both derive it from the first `<title>` element in the document (same as the `document.title` property). GNOME Web is the exception here and just uses the `document.title` verbatim.

The first method looks for a segment separator consisting of the character sequence: space + separator + space; where the separator is one of the following characters: `-`, `>`, `»`, `|`, `\`, or `/`. If such a sequence if found, the leftmost segment is considered the candidate for the document title. A `document.title` of “Article Title - Example Website” would get “Article Title” as the candidate title.

If the first method fails, the second method is tried instead. This method looks for a word followed by a colon (`:`) and a space character and the second segment from the left is considered the title candidate. A `document.title` of “Example Website: Article Title: Extra” would get “Article Title” as the candidate title.

There’s no support for right-to-left (RTL) script systems and languages.

In both of our above examples, the candidate title is “Article Title”. The candidate title is then evaluated against the following criteria:

- The title must contain at least five space-separated words
- The title must contain between 16–150 characters (sorry CJK languages!)

Both the example candidates above resulted in the candidate title “Article Title”; which doesn’t pass the above criteria. It has fewer than five words and is less than 16 characters. In this situation, the original `document.title` is used instead.

Many websites and content management systems use other segment separators, such as mid-dots (·) and bullets (•), which also aren’t compatible with Readability. WordPress for example, uses an en-dash (–) instead of a hyphen-minus (-) character as the segment separator as is as such not supported by default.

### Safari Reader

Apple’s fork of Readability has little in common with Mozilla Readability and is more than twice the size.

Safari Reader finds the title by visually examining the document to find what it determines to be the most likely document title. Candidates are evaluated by how near they are to what Safari Reader determines is the visual top of the article as well as their Levenshtein distance from the `document.title`.

Once the title has been selected, Safari can pick out the author byline from elements with class names such as `author-name`, `article-author`, among others, or other candidates like `a[rel="author"]`. The publication date is usually the `date` element nearest the title, or an element with class names like `dateline` or `entry-date`. The candidate that’s visually nearest the title is usually selected.

Safari sources the Schema.org microdata and Open Graph Protocol metadata from the document, but these are never used to populate the byline. They’re only used to confirm the selection after candidates have already been selected.

To ensure Safari Reader compatibility, you can add class names it wants to see. In the end, Safari Reader requires trial and error to ensure compatibility.

### Maxthon Reader

Maxthon Reader is a fork of Mozilla Readability, but also clearly inspired by Safari Reader, and adjusted and optimized for Chinese, Japanese, and Korean (CJK) language websites. Maxthon Reader employs several site-specific fixes for popular Chinese-language news websites.

The title selection algorithm is mostly based on going through all the `h1`–`h6` elements in the document, and measuring their visual size, measuring their distance from the visual top of the document, and determining whether they’re partial matches of the `document.title`. The title has to be at least four characters long. The `document.title` is used in its entirety if it can’t find a matching headline in the document.

### Microsoft Edge

Edge is the only web browser that has published any guidelines for web developers! 🎉

The title is selected from a `meta[name="title"` element. Its value should match either an `h1`–`h3` element (preferably with a `title` class name), OR yield a partial match in the `document.title`. That is astonishingly straight forward compared to many of the other methods discussed in this article, and it’s even officially documented!

The author byline is selected from the first element in the article that contains a `byline-name` class name. The publication date is likewise the first element that contains the `dateline` class name, OR it can pick a `meta[name="displaydate"]` element. Simple, right?

However, Edge seems quite buggy with these two items and will often ignore the byline and dateline entirely. Reloading and trying again usually helps.

A complete example for Microsoft Edge looks like this:

```html
<title>Article Title | Example Website</title>
<meta name="title" content="Article Title">
<p>by <span class="byline-name">Cave Johnson</span></p>
<p>on <span class="dateline">August, 9th 2018</span></p>
```

Edge also recognizes some other (undocumented) detection methods like `meta[name="auhtor"]`, and class names like `entry-date`, `publish-date`, and `.fn.auhtor`.

### Chrome DOM Distiller

The Chrome DOM Distiller by Google is only [reluctantly included in Chrome for Android](https://www.ctrl.blog/entry/chrome-simplified-view-android/) and hidden under an option in the accessibility menu. It’s featured more prominently in Microsoft Edge for Android, however.

I frankly don’t have any idea of it works. Chrome DOM Distiller is more than 23 000 lines of Java and I haven’t been able to make heads or tails of how it works.

### Mercury Reader

Mercury Reader, available as a browser extension to Google Chrome, uses the `h1`–`h4` nearest to the top of what it determines to be the article.

As discussed above, Mercury Reader extracts the article author from the `meta[name="author"]` element. It extracts the publication date through the Open Graph Protocol which is the same method we’ll discuss next.

### Instaparser (Open Graph Protocol)

I was surprised to learn that only Instaparser uses Open Graph Protocol metadata. This is the metadata tags that Facebook and other social networks use to extract metadata from websites and generate rich-link sharing experiences. They’re widely supported by all major news websites and blogs.

I’ve discussed limitations of [RDFa parsers used by social media websites](https://www.ctrl.blog/entry/rdfa-socialmedia-metadata/) in the past. The property attribute is supposed to contain space-separated values, but the social networks as well as Instaparser can only process metadata if the property attribute is a single value and contains no spaces. Instapaper also has issues recognizing meta tags if they’ve got unexpected extra attributes.

Instaparser uses a non-standards compliant Resource Description Framework in Attribute (RDFa) parser to extract Open Graph Protocol (OGP) metadata including the title and byline author complete with publication date

```html
<meta property="og:title" content="Article Title">
<meta property="article:author" content="Cave Johnson">
<meta property="og:site_name" content="Example Website">
<meta property="article:published_time" content="2018-08-06T12:54:47+00:00">
```

### Pocket

Lastly, there’s Pocket and my recommendation isn’t to bother with it at all. Pocket doesn’t publish any recommendations for web developers. The only thing that’s known about their parser is that it relies heavily on site-specific parsing.

I’ve run the same test documents through Pocket from different URLs and ended up with different results. Pocket’s parser picks up odd links in the middle of the article or in surrounding site navigation and sets it as the author. Pocket also struggles with articles that are split up into sections with subheadings, often selecting a random section in the middle of the article instead of the full article.

I’ve contacted Pocket several times asking for details about their parser, and asking specifically for help resolving compatibility issues with my own websites to no avail. Pocket will either work to support your site or they won’t. There isn’t much you as a web developer can do to influence it.

Continue reading part four: [Inconsistent and bad reading experience](https://www.ctrl.blog/entry/browser-reading-mode-experience/) →

#### Sources

- Vivaldi, version 1.15.1147, 2018-08-07, Vivaldi Technologies
- SafariShared.framework, version 14606, 2018-08-06, MacOS 10.14 beta 5, Apple
- [Readability.js](https://github.com/mozilla/readability/blob/7cf95bd427a3ebb8877e00c25a80423f8fbcd7cd/Readability.js?ref=ctrl.blog), commit 7cf95bd427, 2018-07-24, Readability project repository, Mozilla, GitHub
- Maxthon, version 5.2.3.4000, 2018-06-28, Maxthon
- Microsoft Edge, version 171717134.191, 2018-05, Microsoft
- [Add clean reader mode](https://gitlab.gnome.org/GNOME/epiphany/-/commit/349587cff9c234d46411f691a2305846a951b79a?ref=ctrl.blog), commit 349587cff9, 2018-06-05, Jan-Michael Brummer, GNOME Web project repository, GitLab, GNOME Foundation
- [Designing HTML for Safari Reader Mode](https://www.client9.com/designing-html-for-safari-reader-mode/?ref=ctrl.blog), 2018-04-10, Blog, Nick Galbreath
- [h-entry](https://microformats.org/wiki/index.php?title=hnews&oldid=49426&ref=ctrl.blog), revision 49426, 2018-04-01, Microformats Wiki, Microformats
- [The limitations of Firefox’s Reader mode](https://utcc.utoronto.ca/~cks/space/blog/web/FirefoxReaderModeLimitations?ref=ctrl.blog), 2018-01-28, Chris Siebenmann, CSpace blog
- [Reading view](https://web.archive.org/web/20180823190914/https://docs.microsoft.com/en-us/microsoft-edge/dev-guide/browser-features/reading-view), 2017-10-18, Microsoft Edge documentation, Microsoft Docs, Microsoft
- [Fathom: a framework for understanding webpages](https://hacks.mozilla.org/2017/04/fathom-a-framework-for-understanding-web-pages/?ref=ctrl.blog), 2017-04-26, Erik Rose, Mozilla Hacks, Mozilla
- [Website metadata and improved reading mode support](https://www.brendanlong.com/website-metadata-and-improved-reading-mode-support.html?ref=ctrl.blog), 2015-11-17, Blog, Brendan Long
- [Control text parsing for your site with HTML](https://www.instapaper.com/publishers?ref=ctrl.blog), 2013-09, Publishers, Instapaper
- [Your content’s author](https://mislav.net/2012/08/authorship/?ref=ctrl.blog), 2012-08-02, Mislav Marohnić
- [Article Publishing Guidelines](https://web.archive.org/web/20120814121016/http://www.readability.com/developers/guidelines), 2012-08, Content Guide, Developers, Readability
### Web Reading Mode: Deter­mining the main page content
URL: https://www.ctrl.blog/entry/browser-reading-mode-content/
Last updated: 2026-08-23T22:02:46.000Z
Humans know full-well what the main content of any given page are. Regardless of how many advertisements, social widgets, cookie overlays, or other distractions there are; humans can always spot the actual content. Reading mode maybe not so much.

This article is part two in a series on web reading mode and reading mode parsers.

1. [**The non-standard rendering mode**](https://www.ctrl.blog/entry/browser-reading-mode-parsers/)  
The history of reading mode, a look at the different parsers we have today and how they came to be, and a small criticism of the Apache 2.0 license.
2. **Determining the main page content**  
There are many approaches to content-analysis and extraction, and most only work well with English-content. Why is reader mode so slow to activate, anyway?
3. [**Title, author, and date metadata extraction**](https://www.ctrl.blog/entry/browser-reading-mode-metadata/)  
Visual page inspections, standard metadata, or guesswork? Everyone has their own ideas about how to best determine the metadata describing an article.
4. [**Inconsistent and bad reading experience**](https://www.ctrl.blog/entry/browser-reading-mode-experience/)  
Encourage publishers to fix their designs, and standardize reading mode now.

### Content analysis basics

It hasn’t always been the case, but web developers today can expect that their websites will look and behave mostly the same across the different standards-compliant web browsers. There’s good and plentiful documentation for the standard web however this isn’t at all the case with reading mode. This is where I wish I could write-up a neat summary of how the different reading mode parsers (see table in part one) detect the main content of the page and provide some useful guidelines into how you can ensure your pages are compliant. Unfortunately, there’s no neat summary or guidelines to work from besides the following algorithm:

All the different reading mode parsers try to identify an HTML element that contains a significant portion of text at nearly the same depth in the Document Object Model (DOM). Each node in the DOM is scored and evaluated against a varied set of criteria. Generally, nodes with little textual content or that consists mostly of links may be ignored entirely (including illustrations and tables). The exact criteria vary greatly from parser to parser.

The exact text selection algorithms are complex and varies from implementation to implementation. For example, Mozilla Readability evaluates and scores candidate DOM nodes based on the total number of characters in each node and how many commas (“”), there are in the complete text. Mozilla Readability makes some assumptions here about the average length of a paragraph of text, and the use of commas that don’t hold true in every text or in every language. I’ll get back to this in the next section. Maxthon Reader and Safari Reader works the same way, but adjust the scores significantly based on whether the content is visible on screen at the moment the reading mode button is pressed.

### So, what is the main content?

The semantic HTML5-standard way to determine the main content of a page would be to look for the `<main>` or `<article>` elements. When it comes to reading mode, there’s little consensus. For reading mode, you either need significant amounts of content near the same DOM-level, or some luck.

Pocket gets confused by articles with `<section>`s in them, and will often pick the largest section of an article and display that as the entire article; ignoring every other section of the article. Early versions of Microsoft Edge also did this, but this has improved in later versions.

Safari Reader considers any `<footer>`s inside the main content (such as the sources list at the bottom of this page) to be part of the main content, while Readability explicitly hides footers. Apple Readability also does a good job at hiding inline advertisements and “suggested reading” call-to-actions link paragraphs inside articles. However, it sometimes hides short paragraphs that are a part of the main content. Web developers can direct this somewhat by applying the `instapaper_hide` class name to elements they wish to hide. Instaparser and Apple Readability are the only two implementations that support this explicit class name.

Some reading mode parsers work with some video embeds. Some will only allow video embeds from youtube.com and other may only allow videos embedded from youtube-nocookie.com and dailymotion.com. Others still only allow the native audio and video elements, while even others allow no embedded content at all, and many of the largest video hosting websites on the web aren’t allowed anywhere.

Chrome DOM Distiller finds the DOM node it think is the most likely to be the article, and copies it over into reading mode as-is which often result in cluttered pages.

Every browser will analyze page content when the page has finished loading. Which is why it can take some seconds before the reading mode button appears in browser’s main toolbar. However, websites that use infinite-scrolling or other dynamic loading behavior may load their content after the main document is loaded. Every reading implementation is overall terrible with determining which article is on screen at the moment; meaning that when you click on the Reading Mode button you may see an unexpected article instead of the article you were reading.

### Content analysis internationalization issues

Reading mode is optimized for use with Latin script and European languages, or if we’re being totally honest it’s optimized exclusively for the English language. I’m not an internationalization expert but I’ve identified a couple of serious issues with the popular reading mode parsers.

Mozilla Readability scores text blocks based on the total number of characters in each block and how many commas (“”), there are in the text in total. However, not every languages and writing system uses the same character density in sentences or paragraphs, and not every language and writing system use the same character for the role that the humble comma serves in most European languages.

__Comma internationalization support table__
| Script               | Symbol | Unicode | Readability |
| -------------------- | ------ | ------- | ----------- |
| Most European        | ,      | U+2C    | Supported   |
| Arabic               | ،      | U+60C   | Unsupported |
| Chinese and Japanese | 、      | U+3001  |             |

Unicode includes more than 30 additional symbols not included in the above table that serve the same purpose as commas in stylistic settings and in other writing systems and languages. Additionally, some European languages rely more on the en-dashes (–) or em-dash (—) where other languages would use a comma.

In CJK languages, you would normally count each character as a complete word and not just a single character. Mozilla Readability’s algorithm doesn’t address this issue at all. The Apple-fork and Maxthon-fork of Readability addresses these issues by relying more on how much visual space the whole article takes up on screen instead of character counts.

Only Safari Reader and Microsoft Edge reliably supports right-to-left (RTL) languages like Arabic, and only these browsers have specifically set fonts for Arabic script. Only Safari Reader and Maxthon Reader has consistent and good support for even triggering reading mode for Chinese, Japanese, and Korean (CJK) languages. Only Vivaldi supports vertical text orientation and layouts as used in CJK languages, but will often not offer reading mode because of the Latin script and English language oriented content selection algorithm.

Mozilla Readability determines the document title based on a selection algorithm described in detail in [part three](https://www.ctrl.blog/entry/browser-reading-mode-metadata/). This algorithm always derives titles left-to-right (LTR) which, of course, doesn’t work too well in RTL languages.

### Stale content

Instapaper and Pocket saves copies of reading-mode parsed pages with the services when you or anyone else save a given webpage. This saves these services huge amounts of potentially duplicated work for parsing and storing these articles. These savings also creates some issues that are unique to them.

The page that gets saved isn’t necessarily the same page you wanted to save. It could be years out of date and lack refinements like spelling corrections and updates to the original article. Even if you’re the only reader who’ve saved a specific webpage to the service, that copy could still be out of date by the time you want to read it. Say you saved a breaking news story in the morning and then began reading it later in the next afternoon. You’d miss out on any developments, updates, and corrections that have been added to the original story.

Neither service offer publishers a method to notify them of updates to articles, and they don’t support HTTP cache-revalidation or any of the other standard control mechanisms for content delivery on the web. Readers also don’t have a way to force-update a saved page but have to check in with the page they originally saved to see if it has been updated since it was first saved with the service.

Safari Reader also has a reading list and also stores articles for later offline consumption but it will also redownload pages if it has been awhile since you saved it to prevent them from going stale.

Continue reading part three: [Title, author, and date metadata extraction](https://www.ctrl.blog/entry/browser-reading-mode-metadata/) →

#### Sources

- Vivaldi, version 1.15.1147, 2018-08-07, Vivaldi Technologies
- SafariShared.framework, version 14606, 2018-08-06, MacOS 10.14 beta 5, Apple
- [Readability.js](https://github.com/mozilla/readability/blob/7cf95bd427a3ebb8877e00c25a80423f8fbcd7cd/Readability.js?ref=ctrl.blog), commit 7cf95bd427, 2018-07-24, Readability project repository, Mozilla, GitHub
- Maxthon, version 5.2.3.4000, 2018-06-28, Maxthon
- Microsoft Edge, version 171717134.191, 2018-05, Microsoft
- [Designing HTML for Safari Reader Mode](https://www.client9.com/designing-html-for-safari-reader-mode/?ref=ctrl.blog), 2018-04-10, Blog, Nick Galbreath
- [Vertical reader mode](https://vivaldi.com/blog/three-years-of-innovation/?ref=ctrl.blog), 2018-01-31, Jon von Tetzchner, Vivaldi Blog, Vivaldi Technologies
- [The limitations of Firefox’s Reader mode](https://utcc.utoronto.ca/~cks/space/blog/web/FirefoxReaderModeLimitations?ref=ctrl.blog), 2018-01-28, Chris Siebenmann, CSpace blog
- [Reading view](https://web.archive.org/web/20180823190914/https://docs.microsoft.com/en-us/microsoft-edge/dev-guide/browser-features/reading-view), 2017-10-18, Microsoft Edge documentation, Microsoft Docs, Microsoft
- [Readability algorithm](https://github.com/mozilla/fathom/wiki/Readability/5091603b47109a5317253241dbfbb7bdb03394cd?ref=ctrl.blog), commit 5091603b47, 2016-03-28, Erik Rose, Mozilla, GitHub
- [A New Parser](https://blog.instapaper.com/post/137288701461?ref=ctrl.blog), 2016-01-14, Instapaper blog, Instapapr
- [Article Publishing Guidelines](https://web.archive.org/web/20120814121016/http://www.readability.com/developers/guidelines), 2012-08, Content Guide, Developers, Readability
- [And what of art direction?](https://web.archive.org/web/20110530143701/http://blog.readability.com/2011/05/and-what-of-art-direction/), 2011-05-11, Richard Ziade, Readability blog, Readability
- [Preview: Community text-parser configuration](https://blog.instapaper.com/post/730281947?ref=ctrl.blog),  2010-06-23, Marco Arment, Instapaper blog, Instapaper
### Web Reading Mode: The non-standard rendering mode
URL: https://www.ctrl.blog/entry/browser-reading-mode-parsers/
Last updated: 2026-08-23T22:02:47.000Z
All the leading web browsers, except for Google Chrome, include a separate “reading mode” that extracts the main content from pages, reformats it to be more readable, and hides distractions like advertisements, comments, and even page navigation. This separate rendering mode isn’t governed by any standards and as such it behave differently from web browser to web browser. So, what is a web developer to do to properly support this distinctly separate and non-standard rendering mode?

This article is part one in a series on web reading mode and reading mode parsers. The article is broken up into multiple parts as each part is written for a slightly different audience.

1. **The non-standard rendering mode**  
The history of reading mode, a look at the different parsers we have today and how they came to be, and a small criticism of the Apache 2.0 license.
2. [**Determining the main page content**](https://www.ctrl.blog/entry/browser-reading-mode-content/)  
There are many approaches to content-analysis and extraction, and most only work well with English-content. Why is reader mode so slow to activate, anyway?
3. [**Title, author, and date metadata extraction**](https://www.ctrl.blog/entry/browser-reading-mode-metadata/)  
Visual page inspections, standard metadata, or guesswork? Everyone has their own ideas about how to best determine the metadata describing an article.
4. [**Inconsistent and bad reading experience**](https://www.ctrl.blog/entry/browser-reading-mode-experience/)  
Encourage publishers to fix their designs, and standardize reading mode now.

### What is reading mode?

Reading mode is an alternative web rendering mode where the web browser try to strip out repeated and irrelevant content; such as page navigation, ads, and distractions. The main article is extracted and brought to the front, and displayed in a clean and consistent page design.

Reading mode is increasingly useful as more and more websites seem to have abandoned any ideas of design and readability and focus on littering their pages with as much noise as they can fit in on to a single page.

You can think of reading mode as what you would think of as the ideal paper-print copy of an article you’re reading online. However, like when printing webpages, reading mode can produce odd results and you end up with a useless page.

I’ll look into how reading mode parsers extract the main content and metadata from webpages in part two and three of this series. Before that, however, I’d like to start by establishing a sort of history of reading mode parsers and then quickly talk about parser diversity and the lack of standards for reading modes.

### Readability.js and the birth of a new rendering mode

[Instapaper](https://www.instapaper.com/?ref=ctrl.blog) was first on the scene in 2008 with their ability to extract text from webpages; remove page navigation, ads, and distractions, and even make regular webpages readable on iPhone back before the “mobile-first” mentality had set with web developers. Instapaper also let users bookmark webpages and save them for later. However, Instapaper’s proprietary license make them little more than a footnote in the history of web reading modes.

Arc90 was inspired by Instapaper, and launched the Readability bookmarklet (an early form of a web browser extension) a year later. Readability.js was a parser that could extract the main text of a webpage, and would reformat it with large and readable text in an era where most websites still relied on tiny text to better serve visitors with smaller older displays. More importantly, Readability.js was released under the Apache 2.0 software license. In brief, this is a permissive license that allows anyone to take the source and built upon it — even for commercial purposes — without sharing the sources of the changes they make to the software.

A few months later, Arc90 launched Readability.com as a reading list and reading mode web service. The service was discontinued in 2016, but I’ll cover reading as a service in more detail in part four.

Readability.com made improvements to Readability.js which gave web publishers more control over the appearance of their content in reading mode, but they didn’t share these changes back to the open-source project and discontinued Readability.js entirely in 2010.

### Readability.js makes the leap to web browsers

Apple picked up Readability.js in 2010 (probably contributing to Arc90’s decision to stop maintaining it), bundled it and gave its own Reader button in their Safari 5 web browser for MacOS and Windows. Safari Reader made the leap to iOS the following year. Apple has a reputation for clean and uniform designs, and it’s no wonder they preferred the neatness of Safari Reader to the busy and cluttered web designs many websites comes with from publishers.

Over the years, Safari have made changes and improvements to Readability.js in their own proprietary fork known as Apple Readability. Apple’s changes are quite extensive, and Apple Readability is probably the most capable reading mode parser available today.

In 2014, Microsoft introduced Reading View in Internet Explorer 11\. This reading mode uses Microsoft’s own proprietary parser, loosly inspired by Readability.js. Mozilla didn’t want to be left behind and introduced their own Reader View in Firefox 38 the following year. Mozilla forked the abandoned 2010\-version of Readability.js and re-released it as Mozilla Readability. Mozilla Readability has received some updates but no major overhauls. Mozilla Readability is also licensed under the Apache 2.0 license.

Mozilla Readability’s permissive license made it the de-facto reading mode parser found in everything from the Samsung Browser for Android to niche web browsers like GNOME Web, Maxthon, Vivaldi, and Yandex Browser.

Maxthon have also forked Mozilla Readability as their own proprietary Maxthon Reader with optimization for Chinese-Japanese-Korean (CJK) language specific content parsing and introduced some Apple Readability-inspired parsing rules.

### Reader mode parser diversity

I’ve been talking a lot about Readability.js so far. There are quite a few other reading mode parsers, however. Here is a quick overview of web browsers and services and which parser they’re known to use:

| Vendor        | Product              | Parser              | Environments               |
| ------------- | -------------------- | ------------------- | -------------------------- |
| Mozilla       | Firefox              | Mozilla Readability | Desktop and Android        |
| GNOME         | Web                  | Desktop             |                            |
| Vivaldi       | Vivaldi              |                     |                            |
| Yandex        | Browser              |                     |                            |
| Samsung       | Browser              | Android             |                            |
| Apple         | Safari               | Safari Reader       | MacOS and iOS              |
| Maxthon       | Maxthon              | Maxthon Reader      | Desktop                    |
| Microsoft     | Edge                 | EdgeHTML            | Windows and Windows Mobile |
| Edge Mobile   | Chrome DOM Distiller | Android             |                            |
| Google        | Chrome               |                     |                            |
| Postlight     | Mercury Reader       | Web Reader          | Web / browser extension    |
| Instant Paper | Instapaper           | Instaparser         |                            |
| Mozilla       | Pocket               | Unknown             |                            |

One notable absentee in the above table is the market leader on the desktop: Google Chrome. Google is primarily an advertisement company, and they’re not too keen on any technology that aims to hide advertisements and distractions. Chrome for Android has an optional [reading mode hidden away in the accessibility menu](https://www.ctrl.blog/entry/chrome-simplified-view-android/).

### No standards, little documentation

One of the big problems with reading mode is that there’s no standards for how it’s supposed to work, and I can find little evidence of cooperation between the different reading mode parser vendors. More worryingly, only Microsoft has ever published any documentation about how their reading mode work and how web developers can target it; yet theirs is the parser that there’s the least information available about.

Ideally, web developers should be able to deliver a consistent and good user experience for their users in reading mode. However, web developers who want to support reading mode have a tedious job of testing and retesting across all the different reading modes; all of which behave differently and have different and even conflicting ideas on the way documents should be structured.

The majority of web browsers don’t set a custom URI for content displayed in reading mode, but all the market leading browsers do — yet they’ve been [unable to agree on what URI to use](https://www.ctrl.blog/entry/browser-reading-view-uri/). An agreement on what URI to use would mean websites, or even external programs, could link directly to a page in reading mode. This is indeed possible in some browsers, but only Safari and Microsoft Edge have registered their reading mode URIs in the operating system and enabled other programs to open pages directly in their reading modes.

Reading mode is unreliable for users as even though they’ve experienced that it works on a given website before, they never know whether the button will appear in their browser or whether the whole article will be included once they click it. Clicking on the reading mode button is always a bit of a gamble.

### There was almost a standard

After Readability.com went proprietary, they settled on the [hNews microformat](https://microformats.org/wiki/hNews?ref=ctrl.blog) as the preferred way of parsing pages while keeping what is now the Mozilla Readability implementation as a fallback. hNews is a structured metadata format that adds semantics for identifying titles, publication time, authors, and even the summary and the main content of an article. In other words, there was a defined standard for parsing documents and retrieving both the metadata and the main content.

The hNews microformat did gain some traction, but have since been superseded by the [h-entry microformat](https://microformats.org/wiki/h-entry?ref=ctrl.blog). h-entry microdata is everywhere on the web thanks to it being included by default in the default themes produced by leading content management systems as well as being recognized as a semantic data structure by leading search engines like Bing, Google, and Yandex.

There was aaalmost a standard in place. The only trouble was that Readability.com had stopped contributing to their open-source Readability.js repository, so these changes never made it into Apple or Mozilla’s forks of Readability. The web continued with the non-microformats oriented legacy Readability implementation. When you hear someone argue against the use of the Apache 2.0 software license for open-source projects, things like this is what they’re referring to.

Continue reading part two: [Determining the main page content](https://www.ctrl.blog/entry/browser-reading-mode-content/)

#### Sources

- Vivaldi, version 1.15.1147, 2018-08-07, Vivaldi Technologies
- SafariShared.framework, version 14606, 2018-08-06, MacOS 10.14 beta 5, Apple
- [Readability.js](https://github.com/mozilla/readability/blob/7cf95bd427a3ebb8877e00c25a80423f8fbcd7cd/Readability.js?ref=ctrl.blog), commit 7cf95bd427, 2018-07-24, Readability project repository, Mozilla, GitHub
- Maxthon, version 5.2.3.4000, 2018-06-28, Maxthon
- Samsung Browser, version 7.2, 2018-06-20, Samsung
- [Add clean reader mode](https://gitlab.gnome.org/GNOME/epiphany/-/commit/349587cff9c234d46411f691a2305846a951b79a?ref=ctrl.blog), commit 349587cff9, 2018-06-05, Jan-Michael Brummer, GNOME Web project repository, GitLab, GNOME Foundation
- [h-entry (Microformats Specification)](https://microformats.org/wiki/index.php?title=h-entry&oldid=66805&ref=ctrl.blog), revision 66805, 2018-05-01, Microformats Wiki, Microformats
- Microsoft Edge, version 171717134.191, 2018-05, Microsoft
- [Reading view](https://web.archive.org/web/20180823190914/https://docs.microsoft.com/en-us/microsoft-edge/dev-guide/browser-features/reading-view), 2017-10-18, Microsoft Edge documentation, Microsoft Docs, Microsoft
- [What is Article View?](https://help.getpocket.com/article/1077-what-is-article-view?ref=ctrl.blog), 2017-06-28, Pocket Support, Pocket, Mozilla
- [Firefox 38 release notes](https://www.mozilla.org/en-US/firefox/38.0.5/releasenotes/?ref=ctrl.blog), 2015-06-02, Mozilla
- [Introducing Reading View in IE 11](https://learn.microsoft.com/en-us/archive/blogs/ie/introducing-reading-view-in-ie-11?ref=ctrl.blog), 2014-03-04, Jane Liles; Bonnie Yu, and Marty Hall, Internet Explorer blog, Microsoft
- [hNews 0.1 (draft specifiction)](https://microformats.org/wiki/index.php?title=hnews&oldid=49426&ref=ctrl.blog), revision 49426, 2012-12-29, Microformats Wiki, Microformats
- [Article Publishing Guidelines](https://web.archive.org/web/20120814121016/http://www.readability.com/developers/guidelines), 2012-08, Content Guide, Developers, Readability
- [And what of art direction?](https://web.archive.org/web/20110530143701/http://blog.readability.com/2011/05/and-what-of-art-direction/), 2011-05-11, Richard Ziade, Readability blog, Readability
- [Apple Updates Safari 5](https://www.apple.com/newsroom/2010/07/28Apple-Updates-Safari-5/?ref=ctrl.blog), 2010-07-28, Press Release, Apple
- [Readability](https://web.archive.org/web/20091027025835/http://lab.arc90.com/2009/03/02/readability), 2009-03-02, Arc90 Labs, Arch90
### The early end-of-life for Forza Horizon 2 is a game-cultural tragedy
URL: https://www.ctrl.blog/entry/forza-horizon-2-eol/
Last updated: 2026-08-23T22:07:32.000Z
Merely four years after release, Forza Horizon 2, will be pulled from the Microsoft Store. If you’ve already bought the game and all its add-ons, you can still play it. However, new players won’t be able to purchase the game and add-on content come the end of September 2018.

For those who may be unfamiliar with the title: Forza Horizon 2 is an Xbox One and Xbox 360 exclusive game featuring a large open-world driving experience set in Southern Europe. The game is centered around the Horizon Festival; a music and car event for the ages.

The game isn’t a realistic driving-simulator. Instead, it focuses of the feeling of freedom of roaming about the countryside in a fast car of your choice listening to fitting music. The atmosphere of the game is just great.

Forza Horizon 2 isn’t an outdated game and it runs on current-generation game consoles. It’s still awesome to play in the true sense of the word. It still *feels* stunning to watch, listen, play, and experience all of it. There’s no doubt about it: **Forza Horizon 2 is a masterpiece**.

Forza Horizon 2 opening cinematic

The in-game festival setting isn’t just a game gimmick either. Type in “forza horizon festival” into Google Search, and you’ll see auto-complete come up with things like “ticket prices” and “passes”, “when-” and “where’s it next”, and only at the very bottom of the list people are asking “is it real”. The in-game festival feels like a good thing and people clearly want to take part in it.

Yet after just four years of shelf life, Microsoft Studios will no longer be selling the game. It’s being pulled from Microsoft/Xbox Store by the end of September 2018.

I can’t even speculate on the development costs and the number of man hours involved in making this game. I do feel for everyone of the people who worked on the game, though. The game represents so much creative work and culture that it’s nothing short of a tragedy that it’s being pulled from market.

Players who’ve already purchased the game can continue playing it, and even re-download it from the Microsoft Store. New players and future generations won’t be able to experience the full game. You’ll likely find retail boxed copies of the game on online market places for years to come.

However, there are almost a hundred add-on cars available that don’t come in the box, as well as a large extra area to the open world: Storm Island. Storm Island focuses more on off-road driving and bad weather conditions and offers a quite different game experience from the main game/festival area.

The thing that irks me is that the game is primarily distributed digitally at no cost. The “shelf space” cost for Microsoft is virtually nothing. As long as some people purchase the game, they’d earn more money off it than if it’s just de-listed and made unavailable for purchase.

I highly doubt that online-multiplayer server maintenance costs are to blame for the situation. That could also be patched out at little cost by adding a few dialogs to the game’s menus. So, why did they decide to stop selling it?

The game features fantastic music from well-known artists which suit the fast-paced car and music festival excellently. It’s the music you’d expect to hear at a big festival. The game also features well known cars and car brands. All of these assets needs to be licensed, and it would seem that the publisher was only able to secure licensing of these assets for up to four years from publishing.

Re-licensing these assets would probably be a huge and costly undertaking. It would seem that licensing deals have given the game a short lease on life, even as a digitally distributed title.

Games like Grand Theft Auto will sometimes push patches that strip out music from their games after the licenses have expired. This might not sound all that feasible for a game staged around a music festival, but it was apparently on the table at one time. Robert John Gorham, the DJ responsible for the music selection in Forza Horizon 2 [told IGN in 2014](https://www.ign.com/articles/2014/08/28/how-a-british-dj-is-highlighting-indie-music-in-forza-horizon-2?ref=ctrl.blog) that We have talked about having a lot more versatile stations, maybe replacing tracks with updates in real time. The same article also discusses the game’s focus on \[cheaper\] indie music.

If you’ve bought the original Forza Horizon for the 360, you can play it through backwards compatibility on the Xbox One, but you can no longer purchase it anywhere. Like Forza Horizon 2, the original was de-listed from the Microsoft/Xbox Store four years after its initial release.

I’d normally expect to see these games — music, cars, and all — remain available for digital purchase for at least a decade, or at least until the next generation game consoles rolls out. To me, it seems like a poor return on investment to build these fantastically complex and labor intensive games only to halt sales after just four years on the market.

There’s something wrong with society when huge creative efforts like Forza Horizon 2 are just locked away in a digital warehouse somewhere rather than being made available for people to play and enjoy. I can almost hear future digital archivists and game historians scream in agony over a game title being pulled from the market after only four years. It can’t possibly be more profitable for any of the parties involved in these licensing deals to stop earning money off the game either.

At this point it might surprise you to learn that I don’t care about either cars or music festivals. They are two things that don’t intersect with my life in any meaningful way. I don’t have a driver’s license and sort cars by color instead of by manufacturer and model.

I don’t generally like racing games either. Yet, I’ve absolutely loved the original Forza Horizon for the Xbox 360, Forza Horizon 2 and 3 for the Xbox One, and no doubt the upcoming Forza Horizon 4 for Windows and Xbox One.

I hope no other game will experience the same fate as Forza Horizon 2\. I’m sadden by its fate and that more players won’t be able to experience the game. You should definitely pick up a copy of the game before its set to disappear by the end of September 2018. Forza Horizon 4 is due for release at the same time but that doesn’t in any way make up for the loss of an incredible game like Forza Horizon 2.

#### Sources

- [Forza Horizon 2 will reach “end of life” status next month and be removed from the Xbox store](https://www.eurogamer.net/forza-horizon-2-will-reach-end-of-life-status-next-month-and-be-removed-from-the-xbox-store?ref=ctrl.blog), 2018-08-19, Vikki Blake, Eurogamer, Gamer Network
- [Forza Motorsport Week in Review](https://web.archive.org/web/20180819180724/https://forzamotorsport.net/en-us/news/wir%5F8%5F17%5F18), 2018-08-17, Brian Ekberg, Forza Motorsports, Microsoft
- [Rockstar Pulls David Bowie And More From GTA IV](https://kotaku.com/rockstar-pulls-david-bowie-and-more-from-gta-iv-1825573281?ref=ctrl.blog), 2018-04-26, Ethan Gach, Kotaku, Gizmodo
- [Forza Motorsport Week in Review](https://web.archive.org/web/20161123034947/http://www.forzamotorsport.net/en-us/news/wir%5F9%5F23%5F16), 2016-09-23, Brian Ekberg, Forza Motorsports, Microsoft
- [How a British DJ is Highlighting Indie Music in Forza Horizon 2](https://www.ign.com/articles/2014/08/28/how-a-british-dj-is-highlighting-indie-music-in-forza-horizon-2?ref=ctrl.blog), 2014-08-28, Mike Mahardy, IGN, Ziff Davis
- [GTA San Andreas Steam Pulls Songs And Breaks Saves](https://www.rockpapershotgun.com/gta-san-andreas-steam-removes-songs?ref=ctrl.blog), 2014-11-10, Alice O’Connor, Rock–Paper–Shotgun, Gamer Network
- [How Do Real Cars End Up In Video Games? And Does It Help The Brands?](https://www.fastcompany.com/1669990/how-do-real-cars-end-up-in-video-games-and-does-it-help-the-brands?ref=ctrl.blog), 2012-06-08, Mark Wilson, Fast Company, Mansueto Ventures

Feature illustration courtesy of the Forza Horizon 2 website.
### Customize time and date formats in the GNOME top bar
URL: https://www.ctrl.blog/entry/gnome-clock-formats/
Last updated: 2026-08-23T22:08:32.000Z
Do you want another time and date format in the GNOME top bar than what is set in your default locale? The Clock Override extension for GNOME gives you full control of what and how time and data information is display in the top bar.

The GNOME Shell for Linux doesn’t provide a lot of customization options out of the box. GNOME don’t believe that anyone would ever want to customize their beautiful desktop shell. They’ve taken their design-by-omitting-customization paradigm so far that they’ve even left out the ability to customize the date and time format. Fortunately, the GNOME Shell is quite extensible and users always do find a way to change things the way that they want them.

GNOME Shell doesn’t provide users with options for manually customizing the date and time formats used throughout the desktop. Instead, you’re limited to choosing from locale sets provided by the GNU C Library. If you want to use a locale that isn’t included by default, such as [European English](https://www.ctrl.blog/entry/en-001/), you’ll need to [construct and install your locale definition](http://docs.translatehouse.org/projects/localization-guide/en/latest/guide/locales/glibc.html?ref=ctrl.blog).

While changing the system-wide locale requires a fair bit of time and effort, you can use the [Clock Override extension](https://extensions.gnome.org/extension/1206/clock-override/?ref=ctrl.blog) for GNOME to customize the shell’s most prominently featured timepiece: the clock on the top bar.

Here is how you get started:

1. Either open the GNOME Web browser (simply called Web; formerly Epiphany) or [setup your preferred browser to install GNOME extensions](https://web.archive.org/web/20180610100207/https://wiki.gnome.org/Projects/GnomeShellIntegrationForChrome/Installation).
2. Install the [Clock Override](https://extensions.gnome.org/extension/1206/clock-override/?ref=ctrl.blog) extension through your web browser.
3. Go to [Installed extensions](https://extensions.gnome.org/local/?ref=ctrl.blog), find Clock Override in the list, and click the Configure button next to it.

By default, the extension changes the clock to a full [international date format](https://www.ctrl.blog/entry/date-formats-web/) (ISO 8601.) Some may find this a bit too verbose, so I’ve provided some useful example format recipes that also highlight why programmers hate working with anything related to date and time:

| Format string  | Example output              | Details                |
| -------------- | --------------------------- | ---------------------- |
| %F %G-W%V      | 2010-01-02 2009-W53         | ISO 8601 date and week |
| %R %l:%M %p    | 12:01 12:01 PM              | 24- and 12-hour clocks |
| Some %A, %B %Y | Some Saturday, January 2010 | Sure, why not.         |

You can use any [GLib GDateTime format specifies](https://web.archive.org/web/20180831211708/https://developer.gnome.org/glib/stable/glib-GDateTime.html#g-date-time-format). You can include as many different clock and dates as you like; you’re not just limited to one. Any changes you make in the Configuration dialog are displayed immediately in GNOME’s top bar.

The extension also supports the following three format specifier extensions to the default GLib GDateTime format specifies:

| Format string | Example output | Details                                |
| ------------- | -------------- | -------------------------------------- |
| %H %;vf       | 15 ½           | Slow time; nearest quarter as fraction |
| %;cf          | 🕞             | An emoji clock face                    |
| @%;@.         | @687.          | Internet Time (.beat)                  |

The slow time format and the emoji clock both encodes traditional sexagesimal clocks with reduced precision so you can focus more on your work on less on the exact time. Slow time rounds minutes to the nearest quarter while the emoji clock face only updates every half hour. (Unicode haven’t included more precise clock emojis … yet.)

The Internet Time format is a whole different way of tracking time: the day is divided up into 1000 time beats instead of 24 hours of 60 minutes each; with time moving 1 beat ever 86.4 seconds. The whole world moves to the same beat with no time zones. When its @000\. at midnight 00:00 in UTC+01:00 then it’s @000\. everywhere in the world at the same time. It’s great for organizing events and meetings across time zones.

Please note that you may experience a minuscule negative impact on performance and battery life on devices without a modern graphics card *when* using any time format with second-precision.

Clock Override for GNOME Shell is licensed under the MIT License, and the sources are [available on GitHub](https://github.com/stuartlangridge/gnome-shell-clock-override/?ref=ctrl.blog). I’m effectively the maintainer for this GNOME extension going forward, so please report any bugs and issues on GitHub.

#### Sources

- [README](https://github.com/stuartlangridge/gnome-shell-clock-override/blob/84a30aaae0f0a761f841146359e7ef6bcc861a3c/README.md?ref=ctrl.blog), commit 84a30aaae0, 2018-07-23, Stuart Langridge, Clock Override repository, GitHub
- [UTC is enough for everyone …right?](https://zachholman.com/talk/utc-is-enough-for-everyone-right?ref=ctrl.blog), 2018-05-28, Zach Holman
- [GDateTime](https://web.archive.org/web/20180820121232/https://developer.gnome.org/glib/2.54/glib-GDateTime.html), 2017-09-11, GLib version 2.54, GLib documentation, GNOME Developer Center, GNOME Foundation
- [Glibc locale files](http://docs.translatehouse.org/projects/localization-guide/en/latest/guide/locales/glibc.html?ref=ctrl.blog), 2017-01-06, Dwayne Bailey, Localisation guide, Translate House
- [Internet Time](https://web.archive.org/web/20180820121234/https://www.swatch.com/en%5Fus/internet-time/), 2006, Swatch
### Work-around extension popout-tab refusing to close on Firefox Android
URL: https://www.ctrl.blog/entry/firefox-browseraction-close-popout-android/
Last updated: 2026-08-23T22:06:42.000Z
How do you close an web extension popout-window (the small window that appears when you click on an extension’s toolbar button?) On the desktop, all you need is a simple `window.close()`. Because of the limited available screen space Firefox on Android have popout-tabs instead of popout-windows. Users can dismiss these tabs by pressing the back button, closing them manually, or switching to another tab. However, they’re deceptively difficult to close pragmatically.

**Update** (2020-08-27): This articles applies to Firefox for Android starting with version 57 up to and including 69\. It’s not relevant to versions newer than this.

It’s common for web extension popout-windows to close themselves after the user has completed an action in them. While many web extensions work on Firefox for Android, users often have to manually close the popout-tabs on their own.

You can’t reliably close web extension popout-tabs with the `browser.tabs.remove()` function or replace it with a blank tab using `browser.tabs.update()`. You also can’t close them with `window.close()` because the browser doesn’t allow closing of tabs that weren’t opened by JavaScript (there’s a specific exception to allow this on desktop). So, what can you do?

To close your extension’s tab, you can exploit an implementation detail of how the popout-tabs work. You’ll always have a previously active tab (the opener-tab), and it and the popout-tab are considered to be active at the same time. By reactivating the active tab with `browser.tabs.update()`, you can get the browser to switch back to the opener-tab and dismiss the popout-tab in the process.

The following example `closePopOut()` function will close popout-windows on desktop as well as the popout-tab on Android. The function will use the `window.close()` function on desktop but also as a fallback on Android if the work-around stops working in a future version of Firefox.

```javascript
// SPDX-License-Identifier: CC0-1.0

function closePopOut()
{
  return Promise.all(
    [
      browser.runtime.getBrowserInfo(),
      browser.runtime.getPlatformInfo()
    ]
  ).then(
    data =>
    {
      if (data[0].name == 'Firefox' &&
          data[1].os == 'android')
      {
        return browser.tabs.update(
          {active: true}
        );
      }
    }
  ).finally(
    window.close
  );
}
```

The above method have to be called from the scope of the popout-tab, just like it does on desktop. Calling it from the background script or a content script will have as little effect on the popout-tab as it does on the popout-window.

The method returns a Promise of closing the tab. The method can sometimes be slower than normal if the opener-tab is a private tab (and I’ve got no idea why).This work-around will fail on Android (not on desktop) if you close the opener-tab before calling this method. You can, however, activate another specific tab by tab ID instead of re-activating the previously active tab. Like with private tabs, this can sometime be slow to execute on Android.

Note that the above implementation only reactivates the active tab on Android. You could just always call the work-around code on other platforms too. However, you may see an unattractive white flash in the address field on Windows and accessibility tools might freak out a bit if you first move window focus and then close the popout-window. (The typical order is window-closing followed by resetting focus; going out of order could, e.g. trigger redundant and confusing messages for screen readers.)

The future might not be looking too bright for Firefox for Android, and especially web extensions in Firefox for Android. Mozilla put Firefox for Android on the back burner while it work on new and more exciting browser-like products such as Focus and Fenix. Neither of these two initiatives currently support web extensions, however. Firefox has carved out a mere 0,38 % of the web browser market share on Android (so still a huge number of people), according to StatCounter.

I hope Mozilla won’t abandon extensions on Android going forward. As someone who [likes web extensions](https://www.ctrl.blog/tag/browser-extensions/), I can’t say I’m too happy about this development. Firefox for Android has a limited and buggy web extension support, but its way better than having no extensions at all.

#### Sources

- [Mobile Browser Market Share Worldwide - July 2018](https://gs.statcounter.com/browser-market-share/mobile/chart.php?device=Mobile&device%5Fhidden=mobile&statType%5Fhidden=browser®ion%5Fhidden=ww&granularity=monthly&statType=Browser®ion=Worldwide&fromInt=201707&toInt=201807&fromMonthYear=2017-07&toMonthYear=2018-07&ref=ctrl.blog), 2018-08-18, Global Statistics, StatCounter
- [Firefox Roadmap](https://wiki.mozilla.org/index.php?title=Firefox/Roadmap&oldid=1198082&ref=ctrl.blog), revision 1198082, 2018-07-27, Asa Dotzler, Mozilla Wiki, Mozilla Foundation
### Avoid Nginx’s merge_slashes option
URL: https://www.ctrl.blog/entry/nginx-requesturi-proxycache/
Last updated: 2026-08-23T22:14:50.000Z
This story starts with two seemingly similar but distinctly different URLs: `//document` and `/document`. They’re semantically two distinct and unique URLs (RFC 386) and programs can’t assume they can be normalized by removing the “extra” forward slash. Extra slashes can sneak into URLs unintentionally from all sorts of websites and external software, so it can be tempting to attempt to combine seemingly redundant slashes into a single slash.

You can only safely [normalize and redirect duplicate slashes](https://www.ctrl.blog/entry/relative-double-slashes-url/) in situations where you know that there shouldn’t ever be any duplicate slashes in your URL design and planning. However, caching reverse proxies and content delivery networks (CDN) can’t arbitrarily decide to merge slashes without breaking expectations of the web platform.

But I’m getting ahead of myself. Before going into that in more details, I first need to establish some internal workings of the Nginx web server.

### Two variables

The first variable of note is `$request_uri` which contains the original URL as requested by the client including the path and query arguments. `$uri$is_args$args` are three separate variables that in combination recreates the same information that make up the `$request_uri` variable.

When an Nginx caching reverse proxy receives a request, it will lookup the URL in the cache based on the `$request_uri` variable (the cache key) and serve the client a cached copy of the resource if one exist. If the resource can’t be served from the cache, Nginx will pass on the `$request_uri` to the origin server and save the response in its cache and serve it to the client. These behaviors can be changed by modifying the `proxy_cache_key` or `proxy_pass` options.

The Nginx web server has an option called `merge_slashes` (on by default) that compresses duplicated forward slashes into a single forward slash. In practice this rewrites the internal `$uri` variable so that, e.g. `/hello///world` will become `/hello/world`.

Notably, it doesn’t trigger a client redirect which is the method I prefer, see the referenced article above. The original incoming URL is preserved in the `$request_uri` variable which remains unchanged. There are multiple other ways to rewrite the `$uri` variable, but this one option will serve as a stand-in for all of them in this article.

By default, even with the `merge_slashes` option enabled, Nginx will not modify the request URL as used for caching or the URL sent through the proxy nor the response coming back through from the origin server. So far, everything is humming along nicely.

### Mixing up the variables

A common strategy for improving a caching proxy’s cache hit ratio, the ratio at which a request can find a match to be served from the cache, is to remove and essentially ignore the query parameters from the URL. Meaning that instead of looking up results in the cache based on the full URL, only the path is used to evaluate cache hits (the `$uri` variable sans the `$is_args$args` variables in Nginx parlor.) This strategy is achieved by changing the `proxy_cache_key` **and** the `proxy_pass` option to `$uri`.

However, if you don’t change both options then the origin server and the cache will disagree on which URL is being served. Say we’ve enabled the `merge_slashes` option and only modified the `proxy_cache_key` option. If a user then requests `//document`, the proxy will look in its cache for `/document` and if it hasn’t been cached already, it will ask the origin for `//document`.

The origin will handle the request for `//document` and send it back to the proxy server which will store it as `/document` in its cache and serve it to the user. Any future requests for `/document` will get the same resource.

So, where does this go wrong? Well, if the origin server handles `//document` and `/document` differently (which is to be expected as they’re distinctly different URLs), then the proxy server will begin serving the wrong resource to any subsequent users that request `/document`. This may be okay in some situations but in general, it will cause issues. Let us look at a more concrete example.

### BunnyCDN and the infinite redirect

The broken setup in the above description is essentially what you’ll find at [BunnyCDN](https://bunny.net/?ref=ctrl.blog), the winner of my [budget CDN comparison](https://www.ctrl.blog/entry/budget-cdn-review/). They rewrote the URLs they use for their cache keys without informing the origin server that the URLs had been normalized in a non-standard way.

In my case, [my own normalization](https://www.ctrl.blog/entry/relative-double-slashes-url/) would result in a infinite redirect loop. Given my own knowledge of my URL structure I could work out where the visitors meant to go and send them to the right location. For example, turning `//document` to `/document`.

However, BunnyCDN would cache the redirect on `//document` as `/document`; causing an infinite redirect loop as `/document` would then serve a redirect to itself forever. Every visitor coming to the correct URL would also be served the cached version and stuck in a redirect loop. As discussed earlier, [redirect loops with HTTP/2 server-push](https://www.ctrl.blog/entry/http2-push-redirects/) can get pretty bad for some clients.

BunnyCDN have been positive to change their ways but hesitant to implement the changes. So, I’ve had to implement a work-around involving making all redirects from URLs containing `//` non-cachable. This reduces page load speeds where the cache would normally handle redirects.

However, this workaround should never have been necessary to implement. There are well established standards for how proxy servers should behave and BunnyCDN simply isn’t living up to those expectations in this instance.

### Take away lessons

- Don’t remove duplicate slashes in URLs other than your. Extra slashes are distinctly different addresses even though some servers might serve the same content in some situations. It’s a destructive and non-standard normalization operation.
- When rewriting URLs, be sure either do it consistently and apply the rewritten URLs everywhere or simply don’t do it at all.
- Chose service providers and software that deliver on web standards. You’ll save yourself having to debug weird and unexpected problems.

#### Sources

- [Module ngx\_http\_core\_module](https://nginx.org/en/docs/http/ngx%5Fhttp%5Fcore%5Fmodule.html?ref=ctrl.blog), version 1.14, 2018-04-17, Nginx Documentation, Nginx
- [Module ngx\_http\_proxy\_module](https://nginx.org/en/docs/http/ngx%5Fhttp%5Fproxy%5Fmodule.html?ref=ctrl.blog), version 1.14, 2018-04-17, Nginx Documentation, Nginx
- [RFC 3986: Uniform Resource Identifier (URI): Generic Syntax](https://www.rfc-editor.org/rfc/rfc3986.html?ref=ctrl.blog), 2005-01, Network Working Group, Internet Engineering Task Force
### Pocket Casts’ desktop apps are okay
URL: https://www.ctrl.blog/entry/review-pocketcasts-webapps/
Last updated: 2026-08-23T22:19:42.000Z
My favorite podcast app recently took the leap from mobile platforms and the web to the world of making desktop applications for MacOS and Windows. I’ve taken a long hard look at what you’re getting, and why it might not be the most impressive podcast app available for desktop.

### It’s all the same webapp

There’s only one app and it lives over at [play.pocketcasts.com](https://play.pocketcasts.com/?ref=ctrl.blog). The MacOS and Windows apps are primarily repackaged Pocket Casts versions of the webapp.

Pocket Casts have managed to pull off a design that doesn’t look completely native as either MacOS nor a Windows 10-style app. However, it doesn’t look completely foreign either and everything is laid out so the design works on both platforms and the same design also serves the service well on the web.

Pocket Casts have built their desktop app/webapp hybrids using the native toolkits provided by Apple for MacOS and Microsoft for Windows. However, as The Verge recently put it: [The desktop belongs to Electron](https://www.theverge.com/circuitbreaker/2018/5/16/17361696/chrome-os-electron-desktop-applications-apple-microsoft-google?ref=ctrl.blog). [Electron](https://www.electronjs.org/?ref=ctrl.blog) is a framework based on the Chromium, the web browser engine, for packaging webapps as desktop programs across multiple operating systems. Electron also grants webapps extra permissions to interact with the file system. I promise that this little technical detail will become important quite a few places throughout the article!

I’m not disrespecting on webapps or the web as an app platform. My initial reaction to the first version of the Pocket Casts webapp when it was released back in 2015 was “[Shut up and take my money!](https://www.ctrl.blog/entry/pocket-casts-payment-button/)” Three years later, I am, however, kind of disappointed to find that three years later the only feature that has been added since the initial release is a play queue.

### Desktop app-only features

Pocket Casts’ MacOS and Windows apps are for the most part identical to the webapp. You do, however, get some small extra features that aren’t available on the webapp:

- Multimedia keys work (play/pause, and back and forward)
- Windows only: app media controls on the lock screen
- MacOS only: a small mini-player that floats on top of other windows
- Start menu entry on Windows (oddly labeled “Pocket Casts Desktop”) and Launchpad entry on MacOS

You’re not getting much in terms of desktop integration. Disappointingly, the apps don’t integrate with Spotlight search on MacOS or with Windows Search or Windows Timeline. Searching on your device should bring up your favorite podcast shows and episodes. This could be achieved on both operating systems by creating bookmark files containing the relevant metadata on the local device and deep linking into the relevant screens in the app. You could also get episode searching for free by caching episodes on disk, something I’ll go into in more details next.

### Streaming only

Podcasts is an on-demand media. Most podcast apps, including Pocket Casts for Android and iOS, will periodically download new podcast episodes and store them on your device so they’re ready when you’ve got time to listen to them. Podcast apps for mobile devices will often download episodes when your device is on Wi-Fi and plugged in to a charger to save on data cost and don’t impact your device’s battery life.

Pocket Casts for web can’t support this feature as the web platform doesn’t give websites enough storage capacity to download numerous large files to cache. Pocket Casts apps for MacOS and Windows have inherited this limitation. You’re restricted to only stream podcast episodes over the web and can’t work the app offline.

However, if Pocket Casts had chosen to go down the Electron route it would be a small job to extend the webapp’s functionality and reimplement the download and storage management customers are familiar with from Pocket Casts for mobile.

### Audio issues on MacOS

The MacOS version of the Pocket Casts’ app suffers from being built on Apple technologies. A popular feature found in almost every podcast app is the ability to slightly increase the playback speed. Safari degrades the audio quality considerably when playing it back at a faster rate.

Already at 10 % faster playback, the smallest increment that can be configured in Pocket Casts, the audio starts suffering from distortions and compression artifacts (cracking, popping). At even higher speeds these issues get more and more noticeable.

This issue also isn’t present when using the webapp in Firefox and Chrome on MacOS, but it shows up in Safari. In other words, Pocket Casts could have avoided this issue by building their webapp on Electron instead of the MacOS native toolkit. The first couple of reports and complaints I can find about Safari’s audio distortion issues at higher playback speeds date back to just a few months after Pocket Casts released their first webapp back in 2015.

The Windows version of Pocket Casts don’t have this issue and neither does Microsoft Edge.

### No silence trimming

Audio engineers and podcast producers may feel that five full seconds are important to tell a story properly, but I frankly don’t have that kind of time to listen to absolutely nothing. Pocket Casts for Android and iOS can detect and automatically shorten long silences. According to the trimmed-silences time tracking in the Android app, I’ve cut away over 16 hours of silence in the app. I sure hope that I did something productive with those 16 hours and didn’t just fill them with even more podcasts.

The new Pocket Casts webapp, and thus also the MacOS and Windows desktop apps, don’t support this feature. I feel it’s a lesser experience because of it.

Podcast episodes aren’t served by Pocket Casts but come directly from the podcast publisher’s servers. Not every podcast episode served is identical with things like [programmatic ad insertion](https://www.ctrl.blog/entry/programmatic-podcast-ads/) make it unfeasible for Pocket Casts to analyze and pre-process the audio on their servers.

Pocket Casts’ mobile apps perform the audio processing on-device. The Web Audio API seems like it should be up to the task of detecting silence and trimming them down, but the standards work isn’t quite there yet and neither is the implementation in Safari and the other major web browsers.

### Can’t subscribe to *new* shows, no data portability

It would seem Pocket Casts have learned [a terrible lesson from Spotify and Google Podcasts](https://www.ctrl.blog/entry/google-podcasts-data-portability/) and no longer allow users to subscribe to podcasts by their syndication feed (“RSS”). Pocket Casts’ mobile apps and even the old webapp allowed users to just input the URL of an syndication feed into the search field to subscribe to it. The new beta webapp and the new desktop apps have just gotten rid of this option, and listeners are instead limited to the selection available in Pocket Casts’ catalog.

If you enjoy some fringe content, you’ll first have to [submit it to Pocket Casts](https://pocketcasts.com/submit/?ref=ctrl.blog) and hope they’ll add it to their catalog of podcasts. This isn’t an option for subscribing to personalized syndication feeds, like the ones you get from Patreon and other paid premium podcast vendors.

The new Pocket Casts apps also have another thing in common with Spotify and Google Podcasts: You also can’t export you podcast subscriptions to OPML or import an OPML from another podcasting app. The *General Data Protection Regulation (GDPR) Article 20: Right to data portability* be damned! However, you can still open Pocket Casts for Android or iOS (sold separately) and export your data from there. I doubt this would be enough to appease European regulators, however.

Whatever happen to podcasting being an open ecosystem with open standards?

### Third-party analytics conundrum

Most podcasting apps send their own HTTP User-Agent identifier, allowing for serer administrators to get some aggregate statistics about their partnership and which podcast clients are popular among their listeners.

Pocket Casts’ web app have to use the browser’s own User-Agent for most operations, and that’s understandable. The web app will give analytics software some trouble figuring out what player was used; although the HTTP Referer (sic) header will contain \*.pocketcasts.com/\* for podcasts served over HTTPS so they can work it out.

The new desktop apps are a different matter. In the current beta versions, the MacOS app uses the same User-Agent as AppleCoreMedia for streaming episodes and the same User-Agent as Safari when fetching other resources. The Windows app uses the same User-Agent as Microsoft Edge. However, Pocket Casts should have set their own User-Agent using the available native APIs when setting up the WebViews used internally by the apps. This only requires one–two lines of codes on each platform, or one line of code for both platform if Pocket Casts had gone for Electron instead.

This only matters to podcast publishers who’ll not be able to count Pocket Casts users properly.

### Conclusions

Pocket Casts customers coming over from the Android or iOS apps have come to expect feature rich and high-quality apps. Pocket Casts for web is a quality webapp, but the MacOS and Windows versions doesn’t quite pull it off even though they’re literally the same app an experience. It’s a good companion app for the mobile apps for users who are always connected and don’t mind draining their battery on inefficient streaming.

I was initially quite happy to see that Pocket Casts had made a desktop app and an update to their webapp. However, the desktop apps turned out to be the webapp with very little system integration, it doesn’t bring any real advantages over using their webapp. You can pin the webapp to your Start menu from Microsoft Edge in Windows 10 and get pretty much the same experience.

Simply sticking the webapp into the system native browsers have seriously impeded the apps’ features and left users with bad audio quality on MacOS. I didn’t intend for this but this review quickly turned to a pitch for using Electron for desktop apps instead of native WebViews provided by the operating system. However, this would have made more sense for Pocket Casts and meant they could deliver a better experience and more features on Linux, MacOS, and Windows for the same amount of development time.

I’ll continue to use Pocket Casts for web in Firefox on both MacOS and Windows. Media key support would be great, but I can’t stand to listen to all the audio artifacts in Safari. Other than that, I’m not getting much with this version of Pocket Casts for desktop.

#### Sources

- Pocket Casts for web, version 2.0 (build 49) beta
- [Web Audio API](https://www.w3.org/TR/2018/WD-webaudio-20180619/?ref=ctrl.blog), 2018-06-19, World Wide Web Consortium (W3C)
- [How Big Is A Pocket Anyway?](https://blog.pocketcasts.com/2018/06/12/all-the-betas/?ref=ctrl.blog), 2018-06-12, Russell Ivanovic, Pocket Casts blog, Pocket Casts
- [The desktop belongs to Electron](https://www.theverge.com/circuitbreaker/2018/5/16/17361696/chrome-os-electron-desktop-applications-apple-microsoft-google?ref=ctrl.blog), 2018-05-16, Paul Miller, Circuit Breaker, The Verge
- [OPML export](https://support.pocketcasts.com/knowledge-base/opml-export/?ref=ctrl.blog), 2016-09, Pocket Casts Support, Pocket Casts
- [REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679&from=EN&ref=ctrl.blog), 2016-04-27, The Official Journal of the European Union, EU Parliament and EU Council
- [YouTube speed increase audio bug on Safari](https://www.reddit.com/r/OSXElCapitan/comments/3kcqnv/youtube%5Fspeed%5Fincrease%5Faudio%5Fbug%5Fon%5Fsafari/?ref=ctrl.blog), 2015-09-10, gary500, OSXElCapitan subreddit, Reddit

**Reviewed:** [Pocket Casts](https://pocketcasts.com/?ref=ctrl.blog)

**Review rating:** 4 / 10
### How to configure multiple NTP servers on Windows
URL: https://www.ctrl.blog/entry/tutorial-windows-ntp-config/
Last updated: 2026-08-23T22:23:39.000Z
Though it may appear as Windows will only let you configure one internet time-server, it does support synchronizing with multiple time-servers for increased accuracy and reliability. Here is how you set it up.

Your Windows PC isn’t all that good at keeping time, and over time it will slowly drift away from what every other computer considers to be the correct time. To compensate for our computers’ inability to tell time accurately, we rely on internet time-servers to correct and update the correct time.

There are plenty of Network Time Protocol (NTP) servers around the world available for free. By default, Windows will only connect to a single time-server operated by Microsoft. Although, your network router may auto-configure other network servers on your behalf.

### When is it useful or necessary to configure multiple NTP servers

Configuring multiple time-servers will increase the reliability and accuracy of your PC’s timekeeping abilities. On unreliable and slow networks, it can be especially useful to configure more than one time-server to improve accuracy.

Some managed networks, like a corporate network, may block connections to public time-servers — like the ones operated by Microsoft — and only allow the use of their own internal time-servers. Ask your network administrator for details if you’re having trouble.

However, this internal server is unlikely to be available if you bring your device home or onto any other network. Ideally, you would want to keep using a public time-server and only add the corporate time-server as an additional time source.

### How to add multiple NTP servers in Windows

Neither the Windows Settings app nor the Control Panel will let you configure multiple time-servers in Windows. You’ll need to execute some commands in the Command Prompt to get this set up. I’ll walk you through the whole process:

1. Open an administrative Command Prompt by searching for “cmd” in the Start menu, right-clicking on the program, and choosing “Run as administrator”.
2. Ensure that the time service is currently running by stopping and starting it by entering following command and pressing Enter:  
```  
net stop w32time & net start w32time  
```
3. Configure your list of preferred time-servers by listing their IP or DNS addresses within the quotation marks in the following command; separating multiple servers with spaces:  
```  
w32tm /config /update /manualpeerlist:"pool.ntp.org time.windows.com time.apple.com time.cloudflare.com"  
```

The above example configures Windows to use time-servers operated by the NTP Pool Project, Microsoft, Apple, and Cloudflare. Note that there shouldn’t be any line breaks in the command; it’s all on one line.

Lastly, we’ll tell Windows to resynchronize its time against the newly configured time-servers and finally show the new configuration to confirm that everything is working:

```
w32tm /resync
w32tm /query /peers
```

Note that these changes won’t show up if you go to inspect your internet time configuration in the Time and Date section of the Control Panel. You shouldn’t make any changes there to avoid overwriting your manual configuration.

You can use the peers-querying command, as shown in step 4 above to inspect your configuration. You can also overwrite your setup with different time-servers by updating your configuration again as shown in step two.

You may find references online to changes you can make in the System Registry (`regedit`) to accomplish the same thing, but those changes are Windows-version dependent and won’t stick when you upgrade your system from one release version to the next.

The instructions in this article apply to Windows 10, 8.1, 8, and 7 (and corresponding releases of Windows Server). Check out the [MacOS version of this tutorial](https://www.ctrl.blog/entry/tutorial-macos-ntp-config/) for your Macs!

#### Sources

- [How the Windows Time Service Works](https://learn.microsoft.com/en-us/windows-server/networking/windows-time-service/how-the-windows-time-service-works?ref=ctrl.blog), 2018-05-08, Patti Short, Windows Server, Microsoft Docs, Microsoft
- [How do I use pool.ntp.org?](https://www.ntppool.org/en/use.html?ref=ctrl.blog), 2016-08-27, Ask Bjørn Hansen, NTP Pool Project
### How to configure multiple NTP servers on MacOS
URL: https://www.ctrl.blog/entry/tutorial-macos-ntp-config/
Last updated: 2026-08-23T22:23:38.000Z
System Preferences in MacOS may leave you to conclude that you can’t configure multiple NTP servers for your Mac. However, you *can* configure multiple NTP servers.

Your Mac isn’t all that good at keeping time, and over time it will slowly drift away from what every other computer considers to be the correct time. To compensate for our computers’ inability to tell time accurately, we rely on internet time-servers to correct and update the correct time.

There are plenty of free Network Time Protocol (NTP) servers available around the world. By default, MacOS will only connect to a single time-server operated by Apple.

### When is it useful or necessary to configure multiple NTP servers

Configuring multiple time-servers will increase the reliability and accuracy of your Mac’s timekeeping abilities. On unreliable and slow networks, it can be especially useful to configure more than one time-server to improve accuracy.

Some managed networks, like a university network, may block public time-servers — like the ones operated by Apple — and only allow the use of their own internal time-server.

However, this internal server is unlikely to be available if you bring your device home or onto any other network. Ideally, you would want to keep using a public time-server and only add the university time-server as an additional time source.

### How to add multiple NTP servers in MacOS

In System Preferences: Date and Time, you might expect to see two fields for the primary and secondary time-server. Many network appliances and routers use this setup. However, in MacOS there’s only one field but one field is all you’ll need:

1. Open the System Preferences app: Date and Time
2. Click the lock to unlock the preference pane, if needed
3. Enable the “Set date and time automatically” option
4. Enter the IP or DNS addresses of your preferred time-servers followed by a period character, and separate multiple entries with commas.  
For example, “pool.ntp.org., time.apple.com., time.windows.com., time.cloudflare.com.”

The changes are saved and applied as soon as you close the preference pane.

The above example configures MacOS to pull time information for the hundreds of time servers in the NTP Pool project; as well as the time servers operated by Apple, Cloudflare, and Microsoft. This should provide plenty of redundancy.

The trailing period is strictly speaking optional, but it’s the preferred format that’s used consistently by Apple tools that interact with the system’s NTP settings. Sticking with Apple’s format may help avoid compatibility issues with system upgrades down the line.

You can also enter the IP or DNS addresses of your preferred time-servers directly in the NTP configuration file at /private/etc/ntp.conf. The NTP client configuration file takes one server entry per line, e.g. “server 0.pool.ntp.org.”

The instructions in this article apply to MacOS 10.12 ‘Sierra’ and newer. Check out the [Windows version of this tutorial.](https://www.ctrl.blog/entry/tutorial-windows-ntp-config/)

#### Sources

- [How the Windows Time Service Works](https://learn.microsoft.com/en-us/windows-server/networking/windows-time-service/how-the-windows-time-service-works?ref=ctrl.blog), 2018-05-08, Patti Short, Windows Server, Microsoft Docs, Microsoft
- [NTP’s Configuration File User Manual](https://opensource.apple.com/source/ntp/ntp-136/ntpd/ntp.conf.html?ref=ctrl.blog), 2017-09-28, Apple Open Source, Apple
- [MacOS Sierra: Set the date and time on your Mac](https://web.archive.org/web/20180802125407/https://support.apple.com/kb/PH25523?locale=en%5FUS), 2017-03-28, Knowledge base, Apple Support, Apple
- [How do I use pool.ntp.org?](https://www.ntppool.org/en/use.html?ref=ctrl.blog), 2016-08-27, Ask Bjørn Hansen, NTP Pool Project
### Excessive heat from MacBook Pro under MacOS ‘Mojave’
URL: https://www.ctrl.blog/entry/macbook-late2013-hot-smc/
Last updated: 2026-08-23T22:13:53.000Z
My MacBook Pro (a late-2013, 39 cm model, MacBookPro11,2) have been running hot after I installed the first developer preview release of MacOS 10.14 “Mojave”. The software, and fans and ventilation seemed fine; but what about the power management firmware?

I initially ignored the problem and attributed it to either the higher ambient temperature caused by the heatwave currently sweeping across Northern Europe. Or maybe it was a pre-release bug? However, as the fourth beta release came and went I started to look into the issue in more detail.

The processor temperature, measured with the [Intel Power Gadget](https://www.intel.com/content/www/us/en/developer/articles/tool/power-gadget.html?ref=ctrl.blog), when the computer was under no load and idling (processor utilization under 5 %) was stuck at around 70℃. The high base temperature makes the machine hot to the touch, and also causes thermal throttling of the processor when you want to get something done.

I thought that the internals fans or air passages might be blocked by dust and debris. The machine would get hot mere minutes after boot, and it sounded like the fans operated normally. However, this model MacBook Pro has received a meager iFixit repairability score of 1 out of 10 and I didn’t even want to attempt to take it apart if I could avoid it.

I wasted quite some time trying to catch an app using a lot of resources in bursts with the Energy usage view in Activity Monitor; beveling there was a specific program causing the my issues. As it turned out, there were no rouge crypto-miners or apps experiencing unexpected resource demands with the MacOS beta.

I then stumbled upon an Apple Support document that suggested resetting the System Management Controller (SMC), which is responsible for “thermal management”. This is an easy enough process and Apple Support provides [detailed instructions for resetting the SMC](https://support.apple.com/en-euro/HT201295?ref=ctrl.blog) on a variety of Mac models.

After resetting the SMC, the CPU temperature dropped from 70℃ when idling to just shy of 40℃, and normalized around 45–65℃ with normal use. I haven’t had any issues with my MacBook running excessively hot after resetting the SMC.

There’s little good documentation available on what the System Management Controller does and how it works. The SMC is responsible for power distribution and thermal fan controls, so I can only conclude that it was giving either the processor or some other controller too much juice that just turned into waste heat.

I didn’t think to measure the battery life impact, but it stands to reason that also should have improved given the reduced cooling needs.

I find it interesting that such a simple fix would have much of an impact on the thermals of a modern computer. If it’s a known problem that the SMC gets intro trouble, and Apple have even documented how to reset it: shouldn’t it just reset itself periodically on reboot? I see no reason why it shouldn’t just reset itself automatically every 20 days or so to save people from whatever goes wrong with it. How many MacBook Pros out are running unnecessarily hot or slow over some silly maintenance task that no one knows they’re expected to perform every now and then?

Looking for ideas to cool your laptop? Simply [stick some felt pads underneath it](https://www.ctrl.blog/entry/how-to-laptop-air-cooling-pads/) to life it higher off its resting surface and improve the flow of hot exhaust air.

#### Sources

- [The long hot summer: Heat is causing problems across the world](https://www.economist.com/science-and-technology/2018/07/28/heat-is-causing-problems-across-the-world?ref=ctrl.blog), 2018-07-28, The Economist
- [How to reset the System Management Controller (SMC) on your Mac](https://support.apple.com/en-euro/201295?ref=ctrl.blog), 2018-07-13, Apple Support, Apple
- [Keep your Mac notebook within acceptable operating temperatures](https://support.apple.com/en-euro/201640?ref=ctrl.blog), 2018-01-11, Apple Support, Apple
- [MacBook Pro 15″ Retina Display Late 2013 Teardown](https://www.ifixit.com/Teardown/MacBook+Pro+15-Inch+Retina+Display+Late+2013+Teardown/18696?ref=ctrl.blog), 2013-10-23, iFixit
- [Resetting the power-management chip in your Mac](http://www.thexlab.com/faqs/resetpmchip.html?ref=ctrl.blog), 2013-01-03, Gregory E. Swain, The X Lab
### Update after 3 months with Bitwarden
URL: https://www.ctrl.blog/entry/bitwarden-3m-update/
Last updated: 2026-08-23T22:02:22.000Z
Three months ago, I wanted to move away from LastPass — who’ve lately have been [dropping support for Firefox](https://www.ctrl.blog/entry/lastpass-deprecates-firefox-android/#src=rel) and other platforms — to an open-source password manager.

I chose to [migrate to Bitwarden](https://www.ctrl.blog/entry/migrating-to-bitwarden/). I’ve been happy with the decision overall. Here are my thoughts and impressions after three months with Bitwarden.

### Apps and platform experiences

LastPass only has an app for MacOS and a few failed attempts at different Windows apps over the years. The Bitwarden desktop apps — available for Linux, MacOS, and Windows — are pretty great by comparison.

I use the Bitwarden desktop client on MacOS and Windows, but I prefer to use the [Bitwarden Web Vault](https://vault.bitwarden.com/?ref=ctrl.blog) installed as a [GNOME Web app](https://help.gnome.org/users/epiphany/stable/browse-webapps.html.en?ref=ctrl.blog) under Linux. Bitwarden’s Linux app works as great as its MacOS and Windows brethren but it’s harder to install than a web app and doesn’t auto-update.

I’m not as happy with the experience on Android, however. Bitwarden integrates with the platform provided auto-fill service; a system that’s unreliable at the best of times. I can have Bitwarden auto-fill in my login details into an app or webpage one day and then have it not work on the same app or webpage the next day.

My login flow thus involves first attempting to use auto-fill, sighing, switching to the Bitwarden app and copy my login details, switch back to the app I want to login to, and pray that the app hasn’t dismissed the login prompt while I was away. It’s less than ideal but from my experience, the same thing also happens with LastPass and other password managers on Android.

On a more positive note, Bitwarden’s extension for Firefox for Android works great and I don’t have to skip back and forth between apps to login to websites.

Unfortunately, Firefox for Android [doesn’t support physical security keys](https://www.ctrl.blog/entry/firefox-u2f-google/) so I can’t properly secure my Bitwarden account and get a decent user experience on Android at the same time.

I’ve also not yet had the time to look into self-hosting Bitwarden services myself. However, this is on my to-do list for the coming months so expect another update on that at a later time.

### Third-party scripts are mostly gone from the web vault

In [my last article on Bitwarden](https://www.ctrl.blog/entry/migrating-to-bitwarden/), I raised some concerns over the inclusion of untrusted third-party JavaScript inside the password manager vault. These scripts could theoretically make a copy of your login credentials and run off with your entire unencrypted password vault.

The updated Bitwarden 2.0 web vault has reduced the risk by significantly reducing its reliance on third-party scripts. The only third-party scripts that run inside the web vault now is Stripe, Bitwarden’s payment processor. You now also have to open the payments page before you’re exposed to any risk.

If a malicious third-party were to somehow get control over Stripe’s domains or scripts, they’d be more likely to focus on stealing credit card information that passes through the payment service than in hijacking passwords

However, a password manager should be as securely engineered as its possible to make it. Risks that may be acceptable on less critical websites are unacceptable in the context of a password manager.

Bitwarden could eliminate the risk entirely by moving the payment processing to a separate page outside of the vault to isolate the payment service provider from the sensitive data in the password vault. I’ve discussed this issue briefly with Kyle Spearrin, founder and lead developer at Bitwarden, who says he is hopeful that this will be improved one day.

### Two features that I miss from LastPass

For most users, Bitwarden and LastPass have a mostly identical feature set. There are, however, two features in LastPass that I’ve missed since I switched to Bitwarden.

LastPass keeps track of your old passwords and not only your current password. This is quite handy in cause you accidentally override your password, or for websites where you change your password on the main website.

In some situations, the support page hasn’t updated and require you to still use your old password so you can login. It will complain about the support section having a separate password system that isn’t in sync with the main website. (Real story.) Bitwarden only stores the current password.

**Update** (2019-01-19): Bitwarden has now added a password history list of old passwords associated with each password vault entry. You can only access the password history from their web vault, but history is preserved even when updating a saved password from one of their browser extensions or apps.

LastPass can automatically open a webpage in your browser and simulate user-actions to automatically log in to a supported website and change the user’s password. The auto-password changer feature limited to only 80 supported websites and it has failed on at least some of the supported websites every time I’ve tried to use it.

Bitwarden has nothing similar and I’ve to login and change my passwords manually every time I like to update them. This experience is in practice no different from LastPass as I in practice still had to login and change a ton of passwords manually as most of my passwords were with unsupported websites.

Since LastPass keeps track of past passwords, it also easy to recover the previous password if something went wrong. However, I *want to believe* that it’s a feature that will eventually work with every website out there and I feel like I’m missing out even though this feature isn’t super useful.

#### Sources

- [Web Vault v2.0](https://bitwarden.com/blog/web-vault-v2-0-released/?ref=ctrl.blog), 2018-07-24. Kyle Spearrin, Bitwarden blog, bit Solutions
- [Generating Secure Passwords](https://web.archive.org/web/20180618031315/https://helpdesk.lastpass.com/generating-a-password/), 2018-06, LastPass user manual, Log Me In
### Windows Timeline browser add-on raises few privacy concerns
URL: https://www.ctrl.blog/entry/windows-timeline-extension/
Last updated: 2026-08-23T22:25:25.000Z
*Windows Timeline* is a unified activity history explorer that received a prominent placement next to the Start menu button in Windows 10 earlier this year. You can see all your activities including your web browser history and app activity across all your Windows devices in one place, and pickup and resume activities you were doing on other devices. This is a useful and cool feature, but it’s also a privacy nightmare. 

You may also have read about a cool new browser extension that adds your web browsing history from third-party web browsers — including Firefox, Google Chrome, Vivaldi, and others — to Windows Timeline. The extension attracted some media attention from outlets like [MSPoweruser](https://mspoweruser.com/windows-timeline-and-continue-browsing-extension-now-available-for-chrome-firefox-and-vivaldi-browsers/?ref=ctrl.blog), [Neowin](https://www.neowin.net/news/chrome-and-firefox-gain-timeline-integration-via-add-on/?ref=ctrl.blog), [The Verge](https://www.theverge.com/2018/7/16/17577112/microsoft-windows-10-timeline-chrome-firefox-support-extension?ref=ctrl.blog), and [Windows Central](https://www.windowscentral.com/third-party-extension-adds-windows-timeline-support-chrome-and-firefox?ref=ctrl.blog).

I contributed to the development of the extension and made sure to add prominent information about how the extension works and its consequences for user privacy. The way Windows Timeline works has some serious implications for user privacy, and the extension should have raised some attention to the matter or at least raised some eyebrows.

However, none of the media coverage for it mention privacy or how the extension works. I’m disappointed with all the Windows fanboy-sites and The Verge for not giving privacy a single though in the context of this extension and Windows Timeline.

The first version of the extension even had a bug that submitted all activities from private/incognito mode web browsing to Microsoft. (Sorry about that; fixed in version 1.0.2.) Yet no one even raised the topic of privacy or the massive data collection that Microsoft do through Windows Timeline.

Windows Timeline works by sending all your activities to Microsoft, and then have Windows fetch a list of all activities you’ve done on your local computer down from Microsoft’s servers. The data is associated with you personally though your Microsoft Account.

Microsoft stores collected activity data forever, as I [discussed in more details](https://www.ctrl.blog/entry/delete-old-data-gdpr/) only two weeks ago. However, Windows Timeline only shows you the activities for the last month; meaning they also should have been automatically deleted when they’re no longer needed. 

This design is completely backwards from the “privacy by design and default” principle of the General Data Protection Regulation (GDPR). I’m amazed that Microsoft would release this feature just a month before the GDPR went into effect.

However, it’s nothing new that [Microsoft is collecting all your web browser history](https://www.ctrl.blog/entry/ie11-flip-out-privacy/). They’ve been doing it by default and for many years already in both Internet Explorer and Microsoft Edge.

As I said going in to this: Windows Timeline is a useful feature. It’s so useful that many users opt to share all this data about their online activities with Microsoft to get it. The thing is: this is a false premise for Windows Timeline. It could have been designed to be much more privacy-friendly, but Microsoft chose to build it as a tool for collecting personal data on their customers instead.

Microsoft could have encrypted the activity data end-to-end so that there wouldn’t be a privacy issue in the first place, but Microsoft chose to just scoop up and keep all of this data for their own ends. Microsoft could have automatically deleted the data when it’s no longer useful to the end-user, but Microsoft chose to retain it indefinitely.

I’m over Windows Timeline as its clearly a mass data collection tool that the end-users don’t know the eventual consequences of using. I find Windows Timeline useful enough to have help develop an extension to make it work with non-Microsoft browsers. Yet, I strongly disagree with Microsoft’s data retention and data protection policies around the feature (and Windows 10 in general).

Microsoft has a long way to go to make Windows Timeline respect user privacy. By using Windows Timeline, you’re opting to automatically send a whole lot of information to Microsoft. The Windows Timeline extension for other web browsers sends less information to Microsoft than what Microsoft normally gets if you use the Microsoft Edge browser.

**Update** (2021-05-31): The Timeline extension is no longer available for download. A critical component required to handle logins no longer works. Microsoft has also announced the [removal of the Timeline feature](https://www.theverge.com/2021/4/14/22384316/windows-10-timeline-feature-cortana-sync-ios-android-removed?ref=ctrl.blog "“Windows 10’s Timeline feature is going away”") from Windows 10.

If you still want to use this feature, then you can find ~~download links for it on GitHub~~. Microsoft has since released their own [extension for Google Chrome](https://chrome.google.com/webstore/detail/web-activities/eiipeonhflhoiacfbniealbdjoeoglid/?ref=ctrl.blog), but the original supports Firefox and other browsers in addition to Chrome. 

Microsoft Edge sends the address of every webpage that’s loaded in the browser to Microsoft including frames (ads, embedded video) and every redirect. The extension only shares the address of the primary document and only after it has been displayed in the browser for a minimum amount of time.
### BATify extension brings Brave Rewards to Firefox and Chrome
URL: https://www.ctrl.blog/entry/batify-extension/
Last updated: 2026-08-23T22:02:08.000Z
A new browser extension lets users support their favorite websites, and YouTube and Twitch creators through donations of BAT crypto-tokens via Brave Payments.

91 weeks ago, I argued that Brave Payments would be [a better product as a browser extension](https://www.ctrl.blog/entry/brave-browser-extension/) than a whole web browser. Brave Software has since made no indications that they’re interested in making a browser extension, and have instead scrapped their current Muon based web browser product and begun making yet another web browser built on Chromium.

Browser extension developer Michael Volz, however, have detangled the attention tracking and contribution system from the Brave browser in a new unofficial Brave Payments client called *BATify*.

The BATify extension gives users who don’t want to abandon Firefox, Google Chrome, or Opera for the Brave browser the ability to support their favorite websites and creators through the Brave Payments platform.

**Update** (2019-01-16): The extension appears to have been discontinued and is no longer being distributed for any web browser. The website and project have disappeared completely without a trace.

There were 560 websites registered as verified Brave publisher partners as of early July 2018, according to BAT Growth. All of these can receive funding through Brave Payments using the BATify extension or the Braver web browser.

Users can’t migrate their wallets from the Brave browser to BATify as the two use incompatible backup and restore codes for their wallets. Users also won’t receive free BAT tokens when using BATify so they’ll have to fund their wallets with their own BAT crypto-tokens purchased at an exchange. Brave Payments and BATify needs to address the complexity surrounding user contributed funds to the platform.

BATify is available for Google Chrome and Firefox from the BATify website and for Opera through their website. The extension only had some 130 users across supported platforms as of early July 2018.

The current version of the BATify extension doesn’t work on Firefox for Mobile, despite reports to the contrary. The extension requires the `browser.windows` API which is unavailable on Firefox for Android. (By the by, almost every time I say and extension isn’t available for Firefox for Android, this API is to blame.)

#### Sources

- [List of verified Brave/BAT Publishers](https://web.archive.org/web/20180710024656/https://batgrowth.com/publishers), 2018-07-10, BAT Growth
- [Popup is entirely gray in Firefox for Android](https://github.com/mikel2000/batify/issues/27?ref=ctrl.blog), issue 27, 2018-07-10, Daniel Aleksandersen BATify repository, GitHub
- [BATify also working in Firefox mobile](https://web.archive.org/web/20180718124848/https://twitter.com/BatifyExtension/status/978968675700133888), 2018-03-28, @BatifyExtension, Twitter
- [Add light browser.windows API to Android](https://bugzilla.mozilla.org/show%5Fbug.cgi?id=1404014&ref=ctrl.blog), issue 1404014, 2017-09-28, Rob Wu, Firefox Bug Tracker, Mozilla
### Firefox, Security Keys, U2F, and Google Advanced Protection
URL: https://www.ctrl.blog/entry/firefox-u2f-google/
Last updated: 2026-08-23T22:07:00.000Z
Advanced Protection for Google Accounts uses a legacy web technology that’s only partially supported in Firefox. Here is how you get started with physical security keys and extra protections for your Google Account in Firefox.

### Should you use Google Advanced Protection

There are many reasons why you’d want to add extra layers of protection to your Google Account. Maybe you’ve got a decade worth of personal emails, important documents, or you’ve saved your credit cards and passwords in Google Chrome or Pay, or you’re an AdSense publisher and would like protect your revenue and account standing.

Google recommends that only people who require “extra protection” enable their Advanced Protection program. More specifically, Google suggest this as an option for public personas and others who might be at a higher risk of targeted attacks against their Google Accounts. However, I would argue that the program is suitable for anyone who believes their Google Account contains anything valuable like your email, personal information, and whole digital life.

Advanced Protection shifts Google’s security model form user-convenience towards stronger security. This means you won’t be able to login to some third-party apps and websites using your Google Account. This primarily affects third-parties that accesses or manages your Google Mail or non-app specific data in Google Drive.

### Two-factor login on steroids

Regular Google Accounts can boost their security by adding a secondary factor, usually in the form of the Google Authenticator mobile app that generates time-based one-time passwords that are unique to your account. If you lose or reset your phone, you can go through a few extra steps and unlink Authenticator from your account so that you can sign-in again.

Advanced Protection takes the additional layer of security offered by a second factor component to the login process a few steps further and uses physical security devices instead of relying on a mobile app. These security devices, known as security keys, come in many shapes and forms. They’re built on an open industry standard called Universal 2nd Factor (U2F) and come in wireless varieties with Bluetooth or NFC, and USB\-A or USB-C interfaces.

Advanced Protection require you to add at least two security keys to your account. You can enroll more keys later if you want to keep a third backup in addition to your two primary keys. You want to keep good care of your security keys and have at least one backup.

Unlike the regular two-factor authentication scheme, you can’t just remove the second step authentication requirement once you join the Advanced Protection program. If you lose your keys, you’ve to contact Google customer support and go through a long verification process and provide a lot of detailed information about your Google Account to unlock it. You can expect to lose access to your account for quite some time if you lose your security key.

### Obtaining hardware security keys

Before you can enroll in the Google Advanced Protection program, you must have at least two security keys at the ready. You can use the same keys for multiple Google Accounts, and even reuse the same keys with different U2F-enabled web services.

You should maintain a record of which security keys you register on which websites. If you lose or want to decommission a key, you’ll need this record to know where you need to log in and replace the key.

You can use any FIDO U2F security keys as long as they’re compatible with your devices. Google recommend you get one regular key with USB as your backup token, and one mobile-capable with wireless Bluetooth and NFC as the primary key you carry around with you. Specifically, Google recommends the YubiKey U2F (USB) and either the Feitian Multipass (Bluetooth/NFC/USB) or YubiKey Neo (NFC/USB). Bluetooth is more compatible with a wider range of devices, but the Bluetooth capabilities requires you to charge the key. NFC is less compatible with cheaper smartphones and other devices. However, neither NFC nor USB modes require you to charge the keys for them to operate.

**Update** (2019-05-26): Feitian Multipass model 1, 2, and 3 have been recalled over a security issue. [Free replacement devices](https://www.ftsafe.com/replacement/?ref=ctrl.blog) are being offered by Feitian.

I chose a YubiKey U2F, and a Feitian ePass (NFC/USB) as its about a third of the price of the YubiKey Neo as I don’t have a need for Bluetooth. (The cover photo shows the YubiKey U2F in blue and Feitian Multipass in white.)

Recent versions of Windows and MacOS should immediately recognize your U2F device so you don’t need to install any drivers. Older and stale Linux distributions may not recognize your U2F device, however. You can either update your Linux distribution or copy udev definitions for your device from a newer release.

You also won’t be able to use hardware tokens with [Firefox Flatpak edition for Linux](https://www.ctrl.blog/entry/firefox-linux-flatpak-snap/) without lowering the default security settings.

### Enabling U2F support in Firefox

Firefox version 60 and newer has built-in support for a new standard for hardware security keys called Web Authentication (WebAuthn). Google doesn’t \[yet\] use this standard, but you can enable support for the legacy FIDO U2F protocol in Firefox version 58 and newer.

To enable U2F support, type about:config into the address field in Firefox, and press Enter. Dismiss the warning, and search for the setting called security.webauth.u2f in the list of advanced settings. Double-click on it to enable U2F support and restart Firefox to apply the change.

This setting is only intended to make Firefox compatible with legacy systems that haven’t yet migrated to the newer Web authentication (WebAuthn) standard.

Unfortunately, you won’t be able to register any new security keys to your Google Account using Firefox. Firefox only has partial support for U2F and its implementation doesn’t include key-registration. You’ve to use Google Chrome to add security keys and enable Advanced Protection. Once you’ve added your security keys in Google Chrome, you can use your keys to authenticate in Firefox.

### Enroll in Google Advanced Protection

The first thing you’ve got to do is to put Firefox aside and either install or open Google Chrome if you’ve already got it installed. You can uninstall it after completing the setup process if you don’t want to leave Google Chrome on your system. You must use Google Chrome for the initial setup process of Google Advanced Protection, but you won’t need it afterward.

Using Google Chrome, head to the [Google Advanced Protection](https://landing.google.com/advancedprotection/?ref=ctrl.blog) page on Google.com, click Get started, and complete the enrollment steps. You’ll need both your security keys at this stage.

After you’ve completed the setup process, make sure to store your security keys separately. Don’t keep both of them with you as one should serve as your backup. If you lose on of your keys, be sure to order a replacement key and enroll it as soon as possible. You can add additional security keys and manage your existing keys on the My Google Account: Sign-in options: [Two-step verification](https://myaccount.google.com/signinoptions/two-step-verification?ref=ctrl.blog) page. You must have at least two keys associated with your Google Account unless you choose to disable Advanced Protection again. You’ll need to use Google chrome to manage your keys.

### Authenticating with U2F in Firefox

You’ll be signed out of your Google Account everywhere after you’ve enabled Advanced Protection. Assuming you’ve enabled U2F support in Firefox, as described above, you’ll be prompted to connect your security key once you try to login to your Google Account in Firefox.

### Firefox for Android

Unfortunately, you can’t use U2F with Firefox for Android as of the time of publication. However, work is slowly progressing in this area; at least from the look of things in the Firefox bug tracker. You won’t be able to login to Google services on Firefox for Android after you’ve enabled Advanced Protection.

You’ll again have to rely on using Google Chrome and the Google Authenticator app to access your Google Account. The Authenticator app is only used to facilitate communication between the Chrome browser and a Bluetooth or NFC security key.

Notably, this might be a bonus security and privacy enhancing feature. Keeping your high-value Google Account in Chrome and everything else in Firefox will make it harder for Google to associate your online activities with your Google Account. It will also make it much harder for a website to impersonate Google, as you’ll know that you can’t login to Google in Firefox.

#### Sources

- [Firefox 57 +](https://github.com/prefiks/u2f4moz/issues/59?ref=ctrl.blog), issue 59, 2018-05-23, James C. Jones, U2F support extension for Firefox (u2f4moz) repository, GitHub
- [Support U2F Tokens for WebAuthn on Android](https://bugzilla.mozilla.org/show%5Fbug.cgi?id=1391438&ref=ctrl.blog), bug 1391438, 2018-05-07, Firefox for Android issue tracker, Mozilla
- [Using Hardware Token-based 2FA with the WebAuthn API](https://hacks.mozilla.org/2018/01/using-hardware-token-based-2fa-with-the-webauthn-api/?ref=ctrl.blog), 2018-01-16, James C. Jones and Tim Taubert, Mozilla Hacks blog, Mozilla
- [Common questions with Advanced Protection](https://support.google.com/accounts/answer/7539956?hl=en&ref=ctrl.blog), 2018-01, General security information, Google Account Help, Google Support, Google
- [How to Navigate FIDO U2F in Firefox Quantum](https://www.yubico.com/blog/how-to-navigate-fido-u2f-in-firefox-quantum/?ref=ctrl.blog), 2017-11-30, Jerrod Chong, Yubico blog, Yubico
- [Order your security keys](https://support.google.com/accounts/answer/7545682?hl=en&ref=ctrl.blog), 2017-10, Google Account Help, Google Support, Google
### Personal data should be auto-delete after a few months by default
URL: https://www.ctrl.blog/entry/delete-old-data-gdpr/
Last updated: 2026-08-23T22:04:53.000Z
Do every app and web service we use need to keep all the data they collect until long after we’re all dead? I believe more services should be designed to auto-delete old junk by default, and only optionally store things for longer. —and since the introduction of the GDPR, the European Parliament agrees with me.

Last month, I wrote about how [Flattr automatically deletes data they’ve collect](https://www.ctrl.blog/entry/flattr-gdpr/) from your web browser history after three months. You get little to no value from them holding on to it for any longer, and they don’t get much value from it either.

Since the introduction of the General Data Protection Regulation (GDPR), this should have been the new default. Yet it’s hard to come by examples of any other company that voluntarily deletes the data it has collected about you when its no longer necessary to retain it. Let’s have a quick refresher on what the GDPR says about privacy and data erasure by default:

> “The controller shall implement appropriate technical and organisational measures for ensuring that, by default, only personal data which are necessary for each specific purpose of the processing are processed. That obligation applies to the amount of personal data collected, the extent of their processing, the period of their storage and their accessibility. \[…\]”

GDPR: Article 25 Data protection by design and by default: Paragraph 2

The following excerpt from Recital 39 has a clearer plain-English explanation:

> “This requires, in particular, ensuring that the period for which the personal data are stored is limited to a strict minimum. \[…\] In order to ensure that the personal data aren’t kept longer than necessary, time limits should be established by the controller for erasure or for a periodic review.”

GDPR: Recital 39 (excerpt)

The GDPR spells out in fairly clear terms that personal data should be deleted when it’s no longer strictly necessary to retain it. You can argue to no end over what types of data needs to be retained and stored for how long. Those discussions over data retention policies is what the European Parliament wants companies to have. However, even the biggest players in the data harvesting business appears to still store most data forever by default. I’ll look at two examples next.

### Microsoft Account/Graph

Microsoft collects a huge amount of data on consumer via their product and services. The [Microsoft Account Privacy dashboard](https://account.microsoft.com/privacy/?ref=ctrl.blog) lists an enormous amount of data collected through Microsoft’s many services including which apps and programs you open in Windows, what you do in some of these programs and apps, what websites you use, and more.

Separate from the Privacy Dashboard, you’ll also find individual export options for specific Microsoft products like Outlook, Skype, and To-Do at their respective websites.

A quick look at the exported data reveals that Microsoft Edge does collect every thing you do online. Including the web address (URL) of advertisements loaded in frames on other pages, login and session data passed in URL redirects. It’s interesting to note that these URLs don’t even appear inside your browsing history inside Microsoft Edge; because they’d hold no real value to end-users. Microsoft still collects and stores this data on you.

Microsoft doesn’t offer you any tools to delete all data older than a certain data, or filter your data by keywords. You can download a copy of or delete all your activity (for some services) with a single click, or you can explore data listed chronologically and delete one item at a time. Notably, your data export doesn’t contain data from Skype and Outlook. You can’t setup any policies to blocklist keywords from appearing in your history nor setup automatic deletion of old data.

### Google Account

Depending on how many Google products you use, your [Google My Activity](https://myactivity.google.com/myactivity?ref=ctrl.blog) history will contain your entire life. Google stores information about everything you do on Search, Mail, Chrome, Android, YouTube, and all its other products and platforms.

**Update** (2019-07-14): Google now offers to auto-delete collected location and search history, but users must [turn this on manually](https://www.ctrl.blog/entry/google-autodelete.html).

The Takeout dataset isn’t entirely complete and is [missing some apps like Podcasts](https://www.ctrl.blog/entry/google-podcasts-data-portability/) and music you’ve uploaded to Google Play Music.

Google records pretty much everything you ever do in their products and on their platforms; including how much time you spend with individual apps and which ads you click on around the web.

You can go into My Activity and search for and delete data by keywords or purge data older than whatever time you select. This is a big improvement over what Microsoft offers you, but you still can’t set up any kind of data retention policies. All data associated with your account is stored forever by default. Unless you setup a calendar event to remind you to do this every six months, you’re not going to get around to periodic cleanups of old data.

### Data needs expiration dates

I understand and even value that some data collection can lead to better products and experiences. When I type “windows installation” into a web search, I’m more likely looking for information about the operating system than carpentry services or glass isolation fact sheets. However, you don’t need to store ten yeas worth of data on me to figure that out. Six, three, or even a single month worth of my online habits should suffice! This holds even more true for targeted ads than it does for personalized search results.

Personal data, especially usage and trends data, should have a fairly short shelf life. There’s no need to store everything forever just because it has become increasingly feasible for companies to do just that. I called out Microsoft and Google specifically in this article but they’re not alone in this.

Like with so much else surrounding the GDPR, we’re all still waiting with baited breaths to see how its going to be enforced. I’m curious to see whether any data protection agencies in Europe will go after any company over never-expiring data retention policies by default. Even if the default doesn’t change, people should at least be offered the option to set up their own retention policies.

#### Sources

- [REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679&from=EN&ref=ctrl.blog), 2016-04-27, The Official Journal of the European Union, EU Parliament and EU Council
### How to detect Brave despite it not having a unique User-Agent
URL: https://www.ctrl.blog/entry/brave-user-agent-detection/
Last updated: 2026-08-23T22:02:44.000Z
The User-Agent string is the name that web browsers and other web clients send to web servers to identify their make and model to the server. This data is primarily used for statistical and troubleshooting purposes. The Brave web browser isn’t brave enough to have their own User-Agent and instead tries to camouflage as Google Chrome.

Brave is a very opinionated web browser. This makes it easy to reliably detect it even without a unique User-Agent, and I’ll spend most of the article advocating for why Brave should have their own User-Agent. You can skip to the last two sections if you’re only interested in the detection code.

Brave had a User-Agent of its own in the first few months of its existence, but removed it in April 2016. The history books (git commit logs) show that Brave removed the “Brave/Version” component from their User-Agent string to make it more difficult to fingerprint the browser.

Just days before the removal, Brave Software had attracted the ire of the Newspaper Association of America (NAA) and were understandably worried that publishers would begin targeting and blocking their User-Agent over Brave’s plans to replace publisher ads with their own ads. [The Drum](https://www.thedrum.com/news/2016/04/08/ex-mozilla-chiefs-adblocking-extension-brave-riles-publishers?ref=ctrl.blog) has the details on this.

It’s quite easy to detect ad-blocking extensions, and few (if any?) publishers actively block visitors who use this type of software. There are several other niche web browsers that block ads by default and also set their own unique User-Agent. I haven’t found any indications of publishers actively blocking any of these browsers even on a small scale.

### Detection methods

Brave may not have its own HTTP User-Agent request header, but even the *order* of Brave’s HTTP request headers are in themselves unique to Brave. No client side JavaScript required.

I’ve found over 21 easily detectable characteristics which are unique to Brave, and it only took me half an hour to discover and test these. I’m assuming there are many more methods.

Most of these unique characteristics stem from Brave’s efforts to make it harder to uniquely fingerprint individual users. Which I’m all for. I don’t believe there are any legitimate reason to fingerprint individual users. This, combined with behavior specific to Brave’s ad-blocking implementation, makes it easy to fingerprint the Brave browser itself.

It’s difficult to design a browser that doesn’t allow for fingerprinting of its users while also not making itself uniquely distinct from its upstream browser. Just ask the Tor Browser project.

### The User-Agent is a free promotional tool

How are websites supposed to know that the Brave browser is popular and that they should consider signing up for the [Brave Payments](https://creators.brave.com/?ref=ctrl.blog) platform?

Many web publishers are in desperate need to diversify their income streams, and Brave can held them achieve that at practically no deployment cost to the publisher. However, why would they even bother to do so? When they check their access logs, they’ll see that Brave has 0 users.

Users of other web browsers are promoting that web browser and advocating for the website to test and ensure compatibility. Brave users fly under the radar as Google Chrome users, so websites might never realize that they’re popular among the Brave user community.

Brave Software asks web publishers to help promote their web browser but doesn’t provide the tools publishers require to run and measure an efficient promotional campaign for a web browser. You never see ads for the Google Chrome browser when you’re already using Google Chrome but users of any other web browser knows only too well that ads for Chrome are everywhere on the web.

### Every browser should have its own User-Agent

The point of this article was meant as an argument *for* Brave to adhere to the established etiquette and protocol among web browsers: use your User-Agent!

There are no independent and verifiable counts of how many people use Brave. (Well, *I* count them — but my sample size is quite small.)

Brave should at the very least share their User-Agent with their verified publishers. These are the same websites Brave asks to help it promote the Brave browser. The Brave browser already knows how to identify websites that participate in Brave Payments as verified publishers. Brave could conditionally expose the Brave User-Agent to these websites to allow them to measure and analyze the success of Brave Payments.

Brave can also work around specific site blocking by hiding their User-Agent from any site that would target and negatively impacting their users using site-patching. Site-patching is a tool you’ll find in most web browsers were the browser vendor can run script snippets or change settings for specific websites to work around User-Agent discrimination and compatibility issues.

### How to detect Brave?

**Update** (2020-03-31): Brave still doesn’t have its own User-Agent. The User-Agent may be deprecated going forward, however. On a positive note, you can now reliably detect Brave using the following test:

```javascript
(navigator.brave && await navigator.brave.isBrave() || false)
```

**Update** (2019-12-15): New detection mechanism added. The new method is Brave’s official alternative to a distinct user-agent. The previous mechanism detected a special property of the `window` object.

Brave doesn’t care much to maintain compatibility with the Web Platform and standards. One of the weirder things it does is to remove specific URL query parameters from all requests. These parameters are added and used by companies like Google and Facebook for click-attribution.

To detect Brave: From the client, send a request to a specially crafted URL (below). This should be **sent to the same-origin** or you accidentally measure [WebKit ITP 2.2](https://webkit.org/blog/8828/intelligent-tracking-prevention-2-2/?ref=ctrl.blog) instead.

```
/detect-brave?gclid=3&fbclid=2&sub=marine
```

On the server side, verify whether you got all three query parameters. If the two first parameters were removed then the request *probably* came from Brave. There’s an inherent margin for error when it comes to attributing browser behavior to a specific browser.

There are a few different extensions that has the same behavior. I was only able to identify a combined installation base of 2200 for these extensions in the Chrome Web Store and Mozilla Add-ons Directory.

This method was introduced with Brave for desktop version 1.1.20 and last verified in version 1.1.21\. It doesn’t work on Brave for iOS or Android.

Please **do not** discriminate against people based on their browser of choice! Use this method to measure and communicate with them about it but don’t block access! The web must remain open and diverse.

This type of fingerprinting is ridicules and it shouldn’t be necessary. I hope we’ll see Brave live up to its own name and follow with the web community consensus: every browser should have their own User-Agent.

Please leave a comment below to notify me if the detection method stops working, and I’ll share another detection method. I’ve got a few dozen different methods.

#### Sources

- [Expose way for sites to determine if browser is Brave](https://github.com/brave/brave-core/pull/4721?ref=ctrl.blog), pull request #4721, 2020-03-05, Brave Core repository, Brave Software, GitHub
- [Filter user-tracking parameters from query string](https://github.com/brave/brave-core/pull/3239/files?ref=ctrl.blog), commit 609f59d908, 2019-09-10, Francois Marier, browser-core repository, Brave Software, GitHub
- [Ex-Mozilla chief’s adblocking extension Brave riles publishers](https://www.thedrum.com/news/2016/04/08/ex-mozilla-chiefs-adblocking-extension-brave-riles-publishers?ref=ctrl.blog), 2016-04-08, John McCarthy, The Drum
- [filtering.js](https://github.com/brave/browser-laptop/blob/327fcc7433b266b2d4f3437cfe021d35541696bd/app/filtering.js?ref=ctrl.blog), commit 327fcc7433, 2016-04-05, browser-laptop repository, Brave Software, GitHub
### New Google Podcasts app: who needs data portability anyway?
URL: https://www.ctrl.blog/entry/google-podcasts-data-portability/
Last updated: 2026-08-23T22:09:01.000Z
Google introduced a new app for podcasts this week called [Google Podcasts](https://play.google.com/store/apps/details?id=com.google.android.apps.podcasts&ref=ctrl.blog). Unlike most other podcast apps that are built on open standards; Google focuses on “content discovery” and curation, and a complete lack of interoperability and data portability.

You might not thing about podcasts in these terms, but the podcasting ecosystem is built on open web standards where any listener can subscribe to any podcast. Anyone can publish a podcast and there’s a diverse ecosystem of tools for podcast publishing. This openness is parts of what makes podcasts so great and why there are so many different podcasts to choose from.

Google have decided to take their app in another direction. Before I get into that, I’d like to quickly talk about the “new app” itself.

### The new “app”

First thing first: this isn’t a podcast app, it’s a shortcut to the podcasting section of the main Google Search app. The app is intended to highlight a distinct set of functions that are hidden in the main app by promoting it as a separate app.

Google Podcasts doesn’t request any system level permissions whatsoever. The app doesn’t need to ask for permission to use your location data, contacts, and other permissions as **it has already got those permissions.** Since you’re using the main Google app, the podcast app has all the same permissions as the Google app. I’m not saying that the app uses these permissions but merely pointing out that it has them — and that few (if any?) other podcast apps request the same permissions.

The same goes for the app’s storage space usage report. The shortcut app is just 270 kB consisting mostly of icon files. The app’s caches, including downloaded episodes which can take up significant space, are reported under the main Google app.

The Podcasts app from Google **can’t be configured to automatically download new podcast episodes.** This functionality is found in just about any traditional podcasting app, but it’s nowhere to be found in Google Podcasts. Episodes only begin downloading (potentially over a costly mobile data connection) when you tap the Play button. Podcasts will, however, automatically delete downloaded episodes after a user-configured time interval.

The app isn’t optimized for people who wants to listen to a lot of podcasts. You can’t queue episodes or play all new episodes in one go. You’ve to start new episodes one at a time, which sounds like a small thing until you realize that many listens to podcast while they’re commuting and shouldn’t be distracted by having to manage podcast playback on their devices.

### No data portability

Every podcast app of note supports importing and exporting subscription lists between different apps in a common structured format known as OPML. Google Podcasts doesn’t allow you to either import or export your subscriptions using OPML or even through Google Takeout.

In practical terms, this means that you’re locked in to Google Podcast to a greater extent than other podcast apps. The podcast ecosystem has benefited from people being able to take their subscriptions from one app to another and back again at their choosing. You can export your subscriptions in Pocket Casts and import them into iTunes, and export them from iTunes and import them into Overcast. It might take you a minute to work out how it’s done, but data portability is broadly supported in the podcast ecosystem.

There’s no way from within the app find the original syndication feed address (colloquially known as “RSS”) of a podcast either, so you can’t manually copy over your subscriptions one by one into a different podcast app.

There are more people who don’t listen to podcasts than people who do. Google has already tied Google Podcasts directly into search results on Google on Android. When new audiences discover a podcast through Google Search and choose to subscribe to it in Google Podcasts, they’ll have a harder time moving their subscriptions to a competing app that may offer a better user experience than Google Podcasts. Frankly, just about any other podcast app provides a better user experience than what the Google Podcasts app currently offer.

Only last month, European Union citizens got a legal right to data portability under the General Data Protection Regulation’s (GDPR) 20th article aptly named Right to data portability. Article 20 specifically sets out that people must be able to export their data in a commonly used structured data format (like OPML.) I’d hoped we’d see new apps and services launch with data portability out of the gate, but it doesn’t seem like Google got the memo on this one.

Spotify is the only other noteworthy podcast app that doesn’t support exporting and importing subscriptions.

### Unlisted podcasts

Unlike most other podcast apps, you can’t subscribe to just any podcasts you want through Google Podcasts. You can’t search for or subscribe directly to a podcast’s syndication feed. Instead, Google will discover podcasts as it crawls and indexes the web, and add the podcasts it finds to it’s catalog. That is all well and good if all your podcasts have been discovered and indexed by Google already, and Google claims they’ve already added more than one million podcasts, but it’s of little comfort if your favorite shows aren’t available.

Google has made available a tool for [podcast publishers](https://search.google.com/devtools/podcast/preview?ref=ctrl.blog) that maps URLs to entries in Google Podcasts, but they’ve opted to not offer the same functionality to people using the Podcasts app or even in the Google Search app.

You can influence the selection in Google Podcasts if your favorite show isn’t listed. You can notify Google of a new podcast and hopefully they’ll include it:

1. Find the podcast feed link and copy it
2. Visit [Google’s WebSub hub](https://pubsubhubbub.appspot.com/publish?ref=ctrl.blog) and submit the feed link
3. Wait half an hour or more
4. Visit [Google’s Podcast Preview tool](https://search.google.com/devtools/podcast/preview?ref=ctrl.blog) and submit the feed link in the direct link generator

If your show has been added, you’ll get a link to it that you can open on an Android device with the Google Podcasts app already installed. Or you may get an error message. Try waiting another hour or two and then repeat the process. (Or you can just use an more open podcast app that allows you to subscribe to whatever you want.)

I’ve used the above method to get two long-running but unlisted podcasts included in Google’s catalog, but there’s no guarantee that it will work. A podcast may have been excluded for different reasons. The two links above also contains debugging tools for podcast publishers (and technically minded subscribers) to identify issues.

The only other podcast app I’ve found that doesn’t allow you to subscribe to a podcast by its syndication feed URL is Spotify. Spotify requires that podcasts are delivered through one of twelve approved podcast distribution partners.

### Producing transcriptions and translations

Google’s [blog post about the launch](https://blog.google/products/android/listen-google-podcasts-now-android/?ref=ctrl.blog) talks about the future of the app in grand terms. Specifically, Google suggested that they might add speech-to-text subtitles, as well as automatic translations of podcasts in foreign languages.

I’d personally appreciate a searchable transcript for every podcast episode ever recorded but few shows produce them. Transcripts require hours of human labor and are expensive to create. Today, there’s no way to find your way back to anything you remember hearing on a podcast two months ago other than to sit down and listen through the episode archives. Maybe you remember which show it was and roughly when, but you’re ultimately left with few tools other than your ears and patience.

Episode transcriptions aren’t available at launch because the technology just isn’t good enough yet. Only last year, Six Colors tried transcribing their podcast with Google’s speech-to-text API and [concluded that the accuracy just wasn’t good enough](https://sixcolors.com/post/2017/03/the-dream-of-converting-podcasts-into-text/?ref=ctrl.blog) yet. As far as I can tell, this is the first time one of the major tech companies have talked about automated podcast transcriptions since the closure of Yahoo! Podcasts over a decade ago.

Neither [programmatic ad insertions](https://www.ctrl.blog/entry/programmatic-podcast-ads/) or ad-blocking for podcasts are a thing yet. High quality transcripts would greatly improve Google’s ability to match contextually relevant advertisements and automatically insert ads at opportune moments. Google already dominates the contextual advertising market on the web and video. Google Podcasts might just be their first baby steps onto the podcast advertising scene.

#### Sources

- [Get your podcast on Google](https://support.google.com/podcast-publishers/answer/9476656?ref=ctrl.blog), 2020-05-19, Google Search, Google Developers, Google
- [Listen up: Google Podcasts is now on Android](https://blog.google/products/android/listen-google-podcasts-now-android/?ref=ctrl.blog), 2018-06-19, Zack Reneau-Wedeen, The Keyword blog, Google
- [Listen to podcasts with Google Podcasts](https://support.google.com/websearch/answer/9049144?hl=en&ref=ctrl.blog), 2018-06-19, Google Search Help, Google
- [How do I get a podcast on Spotify?](https://web.archive.org/web/20180617050833/https://artists.spotify.com/faq/popular#how-do-i-get-a-podcast-on-spotify), 2017-10, Frequently Asked Questions, Spotify for Artists, Spotify
- [The dream of converting podcasts into text](https://sixcolors.com/post/2017/03/the-dream-of-converting-podcasts-into-text/?ref=ctrl.blog), 2017-03-28, Jason Snell, Six Colors
- [REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679&from=EN&ref=ctrl.blog), 2016-04-27, The Official Journal of the European Union, EU Parliament and EU Council
- [Yahoo! to Close Its Podcasting Site](https://readwrite.com/yahoo%5Fto%5Fclose%5Fpodcasting%5Fsite/?ref=ctrl.blog), 2007-09-26, Marshall Kirkpatrick, ReadWrite
### Don’t trust YouTube’s break-reminders
URL: https://www.ctrl.blog/entry/youtube-break-reminders/
Last updated: 2026-08-23T22:26:08.000Z
The YouTube app on Android and iOS has an option that will pause video playback and remind you to take periodical breaks from staring at videos from hours on end. These reminders aren’t very reliable, however, and you shouldn’t rely on them for your health.

The web’s economy and the major platforms all run on one scares commodity: people’s attention. Who’d willingly remind people to stop giving their service people’s full and undivided attention? YouTube claims that’s exactly what they’re doing with their new break-reminders.

The new option is found in the YouTube app for Android and iOS since late May 2018, and is off by default. You’ve to discover it and enable it on your; choosing how often you want to be reminded to take a break in the setup process.

Every time you get a notification, you’ll be presented with two options. The first option is to dismiss the reminder and resume the video you’re watching (presumably after taking a short break), and the second option is a one-tap shortcut to Settings were you can disable the reminders again.

The reminder system is a good idea for those of us who find themselves having unintentionally spent two hours watching YouTube and are unable to account for the intervening time.

However, there are a bunch of limitations to how and when the reminders will work or not. Depending on how and where you use YouTube, you may never see any reminders even after you’ve opted-in to seeing them. Here is a list of some of the limitations to when and where you’ll see break-reminders.

- **You can only configure break-reminders in the Android and iOS versions of the main YouTube app.** Reminders don’t work in the YouTube Gaming app or in the YouTube Go app (only available for Android Go edition phones in developing markets.) The YouTube Gaming app in particular is geared towards hours-long programming and long live streams. It also unavailable on both the mobile and desktop websites.
- **Reminders don’t work while you’re controlling or casting video to a Google Chromecast** or a Google Casting compatible device like a TV or gaming console. This would require tigher integration with these playback devices. However, Google could still send a reminder to your phone while you’re watching on another device.
- **Reminders don’t work when you’re watching offline videos** (YouTube Premium and YouTube Go) or playing videos in the background (YouTube Premium and YouTube Music.) This might indicate that it requires an internet connection, and that it may still work as long as your device is online.
- **The watch-duration timer is reset if you (or your operating system) close the YouTube app.** Whether an app runs in the background or is killed is out of users’ control. Modern operating system close background apps at their own discretion to manage device battery and performance. Switching to a messaging app temporarily and switching back may reset the counter. You won’t know for sure, and that causes friction and the feature will fail to live up to people’s expectations.
- **The watch-duration timer don’t carry on if you switch to watching on another device.** Even though YouTube keeps track of every second of every video you watch for revenue-share and engagement tracking purposes, they can’t keep a running tally of your watch time across multiple devices even when you’re signed in with the same account on all of them. Accurate cross-device tracking is apparently only to be used for YouTube’s own purposes.

I don’t believe that anyone who configure YouTube to remind them to take breaks would reasonably expect any of the above situations to cause the reminders to not to be triggered. You’ve to test and discover these for yourself, and by the time you discover them you won’t have much faith in YouTube’s ability or willingness to remind you to stop watching videos on their platform.

For YouTube’s break reminders to work, you’ve to only use the YouTube app on your phone without doing anything else for long periods of times.

I can’t see any strong data privacy or technical restrictions that would warrant any of the above limitations. There’s no reason why YouTube on the web couldn’t store how long you’ve been watching videos this session in your browser. The feature should have been available everywhere.

There’s no reason why my Android phone couldn’t keep a running timer and pause a device using the Google Casting protocol. The pause button is right there on my lock screen at all times! There’s no reason why it wouldn’t work when watching online videos – the timer doesn’t sync with your account, so why couldn’t it also run when watching locally cached videos? —and lastly, loosing session state/resetting the timer when the app is closed is just lazy programming.

Either YouTube engineers took too many breaks to watch videos while testing and developing this feature, or you’ve got to start wondering whether there are ulterior motives at play here. Does YouTube want to interrupt people and potentially discourage them from spending even more time with their product?

The thing is, these reminders are also **good for YouTube**. These reminders enable YouTube to say to advertisers: “People are actively watching these videos for hours and hours! We prod people every 40 minutes, and they confirm that they’re still watching!” I would have expected that YouTube would have wanted to enabled these reminders by default for all users on all platforms. We might very well see that a few months from now.

Netflix have had a similar system in place for years already where they ask viewers to confirm that they’re still watching after a few hours of streaming. Netflix do this to keep down licensing costs for content when there’s nobody watching the stream anymore.

I recommend you find a dedicated break time reminder app to remind you instead of using the functionality built-in to the YouTube app. There are over 200 break time reminder apps for Android on the Google Play Store. Chances are that one of them will work more reliable than YouTube.

#### Sources

- [Take a break reminder](https://support.google.com/youtube/answer/9012523?hl=en&ref=ctrl.blog), 2018-05-10, YouTube Help, Google Support Google
- [100 things we announced at I/O ‘18](https://blog.google/technology/developers/all-io18-announcements/?ref=ctrl.blog), 2018-05-10, Alicia Cormie, The Keyword blog, Google
- [How can I prevent Netflix from auto-playing episodes?](https://help.netflix.com/en/node/2102?ref=ctrl.blog), 2016, Help Center, Netflix
### Moved to Hetzner VPS: Shorter legal docs as a competitive advantage
URL: https://www.ctrl.blog/entry/hetzner-vps-short-legal-docs/
Last updated: 2026-08-23T22:09:08.000Z
Do you read the often lengthy legal agreements required by your Virtual Private Server (VPS) hosting provider? I guess that many skip past these documents, but I read them. My now former VPS hosting provider, Linode, sent me a shedload of updated legal agreements at 23.00 on a Friday night before a long weekend with just six days to review the documents before they went into effect.

I never read what Linode’s lawyers had to say about the General Data Protection Regulation (GDPR). The length of the Linode Privacy Policy alone had grown by 273 % compared to the previous version, and that was only a small part of the overall agreement. I took the opportunity to switch hosting provider, get away from the lengthy legal documents, and save some money at the same time.

Linode, like every other company, had a two year period to adopt to the GDPR – but they chose to wait until the very last week to act. I frankly got a bit pissed off at them for not giving their customers a significantly longer notice period before they enacted any contractual changes. I’m sure Linode’s lawyers are great folks that are doing fine work protecting Linode’s interests. However, the policy changes Linode chose to enact a week before the GDPR should have been ready two months earlier at the very least.

I began looking for a new Virtual Private Server (VPS) hosting provider, and took into account the total length of their legal agreements as well as the usual performance/value-for-money consideration I usually go for.

I’ll not bore you with the details of that search here, but I will point out that the USA based hosting providers in general have significantly wordier legal agreements than hosting providers based elsewhere in the world. Almost all the budget VPS providers I reviewed mixed their website’s privacy policy and the privacy policy for their service offering together in one confusing document.

After spending two days reviewing a dozen different hosting providers, I decided to go with [Hetzner Cloud](https://hetzner.cloud/?ref=zVX7QZtzKyRP). Hetzner’s full English language agreement for their Cloud service is **ten words shorter** than Linode’s privacy policy alone, and just a little over a quarter the length of Linode’s entire set of agreements.

Hetzner is an German budget provider with data centers in Nuremberg and Falkenstein/Vogtland in Germany plus a brand new data center in Helsinki, Finland. My data center location isn’t super important to me as the majority of traffic is routed through and served by [BunnyCDN](https://bunny.net/?ref=ctrl.blog) (see my [budget CDN comparison](https://www.ctrl.blog/entry/budget-cdn-review/)).

Hetzner is cheaper than Linode’s cheapest option and you get considerably more for your money:

|           | Hetzner CX11 | Hetzner CX21 | Nanode 1GB |
| --------- | ------------ | ------------ | ---------- |
| Price     | €2,49        | €4,90        | $5,00      |
| Cores     | 1            | 2            | 1          |
| RAM       | 2 GB         | 4 GB         | 1 GB       |
| Disk      | 20 GiB       | 40 GiB       | 25 GiB     |
| Bandwidth | 2/1 GB/s     | 2/1 GB/s     | 40/1 GB/s  |
| Traffic   | 20 TiB       | 20 TiB       | 1 TiB      |
| +1 TiB    | €1           | €1           | $20        |
| Backup    | €0,50        | €0,99        | $2,00      |

At the current currency exchange rate, and with backup services included, I get two CX11 instances or one CX21 instance at Hetzner for the price of just one Nanode. The traffic overrate charge is 94 % cheaper and even includes 19 TiB more traffic in the standard service package. The biggest difference is in the incoming bandwidth speeds. However, I’m getting the same outgoing speed and that’s the main factor for how fast I can serve the limited number of requests that trickle in from my CDN.

Hetzner offer a choice of the latest version of four Linux distributions: CentOS, Debian, Fedora Linux, or Ubuntu. However, you can choose from additional operating systems with manual setup including Alpine Arch Linux, Devuan, FreeBSD, OpenBSD, OpenSUSE, and even Windows Server (license sold separately, as they say).

I, of course, [chose Fedora Linux](https://www.ctrl.blog/entry/migrated-to-fedora/) and went with Hetzner’s new data center in Helsinki, complete with that fresh new data center smell, to get the latest and hopefully greatest technology. A more conservative admin may have opted for the older data center, but I’m relying on [stale-while-error](https://www.ctrl.blog/entry/how-to-test-stale-while-revalidate/) to cover for me for a few days in the unlikely event a catastrophic failure at Hetzner.

This isn’t the first time I’m with a European hosting provider, but so far is the first time I haven’t hated the experience. Hetzner has a modern looking administration interface paired with prices and services that can compete with the larger players in the VPS space.

#### Sources

- [Cloud Server Plans and Pricing](https://web.archive.org/web/20180604153433/https://www.linode.com/pricing), 2018-06, Linode
- [Hetzner Cloud](https://web.archive.org/web/20180604153229/https://www.hetzner.com/cloud?country=ot), 2018-06, Hetzner Online
- Linode and Hetzner Cloud legal notices; terms of service; privacy policies; etc., 2018-05-21
- [Billing and Payments](https://web.archive.org/web/20180604153516/https://www.linode.com/docs/platform/billing-and-payments/), 2018-05-17, Linode
- [Data centers](https://www.hetzner.com/unternehmen/rechenzentrum/?country=en&ref=ctrl.blog), 2018-05, Hetzner Online
### How to monitor system bandwidth usage statistics with Darkstat
URL: https://www.ctrl.blog/entry/fedora-darkstat/
Last updated: 2026-08-23T22:06:09.000Z
[Darkstat](https://unix4lyfe.org/darkstat/?ref=ctrl.blog) is a handy little program that will monitor and track your system’s bandwidth utilization and help you keep an eye on what is eating up your bandwidth quota. Here is how you set it up in Fedora Linux.

You can install Darkstat on your router, server, or even just your personal computer.

Darkstat will generate statistics and graphs tracking average network utilization in total per hour, day, and month (screenshot below), and statistics per destination host and per port per destination host. (It took me two years to discover the last set of statistics. Click on an IP address in the hosts table to see it.)

### Getting Darkstat up and running

Start by installing the `darkstat` package:

```
dnf install darkstat
```

You **must manually configure your network interfaces** in `/etc/sysconfig/darkstat` configuration file before you can start the service. Adjust the `OPTIONS` variable and list the network interfaces you wish to track with the `-i` argument. (You can see your active network interfaces by running the command `ip a`.) You may only want to monitor your mobile network interface or all external interfaces.

Once you’ve configured a network interface, you can already start Darkstat by issuing the following command:

```
systemctl enable --now darkstat.service
```

Darkstat should be up and running and you can see all the network traffic ticking by your system being counted up by visiting `http://[::1]:667/` (localhost on port 667) in your preferred web browser.

The top of the web interface gives you two options: graphs, which shows your traffic totals, and hosts which shows a per-destination host table. It can take some time for hostnames to resolve, depending on the status of your local or network DNS cache. Learn [how to configure a local DNS cache](https://www.ctrl.blog/entry/knot-dns-resolver-tutorial/).

![Darkstat graphs](https://cdn.synaps.media/control/content/images/2026/08/darkstat-screen-graphs.png)

### Restricting the service

By default, Darkstat runs as the `nobody` user. The installer adds a dedicated `darkstat` system user, but this isn’t used in the default configuration. In this section we’ll switch to using the Darkstat system user to keep other services from reading it’s data (we’ll get back to this in the next section) and move the service to a more secure chroot environment for additional security.

Start by creating the directory we’ll be storing data in, and change the owner to `darkstat` using the following commands:

```
mkdir /var/lib/darkstat/
chown darkstat:nobody /var/lib/darkstat/
chmod 700 /var/lib/darkstat/
```

Next, you’ll need to add some additional arguments to the `OPTIONS` variable in `/etc/sysconfig/darkstat` to let it know where to store its data and which user to run as:

```
OPTIONS="-i p10p1 \
         --user darkstat \
         --chroot /var/lib/darkstat/"
```

The `-i` argument is the interfaces you configured in the initial setup step in the previous setting.

Restart the Darkstat service to apply the changes using the following command:

```
systemctl restart darkstat.service
```

### Configuring persistent records

You may have noticed that Darkstat forgot all the data it had tracked so far when you restarted the service. By default, Darkstat won’t save your usage data to disk and will start tracking anew on restart. Darkstat can store up to 31 days of data in memory or on disk.

If you don’t restart your system often, this may be what you want. However, you may wish to enable persistent storage so that your records will survive past a reboot.

```
OPTIONS="-i p10p1 \
         --user darkstat \
         --chroot /var/lib/darkstat/ \
         --export /netuse.db \
         --import /netuse.db"
```

The other arguments in the above example were configured in the previous sections.

If you’re interested in tracking more than the 300 destination host maximum, you can increase the number of hosts to follow by adding `--hosts-max 5000` (top hosts to track in memory) and `--hosts-keep 4500` (top hosts to save to disk) to the `OPTIONS` variable. This will also enable Darkstat to better keep track of destination hosts that use a “trickle amount” of data over longer periods of time.

5000 addresses will use about 9–12 MB of memory and disk space, and won’t have any noticeable delay on your network performance. You can go above this if you believe there’s any value in tracking even more hosts, but let the data run for a few days before decreasing or increasing the suggested numbers.

Restart the Darkstat service again to apply the changes using the following command:

```
systemctl restart darkstat.service
```

Darkstat was reset one last time for this restart. Try restarting it again and you’ll see that the restart no longer forgets your previously recorded data.

### Surviving sleep and downed network links

Darkstat will exit and not be restarted when a network interface goes down or the system goes to sleep. You can wok around these issues by intruding persistent storage, as described above, combined with the below fixes to the systemd unit file.

Run the following command to create a local system unit file overwrite file to modify the default behavior:

```
systemctl edit darkstat.service
```

Copy the below systemd unit file and include them in the overwrite file that opened when you ran the above command:

```
[Unit]
After=syslog.target network-online.target

[Service]
Restart=always
```

These changes does is cause the service to be restarted if it stops and to wait for the network to not only become available but online before starting Darkstat. Combined with the persistent storage configured above, you won’t notice it when Darkstat restarts.

To apply the changes, you need to reload all systemd unit files, and then restart Darkstat one last time:

```
systemctl daemon-reload
systemctl restart darkstat.service
```

These improvements have been [suggested](https://src.fedoraproject.org/rpms/darkstat/pull-request/1?ref=ctrl.blog) to the Fedora project, but haven’t yet been accepted by the package maintainer for Darkstat. These steps should be unnecessary in the future.

If you’re having problems or want to run Darkstat on a device with frequently changing network configurations (like a laptop), then I recommend you also add `--wait 5` to the `OPTIONS` variable. This just delays the startup of Darkstat to allow for more time to get the network up and running.

#### Sources

- [systemd.service man page](https://www.freedesktop.org/software/systemd/man/systemd.service.html?ref=ctrl.blog), version 238, 2018-03-05, systemd project, FreeDesktop.org
- [darkstat man page](https://unix4lyfe.org/gitweb/darkstat/blob/255cfa8926e1e5d5ff4485907ef508e99b7fa4e3:/darkstat.8.in?ref=ctrl.blog), 2014-01-25, Emil Mikulic, darkstat project repository
### Problems to expect when using the Apache mod_cache module
URL: https://www.ctrl.blog/entry/mod_cache/
Last updated: 2026-08-23T22:14:36.000Z
The `mod_cache` module in the Apache HTTP Server (httpd) is a standard HTTP web cache that you can use to accelerate your website by caching dynamically generated pages (or pages passed through a proxy.) This can bypassing large parts of the processing chain and fulfill each request much faster than if your server had to regenerate the request each time.

I’ve used `mod_cache` for various projects over the years, and almost every time I run into the same set of problems. Here is a collection of some of the problems I’ve ran into repeatedly over the years to help you know what to expect when decide to use `mod_cache`.

Some familiarity with [HTTP caching](https://www.ctrl.blog/tag/http-caching/) and control headers is assumed for this article.

### The unlucky visitor

I’ve sung praises for [asynchronous stale-while-revalidation](https://www.ctrl.blog/entry/how-to-test-stale-while-revalidate/) (RFC 5861) on this blog before. Simply put, it’s a standard control header that instructs a caching server to serve a stale/expired version of a resource to visitors while it revalidates and updates the cached version in the background.

`mod_cache` kind-of-but-not-really support a primitive version of this system that isn’t controlled by a standard HTTP header. `mod_cache` will use one visitor request to revalidate the resource while everyone who comes after that first visitor gets served stale content until it can be updated. The one unlucky visitor will, of course, get a much slower and less satisfactory experience than everyone else.

This is know as the “thundering herd mitigation” and is specifically designed to prevent thousands of requests flooding through to the origin server when a request expired. It’s not designed to give everyone a quick response and a great user experience. This is a relatively small problem for extremely popular websites where every resource is frequently requests. It’s a bigger problem for a smaller website or blog where not every page is super popular. The one unlucky visitor doesn’t care whether you run a small or enormous website; they’ll still have a worse experience than everyone else.

### Too many resource `Vary`\-ants

One of the most used HTTP cache control headers is `Vary`. Read my [explainer article](https://www.ctrl.blog/entry/http-vary-explained/) for a quick refresher. HTTP Server will include a `Vary: Accept-Encoding` response header by default when either `mod_brotli` or `mod_deflate` is enabled to provide compression.

The default HTTP Server filter chain will store compressed variants of each resource in the cache. This saves processing cycles on the server as cached resources are all set and ready to be sent to the visitor without further processing immediately.

However, `mod_cache` doesn’t remove duplicate HTTP request header values, sorts their values, normalizes white space characters, or handle quality scores. It does compare strings in ASCII lower-case and merge duplicate request headers, however. You’ll see a lot of variation in request headers that from browsers, bots, and other clients; depending on the request header in question.

I’ll show a few example `Accept-Encoding` HTTP headers to demonstrate the problems this causes:

```
Accept-Encoding: gzip, br, br
Accept-Encoding: br, gzip
Accept-Encoding: gzip,br
Accept-Encoding: br;q=1, gzip;q=1
```

All of the above headers are perfectly valid in the HTTP standard, and all of them are equivalent and should have been normalize to just one variant:

```
Accept-Encoding: br, gzip
```

From those two candidates, HTTP Server should pick the preferred compression algorithm based on which modules are enabled. You should only end up with one variant from the above `Vary` header. What you get instead is four different variants.

You can use the `RequestHeader` directive from mod\_headers to manually process and normalize the `Accept-Encoding` request header and override it to your preferred content encoding. Below is an example of such a header normalization configuration (quality qualifier unaware) for normalizing known header values of the `Accept-Encoding` header:

```apacheconf
CacheQuickHandler off
<If "%{HTTP:Accept-Encoding} =~ /br/">
  RequestHeader set Accept-Encoding br early
</If>
<ElseIf "%{HTTP:Accept-Encoding} =~ /gzip/">
  RequestHeader set Accept-Encoding gzip early
</ElseIf>
<Else>
  RequestHeader unset Accept-Encoding early
</Else>
```

Similar normalization should be applied to all `Vary`\-ing headers. The thing is, `mod_cache` should be doing this automatically to ensure good cache-hit ratios. I can’t think of any situation where request header normalization would not be the right thing to do. However, this does negatively impact performance as you must disable the `CacheQuickHandler` directive to make HTTP Server process `RequestHeaders` directives and not just immediately look for the request in the cache.

### It doesn’t mix too well with `mod_rewrite`

Incredibly long story short: `mod_rewrite` *rewrites* variables and URLs. Even though it’s right there in the name, you don’t always see the effects of rewriting internal processing variables.

Let’s look at a super-easy but common example where every URL is handed off to `/index.php` who then gets to decide what content to serve for all URLs:

```apacheconf
RewriteRule ^(.*)$ /index.php [L,QSA]
```

The rewrite rule in effect rewrites the REQUEST\_URI variable for every request to `/index.php`; so every page is served the same cached page even though the dynamic script would have handled different URLs differently.

If you enable `mod_cache` at this stage, it would cause some visitors to get the correct page and some would get the wrong page depending on their luck.

You’ll find rewrites like the above in the default configuration for content management systems like WordPress. You can end up with similar problems in a lot of ways and it can be hard to detect the issue unless you’re aware of this problem. This is expected behavior from HTTP Server’s perspective, but not for server administrators.

You need to check each and every instance of mod\_cache and reevaluate whether you’ve to use a `RewriteRule` directive, and if can’t live without it then be absolutely sure it doesn’t modify any of the parameters that make up the cache lookup key. This includes every part of the request URL as well as any header and corresponding module listed in the Vary header.

### When the ‘cache is *unwilling*’ to cache

The `CacheDetailHeader` directive can help you verify and test that your cache is behaving the way you expect it to by including additional details from `mod_cache` about the request. This can be useful when it indicates client-initiated invalidation through control headers.

The cache detail header can also be infuriatingly vague:

cache miss: cache unwilling to store response

The ‘details’ are somewhat spares on why the cache didn’t want to store the response, and the HTTP Server documentation is no help here. This is a catch-all message for situations were a more specific error message isn’t written. You may see this message in any number of situations including conflicting or invalid cache control directives, chunked transfer encoding, or most likely you’re missing the `Content-Length` response header.

I mention this error specifically because I’ve wasted hours of my life trying to decipher exactly why — this time around — Apache was *unwilling* to do my bidding. The problems have always been trivial to fix; but difficult to identify as you’re giving very little information to work with. This perfectly summaries all my experiences with using `mod_cache`: the problems are difficult to identify but easy to fix once you know what the problem is.

For the record, I prefer [Varnish HTTP Cache](https://varnish-cache.org/?ref=ctrl.blog) over `mod_cache`. Varnish gives you better documentation and better performance than `mod_cache`. Like `mod_cache`, Varnish doesn’t handle header normalization automatically but it has fewer quirks and handles `stale-while-revalidate` perfectly out-of-the-box. If you’re not dead set on using `mod_cache`, I suggest you seriously consider using Varnish instead.

#### Sources

- [Caching Guide](https://httpd.apache.org/docs/2.4/caching.html?ref=ctrl.blog), version 2.4.33, 2018-03-17, HTTP Server Documentation, Apache Foundation
- [Apache mod\_cache module](https://httpd.apache.org/docs/2.4/mod/mod%5Fcache.html?ref=ctrl.blog), version 2.4.33, 2018-03-17, HTTP Server Documentation, Apache Foundation
- [Apache mod\_headers module](https://httpd.apache.org/docs/2.4/mod/mod%5Fheaders.html?ref=ctrl.blog), version 2.4.33, 2018-03-17, HTTP Server Documentation,
- [Apache mod\_rewrite Technical Details](https://httpd.apache.org/docs/2.4/rewrite/tech.html?ref=ctrl.blog), version 2.4.33, 2018-03-17, HTTP Server Documentation, Apache Foundation
- [mod\_cache.c](https://github.com/apache/httpd/blob/0d487913fcf433ac05526330f462a99d29dc9b25/modules/cache/mod%5Fcache.c?ref=ctrl.blog), commit 0d487913fc, 2017-02-21, HTTP Server project repository, Apache Foundation, GitHub
- [RFC 5861 HTTP Cache-Control Extensions for Stale Content](https://www.rfc-editor.org/rfc/rfc5861.html?ref=ctrl.blog), 2010-05, Mark Nottingham, Yahoo! Inc., Internet Engineering Task Force
### Actually secure DNS over TLS in Unbound
URL: https://www.ctrl.blog/entry/unbound-tls-forwarding/
Last updated: 2026-08-23T22:23:45.000Z
You’ll find quite a few blog posts and tutorials on how to configure encrypted DNS over TLS forwarding in Unbound. I’ve yet to find a single one that sets up TLS securely with certificate domain validation, however. Without TLS certificate domain validation your DNS can still be intercepted, monitored, or manipulated by a attacker-in-the-middle attacker with nothing more than a self-signed certificate. Here is how you set it up more securely.

I’ve already covered the use and configuration of a local and remote DNS caching service in my [Knot Resolver tutorial](https://www.ctrl.blog/entry/knot-dns-resolver-tutorial/). I’ll not go over those parts again, but I’ll focus exclusively on the required Unbound configuration and, of course, the necessary parts everyone else skips.

Here is a minimal example configuration for Unbound, `/etc/unbound/unbound.conf`, that uses both Quad9 and Cloudflare Resolver as the forwarding resolvers and validates their TLS certificates against the expected domain names for each service:

```yaml
# SPDX-License-Identifier: CC0-1.0

server:
  tls-cert-bundle: /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem

forward-zone:
  name: "."
  forward-tls-upstream: yes
  # Quad9
  forward-addr: 2620:fe::fe@853#dns.quad9.net
  forward-addr: 9.9.9.9@853#dns.quad9.net
  forward-addr: 2620:fe::9@853#dns.quad9.net
  forward-addr: 149.112.112.112@853#dns.quad9.net
  # Cloudflare DNS
  forward-addr: 2606:4700:4700::1111@853#cloudflare-dns.com
  forward-addr: 1.1.1.1@853#cloudflare-dns.com
  forward-addr: 2606:4700:4700::1001@853#cloudflare-dns.com
  forward-addr: 1.0.0.1@853#cloudflare-dns.com
```

The first thing you’ll notice is the inclusion of the `tls-cert-bundle` option that points to the local system’s root certificate authority bundle; including all the trusted root certificates of the operating system. This is needed to verify the validity of a certificate. You’ll get this bundle by installing the `ca-certificates` package in most Linux distributions.

The default location of the root certificate bundle is `/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem` on Fedora Linux, and `/etc/ssl/certs/ca-certificates.crt` on Debian/Ubuntu. Refer to the documentation of your distribution if you can’t locate their root certificate bundle.

If you haven’t setup the `tls-cert-bundle` option correctly, you may end up with certificate validation errors (below) and Unbound refusing to connect to the remove resolver:

notice: ssl handshake failed 9.9.9.9 port 853
error: ssl handshake failed crypto error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed

The domain names to validate the certificates against may appear as comments behind the `forward-addr` configuration lines at first glance. The syntax for `forward-addr` is IP address of the resolver an @ sign and then the resolver’s port number followed by a `#` sign and then the expected TLS domain name to validate the certificate the resolver will present.

It’s important that you get these domain names right or otherwise you’ll end up with the same error messages as shown above. Unfortunately, Unbound doesn’t produce different error messages when the certificate domain mismatch, is expired, or when the root certificate is missing or otherwise not trusted.

You should keep an eye on your logs and watch out for any certificate errors. It may be an indication that someone is trying to intercept, monitor, or modify your DNS requests. You can add an additional layer of protection against this by [enabling DNSSEC validation](https://nlnetlabs.nl/documentation/unbound/libunbound-tutorial-6/?ref=ctrl.blog).

I’ve added both IPv4 and IPv6 addresses in the above configuration example. Unbound will figure out which protocol is available and which is faster on its own. You can get better reliability from your DNS server by configuring more routes and more options to cover for outages or routing disruptions.

I also wrote about [randomizing DNS forwarding servers with Knot Resolver](https://www.ctrl.blog/entry/kresd-random-dns-forwarding/) a few weeks back. This ensures you’re not sending all your DNS traffic to one provider; making it more difficult for any one provider to build a complete profile on your online activities and behavior.

Unbound will do this by default with no additional configuration assuming each of your configured DNS forwarders respond within 400 milliseconds. Note that you’re not limited to just four DNS forwarders as you are with Knot Resolver. You can configure as many DNS forwarders as you want with Unbound and it will spread your forwarding requests out among each of them automatically.

#### Sources

- [unbound.conf man page](https://nlnetlabs.nl/documentation/unbound/unbound.conf/?ref=ctrl.blog), version 1.7.1, 2018-05-03, NLnet Labs, Unbound project
- [DNS over TLS](https://developers.cloudflare.com/1.1.1.1/encryption/dns-over-tls/?ref=ctrl.blog), 2018-04-04, Cloudflare Resolver, Developer Documentation, Cloudflare
- [Frequently Asked Questions](https://www.quad9.net/support/faq/?ref=ctrl.blog), 2018-02, Quad9
### Get the Apple News app for MacOS in unsupported regions
URL: https://www.ctrl.blog/entry/apple-news-macos-worldwide/
Last updated: 2026-08-23T22:01:53.000Z
MacOS 10.14 “Mojave” beta ships with the Apple News app installed by default. However, you may not be able to see the app if your Mac is configured with region settings other than Australia, United Kingdom, or United States. I’m no fan of region-restrictions, so I thought I’d show you how to get around Apple’s geographical restrictions on the News app.

As of MacOS 10.14 Beta (build 18A293u) the new Apple News app is only available in Australia, United Kingdom, and the United States. This matches the region availability on iOS. The app is pre-installed and available everywhere but will only display content targeted for the United States and not your local region. If you’re happy with this compromise, then read on to learn how to unlock the app.

The obvious solution is to open the Settings app and change your Language and Region: Region setting to either Australia, United Kingdom, or the United States. However, this may cause issues for other apps and especially formatting and localization.

### How-to open the Apple News app

Open the Terminal app, you can find it using Spotlight, type `open /System/Applications/News.app` into the terminal, and press Enter.

On MacOS 10, you can also open it from Safari. Open Safari, type `applenews:` in the address field, and press Enter. This method only works in supported regions in MacOS 11.

Once you’ve opened Apple News, you can simply pin it to your Dock, and you’ll have a quick and convenient method to open the app again later.

### Making the invisible News app visible

You can create an alias/shortcut to the News app to make it visible in your Applications folder, in Launchpad, and in Spotlight searches. An app shortcut to a region-restricted app will still be visible even outside the supported regions.

To create the app alias to make the News app visible, you’ll first need to open the Terminal app, type the following command, and then press Enter:

```shell
ln -s /Applications/News.app "/Applications/Apple News.app"
```

This won’t make the `News.app` visible, but you’ll get an alias for it called “`Apple News.app`” which will be visible in your searches and app launchers.

### Some notes for developer and publishes

It’s definitely the same News app we’re used to from iOS. At least, it’s bug-compatible in many ways with the iOS version of the app. It still registered a protocol handler for the ‘`feed:`’ URI protocol, but doesn’t support reading arbitrary syndication feed files.

At least in the first beta, and I suspect this will remain the same for the stable release, the News app doesn’t open non-Apple News formatted article (legacy RSS publishers) in a `WebView` inside the News app; but defers these to the system’s default web browser instead. As such, there’s no [unique User-Agent for the News app](https://www.ctrl.blog/entry/applenews-user-agent/) unlike its iOS counterpart.

Developers may be interested in the new `LSSupportedRegions` (array of country code strings) app property introduced with MacOS 10.14 beta. Finder will hide apps when the current user isn’t in a region included in the array of supported regions.

As indicated above, it’s not a strong regional lock but there can still be some interesting uses for it. Not to give anyone any ideas here, but malicious developers could use this new capability to hide their apps from regular users by setting the value of `LSSupportedRegions` to “Kronos” (the Kligon homeworld); thus effectively making the app invisible to all but the Terminal literate users.

You should not attempt to modify the News app to add your region to the list of supported regions. This will end in tears, or at the very least it will break the security code signature and make MacOS unhappy with you.

#### Sources

- `News.app` 4.0 (1572.10.5)
- MacOS 10.14 Beta (18A293u)
### The tiny NFC area on the Nokia 7 Plus
URL: https://www.ctrl.blog/entry/nokia-7plus-nfc/
Last updated: 2026-08-23T22:14:55.000Z
The Near-field communication (NFC) area on the [Nokia 7 Plus](https://www.hmd.com/en%5Fint/nokia-7-plus?sku=11B2NB21A08&ref=ctrl.blog) (TA-1046) isn’t located at the center back of the phone where you’d find it on most Android models. Instead, you’ll find it in a tiny area at the top right corner on the back. It’s also tiny compared to other NFC-capable smartphones.

The Nokia 7 Plus’ manual only mentions that the NFC contact area is at the back of the device, but doesn’t specify where. I’d decided to get an NFC security token to [lock down my online accounts](https://www.ctrl.blog/entry/firefox-u2f-google/) with a physical two-factor authentication device. I needed to make my Nokia 7 Plus phone talk to my Feitian ePass security key. I’d already set up the key and locked down my accounts and felt a little panic when my phone refused to communicate with the token and I was unable to login to my Google Account.

The instructions on screen clearly told me to place the NFC security key on the center back of the phone underneath the camera lens. This matched my experiences from the five previous NFC-capable phones and I’d no reason to question the instructions.

It took me a good half an hour to work out that the NFC on my new Nokia 7 Plus wasn’t somehow disabled in software or broken in hardware. It just had a poor reach compared to other devices and the contact area was located in a tiny spot to the right of the camera lens. You can see this area highlighted in the above feature photo.

I took a look at some of my older phones and expected to find that the NFC area was located at the center back. Because this is always where I’d used to place NFC tags and other phones to connect them.

However, I discovered that my LG Nexus 5X ([changing the launcher app](https://www.ctrl.blog/entry/google-now-launcher-memory/) did buy it a few more months of life but I ended up swapping it for the Nokia 7 Plus in April) had a much stronger signal in the opposite area of the Nokia 7 Plus on the left side of the camera.

I found out that I could also make a connection with the Nexus 5X by holding my security key up against the camera, 2 cm off the surface of the phone, or even dead center of the phone. I’d never noticed that the connection was better to the side of the camera as NFC had always just worked when I placed NFC devices near the center back of the device.

From looking at device teardowns of the Nokia 7 Plus, I’ve been able to confirm that it has an unusually small NFC antenna to the right of the left of the camera.

The Nexus 5 X has a larger NFC antenna that covers a wider area around the entire camera housing and a little way downwards towards the middle of the phone. The latter design seems to be quite common in other smartphone models as well.

I don’t know whether the Nokia 7 Plus’ NFC problems are caused by the smaller antenna design, a weaker NFC controller or transmission power, or something else entirely. I don’t have access to the equipment required to test this properly as it costs thousands of dollars.

What I can say for sure is that its NFC area is significantly smaller and its much more difficult to get it to read an NFC tag or key than the HTC One (2013), Sony Xperia Z3 (2014), LG Nexus 5X (2015), and the Samsung Galaxy S7 (2016) and S8 (2017).

I’m not the only one experiencing these problems with the Nokia 7 Plus. Some customers on the Nokia phone-community forum though that NFC wasn’t working at all as they’d trouble locating the NFC area.

I find it interesting that none of the hundred or so reviews I’ve found of the Nokia 7 Plus mention NFC other than in passing. It would seem none of the reviewers considered it wroth testing whether NFC capabilities worked any differently than on comparable devices.

On a more positive note and NFC issues aside, I love my Nokia 7 Plus! It’s pretty great, runs Android One (got access to the Android “P” beta on day one), and has high-end features and performance at a mid-range price. It’s a pretty good purchase as long as you don’t intend to work a lot with NFC tags.

#### Sources

- [Nokia 7 Plus User Guide](https://www.hmd.com/en%5Fint/support/api/pdf/nokia-7-plus-user-guide?locale=en&ref=ctrl.blog), 2018-06-02, Nokia, HMD Global Oy.
- [NFC not working](https://web.archive.org/web/20190504165439/https://community.phones.nokia.com/discussion/3500/nfc-not-working), 2018-05-18, Nokia phone community forums, Nokia, HMD Global Oy.
- [「爱·拆」Nokia 7 Plus首发拆解：重拾诺记感觉/做工出色](https://t.cj.sina.com.cn/articles/view/5446104688/m1449cf670001004lbj?ref=ctrl.blog), 2018-02-28, iVankrTech, Financial news, SINA Corporation
- [Nexus 5X Teardown](https://www.ifixit.com/Teardown/Nexus+5X+Teardown/51318?ref=ctrl.blog), 2015-10-22, Geoff Wacker, iFixit
### GDPR in Practice: Flattr now deletes your history within 3 months
URL: https://www.ctrl.blog/entry/flattr-gdpr/
Last updated: 2026-08-23T22:07:06.000Z
Since the launch of [Flattr 2.0](https://www.ctrl.blog/entry/flattr2/), the micro-payment service has collected parts of your web browser history through its browser extension to facilitate effortless payments your favorite creators and websites. Flattr updated their Privacy Policy mere hours before the General Data Protection Regulation (GDPR) went into effect and they now promise to delete your browsing history after a few months.

Flattr subscribers make a voluntary payment from 3 USD/month, install the company’s browser extension which collects their browsing history, and then Flattr divides their subscription fee out among the creators and websites they spent the most time on.

Just in time for the GDPR deadline, Flattr decided to start deleting the digital toxic waste piles of metadata that they’ve been collecting about each of their customers. The updated Privacy Policy for Flattr states that metadata will be deleted once it’s no longer useful to the service after 1–3 months.

Under their old Privacy Policy, Flattr could hold on to information about your web browser history up to six months after you’d deleted your account. The only way you could remove something from your browser history was to delete your Flattr account every month and then sign up for a new account under a new email address.

I emailed Judith Nink, Flattr’s Data Protection Officer, in early April 2018 and asked whether it was strictly necessary to require subscribers to delete and create new accounts every month to have their old browsing data deleted. I also asked for tools to allow subscribers to delete their own data when there’s no longer any value to them in letting Flattr retain the data. Flattr only needs to know what websites you visit for the duration of the current subscription period to deliver their service. Judith Nink responded with promises of reduced data retention duration once the GDPR went into effect in late May 2018.

Flattr’s updated Privacy Policy for the post-GDPR world now outline new policies and greatly improved practices for how long Flattr holds on to data about their subscribers. Your browsing history is now **either outright deleted or anonymized and disassociated from subscriber accounts within 1–3 months** without subscribers having to take any action.

The web addresses and webpage titles collected by Flattr can contain deeply personal data including sensitive data categories such as health, religion, and sexuality. Under Flattr’s old privacy policy, you couldn’t go back even a month in your history to delete a website you no longer wanted Flattr to store a record of you having visited.

Flattr may still retain aggregated data such as the total number of users who contributed to a domain within a certain time period for statistical and business purposes. This data isn’t associated or linked with user accounts, however. The new policy delivers better privacy for everyone and delivers on one of the GDPR’s core principles: privacy by design and default.

I’m happy to see Flattr decide to get rid of old browsing history data as there’s essentially no benefit to Flattr subscribers in Flattr holding on to this data. I’ve been somewhat hesitant to recommend Flattr in the past as I wasn’t too happy about them retaining people’s browsing history indefinitely. However, their updated privacy policy puts my reservations to rest. I’m far less skeptical of a system that records data, uses it, and then automatically deletes it within a short amount of time than any system that clings on to my data forever.

> “The controller shall implement appropriate technical and organisational measures for ensuring that, by default, only personal data which are necessary for each specific purpose of the processing are processed. That obligation applies to the amount of personal data collected, the extent of their processing, the period of their storage and their accessibility. \[…\]”

GDPR: Article 25 Data protection by design and by default: Paragraph 2

> “The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay \[when\] the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;”

GDPR: Article 17 Right to erasure: Paragraph 1: Point A

#### Sources

- [Privacy Policy for Flattr](https://web.archive.org/web/20180524230253/https://flattr.com/privacy), 2018-05-24, Flattr
- [Privacy Policy for Flattr](https://web.archive.org/web/20180517105253/https://flattr.com/privacy), 2018-05-17, Flattr
- [REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679&from=EN&ref=ctrl.blog), 2016-04-27, The Official Journal of the European Union, EU Parliament and EU Council
- [Personal data is as hot as nuclear waste](https://www.theguardian.com/technology/2008/jan/15/data.security?ref=ctrl.blog), 2008-01-15, Cory Doctorow, The Guardian
### I’d welcome usage reporting in Fedora Linux
URL: https://www.ctrl.blog/entry/fedora-popcon/
Last updated: 2026-08-23T22:06:13.000Z
Ubuntu have begun tracking more non-personalized and anonymous usage data to enable better data-driven decisions for the future development of the popular Linux distribution. As a Fedora Linux user myself, I want Fedora Linux to begin collecting the same type of data as I believe it would benefit Fedora Linux in the long term.

Debian derived Linux distributions — including Ubuntu — have had an optional tool called popularity-contest, or “popcon”, for years. Popcon collects data about the most frequently installed and used packages and programs from participating systems and sends them back to the distribution so they may known which software packages are the most frequently installed and used.

Participation in popcon has always been something people would have to opt-in to through the command-line which has skewed reporting towards more technical users. Ubuntu 18.04 will now asks everyone to participate in popcon when they login to their computer for the first time after installing Ubuntu. This will greatly improve popcon participation and increase the accuracy and usefulness of the dataset.

Ubuntu 18.04 has also begun collecting some generic hardware information such as the processor architecture, the amount of installed memory, the screen resolution, and a few other parameters.

Popcon allows distribution maintainers and the whole open-source community to get a sense of the popularity of different packages so that they may prioritize and focus their resources accordingly. The data can also be useful to end-users who can get software recommendations from other distribution users.

Debian and Ubuntu publishes aggregated usage data to the public on [popcon.debian.org](https://popcon.debian.org/?ref=ctrl.blog) and [popcon.ubuntu.com](https://popcon.ubuntu.com/?ref=ctrl.blog) respectively. Notably, Popcon only works for packages installed via the default Debian package system (`dpkg`/`apt`) and exclude programs installed via alternative package systems such as Flatpak, Snap, Python pip, and others.

**Update** (2020-07-15): Canonical has announced it will [remove popcon](https://www.omgubuntu.co.uk/2020/07/ubuntu-popularity-contest-removed?ref=ctrl.blog "“Ubuntu Will No Longer Track Which Packages Users Install”") from the default Ubuntu installation image. The system had fallen into disrepair and didn’t see much use.

Fedora Linux on the other hand doesn’t collect any data whatsoever and the project operates on gut feelings and intuition. Fedora Linux is my preferred Linux distribution and I think they’re doing a superb job without collecting any data whatsoever.

(Despite reports to the contrary, [internet connectivity testing](https://www.ctrl.blog/entry/network-connection-http-checks/) is only used to check if your network connection is working and not data collection.)

However, I believe that Fedora Linux could benefit from some limited data collection out-of-the-box such as the Fedora Linux version and edition, and which packages are installed and how often they’re used. Not only would this for the first time help establish how many computers are running Fedora Linux; but it would also help identify areas which Fedora Linux should work on improving.

Here are some examples off the top of my head for how some basic usage data collection would help answer important questions for the Fedora Linux project:

- Major version updates. Fedora Linux releases major versions two times per year. However, how long do people normally stay on one version before updating to the next?
- Security updates. How quickly are critical security updates installed? Is the Fedora Linux community for the most part patched and immunized within a few days? does it take weeks? or aren’t critical updates being installed at all?
- Broken packages. Rapid changes in the number of installs or time-since-last use in popular software can help identify updates that caused problems.
- Retention rate. Do people keep using Fedora Linux for a long time or do they stop after a week? Do people quickly abandon Cloud edition but stick with Server edition for years and years? Are people more likely to keep using Fedora Linux with Plasma desktop compared to GNOME desktop? Is the retention rate lower among people who use NVIDIA drivers/hardware than other graphic cards?
- Default software selection. Do people uninstall or not use software installed by default? Which alternative do they install and use instead?

Getting answers to the above questions could help guide Fedora Linux development and decisions to benefit the most number of users and enable more people to get a great user experience with Fedora Linux. I’m not advocating to *let the data do all the thinking* but I do believe it could be a useful factor to determine priorities in many areas.

I’d also expect to see an uptick in interest in Fedora Linux from upstream project once they can see that there are people using their software on Fedora Linux. Knowing that there are people using your product can work as a sort of ego-boost and help encourrage support, development, and testing on Fedora Linux.

Fedora Linux could either build on popcon, or better yet — develop a better alternative with a stronger guarantee of privacy to help alleviate the more paranoid among their user base. A very small number of software packages such as health related packages, virtual private networking (VPN) software, and the anonymizing Tor proxy network might be considered sensitive in some countries or contexts. These packages could be excluded to remove any fears about leaking potentially compromising or personal data.

Ubuntu will soon have a much better understanding about the overall software trends on Linux than other Linux distributions do. I believe Fedora Linux and other distributions also should begin collecting some limited and anonymous information to at least count the total number of users and what version of the distribution they’re using.

This type of data isn’t about associating data with people or creating an online profile about individuals or collecting personal data like Google Android and Windows 10 does. It’s about strengthening open-source by building a better understanding of what software is being installed and used. It also gives individuals an effortless way to contribute something back to their preferred Linux distribution.

#### Sources

- [More diagnostics data from desktop](https://lists.ubuntu.com/archives/ubuntu-devel/2018-February/040139.html?ref=ctrl.blog), 2018-02-14, Will Cooke, ubuntu-devel mailing list, Canonical
- [FAQ](https://salsa.debian.org/popularity-contest-team/popularity-contest/blob/7ac40f3d325bd3ae42ce4a15fb4d971a47722459/FAQ?ref=ctrl.blog), commit 7ac40f3d32, 2018-02-11, Debian Popularity-contest repository, Debian
- [README](https://salsa.debian.org/popularity-contest-team/popularity-contest/blob/7ac40f3d325bd3ae42ce4a15fb4d971a47722459/README?ref=ctrl.blog), commit 7ac40f3d32, 2018-02-11, Debian Popularity-contest repository, Debian
- [Infrastructure/Metrics](https://fedoraproject.org/w/index.php?title=Infrastructure/Metrics&oldid=432670&ref=ctrl.blog), revision 432670, 2016-01-20, Fedora Wiki, Fedora project
### What is Lenovo Wi-Fi Security and should you enable or ignore it?
URL: https://www.ctrl.blog/entry/lenovo-vantage-wifi-security/
Last updated: 2026-08-23T22:13:15.000Z
Lenovo laptop customers with the [Lenovo Vantage app](https://www.lenovo.com/us/en/solutions/software/vantage?ref=ctrl.blog) for Windows 10 (preinstalled by default) are being prompted to enable a new feature called *Lenovo Wi-Fi Security*. Lenovo claims the feature will help protect its customers against “malicious Wi-Fi networks”. But what does the feature do? and should you bother enabling it?

Lenovo Wi-Fi Security promises that it will, somehow, “help protect you from connecting to malicious Wi-Fi networks” and “reduce the risk of having your computer and data exposed to attackers”.

However, there are very few details available about how Lenovo Wi-Fi Security works and what it does once its enabled. It’s also hard to get any concrete details about the feature out of Lenovo or Coronet Cyber Security; an Israeli company that provides the infrastructure that powers Lenovo Wi-Fi Security.

Lenovo Wi-Fi Security appears to be a branded distribution of Coronet SecureConnect; a product of which there’s no specific information available on the web. Coronet hasn’t published much details about how any of their services work, but I’ve been able to dig up some hints here and there from historical product pages and news snippets.

### So, what does Lenovo Wi-Fi Security protect against?

It’s unclear exactly what capabilities Coronet SecureConnect has and which have been incorporated into Lenovo Wi-Fi Security as there’s no documentation available about either. I’ve collected some of the most specific statements I’ve been able to find regarding Coronet’s claimed capabilities:

> “Coronet can detect and evade unsafe wireless connections over both Wi-Fi and Cellular networks. It can also rate and keep record of popular network scores \[…\].”

> “Network-in-the-middle attacks (evil twin, PNL honeypots, compromised captive portals). Traffic interception, attempt to steal encryption keys and certificates.”

> “Coronet’s SecureCloud, the platform that offers end to end outside the perimeter security, confirms that it’s the first company to offer protection against KRACK.”

These statements are all made about Coronet SecureCloud product and not their SecureConnect product. I’ve asked Coronet and Lenovo multiple times to provide more specific details about Lenovo Wi-Fi Security, but I haven’t received a reply from either companies.

### Let’s put it to the test

I’ve set up a few different test networks that should seem suspicious, including one with WPAD/DHCP-PAC (proxy auto-configuration), a transparent proxy, and poisoned DNS responses. I even walked about Oslo city center and connected to more than 50 open Wi-Fi access points. All of these networks were cleared by Lenovo Wi-Fi Security as “compliant” with a green rating.

I only managed to trigger a warning from Lenovo Wi-Fi Security after connecting to a Wi-Fi access point that relayed all traffic through a Tor exit node in Russia using my [InvizBox](https://www.ctrl.blog/entry/review-invizbox/).

![Lenovo Wi-Fi Security notification](https://cdn.synaps.media/control/content/images/2026/08/lenovo-wifi-security-malicious-invizbox.png)

“Lenovo Wi-Fi Security has detected potentially malicious activity on InvizBoz network.”

At least one of the Wi-Fi access points I connected to is known not have been patched against the KRACK Attack vulnerabilities. I also doubt that all the networks and devices I connected to in the Oslo city center would have been patched and updated.

I’m frankly surprised more of my attempts weren’t detected as malicious. I thought a transparent proxy would trigger warnings for sure. It’s also notable that you only get one notification from the app informing you about a potential malicious network. You can’t get any more information about the potential risk than the rating (green, yellow, or red).

On one of my household’s three Lenovo laptops, Lenovo Wi-Fi Security will go into an infinite crash loop every minute or so when enabled.

### Privacy and location data

Part of the information that Lenovo Wi-Fi Security collects about wireless networks is the same information used to location-triangulate devices. You’re prompted to grant the Lenovo Vantage app access to your device’s location through the Windows.Devices.Geolocation service when you enable Lenovo Wi-Fi Security. Read [this article](https://www.ctrl.blog/entry/contribute-mls-wifi/) for an introduction to this broader topic.

Lenovo’s Product Privacy Statement doesn’t mention Lenovo Wi-Fi Security, Coronet Cyber Security, or the collection of location data. I contacted Lenovo’s dedicated privacy contact and got the following statement:

> “Coronet collects anonymized **information about the wifi access points in the surroundings of the user device** and communicates part of this information **to the servers of Coronet Cyber Security.** This information is used to generate aggregated knowledge about the wifi networks and is used to allow certain user protection capabilities provided by Coronet.”

Email correspondence, 2018-05-16, Lenovo Privacy Program

The following statement comes form Coronet Cyber Security’s own Privacy Policy. Importantly, this policy **does not apply to Lenovo Wi-Fi Security** as Lenovo customers are never presented with the policy and are never told about the service’s use of Coronet’s infrastructure.

> “\[Coronet\] also collect technical information transmitted by your device, including certain software and hardware information (e.g. your carrier, your operating system, your **approximate location**, etc.) and information regarding the **behavior and usage of networks around and by your device**  to provide you and the License Holder with analysis, in respect to potential threats. Such information may include specific **network configurations**, but will not include any information that was transmitted through the networks (e.g. SMS; online browsing; phone calls, etc.) ” “\[…\]”
> 
> “We will not share your e-mail address or any other personally identifiable information with online advertisers and advertising networks, without your explicit consent.”

[Privacy Policy, Coronet](https://web.archive.org/web/20180520011825/https://coro.net/privacy-policy/)

Marketing materials from Coronet shows the location of end-user devices plotted on a map, but this is probably related to Coronet’s other service offerings for enterprise customers. However, it does confirm and demonstrate their capabilities to track the location of customers. It’s worrying that Lenovo haven’t included more detailed information about their partnership with Coronet Cyber Security in their privacy policy, and that they don’t talk about or promote the service except for the notification prompts they send to Lenovo Vantage app users.

### Conclusions

I don’t know what to make out of Lenovo Wi-Fi Security. I can see the value proposition, but the service doesn’t seem to deliver on it. It doesn’t provide enough information to genuinely help people make good decisions about Wi-Fi network security. It also doesn’t block you from connecting to malicious or suspicious networks. I expected it to abort the connection and prompt me for a confirmation before establishing the connection. All you get is one easily missed notification.

I’m also surprised by the lack of transparency in how the service works and its implications on your privacy. Do you want to send your device location data to an Israeli company?

The short and long of it’s that **you should never connect to a public Wi-Fi access point.** Lenovo Wi-Fi Security can only leave you with the false sense of security and make you trust networks you shouldn’t use.

If you absolutely must connect to a public Wi-Fi access point, then the only thing that can offer you some level of protection is a [virtual private network (VPN) provider](https://www.ctrl.blog/tag/vpn/). Assuming, of course, that you can trust your VPN provider and you don’t end up putting them in a position where [your VPN can intercept your traffic more easily](https://www.ctrl.blog/entry/vpn-root-ca-trust/) than a compromised or malicious Wi-Fi network.

#### Sources

- [Coronet Enables Wi-Fi Security When It’s Needed Most](https://www.pr.com/press-release/747596?ref=ctrl.blog), 2018-03-13, Press Release, Coronet Cyber Security
- [Lenovo Product Privacy Statement](https://web.archive.org/web/20180520113123/https://www3.lenovo.com/us/en/privacy/), 2018-02-07, Lenovo
- [Privacy Policy](https://web.archive.org/web/20180520011825/https://coro.net/privacy-policy/), 2018, Coronet Cyber Security
- [SecureCloud Product](https://web.archive.org/web/20180516140020/https://coro.net/product-3/), 2018, Coronet Cyber Security
- [Coronet offers protection against KRACK](https://web.archive.org/web/20171029055819/https://coro.net/coronet-offers-protection-krack/), 2017-10-17, News, Coronet Cyber Security
- [For device manufacturers](https://web.archive.org/web/20170726175744/http://coro.net/for-device-manufactures/), 2017, Coronet Cyber Security
- [Hackers Can Bypass HTTPS Protection on Windows, Linux, and Mac](https://web.archive.org/web/20161110225356/http://coro.net/hackers-can-bypass-https-protection/), 2016-10-09, Dror Liwer, News, Coronet Cyber Security
### Reviewed options for backing up to Backblaze B2 with Window Backup
URL: https://www.ctrl.blog/entry/windows-backup-backblaze-b2/
Last updated: 2026-08-23T22:24:54.000Z
I’ve reviewed the different possible options for backing up your Windows 10 computer with Windows Backup (formerly known as File History) to the ultra-cheap backup storage provider Backblaze B2\. The software required to do this isn’t quite there yet, but you still have some options.

[Backblaze B2](https://www.backblaze.com/cloud-storage?ref=ctrl.blog) hosted network storage service is affordable for storing backups. At about 5 USD per month per TB, you can cut cost if you’ve multiple computers or a backup smaller than a Terabyte compared to [Backblaze Personal Backup](https://www.backblaze.com/cloud-backup/personal?ref=ctrl.blog) at 5 USD per month per computer.

You get an easy-to use software for MacOS and Windows with Personal Backup, but with B2 you’ve to bring your software and connect it to the B2 service. FreeBSD, Linux, and MacOS all have several great software options for using B2 for backup, but the selection on Windows isn’t as good.

Windows has a built-in backup system that provides file versioning so you can restore earlier versions (“previous versions”) of documents and files right from File Explorer. This tool was known as File History in earlier versions of Windows, but you can now find it in the Windows Settings app under the name Windows Backup.

### Mounting a B2 storage bucket in Windows

A prerequisite of using Windows Backup is to mount the destination, a Backblaze B2 storage bucket in this case, as either a network share or hard drive in Windows.

This proved surprisingly difficult to achieve in Windows. There are several good software options for Linux and MacOS, but the Windows options are more pricey.

The two available options for Windows are [ExpanDrive](https://www.expandrive.com/?ref=ctrl.blog) (80 USD) or [Mountain Duck](https://mountainduck.io/?ref=ctrl.blog) (40 USD with paid upgrades.) Both programs lets you mount Backblaze B2 among other hosted storage providers as local network shares in Windows.

Mountain Duck offers a free trial version, but that somehow expired more than six months before I installed the program and the program kept nagging me about the license.

Both programs use a taskbar icons with menus/guessing game as their primary interface with no clear path to progression. Neither program show any sign of ever having gone through any user experience testing and they were frustratingly unclear on their use. Frankly, neither of them are worth their asking price.

They both work, however! They’ll even optionally let you automatically mount the partition when you boot the computer. You can use them as-is to back up your computer with Windows Backup but without encrypting your backups.

Both will fail if your network take a long time to come online or if the network connection comes online, drops out, and then comes back online. I’ve also fully copied some test files onto a mounted Backblaze drive, rebooted the computer, and then discovered that **all or some of the files were missing.** I only spent a few days with each of these and I was seriously unimpressed with both programs.

There’s a third option and it’s the only free and open-source software for Windows in this category. I’ll get back to the third option after first addressing encryption solutions.

### Windows Backup encryption is an unsolved problem

Windows Backup itself has **no support for on-device encryption** of backups. As [discussed earlier](https://www.ctrl.blog/entry/how-to-file-history-network-storage/), you’ve to rely on Microsoft BitLocker for encryption. BitLocker is only available in Windows 10 Professional and not available on non-NTFS file systems. It also won’t work on network shares and can’t work with ExpanDrive or Mountain Duck.

If you’ve Windows 10 Professional, you can work-around the network share limitation by [creating a virtual hard drive](https://www.ctrl.blog/entry/how-to-file-history-network-storage/) and storing it on your B2 network share. If you don’t have Windows 10 Professional edition, you can use a third-party solution like [Cryptomator](https://cryptomator.org/?ref=ctrl.blog) instead. Cryptomator is a free and open-source utility that creates an encrypted virtual hard drive that can be used as a Windows Backup destination.

Mountain Duck has support for automatically detecting, unlocking, and mounting virtual drives stored on its network shares through Cryptomator. I never got this to work under Windows, and it was unreliable and failed to detect and mount the Cryptomator volumes more often than not when I tried it under MacOS.

Virtual hard drives stored on remote system and accessed over the internet — whether it be a Windows virtual hard drive with BitLocker or a Cryptomator drive — can be quite **unreliable and prune to data loss and corruption.** In the event of a network or local system disruption, your file I/O will have to go through two extra layers with higher than normal latency before its securely stored on the drive.

You can reduce the risks involved with this by storing the virtual hard drive on a secondary local disk rather than directly on a network share, and then copy or sync the local copy onto a network share or B2\. This more than doubles the storage requirements and costs on the local system, and as such isn’t a desirable solution.

Lastly, you can technically force enable Encrypting File System (EFS) — a file/directory-level encryption built-in to Windows — on a non-NTFS file systems or a network share. However, this is something that not even experts should attempt as its much more likely that your files will be irrecoverably encrypted with no way to decrypt them than that you get this setup correctly.

### OpenDedup to the rescue?

[OpenDedup](https://opendedup.org/odd/?ref=ctrl.blog) sounded promising and features data deduplication and encryption by default and it directly exposes B2 as a local hard drive. It requires some manual command-line configuration to set up, but will mount on boot and handle network disconnection and reconnection on its own. The documentation is good and it doesn’t take more than a couple of minutes to set up.

Unfortunately, it uses its own custom SDFS file system which is incompatible with Windows Backup. You can force Windows Backup to use it anyway, but you won’t be able to perform more than the one initial backup and Windows won’t be able to recover data from the backup either. It’s essentially useless for this use case, though OpenDedup shows promise for anyone who want to mount Backblaze B2 as a local drive on Windows for purposes than don’t rely so heavily on features of the NTFS file system.

In my experience, OpenDedup was unfortunately unreliable when it came to mounting drives even with perfect network conditions as I ran into several different software exceptions. I ended up having to reboot the system to mount some drives. I never lost any of my test data with OpenDedup, however, which is an overall improvement over the other options.

### Other solutions for backing up to B2

In July 2017, Microsoft accidentally pushed an update over Windows Update that marked Windows Backup/File History as deprecated and removed the option to create new backups using the tool. Microsoft have since said that this was a mistake but it also shows that Microsoft is considering deprecating Windows Backup to the extent that they’ve developed an update to Windows 10 that strips away the feature.

While Windows Backup is an interesting tool for backuping up your computer and it enables new use cases (such as restoring previous file versions), you don’t want to be using tools that the software vendor is considering to remove in the near future.

I backup my Linux and MacOS computers to Backblaze B2 using [Restic](https://restic.net/?ref=ctrl.blog). It’s an open-source console based application with data deduplication, encryption, versioning, and an overall impressive feature set that I’ll likely cover in more details in a future article.

Restic is also available for Windows but it’s missing a key feature that makes data recovery more difficult than on Linux and MacOS. Under the other two operating systems, you can mount your B2 backup and explore your files and previous versions of files and browse it in your file explorer. As has been a recurring topic in this article, this feature seems to be difficult to deliver on Windows.

Another alternative for Windows that has kept popping up on my radar over the years is [Arq](https://www.arqbackup.com/?ref=ctrl.blog) (80 USD, for one user on MacOS and Windows.) It’s a graphical tool that handles file versioning and on-device encryption and integrates with many different hosted network storage providers. You can even configure it to back up to multiple hosted network providers including low-cost options like Backblaze B2 and Amazon AWS glacier. It’s easy to set up, but don’t expect to get much use out of the file versioning function as the software is clunky in use. The encrypted data blobs it creates out of your backup is well documented, and Arq even provides an open-source tool for decrypting your backups on other operating systems.

I’ve never ended up using Arq mostly because I want to use the same backup tool on all operating systems — and Arq doesn’t support Linux. If Arq added support for Linux today, I’d probably be among the first to buy a license and swap out my existing desktop backup solutions for Arq.

If you only use MacOS and Windows, then I believe Arq to be one of the strongest contenders in this space. It’s a much better option for MacOS and Windows than [SpiderOak ONE](https://www.ctrl.blog/entry/review-spideroak/)

### Conclusions

Third-party software that integrates with hosted network storage providers is too expensive (plus requiring paid upgrades) and is too difficult to use on Windows. OpenDedup — as the only free and open-source option available for Windows — shows promise for general-purpose access to hosted network storage providers even though it can’t be used for Windows Backup. OpenDup requires more stability work and a human-friendly user interface.

Backup encryption with Windows Backup is a big challenge unless you’ve a Windows 10 Professional license and are backing up to a local storage medium where you can enable BitLocker.

Don’t hold your breath for Microsoft adding encryption support to Windows Backup either, and you’ll probably want to find another alternative to Windows Backup anyway. Microsoft seems to be on the verge of deprecating it entirely.

Arq is a solid alternative for MacOS and Windows users, while you may look into Restic for your Linux desktop and server needs.

#### Sources

- [Backblaze B2 Enabled](https://opendedup.org/odd/2018/04/04/backblaze-b2-enabled/?ref=ctrl.blog), 2018-04-04, Sam Silverberg, OpenDedup
- [Restoring from backup](https://restic.readthedocs.io/en/v0.8.3/050%5Frestore.html?ref=ctrl.blog), version 0.8.3, 2018-02-26, Restic Documentation, Read The Docs
- [Mountain Duck 2](https://blog.cyberduck.io/2017/09/07/mountain-duck-2/?ref=ctrl.blog), 2017-09-07, David Kocher, Cyberduck blog, iterate GmbH
- [Arq Backs Up To B2!](https://www.arqbackup.com/blog/arq-backs-up-to-b2/?ref=ctrl.blog), 2017-07-27, Stefan Reitshamer, Arq blog, Haystack Software
- [ExpanDrive 6](https://www.expandrive.com/expandrive-6-the-fastest-most-powerful-expandrive-ever?ref=ctrl.blog), 2017-07-05, ExpanDrive blog, ExpanDrive
- [Thinking About Windows 10 File History](https://www.thurrott.com/windows/windows-10/117541/thinking-windows-10-file-history?ref=ctrl.blog), 2017-06-04, Paul Thurrott, Thurrott
- [A note about the unintentional release of builds today](https://blogs.windows.com/windows-insider/2017/06/01/note-unintentional-release-builds-today/?ref=ctrl.blog), 2017-06-01, Dona Sarkar, Windows Experience Blog, Microsoft
- [arq\_restore](https://arqbackup.github.io/arq%5Frestore/?ref=ctrl.blog), 2017, Haystack Software, GitHub
- [Backing Up to Multiple Destinations](https://www.arqbackup.com/docs/arqbackup/pages/multiple%5Fdestinations.html?ref=ctrl.blog), Arq Help, Haystack Software
### Re-review of the Lenovo Yoga 3 Pro laptop/​tablet hybrid 3 years later
URL: https://www.ctrl.blog/entry/rereview-lenovo-yoga3-pro/
Last updated: 2026-08-23T22:17:01.000Z
I wrote a well-received [review of my *Lenovo Yoga 3 Pro 1370*](https://www.ctrl.blog/entry/review-lenovo-yoga3-pro/) laptop/tablet hybrid back in 2015. Here is something you don’t see very often on the web: a follow-up review three years later of normal wear and tear.

The years haven’t been kind to my late 2015 model Yoga 3 Pro (1370.) I’ll like to start by quickly looking back on a few of the things that I mentioned had bothered me in m 2015 review:

- I never got used to the inconvenient power button placement, and have kept up with turning off the device by accident at least once every three hours. Seriously. It’s located on the side of the laptop in a way that whenever you pick it up, you press it and power cycle the machine.
- The unresponsive Home button eventually stopped working altogether. After the introduction of new touch-screen gestures for the Home button in Windows 8.1 this wasn’t a problem.
- I got used to the unusual keyboard layout, except for the weird position of the pipe key.
- I complained that the device was under-powered considering the at-the-time premium price. This only got worse with time as thermal throttling kept scaling back processing power. I’ll get back to this in more detail.

![Lenovo Yoga 3 Pro (1370) in tablet mode](https://cdn.synaps.media/control/content/images/2026/08/lenovo-yoga-3-pro-1370-yr3-tablet-mode.jpeg)

### Dead battery

The Yoga 3 Pro is the first lithium-ion battery powered device I’ve ever had the battery die entirely on me. For comparison, my six year old Lenovo ThinkPad Carbon X1 (first-generation) still has 88,2 % of its designed battery capacity and my four year old MacBook Pro still rocks 96,8 % of designed battery capacity. The three-year old Yoga 3 Pro on the other hand only has **1,7 % battery capacity remaining.** To be fair, it had 42 % remaining when I first began drafting this follow-up review a few weeks ago — but the battery died entirely while I was still working on the review. The battery only lasted 120 charge cycles, which is pretty pathetic for a modern battery.

I’ve used the device in battery conservation mode using the now deprecated [Lenovo OneKey Optimizer](https://www.ctrl.blog/entry/review-lenovo-onekey-optimizer/) software for maybe 80 % of the time I’ve had the device. This mode applies charging and power management policies to extend the lifetime of the battery by following acknowledged best practices for maintaining good battery chemistry.

I don’t know exactly what killed the battery. It could have been a faulty unit, it could have been that Lenovo used a lower quality battery vendor for this laptop. However, my working theory is that the poor ventilation and poor thermal design may be to blame as high temperatures is know to significantly reduce the lifespan of a lithium-ion battery. There’s a single small fan and an exhaust vent and almost no space for air to flow through the main body of the laptop. The keyboard could get uncomfortably hot to type on and the chassis would be too hot to hold with just a web browser with ten or so *empty tabs in a web browser with no pages loaded.* Thermal throttling kept throttling the processor to compensate for the heat, making the laptop barely usable in the process.

![Fan and battery inside the Lenovo Yoga 3 Pro 1370](https://cdn.synaps.media/control/content/images/2026/08/lenovo-yoga-3-pro-1370-yr3-innards.jpeg)

My [regular felt pad trick for cooling](https://www.ctrl.blog/entry/how-to-laptop-air-cooling-pads/) don’t work with a hybrid laptop/tablet as you’re supposed to be able to flip the laptop screen onto the back of the laptop.

Interestingly, Lenovo Vantage — the software replacement for OneKey Optimizer — reports the battery health as 1,7 % of design capacity but still also says the battery status as “Good”. I wonder how badly a battery must perform for Lenovo Vantage to change away from the Good battery status indication.

Lenovo doesn’t sell replacement batteries for the Yoga 3 Pro (or any other discontinued device for that matter.) Third-party resellers only offer refurbished original batteries or third-party knock-offs, both priced at around 200 USD. It’s frankly not worth replacing the battery at that price point. I can still use the device as long as its plugged into and always charging.

### Failing hardware

I was somewhat skeptical in regards to the durability of the at-the-time unique screen hinge design that enables the screen to be folded back all the way onto the back of the laptop. However, the hinge hasn’t even got a scratch.

The keyboard is another matter entirely and its quite frustrating to use. Keys get stuck and different keys now require different levels of force to register key presses reliably. For example, I have to jam the E, S, and M keys while the R and N require gentler taps or else they won’t register properly. I’m typing out this review on a MacBook Pro not only because I dislike the unusual keyboard layout of the Yoga 3 Pro or am unhappy with the [limited keyboard layout in Windows](https://www.ctrl.blog/entry/windows-keyboard-layout-inadequacies/) but mostly because the physical keyboard is challenging to type on.

The touchpad and touch screens are much the same story as the keyboard. Both register accidental double and triple clicks/taps when I only click/tap once. The gestures for left-clicking on the touchscreen or lower-right corner of the touchpad are both equally hard to get just right. I’m far more likely to accidentally left-clicking when I intend to right-click than to get left-clicking to work when I intend to.

I’ve disassembled the keyboard and touchpad for cleaning, but it isn’t a matter of stuck bits of dust and debris in the cracks of the keyboard and touchpad. They’re just exceeded their design specs and they’re worn out from use.

### Drivers and feature deprecation

I’ve mentioned that the OneKey Optimizer software was deprecated. Lenovo has also either deprecated or not updated firmware and drivers for some components after the upgrade from Windows 8 to Windows 10\. E.g the Yoga 3 Pro has a reading/paper mode that’s supposed to reduce blue light and yellow/red tint the display at a press of a button. However, this button is now entirely useless as there are no drivers or software for it anymore. The key doesn’t even register a keypress event, so I can’t re-purpose it for something like triggering Night Light mode in Windows 10, or triggering my web browsers’ Reading Mode feature, or even opening a text editor.

Lenovo did make available a security update to the Trusted Platform Module (TPM) in the Yoga 3 Pro in December 2017, however the Lenovo firmware update app [didn’t notify me about the update](https://www.ctrl.blog/entry/lenovo-companion-tpm-updates/) even when I went in and checked for updates manually.

The drivers for the Broadcom BCM94352Z Wi-Fi module also haven’t been updated for Windows 10, causing even more dropped connections and instability than I’d with the drivers under Windows 8\. (This could also be down to the poor thermal design of the laptop, as Wi-Fi modules can lock-up and crash at high temperatures.) Luckily, I’d already [replaced it with an Intel Wi-Fi module](https://www.ctrl.blog/entry/replace-broadcom-wifi-with-intel/) already so this problem hasn’t affected me. It’s still annoying that Lenovo didn’t just pick a sub-standard Wi-Fi module for the device, but they also didn’t maintain it with new drivers.

The after-market driver updates and maintenance should have lasted longer than they did. I don’t feel like Lenovo have done an adequate job with maintaining the features and components they built into the Yoga 3 Pro.

### Conclusion

I’ll be the first to admit it: the Lenovo Yoga 3 Pro was a poor purchase decision. I wanted a high-resolution touch screen display, and the laptop/tablet hybrid functionality appealed to the futurist in me. However, the Yoga 3 Pro had higher performance demands and yet a weaker performance profile than the my two-year-old-at-the-time first-generation Lenovo ThinkPad Carbon X1 which it replaced.

Despite not being neither a laptop nor a tablet anymore — a working battery would be required for that — I still have some use for it. I intended for this laptop to be my main device, but it never lived up to my requirements to become my daily driver. It [ran Linux just fine](https://www.ctrl.blog/entry/how-to-lenovo-yoga3-pro-linux/) (once I replaced the Wi-Fi module), but the performance throttling meant it wasn’t ever suited for more than use as a couch laptop. I use it for an hour or so to play with Windows Insider, a test program for new upcoming versions of Microsoft Windows.

My partner recently bought a [fifth-generation Lenovo ThinkPad Carbon X1](https://www.ctrl.blog/entry/linux-on-lenovo-thinkpad-5genx1/) as a replacement for a first-generation of the same device. Both the older and newer generation Carbon X1s were without a doubt better purchases than the Yoga 3 Pro (despite the lack of high-resolution displays or touchscreens.)

**Reviewed:** Yoga 3 Pro (1370)

**Review rating:** 2 / 10
### PCMag’s VPN review-ratings compared to sales commissions
URL: https://www.ctrl.blog/entry/pcmag-vpn-review/
Last updated: 2026-08-23T22:15:20.000Z
PCMag have produced a series of “review-style” pages featuring a selection of Virtual Private Network (VPN) service providers. Prominently featured at the top of these pages is a comparison table with links to each of the different VPNs.

PCMag fails to disclose that they earn a sales commission if you listen to their recommendations and click through to any of the VPNs included in their article. To shine some light on this, I’ve made my own comparison table highlighting how much PCMag stands to gain if you let yourself be influenced by this undisclosed advertisement.

I’m specifically looking at the PCMag article titled “The Best VPN Services of 2018” as its published on PCMag’s website in the United States, United Kingdom, Australia, and India. Note that PCMag also publishes several variants of similar articles with slightly different titles and themes.

The article itself is in my opinion not intended for human consumption; but is included on the page for the benefit of search engine robots. Page snapshots from the Wayback Machine show that PCMag keeps moving the publication date of the article forward so it never appears more than a few days old.

The layout of the page makes it appear as the main body text of the article is a separate article. The text is also so dull that few — if any — humans would be bothered to read it. The body text only tells you generic facts and statements about any generic commercial VPN service and doesn’t talk about the specific services that are being reviewed. It’s filler text.

At the top of the page you’ll see a comparison table (screengrab above) that’s intended for human consumption. The table is neat and orderly and it includes some key facts and rankings for a few popular VPN service providers. The price column contains a row of big red buttons labeled “See It” but no actual price information. I’ll get back to these buttons later in this article. Readers have to click through to make their own price comparisons.

Here are the ratings from PCMag’s “The Best VPN Services of 2018” comparison chart paired with the prices that are missing from PCMag’s version of the chart. The prices are for each VPN provider’s lowest-cost-per-month product. I’ve also included the sales commission PCMag earn from each of the VPN providers.

| PCMag’s ratings | VPN prices and sales commissions |       |          |        |               |           |            |
| --------------- | -------------------------------- | ----- | -------- | ------ | ------------- | --------- | ---------- |
| Service         | Editor’s Choice                  | Stars | Product  | Price  | Revenue share | Recurring | Commission |
| NordVPN         | Yes                              | 5     | 2 years  | 79,00  | 30 %          | Yes       | 31,60      |
| P.I.A.          | Yes                              | 4,5   | 2 years  | 69,95  | 33 %          | Yes       | 23,60      |
| PureVPN         | Yes                              | 4     | 3 years  | 69,00  | 35 %          | Yes       | 27,20      |
| IPVanish        | No                               | 4     | 1 year   | 77,99  | 35 %          | Yes       | 27,30      |
| KeepSolid       | Yes                              | 4     | lifetime | 149,00 | fixed         | No        | 75,00      |
| TunnelBear      | No                               | 4     | 1 year   | 59,88  | fixed         | No        | 30,00      |
| GoldenFrog      | No                               | 3,5   | 1 year   | 80,00  | ?             | ?         | ?          |
| TorGuard        | No                               | 3,5   | 1 year   | 59,99  | 30 %          | Yes       | 18,00      |
| HotSpot Shield  | No                               | 3,5   | lifetime | 119,99 | 30 %          | No        | 59,94      |
| Hide My Ass     | No                               | 3,5   | 1 year   | 95,88  | 40 %          | No        | 38,35      |

__Total revenue per new referred customer over time__
| Service        | 1st year    | 2nd year | 3rd year | 4th year | 5th year | 6th year | 7th year |
| -------------- | ----------- | -------- | -------- | -------- | -------- | -------- | -------- |
| NordVPN        | 31,60       | 63,20    | 94,80    | 126,40   |          |          |          |
| P.I.A.         | 23,60       | 47,20    | 70,80    | 94,40    |          |          |          |
| PureVPN        | 27,20       | 54,40    | 81,60    |          |          |          |          |
| IPVanish       | 27,30       | 54,60    | 81,90    | 109,20   | 136,50   | 168,30   | 191,11   |
| KeepSolid      | 75,00       |          |          |          |          |          |          |
| TunnelBear     | 30,00       |          |          |          |          |          |          |
| GoldenFrog     | Unavailable |          |          |          |          |          |          |
| TorGuard       | 18,00       | 36,00    | 54,00    | 72,00    | 90,00    | 108,00   | 126,00   |
| HotSpot Shield | 59,94       |          |          |          |          |          |          |
| Hide My Ass    | 38,35       |          |          |          |          |          |          |

PCMag may have more favorable revenue share agreements with the different VPN providers than the data quoted above. The above rates are taken either from the public websites for the affiliate programs run by each of these providers or comes via one of their customer support representatives.

All but one of the Editor’s Choice awards went to VPNs with recurring revenue shares. These programs can provide a revenue stream for as many years as the subscriber renews their subscription. The only Editor’s Choice award that didn’t go to a VPN with a recurring revenue share went to the VPN with the highest sales commission for a one-year subscription. The top four ranked VPNs all have recurring revenue shares, and only TorGuard were given a low rating out of the VPNs who offered a recurring revenue share.

What isn’t apparent from looking at the table or even reading the article is that these VPN services all pay PCMag to be included in the article. PCMag earn a sales commission for every new customer they refer to any of the VPN services that have been included in the comparison table. The big red buttons are partner/affiliate links that track purchases and credit PCMag for the sales. However, the buttons use link cloaking techniques and appear to link to a page on PCMag’s website. It’s not apparent that it’ll redirect you to the website of the VPN provider until you click on it.

PCMag Australia, India, and United Kingdom don’t include any disclosures anywhere on the page about these affiliate links. PCMag in the United States do have a generic disclaimer pushed far down on the page next to the main article, but underneath another banner advertisement; safely tucked away where its unlikely to ever be seen. The disclaimer refers to “buying links”, but I doubt very much that anyone would associate “See it” with “buying links.” There’s no information in a more visible place such as below the headline or the beginning of the article. I find even the small disclaimer in the U.S. version of the article inadequate to inform the reader about the primary commercial nature of the article.

Notably, when I try to visit the United States version of this PCMag article from here in Norway, I’m immediately redirected to the United Kingdom version of the article that doesn’t have even the small disclosure message. Ironically, I’ve to use a VPN and tunnel over to the United States to see the affiliate disclosure message.

#### Sources

- [The Best VPN Services of 2018](https://web.archive.org/web/%2A/https://www.pcmag.com/article2/0,2817,2403388,00.asp) (snapshot calendar view), 2018-05-05, Wayback Machine, Internet Archive
- [The Best VPN Services of 2018](https://web.archive.org/web/20180424023910/https://www.pcmag.com/article2/0,2817,2403388,00.asp), 2018-04-23, Max Eddy, PCMag
- VPN sales prices and affiliate commissions were retrieved from either the official websites or customer support on 2018-04-23. GoldenFrog didn’t want to reveal details about their revenue share with affiliates.

This website is registered as an affiliate with some of the companies that were mentioned in this article. None of them have been linked or favored in this article.
### Feed readers can be uniquely fingerprinted
URL: https://www.ctrl.blog/entry/feed-reader-fingerprint/
Last updated: 2026-08-23T22:06:29.000Z
Your unique feed subscription list can be used to deanoymize feed reader client users.

I’ve been thinking of how to more accurately count syndication feed (“RSS”) subscribers now that everyone has devices that roam across several networks every day, and every home are assigned 18 quintillion IPv6 addresses and devices periodically change their IP address. Historically, you’d just count up the number of unique IP address/User-Agent pairs at the end of the day and be done with it.

While pondering this question, I started wondering about how feed analytics services like [FeedPress](https://feedpress.com/?ref=ctrl.blog) and the old Google FeedBurner service kept their subscriber counts accurate. I’ve more or less concluded that they simply can’t ever have had super-accurate counts and that they’re probably just doing the best they can.

However, I did realized that there’s a way to uniquely fingerprint most feed reader users across networks/IP addresses with a varying degree of accuracy depending on how many feeds the client is updating. Assuming that you’re a large scale internet infrastructure service or feed server that handles many feed requests — such as Cloudflare, Google Blogger, Medium, Squarespace, WordPress.com — all of which do serve many feeds.

Everyone’s feed subscription list is as different as people’s personal preferences and interests are different. There will be some overlap but assuming you follow more than a dozen feeds; your *subscription list* will probably be unique. What is more, the *order of your subscription list* is even more unique. Some feed reader clients will sort feeds alphabetically, but as far as I can tell — most sort either by a custom user order or the order the user added a subscription.

Feed readers normally update feeds from first to last in an ordered list. In other words, the subscription list and order can be used as a unique fingerprint that could be used to uniquely identify the user and deanoymize you between different networks.

This is only possible when the user is subscribed to multiple feeds hosted by the same feed publisher (Blogger, Medium, WordPress.com), feed processor (FeedPress, Google FeedBurner), or a large internet infrastructure provider (Amazon AWS, Cloudflare.)

A feed reader client silently updating the users’ subscriptions in the background could lead to deanonymize of the user across networks. An internet user’s feed subscription list is *a good source of personal information* as people are more likely to be subscribed to publishers, categories, and topics they’re deeply interested in. This could include personal data such as health conditions and sexual preferences as well as interest and demographics.

Feed readers can mitigate this to some degree by distributing feed subscription updates on multiple network connections (when available), or by randomizing the scheduled list of subscription updates.

I’m not suggesting that any of this is happening. It’s a theoretical vector for deanonymization that’s only possible because of the web’s growing centralization. A more practical method to fingerprint users like this would involve no more than relying on HTTP cache revalidation super cookies (ETags); which is supported by most feed readers. Heck, some feed reader clients even support persistent cookies.

There isn’t anything everyday internet citizens can do to prevent this type of fingerprinting. You could technically try to avoid all software — not only feed reader clients — with a discernible unique usage profile.

Technology on its own can’t practically be used to prevent large scale tracking and profiling. If our society is going to continue valuing privacy, then there has to be laws to govern and protect it too. New privacy laws like the General Data Protection Regulation (GDPR) is needed to limit the type of deanonymization and profiling as described in this article. I’m personally in favor of stronger privacy regulations instead of letting every internet user fend for themselves. The ever growing complexities and capabilities of web technology makes it unfeasible that anyone should be expected to protect their own privacy against actors that can and will go to any lengths to gather just a little more data about you.

#### Sources

- [Evercookie](https://samy.pl/evercookie/?ref=ctrl.blog), 2010-09-20, Samy Kamkar
### New AdSense APIs for gathering user-consent
URL: https://www.ctrl.blog/entry/adsense-gdpr-consent/
Last updated: 2026-08-23T22:01:04.000Z
Google has published some developer documentation on how AdSense publishers can opt for non-personalized ads and comply with European consent laws. The General Data Protection Regulation (GDPR) is just around the corner, so I thought I’d have a look at what Google is providing to publishers.

Google AdSense will require that publishers update their ad serving implementation to be compatible with Europe’s new (and existing) privacy laws. Google will let publishers take AdSense back to its roots and only display contextually targeted advertising based on a page/site’s content rather than visitors’ online behavior.

Publishers also have new tools to prompt their visitors for consent to online profiling so they can continue to rely on personalized ads. However, publishers will be pressed to find a compelling reason to convince their visitors to opt-in to personalized ads and I fully expect that many will opt for contextual-only advertisements instead.

To even have a discussion on this topic I need to get something out of the way first:

I’m not a lawyer and this isn’t legal advice. This article is intended for entertainment purposes. Code samples are **not approved by Google and are for illustrative purposes only.** Everything in this article is based on my interpretation of the relevant European Union directives and regulations, and Google policies. Everything in this article may be partially or completely wrong.

The AdSense APIs referenced in this article don’t go live until 25th May 2018. Google is giving publishers a window of 0 seconds to update their ad serving implementations before the GDPR comes into effect on the same day. Google also warns publishers against deploying these APIs before that date.

### Quick introduction to the European consent requirements

> “GDPR is probably annoying to implement for engineers, but for consumers of Internet services in the EU it’s the best thing ever.”

[Christoph Nakazawa, Twitter](https://web.archive.org/web/20180507224120/https://twitter.com/cpojer/status/986289872334917633)

Tracking of peoples’ behavior and activities online have been the default way advertising on the web works. The General Data Protection Regulation changes the web’s default of “everything is allowed and maybe give people an opt-out” to “people have rights and companies and websites are required to respect them.” Clear information and opt-ins are the new mode of operation under the GDPR.

AdSense’s new Application Programming Interfaces (API) aren’t just about being compliant with the GDPR. Some are also catching up with the 2011 European ePrivacy Directive, better known as the “cookie law”. Notably, an EU directive isn’t EU-wide law unlike a regulation. The adoption of the ePrivacy directive varies quite a bit from country to country. Some countries considers “browser settings” such as the settings for cookies sufficient, while other requite more explicit consent prompts, and others still allow for cookies-by-default but that publishers inform and provide an opt-out method.

AdSense requires the use of cookies for “frequency capping, aggregated ad reporting, and to combat fraud and abuse” even for their new non-personalized ads. **Publishers** may be required to *not let AdSense set any cookies* before they’ve obtained consent to do so.

“Super-cookies” or “evercookies”, alternative ways of storing information that bypass the browsers’ normal local storage settings may be tempting workarounds but still doesn’t comply with the law.

The upcoming ePrivacy Regulation (as a Europe-wide regulation and not a directive) will simplify things considerably. The current draft regulation indicate it will get away with the cookie consent banners and rely on browser privacy settings and detailed privacy policies instead. However, for the time being the old directive is still in effect yet websites can improve the user experience by listening to web browser settings today.

Likewise, the publisher is required to obtain consent before allowing AdSense to store and personalize advertisement based on a visitor’s online activities.

### Pausing ad-requests until cookie consent have been given

Google AdSense has provided a new `pauseAdRequests` API method that can be used to load AdSense resources but not load any ads or set any cookies. Setting this to 1 or true pauses ad loading, and 0 or false resumes ad loading.

The following code example demonstrates its use by pausing ads unless a specific consent cookie has been set in the browser:

```javascript
var google_ads_cookie_lacking_consent =
    (!document.cookie.indexOf('google_ads_cookie_consent=1') >= 0);

(adsbygoogle=window.adsbygoogle||[]).pauseAdRequests =
  google_ads_cookie_lacking_consent;
```

The above code must be executed before any ad requests are sent to AdSense (before `window.adsbygoogle.push()` to take effect.

Publishers then need to inform their visitors about the website’s use of cookies and ask for permission to set cookies. Once permission has been granted, the publisher can store that consent in a cookie and resume ad loading:

```javascript
document.cookie='google_ads_cookie_consent=1; max-age=47304000'; // 18 months
(adsbygoogle=window.adsbygoogle||[]).pauseAdRequests=0;
```

Note that ads won’t display until you get consent and resume the ad request.

### Opting out of personalized ads

You separately have to obtain consent for the use of tracking and personalized/behavioral ads. This can be tricky to implement as you’ve to inform visitors in great detail about which of Google’s many ad partners you may or may not share data with. You can look into your AdSense revenue reports and assess the impact of outright disabling personalized ads on your website. It may be easiest just to disable them altogether for all users.

Google AdSense has provided a new `requestNonPersonalizedAds` API method that can request non-personalized ads instead of personalized ads (the default). Setting this to 1 or true requests non-personalized ads and setting it to 0 or false (the default) requests personalized ads.

It’s up to publishers to explicitly request non-personalized ads! Publishers can opt-out of personalized ads quite easily:

```javascript
(adsbygoogle=window.adsbygoogle||[]).requestNonPersonalizedAds = 1;
```

The above code must be executed before any ad requests are sent to AdSense (before `window.adsbygoogle.push()` to take effect.

### Handling consent permission for personalized ads

If I haven’t been able to persuade you to abandon personalized ads and you wish to take on additional risk and work with personalized ads, then we’ve reached the section you’ll be the most interested in.

> “One of the best things about the GDPR is now every time a stakeholder at works asks me to do something I don’t feel like doing, I can go ‘um, I’m not sure if it’s GDPR compliant, do you know?’ and they’ll give up and die before figuring it out.”

[Zoe Stavri, Twitter](https://web.archive.org/web/20180507224123/https://twitter.com/stavvers/status/987340474989142018)

We’ll use the same method as for opting out, but introduce some consent cookie and browser settings checks instead of just banning personalized ads outright. The following example looks for a consent cookie and also checks the Tracking Preference API, a web standard for opting-out of tracking, to make sure the user isn’t signaling that they don’t consent to tracking using another browser preference.

```javascript
var google_ads_personalized_consent =
  (document.cookie.indexOf('google_ads_personalized_consent=1') >= 0 &&
  (navigator.doNotTrack != 'unspecified' && navigator.doNotTrack != '1'));

(adsbygoogle=window.adsbygoogle||[]).requestNonPersonalizedAds =
  !google_ads_personalized_consent;
```

The above code must be executed before any ad requests are sent to AdSense (before `window.adsbygoogle.push()` to take effect.

Take special note of the Do Not Track (DNT) implementation as the 2017-01 draft of the ePrivacy Regulation doesn’t specify *which browser setting* the user must use other than it being in the general privacy settings in their web browser. A standardized setting that’s specifically designed to let users signal that they don’t consent to tracking must be respected under the ePrivacy Regulation.

Note that you should also not prompt users who send the DNT signal. Not only are they more unlikely to grant consent, but you’ll still have to deal with the problem of mixed signals from the same visitor.

Publishers will now need to do a thorough job of informing their visitors about online profiling and how it relates to personalized ads. They also need to inform their visitors about which companies, specifically, are involved in collecting data about their online activities. Google has [some resources](https://www.cookiechoices.org/?ref=ctrl.blog) to help publishers with this, but you’re pretty much left on your to get this right.

Once a visitor agrees to online tracking and personalized ads, then you need to **record/document** that they gave consent and how you obtained it. I suggest adjusting your web server log format to log the value of the `DNT` HTTP header as well as the value of the google\_ads\_personalized\_consent cookie along with the users’ IP address and the date of their visit. See also “[EU GDPR and personal data in web server logs](https://www.ctrl.blog/entry/gdpr-web-server-logs/)”. I’m not sure if this is sufficient, however.

Finally, you can let them have personalized ads by setting the cookie we introduced a check for earlier.

```javascript
document.cookie='google_ads_personalized_consent=1; max-age=23328000'; // 9 months
(adsbygoogle=window.adsbygoogle||[]).requestNonPersonalizedAds=0;
```

This wouldn’t take effect until the next pageview, unless ads are also paused (see the section on cookie consent).

### Handling consent withdrawals

The GDPR requires that **it must be as easy to withdraw consent as its to give it.** You can’t say “just delete cookies” when you provided an easy prompt to let people opt-out.

> “Consent must be easy to withdraw; indeed ‘it must be as easy to withdraw consent as its to give it’. No more retention scams that allow online signups but demand users phone a call centre to delete their accounts.”

[Cennydd Bowles](https://cennydd.com/writing/a-techies-rough-guide-to-gdpr?ref=ctrl.blog)

I suggest displaying an “opt-out of personalized ads” link either underneath advertisement banners or at least at the bottom of each page.

Here is an example opt-out link mechanism that removes the consent cookie:

```javascript
<a href="#" onclick="document.cookie='google_ads_personalized_consent=0; path=/; max-age=60';alert('You’ve opted out');">Opt-out</a>
```

However, you also need to inform people about how they can remove the data that Google has already collected about them. I’m frankly not sure how to go about that and I haven’t found any information from Google regarding this either.

At the close, I’d like to remind everyone of the huge yellow disclaimer you read in the beginning of the article. The information in this article may not be accurate, and publishers must read through their contracts with Google and AdSense in detail as well as all the information Google sends them regarding the GDPR.

#### Sources

- [Ads personalization settings in Google’s publisher ad tags](https://support.google.com/adsense/answer/7670312?ref=ctrl.blog), 2018-04-24, AdSense Help, Google
- [Comply with EU user consent policy](https://support.google.com/adsense/answer/7670013?ref=ctrl.blog), 2018-04-24, AdSense Help, Google
- [Tracking Preference Expression (DNT)](https://www.w3.org/TR/2017/CR-tracking-dnt-20171019/?ref=ctrl.blog), 2017-10-19, World Wide Web Consortium (W3C)
- [Proposal: Regulation on Privacy and Electronic Communications](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:52017PC0010&from=EN&ref=ctrl.blog), 2017-01-10, EU Parliament and EU Council
- [General Data Protection Regulation](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679&from=EN&ref=ctrl.blog), 2016-04-27, The Official Journal of the European Union, EU Parliament and EU Council
- [Evercookie](https://samy.pl/evercookie/?ref=ctrl.blog), 2010-09-20, Samy Kamkar
- [Directive on privacy and electronic communications](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32002L0058&from=EN&ref=ctrl.blog), 2002-07-22, The Official Journal of the European Union, EU Parliament and EU Council
### Google Chrome finally includes a Reader Mode but only on Android
URL: https://www.ctrl.blog/entry/chrome-simplified-view-android/
Last updated: 2026-08-23T22:03:22.000Z
Browser reading modes take the main text of a webpage and present it in a uniform style while hiding everything else on the page. Users can also set their own preferred font, text sizes, and colors that will be applied to all texts on all websites when reading mode is used.

Google is primarily an advertising company, and it has been believed they won’t add a reading mode to their Chrome browser because it would hide the ads.

However, Chrome 65 for Android includes a reader mode for the first time. Chrome has had *something* like a reading mode in development for about three years without shipping it in their browser. There was no mention of a reading mode or distraction-free reading in the [Chrome 65 release announcement](https://chromereleases.googleblog.com/2018/03/chrome-for-android-update%5F12.html?ref=ctrl.blog). What Chrome shipped instead of a reading mode was a new accessibility feature called Simplified view.

When the feature is enabled, users will be prompted to switch to a Simplified view on supported webpages (any page that can be parsed by the DOM Distiller) using an Android “snackbar” notification at the bottom of the screen.

The notification is more intrusive than the out-of-the-way Reading Mode toolbar buttons we’re used to from other mobile and desktop web browsers.

![“Show Simplified view” snackbar in Chrome on Android](https://cdn.synaps.media/control/content/images/2026/08/chrome-show-simplified-view-snackbar.png)

“Show simplified view” notification snackbar

Simplified view, like any Reading Mode, is indeed an accessibility feature. The name Simplified view seems to have been chosen to sound unappealing to users who don’t *need* a simpler representation of pages. People who rely on screen readers and other accessive technologies will greatly benefit from this mode.

However, the average user is less likely to enable something that sounds like you’re getting a lesser overall experience compared to something that sounds like you’ll be getting a better reading experience.

There are some issues with Simplified view still such as the security indicators being confused about the security level of the page your reading.

[Details from the DOM Distiller project](https://github.com/chromium/dom-distiller/blob/38037b3482ce9500f2908798d0b88078579b4965/README.md?ref=ctrl.blog) — the open-source component that reduces pages down to their main content for Simplified view — clearly shows that the Chrome team originally wanted to ship a Reading Mode comparable to what was available in other browsers.

I haven’t found any details outlining the reasons why the feature was never shipped in its originally envisioned form. However, Google’s conflict of interests as a huge player in the online advertisement space comes to mind.

I find it interesting that Google has decided to go against their own business interests and include a feature that hides web ads. Then again, Chrome did ship with a [built-in and on-by-default selective ad-blocker in Chrome 64](https://www.ctrl.blog/entry/chrome-adblocker/). I didn’t expect that to happen either. Turns out, I probably wouldn’t be the best technology analyst.

#### Sources

- [Chrome for Android Update](https://chromereleases.googleblog.com/2018/03/chrome-for-android-update%5F12.html?ref=ctrl.blog), 2018-03-12, Estelle Yomba, Chrome Releases blog, Google
- [Use TalkBack to browse the web with Chrome](https://support.google.com/chrome/answer/2633135?hl=en&ref=ctrl.blog), 2018-03, Google Chrome Help, Google
- [DOM Distiller](https://github.com/chromium/dom-distiller/blob/38037b3482ce9500f2908798d0b88078579b4965/README.md?ref=ctrl.blog), commit 38037b3482, 2017-10-17, dom-distiller code repository, chromium project, GitHub
- [The DOM Distiller is an exciting open-source project created by the chromium team](https://web.archive.org/web/20190318195847/https://plus.google.com/100132233764003563318/posts/KEcP88z2tfh), 2015-02-25, François Beaufort, Google+
### How to randomize DNS resolver selection in Knot Resolver
URL: https://www.ctrl.blog/entry/kresd-random-dns-forwarding/
Last updated: 2026-08-23T22:12:45.000Z
[Knot DNS Resolver](https://www.knot-resolver.cz/?ref=ctrl.blog) lets you configure up to four forwarding DNS over TLS servers, and will automatically prefer the fastest server. However, Knot Resolver is highly configurable and you can also configure it to do more exotic things like spread your DNS queries out randomly among a selection of DNS resolvers.

Please refer to [How to get faster and more secure DNS resolution with Knot Resolver](https://www.ctrl.blog/entry/knot-dns-resolver-tutorial/) for an introduction to Knot Resolver and some basic setup and configuration. This article picks up from the end of the previous article where we’d setup forwarding to an external DNS over TLS resolver.

Configuration files in Knot Resolver are Lua scripts, meaning that you’ve got the full capabilities of the Lua language at your disposal. I hope to demonstrate the flexibility this gives Knot over alternative DNS servers. This also gives you plenty of opportunities to shoot yourself in the foot when it comes to breaking things, and reducing stability and performance. That being said, this setup should work just fine unless you’re running a large scale deployment of Knot Resolver.

### Why randomize DNS resolvers

DNS forwarders get a lot of information about the websites you visit and your habits. You send them the addresses of every website you visit and your apps and devices share details about themselves with your DNS forwarder.

You can reduce the ability of your DNS provider to build a complete profile of your internet activities by using more than one provider. Using multiple providers also encourages innovation and competition in the DNS market.

Neither Quad9 and Cloudflare — the two DNS over TLS providers we’ll use later in the examples configurations in this article — didn’t exist at the beginning of 2018. Yet both offer better services than what existed previously. Both promises to not collect any data, store any logs, and provide their services free-of-charge to the internet community.

We didn’t have the additional security and privacy offered by DNS over TLS either as there weren’t anyone who offered implementations and services.

### Configuration

To do anything randomly, you’ll need a source of entropy. The following configuration example loads the `math` module in Lua and seeds the generator with the current time. We don’t need a high level of entropy to make a random server selection, so this will suffice.

```lua
require 'math'
math.randomseed(os.time())
```

Next, we’ll need to overcome some of Knot Resolver’s constraints. The `policy.TLS_FORWARD` action is limited to no more than four IP addresses to DNS resolvers. We’ll still use this action, but populate it from a table containing tables of up-to- four primary and secondary IPv4 and IPv6 addresses for the public DNS resolvers we’ll be using.

The below configuration example shows such a table of tables with Quad9 and Cloudflare Resolver:

```lua
-- SPDX-License-Identifier: CC0-1.0

tls_bundle='/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem'

dns_providers = {
  { -- Quad9
    {'9.9.9.9',
     hostname='dns.quad9.net', ca_file=tls_bundle},
    {'149.112.112.112',
     hostname='dns.quad9.net', ca_file=tls_bundle},
    {'2620:fe::fe',
     hostname='dns.quad9.net', ca_file=tls_bundle},
  },
  { -- Cloudflare Resolver
    {'1.1.1.1',
     hostname='cloudflare-dns.com', ca_file=tls_bundle},
    {'1.0.0.1',
     hostname='cloudflare-dns.com', ca_file=tls_bundle},
    {'2606:4700:4700::1111',
     hostname='cloudflare-dns.com', ca_file=tls_bundle},
    {'2606:4700:4700::1001',
     hostname='cloudflare-dns.com', ca_file=tls_bundle},
  }
}
```

All the root certificates needed to establish DNS over TLS connections is stored in the system-provided TLS CA bundle. I stored this in a variable to reduce repetition. See the last section of the [previous configuration example](https://www.ctrl.blog/entry/knot-dns-resolver-tutorial/) for more details.

You can find a list of free-of-charge public resolvers in the [DNS Privacy Project wiki](https://web.archive.org/web/20180426090908/https://dnsprivacy.org/wiki/display/DP/DNS%20Privacy%20Test+Servers) if you wish to configure additional DNS resolvers.

If you prefer one provider over another, you can duplicate its row and insert it at the end of the table to increase its chance of being chosen. The following example duplicates the first row (Quad9) making it twice as likely to be used as the second row (Cloudflare Resolver.) Note that indexes in Lua start from 1 and not 0.

```lua
table.insert(dns_providers, dns_providers[1])
```

Now that we’ve got a source of randomness and a table of DNS resolvers, all that remains is to make random selections from the table and use the selection to resolve DNS.

The following function adds a policy that uses a custom filter which chooses a random DNS resolver from our table and returns a `policy.TLS_FORWARD` action which uses said resolver.

```lua
policy.add(function (request, query)
  return policy.TLS_FORWARD(dns_providers[math.random(1, #dns_providers)])
end)
```

This policy replaces the `policy.ALL` filter we used in the [previous configuration example](https://www.ctrl.blog/entry/knot-dns-resolver-tutorial/). If you don’t want the selection to be entirely random, you can find an example of [tuning a custom filter function based on the query](https://knot-resolver.readthedocs.io/en/v2.2.0/modules.html?ref=ctrl.blog#id2) in the Knot Resolver Modules documentation.

#### Sources

- [DNS over TLS](https://developers.cloudflare.com/1.1.1.1/encryption/dns-over-tls/?ref=ctrl.blog), 2018-04-04, Cloudflare Resolver, Developer Documentation, Cloudflare
- [Knot DNS Resolver modules](https://knot-resolver.readthedocs.io/en/v2.2.0/modules.html?ref=ctrl.blog), version 2.2.0, 2018-03-28, Knot Resolver documentation, CZ.NIC labs, Read the Docs
- [Frequently Asked Questions](https://www.quad9.net/support/faq/?ref=ctrl.blog), 2018-02, Quad9
- [RFC 7858: Specification for DNS over Transport Layer Security (TLS)](https://www.rfc-editor.org/rfc/rfc7858.html?ref=ctrl.blog), 2016-05, Internet Engineering Task Force
### VPN root certificates leaves you more vulnerable to snooping
URL: https://www.ctrl.blog/entry/vpn-root-ca-trust/
Last updated: 2026-08-23T22:24:09.000Z
Commercial Virtual Private Network (VPN) service providers promise security and anonymity in their marketing; but they ask you to trust them more than any other company on the web. Have they earned their customers’ trust when they position themselves to intercept all of their encrypted network traffic?

Your operating system, web browser, and applications all absolutely trust a group of Certificate Authorities (CA) to verify that the right web server answered our connection attempts and that the software we install haven’t been modified after the software vendor put it together.

I’m not going to go too far into all the details of the technology, intrigues, drama, and politics that govern the web of trust and the absolute trust our operating systems, browsers, and applications place in their Root Certificate Stores. I’ll keep it brief and say that the preinstalled list of certificates on your computer is governed by a strict set of policies and is monitored closely by the security community. The list is maintained by your operating system vendor (Apple, Google, Microsoft, or often by the Mozilla Foundation in the case of Linux and \*BSD.)

**You should never need to install any additional Certificate Authorities** into your operating system’s root certificate store/keychain. That is to say, you shouldn’t download and double-click on a root certificate file and install it into the Windows Certificate Manager, MacOS Keychain, or similar.

Your employer may have you install their own CA on their computers and devices to be able monitor their network, and intercept any email or message — even those sent over encrypted connections. Which is why you generally shouldn’t login to any website with a company issued device as they may intercept passwords and monitor what you do on these websites. If your employer owns the device, they can do what they damned please with it (within the limits of privacy laws — which are sadly lacking outside of Europe.)

Your VPN service providers often ask their users to install their Certificate Authority root certificate (or they just do it for them as part of their installation process.) Any CA installed on the operating system level is implicitly trusted to vouch for any website, email server, app, etc. that has been signed by it.

A VPN service tunnels all your traffic from your network and into a network controlled by your VPN provider. In other words, they’re **perfectly positioned to perform attacker-in-the-middle attacks** and strip off the encryption from your network traffic and seal it back up again after they’ve had a peek at its contents. **There’s no technical restriction limiting them from doing this** once they’re installed into your operating system’s root certificate store.

Security experts would scoff at this article believing it would be obvious to anyone that a VPN service can perform this type of attack against their own customers. However, VPN service providers generally don’t explain the inherent security risks with using their service as part of their marketing campaigns. I haven’t been able to find any serious writing on this subject, so it would be difficult for VPN customers to find resources to educate themselves about the risks.

### To violate customer trust to intercept banking information or stay true to our marketing promises?

The top VPN service providers earn roughly 1,80–3,50 USD per month per customer. (Notably, VPN services will often have high marketing costs from reoccurring revenue shares as high as 20–40 % with their partners and affiliates.) A VPN provider would quite possibly lose all their paying customers if they got caught stealing credit card information, login credentials, or sold information about their customers browsing habits to third-parties. However, who says not all VPN providers do this?

The perfect surveillance operation from any national security agency would involve little more than establishing a low-cost high-performance VPN service provider, and some targeted marketing campaigns to attract desired targets.

It’s also easy for your VPN to run a more targeted attack against a specific user. They already have your credit card information, email address, and other account information. When you logon to their service, you could be triggered as a high-value target and could forgo their regular services in favor of a service that interfered with your network traffic.

A VPN can even do automatic targeted tests to determine whether your operating system trusts their certificate with a high level of certainty. One such test could involve waiting for Windows Update requests, intercepting and resigning those, and seeing whether the client drops the connection or carries on with the update check. Windows would normally silently log a security warning that something were off with Windows Update, and retry later without informing the user. I’m sure a determined soul could find another such background service that doesn’t even trigger a silent log message anywhere on the system.

### Why do VPNs use these potentially dangerous certificates?

Some VPN protocols require the use of certificates. The VPN service provider needs to be able to issue per-device or per-user certificates signed by a Certificate Authority to operate the service. Other protocols optionally uses certificates, and most commercial VPN services opt to use them when that’s an option. When applied correctly, certificate based encryption is several orders of magnitude more secure than a username and weak password.

The root certificate files aren’t dangerous until you install them into your operating system and your operating system and programs begin to trust them.

The certificates can be used with no risks as long as their use is limited to specialized software and never installed into the operating system. Unfortunately, the VPN software that VPN services push on their users often rely on the host operating system’s VPN handling or else rely on its cryptographic functions and key store.

That being said, you shouldn’t install software from your VPN provider as they’ll often install the root certificate into your operating system. You can, however, find VPN client software — such as the OpenVPN client — that are happy to read the VPN’s root certificate from a file and doesn’t rely on it being installed. These programs are often difficult to configure will also be unsupported by the VPN provider’s support team.

### So, what is the alternative?

You can look for a VPN service provider that support IKEv2 EAP/PEAP username/password authentication without requiring you to install a root certificate. Look in their knowledge base/customer support portal for manual IKEv2 setup instructions for your operating system and scan for mentions of installing any certificates.

Please also note that some VPN provides arbitrarily limits IKEv2 usage to iOS only. (Which suggests they prefer you install their certificates … .)

IKEv2/IPsec with EAP user/password authorization is supported in recent versions of Android (third-party app required), iOS, Linux, MacOS, and Windows 10 (some extra work needed to work around an [EAP authentication bug](https://www.ctrl.blog/entry/win10-ikev2-eap-auth/).)

#### Sources

- [The “S” added to the end of the “HTTP” means SECURE. (Or at least it was supposed to.)](https://www.grc.com/fingerprints.htm?ref=ctrl.blog), 2013-04, Steve Gibson, Gibson Research Corporation
- [RFC 6818: Updates to the Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile](https://www.rfc-editor.org/rfc/rfc6818.html?ref=ctrl.blog), 2013-01, Internet Engineering Task Force
- [RFC 5280: Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile](https://www.rfc-editor.org/rfc/rfc5280.html?ref=ctrl.blog), 2008-05, Network Working Group, Internet Engineering Task Force
### How to work around the IKEv2 EAP authentication issue in Windows 10
URL: https://www.ctrl.blog/entry/win10-ikev2-eap-auth/
Last updated: 2026-08-23T22:24:34.000Z
There’s no need to install a third-party Virtual Private Network (VPN) client in Windows 10 as the operating system already supports open standard VPN solutions like IKEv2\. However, bugs in the Settings app in Windows 10 make it difficult to login to and access remote VPN services. Here is how you work the broken Settings app and setup a secure and working IKEv2 VPN profile.

More and more general-purpose VPN service providers are adding IPsec/IKEv2 to the list of protocols they support. The protocol is an open standard and it’s supported natively in iOS, MacOS, and Windows, and has partial (non-EAP authentication only) support in Android.

IKEv2 supports several forms of authentication without the need for the [dubious practice of installing a root certificate](https://www.ctrl.blog/entry/vpn-root-ca-trust/) provided by the VPN service provider. The Extensible Authentication Protocol (EAP; specifically `EAP-MSCHAPv2`) allows customers to authenticate with their account- or a device-specific username and password instead of certificates issued by the VPN provider.

![“Add a VPN connection” dialog in Windows 10](https://cdn.synaps.media/control/content/images/2026/08/windows10-add-a-vpn-connection.png)

Having to click the Save button in the Add a VPN connection dialog a second time to close the dialog is a sure sign that things aren’t working as expected.

Windows 10 does support the use of EAP authentication, but the ability for creating a VPN profile with this authentication method from the Settings app hasn’t worked since at least Windows 10 version 1607 (“Anniversary Update.”)

You can fill in the authentication information in the Add VPN connection dialog for creating a new VPN profile. However, it won’t be saved when you click the Save button. Clicking Save a second time dismisses the dialog but without saving any authentication information or the account credentials. The authentication information can’t be corrected from within the Settings app.

### Creating a working IKEv2 VPN profile with PowerShell

Until Microsoft decides to fix the Settings app, you can still add a working IKEv2 VPN profile through PowerShell. You don’t even need to be an administrative user to add it. Note that PowerShell or the ability to add VPN profiles may have been disabled by Group Policy settings.

The setup instructions are quite simple:

1. Adjust the `-Name` parameter to your choosing and set the `-ServerName` to the VPN server address you’ve been given by your VPN service provider.
2. Open PowerShell from the Windows Start menu.
3. Copy and paste the command into PowerShell, and press Enter to execute it.

```powershell
Add-VpnConnection `
  -Name "Example VPN (Denmark)" `
  -ServerAddress "dk.vpn.example.net" `
  -AuthenticationMethod "Eap" `
  -EncryptionLevel "Maximum" `
  -RememberCredential `
  -TunnelType "Ikev2"
```

You can optionally remove the whole line containing the `-RememberPassword` parameter if you don’t want to save your VPN username and password in Windows. You’ll be required to re-enter your credentials every time you connect to the VPN if you remove this option.

Lastly, you should login and (optionally save) your VPN credentials to make sure that the connection is working.

1. Open the Settings app and go to Network and Internet: VPN, and select the new VPN profile you’ve just created.
2. Click Connect, and enter your VPN username and password when prompted.

You can also connect through the Network status icon in the taskbar. In my experience, this can be a bit buggy and will occasionally fail to remember your VPN credential the first time you connect to the VPN. The Settings app seems to get this part right, however. (Windows 10 has some serious software quality issues … .)

You should always test to verify that your VPN connection is encrypting all your network traffic.

### Plugging the DNS leak

While the IKEv2 protocols allow for clients to be automatically configured to route all DNS requests to a specific DNS server through the VPN, … you don’t know whether that’s happening or not. There’s no indicator in Windows to check this, and you’d have to resort to manually inspecting network traffic to test it.

You should setup the DNS configuration manually to reduce the risk of domain queries leaking outside the VPN connection.

Unfortunately, the PowerShell cmdlets for configuring this are entirely broken and it can’t be configured from the Settings app either. (Seriously — what is up with all the bugs in Windows 10?) You’ll have to go into the legacy Control Panel to set the DNS configuration for your VPN profile from there.

1. Open the Control Panel and go to Network and Internet: Network Connections.
2. Select your VPN connection, right-click, and choose Properties.
3. Switch to the Networking tab, and select IPv4.
4. Click Use the following DNS server address, and enter the IPv4 address you’ve been given from your VPN provider or enter 9.9.9.9.
5. Click OK, and repeat steps three–five for IPv6, but enter `2620:fe::fe`.

The DNS server addresses used above belong to [Quad9](https://www.quad9.net/?ref=ctrl.blog), a security and privacy-enhanced free-to-use public DNS service provider. You can configure any DNS service provider here **except** for your local router or the one offered by your internet service provider (ISP).

This isn’t guaranteed to stop DNS leaks, but it does reduce the risk of DNS request leaks. You can significantly reduce the risk by investing in a dedicated VPN gateway router (like the [Vilfo](https://www.ctrl.blog/entry/vilfo-review-p1-overview/)) and connecting your computer and devices exclusively through that device.

#### Sources

- [Frequently Asked Questions](https://www.quad9.net/support/faq/?ref=ctrl.blog), 2018-02, Quad9
- [Add-VpnConnection](https://github.com/MicrosoftDocs/windows-powershell-docs/blob/ced7757924addcaea0b7a244ae4d240e4d28d93a/docset/windows/vpnclient/add-vpnconnection.md?ref=ctrl.blog), commit ced7757924, 2017-09-15, Windows PowerShell module documentation, Microsoft Docs, Microsoft, GitHub
- [2.2.2.2.14 DataEncryption](https://learn.microsoft.com/en-us/openspecs/windows%5Fprotocols/ms-rrasm/573f5ccd-8d76-40ae-a8b0-57cea79b2480?ref=ctrl.blog), 2013-04, Fileformat for Phonebook, Microsoft Developer Network, Microsoft
- [2.2.2.2.56 CustomAuthKey](https://learn.microsoft.com/en-us/openspecs/windows%5Fprotocols/ms-rrasm/b831b3cf-3472-4f84-b3dd-b04cdef74d8d?ref=ctrl.blog), 2013-04, Fileformat for Phonebook, Microsoft Developer Network, Microsoft
- [2.2.2.2.57 CustomAuthData](https://learn.microsoft.com/en-us/openspecs/windows%5Fprotocols/ms-rrasm/60894c76-10ca-4b07-8643-ee0f8ecb9828?ref=ctrl.blog), 2013-04, Fileformat for Phonebook, Microsoft Developer Network, Microsoft
- [RFC 7296: Internet Key Exchange Protocol Version 2](https://www.rfc-editor.org/rfc/rfc7296.html?ref=ctrl.blog), 2014-10, Internet Engineering Task Force
- [RFC 5247: Extensible Authentication Protocol (EAP) Key Management Framework](https://www.rfc-editor.org/rfc/rfc5247.html?ref=ctrl.blog), 2008-08, Network Working Group, Internet Engineering Task Force
- Windows 10 version 1607, 1709, and 1803
### What breaks if you use First-Party Isolation in Firefox
URL: https://www.ctrl.blog/entry/firefox-fpi/
Last updated: 2026-08-23T22:06:46.000Z
First-Party Isolation (FPI) is an optional privacy feature built-in to Firefox that enforces stricter security policies to block tracking between websites. Essentially, every website you visit will store data separately and isolated from every other website you visit. So, what could go wrong?

First-Party Isolation offers the same privacy protection within one browser as you would get if you open one website in Safari (or another web browser) and then open another website in Firefox. Network connections, caches of different types, cookies, and other persistent data stores would work as normal but there’s no known way for one website to save data in a way that could be read by any other website.

This is a more complete protection against cross-origin tracking between different websites by traditional means like the option for disabling third-party cookies and storage found in most web browsers. FPI was originally designed for use in the privacy-oriented Tor Browser, which is based on Firefox.

Mozilla has been quiet about this feature. It was first introduced in Firefox 55 after years of development work, but wasn’t mentioned in the official release notes or marketing. I’m not sure whether that’s because Mozilla considers it unsafe, unpractical, or don’t want to commit to maintaining the feature in future releases.

First-Party Isolation is a fundamental change in how the web browser operates and it breaks many assumptions made by web developers. If you want to enable the feature and gain better privacy than you also have to pay the price of breaking those assumptions.

Here is a list of the types of problems you can expect to run into with FPI enabled:

### Third-party login failures

Mozilla ran a study where they looked at how many issues people would run into if they enabled one of eight different privacy-enhancing settings in Firefox. The study found that people in the group with First-Party Isolation enabled reported the most number of issues out of any of the test groups.

The same study found that people ran into trouble with Facebook and Google domains, and had trouble login in to websites. Both Facebook and Google provide authentication and login services for other websites that don’t always work as expected when you enable FPI.

Depending on the implementation, you click on a login button on a website that opens a window with either Facebook or Google. This new window is opened in a new security context and is isolated from the originating website. Users can poke a hole in the isolation barrier by changing the privacy.firstparty.isolate.restrict\_opener\_access option to false, which allows for some communication between the login provider and the original website. However, changing this option only makes the login break later in the process.

Users can sometimes work around these issues to some degree. For example, a comment form from Disqus or Facebook is loaded inside a frame on the original page. By right-clicking on the frame and choosing This Frame: Open Frame In a New Tab, you’ll end up on a new frame with just the comment form with the origin as either a Disqus or Facebook domain. By loading the frame from the original origin, you’ll have access to the cookies for that origin and can login and comment as per normal.

Some services, like the Mozilla-backed [Scroll news subscription service](https://www.ctrl.blog/entry/scroll-com-first-impressions/), rely on third-party tracking cookies on partner websites. The service uses this as a mechanism to automatically log you in on partner websites. This type of service is incompatible with First-Party Isolation.

To fully resolve this issue, the login service providers have to change their products to work with stricter origin controls. Unless Mozilla was to enable FPI by default, I doubt any company will invest any time or money in fixing these issues.

### No migration path

You lose all your cookies, caches, and data stores when you first enable First-Party Isolation in Firefox. Firefox doesn’t record the origin of data before enabling the setting, so existing user data has to go when switching to a stricter origin-policy.

Firefox can’t record this data before isolating websites from each other as it otherwise wouldn’t know which changes were made by which website if multiple websites had access to read and write to the same data stores. Its kind of an unavoidable problem, as I see it.

The initial loss of logins, website settings, and an avalanche of reappearing cookie consent toolbars could help explain for the higher number of issue reports in Mozilla’s study. Mozilla doesn’t mention this issue specifically in any publication.

### More CAPTCHAs

As I noted only recently, Google reCAPTCHA has a [99,3 % global marketshare](https://www.ctrl.blog/entry/coinhive-captcha/) in CAPTCHA services.

No CAPTCHA reCAPTCHA uses Google’s knowledge and insights about you from tracking you around the web to determine whether you’re a computer or a human; instead of asking you to pass a cognitive test. Google seems to have **reduced confidence in their ability to identify you as a human** with reduced tracking and an unusual number of unique users (every website is assigned different tracking/user ID/user instead of sharing the same ID) from your IP address.

In my own experience, I’ve had to spend more time and energy trying to manually solve the harder reCAPTCHA options rather than bypassing it all together with Google’s No CAPTCHA reCAPTCHA after enabling First-Party Isolation in Firefox.

### Less shared caching means more data usage

Caching is good. It means you don’t have to download the same font or JavaScript library multiple times if it’s already stored in your browser’s cache. Firefox will still cache content with First-Party Isolation enabled, however it will do so far less efficiently.

Normally, your browser will download one copy of a specific font or JavaScript library once from a content delivery network (CDN) which can be shared between multiple websites. FPI disrupts this causing the browser to download a new copy per website instead of relying on one shared copy.

Firefox doesn’t set aside more disk storage space for its cache when enabling FPI. The browser thus has to store multiple copies of the same files in the same amount of disk space; which causes reduced efficiency for prioritizing what to keep in the cache and what to delete.

You can somewhat reduce the impact of this for some types of common JavaScript libraries by installing the [Decentraleyes extension](https://www.ctrl.blog/entry/decentraleyes-cdn/). This extension acts as a local CDN provider that can bypass the First-Party Isolation by serving the content from the extension rather than a remote CDN.

Depending on your location and internet connection, enabling First-Party Isolation in Firefox may significantly increase costs and slow down page loading times.

### Can’t log-in to many extensions

The extension API for OAuth2 logins, `browser.identify.launchWebAuthFlow`, fails to inform extensions about whether logins failed or succeeded. Extensions will wait for login attempts forever; believing the user just haven’t completed it yet.

You can work-around the problem temporarily by disabling First-Party Isolation, restarting the browser, logging into the extension, and then re-enabling First-Party Isolation. Depending on the configuration of the service you login to,m you may nee to repeat the process every few months, weeks, days, or even hours.

**Update** (2018-07-12): Added information about login issues with extension API.

Other extensions assume that they can access cookies cross-domains in a way that’s prohibited by First-Party Isolation.

### Can’t log-in to Pocket

[Pocket](https://getpocket.com/?ref=ctrl.blog) is Mozilla’s reading list and article recommendation service that you’ll find built-right into Firefox. Unfortunately, you can’t login to Pocket when First-Party isolation is enabled.

You can work-around the problem by temporarily disabling First-Party Isolation, restarting the browser, logging in to Pocket, and then re-enabling First-Party Isolation. The process must be repeated every six months or so.

**Update** (2018-07-11): Added information about Pocket login issues.

#### Enabling First-Party Isolation

You can enable the feature by typing about:config in the address field, changing the privacy.firstparty.isolate option to true, and restarting Firefox. You should only enable the feature if you’re prepared to run into a few issues now and then.

I’ve enabled First-Party Isolation myself and have used it for months already. It can be annoying, but I believe it to be a good security and privacy feature that I hope Firefox can one day enable by default. You can check out the [Tor Browser](https://www.torproject.org/?ref=ctrl.blog) if you wish to use a web browser based on Firefox that enables this feature by default.

#### Sources

- [identity.launchWebAuthFlow doesn’t work when privacy.firstparty.isolate is enabled](https://bugzilla.mozilla.org/show%5Fbug.cgi?id=1475124&ref=ctrl.blog), issue 1475124, 2018-07-12, Daniel Aleksandersen, Firefox bug tracker, Mozilla
- [Pocket doesn’t work with privacy.firstparty.isolate set to true](https://bugzilla.mozilla.org/show%5Fbug.cgi?id=1384657&ref=ctrl.blog), issue 1384657, 2018-05-09, Firefox bug tracker, Mozilla
- [4.5\. Cross-Origin Identifier Unlinkability](https://2019.www.torproject.org/projects/torbrowser/design/?ref=ctrl.blog#identifier-linkability), 2018-02-19, The Design and Implementation of the Tor Browser, Tor Project
- [Improving privacy without breaking the web](https://blog.mozilla.org/data/2018/01/26/improving-privacy-without-breaking-the-web/?ref=ctrl.blog), 2018-01-26, Firefox Data blog, Mozilla
- [How to enable First-Party Isolation in Firefox](https://www.ghacks.net/2017/11/22/how-to-enable-first-party-isolation-in-firefox/?ref=ctrl.blog), 2017-11-22, Martin Brinkmann, gHacks
- [Firefox 55.0 Release Notes](https://www.mozilla.org/en-US/firefox/55.0/releasenotes/?ref=ctrl.blog), 2017-08-08, Mozilla
- [Are you a robot? Introducing “No CAPTCHA reCAPTCHA”](https://security.googleblog.com/2014/12/are-you-robot-introducing-no-captcha.html?ref=ctrl.blog), 2014-12-03, Vinay Shet, Google Security Blog, Google
### How to limit tracking in software downloads
URL: https://www.ctrl.blog/entry/limit-download-tracking/
Last updated: 2026-08-23T22:13:22.000Z
Earlier this week, I talked about how software you download through your web browser [includes unique tracking codes](https://www.ctrl.blog/entry/software-downloads-uids/ "“Tracking beyond the web browser: Unique identifiers being embedded into software downloads”") (“super-cookies”) that are installed along with software downloads. Be sure to read Part 1 first for context. Here are some tips for how you can limit this type of tracking.

While there are existing tools to block tracking inside your web browser, there isn’t many options available on the operating system level. You can’t modify the software you download as easily as you can make changes to website to block or reduce tracking in your web browser.

There’s little to no transparency regarding this type of tracking. You’ve to carefully investigate each bit of software you download to identify whether the software vendor has embedded unique tracking identifiers in the software you’ve downloaded.

You can, however, chip away at the tracking and reduce it’s effectiveness. The most effective methods to limit tracking involves you having to change how you behave on the web to make you more difficult to track.

These following tips are ordered by how effective I believe they are at reducing the effectiveness of software download-embedded tracking.

#### Use an application firewall

There’s no simple way you can absolutely block all tracking short of analyzing all outgoing traffic from your computer and inspect their contents. However, you can make some educated guesses based on the website that a program is trying to reach. For example, does the program you’re trying to install need to communicated with googleanalytics.com?

You can use an *application firewall* to be notified when installers and other programs want to connect to the internet and which website they want to communicate with. These programs also give you the option to proactively block or permit the connection.

It can be quite overwhelming to have to manually set policies for and evaluate which network connections are necessary and which isn’t for each installed program on your computer. An application firewall is only suitable for experienced users, but it’s also the most effective method to effectively reduce tracking.

Popular application firewall options include [Little Snitch](https://www.obdev.at/products/littlesnitch/index.html?ref=ctrl.blog) for MacOS (free trial), [NetLimiter](https://www.netlimiter.com/?ref=ctrl.blog) for Windows (free trial), and [OpenSnitch](https://github.com/evilsocket/opensnitch?ref=ctrl.blog) for Linux (free and open-source).

#### Download from other sources

This is terrible security advise, but you can often find alternative mirrors that host popular software. You may risk downloading modified software with other unwanted side-effects, so this isn’t generally advisable unless you know what you’re doing (you probably don’t even if you think you do).

You can, however, sometimes find alternatives downloads from the official website of the software vendor. These may be labeled as “Offline installer” or “Legacy installer”. Likewise, you may be able to find an official FTP mirror were you can download a vanilla copy of the software.

I haven’t found any downloads from an FTP mirror or who’ve been marked as a “Offline installer” that have contained unique tracking codes. I suspect few people use these alternative download methods so vendors haven’t yet bothered to implement tracking for them. This is no guarantee that you’ll get a version without tracking, however.

#### Change program file names before running them

The most common tracking method on Windows is based on inserting tracking codes in the file name. Changing the filename to something generic like “installer.exe” before running it removes the tracking codes. You can do this if you see that downloaded software has a long and GiBberish looking filename.

This shouldn’t break anything, but it will remove tracking information and make the installer fallback to default values that aren’t associated with your web activities.

#### Only download software in Private/Incognito browsing mode

You can use private browsing mode in your browser when you download software. This won’t stop them from tracking you, but it reduce their ability to bind persistent identifiers (like cookies that already follow you around the web) from your web browser usage to the software you install.

Alternatively (or even complimentary), you can use the Firefox web browser and [enable First-Party Isolation](https://www.ctrl.blog/entry/firefox-fpi/) (FPI). FPI changes how the browser behaves and makes it more difficult to link activities between the different websites you visit.

#### Enable Do-Not-Track

Mozilla will honor the Do Not Track (DNT) setting in your web browser when you download software from them and won’t include marketing data in your installer if you use it. DNT was a proposed internet standard for signaling to websites that you don’t want to be tracked. The standard kind of didn’t go anyway, but [Mozilla says they’ll honor it](https://support.mozilla.org/en-US/kb/desktop-attribution-privacy?ref=ctrl.blog). You can enable DNT from your web browser (under either Advanced settings, Privacy, or Security settings). Firefox automatically enables DNT by default in Private browsing mode.

I’m not aware of any other software vendor that honors the signal, however.

#### Sources

- [About Firefox Desktop Attribution](https://support.mozilla.org/en-US/kb/desktop-attribution-privacy/revision/140197?ref=ctrl.blog), revision 140197, 2017-06-02, Firefox Help, Mozilla
### Software downloads now contain unique tracking identifiers
URL: https://www.ctrl.blog/entry/software-downloads-uids/
Last updated: 2026-08-23T22:22:08.000Z
Software vendors are no longer content with just tracking people as they move around their website to make up their minds whether to download the software or not. A new ‘super-cookie’ technique inserts unique tracking code into the software you download, and is installed onto your computer as a persistent identifier along with the software.

Just about every company keep an eye on what visitors do while they visit their websites. They may run experiments like download button red instead of green or changing page’s background image to see which variant can convince more people to download their software or buy their products. People can to some extent opt-out of this type of monitoring by making changes to their web browsers.

### How unique data is embedded in downloaded executables

Code-signing is a tool of cryptographically verifying that the software you download haven’t been modified or tampered with. Unsigned or modified software will display a scary warning on from your operating system; warning against or outright blocking you from using the software.

However, you’ve likely downloaded software from the official website of the software vendor that has been tampered with *after it was signed* but without breaking the signature seal. This defies the myth that says code-signed programs can’t be modified after the fact.

The code-signature verification systems in MacOS and Windows has a few loopholes that are actively used for tracking and fingerprinting downloaded software installers. Developers can embed arbitrary data before or after the code signature certificates on Windows, or embed data in extended file system attributes on MacOS.

Think of it as someone opening the sanitation seal on a hygiene or grocery product, inserting something into the packet, and then sealing it back up without damaging the reassuring seal.

There’s little to no transparency regarding this type of tracking. You’ve to carefully investigate each bit of software you download to identify whether the software vendor has embedded unique tracking identifiers in the software you’ve downloaded.

### The types of data that’s being embedded

When you visit a software vendor’s website, they’ll assign your web browser a unique identifier. This identifier is included with every request from your web browser to the server, including the software download server. This identifier is either included verbatim, or you may be assigned another unique identifier (the download server then being able to map the to identifiers.)

Other data includes the web browser’s name, make, and version (the User-Agent string); marketing campaign data (Google Analytics/UTM parameters), and the user’s IP address. The latter appears most common with trialware and shareware. However, I’d not be surprised to see IP addresses and maybe even a customer numbers or similar as a fingerprint embedded inside downloads in more expensive premium software.

In most cases the data is embedded as plain-text, but some vendors try to hide and obfuscate the nature of the data. Making changes to the User-Agent, request cookies, URL parameters, or the IP addressed used to download the software does however reveal that the additional data is changing based on these parameters.

**Update** (2020-08-20): I didn’t discuss the security implications of this when I wrote this article. It turns out that people have found ways to [append entire executable Java programs](https://blog.virustotal.com/2019/01/distribution-of-malicious-jar-appended.html?ref=ctrl.blog "“Distribution of malicious JAR appended to MSI files signed by third parties”") on Windows in this way. As far as Windows was concerned, it wouldn’t see any problems with executing the entirely wrong and unsigned program as long as the main portion of the program file was signed. Ouch.

### Alternative approach: unique file name

Embedding tracking codes inside downloads require quite a bit of highly specialized knowledge and a purpose-built download delivery infrastructure.

Some software vendors have settled on serving people files where the downloaded file name itself contains the tracking information. The software installer can then read the desired out of the file name of its own file name, and report back to the software company or store the data persistently on peoples’ computers.

### Which applications are doing this?

You can detect this type of tracking by downloading the same software from different web browsers from different IP addresses. The same version of the same software should be identical. If they’re not, then you can look at the differences between the two downloads.

It can be tricky to detect, though, as some vendors only embed this if you download their software after clicking an advertisement which lead to their website first.

Here are some examples of popular applications and what data they include with their installers:

- **Avast** and **AVG** antivirus includes marketing campaign data in the downloaded file name, but no unique identifiers.
- **Avira** antivirus includes marketing campaign data, and an unique identifier (an incremental counter) in the downloaded file name.
- **Backblaze** backup includes partner referral codes in the downloaded file names to accredit sale leads.
- **Brave** browser includes partner referral codes in the downloaded file names to accredit sale leads.
- **Google Chrome** embeds a unique identifier, the name of the browser you used to download their browser, your device language, whether you’ve opted-out of data collection using a checkbox on their website, and marketing data including which Google website or advertisement you clicked to download Chrome.
- **Mozilla Firefox** doesn’t embed unique identifiers, but they identify whether you downloaded Firefox from Firefox.com, Mozilla.org, or other. Mozilla lets you opt-out by enabling the Do-Not-Track preference in your web browser.
- **Opera** is believed to embed similar data to Chrome and Yandex, but hard to verify exactly as they obfuscate the data.
- **WinZip** doesn’t embed unique identifiers, but they do embed marketing campaign data. Notably, WinZip appears to have prepared a few different variants of their software and code-signed each of them individually.
- **Yandex.browser** embeds two different unique identifiers, the name of the browser you used to download their browser (which they use to copy bookmarks and data from your preferred browser on install), and whether you’ve opted-out of data collection using a checkbox on their website (preference appears to be non-functioning at the time of publication.)

You can tell from the above list of software that web browsers track the most data about their users. You can also see that all, excluding WinZip, are freeware or freemium software with either rely on advertisement revenue or that have a high ad-spending budget of their own.

Continue reading [Part 2: How to limit tracking in software downloads](https://www.ctrl.blog/entry/limit-download-tracking/).

#### Sources

- Downloads collected from the various products mention in this article form their official websites using different browsers and settings, 2018-04-02
- [Environment](https://web.archive.org/web/2020%2A/https://dxr.mozilla.org/mozilla-central/rev/d8480fd61e80/toolkit/components/telemetry/docs/data/environment.rst), revision d8480fd61e, 2018-03-23, Data documentation, Telemetry, Mozilla Central source repository, Mozilla
- [Technical Note TN2206: MacOS Code Signing In Depth](https://developer.apple.com/library/archive/technotes/tn2206/%5Findex.html?ref=ctrl.blog), 2016-09-13, Guides and Sample Code, Apple Developer Portal, Apple
- [Changing a Signed Executable Without Altering Windows Digital Signature](https://blog.barthe.ph/2009/02/22/change-signed-executable/?ref=ctrl.blog), 2009-02-22, Aymeric Barthe, Aymeric on Software
### Firefox to reintroduce OpenSearch discovery and install in Firefox 61
URL: https://www.ctrl.blog/entry/firefox-reintroduces-opensearch/
Last updated: 2026-08-23T22:06:55.000Z
Firefox removed the separate search field from the address bar in Firefox 57\. With it, Firefox also removed the ability to discover and install new search providers from the websites you visited. Firefox 61 reintroduces OpenSearch but it’ll be harder to discover it than in earlier versions.

OpenSearch is an open standard for expressing how a search client (like a web browser) can communicate with a search provider. Your web browser has a few built-in defaults, but you can use OpenSearch to install additional search engines.

Firefox 56 and older versions used to mark the search icon in the search field with a green notification badge to indicate that it had detected an OpenSearch provider on the current website.

![OpenSearch discovery user-interface in Firefox](https://cdn.synaps.media/control/content/images/2026/08/firefox60-vs-56-opensearch-ui.png)

Comparing the user-interface for OpenSearch discovery in Firefox ≥ 61 (left) and Firefox ≤56 (right).

Firefox 61 will reintroduce the capability as a new menu item in the Page Actions menu (the three dots to the right inside the address field). There’s no notification badge on the Page Actions menu to indicate to the user that a new search provider is available for the current website. The new user interface also says where the search provider is being added, rather than just saying that it would be added in some capacity like the old version did.

Firefox 61 is expected to be released at the end of June 2018.

[Microsoft Edge](https://www.ctrl.blog/entry/edge-search-provider/), Google Chrome, and [Safari](https://www.ctrl.blog/entry/safari-quick-website-search/) all automatically detect and install OpenSearch providers.

Microsoft Edge and Google Chrome adds discovered search providers to a list of optional search providers inside Settings. Both browsers let you change the browser’s default search engine to one of the previously discovered search engines.

In Safari, you’ll get the chance to search directly on websites you’ve previously visited when typing their name or domains in the address field followed by a search term. Safari’s approach helps to [decentralize search](https://www.ctrl.blog/entry/safari-decentralizes-search/) by routing search directly to other websites instead of a generalized search engine provider like Bing or Google. You’ll be able to search for movies and TV shows directly on the Internet Movie Database website from the address field in Safari without going to an external search engine first.

I wish Mozilla had learned a lesson or two on how to do this from Safari. The leading search engines in the market has way more control over our online habits and which websites we visit than they’ve any right to. If you begin your search with “YouTube” than Firefox should, as Safari do, provide a method for searching on YouTube directly without involving another search engine.

Notably, Mozilla is funded by partnerships for the position to be Firefox’s default search provider in key markets. It would be a treat to the organization’s funding if they were to begin diverting search traffic away from their partners and onto other websites instead. Apple has no such concerns with Safari and are happy to provide people with alternatives instead of funneling all their users to their main competitor Google.

#### Sources

- [The “Add Search Engine” page action button doesn’t have a plus-sign (+) badge when it’s in the address bar](https://bugzilla.mozilla.org/show%5Fbug.cgi?id=1450125&ref=ctrl.blog), issue #1450125, 2018-03-30, Bugzilla, Mozilla
- [Add search engines discovery to the location bar](https://bugzilla.mozilla.org/show%5Fbug.cgi?id=1221539&ref=ctrl.blog), issue #1221539, 2018-03-26, Bugzilla, Mozilla
- [Sync search plugins](https://bugzilla.mozilla.org/show%5Fbug.cgi?id=444284&ref=ctrl.blog), issue #444284, 2017-11-29, Bugzilla, Mozilla
- [Photon Engineering Newsletter #5](https://dolske.wordpress.com/2017/06/08/photon-engineering-newsletter-5/?ref=ctrl.blog), 2017-06-08, Justin Dolske, Dolske’s Blog
### Get faster and more secure DNS resolution with Knot Resolver on Linux
URL: https://www.ctrl.blog/entry/knot-dns-resolver-tutorial/
Last updated: 2026-08-23T22:12:40.000Z
[Knot Resolver](https://www.knot-resolver.cz/?ref=ctrl.blog) is a caching DNS resolver that can help speed up and secure DNS resolution on your Linux workstation. Here is how you set up Knot Resolver to validate DNSSEC and cache the DNS requests from your local device or set it up as a server for your other devices.

This tutorial is applicable to Knot Resolver version 2.1.0 and newer on Fedora Linux 27\. This tutorial will be updated to cover Debian 10 “Buster” and Ubuntu 18.04 “Bionic Beaver” in the future as packaging issues makes it more difficult to set up Knot Resolver on these distributions.

This tutorial is split in two sections: The first part deals with getting the service up and running for the local system, and how to enable it as a service for other systems on your network. You’ll have a fully working caching DNS server by following the first section. The second section goes more into details on configuration to enable some of Knot Resolver’s more advanced features.

### Installing and starting Knot Resolver

Knot Resolver works out of the box with all the basic features without any configuration. I’ll get back to enabling some of the more interesting features of Knot Resolver in a later section of the tutorial.

Start by installing the `knot-resolver` package from your distribution’s package repository using your favorite package manager, e.g. `apt` or `dnf`. This tutorial assumes you’ll be installing version 2.1.0 or later.

There’s just one step to get the service up and running: enable and start an instance of the service using the following command:

```shell
systemctl enable --now kresd@1.service
```

You can then immediately start using Knot Resolver on your local system. However, you must first ensure no other process is managing the `/etc/resolv.conf` configuration file before proceeding. Please read my extensive [tutorial on taking manual control over the DNS configuration on Linux](https://www.ctrl.blog/entry/resolvconf-tutorial/) for details. Follow the instructions for configuring `/etc/resolv.conf` to use a DNS resolver running on `localhost` in the last section of that tutorial to use your Knot Resolver instance.

### Allowing remote connections

By default, Knot Resolver will only allow connections from the local system. This is useful if you intend to use it as a caching server for a single device. However, you’ll get the best performance by sharing the same DNS cache between all the devices in your network. It can also be beneficial to also setup local caches on laptops and devices that roam between different networks.

**Update** (2020-06-26): This section previously discussed how to manage Knot’s systemd activated socket (`kresd.socket`.) However, that has been deprecated since Knot Resovler version 5 and has been removed from the tutorial. The tutorial has been updated to include new instructions.

You must configure a new `net.listen` directive and specify the IP address you want Knot to listen to incoming connections on. Open up `/etc/knot-resolver/kresd.conf` in your favorite editor and include the following configuration. Adjust the IP to the server’s LAN or WAN address depending on which networks you want it to accept DNS queries from.

```lua
-- listen to local connections
net.listen(net.lo, 53)
-- listen to connections on this IP
net.listen('198.51.100.1', 53)
```

The last step required is to poke a hole in your firewall for incoming connections. The below are example commands that create permissive rules with FirewallD or UFW. You should adjust these to only allow connections from your local network unless you want Knot Resolver to be available on the public internet.

```shell
# Add DNS to default FirewallD zone (CentOS, Fedora Linux)
firewallctl zone "" --permanent add service "domain"

# Add DNS to (Ubuntu)
ufw allow "domain"
```

### Tweaking the default configuration

You can find extensive documentation on optional modules and their configuration in [Knot Resolver Modules documentation.](https://knot-resolver.readthedocs.io/en/stable/config-overview.html?ref=ctrl.blog#modules)

If you don’t want to read through all that documentation; I’ll suggest a configuration that improves reliance, improves security and performances, and improves compatibility.

Open up `/etc/knot-resolver/kresd.conf` in your favorite editor and include the following configuration:

```lua
-- SPDX-License-Identifier: CC0-1.0

-- Enable optional modules
modules = {
  'policy',
  'hints',
  'serve_stale < cache',
  'workarounds < iterate',
  'stats',
  'predict'
}

-- Forward queries to Quad9
policy.add(policy.all(policy.FORWARD({'9.9.9.9', '2620:fe::fe', '149.112.112.112'})))

-- Cache size
cache.size = 150 * MB

-- Prefetch learning (20-minute blocks over 24 hours)
predict.config(20, 72)

-- Enable DNSSEC validation
trust_anchors.file = '/etc/knot-resolver/root.keys'
```

Most of the above configuration is straightforward, but I’ll explain what the configuration changes do in more details.

The first set of changes load some additional modules in a specific order to enable additional features. For example, the `workarounds` module is loaded before the core `iterate` module. The `workarounds` module contains a set of hotfixes to ensure compatibility with DNS servers with known compatibility problems with modern DNS standards.

The `policy` module can be used to manipulate request handling. I’ve set uncached requests to be forwarded to the IPv4 and IPv6 addresses of [Quad9](https://www.quad9.net/?ref=ctrl.blog). Quad9 is a security-enhanced public DNS server that proactively blocks domains used to communicate with botnet and other malicious activity that promises to not log any requests from users. Quad9 will act as an intermediary caching proxy which will significantly improve performance of most DNS queries. If you remove this directive, Knot Resolver will have to resolve the whole DNS chain from the root servers and down to the queried domain’s DNS servers. This is significantly slower than using an intermediary caching provider.

The `serve_stale` module allows expired entries to be served from the cache for some additional time when the upstream DNS server is unable to respond to queries. This can help mitigate the impact on you with regards to the websites you visit the most during a large scale distributed denial of service (DDoS) attack against critical DNS infrastructure (as we’ve witnessed again and again in recent years.)

The `stats` and `predict` modules work together to identify usage patterns and preemptively refresh expired queries from the cache. We all have patterns for when in the day we check our email and specific websites. So too do many of the internet-of-things devices we have in our homes. Knot Resolver may end up sending some unnecessary requests for this feature to work. However, in my experience its quite good at deciding which domains it should keep up-to-date in its cache and when it should stop updating domains I no longer visit.

Lastly, Knot Resolver is configured to validate DNSSEC. Domain owners can cryptographically sign their domains in a way that a validating resolver (such as Knot Resolver) can ensure that a third-party hasn’t modified or hijacked the domain. In Fedora Linux, this just requires this line to be present.

### Encrypt external DNS requests

All your DNS requests traditionally leave your network unencrypted, allowing for someone with the ability to intercept your network traffic to see what domains you’re accessing. You can encrypt this traffic with TLS with some additional configuration.

Note that not many DNS providers support TLS yet. You can replace the example forwarding configuration used above with the following configuration to use DNS over TLS from Quad9.

```lua
-- SPDX-License-Identifier: CC0-1.0

-- Forward queries encrypted to Quad9 over TLS
policy.add(policy.all(policy.TLS_FORWARD({
  {'9.9.9.9', hostname='dns.quad9.net', ca_file='/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem'},
  {'2620:fe::fe', hostname='dns.quad9.net', ca_file='/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem'},
  {'149.112.112.112', hostname='dns.quad9.net', ca_file='/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem'}
})))
```

The certificate bundle used in the configuration contains the same root certificates as your web browser trusts. You can install the bundle by installing the `ca-certificates` package from your package repository (it should be present on most systems by default, however.)

#### Sources

- [systemd.socket man page](https://www.freedesktop.org/software/systemd/man/systemd.socket.html?ref=ctrl.blog), version 238, 2018-03-05, systemd project, FreeDesktop.org
- [Knot DNS Resolver daemon](https://knot-resolver.readthedocs.io/en/v2.1.1/daemon.html?ref=ctrl.blog), version 2.1.1, 2018-02-23, Knot Resolver documentation, CZ.NIC labs, Read the Docs
- [Knot DNS Resolver modules](https://knot-resolver.readthedocs.io/en/v2.1.1/modules.html?ref=ctrl.blog), version 2.1.1, 2018-02-23, Knot Resolver documentation, CZ.NIC labs, Read the Docs
- [kresd.systemd.7 man page](https://gitlab.labs.nic.cz/knot/knot-resolver/blob/1f9aa9a6237ec9945cae79a62c3b7a24f606c526/doc/kresd.systemd.7?ref=ctrl.blog), revision 1f9aa9a623, 2018-02-09, Knot Resolver repository, Knot projects, CZ.NIC labs
- [Security Audit Report: Knot DNS](https://wiki.mozilla.org/images/0/09/Knot-dns-report.pdf?ref=ctrl.blog), 2018-02-02, Mozilla Secure Open Source Fund, Least Authority, Mozilla
- [Frequently Asked Questions](https://www.quad9.net/support/faq/?ref=ctrl.blog), 2018-02, Quad9
- [Configuring upstream dns forwarders from resolv.conf](https://gitlab.labs.nic.cz/knot/knot-resolver/-/wikis/-Configuring-upstream-DNS-forwarders-from-resolv.conf?ref=ctrl.blog), 2017-09-04, Knot Resolver wiki, Knot projects, CZ.NIC labs
- [On binding datagram (UDP) sockets to the ANY addresses](https://blog.powerdns.com/2012/10/08/on-binding-datagram-udp-sockets-to-the-any-addresses?ref=ctrl.blog), 2012-10-08, Bert Hubert, PowerDNS Technical Blog, PowerDNS
- [Use of Bit 0x20 in DNS Labels to Improve Transaction Identity](https://datatracker.ietf.org/doc/html/draft-vixie-dnsext-dns0x20-00?ref=ctrl.blog), 2008-03-17, David Dagon and Paul Vixie, DNSOP Working Group, Internet Engineering Task Force
### Top 15 Roomba names
URL: https://www.ctrl.blog/entry/popular-roomba-names/
Last updated: 2026-08-23T22:15:50.000Z
Almost everyone keep the default “Roomba” name for their Wi-Fi connected vacuum cleaning robots. However, many also give their Roomba a proper name. Here are some fun ideas and inspiration based on iRobots’ top list of the most popular Roomba names.

It’s hard not to anthropomorphize your robotic vacuum cleaner like its the new household pet. It can be kind of cute when it’s whizzing around on your floors and gently bump into things.

Whether you’ve got a smart or a rather stupid model of robot vacuum cleaner, you’ll want to give it a good solid name of its own. You’ll probably want to give it a fun and meaningful name too.

The following is a list of the 15 most popular names given to Wi-Fi connected Roomba models vacuum cleaners, according to data collected via the iRobot Home app for Android and iOS.

1. **Roomba**  
The default name. Call a spade a spade.
2. **Rosie**  
After the robotic housemaid from the 1960’s TV show *The Jetsons*.
3. **Alice**  
After the maid in The Brady Bunch, or an early-2000’s chatbot capable of responding to many queries, or a programmable microbot from the same era.
4. **Hazel**  
After a popular 1940’s comic strip about a maid, or the 1960’s TV show based on it.
5. **Alfred**  
After Batman’s trusted butler and father-figure.
6. **DJ Roomba**  
After an actual Roomba that appeared on the 2010’s TV show *Parks and Recreation*.
7. **Wall-E**  
After a beloved Disney character commissioned to clean the entire planet Earth in the movie of the same name.
8. **Ruby**  
Possibly after a chatbot known as Agent Ruby, or the slightly useless maid in the 1970’s British TV show *Upstairs, Downstairs*.
9. **R2D2**  
After Anakin Skywalker’s astromech droid in the *Star Wars* movie series.
10. **Robbie**  
After the clunky robotic character in the 1950’s movie *Forbidden Planet*.
11. **Dusty**  
A very utilitarian name.
12. **Bob**
13. **Jeeves**  
After the arch-British valet of the *Jeeves & Wooster* books, or one of several characters based on Jeeves — like the Ask Jeeves search engine’s butler figurehead, “the perfect gentleman robot butler” from the videogame *World of WarCraft*, or perhaps Hugh Laurie’s Jeeves from the 1990’s British TV show based on the books.
14. **Maria**  
After either or both the heroine or the False Maria robot in the 1920’s movie *Metropolis*.
15. **Rhonda**  
After a robotic character in the videogame *Fallout*.

There are some really good Roomba names on this list! People clearly like to name their robotic aid after beloved maids and butlers in pop-culture and after science fiction robots.

I’d expected people to choose funnier names and more puns for their Roombas. Although, none of the obvious ones have made it onto the iRobot list.

If you’re looking for more robot vacuum name suggestions, here’s my list of names that I’ve given to my robot vacuum cleaners over the years:

- **Skippy**  
After Skippy The Magnificent, the artificial intelligence housed in a shiny beer can in Craig Alason’s *Expeditionary Force* series of books.
- **CL4P-TP**  
After the annoying little robot in the *Borderlands* videogame series.
- **Dustin Bieber**  
A pun based after a Canadian musician.
- **Niles**  
After the sardonic butler in the 1990’s TV show *The Nanny*.
- **Zero Credibility**  
After an artificial intelligence in *The Culture* novels.

#### Sources

- [Replying to @ChelseaKane](https://twitter.com/iRobot/status/947927144868532225?ref=ctrl.blog), 2018-01-01, iRobot, Twitter
- Roomba 15th Anniversary flyer, 2017-09-08, iRobot
- Cultural references from Wikipedia articles ranked by Google. #badjournalism

Feature photo based on a promotional photo by © 2016 iRobot.
### Certbot certificate renewals through a NAT+UPnP router
URL: https://www.ctrl.blog/entry/upnpc-certbot/
Last updated: 2026-08-23T22:23:45.000Z
Here is a quick tip for self-hosting enthusiasts who host their own services behind a NAT router for temporary allowing redirection/forwarding of ports required for Let’s Encrypt certificate issuance and renewals using UPnP.

You may be using a free-of-charge certificate from Let’s Encrypt for use with your email, chat, or other server that uses TLS on your domain but that isn’t normally web accessible. One of the ways you can obtain a certificate from Let’s Encrypt is by demonstrating that you’ve control over the `A` and `AAAA` domain records (IPv4 and IPv6) on port 80 and 443.

You can temporarily create port forwarding rules on your router to forward these port from the internet to the computer in question. Certificates from Let’s Encrypt has to be renewed every three months, so you’ll either have to leave the computer that requires certificate permanently exposed to the internet or come up with a better solution. This doesn’t scale if you’ve more than one computer you’d like to issue certificates for, or if you use a game console like the PlayStation 4 or Xbox One that temporarily wants control over port 80 for online multiplayer purposes.

Luckily, you can remote-control the port redirection/forwarding rules of most routers to create temporary rule-sets using the UPnP protocol. I’m assuming that your router has UPnP support, as almost all routers sold in the last decade has UPnP support enabled by default. You may need to double-check your router configuration to check whether you run in to any issues. The article assumes you’ll be using UPnP to renew certificates from Let’s Encrypt, but you can use it as a basis for anything that needs you to temporarily open a port on your router.

You’ll need to install the `upnpc` client program, which you’ll find in the package repository of most Linux distributions under the name `miniupnpc`. After you’ve installed it you need to create a simple script that requests the ports you need through UPnP, performs the certificate renewal, and then releases the ports again. The following example script should do the job in most cases:

```shell
# Add temporary port redirection
upnpc -e "Certbot" -r 80 80 tcp
upnpc -e "Certbot" -r 443 443 tcp

# Update certificates with Certbot
certbot renew

# Remove port redirection
upnpc -d 80 tcp
upnpc -d 443 tcp
```

You’ll likely need to adjust the firewall on your server to temporarily allow incoming connections on port 80 and 443 as well. The following two examples shows the commands for adding and removing firewall rules for two popular front-ends to the Linux `iptables` firewall:

```shell
firewallctl zone "" add service "http" "https"
firewallctl zone "" remove service "http" "https"
```

FirewallD (Fedora Linux)

 / 

Uncomplicated Firewall (Ubuntu)

Adjust your UPnP port redirecting script to include the firewall rules you need. Include the command for adding the rule before `certbot renew` and the command for removing it below it.

Save your script to a file, make it executable, and run it every week through `cron` or another task scheduler program.

Please note that some routers may not let you redirect privileged ports (ports below 1024.) There may be an option you can toggle for this in your router’s administration interface. Some router firmware, like MikroTik RouterOS may not let you redirect [ports used on the internal network for administrative interface services](https://www.ctrl.blog/entry/routeros-upnpc-tcp80/) like port 80 and 443\. Documentation around UPnP capabilities and limitation is usually hard to come by, so you’ll just have to try to experiment on your if you run into any issues.

#### Sources

- [upnpc.c](https://github.com/miniupnp/miniupnp/blob/ce2673118defd31ddf41420ffbdce9b4ea027892/miniupnpc/upnpc.c?ref=ctrl.blog#L644-L668), commit ce2673118d, 2018-02-22, miniupnp repository, GitHub
- [Renewing certificates](https://eff-certbot.readthedocs.io/en/stable/using.html?ref=ctrl.blog#renewing-certificates), 2017, User Guide, Certbot, Electronic Frontier Foundation
### How to allow UPnP port mapping of 80 or 443 on MikroTik RouterOS
URL: https://www.ctrl.blog/entry/routeros-upnpc-tcp80/
Last updated: 2026-08-23T22:21:23.000Z
Here is a quick tip for MikroTik router owners on how to configure MikroTik RouterOS to allow UPnP to map local devices to privileged ports including TCP/80 (HTTP) and TCP/443 (HTTPS) on an external interface.

Some game consoles including the PlayStation 4 and Xbox One sometimes need to redirect/forward port 80 and 443 from the public internet to the console for some online multiplayer functions. Being able to temporarily redirect port 80 can also be useful for other tools like when you need to demonstrate control over port 80 to be issued an encryption certificate by Let’s Encrypt.

RouterOS doesn’t distinguish between privileges (ports below 1024) and unprivileged ports (ports including and above 1024), yet you’ll find that UPnP won’t be able to map port 80 which can result in degraded online gaming experiences. You’ll get the following error message if you fire up `upnpc` to manually test port redirection:

failed with code 729 (UnknownError)
GetSpecificPortMappingEntry() failed with code 714 (NoSuchEntryInArray)

Depending on your configuration, you may have the same problem with other ports including 22 (SSH), 23 (telnet), 80 (http), and 443 (https) as well as 8701, 8729, and 8291\. By seeing all the affected ports together in a list, you may have recognize them as the ports for the various administrative interfaces available on RouterOS.

These administrative and unmappable ports don’t show up in the firewall or NAT overviews in any of RouterOS’ administrative interfaces. You can manually setup a port redirection from port 80 on WAN to any device on your LAN side. Yet, the UPnP server in RouterOS will fail to redirect any of the ports that are used by a service on the router.

There are a few different options you can try to work around these limitations and allow these ports to be redirected with UPnP:

1. Move the affected service from its default port to another port.
2. Disable the service that blocks the port you want to use.
3. Manually configure port redirection to a specific device in NAT.

You can change service port assignments or disable services in RouterOS from IP: Services, or configure port redirection from IP: Firewall: NAT. You’ll find the exact details on how you can apply these changes in the [RouterOS manual](https://wiki.mikrotik.com/wiki/Manual:TOC?ref=ctrl.blog#IP).

RouterOS is a small business/enthusiast network solution, yet you can’t restrict it from redirecting privileged ports (ports below 1024.) It also fails to redirect some ports without giving you any clear indication of why it can’t perform the redirection the client asked for. There’s no log message or any other indication about the problem.

The ability to redirect port 80 with UPnP is one of those things that set routers apart but its also nearly impossible to dig up any information on this ability before you purchase the router and can test for yourself.

#### Sources

- [IP/Services](https://wiki.mikrotik.com/index.php?title=Manual:IP/Services&oldid=29785&ref=ctrl.blog), revision 29785, 2017-09-15, RouterOS Manual, Documentation wiki, MikroTik
### Vilfo VPN router review: Conclusions – Part 4:4
URL: https://www.ctrl.blog/entry/vilfo-review-p4-conclusions/
Last updated: 2026-08-23T22:24:05.000Z
**Sponsored:** Vilfo provided the product for free. It had no editorial control of this review.

Who needs a VPN router for their homes anyway?

This is part four in a series on the Vilfo router.

1. Part 1 [Overview, setup, and hardware](https://www.ctrl.blog/entry/vilfo-review-p1-overview/)
2. Part 2 [Vilfo as a Wi-Fi access point](https://www.ctrl.blog/entry/vilfo-review-p2-wifi/)
3. Part 3 [Not designed for security or privacy](https://www.ctrl.blog/entry/vilfo-review-p3-security/)
4. Part 4 Conclusions

Vilfo sent me a review unit in the middle of March 2018 and they expect shipping to begin in April 2018. While some of the issues I highlight throughout this review may be excused as “beta-quality bugs”, the overall impression is that it’s nowhere near ready.

Spotty-to-unusable Wi-Fi weeks before release shows that there’s much left to do on the Vilfo. I’d also expect customers will be confused and upset when they take home their new 430 USD router and it can’t do 2,4 GHz and 5 GHz Wi-Fi simultaneously. It’s something people should rightfully expect to just work.

The security flaws I found in the Vilfo would have been *inexcusable* in your average router firmware. To find these type of issues and design flaws in a product designed for enhanced privacy and security is alarming.

The router fails to deliver a reliable way to bypass geographical blocking because of the way DNS is configured. It also fails to deliver real privacy; not only because of the way DNS is configured — but because it shares information about you and your network with third-party companies.

The use of third-party trackers and built-in customer support chat function in the web administration interface clearly shows that the Vilfo isn’t built for the privacy conscious. But seriously: who other than a security or privacy minded customer would be buying a VPN gateway for their homes?

Vilfo is a 5-person company, yet they expect to staff a live chat customer support system built-in to the product in all time zones? That level of service costs. A lot. It might help explain the disparity between the Vilfo’s 430 USD price tag and the 185 USD retail cost for its components.

You can get a generic VPN-capable Wi-Fi router for as cheap as 20 USD. Vilfo’s raw performance is better, but I doubt it’s 409 USD better.

I unfortunately didn’t have enough time with the Vilfo to run performance benchmarks or look too closely at its main VPN features. Vilfo wanted their router back “as soon as possible” when I started raising concerns over security and privacy issues and the crashing Wi-Fi drivers.

**Update** (2019-10-06): Vilfo have published [a reply to my review](https://www.vilfo.com/ctrlblog?ref=ctrl.blog).

**Reviewed:** [VPN Router](https://www.vilfo.com/?ref=ctrl.blog)

**Review rating:** 4 / 10
### Vilfo review: Not designed for security or privacy – Part 3:4
URL: https://www.ctrl.blog/entry/vilfo-review-p3-security/
Last updated: 2026-08-23T22:24:04.000Z
**Sponsored:** Vilfo provided the product for free but. It had no editorial control of this review.

The Vilfo VPN router is built by a Swedish company and is going on the market just a month before the General Data Protection Regulation (GDPR) comes into effect. Anyone buying a VPN gateway for their house would be a bit extra cautious about their security and privacy. In this context, I took a look at how the Vilfo would fare in terms of device security and privacy. The results were not encouraging.

This is part three in a series on the Vilfo router.

1. Part 1 [Overview, setup, and hardware](https://www.ctrl.blog/entry/vilfo-review-p1-overview/)
2. Part 2 [Vilfo as a Wi-Fi access point](https://www.ctrl.blog/entry/vilfo-review-p2-wifi/)
3. Part 3 Not designed for security or privacy
4. Part 4 [Conclusions](https://www.ctrl.blog/entry/vilfo-review-p4-conclusions/)

I’m disclosing these security vulnerabilities before the customary 90-day disclosure window as I’m *not putting anyone at risk.* The product has yet to be released with shipping to customers not expected to begin until April 2018. (I received a review unit sent to online publications in the two weeks before April.)

### Broadcasting passwords to your neighbors

Vilfo doesn’t come with a default password for the WiFi, so the initial setup process in Vilfo’s web administration interface happens over HTTP on an unencrypted Wi-Fi connection that’s literally broadcast in the clear to your neighborhood.

You’re required to input a lot of information in the web administration interface before you get the option to enable encryption on the connection. At the very least, you must provide the following: a unique license key for Vilfo, your **email address**, your **username and password for at least one predefined VPN service provider**, your desired username and administrative **(root) password** for the router, and at the end you also input your desired Wi-Fi name and **password**. All of this information is transmitted in clear-text and can trivially be collected by nearby devices.

Most (if not all) consumer wireless access point equipment will come from the factory with a default password, usually unique to the device which will be printed on a sticker on the device. This ensures the device can only be administrated and setup by someone with physical access to the device.

### Trivial privilege escalation

The root password is stored in a file called /etc/vilfo/.env. This file has no access restrictions and can be read by any system user or anyone who gains access to the system. This file is read into the system environment and is made available as an environmental variable called LEDE\_PASSWORD.

The password in the file and variable is stored as a base64-encoded string. This isn’t a secure and irreversible cryptographic hash function, but a trivially reversed data encoding format that yields the root password in plain-text.

This makes it trivial for anyone who gains access to the system to escalate to root privileges.

This isn’t an oversight either: it was designed to work this way. There are even unit tests included as part of the web interface to verify that the root password is decodable to plain text.

### Relaxed security policies

Any system user can read and modify any saved VPN profiles including usernames and password. These entries are stored in files that can be read or modified by any system user.

Administration services like secure-shell (SSH) access and the Vilfo web administration interface are bound to every network interface including the WAN port that exposed to the internet. Access to the service is controlled exclusively through the firewall. If an attacker finds a way around the firewall, they’ll find the administrative interfaces ready and waiting for them.

With a layered approach to security, file access permissions would be as tight as they could be made — all services would be bound exclusively to the LAN network interfaces were they’re expected to be available. There doesn’t appear to have been made any attempts at hardening the security of the firmware.

### Web interface shares a lot of data with third-parties

The Vilfo router doesn’t yet have a privacy policy. However, it sure does collect and share a lot of data with its partners.

First of all, the web administration interface includes Google Analytics, an online solution that collects data about your online behavior and how you interact with an app or website. The collected data includes all the MAC addresses on your local network, which would be considered personal data under the General Data Protection Regulation (GDPR). It’s also a violation of Google Analytics’ own Terms of Service to collect this type of data on users through the service.

The web interface also includes a live chat support interface from a company called Intercom. The chat system lets you chat with Vilfo’s support staff. This sounds like a neat but pretty flawed idea. You’d most likely only want to chat with customer support when the network or your internet connection isn’t working. In these situations, the live-chat system would simply not be available.

Intercom also collects data about what you do inside the web administration panel, plus, of course, any information you type in to the chat system.

### Shares diagnostic data (including passwords) with Intercom

You can choose to submit diagnostic data to Vilfo via the web administration interface. There’s no notice in the web interface indicating that Vilfo will be able to contact you regarding your submitted diagnostic data, yet the data includes the email address you provided during the initial setup process.

The diagnostic data contains a dump of your router configuration that includes the MAC address of every device that have been observed on your network in the last four months plus **behavioral data collected about each device**, your **email address**, the **password to your wireless network**, and information about your VPN usage. This is waaay more information than Vilfo should be collecting let alone sharing with a third-party service provider.

The diagnostic data is sent to Intercom, the company behind the live chat support feature inside the web administration interface. Their privacy policy on data collected about people clearly indicates that they **use your email address to profile you** by sharing your email address with and collecting data from other third-party companies.

> “The Services use third-party services provided by FullContact, Inc. (“FullContact”) to enable you to retrieve publicly-available information about People including without limitation social media information, profile information, gender, company, job titles, photos, physical addresses, and website URLs based on People’s email addresses input into the Services.”

Privacy Policy, Intercom

### Shares data about your browsing habits with OPVN Integritet

The Vilfo router and company is an offshoot from the Swedish VPN service provider OVPN Integritet. A DNS service is the system that turn domain names in to the actual Internet Protocol addresses computers use to talk to each other. OVPN Integritet offers a free DNS service to the public.

The Vilfo router by default uses DNS services from OVPN Integritet rather than picking them up from your network or Internet Service provider over a protocol called DHCP.

All of your devices asks OPVN Integritet about the addresses to every website you visit regardless of whether you use no VPN, their VPN service, or another VPN service entirely. Your DNS data includes a lot of potential personal data as well as behavioral data, if it were collected by the DNS server.

OPVN Integritet’s DNS service isn’t covered by OPVN Integritet’s privacy policy; so it’s hard to say whether they collect any data though your use of the service or not.

### Leaks DNS outside the VPN

The router runs a caching DNS server (dnsmasq) which greatly helps improve DNS responsiveness. Every device on the network is auto-configured to use the router as their DNS server through DHCP.

The same DNS server is shared among all VPN connections. This means that all VPN connections end up using the same DNS responses. This causes issues for services like GeoDNS — geographically targeted DNS responses — as you’ll get the same response/location regardless of where in the world the tunneled connection appear. This reduces the router’s ability to bypass geographical restrictions, and probably lowers the device’s value to many potential customers.

The caching DNS server runs on the router itself. Vilfo doesn’t allow you to forward traffic originating on the router through a VPN. So, all DNS lookups from all devices on your network will be routed outside the VPN connections; meaning they’ll be exposed unencrypted as originating from your IP address to your ISP and any other intermediaries. This effectively exposes information about which domains you visit over VPN.

Advertisement: You can test your VPN setup using an automated [DNS Leak Test](https://dnsleak.com/r/ctrl?ref=ctrl.blog).

Ouch. Continue to [Part 4: Conclusions](https://www.ctrl.blog/entry/vilfo-review-p4-conclusions/).

#### Sources

- [Privacy Policy](https://web.archive.org/web/20180315233332/https://www.ovpn.com/en/privacypolicy), 2018-03-15, OVPN, OVPN Integritet
- Vilfo firmware version 2018031201, 2018-03-12, based on LEDE Reboot 17.01.4, with custom kernel and Wi-Fi drivers
- [Privacy Policy](https://web.archive.org/web/20170904125230/https://www.intercom.com/terms-and-policies%23privacy), 2017-07-20, Intercom
- [Google Analytics Terms of Service](https://web.archive.org/web/20160527181723/http://www.google.com/analytics/terms/us.html), 2016-05-24, Google Analytics, Google

**Reviewed:** [VPN Router](https://www.vilfo.com/?ref=ctrl.blog)

**Review rating:** 4 / 10
### Vilfo VPN router review: Vilfo as a Wi-Fi access point – Part 2:4
URL: https://www.ctrl.blog/entry/vilfo-review-p2-wifi/
Last updated: 2026-08-23T22:24:04.000Z
**Sponsored:** Vilfo provided the product for free. It had no editorial control of this review.

The Vilfo VPN router has some support for Wi-Fi, but is it any good as a Wi-Fi router?

This is part two in a series on the Vilfo router.

1. Part 1 [Overview, setup, and hardware](https://www.ctrl.blog/entry/vilfo-review-p1-overview/)
2. Part 2 Vilfo as a Wi-Fi access point
3. Part 3 [Not designed for security or privacy](https://www.ctrl.blog/entry/vilfo-review-p3-security/)
4. Part 4 [Conclusions](https://www.ctrl.blog/entry/vilfo-review-p4-conclusions/)

Vilfo uses the MediaTek MT7612E Wi-Fi module. It’s found in a few well-reviewed routers, but there are significant design differences in *all* other routers with this Wi-Fi module and the Vilfo.

Vilfo only supports one 5 GHz or one 2,4 GHz network; it can’t do both at the same time. Every other Wi-Fi router pairs the MT7612E with a secondary Wi-Fi module so that one can handle the 2,4 GHz network and the other can handle the 5 GHz network.

With Vilfo, you must decide whether you want to use the latest Wi-Fi technologies and get the fastest theoretical speeds, or be compatible with lower-end and legacy devices.

The Vilfo website lists the following feature:

> “Vilfo will support 802.11ac”

802.11ac is the latest and fastest Wi-Fi technology. However, what does ”support 802.11ac” mean? The *big deal* with 802.11ac is support for up to eight simultaneous input–output streams between multiple devices (MU-MIMO) at speeds up to 1,69 GBit/s.

Vilfo is only designed for a two-transmitting–two-receiving antennas (2T2R) array. This limits the theoretical max speeds of 867 MBit/s to one double-antenna device at a time, or 433 MBit/s to two single-antenna devices simultaneously. When not acting as a VPN gateway, the Vilfo can max out my 250 MBps internet connection over Wi-Fi under ideal conditions.

I was unfortunately not able to perform any real performance tests as the review unit I received **didn’t have working 802.11ac** at all. The wireless network driver kept crashing after a few seconds of communicating with any device over 802.11ac. This caused the Vilfo to stop transmitting or receiving anything over Wi-Fi for several minutes before the Wi-Fi module was automatically restarted by the kernel.

I could get the router working more reliably by forcing client devices to use the older 802.11a standard. Vilfo would still go radio silent after a few minutes of use, however.

This may have been an issue specific to the review unit. I discussed the issue with the vilfo team, and they said they’d never experienced this issue before. It’s a bit worrying that they’re having this type of issues so close to release.

You should expect to get a dual-frequency capable (2,4 GHz and 5 GHz simultaneously) with support for more simultaneous channels from a 430 USD router. The Vilfo is quite unimpressive as a Wi-Fi access point. The router would be better as a Ethernet-only device as it wouldn’t give people the impression that it’s usable as a Wi-Fi access point.

You can get higher speeds and better support for more devices from any generic cheap Wi-Fi access point. An unmanaged Wi-Fi access point plugged into one the Vilfo’s LAN ports will get you higher speeds and better device compatibility for 100–150 USD.

Continue to [Part 3: Not designed for security or privacy](https://www.ctrl.blog/entry/vilfo-review-p3-security/).

#### Sources

- [Devices with MT7612E](https://web.archive.org/web/20190508032841/https://wikidevi.com/w/index.php?title=Special:Ask&x=-3Cq-3E-20-3Cq-3E-5B-5BWI1-20chip1-20model%3A%3AMT7612E-5D-5D-3C-2Fq-3E-20-20OR-20-20-3Cq-3E-5B-5BWI2-20chip1-20model%3A%3AMT7612E-5D-5D-3C-2Fq-3E-20-3C-2Fq-3E%2F-3FEmbedded-20system-20type%3DType%2F-3FFCC-20ID%2F-3FCPU1-20model%3DCPU1%2F-3FCPU2-20model%3DCPU2%2F-3FWI1-20chip1-20model%3DWI1-20chip1%2F-3FWI1-20MIMO-20config%3DWI1-20MIMO%2F-3FWI2-20chip1-20model%3DWI2-20chip1%2F-3FWI2-20MIMO-20config%3DWI2-20MIMO%2F-3FSupported-20802dot11-20protocols%3DPHY-20modes%2F-3FEstimated-20year-20of-20release%3DEst.-20year&format=broadtable&limit=500&link=all&headers=show&searchlabel=%E2%80%A6%20further%20results&class=sortable%20wikitable%20smwtable&offset=&mainlabel=), 2018-03, WikiDevi
- [MT7612E](https://www.mediatek.com/products/broadband-wifi/mt7612e?ref=ctrl.blog), 2013, Wi-Fi Products, MediaTek

**Reviewed:** [VPN Router](https://www.vilfo.com/?ref=ctrl.blog)

**Review rating:** 4 / 10
### Vilfo VPN router review: Overview and hardware – Part 1:4
URL: https://www.ctrl.blog/entry/vilfo-review-p1-overview/
Last updated: 2026-08-23T22:24:03.000Z
**Sponsored:** Vilfo provided the product for free. It had no editorial control of this review.

[Vilfo](https://www.vilfo.com/?ref=ctrl.blog) is an upcoming VPN client gateway intended for home users to shield their activities from their internet service provider. It’s much more powerful (and expensive) than your average VPN capable home router, but is powerful hardware all it takes to make a good VPN gateway?

This review is divided into four parts.

1. Part 1 Overview, setup, and hardware
2. Part 2 [Vilfo as a Wi-Fi access point](https://www.ctrl.blog/entry/vilfo-review-p2-wifi/)
3. Part 3 [Not designed for security or privacy](https://www.ctrl.blog/entry/vilfo-review-p3-security/)
4. Part 4 [Conclusions](https://www.ctrl.blog/entry/vilfo-review-p4-conclusions/)

### What is the Vilfo?

Vilfo is a powerful 430 USD network router using mini-PC hardware rather than the traditional barely-enough processing power you can expect from a traditional router. Vilfo envisions you’ll use this extra processing power to encrypt all your traffic and tunnel it through to a remote virtual private network (VPN) provider.

> “Protect your home with a VPN router”

Vilfo website

I’m somewhat unclear on what exactly the Vilfo is designed to *protect* against. A VPN service provider won’t make you anonymous on the web; it merely shifts were your traffic emerges from your home to a server farm somewhere else in the world. A VPN service is most useful when you access the web from an untrusted network (such as a café Wi-Fi network) and don’t want other people on the same network to see your internet traffic. Vilfo does however suggest some use cases for home users:

> “Browse safely online, access blocked content overseas & setup your favourite VPN provider in seconds”

Vilfo crowd-funding campaign, Indiegogo

It’s intended to be used to bypass geographical restrictions on digital content (something the European Union is already [working to abolish](https://euobserver.com/digital/139964?ref=ctrl.blog)). However, design flaws make it unsuitable for the task. Vilfo leaks information about the domains you visit, and it certainly isn’t designed for security or privacy. I cover this in much more detail in [Part 3](https://www.ctrl.blog/entry/vilfo-review-p3-security/).

### Software

Vilfo is based on the open-source Linux-based [OpenWRT](https://openwrt.org/?ref=ctrl.blog) (actually LEDE Project which has since merged with OpenWRT) with a custom web administrative interface on top that focuses on configuring and selling VPN services. OpenWRT is a solid base for any network router, and they can be a great template for developing a commercial product.

The initial setup requires you to connect to the Vilfo over a password-less Wi-Fi connection, and type in the router’s IP address in your browser. You then wait for a minute or two on a empty page with a progress spinner before you’re guided through the setup process. [Part 3](https://www.ctrl.blog/entry/vilfo-review-p3-security/) goes into detail on security issues with this process.

I’d like to take a minute to note that the Vilfo isn’t suited for anyone who needs to use any assistive technologies like a screen reader. The first page has you waiting for one minute on an entirely blank page with no feedback what so ever. This frustrating and confusing experience is representative for the Vilfo web interface as a whole. A sighted person with all senses in order won’t have any problems using the Vilfo, but its not at all optimized for assistive technologies.

The web interface is easier to use than most home routers I’ve encountered. It sacrifices features and focus on its strengths: being a simple router and an easy-to-configure VPN gateway. This may sound complex, but Vilfo makes it relatively easy.

The web administration interface could have benefited from being more task-oriented as its not always clear what you need to do next. You can chat with the Vilfo support staff right from the web administration interface; which raises some privacy issues I cover in [Part 3](https://www.ctrl.blog/entry/vilfo-review-p3-security/).

Vilfo also features some pretty graphs to give you insights on the devices that connect to your network.

Vilfo let you group devices on your network (by MAC address) and assign each device group to a VPN provider, or different server farm location from the same provider. You can set up multiple VPN providers and route different devices to different providers. This isn’t a unique feature, but Vilfo certainly has made it much easier to do than your average router.

### Hardware

Unlike most routers, the Vilfo VPN router is a regular mini-PC in a box. It even has an HDMI port and USB so you can plugin a screen, and keyboard and mice to re-purpose it as a mini-computer. If you pop open the cover, you’ll even find a few internal extension ports and a SD-card reader.

Specifically, you’ll find a Qotom Q310G4-4 board with an Intel Celeron 3215U processor, 2 GiB of RAM, a 16 GB SSD, and a single MediaTek MT7612E Wi-Fi module. While the processor is remarkable, the Wi-Fi leaves a lot to be desired. I’ll get back to the Wi-Fi in much greater detail in [Part 2: As a Wi-Fi access point](https://www.ctrl.blog/entry/vilfo-review-p2-wifi/).

As a standard PC the Vilfo uses standard PC components; which you could technically upgrade if the need arise. The SSD is a standard PCI Express, and the Wi-Fi module is a standard PCI Express half-length card. (There’s room for two full-length PCI Express cards.)

You can get the same Qotom Q310G4-4 with an Atheros AR9287 Wi-Fi module, a 32 GB SSD, and a heat dissipating black aluminum chassis pre-installed with [pfSense](https://www.pfsense.org/?ref=ctrl.blog) (a FreeBSD based router operating system) direct from Qotom on Amazon or AliExpress retailing at around 185 USD.

Continue to [Part 2: Vilfo as a Wi-Fi access point](https://www.ctrl.blog/entry/vilfo-review-p2-wifi/).

#### Sources

- Vilfo firmware version 2018031201, 2018-03-12, based on LEDE Reboot 17.01.4, with custom kernel and Wi-Fi drivers
- [Payment and delivery](https://web.archive.org/web/20180317163927/https://docs.vilfo.com/pre-order-and-delivery/payment-and-delivery), 2018-03, David Wibergh, Vilfo Docs, Vilfo
- [Vilfo - the most powerful VPN router ever created](https://www.indiegogo.com/projects/vilfo-the-most-powerful-vpn-router-ever-created?ref=ctrl.blog), 2018-03, David Wibergh, Vilfo, Indiegogo
- [EU bans ‘geo-blocking’ — but not (yet) for audiovisual](https://euobserver.com/digital/139964?ref=ctrl.blog), 2017-11-21, Peter Teffer, EUobserver
- [Q310G4 4 LAN Mini PC](https://web.archive.org/web/20180321011316/http://www.qotom.net/goods-127-Q310G4%204%20LAN%20Mini%20PC.html) (Q310G4-P), 2016-02-25, ShenZhen Qotom Technology

**Reviewed:** [VPN Router](https://www.vilfo.com/?ref=ctrl.blog)

**Review rating:** 4 / 10
### How to take back control of /etc/resolv.conf on Linux
URL: https://www.ctrl.blog/entry/resolvconf-tutorial/
Last updated: 2026-08-23T22:17:02.000Z
Several DNS\-related programs want to automatically manage the DNS name server and resolution configuration file at `/etc/resolv.conf`. In some situations, you may want to manage this file yourself. Here is how you identify which programs are automatically managing this file on your Linux distribution, and how you can take back manual control of the file.

There are quite a few different tools that fight to control a Linux system’s DNS resolution configuration file `/etc/resolv.conf` including `netconfig`, `NetworkManager`, `resolvconf`, `rdnssd`, and `systemd-resolved`.

Except for `NetworkManager`, most of these tools are oblivious to each other’s presence which can cause DNS resolution problems. If you simply try to make changes to the file without disabling the managing program, it may overwrite your changes after a few minutes or revert them when you reboot the system.

### Identifying which utility currently controls your `/etc/resolv.conf`

The following command will read the first few lines the `resolv.conf` file, which should include a comment identifying any programs that have automatically taken over management over the file.

```shell
head /etc/resolv.conf
```

Some utilities don’t include a comment in the `resolv.conf` file, but you can identify these programs by checking for symbolic links with the following command:

```shell
ls -l /etc/resolv.conf
```

As a last resort, you can check your init system to see if any of the programs mentioned in this article are running. If you can’t identify any management programs using these methods, chances are you should be in control over the `resolv.conf` file and your system’s DNS resolution.

The next sections will teach you how to disable various programs that automatically manage `resolv.conf`.

### Opting-out of `NetworkManager`

`NetworkManager` is by far the most common auto-configuration tool for the entire networking stack including DNS resolution. It’s responsible for `/etc/resolv.conf` on many popular Linux distributions including Debian and Fedora Linux.

After you’ve disabled all other programs that try to manage `resolv.conf`, you may also discover that `NetworkManager` will jump in to fill the job — as happens on Ubuntu 16.10 and later.

Set the `dns` option in the `main` configuration section to `none` to disable DNS handling in NetworkManager. The below commands sets this option in a new `conf.d/no-dns.conf` configuration file, restarts the NetworkManager service, and deletes the `NetworkManager`\-generated `resolv.conf` file.

```shell
echo -e "[main]\ndns=none" > /etc/NetworkManager/conf.d/no-dns.conf
systemctl restart NetworkManager.service
rm /etc/resolv.conf
```

If you discover that NetworkManager is still managing your `resolv.conf`, then you may have a configuration conflict (usually caused by `dnsmasq`.) Recursively search through your NetworkManager configuration to discover any conflicts.

```shell
grep -ir /etc/NetworkManager/
```

Refer to the last section of this article for instructions on recreating a `/etc/resolv.conf` file with manual configuration

### Opting-out of `netconfig`

You’ll encounter `netconfig` on openSUSE, SUSE, and derivative distributions.

You can disable `netconfig`’s handling of `/etc/resolv.conf` by disabling the `NETCONFIG_DNS_POLICY` option in `/etc/sysconfig/network/config` to an empty string as shown below.

```ini
NETCONFIG_DNS_POLICY=""
```

Afterward, you should delete the `netconfig`\-generated `resolv.conf` file, and reboot the system.

```shell
rm /etc/resolv.conf
reboot
```

Refer to the last section of this article for instructions on recreating a `/etc/resolv.conf` file with manual configuration.

### Disabling `resolvconf` and `rdnssd`

If you installed Debian 8.0 or Ubuntu 15.04 with an active IPv6 connection and have upgraded your system, you may end up with both [resolvconf and rdnssd fighting each other for control over resolv.conf](https://www.ctrl.blog/entry/how-to-debian-dns-resolv/). Both services want to control the file, which may lead to intermittent DNS resolution outages as the two services overwrite each other’s changes every few milliseconds.

You can disable both services with the following commands. You can just go ahead and run both commands, as nothing unexpected should happen if disable an already disabled service.

```shell
systemctl disable --now resolvconf.service rdnssd.service
rm /etc/resolv.conf
```

You may also need to follow the instructions in the section on `NetworkManager`, as it may step in automatically to handle the `resolv.conf` file after you remove it.

### Disabling `systemd-resolved`

If you’re running Ubuntu 16.10 or later, your DNS resolution will be managed by the `systemd-resolved` service. You can disable this service without any further ado using the following commands.

```shell
systemctl disable --now systemd-resolved.service
rm /etc/resolv.conf
```

You may also need to follow the instructions in the section on `NetworkManager`, as it may step in automatically to handle the `resolv.conf` file after you remove it.

### Recreating `/etc/resolv.conf`

By this point, you shouldn’t have anything automatically creating the `/etc/resolv.conf` file anymore. Please begin again from the top of this article to troubleshoot if the file still exists on your system. You now need to create a world-readable (permission 644) `resolv.conf` and add some nameservers to it.

The below shows two examples that set IPv4 and IPv6 nameservers. The first example uses the free security-hardened public DNS service from [Quad9](https://www.quad9.net/?ref=ctrl.blog), and the second example assumes there’s a DNS server like [Knot Resolver](https://www.ctrl.blog/entry/knot-dns-resolver-tutorial/) or `dnsmasq` running on your local device. Both examples are set up for dual-stack IPv4/6 routing for improved reliance and compatibility.

Example `/etc/resolv.conf` files:

Quad9

```
nameserver 9.9.9.9
nameserver 2620:fe::fe
nameserver 149.112.112.112
```

Localhost

```
nameserver 127.0.0.1
nameserver ::1
```

You generally don’t need to restart any network management services for the changes to take effect. However, some system services or programs may have entered a failed state while DNS resolution was disabled. Do a quick reboot to kick-start them unless you want to manually double-check that all running services and programs have recovered.

You may want to configure additional parameters for the `resolv.conf` file. See the `man 5 resolv.conf` manual for details on other domain resolution configuration options.

#### Sources

- [resolved.conf man page](https://www.freedesktop.org/software/systemd/man/resolved.conf.html?ref=ctrl.blog), version 238, 2018-03-05, systemd project, FreeDesktop.org
- [Basic Networking](https://web.archive.org/web/20180316052706/https://doc.opensuse.org/documentation/leap/reference/html/book.opensuse.reference/cha.basicnet.html), version Leap 42.2, 2018-02-26, Reference, openSUSE Documentation, SUSE
- [Frequently Asked Questions](https://www.quad9.net/support/faq/?ref=ctrl.blog), 2018-02, Quad9
- [NetworkConfiguration](https://wiki.debian.org/NetworkConfiguration?action=recall&rev=99&ref=ctrl.blog), revision 99, 2017-12-31, Debian Wiki, Debian
- [NetworkManager.conf](https://developer-old.gnome.org/NetworkManager/1.10/NetworkManager.conf.html?ref=ctrl.blog), version 1.10, 2017-11, GNOME Developer Center, GNOME
- [Network Configuration](https://web.archive.org/web/20181101095025/https://help.ubuntu.com/16.04/serverguide/network-configuration.html), version 16.04, 2016-04-16, Ubuntu Server Guide, Ubuntu Documentation, Canonical
- [Bug #740998: NetworkManager and rdnssd don’t play well together](https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=740998&ref=ctrl.blog), 2014-03-07, Debian Bug report logs, Debian
### Why I migrated from LastPass to Bitwarden
URL: https://www.ctrl.blog/entry/migrating-to-bitwarden/
Last updated: 2026-08-23T22:14:33.000Z
I’ve got hundreds of accounts and passwords, and I need a good password manager with good integration with my web browsers. My brain would explode if I had to remember all the individual accounts and password details I need to login in to every week.

I’ve been using LastPass despite never having *liked* or [fully trusted them](https://www.ctrl.blog/entry/lastpass-client-trust/). Then LastPass began stripping away platform support and I started looking for an alternate password manager.

I’ll go through a few points that I feel were important to me when deciding on a password manager, and compare how Bitwarden vs LastPass lives up to my expectations.

#### Platform availability

Bitwarden and LastPass both offer free hosted password management services with clients available for multiple popular platforms.

LastPass have been pretty good about being available in every web browser and on every platform. However, they left the LastPass extension for Firefox for Android to rot for over a year before abandoning it. They were slow to migrate their extension to WebExtensions, the new Chromium-inspired extension API used since Firefox Quantum. They’ve also got a long history of shipping outdated versions of their extensions to Firefox users over several years.

In my experience, the LastPass extension for Firefox has been only getting more and more buggy with time. My browser of choice, Firefox, clearly haven’t been a priority for LastPass.

Bitwarden have desktop apps for Linux, MacOS, and Windows; as well as mobile apps for Android and iOS and browser extensions for just about all web browsers — including the underdogs like [Vivaldi](https://vivaldi.com/?ref=ctrl.blog) and [Brave](https://www.ctrl.blog/entry/brave-payments/) with their tiny marketshares. Bitwarden is everywhere I am and everywhere I can foresee finding myself — whereas LastPass [suggest you switch your browser](https://twitter.com/LastPassHelp/status/959461869907046400?ref=ctrl.blog) to continue using their service.

LastPass’ toolbar icon in my browsers used a glaring red color; a color normally reserved to indicate that something is broken or requires your attention. Bitwarden’s calm blue icon is less alarming and I subjectively strongly prefer it over LastPass’ icon. I’ve also found that Bitwarden displays error messages in situations were LastPass would just silently fail to perform the requested operation.

#### Open-source and self-hosting

LastPass is a proprietary software and service. You’ve to rely on their infrastructure and will to continue operating the service [without interference](https://www.ctrl.blog/entry/lastpass-client-trust/).

Bitwarden on the other hand is open-source from top to bottom. Their apps, extension, and online services are all open-source. If Bitwarden.com where to announce they were shutting down tomorrow, you could grab the source from their servers and host it yourself to ensure continued service.

Self-hosted instances of Bitwarden isn’t an after-thought either as the company behind it considered self-hosting a “first-class feature”. I’ve yet to dig into this in more detail, but I expect that I’ll look into hosting it for myself with time.

As a developer, I also value the ability to inspect their code and suggest changes when I encounter bugs. I haven’t ran into anything that have needed my attention in Bitwarden, but I like knowing that I’ve the option to fix it myself. I’ve submitted quite a few concrete bugs and even suggested patches to LastPass through their support form, but they’ve always preferred to leave the bug unresolved in their browser extensions for years instead.

### Security

I don’t have the time nor ability to evaluate exactly how secure or insecure any password manager is compared to another. However, I’ve noted a few things of interest.

There hasn’t been a full independent security review of Bitwarden yet. The code is open and anyone can look at it, and hopefully it will be “the good guys” who’ll find any potential security vulnerabilities and report the issues to Bitwarden. The probability of that happening is much greater than with a proprietary product; seeing how everyone has access to Bitwarden’s source code.

I was positively surprised to learn that Bitwarden’s browser extension doesn’t auto-fill login information on pages as soon as they’ve loaded. The user has to interact with the extension to cause it to fill in stored usernames and passwords.

While this is a slight inconvenience, it also effectively **stops auto-fill theft** as some advertisement networks were [caught doing in late 2017](https://www.bleepingcomputer.com/news/security/web-trackers-exploit-flaw-in-browser-login-managers-to-steal-usernames/?ref=ctrl.blog). This issue has been known to browser vendors for over a decade already, yet the built-in password manager in most web browsers and most third-party password managers have all ignored it.

I’ve also got some concerns regarding Bitwarden’s use of third-party script resources which I’ll go into greater detail in the next section.

### Security concerns over third-party resources

In my opinion, **no external resources should be loaded from any third-party domains** inside a high-risk high-security environment like a password manager.

LastPass hosts everything under their own domains and thereby can ensure that as long as they’ve control over their servers, they maintain control over everything that loads inside the password manager.

**Update** (2018-07-27): The rest of the information in this section is outdated. Please see the [3-months with Bitwarden update](https://www.ctrl.blog/entry/bitwarden-3m-update/) for newer information.

Bitwarden loads scripts and styles from Bootstrap CDN as well as Google Fonts and Google Hosted Libraries. These resources are loaded with Subresource Integrity enforcement, meaning that modern browsers will refuse to load them if the external resource don’t match a predetermined checksum. In other words, Bitwarden have a fairly good confidence that they don’t load anything malicious or unexpected by including these remotely hosted resources.

However, Bitwarden also loads JavaScript from the two payment service providers Braintree (PayPal) and Stripe, as well as Google Analytics and the two-factor login services provider Duo Security. All these third parties are included when you login to the web vault, and are loaded without Subresource Integrity enforcement. Subresource Integrity enforcement isn’t supported by these third-party vendors.

Including any **third-party content is a potential avenue for malicious actors** to get in to the password vault. I can’t see any strong reason why any of these companies should be able to execute code inside the password vault. They’re all well-established service providers and it’s not very likely that they’ll loose control over their domains. However, it’s an unnecessary risk factor and frankly their inclusion also seems entirely unnecessary.

### Third-party analytics

The Bitwarden mobile apps, desktop apps, extensions, and web vault all integrate Google Analytis for tracking behavioral data from users. Users can opt-out by disabling the Analytics option by going to Settings: Other: Options.

**Update** (2018-07-27): Bitwarden no longer includes Google Analytics scripts directly. Please see the [3-months with Bitwarden update](https://www.ctrl.blog/entry/bitwarden-3m-update/) for newer information.

This is another example of an unconstrained third-party script that don’t belong in a secure environment such as a password manager. Users should opt-in to tracking in this instance rather than having to opt-out.

It’s not enough to opt-out once in the web vault or in one of the apps or extensions. Users have to opt-out again in every client they use as the opt-out preference isn’t being synchronized between clients.

I completely understand the need and desire for tracking some behavioral analytics. However, what is good enough for a normal website isn’t necessarily good enough for a security critical environment like a password manager. In my opinion, there’s no good reason for using Google Analytics — or any third-party analytics — in the way Bitwarden uncritically uses it.

### Data portability

Bitwarden and LastPass can export and import password, secure notes, and other secure notes to a comma-separated value (CSV) format with headers denoting each value. Many password managers support importing from CSV files, but some manual shuffling of the data columns may be required (as with anything else that use CSV in lieu of a formally standardized interchange format.)

Bitwarden being the underdog, can import data from LastPass. However, if you want to go the other way around, you’ll need to reformat the CSV export file for LastPass to accept it. CSVs are easy enough to work with, and the important point to note is that all data appears to be present when exporting from both password managers.

LastPass incorrectly encoded a few (but not all) UTF-8 characters when I exported data to be imported in Bitwarden. I’d to manually correct these in the comma-separated export format before Bitwarden could import the file. (This is a bug in LastPass and not Bitwarden.) Having just run into an export issue, I also tested and made sure that Bitwarden didn’t do the same mistake when exporting.

Both Bitwarden and LastPass can store other types of information including secure notes and credit card information. These types of data are also part of the password database dump.

### Conclusions

I choose to use Bitwarden over LastPass despite being more skeptical about their security practices when it comes to inclusion of third-party executable scripts inside the password manager. I hope we’ll see Bitwarden make changes to limit the number of possible attack vectors in the future.

Bitwarden doesn’t have a proven record of maintaining strict operational security for a decade like LastPass. However, my personal values, beliefs, and preferences lean heavily towards Bitwarden over LastPass as an optionally self-hosted open-source application with clients for every platform.

**I’ve no strong reason to *trust* LastPass over Bitwarden**. I find that I *like* using Bitwarden whereas I never liked using LastPass. Bitwarden seemed to me like the best LastPass alternative out there.

If you require absolute security, you should probably stick with LastPass as they’ve get a decade of experience in offering hosted password management services. You could opt to self-host Bitwarden in an environment that isn’t exposed to the internet as an alternative. However, for most folks — the current level of security offered by Bitwarden is *probably good enough.* Hopefully, we’ll see Bitwarden undergo a full security audit soon.

**Update** (2018-11-14): German security agency Cure53 have now completed an independent security audit of Bitwarden. All noted issues have been patched.

#### Sources

- [Bitwarden Completes Third-party Security Audit](https://bitwarden.com/blog/third-party-security-audit/?ref=ctrl.blog), 2018-11-12, Kyle Spearrin, Bitwarden blog, 8bit Solutions
- [Bitwarden clients repository](https://github.com/bitwarden/clients/tree/d54ffd52e31d86fa031f5d3afbff7f80f8f33f9e?ref=ctrl.blog), commit d54ffd52e3, 2018-03-08, Bitwarden browser extension repository, Bitwarden project, 8bit Solutions, GitHub
- [Bitwarden web vault repository](https://github.com/bitwarden/web/tree/859f44db4376a2b35178f215bb236c4ed8bb4aab?ref=ctrl.blog), commit 859f44db43, 2018-03-06, Bitwarden web vault repository, Bitwarden project, 8bit Solutions, GitHub
- [BitWarden doesn’t care about security.](https://medium.com/@brandon.a.davis/bitwarden-doesnt-care-about-security-59e2ef87870a?ref=ctrl.blog), 2018-01-19, Brandon Davis, Medium
- [Web Trackers Exploit Flaw in Browser Login Managers to Steal Usernames](https://www.bleepingcomputer.com/news/security/web-trackers-exploit-flaw-in-browser-login-managers-to-steal-usernames/?ref=ctrl.blog), 2017-12-30, Catalin Cimpanu, Bleeping Computer
- [Host Your Own Open Source Password Manager](https://bitwarden.com/blog/host-your-own-open-source-password-manager/?ref=ctrl.blog), 2017-10-04, Kyle Spearrin, Bitwarden blog, 8bit Solutions
- [Browser autofill used to steal personal details in new phishing attack](https://www.theguardian.com/technology/2017/jan/10/browser-autofill-used-to-steal-personal-details-in-new-phising-attack-chrome-safari?ref=ctrl.blog), 2017-01-10, Samuel GiBbs, The Guardian
- [Subresource Integrity](https://www.w3.org/TR/SRI/?ref=ctrl.blog), 2016-06-23, World Wide Web Consortium (W3C)
- [Do not let your CDN betray you: Use Subresource Integrity](https://hacks.mozilla.org/2015/09/subresource-integrity-in-firefox-43/?ref=ctrl.blog), 2015-09-25, Frederik Braun and Francois Marier, Mozilla Hacks, Mozilla
- [Why is the version in the Mozilla add-on store out of date?](https://web.archive.org/web/20190508165547/https://lastpass.com/support.php?cmd=showfaq&id=6036), 2014, LastPass Support, LastPass, LogMeIn
### XDG Base Directory shell scripting tutorial
URL: https://www.ctrl.blog/entry/xdg-basedir-scripting/
Last updated: 2026-08-23T22:25:59.000Z
I’ve mentioned the XDG Base Directory specification a few times over the last months, and people have been curious about how to comply with the specification within their own shell-scripts and programs.

The incoming web traffic to my article “[Flatpak, Steam Cloud, and XDG Base Directories](https://www.ctrl.blog/entry/flatpak-steamcloud-xdg/)” reveals that there’s interest in a rudimentary tutorial on how to meet the requirements of the [XDG Base Directories Specification](https://specifications.freedesktop.org/basedir-spec/basedir-spec-latest.html?ref=ctrl.blog) from shell scripting. Please read that article first for an introduction to the XDG Base Directory specification, and a concrete example of the kind of problems that can be caused by not following the specification.

According to the XDG Base Directory Specification, applications should store their data in one of four locations according to the type of data. Applications should discover this location by reading environmental variables, or falling back to a predefined set of default paths only if these variables aren’t set in the environment.

The below table shows the XDG Base Directory environmental variables, their default path, and what type of data goes in which directory. Your users will appreciate you for putting data in the right directories.

| Env. variable      | Default path        | Purpose                                                                                                                    |
| ------------------ | ------------------- | -------------------------------------------------------------------------------------------------------------------------- |
| $XDG\_CACHE\_HOME  | $HOME/.cache/       | Temporary non-persistent data that might be needed later. Cache data can be recreated from other local or downloaded data. |
| $XDG\_CONFIG\_HOME | $HOME/.config/      | Program runtime configuration data.                                                                                        |
| $XDG\_DATA\_HOME   | $HOME/.local/share/ | Unique program-specific user-created data.                                                                                 |
| $XDG\_STATE\_HOME  | $HOME/.local/state/ | Program state, logs, history, current cursor/reading position, etc.                                                        |

Reading an environmental variable from a shell script is quite easy; the only trouble is ensuring that the default paths are used when the variables are unset. The XDG Base Directory specifications defaults should be used in this situation.

The below script assigns the default variables to the XDG Base Directory environmental variables only if they haven’t already been set in the environment. To override these system-wide, you can prefix these commands with the `export` command and put them in your shell profile.

```shell
XDG_CACHE_HOME:="$HOME/.cache"
XDG_CONFIG_HOME:="$HOME/.config"
XDG_DATA_HOME:="$HOME/.local/share"
XDG_STATE_HOME:="$HOME/.local/state"
```

This will let you use the XDG Base Directory variables as pointers to these directories directly in your script. Note that there’s no guarantee that the directories exist, so you’ll also have to test that they do exist and you may need to create them before you can store any data in them.

Applications traditionally create their own unique sub-directory underneath the base directories where they keep their own data. You’ll want to store variables for your sub-directories without modifying the XDG Base Directory environments themselves.

The below script creates four variables for your application’s sub-directories inside the XDG Base Directories without assigning anything to the XDG Base Directory variables themselves:

```shell
PROGRAM_NAME="my-app"

CACHE_DIR="${XDG_CACHE_HOME:-$HOME/.cache}/$PROGRAM_NAME"
CONFIG_DIR="${XDG_CONFIG_HOME:-$HOME/.config}/$PROGRAM_NAME"
DATA_DIR="${XDG_DATA_HOME:-$HOME/.local/share}/$PROGRAM_NAME"
STATE_DIR="${XDG_STATE_HOME:-$HOME/.local/state}/$PROGRAM_NAME"

mkdir $CACHE_DIR $CONFIG_DIR $DATA_DIR $STATE_DIR
chmod 700 $CACHE_DIR $CONFIG_DIR $DATA_DIR $STATE_DIR
```

The two example scripts in this article targets any modern POSIX-compatible shell such as `bash`, `sh`, and `zsh`. They may not work with non-POSIX-compatible shells like `tcsh/C shell`.

There are more directories in the XDG Base Directory specification, and you may be able to obtain several more for common directories like Desktop, Documents, and Downloads by sourcing `$(XDG_CONFIG_HOME:-$HOME/.config)/user-dirs.dirs`. This file is available in almost all graphical desktop environments where the [xdg-user-dirs program](https://freedesktop.org/wiki/Software/xdg-user-dirs/?ref=ctrl.blog) is used.

**Update** (2022-08-07): Added the new `XDG_STATE_HOME` directory as introduced in the XDG Base Directory Specification version 0.8.

#### Sources

- [XDG Base Directory Specification](https://specifications.freedesktop.org/basedir-spec/basedir-spec-0.8.html?ref=ctrl.blog), version 0.8, 2021-04-08, FreeDesktop.org
- [Shell Command Language](https://pubs.opengroup.org/onlinepubs/9699919799/utilities/V3%5Fchap02.html?ref=ctrl.blog#tag%5F18%5F05) (POSIX.1-2008), 2016 Edition, The Open Group Base Specifications Issue 7, IEEE and The Open Group
- [XDG Base Directory Specification](https://specifications.freedesktop.org/basedir-spec/basedir-spec-0.7.html?ref=ctrl.blog), version 0.7, 2014-04-02, FreeDesktop.org
### On using Coinhive CAPTCHA instead of reCAPTCHA by Google
URL: https://www.ctrl.blog/entry/coinhive-captcha/
Last updated: 2026-08-23T22:03:42.000Z
Coinhive, the in-web-browser crypto-currency-mining service, has an interesting new approach to CAPTCHA challenges. Instead of asking people to perform meaningless tasks, Coinhive asks their computers to perform a processor-intensive task for a few seconds instead.

Here is why I decided to use Coinhive’s CAPTCHA service despite their tainted reputation over the many malicious implementations of their technology on hijacked websites in recent times.

**Update** (2018-03-13): So that was a short-lived experiment. Coinhive CAPTCHA is now blocked everywhere including on DNS and ISP levels so I’d to stop using them. Unfortunately, I haven’t found any other alternative CAPTCHA services available with the same level of privacy and ease-of-use on the user. But I’ll keep looking!

**Update** (2019-02-28): Coinhive have closed down.

CAPTCHAs are those little interactive gatekeepers/roadblocks at the end of online forms that try to prevent automated tools from submitting said form.

Historically, CAPTCHAs required people to fill in some distorted numbers and letters shown on an image into a text field. Robots have been better than us humans at this task for quite some time, and it’s been an enormous roadblock for anyone with reduced vision or accessibility needs.

Today, you’ll most likely be asked to click on a single checkbox saying “I’m not a robot” or you’ll be asked to identify a specific object on a set of photos. Those type of CAPTCHAs are for the most part delivered by Google reCAPTCHA; a service that Google offers at no-charge to website owners. reCAPTCHA has somewhere between 94 and 99,3 % global marketshare out of all CAPTCHA service providers according to BuiltWith and Wappalyzer respectively.

The reCAPTCHA service is covered by Google’s regular end-user privacy policy and terms of service. In short, it means that any website that implements reCAPTCHA to protect their forms agrees to share information about their visitors’ behavior with Google.

> “If you aren’t paying for it, you’re not the customer; you’re the product being sold.”

Andrew Lewis

I believe that Google already has more than enough information about every human being on the planet, so I’ve been looking for a more privacy-friendly CAPTCHA service provider. A service provider that don’t store and analyze personal data would also greatly simplify compliance with the European Union’s new General Data Protection Regulation (GDPR).

Towards that end, I found only one cost-free CAPTCHA system provider with an admirable privacy policy and a clear business model that doesn’t involve data collection or display-ads. That service provider is Coinhive. Here is an excerpt from their privacy policy:

> “We only keep track of the absolute minimum of information that’s necessary to operate this service. \[…\] We **do not** track users. We **do not** use cookies. \[…\] We keep your IP address on our servers in working memory (RAM) only.”

Privacy Policy, Coinhive

Coinhive’s CAPTCHA service looks and behaves much like Google’s no-CAPTCHA reCAPTCHA implementation. No-CAPTCHA admits people automatically based on Google’s observations about your behavior as they’re tracking you around the web.

Coinhive CAPTCHA on the other hand spends a few seconds to mine crypto-currencies using the visitor’s computer. This is a resource intensive operation that increases the near-zero cost and time it takes to submit millions of automated form requests

The user experience with Coinhive CAPTCHA is comparable to that of reCAPTCHA:

Coinhive proof-of-work CAPTCHA

Google No-CAPTCHA reCAPTCHA

**Google undoubtedly does a better job at blocking automated bots** than Coinhive. However, Google only gets to be good at blocking bots by monitoring and logging people’s behavior across the web. Coinhive on the other hand doesn’t even attempt to block automated uses of their CAPTCHA.

Instead, the idea is that the processing power required to solve the crypto-currency mining task that’s required to complete their CAPTCHA would take up too much of the bot’s resources for it to be worth the attempt. There are plenty of softer targets, so why spend a lot of time on just one form submission that may not even succeed if they do solve the CAPTCHA?

The crypto-currency mining that takes place during Coinhive’s CAPTCHA magic also directly pays Coinhive for the service. They don’t need to collect and resell people’s behavioral data to make a profit, and they also don’t need to charge the publisher. In fact, Coinhive shares their earnings from their CAPTCHA service 30/70 % with the website publisher.

Coinhive is a somewhat controversial choice as for as an online service provider goes as their other web-browser-based crypto-currency mining services have [a terrible reputation](https://www.vice.com/en/article/vbpbz4/creators-of-in-browser-cryptocurrency-miner-coinhive-say-their-reputation-couldnt-be-much-worse?ref=ctrl.blog).

Coinhive’s web-browser-based miner scripts have been inserted onto hijacked websites and mobile apps to automatically mine crypto-currency on people’s devices running at full throttle indefinitely. Coinhive have been blocked by antivirus vendors, web browser vendors, ad-blocking software, and even DNS service providers over the rampant misuse of their service.

Notably, the Coinhive CAPTCHA service doesn’t run automatically. It only starts when people click on it, and it only run for a very limited amount of time (usually a few seconds). In my implementation, I’ve made sure the forms can still be submitted if the Coinhive CAPTCHA API goes down as I’m not completely convinced that Coinhive will be around forever and have anticipated that their servers may be unavailable for some time.

So, why do I still want to use Coinhive’s CAPTCHA service despite their terrible reputation?

I’ve literally **worked as a professional CAPTCHA solver**. That is to say, I’ve helped people who’ve emailed in to support to complain that they couldn’t create an account with one of my previous employers online services because they couldn’t solve the CAPTCHA. It was a awful CAPTCHA and it regularly took me 5–10 attempts to solve it on behalf of customers as I tried to help them setup their accounts. I hate traditional CAPTCHAs. They’re awful.

I find Coinhive’s transparent business model and privacy-friendly CAPTCHA to be preferable to traditional CAPTCHAs. Google No-CAPTCHA reCAPTCHA isn’t an option if you wish to run a privacy friendly website, and find unfortunate that Google reCAPTCHA has cornered 99,3 % of the global CAPTCHA market. **Google has a monopoly on CAPTCHA services** and I frankly want to see more diversity and innovation in this market as in any other market.

I only use CAPTCHAs on a few forms where readers can submit corrections to my articles or contact me for some other reason. So, I in no way expect to turn a minuscule profit from Coinhive’s crypto-mining in the CAPTCHAs on my website as the numbers are relatively small. (The number of automated submissions have been steadily increasing, however). I’m okay with Coinhive making a fractional minuscule profit of the mining as payment for the CAPTCHA service.

The Coinhive CAPTCHA can be slow to solve on older computers, yet I don’t believe that should be much of a problem. I do in fact believe that it’s probably a good thing if people were forced to cool down for a few seconds before they can contact me. I’ve literally received death threats over [a positive Android app review](https://www.ctrl.blog/entry/review-conversations-xmpp-android/) where someone desperately wanted me to review their favorite app instead. Giving people a few seconds to breathe and think will probably be beneficial.

There are some accessibility and legacy-browser compatibility issues with Coinhive CAPTCHA. I’ve sent them some feedback regarding improved accessibility support and they’ve responded positively. I’m more worried that they won’t resolve legacy-browser compatibility issues as the technology simply isn’t there. Coinhive CAPTCHA displays a notice urging users to upgrade their browsers to a more recent version, but this is about the extent their legacy browser support goes.

I also hope to see a fractional reduction in the volume of correspondence from people who’re not all that invested in what they thought they wanted to say when faced with a small delay.

#### Sources

- [CAPTCHA Market Leaders](https://web.archive.org/web/20180228153841/https://www.wappalyzer.com/categories/captchas), 2018-02-28, Wappalyzer
- [CAPTCHA Usage](https://web.archive.org/web/20180228153940/https://trends.builtwith.com/widgets/captcha), 2018-02-28, BuiltWith
- [Creators of In-Browser Cryptocurrency Miner ‘Coinhive’ Say Their Reputation Couldn’t Be Much Worse](https://www.vice.com/en/article/vbpbz4/creators-of-in-browser-cryptocurrency-miner-coinhive-say-their-reputation-couldnt-be-much-worse?ref=ctrl.blog), 2018-02-13, Joseph Cox, Motherboard, Vice
- [Privacy Policy](https://web.archive.org/web/20190330130938/https://coinhive.com/info/privacy), 2018, Coinhive
- [AuthedMine – Non-Adblocked](https://web.archive.org/web/20190227204358/https://coinhive.com/blog/en/authedmine), 2017-10-16, Coinhive Blog, Coinhive
- [Are you a robot? Introducing “No CAPTCHA reCAPTCHA”](https://security.googleblog.com/2014/12/are-you-robot-introducing-no-captcha.html?ref=ctrl.blog), 2014-12-03, Vinay Shet, Google Security Blog, Google
- [Comment 3256046](https://www.metafilter.com/95152/Userdriven-discontent?ref=ctrl.blog#3256046), 2010-08-26, Andrew Lewis, MetaFilter
### How to change to the European English locale on Android
URL: https://www.ctrl.blog/entry/android-en150-localization/
Last updated: 2026-08-23T22:01:41.000Z
I’m European and all my devices run Android set to American English. However, I’d also like to use a 24-hour clock, have a sensible date format, start the week on Mondays, and use a comma character to separate decimals in numbers. In other words: I want my Android devices to use European English. Luckily, Android natively supports European English – it’s just unfortunately not made available to users without a bit of tweaking.

Android follows a trend where the operating system has great support for localization, but where the capabilities aren’t made available to the user. You can still customize your language and locale settings separately from each other with a bit of tweaking.

In this article, I’ll talk you through you can change your devices running Android 7.0 or later to use the European English locale. The European English locale is different from the American English locale in a few significant ways:

- Uses a comma instead of a period as the decimal separator.
- Uses a period instead of a comma as the thousand separator. (The majority of European locales use a space and not period.)
- Uses the metric system instead of imperial units. (This isn’t a part of the locale settings, but most the apps I’ve tested changed to metric.)
- The first day of the week is Monday instead of Sunday.
- Uses the day month year (little-endian) instead of moth day year (middle-endian) date format.
- Uses a 24-hour instead of 12-hour time format.
- The first week of the year always contains 1\. January. (The majority of European locales follow the 4-day-minimum-week/ISO-week rule.)
- Uses the generic currency symbol is ¤ instead of US$.

You can learn more about this in my article on the [World English and European English locales](https://www.ctrl.blog/entry/en-001/). As you may have noticed from my notes, the locale setting for European English may not perfectly match your expectations. You can, of course, follow along in this article to set other custom locales – use the [ICU Locale Explorer](https://web.archive.org/web/20190504154550/https://ssl.icu-project.org/icu-bin/locexp?d%5F=en%5F001) to learn about available locales.

Not all apps will have good localization support and may either choose to use a fallback language’s locale, or whatever the programmer hardcoded into the app. I’ll get back to talking about app compatibility towards the end of this article.

### Preparing your device

The first thing you’ll need to do is to install the [MoreLocale 2 app](https://play.google.com/store/apps/details?id=jp.co.c%5Flis.ccl.morelocale&ref=ctrl.blog). However, unless you’re running a rooted phone (you’d know if you were) you’ll also need to use Android Developer mode to grant it some special privileges.

You’ll need to install and enable [Android Developer Bridge](https://developer.android.com/tools/adb?ref=ctrl.blog) (`adb`) on your PC. On Linux this can be installed from the `android-tools` package. Windows and MacOS can download it as part of the [Android platform tools](https://developer.android.com/tools/releases/platform-tools?ref=ctrl.blog). You’ll next need to enable [Developer mode and debugging over USB](https://developer.android.com/studio/debug/dev-options?ref=ctrl.blog#enable) on your device.

Once you’ve set up ADB and have connected your Android device to your PC over USB, you should be ready to go. I haven’t included exact details on doing this here as there are many good tutorials available if you need further assistance. The only thing you needed ADB for is executing this one command on your PC while your Android device is connected:

```shell
adb -d shell \
    pm grant "jp.co.c_lis.ccl.morelocale" \
    android.permission.CHANGE_CONFIGURATION
```

The above commands give the MoreLocale 2 app access to changing your device’s configuration. Granting apps extra privileges can be a security risk, and you shouldn’t do it with untrusted apps people randomly tell you about on the web. (I do see the irony in recommending you do something and then recommending you don’t do it in the next paragraph.)

### Adding a custom locale

You can now open the MoreLocale 2 app that we installed and granted extra privileges to in the previous section. It will list some of the locales available on your device. Unless your device manufacturer has interfered too much with the Android project, you should have a list of hundreds of languages and locales.

You may also notice that some locales, including European English (or English (Europe)) aren’t on the list.

To add European English to the list, click the small label at the top of the list marked Custom locale. Enter “en” (for English) in the Language field and “150” (for the continent of Europe) in the Country field. Finally, click the Set button to add it to the list and set it as the system’s locale.

[![Adding a custom locale in MoreLocale 2](https://cdn.synaps.media/control/content/images/2026/08/morelocale2-android-custom-locale.png)](https://cdn.synaps.media/control/content/images/2026/08/morelocale2-android-custom-locale.png?ref=ctrl.blog) 

[![Locale ordering in Android language and locale preferences](https://cdn.synaps.media/control/content/images/2026/08/android-locale-preferences.png)](https://cdn.synaps.media/control/content/images/2026/08/android-locale-preferences.png?ref=ctrl.blog) 

Your device is now set to European English. However, the change will **not persist after a reboot** and it may not work in all of your apps yet. When you change the system locale, some apps will be automatically restarted to apply the new locale. The automatic restart doesn’t work with all apps nor most of the system-provided user interface.

To make the change persistent, you’ll also have to confirm the locale change in the Language preferences screen. You’ll find this screen either in the System Settings app: Languages, or System Settings: System: Languages and input. The Language preference screen should contain one entry called “English (Europe)”. Click Add language and add a fallback language. I recommend you pick another variant of English such as American English (English (United States)) as your secondary language.

Your locale settings are now permanent and should persist after a reboot. You may remove the fallback language again at this stage. However, I do recommend you keep at least one common fallback language such as American English on the list to ensure good app compatibility.

You should **reboot your device** at this point to make sure all apps pick up the change in the system locale.

### App compatibility

Apps that have been created with internationalization and localization in mind will just work, and will apply the new locale. Everything from the Calculator app to Google Maps will switch decimal mark from the period to comma, and you’ll see European date formatting in almost every app.

Some apps don’t go all the way and may use your locale settings inconsistently. This is a problem with the app, but it’s a relatively rare problem for any app that’s available in more than one language.

I’m only aware of a single app that doesn’t work with the European English locale: the Google AdSense app. The app will switch from period to comma decimal marks and apply your localization settings alright. However, it will no longer be able to update data and will be stuck displaying the same data forever. This is caused by an app-specific problem where the app expects language codes to have four letters and a dash, and fails when encountering the [European English language code (en-150)](https://www.ctrl.blog/entry/en-001/).

In general, you can expect to have the same type of localization issues with a more “exotic” locale setting as you’d have with any other locale settings. The operating system will handle most of the localization for any apps that use the provided localization tools in Android.

#### Sources

- [java.util.Locale](https://developer.android.com/reference/java/util/Locale?ref=ctrl.blog), API Level 26, 2017-08, Android Developer Reference, Android Platform, Google
- [MoreLocale 2](https://web.archive.org/web/20180301172029/https://www.c-lis.co.jp/en/our%5Fservices/morelocale-2), 2013-02, C-LIS CO., LTD.
- [English (Europe)](https://web.archive.org/web/20190504165516/https://ssl.icu-project.org/icu-bin/locexp?%5F=en%5F150&d%5F=en&d%5Fr=150) in the International Components for Unicode: Locale Explorer
### How to back up Flatpak user-data and apps
URL: https://www.ctrl.blog/entry/backup-flatpak/
Last updated: 2026-08-23T22:02:05.000Z
You’ll probably want to make some changes to your home directory backup script after adopting and installing a few Flatpak applications. Here are the things you’ll need to think about.

There are three things you need to back up everything in Flatpak: your user settings and data, the list of installed apps, and the repositories configuration so Flatpak will know where to install apps from.

### Backing up user-data

Backing up and restoring user-data is as easy as copying the files from the per-application data directories that Flatpak assigns to each app.

Flatpak stores user data in `$HOME/.var/app/` for confined apps. Some apps may have access to and writes to directories in your home directory. You’ll need to investigate which apps have access to write to the home directory and which stick to their per-application Flatpak directory to be sure you backup all required data. With time, more applications are expected to be confined to their per-application directory.

You should exclude the `$HOME/.var/app/*/cache/` directories which are equivalent to the `$XDG_CACHE_HOME` (`$HOME/.cache/`) directory for regular applications. The first and second section of my article on [Steam and XDG in Flatpak](https://www.ctrl.blog/entry/flatpak-steamcloud-xdg/) explains how XDG Base Directories are mapped in the Flatpak per-application user directory.

You should always verify that apps you care about are properly backed up.

### Backing up repository configuration

It’s difficult to untangle the repository configuration from the installed app and runtime data, and the locally installed repository contents and metadata. If you’ve installed a few apps and runtimes, this data quickly grows to several Gigabytes. You generally don’t want to include this in your backup as this data isn’t unique and you can just download the data again given that the list of apps and repositories is known. I’ll get back to this point later.

If you’ve installed apps, runtimes, and repositories as `--user` all of this data ends up in the Flatpak installation directory at `~/.local/share/flatpak/`. You can choose to back up this directory in its entirety, but you’ll probably want to exclude this directory to keep your backups small and storage costs down. I’ll assumed that you’ve installed everything as `--user` in this article. You’ll have to adjust the paths to the shared system directory at `/var/lib/flatpak/` if you’ve installed things there instead.

As I mentioned initially, you unfortunately can’t backup the repository file and it’s signing key directly (`~/.local/share/flatpak/repo/config` and `./*.trustedkeys.gpg`. Or rather, nothing is stopping you from backing up those files — but you can’t just move those files back on an empty Flatpak install directory on a new system. Flatpak expects and requires that its whole set of complex directories and certain large data files already exist. You must add repositories using the command-line utilities to set up the environment properly.

The script in this section requires Flatpak version 0.10.4 or later, and it relies on an unstable interfaces which may change.

The following example script exports a list of your repositories as a list of commands that you can execute to reinstall your Flatpak repositories. You can pipe send the output list to a file as part of your backup script.

```
flatpak remotes --show-details | awk '{print "echo \"echo \\\x22$(base64 --wrap=0 < $HOME/.local/share/flatpak/repo/" $1 ".trustedkeys.gpg)\\\x22 | base64 -d | flatpak remote-add --if-not-exists --gpg-import=- --prio=\\\x22"$4"\\\x22 --title=\\\x22"$2"\\\x22 --user \\\x22"$1"\\\x22 \\\x22"$3"\\\x22\""}' | sh
```

So … there’s a lot going on in that one script. The first part of the script prints a list of all the installed repositories excluding their signing signature. The next part finds the signing key and endcodes it in a format that can be stored as a string. The last part of the script constructs the import command with all the repository’s information and instructions to import the signature. The output is one command per repository that can be used to install the repository on fresh installation.

You also have to run `flatpak update` once after installing repositories to retrieve metadata.

### Backing up the list of installed apps

Once you’ve backed up your repositories, you can also export and backup a list of which apps you’ve got installed.

The following example script exports a list of your installed apps as a list of commands that you can execute to reinstall your Flatpak apps after you’ll restored your repository list. You can send the output of the example command to a file as part of your backup script.

This script relies on an unstable interfaces which may change.

```
flatpak list --app --show-details | \
awk '{print "flatpak install --assumeyes --user \""$2"\" \""$1}' | \
cut -d "/" -f1 | awk '{print $0"\""}'
```

The script asks Flatpak to list of a detailed view of installed applications (this isn’t a stable interface!), and then constructs the commands required to reinstall them. Lastly it discards the version information so that you get the most recent version of the app when restoring it. Please note that the example script doesn’t handle multiple versions of the same app.

You can also export and import your list of apps using the stable interface provided in libflatpak. However, there are no clients that implement this interface for this purpose at this time.

I **don’t recommend that anyone rely on these example scripts** for backup purposes without regularly testing that their backups still work. They don’t use stable interfaces, and Flatpak is currently under heavy development. Things may — and I fully expect them to — break.

You can follow [Flatpak issue #1356](https://github.com/flatpak/flatpak/issues/1356?ref=ctrl.blog) if interested in seeing better export and backup functionality built-in to Flatpak. Or you may have a look at the stable interfaces in libflatpak if you wish to create a better backup utility (note that signing keys aren’t available through this API.)

I wrote this article to bring attention to Flatpak’s backup problems and to provide people with the means to export their data. Just because an app is stored in a container doesn’t mean you don’t also want to back up its data.

#### Sources

- [Release 0.10.4](https://github.com/flatpak/flatpak/releases/tag/0.10.4?ref=ctrl.blog), 2018-02-14, Alexander Larsson, Flatpak repository, GitHub
- [common/table-printer: separate columns with tab in non-TTY stdout](https://github.com/flatpak/flatpak/pull/1354?ref=ctrl.blog), pull request #1354, 2018-02-02, Daniel Aleksandersen, Flatpak repository, GitHub
- [Filesystem](https://github.com/flatpak/flatpak/wiki/Filesystem/b8bd642b24b965e3e3ed5bb8e6dab776c61cbba8?ref=ctrl.blog), commit b8bd642b24, 2016-05-16, Flatpak project wiki, Flatpak repository, GitHub
- [XDG Base Directory Specification](https://specifications.freedesktop.org/basedir-spec/basedir-spec-0.7.html?ref=ctrl.blog), version 0.7, 2014-04-02, FreeDesktop.org
- [Command reference](https://docs.flatpak.org/en/latest/flatpak-command-reference.html?ref=ctrl.blog), version 0.11.1, Flatpak Documentation
### How to change the UEFI System Partition size in Windows Setup
URL: https://www.ctrl.blog/entry/how-to-esp-windows-setup/
Last updated: 2026-08-23T22:09:47.000Z
Windows Setup, the Windows installation tool, unfortunately, doesn’t provide any graphical tools for shrinking or expanding a UEFI System Partition (ESP; sometimes EFISYS).

You can still create a custom-sized ESP by side-stepping out of Windows Setup and into the Command Line for a minute to partition the disk to your liking. I’ll walk you through the process in this tutorial.

This tutorial assumes you’re working with an empty disk, and that your computer is UEFI compliant. You may need to delete any existing partitions on the drive before proceeding. You can’t rely on this tutorial to grow the UEFI System Partition (ESP) on an existing installation as any attempt would be blocked by your existing partition boundaries.

Windows won’t let you recreate a UEFI system outside the Windows Setup installation program. You should follow this tutorial during the initial Windows installation process with Windows Setup.

You are responsible for any data loss and to ensure that you’ve adequate backups of your data. Unplug disks you don’t intend to use during the installation to avoid data loss. This is your only warning.

So, you’ve booted up into Windows Setup from your installation media, and you’ve selected to perform a Custom installation. Whether you’re planning to and [preparing to dual-boot with Linux](https://www.ctrl.blog/entry/dual-boot-bitlocker-device/) or just want to provide a larger margin of error; you may have noticed that the default 105-or-273 MB (100-or-260 MiB) partition for the UEFI System Partition is a tad small. (The default ESP size depends on your disks physical sector size.)

You need to decide what size you want your UEFI System Partition to be before you begin. You can take a pause here to read [How large should you make your UEFI System Partition?](https://www.ctrl.blog/entry/esp-size-guide/) before you proceed as it will be quite challenging to attempt to change the size you allocate to your ESP after you’ve installed the system without reinstalling.

Once you’ve decided on the appropriate size for your computer and needs, then you can follow these steps to proceed. The tutorial begins from the first step of the Custom installation screen in Windows Setup (screenshot of this screen at the end of the article):

1. Select your installation target and make sure it has no partitions (except unallocated space)
2. Click the New and then the Apply button.

You should now have four partitions: Recovery, System (ESP), MSR, and Primary.

1. Select each of the System, MSR, and Primary partitions in turn and click the Delete button to delete these partitions. Leave the Recovery partition in place.
2. Press Shift+F10 to open the Command Prompt
3. Type diskpart.exe and press Enter to open the disk partitioning tool
4. Type list disk and press Enter to list out your disks
5. Type select disk n where n is the number for the disk you want to install to as identified by the above command and press Enter
6. Type create partition efi size=550 where 550 is the desired size of the ESP in Mebibytes (MiB), and press Enter
7. Type format quick fs=fat32 label=System and press Enter to format the ESP
8. Type exit and press Enter to exit the disk partitioning tool
9. Type exit and press Enter again to exit the Command Prompt

You should now be back in the graphical Windows Setup partitioning tool where nothing has changed since the last time you looked at it.

1. Click the Refresh button to detect your partition changes

You should now have a disk with a default Windows Recovery tools partition, a 500 MiB UEFI System Partition, and some unallocated space for your Windows installation.

1. Select the unallocated space from the disk list and click the New button to automatically recreate the MSR and System partition in the remaining space

The final result should look something like this:

![Screenshot of a 550 MiB ESP in Windows Setup](https://cdn.synaps.media/control/content/images/2026/08/windows-setup-550mib-esp.png)

That should be all. From here, you can continue with your Windows installation as normal. If you should run into problems with the system not booting after completing this tutorial, then please refer to your systems manufacturer documentation for any special hardware requirements. Look for references to UEFI boot and the UEFI System Partition in particular.

Some older hardware models required non-standard FAT16-formatted ESPs, or had special partitioning size requirements. You should be able to adjust the steps in the tutorial to accommodate such requirements.

#### Sources

- [UEFI/GPT-based hard drive partitions](https://web.archive.org/web/20180223030705/https://github.com/MicrosoftDocs/commercialization-public/blob/8e91cc5a09654f5ab791da89bcb092ab874ec6bd/manufacture/desktop/configure-uefigpt-based-hard-drive-partitions.md), 2017-07-19, Joshua Baxter, commercialization-public repository, Microsoft Docs, Microsoft, GitHub
- [DiskPart Command-Line Options](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-vista/cc766465%28v=ws.10%29?ref=ctrl.blog), 2008-07-25, Microsoft Docs
### How large should you make the UEFI System Partition?
URL: https://www.ctrl.blog/entry/esp-size-guide/
Last updated: 2026-08-23T22:05:54.000Z
You’ll find a small UEFI System Partition (ESP; sometimes EFISYS) partition on all modern computers. The ESP partition is a required system partition that holds the system boot managers on UEFI compatible computers. However, when you’re installing one or more operating systems yourself — how big should you make the UEFI partition?

In this article I’ll first look at the default suggested partition sizes suggested in some operating system installers and why, and then suggest a definitive recommendation for ESP sizing.

### Default UEFI System Partition sizes

The suggested default size of the UEFI System Partition (ESP) by various operating systems varies based on a few metrics including the physical sector size of the storage media. The size of your device’s default ESP may be completely different depending on the UEFI implementation and your hardware vendor.

The below table looks at the defaults suggested in popular operating system installers for an x86-64 processor architecture setup:

| Operating system               | Partition tool        | File system | Sector size | ESP size | EFI size   |
| ------------------------------ | --------------------- | ----------- | ----------- | -------- | ---------- |
| Fedora Linux 27                | anaconda/blivet       | FAT16       | any         | 250 MiB  | 11,5 MiB   |
| openSUSE 2018-02-10            | YaST2                 | FAT16       | any         | 500 MiB  | 4,8 MiB MB |
| openSUSE Leap 42,3             | YaST2                 | FAT16       | any         | 156 MiB  | 4,8 MiB    |
| TrueOS 17.12 (like FreeBSD 11) | ?                     | FAT16       | any         | 100 MiB  | 1,1 MiB    |
| Ubuntu 17.10 (like Debian 9)   | ubiquity/partman-auto | FAT32       | any         | 513 MiB  | 4,9 MiB    |
| Windows 7, 8.1, and 10         | Windows Setup         | FAT32       | <4 KiB      | 100 MiB  | 25 MiB     |
| Windows 10                     | Windows Setup         | FAT32       | ≥4 KiB      | 260 MiB  | 25 MiB     |
| Windows 7, 8, and 8.1          | Windows Setup         | FAT32       | ≥4 KiB      | 259 MiB  | Fails      |

There are a few interesting things to note about the default ESPs:

#### mkfs.fat defaults to FAT16 for small partitions

All the Linux based installers use a utility called mkfs.fat to format their UEFI System Partitions. It defaults to creating FAT16 file systems for partitions smaller than 260 MiB unless overridden with a special flag. For larger partitions, the utility will default to FAT32.

I believe that many of the internet myths about “too small ESP causing compatibility issues” are caused by UEFI systems that follow the UEFI Specification and require that ESPs are FAT32-formatted.

#### 4 KiB native sector drives (4 Kn) require larger partitions

Hard drives have traditionally been split in sectors of 512 bytes, but newer drives have sectors 4096 bytes (4 KiB). Most of these 4 KiB drives emulate 512 byte drives through firmware for compatibility.

However, some drives are what the industry calls high-performance “4 K native” drives that don’t emulate 512 sector sizes but expose 4 KiB sectors to the operating system.

Due to how the FAT file system works, the smallest possible size for a FAT32 partition on a 4 KiB native disk is 260 MiB compared to 32 MiB on a traditional 512-byte-sector disk.

Windows 10 and updated Windows 8.1 installers will suggest creating a 260 MiB ESP when you try to install on a 4 Kn disk, but Windows 8 and early 8.1 installers would suggest 259 MiB and the installation would fail.

None of the Linux installers I’ve examined for this article included any special handling for 4 KiB native drives. Fedora Linux 27, openSUSE Leap 42,3, and TrueOS 17,12 all use FAT16 which requires partitions to be at least 32 MiB on a 4-KiB-sector disk so they shouldn’t have any trouble creating the partitions despite suggesting to use too small partitions to use FAT32.

### Why does the ESP has to be so much bigger than the installed system?

We’ve already looked into how the file systems themselves have minimum size requirements (32 MiB on a traditional 512-byte-sector disk and 260 MiB on a newer 4 Kn type disk). However, all the installers can fit on a 32 MiB partition so why are they so much larger by default?

Windows uses only about 25 MiB out of the 100/260 MiB minimum partition size it suggest you reserve for the ESP. A small portion of the disk’s size is taken up by file system overhead. Besides that, Microsoft leaves some extra space for third-party hardware component drivers (such as special input drivers and RAID-controllers for disk arrays). There isn’t reserved any space for a second operating system for a dual-boot environment. Microsoft reserves a 100 MiB partition for Windows alone.

On the Linux side, the newest versions of Debian, openSUSE, and Ubuntu appears to be following the sizing suggestion from *The Boot Loader Specification* which suggests that the ESP partition should be about 477 MiB (500 MB).

None of these distributions follow the same specification’s suggestion of getting rid of the separate /boot partition, and install the GRUB boot loader directly onto the much larger provisioned ESP partition. This type of installation would have required 150–220 MiB space on the ESP; which is considerably larger than what all the examined Linux distributions installs onto the ESP today.

### Conclusions

The UEFI System Partition should be **at least 260 MiB** (273 MB) to ensure its properly formatted with FAT32 so that you avoid UEFI implementation compatibility issues. (If you do have incompatible hardware that requires FAT16-formatting, then I suggest you move aside the files on the UEFI System Partition, convert the partition to FAT16, and copy the files back over to it.)

Microsoft recommends you set aside **100 MiB for Windows**. Unless you decide to get away with the separate /boot partition on Linux, then **I** recommend you set aside **100 MiB of space per Linux system** you intend to install.

Keep in mind that you should allocate some space for failed and past installations, upgrade staging, and operating/file system debris as well. There’s no reason to try to squeeze down the size of the ESP to a point where it might cause issues for you in the future.

Note that you can create separate UEFI System Partitions for each operating system or install all of them on the same partition. Some operating system installers are better than others in letting you choose where you want to install their UEFI blobs.

Please feel free to submit corrections or notices of specific UEFI implementation compatibility problems you might encounter using the link below.

#### Sources

- [storage\_utils.py](https://github.com/rhinstaller/anaconda/blob/589e72dc6476f007fc6bc852d56533604b3fde1c/pyanaconda/storage%5Futils.py?ref=ctrl.blog), commit 589e72dc64, 2018-01-17, Anaconda repository, Red Hat installer project, GitHub
- [y2storage/boot\_requirements\_strategies/uefi.rb](https://github.com/yast/yast-storage-ng/blob/52089a70e3090373fa0bc122b08fd36487a8503d/src/lib/y2storage/boot%5Frequirements%5Fstrategies/uefi.rb?ref=ctrl.blog), commit 52089a70e3, 2018-01-15, yast-storage-ng repository, YaST project, GitHub
- [mkfs.fat man page](https://github.com/dosfstools/dosfstools/blob/fe3ada31627b6ee371efcfc9e6886499b0ec0d9a/manpages/mkfs.fat.8.in?ref=ctrl.blog), commit fe3ada3162, 2017-10-15, Andreas Bombe, dosfstools repository and project, GitHub
- [Unified Extensible Firmware Interface (UEFI) Specification](https://uefi.org/sites/default/files/resources/UEFI%20Spec%202%5F7%5FA%20Sept%206.pdf?ref=ctrl.blog), version 2.7 errata A, 2017-08, Unified EFI Forum
- [UEFI/GPT-based hard drive partitions](https://web.archive.org/web/20180223030705/https://github.com/MicrosoftDocs/commercialization-public/blob/8e91cc5a09654f5ab791da89bcb092ab874ec6bd/manufacture/desktop/configure-uefigpt-based-hard-drive-partitions.md), 2017-07-19, Joshua Baxter, commercialization-public repository, Microsoft Docs, Microsoft, GitHub
- [Partitions.rb](https://github.com/yast/yast-storage/blob/5a52703adc14d34f050eaca1124249a44ecfd6c9/src/modules/Partitions.rb?ref=ctrl.blog), commit 5a52703adc, 2016-07-29, yast-storage repository, YaST project, GitHub
- [The Boot Loader Specification](https://www.freedesktop.org/wiki/Specifications/BootLoaderSpec/?ref=ctrl.blog), 2016-04-21, Specifications, FreeDesktop.org
- [Increase the EFI System Partition size slightly to ensure that it's at least 512 MiB](https://salsa.debian.org/installer-team/partman-auto/blob/a5df6f5c98a58bb81e688fc3c2b6532833a8e4d0/recipes-amd64-efi/home?ref=ctrl.blog), commit a5df6f5c98, 2014-09-06, partman-auto repository, Debian
- [Important Issues in Windows 8.1](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-8.1-and-8/dn387075%28v=ws.11%29?ref=ctrl.blog), 2014-08-13, Release Notes, Install; Deploy, and Migrate to Windows, Microsoft Docs
- [EFI SYSTEM PARTITION should be atleast 100 MiB size and formatted as FAT32, not FAT16](https://bugs.launchpad.net/ubuntu/+source/partman-efi/+bug/811485?ref=ctrl.blog), bug 811485, 2011-07-16, partman-efi bug tracker, Ubuntu Launchpad, Canonical
### LastPass quietly deprecates Firefox for Android extension
URL: https://www.ctrl.blog/entry/lastpass-deprecates-firefox-android/
Last updated: 2026-08-23T22:12:55.000Z
Firefox for Android loses one of its most popular extensions as LastPass discontinued their password manager extension on 2017-02-01.

The LastPass for Firefox Mobile extension hadn’t been updated in nearly a year, and it stopped working entirely in Firefox 53 (2018-05). It’s a shame to see Firefox for Android lose such a great extension as LastPass. Extension support is the number one feature differentiator for Firefox for Android compared to Chromium/WebView based web browsers.

At the end of 2017, Firefox for Android had 0,87 % (up from 0,1 % in 2016) of the web browser market share on Android worldwide, according to StatCounter.

Firefox for Android’s relatively tiny marketshare — despite the great year-over-year growth — combined with less than a stellar development environment probably contributed to LastPass’ decision to deprecate the platform.

LastPass was slow to port their extension for Firefox for desktop from Firefox’s legacy extension platform to the new WebExtensions application programming interface (API). The updated extension wasn’t ready until days before the release of Firefox 57, the last version that supported the legacy extension platform.

The porting delay is interesting as the WebExtension API is very similar to the Chromium Extension API that have been used by Google Chrome and other web browsers for many years already. LastPass already had working extensions for these browsers, so it shouldn’t have been a huge job to port it.

As a trusted password manager, there are stricter security and testing requirements for LastPass than most other types of browser extensions. However, looking in from the outside and impatiently expecting an updated LastPass extension for desktop it didn’t appear like LastPass was on top of the situation.

The differences between the new WebExtension API for Firefox for Android and desktop are smaller than the differences were with the legacy platform. Developing extensions for Firefox for Android can more difficult than developing desktop extensions. Developer tools like [source maps](https://firefox-source-docs.mozilla.org/devtools-user/debugger/how%5Fto/use%5Fa%5Fsource%5Fmap/?ref=ctrl.blog) aren’t available, [debugging](https://www.ctrl.blog/entry/debug-firefox-webextension-android/) is more difficult, and test [deployment](https://extensionworkshop.com/documentation/develop/developing-extensions-for-firefox-for-android/?ref=ctrl.blog) is unnecessarily complex.

Google Chrome and a few other Chromium based web browsers can LastPass through the LastPass app’s *Fill Helper* on Android 8 or newer. Firefox for Android users can use the LastPass keyboard feature (enable it as a keyboard through System Settings). Notably, the keyboard feature seems to have been abandoned some years ago, so don’t be surprised if that’s deprecated and removed also.

Other popular extensions like 1Password can be installed in Firefox for Android, but the 1Password extension isn’t working on Android either. There are [other password manager extensions available](https://addons.mozilla.org/en-GB/firefox/collections/4757633/password-managers/?ref=ctrl.blog) to Firefox for Android, but I haven’t tested to see if any of them work because none of them have managed to attracted a significant number of users.

**Update** (2018-02-20): I’ve decided to switch from LastPass to [Bitwarden](https://addons.mozilla.org/en-US/firefox/addon/bitwarden-password-manager/?ref=ctrl.blog "Bitwarden password manager extension for Firefox for Android") on Android and desktop. I’ll post something about Bitwarden at a later time.

The most practical built-in password manager alternative for Firefox for Android is Firefox’s own [built-in password manager](https://www.mozilla.org/en-GB/firefox/features/password-manager/?ref=ctrl.blog) combined with [Firefox Sync](https://web.archive.org/web/20181129094958/https://www.mozilla.org/en-GB/firefox/features/sync/). I need a more flexible and portable solution than what is offered by the built-in password manager, and will be looking for a replacement password manager. Again.

#### Sources

- [“LastPass extension for Firefox on Android has been deprecated.”](https://twitter.com/LastPassHelp/status/959461869907046400?ref=ctrl.blog), 2018-02-02, LastPass Support, LastPass, Twitter
- [Re: Cannot login on Android Firefox Extension](https://web.archive.org/web/20190504161138/https://forums.lastpass.com/viewtopic.php?f=12&t=280445&start=70#p968105), 2018-01-25, martianpilot, General Support & Troubleshooting, LastPass Help & Support, LastPass Forums, LastPass
- [Mobile Browser Market Share Worldwide](https://gs.statcounter.com/browser-market-share/mobile/worldwide/?ref=ctrl.blog#quarterly-201704-201704-bar) and [Mobile Operating System Market Share Worldwide](https://gs.statcounter.com/os-market-share/mobile/worldwide/?ref=ctrl.blog#quarterly-201704-201704-bar) (Q4 2017), 2018-01, Global statistics, StatCounter
- [Differences between desktop and Android extensions](https://extensionworkshop.com/documentation/develop/differences-between-desktop-and-android-extensions/?ref=ctrl.blog), revision 1329839, 2017-11-23, Browser Extensions, Mozilla Developer Network, Mozilla
- [Firefox version 57.0 release notes (Android)](https://www.mozilla.org/en-US/firefox/android/57.0/releasenotes/?ref=ctrl.blog), 2017-11-14, Release Notes, Mozilla
- [LastPass Beta for Firefox 57](https://blog.lastpass.com/2017/10/lastpass-beta-firefox-57/?ref=ctrl.blog), 2017-10-12, Akos Putz, LastPass blog
- [Firefox add-on technology is modernizing](https://support.mozilla.org/en-US/kb/firefox-add-technology-modernizing?ref=ctrl.blog), 2017-10, Firefox Help, Mozilla
- [Mobile Browser Market Share Worldwide](https://gs.statcounter.com/browser-market-share/mobile/worldwide/?ref=ctrl.blog#quarterly-201604-201604-bar) and [Mobile Operating System Market Share Worldwide](https://gs.statcounter.com/os-market-share/mobile/worldwide/?ref=ctrl.blog#quarterly-201604-201604-bar) (Q4 2016), 2017-01, Global statistics, StatCounter
- [What browser(s) are supported with LastPass Fill Helper on Android?](https://web.archive.org/web/20190508165547/https://lastpass.com/support.php?cmd=showfaq&id=6036), 2017, Frequently Asked Questions, LastPass Support, LastPass
### Should web browsers adopt Google’s new selective ad-blocking tech?
URL: https://www.ctrl.blog/entry/google-adblocking-competition/
Last updated: 2026-08-23T22:08:45.000Z
Google has granted itself the ability to [take away advertising as a revenue stream](https://www.ctrl.blog/entry/chrome-adblocker/) for websites that don’t agree with its vision for how advertising on the web. I’ve no doubt that Google will achieve its stated goals of improving user experience across the web and reduce the number of people who install ad-blockers. However, should other web browsers grant Google the ability to decide which websites can and can’t make money from advertising?

Google has expanded its Google Safe Browsing fraud/malware protection service to identify a new type of threat to the web ecosystem: websites with advertisements that don’t comply with the Better Ads Standards. The Better Ads Standards is defined by the Coalition for Better Ads where Google and Microsoft are board members. Other web browser vendors, such as Alibaba Group (UC Browser), Apple (Safari), Mozilla (Firefox), and Yandex (.browser) aren’t coalition members at the time of publication.

Google Chrome will begin enforcing the Coalition’s will this week through automatic ad-blocking on websites identified as non-compliant by the Safe Browsing service.

Firefox, Google Chrome, and Safari have one thing in common: They all rely on the Google Safe Browsing service to help protect their users against fraud, phishing, and malware. All but the [most fringe of web browsers](https://www.ctrl.blog/entry/fraud-protection-alternate-browsers/) includes a protection service like Safe Browsing.

As noted in [my article on the new ad-blocker in Chrome](https://www.ctrl.blog/entry/chrome-adblocker/), the public API for Google Safe Browsing doesn’t yet allow third-party programs to use the Better Ads standards compliance data. However, I expect we’ll see Google provide this to other web browsers and applications in due time.

The big question then becomes: **should other web browsers allow Google to make decisions regarding which websites can be monetized with advertisements on the public web?** Google have effectively granted themselves the capability to decide who makes it on the ad-funded web.

Chrome had a dominating 55 % of the global web browser market share across all devices at the end of 2017, according to StatCounter. Google’s decisions on whether or not to block advertisements on a website will make a huge impact regardless of whether other web browsers decide to build on Safe Browsing data and build in an ad-blocking system similar to the one in Google Chrome. **Google would be granted incredible powers over the ad-funded web economy** if the other leading web browsers were to enforce The Coalition for Better Ads’ will through Google Safe Browsing.

Google Safe Browsing identifies websites that don’t meet the Better Ads Standards through automated tests. The decision on which websites end up having their ads blocked is ultimately up to Google. Google offer website publishers an [Ad Experiences Report](https://www.google.com/webmasters/tools/ad-experience-unverified?ref=ctrl.blog) that identifies whether or not a publisher’s websites are on the list, and what the potential problems with the publisher’s website are.

It’s important to note here that Google already [backs an advertisement industry wide self-regulatory policy](https://torrentfreak.com/tech-giants-sign-deal-to-ban-advertising-on-pirate-websites-130715/?ref=ctrl.blog) which aims to block advertisement on “pirate” websites. I’m certain we’ll see strong encouragement from intellectual property rights organizations for Google to use Chrome’s new selective advertisement blocking technology to strangle ‘pirate’ websites.

If you take a stroll down that same trail of thoughts, you’ll also find scary scenarios like governments pressuring Google to block critical voices and journalism. There’s no need to outright sensor someone if you can take away their funding and ability to pay their living expenses and hosting bills.

There have been no public signals from other the web browser vendors regarding whether or not they’ll implement selective ad-blocking.

User demand for ad-blocking is growing, and it’s seriously impacting content creators that make their content available for free with ads. Some web browsers like Opera have already built-in an ad-blocker that’s off by default, but will block every advertisement on the web if enabled by the user. This is no different from installing an ad-blocking extension, and Google’s more selective ad-blocking is much better for the web. overall

I’d rather see the other web browsers implement their own selective ad-blocking to improve user experience and help the web economy. They shouldn’t defer the blocking decision Google Safe Browsing service. A web browser could allow people to optionally block advertisements per-website and collect anonymous details about which websites people choose to block. The collected data could be used to block websites with higher than usual blocking rates by default. This may not be a perfect model, but it’s preferable to seeing other web browser vendors grant Google even more control over the web platform and economy.

#### Sources

- [Members](https://web.archive.org/web/20180207150031/https://www.betterads.org/members/), 2018-02, Coalition for Better Ads
- [Browser Market Share Worldwide Q4 2017](https://gs.statcounter.com/browser-market-share?ref=ctrl.blog#quarterly-201704-201704-bar), 2018-01, Global statistics, StatCounter
- [Google starts its ad-blocking purge in February](https://www.cjr.org/business%5Fof%5Fnews/google-chrome-ad-blocker.php?ref=ctrl.blog), 2017-12-20, Mathew Ingram, Columbia Journalism Review
- [Stop showing ads on websites that aren’t compliant with the Better Ads Standards](https://www.chromestatus.com/feature/5738264052891648?ref=ctrl.blog), 2017-06-27, Chrome Platform Status, Google
- [Initial Better Ads Standards: Least preferred ad experiences for desktop web and mobile web](https://web.archive.org/web/20170329180103/https://www.betterads.org/standards/), 2017-03, Coalition for Better Ads
- [Introducing native ad-blocking feature for faster browsing ](https://blogs.opera.com/desktop/2016/03/native-ad-blocking-feature-opera-for-computers/?ref=ctrl.blog), 2016-03-10, Krystian Kolondra, Opera Desktop Team blog, Opera Software
- [Tech Giants Sign Deal to Ban Advertising on “Pirate” Websites](https://torrentfreak.com/tech-giants-sign-deal-to-ban-advertising-on-pirate-websites-130715/?ref=ctrl.blog), 2015-07-15, Andy Maxwell, TorrentFreak
### Fedora Server vs. Workstation Edition
URL: https://www.ctrl.blog/entry/fedora-server-vs-workstation/
Last updated: 2026-08-23T22:06:15.000Z
Obviously, Fedora Workstation is intended for use on workstations and Fedora Server Edition is intended for servers. However, what exactly are the differences between the two editions?

Fedora Workstation and Server Edition are shipped with slightly different defaults. The primary differences are found in the default storage media partitioning and the selection of programs and packages that are installed by default.

### Default partitioning

Fedora Workstation and Server Edition will create a 1 GiB Ext4-formatted /boot partition, plus an UEFI partition if needed. Both editions will also create a swap partition (storage-backed memory) based on the available system memory.

Fedora Server Edition creates an XFS-formatted / root partition up to 50 GiB in size. Fedora Workstation does the same, but uses the Ext4 file system for its root instead of XFS.

Fedora Workstation will create an additional Ext4-formatted /home partition out of the remaining disk sizes assuming the disk has at least 51 + swap GiB available.

Fedora Workstation defers the file system selection for all partitions to the default of the blivet partitioning tool. Server Edition explicitly overrides the default and sets XFS as the root file system.

### Configuration

There are some services that are configured differently between the two editions. Most notably is the differences in the default firewall configurations.

Fedora Workstation will reject any incoming TCP/UDP connection below port 1024 (privileged ports) except to ports TCP/22 (SSH), UDP/137+138 (Samba), and UDP/546 (DHCPv6 client); but otherwise allow TCP and UDP connections.

Fedora Server Edition will reject any incoming TCP/UDP connection except to ports TCP/22 (SSH), UDP/546 (DHCPv6 client), and TCP/9090 (Cockpit).

### Default packages

The most significant difference between the two editions is, of course, the selection of default packages. Fedora Server Edition installer will install the server-product-environment package group by default, and Fedora Workstation will install the workstation-product-environment group. The Server installer or any network-installer image will let users select from more groups and customize their installations.

The following overview shows packages that are unique to the defaults of each edition. Packages that are installed in both editions have been excluded to highlight the differences:

#### Fedora Server Edition

- cockpit
- cockpit-bridge
- cockpit-networkmanager
- cockpit-packagekit
- cockpit-shell
- cockpit-storaged
- cockpit-ws
- coolkey
- ed
- fedora-release-notes
- fedora-release-server
- irqbalance
- nano
- NetworkManager-team
- rolekit
- rsyslog
- smartmontools
- sscg
- util-linux-user

#### Fedora Workstation

- aajohan-comfortaa-fonts
- abattis-cantarell-fonts
- abrt-desktop
- abrt-java-connector
- adobe-source-han-sans-cn-fonts
- adobe-source-han-sans-tw-fonts
- adobe-source-han-serif-cn-fonts
- adobe-source-han-serif-tw-fonts
- adwaita-qt4
- adwaita-qt5
- alsa-plugins-pulseaudio
- alsa-ucm
- alsa-utils
- at-spi2-atk
- at-spi2-core
- avahi
- baobab
- bluez-cups
- caribou
- caribou-gtk2-module
- caribou-gtk3-module
- cheese
- colord
- control-center
- cups
- cups-filters
- cups-pk-helper
- dconf
- dejavu-sans-fonts
- dejavu-sans-mono-fonts
- dejavu-serif-fonts
- desktop-backgrounds-gnome
- eog
- evince
- evince-djvu
- evince-nautilus
- evolution
- evolution-ews
- evolution-help
- fedora-bookmarks
- fedora-productimg-workstation
- fedora-release-workstation
- fedora-user-agent-chrome
- fedora-workstation-backgrounds
- file-roller
- file-roller-nautilus
- firefox
- foomatic
- foomatic-db-ppds
- fros-gnome
- gdm
- gedit
- ghostscript
- git
- glib-networking
- glibc-all-langpacks
- glx-utils
- gnome-backgrounds
- gnome-bluetooth
- gnome-boxes
- gnome-calculator
- gnome-calendar
- gnome-characters
- gnome-classic-session
- gnome-clocks
- gnome-color-manager
- gnome-contacts
- gnome-disk-utility
- gnome-documents
- gnome-font-viewer
- gnome-getting-started-docs
- gnome-initial-setup
- gnome-logs
- gnome-maps
- gnome-screenshot
- gnome-session-wayland-session
- gnome-session-xsession
- gnome-settings-daemon
- gnome-shell
- gnome-shell-extension-background-logo
- gnome-software
- gnome-system-monitor
- gnome-terminal
- gnome-terminal-nautilus
- gnome-themes-standard
- gnome-todo
- gnome-user-docs
- gnome-user-share
- gnome-weather
- gnu-free-mono-fonts
- gnu-free-sans-fonts
- gnu-free-serif-fonts
- google-noto-emoji-fonts
- google-noto-sans-lisu-fonts
- google-noto-sans-mandaic-fonts
- google-noto-sans-meetei-mayek-fonts
- google-noto-sans-sinhala-fonts
- google-noto-sans-tagalog-fonts
- google-noto-sans-tai-tham-fonts
- google-noto-sans-tai-viet-fonts
- gstreamer1-plugins-bad-free
- gstreamer1-plugins-good
- gstreamer1-plugins-ugly-free
- gutenprint
- gutenprint-cups
- gvfs-afc
- gvfs-afp
- gvfs-archive
- gvfs-fuse
- gvfs-goa
- gvfs-gphoto2
- gvfs-mtp
- gvfs-smb
- hplip
- hyperv-daemons
- ibus-gtk2
- ibus-gtk3
- ibus-hangul
- ibus-kkc
- ibus-libpinyin
- ibus-libzhuyin
- ibus-m17n
- ibus-qt
- ibus-rawcode
- ibus-typing-booster
- jomolhari-fonts
- julietaula-montserrat-fonts
- khmeros-base-fonts
- libcanberra-gtk2
- libcanberra-gtk3
- liberation-mono-fonts
- liberation-sans-fonts
- liberation-serif-fonts
- libproxy-mozjs
- libreoffice-calc
- libreoffice-emailmerge
- libreoffice-graphicfilter
- libreoffice-impress
- libreoffice-math
- libreoffice-writer
- librsvg2
- libsane-hpaio
- lohit-assamese-fonts
- lohit-bengali-fonts
- lohit-devanagari-fonts
- lohit-gujarati-fonts
- lohit-gurmukhi-fonts
- lohit-kannada-fonts
- lohit-odia-fonts
- lohit-tamil-fonts
- lohit-telugu-fonts
- lrzsz
- mesa-dri-drivers
- ModemManager
- mousetweaks
- mpage
- nautilus
- nautilus-sendto
- naver-nanum-gothic-fonts
- NetworkManager-adsl
- NetworkManager-openconnect-gnome
- NetworkManager-openvpn-gnome
- NetworkManager-pptp-gnome
- NetworkManager-ssh-gnome
- NetworkManager-vpnc-gnome
- nss-mdns
- open-vm-tools-desktop
- orca
- PackageKit-command-not-found
- PackageKit-gstreamer-plugin
- PackageKit-gtk3-module
- paktype-naskh-basic-fonts
- paps
- paratype-pt-sans-fonts
- pinentry-gnome3
- plymouth-system-theme
- ppp
- pulseaudio
- pulseaudio-module-x11
- pulseaudio-utils
- qemu-guest-agent
- qgnomeplatform
- qt
- qt-settings
- qt-x11
- qt5-qtbase
- qt5-qtbase-gui
- qt5-qtdeclarative
- qt5-qtxmlpatterns
- rdist
- rhythmbox
- rp-pppoe
- rygel
- samba-client
- sane-backends-drivers-scanners
- scl-utils
- setroubleshoot
- shotwell
- sil-abyssinica-fonts
- sil-mingzat-fonts
- sil-nuosu-fonts
- sil-padauk-fonts
- simple-scan
- smc-meera-fonts
- spice-vdagent
- stix-fonts
- sushi
- system-config-printer-udev
- tabish-eeyek-fonts
- thai-scalable-waree-fonts
- totem
- totem-nautilus
- tracker
- tracker-miners
- unoconv
- vlgothic-fonts
- wvdial
- xdg-desktop-portal
- xdg-desktop-portal-gtk
- xdg-user-dirs-gtk
- xorg-x11-drv-armsoc
- xorg-x11-drv-ati
- xorg-x11-drv-evdev
- xorg-x11-drv-fbdev
- xorg-x11-drv-intel
- xorg-x11-drv-libinput
- xorg-x11-drv-nouveau
- xorg-x11-drv-omap
- xorg-x11-drv-openchrome
- xorg-x11-drv-qxl
- xorg-x11-drv-vesa
- xorg-x11-drv-vmware
- xorg-x11-drv-wacom
- xorg-x11-server-Xorg
- xorg-x11-utils
- xorg-x11-xauth
- xorg-x11-xinit
- yelp

Unsurprisingly, Fedora Workstation installs [GNOME](https://www.gnome.org/?ref=ctrl.blog) and a complete desktop environment whereas Server Edition installs a base-system and headless management tools such as the [Cockpit server administration web interface](https://cockpit-project.org/?ref=ctrl.blog).

There isn’t much going on here beyond what you’d expect to see. However, I’d like to see the remarkably useful Cockpit administration dashboard installed by default on Workstation edition as well.

This comparison was done with Fedora Linux 27.

#### Sources

- [installclass.py](https://github.com/rhinstaller/anaconda/blob/40fc2d9f4822e8960d55f1fc35dcb325460b81cf/pyanaconda/installclass.py?ref=ctrl.blog), commit 40fc2d9f48, 2018-01-16, Anaconda repository, Red Hat installer project, GitHub
- [installclasses/fedora\_server.py](https://github.com/rhinstaller/anaconda/blob/8dfd840f725213603d581184f71eb7305c3e6b56/pyanaconda/installclasses/fedora%5Fserver.py?ref=ctrl.blog), commit 8dfd840f72, 2018-01-10, Anaconda repository, Red Hat installer project, GitHub
- [installclasses/fedora\_workstation.py](https://github.com/rhinstaller/anaconda/blob/8dfd840f725213603d581184f71eb7305c3e6b56/pyanaconda/installclasses/fedora%5Fworkstation.py?ref=ctrl.blog), commit 8dfd840f72, 2018-01-10, Anaconda repository, Red Hat installer project, GitHub
- [comps-f27.xml.in](https://pagure.io/fedora-comps/blob/2b71d398c448ac6602a2c4d281179a1975512d7b/f/comps-f27.xml.in?ref=ctrl.blog), commit 2b71d398c4, 2018-01-02, fedora-comps repository, Pagure
- [storage/partspec.py](https://github.com/rhinstaller/anaconda/blob/24fd01576426c3a3c6cc03d3ee1416b1e1457548/pyanaconda/storage/partspec.py?ref=ctrl.blog), commit 24fd015764, 2017-10-25, Anaconda repository, Red Hat installer project, GitHub
- [installclasses/fedora.py](https://github.com/rhinstaller/anaconda/blob/e2c9b82afb3972f1243053c1633431b508bfef4a/pyanaconda/installclasses/fedora.py?ref=ctrl.blog), commit e2c9b82afb, 2017-08-01, Anaconda repository, Red Hat installer project, GitHub
- [Anaconda](https://fedoraproject.org/w/index.php?title=Anaconda&oldid=495124&ref=ctrl.blog), revision 495124, 2017-06-20, Fedora Project wiki
- [FedoraServer.xml](https://web.archive.org/web/20190504163610/https://src.fedoraproject.org/rpms/firewalld/blob/HEAD/f/FedoraServer.xml?h=3bcc74d62620fec22b31bca27dc5e5b4fa3fb07e), commit 3bcc74d626, 2014-07-08, Thomas Woerner, rpms/firewalld.git, Fedora Project
- [FedoraWorkstation.xml](https://web.archive.org/web/20190504170229/https://src.fedoraproject.org/rpms/firewalld/blob/HEAD/f/FedoraWorkstation.xml?h=3bcc74d62620fec22b31bca27dc5e5b4fa3fb07e), commit 3bcc74d626, 2014-07-08, Thomas Woerner, rpms/firewalld.git, Fedora Project
### Flatpak, Steam Cloud, XDG Base, and why Linux doesn’t sync progress
URL: https://www.ctrl.blog/entry/flatpak-steamcloud-xdg/
Last updated: 2026-08-23T22:07:05.000Z
If you’ve installed Steam on Linux through Flathub, chances are that Steam Auto-Cloud — Steam’s free game progress synchronization service — won’t work for many of your games that are built with the markets most popular game engines. I’ve dug into why it isn’t working, and discuss two possible solutions to fix the problem.

Before we get into the issue, I’ll first need to establish quite a bit of context regarding where games and applications store their configuration files and user data, and how they decide on where to store it. If you’re already familiar with the XDG Base Directory specification, you can glance at the tables and skip straight to the third section.

The Steam for Flatpak package on Flathub is a third-party community effort and isn’t endorsed nor supported by Valve Corporation.

### Where applications should store their configuration and data

Historically, applications on Linux would store their configuration and other files in a hidden directory inside each user’s home directory. This created a huge mess in the home directory, and the legacy from those ancient times still drive neat-freak users insane to this day.

The XDG Base Directory specification provides a set of rules for where configuration and user data, cache data, and other common data types should be stored to clean up people’s home directories. A tidier home directory provides other benefits such as easier to configure backups.

The XDG Base Directory specification specifies two folders of particular interest: the $XDG\_CONFIG\_HOME directory for user-specific application configuration data (defaults to \~/.config/), and the $XDG\_DATA\_HOME directory for user-created data files (defaults to \~/.local/share/). XDG Base Directory compliant applications should first attempt to read these values from the environment variables, or fallback to the default paths if these variables aren’t set in the runtime environment.

Other operating systems have similar directory schemes such as the Application Support and Configurations directories in the user Library directory on MacOS, and the Local, LocalLow, and Roaming directories in the user AppData directory on Windows.

### Flatpak overrides the XDG Base Directory defaults

Flatpak can run applications in a limited environment where applications can’t read and write to the user’s home directory (\~/). Each application instead get their own data directory at \~/.var/app/com.example.Application/ for storing persistent user data. The Flatpak runtime environment overrides the XDG base directories per-application by pointing the override environmental variable to the application specific directories in the per-application Flatpak data directory.

The below table shows where XDG base directories are located by default, and where they are located inside the per-application Flatpak data directory:

| Env. variable      | XDG default path | Flatpak path                                |
| ------------------ | ---------------- | ------------------------------------------- |
| $XDG\_CACHE\_HOME  | \~/.cache/       | \~/.var/app/com.example.Application/cache/  |
| $XDG\_CONFIG\_HOME | \~/.config/      | \~/.var/app/com.example.Application/config/ |
| $XDG\_DATA\_HOME   | \~/.local/share/ | \~/.var/app/com.example.Application/data/   |

Applications that don’t comply with the XDG Base Directory standard and don’t read the environmental variables will end up storing data in the wrong directory outside the per-application Flatpak data directory. Note that depending on the specific Flatpak application, the home directory may not be readable or writable. A more secure Flatpak application will be more limited, but Steam has broader permissions than many other applications as Steam itself is meant to be used as a runtime for other third-party applications downloaded through the service.

Games built using either of the two popular game engines Unity 3D or Unreal Engine will by default save game progress to $XDG\_CONFIG\_HOME/unity3d/GameStudioName/GameName/ or $XDG\_CONFIG\_HOME/Epic/. These games will correctly pickup on the overridden XDG environmental variable and save their game progress inside the Flatpak per-application data directory created for Steam. This is provided for game developers by the data storage functions in the game engines, and these game engines use the XDG Base Directory specification. Game developers may not be too familiar with the Linux platform and may be completely unaware that Unity 3D and Unreal Engine may store data at any paths other than the default.

Games built on other game engines, or games that don’t use the directory-mapping functions provided by their game engines may hardcode the default directories or save to other directories entirely.

### Steam Auto-Cloud

Game developers can provide game-progress synchronization as a free add-on service to their customers through one of two integration options: the Steam Cloud API or Steam Auto-Cloud. Most developers prefer the latter because it doesn’t require any changes to the game’s code. Instead, developers configure Steam to automatically synchronize a directory or set of files at an arbitrary location in the home folder.

To configure Auto-Cloud, developers must first select one of 14 predefined directory root directory variables which map to specific directories on the file system, and then setup the path and file patterns they want to synchronize. Auto-Cloud works like most other consumer-grade file synchronization services, and Steam will automatically synchronization the files specified by game developers at the beginning and end of your gaming sessions.

For the Linux platform, there are two documented and one undocumented Steam Cloud root directory variables available:

| Steam Cloud root   | Env. variable      | Default path     | Comment       |
| ------------------ | ------------------ | ---------------- | ------------- |
| LinuxHome          | $HOME              | \~/              |               |
|                    | $XDG\_CACHE\_HOME  | \~/.cache/       |               |
| LinuxXdgConfigHome | $XDG\_CONFIG\_HOME | \~/.config/      | Undocumented. |
| LinuxXdgDataHome   | $XDG\_DATA\_HOME   | \~/.local/share/ |               |

According to Steam Database, there are only six games in the entire Steam game catalog that have configured Steam Cloud to use the undocumented LinuxXdgConfigHome root. 114 other games have instead set their root to LinuxHome and hardcoded the path .config. This means that only six of the games that store data in the $XDG\_CONFIG\_HOME directory will synchronize game progress to and from the correct $XDG\_CONFIG\_HOME path inside Steam’s data directory in Flatpak. The 114 other games that use the hardcoded path will instead save to the user’s home directory instead.

[![Auto-Cloud path mapping example for a Unity 3D game](https://cdn.synaps.media/control/content/images/2026/08/steam-autocloud-unity-documentation-example.png)](https://cdn.synaps.media/control/content/images/2026/08/steam-autocloud-unity-documentation-example.png?ref=ctrl.blog) 

Auto-Cloud configuration example for a Unity 3D game using the wrong root. Image courtesy of Steamworks documentation, Valve Corporation.

As previously mentioned, the LinuxXdgConfigHome variable isn’t part of the Steam Auto-Cloud documentation that Valve offers to developers. Instead, Valve suggests that developers choose the LinuxHome variable and hardcode the .config directory path. *Thanks Valve….*

An estimated 450 other games also use LinuxHome and either hardcodes the path to .local/share/ or use different paths entirely.

### So, what can be done about fixing Steam in Flatpak?

This is a difficult problem to get right. The earliest version of Steam that was published on Flathub in June 2017 got this partially right. It created a new home directory inside the $XDG\_DATA\_HOME directory inside the data directory at \~/.var/app/com.valvesoftware.Steam/home/. It would then rewrite the $HOME variable to this path and would thus ensure everything would be stored inside Steam’s data directory.

However, this solution didn’t go far enough in overriding environmental variables. Steam Auto-Cloud and games that had hardcoded their directory paths relative to the home directory worked splendid with this setup. The XDG Base Directory environmental variables, which are overridden in Flatpak runtime environments, still didn’t point at the same directories even when the home directory was moved inside the Flatpak data directory. The following table shows paths and variables relative to the root of the data directory at \~/.var/app/com.valvesoftware.Steam/. 

| Steam Cloud root   | Env. variable      | Flatpak path | Proposed override    |
| ------------------ | ------------------ | ------------ | -------------------- |
| LinuxHome          | $HOME              |              | ./home/              |
|                    | $XDG\_CACHE\_HOME  | ./cache/     | ./home/.cache/       |
| LinuxXdgConfigHome | $XDG\_CONFIG\_HOME | ./config/    | ./home/.config/      |
| LinuxXdgDataHome   | $XDG\_DATA\_HOME   | ./data/      | ./home/.local/share/ |

This approach was reverted at the end of October 2017, and Steam was granted permission to write to the actual home directory instead. This lowers the level of security that the Steam Flatpak can provide. However, the XDG Base Directory overrides remained untouched.

I can suggest two possible solutions:

#### 1\. Move $HOME back into the Flatpak data directory and override XDG variables

The first solution is to restore the original idea of moving the home directory into the Flatpak data directory and overriding the $HOME variable (re-homing). The same launcher script that sets up this override could then also override the thee XDG base directory environmental variables discussed in this article to point to their default paths inside the re-homed home directory. Every application should then agree on where data is stored.

The launcher would also have to create these three directories inside the re-homed home directory as Steam assumes that these directories exist already on its first launch and will crash if they don’t exist.

#### 2\. Override the XDG overrides to restore their defaults

The second solution is to abandon re-homing and the idea of neatly keeping application user-data away from the actual home directory. Instead, the launcher script could be modified to override the Flatpak overrides of the three XDG Base Directory variables discussed in this article to point each of them to their default paths in the actual home directory. Much like the first suggested solution, this should make every application agree on where data is stored.

You may notice that these proposed solution acknowledge that it’s near impossible to change the XDG Base Directory variables and focus on mapping them to their default values. There are simply too many applications that have made assumptions about the environment without being familiar with the Linux desktop ecosystem. Given that all the applications we’re dealing with are closed-source, there isn’t much the community can do to fix the situation.

Both of the above solutions will cause some players to lose their local game progress. The task of migrating possibly hundreds of unknown directories from multiple unknown paths and merging them to another unknown path is simply too complex to automate. Even given perfect knowledge of all the directories involved wouldn’t help much as automating conflict-resolution of both local duplicates and conflicting Steam Cloud saves would surely cause data loss for players.

### The status quo

So, the current situation is a bit of a mess.

**Update** (2018-12-03): This issue has been fixed and Steam Cloud should now work will all your games.

Players shouldn’t install Steam through Flathub until these issues are resolved. There will be a data loss at some point down the line when the issues discussed in this article are resolved.

Players can temporarily work-around the issues by creating elaborate symlinks between the mismatched directories mentioned in this article. However, in my testing I found that many games don’t follow symlinks and some crash on start-up if their data directories are symlinked.

The only thing I fault Valve Corporation with in all of this is to recommend hardcoding the .config directory inside their LinuxHome root variable instead of recommending developers use their LinuxXdgConfigHome root variable. I’ve contacted Valve regarding updating their documentation.

#### Sources

- Custom database search query on Steam Auto-Cloud root and path usage for this article, [Steam Database](https://steamdb.info/?ref=ctrl.blog),2018-01-30, Pavel Djundik, Steam Database
- [Steam Cloud path conflicts breaks game-save syncing](https://github.com/flathub/com.valvesoftware.Steam/issues/60?ref=ctrl.blog), issue 60, 2018-01-29, Daniel Aleksandersen, com.valvesoftware.Steam flatpak repository, Flathub project, GitHub
- [com.valvesoftware.Steam flatpak package](https://github.com/flathub/com.valvesoftware.Steam/tree/54827bfbe8aeb7fa3a459c988ee966cae064a986?ref=ctrl.blog), revision 54827bfbe8, 2017-12-15, com.valvesoftware.Steam flatpak repository, Flathub project, GitHub
- [steam-wrapper](https://github.com/flathub/com.valvesoftware.Steam/blob/fb26150f57a47e748a36c7a757eb364aa654233a/steam-wrapper?ref=ctrl.blog), revision fb26150f57, 2017-10-28, com.valvesoftware.Steam flatpak repository, Flathub project, GitHub
- [steam-wrapper](https://github.com/flathub/com.valvesoftware.Steam/blob/200f5140f133477f2544e1895ce4c955764a67bc/steam-wrapper?ref=ctrl.blog), revision 200f5140f1, 2017-06-19, com.valvesoftware.Steam flatpak repository, Flathub project, GitHub
- [Application.persistentDataPath](https://docs.unity3d.com/2017.3/Documentation/ScriptReference/Application-persistentDataPath.html?ref=ctrl.blog), version 2017.3, 2017-03, Scripting API, Unity Documentation, Unity Technologies
- [Steam Cloud](https://support.steampowered.com/kb%5Farticle.php?ref=6736-QEIG-8941), 2017, Knowledge Base, Steam Support, Valve Corporation
- [Filesystem](https://github.com/flatpak/flatpak/wiki/Filesystem/b8bd642b24b965e3e3ed5bb8e6dab776c61cbba8?ref=ctrl.blog), commit b8bd642b24, 2016-05-16, Flatpak project wiki, Flatpak repository, GitHub
- [Steam Cloud](https://partner.steamgames.com/doc/features/cloud?ref=ctrl.blog), 2016, Steamworks Documentation, Valve Corporation
- [What’s new in Unity 5.0](https://web.archive.org/web/20150304172427/https://unity3d.com/unity/whats-new/unity-5.0), 2015-03-03, Unity 3D Features, Unity Technologies
- [XDG Base Directory Specification](https://specifications.freedesktop.org/basedir-spec/basedir-spec-0.7.html?ref=ctrl.blog), version 0.7, 2014-04-02, FreeDesktop.org

*Thanks to Pavel Djundik of [Steam Database](https://steamdb.info/?ref=ctrl.blog) for digging up numbers on the roots and paths used by Linux games in their Steam Auto-Cloud configuration!*
### How Chrome’s built-in ad-blocker works
URL: https://www.ctrl.blog/entry/chrome-adblocker/
Last updated: 2026-08-23T22:03:11.000Z
Google Chrome will begin blocking ads on some websites by default on 15th February 2018. I took a look at Chromium source-code to find out a bit more about how this new ad-blocker will work.

At the end of 2017, Google Chrome had nearly 55 % of the web browser market share across all devices worldwide, according to StatCounter. Any changes it implement immediately changes how the web operates and how websites an monetize.

Google have announced that their Google Chrome web browser will block every ad on websites that aren’t compliant with the Better Ads Standards by default. Google admits that they’re taking action against the types of web advertisements that annoy people the most in an order to halt the rise in ad-blockers that block all forms of advertisements on all websites.

The Better Ads Standards are a set of rules, one set for desktop and one for mobile, that define unacceptably intrusive, distracting, and annoying advertisement formats. The standards ban ad formats like auto-playing video ads, large ads that stick to the screen when you scroll, and interstitial ads. The standards are created by the Coalition for Better Ads, which includes advertisement industry organizations and companies like Microsoft and Google.

### Powered by Google Safe Browsing

Google Chrome already blocks malware, fraud, phishing, pop-up/under/-redirects, and other unwanted behavior through their Google Safe Browsing service. Chrome checks every website you visit against a list of malicious websites that it periodically downloads from Safe Browsing.

Google have extended the Safe Browsing service to include a new type of threat called “BETTER\_ADS”. Websites that don’t comply with the Better Ads Standards will be labeled as being a threat of this type, and the browser can take actions against them according to user settings. Ad-blocking will be enabled by default on desktop and mobile. Users can opt-out of the ad-blocker by going to Chrome Settings: Content Settings: Ads and disabling the feature.

Safe Browsing is built-in to many web browsers including Google Chrome, Mozilla Firefox, and Safari. Not all web browsers block all types of unwanted software or behavior that the Safe Browsing service can identify.

At the time of publication, this new type of threat data isn’t available in the public API for Safe Browsing that Google offers to third-party developers. However, Google might offer the list of websites that don’t comply with the Better Ads Standards to other web browsers at some point in the future. I don’t want to see [other web browsers cede control over ad-blocking to Google](https://www.ctrl.blog/entry/google-adblocking-competition/), however.

Which websites end up on the blocklist is entirely at Google’s discretion. Google is going through and analyzing websites to determine whether they meet the Better Ads Standards or end up on the blocklist. Google offer website publishers an [Ad Experiences Report](https://www.google.com/webmasters/tools/ad-experience-unverified?ref=ctrl.blog) that identifies whether or not a publisher’s websites are on the list, and what the potential problems with the publisher’s website are.

So, how is Google going to block advertisement on offending websites?

### EasyList and EasyPrivacy blocklists

Google Chrome will periodically download a set of block rules, which consist of two popular ad-blocking lists: EasyList (advertisement) and EasyPrivacy (tracking). EasyList and EasyPrivacy is built-in to many popular ad-blocking extension including uBlock Origin and AdBlock Plus, as well as in privacy oriented apps and web browsers. Google’s ad-blocking capabilities will be on par with the best tools available from day one.

These lists are used to limit what resources are loaded on websites identified by Safe Browsing as being non-compliant with the Better Ad Standards. Google’s implementation is a bit different from how most extension ad-blocking is enforced. It does it at an earlier stage in the rendering processes than extensions have access to.

Google appears to be shipping the entirety of EasyList and EasyPrivacy; which include blocking rules for Google’s own AdSense and DoubleClick advertisement platforms as well as Google Analytics, and other Google services.

![Chrome Site Settings for Ads](https://cdn.synaps.media/control/content/images/2026/08/chrome-block-ads-desktop-settings.png)

Chrome’s user-interface permits users to allow ads on a blocklisted website. However, users can’t add their own websites to the blocklist. The user interface on desktop is a bit confusing when it’s referring to “Allow” and “Block” in Site Settings. The actual choices users have are Block-if-on-the-blocklist or Allow.

I’d personally like to see Google give their users the power to enable the blocklist on a per-website basis themselves. Users who want this level of granular control still have to install a third-party ad-blocking extension.

Power-users can force-update the blocklists manually by going to `chrome://components` and updating the “Subresource Filter Rules” component. The update takes effect on new pageloads. You don’t need to restart the browser.

### Notifications

Users will be notified of any blocking action using either a notification in the address field (“the omnibox”) on desktop, or with a notification toolbar on mobile. These work the same as similar pop-ups used for cookie and pop-up blocking.

[![Chrome UI: blocking ads on desktop](https://cdn.synaps.media/control/content/images/2026/08/chrome-blocked-ads-desktop.png)](https://cdn.synaps.media/control/content/images/2026/08/chrome-blocked-ads-desktop.png?ref=ctrl.blog) 

[![Chrome UI: blocking ads on mobile](https://cdn.synaps.media/control/content/images/2026/08/chrome-blocked-ads-mobile.png)](https://cdn.synaps.media/control/content/images/2026/08/chrome-blocked-ads-mobile.png?ref=ctrl.blog) 

Ad-blocking notification on desktop (first/left) and Android (last/right).

The notification gives users the option to Allow ads to be loaded and allow-list the current website. The notifications can’t be disabled without disabling the ad-blocker.

To be honest, I don’t believe any user want to see these notifications. It’s subtle enough on desktop, but the info toolbar on mobile takes up a relatively large part of the available space on the screen. However, notifying users every time Chrome blocks any advertisements makes the system somewhat transparent — even though users frankly won’t care one bit.

It will be interesting keep an eye on this and see whether Chrome’s new built-in ad-blocker will be enough to have any effect on the number of users who install ad-blockers. In an ideal situation, the Better Ads Standards will remove enough pain-points for users to accept the remaining ads and don’t be tempted/reminded to install a third-party ad-blocker that blocks all online advertising.

#### Sources

- [safe\_browsing/db/util.h](https://chromium.googlesource.com/chromium/src.git/+/2fd18acbc089387f9db59c2b152eb1bea8cd7b76/components/safe%5Fbrowsing/db/util.h?ref=ctrl.blog), commit 2fd18acbc0 2018-01-12, Chromium code repository, Google Git, Google
- [safe\_browsing/db/v4\_get\_hash\_protocol\_manager.cc](https://chromium.googlesource.com/chromium/src.git/+/2fd18acbc089387f9db59c2b152eb1bea8cd7b76/components/safe%5Fbrowsing/db/v4%5Fget%5Fhash%5Fprotocol%5Fmanager.cc?ref=ctrl.blog), commit 2fd18acbc0, 2018-01-12,Chromium code repository, Google Git, Google
- [Browser Market Share Worldwide Q4 2017](https://gs.statcounter.com/browser-market-share?ref=ctrl.blog#quarterly-201704-201704-bar), 2018-01, Global statistics, StatCounter
- [Coalition for Better Ads to Introduce Better Ads Experience Program](https://www.betterads.org/blog/coalition-for-better-ads-to-introduce-better-ads-experience-program?ref=ctrl.blog), 2017-12-18, Coalition for Better Ads
- [subresource\_filter/content/content\_activation\_list\_utils.cc](https://chromium.googlesource.com/chromium/src.git/+/ba2d685c04f9b1a228caa4dc0a0c9565b5e093f2/components/subresource%5Ffilter/content/browser/content%5Factivation%5Flist%5Futils.cc?ref=ctrl.blog), commit ba2d685c04, 2017-11-10, Chromium code repository, Google Git, Google
- [ThreatType](https://developers.google.com/safe-browsing/v4/reference/rest/v4/ThreatType?ref=ctrl.blog), 2017-07-31, Google Safe Browsing Safe Browsing APIs (v4), Google Developers portal, Google
- [Building a better web for everyone](https://blog.google/technology/ads/building-better-web-everyone/?ref=ctrl.blog), 2017-07-01, Sridhar Ramaswamy, Journalism & News, The Keyword, Google
- [Stop showing ads on websites that aren’t compliant with the Better Ads Standards](https://www.chromestatus.com/feature/5738264052891648?ref=ctrl.blog), 2017-06-27, Chrome Platform Status, Google
- [Improving advertising on the web](https://blog.chromium.org/2017/06/improving-advertising-on-web.html?ref=ctrl.blog), 2017-06-01, Rahul Roy-Chowdhury, Chromium Blog, Google
- [Initial Better Ads Standards: Least preferred ad experiences for desktop web and mobile web](https://web.archive.org/web/20170329180103/https://www.betterads.org/standards/), 2017-03, Coalition for Better Ads
### Replaced the default Google Now Launcher app to save my Nexus 5X
URL: https://www.ctrl.blog/entry/google-now-launcher-memory/
Last updated: 2026-08-23T22:08:57.000Z
The perceived performance of my Nexus 5X has never been all that great. The app-swapping animations would stutter when switching between apps and the apps became unresponsive for a second or two after swapping. My background apps, usually a podcast or audio book player, would get killed-off while I was listening to them even when the display had been locked for a few minutes and I wasn’t otherwise using the device. The experience wasn’t great, but I could newer pin down the issue until now.

I’d looked into the memory usage of the device and noticed that the device’s 2 GB of memory was constrained. My apps seldom used more than 2–400 MB of memory, but the reported average total memory usage was usually around 1,8 GB at all time. 0,9–1,4 GB of the device’s memory was eaten up by System, plus the memory used by the default apps and services. Rebooting the device every morning cleared up the System’s memory usage for a few hours, but the problem would return.

There’s nothing wrong with high memory usage if the device can manage it properly. Having free available memory does you no good; it’s there to be used. However, my Nexus 5X was clearly behaving like memory was constrained and the out-of-memory reaper (oom-reaper; the process that “kills” processes when running low on memory) were killing off my apps even while I was typing data into them.

Uninstalling apps and widgets didn’t help, and the memory usage report indicated that my apps weren’t the issue anyway. I’d tried going through a factory reset and avoided installing any apps at all and sticking with the Google provided default apps, but this didn’t make much of a difference. I learned to live with the abruptly interrupted audio and stuttering app-switching, and have done so for nearly two years.

My Nexus 5X defaults to the Google Now Launcher; a now *kind-of-but-not-entirely-discontinued* Google product. On a whim I decided to install a third-party launcher that resembles the Now Launcher but didn’t include the Google Now service screen (the “minus-one” screen.) My motivation was just to remove Google Now as I don’t use it but keep opening it by accident as it has such a prominent position on Android.

I didn’t notice the difference at first, but my phone stopped killing off my background apps and switching between apps went much faster and smoother. I looked into the memory consumption of my device, and notice it had dropped from 1,8 GB on average to 1,5 GB. Most notably, the system service now took up less memory than when I used the Google Now Launcher.

I had always just assumed that the Google provided launcher were doing a good job, but I now started questioning that assumption. I also notice that the Gboard (formerly Google Keyboard) process had an average memory consumption of 200 MB. I honestly don’t know how much memory a virtual keyboard software is supposed to use, but this seemed excessive. I went in to Gboard settings and disabled just about every feature I could find an off switch for: text suggestions strip, offensive word blocker, suggest contact names and personalized suggestions, glide typing, personal dictionary synchronization, predictive search, and usage statistics submission.

Within a few hours of use, the average memory consumption had fallen from 200 MB to 55 MB, which sounds more reasonable. Average system memory at this time was down to an average of 1,2 GB. The numbers has remained fairly stable like this with regular use for the last few weeks. My Nexus 5X has never felt this fast! I can instantly switch between apps now while listening to audiobooks! It’s amazing.

I’m not at all sure how representative my memory usage numbers are to that of other Nexus 5X owners. I do have some custom settings that could affect memory usage like having my device setup with two input languages. This could help explain a higher than normal memory footprint on the virtual keyboard app. I don’t believe it alone would explain the high system memory usage. In my experience, disabling the add-on services that Google have built-in to the keyboard app freed up a lot more memory than removing all but one of the input languages I’ve configured.

In any case, scaling back on unnecessary functionality in the virtual keyboard app combined with swapping out the default launcher did miracles for my Nexus 5X. I’m not sure why, but it never occurred to me to question the pre-installed software. The Nexus line of phones was supposed to be the best of the best of what is known as “stock-Android”.

I falsely believed that Android was doing a good enough job with memory management that a performance issue like the one I experienced shouldn’t have been an issue. To anyone experiencing performance issues with the Android devices, especially if these issues appeared after a system or app upgrade, do take the time to learn about and investigate your device’s memory utilization.

#### Sources

- [Google Now Launcher to be discontinued by Google](https://www.androidcentral.com/google-now-launcher-be-discontinued-google?ref=ctrl.blog), 2017-02-03, Ara Wagoner, Android Central, Future
### How to change the BitLocker boot-screen language and keyboard layout
URL: https://www.ctrl.blog/entry/preboot-bitlocker-localization/
Last updated: 2026-08-23T22:15:55.000Z
Localization support in Windows 10 is pretty good with most parts of the operating system and Windows platform supporting user-defined locale settings. By installing a language pack, you can change the interface language everywhere in Windows — except in the BitLocker Device Encryption pre-boot environment.

You normally can’t encrypt your Windows operating system drive with BitLocker unless your device has a Trusted Platform Module (TPM) device. However, you can configure Windows to prompt for a password in the pre-boot stage rather than relying on a TPM by enabling the Windows Components: BitLocker Drive Encryption: Operating System Drives: Require additional authentication at startup system policy.

When booting your device in such a setup you’ll be prompted with the following screen:

![Pre-boot screen prompting for BitLocker password](https://cdn.synaps.media/control/content/images/2026/08/bitlocker-preboot-password-entry.png)

This simple looking screen is very limited when it comes to input. You can’t bring up the Windows on-screen keyboard, the Windows touch-screen keyboard, or change the keyboard input layout. You can’t use compositing keys or even press Ctrl+A to select all text in the input field. Normal conventions for input doesn’t apply on this screen.

This can be a problem for bilingual users who use multiple keyboard layouts or a single keyboard layout different from the Windows display language, and for users with [custom keyboard layouts](https://www.ctrl.blog/entry/windows-keyboard-layout-inadequacies/). Any custom layout would be installed onto the encrypted disk so it makes sense that it won’t be available on this screen. However, you don’t have any indication of what keyboard layout you’re using and input is obviously masked with \* as this is a password field.

As you can see above, there also isn’t a keyboard layout indicator anywhere on the pre-boot screen.

What makes this more confusing is that the keyboard layout on this screen follows the default keyboard layout of the Windows installation media language, and not the Windows user, default, or system language and locale or keyboard layout settings. In other words, the only way to change the language and thus the keyboard layout on this screen is to download a Windows installation media which uses your preferred keyboard layout and reinstall Windows.

Notably, when configuring a pre-boot environment password for Windows Device Encryption; you’ll be prompted to use letters, numbers, and special symbols. There’s no warning or information provided if you’re using a keyboard layout that’s different from the keyboard layout that you’ll be required to input on the boot screen.

Depending on your keyboard layout and language settings, **it may be impossible for you to input the same password** again in the BitLocker pre-boot environment as you created for your system inside Windows. Unless you’ve your device’s BitLocker recovery key at the ready, you may be permanently locked out of your Windows installation.

![Dialog prompting for new BitLocker password](https://cdn.synaps.media/control/content/images/2026/08/bitlocker-create-a-password.png)

So, there are a lot of different problems with the BitLocker pre-boot environment and localization. It’s a pretty big deal that you can’t change the keyboard layout and language independently of each other. It’s even more of a problem when you can’t change the language without reinstalling the operating system from scratch. On top of these issues, the user isn’t notified in any way about these limitations when setting up their encryption password.

If the user were told that they’d be limited to another keyboard layout for their password, they could avoid including symbols and characters/numbers in their password that vary between their own keyboard layout and the pre-boot environment keyboard layout. This isn’t a good solution, but it would at least help the user avoid locking them out of their own computers.

I can’t fault Microsoft for not making localization work perfectly in an optional feature that has to be enabled by group policy. However, Microsoft should at least have provided their users with more information about the limitations of this feature to help people avoid characters and symbols in passwords that won’t work in.

You can leave feedback to Microsoft and vote on [this report in the Windows Feedback Hub](feedback-hub:?contextid=110&feedbackid=4a424200-d520-4013-becd-e3d3b0bbdce6&form=1&src=1) (link only works on Windows 10) to let them know you consider this an important issue.
### Permanent redirects are supposed to be permanent
URL: https://www.ctrl.blog/entry/permanent-redirects/
Last updated: 2026-08-23T22:15:20.000Z
Every web developer should already be familiar with the ‘301 Moved Permanently’ redirect and maybe even the newer ‘308 Permanent Redirect’ status responses in HTTP. Did you know that you shouldn’t just follow the redirect to the new location, but update your stored reference to point to the new location?

In my article [Best practices for caching of syndication feeds](https://www.ctrl.blog/entry/feed-caching/), I mention that feed clients shouldn’t keep pulling the same old URL over and over again when encountering a permanent redirect. According to the HTTP specification, they’re supposed to direct future references to permanently redirected resources to the new location directly without first going through the redirect.

This won’t only speed up future feed updates, but also helps ensure that the feed will keep working in the future in case an old domain, website, or just the redirect goes away. This doesn’t only apply to syndication feeds, but all documents and resources on the web. A permanent redirect is a signal of a permanent change, and your content management system (CMS) or program should respond to that signal accordingly.

Developers often forget that permanent is supposed to be permanent, and from the feedback I’ve received on my best practices article, web developers are also entirely unaware of this part of the HTTP specification. So, here’s the relevant section from RFC 7538 (the exact same language is applied to 301 Moved Permanently in RFC 7231):

> “The 308 (Permanent Redirect) status code indicates that the target resource has been assigned a new permanent URI and any future references to this resource ought to use one of the enclosed URIs.”  
>  
> “Clients with link editing capabilities ought to automatically re-link references to the effective request URI to one or more of the new references sent by the server, where possible.”

Developers of content management platforms, syndication engines, etc. are clearly not aware of or care about the permanent nature of redirects. I’m still processing thousands of syndication feed requests for addresses that haven’t been in use and that have been signaling a permanent redirect for over four years.

More redirects have been created in the last year than ever before on the web because of the mass transition from HTTP to HTTPS. Yet, an enormous amount of websites will continue pointing to the less secure HTTP variant and require clients to go an extra round back and forth between the destination website and its new and updated location.

The [Broken Link Checker plugin](https://wordpress.org/plugins/broken-link-checker/?ref=ctrl.blog) for WordPress can help WordPress websites stay on top of redirects by regularly querying and detecting broken and redirected links.

It won’t process redirected links automatically, but it will give you a list you can check once a month to make sure all your internal and external links are as direct and fast as possible. There are solutions for other publishing platforms out there, and it’s not that hard to create an automated link-updating system.

### Permanent redirect attack

The HTTP specification doesn’t address the possibility that someone could temporarily loose control over their web server and thus allow a third party to hijack web traffic by permanently redirecting it to another server. Ouch.

This can be solved by monitoring the redirect for some days before acting on it. A client could track a redirect for a week or a month, and then only update the reference if the redirect is still in place after some time has passed. This also guards against temporary configuration mistakes, aggressive captive portals, and other problem spots.

Nothing can beat human verification of a redirect to make sure that the new destination is the same as the old one. Though, you can automate this part to a great extent by storing information about the destination such as title, date of publication, and excerpt in a link reference database. This goes against the destination-unaware design of the web, but that doesn’t make the user any happier about broken links.

There are a lot of tools available to automate extraction of link destination metadata. By comparing some locally stored information about link targets, you can detect dead websites that have turned into link-farms or have changed so significantly that you’d either want to link to an older archived version of the same page in the Internet Archive, or just remove the link altogether.

So, why bother with any of this? This helps improve and maintain the quality and reputation of your website by making sure external links are fast/direct and continue to work. Link rot is a huge problem on the web; a 2013 study found that “49 percent of the hyperlinks in Supreme Court decisions no longer work”, according to the New York Times.

Links go away all the time, but you can help maintain the links on your website by updating redirects and follow the resource instead of waiting for old links to just stop working.

I spend maybe three minutes per month on updating redirects and rooting out dead links. The combination of my own [Post Archival in the Internet Archive plugin](https://wordpress.org/plugins/post-archival/?ref=ctrl.blog) and the Broken Link Checker plugin for WordPress means that most links will be available in the Internet Archive.

My plugin automatically submits external links (and the links to my posts) to the Internet Archive, and the Broken Link Checker detects broken links and suggests updating redirects to their new destination or replacing dead links with archived versions. It’s a simple setup that helps ensure that the references and sources I use keeps working in the future.

You probably can’t fix the web’s link rot problem on your own, but you can contribute to keeping links working in your own tiny corner of the web with a little effort. Detect and act on the permanent redirect signals, and you’ll have happier visitors to your site that can still get to the external resources you’ve linked to in the past.

#### Sources

- [RFC 7538: The Hypertext Transfer Protocol Status Code 308 (Permanent Redirect)](https://www.rfc-editor.org/rfc/rfc7538.html?ref=ctrl.blog), 2015-04, Internet Engineering Task Force
- [RFC 7231: Hypertext Transfer Protocol (HTTP/1.1): Semantics and Content](https://www.rfc-editor.org/rfc/rfc7231.html?ref=ctrl.blog), 2014-06, Internet Engineering Task Force
- [In Supreme Court Opinions, Web Links to Nowhere](https://www.nytimes.com/2013/09/24/us/politics/in-supreme-court-opinions-clicks-that-lead-nowhere.html?ref=ctrl.blog), 2013-08-23, Adam Liptak, The New York Times
### Set a custom /path for Word­Press search result pages
URL: https://www.ctrl.blog/entry/wordpress-search-path/
Last updated: 2026-08-23T22:25:49.000Z
Create a site-search landing page, separate your front page and search result pages in analytics, and make your search links explain themselves by adding a custom `/search` path to your WordPress website.

This tutorial assumes your WordPress website is configured to use what is known as “pretty” permalinks (rewrites), and that you’ve got access to modify your server configuration, e.g. `.htaccess`.

### Why you’d want a custom path for search results

You probably already have a good idea of why you’d want to add a custom path to your search result pages if you’re reading this article. Anyhow, here are some of the reasons that I’d for separating search result pages in WordPress out from the base path shared with the front page and over to their own URL path:

- A linkable site-search landing page for my site navigation menu
- Make it easier to separate the front page and search result pages in my web analytics software
- Make it possible to ignore query parameters for every other path (for proxy caching purposes)
- Vanity URL – it looks better and the URL says clearly that it’s a search

### Rewrite the path

WordPress will treat a request with the `s` query parameter set as a search, so essentially all you’ve to do is to mask the custom path and rewrite the traffic so that WordPress’ `index.php` file will handle it.

For Apache Web Server:

```apacheconf
RewriteCond %{REQUEST_URI} "^/search"
RewriteRule "^/search(/page/([0-9]+))?$" "/index.php?paged=$2&s" [QSA]
```

For Nginx:

```nginx
location "/search" {
  rewrite "^/search(/page/([0-9]+))?$" "/index.php?paged=$2&s";
}
```

There are a few different things going on in the above rewrite rule, and I’ll try to explain each of them in turn. Firstly, the rule is only triggered when the request URI is `/search`. Note that the rewrite rule doesn’t trigger a redirect but only an internal remapping of the requested URL into WordPress core.

We then set the `paged` query parameter from the request URI, or it will be set to an empty value when requesting the first page and thus ignored. Your theme should handle appending numbered page suffixes like `/page/2` to the end of your custom search path without any additional tweaking to your WordPress theme. You may have to undo some existing customization to your search result pagination links if this isn’t the case.

Lastly, we set an empty `s` (search) query parameter. This empty parameter is ignored in favor of an existing/user-provided query if supplied. However, the empty search value will trigger an empty search and thus ensuring that WordPress will always treat the custom search path as a search page even when no keywords have been provided.

By default, WordPress will return all posts in chronological order when triggering an empty search. However, setting this empty parameter allows you to create things like a site search oriented landing page by further tweaking your theme.

The `QSA` flag in the Apache configuration example, short for “query string append”, at the end of the rule merges the existing/visitor-provided query parameter with our hardcoded query options. This is the default behavior in Nginx.

### Updating the search form

Now that the custom search path should be working, it’s time to modify the search form to direct traffic to the new address. Depending on how your theme is set up, you should find the search form in `searchform.php`. All you need to do is to add your custom `/search` path to the form’s `action` attribute.

```html
<form … action="<?php echo esc_url(home_url('/search')); ?>">
```

### Optional: Redirect the default search links to the custom path

WordPress’ default search URLs will still work as-is alongside your new custom search path unless you redirect them to the new path. However, search engines generally don’t like it when the same content resides on multiple addresses. You can reduce content duplication and push every visitor over to the same URLs by redirecting the old WordPress-default URL to the new URLs.

For Apache Web Server:

```apacheconf
RewriteCond %{QUERY_STRING} "(^s=|&s=)"
RewriteCond %{REQUEST_URI} "!/(search|wp-admin)"
RewriteRule "(.*)" "/search" [redirect=301,last]
```

For Nginx:

```nginx
location ~ "/(?!search|wp-admin)" {
  if ($arg_s != false)
    rewrite "(.*)" "/search" last;
} }
```

The above redirects triggers a redirect for URLs that contain the search query parameter (`s=`) on any path other than your custom search path to the new search path (`/search`). Note that special `$arg_s` in the Nginx code configuration example variable holds the value, if any, of the `s` string query parameter.

Remember to also update your OpenSearch description file, Schema.org `SearchAction`, or other integration points that depends on how your website builds its search URLs.

#### Sources

- [Using Permalinks](https://codex.wordpress.org/index.php?title=Using%5FPermalinks&oldid=160179&ref=ctrl.blog), revision 160179, 2017-03-20, WordPress Codex, WordPress
- [Apache Module mod\_rewrite](https://httpd.apache.org/docs/2.4/mod/mod%5Frewrite.html?ref=ctrl.blog), version 2.4, HTTP Server Documentation, Apache Foundation
- [RewriteRule Flags](https://httpd.apache.org/docs/2.4/rewrite/flags.html?ref=ctrl.blog#flag%5Fqsa), version 2.4, HTTP Server Documentation, Apache Foundation
- [Module ngx\_http\_rewrite\_module](https://nginx.org/en/docs/http/ngx%5Fhttp%5Frewrite%5Fmodule.html?ref=ctrl.blog), version 1.13.0, Nginx Documentation, Nginx
### EU GDPR and personal data in web server logs
URL: https://www.ctrl.blog/entry/gdpr-web-server-logs/
Last updated: 2026-08-23T22:07:57.000Z
Web server logs contain information classified as personal data by default under the European Union’s General Data Protection Regulation (GDPR). The new privacy regulation comes in effect from May 2018. Just about everyone needs to take action now to become compliant.

Disclaimer: I’m not a lawyer and *I’m not providing you legal advice*. Contact your legal counsel for help interpreting and implementing the GDPR. This article is provided for entertainment purposes, and amounts to nothing but my interpretation of the GDPR.

The General Data Protection Regulation shifts the default operating mode for personal data collection from *collect and store as much information about everyone as possible for all eternity* to *don’t collect any information about anyone unless there’s documented and informed consent for the collection, and don’t use that information for anything but the specified purposes*.

The GDPR turns big-data collection of personal data on the web from an asset into a liability with fines as high as 20 000 000 Euro or 4 % of global revenue (whichever is greater.)

I’ve limited the scope of this article to discuss and focus on some of the technical requirements surrounding personal data collected by default in the logs generated by popular web server software. I’ll not go through the entire GDPR and all the requirements, but focus on some actionable points.

### Personal data in server logs

The default configuration of popular web servers including Apache Web Server and Nginx collect and store at least two of the following three types of logs:

1. Access logs
2. Error logs (including processing-language logs like PHP)
3. Security audit logs (e.g. ModSecurity)

**All of these logs contain personal information** by default under the new regulation. IP addresses are specifically defined as personal data per Article 4, Point 1, and Recital 49\. The logs can also contain usernames if your web service uses them as part of their URL structure, and even the referral information that’s logged by default can contain personal information, e.g. unintended collection of sensitive data; like being referred from a sensitive-subject website.

If you don’t have a legitimate need to store these logs **you should disable logging in your web server**. You’re **not even allowed to store this type of information** without having obtained direct consent for the purposes you intend to store the information for from the persons you’re storing information about. The less customer information you store the lower the risk to your organization.

### Legal basis for collecting and storing logs *without* consent

You can’t collect and store any personal data without having obtained, and being able to document that you obtained, consent from the persons you’re collecting data from. You can, however, still collect and store personal data in your server logs for the limited and legitimate purpose of detecting and preventing fraud and unauthorized system access, and ensuring the security of your systems.

Here are the relevant excerpts from the GDPR that allows data collection for this type of purposes:

> “Processing shall be lawful only if and to the extent that at least one of the following applies: \[…\] (f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.”

Article 6, Paragraph 1, Point F

> “The processing of personal data to the extent strictly necessary and proportionate for the purposes of ensuring network and information security, i.e. the ability of a network or an information system to resist, at a given level of confidence, accidental events or unlawful or malicious actions that compromise the availability, authenticity, integrity and confidentiality of stored or transmitted personal data, and the security of the related services offered by, or accessible via, those networks and systems, \[…\] by providers of electronic communications networks and services and by providers of security technologies and services, constitutes a legitimate interest of the data controller concerned. This could, for example, include preventing unauthorised access to electronic communications networks and malicious code distribution and stopping ‘denial of service’ attacks and damage to computer and electronic communication systems.”

Recital 49 (excerpt)

Notably, this doesn’t exempt such collection from the strict requirements of the GDPR. *Gandalf the Grey* offers some great advice for how you should treat personal data to achieve GDPR compliance in your organization:

> “Keep it secret; keep it safe.”

### Encryption, access restriction, and timely erasure

The specific requirements under the GDPR that apply to your organization depend on the scope and type of data you collect set against the needs to store the data. The regulation with all its recitals is 54 800 words long, but I’ll try to summarize some practical implementation requirements from the regulation:

> “Personal data shall be: (b) \[…\] collected for specified, explicit and legitimate purposes and not further processed \[…\] (c) \[…\] limited to what is necessary in relation to the purposes for which they are processed \[…\] (e) \[…\] personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest \[…\] (f) processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality.’)”

Article 5, Paragraph 1, Point B (excerpt); C (excerpt); E (excerpt), and F (excerpt)

There are no specific technical details offered regarding how these requirements should be implemented besides the suggestion to use “encryption” in Article 6, Paragraph 4, Point E and Recital 83\. The take-away is still clear: data should be secured, access should be limited even within your organization, and data should be deleted (including from backups) when there’s no longer a need to retain it.

### Utility of the day: `logrotate` (+ `gnupg`)

`logrotate` is a very useful tool that can be used to encrypt logs in storage even on edge servers, and can help automate the deletion of old log files. It can also be used to **encrypt log files in storage** which when combined with organizational measures can limit access to decrypting the log files.

Unless you encrypt your logs, an unauthorized third-party who gained access to your servers could extract a lot of data about your users from your logs. Depending on how much private information is stored in your log files and the potential sensitive nature of your business, you shouldn’t store log files for more than a few hours or days unless you take measures to protect them.

Managing PGP keys in GnuPG is beyond the scope of this article. In short, you would create a key-pair on a secure machine, and then import the public-key into the GnuPG key chain on your servers while storing the private-key on a secure medium with limited access for authorized employees only, e.g. printed on paper or kept on a removable storage media.

The server can then use the public key to encrypt its log files without with public key cryptography; resulting in the server being able to encrypt the data without being able to decrypt it without the private. The log files could even be transferred to a centralized log-storage server for cold storage.

I believe such a setup could be used to achieve GDPR compliance while still maintaining auditable logs in the event of a breach of server security or other incidents that would require a log trail.

The following `logrotate` configuration example demonstrates secure encrypted storage (using GnuPG) erasure after time intervals (`rotate` in days) appropriate to how important it’s to store the various log files following a security incident.

```
daily
shred
compress
compresscmd /usr/bin/gpg2
compressoptions --encrypt --default-key your-key-id
compressext .gpg

/var/log/httpd/access* {
  rotate 100
}

/var/log/httpd/error* {
  rotate 200
}

/var/log/httpd/mod_security* {
  rotate 400
}
```

In the above example, access logs are deleted after 100 days, error logs after 200 days, and ModSecurity logs (which would only contain suspicious activity), is retained for 400 days. After this time, the logs would be securely erased using the `shred` utility.

The logs are still kept unencrypted for up to 24-hours when they were first recorded. This is a small time window when the data isn’t stored encrypted, but it’s required to allow human technicians and automated log analyzing tools (like SSHGuard or Fail2Ban) to process the data and act upon it to help detect and prevent unauthorized or unlawful system access.

You can reduce the time window when data is kept unencrypted by rotating logs hourly instead of daily, or by piping logs directly from your web server into an encrypted storage. This may have a serious performance impact on your server and complicate the configuration of automated security monitoring tools.

### Summary

Any identifier, including network or equipment identifiers like an IP address, are considered personal data. Don’t store server logs if you don’t have to. Encrypt logs in storage and limit access to decryption credentials. Delete logs as early as possible, including from any backups. Document what steps you’ve taken to secure data and limit the impact in the case of a server breach.

This article has focused on server logs as they’re something every organization with a website or an online service will have to deal with.

However, the same principles and even stricter requirements apply to other types of data that your organization keeps on people. The deadline for GDPR compliance is May 25th 2018, and that’s barely enough time to read through the 54 800 word regulation.

With fines up in the 20 Million Euro range; you better get started auditing personal information collection and storage in your organization right away. This is the perfect time to rethink old decisions regarding what data your organization needs to keep and for how long.

#### Sources

- [logrotate man page](https://github.com/logrotate/logrotate/blob/81ed01b7bbff6f672e6e481f9f0123db3a408551/logrotate.8.in?ref=ctrl.blog), revision 81ed01b7bb, 2017-12-07, logrotate project, GitHub
- [REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679&from=EN&ref=ctrl.blog), 2016-04-27, The Official Journal of the European Union, EU Parliament and EU Council
### Linux on Lenovo ThinkPad Carbon X1 (5th generation)
URL: https://www.ctrl.blog/entry/linux-on-lenovo-thinkpad-5genx1/
Last updated: 2026-08-23T22:13:27.000Z
I installed three Linux distributions — Fedora Linux 27, openSUSE Tumbleweed, and Ubuntu 17.10 — on the Lenovo ThinkPad Carbon X1 (5th gen.) and had a look at the out-of-the-box Linux hardware compatibility with these three distributions.

I tested three popular Linux distributions on the new fifth generation Lenovo ThinkPad Carbon X1\. I’d to make a few [preparations in Windows](https://www.ctrl.blog/entry/dual-boot-bitlocker-device/) before I could even start the installation, but I won’t go into details about that here as I’ve already written more about this last month.

I was positively surprised with the three Linux distributions as almost everything worked out-of-the-box. Hardware compatibility used to vary quite a bit between different Linux distributions just a few years ago. These differences seem to be going away now that all distributions release up-to-date Kernels and userlands at least twice a year.

I downloaded all available software updates for each distribution after installing them. I didn’t configure or seek out any drivers or instructions other than the regular-use-configuration required to connect to networks and devices for testing.

#### Things that works out-of-the-box with no additional setup:

- Speakers, audio-jack, and built-in microphone.
- Bluetooth (tested with generic mouse, gamepad, and portable speakers)
- 4G connectivity (requires Micro-SIM card, EM7455 Qualcomm Snapdragon X7 LTE-A)
- WiFi (I saw same network speeds and reliability as Windows 10)
- The included proprietary-connector (‘Lenovo Native RJ45’) Ethernet adapter
- Graphics, display, and backlight control (Intel HD Graphics 620)
- Multimedia and function keys
- Thouchpad and trackpoint
- Micro-SD card reader
- GNOME running under X11 and Wayland

The Micro-SD card reader is located at the back of the machine inside the SIM-tray compartment. It’s an inconvenient location and requires that you tilt the screen down a bit to open the compartment. This isn’t the laptop to get if you intend to use the Micro-SD card reader a lot. If you only intend to use the Micro-SD card reader as a storage expansion slot or as a backup drive, then its sub-optimal location shouldn’t be a problem.

#### Things that didn’t work:

- GNOME apps can’t use the built-in Qualcomm GPS module for location (not recognized as a location source by GeoClue)
- Linux recognizes the finger print reader, but it can’t be used in GNOME.

In other words, you shouldn’t have any hardware compatibility problems for the common components of this laptop with the fifth generation Lenovo ThinkPad Carbon X1 in any recent and up-to-date Linux distributions.

### Extra: USB Type-C power

The ThinkPad Carbon X1 charges through a standard USB-C connection with the included charger providing up to 65 watt. However, you can also slow-charge from a lower wattage USB-C source such as the charger for your smartphone or even a standard battery pack.

You can only get about 20 W from a Type-C charger meant for use with a mobile phone, so the battery is discharging faster than the power source can provide a charge. It can be slow-charging option in situations where you’ve forgotten the charger in a meeting room or don’t have access to another power source. Notably, this doesn’t work in Windows 10 as it doesn’t seem able to negotiate a charge from anything but the included charger. If you turn off the laptop, put it into hibernation (even Modern Standby, a.k.a. Fast Boot), or boot into Linux — you can charge from standard USB-C power source.

I also tested the output of the built-in USB Type-C ports using the [Delock USB-C volt-/ammeter](https://www.ctrl.blog/entry/review-delock-usbc-vameter/). The ports can provide up to 3 ampere at 5 volt (15 watt) for powering and charging your USB-C devices. This is just slightly less than you can expect from most USB-C chargers, which typically output 16–20 W.

### Conclusions

I had a first generation ThinkPad Carbon X1 some four years ago, and it had problems with Wi-Fi disconnecting every few minutes, and the screen backlight wouldn’t turn on after resuming from hibernation.

I must admit that I was surprised that the 4G connectivity worked out-of-the-box without requiring hours to chase down drivers and troubleshooting. I fully expected that would be necessary, but it just worked right away.

Kudos to Lenovo for choosing components with open-source drivers available, and kudos to the Linux kernel for keeping up with the times and providing excellent support for new devices and components. The increased Linux support from component and device manufacturers means things now — even on new devices — just work.

I tested the Lenovo ThinkPad Carbon X1 model 20HR0022MX. I used the latest Kernel version for each distribution: 4.14 for Fedora Linux and openSUSE, and 4.13 for Ubuntu.
### The many problems with the Logitech G403
URL: https://www.ctrl.blog/entry/logitech-g403-problems/
Last updated: 2026-08-23T22:13:40.000Z
The Logi G403 gaming mouse has issues with everything from hardware design to its firmware and software. But it does have pretty pulsating colored lighting effects; at least until you install their the Logitech Gaming Software.

The Logitech G403 wired (also available as a wireless option) is a ‘gaming mouse,’ which means it’s high-sensitivity, is more expensive, and is decorated with pulsating and colorful LEDs.

This specific model seems to have a multitude of issues, so rather than a review I’ll just detail the issues I’ve encountered and you can make up your mind about the quality of the G403.

### Lighting and software

The factory default lighting effects on the G-logo and the scroll wheel worked fine out of the box on MacOS 10.12, Linux (Fedora 27), and Windows 10\. The basic operations of the mouse worked fine as well; that’s until I installed Logitech’s management software.

#### Stopped working after installing *Logitech Gaming Software*

I was prompted to reboot the system after installing *Logitech Gaming Software*. This seems more than a little excessive just to support a mouse but I went ahead and rebooted anyway. I noticed some new issues even before the system had rebooted.

The LEDs on the mouse would flash a couple of times and then turn off right after powering on the system. The same would happen again just before the Windows boot sequence finished (which causes the internal USB hub to power cycle.)

The problems persisted even when I plugged the mouse into different computers running Linux or MacOS. The mouse has some internal memory for storing configuration, so I assumed the configuration must have been changed during the software installation. I opened Logitech Gaming Software again, and every lighting setting appeared to be correct.

Notably, the lighting effects also came on again after opening Logitech Gaming Software. But the problem would reappear after a reboot. I also noticed a firmware update for the mouse (!), but applying this didn’t resolve the problem but did instead introduce new issues (!) which I’ll get back to later.

I found an option called “Lighting Sleep Timer” in the Lighting section in the Gaming Software center. This feature would turn off the lights after a configurable amount of inactivity. Despite being presented as a on-board memory configuration option, the lighting sleep timer only works on Windows with Logitech Gaming Software installed.

Regardless, this option was not to blame. It took a little while, but I eventually found an option called “Device Startup Effects”. Disabling this option fixed the problem. Notably, this is the only option that has to be applied anew if you plug the G403 into another USB port on your computer.

#### Logi Analytics crash

When I installed the Logitech Gaming Software I got an unwanted additional component that caused problems every time I logged in to Windows. Even before the Windows shell is displayed, I got a problem report from Windows saying that “Logi Analytics Client (UNICODE) has stopped working”.

![Logi Analytics Client (UNICODE) has stopped working](https://cdn.synaps.media/control/content/images/2026/08/logi-analytics-client-crash.png)

The Logi Analytics Client is clearly some sort of feedback collection service that’s supposed to run in the background to gather feedback on how I use the mouse and its configuration. However, I’ve been unable to find a privacy policy that covers the data collected by Logi Analytics Client. It could be a key-/mouse-click logger for all I know. I do find it worrying that there isn’t an easily available privacy policy that explains what the Analytics Client does and what type of data it collects.

Most consumers would be unaware and not care in the slightest about this unwanted data collection, had it not been for the crash dialog on startup. I’ve found a couple of threads on the Logitech discussion boards and Reddit that discusses this dialog.

In any case, the client is unwanted and the crash goes away by removing Logi Analytics Client from your system. You can disable it from within Settings on the Logitech Gaming Software, or by disabling the software’s service from Windows Service Manager.

### Scroll wheel and scrolling

I mostly like the feel of the scroll wheel but it has some serious issues including a hardware design flaw that hurts for people with small hands.

#### Sporadically scrolls in the wrong direction

Before applying the firmware update to my G403, I didn’t have any issues with scrolling behavior. That changed as soon as I applied the *G403 Firmware Update 108.2.13* that contained the following changelog entry:

> “Fixes an intermittent scrolling issue experienced on some G403 gaming mice”

In my case, the update seem to have introduced an intermittent scrolling issue that wasn’t present before the update. Scrolling downwards sometimes scrolls upwards one “tick”, pauses there, and then continue scrolling downwards. The same happens in the opposite direction.

It’s a small annoyance when scrolling down a document, but it can seriously interfere with your performance in a game or other software where the scroll wheel changes from one tool to another as the issue causes you to select the wrong tool. The issue happens on all operating systems after applying the firmware update.

I can make the issue go away for a few hours by scrolling while unplugging and reconnecting the G403 from my computer. I’ve reached out to Logitech customer support regarding availability of older firmware so that I may roll back to the previous working version.

#### Hurts to scroll

Besides the intermittent issues with scrolling going off in the wrong direction, I generally like the feel of the scroll wheel. Except that it hurts my index finger when I use it. This shouldn’t be an issue for anyone with large hands or who rests their hands on the front of the mouse.

If you rest your hand on the back of the mouse your stroke-to-scroll motions over the scroll wheel can make your index finger **collide with an inexplicably stupid hardware design flaw**. There’s a raised pointy edge just at the end of the scroll wheel shaft that you’ll poke your finger against at the end of a downwards scrolling motion.

![Protruding edge at the end of the scroll wheel shaft on the Logtech G403](https://cdn.synaps.media/control/content/images/2026/08/logi-g403-scrollwheel-protruding-edge.jpeg)

Finger-cutting edge at the end of the scroll wheel shaft.

I spent half an hour looking at photos of “gaming mouse” on a web image search, and every other model I can find has soft round edges at the end of the scroll shaft. It’s almost like the other gaming mice manufacturers product tested their designs and found that sharp pointy edges could be painful to use for some customers. I don’t know what Logitech were thinking on this design. No other mouse in Logitech’s current gaming or general-purpose mouse product line-up feature anything but round subdued edges.

I can work around this issue by repositioning my hand, but having to use the mouse this way is less comfortable over time as it forces me not use a relaxed posture in my arm to accommodate the scroll wheel. Not relaxing my arm in turns leads to pain in my shoulder, which should be familiar to anyone with small hands using a mouse that’s designed to fit in the hand of giants.

#### Rattling scroll wheel

I haven’t experienced this one for myself, yet, but just about any online search for this mouse model will bring up complaints about the scroll wheel being fitted too loosely causing it to make a rattling noise when used.

From what I’ve read, this problem can appear after a month or three of use — although some people have gotten this issue out-of-the-box. I’ll update this blog post in the future if my scroll wheel starts making a rattling noise.

### Conclusion time

The Logitech G403 is a flawed product from a manufacturer who’ve got a good track record and reputation for making good computer accessories without these kinds of issues. The mouse is physically uncomfortable to use, the software is unstable and difficult to use, and their firmware update turned off the shiny exterior lighting effects that drives the sales in the whole gaming-peripherals category.

My impression is that this may have started as a concept drawing that for some reason was rushed to market without the normal quality controls consumers expect from Logitech.

#### Sources

- Logitech G403 Firmware, version 108.2.13, 2017-11-14, Logitech
- Logitech Gaming Software, version 8.96.88, 2017-10-26, Logitech
### Does casting videos to the big screen come at the creators’ expense?
URL: https://www.ctrl.blog/entry/chromecast-costing-creators/
Last updated: 2026-08-23T22:03:24.000Z
Creators on YouTube had a rough year in 2017 with prominent large advertisers leaving the platform over a continuous stream of scandals regarding where their ads show up. In the wake of this, some of my own favorite channels now produce fewer videos than before and others have just disappeared off YouTube.

I gave a little more thought to YouTube ads in this context, and realized I don’t see any ads when watching YouTube. As it turns outs, there seems to be a bug where YouTube don’t show ads when using Google Chromecast and the YouTube app for Android or Chrome on PC where ads just don’t show up.

I do see ads on YouTube when watching on mobile, desktop, and on the YouTube app for Xbox One and PlayStation 4\. I can’t say I’ve missed the ads, but I don’t believe I’ve seen more than one advertisement in the last 12 months on Chromecast.

I watch about 40–80 minutes of YouTube videos per day all played on my projector through Chromecast and the YouTube app. The creators I watch don’t earn anything off me. I’ve asked around among friends and on various online channels, and people located outside the United States don’t appear to see ads while using the Chromecast with the YouTube app. This isn’t conclusive of anything other than that others experience the same *problem* as I do.

I can switch to using the YouTube app on Xbox One or PlayStation 4\. However, neither have nay sort of play-queue or playlist handling. I can prepare playlists beforehand on other devices, but this is more inconvenient than just using YouTube on mobile with the Chromecast.

The console editions of YouTube also have trouble updating playlists, and I would often have to force-quit the apps and do the restart-app dance to get them to update. Videos played on the console editions of the YouTube app also stutter and have playback issues. *My YouTube experience* would be made worse and I’d end up seeing more loud and distracting ads to boot.

But is it a problem that I don’t see ads? I’m split over this. As I mentioned above, I don’t use ad-blockers as I understand that both websites and creators need to be able to make money. Like them or not, ads are the way of the web until services were visitors can pay websites and creators directly, like [Flattr](https://www.ctrl.blog/entry/flattr2/) and [Brave](https://www.ctrl.blog/entry/brave-payments/), gains mass mainstream adoption.

However, I’m not actively blocking ads although the technical decisions I’ve made about how I watch videos, and YouTube’s inability to deliver ads in the Chromecast playback queue, effectively cause the same effect.

Ideally, I’d want to see no ads at all on YouTube and rather pay the monthly fee for ad-free viewing with [YouTube Red](https://www.youtube.com/red?ref=ctrl.blog). However, that doesn’t help me her in Norway as YouTube Red isn’t available outside Australia, Korea, Mexico, New Zealand, and the United States.

I don’t know how to feel about this situation. On one hand, the creators I enjoy on YouTube seem to be giving up or at least scaling back their production schedules — and at least some of them are struggling with the reduced returns in advertisement revenue.

On the other hand, I haven’t done anything actively to block the ads yet I’m freeloading on the content people spend time and energy to produce to entertain me.

Looking around on Reddit and Twitter, you’ll find quite a few positive reactions to “no ads” when using Chromecast and the YouTube app going back to 2014. You’ll find many more complaints about “too many ads” or other problems with the ad-delivery, but people also seem to have notice that ad-delivery has stopped working for them.

Google has released a continuous stream of firmware updates to the first generation hardware, and has since released the second revision hardware and the new Chromecast Ultra edition. How come people are still having these kind of issues?

I’ve reset my Chromecast to factory settings, tried casting to the YouTube app on Xbox One instead of the Chromecast, messed about with locale and region settings – even accessibility and caption settings, created new Google accounts on factory-fresh Android devices, connected to the web through a different internet service provider, and done everything I could think of to troubleshoot this issue.

No matter what I do, I always see ads when watching YouTube on the web or in the mobile app, but all the ads go away as soon as I connect over Chromecast. As soon as the Google Cast protocol is involved, all ads just go away.

Google reported sales of 55 million Chromecasts worldwide in October 2017. Here in Norway, the largest electronics retailer in Norway alone sold 1 million Chromecast devices in a country of only 2,38 million private households.

The point I’m trying to make is that a lot of people have Chromecasts. At least some of these people are probably also using their Chromecast. How many of them only see one advert per year like I am? How is this effecting creators on YouTube? **How come YouTube hasn’t noticed the problem and issued a fix?** I’m sure they’ve got statistics and graphs of everything under the sun. Including failed ad-insertion opportunities and ads-per-video rates per device type.

I don’t have any answers. YouTube and big algorithms work in mysterious and opaque ways. However, this issue seems like it deserves some human attention from YouTube engineers. After all, **this affects YouTube’s own bottom line and not only the creators on their platform.**

#### Sources

- [YouTube Red available locations](https://support.google.com/youtube/answer/6307365?hl=en&ref=ctrl.blog), 2017-12, YouTube Support, YouTube
- [Google has sold 55 million Chromecasts, up from 30 million in July 2016](https://venturebeat.com/media/google-has-sold-55-million-chromecasts-up-from-30-million-in-july-2016/?ref=ctrl.blog), 2017-10-04, Emil Protalinski, VentureBeat
- [Families and households](https://web.archive.org/web/20171204031958/https://www.ssb.no/en/befolkning/statistikker/familie), 2017-09-26, Population, Statistics Norway
- [Vi har snart solgt 1 mill. Chromecasts](https://web.archive.org/web/20171204032120/https://twitter.com/elkjop%5Fno/status/791184666728468480), 2016-10-26, Elkjøp, Twitter
### Allow OCSP stapling in Apache Web Server with SELinux policies
URL: https://www.ctrl.blog/entry/ocsp-httpd-selinux/
Last updated: 2026-08-23T22:15:02.000Z
Most Linux distributions with enforced Security-Enhanced Linux (SELinux) policies won’t allow the Apache Web Server to connect to an OCSP responder server by default. Here is how you adjust your SELinux policies to allow Apache to perform OCSP stapling, and what it means for your server security.

This tutorial assumes that you’re running a Linux distribution with a default SELinux policy set resembling those from *SELinux Reference Policy* by Tresys Technology. (Including recent versions of CentOS, Fedora Linux, Red Hat Enterprise Linux (RHEL), and optionally most others.)

OCSP stapling is a process where your server will attach up-to-date and cryptographically signed response from an OCSP server about your certificate’s current validity to your certificate. Visitors will receive both the certificate for your domain and a signed OCSP response from your web server in one-go rather than having to send a separate OCSP request themselves. This can speed up website load times especially for visitors on mobile or high-latency connections.

### Permission denied

The policy that causes trouble for OCSP stapling is meant to protect against code, possibly from injected scripts through a vulnerability in a web application, being allowed to open sockets and connect to network locations. Something like the CGI or PHP interpreter running in a web server could be used to download remote code or transmit data out of the system.

Apache’s error log messages will show that Apache’s process (`httpd`, in this example) failed to obtain permissions to connect to the OCSP responder (Let’s Encrypt, in this example):

[ssl:error] Permission denied: AH01974: could not connect to OCSP responder 'ocsp.int-x3.letsencrypt.org'
[ssl:error] AH01941: stapling_renew_response: responder error

This would manifest as error “SEC\_ERROR\_OCSP\_TRY\_SERVER\_LATER” in Firefox who’ll see a stapled OCSP error response from Apache and block visitors from accessing the website. You’ll find a matching message in the SELinux audit log showing that Apache was denied permissions to connect to a remote port 80 over a TCP socket:

type=AVC msg=audit(1514069285.431:489): avc:  denied  { name_connect } for  pid=1856 comm="httpd" dest=80 scontext=system_u:system_r:httpd_t:s 0 tcontext=system_u:object_r:http_port_t:s0 tclass=tcp_socket permissive=0

### Granting access

At this point, you could use `audit2allow` to generate a new policy from the above log entry to allow Apache access to open a `tcp_socket`. However, there’s a ready-made boolean switch which in the SELinux Reference Policy that covers this specific scenario. You can enable the `httpd_can_network_connect` boolean to allow Apache to connect to network locations with the following command:

```shell
setsebool -P httpd_can_network_connect 1
```

You must restart the web server after issuing this command for it to take effect on a running server instance. This is the same boolean you’d use to allow connections to a reverse or intermediary proxy, or to allow network connections from a script executed as the Apache user.

Browsers who trust stapled OCSP response, such as Firefox, won’t retry a OCSP request on their own in error conditions. Personally, I believe it’s better to not staple error responses (in case of server configuration issues like this, or a network issues) and let clients retry for themselves. This potentially increases the load on the OCSP responder, but at least clients won’t give up on connecting to your website. You can change this behavior by modifying the following option in your Apache configuration:

```apacheconf
SSLStaplingReturnResponderErrors off
```

### Locking down network access again

After you’ve changed the above option, you’ve also opened up your web server to some types of attacks. However, please do note that this doesn’t make your system any less secure than an instance of Apache running on a system that doesn’t enforce any SELinux policies.

You can re-impose more specific limitations by configuring the system firewall to only allow outgoing connections initiated on the system to go to a allow-listed set of addresses, including the OCSP responder for your certificates (the specific address is embedded in the individual certificate files.) Maintaining an allow-list of allowed remote hosts in the firewall will also help secure the system from other attack vectors, but it can be complex to manage.

Practically speaking, you must either accept the risk of allowing your web server to initiate remote connections or disable OCSP stapling to remove the need for making remote connections. Please note that removing OCSP stapling can negatively affect your website performance for your visitors as each client will have to do their own OCSP requests instead.

### Didn’t this “just work” before?

Yes, it did work out-of-the-box sometimes on CentOS, Fedora, and RHEL. These distributions have an extra SELinux policy boolean called `httpd_graceful_shutdown` that allows TCP connections to port 80 (this isn’t clear from the name.) Many certificate comes with OCSP responder servers listening on port 80, so they would happen to work by in the default configuration.

The default value of `httpd_graceful_shutdown` was changed to `deny` in October 2017, causing all OCSP stapling requests and checks to fail by default starting with Fedora Linux 27 and later releases. This doesn’t affect systems that are updated from older policy sets, but any system installed after the change will have the new default policies.

Enabling the `httpd_can_network_connect` policy boolean instead of `httpd_graceful_shutdown` will ensure that all OCSP responders will work regardless of which TCP port they listen on. The policy also has much clearer consequences than the more ambiguously named `httpd_graceful_shutdown` policy.

#### Sources

- [\[HEADS UP\] Default value of SELinux boolean httpd\_graceful\_shutdown will changed](https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/message/MA4CEL3R2ZDJVAPV3WOIHNET7QXFP4L7/?ref=ctrl.blog), 2017-09-29, Lukas Vrabec (Software Engineer, Security Technologies, Red Hat), devel mailing list, Fedora Project
- [apache.te](https://github.com/TresysTechnology/refpolicy-contrib/blob/9401ae10439194149e43f840803281590111978f/apache.te?ref=ctrl.blog) (SELinux policy), commit 9401ae1043, 2011-09-09, refpolicy-contrib repository, Tresys Technology, GitHub
- [Apache Module mod\_ssl](https://httpd.apache.org/docs/2.4/mod/mod%5Fssl.html?ref=ctrl.blog#SSLUseStapling), version 2.4, HTTP Server Documentation, Apache Foundation
### Linode and Vultr no longer disables SELinux in Fedora Server
URL: https://www.ctrl.blog/entry/selinux-fedora-linode-vultr/
Last updated: 2026-08-23T22:21:49.000Z
The two virtual private server (VPS) hosting providers [Linode](https://www.linode.com/?r=bded785ca36b951af61a1af005c7d4a947298f76&ref=ctrl.blog "Linode home page (affiliate link)") and [Vultr](https://www.vultr.com/?ref=7131491 "Vultr home page (affiliate link)") have been offering server instances of Fedora Server with Security-Enhanced Linux (SELinux) enforcement disabled by default. New instances deployed with Fedora Server 27 now enable SELinux in enforcing mode by default. This aligns them to the upstream Fedora defaults.

SELinux is a mandatory access control system managed by a set of security policies that the Kernel use to limit what processes and users can do on the system. One of Fedora’s differentiating features compared to other Linux distributions is its well-maintained and low-friction default SELinux policy set.

### Disabling of SELinux

Both Linode and Vultr used to disable SELinux by default, which meant customers didn’t get the same experience when deploying servers through these server providers when compared to a default installation of [Fedora Server edition](https://getfedora.org/en/server/?ref=ctrl.blog).

Linode replaced the kernel provided by the Fedora project with their own *Linode Unified Kernel* (LUK). My [review of Linode VPS](https://www.ctrl.blog/entry/review-linode-2gb/) contains a long section detailing LUK. LUK was being compiled with SELinux disabled, but Linode hadn’t disabled SELinux – causing some funny boot time messages about SELinux being turned on but not being available in the Kernel. The result was that the SELinux policy set wasn’t being enforced. Re-enabling the default Fedora kernel — to enable SELinux with it — required changes to the server’s configuration in the Linode Manager, plus enough knowledge to relabel and repair a system with broken SELinux labels.

Vultr had just disabled the SELinux option while keeping the default kernel. Resetting to default enabled state required restoring the configuration for SELinux and a full relabeling of the system.

### Aligning with upstream defaults

If you deploy a new instance of Fedora Server 27 on Linode today, you’ll now get an unmodified system image that’s enforcing SELinux policies by default.

Vultr have been enforcing SELinux by default in all supported versions of Fedora since late August 2017.

Note that updating an existing Fedora Server instance with either Linode or Vultr won’t suddenly enable SELinux. The change only applies to new instances deployed for the specific versions or since the dates mentioned above.

These changes means Fedora users who deploy with any of these cloud service providers now get a system that’s much closer to the default Fedora Server experience. Documentation and community support now match the default experiences with Fedora.

### Why the change happened

I wasn’t happy after having made the switch from DigitalOcean, another VPS hosting provider, to Linode and found that my distribution of choice, Fedora 22 at the time, differed greatly from Fedora on DigitalOcean and on my own hardware. I vented some frustration in my [Linode review](https://www.ctrl.blog/entry/review-linode-2gb/), made the \[complex\] required changes to use the default Fedora kernel, and let it be with that.

Some months later I was managing more instances on Linode, and had started playing with Vultr as a possible Linode replacement. Vultr reportedly has slightly better performance than Linode for the same cost, so I thought I’d have a look at it. Again, I was frustrated when I found out that Vultr also had disabled SELinux by default!

I remember having read about [Canonical taking action against modified versions of Ubuntu](https://ubuntu.com/blog/2016/12/01/taking-a-stand-against-unstable-risky-unofficial-ubuntu-images?ref=ctrl.blog) offered with some service providers. Ubuntu includes a clause that you’ve to change the name if you modify and redistribute copies of Ubuntu to others, on grounds of protecting the Ubuntu trademark. After some research, I found that Fedora had similar legal requirements for use of their trademark to those of Ubuntu.

The gist of these trademark use requirements means that Linode and Vultr would have to rename their modified versions of Fedora to something like “Linode Fedora Remix” in marketing to clearly differentiate it from the upstream Fedora as distributed by the Fedora project. I would have been perfectly happy with this resolution as I’d know that I wasn’t getting the stock default Fedora Server edition with this naming scheme.

I proceeded to open [a ticket with the Fedora Council](https://pagure.io/Fedora-Council/tickets/issue/99?ref=ctrl.blog) requesting that the council look into the matter of modified VPS images as distributed by these two cloud providers. The matter was referred to Tom ‘spot’ Callaway of the Fedora legal team who worked with Lindoe and Vultr. Vultr was able to resolve the matter in four months, while it took Linode seven months to resolve the issue.

In summary, both Linode and Vultr are great cheap options for all your virtual private server hosting needs for Fedora Server edition!

#### Sources

- [Notification of possible ‘Fedora’ trademark violations: Modified VPS images branded as Fedora](https://pagure.io/Fedora-Council/tickets/issue/99?ref=ctrl.blog), issue 99, 2017-11-21, Daniel Aleksandersen and Tom ‘spot’ Callaway, Fedora Council issue tracker, Fedora Project
- [Taking a stand against unofficial Ubuntu images](https://ubuntu.com/blog/2016/12/01/taking-a-stand-against-unstable-risky-unofficial-ubuntu-images?ref=ctrl.blog), 2016-12-01, Ubuntu Insights blog, Canonical
- [Legal: Trademark guidelines](https://fedoraproject.org/w/index.php?title=Legal:Trademark%5Fguidelines&oldid=406470&ref=ctrl.blog#Distributing%5FFedora%5Fsoftware), 2015-03-12, Fedora Project wiki, Tom ‘spot’ Callaway, Fedora Project
### About the <å> element
URL: https://www.ctrl.blog/entry/the-aring-element/
Last updated: 2026-08-23T22:23:17.000Z
I’ve received an embarrassing number of questions over the years asking me about my use of “`<å>`” in my articles. I’ve had to answer this so many times that I finally decided to put the explanation on the blog.

Spoiler alert: it’s just a typo!

`<å>` is neither a scientific notation, a new HTML element, nor some ongoing in-joke or meme. It’s just a mistake that I keep doing over and over again.

*Å* is an extra vowel used in some North Germanic languages and is found as an extra key on the keyboard layouts for these languages. On the Norwegian keyboard layout, which is the one I use, the Å-key is located right next to the P-key. Meaning that when I’m creating `<p>` elements to mark a new paragraph in HTML, I sometimes hit the Å-key by accident.

`<å>` isn’t on the allow-list of HTML elements built-in to WordPress, so it escapes the angle brackets and prints it as-is; resulting in the distinctly *Daniel-esque* `<å>` element. When I look at in my editor, it’s easier to overlook `<å>` for `<p>`. “Å” is a word in Norwegian, so my bilingual spell-checker doesn’t flag it as a mistake either.

In conclusion, you’ve learned that I type out and format plain HTML in my writing, that I sometimes don’t quality check my work sufficiently, and you’ve learned that people get curious when they see something unfamiliar that looks a bit like a new HTML element. However, it’s just a reoccurring typo that I make on my somewhat exotic keyboard layout.
### Two steps backwards on IPv6 adoption in 2017
URL: https://www.ctrl.blog/entry/ipv6-in-2017/
Last updated: 2026-08-23T22:12:15.000Z
The web as a whole might be steadily progressing towards greater IPv6 adoption, but my own journey has hit some rough patches in the last year. My website is now IPv4-only and so is my home internet connection. Here is my year in IPv6.

### Ctrl blog off IPv6

I removed IPv6 support here on Ctrl blog in mid-September when I stopped maintaining a bunch of edge servers and migrated it to *BunnyCDN* — my [budget content delivery network of choice](https://www.ctrl.blog/entry/budget-cdn-review/).

After signing up for BunnyCDN, I tested and confirmed that IPv6 was unavailable right away when I signed up. There wasn’t any notices about IPv6 connectivity issues on BunnyCDN’s status page, blog, or Twitter stream so I reached out to support to inquire about it. One of my deciding factors when choosing a CDN for this website was BunnyCDN’s [advertised IPv6 support](https://web.archive.org/web/20171228015004/https://bunnycdn.com/features/ipv6), but IPv6 hasn’t been available on their platform since August 2017.

It feels like a bit of a set-back to revert to an IPv4 only website after successfully serving 18,8 % of its monthly visitors over IPv6\. Ultimately, I felt that it was worth the sacrifice and that my own interests and those of my visitors were better served by reducing page load times and by the reduced complexity offered by moving everything over to a content delivery network.

### Home ISP off IPv6

A new local internet service provider, Lynet Internett, expanded into my neighborhood in the beginning of September. They offered free installation, twice the download speed, and ten times the upload speed for the same price I was paying my old ISP. I did some quick research and was pleased to learn that they were among the first to offer residential customers IPv6 in the country starting in 2010\. My old ISP had random service outages of random durations several times per month, so I was more than happy to switch to a different provider who had also been an IPv6 pioneer.

Unfortunately, the new ISP’s network expansion meant that they’d also invested in new network equipment for their own core networking infrastructure. Long story short, the new hardware had introduced a problem that meant they’d had to turn off DHCPv6, which means my border gateway device (“router”) won’t get an IPv6 address prefix delegated. In other words, I can’t get an IPv6 address for any device behind my border gateway device. When I complained about the problem, their support representative summed up the situation nicely:

> “We were among the first to offer IPv6 services in Norway, and we’re the first to take it away again.”

They haven’t communicated the issue publicly in any channel, and they’ve not been able to give me a time frame for when the issue will be resolved. They have delivered on the faster speeds (plus 2 Megabits per second up/down above and beyond their promised speeds) and they’ve not had a single minute of downtime that I’ve noticed.

So, I’m off IPv6 entirely now for the first time since 2012.

### What else happened in the IPv6-year 2017?

The Jetpack plugin for WordPress had a serious bug that [locked every IPv6 address out of the WordPress administration interface](https://www.ctrl.blog/entry/jetpack-protect-ipv6-port/). This turned out to be yet another case of port-number “cutting”, a programming shortcut for IPv4 addresses notation that entirely breaks IPv6 addresses.

I looked in to [why the Windows IPv6 Control Message service](https://www.ctrl.blog/entry/win10-icmp6-usage/) consumes so much bandwidth in the Data usage report in Windows 10\. (Most likely caused by a crowded local network or a faulty network interface.)

I extended SSHGuard — the brute-force-login blocking service — to support [IP subnet blocking](https://www.ctrl.blog/entry/sshguard2p1/) A standard residential network gets a whole /64 subnet’s worth of IPv6 addresses, so SSHGuard needed to provide better tools for blocking large subnets. Detection is currently limited per-address, but [stay tuned](https://www.ctrl.blog/follow.html) for same-origin subnet detection!

Fail2Ban, an alternative to SSHGuard, finally released [version 0.10](https://www.ctrl.blog/entry/fail2ban-ipv6/) with IPv6 support after more than a year of development. It’s better late than never, but the Fail2Ban project hasn’t stayed on top of IPv6 support. SSHGuard has had IPv6 support since the 1.0 release over 10 years ago.

I tested some website certificate monitoring services and found that [*SSLPing* didn’t support IPv6 websites](https://www.ctrl.blog/entry/review-sslping/) at all, and [*KeyChest* supports IPv6](https://www.ctrl.blog/entry/review-keychest/) but doesn’t do a good job with it — or certificate monitoring.

For my own sake, I hope that both BunnyCDN and my ISP can work out their IPv6 compatibility issues and restore IPv6 connectivity as soon as possible.

For the web as a whole, I hope we’ll see global IPv6 adoption skyrocket in 2018 without causing issues for the masses. I won’t hold my breath for a smooth IPv6 transition year, however.

#### Sources

- [BunnyCDN Service Status](https://web.archive.org/web/20171228135706/https://bunnycdn.com/status), 2017-12, BunnyCDN
- [Tilbyr IPv6 til alle fiberkundene](https://www.digi.no/artikler/tilbyr-ipv6-til-alle-fiberkundene/291536?ref=ctrl.blog), 2010-11-05, Harald Brombach and Eirik Rossen, Digi
- [sshguard 1.0](https://sourceforge.net/p/sshguard/mailman/message/378661/?ref=ctrl.blog), 2007-06-05, Michele Mazzucchi, Sshguard-maintainers mailing list, SSHGuard project, SourceForge
### Latest TP-Link updates resolve NTP data squandering firmware issue
URL: https://www.ctrl.blog/entry/ntplink-fixed/
Last updated: 2026-08-23T22:15:00.000Z
The latest firmware update for TP-Link repeaters/range extenders saves their customers approximately 715 MB every month in unwanted internet traffic.

A month ago today, I wrote about [a design flaw in the firmware of TP-Link Wi-Fi repeaters](https://www.ctrl.blog/entry/tplink-aggressive-ntp/) that caused these devices to waste roughly 715 MB of data per month each in meaningless NTP traffic. TP-Link has now released firmware updates for most of their still-supported models that include the following changelog entry:

> “Improved Online detection method and reduced unnecessary data traffic.”

The update changes the online connectivity check in TP-Link’s products to no longer sending one NTP request and five DNS requests out on the public internet every five seconds. These excessive checks resulted in a data consumption of approximately 715 MB per month per device.

The new check consists of sending one ICMP ping request to the local network gateway/router every five seconds instead. This means TP-Link repeaters will remain fairly chatty devices on your local network, but they will no longer slowly eat up your monthly data cap with your internet service provider.

### Firmware update availability by model

- RE650 V1 (update available)
- RE500 V1 (no information – notably the [hardware is identical to RE650 V1](https://www.ctrl.blog/entry/tplink-re650-vs-re500/))
- RE450 V1 and V2 (update available)
- RE350 V1 (update available)
- RE305 V1 (update available)
- RE205 V1 (no update, but problem has been acknowledged)
- RE200 V2 (no update, but problem has been acknowledged)
- TL-WA855RE V2 and V3 (update available)
- TL-WA850RE V4 and V5 (update available)

This update also **removes the non-functioning check-for-update interface** mechanism in TP-Link’s web administration interface. Rather than to fix the update check and introduce proper auto-update, TP-Link chose to removed people’s abilities to pretend to check-for-updates. I guess that’s progress? Customers must manually check for and download the firmware update from their local TP-Link website.

Please note that the update downloads are **only available in some countries** through the local TP-Link website in each country. Firmware for your region may still be available from a neighboring country. The problem appears to be that TP-Link just has bad routines for pushing out updates to each of their country-specific websites.

I wrote about this issue extensively in “[TP-Link serves outdated or no firmware at all on 30 % of its European website](https://www.ctrl.blog/entry/tplink-firmware-outdated-downloads/)”. For this specific firmware release, the issue also affects TP-Link’s websites in the United States for some models.

While researching this article, I noticed that some TP-Link repeater models have received updates for the KRACK Attacks security vulnerabilities that were disclosed in October 2017. About half of the models mentioned above have yet to receive updates for KRACK Attacks. These security updates have also only been pushed out in some countries; but the firmware for some models may be outdated even in countries that have received updates for other models. Which countries receive which updates appears to be a matter of random chance.

#### Sources

- [<更新>TP-Link製無線LAN中継器によるNTPサーバーへのアクセスに関して](https://www.tp-link.com/jp/press/news/17792/?ref=ctrl.blog), 2017-12-22, News release, TP-Link Japan
### Exploring Bitcoin vanity addresses
URL: https://www.ctrl.blog/entry/bitcoin-vanity-address/
Last updated: 2026-08-23T22:02:16.000Z
Bitcoin payment addresses are around 30 character strings of cryptographic gobbledygook. However, if you expend a little processing power, and you could get a slightly less meaningless string that humans might appreciate a bit more than a purely random address.

I’ve been asked more times for my Bitcoin address by people and services than the number of transactions I’ve ever received with the web’s favorite crypto-currency. I’ve had a Bitcoin address on my tip jar page for a few months, but I only received about 0,15 USD in a single tiny transaction.

I’ve estimated the transaction fee of that transaction to have been at least twice the amount transferred. (Bitcoin isn’t suitable for microtransactions, something I explored a bit [more thoroughly for credit card transactions](https://www.ctrl.blog/entry/flattr2/) last month.)

I publish an Bitcoin address for this site there mostly because people asked for it (and because I can use any funds received to play/test with Bitcoin software). I thought I’d try to make the address itself a little more appealing to the inner geek I suspect many Bitcoin users more to the inner geek of Bitcoin users by hashing out a vanity address for myself:

[1CTRLTiPsApiTUd5Eq5HswjQZF8yWiuJS4](bitcoin:1CTRLTiPsApiTUd5Eq5HswjQZF8yWiuJS4)

Functionally, a readable Bitcoin address, or *vanity address*, makes no difference what so ever.

The above vanity address, like any other Bitcoin address, is a base-58 encoded representation of a cryptographic key pair. The main difference is that I wasted 13 hours of processing power and electricity to generate a fancy address with two recognizable words instead of the normal random address. Note that you can’t a vanity address with a long string as the computational difficulty gets exponentially more difficult.

My first attempt at creating a specific vanity address for myself took about 4-minutes for the phrase “`CTRL`”. That first attempt unfortunately also contained a derogatory term for the female genitalia. The odds of the C-word appearing in any Bitcoin address along are astronomical, and it should have been even less likely to happen in an address with a reduced length for random characters.

Needles to say, I’d to restart and let the hashing run for 19 hours which yielded about six thousand other candidates. After making sure that it didn’t contain any offensive words, I landed on an address that had the word “tips” immediately after my brand pattern. I felt quite lucky to get that one by random chance.

This incidence reminded me of a recent episode where the Australian Bureau of Statistics had to issue an apology for [a barcode that contained the word “BUMSEX”](https://metro.co.uk/2017/09/20/postal-vote-for-gay-marriage-has-unfortunate-bumsex-barcode-6941087/?ref=ctrl.blog). The barcode was found on a postal vote for the Australian national marriage equality vote.

All things considered, I’d say it’s more important that you check that any Bitcoin addresses you generate and publish for human consumption don’t contain any possibly offensive terms than that you spend time and resources generation a vanity address.

Run it your address through a dictionary before publishing it anywhere, and run it through a human or two for an address that will be widely circulated (such as an address for a donation pledge).

A vanity Bitcoin address can be a cute design detail. However, your priorities should be a little different if you’re to investing time in creating an address for wide circulation.

Users are likely to copy-and-paste a Bitcoin wallet into their wallet software to perform the actual transaction. This can introduce errors if the user hasn’t fully selected the full address, and only got a partial address.

Most wallet software will warn the user about an invalid address. The user could also have malware on their devices that looks for Bitcoin addresses on the clipboard, and replaces them with their own addresses ones they’re being pasted.

You can help people identify such issues themselves by having a recognizable word or pattern **at the end of the address** rather than at the front. This increases the chance that people will spot that the address they pasted into their software is different from the address they meant to copy.

Assuming the person looks for the end and beginning of the string, which they must do to select and copy it, they’re can also notice words like “`PAY`” or even a common abbreviation like “`WWW`”. If that pattern is missing or gone when they paste it into their wallet software, they might notice the mistake right away when they expected to see the same pattern they saw seconds earlier. Any pattern that draws attention to the end of the wallet address can be a beneficial.

### How to make a Bitcoin vanity address

In order to make your Bitcoin vanity address, you’ll need a wallet software that can import private keys from their key hashes. Bitcoin Core and its derivatives support this feature, but not all other wallets have support for importing private keys. Check your wallet software’s documentation before investing any time in creating a custom payment address.

To do the actual cryptographic work required for the address generation, I used a software project called [vanitygen](https://github.com/samr7/vanitygen?ref=ctrl.blog). The project page has all the information you need to get it going. As its impossible to deterministic generate a desired hash-outcome, the software will just try and try and try again until it finds a desired pattern.

Depending on your luck, processing power, and the complexity/length of the desired pattern — this could take anywhere from minutes to millennia. Make sure you start with a short phrase to test that it’s working before waiting a week for a longer/fancier result.

There are online services that can do this for you for a small fee, but you should perform address generation yourself to ensure you remain in control of the private key that unlocks your fancy new vanity address.

Once the `vanitygen` program is done, you’ll have a public vanity address and a private key string. You can now import the private key into your Bitcoin wallet software. The import process adds the private key required to confirm your ability to decrypt and spend funds sent to the vanity address to your wallet.

You may want to print your private key for backup purposes, but be sure to store it securely — whether physically or digitally. Anyone who gets hold of your private key also has access to all funds stored on the public vanity address.

Using the Bitcoin Core software, you can open the debug console from the Help menu: Debug Window. If you’ve locked your wallet, you’ll need to lookup a tutorial on how to unlock it or type “help” to learn how to do it. From the debug console, you can import your vanity address’ private key into your wallet with the following two commands:

```shell
importprivatekey "privatekey" "My label"
validateaddress "1vanityaddress"
```

The first command can take several minutes to complete. The second command isn’t strictly necessary, but it will show a reassuring confirmation that you’ve imported and taken control of your vanity address. You won’t see your new vanity address anywhere else in the Bitcoin Core user interface before it has received funds; at which point it will show up in the transactions log.

If you enjoyed this article, or simply have too much Bitcoin burning in your digital wallet – please feel free to send some to the address included at the top of the article to support my writing.

#### Sources

- [Postal vote for gay marriage has unfortunate BUMSEX barcode](https://metro.co.uk/2017/09/20/postal-vote-for-gay-marriage-has-unfortunate-bumsex-barcode-6941087/?ref=ctrl.blog), 2017-09-20, Richard Hartley-Parkinson, Metro.co.uk
- [bitcoin-qt.1](https://github.com/bitcoin/bitcoin/blob/fa2c3b6cf73e776147b5a714fd3f0dc0652c4b34/doc/man/bitcoin-qt.1?ref=ctrl.blog), commit fa2c3b6cf7, 2017-09-12, Bitcoin Core repository, Bitcoin Core project, GitHub
- [Address](https://en.bitcoin.it/w/index.php?title=Address&oldid=61535&ref=ctrl.blog), revision 61535,2016 -09-06, Bitcoin Wiki
- [vanitygen](https://github.com/samr7/vanitygen?ref=ctrl.blog), commit cd1a728243, 2012-10-24, vanitygen repository
### The inadequate Windows keyboard layout
URL: https://www.ctrl.blog/entry/windows-keyboard-layout-inadequacies/
Last updated: 2026-08-23T22:25:04.000Z
Your keyboard layout (“keymap”) is the map between your thoughts and the physical movements of your hands and fingers — whether it be on a touch screen or actual keycap-buttons — to the symbols, letters, and words you write out in digital formats.

I’d like to discuss the shortcomings of the default keyboard layouts in Windows compared to Linux and MacOS. It’s something you use everyday but you rarely think about.

The default U.S. English keyboard layout on MacOS can produce 213 different symbols compared to just 105 symbols on Windows. The layout on Windows doesn’t have any diacritical marks and is limited to ASCII punctuation marks.

The alternative U.S. International (Int’l) keyboard layout is better with 206 different characters including a wide range of diacritical marks and some additional punctuation marks. On Linux, there are a lot of different keyboard layouts with varying capabilities to choose from.

You can’t easily type dashes of varying lengths or typographic quotation marks with the U.S. English keyboard layout. The U.S. Int’l keyboard lets you type double angled quotation marks and single curved quotation marks, but not single angled- or double curved quotation marks.

The US-Int’l layout is a great improvement over the default keyboard layout, but it’s full of compromises and omissions. The default layout on MacOS and many layouts installed by default in most Linux distributions let you type out half a dozen different types of quotation marks, horizontal ellipsis, and dashes and a myriad of other punctuation marks.

The tools we have available to us for writing makes a difference in how we express ourselves. Rich punctuation may not ever have been important to the masses, but we’re all exposed to it every day through everything we read that has a little more thought put into it than a quick personal message.

For example, longer dashes are called “Gedankenstrich” (a though-stroke) in German and North Germanic languages. It’s used to mark a thought break or a subordinate clause in a sentence, in addition to the uses it has in English. Neither the German nor US-Int’l keyboard layouts include any dashes other than the hyphen-minus (or ASCII hyphen) on Windows, but there are at least two more dashes available on MacOS and Linux layouts.

I sometimes feel like signing off on whatever message I’m typing to someone with “Sent from Windows” — drawing on the association from default mobile email client signatures, who all implicitly also apologize for and excuses typos and brevity. However, that wouldn’t be entirely fair. Windows 10 Mobile and Windows 10 shell on PC in tablet mode has an excellent touch keyboard which is as capable as the iOS and Android keyboards.

### Native input methods

Even when the symbols aren’t available right there on your keyboard layout, you still have some other tools available for inputting symbols that are missing from your keyboard layout.

The Windows software/touch keyboard layout is much better than its physical counterparts when it comes to the availability of rich punctuation marks. I’m a slow typer with software keyboards, and I find it uncomfortable to repeatedly tap on glass surfaces to type out a long text.

I just can’t seem to get touch-typing right without the physical knobs denoting the touch-typing starting positions. I much prefer typing on my mechanical Logitech G810 with actual tactile feedback. It’s a fairly quiet mechanical keyboard with some shiny rainbow light-effects, and I can type fast and accurate on it.

I’ve enabled the Touch keyboard button on the Windows taskbar, and sometimes use it to access punctuation marks using the mouse. It’s inefficient, but it’s *a portable skill;* that’s to say: a tool I can get to quickly on all Windows computers without administrative privileges and installing additional software.

The only other built-in option is to use Unicode composition mode. This mode only works in some programs and it doesn’t even work reliably in Microsoft’s own programs. You can hold the Alt key pressed, and type out the four-character UTF-16 hexadecimal sequences representing the various characters you need.

I’ve tried using this method but had trouble memorizing which letter–number combinations produced which symbols. I also got frustrated with how unreliably it works across first-party and third-party programs.

You can technically rely on Smart Quotes and other assistive typing technologies that substitutes your ASCII quotation marks and ASCII hyphens with quotation marks and hyphens where it thinks it’s appropriate. These tools aren’t universally available in all programs and different implementations behave quite differently from program to program. They’re also mostly limited to dealing with quotation marks and dashes. I find these “smart” assistive tools to be so dumb as to be nothing but a distraction.

### Third-party keyboard layouts

You can create custom keyboard layouts for Windows using the [Microsoft Keyboard Layout Creator](https://web.archive.org/web/20171219070814/https://www.microsoft.com/en-us/download/details.aspx?id=22339) tool. It’s a legacy program that “works” on modern day Windows as long as you don’t install it too deeply nested in your directory structure or include a space in its installation path. These issues aren’t signs of low quality but rather emphasizes the tool’s advanced age.

Smashing Magazine commissioned Russian designer Ilya Birman to create a [typography-friendly keyboard layout](https://ilyabirman.net/typography-layout/?ref=ctrl.blog) for Windows in 2009. Since then others have attempted to recreate the [MacOS keyboard layout for Windows](https://andrewdunning.ca/Mac-Keyboard-Layouts-for-Windows/?ref=ctrl.blog) but only for English layouts.

I’m using a Norwegian keyboard with extra keys for some [extra vowels](https://www.youtube.com/watch?v=f488uJAQgmw&ref=ctrl.blog), so none of the US-centric keyboard layouts work well for me. I’ve created my own [Norwegian extended keyboard layout](https://github.com/da2x/win-nor-ext-kbd-layout?ref=ctrl.blog) which has all the vowels, accent marks, and punctuation I need. It’s a cross between the two MacOS and Linux keyboard layouts I use the most.

However, you can’t install third-party keyboard layouts in Windows 10 S edition. You also can’t persistently set a third-party keyboard layout as the default if you synchronize your Windows settings with other Windows PCs using OneDrive and Microsoft Account.

The keyboard layout isn’t in the default list of available keyboards, so Windows will unset your custom keyboard and use another keyboard layout instead. You can work around the issue, but it adds up to extra work. You also can’t use a custom or even [choose the keyboard layout used in BitLocker](https://www.ctrl.blog/entry/preboot-bitlocker-localization/). These problems just highlight how little Microsoft cares about third-party keyboard layouts.

An interesting aside is that I found several more alternative keyboard layouts on the web for MacOS than Windows. Even though the MacOS layout offers more options by default than the Windows keyboard. I believe that having more symbols on the keyboard means MacOS users are more aware of alternative keyboard layouts. It also raises questions about what the lack of exposure to rich sets of symbols does to how Windows users express themselves through their keyboards.

### Conclusions

I don’t expect that Microsoft will make any changes to their keyboard layouts any time soon. Doing so would could change behavior and expectations regarding how and when keyboard shortcuts are triggered. Microsoft doesn’t like disrupting their ecosystem of or compatibility with legacy programs.

That all being said, I still wish that Windows would include extended keyboard layouts with more compositing and punctuation options available. They don’t need to be the default to preserve compatibility with long-since discontinued software, but these writing tools shouldn’t be limited to people who use touch-based keyboards only.

This text was typed out as-is on a keyboard with the actual characters you see on screen. No assistive writing or typing tool — besides spelling and grammar aids — were used to produce this text. The ability to do just that was also what this whole text was all about. I couldn’t have written this text on Windows without third-party software or specialist touch-friendly hardware; whereas both MacOS and Linux include all the symbols and punctuation marks used in this text by default.

#### Sources

- [Windows Keyboard Layouts](https://github.com/MicrosoftDocs/globalization/blob/f053f361c8e61f07fbad31cdef39d1e4a91f76bb/globalization/windows-keyboard-layouts.md?ref=ctrl.blog), commit f053f361c8, 2017-08-29, Kent Sharkey, Globalization repository, Microsoft Docs, Microsoft, GitHub
- [Mac Keyboard Layouts for Windows](https://github.com/adunning/Mac-Keyboard-Layouts-for-Windows/blob/2a5383b9830d236b009de7dd3e0df7957d5c3bc4/README.md?ref=ctrl.blog), commit 2a5383b983, 2015-08-31, Andrew Dunning, Mac Keyboard Layouts for Windows repository, GitHub
- [Typography Keyboard Layout](https://www.smashingmagazine.com/2009/04/typography-keyboard-layout/?ref=ctrl.blog), 2009-04-02, Smashing Magazine
- [US-International Keyboard Layout](https://learn.microsoft.com/en-us/globalization/keyboards/kbdusx.html?ref=ctrl.blog), 2000-02-29, Globalization, Microsoft Docs, Microsoft
- [US Keyboard Layout](https://web.archive.org/web/20171219070914/https://docs.microsoft.com/en-us/globalization/keyboards/kbdus.html), 2000-02-29, Globalization, Microsoft Docs, Microsoft
### Recover from HTTP clients that include URL #fragments in requests
URL: https://www.ctrl.blog/entry/recover-url-fragment-requests/
Last updated: 2026-08-23T22:16:48.000Z
The web is an open place where all sorts of broken client implementations can roam free. In this article, I’ll walk you through how you can help out clients (mostly feed readers and bots) that don’t know that URL `#fragments` should be dropped from request target addresses.

The fragment part of an URL, that’s everything after the first `#` character, should be omitted when forming a valid [request target in HTTP](https://www.rfc-editor.org/rfc/rfc7230.html?ref=ctrl.blog#section-5.3). The request target is the page address that a HTTP client requests from a web server. However, going through my server logs I found a noticeable number of syndication feed readers and bots that have either percent-encoded the fragment portion of URLs or even sent it as-is in their `GET` requests.

These requests end up with 404 Not Found error as an HTTP server will interpret the fragment to be part of the URL’s path. It’s not Hurricane Katrina, but it’s still a problem. I’ve sent some patches around to fix some of the broken implementations, but I can’t possibly fix all of them. You can still recover traffic from clients and bots that make this mistake using some redirect magic.

The following Apache web server configuration example finds the first literal or URL-escaped # character, drops it and anything after it from the URL, and finally redirects the client to the corrected address with the fragment removed.

```apacheconf
RewriteEngine On
RewriteCond %{REQUEST_URI} "(.*?)(#|\%23)"
RewriteRule "(.*)" "%1" [last,redirect=302]
```

Notably, this redirect entirely discards the fragment portion from the URL. By triggering this rewrite rule, a client has already demonstrated that its incapable of properly handling URL fragments.

I’ve had no luck constructing a similar redirect rule for Nginx. It seems Nginx, understandably, refuses to believe a client would ever submit the fragment portion of an URL as part of a request and just refuse to match against it.

### Working around the problem using a different URL pattern

Broken clients will often remain broken and new broken clients come in to the mix all the time. There will always be buggy clients. However, you can mitigate this somewhat for links on your website that contains fragments.

By changing the fragment to appear after the query string or the last query value group in your links, most web servers should be able to normalize incoming request without the need for any special configuration or redirects. These examples should make this method a bit clearer:

```
https://www.example.com/path?#fragment
https://www.example.com/path?query&#fragment
```

If these request came in to the server from a HTTP compliant client, they’d contain an empty query string or an unrecognized query value group. If there request where to come from a broken client, however, the path portion of the URL wouldn’t be corrupted by the tagged-on fragment portion. They’d instead contain non-nonsensical query strings or an unrecognized query value group. The point being, that most web servers already know how to deal with unexpected query strings – so the URLs should remain functional.

The **issue with this approach** is that most clients following such a link from, e.g. `/path` would have to issue another request to `/path?`. Some clients would normalize an empty query string and not issue a second request, however, this isn’t standard compliant behavior either.

The best approach seems to be to just redirect any broken requests when they’re encountered.

#### Sources

- [RFC 7230 HTTP/1.1: Message Syntax and Routing](https://www.rfc-editor.org/rfc/rfc7230.html?ref=ctrl.blog#section-5.3), section 5.3\. Request Target, 2014-06, Internet Engineering Task Force
- [Apache Module mod\_rewrite](https://httpd.apache.org/docs/2.4/mod/mod%5Frewrite.html?ref=ctrl.blog), Apache 2.4 documentation
- [Rewrite module: RewriteRule Flags](https://httpd.apache.org/docs/2.4/rewrite/flags.html?ref=ctrl.blog), Apache 2.4 documentation
### Dual-booting Linux with BitLocker Device Encryption and Secure Boot
URL: https://www.ctrl.blog/entry/dual-boot-bitlocker-device/
Last updated: 2026-08-23T22:05:23.000Z
Take some precautions, have a backup plan, and you can leave your Windows partition encrypted and keep your system using secure boot alongside a Linux distribution. These notes are meant to help you setup a dual-booting system with Linux on a computer running Windows 10 Professional with BitLocker Device Encryption, Modern Standby (a.k.a. Fast Boot), and Secure Boot.

Linux (or any other secondary operating system) installation is only covered in brief as these notes will focus on preserving the Windows pre-boot UEFI environment in such a setup.

Devices shipping with a compatible Trusted Platform Module (TPM) may come with BitLocker Device Encryption enabled by default. As the encryption secret is held by the TPM, you’ll not be prompted for a decryption password on start up and may not even be aware that the device is configured with enhanced security. It’s important to make adequate preparations when making changes to the boot environment on such a setup.

### Making preparations

Before proceeding, you should **back up all important data** to an external hard drive or your preferred online backup provider; preferably both. There’s a not insignificant risk of permanently breaking your Windows 10 installation in a non-recoverable fashion as you’ll be making changes to the UEFI partition in your computer.

You should also print a copy of your BitLocker recovery key as it may be needed during this process. This is **not your BitLocker PIN or password**, but a separate numeric key. You can print your recovery key from Control Panel: System and Security: BitLocker Drive Encryption.

Please note that **the recovery key changes** every time you disable and re-enable BitLocker Device Encryption. Be sure you always have several copies of the most recent recovery key, or you may loose access to your encrypted data.

You should also [download and prepare a Windows 10 Installation Media](https://www.microsoft.com/en-us/software-download/windows10ISO?ref=ctrl.blog) (e.g. a 16 GiB+ USB stick) for recovery purposes beforehand. Note that you’ll also need a separate Linux installation media.

Lastly, you should double-check that you’ve the latest firmware updates installed — especially your Trusted Platform Module (TPM) firmware. Note that vendors might [not auto-update the TPM](https://www.ctrl.blog/entry/lenovo-companion-tpm-updates/) using their regular driver and firmware update utilities.

Read the above section carefully to avoid — or at least prepare to recover from — accidental irrecoverable data loss!

### Freeing up space on the drive

To install a second operating system — whether that be another copy of Windows, Linux, or something more exotic — you’ll need to free up space on your system drive. You can also use a secondary drive, but this is probably not an option for laptop users and small-form-factor devices.

See also: [How large should you make the UEFI System Partition?](https://www.ctrl.blog/entry/esp-size-guide/)

You’ll need to free up at least 20 GiB for a small Linux installation, but you’re the only one who can say exactly how much disk space you’ll need. Some Linux distribution installers (at least Ubuntu and Fedora Linux) can install itself alongside Windows with fully guided installation options if you prepare your disk in this way.

Optionally, if your partition layout allows for it you should also grow your UEFI System Partition to about 1 GiB. Some manufacturers may only ship 100 MiB partitions or smaller. As multiple operating systems will be storing their UEFI blobs (and possibly multiple versions during system upgrades), it can be beneficial in the future to have more space available on this partition.

You may not be able to accomplish this without reinstalling Windows from scratch, and it’s not absolutely necessary — although it might save you some troubleshooting at a later time.

You can resize and manage your partitions with the built-in Disk Management utility in Windows. You can find it by searching for “Create and manage hard disk partitions” in Windows Search or Cortana.

If this is a new device that you’ve never stored any personal data on, I’d recommend that you first disable BitLocker Device Encryption temporarily before making changes to your drive partitions. Windows is fairly decent at self-repairing any accidental damage or problems that can occur when you manipulate your partitions.

Windows can do more with a native NTFS drive than a BitLocker encrypted drive if something goes wrong. After disabling BitLocker Device Encryption from Windows Settings, you must wait some time for the decryption to complete. Then you can proceed to shrink the main drive. Both of these operations can take hours, depending on the drive.

When you’ve shrunk your partition and freed up space, you can re-enable BitLocker Device Encryption. You should reboot your system and wait several hours for the process to complete before proceeding to avoid running into issues later.

If you’ve already stored personal data on the drive, you should first backup everything, leave BitLocker Device encryption enabled, and then just resize the encrypted drive and hope for the best.

Don’t format or partition the freed up space afterward, leave this to the Linux installer later.

The above instructions aren’t written as a step-by-step instructions on purpose. You need to learn more about disk management and partitions before proceeding if you don’t know what to do by this stage.

### Installing the secondary operating system

Linux installers vary a lot, so I’ll only give some general pointers on the installation process. You shouldn’t need to disable Secure Boot to install a modern Linux distribution. Refer to the documentation for your distribution for specifics. Depending on your device, you may have to boot into your installation media from the Windows Settings app: System and Updates: Recovery: Advanced Startup.

You shouldn’t select to use the entire drive. The graphical installers for Fedora Linux and Ubuntu will automatically suggest using the space you freed up on your system drive earlier. You should always verify that the installers aren’t going to format your Windows or UEFI partitions before accepting their suggestions.

Windows 10 and Linux share the same partition for their UEFI blobs. However, you can not install multiple versions of Windows or multiple version of the same Linux distribution on the same UEFI system partition. Each will install into a folder named after the operating system, e.g. “Fedora”, “Microsoft”, and “Ubuntu”, but this naming scheme doesn’t allow for more than one version at the time.

If you need to install multiple version of, e.g. Windows, then you also need to create separate UEFI system partitions for each one. Please note that this will require that you disable BitLocker Device Encryption as changing the boot partition will upset the TPM.

Older versions of Windows and some Linux installers would sometimes overwrite the entire UEFI partition, but I don’t believe this has been a problem for some years now. You’ll want to mount the existing Windows UEFI partition **without formatting it** to `/boot/efi` on your Linux system. You should use a shared UEFI partition this even if you’re installing Linux to a secondary drive as it will give you an easier time with Secure Boot, BitLocker, and GRUB2.

`os-prober` should auto-detect Windows and create a boot menu item for it alongside Linux in GRUB2\. Windows Update requires multiple reboots, so you’ll want to configure GRUB to remember your last boot menu selection (`GRUB_DEFAULT=saved; GRUB_SAVEDEFAULT=true`).

This will allow either operating systems to trigger multiple reboots to perform updates and have it boot into the correct operating system. It’ll also get you back into the same operating system that you used the last time you booted your system.

You may be prompted for your BitLocker Recovery key after completing the installation.

I hope you’ll now feel a little bit more prepared to create a dual-booting system with Secure Boot and BitLocker Device Encryption. Things should just work, but the boot process is delicate so you must take precautions in case you need to restore your system. *Good luck!*

#### Sources

- [Modern Standby](https://web.archive.org/web/20171212164406/https://github.com/MicrosoftDocs/commercialization-public/blob/301ee27654ecaf06ca79481742339e30b3f1a845/design/device-experiences/modern-standby.md), commit 301ee27654, 2017-07-20, Hardware Documentation for Microsoft partners, Microsoft Docs, GitHub, Microsoft
- [Overview of BitLocker Device Encryption in Windows 10](https://github.com/MicrosoftDocs/windows-itpro-docs/blob/d35e09bf3010a79dec1cff088c31baf1b5d33471/windows/device-security/bitlocker/bitlocker-device-encryption-overview-windows-10.md?ref=ctrl.blog), commit d35e09bf30, 2017-04-05, IT Professionals Docs, Microsoft Docs, GitHub, Microsoft
- [UEFI](https://help.ubuntu.com/community/UEFI?action=recall&rev=73&ref=ctrl.blog), revision 73, 2015-06-07, Community Help Wiki, Ubuntu Documentation, Canonical
### Roomba app notifications are unhelpful and miss the point
URL: https://www.ctrl.blog/entry/roomba-notifications/
Last updated: 2026-08-23T22:21:20.000Z
The Roomba iRobot 900, 890, and 690 series robotic vacuum cleaners are Wi-Fi enabled and can be remotely controlled from the iRobot Home app. The app experience is okay, but the notifications that your robotic floor aid sends your device serve no purpose at all.

I bought and returned a [fairly unimpressive Neato Botvac D3](https://www.ctrl.blog/entry/review-neato-botvac-d3-connected/) earlier this year, and later replaced it with the Roomba 960\. Both robots are operated remotely using smartphone apps, and both get mobile notifications all wrong.

Like the Neato D3, Roomba sends out a notification at the end of the cleaning session saying “\[it\] has successfully completed a cleaning job.” This is cute on day one, but its not a useful interruption and ultimately entirely pointless. I don’t want push notifications on my phone telling me what a good job my vacuum cleaner is doing. Unfortunately, you can’t turn off these notifications without also turning off all other notifications.

**Update** (2018-03-05): iRobot Home version 2.6 and Robot firmware 2.4.4 (January 20018) now lets you disable job status reports if you sign up for an iRobot Account and link your vacuum. (That is an incredible sentence I never thought I’d write.)

Roomba is so fond of these positive notifications that it has also sent me about a dozen or so notifications about having completed jobs in the middle of the night. I know that it hasn’t been cleaning in the middle of the night, and I haven’t scheduled jobs to run in the night either. I don’t know whether these notifications are random glitches, were meant to be sent to other robot-owners, or were 12 or more hours delayed from when they were supposed to have been delivered. The only thing they achieve is to remind me how little I care about notifications telling me that everything is working as intended.

What is more, my Roomba 960 drives back to its charging station at the end of a cleaning session, sends a push notification about its job well done — and then fails to notify me that its derbies bin is full. The latter would be something I’d have to do to ensure the robot will keep on cleaning the following day. But iRobot designers decided it was more important to remind me that everything is okay than to tell me that my robot won’t work the next day unless I empty the debris bin. The robot base a blinking red light on top to indicate that the bin is full, and if I open the app — why would I do that if everything is okay? — it will say its full. My Roomba lives underneath a sideboard, so I don’t see it nor the tiny bin status light.

Some 10–15 minutes before the next scheduled cleaning job it will send you another message telling you to empty the dust bin. Roomba won’t start with a full bin, and you can’t empty the bin as you’re likely to schedule cleaning jobs when you’re not home … .

The app designers are completely off when it comes to prioritize what information is important and useful to the customer. I don’t need to be told when it “just works”, only when I need to do something to keep it working. I never want to be notified when it’s just doing its thing.

Roomba can also speak to announce specific problems such as it being stuck or other error conditions that it can’t resolve on its own. I’d one episode where the robot itself **randomly talked out load to the living room in the middle of the night** while it was parked at its charging station. It [gave me quite the scare](https://www.ctrl.blog/entry/shut-up-roomba/) as I was awake and sat with my back turned against the unexpected voice. This is another example of how the robot just disregard when information is useful and when it’s not appropriate to notify the user.

Ideally, the robot should wait a couple of minutes after my phone returns to the same Wi-Fi network as the robot and only then send a push notification. That way, it would notify me when I’m in the vicinity of the robot and can do something about the situation. Sending me a notification about the bin being full or it being stuck in the middle of the day doesn’t help when I’m not near the robot. I might dismiss the notification and forget about it by the time I get home. If I don’t return to the same network for several hours/before evening, the notification could be sent out regardless of my location as a fallback.

It’s not hard to imagine more useful and aware notifications for the Roomba. Frankly, I’m surprised that a company that does nothing but build robotic vacuum cleaners primarily for the domestic market can’t work this out. The robot and the companion app already knows how to detect whether you’re on the same network, the robot already knows its bin is full, … there aren’t any unknowns here other than why iRobot can’t design useful notifications.

Oh, and yes – I’ve named my Roomba *‘Dustin Bieber.’* Although its name should have been Dustin Bieber Ⅱ.
### New Web Media Extensions adds Ogg, Theora, and Vorbis to Windows
URL: https://www.ctrl.blog/entry/windows-webmedia-ext/
Last updated: 2026-08-23T22:25:30.000Z
In October, I wrote about how [Microsoft is bringing Ogg, Theora, and Vorbis open media formats to Windows 10](https://www.ctrl.blog/entry/windows-ogg/). They’ve managed to deliver on that quicker than I’d expect, but they also haven’t integrated it as tightly into Windows 10.

The new *Web Media Extension* app is already [available in the Microsoft Store](https://apps.microsoft.com/store/detail/web-media-extensions/9N5TDP8VCMHS?ref=ctrl.blog) for free or Windows 10 and Xbox One. Though the app can be a bit hard to find in the Microsoft Store. Although the app manifest associates it with all the common Ogg media container file extensions, you can’t find it by searching for apps that support those extensions.

People are most likely to encounter Ogg, Theora, and Vorbis media files when browsing the web. The Web Media Extension does extend Microsoft Edge’s media playback capabilities when installed.

However, people won’t be prompted to install it from the Microsoft Store on demand when they encounter multimedia files in these formats. The same goes for the Movies and TV app and the Groove Music app too.

The Movies and TV app, along with all other Universal Windows Platform apps, will also be capable of playing back Ogg, Theora, and Vorbis files. However, the Movies and TV app isn’t associated with the Ogg media container file extensions and as such won’t allow you to open the files in the app — despite the app now being capable of playing them back to you. You can fool the app to open the file and have it play it back to you, but this isn’t something a normal user will know how to do.

![“To play this video, you need a new codec”](https://cdn.synaps.media/control/content/images/2026/08/windows-zunevideo-you-need-codec.png) 

Media and TV app prompts about codec installation.

This may change in a future version of the Movies and TV app. The app will prompt viewers to install [MPEG2 Video Extension](https://apps.microsoft.com/store/detail/mpeg2-video-extension/9N95Q1ZZPMH4?ref=ctrl.blog) from the Microsoft Store inside the app when encountering MPEG1 or MPEG2 media files. Neither Microsoft Edge nor Groove Music currently prompt you to install any MPEG2 codecs, but Microsoft may prioritize handling this in a better way now that there are more codecs available in the Microsoft Store. Who knows? —maybe they could even convince people to start paying for optional/premium codecs in the future after they build out their platform infrastructure to support it in a good way.

Notably, the Web Media Extensions app won’t extend Windows Media Player or Internet Explorer to include Ogg container support. I’d expected that Microsoft would extend Windows Media Foundation add support in all apps, including these legacy programs. However, the Web Media Extensions is instead built as a Universal Windows App windows.mediaCodec provider.

The Web Media Extensions app is build on top of the open-source [FFmpeg project](https://ffmpeg.org/?ref=ctrl.blog). FFmpeg’s Ogg, Theora, and Vorbis playback support comes courtesy of the [Xiph Project](https://www.xiph.org/?ref=ctrl.blog)’s reference implementation libraries for Ogg media containers, the Theora video codec, and the Vorbis audio codec (also frequently found in WebM video containers.)

In other words, Microsoft is using the same open-source libraries as Mozilla Firefox, Google Chrome, and in many open-source media players and devices. Compatibility should be on par with other web browser and media players.

#### Sources

- [uap4:MediaCodec](https://github.com/MicrosoftDocs/winrt-related/blob/eb382b824dbfa21eaca056d8d42192f7d37b70d5/winrt-related-src/schemas/appxpackage/uapmanifestschema/element-uap4-mediacodec.md?ref=ctrl.blog), commit eb382b824d, 2017-04-05, Lauren Hughes, Microsoft Universal Windows Platform, Microsoft Docs, Microsoft
- Microsoft.WebMediaExtensions app package from the Windows Store, version 1.0.3102.0
- Microsoft.ZuneVideoapp package from the Windows Store, version 10.17102.13911.0
### Lenovo Companion app doesn’t notify you about TPM firmware updates
URL: https://www.ctrl.blog/entry/lenovo-companion-tpm-updates/
Last updated: 2026-08-23T22:13:00.000Z
New Lenovo devices come pre-installed with the *Lenovo Companion*; an app that manages device maintenance and warranty, and is responsible for updating your Lenovo drivers, firmware, and software. However, the Companion app doesn’t take its responsibility too seriously and fails to notify you about security updates to your device’s firmware.

My significant other bought a new Lenovo ThinkPad Carbon X1 (5 gen.) and I may have seized it so I could compare it to my old first generation model. One of the differences I noticed was that it had the new Lenovo Companion app, the modern replacement for the old [Lenovo OneKey Optimizer app I reviewed](https://www.ctrl.blog/entry/review-lenovo-onekey-optimizer/) back in August 2015.

At first glance, I was quite pleased to see that Lenovo Companion now finds, downloads, and installs updates to Lenovo drivers, firmware, and software. The Companion app organizes available updates in three categories: Critical, Recommended, and Optional. Two restarts and a couple of minutes later, I thought I’d gotten every available firmware update in one go. It turns out, that wasn’t the case despite this reassuring message in the Lenovo Companion app:

> “No updates are available. Your system is up-to-date.”

On closer inspection, I also noticed a box down in the bottom right corner labeled “Additional updates” that links you off to the product support page for your product on Lenovo’s website. I found three additional updates available, but the one that caught my interest was the only update in the “Security” section.

I found a security update for the trusted platform module (TPM) firmware that addressed a vulnerability in its random number generator (CVE-2017-15361 or “ROCA.”) The vulnerability allows attackers to extract the TPM’s private encryption keys, and thus gain the ability to decrypt, e.g. BitLocker Device Encryption that protects Windows by default on this device.

![Windows TPM Management identifying Infineon vulnerability](https://cdn.synaps.media/control/content/images/2026/08/windows-infineon-tpm-management.png)

Neither Windows Update nor Lenovo Companion nor automatically installed or informed me about the availability of this security update. Windows Update did kind-of-but-not-really address this issue with an update that added a notice about the outdated firmware in the Windows Trusted Platform Module (TPM) Management utility.

I doubt many users (if any) ever open this program, and even fewer would notice the update-prompt that Microsoft have hidden there.

### Why wasn’t this auto-updated?

Updating a hardware encryption module is risky, and this update was no exception. Updating the TPM firmware also removes the private keys stored on it; meaning that you would **loose the ability to decrypt data** stored in Windows BitLocker and other decryption software. This isn’t a flaw in the design of the module; it’s supposed to make it hard to recover any data from it by tampering with its firmware.

The firmware update notices mention that the updater is capable of dealing with BitLocker on its own, but the needs of any other encryption software would need to be handled by the user. To cite the firmware update utility release notes:

> “Applying TPM firmware **update will erase information stored in the TPM chip.** In case customer uses any software (such as disk encryption software) which stores created keys to TPM chip, customer needs to stop using those software temporarily before applying TPM firmware update. This tool has the built-in function to suspend Microsoft BitLocker during TPM firmware update, for other software, customer needs to follow the instructions of software to avoid the data loss.”

In other words, you can’t just install this update automatically without informing the user. The updater could have included detection tools for other common software that use the TPM, and it could have displayed warnings about backing up any encrypted data before installing the update.

This doesn’t fully mitigate the potential of data loss in cases where the users didn’t understand the message, didn’t know they relied on software that used the TPM, or the TPM firmware update outright failed. A staged-update approach could have helped mitigate these issues.

The update utility could have first disabled the TPM on reboot, and displayed a message on every boot thereafter prompting the user to check that all their software still works and then reboot, re-enable the module, and update its firmware.

My point is that it’s not beyond the wit of man to handle this update process in a better way than what Lenovo and Infineon (the TPM vendor) decided on. At the very least, the user should be notified and made aware about the availability of new firmware rather than being falsely reassured by the Companion app that their “system is up to date.”

#### Sources

- [ADV170012: Vulnerability in TPM could allow Security Feature Bypass](https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV170012?ref=ctrl.blog), 2017-11-16, Security TechCenter, Microsoft
- [LEN-15552: RSA Keys Generated by Infineon TPMs are Insecure](https://support.lenovo.com/uu/en/product%5Fsecurity/len-15552?ref=ctrl.blog), 2017-11-01, Lenovo Product Security Advisories, Lenovo
- [CVE-2017-15361 Detail](https://nvd.nist.gov/vuln/detail/CVE-2017-15361?ref=ctrl.blog), 2017-10-22, US National Vulnerability Database, Information Technology Laboratory, US National Institute of Standards and Technology
- [TPM Firmware Update Utility README](https://download.lenovo.com/pccbbs/mobiles/n1czt01w.txt?ref=ctrl.blog), 2017-10-11, Lenovo
- [Drivers and Software](https://pcsupport.lenovo.com/uu/en/products/laptops-and-netbooks/thinkpad-x-series-laptops/thinkpad-x1-carbon-type-20hr-20hq/20hr/20hr0022mx/downloads/driver-list/?ref=ctrl.blog), X1 Carbon 5th Gen – Kabylake (Type 20HR, 20HQ) Laptop (ThinkPad) 20HR0022MX, Lenovo Support, Lenovo
### Flattr vs Brave Rewards, comparing micro-transaction service fees
URL: https://www.ctrl.blog/entry/flattr-vs-brave-fees/
Last updated: 2026-08-23T22:07:09.000Z
There was a surprising amount of interest in last month’s article where I discussed the [fees for the micro-transaction service Flattr](https://www.ctrl.blog/entry/flattr2/) and compared them with the fees at Patreon. I’m following up that article by comparing Flattr to [Brave Rewards](https://www.ctrl.blog/entry/brave-payments/), a service who is a service that more closely is trying to compete with Flattr.

Brave and Flattr are two services that both want you to voluntarily pay a monthly fee to fund the web’s many creators and publishers. Each promise to automatically divide up your monthly subscription fee and share it among the creators and website you’ve spent the most time within your web browser.

There are two main differences between the two services:

1. Brave Rewards is limited to only pay out per domain, e.g. medium.com, whereas Flattr can reward individual creators on many platforms for sharing creative works (YouTube, Medium, Vimeo, GitHub, SoundCloud, Twitch, etc.) in addition to pages with a special meta tag and domains.
2. Brave Rewards only work with its own crypto-currency whereas Flattr works with regular credit cards and good old fashioned money.

Brave Rewards have moved away from its reliance on Bitcoin and instead focus on their own Basic Attention Token crypto-currency/token. That is to say, you can still fund your contributions on Brave with Bitcoins – but they’ll be automatically converted to BAT at a transaction fee. Calculating transaction fees for Brave can be hard as its so damned difficult to give them any money. I’ve chosen to use a credit card payment through Brave’s recommended crypto-currency market Uphold for the fee calculation examples below. This is the most convenient method for making payments using Brave and also the same method as Flattr uses.

__Fees for micro-transaction services__
| Service                 | Payment                    | Fee estimate         | Paid to creators |
| ----------------------- | -------------------------- | -------------------- | ---------------- |
| Monthly                 |                            |                      |                  |
| Brave (Uphold)          | 5 USD (one-time)           | 3,57 USD (71,40 %)1  | 1,43 USD         |
| Flattr (after 2018-02)  | 5 USD (5 USD/monthly)      | 0,5 USD (10 %)2      | 4,5 USD          |
| Flattr (before 2018-02) | 5 USD (5 USD/monthly)      | 0,825 USD (16,50 %)2 | 4,175 USD        |
| 10-months               |                            |                      |                  |
| Brave (Uphold)          | 50 USD (prepaid 10 months) | 7,08 USD (14,16 %)1  | 42,92 USD        |
| Flattr (after 2018-02)  | 50 USD (5 USD/monthly)     | 5 USD (10 %)2        | 45,00 USD        |
| Flattr (before 2018-02) | 50 USD (5 USD/monthly)     | 8,25 USD (16,50 %)2  | 41,75 USD        |

**Update** (2019-09-19): The above table was updated to reflect Flattr’s new fee structure.

So, there’s something strange going on with Brave Rewards through Uphold. Their fee structure clearly isn’t meant for micro-transactions. Uphold, the currency exchange service recommended by Brave, requires a minimum credit card transaction of **at least 50 USD or 75 EUR**.

If we break down the fees that Brave and Uphold charge; we find conversion, transaction, and withdrawal fees from Uphold of 1 % + 2.99 USD + 3 BAT3 \+ 1,95 % and finally the 5 % fee charged by Brave. This fee structure explains the lower costs at higher transfer amounts.

In comparison, after 2018 February, Flattr’s payment provider would charge a flat fee of 10 %. Half of which goes to their payment processor. You can play with the figures yourself and see how much each flattr is worth and how much you’re paying in fees with the [Flattr contributor-value and fee calculator](https://www.daniel.priv.no/tools/flattr-calculator/?ref=ctrl.blog).

Before 2018 February, Flattr would keep a 7,5 % for themselves plus a flat 9 % transaction fee, which works better for smaller amounts but adds up quickly for higher amounts.

The longer time commitment and initial cost to adopt Brave Rewards can be off-putting compared to Flattr’s smaller monthly payments. The volatility of crypto-currencies doesn’t fill me with confidence when it comes to prepaying for services almost a full year in advance. It’s much harder to accurately predict the exact value your payments will have to creators and publishers when using Brave as your 50 USD today likely won’t be worth 50 USD in ten days – let alone ten months.

I made a fee calculator for Flattr in a couple of minutes. However, I wouldn’t even attempt to create such a calculator for Brave Rewards as there are too many variables and too much uncertainty involved in their payment scheme.

Despite Brave being slightly cheaper in the long run, I’d recommend that people [use Flattr](https://flattr.com/?ref=ctrl.blog) instead. You’re paying a little extra for the convenience of using a credit card and predictable payment terms, but you’re also getting a service that’s more flexible and can benefit more creators and publishers than Brave. Plus, you get to keep your existing web browser instead of having to switch to the Brave browser.

#### Sources

- [Account funding & withdrawal costs and limits](https://web.archive.org/web/20171106020708/https://support.uphold.com/hc/en-us/articles/206118653), 2017-11-06, Uphold Support, Uphold
- [Our new fee structure](https://web.archive.org/web/20211023073147/https://blog.flattr.com/2017/10/our-new-fee-structure/), 2017-10-06, Linus Olsson, Flattr Blog, Flattr
- 1 Brave Payments fee example: (((X\*0,99)-(2,99 USD + 3 BAT3))\*0,9805)\*0,95.
- 2 Flattr fee calculation: X\*0,835.
- 3 3 BAT was worth 0,4363 USD at the time of publication.
### Amazon Australia prepares for Affiliate Program launch
URL: https://www.ctrl.blog/entry/amazon-affiliate-australia/
Last updated: 2026-08-23T22:01:19.000Z
A new [website for the Amazon Australia Affiliate Program](https://affiliate-program.amazon.com.au/?ref=ctrl.blog) came online some time in early November 2017. At the time of publication, the site only returns a blank responses.

**Update** (2018-04-28): The Amazon Australia Affiliate Program was temporarily live and open for registration this month. The website has since gone offline again.

**Update** (2018-07-28): The website is now live and accepting partner sign-ups.

Amazon Australia has only sold digital goods and Amazon branded electronics like the Kindle and Fire TV sticks. Amazon Australia has been a minimalist light version of the full “everything store” experience until now. However, since March 2017, there have been reports about Amazon building out logistic centers and distribution capacity in Australia.

Amazon hasn’t yet publicly announced anything regarding expanding into Australia, but rumors and speculation exploded in response to a leaked Amazon email that were sent to select Amazon Marketplace Sellers. The email hinted about a soft-launch of Amazon.com.au in time for Black Friday on 2017-11-24.

Black Friday came and went and Amazon’s Australian website didn’t massively transform online retail in Australia in time for the year’s biggest shopping event.

I noticed something here the other day, which I haven’t seen anyone report on yet. Amazon Australia opened a placeholder website for a new Affiliate Program portal. Amazon currently operates 12 separate affiliate programs around the world.

The new website is at https://affiliate-program.amazon.com.au/.

Amazon only operates an Affiliate Program in countries with a local Amazon marketplace website. Amazon relies on its large network of affiliates to help it promote products and maintain a high level of awareness — even a feeling of omnipresence — among their customers.

Earlier this year, Amazon made it easier for its their affiliate program partners to monetize international visitors with the launch of their new [OneLink regional redirection service](https://www.ctrl.blog/entry/amazon-onelink-affiliate-redirection/). OneLink redirects visitors to their nearest regional Amazon website and onto equivalent product pages across borders.

**Update** (2018-04-25): The Amazon Australia Affiliate Program is isn’t yet linkable with Amazon OneLink.

eBay launched their Partner Network in Australia just two months ago (September 2017); calling on new partners to help them dig out a bigger cut of the Australian market. eBay’s timing suggest they may have wanted to establish a local presence in Australia before Amazon could launch its own affiliate program in the country.

The new Affiliate Program website has its own encryption certificate specific for its domain name. This certificate is of the same type and from the same issuer as the certificate that’s used on the main Amazon Australia website. The placeholder website appears to have come online on November 7th (exact date unconfirmed), and certificate issuance transparency logs say the certificate was issued some weeks earlier on 2017-08-14.

Other than that, there isn’t much to be said about a single blank page.

#### Sources

- [Amazon Australia Launch: Everything You Need To Know](https://www.lifehacker.com.au/2017/11/everything-you-need-to-know-about-amazon-australia/?ref=ctrl.blog), 2017-11-27, Ryan Jackson and Chris Jager, LifeHacker Australia
- [The 'Amazonageddon' that never happened](https://finance.nine.com.au/business-news/the-amazon-launch-that-never-happened/2a9c839a-7e12-4b21-86de-84e8852228ec?ref=ctrl.blog), 2017-11-24, Stuart Marsh, 9Finance, Nine Digital
- [How will Amazon navigate Australia’s taxation system?](https://theconversation.com/how-will-amazon-navigate-australias-taxation-system-85323?ref=ctrl.blog), 2017-11-11, Roman Lanis and Brett Govendir, The Conversation, The Conversation Trust
- [Why We Think Amazon Australia Will Launch Any Day Now](https://www.lifehacker.com.au/2017/11/why-we-think-amazon-australia-will-launch-any-day-now/?ref=ctrl.blog), 2017-11-07, Ryan Jackson, LifeHacker Australia
- [Certificate details for affiliate-program.amazon.com.au](https://transparencyreport.google.com/https/certificates/bMMZyyI5FI3B5qipJ77kzXf2lceF3VVV3T20njrEuFI%3D?ref=ctrl.blog), 2017-09-16, HTTPS encryption on the web, Certificate Transparency Report, Google
- [eBay Partner Network Launches Our Newest International Site: Australia](https://web.archive.org/web/20171129141005/https://partnernetwork.ebay.com/epn-blog/2017/9/ebay-partner-network-launches-our-newest-international-site-australia), 2017-09-05, Scott Parent, eBay Partner Network blog, eBay
- [Amazon to seek Australian logistic centres](https://www.smh.com.au/business/companies/amazon-to-seek-out-australian-logistic-centres-20170307-gusfek.html?ref=ctrl.blog), 2017-03-08, Carolyn Cummins, The Sydney Morning Herald
### Topical leaks users’ email addresses and interests
URL: https://www.ctrl.blog/entry/topical-vulnerabilities/
Last updated: 2026-08-23T22:23:23.000Z
[Topical](https://web.archive.org/web/20171207160225/http://gettopical.com/) was a daily email newsletter service that would send you “the most popular stories \[to\] your inbox daily”. To cut the description of Topical short, it fetch the top messages on whatever keyword you give them from the Twitter Search API and send you a daily email with the top links. The service also leaks your email address and the interest subscription list onto the public web.

**Update** (2019-05-01): The Topical website ceased operations in April 2019.

Topical clearly wanted to create a frictionless service. There’s no form of authentication required when signing up for a topic. Instead, you just enter your email address and you’ll receive your first email on the topic the next day.

Most large email list providers require what’s known as a double opt-in where they require users to click on a confirmation link before they deliver any further emails. This is done to maintain a good reputation for their domain within email systems and spam classification lists.

Each email address is assigned a unique account identifier. This identifier isn’t derived from the email address itself through a process like hashing (meaning it’s not guessable if you already know the email address), but is an arbitrary identifier of a format called UUID version 4.

Such an identifier contains 122 bits of randomness and is virtually impossible to guess. This identifier is **the only thing required to see the email address and interests** of a user. In security terms, the **account identifier (“username”) is also the account secret (“password”).**

It’s important for web services to keep the secrets we give them to keep. Unfortunately, Topical’s desire to create an easy-to use and frictionless service means that the secret isn’t very well protected at all. Every link in the emails Topical sends out points to their own website.

These links also contain the account identifier, enabling the user to modify their interest subscriptions without any extra steps. Topical’s website doesn’t use HTTPS, which means the account identifier is already vulnerable to a attacker-in-the-middle interception attack at this point.

The real problems begin when users share links sent to them by Topical with others. Since their unique account identity is included with the link, they inadvertently hand over the list of topics they’ve subscribed to and their email address.

Some web browsers like Google Chrome, [Internet Explorer](https://www.ctrl.blog/entry/ie11-flip-out-privacy/), and Microsoft Edge even collect the user’s browsing history for various purposes including extending their search indexes.

You can also find a large collection of links containing unique user identifiers and the email addresses of Topical users through regular web search engines.

The account identifier also leaks out when clicking on the links to other websites on the Topical website. As I’ve discussed previously, account secrets and [private information can leak out through the HTTP Referer request header](https://www.ctrl.blog/entry/private-bts-referrer-header/) (sic.) Topical is a prime example of this problem.

### What do you get with a compromised account?

Users can only subscribe to 5 topics with one email address on Topical. Though the service suggests working around their own arbitrary limitation by using different email addressees.

I’m not sure if this is a misguided effort to artificially increase their number of active users for investors, or if they do have a solid technical reason why users are limited to only 5 topics per email address. I suspect the former to be the case.

I can’t find any evidence that Topical have made any attempts at protecting the account identifier. It leaks out of the service through insecure cookies, referrer headers, and all over the place out of sheer negligence.

Account UUIDs are practically impossible to guess. However, you **don’t even need to know an account holder’s identifier to get into their account information**. **All you need is a target’s email address**. Given a registered email address, you can sign up for any topic – and in the process the service will lookup any existing account and log you in to it, or create a new account on the fly. So, simply by typing in someone’s email address into the service, you’ll know what topics — if any — they’ve already subscribed to.

An attacker is free to see the registered email address of the user, the list of topics they’ve subscribed to, and can also freely change the topics that the target will receive daily email updates about.

You could use such an attack to boost exposure to a product launch, drive people’s attention to a new piece of software — that’s a camouflaged malware — or other creative exploits of Topical.

### What could have been done to reduce the risks?

The obvious solution is to require users to authenticate, but everyone hates passwords and it was clearly a design goal at Topical to avoid that — no matter the cost.

The risk of leaking out the account identifier could have been avoided in many ways. First by moving all website communication to HTTPS to close any monster-in-the-middle (MITM) attacks against the request address or the cookie containing the account identifier.

The email newsletters sent out by Topical should never have contained account tokens. (At the very least not a persistent account token.) Some people forward newsletters to their friends and peers.

There’s nothing to suggest that they shouldn’t forward emails from Topical just like they would any other newsletter. It’s just a newsletter, right?

Any email that did contain a time-limited login token should use redirects to remove the token from the URL. This could be as simple as loading /example?uid=token, setting the account cookie, and then immediately redirecting to /example.

By hiding the token, you reduce the risk of sharing it, either deliberately by posting it on Twitter or unwittingly throughout a click that contains a HTTP Referer (sic) request header.

Lastly, you should instruct search engines to never index pages containing tokens. This would have reduced the impact and ease of discovering accounts through “good” search engines. There are several well documented ways to exclude something from search engines, but Topical haven’t done any of them.

It’s not beyond the wit of men to create a service that fulfills Topical’s effortless authentication requirements. However, you do have to put in the work, and test to make sure that user data doesn’t leak out.

Topical was notified about this issue by email on 2017-08-12 but haven’t acknowledged it in any way. Topical is made by one of the many companies with the name CatchApp Ltd. The copyright footer on their website says 2015, and their last message on Twitter was posted more than a year ago on September 2016. The service appears to have been abandoned by its creator.

#### Sources

- [RFC 4122 Universally Unique IDentifier (UUID)](https://www.rfc-editor.org/rfc/rfc4122.html?ref=ctrl.blog), 2005-06, Network Working Group, Internet Engineering Task Force
### TP-Link repeater firmware squanders 715 MB/month
URL: https://www.ctrl.blog/entry/tplink-aggressive-ntp/
Last updated: 2026-08-23T22:23:25.000Z
You should probably avoid TP-Link products if you’re on a tight bandwidth budget. **By design,** TP-Link firmware sends six DNS requests and one NTP query every 5 seconds, for a total of 715,4 MB per month.

The firmware of some TP-Link repeaters — **but not routers** — including all 2017 models are very talkative on NTP, to a total of 715,4 MB per month. NTP is the network time protocol used to synchronize clocks across the web. To put this number in context: an always-on Windows device will use around 1,6 KB per month on NTP.

TP-Link’s firmware doesn’t have any sort of DNS caching, and they query DNS about 6 NTP server pool addresses every 5 seconds followed by an NTP request to one of them. An always-on Windows client sends 1 DNS and 1 NTP request once a week. (If you power cycle or suspend your device, it will send one additional request.)

This means your TP-Link product is using about 1,38 KB every 5 seconds — or 23,85 MBs per day — on timekeeping. For comparison, a 5-minute check would be considered a pretty aggressive checking interval, and would only consume 11,92 MB per month.

**Update** (2017-12-24): TP-Link have issued [firmware updates to address this issue](https://www.ctrl.blog/entry/ntplink-fixed/).

### But why‽

This behavior isn’t a bug from TP-Link’s perspective. They misuse DNS and NTP as a stand-in for an internet connectivity test feature. These types of tests are normally [implemented over HTTP](https://www.ctrl.blog/entry/network-connection-http-checks/) and only check against remote servers every 5–45 minutes.

The feature as TP-Link has implemented it’s overly aggressive, and they don’t even have the decency to direct the traffic at their own servers. Instead, they misuse public infrastructure provided by volunteers (like the NTP project pool servers), universities, and the U.S. government.

TP-Link repeaters don’t seem to modify their behavior based on whether there’s a working internet connection or not. (Except for providing a DHCP server when they fail to detect another DHCP server, but that’s irrelevant for this discussion.) I may be mistaken, but as far as I’ve been able to observe by studying the network traffic and behaviors of my TP-Link RE650 – it only controls the string “Internet Status: Connected”. Wasting 715,4 MB per month for a single string on a web administration interface that the customer is only likely to visit once a year is **outright stupid.**

### More details!

TP-Link has hardcoded the following non-configurable NTP servers and server pools in their firmware:

- time.nist.gov, time-a.nist.gov, time-b.nist.gov, time-nw.nist.gov
- au.pool.ntp.org, nz.pool.ntp.org
- 133.100.9.2, 128.138.140.44, 192.36.144.22

The first sets of servers are operated by the U.S. National Institute of Standards and Technology (NIST). The second is the Australian and New Zealand public NTP project time server pools. The IP addresses are owned by universities in Japan, Colorado; US, and Sweden respectively.

The NTP Pool project asks device manufacturers and vendors to register (and optionally sponsor) their own pools through the service (e.g. tplink.pool.ntp.org), and emphasize that they “must absolutely not use the default pool.ntp.org zone names”. They also request that vendors don’t check more often than every 5 minutes at the most. I find it interesting that TP-Link chose to use the Australia and New Zealand server pools in their firmware globally.

The six DNS requests add up to about 75 bytes each with a median response size of 125 bytes. An NTP request is another 90 bytes plus a 90 byte response. Multiply this by one request per 5 seconds throughout the day, and then finally add up the monthly figure and you’ll end up at 715,4 MB.

The number can be reduced by about 15 % if your router has a caching DNS server and you’re extremely lucky with request timings. The NTP pool addresses have very short caching lifespans, and they may even have expired before they reach your router.

### Mitigation

You can avoid buying TP-Link products to avoid this problem.

You can’t turn this behavior off in TP-Link’s web administration interface nor in their management app for mobile. You can’t change the NTP server addresses it targets either.

You can set up firewall rules rate-limiting your TP-Link product to one outgoing connection on UDP to port 123 (NTP) to limit the NTP traffic (which makes up for 93,31 MB out of the month total data usage.)

You can likewise rate limit connections to the three hardcoded IP addresses. If your TP-Link product is running in access point mode, you can also safely limit its DNS queries (UDP out to port 53). Please note that this will also prevent you from checking for firmware updates on the device, and you’ll have to rely on [TP-Link’s unreliable website](https://www.ctrl.blog/entry/tplink-firmware-outdated-downloads/) to find firmware updates instead.

Your home router may not have the features required to configure firewall rules that meet these requirements. It’s not uncommon for network routers aimed at the home market only to have configurable incoming and not outgoing firewalls.

You should also complain to TP-Link Support. This is a broken feature that generates a ton of unnecessary data and they should fix it. To save everyone a bit of time, you may refer them to this article. (Send them the one linked above while you’re at it!)

### Impact

715,4 MB isn’t trivial when you’re paying by the megabyte or you’ve a tight monthly data quota. This bug can run up a significant monthly cost for TP-Link customers who are on mobile, satellite, or other expensive internet connection options. Customers are also unlikely to be aware that it’s their TP-Link products that are secretly eating up their data quotas.

This is a small amount of data for a high-speed uncapped broadband consumer. However, let us wildly speculate that TP-Link has sold 100 million of these devices. That is 2385 PB (petabytes) or 2385 TB (terabytes) per day transmitted to public DNS and NTP infrastructure. It’s starting to resemble a small distributed denial of service (DDoS) botnet attack by this point.

[TP-Link sold 161 million devices in 2016](https://www.tp-link.com/my/press/news/17669/?ref=ctrl.blog), but it’s unspecified what type of devices were sold.

I hope TP-Link will update their firmware to address this issue soon! These devices don’t have automated firmware update checks, notifications, and even [TP-Links websites do a poor job with firmware updates](https://www.ctrl.blog/entry/tplink-firmware-outdated-downloads/). They should address this problem with a firmware update regardless of the distribution difficulties — which they themselves have also created.

#### Sources

- TP-Link firmware (latest version for each product as of 2017-11-23):  
  - RE450(AU)\_V2\_170626
  - RE500(EU)\_V1\_170420
  - RE650(EU)\_V1\_170524
  - TL-WA850RE(US)\_V4\_170109
  - TL-WA855RE(EU)\_V1\_160414
- [RE450 spams time.nist.gov and several other NTP servers constantly](https://web.archive.org/web/20171124151408/http://forum.tp-link.com/showthread.php?97245-RE450-spams-time.nist.gov-and-several-other-NTP-servers-constantly), 2017-11-05, davidsn, member, TP-Link Forums
- [TP-Link Sales Revenue Tops $2.1 billion in 2016](https://www.tp-link.com/my/press/news/17669/?ref=ctrl.blog), 2017-10-30, Press Release, TP-Link
- [The NTP Pool for vendors](https://www.ntppool.org/vendors.html?ref=ctrl.blog), Ask Bjørn Hansen, NTP Pool Project
- [ TL-WA855RE V1 Pinging Time servers non-stop](https://web.archive.org/web/20171124151412/http://forum.tp-link.com/showthread.php?100423-TL-WA855RE-V1-Pinging-Time-servers-non-stop), 2017-09-16, FranknBeans, member, TP-Link Forums
- [WiFi extender querying various time servers multiple times a second](https://www.reddit.com/r/HomeNetworking/comments/6nloa8/wifi%5Fextender%5Fquerying%5Fvarious%5Ftime%5Fservers/?ref=ctrl.blog), 2017-07, HomeNetworking, Reddit
- [TP-Link range extender topping the stats. Normal?](https://www.reddit.com/r/pihole/comments/570oyr/tplink%5Frange%5Fextender%5Ftopping%5Fthe%5Fstats%5Fnormal/?ref=ctrl.blog), 2016-10-11, Pi-Hole, Reddit
### Hover.com trouble, continued
URL: https://www.ctrl.blog/entry/hover-trouble-continued/
Last updated: 2026-08-23T22:09:09.000Z
You may remember the tale of my issues with the domain name registrar Hover back in September, and how [I regretted transferring all my domains to them](https://www.ctrl.blog/entry/review-hover-registrar-transfers/). Some 1600 words in I vowed to transfer my domain names to a better registrar at the end of the 60-day transfer lock-in period. Well, this is **part two** documenting the issues I’d transferring my domain names out of the service.

To recap [part one](https://www.ctrl.blog/entry/review-hover-registrar-transfers/): I transferred all my domain names to Hover at the recommendation of [podcast hosts](https://www.ctrl.blog/entry/programmatic-podcast-ads/). I felt uneasy about the entire purchase process which saw me transferring control of my domain names to Hover even before they’d my email address or knew who I was.

The transfer process also involved unavoidable downtime unless I **gave Hover my account passwords** for my old registrar etc. I then ran into various technical issues with their new customer dashboard, and was pretty dissatisfied with paying premium rates for what turned out to be a substandard service. Due to ICANN rules governing domain name transfers, I was locked-in with Hover for 60-days.

It has been more than two months since I transferred my domain names, meaning that I can now transfer them to another registrar! I wanted to get away from Hover and over to a more reliable service provider. I’ve held out hopes that Namecheap would add support for transferring in .blog top-level domains (TLD), but some twelve weeks later they still don’t support my TLD.

I’ve instead settled on [Gandi](https://www.gandi.net/en?ref=ctrl.blog) as my new registrar. They’re a French service provider who not only accept `.blog` TLDs, but also my `.no` domain names; something Hover didn’t support. They’re more expensive than most other service providers, but they appear to have an almost flawless reputation.

To transfer my domain names to a new registrar I would first need to remove the transfer locks held by Hover and disable domain privacy protections so that the new registrar can see my email address in the WHOIS records and initiate the transfer request This meant that I would need to login to and interact with the Hover accounts dashboard again.

By this time, I surmise that you’ve gathered that this didn’t go down to well. —and you’re entirely right. I logged in to my account on Hover, found my domain names, clicked on the little button to disable transfer protection, and then nothing happened. As I noted in part one, the Hover.com web interface assumes everything will always work flawlessly and they haven’t bothered to implement any kind of error handling or feedback in error situations.

I reloaded the page and tried again a few times, but still nothing. I opened up the developer tools in my web browser, and sure enough:

HTTP 422 Unprocessable Entity
{ "succeeded": false,
  "id": "domain-ctrl.blog",
  "errors": ["SSL_connect returned=1 errno=0 state=error: certificate verify failed"]
}

Hover’s backend responded to my actions with an error message, but the account dashboard gave no visual indicator that anything was wrong. This is the most frustrating thing about the whole experience. Any developer worth their pants should know that you must handle error messages or present them to the user if there’s no better option available for dealing with it. Giving me no feedback was just a frustrating experience.

There were no noticed anywhere on the account dashboard about service outages, so I reached out to their support staff via chat. A minute later and I was informed that they were aware of the issue and working on it. I ended the chat and explicitly chose **not** to receive a transcript of the chat by email. A minute later I received a chat transcript by email anyway ….

The [incident report page](https://hoverstatus.com/pages/incident/54ad824c22de98fe5e000028/5a14d40723cb68362100ec62?ref=ctrl.blog) published by Hover says the problem affected every customers ability to purchase or modify any domain names for five hours. Domain names is Hover’s only business so this outage was — albeit short — crippling to their business.

I’m not upset with Hover for having a random service outage. Unforeseen things happen all the time. I am, however, upset with them for not preparing better. The error message reported by their backend should have been brought to the user’s attention instead of just being ignored. There should have been a system in place to include a notice at the top of their website saying “Hey, we’re having trouble right now. Here is a 10 % off coupon. Please come back later!”

I waited half a day and tried again. This time I was able to get the domain transfer authentication codes from Hover and disable domain privacy. Within half an hour I’d transferred most of my domains to Gandi. Unlike Hover, Gandi even copied my existing nameserver (`NS`) records when they transferred the domains — leading to no downtime at all. I don’t have much to say about them yet, which is a already a huge improvement over Hover.

It has already been a couple of hours since the domains were transferred out of Hover. However, Hover still show all the domains I’ve transferred out as still being “active” with their service. Their only business is registering and managing domain names, and their systems don’t even realize when they’ve lost a few? I’m not impressed.

#### Sources

- [Unable to update, renew or transfer domains.](https://hoverstatus.com/pages/incident/54ad824c22de98fe5e000028/5a14d40723cb68362100ec62?ref=ctrl.blog), incident 5a14d40723cb68362100ec62, 2017-11-22, Hover Status, Hover
### TP-Link serves outdated firmware on ⅓ of its European websites
URL: https://www.ctrl.blog/entry/tplink-firmware-outdated-downloads/
Last updated: 2026-08-23T22:23:30.000Z
The Chinese network equipment manufacturer TP-Link has 60 country-specific websites around the world, out of which 24 are in Europe. While we’re still waiting for TP-Link to release firmware updates addressing last month’s [KRACK Attack](https://www.krackattacks.com/?ref=ctrl.blog) Wi-Fi vulnerabilities disclosures; I’d a look to see how up-to-date each of these 24 websites were in terms of available firmware releases. The results were discouraging to say the least.

Europe has a single “harmonized standard” for radio equipment including Wi-Fi enabled devices. Well, Switzerland and Turkey wasn’t fully on board until directive 2014/53/EU went into effect earlier this year — but in essence there should be no need for country specific firmware for Wi-Fi networking equipment within the EEA\-single-market.

TP-Link distributes a few different regional variants of their firmware, but the European market — with some exceptions that I’ll get back to later — gets the same EU variant of the firmware. This EU variant should meet European regulations and contains every language the device is capable of in one package. So, whether you’re downloading from the French or the Polish TP-Link website you’ll end up downloading the exact same file.

I bought a TP-Link RE650 repeater last month, and noticed that my local TP-Link website here in Norway was two firmware releases behind the neighboring countries of Denmark and Sweden. After some digging around, I found more discrepancies with which TP-Link product had which firmware version in which country. I decided to dig a bit further.

I looked into **nine TP-Link products** that are sold in Europe, and checked the firmware version for the product offered in each of TP-Link’s 26 European websites. The websites of some countries has multiple languages, but I found no difference between different languages within the same country. 

Eight of the products were randomly selected plus the RE650 that I own. The model is [the same as the cheaper RE500](https://www.ctrl.blog/entry/tplink-re650-vs-re500/), but rated for higher transfer speeds through firmware locks. These were the products I tested — spanning multiple product categories, performance and price ranges, and release years:

- AD7200 V2
- Archer C3200 V1
- AP500 V1
- RE305 V1
- RE650 V1
- TL-PA9020P V1
- TL-WA801ND V5
- TL-WA850RE V2
- TL-WR802N V4

That means that I checked a total of 216 support pages for their firmware version.

You can skip to the end and dig into the raw spreadsheet with my findings, or continue reading my analysis.

### The state of TP-Link firmware distribution in Europe

Only the Czech Republic, Finland, France, Italy, the Netherlands, and Romania have the latest firmware versions available for all products listed on their regional websites. In other words, there are problems on 75 % of TP-Link’s European websites.

If we extend that list to include countries with two or fewer missing firmware releases but no outdated firmwares, we can add Germany, Greece, and Poland to the list. That still leaves 62,5 % of the TP-Link websites in Europe with outdated or missing firmware releases.

Only three of the tested products had firmware releases available in every region, and only one of those had the most recent version available in all regions (two years since the first and only update.)

25 of the firmware listings, or 11,57 %, were outdated as compared to the most recent version of the EU specific firmware release that’s distributed within Europe. Firmware releases were unavailable for 39 (18,06 %) products.

These numbers stack on top of each other, creating a 29,63 % chance that you’re either getting outdated or no firmware at all by visiting your local TP-Link website.

On some product pages in some countries (it seems entirely random which ones), there’s a big red warning informing you that you shouldn’t install TP-Link firmware from any regional website except the one where you bought the product.

However, within the EU I only found three products (33 % of products tested) that had anything but the unified EU-market variant and all of those were releases specific for the United Kingdom. Two of the UK specific firmware releases were as much as **6 months to a year out of date** compared to the EU firmware.

Notably, two of the UK specific firmware releases were for products that stick directly into power sockets. The UK’s power socket isn’t compatible with the power sockets most common in the rest of Europe.

I find it a bit weird that TP-Link added a big red warning for a problem affecting only 1,39 % (or 33 % within the United Kingdom) of their European regional websites given the more serious problem of outdated firmware.

I’ll not say they are wrong to discourage users from installing firmware blobs from other markets, but the problem here’s that TP-Link doesn’t serve the European market well. Users may be better off by not heeding their warning.

There are fewer firmware updates available in Switzerland than any other country; until recently they were not on-board with the unified European standard. All the updates that are available in Switzerland use the standard EU-variant of the TP-Link firmware.

However, Austria, Belgium, and the Baltic countries also have fewer firmware releases than other countries, although I did confirm with a few web searches that most of the tested products were available for sale in at least two online stores operating in each country.

This all sounds pretty bad. The most recent European firmware versions can be as much as **a year out of date compared to the US-specific firmware** variant. Notably, the changelogs for the newer US-firmware include changes that don’t appear to be region specific in any way.

### No auto-update

TP-Link has no auto-update in place for any of their products, *as far as I can tell.* I could only confirm this with my own RE650\. Though, I also looked into other TP-Link products through the web interface emulators that TP-Link offers on its website and saw no evidence of automated firmware updates being an option.

You can login to the web interface of your router and manually check for and apply updates.

I reached out to TP-Link to inquire about how customers can keep themselves up to date on firmware updates. They offer no emailing lists, syndication feeds, or other notifications when your product is updated. A support technician who shall remain nameless stated that it’s “**not suggest you update the firmware if the device is working fine.**”

The same technician also offered to personally email me if there was a new firmware update available. However, the firmware version offered in my country was already two releases behind when this email exchange took place. These emails were exchanged only a week before the KRACK Attack vulnerabilities were disclosed publicly.

Separately, I emailed TP-Link about methods for receiving security advisories. TP-Link publishes them on [a dedicated support page](https://web.archive.org/web/20180521112113/https://www.tp-link.com/us/security), but there’s no email list, syndication feed, or other method to be notified of new disclosure. TP-Link hasn’t responded to this email in well over a month. Again, this message was sent a week before the KRACK Attack disclosure.

Not only is TP-Link’s firmware distribution in Europe very unreliable and convoluted; but the customer is entirely responsible for periodically checking for and applying new firmware themselves. I doubt many TP-Link customers care enough to check and update their firmware on a regular basis.

### Conclusions

TP-Link’s firmware distribution seems to be a bit of a mess, to be honest, and the mess appears to be entirely of TP-Link’s own making.

The lack of auto-update combined with unreliable information on TP-Link’s website depending on what country you’re makes it difficult for customers to keep their firmware up to date.

We’re a month in to the KRACK Attack vulnerability disclosure, and TP-Link hasn’t yet released updates for any of their products. Not that it’s likely that TP-Link would manage to release new updates to every customer’s regional website, nor would their customers would have any way of knowing about any updates.

I briefly looked into the firmware distribution of ASUS, Linksys, Netgear, and other competitors — and they all have a single global firmware download, or two–three regional variants at the most all being offered on the same download page.

I even looked specifically at other products built with the same networking chipsets as TP-Link products uses: they still only have one–two different firmware variants being distributed globally.

Stay well away from TP-Link products if you’re any bit conscious about the security of your devices.

#### Sources

- [TP-Link firmware availability in Europe](https://cdn.synaps.media/control/content/files/2026/08/2017-11-18%5Ftplink-european-firmware.ods?ref=ctrl.blog) (OpenDocument spreadsheet), 2017-11-08, sourced from European TP-Link websites, Daniel Aleksandersen
- [WPA2 Security (KRACKs) Vulnerability Statement](https://web.archive.org/web/20171104125745/http://www.tp-link.com/us/faq-1970.html), 2017-10-19, Security Advisory, TP-Link
- [Wi-Fi / WLAN Channels, Frequencies, Bands & Bandwidths](https://web.archive.org/web/20171117005143/http://www.radio-electronics.com/info/wireless/wi-fi/80211-channels-number-frequencies-bandwidth.php), 2017, Ian Poole, Wireless Connectivity, Radio-Electronics.com
- Emails with various TP-Link support staff

TP-Link product packaging photos courtesy of the TP-Link website.
### Difference between TP-Link RE650 and RE500? Firmware limits.
URL: https://www.ctrl.blog/entry/tplink-re650-vs-re500/
Last updated: 2026-08-23T22:23:31.000Z
TP-Link’s two Wi-Fi access points/repeater models AC1900 RE500 and the AC2600 RE-650 look identical on the outside, and their FCC filings reveal that **they’re also identical** on the inside. The two products are limited to different theoretical maximum speeds only because the cheaper model is locked to at lower speeds.

At the time of publishing, the RE500 costs 109 USD and the RE650 costs 149 USD on Amazon. However, you’re getting the same physical product no matter which model you decide to purchase. Despite being the same product sold under different names, the two models are sold with different performance specifications:

| Model | MU-MIMO | 802.11ac Type |
| ----- | ------- | ------------- |
| RE500 | 3×3     | AC1900        |
| RE650 | 4×4     | AC2600        |

The availability of the different models varies by market.

Despite the two models’ different performance characteristics, the hardware is entirely the same according to FCC test report filings. Meaning that the lower performance on the cheaper model is controlled entirely by software locks in the device’s firmware. Specifically, the RE500 is limited to using 3×3 streams Multi-User Multiple-Input and Multiple-Output (MU-MIMO) compared to the 4×4 streams the hardware is capable of.

This artificial performance cap in one of the two models based on the same identical hardware is just yet another thing that reinforces [why it’s important with open Wi-Fi firmware](https://blog.tohojo.dk/2016/02/why-is-access-to-wifi-firmware-important.html?ref=ctrl.blog). The device could be faster at the same reduced price, but TP-Link decided to cripple one version of the product to ensure they could charge extra for the fastest performing model. Notably, TP-Link was one of the first Wi-Fi equipment manufacturers that began locking down their firmware in 2016 to prevent the installation of custom after-market firmware.

I don’t know the technical measures TP-Link uses to limit the RE500 to slower speeds. It could be that you can just install the RE650 firmware on the RE500\. I’m unable to test this and can’t confirm whether this is the case. TP-Link could be signing or verifying their firmware by serial numbers or other markers that would block the RE650 firmware from being installed on the RE500\. If anyone can test this, please get in touch!

**Update** (2017-01-27): I’ve now heard from three readers who’ve tried to install the firmware from the RE650 on the RE500\. The installation will fail with a message saying the update failed a checksum test.

In conclusion: if you’re considering getting either of these models then you shouldn’t buy the RE500\. Instead, wait for the RE650 to either drop in price or go on sale at a comparable price to the RE500\. TP-Link themselves have confirmed that the price of the RE500 is closer to what you should be paying for a device with the performance characteristics of the RE650\. You shouldn’t pay any extra to get the exact same hardware without the artificially imposed performance restriction.

#### Sources

- [FCC Test Report no. FR6N0412AA](https://fccid.io/TE7RE650/Test-Report/Test-Report-DTS-3262270.pdf?ref=ctrl.blog),2017-01-13, Sporton International Inc.
- [Way to Go, FCC. Now Manufacturers Are Locking Down Routers](https://www.wired.com/2016/03/way-go-fcc-now-manufacturers-locking-routers/?ref=ctrl.blog), 2016-03-23, Kyle Wiens, Wired
- [Why is access to Wi-Fi firmware important?](https://blog.tohojo.dk/2016/02/why-is-access-to-wifi-firmware-important.html?ref=ctrl.blog), 2016-02-17, Joke Høiland-Jørgensen
- [AC2600 Wi-Fi Range Extender (RE650)](https://web.archive.org/web/20171117020253/http://www.tp-link.com/us/products/details/cat-5508%5FRE650.html#specifications), TP-Link
- [AC1900 Wi-Fi Range Extender (RE500)](https://web.archive.org/web/20171117020257/http://www.tp-link.com/us/products/details/cat-5508%5FRE500.html#specifications), TP-Link

TP-Link product packaging photos courtesy of the TP-Link website.
### How to debug a WebExtension back­ground script on Firefox for Android
URL: https://www.ctrl.blog/entry/debug-firefox-webextension-android/
Last updated: 2026-08-23T22:04:42.000Z
*The* differentiating feature for [Firefox for Android](https://play.google.com/store/apps/details?id=org.mozilla.firefox&ref=ctrl.blog) is its support for browser extensions. As an extension developer however, you haven’t got the best tools or documentation available when developing for Firefox for Android. Here is how you can connect Firefox developer tools on a computer to a WebExtension background script running on Android.

Firefox for computers can debug extension pop-out windows and background scripts from the internal `about:debugging` page. This page let extension developers enable extension development tools and connect Firefox developer tools to an extension background script.

Although the convenient `about:debugging` page isn’t available on Firefox for Android, you can still debug extension background scripts. I’ll now walk you through the steps of connecting your phone to the WebIDE in Firefox, and then connecting it up to an extension running on Firefox for Android.

This tutorial comes with a pretty heavy list of prerequisites:

- A computer with a USB port, and a USB cable to your phone.
- Installed an up-to-date copy of Firefox for Android on your phone, and Firefox on your computer.
- Installed the [Android Developer Bridge](https://developer.android.com/studio/command-line/adb?ref=ctrl.blog) (`adb`) on your computer. On Linux this can be installed from the android-tools package. Windows and MacOS can download it as part of the [Android platform tools](https://developer.android.com/studio/releases/platform-tools?ref=ctrl.blog).
- Enabled [Developer mode and debugging over USB](https://developer.android.com/studio/debug/dev-options?ref=ctrl.blog#enable) on your phone.
- Disabled automatic-screen dimming and locking on your phone. The connection to Firefox may be lost when the screen locks — so save yourself some trouble and either disabling or extending the display sleep/lock timeout interval.
- Already installed the plugin you wish to debug on Firefox for Android.

Given you’ve met all the above requirements, you can proceed with this tutorial.

The first step is to connect Firefox for Android to Firefox running on your computer over the Android Debug Bridge. Assuming you’ve already setup ADB, this process should be fairly straight forward.

1. Open Firefox for Android, and go to Settings: Advanced: Developer tools, and enable the Remote debugging via USB option.
2. Open Firefox on your computer, click the Firefox menu, and choose Web developer: WebIDE.
3. On the right side of the window, it may say “Install ADB Helper” under the headline USB devices (see 4 on the below illustration). Click this and install the helper if needed. **Restart Firefox** if you needed to install the helper.

You should see your device listed under the USB devices list or a helpful prompt asking if you don’t see your device. Click this if you need to troubleshoot your device connection. Though, I’d recommend you run the command adb devices in a terminal and verify that works first. You may need to change your device from charging to data transfer mode before ADB will work.

1. Select your device from the USB device list inside WebIDE. You’ll be prompted on your device to allow an incoming debugging connection.

![WebExtension development for Android in Firefox WebIDE](https://cdn.synaps.media/control/content/images/2026/08/firefox-debug-android-extensions-webide.png)

Connecting to a WebExtension background script in Firefox WebIDE.

You’ll see the WebIDE window get populated with your tabs from Firefox for Android. You can use debug tabs for web development purposes from this interface. However, this is the point where Mozilla’s official documentation leaves you wondering what to do next regarding connecting to extension scripts. They’re not shown along with the tabs nor anywhere else obvious.

The official documentation assumes you’re familiar with the internal workings of WebExtensions on Firefox for Android, even though available documentation is sparse. I’ll not leave you hanging and show you the last few steps to debug an extension background script:

1. On the left side of the window, click Main process under the Runtime apps list. This can be slow, so wait a little while before proceeding.
2. On the right side of the window, click the Frame selector button (see 6 on the above illustration).
3. Select the frame matching your extension’s identification string, and background script or pop-out window file name from the list of frames.

You should now have connected Firefox developer tools on your computer to the extension background script running on Android. You can use the WebIDE window as you normally would use the stand-alone developer tools window and interact with the console, storage, debugger, network activity, profiler, and all the other development tools you’re familiar with from developing WebExtension on Firefox for computers.

Good luck with your mobile WebExtension development efforts!

P.S.: The developer document “[Differences between desktop and Android extensions](https://extensionworkshop.com/documentation/develop/differences-between-desktop-and-android-extensions/?ref=ctrl.blog)” is incredibly useful when porting an extension to Firefox for Android!

#### Sources

- [Configure On-Device Developer Options](https://developer.android.com/studio/debug/dev-options?ref=ctrl.blog), 2017-10-25, Android Studio, Android Developer portal, Open Handset Alliance
- [Debugging browser extensions](https://web.archive.org/web/20200123033240/https://wiki.developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/Debugging$revision/1319200), 2017-10-17, revision 1319200, Firefox Developer Tools, Mozilla Developer Network, Mozilla Foundation
- [Debugging Firefox for Android over USB](https://web.archive.org/web/20200123033240/https://wiki.developer.mozilla.org/en-US/docs/Tools/Remote%5FDebugging/Debugging%5FFirefox%5Ffor%5FAndroid%5Fwith%5FWebIDE$revision/1315157), 2017-10-06, revision 1315157, Firefox Developer Tools, Mozilla Developer Network, Mozilla Foundation
### Firefox 57 with a new and more distracting New Tab experience
URL: https://www.ctrl.blog/entry/firefox-new-tab-distractions/
Last updated: 2026-08-23T22:06:53.000Z
Firefox 57, out this week, is a major leap forward for web performance and for Firefox as a platform. This release sees a new visual style for the user interface, and new features and innovations. However, all of Firefox’s new-found beauty and performance is for nigh when Mozilla now uses their browser to grab a piece of your attention.

I’ve followed along as all the major web browsers have [added news content on their New Tab pages](https://www.ctrl.blog/entry/newtab-news/). With the exception of Sleipnir, who source news directly in the browser by [looking for syndication feeds in your top-visited websites](https://www.ctrl.blog/entry/sleipnir-site-updates/), the browser vendors have all filled their New Tab pages with featured/recommended content from their own recommendation services.

Now it’s Firefox’s turn to display “recommended” news articles and essays on the New Tab page. Firefox sources their content from Pocket, a reading-list and article skimming service, that was acquired by Mozilla in February 2017. Firefox’s recommendations would seemingly be derived from what is popular on Pocket in the user’s local market.

![New Tab page in Firefox 57](https://cdn.synaps.media/control/content/images/2026/08/firefox57-newtab-page.jpeg)

There are a lot of content and distractions on Firefox’s new New Tab page.

### More distractions

Earlier versions of Firefox displayed a grid of icons of your top most visited websites on the New Tab. Seeing icons for Facebook, Twitter, YouTube, and other time-sinkholes was already quite distracting. It’s so easy to spot the icon and think to yourself “I’ll just quickly check Facebook one more time …” and discover that another 15 minutes of your day has past.

The act of **opening a new tab is already a distraction** that moves focus away from what you’re doing. Pretty icons and other distractions that thug at your attention can be a real productivity killer when the reason that you opened a new tab was already a distraction in itself.

The additions of reading recommendations; displayed as news headlines, article snippets, and large images isn’t good news for our attention spans. It adds more and even larger surface areas that pull our attention away from what we’re supposed to be doing and introduces new opportunities to shutter our ability to focus.

Firefox 57 have also added a new “highlights” section to the New Tab. Highlights feature recently bookmarked pages and a random selection of pages from your recent browsing history. I’m not entirely clear on the use case for this feature, but it’s there just in case you want to read the same article again.

### Attention is *the* online currency

I’ve previously written about the Brave browser who wanted their users to [pay online publishers in Bitcoin](https://www.ctrl.blog/entry/brave-payments/) based on how long they spent on any given website. Brave have since moved their attention-as-a-currency platform to their own [Basic Attention Token](https://basicattentiontoken.org/?ref=ctrl.blog) (BAT) crypto-currency. BAT is an explicit acknowledgement of the attention economy.

It shouldn’t come as a surprise to anyone that news organizations may be willing to pay to appear in such prominent positions in people’s web browsers. Advertisers pay for people’s attention, and advertisement pays for the web, and publishers sometimes also make partnerships to increase the number of people/amount of attention they can sell to advertisers. Microsoft already has partnerships with news organizations for their Edge browser through their MSN and Bing News services. Microsoft Edge shows news recommendations mixed in with ads for other Microsoft products and services powered by Bing.

Pocket monetizes the content it takes from publishers by sells premium accounts with a few extra features to users. As the service’s recommendations is now prominently baked in to a page that Firefox users will see several times a day, I expect any online content marketer worth their salt with sign-up for Pocket in search of ways to impact Firefox’s recommendations. I’ve got no idea about Mozilla’s plans in this area, but I’d not be surprised if they soon land publishing partnerships with large publishers.

**Update** (2018-01-29): As expected, Mozilla has now [announced plans](https://blog.mozilla.org/futurereleases/2018/01/24/update-on-pocket-and-firefox-integration/?ref=ctrl.blog) to show ads among the recommendations.

### Go with a blank page

I recommend that you configure your web browsers to hide all distractions when you open a new tab. Firefox 57 makes this easy: click the gray gear icon in the top right corner and **disable the five different types of distractions** they’ve for the New Tab page. The web is already full of distractions and no one needs their browsers to throw new distractions in their path every time they open as new tab.

#### Sources

- [Update on Pocket and Firefox Integration](https://blog.mozilla.org/futurereleases/2018/01/24/update-on-pocket-and-firefox-integration/?ref=ctrl.blog), 2018-01-24, Future Releases blog, Mozilla
- [The whole web at maximum FPS: How WebRender gets rid of jank](https://hacks.mozilla.org/2017/10/the-whole-web-at-maximum-fps-how-webrender-gets-rid-of-jank/?ref=ctrl.blog), 2017-10-10, Lin Clark, Mozilla Hacks developer blog, Mozilla
- [Taking Pocket Further with Mozilla](https://blog.getpocket.com/2017/02/taking-pocket-further-with-mozilla/?ref=ctrl.blog), 2017-02-26, Nathan Weiner, Pocket blog, Pocket
- [FAQ](https://web.archive.org/web/20171010024605/https://www.basicattentiontoken.org/faq/), Basic Attention Token, Brave Software
### First impressions of KeyChest – A TLS certificate expiration tracker
URL: https://www.ctrl.blog/entry/review-keychest/
Last updated: 2026-08-23T22:18:54.000Z
On today’s web; admins have to keep track of dozens or more certificates for their various domains and servers. Manually keeping an eye on one or two website certificates and making sure they haven’t expired is tedious work and prone to human error. You’ll eventually realize that you need an automated tool, and [KeyChest](https://keychest.net/?ref=ctrl.blog) is hoping to be it.

I [reviewed SSLPing](https://www.ctrl.blog/entry/review-sslping/), a free website certificate health monitoring service, earlier this year. After reading this, Dan Cvrcek, CEO of Enigma Bridge, reached out to me to let me know about their new free service called [KeyChest](https://keychest.net/?ref=ctrl.blog).

During an average week I surely run into at least a dozen websites that throw up certificate errors because their domains have expired. It’s a real problem that has become more common with the explosive adoption growth of HTTPS in recent years. Keeping track of certificate expiration is a important tasks that some websites fail to live up to.

KeyChest isn’t a certificate health monitoring tool like SSLPing *yet*. KeyChest only keeps track of your certificate expiration and TLS connectivity issues (like an uptime monitor.) Unfortunately, it doesn’t notify the user when something goes wrong. You’ve to login and check the status of your websites on the KeyChest dashboard. I expect that this feature will be added soon, but it seems like a critical omission.

Dan Cvrcek let me know that their long-term plan is to integrate with and source best-practices and certificate health information from the well respected [SSLLabs](https://www.ssllabs.com/?ref=ctrl.blog).

![KeyChest dashboard overview](https://cdn.synaps.media/control/content/images/2026/08/keychest-dashboard.png)

KeyChest dashboard overview.

The design and information flow in the KeyChest dashboard focus on things that work, with broken servers and certificates shun to the far right hand side of the page. The list of broken servers and certificates is included in the middle of the page (which requires a fair amount of scrolling.) Any broken certificates and servers are the most important bits of information and should be at the top of the page instead of hidden far down on the page.

The reports you get are frustratingly vague and don’t the information you’d need to assist you in troubleshooting a problem. E.g. in the below screenshot, the IPv6 address of a domain didn’t respond.

However, without knowing what the problem is or even which IP address is causing the problem; you could end up wasting a lot of time that would have been solved by having just a little more information from KeyChest.

![KeyChest user interface listing a “TLS checks failed for 1 of 2 IP addresses”](https://cdn.synaps.media/control/content/images/2026/08/keychest-failed-tls-checks.png)

*Something* is wrong with one of two IP addresses. But which?

There are some great things about KeyChest, though. Unlike SSLPing, they support IPv6 for starters. KeyChest also scans every A and AAAA record for a given domain for issues, instead of only one record like SSLPing. This one feature alone makes KeyChest a better option than SSLPing.

They also auto-discver subdomains and certificates by looking up a domain’s Certificate Transparency report. You only need to provide your top level domain, and they’ll find all certificates issues for your domain.

This can be useful for monitoring which certificates exist within on a large organization where such things can be hard to keep track of. It can also saves you a lot of time keeping track of which certificates and servers need monitoring.

There are a ton of bugs and KeyChest is definitively not a done product yet. The “Remember me” checkbox on the login page that does exactly nothing (cookies still expire at the end of the session), the link to the settings page simply saying “More to come …” when there’s a perfectly functional settings page if you dig around a little. Confusingly, if you collapse the sidebar on the left of the screen, the name changes from “KeyChest” to “KA” (??). There are small things like this everywhere you look.

### Conclusions

It’s buggy but it’s showing promise. I can see potential for KeyChest, but I don’t see much value in the service at this time. They offer the service for free for up to 1000 domains/3000 servers.

The poor incident reports and the lack of email notifications when trouble is detected seriously diminishes the value of the service.

KeyChest needs to get the certificate health checks in place, and they need much more detailed reports when something goes wrong. There’s some value in being told there’s a problem with one domain, but when you don’t know what the problem is you risk wasting a lot of time chasing down something that could have been trivial to fix if you knew what the problem was.

I can’t recommend KeyChest at this time, but if you need a service like KeyChest — then you should bookmark it and revisit it in a couple of months.

#### Sources

- Email exchange with Dan Cvrcek, CEO of Enigma Bridge

Some screenshots have been manipulated to remove private data and to make them more compact.

**Reviewed:** [KeyChest](https://keychest.net/?ref=ctrl.blog)

**Review rating:** 4 / 10
### Why ‘IPv6 Control Message’ uses so much data in Windows 10
URL: https://www.ctrl.blog/entry/win10-icmp6-usage/
Last updated: 2026-08-23T22:24:32.000Z
The Data usage report in Windows Settings keeps track of how much network bandwidth your Windows 10 device has used in the last 30-day period. You may see an entry labeled ‘IPv6 Control Message’ near the bottom of the list which uses a small amount of data. However, this entry can consume hundreds of megabytes of data under certain conditions. In this article, I’ll look into why this process may end up consuming so much data.

IPv6 is the next-generation internet protocol. Unlike the previous version, IPv4, IPv6 networks are designed to be self-configuring. As a device is connected to a network, it will broadcast a request to any router on the network to identify itself and send the device configuration instructions so that it may configure itself. Routers will also periodically announce themselves so that every device on the network is notified of any changes to the local network or how to reach the global internet.

These messages used to auto-configure network configuration is counted in the Data usage report in Windows 10 as *IPv6 Control Messages* (ICMPv6.) There are a few other diagnostic and maintenance messages that go into this category, but they’ve mostly used by network administrators in short time periods for troubleshooting purposes.

Windows 10 doesn’t differentiate between traffic sent only on the local network and what goes out to the public internet. Your internet service provider only counts/charges for traffic that leaves your local network. ICMPv6 network traffic is only sent to the nearest router. On most residential and office networks, you’ll most likely be connected to the internet behind a gateway router. On a mobile network, your nearest router would be on your ISPs local network. If your device is connected directly to the internet or it’s using a mobile data connectivity, ICMPv6 packages will be counted towards your data cap.

Normally, these network control messages will use less than a megabyte in a month for a computer that’s on a fixed and stable network connection. It can use a little more for mobile devices that move between networks or use less reliable wireless connections. On a network with hundreds of wireless devices or laptops, ICMPv6 may be logged as having used a couple of megabytes in a month. If your network has hundreds of devices on it, you can ask the network administrator to split the network into several smaller subnets with smaller subnet masks to mitigate the problem.

### Troubleshooting high ICMPv6 data usage

Troubleshooting high ICMPv6 utilization is most critical for battery powered devices connected over Wi-Fi. Devices can never power down their wireless antennas and enter power savings mode if these they’re constantly receiving broadcast messages on the local network in the form of ICMPv6 message. This could help explain unexpected battery drainage on your smartphone when it’s connected to your home or office Wi-Fi network.

If you’re seeing high data usage from IPv6 Control Messages in Windows 10, then there’s something wrong with your network equipment. It could be a problem with your device’s Ethernet card or its Wi-Fi module. If your computer suffers intermittent network outages or otherwise keeps dropping off and on the network, this would explain unusually high uses of ICMPv6 from your device.

More frustratingly, it can also be caused by another computer, or another network connected device, your router or other network equipment, or even faulty network wires. ICMPv6 use broadcast messages for most things, meaning that most of the time — every device connected to the same local network will receive ICMPv6 messages to and from every other device on the network. This is an intentional design that makes devices on the same network aware of each other, which is a desirable attribute of a well configured network most of the time.

To identify which device(s) is causing the issue, you need to inspect the broadcast packet traffic in your network. You can use [WireShark](https://www.wireshark.org/?ref=ctrl.blog) to do capture the network traffic. WireShark is a complex software and its use is out of scope for this article. If you’ve got a Linux or MacOS computer handy, you can issue the below command to have the [tcpdump](https://www.tcpdump.org/?ref=ctrl.blog) utility output every ICMPv6 package it sees on the network as they fly by.

```shell
tcpdump -nvvl icmp6
```

In the output from this command (or WireShark), you can look for repeating MAC/hardware addresses in ICMPv6 messages. The MAC address will be shown in a hexadecimal format represented like this: FF:FF:FF:FF:FF:FF. These addresses corresponding to a device on your network, and you may find it printed underneath your devices. If you can’t find the MAC address printed on the actual device, refer to the device’s or its operating system’s manual for details on how to find its MAC address.

This isn’t a quick task and does require some familiarity with network troubleshooting. However, once you’ve identified which issue is causing the problem, you can being to troubleshoot its connectivity issues or alternatively remove it from the network.

#### Sources

- [Manpage of TCPDUMP](https://www.tcpdump.org/manpages/tcpdump.1.html?ref=ctrl.blog), 2017-02-02, TCPDUMP project
- [RFC 7772 Reducing Energy Consumption of Router Advertisements](https://www.rfc-editor.org/rfc/rfc7772.html?ref=ctrl.blog), 2016-02, Internet Engineering Task Force
- [RFC 4861 Neighbor Discovery for IP version 6](https://www.rfc-editor.org/rfc/rfc4861.html?ref=ctrl.blog), 2007-09, Network Working Group, Internet Engineering Task Force
### Tutorial: WordPress brute-force login protection with SSHGuard
URL: https://www.ctrl.blog/entry/how-to-wordpress-sshguard/
Last updated: 2026-08-23T22:11:22.000Z
[*SSHGuard 2.1* was just released](https://www.ctrl.blog/entry/sshguard2p1/), and in this release SSHGuard gained the ability to detect and block brute-force login attempts against WordPress. Here is how you get started with using SSHGuard to protect WordPress.

Some prerequisites before you begin on this quick tutorial:

- You should already have installed and configured SSHGuard ([Fedora Linux instructions](https://www.ctrl.blog/entry/how-to-sshguard-firewalld/); [generic instructions](https://bitbucket.org/sshguard/sshguard/src/master/INSTALL.rst?ref=ctrl.blog)). Check for SSHGuard version 2.1 or newer in your package repository, or install it from source if it’s not available in your main package repository.
- Your web server must be storing its access logs in NCSA Common Log Format (CLF). Most web servers either do this by default (like Apache Web Server and Nginx), or can be configured to output to this format. Extended formats with extra data fields at the end are also supported.
- Your server logs must contain the *real remote IP address* for it to be effective. Make sure you don’t accidentally log the IP address of your upstream caching proxy or a CDN in lieu of the actual remote address.
- Please note that using log buffering, such as the `BufferedLogs` option in Apache, will delay logs and thus reduce SSHGuard’s responsiveness.

All you need to do after having configured SSHGuard is to feed it your server logs. Here you’ve a few different options.

### Selective logging of WordPress attacks

Depending on the traffic load of your web server, you may not want to keep an all-inclusive access log as this may negatively affect performance of your web server and SSHGuard. Instead you can configure selective logging of any relevant requests in a separate log file.

The following configuration snippet demonstrate how you setup logging of request to `wp-login.php` only with the `CustomLog` directive in Apache HTTP Server:

```
SetEnvIf Request_URI "/wp-login\.php"$ wordpresslogins
CustomLog "/var/log/httpd/wordpress-logins.log" common env=wordpresslogins
```

The next configuration snippet shows the same for Nginx:

```
location "/wp-login\.php" {
  access_log "/var/log/httpd/wordpress-logins.log";
}
```

You can then feed the log file `/var/log/httpd/wordpress-logins.log` to SSHGuard using the FILES configuration option. At this point **you’re finished.** You’ll still want to read the section about XML-RPC below.

### Remember to disable XML-RPC

SSHGuard doesn’t support blocking brute-force attacks against the XML-RPC service in WordPress. Such attacks can be massively amplified with hundred of login attempts per single server request without leaving any distinct signature in your server logs.

Unless you use the Jetpack plugin or one of WordPress’ mobile apps, you should disable the XML-RPC service altogether. The XML-RPC service leaves your website vulnerable to many types of attacks. It’s important to the wider WordPress ecosystem with apps and add-on services, but it’s not essential to WordPress itself. The best option is just to disable it altogether when possible.

You can disable XML-RPC by blocking all remote access to `/xmlrpc.php` in your web server configuration.

#### Sources

- [Apache Module mod\_log\_config](https://httpd.apache.org/docs/2.4/mod/mod%5Flog%5Fconfig.html?ref=ctrl.blog), 2017, HTTP Server documentation, Apache
- [Module ngx\_http\_log\_module](https://nginx.org/en/docs/http/ngx%5Fhttp%5Flog%5Fmodule.html?ref=ctrl.blog), Nginx documentation, Nginx
- [Apache Module mod\_journald](https://httpd.apache.org/docs/trunk/mod/mod%5Fjournald.html?ref=ctrl.blog), 201, HTTP Server documentation, Apache
- [Brute Force Amplification Attacks Against WordPress XMLRPC](https://blog.sucuri.net/2015/10/brute-force-amplification-attacks-against-wordpress-xmlrpc.html?ref=ctrl.blog), 2015-10-08, Daniel Cid, Sucuri Blog, Sucuri
- Myself, through my role as an SSHGuard project contributor
### What’s new in SSHGuard 2.1
URL: https://www.ctrl.blog/entry/sshguard2p1/
Last updated: 2026-08-23T22:22:25.000Z
[SSHGuard](https://www.sshguard.net/?ref=ctrl.blog) is an intrusion prevention utility that parses logs and automatically blocks misbehaving IP addresses (or their subnets) with the system firewall. SSHGuard version 2.1 was just released with new blocking services, the ability to block a configurable-sized subnet, and better log reading capabilities.

**SSHGuard 2.1** was just released, only 236 days after the last major release with [SSHGuard 2.0](https://www.ctrl.blog/entry/sshguard2/). In addition to updated attack signatures, here’s a quick overview of the new features that have been included with the latest release:

### New feature: Block attacker’s subnet

Administrators can now configure the size of an IPv4 and IPv6 subnet that should be blocked in response to an attack originating from that subnet. By default, SSHGuard will block a /128 subnet for IPv6 addresses and /32 for IPv4 (meaning, just a single address.)

SSHGuard doesn’t *yet* support detecting attacks originating from within the same subnet.

### New service: Remote SSHGuard

SSHGuard can now parse and act on its own logged attack- and block responses. Meaning you can feed it a remote SSHGuard log with a remote log feed service (like systemd remote journal), and share attack data and blocklists between multiple systems. Please try to avoid feeding it the local log to avoid recursive blocking.

### New service: Cockpit administration dashboard

SSHGuard can now detect and thwart brute-force login attacks against the [Cockpit web administration dashboard](https://cockpit-project.org/?ref=ctrl.blog) for Linux systems.

### New service: HTTP server probing

SSHGuard can now process the NCSA Common Log Format (CLF) and can detect and thwart probing for popular web services like WordPress, Horde, RoundCube, and phpMyAdmin. Supports all web servers with CLF logging capabilities (extended formats also supported.)

### New service: WordPress

A new WordPress service lets SSHGuard detect and thwart brute-force login attacks against WordPress.

Note that only login attempts against wp-login.php is supported, as attacks against `xmlrpc.php` (XML RPC) doesn’t leave behind a discernible attack signature in the server log signature. XML RPC should be disabled in any case as it allows over a hundred password guess per server request. (Yikes!) Web server logs must be in NCSA CLF. Check out the [accompanying tutorial](https://www.ctrl.blog/entry/how-to-wordpress-sshguard/) for instructions on how to set this up.

### New firewall backend: nftable

The new `sshg-fw-nft-sets` backend works with nftables. It creates a priority -10 table called sshguard, adds attackers, and will by default set up rules to drop future connections from recognized attackers. Like all firewall backends, the new backend is a easily-customized script that you can replace with your custom firewall backend script.

### Changed: Simultaneously read logs from files and a logreader

All these new features depend on having the relevant service logs fed into SSHGuard. It’s now easier than ever to pipe logs to SSHGuard. SSHGuard can now be configured to read logs from a LOGREADER command (like `tail -f` or `journalctl`) and from a list of FILES at the same time. Earlier versions would not read logs from FILES when a LOGREADER was configured. This provides greater flexibility for systems and services not yet on-board with unified logging systems like the systemd journal on Linux or os\_log on MacOS.

You can get the latest release of SSHGuard from [Sourceforge](https://sourceforge.net/projects/sshguard/files/sshguard/?ref=ctrl.blog), learn more on the [SSHGuard website](https://www.sshguard.net/?ref=ctrl.blog), or grab [the source from BitBucket](https://bitbucket.org/sshguard/sshguard/?ref=ctrl.blog). You can find [generic installation instructions](https://bitbucket.org/sshguard/sshguard/src/master/INSTALL.rst?ref=ctrl.blog) and I’ve provided more specific [install and setup instructions for Fedora Linux users](https://www.ctrl.blog/entry/how-to-sshguard-firewalld/).

#### Sources

- [v2.1.0 commit messages](https://bitbucket.org/sshguard/sshguard/commits/tag/v2.1.0?ref=ctrl.blog), 2017-10-30, SSHGuard source repository, BitBucket
- [Brute Force Amplification Attacks Against WordPress XMLRPC](https://blog.sucuri.net/2015/10/brute-force-amplification-attacks-against-wordpress-xmlrpc.html?ref=ctrl.blog), 2015-10-08, Daniel Cid, Sucuri Blog, Sucuri
- Myself, through my role as a project contributor
### Contribute to creators all over the web with the new Flattr
URL: https://www.ctrl.blog/entry/flattr2/
Last updated: 2026-08-23T22:07:23.000Z
Earlier this week, [Flattr](https://flattr.com/?ref=ctrl.blog) introduced their new take on an automated micro-contribution service to fund creators on the web. The monthly subscription service let people voluntarily pay their favorite creators automatically as they browse the web. So, what is it like? and will publishers sign up for free money?

**Update** (2023-02-02): Flattr has discontinued its automatic browser-based monthly micro-payment subscription services.

Flattr 2.0, briefly known as Flattr Plus, is a new direction for Flattr. The service has been around since 2010 but hasn’t gained any traction with creators or publishers. The old Flattr required websites to embed a payment button — similar to the Facebook and Twitter sharing buttons you see everywhere — and required users to find and click on these buttons to pay-up. This was a cumbersome experience and Flattr couldn’t get either publishers or users to adopt it.

### The new Flattr

The reimagined version of Flattr has been in development for at least 18 months, and the service now does away with their website buttons. Instead, users install the Flattr extension in their web browsers and it keeps track of how much time you spend on websites and awards them Flattrs based on how much attention/time you spend on a given website.

“A Flattr” is a token share of a user’s monthly subscription. The exact value of a Flattr will vary based on how much each user contributes into the system and how many Flattrs they’ve given out in the current subscription period. Users can set their own monthly contributions starting at 3 USD with a suggested subscription of 5 USD.

The extension is mostly set and forget. You won’t need to interact with it. Just install it and let it do its thing in the background.

The old model required creators and publishers to sign-up for and embed Flattr into their websites. In the new model, any unique URL can be Flattr’ed whether that website operator have registered with Flattr or not. At the end of the month, Flattrs for websites that haven’t got a registered recipient is removed and user’s contribution is divided out among the participating creators and websites.

The model is the same as [Brave Payments](https://www.ctrl.blog/entry/brave-payments/), except that Flattr did the sensible thing and [made a browser extension instead of a full web browser](https://www.ctrl.blog/entry/brave-browser-extension/) to run their payment platform.

### What websites can be Flattr’ed?

Any. The extension is mostly built around rewarding domains, but it also works for individual creators on larger platforms such as YouTube, Twitch, WordPress, Soundcloud, Medium, Flickr, and even the GitHub code hosting and developer website.

However, the extension as of version 0.3.356, only automatically gives out Flattrs to domains on their allow-list. More on *the list* in a later section.

The extension awards the first Flattr to a domain after a few minutes of use. It maxes out at four automatic Flattrs per 24-hour period per domain, but users can always click the button in their browsers to manually reward a page more.

The extension gives out Flattrs at a reduced rate on video websites including Daily Motion, Twitch, Vimeo, and YouTube.

Anyone website, content platform, or multi-author blog can implement a system where individual creators receive the contributions from their own pages. Flattr have integrated with the APIs of some of the web’s largest platforms. Smaller websites can let users input their Flattr IDs,. and have the platform insert a meta element with this ID into pages created by that creator. It would work the same way as websites that let guest authors replace the AdSense token with their own token for pages they’ve created to share on ad revenue.

The running attention-counter resets after a few hours, which hugely disfavors websites you visit ones a day, but don’t spend a lot of time on in one sitting; such as a web comic strip or short stories or poems on Twitter.

I’ve been part of the closed beta period, and have noticed a few problems with how the extension works. Most annoyingly, the per-domain reward system doesn’t work well on content platforms like GitHub or YouTube. You may spend more time with the videos from one creator, but the extension might not award a Flattr until you move your mouse to stop the video that automatically started played after the video you choose to watch. Similarly, if you read multiple articles on Medium – it’s kind of game of chance which of the author’s you read will be Flattr’ed.

### The extension

The new Flattr extension only has official support for Firefox and Chrome, and can be [installed from the Flattr website](https://flattr.com/?ref=ctrl.blog).

The extension also works with most WebExtension or Chromium extension capable web browsers that can pretend to be either Firefox or Chrome during the installation process including Vivaldi and Opera, but not Microsoft Edge. Flattr can also be installed on the [current beta version of Firefox for Android](https://play.google.com/store/apps/details?id=org.mozilla.firefox%5Fbeta&ref=ctrl.blog), if you’re interested in Flattr’ing from your mobile device.

Flattr doesn’t have a strategy for the mobile web. However, you can login to Flattr.com with Firefox 57+ for Android, choose ‘Request desktop site’ from the Firefox menu, and then you’ll get the option to install the extension.)

The extension looks good and does its thing. It does, however, require more memory than any other of the 16 extensions I’ve installed in Firefox. It’s not designed with performance in mind. Not that you’d notice it on newer hardware, but the optimization potential is huge.

### The allow-list

By default, Flattr will only work automatically on the 37 800 domains found on the “Flattr enabled list”. This is a allow-list of domains maintained by Flattr where the extension will work in unattended mode. Any page on any domain can be Flattr’ed, but that requires that the user manually add their favorite websites to the allow-list while their on it.

The tyranny of the default suggests most users won’t ever change any settings, but Flattr have created a nice way for websites not on the allow-list to prompt their visitors to turn on Flattr. The Flattr extension icon will turn blue to remind you to turn it on on websites you’ve visited at least four times in the last month.

![Non-allow-listed websites onboarding on Flattr](https://cdn.synaps.media/control/content/images/2026/08/flattr-not-whitelisted-onboarding.png)

Flattr reminds you to enable it on non-allow-listed websites you frequent.

The entries on the allow-lists were initially seeded from the Top 100 000 domains list offered by Alexa Internet. The list was filtered by Flattr to ensure it only contained websites their users “would want to Flattr”. Flattr hasn’t been all that forthcoming about how they manage the allow-list but have suggested that websites that frequently receives Flattrs from subscribers will be added to the list. The company has also suggested it might hand management of the list over to the community at a later time.

### Will creators, publishers, and people sign up?

Flattr was acquired by Eyeo GmbH in April 2017, the company behind the unpopular-with-web-publishers Adblock Plus browser extension. This relationship may make larger publishers hesitant to get into a business relationship with Flattr. However, having such a close relationship with such a popular extension may also be a great asset.

Eyeo may have plans to integrate Flattr or directly into or at least prominently advertise the Flattr service in their Adblock Plus extension. This would put Flattr in front of 25 million users who’re unhappy with how the web is monetized through ads, and possibly a little guilt over denying publishers advertisement revenue. Such a partnership could be hugely beneficial to Flattr as a platform for funding the web.

Readability already proved that people are willing to sign-up and pay a monthly fee to help support their favorite online publishers and creators. They couldn’t get publishers to accept the payments they collected on their behalf, however. Unlike Readability, Flattr won’t set aside money for publishers who’ve yet to sign-up. They’ll count the number of times a URL is Flattr’ed and present this to publishers as evidence that they should sign-up.

Patreon is another more recent example of a service where more than 1 million people have signed up to pay on average 12 USD per month to their favorite creators individually. Flattr’s model is based on more people making many more and smaller contributions to more creators. Flattr resembles [the old Google Contributor program](https://www.ctrl.blog/entry/two-months-google-contributor/) (since discontinued) and [Brave Payments](https://www.ctrl.blog/entry/brave-payments/) more than Patreon.

Registering with Flattr doesn’t cost creators or publishers anything. They don’t have to turn their content over to Flattr, or spent time and money integrating with the service. Creators need only sign-up and link their various social media accounts and websites to their Flattr accounts to receive their dues. Publishers will also need to submit proof that they own and operate their domain under a given business name, but honestly — it’s free money. Why not take it?

### Micro transactions, big fees

The foe of any web service that charges small amounts of money for anything is the high fees on international credit card transactions. Transactions cost between 0,20 USD and 0,50 USD per transaction plus roughly 2 % of the transaction sum. The fees are roughly halved in Europe compared to the rest of the World. On top of these fees, the payment processor — the service company that verifies and performs the transaction on behalf of the merchant — wants a cut as well.

Flattr charges a flat 9 % payment processing fee every time they charge a subscriber’s credit card for their monthly due. A 6 USD monthly subscription will cost subscribers 6 USD but this translate to a 546 USD monthly contribution. On top of this, your bank is likely to charge a currency conversion fee when applicable and possibly another transaction fee.

Flattr also charges creators and publishers 7,5 % of their monthly revenue, which is a roundabout way of hiding Flattr’s own cut from subscribers. The total amounts of fees is **16,5 % of what subscribers pay into the system.** (The fees are indeed stacked.) Additionally, Flattr charges creators again with a 3 USD fee when they want to withdrawal money from their accounts to their bank account.

The fees might sound high, and they are, but they’re the cost of the convenience of a credit card based system. Alternatives do exist, such as the [Brave Payments and adblocking browser](https://www.ctrl.blog/entry/brave-payments/) platform which is built on a crypto-currency system which for many users would result in even higher fees.

**Update** (2017-11-09): You can check how much you pay in fees and how much each Flattr token is worth using the [Flattr worth and fee calculator](https://www.daniel.priv.no/tools/flattr-calculator/?ref=ctrl.blog).

### Fees compared to Patreon

For comparison, a typical 5 USD contribution processed every month on Patreon — a competing subscription platform where people sign-up to pay their favorite creators — leaves 4,36 USD1 for creators compared to 4,18 USD2 on Flattr.

The smallest subscription on Flattr is 3 USD per month, and it works out to 2,51 USD2 for creators on Flattr or 2,55 USD1 on Patreon. A 12 USD monthly subscription would hand over 10,88 USD1 to creators on Patreon or 10,02 USD2 on Flattr.

The average monthly contribution on Patron is 12 USD. A creator would have to collect ⅒ from 29 or 1 % from 287 Flattr subscribers’ monthly 5 USD contributions to make the same as the average Patron member pays an individual contributor per month.

To put things in perspective, 1 % of a 5 USD monthly Flattr subscription is still a solid 1090 % increase on revenue as compared one-to-one with the industry average revenue from one pageview with online ads. A tiny portion of something is always worth a great more than practically nothing.

The biggest differences in terms of their fee structure is that Patreon doesn’t charge a flat payment processing fee, which can benefit subscribers especially in Europe, and only keeps 5 % for themselves compared to Flattr’s slightly higher rate at 7,5 %.

### What happens now?

The [Flattr website](https://flattr.com/?ref=ctrl.blog) doesn’t make a great pitch for why anyone would want to subscribe to the service. Flattr introduced a new partner program along with the relaunched service, and it appears they’re hoping to convince creators and publishers to convince their own audiences to sign up, and achieve a network effect with multiple networks growing up around individual creators.

I don’t expect that Flattr will work on nearly as many websites as the old Google Contributor program reached. Contributor worked automatically on all websites with Google AdSense advertisements without requiring any additional work from website owners.

Publishers have been reluctant to sign up for free money from services like Flattr in the past, something that also have been a huge problem for micro-payment platforms to reach a critical mass of people. Whether Flattr will beat this trend and secure large publishers, small creators, and all their readers and fans remains to be seen.

#### Sources

- Corrections email from Linus Olsson.
- [Today’s the day: Flattr 2.0 launches to the public](https://web.archive.org/web/20180204063856/https://blog.flattr.com/2017/10/todays-the-day-flattr-2-0-launches-to-the-public/), 2017-10-24, Linus Olsson, Flattr blog, Flattr
- [About Patreon](https://web.archive.org/web/20171025020517/https://www.patreon.com/about), 2017-10, Patreon
- [The Story about the new Flattr – The Flattr enabled list](https://web.archive.org/web/20190504155847/https://blog.flattr.com/2017/09/the-story-about-the-new-flattr-the-flattr-enabled-list/), 2017-09-27, Linus Olsson, Flattr blog, Flattr
- [Adblock Plus & Flattr join forces](https://web.archive.org/web/20190504161252/https://blog.flattr.com/2017/04/adblock-plus-flattr-join-forces/), 2017-04-05, Linus Olsson, Flattr blog, Flattr
- [How do you calculate fees?](https://web.archive.org/web/20171024231711/https://patreon.zendesk.com/hc/en-us/articles/204606125-How-do-you-calculate-fees-), 2017, ‘Dave’, Patreon Support, Patreon
- [Flattr Plus update #2](https://web.archive.org/web/20190504165756/https://blog.flattr.com/2016/08/flattr-plus-update-2/), 2016-08-30, Linus Olsson, Flattr blog, Flattr
- [An Important Announcement](https://web.archive.org/web/20120615174207/http://blog.readability.com/2012/06/announcement/), Richard Ziade, 2012-06-13, Readability Blog
- 1 Patreon fee example: ((X-0,25)\*0,975)\*0,95
- 2 Flattr fee calculation: X\*(0,835)
- Flattr extension for Firefox version 0.3.356.
### Budget CDNs Bunny­CDN, Key­CDN, and CDN­Sun compared
URL: https://www.ctrl.blog/entry/budget-cdn-review/
Last updated: 2026-08-23T22:02:55.000Z
Here is my quick comparison and micro-review of three budget content delivery networks (CDN) for speeding up your website’s page load times.

A *content delivery network* is a marketing phrase meaning “a service that provides caching servers located all over the world.” The idea being that your webpages will load faster if they’re located physically closer to the people that want to visit them. A content delivery network will request pages, images, and other assets from your origin server; store it on their own servers, and then deliver those cached copies to your visitors.

I’ll focus the review on how they perform as standard-compliant HTTP caching proxies (“pull CDN”), and not look into more specialized features. I’ll also not bother with performance as they’re all excellent, and there are already websites that specializes in daily automated testing of CDN performance.

All of these are budget options with low transfer costs. I’ll not include their actual transfer rates — it changes all the time and it’s practically the same for all providers. I’ll include their minimum yearly fee, which is the biggest price differentiator between the services and the least likely to change before tomorrow.

#### Contents

1. [BunnyCDN](#section-budgetcdn-bunnycdn)
2. [CDNSun](#section-budgetcdn-cdnsun)
3. [KeyCDN](#section-budgetcdn-keycdn)
4. [Conclusions](#section-budgetcdn-conclusion)

I’ll proceed to review each provider listed alphabetically. Coincidentally this also lists the best and cheapest provider at the top and the worst at the bottom.

### [BunnyCDN](https://bunny.net/?ref=ctrl.blog)

BunnyCDN is very easy to set-up and use compared with CDNSun and KeyCDN. Their web dashboard has clear instructions and is neat and logically organized. There are some shortcomings such as the quite confusing Network Limit configuration, where you can set up per-IP bandwidth and connection limits.

Configuration changes take less than three minutes to apply.

The documentation is very sparse, and communication about service changes and features happens primarily on Twitter and Facebook (you won’t find the same information in both places). Despite this, BunnyCDN’s website is the best out of the bunch and the most informative.

Respects the origin’s Cache-Control header by default. When I first started evaluating BunnyCDN, they didn’t support [RFC 5861 asynchronously](https://www.ctrl.blog/entry/cdn-rfc5861-support/). They enabled it after a quick email exchange. This allow you to set relatively short cache expiration times, but quickly serve old copies from the cache while the CDN updates their cached copy of pages and assets. Preserves but ignores the standard [Vary header](https://www.ctrl.blog/entry/http-vary-explained/) mechanism.

Provides free automated TLS certificates from Let’s Encrypt, or you can upload your custom certificates. The setup process only takes about a minute.

Bills on a pay-as-you-go model with minimum account charges of just 10 USD. Credits expire after one year, but unlike CDNSun and KeyCDN any remaining credits roll over into a new period when you add more account credit. BunnyCDN also accepts payments in Bitcoin through Coinify.

BunnyCDN advertise themselves as an “IPv6 Enabled CDN”. However, at least since early September 2017 to now in late October, **no part of their service is in fact IPv6 capable.** BunnyCDN’s service status page doesn’t mention any connectivity problems with IPv6 and just says “Hopping Smoothly. We aren’t detecting any problems with our network.”

**Update** (2017-12-12): BunnyCDN’s service status page now lists “IPv6 Maintenance” as a low priority issue.

I reached out to BunnyCDN regarding the IPv6 issues, and got a reply from Dejan Pelzel assuring me that “We are currently performing a maintenance of the IPv6 system to improve monitoring and performance.” Upon pressing him further for why this wasn’t considered to be service downtime, I got a follow up reply “While I would technically not consider it downtime \[…\], it might alert people who aren’t familiar with IPv6 thinking that their site isn’t accessible at all.”

BunnyCDN has 22 POPs but non in Northern Asia. Continents are priced differently, and you can opt-out of individual continents (except South Africa which has no opt-out or price information) to limit costs. The company is based in the Slovenia.

### [CDNSun](https://cdnsun.com/?ref=ctrl.blog)

CDNSun blocked my IP from accessing their entire website about 10 minutes after I signed up for a trial account. Blocking me from even obtaining information about how to contact their support department doesn’t seem like a good business practice and it didn’t leave a good first impression. I tried again a few days later, but was still blocked. Two weeks later, I switched ISP and was then finally able to sign up.

The web dashboard isn’t pretty but it’s easy to understand and you’ll be up and running in no time. CDNSun is more focused on video delivery than any of the other services. This can be beneficial if you’re looking for this, but it creates a lot of clutter in the web dashboard if you’re just looking for a pull CDN for webpages and media assets.

Configuration changes take about half a minute to apply, but CDNSun suggest it can “take up to 20 minutes” before changes apply globally.

The documentation is okay but is limited in technical details and seems to be incomplete.

Respects the origin’s Cache-Control header by default but doesn’t support the [stale-if-error/stale-while-revalidate](https://www.ctrl.blog/entry/cdn-rfc5861-support/) extension. This means performance on pages with shorter expiration dates can be degraded compared to a CDN provider that support this feature. Preserves but ignores the standard [Vary header](https://www.ctrl.blog/entry/http-vary-explained/) mechanism.

**Update** (2018-06-07): KeyCDN now supports asynchronous background revalidation.

Provides free automated TLS certificates from Let’s Encrypt, or you can upload your custom certificates.

Bills on a pay-as-you-go model with minimum account charge of 49 USD. Credits expire after one year. Pricing information is scattered on different pages. This seems to have been done to hide the minimum yearly charge from prospecting customers.

CDNSun doesn’t support IPv6.

CDNSun has 70 POPs including South Africa and the Middle East, and in the middle of Siberia (Northern Asia). Each POP is priced separately, and you can opt-out of individual POPs to limit your costs. The company is based in the Czech Republic.

### [KeyCDN](https://www.keycdn.com/?ref=ctrl.blog)

When I first signed up for a free trial account, KeyCDN responded by immediately blocking my IP address from accessing the client dashboard. I submitted a support form on their main website, which I could still access, and it took them two attempts and as many days to unblock my IP address. After my account was unlocked, they also blocked my IP address again a few weeks later as I was tweaking some configuration. This time they unblocked my IP after roughly half an hour had passed. I don’t know what caused them to block me, but frankly — it wasn’t at all confidence inspiring.

KeyCDN’s web dashboard looks tidy at first, but it’s quite difficult to use. KeyCDN includes more inline documentation in the configuration interface than the other two combined. However, both the settings and their help texts are confusing. It’s unclear what effect each setting has, which is mostly caused by badly written copy.

Configuration changes take several minutes to apply.

KeyCDN has tons of documentation and blog posts filled with details about CDNs in general and caching. They also have a lot of pages which are clearly aimed at search engines and not written for people (repeated terms set in bold and included in pointless headlines on content-thin pages). The documentation is technically quite good but they don’t clarify whether they’re speaking in general terms or specifically about the capabilities of their own service. Again, this seem to be a strategy to attract search traffic more than an attempt at providing good documentation.

Account passwords must be 8–32 characters. This upper limit on password length may indicate that they store passwords in plain-text rather than following the best-practice of password storage by only storing a cryptographic hash of the password (which would have the same length regardless of the length of the actual password).

It doesn’t respect the origin’s Cache-Control header by default. The standard cache control mechanism should be the default way to control caching. The configuration required to make it support it’s complicated and frankly overly complicated to work out. KeyCDN only partially supports the [stale-if-error/stale-while-revalidate](https://www.ctrl.blog/entry/cdn-rfc5861-support/) extension, but only non-asynchronously — meaning some visitors will get slow page loads. Ignores and overwrite the origin’s [Vary header](https://www.ctrl.blog/entry/http-vary-explained/).

Provides free automated TLS certificates from Let’s Encrypt, or you can upload your custom certificates. Setting up Let’s Encrypt requires quite a few extra steps including going back into different configuration and saving the configuration (unchanged) multiple times.

Bills on a pay-as-you-go model with minimum account charge of 49 USD. Credits expire after one year, and they’re very open about it prices. KeyCDN also charges extra if you want to see access logs, or if you configure more than 5 unique caches.

KeyCDN doesn’t support IPv6.

KeyCDN has 25 POPs but none in Africa (planned), or Middle East (planned), or Northern Asia. The company is based in Switzerland.

### Conclusions

I already revealed that **I preferred BunnyCDN** before I got wound in the details. They’re been the CDN provider for this website for over a month already as you’re reading this!

Although I haven’t included prices in this article (they’d be out-of-date before I clicked ‘Publish,’) BunnyCDN won on feature support and price. At the time of publishing, for traffic in Europe and North America, BunnyCDN costs ¼ the price of KeyCDN — the second cheapest option.

BunnyCDN’s failure to own up to their IPv6 connectivity issue and failing to list it as a service outage is probably my biggest worry about their service. I want to know about problems, and they’ve a clear channel to communicate it through. IPv4 is slower on some mobile networks, and mobile performance. Seeing how none of the other CDN providers are offering IPv6 support, BunnyCDN gets points for at least trying even though they’re failing to live up to their advertised feature set.

**CDNSun seems like a solid second option**. Their lack of RFC 5861 support means they’ll be at a performance disadvantage to the other two for serving less popular pages and assets. They have three POPs in South America, three in Australia, one in New Zealand, and even in the middle of the populated parts of Siberia. They’ve got you covered where ever on Earth your visitors may be located. I’d not be surprised to see them open up of the first CDN service on the Moon and Mars colonies some day in the future — assuming they can roll out IPv6 by then.

I’m not sure what to say about **KeyCDN**. Their website is built to attract traffic from search engines at the cost of content quality and its ability to convey useful information, they charge extra for things the others include for free, and they just generally don’t leave a good impression. Their service works just as well as the two others, but there’s nothing about them that makes me want to be their customer.

I don’t know what alarm bells my account registrations triggered at KeyCDN or CDNSun. At any rate, I don’t appreciate being blocked by some automated process. Do they randomly block paying customers too? I just don’t know and neither companies were communicative about the incidents. I’m a heavy keyboard user and maybe I didn’t move my mouse cursor enough, or they didn’t like that I used a residential IP address. In any case, it can’t be good for their business to block prospecting new customers just as they’re signing up to become new customers.

I’ve made it through this entire article without making any bunny jokes. Here at the close I’ll recommend you hop along over to [BunnyCDN](https://bunny.net/?ref=ctrl.blog) if you’re looking for a cost effective CDN for a small to medium website. For ones, the cheapest option also appears to be the best option. (Oh, and they don’t block your IP for signing up to be a customer!)

P.S.: I do apologize to New Zealanders for leaving you out of the world map in the illustration.
### Which CDN providers support stale-while-revalidate?
URL: https://www.ctrl.blog/entry/cdn-rfc5861-support/
Last updated: 2026-08-23T22:03:03.000Z
Last week, I talked about the benefits of and how you can [test for stale-while-revalidate support](https://www.ctrl.blog/entry/how-to-test-stale-while-revalidate/) (RFC 5861.) This week, I’ve done the testing for you.

The below table shows some content delivery networks (CDN) and to what degree they support RFC 5861\. The selection of CDNs included is skewed towards low-cost providers, and providers with a free trial period. I hope to expand the table in the future.

__RFC 5861 support on select content delivery networks__
| Provider         | stale-if-error | stale-while-revalidate | Using HTTP | Async | Documented |
| ---------------- | -------------- | ---------------------- | ---------- | ----- | ---------- |
| Azure CDN        | Supported      | Yes                    | No         | Yes   |            |
| BelugaCDN        | Unsupported    | No                     |            |       |            |
| BunnyCDN         |                |                        |            |       |            |
| CDN77            | Supported      | Yes                    |            |       |            |
| CDNSun           | Unsupported    |                        |            |       |            |
| Cloudflare       | Supported      | No                     | Yes        |       |            |
| Fastly           | Supported      |                        |            |       |            |
| KeyCDN           |                |                        |            |       |            |
| Google AMP Cache |                |                        |            |       |            |

**Update** (2020-11-23): Corrected table to reflect that Cloudflare does not support asynchronous background revalidation.

**Update** (2018-06-07): KeyCDN now supports asynchronous background revalidation.

### Why asynchronous revalidation?

Azure CDN, Cloudflare, and KeyCDN support `stale-if-error` and `stale-while-revalidate`, but they don’t support asynchronous background revalidation of expired cached items. This means that the first visitor to request an expired resource from the cache has to wait while it’s being updated at the cost of latency.

Subsequent requests to the same resource while another request is busy updating it gets served a stale copy from the cache. This isn’t RFC 5861 compliant and as such is marked in orange in the table as some visitors will experience higher latency than other visitors as compared to a fully asynchronous implementation.

I can’t explain this any better than RFC 5861 itself:

> “The `stale-while-revalidate` HTTP Cache-Control extension allows a cache to immediately return a stale response while it revalidates it in the background, thereby hiding latency (both in the network and on the server) from clients.”

All but one of the providers included in the above table use either Varnish Cache or Nginx. Neither servers support `stale-while-revalidate` out-of-the box; it has to be enabled in configuration. As [discussed last week](https://www.ctrl.blog/entry/how-to-test-stale-while-revalidate/), Nginx requires additional configuration to support asynchronous updates to the cache that only recently became available. The table would have looked very different just 10 months ago.

CDN providers that deploy Varnish Cache or Apache Traffic Server are more likely to have support for stale-while-revalidate with asynchronous updates. The feature have been available in the two servers since 2015 and 2014 respectively. Nginx only recently added support in February 2017.

### No documentation? No support?

The only two things that sets Fastly apart from BunnyCDN and KeyCDN is that Fastly runs on Varnish Cache rather than Nginx, and that Fastly have stated publicly that they support RFC 5861.

If there isn’t any official documentation about the feature from a CDN provider, you also don’t have any indication of a commitment from them that it will continue to be supported. If it stops working some time in the future, it’s also less likely that they’ll prioritize fixing it again. You may have a harder time reaching out to customer support if anything goes wrong.

**Update** (2020-02-05): BunnyCDN have since disabled support for RFC 5861\. Demonstrating my above point perfectly.

You should choose a CDN provider that has official documentation, or at the very least an official acknowledgment of the features your website relies upon. RFC 5861 is no exception to this rule of thumb, which is why I included this in information in the comparison table.

**Update** (2020-07-29): Cloudflare has been added to the table. It supports RFC 5861 even on its free tier, but only when the Origin Cache Control feature is enabled.

**Update** (2018-02-10): KeyCDN has been added to the table.

You can submit new CDN providers that are missing from the table using the below corrections link. I’ll review it and add it to the article. Please include any links to official documentation from the provider you wish to include.

#### Sources

- [Understanding Origin Cache-Control](https://developers.cloudflare.com/cache/concepts/cache-control/?ref=ctrl.blog), 2020-06-15, Caching, Support, Cloudflare
- My own tests conducted in September 2017.
- Email exchanges with Dejan Pelzel, founder of BunnyCDN.
- [KeyCDN Now Supports Stale-While-Revalidate & Stale-If-Error](https://www.keycdn.com/blog/keycdn-supports-stale-while-revalidate?ref=ctrl.blog), 2017-05-18, Cody Arsenault, KeyCDN Blog, KeyCDN
- [Google AMP Cache Overview](https://developers.google.com/amp/cache/overview?ref=ctrl.blog#google-amp-cache-updates), 2017-02-09, AMP on Google, Google Developers, Google
- [Azure CDN rules engine features](https://learn.microsoft.com/en-us/azure/cdn/cdn-verizon-premium-rules-engine-reference-features?ref=ctrl.blog), 2017-01-23, Richard Li and Cam Soper, Microsoft Azure Documentation, Microsoft
- [Changes in Varnish 4.1](https://github.com/varnish/Varnish-Cache/blob/b961b70cad/doc/sphinx/whats-new/changes.rst?ref=ctrl.blog), commit b961b70cad, 2015-09-30, Federico G. Schwindt and Lasse Karstensen, Varnish Cache project repository, Varnish Cache, GitHub
- [Stale-While-Revalidate in the core](https://cwiki.apache.org/confluence/pages/viewpage.action?pageId=56067381&ref=ctrl.blog), revision 56067381, 2015-04-29, Sudheer Vinukonda, Traffic Server wiki, Apache Software Foundation
- [Stale-While-Revalidate, Stale-If-Error Available Today](https://www.fastly.com/blog/stale-while-revalidate-stale-if-error-available-today?ref=ctrl.blog), 2014-09-18, Steve Souders, Fastly Blog, Fastly
- [RFC 5861 HTTP Cache-Control Extensions for Stale Content](https://www.rfc-editor.org/rfc/rfc5861.html?ref=ctrl.blog), 2010-05, Mark Nottingham, Yahoo! Inc., Internet Engineering Task Force
### Podcasters should embrace programmatic ad insertion
URL: https://www.ctrl.blog/entry/programmatic-podcast-ads/
Last updated: 2026-08-23T22:16:04.000Z
On the web, few companies are wiling to pay for advertisements that aren’t targeted to their ideal customer – or at the very least a customer in their target market. However, in podcasting, listener targeted ads haven’t been a thing.

After listening to podcasts almost every day for a decade, last month I finally heard an advertisement that wasn’t meant to be heard by someone an ocean away on another continent. Advertisement technology seems to finally be catching up to audio-content delivery.

I don’t live in the United States of America, but I listen to many English language podcasts. Most of these have been produced in the US, but a good portion is produced in the United Kingdom, and other still are produced elsewhere in the world. What they all have in common is that they’ve almost exclusively been running advertisements aimed at an American listenership.

I’ve heard more ads about American cellphone providers, online mattress stores, and clothing and food subscription services that only operate in the U.S. than any non-US citizen should in a lifetime. These ads run for months, and sometimes years, on repeat across multiple podcasts and networks.

In mid-September 2017 I heard the first ad read on a podcast that was specifically targeted at a non-US audience in a US-produced podcast. This was the first time I’ve ever heard this over the course of more than a decade of daily listening to podcasts. I decided to look into it a bit, and downloaded the same episode from a U.S. proxy server. When I got the episode this time, I heard a completely different advertisement for a U.S. based monthly subscription service. This was the first time I’ve ever experienced anyone using dynamic ad inserts on a podcast to deliver targeted advertisement.

Splicing in different audio ads into a specific portion of an ad isn’t a technologically difficult challenge to solve. Dynamically inserted ads, or even programmatically matched and inserted ads, can open up new revenue streams and markets to podcasters — who can also benefit from diversifying their income streams.

Advertisers prefer host-read ads, and 60 % of podcast advertising revenue in 2016 came from host-read adspots, according to [a study](https://www.iab.com/wp-content/uploads/2017/06/PwC%5FIAB-Podcast-Advertising-Study%5FFY2016%5FFinal.pdf?ref=ctrl.blog) by PricewaterhouseCoopers. Dynamic ad insertion can work for host-read ads as well as produced adspots delivered by advertisers.

It has proved impossible to dig up any numbers on the breakdown of the international listenership of podcasts. However, English is an official language in as many countries as there are states in the US. It’s a second language in more than double that number. Only about 20 % of the world’s English speaking population lives in the US. That leaves a huge unmonetized market ripe for the picking if podcasters only had the right advertiser inventory.

When the occasional advertiser accepts international customers, their aired promotions don’t apply outside the US. No service discounts, and no two free audiobooks either. Not to mention that promotional codes or offers burned in to the main audio program may expire, the ad read by the host will live on for perpetuity.

But things seem to finally be changing. As [reported by AdExchanger](https://www.adexchanger.com/platforms/podcasts-try-dynamic-ad-insertion-but-you-might-not-notice/?ref=ctrl.blog), Matt Lieber, president of Gimlet Media, said the following at an event in 2016:

> “Until recently, whenever we put an ad into the show it stayed there. Forever. \[…\] \[We now\] put the ad in and it stays there for a certain amount of time and it comes out when it’s reached a certain amount of impression.”

Dynamically inserted ads have many benefits besides letting the host keep their credibility and independence. (Something I believe it’s [near impossible to achieve with host-read ads](https://www.ctrl.blog/entry/podcast-host-read-ads/).) While interest/tracking based advertising isn’t currently possible in podcasts, dynamic ad inserts can still enable podcasters to sell the same adspot to different advertisers in different regions and at different times.

For example, a very simple location targeting to get podcasters started could be to split U.S. listeners and everyone else up into their own segments. Instead of pushing ads that only work on U.S. listeners to an international audience, podcasts could diversify their revenue streams by having ads they can profit from — even at a lower rate — instead of serving ads for companies and services that aren’t even available in their region. Even without one or more international advertisers lined up, podcasters could better monetize this segment by addressing these listeners directly and ask them to donate or buy T-shirts. This same ad could be used as a fallback advertisement for U.S. listeners too if a podcast suddenly found itself without an advertiser.

Companies like Megaphone by Panoply and Podbean already offer dynamic ad insertion and location-targeted episode delivery to podcasters. Acast and AdsWizz AdWave are working on extending this to create ad marketplaces for programmatically driven automated dynamic ad insertion akin to how Google AdSense works for web publishers.

Dynamic ad inserts combined with programmatically matched ads would also make it easier for podcasters to monetize their back catalogs of old episodes. Something which could encourage the production of episode transcripts and other methods to help make old episodes more discoverable.

I hope more podcasts will embrace location based dynamically inserted ads. I don’t want to listen to a dozen ads for products and services that aren’t available in my region every week. It’s not only wasting my time, but also depriving podcasters of potential revenues.

This might sound like a silly idea, but I believe that ads relevant for your region would make podcasts more inclusive. They’d help transform shows for something exclusively for the North American market to something that’s more approachable for a wider international audience.

#### Sources

- [Field listing: Languages](https://web.archive.org/web/20170912133454/https://www.cia.gov/library/publications/the-world-factbook/fields/2098.html), 2017-09-22, The World Factbook, Central Intelligence Agency
- [IAB Podcast Ad Revenue Study: An Analysis of the Largest Players in the Podcasting Industry](https://www.iab.com/wp-content/uploads/2017/06/PwC%5FIAB-Podcast-Advertising-Study%5FFY2016%5FFinal.pdf?ref=ctrl.blog), 2017-06-22, PricewaterhouseCoopers, sponsored by the Interactive Advertising Bureau (IAB), and major podcast networks and producers
- [Podcasts Try Dynamic Ad Insertion (But You Might Not Notice)](https://www.adexchanger.com/platforms/podcasts-try-dynamic-ad-insertion-but-you-might-not-notice/?ref=ctrl.blog), 2016-02-18, Ryan Joe, AdExchanger
### How to test for HTTP stale-while-revalidate support?
URL: https://www.ctrl.blog/entry/how-to-test-stale-while-revalidate/
Last updated: 2026-08-23T22:11:05.000Z
`stale-while-revalidate` is a useful extension to the HTTP `Cache-Control` response header. The header instructs intermediary caches that they can fulfill requests by returning resources that have expired from the cache for some additional time. The cache can then asynchronously perform a revalidation or update if the cached resource. This way, the visitor won’t have to wait for an edge server to update a resource before delivering it.

Sounds neat, right? But how do you test that this work? As for many other problems in the world, this is one that you need to sleep on.

Lately, I’ve been evaluating a few different content delivery networks (CDN), and have found the market is full of exaggerations and lies about the networks’ technical capabilities. Documentation is also quite lacking for many service providers. I found it necessary to test and confirm their claims on my own, and had to find a reliable way to test whether `stale-while-revalidate` (RFC 5861) worked asynchronously from a given intermediary cache.

### The test setup

You’ll need a simple test script, see `test.php` included below, that returns the appropriate `Cache-Control headers` for the test and that introduces a measurable delay that can be used for testing.

```php
<?php
  header('Cache-Control: max-age=20, stale-while-revalidate=80');
  sleep(10);
  print('This is a slow test.');
```

The test page sets the `Cache-Control` header with a freshness of 20 seconds, and allows intermediary caches like a reverse proxy, content distribution network (CDN), or web accelerator to serve stale copies for an additional 80 seconds. Before the test returns, it waits for 10 seconds. When `stale-while-revalidate` is working, no request/visitor should have to wait for ten seconds before the request has completed as long as the page remains in the cache (which in this case is 20+80 seconds.)

You can easily test this assumption using the [Apache benchmarking tool](https://httpd.apache.org/docs/current/programs/ab.html?ref=ctrl.blog) (`ab`.) Request the test page once to populate the cache, this first request will have to wait for the full 10 seconds. The subsequent requests should be served from the cache and thus all return within a few milliseconds.

```shell
ab -s50 https://www.example.com/test.php && \
ab -s50 -n2000 -v2 https://www.example.com/test.php
```

If you see any results in the second test run that takes 10 seconds or more, the intermediary cache doesn’t support asynchronous `stale-while-revalidate` update. Either the server doesn’t support `stale-while-revalidate` at all, or you’re testing against Nginx.

You can test if subsequent requests are served stale copies while one request is held up by adding `c2` to the test to run two concurrent test runs.

I’ve tested RFC 5861 support at a few content delivery networks (CDN), and [published the results](https://www.ctrl.blog/entry/cdn-rfc5861-support/) if you’re interested.

### Notes on `stale-while-revalidate` in Nginx

You can enable `stale-while-revalidate` in Nginx by setting the `proxy_cache_use_stale` option to include `updating`. By default, Nginx will mimic Apache’s infamous “thundering herd” mitigation solution: the first request to an expired resource in the cache will serve as the cache lock while the resource is being revalidated or updated. Subsequent requests while the lock is in place will be served the stale file directly from the cache. However, this still means that one request/visitor will see slower response times while the cache is updated.

To allow fully asynchronous `stale-while-revalidate` handling for all visitors, you also need to set the `proxy_cache_background_update` option to on. This option is a fairly new addition and only recently appeared in Nginx version 1.11.10\. If you repeat the above test with this option enabled, you should no longer see any slow requests.

#### Sources

- [RFC 5861 HTTP Cache-Control Extensions for Stale Content](https://www.rfc-editor.org/rfc/rfc5861.html?ref=ctrl.blog), 2010-05, Mark Nottingham, Yahoo! Inc., Internet Engineering Task Force
- [ab – HTTP server benchmarking tool](https://httpd.apache.org/docs/2.4/programs/ab.html?ref=ctrl.blog), version 2.4, Apache
- [Module ngx\_http\_proxy\_module](https://nginx.org/en/docs/http/ngx%5Fhttp%5Fproxy%5Fmodule.html?ref=ctrl.blog), Nginx
- [Avoiding the Thundering Herd](https://httpd.apache.org/docs/2.4/en/mod/mod%5Fcache.html?ref=ctrl.blog#thunderingherd), Apache Module mod\_cache, version 2.4, Apache
### Microsoft adds Ogg, Theora, and Vorbis media formats to Windows 10
URL: https://www.ctrl.blog/entry/windows-ogg/
Last updated: 2026-08-23T22:25:17.000Z
Just last week, Microsoft announced it would migrate their Groove Music subscribers to Spotify – a streaming music service which is probably the web’s largest user of the Vorbis audio codec. This week, Microsoft also announced that they will add support for the open media standards Ogg (media container), Vorbis (audio codec), and Theora (video codec) to a future version of Windows 10 and Microsoft Edge.

The Microsoft Edge platform development status page announced on October 9th that Microsoft is now working on implementing support for these new media formats. Edge is usually the first part of Microsoft to announce such changes as Microsoft has seen the need to keep a more open dialog with web developers about upcoming changes to the platform. The news comes way too late for support for the new media formats to be included in the Windows 10 Fall Creators Update due later this year.

**Update** (2017-12-05): Microsoft have now released support for Ogg media container files and these codecs as [an optional add-on to Windows 10](https://www.ctrl.blog/entry/windows-webmedia-ext/) and Xbox One available for free in the Microsoft Store.

Windows 10 already support other open media formats like the Matroska (MKV) container format, the WebM video container format, as well as the Free Lossless Audio Codec (FLAC) and recently the Opus audio codec. MKV, WebM, FLAC, and Opus support isn’t just limited to Microsoft Edge – they work in all Universal Windows Platform (UWP) apps. This will probably be the case for Ogg, Theora, and Vorbis too — because who’d want to maintain two separate multimedia implementations on one platform?

I’d hazard to guess that the decision to work on adding support for Vorbis at this point may have been heavily motivated by Microsoft’s growing partnership with Spotify. Last week, Microsoft announced it would [migrate their Groove music customers to Spotify](https://blogs.windows.com/windows-insider/2017/10/02/microsoft-to-bring-spotify-to-groove-music-pass-customers/?ref=ctrl.blog). Spotify shipped an app for the Xbox One and appeared in the Windows Store just last month. To continue on my trail of speculation, I’d also like to point that we might were well be seeing signs of a possible Microsoft acquisition of Spotify in the works right here. The two companies sure are tying tighter bounds between each other.

Spotify have been using **Vorbis as their default audio codec on desktop** for years. As far as I can tell, Spotify’s 140 million active users (as of 2017-07) makes them the world’s largest distributor of Vorbis encoded audio.

Until now, Spotify have included their own Vorbis audio codec decoder (libvorbis and libogg) as part of the Spotify software. I believe that Microsoft can provide better performance and reduce the power requirement with their own implementation as part of Windows compared to decoding audio outside of the native Windows multimedia stack. While this may not matter much on high-end desktop computers, laptops and Xbox consoles running on Windows 10 may benefit more form a better platform integration.

The Vorbis audio codec isn’t only used in Ogg media containers; but is often found in WebM media containers. Microsoft Edge and Windows 10 already has partial support for WebM video playback without audio. Getting Vorbis playback in place would mean Microsoft product would be capable of playing back even more WebM files without dropping their audio streams.

Vorbis have tried to compete as an unpatented and cost-free alternative to the MP3 audio codec for 17 years without any notable success besides being the format of choice for Spotify. The last patents to the MP3 audio codec expired earlier this year. It could be that Microsoft wouldn’t commit to supporting Vorbis for all those years until after the possible unexplored legal treats from MP3 format rights holders had been laid to rest.

Vorbis offers better sounding audio at in much smaller file sizes compared to MP3\. Yet the format hasn’t had any large organizations pushing for its adoption. Users have had the ability to install support in Windows for the last 14 years, but who installs any add-on codecs these days?

Going forward, Windows will support three more open media formats which is good for the open web and the free exchange of culture and media. The only remaining web browser vendor who haven’t shown any sign of adopting any open media formats, besides Opus, is Apple. Will Microsoft’s newfound love for open standards sway the last holdout to reconsider adopting open formats? I sure do hope so.

#### Sources

- [OGG Container](https://web.archive.org/web/20171011173819/https://developer.microsoft.com/en-us/microsoft-edge/platform/status/oggcontainer/), 2017-10-09, Platform status, Microsoft Edge, Microsoft
- [Vorbis Audio Codec](https://web.archive.org/web/20171011173822/https://developer.microsoft.com/en-us/microsoft-edge/platform/status/vorbisaudiocodec/), 2017-10-09, Platform status, Microsoft Edge, Microsoft
- [Theora Video Codec](https://web.archive.org/web/20171011173824/https://developer.microsoft.com/en-us/microsoft-edge/platform/status/theoravideocodec/), 2017-10-09, Platform status, Microsoft Edge, Microsoft
- [Microsoft to bring Spotify to Groove Music Pass customers](https://blogs.windows.com/windows-insider/2017/10/02/microsoft-to-bring-spotify-to-groove-music-pass-customers/?ref=ctrl.blog), 2017-10-02, General of Microsoft Groove Jerry Johnson, Windows Experience blog, Microsoft
- [Spotify comes to Xbox One](https://web.archive.org/web/20180316152707/https://press.spotify.com/us/2017/08/08/spotify-comes-to-xbox-one/), 2017-09-08, Press release, Spotify
- [MP3 ‘died’ and nobody noticed: Key patents expire on golden oldie tech](https://www.theregister.com/2017/05/16/mp3%5Fdies%5Fnobody%5Fnoticed/?ref=ctrl.blog), 2017-05-16, Andrew Orlowski, The Register
- [WebM, VP9 and Opus Support in Microsoft Edge](https://blogs.windows.com/msedgedev/2016/04/18/webm-vp9-and-opus-support-in-microsoft-edge/?ref=ctrl.blog), 2016-04-18, Microsoft Edge developer blog, Microsoft
- [Windows 10 build 14316](https://developer.microsoft.com/en-us/microsoft-edge/platform/changelog/desktop/14316/?ref=ctrl.blog), 2016-04-06, Platform changelog, Microsoft Edge, Microsoft
- [Windows 10 build 14291](https://developer.microsoft.com/en-us/microsoft-edge/platform/changelog/desktop/14291/?ref=ctrl.blog), 2016-03-17, Platform changelog, Microsoft Edge, Microsoft
- [Audio quality settings](https://web.archive.org/web/20171109172037/https://support.spotify.com/us/article/high-quality-streaming/), Spotify Support, Spotify
### Native content blocking in Firefox without installing any extensions
URL: https://www.ctrl.blog/entry/firefox-native-content-blocker/
Last updated: 2026-08-23T22:06:51.000Z
Firefox lets you block permissions per domain for many things including the permission to load images and scripts. This can be used in lieu of a more advanced content- or ad-blocking extension when you only want to block a couple of specific domain names. I’ll walk you through how.

To follow along with this tutorial, you should already be a bit familiar with how the web is put together and how resource loading on the web work. I’ll try to explain along the way, but this tutorial may not be suited for people without any experiences in web development.

You may not want to install an ad-blocker but still want to block some of the more intellectually offensive types of advertisements. (I’m looking at you Outbrain, Taboola, and Revcontent!)

To block any type of content, you’ll need to know which domain it’s being loaded from. The Network Monitor in Firefox can show you where everything is coming from. Press Ctrl + Shift + E (or Command + Option + E on MacOS) to open the Network Monitor. You’ll need to reload the page after opening it for it to show you anything about the current page.

Let’s assume you want to block scripts originating from `https://www.example.com` from loading on any website for the purposes of this tutorial. Example domains have always annoyed me, so let’s stop any JavaScript from being loaded from that domain.

To block content from a domain, you need to inject a block rule in the site permissions store. You can’t do this from within Firefox, and you *should quit Firefox* before proceeding.

The site permission store is kept in an SQLite database called `permissions.sqlite` within your Firefox profile (you can find your Firefox profile folder by opening `about:profiles` in Firefox’s address field). You can use a graphical tool like [DB Browser for SQLite](https://sqlitebrowser.org/?ref=ctrl.blog), or the `sqlite3` command-line interface.

I’ll explain all the changes you’ll be making in general terms, and then show it of with the SQL query statement as it would be used with the `sqlite3` command-line interface (available on MacOS and most Linux variants by default).

### Blocking a domain

First you’ll need to add a new row/record to the `moz_perms` table. Set the `origin` to the protocol plus the domain you want to block, e.g. `https://www.example.com`. Note that you’ve to add separate block rules for HTTP and HTTPS.

You then set the `type` to the type of content you want to block. For the most part, you’ll want to use either “`image`”, “`script`”, or “`document`”. You can find a full list of supported types in [nsPermissionManager.cpp](https://web.archive.org/web/20190508174721/https://dxr.mozilla.org/mozilla-central/rev/2b347fb55a99/extensions/cookie/nsPermissionManager.cpp#107-128) and [PermissionUtils.cpp](https://web.archive.org/web/20190626050010/https://dxr.mozilla.org/mozilla-central/rev/d10c97627b/dom/permission/PermissionUtils.cpp#13-17). Most ads are loaded over JavaScript, so revoking their domain’s ability to execute scripts effectively stops them dead in their tracks.

Now that you know what permission to block for which domain, proceed by editing the `permissions.sqlite` database file. In the `moz_perms` table, you’ll need to insert a new record. Set the value of `origin` to `https://www.example.com`, then set `type` to `document`, and finally set `permission` to `2` (which means “revoked.”) Commit the changes, and launch Firefox. The example website should no longer load!

Here is the same exact same process using the `sqlite3` command-line interface:

```shell
sqlite3 ./permissions.sqlite "INSERT INTO 'moz_perms' (origin, type, permission) VALUES('https://www.example.com', 'script', '2');"
```

The above is *one* command without any line breaks.

So, this isn’t the most convenient technique to block content. However, it’s one of the fastest methods available and you don’t need to install any extensions that all add complexity, slow down the browser, and potentially even open up new avenues for attacking the we browser.

Back in ancient times, you could block these sorts of things from the user interface in Firefox itself. You can still block images this way, but unfortunately you can’t revoke permissions such as scripting permissions from the user interface anymore. This option in particular was removed in 2013 over [fears that Firefox users were hurting themselves](https://limi.net/checkboxes?ref=ctrl.blog).

This technique may however be useful when deployed along with automated browser test suites for tests in environments where an API endpoint or other important resource needs to be simulated as being blocked. This technique can also be used to grant other user-prompted permissions without slowing down tests to interact with the user interface, for the purposes of testing.

#### Sources

- [nsPermissionManager.cpp](https://web.archive.org/web/20190508174721/https://dxr.mozilla.org/mozilla-central/rev/2b347fb55a99/extensions/cookie/nsPermissionManager.cpp), 2017-07-31, revision 2b347fb55a99, Mozilla source repository, Mozilla
- [Network Monitor](https://firefox-source-docs.mozilla.org/devtools-user/network%5Fmonitor/?ref=ctrl.blog), 2017-06-01, revision 1251289, Mozilla Developer Network, Mozilla
- [PermissionUtils.cpp](https://web.archive.org/web/20190626050010/https://dxr.mozilla.org/mozilla-central/rev/d10c97627b/dom/permission/PermissionUtils.cpp), 2016-12-16, revision d10c97627b, Mozilla source repository, Mozilla
- [Sync site permissions (nsIPermissionManager)](https://bugzilla.mozilla.org/show%5Fbug.cgi?id=470699&ref=ctrl.blog), bug 470699, Mozilla Bugzilla, Mozilla
- [Checkboxes that kill your product](https://limi.net/checkboxes?ref=ctrl.blog), 2013-03-18, Alex Limi

Feature based on assets by © 2017 Edwin Husein.
### Save-Data aware HTTP/2 server push
URL: https://www.ctrl.blog/entry/http2-save-data-push/
Last updated: 2026-08-23T22:11:44.000Z
Server-initiated push is a new feature in HTTP/2 that can greatly improve page load performance by pushing critical resources to the client without requiring the client to request the download first. The only caveat by preemptively pushing out resources is that the server won’t be aware of the client’s local cache. This not only wastes bandwidth for both visitors and websites, but can potentially cost visitors with high data charges dearly.

The decision whether to push a resource or not is normally taken without the user having a say. Web developers must choose on their visitors behalf between potential page load performance gains and potentially running up their data usage and running against their data caps. The new `Save-Data` request header, which I’ve already [introduced in greater detail](https://www.ctrl.blog/entry/http-save-data/) already, let users have a say in the performance versus bandwidth-usage decision making process.

A website that have implemented HTTP/2 server push can become cache-aware by setting cookies on their visitors’ devices. These cookies can be implemented in a way to act like a toggles to turn off repeated server push in future requests. However, this requires added complexity at the edge to map cache-token cookies and resources the server would normally push to all clients. For smaller resources, it may not be worth the extra time and investment to avoid pushing already served-and-cached resources.

The additional data spent by repeated server pushes is a *worthwhile performance compromise* for many people in parts of the world. If you pay a lot for data usage, you may prefer websites to work in the more traditional dumber fashion where the client has greater control over what resources they fetch.

Some users will prefer to keep their bandwidth usage as low as possible. It’s entirely up to web developers to strike a balance between potential performance gains and potentially wasted bandwidth.

People who want to save bandwidth can configure their clients to send a `Save-Data` request header. This is added automatically to all requests when using the Data Saver feature in Google Chrome or Android, or Turbo mode in Opera or Yandex.browser. The header is a clear signal from the user that they want the server to do what it can to keep the bandwidth usage low.

If you don’t want to use a third-party compression proxy like Google Data Saver or Opera Turbo, you can also install my *Save-Data: on* extension for [Firefox](https://addons.mozilla.org/en-US/firefox/addon/save-data/?ref=ctrl.blog) or [Google Chrome](https://chrome.google.com/webstore/detail/save-data-on/nholpkfnmjbinlhcfihkhiehdaohlibg?ref=ctrl.blog). All the extension does is to include the `Data-Saver` header with every request.

In a situation where a client sends this header, a HTTP/2 server push can be disabled entirely — or scaled back to include only a few small resources. Websites shouldn’t push large resources at any time, but may push smaller things like only the smallest critical stylesheets and scripts. For some types of resources, like redirects, it makes sense to [enable server pushed redirects](https://www.ctrl.blog/entry/http2-push-redirects/) whenever possible.

The two examples below show how you can configure this behavior by removing any `Link: rel=preload` response headers in response to any incoming `Save-Data` request headers.

```javascript
if (req.http.Save-Data == "on") {
  unset resp.http.Link;
}
```

The above configuration example is for the Varnish Cache, and the below example is for the Apache HTTP Server:

```apacheconf
SetEnvIfNoCase ^Save-Data$ "on" data_saver="on"
Header unset Link env=data_saver
```

Do remember to also add a [Vary response header](https://www.ctrl.blog/entry/http-vary-explained/) to indicate that a resource varies based on the presence of the `Save-Data` request header. This helps intermediary caches and proxies, whether it be your backend or on the visitor’s side, do the right thing.

```
Vary: Save-Data
```

Please make sure to carefully test your implementation thoroughly. Substandard web servers with weak HTTP caching implementations (like Nginx) may have issues performing cache negotiation when resources vary other than their `Accept-Encoding`. You should always test and verify that you’re not serving the wrong variant.

I hope I’ll find that your HTTP/2 cache-pushing websites support the `Save-Data` header whenever I next visit it from an expensive mobile plan! Maybe you’ll even find the time to do some [more Save-Data optimizations](https://www.ctrl.blog/entry/http-save-data/) while your at it.

**Update** (2020-11-30): Chrome has announced plans to [remove support for server push](https://www.ctrl.blog/entry/http2-push-chromium-deprecation/).

#### Sources

- [Preload](https://www.w3.org/TR/preload/?ref=ctrl.blog), 2017-08-30, Specification Working Draft, World Wide Web Consortium (W3C)
- [HTTP Client Hints](https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-client-hints-04?ref=ctrl.blog), 2017-04-18, HTTP Working Group, Internet Engineering Task Force
- [Data Saver](https://web.archive.org/web/20171114184320/https://developer.chrome.com/multidevice/data-compression), Chrome for a Multi-Device World, Google Developer
- [RFC 7540: Hypertext Transfer Protocol Version 2 (HTTP/2)](https://www.rfc-editor.org/rfc/rfc7540.html?ref=ctrl.blog), 2015-05, Internet Engineering Task Force
### Podcast hosts shouldn’t read ads to maintain trust
URL: https://www.ctrl.blog/entry/podcast-host-read-ads/
Last updated: 2026-08-23T22:15:44.000Z
Podcasts “leverage the relationship between a show host and their listeners” to push products and services in their adspots. I recently had a frustrating experience where I realized that I’d internalized something I’ve heard read aloud over and over by a podcast host as a genuine endorsement. It shattered the trust I’ve built with this host and made me question their integrity and how podcast advertising works.

Host-read ads are the most common form of advertisement on podcasts. These are either the regular program host reading from a script provided by the advertiser, or it’s the host coming up with some talking points about the company on-the-spot. It can be *hard to distinguish from the main content*, especially when guests on the program inject their own comments to the advertisement — just like they would during any other part of the program

It’s no accident that this has become the preferred advertisement format. Quoting from [a 2015 piece in The New York Times](https://www.nytimes.com/2015/07/27/business/media/ads-for-podcasts-test-the-line-between-story-and-sponsor.html?ref=ctrl.blog) about podcast advertising:

> “Advertisers are naturally attracted to being associated with well-liked hosts. **‘When the host is personally reading the ad and telling a story about the product in her own words, it lands with the audience in a different and more authentic way than a traditional ad spot,’** said Mark DiCristina, marketing director at MailChimp, an email marketing company that’s one of the most prolific podcast advertisers.”

A [Best Practices in Podcast Advertising](https://web.archive.org/web/20180209042445/https://blog.audioboom.com/best-practices-in-podcast-advertising-62db494e0307) from audioBoom, a podcast advertisement broker, is very straight forward:

> “\[T\]he true value of podcast advertising lies in an advertiser’s ability to leverage the relationship between a show host and their listeners.”

I conducted a very unscientific survey of the most recent episodes from the 33 podcasts that I’m currently subscribed to. All but four had host-read ads. Some podcasts play a small jingle before and after their ads, and others play some low-key background music while they read the ads. Most however, went straight from content to ads without even a small break of silence in between. The average host-read adspot in my own unscientific survey lasted three minutes and twenty seconds.

In talk-show style podcasts, guests and co-hosts would even drop in comments and discuss the advertiser during the ad read. There were generally very little differentiation between the programming and the advertisement.

This style of advertisement seem to be quite profitable too. 60 % of podcast advertisement revenue in 2016 came from host-read ad spots, according to [a study](https://www.iab.com/wp-content/uploads/2017/06/PwC%5FIAB-Podcast-Advertising-Study%5FFY2016%5FFinal.pdf?ref=ctrl.blog) by PricewaterhouseCoopers. The study was sponsored by the Interactive Advertising Bureau (IAB) and several of the largest podcast networks and producers.

### The trust issue

I recently [wanted to move to a new domain registrar](https://www.ctrl.blog/entry/getblog-registrar-gone/) and was in a bit of a hurry to get it done. I recalled having heard or read good things about Hover.com and that others liked it. I follow a lot of blogs written by techies, and seemed to remember that I’d heard about it through them. I didn’t do my research here and was [quite disappointed with Hover.com](https://www.ctrl.blog/entry/review-hover-registrar-transfers/).

After I reviewed what had happened and lead up to the decision, I realized that I’d been influenced by ads. I didn’t have any memory of anyone giving a positive review of Hover. I’d problems finding any positive reviews of their services on the web that don’t contain a paid affiliate link. What I did remember was podcast hosts reading ads for Hover.com.

I felt deceived, and I still feel like my trust was violated. I’m also angry with myself for not realizing that I’d been influenced by ads. Podcast ads tend to be quite long, which is just yet another way they mix in with the regular content.

Advertisers buy adspots to reach new and influence potential buyers and decision makers. I’m not fundamentally against the idea in any way. I run ads on my own blog. However, I don’t like the increasing adaptation of advertisement into the main content. So-called “native advertisement”. Native ads are styled to mimic the content their included with, whether that be an audio program or a website.

The problem is that when you can’t clearly tell the content and advertisement apart, you blur the lines between what a host says is authentic and can be trusted — and what is financially influenced or even dictated by an advertiser. We *trust familiar voices*, and I at least feel very familiar with the hosts I’ve listened to regularly for years if not decades.

I made a list of the podcasts that I listen to with host-read advertisements, and unsubscribed from a quarter of them. This was a away overdue cleanup of the shows I spend my time listening to, but I unsubscribing also gave me a way to signal my annoyance with how these shows are monetized. It gave me some way to assert a little bit of control.

### Hosts shouldn’t read ads

I feel pretty strongly now that hosts shouldn’t read ads. It interferes with their credibility on almost any type of show. A different voice should read the ad, or an ad produced by the advertiser should be played instead. The thing with podcasts is that you may be doing other things while listening to them. You may not hear the ad jingle or pay fully attention when a section of a show is introduced as an advertisement. Properly distancing advertisements from content is tricky in an audio-only form, and even more difficult when you only hear the same voice.

I don’t believe podcast hosts can be both a trusted voice and the voice of an advertiser at the same time. I’ve thought about this many times over the years, but this hasn’t affected me directly before since podcast ads have been largely focused on U.S. audiences/consumers.

I believe methods like *programmatic ad insertion* could help podcasters better monetize their international audiences and diversify income by not being reliant on one big advertiser. I’ll write more about this later in [a separate article](https://www.ctrl.blog/entry/programmatic-podcast-ads/). Programmatic ads and dynamic ad insertion would also help ensure the podcast host doesn’t know who the advertisers are going to be, and thus can’t influence the program as they’d be entirely removed from the production process.

#### Sources

- [Best Practices in Podcast Advertising](https://web.archive.org/web/20180209042445/https://blog.audioboom.com/best-practices-in-podcast-advertising-62db494e0307), 2017-08-24, Jeremy Helton, audioBoom
- [IAB Podcast Ad Revenue Study: An Analysis of the Largest Players in the Podcasting Industry](https://www.iab.com/wp-content/uploads/2017/06/PwC%5FIAB-Podcast-Advertising-Study%5FFY2016%5FFinal.pdf?ref=ctrl.blog), 2017-06-22, PricewaterhouseCoopers, sponsored by the Interactive Advertising Bureau (IAB), and major podcast networks and producers
- [Ads for Podcasts Test the Line Between Story and Sponsor](https://www.nytimes.com/2015/07/27/business/media/ads-for-podcasts-test-the-line-between-story-and-sponsor.html?ref=ctrl.blog), 2015-07-26, Dino Grandoni, Business Day: Media, The New York Times

Feature image based on a photo by © 2016 Barthy Bonhomme.
### I regret transferring my domains to Hover
URL: https://www.ctrl.blog/entry/review-hover-registrar-transfers/
Last updated: 2026-08-23T22:18:28.000Z
I got a bit [upset with my old domain registrar](https://www.ctrl.blog/entry/getblog-registrar-gone/), and wanted to move my .blog domain away from them as quickly as possible. In my rush to transfer to a new registrar, I didn’t do proper research and ended up over at Hover.com.

My first choice of registrar was Namecheap.com. Despite the cheap name, they’ve a better reputation than Hover.com and I was more impressed with what they offered and they’re also cheaper. Unfortunately, Namecheap.com doesn’t support transfers of .blog top-level domains, so they were not an option.

I thought I remembered hearing good things about Hover.com, so I went with them without any further research. Some time later, I realized that I’d only [heard podcast hosts praise the service](https://www.ctrl.blog/entry/podcast-host-read-ads/) in their ad readings.

Here are my experiences with transferring half a dozen domains as a new customer.

### Handing over control of your domains before they know who you are

You can’t register an account at Hover without making a purchase. This isn’t much of a worry when purchasing a new domain name. You don’t have anything to loose, and you’ll give your email address to Hover, and then pay for their domain services. The on-boarding process for new customers is a-okay.

When you want to transfer a domain, the process will put your trust of Hover to the limit. Without having the option to register an account first, you’re asked to input the domain transfer authentication code and click a link in an email sent to the domain owner’s designated contact address. So, you’re handing over everything someone would need to take control of your domain who’ve you haven’t registered with before Hover and you’ve agreed on a contract.

This process set off a lot of alarm bells in my mind, but I still persisted through the process. I was worried about my web browser crashing and loosing its cookies, or that Hover would somehow loose track of the transaction. There was also the potential that Hover could just cease my domain name and refuse to return it before I paid a much higher price for the transfer than the price listed on their website.

To put it mildly I found the whole process very uncomfortable. Hover.com haven’t bothered with an Extended Validation certificate for their website either, meaning it was hard to verify that the server I’d connected to was in fact owned and operated by Hover. I spent a good quarter of an hour verifying that I was connected to Hover and that this was indeed the transferal process I should be expecting. It was **almost unbelievable to me** that they’d ask for all this much information without first getting my email address and credit card on file.

I found it unbelievable that they’d let me put in all this sensitive information without requiring me to agree to their terms of service also. Hover.com shouldn’t teach their customers to be this trusting and willing to give up control of their domain names.

To clarify, the email address Hover sent confirmation emails to was my WHOIS or domain registry information. This address is often invalid or operated by the previous registrar as a privacy measure to protect your actual email address from being picked up by spammers.

### Unavoidable downtime

I got another unpleasant surprise once I’d confirmed that transferal of my domain, created my account, and paid.

When I last transferred a couple of domains between registrars, the new registrar didn’t complete the transfer until I’d entered my DNS information in their web interface and confirmed I that they should complete the transfer process.

At Hover, however, you can’t set name servers or add DNS entries until the domain transfer is completed. Hover also doesn’t copy over your existing name server or even the bare minimum of your DNS entries when they setup your domain. Meaning your domains will revert back to their default name servers upon the completion of the transfer process. Since your domain’s DNS will be wiped out, you’re left with a domain name that doesn’t work until you can re-configuring the domain.

Hover has a sleek web interface for configuring your name servers, or DNS entries if you wish to host your DNS with them (free of charge.) The web interface doesn’t work while your domain is pending transfer, however. When I tried to add an entry, all I got was error messages from their PowerDNS server. This isn’t a new problem either, as I found others complaining about this all the way back in March 2014.

I’ve never had this problem with any registrar going back to the first time I moved from one registrar to another some 15 years ago. Historically, my new registrar would clone my entire DNS zone file from the old registrar. This practice is blocked by most DNS providers nowadays over security concerns. However, probing and copying the critical A and MX records to keep the domain functional has always been possible — even if this isn’t a complete migration.

Downtime isn’t entirely unavoidable if you’re willing to put even more blind trust in Hover and their employees.

### *We’ll take care of it! Just give us your passwords!*

Hover offers to solve the DNS migration problem for you for any number of domains with their no-cost *Valet Transfer Service*. All you need to do is add billing information to your Hover account, give their customer support department a list of the domain names you want to transfer, **your account password at your current registrar**, and off they’ll go.

I’ve already mentioned that Hover made me feel unease about their security practices. Asking their customers to hand over account passwords to competing services is taking that uneasy feeling to a whole new level.

People will have their credit card information on file with their old registrars. Their personal information will already be available to Hover, and their credit cards too. I do suspect — at least hope — that Hover’s support staff can’t see your credit card information in their own systems. But they may have access to it after you’ve given them access to your account at competing service.

No company should be asking for your passwords and especially not ask you to hand if off to a random employee.

It’s interesting to note that their support staff apparently has the ability to add DNS records to domains before they’re transferred while customers can’t do this with self-service.

### Failing to transfer .blog domain

Before the transfer, I checked that my domain’s WHOIS information clearly said “CLIENT TRANSFER PROHIBITED”. Which means the old registrar doesn’t permit other registrars to initiate any requests to transfer the domain. This is called a domain lock, and is something the customer usually have to turn off themselves before transferring the domain name.

Hover incorrectly identified my domain as unlocked and said it was ready for transfer. I went ahead and tried transferring it, and *unsurprisingly it failed* as the domain was locked. In an automated email from Hover, they even incorrectly misidentified the problem and laid the blame on me: “Your transfer of ctrl.blog to Hover failed because the transfer auth code provided was incorrect.”

I then unlocked the domain at my old registrar, verified that the WHOIS had been updated, and entered the exact same authentication code again to complete the transfer. This time the transfer went through just fine.

Even though my old registrar also [had bad processes for domain transfers](https://www.ctrl.blog/entry/getblog-registrar-gone/), the blame for this one clearly lies with Hover. I’m not sure if they just couldn’t parse the WHOIS information properly or if there was some other bug. Whatever the reason, my old registrar did clearly indicate that the domain was not available for transfer and Hover failed to process that information correctly.

I’ve checked with a dozen other .blog domains, and Hover’s transfer tool incorrectly says they’re all unlocked and ready for transfer. It’s making a bit more sense to me now that Namecheap.com said they didn’t support transferring .blog top-level domains. Apparently, you need to do proper testing to verify that things work when you add support for a new TLD. Something that Hover clearly hasn’t done for .blog domains.

### Conclusion

Hover.com’s website is pretty to look at, but it’s clear that they’ve spent more effort on making it look good than verifying that things work properly.

I went through an emotional roller coaster when transferring my domain names to Hover. I felt everything from distrustful, uncertain, annoyed, frustrated, and most of all disappointed. I soon had to add anger to that list after learning that Hover’s **renewal prices for .com is 15.4 % higher** than their already expensive domain prices. This wasn’t at all clearly communicated when I made the purchase! These aren’t the sort of feelings you wish your customer to associate with your brand.

Hover’s premium prices and good looks don’t mean you’ll get a premium domain service.

There’s an honor system among domain registrars. When transferring-in, they’ll only charge a regular 1-year fee for the domain and then add it on top of any remaining expiration time. They’ll honor the expiration time so you as their new customer don’t loose anything by switching domain provider early.

Most of my domain names are now under a transfer lockdown period for the next two months. At the end of this period, I’ll be reviewing other options — more carefully this time — because Hover wasn’t my cup of tea. ?

**Update** (2017-11-23): You can now read [part two](https://www.ctrl.blog/entry/hover-trouble-continued/) about the trouble I’d transferring domains away from Hover. It’s more of the same sort of problems as mentioned here, to be honest.

#### Sources

- [FAQ: Valet Transfer Service ](https://web.archive.org/web/20180919094227/https://help.hover.com/hc/en-us/articles/115005153907-FAQ-Valet-Transfer-Service), 2017-08-29, Blair M., Hover Help, Hover
- [The New Hover Control Panel is Here](https://hover.blog/new-hover-control-panel/?ref=ctrl.blog), 2017-05-25, James Koole, Hover blog, Hover
- [Untitled email](https://web.archive.org/web/20170905052519/http://commonage5.rssing.com/chan-4022739/all%5Fp116.html#item2320), 2014-03-16, Unknown author, Domains in Office 365 mailing list

**Reviewed:** [Hover.com](https://www.hover.com/domains?ref=ctrl.blog)

**Review rating:** 2 / 10
### Charge devices faster with a new USB 3.1 Type-C controller
URL: https://www.ctrl.blog/entry/review-asm1142-linux/
Last updated: 2026-08-23T22:17:24.000Z
My computer’s mainboard, an ASRock H270M Pro4, has a USB 3.1 Type-C connector port. However, it’s power delivery capabilities were quite underwhelming. I thought I’d look into the issue with [a USB multimeter](https://www.ctrl.blog/entry/review-delock-usbc-vameter/) to investigate why my devices weren’t quick-charging. My investigation lead me to add-on a new USB 3.1 controller that was capable of delivering the promised power output of a Type-C connector.

Although the H270M mainboard’s USB-C port supports the full USB 3.1 Gen 1 specification when it comes to data speeds (5 GBps), it’s power delivery capabilities were capped at that of USB 2.0\. That is to say, 0.45 ampere (A) at 4.45 volt (V), or just shy of 2 watt (W.) That is just ⅙ the power of my Nexus 5X’s original USB Type-C charger. No wonder my phone didn’t charge quickly from the USB-C port on my computer! For reference, the best performing USB 3.1 Type-A port on the same mainboard yields up to 0.65 A and 4.6 V, or 2.95 W.

So, my mainboard’s USB-C port was no good for charging anything. After reading up on the subject, I decided to upgrade my PC with another Type-C port which promised higher power delivery rates. The ASRock USB 3.1 (type A+C) PCI Express card was a natural choice, as it was the only card with documented support for Linux as well as Windows — and surprisingly even MacOS as well.

This PCIe card is a bit on the pricey side, but any card featuring the ASMedia ASM1142 chipset should have the same overall performance and power characteristics as the ASRock model I chose. The ASRock USB 3.1 (type A+C) features one USB 3.1 Type-A and one Type-C connector port. You can find other models from other manufacturers with the same chipset featuring two of the same port, if that’s more to your liking.

I’m happy to report that the ASM1142 works flawlessly without the need to install any additional drivers in Linux kernel 4.12 and in Windows 10 Creators Update. My computer did freak out and rebooted from Windows 10 without a bluescreen the first time I plugged in a USB Type-A cable in the card. However, I haven’t had any trouble with it in either Linux nor Windows other than that one-time incidence.

Using my USB-C multimeter, I was able to verify that my Nexus 5 X and a Samsung Galaxy S8 control device charges at full speed at 2.45 A at 5 V (12 W) off the Type-C port on the ASRock USB 3.1 (type A+C.) The ASRock card is advertised as supporting up to 3 A at 5 V (15 W.) This is six times the charging speed I got from my computer’s built-in USB-C port, and identical to the power delivered by the chargers that originally came with each phone.

The Type-A port on the ASRock USB 3.1 (type A+C) is also better than the best performing Type-A port on my mainboard. The ASMedia card delivered 0.7 A at 4.85 V (3.4 W), compared to 0.65 A and 4.6 V (2.95 W) from the mainboard. The ASRock card is advertised as supporting up to 1.5 A at 5 V (7.5 W.)

The product documentation on the ASRock USB 3.1 (type A+C) card says:

> “For charging Type-A USB devices, we suggest using the Type-A connectors on your motherboard.”

I’m not clear what this warning is meant to suggest. There’s more than enough power through the PCIe 2.0 x4 connector to charge an USB-A and C device at the same time while delivering the maximum supported power on both ports. as mentioned already, my computer did a unexpected reboot the first time I used the Type-A port in Windows 10, but that only happen once! I’ve contacted ASRock about this and will update the review when I get a reply.

During my testing, I got very consistent power reading at each port. However, I also noted that the different USB 3.1 Type A ports on my mainboard gave off ampere from 0.45 to 0.65 and voltage from 4.3 to 4.65\. This may be an indication that the power management on my ASRock H270M Pro4 mainboard may not be the best.

Unfortunately, I don’t have any device or test equipment available that will let me test the full data transfer speeds of the ASM1142.

All tests with USB-C–C cables where performed using two different Apple USB-C Charge Cables, as well as the original cables that came with the Nexus 5X and Samsung Galaxy S8\. I’m happy to report that [my test USB Type-C volt-/ammeter](https://www.ctrl.blog/entry/review-delock-usbc-vameter/) didn’t detect any notable difference in the cables whatsoever. Notably my multimeter isn’t all that accurate – and I don’t have the proper testing equipment to fully test the max load or USB Power Delivery handling.

#### Sources

- [Nexus Quick Charging explained](https://pocketnow.com/nexus-quick-charging-explained/?ref=ctrl.blog), 2015-10-14, Joe Levi, Pocket Now
- [USB Power Delivery](https://www.usb.org/usb-charger-pd?ref=ctrl.blog), USB Implementers Forum
- [ASRock USB 3.1 (A+C)](https://www.asrock.com/mb/spec/card.asp?Model=USB%203.1%2FA%2BC&ref=ctrl.blog), Products, ASRock
- [ASMedia ASM1142](https://web.archive.org/web/20171113181247/http://www.asmedia.com.tw/eng/e%5Fshow%5Fproducts.php?item=155), Products, ASMedia
- [ASRock H270M Pro4](https://www.asrock.com/mb/Intel/H270M%20Pro4/?ref=ctrl.blog), Products, ASRock

**Reviewed:** [ASRock USB 3.1 (type A+C)](https://www.asrock.com/mb/spec/card.asp?Model=USB%203.1%2FA%2BC&ref=ctrl.blog)

**Review rating:** 8 / 10
### Documentation for Cache-Control plugin for WordPress
URL: https://www.ctrl.blog/entry/wp-cache-control-documentation/
Last updated: 2026-08-23T22:25:51.000Z
### Introduction

The *Cache-Control plugin for WordPress* lets you set the *cache freshness duration* for dynamically generated pages on a WordPress website through the use of the Cache-Control HTTP response header. The plugin isn’t a cache plugin in itself, but can be used to control the behavior of standard HTTP caches such as browser caches, reverse proxies, content delivery networks (CDN), and web accelerators.

You set the cache freshness as the most number of seconds from the page was initially loaded that it’s acceptable for website visitors to be served a cached version of a page. The desired freshness duration will vary from page to page within a given website, but also from website to website. A longer freshness duration can save you bandwidth costs and money, and it can also help speed up your website. However, you must balance that between how frequently content is updated and how acceptable it’s for visitors to see cached and potentially old pages.

Additionally, you can set error and cache-updating behavior in modern caches by configuring stale-cache handling.

Some familiarity with caching in HTTP will be required. [Section 5.2](https://www.rfc-editor.org/rfc/rfc7234.html?ref=ctrl.blog#section-5.2) in or the whole of [RFC 7234](https://www.rfc-editor.org/rfc/rfc7234.html?ref=ctrl.blog) can get you up to date. For stale cache handling specifically, you should also refer to [RFC 5861](https://www.rfc-editor.org/rfc/rfc5861.html?ref=ctrl.blog).

### Configuration

The plugin can be configured for your WordPress administration area. Go to Settings: Cache-Control to see the options page.

All options within the plugin is set in seconds. Any option set to 0 seconds will omit the given omitted the given field from the Cache-Control header. Setting all options for a given type of pages to 0 seconds will make it uncachable. Uncachable pages

Each type of page must be configured separately. You can override the plugin and do entirely custom handling for specific request or type of pages using your criteria using the `cache_control_cachedirective` filter hook. See the [HACKING file](https://plugins.trac.wordpress.org/browser/cache-control/trunk/HACKING?ref=ctrl.blog) in the plugin installation directory for details.

### Configuration fields

The following fields can be configured within the plugin administration page. Each field matches the corresponding Cache-Control HTTP header as defined in [RFC 7234 Section 5.2](https://www.rfc-editor.org/rfc/rfc7234.html?ref=ctrl.blog#section-5.2).

#### max-age (private cache)

Sets the number of seconds a page can be cached before it should be refreshed. This is the simplest field required for caching to work in most clients, and the only field which is set by default.

#### s-maxage (shared cache)

Sets the number of seconds a shared cache can store a page in its cache. A shared cache is a cache designed to be used by more than one device or visitor, such as a reverse proxies, content delivery network (CDN), or a web accelerator.

This option allow you to instruct intermediary caches to refresh cached resources more or less often than a private cache. In many situations, you may want a shared cache to update more often than a private cache.

If no shared cache duration is set, then the configured private cache duration is inherited for use by shared caches.

#### stale-if-error

Sets an additional number of seconds after a cached page has expired in the cache which stale copy of a page can be returned from the cache if your web server returns an HTTP error. For many websites, it’s undesirable to return an error message when an older cached copy of a page can be served instead.

This can be set to hours or even days to help ensure your website remains available. This option is typically only desired when using a reverse proxy or a content distribution network.

You must also specify a private or shared cache duration to use this option.

#### stale-while-revalidate

Like the `stale-if-error` option, but doesn’t depend on the original web server returning an HTTP error code. This option allows shared caches to keep serving cached copies to visitors for a number of seconds while updating the cached copy in the background. This can greatly improved page loading times for visitors won’t have to wait for pages to be updated.

This should be set to minutes, hours, or even days depending on how fresh you need your content to be. Note that you can likely benefit from decreasing the maxage option in favor of a longer `stale-while-revalidate` duration when using a reverse proxy or content distribution network. You should [test and verify](https://www.ctrl.blog/entry/how-to-test-stale-while-revalidate/) that stale-cache handling works on your infrastructure before deploying it.

You must also specify a private or shared cache duration to use this option. This option can be used in addition to `stale-if-error`.

#### Static resources

This plugin only works with dynamic pages generated by WordPress itself. You should also set Cache-Control headers manually in your web server configuration for images, scripts, stylesheets, redirects, and other static resources. Please refer to the documentation for your web server for details.

### Extended feature set

In addition to controlling standard HTTP caching behavior, the *Cache Control plugin for WordPress* has a number of additional advanced features.

#### Scheduled posts

You can safely set long private and shared cache freshness duration as dynamic pages (indexes, feeds, taxonomies, searches, others) will dynamically reduce their max caching duration to a few seconds after a scheduled post is published. After a scheduled post has been published, affected pages return to normal caching duration. Every dynamic page will not expire at the exact same time by introducing some random number of seconds delay to mitigate “the thundering herd” problem.

Note that the stale-cache handling options are unaffected by scheduled posts. Intermediary caches will, however, be instructed to refresh their copies earlier than normal as pages will expire quicker.

#### Increasing pagination factor

When this option is set, older pages in to paged indexes will be cached for longer than newer pages (as determined by page number.) The configured pagination factor is added to the main maxage and s-maxage options. This allows less popular archives to be served as stale for longer.

For example, the *8th* tag archive page with a pagination factor of 80 will have a max-age of `max-age + (80 * 8)`.

Set this to 0 seconds to disables this feature. Index sorting order doesn’t affect this option.

#### Old-age multiplier

When this option is set, the `max-age` and `s-maxage` values will be multiplied by the number of years since the last edit or comment (the Last Modified time.) The factor uses a monthly precision. This allows posts that were published a long time ago and that haven’t been changed for a long time to be cached longer than newer posts.

For example, a post that hasn’t been modified or had a new comment in *3 months* (¼ of a year) will be cached for `max-age * 1.25`.

This feature works better with the [*Mintor Edits* plugin](https://wordpress.org/plugins/minor-edits/?ref=ctrl.blog) installed. This plugin prevents tiny and unimportant edits from changing the Last Modified time of a post.

#### Delta feed updates

You can improve reduce bandwidth usage of web syndication feeds (“RSS”) by offering [feed delta updates](https://www.ctrl.blog/entry/feed-delta-updates/). The [*Feed Delta Updates* plugin](https://www.ctrl.blog/entry/wordpress-feed-delta-updates/) for WordPress enables this feature on your website, and works great with the Cache-Control plugin for WordPress.

#### Supports WooCommerce

After you install the popular WooCommerce plugin for WordPress, additional options will appear in the administration interface for configuring WooCommerce specific page types.

### Security considerations

By default, the plugin will mark any of the of the following pages uncachable:

- The WordPress login page (wp-login)
- Any page from the WordPress administration area (wp-admin)
- Pages loaded by a user who is logged in
- Post previews
- Unknown or custom page types (see the plugin administration page)

These defaults should prevent information leakage about administrative or user accounts on a default WordPress installation that hasn’t been modified by plugins or the user. It’s **your responsibility** to verify that you’ve implemented caching correctly and that you don’t cache pages you don’t want to be saved.

By default, WordPress may modify and potentially leak information about people who leave comments on your WordPress website through its poorly conceived auto-fill feature. You can mitigate this by [disabling the commenter cookie in WordPress](https://www.ctrl.blog/entry/wordpress-localstorage-commenterdata/). You can still keep this functionality without the cookie by moving the data storing [from cookies and into localStorage](https://www.ctrl.blog/entry/wordpress-localstorage-commenterdata/) in the visitors browser.

You may be interesting in reading my feature articles on [HTTP](https://www.ctrl.blog/tag/hypertext/) and [caching](https://www.ctrl.blog/tag/http-caching/)!

WordPress is a trademark of WordPress Foundation.
### Accelerate redirects with HTTP/2 server push
URL: https://www.ctrl.blog/entry/http2-push-redirects/
Last updated: 2026-08-23T22:11:42.000Z
You can achieve low-latency responses to redirects with HTTP/2 by pushing the resource at the redirected location along with the response that informs the web browser about the redirect. It’s even easy to set up.

Traditional HTTP redirects have required clients to first wait for the server to tell them about the redirect, and then issue a new request to the redirected location. This extra round-trip back and forth between the browser and server introduce higher latency times before the final resource is delivered to the client.

A HTTP/2 compatible server can be configured to handle redirects in a much more efficient way and remove the latency penalty. When a HTTP/2 server handles a redirect, it can not only inform the client about the redirect — but also preemptively push the new location to the client even before it knows it has to request it.

At the time of writing, few HTTP/2 capable clients and servers have implemented cross-origin push handling yet. However, as long as you’re redirecting within the same protocol and domain, you can benefit from pushing any redirects within the same origin. HTTP/2 push delivery is supported by recent versions of all major web browsers including Firefox, Google Chrome, Microsoft Edge, and Safari.

Server initiated push can be implemented in many different ways. The method that has caught on with web developers and server implementors alike involve introducing a simple HTTP `Link` response header. This can easily be added in on existing server and backend solutions, with the server handling the details. Since this method is easy to explain, I’ll show you how it can used to automatically adding server push support to your existing redirects.

Below, you’ll see a simple `Link` response header that would instruct a HTTP/2 capable server to push `https://www.example.com/new-location` to the client:

```
Link: <https://www.example.com/new-location>; rel=preload
```

By including this response header, you can push any number of supplemental resources to the client. Common examples of other types of resources that could be pushed with this method include critical stylesheets and scripts required for a page to render quickly. Any resource can be pushed to the client, but websites should take care to not over-do it by pushing overly large resources. Developers should also avoid pushing the same resources multiple times to the client and rather leverage client-side caching.

You can easy add this header to any redirects by copying the contents of the `Location` response header. The `Location` header is required for redirects and must contain an absolute URL pointing to the redirected location.

The following is a Varnish Cache configuration example, that doubles as pseudo-code to show you how you can turn a plain old redirect to a redirect that also pushes the final destination location:

```
sub vcl_deliver {
  if ((resp.status == 301 || resp.status == 307 ||
       resp.status == 302 || resp.status == 308)  {
    if (resp.http.Location ~ "^https://www\.example\.com/") {
      set resp.http.Link = "<" + resp.http.Location + ">; rel=preload; as=document"
} } }
```

Depending on your choice of web server and infrastructure, adding the `Link` response header may be enough to enable HTTP/2 server push. For Apache, IIS, and Nginx, the above should be enough assuming the additional header is introduced at the right time in the processing chain. HTTP/2 server push can be implemented in a number of ways, and you risk not introducing preload `Link` header early enough in the processing chain. You should make sure to test and verify that your setup works.

You can also introduce this header in your application backend when creating an redirect. You’ll likely have the best information about the redirect at the time the redirect is created, so that’s a good time to include the `preload Link` header.

Here is an example using `mod_rewrite` to have the Apache HTTP Server produce the header when redirecting from `/old/` to `/new/`:

```apacheconf
RewriteCond %{REQUEST_URI} "^/old/(.*)"
RewriteRule "^/old/(.*)" /new/$1 [redirect=301,env=h2pushredir:/new/$1]
Header always append "Link" "<%{h2pushredir}e>; rel=preload; as=document" env=h2pushredir
```

Lastly, I’d also like to stress the importance of testing that your implementation **detects and cancels redirect loops**. If you implement automatic redirect pushing using a method similar to the one I outlined above, It would be most unfortunate to get your server stuck pushing an infinite number of redirects to a client in an newer ending loop.

### Predictions

**Update** (2020-11-30): This didn’t turn out quite the way I’d envisioned. Chrome has announced plans to [remove support for server push](https://www.ctrl.blog/entry/http2-push-chromium-deprecation/).

Within a few years, I expect that we’ll see most HTTP/2 web servers automatically push the new location along with any redirects they serve. (At least within the same origin.) It greatly improves performance of redirects, reduces latency, and it’s so easy to implement!

Web servers will need to identify and put in place protections against redirect loops, but other than that: there shouldn’t be any roadblocks to enabling redirect-pushes by default.

At the very least, web servers will implement redirect-pushes by default for any redirects that have been created through server configuration. They may choose to not interfere with any redirects issues by a higher level applications, but I don’t see any major reasons why they wouldn’t want to handle those as well.

Until web servers start taking care of this on their own, web developers need only spend a few minutes of their time to speed up all redirects. —and we all want faster redirects, right?

#### Sources

- [Preload](https://www.w3.org/TR/preload/?ref=ctrl.blog), 2017-08-30, Specification Working Draft, World Wide Web Consortium (W3C)
- [RFC 7540: Hypertext Transfer Protocol Version 2 (HTTP/2)](https://www.rfc-editor.org/rfc/rfc7540.html?ref=ctrl.blog), 2015-05, Internet Engineering Task Force
- [RFC 7231: HTTP/1.1: Semantics and Content](https://www.rfc-editor.org/rfc/rfc7231.html?ref=ctrl.blog), 2014-06, Internet Engineering Task Force
### FSFE: Publicly funded software has to be Free
URL: https://www.ctrl.blog/entry/public-money-public-code/
Last updated: 2026-08-23T22:16:09.000Z
The Free Software Foundation Europe (FSFE) has published an open letter to EU legislators. The organization calls for new legislation that will require code paid for by the people to be made available as Free and open-source software. *“Public Money? Public Code!”* 

The [open letter](https://web.archive.org/web/20170913092729/https://publiccode.eu/openletter/), signed by tens of organizations and thousands of individuals, calls on EU legislators to:

> “Implement legislation requiring that publicly financed software developed for public sector must be made publicly available under a Free and Open Source Software licence.”

The FSFE brings up all the usual benefits in its arguments for requiring that public software is developed in the open: tax savings, collaboration between local governments within and beyond nations, and fostering innovation and security research.

Do neighboring counties (or even countries) need to reinvent the wheel and reproduce the same code and functionality to solve the same problems? Do our society get the most value out of privately owned software or software owned by the people?

Private ownerships over critical software infrastructure support monopolies and hinder competition. Governments shouldn’t run on licensed software it doesn’t control. It gives private companies too much control over how public software works and even whether public service remains operative.

Public funds shouldn’t be used to develop software that puts the profits and interests of corporations before the general public. Public money should *only* fund public code.

I agree with the Free Software Foundation Europe’s goal in this campaign. Public money shouldn’t go to privately controlled and owned software. Governments should require that the public owns the software that the government depends on to provide public services.

A small subsection of software components may need to be developed and kept out of the public’s view. However, I believe this should be the exception and not the norm for publicly funded software projects.

Software developed for our governments should belong to the people. The people can be a valuable contributor to the development of software instead of only getting the opportunity to complain about a finished software work that doesn’t fulfill their needs after a secretly developed project is made available to the public.

To be clear, I don’t have anything against private contractors contributing to public software. However, the work must be undertaken in the public view — following open development processes. This not only allows for early feedback from other interested parties but from the public at large.

I urge you to [read and sign the open letter](https://publiccode.eu/?ref=ctrl.blog). Sign the letter if you believe that tax-payer funded software should be required to benefit and be open to the public instead of being owned and controlled by private companies. Restrictively licensed software that isn’t owned by the public shouldn’t be the product of any publicly funded project.

Signatories to the open letter include the Free Software Foundation Europe (FSFE), Open Source Initiative (OSI), European Digital Rights (EDRi), The Document Foundation, Debian Project, openSUSE, KDE e.V., among other open-source and digital rights advocacy groups.

#### Sources

- [Open letter](https://web.archive.org/web/20170913092729/https://publiccode.eu/openletter/), 2017-09-13, Free Software Foundation Europe
- [Public Money? Public Code! 31 organisations ask to improve public procurement of software](https://fsfe.org/news/2017/news-20170913-01.en.html?ref=ctrl.blog), 2017-09-13, Free Software Foundation Europe
### Don’t register your domains with Automattic
URL: https://www.ctrl.blog/entry/getblog-registrar-gone/
Last updated: 2026-08-23T22:08:02.000Z
Automattic rearranged their domain business at the beginning of the month, and they didn’t bother telling their customers about the changes. I was afraid that my domain had been hijacked! This will be a fairly lengthy but thrilling tale of poor planning, execution, and customer communication.

Automattic, the company behind WordPress.com, secured the rights to the .blog top-level domain in late 2016. At launch, you could register a .blog domain name through WordPress.com or Get.blog, both operated by Automattic. Other registrars soon started offering the domain name as well.

I though it would be a good idea to register [my own .blog domain](https://www.ctrl.blog/entry/rebrand-ctrlblog/) through Automattic, and more specifically their Get.blog service. I don’t use hosted WordPress .com services so I wanted to keep my domain separate from that service. Cutting out a middleman registrar and getting the domain directly from Automattic was appealing to me.

As of the start of September 2017, Get.blog was shut down as a separate registrar service. Customers were moved over to WordPress.com *without any prior notice.*

The first I heard of the changes was this scary looking email from WordPress.com on September 4th:

> “**Custom Domain for ctrldotblog.wordpress.com**”  
>  
> “Howdy, you recently asked us to activate the domain mapping upgrade to use your domain name ctrl.blog as the address of your site ctrldotblog.wordpress.com”  
>  
> “In order to get things working, you’ll need to visit your domain registrar’s site and update your name servers. The registrar is the company you own this domain through, either where you purchased it originally or transferred it to.”  
>  
> “Your name servers are currently set to:  
> (my nameservers)”  
>  
> “These will need to be changed to:  
> NS1.WORDPRESS.COM  
> NS2.WORDPRESS.COM  
> NS3.WORDPRESS.COM”  
>  
> “Once you make the update, it’ll take a few hours to display your WordPress.com site at ctrl.blog.”  
>  
> “If you’re not sure how to update your name servers, please contact your domain registrar.”  
>  
> “If you need to check the status of your domain mapping upgrade, visit the Me> Manage Purchases section of your dashboard.”  
>  
> “Thanks for flying with WordPress.com”

After receiving this email, I thought for sure that my domain had been hacked! I wasn’t a WordPress.com customer, I hadn’t registered “ctrldotblog.wordpress.com”, and I’d certainly not asked WordPress.com to make any changes to my domain name!

To me, this sounded like someone had managed to exploit a flaw in the WordPress.com management platform to hijack a .blog domain. I fired off an email to WordPress.com Support stating that I’d requested no such changes and asking for clarification.

I then proceeded to attempt to login to my account on Get.blog, but the website wouldn’t load. After an hour, the page did load but the login system was disabled “while we’re making changes”.

On September 3rd, some 30 hours later, I heard back from WordPress.com:

> “Sorry about any confusion caused, the email was sent in error due to a glitch at our end.”  
>  
> “No changes were made or are needed for your domain name and the email can safely be ignored.”

“No changes were made or are needed for your domain name”, sounds reassuring. I was a bit upset that they’d not sent a follow-up immediately after having sent out the first email. Although I suspected that Get.blog would be merged into WordPress.com at this point, I’d just been assured that there wouldn’t be any changes needed.

Just 23 hours later, I received another email that went directly into my Spam folder titled “New login information for your domain” from WordPress.com:

> “**Howdy!**”  
>  
> “We’re contacting you because you purchased a domain from get.blog, a WordPress.com service.”  
>  
> “To give you the best experience we can offer, we’re merging the ease of use of get.blog with the power of WordPress.com. Starting today, get.blog domains will be managed at WordPress.com. This will give you advanced domain management tools, plus the ability to register other domain extensions (like .com, .org, and more!)”  
>  
> “Nothing changes about the domain itself. Any websites, emails, or other services you use with your domain will continue working normally.“  
>  
> “You will now renew your domains and manage them through WordPress.com instead of get.blog.”  
>  
> “Click "Create My Password" in this email. You’ll be asked to enter your email address — use the same email address you used on get.blog: \[…\]”

First thing first: never start an email asking customers to waste their time setting up new accounts and having to manage more passwords with “Howdy!” Secondly, there was no recognition in this email about the lack of prior notice and “glitched” automated emails.

I proceeded to set up a WordPress.com account to mange my domain. This is my third WordPress.com account, and I was not happy being asked to register yet another one under a different email. I wasn’t happy about this situation at all, actually!

After registering with WordPress.com, I was immediately presented with prompts to create my site on WordPress.com, and prompts to upgrade to WordPress.com Premium. I wasn’t surprised to see the upselling attempts, but it was more aggressive than I’d expected. WordPress.com had also **helped themselves to my credit card information** from my Get.blog account. The whole experience was quite unpleasant and left me with a bad impression of Automattic as a whole.

At this point, I decided to transfer my domains away from WordPress.com and find a more established registrar instead. This was, however, more difficult than expected. As it turns out, almost no registrar that let you register a .blog top-level domain will accept transfers of .blog domain names! I eventually found one, and will share my experiences with them in a separate update later.

However, transferring my domain away from WordPress.com was more difficult than expected. In the WordPress.com domain administration interface, you’ve a big green label that says “Privacy Protection: on”. Domain privacy hides your personal information form public domain registration records, and is generally a good thing. In order to transfer a domain from one registrar to another, you need to have a working email address in your public domain record (“whois information.”) I couldn’t figure out how to turn it off! Clicking on the on button took me to a screen that said it was enabled and offered me to change my details.

After three hours I found that I could cancel the domain privacy service next to the “Cancel Domain” option hidden away in the billing section of WordPress.com. After I finally managed to turn off the privacy service, I could initiate the domain transfer to my new registrar.

I moved a bunch of domains at the same time, and all transferred without incident within ten minutes. My .blog domain, however, took 14 hours to transfer. This was an early indication that WordPress.com didn’t have good procedures for handling domain name transfers.

As it turns out, WordPress.com apparently has **no routines for handling domain transfers**. After I’d moved my .blog domain name over to a new registrar, I can still manage it at WordPress.com. For whatever reason, the domain name and the ability to manage it haven’t been removed from my account. It has been five days since I transferred the domain away from WordPress.com. The interface lets me configure nameservers, change DNS entries and registration data, or even renew or cancel the domain.

I’ve contacted support to ask them why the domain haven’t been removed from my WordPress.com account following the transfer. I receive a reply a day later, and the domain was removed from my account. However, if you’ve similar problems you may not get it resolved as quickly:

> “**Limited Support Sep 11 - 18**”  
>  
> “Private *support will be closed* from Monday, September 11 through Monday, September 18, included. We will reopen private support on Tuesday, September 19.”  
>  
> “Why? Once a year, the WordPress.com Happiness Engineers and the rest of the WordPress.com family get together to work on improving our services, building new features, and learning how to better serve you, our users.”

I don’t know what Automattic were thinking here. It shows poor planning when they choose to execute a customer account transition the week before a planned company-wide seminar. It’s not the best time to shut down one’s customer support department for a week.

### Takeaways

Don’t register your domains through Automattic. The next time you’re looking for a domain registrar, go for an established and more experienced registrar.

This wasn’t a clean transition for .blog domain holders who had registered at Get.blog. Automattic should have communicated better about the transition, given prior notice (with enough time to choose another registrar), and they seriously need to work on their routines for handling domain transfers!

I’m embarrassed to admit that one of the reasons I registered with Get.blog was the dad-joke Automattic had given their domain business subsidiary: *Knock Knock Whois There, LLC*. I thought it would look cool in my whois-information. In hindsight, this was very poor judgment on my part. I also should have taken the silly company name as a red flag: Automattic seemingly don’t take their domain name business and customers all that seriously.

#### Sources

- [.blog Domains Are Now Available to Everyone!](https://wordpress.com/blog/2016/11/21/blog-domains-are-now-available-to-everyone/?ref=ctrl.blog), 2016-11-21, Sara Rosso, WordPress.com Blog, Automattic
- Automated emails from WordPress.com, and emails from WordPress.com Support staff.
### Review: Delock USB-C volt-/ammeter
URL: https://www.ctrl.blog/entry/review-delock-usbc-vameter/
Last updated: 2026-08-23T22:18:05.000Z
I needed a USB Type-C multimeter to test a couple of under-performing USB Type-C ports, and to gather some data for [another review](https://www.ctrl.blog/entry/review-asm1142-linux/) I’ve been working on. I ended up with a cheap model from German manufacturer Delock, and here’s what I think about it.

To figure out how fast a device is charging, you need to know both the voltage (V) and current (A). Historically, classic USB Type-A ports would always provide 5 volt. The USB Power Delivery (USB-PD) specification has since added the ability to let devices negotiate higher voltages.

I haven’t got access to the proper testing equipment required to fully evaluate the capabilities of this USB Type-C multimeter. However, if you’re considering getting a USB multimeter, you’ll still find useful information in this review.

The Delock volt- and ampere meter for USB Type-C is an inexpensive option for measuring a current of up to 6 ampere at up to 24 volt. That means it should theoretically support up to 144 watts (W), though no maximum power is specified (and the USB-PD standard stops at 100 W). I’ve reached out to Delock for a clarification, and will update this review when I get a reply. For reference, a current model Apple MacBook Pro chargers that use Type-C connectors delivers either 61 W or 87 W.

### Unidirectional measurements only

The male Type-C connector is quite chunky. It collides with my computer’s chassis and other cables when plugged in to my mainboard. I also can’t connect it to my Nexus 5X without removing its protective rubber bumper. I’ve looked at a few other multimeter alternatives, and all but one other model feature an elongated and slimmer design. I undervalued the benefits of these designs when I chose the Delock voltage- and amperage meter.

The male connector must be connected at the end providing the power source. Unlike every other design for a power multimeter for USB-C, the Delock **isn’t bidirectional**. This doesn’t matter much if you only intend to test Type-C cables. However, it does mean the multimeter can’t be used to measure a male Type-A to male Type-C cable. A female Type-C to female Type-C adapter can be used to work around this limitation, but this may introduce additional resistance and be a source of error in your testing.

Notably, I couldn’t find any other USB Type-C multimeters that are unidirectional like the Delock model. It seems to be a unique feature to not support bidirectional measurements. Which is extra interesting for Type-C cables, as one of their better features is that I can reverse the flow of power and charge my laptop battery from my phone – or the other way around at my choosing.

There should at least have been a switch for changing the measurement direction, even if it didn’t support bidirectional measurements.

### Reading measurements

The screen of the Delock switches every second between displaying either ampere or voltage. The current unit is indicated by lighting up a LED behind either the ampere or voltage indicators (A on top and V below). As an aside, these indicators look a lot like stepper buttons.

![Closeup of the Delock USB-C multimeter](https://cdn.synaps.media/control/content/images/2026/08/delock-usbc-vameter-closeup.jpeg)

A frustrating detail about this design is that it’s hard to read when upside down. An upside down A looks like a V and vice versa. Because of the layout of my computer setup, I’ve spent more time reading the display upside down than in the correct orientation.

The multimeter works instantly as soon as you connect a power source on the male port. As mentioned already, it’s not bidirectional. If you don’t provide power on the male port, the display will still show the correct voltage but not the current, and power will still go through the cable.

As for the accuracy of the measurements, I can’t tell for sure. What I can say, however, is in my testing I am seeing the expected results from my various USB Type-C chargers, ports, and other devices.

### Alternatives

There’s a huge selection of Type-A multimeters on the market. As USB Type-C is relatively new, your choice in multimeters is somewhat more limited. Here are two \[better?\] alternatives to the Delock USB-C multimeter.

The Pluggable USB-C Voltage and Amperage Meter supports voltages between 4 and 20 V, and current up to 10 A. It should theoretically support 200 W, which is double that of the current USB Power Delivery specification. It supports bidirectional measurements and even features a direction indicator and a proper OLED display. The design is similar to the Delock multimeter, but is possibly a better option as its not unidirectional.

Another popular option is the Satechi Type-C Power Meter. This is the most sold USB-C multimeter on Amazon.com. This is the only multimeter I’ve found that specifies its maximum load (64 W). This is lower than the 100 W maximum of the USB-PD standard, and 32 % of what you’d expect, given that it specifies the same 4–20 V at 10 A operation range as the Pluggable USB-C multimeter.

It could very well be that Satechi is just more open about their product’s limitations. It supports bidirectional measurements and also tracks milliampere per hour, which seems to be a useful and unique feature. This multimeter is encased in a sleek aluminum body rather than cheap black plastic like the two other multimeteres.

### Conclusion

There isn’t anything wrong with the Delock model other than its unidirectionality. Get yourself a bidirectional multimeter instead as this will be more flexible and let you test more types of devices and cables.

I would not buy this product again and I don’t recommend you do it either. Have a look at one of the alternatives mentioned above instead.

#### Sources

- [Delock USB Type-C Adapter with LED indicator for Voltage and Ampere](https://www.delock.com/produkt/65688/merkmale.html?ref=ctrl.blog), item #65688, Products, Delock
- [Type-C Power Meter](https://web.archive.org/web/20200731040758/https://satechi.net/collections/power-charging/products/usb-c-power-meter), Products, Satechi
- [USB-C Voltage and Amperage Meter](https://plugable.com/products/usbc-vameter/?ref=ctrl.blog), Products, Pluggable
- [USB Power Delivery](https://www.usb.org/usb-charger-pd?ref=ctrl.blog), USB Implementers Forum

**Reviewed:** [USB-C volt-/ammeter](https://www.delock.com/produkt/65688/merkmale.html?ref=ctrl.blog)

**Review rating:** 8 / 10
### Keep a record when sourcing royalty-free stock photos for your works
URL: https://www.ctrl.blog/entry/record-royaltyfree-photos/
Last updated: 2026-08-23T22:16:46.000Z
There’s a lot of awesome photographs available on royalty-free stock photography repository websites like [Pexels](https://www.pexels.com/?ref=ctrl.blog), [Pixabay](https://pixabay.com/?ref=ctrl.blog), and [Unsplash](https://unsplash.com/?ref=ctrl.blog) at no cost. But there might be an issue with one of the photos you use, so you should take some precautions to limit your risks.

Disclaimer: I’m not a lawyer and this isn’t legal advice. This article is intended to be entertainment and possibly a wake-up call. This article assumes you’re already familiar with copyright, and royalty-free licensing.

You’ve no guarantees that the royalty-free photographs you get at no cost at repositories of stock photography are okay to use in your works. You can slap a [meaningless copyright-disclaimer](https://www.ctrl.blog/entry/copyright-disclaimers/) on your use of the photo, but that won’t help you in any way. The user who uploaded the photo may not have the rights to license it, or the photographer may have changed their mind and taken action to get their rights back.

The license can’t be revoked after a photo have been made available under a Public Domain or similar unrestricted license. The exact details will vary based on the legal jurisdiction of the photographer and you or your company. You should be good to go. However, if someone who didn’t have the rights to license the photograph have uploaded it to a stock photography repository, then the license wasn’t ever legal in the first place.

I reached out to the operators of some of my favorite stock photography repositories, and asked them about how frequently someone disputes a photograph published on their websites.

*Annie Spratt* from Unsplash told me they almost never receive any requests, and cited only having received 4 requests for the first eight months of 2017\. *Simon Steinberger* from Pixabay cited similar numbers, saying they only receive about 5–10 requests per year.

Considering that both of these websites publish hundreds of royalty free photographs every month, the numbers of requests for removal of photos is quite low.

However, you should still keep a record of exactly where photos came from you use in your works. A record of where the photos came from can demonstrate you acted in good-faith, and help you build a defense if trouble ever sets its legal eyes on you or your website.

You could save the URL where you found the photo in a custom metadata field in your content management system. You can also keep lists mapping image files on your website and their source in a spreadsheet. Alternatively, you could credit the image source on your public website – even though this isn’t strictly required by the license and not always possible to do.

If there ever where a problem, the webpage may very well be taken down. If you’ve the exact address where you got it, you can still reach out and contact that source website and get details on when it was published, and when and why it was removed.

You can also preserve a copy of the webpage for future reference in the case the original website take it down by submitting a website capture request to the [Internet Wayback-Machine](https://web.archive.org/) over at the Internet Archive. That way, you’ve a second record showing that the photo was published under an permissive license.

At the close, I’d also suggest that if you want to mitigate any potential legal risks, you should probably not use newly uploaded photos. Wait a couple of months after a photo was uploaded before using it in your work. That way, reverse image search and bots will have had time to locate, fingerprint, and stir up trouble for photos belonging to photographers likely to take offense and act upon unauthorized republication. It’s also a safety margin for photographers who did upload one of their images but regretted the decision afterward.

#### Sources

- Takedown request numbers for Pixabay, from email exchange with Simon Steinberger from Pixabay.com.
- Takedown request numbers for Unsplash, from email exchange with Annie Spratt from Unsplash.com.
### Postmortem re-review of the Sense sleep monitoring system
URL: https://www.ctrl.blog/entry/review-sense-postmortem/
Last updated: 2026-08-23T22:19:52.000Z
I thought I’d revisit the Sense sleep tracker which I [first reviewed](https://www.ctrl.blog/entry/review-sense-sleep-tracker/) back in October 2015. The Internet connected alarm clock has now been discontinued after two years on the market, and the online services and apps are expected to close down soon. So, did a sleep monitoring system improve my sleep habits?

This odd orb device watched me sleep for nearly two years. The Sense failed to gently wake me up in the morning, failed to deliver on promised features, and ultimately failed as a sustainable business.

### Discontinued

CEO and founder James Proud announced the closure of Hello, Inc in June 2017 and said he didn’t know what would happen with the expensive devices his company had already sold.

Two months after that announcement, it’s looking like the devices will be turned in to useless bricks as they completely depend on infrastructure delivered by the company. The Sense is still up for sale on Amazon and other retailers even though the product is expected to stop working any day.

The Hello, Inc. website have been down a few times following the announcement with outages lasting a few hours. There have been no other communication from the company clarifying anything about when servers will shut down.

### What have changed since [my original review](https://www.ctrl.blog/entry/review-sense-sleep-tracker/)?

I stopped using my Sense in late May, just a few weeks before the announcement.

My Sense insisted that I needed to replace the batteries on the Sense Pill, a small pillow-attached tracker that’s paired with the main Sense orb. However, it didn’t matter if the batteries were replaced or not, it insisted the battery level was low and stopped tracking sleep data. This went on for a about two months before I gave up, disconnected the Sense, and put it in a drawer.

I’m somewhat surprised that the software problems I mentioned in my original review weren’t ever addressed. I wrote about the unpleasant noise disruption when alarm tones and ambient sleep sounds looped at the end of their playback. This is clearly something that could have been addressed in a software update, but it wasn’t ever addressed.

Sleep sounds, the various ambient noises the Sense orb could produce to drown out the neighbors, was my favorite feature. There are apps that do the same, and since you’d to turn this on from the Sense app — there wasn’t much benefit to using this feature on the Sense instead of a standalone app. Every standalone app I’ve tested have also managed to loop their soundtracks without making disruptive noises.

Considering that the Sense knew when I went to bed, it should have been able to start playing sleep sounds on its own. Automatically fading-in sleep sounds when I went to bed would be great! This is also something that could have given the Sense an edge over standalone apps and it could have been added in a firmware update. This potential was never realized.

### The alarms didn’t wake me

I’m a heavy sleeper. The volume and intensity of the overly-pleasant wake-alarm options the Sense offered could nearly never raise me from sleep.

I vaguely recall turning off the Sense once or twice over the last year or so, but would most often sleep through the alarm until my backup phone alarm woke me up some 15 minutes after Sense were set to go off. If I turned off my phone’s alarm clock, I’d never wake from the Sense alone.

At least for me, as a heavy sleeper, the Sense didn’t fulfill it’s primary function. Admittedly, I’ve considered investing in alarm clocks that shake the entire bed or give me small electric shocks to wake me.

### Where are the push notifications

The Sense produced a proprietary Sleep Score that was supposed to represent how well/calm you slept. This score was available when you opened the app in the morning.

The company promised to offer push notifications with the Sleep Score every morning, making them more visible and actionable. I rarely opened the app for doing anything other that adjusting alarms or starting the ambient sleep sounds that the orb could play.

However, the months and years went by after the product was shipped — yet no push notifications arrived. The app was redesigned several times in this time period, but the daily sleep reports never materialized.

I’m frankly surprised the company went bust before they managed to ship this advertised feature. Push notifications isn’t a difficult technology to implement. Even the least elegant single-developer apps have them, yet all the millions and resources that Hello, Inc. had available wasn’t enough for them to implement push notifications.

### Conclusion

The Sense was over-designed yet didn’t deliver on the features they’d promised their customers. I wouldn’t have kept using the product even if the current level of service hadn’t shut down or I didn’t experience a hardware failure just before the company announced closure.

I bought an overpriced gimmicky alarm clock that was totally dependent on a hosted web service that’s about to be shut down for good. That purchase was a stupid mistake and I regret it today.

Some customers are opting to extend the life of their Sense sensors by asking Hello, Inc to open-source their sleep data processing system. Hello haven’t responded to these requests, and frankly they don’t have any motivation for following through on it either. They’ve already sold the product and made their money off the sale.

I believe we’ll see a lot more products being discontinued and their cloud services unceremoniously shut down in the next decade. The only real question is: when will consumers wise up and demand that the devices they buy don’t rely on other people’s servers?

#### Sources

- [Hello’s sleep-tracking Kickstarter hit collapses](https://www.bbc.com/news/technology-40259809?ref=ctrl.blog), 2017-06-13, Leo Kelion, BBC News
- [Did Silicon Valley hubris sink sleep-tracking company Hello?](https://web.archive.org/web/20181116022034/https://sleeptrackers.io/hello-announces-company-is-closing-down/), 2017-06-13, SleepTrackers.io
- [Would it be possible for you guys to release the code \[…\]?](https://web.archive.org/web/20190504154525/https://medium.com/@christopheraglandwilliams9/would-it-be-possible-for-you-guys-to-release-the-code-so-we-dont-have-a-paper-weight-ef2b28d4fb1b), 2017-06-12, Christopher Agland-Williams, Medium
- [Goodbye, Hello.](https://medium.com/@hello/goodbye-hello-c62ea1f58d13?ref=ctrl.blog), 2017-06-12, James Proud, Medium, Hello Inc.

**Reviewed:** Sense

**Review rating:** 0 / 10
### Is remote desktop making a come­back in GNOME on Wayland?
URL: https://www.ctrl.blog/entry/wayland-gnome-remote-desktop/
Last updated: 2026-08-23T22:24:13.000Z
Remote desktop under Wayland seems to finally be happening; thanks to work on new Application Programming Interfaces (API) and a new GNOME Remote Desktop service undertaken by *Jonas Ådahl*!

GNOME’s Vino remote desktop server was left behind when GNOME transitioned their desktop from the X compositor to Wayland. This meant that people who use distributions that stay close to upstream, like Fedora Linux 25, have been left without a working VNC or RDP server for almost a full year.

*Jonas Ådahl* from Red Hat has been busy adding new D-Bus APIs to libmutter. Mutter is the GNOME window manager and Wayland compositor. The two new APIs, `org.gnome.Mutter.RemoteDesktop` and `org.gnome.Mutter.ScreenCast`, expose a PipeWire stream containing the contents of the system’s screens. The new APIs can create full-screen streams, or streams for individual windows. Only the former has been implemented.

These new APIs finally allows for services such as RDP and VNC servers and screen recording under Wayland. Once again, Mr. Ådahl delivers! He has also created *GNOME Remote Desktop*, a new user-level systemd service daemon that’s built on the new RemoteDesktop API in libmutter, plus VNC support from libvncserver. The new service can be used to connect up a remote VNC client to your local screen’s session. GNOME Remote Desktop appears to be a drop-in replacement for Vino server.

The new APIs are still considered experimental, but the adventurous need not wait. You can build Mutter plus its dependencies with Mr. Ådahl’s extensive patches with the \--enable-remote-desktop flag. You’ll also need to build gnome-remote-desktop to get any use of the changes.

It’s unclear at this time when these changes will all be integrated into the GNOME codebase, let alone be included in a shipping release. Never the less, I’m quite excited to see that there’s finally some progress being made on adding remote desktop capabilities back under Wayland!

#### Sources

- [gnome-remote-desktop – Remote desktop server for GNOME](https://bugzilla.redhat.com/show%5Fbug.cgi?id=1483499&ref=ctrl.blog), 2017-08-25, bug #1483499, Fedora Bugzilla, Red Hat
- [\~/jadahl/gnome-remote-desktop/src](https://gitlab.gnome.org/jadahl/gnome-remote-desktop/tree/b252739239/src?ref=ctrl.blog), 2017-08-22, Jonas Ådahl, commit #b252739239, gnome-remote-desktop repository, GNOME
- [Add screen cast and remote desktop support](https://bugzilla.gnome.org/show%5Fbug.cgi?id=784199&ref=ctrl.blog), 2017-06-28, bug #784199, GNOME Bugzilla, GNOME
- [sharing: Add Wayland screen sharing support](https://bugzilla.gnome.org/show%5Fbug.cgi?id=786565&ref=ctrl.blog), 2017-06-21, Jonas Ådahl, bug #786565, GNOME Bugzilla, GNOME
- [Changes: Wayland by Default](https://fedoraproject.org/w/index.php?title=Changes/WaylandByDefault&oldid=469137&ref=ctrl.blog), 2016-08-24, revision 469137, Fedora Project Wiki, Fedora
### Reduce the max cookie lifetime from decades to days in Firefox
URL: https://www.ctrl.blog/entry/firefox-cookie-lifetime/
Last updated: 2026-08-23T22:06:44.000Z
If you visit the Google homepage in any web browser, the search giant will leave behind a cookie that lasts for 20 years. Every website you randomly visit one can do the same. Do you need to store long-lasting cookies for all the websites you’ve only visited once? With Firefox, you don’t have to.

**Update** (2018-08-30): The features and settings described in this article have been retired and no longer works as of Firefox 63.

Manually clearing cookies in your browser is inconvenient. However, you can still have a lean cookiejar in your web browser by reducing how long cookies can remain in your browser.

Some website may reset their cookies every time you visit them, while others will set it once and wait for it to expire. When your cookies expire, you may need to login to services anew or set some site preferences again. Dropping cookies can for some websites lead to a decreased user experience, but may yield an overall net gain in performance and possibly also privacy.

![Screenshot showing about:config listing these options](https://cdn.synaps.media/control/content/images/2026/08/firefox-config-network-cookie-lifetime.png)

`about:config` contains all of Firefox’s hidden settings.

To change Firefox’s cookie policy to have it limit the age of cookies, you would make the following changes:

1. Type `about:config` in the address field and press Enter.
2. Take the warning to heart, and proceed.
3. Search for `network.cookie.lifetime` in the list of options.
4. Change the value of `network.cookie.lifetimePolicy` to 3

This change will reduce the maximum lifetime of new cookies to three months (90 days) by default. After 90 days, cookies will be deleted from your web browser automatically. Existing cookies will not be readjusted, but if you delete all cookies once then the change will apply to all cookies.

You can configure the number of days to store cookies by changing the `network.cookie.lifetime.days` option to the number of days you want your browser to be storing cookies.

You should set this value lower the more time you spend in your web browser, and the more likely you are to browse through many new and different websites per day. I’ve reduced the default from three months to three weeks (21 days.)

This works on both Firefox for desktop, and Firefox Mobile for Android. The setting will be synchronized between the your devices with *Firefox Sync* unless you disable the `services.sync.prefs.sync.network.cookie.lifetimePolicy` and `services.sync.prefs.sync.network.cookie.lifetime.days` options.

The options mentioned in this article are unavailable in Firefox for iOS (which uses WebKit instead of Mozilla Gecko), and Firefox Focus for Android and iOS (which deletes all cookies on exit.)

As a fun factoid at the end: If you look around in your web browser’s cookie storage (the “cookiejar”), you’ll undoubtedly notice that an uncanny amount of cookies will expire in the beginning of the year 2038\. This is because of the *Year 2038 Problem*: One common way of storing timepoints is as the number of seconds from the *epoch*, the 1st of January 1970\. When using 32-bit numbers, the latest possible value is early in 2038\. If you try to go past that point, the counter wraps around and starts at zero (that is, 1970) again, producing dates in the past.

#### Sources

- [Get rid of network.cookie.lifetime.enabled and network.cookie.lifetime.days prefs](https://bugzilla.mozilla.org/show%5Fbug.cgi?id=1430095&ref=ctrl.blog), 2018-08-01, Firefox bug tracker, Mozilla
- [network.cookie.lifetimePolicy](https://web.archive.org/web/20170824003032/http://kb.mozillazine.org/index.php?title=Network.cookie.lifetimePolicy&oldid=45688), revision 45688, 2013-03-05, MozillaZine Knowledge Base wiki, MozillaZine
- [The Project 2038 Frequently Asked Questions](https://web.archive.org/web/20070820023630/http://maul.deepsky.com/~merovech/2038.html), 2007-08-15, William Porquet
- [network.cookie.lifetime.days](https://web.archive.org/web/20070504213632/http://kb.mozillazine.org/index.php?title=Network.cookie.lifetime.days&oldid=23246), revision 23246, 2006-02-24, MozillaZine Knowledge Base wiki, MozillaZine
### SpiderOak ONE: not the best treatment after the trial ended
URL: https://www.ctrl.blog/entry/spideroak-trial-ended/
Last updated: 2026-08-23T22:22:16.000Z
I had signed up for a free 21-day trial account of SpiderOak ONE, and used that to write my [SpiderOak ONE review](https://www.ctrl.blog/entry/review-spideroak/). As a small addendum that didn’t fit in my review, I’d like to talk about how I was treated after my free trial had expired.

I was given a three weeks and a 250 GB account to evaluate a SpiderOak ONE. All they asked for was an email address, and they didn’t require me to give away my credit card details to evaluate the service. For trail offerings, that’s a respectable offer.

If you haven’t read my feature [review of SpiderOak ONE](https://www.ctrl.blog/entry/review-spideroak/) yet, then I can summarize it by saying I wasn’t too thrilled about their cloud backup service, and especially not their backup client software.

After my three weeks were up, I received the following email titled “ACTION REQUIRED: Your SpiderOak ONE trial ends today”:

> “Your trial ends today”  
>  
> “I hope you’ve enjoyed your 21 day trial of SpiderOak ONE. Today is the final day of your trial; to continue using your account and retain the 13,68 GB of data you’ve already uploaded you’ll need to upgrade to one of our paid plans.”  
>  
> “As a reminder, we have a special deal for you — 10 % off our most popular plan. Get 1 000 GB of storage for 10 % off the normal annual price. To take advantage of this deal, simply click the button below to log in to your Account page, click Change in the ONE Plan section, then select the Welcome to SpiderOak 10 % Discount.”  
>  
> “\[Log in to your account to upgrade\]”  
>  
> “If you’ve any questions or feedback for us, please reply and our team will be happy to work with you.”  
>  
> “All the best, Adam Tervort, Customer Success Director”

I read the above email as “you’ve got to update or the clients will stop working and we’ll eventually delete your data”. However, please note that the email doesn’t say exactly what will happen to your account.

In lack of more clear instructions, I thought I’d *wait and see what would happen.* I believed I’d receive one or more emails urging me to pay-up or have my backed up data deleted.

After three–four days, my SpiderOak ONE clients all switched from saying “Connected” to “Disconnected”. When I clicked Account within the client I received the following error message:

> “SpiderOak can’t reach the server to retrieve a secure login URL for you account.”

I though maybe they were experiencing server difficulties, and noticed that SpiderOak was [apologizing to customers on Twitter](https://twitter.com/SpiderOakAssist/status/897470118166499330?ref=ctrl.blog) for outages on other SpiderOak services. I assumed my problem was related and ignored the situation for another few days.

Less than a week later, I received the first email update since the notice calling me to action. This email was a promotion saying that “Today is a once in a lifetime opportunity”, promising “20 % off of any of SpiderOak’s annual plans.” I thought that was a good deal and decided to keep SpiderOak ONE for a couple of months while I evaluated other backup providers.

However, the SpiderOak ONE client still gave me the same error message as before. I tried logging in through their web interface where I was given the following error message: “Incorrect email/username or password.”

As it turns out, you **don’t get any further email notifications** before your account is deactivated. You’re locked out when you don’t pay-up, and SpiderOak don’t even send you an email to inform you that your account has been locked.

I don’t quite see how they expect to turn trial members into paying subscribers when they won’t let us login to our accounts to make the payment.

I don’t believe I’ve experienced anything like this before from any online service provider of any kind. Yes, they may suspend your account service, and yes, they may even delete all your files. But they never lock you out of your account and prevent you from paying up!

I’m not sure whether this happen because of a bad technical solution where SpiderOak disables user accounts to turn off their clients, or whether this is by design. However, this can’t possibly be good for business.

All the time, I was also unclear what had happen to my files. Where they still stored at SpiderOak? Had they been deleted? Without any further information, I reached out to SpiderOak Support to clarify my account status.

Support got back to me in 17 hours and told me that my account had been disabled, and they would reactive it for 48 more hours. I quickly logged in to my account, and discovered that **my files hadn’t been deleted.**

I ended up deleting my account instead of extending my trail period to a paid subscription. I felt that was the best decision all things considered. I [didn’t like the ONE backup client](https://www.ctrl.blog/entry/review-spideroak/), SpiderOak aren’t competitively priced, and I don’t appropriate their poor communication and policies governing trial accounts and account termination. Surely, there must be better backup providers out there?

??

#### Sources

- [We’re sorry for the outage!](https://twitter.com/SpiderOakAssist/status/897470118166499330?ref=ctrl.blog), 2017-08-15, SpiderOak Assist, Twitter
### SpiderOak ONE review: Okay backup service, clunky software
URL: https://www.ctrl.blog/entry/review-spideroak/
Last updated: 2026-08-23T22:20:03.000Z
SpiderOak ONE is an online backup service built around privacy and strong encryption. One of the service’s design goals was not having access to or even knowing anything about their customers’ backed up files. This product philosophy makes SpiderOak ONE an interesting contender for computer backup, but their philosophy comes with a fair bit of added complexity that their design doesn’t make up for.

SpiderOak sells their subscription backup services by gigabyte quotas. You can install their SpiderOak ONE client on as many computers you like, and they all share the same subscription and data quota. This sets ONE apart from many competing backup services who all charge per-computer rather than assign users a storage quota.

Their price model is something which makes SpiderOak ONE appealing to users with smaller storage needs and multiple devices. However, the client software doesn’t make it easy to manage your quota.

SpiderOak ONE is available for Linux, MacOS, and Windows. You can strictly speaking also access your files on the web and mobile, but you **don’t get to keep your privacy** if you use either mobile apps or the web interface.

I’ll get back to the above points in greater detail later in the review.

### Keep it secret, keep it safe

Privacy and security is at the core of SpiderOak’s brand and their ONE backup service. The service positions itself as a privacy-by-default service, something they almost-but-not-quite deliver on.

SpiderOak ONE encrypts your files locally before uploading the data to their servers for safekeeping. As they don’t know your actual account password (only a password hash which is different from the password hashes used in the encryption process), they can’t see the contents of your files. Their architecture also makes it so they can’t even see the file names of what you’ve backed up.

This all assumes that SpiderOak simply doesn’t push an automated update to their ONE client and instruct the client to collect account passwords and send them back to their servers. The system has [the same trust issue](https://www.ctrl.blog/entry/lastpass-client-trust/) as with other hosted security services like LastPass.

This may sound far-fetched, but as it turns out, SpiderOak already **has ONE clients that collect users passwords** and sends them to their servers to perform decryption and encryption operations on their infrastructure instead of in the clients. I’m, of course, talking about their web interface and mobile clients.

### Mobile and web cost your privacy

SpiderOak ONE has clients for Android and iOS, as well as a web interface, that let you access your backed up files remotely. However, when using the mobile or web interface, you completely bypass the normal privacy and security measures.

Unlike the full SpiderOak ONE client for desktop, the “light” versions for mobile and web transmit your password to SpiderOak so they can perform the decryption on their servers before sending the unencrypted data to your device.

As a customer, you can choose between the convenience of having access to your content on mobile and on the web — or staying private and secure. You can’t have it both ways with SpiderOak ONE.

Online storage services like MEGA support the use of full encryption on the web and in their mobile and other apps. Decrypting files on mobile with MEGA’s client can drain your battery quite fast, and decrypting in a web engine can take quite a bit of time.

These may be some of the reasons why SpiderOak ONE won’t give you secure access to your files remotely. However, I believe it to be more likely that it’s caused by legacy decisions and technological debt regarding how they perform encryption. Something a newer service like MEGA doesn’t have to deal with.

In today’s mobile-first world, SpiderOak ONE has fallen behind the curve. Customers *can* get to their files if they absolutely need to, but it’s not a fully supported end-to-end encrypted feature like their main desktop client.

### Multiple devices and unclear storage quotas

You can back up multiple devices on a single subscription. This can be a great money-saver when comparing SpiderOak ONE to a service like CrashPlan that charge per device.

With SpiderOak ONE, it can be hard to keep track of your backup storage quota on a single device — and even more complicated when using multiple devices. The user interface in the client doesn’t provide much information beside the total amount of data stored on the plan and a potentially misleading per-file-revision quota.

If you modify a file, ONE keeps track of the file changes for you through file versioning. This is great for almost any type of file, as you can get an earlier version of a file back off SpiderOak. A file doesn’t necessarily take up double the storage when you save two copies of it, as SpiderOak will attempt to only store the differences between the two copies. This doesn’t work for all file formats, but it’s great for documents and such that you make a lot of changes to over time.

If you backup the exact same file from two devices, SpiderOak ONE will first create a cryptographic hash of the file as part of the normal backup encryption process. This hash is then checked against a list of other hashes in your account. If the exact same version of the file has already been backed up in your account, SpiderOak ONE doesn’t upload a second copy, but instead simply updates their record so they know the file exists on two computers at two different file paths. This saves your upload bandwidth and doesn’t occupy any additional space on your storage quota.

In my testing, the deduplication process don’t work with most files. I can copy a backed up file to a directory that isn’t being backed up with SpiderOak ONE, and then replace the backed up file with the exact same file from the other directory, and this will cause SpiderOak ONE to back it up as another revision of the file even though the file’s contents and hash is identical.

There’s no indicator in the client letting the user know that the file isn’t backed up multiple times nor is it shown anywhere that it isn’t consuming as much storage as the user interface might suggest. From within the client, you can see all revisions of a file and how large the file was at different points in time. You can’t see the total size of all historical versions on one or all devices.

You can only manage and delete files and old file revisions from your current device. If you want to remove files backed up by another computer connected to the same account, you’ve to go to that computer and remove the files from there. You can see the files backed up by all computers, but you can’t make any changes to them.

### Some general points about the user interface

Before I proceed, I want to tell you more about the main user interface of SpiderOak ONE. To put it frankly, it isn’t very user-friendly. It shows clear signs of being built up around how the software works rather than being designed to be useful and solve problems.

My first impressions of SpiderOak ONE were quite underwhelming. There’s no support for high-resolution displays (HiDPI), meaning that on my various screens; all the text and controllers are small and hard to read. (Shown in correct proportions below, but imagine everything in the window being half the size.)

![Main window from SpiderOak ONE](https://cdn.synaps.media/control/content/images/2026/08/spideroak-main-screen.png)

The top navigation in the client is clear enough at the first glance with five main categories: Home, Backup, Manage, Sync, and Share. If you stop and think about it for a second, what do you expect these different tabs to do? Backup and Manage holds two views that look almost exactly the same. It’s hard to identify the differences and purposes of each as both show you a treeview of your files with checkboxes you can turn on and off. To back up a folder, do you go to Backup or Manage?

In the Manage tab, some folder icons may be shown as partially green, but the same folders aren’t green in Backup tab. I thought this may meant that they were either fully or partially backed up. However, you go to the Sync tab and choose to edit a synchronized folder – there’s a small note at the bottom of the screen that says that “Synced folders will appear as green within the Manage tab.” The Hive folder has an orange icon by default, so this all makes very little sense and is quite unintuitive.

On the Home tab (shown above) there’s a second row of tabs containing Overview, Activity, Action, Completed, and Details. Each of these show you … uhm, I’ve to be honest here: even as a geek, I don’t care in the slightest what these tabs show. There’s no conceivable reason why there would be so many of them! They all list file activity in one way or another. Surely listing files being uploaded and downloaded in two columns would be good enough? You can find this design in just about any other backup software.

A second set of tabs within tabs is considered somewhat of a bad design. To quote renowned user experience researcher Jakob Nielsen:

> “Multiple rows \[of tabs\] create jumping UI elements, which destroy spatial memory and thus make it impossible for users to remember which tabs they’ve already visited. Also, multiple rows are a sure symptom of excessive complexity: If you need more tabs than will fit in a single row, you must simplify your design.”

This sums up how I feel about the tabs-within-tabs design that SpiderOak ONE uses on its Home tab. This feeling is strengthened by how useless and un-actionable the presented information is. There are also small behavioral oddities all over the place, like the weirdly [hard to understand checkboxes](https://cdn.synaps.media/control/content/media/2026/08/video-10.mp4?ref=ctrl.blog) and inconsistencies.

### Synchronizing folder contents between devices

Beside its main purpose of backing up your files, SpiderOak ONE can also help you move files between your computers or keep arbitrary folders in sync. You can quickly move files around by moving them into a special folder created in your Home folder called SpiderOak Hive. The Hive folder works like a drop box where everything ends up on all of your machines. For more selective syncing, you can set up your synchronization folders.

Hive is easy enough to use as its setup for you when you install SpiderOak, and works automatically on all your computers. However, configuring a custom set of folders is a much more complex task and you’re given very little assistance along the way.

To set up a folder for synchronization, you first have to know that you need to already have set up each folder to be backed-up on all the computers you want to sync to. You can then go into the Sync tab on one of your computers and setup what SpiderOak calls “a Sync”, which is to say – a synchronized folder task.

You’re asked to provide a name and describe the “sync” before being asked to choose which already backed-up remote and local folders you wish to keep in synchronization. The user interface is quite unforgiving. If you haven’t already synced the folders you want to use, you’ve to cancel the process and loose your changes while you go back and setup the folders to be backed up first.

This is a cumbersome setup process for something other software has been able to do seamlessly for years already.

Sync folders are just as confusing as regular backup folders when it comes to the actual storage usages. You need to carefully remember which devices uploaded which files, because files can only be managed and deleted from the computer that uploaded them. To quote the ONE support page on file deletion:

> “You can only remove files from your SpiderOak backup by using the SpiderOak application which you install on your computer. Further, you can only remove files through the desktop application which were uploaded from the device you are seated at.”

It’s quite unclear what would happen to your synced files if you remove one computer from your account.

Synchronized folders in SpiderOak ONE clearly require quite a bit more manual management than the synchronized folders people may be familiar with from services like Dropbox or OneDrive. Frankly, I don’t see why anyone would choose a complicated folder synchronization service. These services are already difficult enough to use as it is.

### Conclusion

SpiderOak ONE lets you backup from and synchronize files between multiple computers under one subscription. This functionality sets it apart from competing services as a compelling option for those of us who don’t need to back up enormous amounts of data and want to get the job done on a budget.

The SpiderOak ONE user interface isn’t actively user hostile, but that wouldn’t be an unfair description of it either. There’s very little abstraction in the user interface from the technical foundations of SpiderOak ONE. The software is as awkward to use as the service’s name.

Unfortunately, the multi-device functionality shows signs of being driven by engineering decisions and having been tacked onto an existing service as an after-though.

I was genuinely surprised by how difficult SpiderOak ONE had managed to make setting up folder synchronization. It’s clear that the user interface was added on to an already designed solution rather than creating a solution to specific use cases.

The software assumes you’re already familiar with the technicalities of how features have been implemented to be able to use them. You’re not provided with enough information in the client to get common tasks done, and being familiar with underlying concepts and similar software doesn’t help you one bit. (To be fair, it does help you navigate their online knowledge base.)

I could get by using SpiderOak as my backup solution, but the product as a whole feels inelegant and dated. It comes with a high learning curve, and even if you’re technologically savvy and want to use it — it can still be difficult to use.

SpiderOak ONE is good enough to back up one computer, but I’d not recommend you use it to back up multiple computers nor use it to sync files between multiple computers.

Unfortunately for SpiderOak ONE, there are cheaper and more attractive alternatives that offer single-computer backup with strong encryption at more competitive prices.

#### Sources

- Deleting Files, 2017-08-19, Adam Tervort, SpiderOak Support, SpiderOak
- [No Knowledge, Secure-by-Default Products](https://web.archive.org/web/20170829203847/https://spideroak.com/no-knowledge/), 2017-08-12, SpiderOak
- [SpiderOak ONE on Mobile](https://web.archive.org/web/20190504155635/https://spideroak.support/hc/en-us/articles/115002890086-SpiderOak-ONE-on-Mobile), 2017-08-10, Adam Tervort, SpiderOak Support, SpiderOak
- [Syncing your data](https://web.archive.org/web/20190504162517/https://spideroak.support/hc/en-us/articles/115001853943-Syncing-Your-Data), 2017-08-07, Adam Tervort, SpiderOak Support, SpiderOak
- [SpiderOak It doesn’t Deduplicate Data Across Users (and Why It Should Worry You if We Did)](https://web.archive.org/web/20190504165525/https://spideroak.support/hc/en-us/articles/115001854723-SpiderOak-Doesn-t-Deduplicate-Data-Across-Users-and-Why-It-Should-Worry-You-if-We-Did-), 2017-07-27, Adam Tervort, SpiderOak Support, SpiderOak
- [Historical Versions Explained](https://web.archive.org/web/20190504154201/https://spideroak.support/hc/en-us/articles/115002157643-Historical-Versions-Explained), 2017-07-25, Adam Tervort, SpiderOak Support, SpiderOak
- [Deduplication](https://web.archive.org/web/20180906184904/https://spideroak.support/hc/en-us/articles/115001854643-Deduplication), 2017-07-22, Adam Tervort, SpiderOak Support, SpiderOak
- [Tabs, Used Right](https://www.nngroup.com/articles/tabs-used-right/?ref=ctrl.blog), 2017-07-09, Jakob Nielsen, Nielsen Norman Group

**Reviewed:** ONE Backup

**Review rating:** 5 / 10
### Recover language packs after locking a UI-override in Windows 10
URL: https://www.ctrl.blog/entry/windows-language-packs-override/
Last updated: 2026-08-23T22:25:04.000Z
The split between the Control Panel and the Windows Settings app can cause some weird situations. Here is how to restore the ability to download additional language packs after having locked in an UI override language on a Windows 10 device.

Language packs translates and localizes Windows 10 into different languages. In older versions of Windows, you were stuck with the language the license was bought with – or you could install extra language packs if you’d paid extra for the Windows Professional edition. In Windows 10, you can install language packs for free with any edition of Windows at no upgrade cost.

You can normally install language packs from within the Windows Settings app: Time and Language: Region and Language: Language list. After adding a new language to the list, Windows will install a language pack for the selected language. If you’re running low on disk space, you may need to initiate the download manually.

However, I ran into a situation where Windows no longer offered the option to install a language pack. New language packs could also not be installed from the classic Control Panel. It took a little while to work out, but I’d set a UI override language in the classic Control Panel. An UI override language is a language that takes residence over your defined language list. Windows will normally use the language at the top of your language list as the preferred language. For example, this configuration will let you get to keep an English user interface (the UI override language) while getting content inside your apps and on the web in order of the language list in Windows.

To restore the ability to download and install language packs, you’ll have to — at least temporarily — disable any UI or keyboard input language overrides:

1. Go to Control Panel: Clock, Language, and Region: Language, and choose Advanced settings.
2. Change the two options *Override for Windows display language* and *Override for default input method* to *Use language list*.
3. Click Save at the bottom of the screen.
4. Close the Control Panel and reopen the Advanced language settings view.
5. Click the Copy settings button under the Welcome screen and new user accounts panel. Choose to copy your settings to all destinations and click the OK button.
6. Reboot the PC.

You can now go to the Windows Setting app: Time and language: Region and language: Languages to manage your language packs. Each of the listed languages should now have language packs, fonts, handwriting, and other locale downloads made available to them again.

Note that you’ve to log out and back in again before newly installed language packs will show up in the list of available language overrides in the Control Panel.
### Keep an eye on your certificates with SSLPing
URL: https://www.ctrl.blog/entry/review-sslping/
Last updated: 2026-08-23T22:20:03.000Z
**Update** (2022-04-11): SSLPing ceased operations in April 2022 after getting crushed by its own technical debt. Read the [statement from Chris Hartwig](https://web.archive.org/web/20220410144610/https://sslping.com/). Most people looking for a free certificate monitoring service are probably already using free certificates from Let’s Encrypt; who’ve automated certificate renewals and send email notifications if there’s a problem. Still need monitoring? Read [my review of KeyChest](https://www.ctrl.blog/entry/review-keychest/).

SSLPing is an cost-free service that provides reoccurring monitoring of the security state of your HTTPS websites. The service tests your websites daily and will report on problems with insecure configurations and use of no-longer-considered-secure cryptography ciphers in an ever-changing security landscape. You’ll also be notified by email if your certificates are about to expire.

The service is a good tool for monitoring simple IPv4-only secure websites.

Before I continue, I’ve to acknowledge the service’s antiquated name. SSL was deprecated two years ago after having been replaced by TLS over a decade ago. Anything calling itself “SSL”-anything today sounds like the protocol: obsolete. Three-letter soups don’t make for great names in general.

I’ve been using SSLPing in addition to another service to monitor the security configuration and certificates of my various websites. I’m happy that a cost-free alternative like SSLPing exist, but it has some serious limitations you should be aware of.

### Why is certificate monitoring important?

Keeping up to date with new configuration vulnerabilities and the ever-changing recommended best-practices for cryptography ciphers is a daunting task. Manually testing and remembering to retest every so often can be time-consuming, and the task quickly grows out of hand if you’ve got more than one website to test.

With the raise of Let’s Encrypt and automated 90-day-certificates, it has become more important than every to automate monitoring of the certificate health of a website. Let’s Encrypt should in theory be configured to auto-renew certificates, but server configuration and other issues can cause that automated process to fail over time.

Without a valid certificate and a solid and secure configuration, you may be putting your users in risk and web browsers will be doing all they can to make sure they don’t trust your website. Automated monitoring lets you act on any problems proactively without damaging the reputation of your websites.

### When there’s a problem

SSLPing will email you for any problem and well in advance of any expiring certificates. Emails are sent out daily when there’s a problem and on the next daily checkup to let you know that everything works again. You can’t configure your notification in any way or even add additional email addresses to be notified of issues.

SSLPing also keeps a record of any problem and status changes for your certificates. It doesn’t store historic fingerprints of the certificates it has tested, which I think is a real shame. It would be nice to have a record of when your certificates renew/change.

Some months back, I’d an issue with a website where I’d get emails every other day telling me about a problem one day and that the problem had gone away the next day. I tried to figure out the problem, but couldn’t quite work out what was going on.

I emailed Chris Hartwig, the owner of SSLPing, and we worked out that this was a round-robin problem where an IP address of an old web server showed up in DNS in one geographic region.

On my suggestion, Chris added more information — such as IP addresses — to problem messages on SSLPing. This and other changes have made the problem reports from SSLPing much more useful when troubleshooting than they were just a year ago.

### No support for IPv6 or DNS multi-records

SSLPing doesn’t support IPv6, as was also the case with all of the more generalized website [uptime monitors I reviewed](https://www.ctrl.blog/entry/review-3-uptime-monitors/) last year.

Any given domain may return more than one IP address or list both IPv4 and IPv6 addresses. There’s no guarantee that each of these different IP addresses point to the same server, and each server may have different configuration issues. SSLPing will only test whichever IPv4 address its deterministic network stack returns.

Testing is only performed from one server location, further complicating matters when different geographical regions get different IP addresses using [GeoDNS](https://www.ctrl.blog/entry/review-3-uptime-monitors/).

As mentioned above, this can cause problems for websites other than the simplest DNS setups with only one IP address being returned over DNS worldwide. This limitation makes SSLPing unsuited for websites with anything but the simplest deployments and needs for testing.

You can’t configure SSLPing to monitor a specific IPv4 or IPv6 addresses instead of domain names. Inputting an IPv6 address using any of the standard notations causes the all to common colon-split problem.

You’ll need to create unique domain names for each server you want to monitor, and your certificates will need to be valid for those domains. This can increase the configuration complexity greatly when all you want is to test some geographically disbursed endpoints for the same website.

### Conclusion

SSLPing is a great service for simple IPv4-only TLS websites. Whether you’re automatically deploying certificates with Let’s Encrypt, or manually deploying them from another certificate authority once a year — you can get value out of SSLPing.

There are no account limits, so you can monitor thousands of websites on a single account. At no cost, it’s also a good tool to have set up as a backup monitoring service for websites with IPv6 or more complex DNS configurations.

#### Sources

- [About SSLPing.com](https://web.archive.org/web/20170907025150/https://sslping.com/about), 2017-08, Chris Hartwig, SSLPing
- [Milestone: 100 Million Certificates Issued](https://letsencrypt.org/2017/06/28/hundred-million-certs.html?ref=ctrl.blog), 2017-07-28, Josh Aas, Internet Security Research Group, Let’s Encrypt
- [SSLPing has just passed the 5000 servers!](https://twitter.com/sslping/status/834333097252499456?ref=ctrl.blog), 2017-02-22, SSLPing, Twitter
- [RFC 7568: Deprecating Secure Sockets Layer Version 3.0](https://www.rfc-editor.org/rfc/rfc7568.html?ref=ctrl.blog), 2015-06, Internet Engineering Task Force
- [SSL and TLS Deployment Best Practices](https://github.com/ssllabs/research/wiki/SSL-and-TLS-Deployment-Best-Practices/%5Fhistory?ref=ctrl.blog) (version history), SSL Labs Research repository, Qualys

**Reviewed:** SSLPing

**Review rating:** 7 / 10
### How to report a false-positive in Microsoft SmartScreen
URL: https://www.ctrl.blog/entry/how-to-false-smartscreen-positive/
Last updated: 2026-08-23T22:09:58.000Z
SmartScreen is a Windows Defender component found in Microsoft Edge and Internet Explorer as well as in all universal apps from the Windows Store. It’s used to block phishing and fraudulent websites from loading, and to block malicious apps from running.

What do you do when your program is incorrectly matched to a malicious signature in *Microsoft SmartScreen*? What recourse do developers have to get their programs allow-listed? What should you do as a user when something is blocked by SmartScreen?

Completely unrelated (not) to the newly released [update to my free *EdgeDeflector* utility](https://www.ctrl.blog/entry/edgedeflector-111update/), I needed to find out how to report a false-positive in Microsoft SmartScreen. Users of Internet Explorer and Edge were being blocked from downloading the update because the installer for the update was falsely identified as malicious by SmartScreen (“Windows Defender”.) Users of other browsers were told the executable couldn’t be run when they tried to execute it.

So, what recourse does a developer have when their software is being blocked by Microsoft? What do you do when a verified-good download from a known and trusted source is incorrectly flagged as malware?

It was surprisingly hard to find any documentation for reporting false-positives in Windows Defender to Microsoft. I even asked the Windows digital assistant, Cortana, and it responded by telling me about the local weather. This was obviously not useful. In any case, the actual process is as follows:

1. Download the program through a publicly accessible link using Microsoft Edge or Internet Explorer.
2. Wait for a notification telling you that “Windows Defender SmartScreen reported \[file\] as unsafe.”
3. Click the View Downloads button on the notification.
4. Right-click on the downloaded file, and choose *Report that this download is safe*.
5. Fill in the online form.

You’ll end up on an online form, but you can’t get to this form without using the links provided by Microsoft. The special reporting link contains the file hash, as well as other information about the file such as the name and where it was downloaded from.

You could theoretically construct this URL manually, but it’s much easier from Microsoft Edge. I haven’t found any way to get the parameters for this form if you use another browser than Microsoft Edge or Internet Explorer.

There’s no other way to say this so I’ll be very blunt: unless you know for sure and have verified and double-checked your findings: you shouldn’t be reporting anything as a safe download unless you know that the exact file you’ve is safe. Assume your malware protection software is right unless you *actually know better.*

If Windows Defender begins recognizing a specific named threat or recognize your program as malicious after it has been installed, you can use the [Windows Defender Security Intelligence File Submission](https://www.microsoft.com/en-us/wdsi/filesubmission/?ref=ctrl.blog) form instead. Note that this form shouldn’t be used for reporting any executable that just haven’t yet established an application reputation (new or unpopular programs.)

My program was probably not flagged as malicious, but rather it doesn’t have what Microsoft calls an “application reputation.” SmartScreen looks at the history and number of downloads of executable files.

An uncommon and unusual download is assumed to be riskier than a frequently downloaded file. When a file has been downloaded enough times, it will be added to SmartScreen as a safe download.

You can help boost your application reputation by digitally signing your executables. Code signing isn’t a very complicated process, but the signing certificates have to be renewed yearly and they cost a couple of hundred dollars every year. I’m not interested in covering that cost considering that I’m developing a small utility program that I make available for free.

#### Sources

- [Submission guide](https://web.archive.org/web/20170807150407/https://www.microsoft.com/en-us/wdsi/antimalware-support/file-submission-guide), 2017-08, Windows Defender Security Intelligence, Microsoft
- [FAQ](https://web.archive.org/web/20170807015213/https://feedback.smartscreen.microsoft.com/smartscreenfaq.aspx), 2017-08, Windows Defender SmartScreen, Microsoft
- [Windows Defender SmartScreen](https://web.archive.org/web/20170711205446/https://docs.microsoft.com/en-us/windows/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview), 2017-04-05, Windows Thread Protection, Windows IT Center, Microsoft
- [SmartScreen Application Reputation – Building Reputation](https://learn.microsoft.com/en-us/archive/blogs/ie/smartscreen-application-reputation-building-reputation?ref=ctrl.blog), 2011-03-22, Ryan Colvin, IEBlog, Microsoft
### Mozilla celebrates 1M new non-Gecko users
URL: https://www.ctrl.blog/entry/mozilla-gecko-focus/
Last updated: 2026-08-23T22:14:41.000Z
Firefox Focus browser for Android has been downloaded 1 million times in just one month since its initial release. The new web browser from Mozilla blocks ads and trackers by default, and is branded as a privacy focused alternative to traditional web browsers. Along the way, Mozilla seem to have lost their focus on building a cohesive mobile platform.

What makes a web browser unique? To me, one of the essential things that sets Firefox apart from other web browsers is its open-source Mozilla Gecko web rendering engine. Gecko is used in Firefox for desktop and Android. However, the first two releases of Firefox Focus for Android have shipped with Android WebView, based on Chromium’s Blink rendering engine, instead of Gecko.

Firefox Focus, also known as “Firefox Klar” in some markets, has a quite different design to that of Firefox Mobile. Focus is limited to only a single tab and comes with built-in blocklists of known internet trackers and advertisement. Focus was released for iOS last year, using the WebKit WebView rendering engine. Notably, Apple doesn’t allow other rendering engines to be distributed through their App Store, so Mozilla had no other choice. On Android, however, they could have chosen to use Gecko instead.

**Update** (2018-10-02): Firefox Focus version 7.0 for Android now ships with both WebView and GeckoView. Mozilla have opted for a staged roll-out so only some users will be using GeckoView now but they intend to move all users over to Gecko in the coming months.

Does Mozilla have **so little faith in their own rendering engine** — which is already available on Android — that they’d choose to release their new mobile web browser product for Android without it?

The Android WebView version of Focus for Android was initially referred to as a prototype. From digging around in Mozilla’s public bug trackers, it seems their [GeckoView](https://mozilla.github.io/geckoview/?ref=ctrl.blog) — slated to become a drop-in replacement for WebView on Android — just wasn’t ready to ship. The bug tracker also shows signs of ongoing efforts to bring GeckoView and its interfaces up to par with and introduce a shim for Android WebView.

Focus can be built from source to use GeckoView today. It’s not quite on feature parity with its WebView counterpart just yet. Some basic functionality in a mobile browser is still missing from the current Firefox Focus builds with Gecko including page-zoom gestures and audio playback.

It sure looks like a switch to Gecko is on the roadmap for Firefox Focus on Android some time in the future. I still find it worrying that one of the few remaining web rendering engines isn’t more important to Mozilla’s strategy.

### Not a productivity tool

Firefox Focus is meant to be a more privacy-friendly option by default. As such, it doesn’t store history to the internal storage and keeps everything in RAM. This means the app doesn’t sleep when it’s left open in the background, causing it to drain your battery more quickly by design.

There are also a lot of features missing by design. As the browser is designed to not remember anything about your browsing habits, there are also no list of frequently visited websites nor a bookmarks manager. Opera tried stripping the bookmarks manager when it abandoned its own Presto rendering engine in favor of WebKit. This greatly angered users at the time, and that was while there were other options like Speed Dial and “Stash” available. Firefox Focus has no way of storing your favorite websites.

The current beta builds contain a new “Add to Home screen” menu item that currently doesn’t do anything. This will probably add a shortcut to the current page to the user’s Home screen.

Firefox Focus is limited to only one tab and one instance/window at a time. Combined with the lack of a real bookmarks manager, reading list, stash, or other way of managing multiple pages; this essentially kills Focus as a productivity tool. It’s great for logging in to one thing and keeping it separate from your main web browser, but it means Focus is more limited than other options. I theorize that this one-tab limit is put in place to limit the RAM and power consumption, and as its hard to isolate tabs/cookies/sessions from each other in a tabbed browser. When do users expect logins and cookies to be shared between two tabs? and when do they prefer to keep them separate? These are questions the browser couldn’t answer on its own without annoyingly prompting the user.

Speaking of logins: there’s no password manager built-in to Focus and WebExtensions and thus LastPass and similar alternatives aren’t supported. Combined with the short session duration and lack of persistent cookies, this can be a real hurdle depending on your personal password hygiene.

### Why not *focus* on Firefox Mobile?

Mozilla already has a superior product available on Android: Firefox Mobile for Android. It has multiple tabs, bookmarks, it supports WebExtensions and Firefox Sync, there are a bunch of accessibility settings available and it’s an actual web browser and can be used as an actual productivity tool.

Firefox Mobile allows users to install additional privacy enhancing plugins that goes beyond just blocking advertisement and trackers including [Decentraleyes](https://www.ctrl.blog/entry/decentraleyes-cdn/) and [Privacy Badger](https://www.ctrl.blog/entry/privacy-badgering/) among other privacy-focused extensions.

Firefox Mobile can be configured to clear all user data on exit. When used in combination with a tracking and ad-blocking extension, you’ve essentially recreated Firefox Focus in a more capable packaging (and with Gecko!) Firefox Mobile is **not private by default**, but maybe what is needed is to improve the capabilities of Private Browsing mode.

Since the end of 2015, Firefox has a built-in tracking protection in Private Browsing mode imaginatively called “Private Browsing + Tracking Protection”. It’s enabled by default, and users can toggle it on and off from an empty private window. However, this is much harder to communicate to users than Focus’ “it’s private by default.”.

Firefox Mobile is a better replacement for Google Chrome and Samsung Browser than Focus as it has all the features users would expect of it. I fear that **many of the 1 million users who’ve downloaded Firefox Focus may be put-off** by its barebones nature and will never want to use Firefox again on any of their devices. It’s easier to understand than Private Browsing mode for users who wants increased privacy. However, it does a poor job for anyone who want to get any work done in their browsers.

The User-Agent of Firefox Focus varies by market. In Germany, Austria, and Switzerland the User-Agent contains “Klar/2.0” and “Focus/1.1” in the rest of the world. I’ve never seen any product change their User-Agent like this before, but I guess there’s always a first for everything. Additionally, Focus sends a “X-Requested-With“ of “org.mozilla.focus” HTTP header with every request while Klar sends “org.mozilla.klar” in the same header.

The User-Agent of Firefox Focus doesn’t contain the word “Firefox”. It’s a not so subtle reminder that Firefox Focus isn’t the Firefox users know and love. It’s something else entirely that’s diluting the Firefox brand. The User-Agent of Firefox Mobile, however, contains both “Gecko” and “Firefox”.

#### Sources

- [New Firefox Focus comes with search suggestions, revamped visual design and an under-the-hood surprise for Android users](https://blog.mozilla.org/en/products/firefox/firefox-news/new-firefox-focus-comes-with-search-suggestions-revamped-visual-design-and-an-under-the-hood-surprise-for-android-users/?ref=ctrl.blog), 2018-10-02, Barbara Bermes, Mozilla Blog, Mozilla
- [Firefox Focus for Android Hits One Million Downloads! Today We’re Launching Three New User-Requested Features](https://blog.mozilla.org/en/products/firefox/firefox-focus-android-hits-one-million-downloads-today-launching-three-new-user-requested-features/?ref=ctrl.blog), 2017-07-20, Barbara Bermes, Mozilla Blog, Mozilla
- [I can’t find Firefox Focus in Germany, Austria or Switzerland](https://support.mozilla.org/en-US/kb/difference-between-firefox-focus-and-firefox-klar?ref=ctrl.blog), 2017-06-21, Firefox knowledge base, Mozilla
- [Firefox Focus New to Android, blocks annoying ads and protects your privacy](https://blog.mozilla.org/en/products/firefox/firefox-focus-new-to-android-blocks-annoying-ads-and-protects-your-privacy/?ref=ctrl.blog), 2017-06-20, Barbara Bermes, Mozilla Blog, Mozilla
- [Privacy made simple with Firefox Focus](https://blog.mozilla.org/en/products/firefox/firefox-news/privacy-made-simple-with-firefox-focus/?ref=ctrl.blog), 2016-11-17, Denelle Dixon, Mozilla Blog, Mozilla
- [GeckoView](https://wiki.mozilla.org/index.php?title=Mobile/GeckoView&oldid=1139095&ref=ctrl.blog), 2016-07-06, revision 1175194, Mobile, Mozilla Wiki, Mozilla
- [Firefox Now Offers a More Private Browsing Experience](https://blog.mozilla.org/en/products/firefox/firefox-now-offers-a-more-private-browsing-experience/?ref=ctrl.blog), 2015-11-03, Nick Nguyen, Mozilla Blog, Mozilla
- [Celebrating 10 Years of Firefox](https://blog.mozilla.org/en/products/firefox/celebrating-10-years-of-firefox-2/?ref=ctrl.blog), 2014-11-10, Johnathan Nightingale, Mozilla Blog, Mozilla
- [Ctrl+Z of Ctrl+D](https://blogs.opera.com/desktop/2013/07/ctrl-z-of-ctrl-d/?ref=ctrl.blog), 2013-07-10, Krystian Kolondra, Opera Desktop, Opera Software
- [Switch from WebView to GeckoView](https://github.com/mozilla-mobile/focus-android/issues/13?ref=ctrl.blog), issue 13, Focus for Android, Mozilla Mobile
- [\[geckoview\] \[meta\] GeckoView MVP](https://bugzilla.mozilla.org/show%5Fbug.cgi?id=1322573&ref=ctrl.blog), Mozilla Bugzilla, Mozilla
### The fabulous USB Type-C Simulator app
URL: https://www.ctrl.blog/entry/usb-c-simulator/
Last updated: 2026-08-23T22:23:49.000Z
So, you haven’t yet upgraded to a phone with a reversible USB Type-C cable? There’s an app for that.

*USB Type-C Simulator* is a mobile app somewhere in the category between a piece of art, social commentary, and a mobile game. The novelty app lets you insert and reverse a USB Type-C cable to your hearts content in one of seven different virtual smartphones. That is all there’s to the app; but it’s quite well done for what it is. The game has a beautiful pixelated art style that compliments its simplicity quite well.

While the app concept and execution is very straight forward; players get treated to a fantastic sparkling rainbow display with fantastic accompanying music every time they insert the USB cable. The fabulous display that ensues from plugging in the cable should be enough to trigger the reward center in the primal part of just about anyone’s brain.

[![USB Type-C Simulator app’s main screen](https://cdn.synaps.media/control/content/images/2026/08/usb-type-c-simulator-app.png)](https://cdn.synaps.media/control/content/images/2026/08/usb-type-c-simulator-app.png?ref=ctrl.blog) 

Plug in for some joy!

The real joy of the game is to discover one of the new USB Type-C cable connector’s main benefits: there’s no right-side-up! The cable works in any orientation!

You can unlock additional virtual phones in the game by repeatedly plugging and unplugging the cable, or by rotating the cable. Each task helps you towards completing quests which grant you larger bonus payouts.

The actual game isn’t all that interesting. I was more fascinated by an app built around a cable connector standard. I doubt many non-technically minded people will ever download this app and learn about the wonders of the USB Type-C connector. Although this app is something that Samsung or one of the other major phone vendors maybe should have created as a promotion for their own devices with Type-C connectors. I believe this app could have been an effective and cheap advertisement for a specific device given a little PR help.

**Update** (2018-07-17): The app is no longer available on Google Play.

USB type C Simulator is available exclusively for Android on the ~~Google Play Store~~. The app is cost-free but with advertisements.

Gameplay tip: You can tap the plug/unplug and reverse buttons at the same time to insert/remove the cable while rotating it. This strategy will let you maximize the bonuses money you can collect from completing quests. For any achievement hunters out there, there’s an easy 87 000 points across 8 achievements in Google Play Games.

Please be aware that the app encourages you to repeatedly and rapidly tap on the same point on the screen only to throw up a full-screen advertisement that covers up the area you’re clicking on. That is against the terms of service for most mobile advertisement networks, yet the app does it anyway.

This has only happened after you’ve played the app for a little while, and then it happens a few seconds after your start the game. I do want to call out Adrian Zarzycki — the app’s developer — for this obtrusive advertisement behavior and badly behaved app. *Bad app developer. Bad.*
### EdgeDeflector 1.1.1.0 updated for Windows 10
URL: https://www.ctrl.blog/entry/edgedeflector-111update/
Last updated: 2026-08-23T22:05:33.000Z
I released *EdgeDeflector* half a year ago as a utility that let users [enforce their default web browser choice throughout Windows](https://www.ctrl.blog/entry/edgedeflector-default-browser/); even where Microsoft would force users to use their Edge web browser instead of the system default.

Since then EdgeDeflector has grown unexpectedly popular, and just as unexpectedly existing users will run into an unexpected problem in an upcoming versions of Windows 10.

Over the last six months, EdgeDeflector has been featured on many popular websites around the web including:

- [PCWorld](https://www.pcworld.com/article/412191/how-to-force-cortana-to-use-your-default-browser.html?ref=ctrl.blog)
- [LifeHacker](https://lifehacker.com/edgedeflector-forces-cortana-to-use-your-default-web-br-1792427125?ref=ctrl.blog)
- [Softpedia](https://www.softpedia.com/get/Tweak/System-Tweak/EdgeDeflector.shtml?ref=ctrl.blog)
- [How-To Geek](https://www.howtogeek.com/226638/make-the-windows-10-start-menu-and-cortana-search-google-instead-of-bing/?ref=ctrl.blog)
- [MakeUseOf](https://www.makeuseof.com/tag/force-cortana-use-chrome-google-windows-10/?ref=ctrl.blog)
- [Addictive Tips](https://www.addictivetips.com/windows-tips/how-to-make-cortana-use-your-default-browser-in-windows-10/?ref=ctrl.blog)
- [GroovyPost](https://www.groovypost.com/howto/make-cortana-use-your-default-browser-instead-of-edge-in-windows-10/?ref=ctrl.blog)
- [Giga Windows](https://www.giga.de/downloads/windows-10/tipps/windows-10-standard-suchmaschine-von-bing-auf-google-aendern-so-geht-s/?ref=ctrl.blog)
- [Just Geek](https://www.justgeek.fr/edgedeflector-forcer-cortana-a-utiliser-navigateur-web-defaut-50963/?ref=ctrl.blog)

I’m both intrigued and surprised by the popularity of EdgeDeflector. It’s evidence that people are interested in using Cortana in Windows 10, and that they care about their preferred web browsers. I hope Microsoft will stop diverting traffic away from the system default web browser to artificially boost the popularity of their Edge web browser.

Unfortunately, EdgeDeflector will stop working in Windows 10 builds after 16241\. The current main build that most users will be using is the Creator’s Update build number 15063\. Newer builds are at the time of writing only available to Windows Insiders, but is expected to be made generally available later this year.

Users must update to EdgeDeflector version 1.1.1.0 to resolve this problem. Please **download the latest version of EdgeDeflector** from [GitHub releases](https://github.com/da2x/EdgeDeflector/releases?ref=ctrl.blog).

### What changed?

Due to changes in how Microsoft construct the `microsoft-edge:` URI scheme, Windows will report that “EdgeDeflector has stopped working” and links will not be opened. Microsoft seem to have added some additional telemetry to tighten the integration of Cortana and Microsoft Edge, and this resulted in a unforeseen format change in the links that EdgeDeflector intercepts.

The new URI format is only used in Cortana, and looks like the following:

```
microsoft-edge:?{telemetry-data}&url={url-encoded-link}
```

I believed I’d been clever and anticipated such changes by always verifying that I’d a working URI. Unfortunately, I forgot to implement proper exception handling for this part of the code which lead to the crash. I did think about such an eventuality, but my execution was all but perfect.

### No auto-update.

There’s no auto-update system built-in to EdgeDeflector. This would entail administrative and infrastructure costs as well 2–300 times more code than the current codebase of today.

Users can subscribe to [EdgeDeflector’s AppCast](https://github.com/da2x/EdgeDeflector/releases.atom?ref=ctrl.blog) to be notified of new releases. An AppCast is a fancy way of saying that it’s a syndication feed that’s updated for every new release.

This isn’t an ideal solution, but I believe it’s still the right choice for a utility program as small as EdgeDeflector.

Thanks to Mark Young for contributing code to this release, and thank you all for your interest in EdgeDeflector! I do apologize for the unfortunate crash problem that made you’ve to go out on the web to find and read this blog post.
### How to prevent Let’s Encrypt from issuing certificates for your domain
URL: https://www.ctrl.blog/entry/how-to-block-letsencrypt/
Last updated: 2026-08-23T22:09:22.000Z
Are you acquiring your certificates from a certificate authority other than Let’s Encrypt? Now you can block Let’s Encrypt and certificate authorities other than the ones you’ve a relationship with from misissuing certificates for your domain. All it takes are a few extra DNS records.

Let’s Encrypt has automated the certificate issuance and renewal process entirely and has lowered the cost and technical barrier to deploying client-to-server encryption on the web. Certificates are issued for any domain that can pass a set of challenges, which revolve around demonstrating control over the standard port for web traffic (TCP 80) for a given domain’s `A` or `AAAA` (IPv4 or IPv6) records.

As an additional security measure, Let’s Encrypt will also check and verify any `CAA` records for the domain stored in DNS. `CAA`, or certificate authority authorization records, are a set of instructions specifically for CAs that can be used to grant exclusive issuance permissions to one or more CAs.

Let’s Encrypt was one of the very first CAs to implement checks for `CAA` records. They will query DNS for `CAA` records from multiple geographically dispersed locations around the worlds. If a conflicting `CAA` records is found, than they will refuse to issue a certificate for a domain.

If you’ve configured multiple DNS service providers to act as nameservers for your domain, than Let’s Encrypts approach helps protect your domain even if one nameserver may have been compromised by an attacker.

Assuming you only want to block Let’s Encrypt and anyone but DigiCert from issuing certificates for your domain, you can let any CA that ask about this know using the following DNS records (shown below in `bind` format):

```
example.com.  IN  CAA  0 issue "digicert.com"
example.com.  IN  CAA  0 issuewild ";"
```

The above example says that only a certificate authority that self-identifies as `digicert.com` can issue a certificate for the `example.com domain`. Furthermore it says that only a CA that identifies as an empty string (meaning no one) can issue a wildcard certificate for the domain.

There are a couple of more `CAA` records you should set which I go in to more detail about in a [past article](https://www.ctrl.blog/entry/dns-caa/). You also need to set `CAA` records for any subdomain, including `www`, in addition to your root domain. You should review my previous article in detail before deploying any `CAA` records on your domains.

All CAs have agree to start checking `CAA` records by September 2017.

#### Sources

- [Automatic Certificate Management Environment (ACME)](https://web.archive.org/web/20170405094129/https://datatracker.ietf.org/doc/html/draft-ietf-acme-acme-06), 2017-03-13 ACME Working Group
- [/cdr/resolver.go](https://github.com/letsencrypt/boulder/blob/d92baeee873ce2a972b51fb3c3f8b36eaa58b46e/cdr/resolver.go?ref=ctrl.blog), 2016-11-30, revision d92baeee873c, letsencrypt/boulder project, GitHub
- [RFC 6844: DNS Certification Authority Authorization (CAA) Resource Record](https://www.rfc-editor.org/rfc/rfc6844.html?ref=ctrl.blog), 2013-01, Internet Engineering Task Force
### How caching affects internet connectivity tests
URL: https://www.ctrl.blog/entry/network-connection-http-checks/
Last updated: 2026-08-23T22:14:45.000Z
Windows 8.1 and older did a better job of detecting “captive portals” (Wi-Fi networks that require logins) and determining whether the state of a computer’s internet connection than Windows 10\. Android has never been good at it. I looked into how different operating systems interact with internet connectivity tests.

Every major operating system tries to fetch a test file over the web as soon as a new network interface comes online. This check is meant to detect whether the device is connected to the internet, and to detect whether something may have interfered with the fetch request. Some operating systems also repeat this test every few minutes.

These tests are used to determine the quality of a Wi-Fi network, determine whether a paid Wi-Fi hotspot is available, check whether the device is online, and to detect “captive portals” or networks that require you to login. the test also tests networking services such as DNS and routing.

These tests require any intermediary services to process the requests as expected. Unfortunately, due to a configuration problem with the test endpoints (the URLs used for testing), some intermediary services such as a web cache or accelerator may serve stale test results. Meaning that an Android device, Amazon Kindle, Xbox, or Windows 10 computer may think they’ve got a working internet connection when the network is down.

A transparent proxy cache (or “web accelerator”), works by intercepting unencrypted network traffic and storing files fetched over the network locally for later use. If the same or different device request the same file, it can be served from the cache without having to download the same file again. Caching proxies are more common on corporate networks, but can also be found in some residential routers or shared networks such as at an airport or café. It can also be installed on a local device as an add-on software. Whether a file is stored in the cache or not is controlled by the URL’s caching-policy (HTTP headers such as `Cache-Control` and `Expires`.)

Some test endpoints allow caching, meaning that the full test won’t be performed and the test file can be served by a local cache. The below table shows caching policies for some popular operating systems and devices.

__Caching policies of internet connection test endpoints.__
| URL                                                        | Cache policy | Product                                    | Comment                                           |
| ---------------------------------------------------------- | ------------ | ------------------------------------------ | ------------------------------------------------- |
| http://www.msftconnecttest.com/connecttest.txt             | default      | Windows 10 and Xbox                        | Hosted on Microsoft Azure                         |
| http://www.msftncsi.com/ncsi.txt                           | revalidate   | Windows 8.1 and older                      | Hosted on Akamai                                  |
| http://captive.apple.com/hotspot-detect.html               | 5 min        | MacOS 10.10 and iOS 8 and newer            | Hosted on Apple IP range on Apache Traffic Server |
| http://www.apple.com/library/test/success.html             | 0 sec        | MacOS 10.9 and iOS 7 and older             | Hosted on Akamai                                  |
| http://connectivitycheck.gstatic.com/generate\_204         | default      | Android 5 and newer, Google Chrome browser |                                                   |
| http://play.googleapis.com/generate\_204                   | default      | Android 7 and newer                        | (fallback 1)                                      |
| http://clients3.google.com/generate\_204                   | default      | Android 4 and older                        | (fallback 2)                                      |
| http://www.google.com/gen\_204                             | default      | Android                                    | (fallback 3)                                      |
| http://fedoraproject.org/static/hotspot.txt                | revalidate   | Fedora Linux                               | NetworkManager                                    |
| http://network-test.debian.org/nm                          | revalidate   | Debian Linux                               | NetworkManager, not enabled by default            |
| http://www.archlinux.org/check\_network\_status.txt        | revalidate   | Arch Linux                                 | NetworkManager                                    |
| http://nmcheck.gnome.org/check\_network\_status.txt        | revalidate   | GNOME Desktop                              | NetworkManager                                    |
| http://detectportal.firefox.com/success.txt                | revalidate   | Firefox browser                            | Hosted on Amazon S3                               |
| http://spectrum.s3.amazonaws.com/kindle-wifi/wifistub.html | default      | Kindle                                     | Hosted on Amazon S3                               |

A ”default” policy means any cache is free to set their own caching policy. Subsequent requests may be served from the cache for the next couple of minutes or even days, depending on the cache implementation and policies, and demand and available storage. Revalidating or short cache duration means any cache must reach out over the internet to the connectivity test endpoint, and thereby retest that the internet connection is indeed working every time rather than bypassing the actual check and serving from the cache.

Windows 8.1 and older did everything correct with test endpoints hosted by Akamai. Once Microsoft brought the testing endpoint in-house and over to their own Azure hosting platform — their knowledge of how to configure a test endpoint seems to have got lost along the way. During a network outage, a Windows 10 device will happily report that the internet connection is working as long as it got the test endpoint from a local cache. Windows 8.1 and older would have reported that the internet connection was broken. Notably this is the exact same issue that makes the [Microsoft Network Speed Test app](https://www.ctrl.blog/entry/windows-network-speedtest-apps/) unreliable.

Newer versions of Apple’s MacOS and iOS operating systems relies on a test endpoint hosted by Apple, whereas older versions relied on Akamai. Both versions are proxy-aware though newer versions of their operating systems test against an endpoint that can be cached for 5 minutes. This allows a corporate network or a school to rely the same test result to all devices within a five minute time slot before repeating the test. This can ease the load on Apple’s test endpoint as well as speed up testing on networks with many devices.

Android devices are blissfully unaware of the impact of caching on their test endpoints. What is more interesting is that Android is the only operating system with multiple test endpoints in case one is either blocked by a network administrator or has some other problem.

It’s interesting to note that Mozilla, the organization behind the Firefox web browser, has a firm grasp of how to do this correctly. Mozilla’s test endpoint is hosted by Amazon S3\. Amazon uses their own hosting service to host the test endpoint they use for their own Amazon Kindle line of ereaders. However, Amazon haven’t configured their own endpoint as well as Mozilla. Further more, Amazon devices will disconnect from a network if the test service is unreachable. During an outage of the S3 hosting platform in late February 2017, customers reported that their Kindle devices couldn’t join Wi-Fi networks at all.

In summary, older versions of Windows and iOS were more reliable than newer versions when it comes to detecting their internet connectivity status. It could seem know-how and familiarity with the HTTP specification is passing into oblivion, as newer test endpoints don’t announce any caching policies.

#### Updates

- 2017-07-21: Arch Linux have changed their caching policy from “default” to “`must-revalidate`” as well.
- 2017-07-20: The GNOME Desktop and Debian have changed their caching policy from “default” to “`must-revalidate`” in response to this blog post.

#### Sources

- Manage connections from Windows operating system components to Microsoft services, [section 13: Network Connection Status Indicator](https://learn.microsoft.com/en-us/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services?ref=ctrl.blog#a-href-idbkmk-ncsia13-network-connection-status-indicator), 2017-05-22, Windows IT Center, Microsoft
- [NetworkManager for Administrators Part 1](https://blogs.gnome.org/dcbw/2015/02/16/networkmanager-for-administrators-part-1/?ref=ctrl.blog), 2015-02-16, Dan Williams, Dan William’s blog
- [An undocumented change to Captive Network Assistant settings in OS X 10.10 Yosemite](https://grahamrpugh.com/2014/10/29/undocumented-change-to-captive-network-assistant-settings-in-yosemite.html?ref=ctrl.blog), 2014-10-29, Graham Pugh, Subject: Macs
- [Amazon’s web servers are down and it’s causing trouble across the internet](https://www.theverge.com/2017/2/28/14765042/amazon-s3-outage-causing-trouble?ref=ctrl.blog), 2017-02-28, Jacob Kastrenakes, The Verge
- [Amazon Outage on 2/28/17 May cause Kindles to not connect](https://web.archive.org/web/20171017080819/http://cc.bingj.com/cache.aspx?q=Tx251LI7RQ82F3&d=4647242239249050&mkt=nb-NO&setlang=en-US&w=3i44wvXntEJBUh%5FE92zqTZ8W64FsTRXq), 2017-02-28, Irvin L., Kindle forum, Customer Discussions, Amazon
### How to fix Roomba 900-series Wi-Fi network not being broadcast
URL: https://www.ctrl.blog/entry/how-to-roomba-reestablish-wifi/
Last updated: 2026-08-23T22:10:59.000Z
I’ve run into an issue two times now where my *Roomba 960* won’t setup its own temporary configuration Wi-Fi network. Without it, the robotic vacuum’s app can’t talk to it and you can’t control the vacuum remotely. Here is how I solved this when the manufacturer refuse to document any troubleshooting tips.

By following the normal procedure for configuring the Roomba puts the Roomba in a special mode where it broadcasts its own unsecured Wi-Fi network. The iRobot Home app will look for this network, which is named Roomba-<id>, connect to it, and transmits the information about the local Wi-Fi network configuration from the app to the robotic vacuum.

This all sounds neat in theory, but not so when it the app and Roomba can’t find each other.

I used a Wi-Fi analyzer to verify the problem, and it seems that Roomba — for whatever reason — sometimes won’t setup and broadcast this special network after being put into configuration mode. I tried the normal way to rebooting the Roomba (holding in the Clean button for 10 seconds) but after a restart, the problem still persisted.

As with [other products](https://www.ctrl.blog/entry/how-to-asus-reset-repeater/) that I’ve documented on this blog, the Roomba’s manual don’t contain any instructions for resetting or even rebooting the product. As its designed to never fail, why would the customer ever need to reset or reboot it? Well, such product design thinking usually only holds water for a few weeks at most when the company don’t put in the engineering work to fulfill the design requirement.

The first time this happened, I let the Roomba sit for a while and tried multiple times to reboot and set it up again using the iRobot Home app. I got nowhere with this, and eventually ended up turning the little robotic vacuum on its head. Then I proceeded to unscrew the battery compartment, and remove the battery before placing it back in again.

The first time I did this I took it out for about five seconds before reinserting the battery. This however, didn’t work. I’d to go in a second time, remove the battery, and then leave it disconnected for a full minute before reinstalling it.

When I next started the Roomba, and held the Dock and Spot buttons (the two smaller buttons on top of the Roomba 900-series) pressed for 5 seconds. My Roomba then started broadcasting the temporary configuration network as expected, and the iRobot Home app could connect and convince the robot to join my home Wi-Fi network.

Nothing may ever beat “turning it off and on again” when it comes to troubleshooting technology issues. However, that mantra should be updated to account for modern battery powered gadgets and devices that aren’t fully powered down when using their on/off buttons (if they even have one!.) My proposal may not be as catchy as the old mantra, but more accurate: “Actually power down and try again.”

#### Other issues

Roombas only support the legacy 2,4 GHz Wi-Fi standard. Older versions of the iRobot Home app would always assume any Wi-Fi network was 2,4 GHz-capable. Your smartphone would know whether your network supported 2,4 GHz, 5 GHz, or both — but iRobot didn’t check to make sure.

This resulted in annoying issues with the app trying to set up Roombas with Wi-Fi networks that they didn’t support. If you kept doing this repeatedly, the vacuum could eventually stop working and required a restart.

This problem has since been fixed and the iRobot app now insist you provide it wit credentials for a 2,4 GHz network.
### Search results in Windows 10 limited to exact matches and promotions
URL: https://www.ctrl.blog/entry/windows-start-search-results/
Last updated: 2026-08-23T22:25:23.000Z
Whether or not you’ve [disabled Cortana](https://www.ctrl.blog/entry/how-to-disable-cortana/) in favor of Windows Search, the search results you get in the Start menu in Windows 10 are very limited. The search results are powered by a limited search engine with almost no leeway on how you phrase search queries. You can only finds the app you’re looking for when you know exactly how to search for it.

Here are five issues with the search results in the Start menu that have annoyed me since the initial public release of Windows 10 two years ago:

### Exact string matches only

A search for “file history” lists the pane in the Control Panel with the same name, and also shows a shortcut to the rebranded *Windows Backup* in the Windows Settings app. If you reorder the words in the search phrase and search for “history file”, it comes up with zero results.

Can you guess what I’m trying to find with the following list of search terms? “disk cleaner”, “clean up system files”, “free up disk space”, “remove caches”, or “empty trash”. Did you guess the Disk Cleanup utility? Well, Windows certainly didn’t. How about “partition hard disk”, “format partition”, or “manage disks”. Disk Management never shows up for any of these search. Rearrange the order of the words, however, and Disk Management will pop right up at the top of the results.

### No partial matching

I expect to find [FileLocator](https://www.ctrl.blog/entry/review-filelocator/) when I search for “locator”. Or say I just started typing a split second before the Start menu have open completely. Typing just “alculator” should still bring up the Windows Calculator app.

Windows Search also doesn’t strip common word suffixes like -s, -ing, -er, etc. A few default apps have hardcoded behaviors for this, like “notepads” – but there’s no general solution in place for all programs.

### Too simplistic app usage rankings

I’ve got both “Firefox” and “Firefox developer edition” installed. When I search for “firefox”, it always gives me the developer edition even tough I always select the standard edition for this search. I do search for “developer” and open up the developer edition of Firefox more often than I open the regular version. However, in this example I’m searching for entirely different words expecting different results. Instead Windows always prefers the app that I’ve opened the most often from the Start menu, regardless of the search term used to open it.

### Favors Microsoft’s own apps

If you search for “web browser”, you’ll find Microsoft Edge and Internet Explorer. It’s peculiar that the Windows Settings app identifies and lists every web browser you’ve installed — including third-party browsers like Firefox and Chrome — as *web browsers*, but can’t pull off the same trick in the Start menu search results. This is especially interesting when you’ve set a third-party web browser as the system’s default browser, and it still doesn’t show up in this search in the Start menu.

I haven’t been able to identify any special properties of Internet Explorer’s or Microsoft Edge’s shortcuts that would account for this preferential treatment. The behavior is built-in to the Start menu itself. Third-party developers can’t compete unless they specifically name their apps “web browser”, and that would only account for one language.

### It doesn’t find newly installed apps

After I install any classic program or an app from the Windows Store, I’ll see it on the *Newly installed* list in the Start menu right away. However, it can take several minutes (or sometimes a reboot) before that new app will start appearing in search results in the Start menu.

### It doesn’t find pinned websites

You can pin your favorite websites to either the Start menu or task bar from Microsoft Edge. Pinned websites show up as app tiles in the Start menu or program icons on the taskbar. They’re given app-like status in the Windows Shell, but you can’t search for either their web address or the title that’s shown in the start menu.

### “No results found”

Better search should have been a higher priority in Windows 10; considering the sheer number of users of Windows with all their diverse needs and spelling prowess. I’ve seen little to no improvement since Windows 10 was released in 2015 July.

All the above issues I listed above have two things in common:

1. They’re not technically difficult to solve
2. Solving them would slow down searches

Performance is indeed important for a good user experience. However, I believe it’s well worth the time to find what users search for rather than defaulting to “No results found”.

Windows could have used multiple strategies to perform searches, e.g. it could first try a quick-and-exact match search, and then fallback to a more complex search engine if it didn’t find anything with the first method. The problems I mentioned above are all problems we know how to solve.

An interesting aside is that Windows 10 does have a better search engine built-in. Hidden away in File Explorer, you’ll find the same Windows Search engine which has remained mostly unchanged from Windows 7\. From within a File Explorer window, you can even search using advanced query operators; which isn’t supported in the Start menu. You can’t use Windows Search in File Explorer as a replacement to the Start menu search in Windows 10, as its blissfully unaware of Windows Store apps and the various sections in the Settings app.

I’m surprised that Microsoft haven’t put more effort into making a great search experience in the Start menu. How can they expect to convince their users to like their Cortana digital assistant service — which has been embedded into the search functionality in Windows 10 — without providing a good search experience that always finds what the things they’re looking for? You wouldn’t want a personal assistant in real life that made no effort to find the stuff you asked them to find, so why would anyone want a digital assistant that’s bad at searching through your stuff?
### Amazon begins to redirect affiliate links to nearest regional website
URL: https://www.ctrl.blog/entry/amazon-onelink-affiliate-redirection/
Last updated: 2026-08-23T22:01:24.000Z
Amazon, the behemoth online “everything” retailer, has virtual stores in many of the most populous and prosperous countries around the world. Many of these regional Amazon websites offer an affiliate program where Amazon associates can get a cut of the sale by sharing product links. Until now, these links have only worked for the regional store it was generated for.

**Update** (2021-02-25): Amazon now handles this automatically. There’s no longer any need to install the Amazon OneTag script on your website. You no longer need to use the special redirect link scheme discussed in this article.

This week Amazon has introduced a system for that will redirect affiliate links to the Amazon regional website that’s nearest for each user. I took a peek at how it all works.

[Amazon Associate OneLink](https://affiliate-program.amazon.com/onelink/?ref=ctrl.blog) is the Amazon Associate program’s new feature where associates can link their Amazon Associate program accounts in Canada, France, Germany, Italy, Japan, Spain, United Kingdom, and United States together. After an associate has linked their different regional accounts together, they can then install a JavaScript on their websites that will take care of redirecting users to the correct regional Amazon website with the correct sales tracking code for that region.

Before the introduction of OneLink, Amazon Associates would either have to come up with their own geo-targeting solution or license one of a handful of existing geographically aware redirect services specializing in Amazon affiliate links.

OneLink is a simple and fast way for Amazon associate partners to unlock affiliate revenue from users in markets they normally don’t reach. In my opinion, the feature is over a decade overdue but still very welcome.

The suggested deployment method on the Amazon Associate Central website is to include a JavaScript that goes through every link to detect Amazon links — including in banners and some Amazon widgets — to replace them with a special redirect link. The script will update existing Amazon links without the need for website owners to update existing links.

However, that JavaScript is quite inefficient. It does a lot of unnecessary operations, and slowly works its way over every link on a page to find any Amazon Associate links. It also adds 22,3 KiB (7,2 KiB compressed download) to the size of each page load where it’s included. I thought I’d see if the script was necessary.

The script boils down to a simple redirect service that only works for Amazon Associates who’ve linked their regional Amazon Associate accounts beforehand. The redirect service detects your Amazon Associate “`tag`” in a link, figures out where the user is located using an IP address based geolocation lookup, and then replaces the associate tracking tag with the appropriate linked tag for the region, before the user is redirected to their local Amazon website.

Here is an example link that will be redirected to either `Amazon.ca`, `Amazon.fr`, `Amazon.de` , `Amazon.it`, `Amazon.co.jp`, `Amazon.es`, `Amazon.co.uk`, or to `Amazon.com` depending on their estimated geographical location:

```
https://assoc-redirect.amazon.com/g/r/https://www.amazon.com/dp/0316219282?tag=ctrltxt-20
```

The anatomy of this link is quite simple:

```
Redirect service + Amazon link + "?tag=" + associate ID
```

```
https://assoc-redirect.amazon.com/g/r/<amazon-link>?tag=<associate-id>
```

The above scheme doesn’t only work with Amazon product pages. It also works with other Amazon page links including search results, categories, mini-stores, and other pages you can link to as an Amazon associate. It also works with Amazon’s `amzn.to` shortlinks as long as they contain an Amazon associate ID tag.

You can use these direct-to-redirect links instead of the Amazon issued JavaScript replacement. This assumes you’ve got some control of your Amazon links and can update all of them quickly. If you need to update a lot of existing links and use Amazon Associate widgets or banners, you may want to use their JavaScript instead.

If you regenerate banners and widget code on the Amazon Associate Central website, it would seem you don’t need to include a separate piece of JavaScript to use OneLink. You still need the separate script (or the direct-to-redirect links) if you want to use OneLink for your plain affiliate links.

As of November 2017, OneLink works with the affiliate programs in Canada, France, Germany, Italy, Japan, Spain, United Kingdom, and United States, and through extension their neighboring countries.

OneLink was initially only available for the Amazon Associate programs in Canada, United Kingdom, and United States. These are Amazon’s largest English language markets. Although not stated explicitly by Amazon, I believe OneLink debut in these markets because the online retailer found it easiest to match products across their international catalogs when the stores at least speak the same language. Associates can choose between only allowing “direct matches” where product links must link to an exact copy of the product, or “close matches” where a very similar product or search results may be displayed instead. The latter feature is the default, and I believe it’s a trick that easier to pull off technically when the product catalogs are all in the same language.

**Update** (2017-09-23): Amazon OneLink now also works with Amazon Native Shopping ads for the United Kingdom (this ad type isn’t currently available in Canada). After some testing, I can confirm that you still don’t need to install the OneLink script on your website if you go on to Amazon.com and regenerate your Native Shopping script and reinstall it on your website.

**Update** (2017-11-03): Amazon OneLink has expanded to include affiliate programs in Europe and Japan. There’s still no word on the Indian or the Australian affiliate programs.

#### Sources

- [OneLink Integration Guide](https://web.archive.org/web/20171103091503/https://affiliate-program.amazon.com/help/node/topic/202164400), 2017-11-01, Amazon Associate Central, Amazon
- [Now monetize your traffic from United Kingdom with Native Shopping Ads](https://web.archive.org/web/20170923021457/https://affiliate-program.amazon.com/promotion/landing/trafficmonetization), 2017-09-22, Amazon Associate website, Amazon
- [Monetize Your UK and Canada Traffic with OneLink](https://web.archive.org/web/20170707094733/https://amazonassociates.typepad.com/us/2017/07/monetize-your-uk-and-canada-traffic-with-onelink.html), 2017-07-03, Amazon Associates Blog, Amazon
- [Integration Guide](https://affiliate-program.amazon.com/help/node/topic/202164400?ref=ctrl.blog), 2017-07-03, OneLink, Tools and Product Linking, Amazon Associates Help, Amazon
- [onejs](https://web.archive.org/web/20170704233721/https://z-na.amazon-adsystem.com/widgets/onejs?MarketPlace=US&adInstanceId=b3855187-69a3-42f1-8f1d-e4748ccb4b5b) (JavaScript code snippet), 2017-07-04, Amazon Associates website, Amazon
### Cockpit admin web-interface gets new Software Update panel
URL: https://www.ctrl.blog/entry/cockpit-packagekit/
Last updated: 2026-08-23T22:03:35.000Z
[Cockpit](https://cockpit-project.org/?ref=ctrl.blog) – a quite capable web administration interface for Linux systems — just added a great new feature: software update management. Cockpit now integrates with the package managers in popular Linux distributions including Arch, Debian, Fedora Linux, Mandriva, openSUSE, SUSE, Ubuntu, and others.

Cockpit achieved its new cross-distribution support for updating software packages by leveraging PackageKit – an abstraction layer for common tasks in popular package management systems. The result is an easy to use interface were you can quickly apply pending software updates on the local or remote systems from the comfort of your web browser.

You can choose to install all pending updates or just the security updates. This last feature depends on repositories and package management backend providing the necessary information about security vulnerabilities.

![Available Updates in Cockpit PackageKit](https://cdn.synaps.media/control/content/images/2026/08/cockpit-packagekit-available-updates.png)

At least for now, Cockpit will suggest you reboot the system after applying any updates. However, the Cockpit project aims to be smarter about when it suggests to restart the system in a future update. Likewise, Cockpit also hopes to offer a one-stop shop for configuring auto-updates and scheduled reboots in a future update. Both of these features would require tighter integration with [DNF automatic for Fedora](https://www.ctrl.blog/entry/how-to-dnf-automatic/)/RHEL and unattended APT for Debian/Ubuntu as these are features which aren’t offered by PackageKit.

You can safely use PackageKit in Cockpit on the web and use the command-line interface at the same time. For example, you can start an update process with PackageKit using the pkcon update command, and then monitor the status of the ongoing updates as they’re being applied in the Cockpit interface at the same time.

![Applying updates with Cockpit PackageKit](https://cdn.synaps.media/control/content/images/2026/08/cockpit-packagekit-applying-updates.png)

Fedora Linux 26 users will be among the first to try the new Cockpit PackageKit module, which was introduced with Cockpit version 143\. The cockpit-packagekit package isn’t installed by default on Fedora Workstation or Server editions. The new Software Update panel will be hidden if you’ve installed the cockpit-ostree package (provides a different but conflicting Software Update panel for Fedora Atomic) at the same time.

Unfortunately, the DNF backend for Fedora Linux in PackageKit doesn’t provide the best package management experience on Fedora Linux. You may want to [stick with DNF instead](https://www.ctrl.blog/entry/packagekit-dnf/) until libdnf and PackageKit sees some more improvements.

Overall the new Software Update panel is a nice addition to Cockpit’s already impressive capabilities. I’ve previously used the Terminal panel to manually issue update commands to the package management systems on hosts where I’ve got Cockpit installed. The new dedicated panel isn’t only a time saver, but it definitely looks better and behaves more like a coherent product experience as well.

#### Sources

- [Cockpit 143](https://cockpit-project.org/blog/cockpit-143.html?ref=ctrl.blog), 2017-06-19, Cockpit blog, Cockpit project
- [Cockpit Feature: OS Updates](https://www.youtube.com/watch?v=BENWI-dTKMs&ref=ctrl.blog), 2017-06-08, Martin Pitt
- [Feature: System Updates for dnf, yum, apt hosts](https://github.com/cockpit-project/cockpit/wiki/Feature%3A-System-Updates-for-dnf%2C-yum%2C-apt-hosts/4c43285f8b06e034a1f13ea4fb68fce48d50cb5c?ref=ctrl.blog), 2017-06-14, revision 4c43285, Cockpit Wiki, Cockpit project
- [packagekit: Add OS package update support](https://github.com/cockpit-project/cockpit/pull/6724?ref=ctrl.blog), GitHub issue 6724, Martin Pitt, Cockpit project
- [Software Updates: Reboot after update](https://github.com/cockpit-project/cockpit/issues/7065?ref=ctrl.blog), GitHub issue 7065, Martin Pitt, Cockpit project
### Use DNF rather than PackageKit on Fedora Linux
URL: https://www.ctrl.blog/entry/packagekit-dnf/
Last updated: 2026-08-23T22:15:14.000Z
Fedora Workstation comes with two package managers by default: DNF and PackageKit. DNF has all the latest features and the best support, but PackageKit is put front and center in GNOME Software, KDE Plasma Discover, and as of Fedora Linux 26 also in [Cockpit’s new Software Update panel](https://www.ctrl.blog/entry/cockpit-packagekit/).

You may be better off sticking with the DNF package manager in the command-line; even though PackageKit is the choice of all the graphical package managers. Here is some of the advantages DNF still gives you over PackageKit based applications.

PackageKit is part of the magic that makes GNOME Software Center and KDE Plasma Discovery — the two most widely used “app stores” on Linux — work across different Linux distributions despite each having their own package manager.

The idea behind PackageKit is to provide a cross-platform front-end and API layer for common operations in popular Linux package managers such as APT for Debian and Ubuntu, DNF for Fedora and RHEL, Zypper for openSUSE and SUSE, and Pacman for Arch Linux. Other package managers and distributions are supported as well. That is to say, you can use the same command-line interface — or programming API — for interacting with the host operating system’s package manager regardless of the distribution or underlying package manager.

However, PackageKit in Fedora Linux isn’t great. It relies on the still in-development libdnf library which is a fairly new effort to port DNF from Python to C. To quote the library’s own README file:

> “Note that libdnf is currently being reworked and is considered unstable. Once major users like PackageKit and DNF are fully ported, a new stable release will be considered.”

In other words: GNOME Software and Plasma Discover, two front-and-center applications for end-users on Fedora Workstation (and the Fedora KDE Plasma Desktop edition), rely on an unfinished work-in-progress library on Fedora Linux. It’s worth noting here that both the Pacman backend for Arch Linux and APT backend for Ubuntu seem to be in a much better shape than the DNF backend in PackageKit.

Problems quickly show up when comparing pkcon and dnf, the command-line interfaces of PackageKit and DNF respectively:

The command-line dnf utility can automatically identify and remove orphaned packages — unused libraries and other packages — when you upgrade or remove software. PackageKit will simply leave the orphaned packages installed and even keep updating them in the future even though the library sits there without any software ever using it.

libdnf and PackageKit don’t yet support downloading [delta RPMs](https://www.ctrl.blog/entry/how-to-fedora-drpm-network-bandwidth/). Which results in PackageKit requiring up to *three times more network bandwidth* and data usage to keep the system up-to-date compared to updating with delta RPMs. (The exact figures depends on the which packages you’ve installed on your system – and how they’re updated.)

Both libdnf and PackageKit *ignores* the /etc/dnf/dnf.conf configuration file which lets users enable features in DNF such as automatic-fastest-mirror-selection, package exclusions, and control network utilization. Not being able to configure package exclusions with PackageKit can be very disruptive to your workflow depending on your use for excluding certain packages.

The DNF backend for PackageKit in Fedora Linux also lacks safeguards to prevent users from uninstalling crucial packages such as glibc, dnf, libdnf, and indeed PackageKit itself. These are in place for other backends, including DNF’s predecessor Yum, but are marked as “TODO” for DNF. The dnf command-line interface, however, *does* protect a shortlist of critical packages – including itself — from being removed.

In conclusion: All graphical package managers/app stores in Fedora Linux 25 and 26 currently give you less control over your packages, use more time and bandwidth to update, and leave behind unused dependencies when you uninstall packages.

Stick with dnf on the command-line for the best experience – albeit without a graphical interface. Take a minute to set up [automated updates with DNF automatic](https://www.ctrl.blog/entry/how-to-dnf-automatic/) if you want to be less involved with your package manager.

I’m likely to reverse this recommendation and suggest you embrace PackageKit once libdnf and PackageKit support more of DNF’s functionality at some point in the future. Learning PackageKit is a “portable skill” that you’ll find useful even when you find yourself on an unfamiliar Linux distribution.

#### Sources

- [PackageKit code repository](https://github.com/PackageKit/PackageKit/tree/3affc66ca3382a9d8b5c2d1f6259c9d283f8561b?ref=ctrl.blog), 2017-06-15, commit 3affc66ca3, PackageKit project
- [DNF into C initiative started](https://web.archive.org/web/20170711162452/http://dnf.baseurl.org/2016/02/24/dnf-into-c-initiative-started/), 2016-02-24, Jan Šilhan, DNF blog
- [README](https://github.com/rpm-software-management/libdnf/blob/ea0c93dc524bb02568ea739b821d979a3ba1c86f/README.md?ref=ctrl.blog), 2017-05-05, commit ea0c93dc52, libdnf project

Package icon courtesy of the GNOME Project.
### Review of IPFire as a home router
URL: https://www.ctrl.blog/entry/review-ipfire-home/
Last updated: 2026-08-23T22:18:37.000Z
IPFire is a Linux distribution that’s focused on delivering a starting point for a router and firewall solution with a web interface. It can be made to do a whole lot, but it may not be the best fit for the needs of a home network.

I’ll not go in to performance testing at all in this review as this will vary based on your hardware. You can use any x86\_64 (or armv5tel) system with at least two Ethernet ports. You may need a third Ethernet port if you want to use an external wireless access point rather than configuring the box you want to use with IPFire as your access point.

### Installation

You’re required to know the basics of local network administration and services to use IPFire. Beyond that, you’ll also need to be familiar with IPFire’s unusual names for the standard network zones: red, green, blue, and orange for WAN, LAN, WLAN, and DMZ respectively.

These colored network zone names can be a bit confusing and they’ve standard rules applied to them, and can’t be used interchangeably. During setup, you’re presented with the following screen with no context or explanation:

![IPFire  installer: colored network zones](https://cdn.synaps.media/control/content/images/2026/08/ipfire-installer-colored-zones.png)

Here you’re asked to choose how many zones you want to use, and later which network interface to assign to each zone and how they should be configured. Without knowing which zones are what color, you may be more than a little lost and can end up with a non-functioning setup.

The remainder of the initial installation and setup process doesn’t hold any other great mysteries if you’ve ever configured a network before. Once you’ve completed the initial setup, you should have a basic working network and a working web administration interface.

The colored zone names also leads to some confusing user interfaces in the web administration interface. The below is a screenshot from the main status page. Despite “Internet” being showed with a red background, a color that’s normally used to signal that there’s something wrong, the red network/the internet interface is working just fine.

![IPFire’s main status overview](https://cdn.synaps.media/control/content/images/2026/08/ipfire-main-status-overview.png)

To make matters worse, the web interface sometimes transmits the page up to and including the red “Internet” label, while the rest of the page takes a few seconds longer to load in the web browser. The page is partially transmitted by the web server on the router, which reinforces the oddity of choosing a red/error background color in this part of the user interface.

I found it quite interesting to note that you can’t reassign or make changes to the configured network interfaces or zones from the web interface. You can reconfigure it from a terminal using the setup command, but it’s a task the web interface rally should have been able to handle.

### Wireless

You can install the hostapd package through the web interface, which adds a new menu entry called WLanAP for configuring a wireless access point on your IPFire box. WLanAP has support for configuring either a 2,4 GHz or a 5 GHz network – but not at the same time. You must choose between the older frequency range for device compatibility, or the newer range with higher speeds.

No device is allowed to connect on WLAN, as IPFire defaults to using MAC allow-listing under a page called “Blue Access”. You can disable this by adding an allow-listing entry with an empty MAC address. There’s no hint that this should work, quite the opposite in fact, but that’s how you disable it.

![IPFire add MAC to allow-list](https://cdn.synaps.media/control/content/images/2026/08/ipfire-grant-blue-access-to-all.png)

Alternatively, you can connect a dedicated wireless access point to your WLAN zone/interface. A separate guest network access point can be connected to the DMZ zone/interface.

Both of these approaches may cause you problems down the line, which I’ll get back to in more details in the ‘Getting local devices talking to each other’ section.

If you just want wireless networking to work for home use-cases, then configure a wireless access point in passive access point mode (no DHCP broadcast) and connect it you your LAN zone.

### Getting local devices talking to each other

What is a router but a bridge between your home network and the public network? Well, it can be an appliance that can wall off some portions of your network from each other. In the default configuration, devices on the LAN and WLAN can’t talk to each other. Devices in the DMZ can’t talk to any zone other than the internet.

This default zone configuration is just fine if you don’t need to transfer data from mobile devices or laptops to any device on the wired LAN. If you want to stream videos from your laptop to your [Ethernet bound Chromecast](https://www.ctrl.blog/entry/review-chromecast-ethernet-adapter/) or have device and service auto-discovery working, you’re in trouble. IPFire don’t want you to pass multicast broadcast packages between the two networks.

First of all, you can’t have multicast packets traveling between the LAN and WLAN using any method available in the web interface. You can pass TCP/UDP traffic back and forth between the LAN and WLAN zones just fine.

However, both networks need to be within reach of each other’s netmasks which is automatically computed from their assigned subnet ranges for use in DHCP broadcasts. You can configure your network in a way where they’ll be assigned different subnet ranges and a netmask that will allow multicast broadcast packages to travel between the two networks.

Such a setup can’t, unfortunately, be configured in the firewall to allow traffic to pass between them as to the firewall they’ll appear with the same network profile (netmask + subnet.) You’ll then also run in to trouble with WLAN clients as they can’t communicate with the default route, which is located on the LAN network.

The above problem is a side effect of how the zones are structured in IPFire. You’re clearly not meant to pass traffic between the two networks.

Your next best option is to combine the green and blue – I mean LAN and WLAN — networks into one network. You can accomplish this by moving the network connection for your external wireless access point from the assigned blue network interface to the green – or to behind a switch on the green network. However, if you’ve configured your IPFire box to be your access point you’ll need to be a bit more creative.

The IPFire forum and wiki contains a script that you can use to combine the two networks. The blue network will be just another part of the green network. However, the web interface won’t reflect this change, and changes you make in the web interface can end up breaking your WLAN zone without warning. It’s not a supported configuration mode and again is something that takes you out of the web administration interface to configure.

To get TCP, UDP, and multicast working you better just add a wireless access point to your LAN zone.

### Getting external things talking to your services

Port forwarding and other traditional network configuration is a breeze. You may run in to some weird word choices in the configuration interface, but if you’ve ever configured this in a consumer grade router you’re good to go.

Automatically configuring port allocations for your games, apps, and services — best known as UPnP — isn’t supported by IPFire out of the box. You can add support by installing the miniupnpd package. The default configuration of this service isn’t securely configured by default, doesn’t automatically adjust based on your network profile, and hasn’t ever worked since it was introduced in 2010.

You can fixup the configuration file in the terminal, as there’s no web administration interface for it, and get working UPnP quite easily if you’re familiar with MiniUPnPd configuration. (Who is?) I’ve submitted a patch to IPFire to at least make the service work by default after its installed. However, UPnP should just be an option you turn on for a network zone in the web administration – it shouldn’t need any more configuration than that.

### Odds and ends

By now it’s starting to become clear to me that IPFire isn’t meant for home users. At least not today’s modern homes with lots of devices needing to talking to each other unhindered. Here is a collection of odds and ends before I draw a more complete conclusion towards the end:

Good ones:

- Quality-of-Service (QoS) works out of the box. Just specify your exact bandwidth constraints, and it does a good job. This is quite unusual as routers usually need a month’s worth of configuration and repeated beatings to behave.
- Graphs and statistics are great. I’d wish there was per-host statistics for bandwidth usage, but overall you’ve all the information you could need neatly presented in the web interface.
- Easy to configure transparent HTTP web caching.

Bad ones:

- The web interface can be quite confusing. Uou may submit a form to add an entry to some kind of list, and upon submission the form changes slightly to allow you to update the entry you just added. There’s no confirmation that it was added and the values you typed in are still where you added them. There are in many places no confirmation that anything was added, and I’ve even sat there for a while waiting for it to submit and clear the form – only to realize it has been done for some time already. To add another entry, you then have to reload the page to reset the form.
- The web administration interface isn’t mobile-friendly. It’s not just not optimized for mobile, but I’d say it’s actively mobile unfriendly. IPFire’s table based layout (sic) is hard to keep in view at a reasonable size on mobile, and the hover-driven menus are all but impossible to traverse with a touch screen.
- Unfortunately, you’ll have to resort to reading the web interface’s source code to do any troubleshooting. Many error messages are vague to the point of being meaningless. They often don’t explain the problem, and the same error message is reused for different situations.
- IPFire sees regular security updates, releases, and development activity on its 2.x release branch. In 2009, a IPFire 3.0 alpha version was released. This version promises to be a complete rewrite of IPFire. However, it’s been 8 years since that initial release. I believe we can conclude that it’s in fact vaporware.

### Conclusion

IPFire can be a good starting point for a router for a home or small office network. It does require prior knowledge of networking services, but I assume you already have some if you’ve read this far.

If you want a Linux based and open-source firewall with a built-in web administration interface, then IPFire is a strong contender in a weak market.

I think I can conclude that IPFire is **not suitable for a home network.** It requires too much fiddling to get it up and running in terms of network basics like having multicast work between LAN and WLAN, and configuring UPnP.

IPFire can be made to fill the role, but it’s not purpose built for it. You’re required to know a lot about the software that runs the services you want to use. In the end, you could have just as well configured any general-purpose Linux distribution to provide this services without IPFire getting in the way.

IPFire should be treated as a generic Linux server in terms of security. The development team behind IPFire have a good track record with security updates to the services they bundle. However, your network security needs may be better served by being backed by a larger distribution with a dedicated security team such as Fedora Linux, Debian, or Ubuntu.

You’d want your home network to *just work*, and that isn’t what you get out of the box with IPFire. It may not even be what you’ve after a few hours of configuration.

#### Sources

This review was based on IPFire version 2.19 Core Update 110, and its source code.

- [Step 5: Network Setup](https://web.archive.org/web/20190504163124/https://wiki.ipfire.org/installation/step5?rev=1470098168), 2016-08-02, revision 1470098168, IPFire Installation Handbook, IPFire wiki
- [Wireless access point](https://web.archive.org/web/20190504163545/https://wiki.ipfire.org/addons/wireless/start?rev=1469664891), 2016-07-28, revision 1469664891, Addons, IPFire wiki
- [Combine green and blue to form one logical network](https://web.archive.org/web/20190504155833/https://wiki.ipfire.org/configuration/network/bridge-green-blue?rev=1407253250), 2014-08-05, revision 1407253250, IPFire wiki
- [miniupnpd.conf](https://github.com/ipfire/ipfire-2.x/blob/7331b247574f78c835551d9f2944483cb1381b94/config/miniupnpd/miniupnpd.conf?ref=ctrl.blog), 2010-11-22, revision 7331b24757, IPFire repository, GitHub

**Reviewed:** [IPFire](https://www.ipfire.org/?ref=ctrl.blog)

**Review rating:** 4 / 10
### Devices that speak in the night
URL: https://www.ctrl.blog/entry/shut-up-roomba/
Last updated: 2026-08-23T22:21:56.000Z
*The room is dimly lit and it’s 02:30 in the morning. My internet service provider is doing some unscheduled maintenance and my internet connection is down. I probably should have been sleeping…. Then all the sudden, a loud female voice starts talking behind me:*

> “Error 15: ‘Press CLEAN to restart.’”

The above isn’t the start of some bad sci-fi novel set in the slight-future. It was an episode that scared the heck out of me a couple of nights ago.

As anyone who’ve walked up behind me and started talking while I’m concentrating on something can attest to: I’m easily startled and I can jump surprisingly high. I also make the most manly of screams.

It took me half a minute to realize that it was my needlessly-internet-connected Roomba 960 robotic vacuum that had spoken from its parking position. Apparently, it was unhappy about the disruption of internet service and wanted someone to take care of it. I felt the same way myself, but there wasn’t much I could do about it.

I believe this is the perfect time to introduce a revolutionary new general design rule for any internet connected device that provide spoken feedback: **REMAIN QUIET UNTIL MORNING!** That applies to almost all types of devices that provide any type of audible feedback.

Unless there’s a fire or a danger to health and safety, then *things* should remain quiet during the night. They most certainly shouldn’t start talking loudly on their own initiative!

The error in question, according to [iRobot’s documentation](https://web.archive.org/web/20190504164602/https://homesupport.irobot.com/app/answers/detail/a%5Fid/8967/~/wi-fi-connected-roomba%3A-error-15), is an “internal error” and I should hold the Clean button pressed for ten seconds to reset it. This could have waited till morning.

I don’t have a talking digital assistant or “cylinder lady” in my home. However, I certainly hope they’re smarter than my Roomba when it comes to understanding the concept of quiet time.
### Embed a JavaScript CDN in your web browser with Decentraleyes
URL: https://www.ctrl.blog/entry/decentraleyes-cdn/
Last updated: 2026-08-23T22:04:44.000Z
[Decentraleyes](https://decentraleyes.org/?ref=ctrl.blog) is a browser extension for Mozilla Firefox and Google Chrome that acts as a content delivery network (CDN) for popular JavaScript libraries right from within your browser. This reduces page load times and bandwidth costs as some popular libraries can be loaded from your device. It also reduces your reliance on potentially-privacy-worrisome external repositories of open-source libraries.

Decentraleyes is strictly speaking only useful if you’re bandwidth constrained or very worried for your privacy, but it’s a neat idea non the less.

Decentraleyes works by identifying liked resources from known content delivery networks and replacing them with links to the same version of the same JavaScript library from inside the extension. This causes the library to be loaded from inside the extension rather than fetched from the web. Decentraleyes ships with multiple versions of all the most popular open-source JavaScript libraries by default.

Before the page starts fetching external resources, such as JavaScript files, the links to external content networks known to Decentraleyes is rewritten to the same version of the same library stored inside the extension. No HTTP connections are ever made to the CDN when addresses can be successfully rewritten. This address rewriting causes the origin of the library to change, witch can be a problem on some secure websites.

### `Content-Security-Policy` trouble

Meddling with the security of websites by an extension is understandably not allowed under Mozilla’s policies for extensions. The wording specifically says than an extension isn’t to “Degrade the security of HTTPS sites” nor “Create or expose security vulnerabilities”.

`Content-Security-Policy` (CSP) is a standard specifications that lets HTTPS websites allow-list a set of domains/origins from which the browser may load external content such as images and JavaScript. By changing the origin of a JavaScript library from a CDN that a website has allow-listed to an unknown origin, in this case to the extension’s own origin, the browser will enforce the `Content-Security-Policy` and block the library from being loaded.

This problem can’t be solved under Mozilla’s current extension policies of not weakening website security. Decentraleyes’ only option is to either block-and-don’t replace the library, which some users may find useful, or to allow the library to b loaded from the external CDN when it detects a strong `Content-Security-Policy`. Currently, this problem results in a few broken websites here and there when using Decentraleyes.

**Update** (2017-11-05): Version 2.0.0 has been completely rewritten using the Firefox WebExtension API. However, this problem remains unresolved — and now even more website use CSP and run into problems with Decentraleyes.

### So, what is the privacy problem, anyway?

The privacy issue that Decentraleyes wants to fix is all about the referrer header. Like [the issue I discussed last week](https://www.ctrl.blog/entry/private-bts-referrer-header/), the HTTP referrer header can leak information about what websites you visit. A content distribution network receives requests from your web browser every time you visit any page that loads anything from them.

The most popular CDN providers thus receives a lot of signals about which webpages interest a user, even though the CDN is supposedly only providing hosting services.

It’s interesting to note that some of the free content delivery networks are provided by data brokers like Google and Baidu. EFF’s [Privacy Badger extension](https://www.ctrl.blog/entry/privacy-badgering/) automatically detects some of these CDNs as trackers and will automatically block them.

Decentraleyes as of version 1.3.8 supports many of the most popular open-source JavaScript libraries including Angular, Backbone, Dojo, Ember, ExtCore, jQuery, jQuery UI, Modernizr, Mootools, Prototype, script.aculo.us, SWFObject, Underscore, and Web Font Loader. Library substitution only takes place when they’re loaded from known content delivery networks including Google Hosted Libraries, Microsoft Ajax CDN, Cloudflare, jQuery CDN and jsDeliver (MaxCDN), Yandex CDN, and Baidu CDN.

I hope to see a resolution to the `Content-Security-Policy` problem, and to see a longer list of supported content delivery networks in future updates to Decentraleyes.

#### Sources

- [Review Policies](https://web.archive.org/web/20200123033237/https://wiki.developer.mozilla.org/en-US/docs/Mozilla/Add-ons/AMO/Policy/Reviews$revision/1246395), 2017-05-19, revision 1246395, AMO Policies, Mozilla Developer Network wiki, Mozilla
- [Content Security Policy (CSP)](https://web.archive.org/web/20200123033242/https://wiki.developer.mozilla.org/en-US/docs/Web/HTTP/CSP$revision/1229193), 2017-04-09, revision 1229193, HTTP, Mozilla Developer Network wiki, Mozilla
- [Library blacklist blocks valid submissions](https://github.com/mozilla/addons-linter/issues/1035?ref=ctrl.blog), issue 1035, Mozilla Firefox Add-ons linter repository, GitHub
- [How to override Facebook CSP in Firefox Add-on](https://stackoverflow.com/q/22882483/656132?ref=ctrl.blog), Stormvision, StackOverflow
### KMail’s Send Later sent PGP encrypted emails in plain-text
URL: https://www.ctrl.blog/entry/kmail-cve-2017-9604-openpgp/
Last updated: 2026-08-23T22:12:39.000Z
I recently discovered the security vulnerability CVE-2017-9604 in the KDE Project’s KMail email client. This vulnerability led KMail to not encrypt email messages scheduled to be sent with a delay, even when KMail gave every indication that the email contents would be encrypted using OpenPGP.

OpenPGP, or Pretty Good Privacy, is a standard for digitally signing and encrypting email contents that can provide end-to-end encryption. OpenPGP, when implemented correctly, can provide integrity checking and tamper-proofing of received email messages, as well as concealing the contents of an email message. An encrypted email message’s headers, including the sender and recipient, are left unencrypted to facilitate delivery of the message through the existing email infrastructure.

KMail, an email client from the KDE Project, introduced a new feature in version 4.11 that lets users delay sending of emails until a scheduled later time. Unfortunately, this new feature wasn’t compatible with KMail’s existing OpenPGP implementation.

If you combined the two features, KMail would give every indication that the email message would be signed and encrypted. However, upon scheduling it to be sent at a later time, the OpenPGP routines were bypassed – leading to the email being sent in plain-text without being signed or encrypted. The bug would lead to unintentional information disclosure of private message contents.

I reported the problem to KDE’s security group, and the problem was promptly fixed by KDE developer Laurent Montel.

KMail versions between 4.11 and 17.04.1 are vulnerable. KMail version 17.04.2, released on 2017-06-08, contains a fix for the problem. You should update KMail before sending any private messages with OpenPGP, to ensure your messages will remain private. Different Linux distributions will push out this update on their own schedules.

KMail’s documentation does urge users to verify that OpenPGP works before they start using it:

> “\[It\] is important that you test if encryption works with your setup before you start using it seriously. KMail might not warn you if something fails.”

The documentation didn’t provide any instructions for *how* you’d test and verify that encryption works. I was testing to see whether encryption was working by sending delayed encrypted emails to myself using the Send Later with Delay feature in KMail.

I thought it was a good way to inspect that the message would be encrypted in a way that wold be compatible with other OpenPGP capable email clients before sending the message.

#### Sources

- CVE-2017-9604: [KMail: Send Later with Delay bypasses OpenPGP](https://kde.org/info/security/advisory-20170615-1.txt?ref=ctrl.blog), 2017-06-15,KDE Project Security Advisory, KDE
- [KDE Applications 17.04.2](https://kde.org/announcements/announce-applications-17.04.2/?ref=ctrl.blog), 2017-06-08, KDE Announcements, KDE
- [KDE Applications 4.11](https://kde.org/announcements/4/4.11.0/applications/?ref=ctrl.blog), 2013-08-14, KDE Announcements, KDE
- [New in kdepim 4.11: Send Later Agent](http://famillemontel.org/index.php/2013/07/06/new-in-kdepim-4-11-send-later-agent/?ref=ctrl.blog), 2013-07-06, Laurent Montel, KDEPIM KDE and opensource
- [Signing and Encrypting Messages with GnuPG](https://web.archive.org/web/20170719224843/https://docs.kde.org/stable5/en/pim/kmail2/pgp.html), Using KMail, KDE Documentation, KDE
- [kmcomposerwin.\[cpp|h\]](https://invent.kde.org/pim/kmail/-/commit/78c5552be2f00a4ac25bd77ca39386522fca70a8?ref=ctrl.blog), 2017-06-02, commit 78c5552be2, KMail repository, KDE
### Disappointed by own expectations for Zelda: The Breath of the Wild
URL: https://www.ctrl.blog/entry/zelda-wild-expectations/
Last updated: 2026-08-23T22:26:12.000Z
I’ve just played through the endgame in Zelda: The Breath of the Wild and I’ve to say that I was disappointed.

Here is what I believed to be a unique take on the story of Breath of the Wild. I’ll try to answer whether the game lead me to believe there would be more to it? or if I mislead myself.

I’ve never played a Zelda game before. I’ve owned a couple of Nintendo game consoles over the years, but I never got into any of the Zelda games. I didn’t quite know what to expect other than adventure, exploration, and grinding in repetitive tasks to level up. The game certainly delivered on these points and I quite enjoyed roaming around exploring Hyrule.

My expectations for the final stage of The Breath of the Wild was, however, way off the mark. From the beginning of the game, the player is repeatedly told that the endgame will be a hard-fought battle against Calamity Ganon (or the “swirling swine” as he is best described as he is shown as a dark shadow swirling around Castle Hyrule.) Link has to collect legendary equipment and prepare for an epic battle at Hyrule Castle against “hatred and malice incarnate”. Oh, and killer robots called “Guardians”.

This article spoils the entire game.

### The set up

Zelda: The Breath of the Wild is an open world game focused on exploration. The world of Hyrule is populated by mostly humanoid creatures and monsters. The Hylians, except for the protagonist Link and Princess Zelda were defeated 100 years ago by Calamity Ganon. Ganon wants to destroy the world for no reason – fair enough.

Ganon has been kept back at Castle Hyrule for the last 100 years by Princess Zelda using feminine charms. The game is a bit unclear on exactly how the Princess has managed to achieve that last part. Meanwhile, our protagonist Link has taken a nap in the Shrine of Resurrection for the last 100 years. The opening scene of the game, pictured above, shows Link having just been woken up from his stay at the spa, and find himself with a complete loss of memory. The player gets a fairly blank slate and learns the mechanics and state of the world alongside Link.

Alongside the Hylians, there are four other main races still roaming Hyrule. Each of the four races have their own “divine beast”, and you’re told that you need to wrest control of these mechanical monstrosities away from Ganon and use all of them to defeat him.

There are monsters and killer robots running all over Hyrule, so you quickly need to relearn how to battle these creatures to survive. —and you need to learn how to cook to heal yourself back up to full health.

### Entering the wild

From the opening scene, you can choose to pretty much run straight in to meet the Calamity Ganon after just minutes of gameplay. You’ll be brutally murdered long before you reach him at Hyrule Castle, but the game does give you the option to try.

Taxation in Hyrule much have been pretty tough, as the Hylians apparently could afford paying the ancient — now extinct — Sheikah race to build 120 personalized gyms, or “shrines”, where Link can train his puzzle solving abilities and skills with a sword. As you run around Hyrule, you’ll find these strewn all around the landscape.

Link is given a ‘Sheikah slate’ early in the game, a tablet computer with a camera and various sensors that also work as a single-sign-on authentication device for entering shrines and downloading apps (or “rune powers”) and map updates. Like in real life, you’ve to wait for the updates to be applied in unskippable OS update cutscenes. The game could do without that bit of realism.

My main issue with the main part of the games are the misuse of cutscenes. There are small, annoying, multi-part cutscenes everywhere. Watching Link wave his iPad over an access panel, or standing on an elevator platform gets tiresome very fast. Some cutscenes are skippable, but different cutscenes use different buttons on the controller to skip them. If you can’t be bothered to learn which type of cutscene uses which skip button, then you’ll be reduced to aimlessly mashing the controller hoping the dreadfully repetitive cutscenes will end.

Along the way, you’ll rediscover some of Link’s lost memories. Or actually, they’re all memories of Princess Zelda — Link is entirely mute throughout the game and only communicates with others through hand gestures, so Zelda does all the talking. It’s slowly revealed that the background story of the game is Princess Zelda’s quest to become a woman – and unlock the “power to seal Ganon away”. She doesn’t discover said power until she comes of age on her 17th birthday, which is a tad too late to save the Kingdom of Hyrule.

At the center of the map, you’ve got an ever present reminder of what you’re trying to achieve. Castle Hyrule is dark and ominous, and if you get to near in the early game — you’ll be slaughtered by a Guardian robot.

You’re for the most part left with few instructions about anything and just have to make your way towards the castle. I spent hours and hours just solving shrines, battling monsters, hunting animals and gathering ingredients for cooking, and just exploring the beautiful landscape. It didn’t even feel all that repetitive because of the variety in landscape and there’s enough new stuff to keep the interest going.

You’ve to find weapons and different environment-specific clothes for Link before entering a new region of the map. Link starts out in his boxers, but you’ll hopefully have found him some decent weapons and armor before setting off to defeat Ganon.

You can choose to encounter four optional bosses that also double as large puzzle sets. The divine beasts, as they’re called, are mechanical monstrosities designed by the Sheikah race, that were meant to help defeat Ganon.

However, due to poor engineering and outdated firmware — the divine beasts are captured by Calamity Ganon. The Sheikah have already demonstrated that their devices are capable of installing software updates, so we’re left to assume that Ganon exploited a 0-day vulnerability in the divine beasts.

The beasts are in themselves quite interesting. Each divine beast is conquered in three parts: first you’ve to use different game gimmicks to defeat them, then you enter them and solve a set of puzzles inside which lets you take control of them, before you finally have to defeat a miniature version of Ganon himself.

Once you’ve recaptured a divine beast, it takes up position and aim at Castle Hyrule — waiting to strike against Ganon, and waiting for a signal from Link.

### Storming Castle Hyrule

Eventually, you feel that you’ve done all that you can to prepare Link for the final showdown with Calamity Ganon. Every shrine you can find is solved, every mystery unraveled, every enemy (and animal) slain, and every rock turned. (You do have to pick up and turn every loose rock in the game, but that’s a story for another time.) It’s time to storm the gates!

I expected the castle to be as large an area as the other main regions on the map. However, only 18 minutes after entering the castle, I’d already defeated Ganon and felt disappointed with the endgame. I’d expected so much more of the final stage!

Shouldn’t Castle Hyrule have been more of a maze? I expected the whole thing to be one giant maze! Depending on where you enter the castle from, there are some simple puzzles you can choose to traverse. Optionally, you can just fly up the castle walls from the outside.

There isn’t much more to this final stage than finding Ganon. I don’t know about you, but I’d expected so much more. What I miss is for more of the elements of the game to play a role in the endgame, really. The boss battle itself was disappointingly bland on its own. However, there’s so much more to the game than the fighting!

At one part of the game, Link has to dress up as a woman to enter a women-only town out in the desert. So, I’d expected to sneak past guards and play masquerade at some point of the endgame.

The game has a lot of focus on cooking and preparing dishes. Links learns to cook different meals through reading, quests, experimentation, and non-playable characters in the game. I’m not entirely sure what I’d expected, but I did expect it to play some part of the endgame. Maybe not a “Cooking with Moblins” contest or something silly, but possibly something requiring Link to demonstrate his cooking prowess to solve a puzzle.

The Guardians played a small role in the endgame. They were originally designed by the Sheikah and was meant to serve the same purpose as the divine beasts.

However, the Guardians developed the same fatal software flaw that allowed Ganon to capture the divine beasts. Link encounters two “ancient tech” (technology left behind by the Sheikah) scientists in the game. I expected that at some point I’d use their help to capture a small army of Guardian robots that would help me storm the castle.

### Defeating evil

Halfway up the castle you find Calamity Ganon hanging in the ceiling of a large room. Finding out the final boss had been hanging out in a ceiling like a lump/bat for the last 100 years was a bit anticlimactic on its own. Having him fall down and smash through the floor to fall straight down a garbage chute to a battle arena located deep below the castle was another major disappointment.

The entire battle with Calamity Ganon takes place in a single round room. I’d expected that Ganon and Link would make use of the main castle as the stage for their final showdown. Being confined in a small room was definitely not what I’d imagined and disappointing. The Castle has multiple exterior levels and details that could have been put to good use as an open battle arena. The castle itself could be an increasingly challenging puzzle mixed with increasingly difficult combat. Instead, players are treated to the least interesting area of the game and a final boss less interesting than any of the divine beasts.

Speaking of the divine beasts, they were another disappointment. I’d imagined that I’d to get Ganon to retreat to the top of the tallest tower, and only then would the divine beasts attack Ganon. Otherwise their attack would completely destroy Castle Hyrule itself, right?

What happened instead as soon as Ganon falls into the battle arena, Durak, the Goron champion, proclaims: “Open up wide, Ganon!” As he shouts that, all four divine beasts open up a laser attack which results in a rain of small lasers hitting Ganon. Each divine beast knocks off ⅛ of Ganon’s health in the opening attack. If you’ve got all four divine beasts, that means Ganon start the battle at ½ health.

That’s it. The massive divine beasts are only capable of a single underwhelming shot each. After that, Link is left to defeat Ganon on his own with no further support from the massive mechanical beasts. What follows is a standard game boss battle in two rounds. The second round takes place outside the castle ground — again ignoring the castle as a possible battle arena — and is an even less impressive fight than the first round.

### Then it was all over

The game delivered a varied and entertaining gameplay before reaching the final stage. I’d give the game experience until entering Castle Hyrule quite a high score. However, the endgame didn’t deliver on the game’s promise. I’m especially disappointed about having to battle Ganon inside a fish bowl in the basement of the castle rather than putting the castle exterior to better use.

The endgame was weak, and didn’t feel like it was any sort of conclusion nor a satisfying reward for all the hours I put in to the game. Maybe I’m expecting too much of a game, but I don’t feel the end to Breath of the Wild was anywhere near the level of good gameplay and not at all interesting compared with the rest of the game.

Breath of the Wild is an excellent game. The endgame, however, didn’t seem to be from the same game designers – let alone the same game. The game just ended as abruptly and unsatisfactory as this article.
### Fedora Linux specific tweaks for Raspberry Pi
URL: https://www.ctrl.blog/entry/rpi-fedora/
Last updated: 2026-08-23T22:21:27.000Z
Fedora Linux 25 has added support for Raspberry Pi 2 Model B and 3 Model B. Fedora Linux is an as excellent a choice for your Raspberry Pi as it’s for your desktop and laptop PCs. It comes with up-to-date packages and innovative new technology, as you’d expect from Fedora Linux. Here are a few things you can do to get a slightly longer lifetime from your SD card and a better experience running Fedora Linux on your Raspberry Pi.

These tips were written for Fedora Linux 25 and 26 Server edition, but are applicable for the Workstation and other editions too.

If you poke around the web, you’ll find quite a few tips for improving the life expectancy of your SD card — all focused around reducing write operations — and gaining performance on the Raspberry Pi. Fedora Linux already does many of the most commonly mentioned optimizations by default. Including disabling the recording of file “access times” (when a file was last opened) and the use of chronyd over ntpd for internet time keeping.

There are still some things you can do on a low-resource system like any model Raspberry Pi to improve your experience:

### Disable delta RPM updates

[Delta RPM updates](https://www.ctrl.blog/entry/how-to-fedora-drpm-network-bandwidth/) are designed to reduce the bandwidth requirement of keeping packages up to date in a fast-moving ecosystem such as Fedora Linux. However, this bandwidth saving comes at the expense of more CPU processing times. The latter is more likely to be the limiting factor on a Raspberry Pi, so unless you need to keep your bandwidth use down – then you’ll get **much faster system updates** by disabling delta RPMs.

To disable the use of delta RPMs, set the deltarpm option to False in /etc/dnf/dnf.conf.

### Auto-update

By default, Fedora Linux will fetch new updates to the package repository metadata once ever hour. You may wish to tune this down to once or twice a day instead. I’ve covered this already in a [previous article](https://www.ctrl.blog/entry/how-to-fedora-drpm-network-bandwidth/) (towards the end) that also contains some other tips on getting the most out of DNF.

Fedora Linux doesn’t automatically download nor install updates to your system. However, if you can admit to yourself that you’re lazy and unlikely to actively maintain the system on a regular basis, you should consider configuring [fully automatic updates with DNF](https://www.ctrl.blog/entry/how-to-dnf-automatic/).

At the very least, you’ll want to use [Cockpit Software Updates](https://www.ctrl.blog/entry/cockpit-packagekit/) to remotely manage software updates.

### Reduced logging to disk

Wear-out from excessive write operations is a common concern for low-resource systems like the Raspberry Pi that relies on SD cards for storage. Fedora Linux defaults are already quite good in this area. You should still review any extra software you’ve installed to the system to make sure they’re well-behaved.

Excessive log writing can be a source of unnecessary writes. Except for CRIT, ALERT or EMERG who are written to disk immediately, the systemd journal will only log to disk every five minutes (the SyncIntervalSec option controls this behavior.) This is a nice way to reduce log-writes. You should review your /var/log/ directory and reconfigure programs not currently logging to systmed, and refer to their manuals for ways to reduce their logging verbosity. You probably don’t need all log messages.

In the spirit of not needing every logmessage, you can also configure the systemd journal to store fewer less-important messages to disk. You can drop info, notice, and debug messages by setting the MaxLevelStore, MaxLevelSyslog, and MaxLevelConsole options to "warning" in /etc/systemd/journald.conf. Any message including and above this logging level (emerg, alert, crit, err, and warning) will be stored in the journal, and lower priority messages will be ignored.

So, I didn’t have anything new or revolutionary to share in this text. I believe that’s generally a good thing and only mans Fedora Linux provides a pretty good experience right out of the box on any hardware.
### Private bug trackers leak data on security and other known issues
URL: https://www.ctrl.blog/entry/private-bts-referrer-header/
Last updated: 2026-08-23T22:16:02.000Z
Private bug trackers disclose data about bug reports to any website that publishes information about security vulnerabilities or other issues that affect the organization.

It’s easy to picture the scene. A new security vulnerability has been discovered. Everyone scrambles to fix it before anyone manages to exploit it and damage their reputation. Issue trackers are being filled up with requests from managers linking to news stories telling horrifying tales of a new security exploit. The organization is definitely vulnerable and the overtime-pay clock is ticking.

The Heartbleed bug was a named issue in the OpenSSL library that started a new trend for security disclosures: It had a domain name, website, and even a logo. All designed to attract more media attention to the quite severe security vulnerability. Other important security issues that have been disclosed since has since copied this approach including Dirty Cow, Shellshock, and Stagefright. CVE numbers are so last year.

So, what changes now that the people who disclose security issues now run their own websites? They can start to collect direct information from responsible organizations that are trying their best to keep up with the latest security news. The vulnerabilities website can be an important resource, and everyone involved clicks through to read up on the implications of the vulnerability. It’s not only the individual or organization that disclosed the vulnerability that gets this data. All the forums, blogs, and news websites that cover the disclosure also get their share of links in internal bug trackers.

By default, browsers will transmit a Referer (sic) header field containing the referring website’s address. Sharing this information is usually not a problem as the use of it’s usually limited to marketing, analytics, or vanity purposes. Due to legacy standards, the header is freely shared between HTTPS websites cross-origins, but browsers may unset it when clicking through from HTTPS to a HTTP website. Since more and more websites now use HTTPS by default, this standard behavior no longer — if it ever did — protects privacy.

The Referer header contains more information than just accessing a page from an IP address allocated to an organization. You can tell what company an IP belongs to, but you can’t know who is visiting and why. Small and medium organizations also don’t own their own allocated blocks, making it difficult to identify them through an IP address alone.

I’ve written about my [local banks’ TLS implementations](https://www.ctrl.blog/entry/tls-ratings-norwegian-banks-update/) and [number formatting with HTML5 inputs](https://www.ctrl.blog/entry/html5-input-number-localization/) in the past. These two texts alone have let me collect the URLs to the bug tracker of every local and many international banks and payment processors who’ve referenced these issues in their private bug trackers. A fair amount of other articles, which often covers various specific technical problems, have also ended up being linked from private bug trackers.

Another example I see in my server logs are from various popular public discussion board software. These often allow users to exchange private messages between each other. The links to these messages will include the user IDs of both the sender and recipient. In a private discussion that contain links, the Referer header will include the forum identities of both participants in addition to their topic of conversation (obviously, the referred website or its topic.)

Web app developers can to some extent control what Referer headers are sent when users click-away from their pages. The [Referrer Policy](https://www.w3.org/TR/referrer-policy/?ref=ctrl.blog) is a Candidate Recommendation from the World Wide Web Consortium (W3C) that introduces several mechanisms for instructing browsers on how much data they should include in the Referer header if any. It’s not widely supported by browsers yet, but adoption interest is promising.

I believe the default behavior of web browsers today is good as-is. There’s value in being able to track what other *public* discussions are taking place about the subject of a webpage. However, measures should be taken to ensure that *private* discussions — like private forums, chat rooms, webmail apps, and bug trackers — opt-out of this relation data sharing.

Application developers should consider whether headers should be sent from their environment. A good rule of thumb is that if any page that has limited private distribution and require authentication to access, should not send Referer headers. Developers need to define and inform browsers of their Referrer Policy. Technically, this i achieved either by adding a small piece of metadata to the page or individual links, or by appending an extra HTTP header.

In summary: Referrer headers are normally harmless, but should be disabled in any non-public context. The existence of a link stored in a bug tracker or exchanged by email under a corporate domain may be more information than you’re willing to share.

#### Sources

- [Referrer Policy](https://www.w3.org/TR/referrer-policy/?ref=ctrl.blog), 2017-01-26, Candidate Recommendation, W3C
- [Tighter Control Over Your Referrers](https://blog.mozilla.org/security/2015/01/21/meta-referrer/?ref=ctrl.blog), 2015-01-21, Sid Stamm, Mozilla Security Blog
- [Referrer Policy](https://caniuse.com/?ref=ctrl.blog#feat=referrer-policy), Can I use … ?
- [Heartbleed, Shellshock, and other security logos](https://access.redhat.com/sites/default/files/video/files/20150616-lightning-mjc.pdf?ref=ctrl.blog), 2015-06-16, Mark Cox, Red Hat
### Google Contributor resurfaces as a subscription management platform
URL: https://www.ctrl.blog/entry/google-contributor-twopointoh/
Last updated: 2026-08-23T22:08:55.000Z
Google just relaunched Google Contributor as a service for managing “ad removal passes” on behalf of websites that users have opted-in to supporting. The ad removal passes places a fixed cost per page load at participating websites instead of the old model where users would automatically compete to buy-out the ad spaces in the regular ad auction.

After [the old Google Contributor shut down](https://www.ctrl.blog/entry/google-contributor-no-new-signups/) in December 2016, the Google Contributor website just read “We’re launching a new and improved Contributor in early 2017!”. It’s now six months later and mid-2017, but Google Contributor is now back and have taken on a very different form.

Google Contributor was a scheme where users could pay a monthly subscription fee that was used to [outbid the cheapest/worst ads](https://www.ctrl.blog/entry/google-contributor/). The fee would be divided out among the websites the subscriber frequented and would hide an estimated 20–40 % of ads served by Google in a month.

The new Contributor service is only open for participating websites. Users must now opt-in to purchase an “ad removal pass” per website rather than having the Contributor service work on every website that served advertisement by Google.

Subscribers no longer pay a monthly subscription fee that’s divided out among the websites they visit automatically. Instead, they fill up their account with funds with are used to pay participating websites per unique page load instead. Users are told the price per page-load when they sign up for an “ad removal pass” on a specific website.

Websites are free to set whatever cost they want per page, but Google seem to be suggesting 0,02 USD per page. Google will handle subscription, charges, and ad removals automatically for the website through Google’s ad platform.

It is unclear if participating websites must commit to only display ads from Google. This seems to be the only way the new Contributor service could work as subscribers will expect all ads to be removed.

In the old Contributor program, websites didn’t have to make such commitments to Google as the program only worked on ads served by Google.

Google seems to position Contributor as a complimentary service to the recently announced bad-ads blocker that the company is working on adding to their Chrome web browser.

The new Contributor is in my opinion less interesting than the old automated Contributor service. Users are unlikely to subscribe to many websites and they’ll not get all that much out of their subscription. Under the old subscription scheme, you’d notice pretty much right away that ads where disappearing (or were [replaced with pictures of cats in “meow mode.”](https://www.ctrl.blog/entry/google-contributor-revisited/))

The old Google Contributor was a solution to fix a systemic problem with bad ads on the web. The new Contributor is a far less ambitious subscription management service for large websites that want to offer a pay-per-page solution.

The only thing I find mildly interesting is the potential that Google Contributor’s ad removal passes have to slim down websites enough until the price per page load decreases compared to a non-subscribing user in terms of mobile data fees. This, however, is more a reflection of the failure of websites to optimize (or even care about the cost of data) for their visitors on mobile devices.

On a more positive note, Contributor has finally expanded beyond the United States and is now also available in the United Kingdom, New Zealand, and Germany. If you live outside these regions and may be interested in alternatives that work more like the old Contributor program, check out [Brave Payments](https://www.ctrl.blog/entry/brave-payments/) or the [re-imagined Flattr](https://www.ctrl.blog/entry/flattr2/) micro-payment service.

#### Sources

- [Building a better web for everyone](https://blog.google/technology/ads/building-better-web-everyone/?ref=ctrl.blog), 2017-06-01, Sridhar Ramaswamy, Journalism & News, The Keyword, Google
- [How Contributor works](https://web.archive.org/web/20170603015000/https://support.google.com/contributor/answer/6182580), 2017-06-01, Contributor Help, Google
- [Pricing](https://web.archive.org/web/20170603014847/https://support.google.com/contributor/answer/7359560), 2017-06-01, Contributor Help, Google
- [Where’s Contributor available?](https://web.archive.org/web/20170603015045/https://support.google.com/contributor/answer/6182581), 2017-06-01, Contributor Help, Google
### Should you trust Fedora Linux to automate updates?
URL: https://www.ctrl.blog/entry/dnf-unautomatic/
Last updated: 2026-08-23T22:05:10.000Z
Short answer: Yes, dnf-automatic works great. Except when external repositories are involved.

Earlier today, I wrote about how you can [configure Fedora Linux to download and install updates automatically](https://www.ctrl.blog/entry/how-to-dnf-automatic/). Avid readers of my blog may recall some of my earlier writings on auto-updates including [The constant software update tyranny](https://www.ctrl.blog/entry/software-update-tyranny/) and [The software update experience sucks!](https://www.ctrl.blog/entry/software-updates-suck/) These articles were primarily about Windows, and the gist of those articles were that software updates mustn’t get in the way of letting the user get their things done with forced automated updates and interruptive dialogs.

Automated updates in Fedora Linux just does its thing in the background without getting in your way – until a point. Occasionally, you do need to reboot the system to apply an update, but it’s not done automatically. The user stays in control of their system and can reboot at their leisure. The package management system, DNF, can be configured to notify the user of updates through the systemd journal, email, or a custom command to trigger a notification up pending or completed updates.

If you reboot your PC or server running Fedora Linux once a week, you only need to worry about the end-of-life for the release – which is about every two years. As long as you stick with using the Fedora Linux repository only, you shouldn’t have any problems with automated updates.

That last caveat can be a real problem for Workstation deployments that rely on proprietary firmware blobs. Proprietary firmware blobs are generally a problem in themselves, but in the Fedora Linux ecosystem they’re more of a problem than say Ubuntu because the Fedora Linux repositories don’t include any proprietary blobs out of principle. Users have to turn to third-party repositories like the popular RPM Fusion repositories for device drivers.

In my own experience, Fewer and fewer devices rely on proprietary drivers. However, my main PC relies on the \[a\]kmod-nvidia graphics card driver and although I’ve [replaced the Broadcom chip in my primary laptop](https://www.ctrl.blog/entry/replace-broadcom-wifi-with-intel/); I can’t do the same with the Broadcom chip in my non-serviceable MacBook. I believe the broadcom-wl wireless network driver has been the most troublesome package I’ve ever installed on any system, and it causes issues working every few months or so.

The problem with third-party repositories, and especially when used for hardware support, is that they quickly become out of sync with the Linux kernel version available in the main Fedora Linux repositories. Firmware drivers, often implemented as kernel modules, often rely on specific versions of the Kernel to function, and external repositories aren’t part of the testing and release cycles of Fedora Linux.

They also can’t magically produce newer versions of proprietary blobs once these stops working with the kernel version that Fedora Linux ships. To make things worse, external repositories are often maintained by small teams with limited abilities to respond quickly to new kernel releases.

RPM Fusion has a sort-of-solution to this problem called akmods. Akomds are kernel modules that will attempt to automatically rebuild themselves after an updated kernel has been installed and booted. The rebuild process is done on the first boot-up with a new Kernel, and can take significant time even on a high performance modern desktop PC.

Unfortunately, these kernel module rebuilds don’t always work – or will conflict with automatically installed open-source drivers pushed from the main Fedora Linux repository. Which means you end up with a system without working devices after an upgrade.

Now, none of the above is the fault of DNF automatic. However, its reason to be a bit conservative regarding automatically applying updates to a system that relies on proprietary firmware blobs.

You may also see version conflicts when the main Fedora Linux repository updates a package that a piece of software that you’ve installed from a third-party repository has marked as a dependency.

For my own purposes, I’ve turned on automatic downloads on every machine. Priming the cache means I spend less human-time on updates. This is a no-brainier unless you’re in a bandwidth constrained environment — for which [DNF also provides solutions](https://www.ctrl.blog/entry/how-to-fedora-drpm-network-bandwidth/) that can be combined with automatic updates.

I’ve also turned on automatic installation of all updates on some of the servers I manage. I’ve enabled automated installation security updates all my other PCs. The only exception is my MacBook which depends on the Broadcom firmware for networking. A laptop is pretty useless to me without wireless networking, and the Broadcom driver has failed quite often on me after system updates. I like to only update this machine in a controlled environment.

I’ll update this post in the future if I run into any serious problems with automated updates in Fedora Linux.

#### Sources

- [Kernel modules: Akmods](https://rpmfusion.org/Packaging/KernelModules/Akmods?action=recall&rev=6&ref=ctrl.blog), 2016-07-14, revision 6, RPM Fusion wiki
### How to get Fedora Linux to take care of its own updates
URL: https://www.ctrl.blog/entry/how-to-dnf-automatic/
Last updated: 2026-08-23T22:09:44.000Z
Applying software updates can be time-consuming, and your time is often better spent on just about anything else. Except that you also has to stay on top of security and stability updates. Here is how you can find equilibrium by having Fedora Workstation or Server to automatically download, and optionally install, updates as they become available.

Automated updates keep your system up to date with the latest security, stability, and feature updates for all your software that have been installed from a Fedora Linux repository. When configured, it allows you as the system administrator to spend your time doing other things than constantly having to update all the systems you maintain.

If you’re using any repositories other than the default repositories, including RPM Fusion, then you’ll want to read this [companion article](https://www.ctrl.blog/entry/dnf-unautomatic/) before proceeding. Updates maybe more complicated if your system differs too much from the Fedora Linux project’s expectations.

Fedora Linux’s automatic updates work very similarly `unattended-upgrades` in Ubuntu. Automated updates in Fedora Linux are part of the DNF package manager but the necessary components not installed by default in Fedora Workstation nor Server editions.

DNF offers similar automatic update features to the `unattended-upgrades` system in Ubuntu and Debian. Both systems share the limitation that they won’t automatically reboot the system to complete any updates.

To configure automatic updates, you’ll first need to install the `dnf-automatic` package:

```shell
dnf install dnf-automatic
```

Next, you need to review the configuration file stored at `/etc/dnf/automatic.conf`. Here you’ll need to make some decisions about the level of automation you want for your system. The file has good inline documentation, and there are three important options you need to review:

1. Do you want to update everything or just security updates? This is controlled by the `upgrade_type` option which accepts two values: `security` or `default` (everything).
2. Do you want to download updates to the local package cache for faster manual installations? or do you want for updates to also be installed automatically? You control this by setting either the `download_updates` or `apply_updates` option to `yes`. (Setting the later to `yes` implies the former is also set).
3. How do you want to be notified of updates? Fedora Linux’s default behavior is to log automated installations to the systemd journal. You can change this to send you logs to email or custom scripts by changing the `emit_via` option.

Depending on the level of automation you’ve chosen (download or install), you need to start the corresponding systemd unit timer. Start and enable **either** `dnf-automatic-download.timer` **or** the `dnf-automatic-install.timer` using the following command:

```shell
systemctl enable --now dnf-automatic-install.timer
```

These services were called `dnf-automatic.timer` prior to DNF version 2.0\. You should only start and enable one of the two services at a time. The install service will also download, while the download service only prefetches updates.

You should still manually verify that updates are applied from time to time. Keep in mind that you’ll need to reboot the system occasionally to apply all updates. Set up a monthly reoccurring reminder to check that your systems are up to date, and verify the systemd journal from previous automatic update cycles at the same time.

You may also want to [configure DNF to use less bandwidth](https://www.ctrl.blog/entry/how-to-fedora-drpm-network-bandwidth/) for system upgrades. (It uses more processor time instead.)

#### Sources

- [DNF Automatic](https://github.com/rpm-software-management/dnf/blob/48506ee/doc/automatic.rst?ref=ctrl.blog), 2017-05-02, revision 48506ee, DNF project repository, RPM Software Management, GitHub>
### 50+ unpatched security vulnera­bilities in A5-generation iOS devices
URL: https://www.ctrl.blog/entry/apple-abandoned-product-security/
Last updated: 2026-08-23T22:01:51.000Z
Devices running the Apple A5 chipset were all abandoned last year when Apple released iOS 10\. Since then, there are 51 disclosed security vulnerabilities in iOS 9.3.5 — the last version available to devices with A5 chipset. Including a lock screen bypass vulnerability and 20 issues that are remotely exploitable through Safari (and any other web browser allowed on the device.)

But have Apple done a good enough job informing their customers that their devices are no longer secure?

Apple haven’t publicly said a word about support or availability of updates for A5 chipset devices. However, it has been nine months since iOS 9.3.5 — the last update for these devices — was released. Since then Apple have released iOS version 10.0.2 through 10.3.2 already and will soon catch up to iOS 9 in point releases.

If you still use an iPad 3, iPad 2, 5th generation iPod Touch, or an iPhone 4S then it may be time to wipe off all your data and turn it in for recycling.

![Software Update: iOS 9.3.5 is up to date](https://cdn.synaps.media/control/content/images/2026/08/ios-software-update-935.png)

Apple claiming outdated software is up-to-date.

I was quite annoyed when Apple [abandoned my 3-year old iPod Touch](https://www.ctrl.blog/entry/ipod-5gen-iosx/) as they released iOS 10\. However, I’m even more annoyed by Apple’s treatment of their customers in the months since they made that decision.

When I manually go to check for software updates for my iPad 3 or 5th generation iPod Touch, **I’m assured by Apple that “Your software is up to date.”** There’s no mentions of iOS 10, nor that iOS 9.3.5 is indeed not the latest version of the operation system.

There’s no public mention of product deprecation on Apple’s support website. A5 chipset devices aren’t listed on Apple’s list of vintage or obsolete products. Yet, the company have stopped delivering software updates for these older devices.

The devices themselves haven’t informed me in any way that they’re now obsolete and are no longer receiving critical security updates. The only hint I could find is a mention of how to manually update to iOS 10 in the Tips app. However, this doesn’t even apply to my devices as they’re unsupported and can’t be upgraded.

I believe it’s irresponsible of Apple not to update these devices any longer, and also not to inform their users that the devices are no longer supported. Apple should have **pushed notifications to unsupported products to inform their users** that they need to upgrade.

This would probably boost Apple’s sales figure for their current iPad models, so I’m not sure why they haven’t done it already. In January this year, I recycled my original first generation iPad. It hadn’t been updated in years, and it also hadn’t received any kind of on-device notification about it being unsupported.

Such product deprecation notifications — and especially one asking customers to purchase a newer models of the product — may generate some negative press.

However, informing users would be much better practice from a security stand point. It seems to me that Apple’s fear of bad publicity is leaving some of their users unaware of their security situation.

No one using Windows XP on a desktop computer today doesn’t know that their operating system is unsupported and no longer receives updates from Microsoft.

Microsoft made that quite clear with increasingly aggressive notifications **before** they discontinued their old operating system. It’s not at all too much to ask from Apple to show the same level of consideration.

iOS isn’t magic, it’s software. Internet connected devices don’t remain secure forever, and especially not after their manufacturer stops delivering security updates for them. These types of devices [should be sold with best-before-dates](https://www.ctrl.blog/entry/device-best-before-dates/), but that’s another discussion.

I do **not feel safe using a web browser with several known security vulnerabilities** that have remained unpatched for ¾ of a year. Considering the sensitive nature of information we all access using web browsers, including financial and other important online accounts, it would be completely irresponsible to keep using the device for web browsing.

I’ve stopped using my own iPad as a couch-device and have removed all my data from both my iPod Touch and iPad. I don’t intend to replace them with newer models, as I feel their product lifetime should have been much longer.

Apple have had a reputation of keeping their devices up-to-date, but I strongly feel like they haven’t done enough to maintain this reputation in the last couple of years.

I’ve ordered parts and components and will try to re-purpose the high-resolution display in the iPad 3 into an extra monitor for my PC. (Details in a later update.) It’s a good display panel, and it’s not seen all that much use, to be honest. I’m afraid my iPad will see more hours use as a secondary PC monitor than it ever did as a tablet computer.

#### Sources

- [National Vulnerability Database search results for iOS 9.3.5](https://web.archive.org/web/20170521231301/https://nvd.nist.gov/vuln/search/results?adv%5Fsearch=true&form%5Ftype=advanced&results%5Ftype=overview&cpe%5Fvendor=cpe%3a%2f%3aapple&cpe%5Fproduct=cpe%3a%2f%3a%3aiphone%5Fos&cpe%5Fversion=cpe%3a%2f%3aapple%3aiphone%5Fos%3a9.3.5), 2017-05-22, US-CERT Security Operations Center, National Institute of Standards and Technology, U.S. Department of Commerce
- [About the security content of iOS 9.3.5](https://web.archive.org/web/20190504164654/https://support.apple.com/en-euro/HT207107), 2016-08-26, Apple Support, Apple
- [Vintage and obsolete products](https://web.archive.org/web/20190504161839/https://support.apple.com/en-euro/HT201624), 2017-05-18, Apple Support, Apple
### How a Trend Micro router security feature broke Steam
URL: https://www.ctrl.blog/entry/steam-offline-aiprotection/
Last updated: 2026-08-23T22:22:31.000Z
It took me a few hours of troubleshooting to figure out that there was nothing wrong with my new PC hardware – it was my damned ASUS router that was blocking me from installing Steam.

> “Steam needs to be online to update. Please confirm your network connection and try again.”

My device was online and it passed every standard network test. Steam’s status page showed their servers were online and that all services were fully operational. Everything else seemed to be able to connect to the internet, so what was going on?

I had to reinstall Windows on my PC last week as Windows doesn’t like it when you install a brand new mainboard and processor on an existing system. The system was overdue for the good old clean-installation treatment anyway, and I only use the Windows system for gaming. So, I’d a new mainboard with a new network interface and a fresh Windows installation with new drivers for the new hardware.

It took me quite some time to work out that I wasn’t dealing with any problems with my new hardware or drivers.

I had quite a few negative things to say about the AiProtection, or “Malicious Sites Blocking” by Trend Micro, feature in my recent [review of the ASUSWRT router firmware](https://www.ctrl.blog/entry/review-asuswrt/). In closing I recommended that people avoid routers that incorporate Trend Micro security features.

I still use that same ASUS router as my home network router. It was quite expensive and I haven’t found any good consumer grade replacement for it yet. I’d turned on “Malicious Sites Blocking” as part of that review, and unfortunately I forgot to turn it back off again.

The Malicious Site Blocking feature regularly downloads a list of blocklisted URLs and patterns from Trend Micro that contains suspected of distributing malware. It just happens that it recently included some of Steam’s – the popular game distribution platform — download mirrors. This resulted in a Fatal Error in the Steam update installer and prevented it from installing Steam.

Once I’d turned off the site blocking feature in my router, the Steam installer finished up in seconds.

This could have been a real security issue, but as the security alerts showed up in the router’s logs rather than on my device I’d no way of knowing that the router had interfered with my network traffic. This is quite a big flaw with ASUSWRT as it should have a better system for notifying users of security incidents.

Lessons learned: Don’t buy routers with “Home network security” features beyond those you expect to find on a router. Trust in Windows’ built in Microsoft SmartScreen blocklists to keep your device free from known threats rather than third-party lists as antivirus providers frequently include false positives. (Antivirus vendors have always hated ‘network installers’ because they behave much like viruses.)
### New Save-Data HTTP header tells websites to reduce their data usage
URL: https://www.ctrl.blog/entry/http-save-data/
Last updated: 2026-08-23T22:11:34.000Z
Some users are okay with a slightly degraded user experience and lower image quality in exchange for lower data usage and costs savings. There haven’t been a standard way of letting websites know about this preference before, but the new `Save-Data` HTTP request header introduces just such a method. Now it’s up to web developers to adopt it to serve their audience the best way they can.

By default, every website should use as little bandwidth as possible while still delivering the user experience they want to give their users. The average website at the end of 2016 weight 2,48 MB up from 1,2 MB just four years earlier, according to HTTP Archive. This trend isn’t good news for the data usage conscious web surfer.

The new `Save-Data` HTTP request header introduces a standard method for visitors to express their preference to the websites they visit. Websites have previously been making decisions about bandwidth usage — I suspect those decisions have often been made uninformed — in total isolation from their visitors and their needs. The new request header is a clear and actionable signal for websites that data usage is at a premium, and that **the best way to deliver a good user experience is to reduce their bandwidth footprint.**

Web browsers and other clients and apps can tell web servers about their preference for data-savings by including an additional HTTP request header:

```
Save-Data: on
```

Supporting web servers who understand this request can make whatever adjustment they feel are necessary to “save data” in their responses. There’s **no standard for how websites should handle these requests.** However, the intention is for websites to reduce their data footprint in whatever way they think will impact their audience the least.

Some ideas may be to return an empty favicon, increase image compression rates at the expense of image quality, avoid preloading full image galleries and images far down on the page, stop auto-buffering and auto-playing video and audio, and maybe even reduce ads and third-party embedded widgets. Of course, the website should consider always doing these things as it would boost their loading performance.

Websites could even deploy even more transforming alterations removing some images entirely. For example, an news site could display images for their top ten news stories on their front page, and rely on headlines and ingresses for articles further down the page. A news app or feed reader could likewise drop images for older stories.

Any resource that vary depending on the `Save-Data` request header must include a `Vary: Save-Data` response header to inform caches about the varying. See [Explaining the HTTP Vary response header](https://www.ctrl.blog/entry/http-vary-explained/) for details. The following example response shows a resource that varies based on supported compression methods, `Do-Not-Track` requests, and `Save-Data` requests:

```
Vary: Accept-Encoding, DNT, Save-Data
```

### Client support

You may have heard of the compression proxy service called Turbo mode in the Opera browser and Yandex.browser, or the Data Saver option in Google Chrome for Android. When users enable these features, their HTTP traffic is sent to compression proxy servers operated by their parent companies who perform aggressive compression on behalf of their users. These services don’t process encrypted HTTPS websites; which is quickly becoming the default across the web as browsers are moving to label HTTP as insecure.

When users enable these options, however, they’ll start including the `Save-Data: on` header with all their requests — including to HTTPS websites. It’s up to each individual website to handle these requests, the same way websites might handle the Do-Not-Track request and other specialized request headers.

No client that I’m aware of sends the Save-Data header by default everywhere. However, I believe we might see it on by default in the future in mobile applications and browsers when they detect they’re on EDGE or other legacy mobile networks. This option may also show up by default in less powerful devices and devices with lower resolutions screens like budget E-readers and lower-end phones.

The Data Saver option (which includes the compression proxy service) is also available for Google Chrome on the desktop, Opera, Vivaldi, and other Chromium based web browsers as an extension. Google have discontinued this extension as of 2019-06-16.

If you want to enable the `Save-Data: on` request header in your web browser without the use of a compression proxy service, you can install my aptly named `Save-Data: on` extension for Firefox, and for Google Chrome, Vivaldi, Opera, and other Chromium based web browsers.

[![Get this Mozilla Firefox add-on](https://cdn.synaps.media/control/content/images/2026/08/get-firefox-extension.svg)](https://addons.mozilla.org/en-US/firefox/addon/save-data/?src=external-addonsbadge-ctrl.blog&ref=ctrl.blog)[![Get this Microsoft Edge extension](https://cdn.synaps.media/control/content/images/2026/08/get-msedge-extension.svg)](https://microsoftedge.microsoft.com/addons/detail/ikpocbechgonkffflodoiadeddajhfli?ref=ctrl.blog)[![Get this Google Chrome extension](https://cdn.synaps.media/control/content/images/2026/08/get-chrome-extension.svg)](https://chrome.google.com/webstore/detail/save-data-on/nholpkfnmjbinlhcfihkhiehdaohlibg?ref=ctrl.blog)[![Get source on GitHub](https://cdn.synaps.media/control/content/images/2026/08/get-github-source.svg)](https://github.com/da2x/save-data?ref=ctrl.blog) 

### Website adoption

Websites that have out-sourced their performance decisions to Google already support the `Save-Data` request header for image compression levels. Websites using the Google PageSpeed module version 1.11.33.1 (released in March 2016) or newer for Apache or nginx web servers who haven’t disabled the default rewrite\_images module serve lower quality images to visitors who request data savings.

The PageSpeed module by Google is installed on more than 8500 websites, according to BuiltWith. However, over a year after the first version with `Save-Data` support was released, very few websites seem to be running a recent enough version to take advantage of it.

It’s interesting to note that Google’s own Data Saver compression proxies are powered by the same open-source libraries that are used to make the PageSpeed module. The behavior and image quality should be very similar for images compressed using Google’s proxy servers and the images served with a self-hosting Google PageSpeed module instance.

I went through the `Vary` response headers that listed `Save-Data` across the web in April 2017 as recorded by the HTTP Archive to see what deployments where out there. When I exclude my humble blog, I only found four other websites that had implemented support for the `Save-Data` request header without the use of the Google PageSpeed module.

Considering how easy it’s to support and how beneficial it can be to users’ wallets, I’m frankly surprised that the number was so low. It seems web developers should pay closer attention to developments in new HTTP standards. I hope that you’ll consider adding support in your website or app now that you’ve spent all this time reading down to the end of my little introductory article.

#### Sources

- [HTTP Client Hints](https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-client-hints-04?ref=ctrl.blog), 2017-04-18, HTTP Working Group, Internet Engineering Task Force
- [Image Filter and Option Reference](https://www.modpagespeed.com/doc/reference-image-optimize?ref=ctrl.blog), PageSpeed documentation, Google
- [Release notes for 1.11.33.0-beta](https://www.modpagespeed.com/doc/release%5Fnotes?ref=ctrl.blog#release%5F1.11.33.0-beta), 2016-03-30, PageSpeed Release Notes, Google
- [Data Saver](https://web.archive.org/web/20171114184320/https://developer.chrome.com/multidevice/data-compression), Chrome for a Multi-Device World, Google Developer
- [\[HTTP\] Trends](https://httparchive.org/reports/state-of-the-web?start=2012%5F01%5F15&end=2016%5F11%5F15&ref=ctrl.blog), 2016-11-15, HTTP Archive
- [Avoiding the Not Secure Warning in Chrome](https://developer.chrome.com/blog/avoid-not-secure-warn/?ref=ctrl.blog), 2016-10, Eric Lawrence, WebFundamentals, Google
- [Google PageSpeed Module trends](https://web.archive.org/web/20170517034511/https://trends.builtwith.com/framework/Google-PageSpeed-Module), 2017-05-17, BuiltWith
- [HTTP Archive dump for 2017-04-15](https://web.archive.org/web/20180324094933/http://httparchive.org/downloads.php), 2017-04-15, HTTP Archive
### What I learned after 30 minutes with ReFS
URL: https://www.ctrl.blog/entry/adventures-in-refs/
Last updated: 2026-08-23T22:01:10.000Z
Microsoft’s new Resilient File System (ReFS) has been available as an option for enterprise storage needs since Windows Server 2012\. But how does it fare for desktop needs in Windows 10? I gave this question 30 minutes of my time.

Windows’ New Technology File System (NTFS) is soon to be 24 years old. NTFS technology certainly isn’t “new” anymore and Microsoft has tried replacing their veteran file system multiple times over the years. The Resilient File System (ReFS) is Microsoft’s latest attempt at a next-generation file system.

This is by no means a comprehensive review of ReFS nor of its capabilities. It’s a recount of my own experiences and adventures with ReFS on a new spinning disk drive in Windows 10 Professional with Creator’s Update. I used one physical disk setup as a simple disk formatted with ReFS for these tests.

Here are some points I was able to learn after a quick 30 minutes of experimentation on ReFS:

- You can format a drive with ReFS using Disk Management or PowerShell in Windows 10 Professional. The option is unavailable in Windows 10 Home edition. (This option has later been limited to Windows 10 Workstation and Server editions only.)
- There’s no support for NTFS features like per-file compression nor encryption. Full disk encryption with BitLocker seems to be supported, but I haven’t verified that it works.
- Windows Search worked fine even with advanced queries. I’ve read elsewhere that there are problems with Windows Search, but I couldn’t construct any search queries that didn’t return the expected resuls.
- Windows Backup (a.k.a. File History) will let you backup to and from a ReFS formatted disk. This is probably a bad idea, however, as File History relies on a lot of NTFS features.
- Windows Store can’t install any Windows Apps to a ReFS formatted disk. It’s listed as an available installation destination, but the Store app will throw an exception if you try to install to it. ReFS doesn’t implement the necessary parts of NTFS’ access control entries required to enforce the Windows Store’s app licensing-technology.
- I installed a couple of programs to a ReFS formatted disk, and most failed to start. The programs executed, but then quickly ran into different problems or just crashed after a few seconds.
- All programs I tested could open and save changes to existing files to a ReFS formatted disk. However, about half the programs had problems creating new files under ReFS.
- I got a steady 70 MB/s when copying many small files onto a ReFS formatted disk. I got speeds varying from 150–180 MB/s with the same file set when copying it to the same disk formatted as NTFS.
- You can’t convert existing NTFS file system to a ReFS file system in-place. There is no migration path for existing storage pools from NTFS to ReFS. The structures of the two file systems are so different that there’s no easy solution for it either.

It doesn’t look like ReFS will threaten NTFS’ position as the main operating system for Windows quite yet. I’m not sure where Microsoft is going with ReFS, but it doesn’t look like they’re aiming for the desktop. You probably shouldn’t use ReFS on Windows 10 desktops at this time.

**Update** (2017-08): Microsoft is reportedly going to remove ReFS support from Windows 10 Professional edition. It sure doesn’t look like ReFS is the future of the Windows desktop.

#### Sources

- [Microsoft to remove full ReFS support from Windows 10 Pro](https://arstechnica.com/gadgets/2017/08/microsoft-to-remove-full-refs-support-from-windows-10-pro-push-workstation-sku/?ref=ctrl.blog), 2017-08-21, Peter Bright, Ars Technica, Condé Nast

Tested with Windows 1703 build 15063.296.
### Windows network speed testing apps compared: Ookla or Microsoft?
URL: https://www.ctrl.blog/entry/windows-network-speedtest-apps/
Last updated: 2026-08-23T22:25:11.000Z
Which is the better network speed testing app for Windows: [Microsoft Network Speed Test](https://apps.microsoft.com/store/detail/network-speed-test/9WZDNCRFHX52?ref=ctrl.blog) or [Ookla Speedtest](https://apps.microsoft.com/store/detail/speedtest-by-ookla/9NBLGGH4Z1JC?ref=ctrl.blog)? One wins by default as the other is entirely incompetent and created without much knowledge of decades old technologies!

Ookla Speedtest (OST) has a wide network of servers you can test your network speed against scattered all across the world. Through partnerships with large web hosting providers and internet service providers (ISP), Ookla can not only tell you how fast your internet connection is to servers in your region but anywhere in the world with over 6000 test servers to choose from.

Microsoft Network Speed Test (MNST) can only test against the geographically closest Microsoft Azure data center. That is still 34 regions around the world, but you’re limited to testing against only one. Azure has no local presence in Africa, Russia, and only one in South America.

When I run speed tests with the two apps, I get **quite different results**. Ookla Speedtest measures my download speed at **160 MBps**, which is slightly above the expected 150 MBps my ISP promises. Microsoft Network Speed Test inexplicably measures **2,6 GBps**.

So, what is going on here? After some digging, I found out that Microsoft tests download speeds against Azure Storage Blobs, part of Microsoft Azure “cloud offerings”. Files hosted on this platform aren’t assigned any caching policies out of the box, and Microsoft’s team working on the Network Speed Test app didn’t configure any caching headers for their test “blobs”/files. Since the test downloads don’t specify any caching headers, caches will just store these by default.

The result I get are between my local Windows PC and my local Squid web cache server over a 10 Gigabit fiber optic cable and network cards. The 2,5 GBps speed is maxing out what my local network can perform rather than the external network; which is usually what you want these types of services to reliably test.

This may cause issues for anyone testing their network speeds behind a web cache/accelerator or other caching appliance, or who is running a web accelerator software on their computers. Quite a few ISPs still runs web caches to speed up networking for their customers (and save on costs if bandwidth is expensive in the area.)

This makes the test results from Microsoft’s app entirely untrustworthy as you’re never sure what you’re testing against. Ookla’s app doesn’t have any such problems.

I’ve contacted Microsoft about the issue two times, first in September 2015 through multiple channels but haven’t receive any sort of acknowledgment of the issue. The app has been updated four times in the Windows Store since the first time I alerted them about ~~their incompetence~~ the issue.

I also find it telling that the “speedometer” user interface for Microsoft Network Speed Test app only goes up to 50 MBps whereas Speedtest by Ookla can measure up to 500 MBps before the needle surpasses the maximum value. This is probably the result of different design cultures. Microsoft designed an app for the United States market — where bandwidth is expensive and speeds are slow — and Ookla designed an app for the international market where speeds often exceed 50 MBps.

![Testing history views of Ookla Speedtest and Microsoft Network Speed Test](https://cdn.synaps.media/control/content/images/2026/08/windows-network-speedtest-history.png)

There isn’t much else to these apps except for the networking speed tests; except that both apps keep histories of your previous test results. The Microsoft Network Speed Test app lists previous tests in a plain table and don’t utilize available screen space all that well. Ookla Speedtest is almost the same, but chooses to fill the whole screen with the three most recent results instead.

OST uses the regular Wi-Fi signal icon to represent networking throughout the app. This is a bit confusing when you’re testing with a device with both a wired Ethernet connected as well as a wireless Wi-Fi connection as there’s no way to determine what network interface is used. Both apps defer the decision as to what network interface to use for testing to Windows, but Ookla confuses the issue with a poor icon choice.

Uses Wi-Fi signal icon for networking, even though I tested with Ethernet. A normal globe-means-internet or a router icon would be preferred, as it caused me some confusion as to which network interface was being used for testing.

### Conclusion

Stick with the Ookla Speedtest app. Ookla has more experience with running a network speed testing service, through their popular [SpeedTest.net](https://www.speedtest.net/?ref=ctrl.blog) tool. Don’t trust developers who are just “making another network speed testing app” to fill up their platform’s new App Store and who don’t have much experience with the problem their app is trying to solve.

#### Sources

- [Azure Regions](https://web.archive.org/web/20180802025217/https://azure.microsoft.com/en-us/global-infrastructure/geographies/)
- [Ookla](https://web.archive.org/web/20170515132812/http://www.ookla.com/)
### Are you even trying to fight spam bots, Twitter?
URL: https://www.ctrl.blog/entry/twitter-bot-patterns/
Last updated: 2026-08-23T22:23:40.000Z
I followed the #Eurovision topic tag on Twitter after the Eurovision Song Contest Finale yesterday. What I saw was a lot of jokes and political opinions, plus some comments about the actual music. What you expect from Eurovision, in other words. What I also noticed was the enormous amount of bot activity posting and reposting the exact same messages.

I’ve heard of Twitter’s spam bot problem on and off for years. However, I’ve never had much personal experience with it besides the normal number of attractive woman liking my posts in an attempt to get me to visit their porn filled profiles. Seeing the large number of identical posts streaming past my screen yesterday was a complete surprise.

Note: *I’m posting this from way up on my high horse with no knowledge of the efforts Twitter may be undertaking to prevent spam postings. I don’t have access to the full “hose” of all messages, so this post is pure speculation based on an incomplete picture of the situation.*

I’ll not draw any attention to the agendas or topics that the bots were trying to promote. It’s enough to say that it was vicious, hateful, and almost surreal messages that didn’t relate to anything. Instead I’ll just like to discuss the pattern I observed after following the junk bots posted under the #Eurovision topic tag on Twitter yesterday:

- The bot accounts posted tweets in bursts: three–four tweets in about one minute, followed by a random pause of seconds or hours, before a new burst of posts over a minute.
- Messages included all the top two–four worldwide trending hashtags.
- The same account posted the same messages multiple times (only once per burst.)
- The messages were posted under several hundred accounts in what seemed to be a continuous stream. Each account posted nearly identical messages – the varying factor was the order of the trending hashtags.
- Didn’t use Twitters “retweet” feature to amplify a single message, but rather drowned the conversation with a flood of identical messages.
- None of the bot accounts had profile pictures. Their home pages were set some of the most popular domains. It looked to be a random selection from Alexa Internet’s top 1000 domains. No real user sets their home page address to “www.fbcdn.net” (a Facebook CDN) or “www.googleusercontent.com” (content uploaded by Google customers.)
- Accounts would either follow other two–four other spam accounts, or follow two–four verified Twitter accounts. The verified accounts they followed looked to be the type of accounts new users are greeted with on the welcome screen when they first register for Twitter.
- Most accounts had no followers, with a few following one–two other spam accounts that were positing the same messages as themselves.
- Bots struggle with character encoding. Seems to originate from processing a source UTF-8 byte stream as if it was a single 8-bit encoded character (resulting in three–four random characters instead of the one expected UTF-8 character.)

I don’t believe that you need a semi-artificial intelligent fake-account detection system to identify and block combinations of the above patterns. The volume of messages streaming across my screen should be more than enough for Twitter to notice the pattern and act upon it. I searched through Twitter, and found the exact same messages appearing more than a month ago. I’m surprised a spam message can have this many exact duplicates over such a long period of time without the platform blocking it and any future instance of it.

I understand that Twitter is built on its users reposting, or retweeting, each others’ most interesting messages. However, if Twitter were to push legitimate users to use it’s native retweeting feature instead of copy-pasting posts (isn’t that out-of-fashion anyway), then their moderation job could be made much easier. If spammers were to retweet the same message to spread it, then a couple of spam reports against a single message could take care of it. Reposting the same message from different accounts would then more easily flag the message and those accounts as spammers.

I’m not suggesting this type of bot activity is Twitter’s only bot problem, and I’m simplifying the issue a lot here. I was only looking at one topic tag’s stream for about an hour and don’t have a clear grasp of the situation they’re dealing with over at Twitter headquarters. However, the patterns I observed doesn’t look all that different from what forums and comments system already identify and block all over the web.

I don’t have much faith in Twitter’s ability to solve their fake news/bot problem if they can’t even address the pretty obvious bot activity that I observed under the #Eurovision topic tag. I’ve got my own reasons for not being an active participant on Twitter. After peeking behind the scenes at the ongoing botfest that Twitter has become, I don’t see any reason why I’d want to be more active on Twitter in the foreseeable future.
### Update an RPM from a newer up­stream source release – for beginners
URL: https://www.ctrl.blog/entry/how-to-update-srpm/
Last updated: 2026-08-23T22:11:06.000Z
Is your RPM based Linux distribution slow at updating your favorite package? Are you impatient for the new hotness in a recently released version of a software of which you simply must have the latest version? Here is a quick-guide for rebuilding an RPM with up-to-date upstream sources.

You can follow along in this tutorial using the package that you want to update. I’ve used nginx as an example package throughout the tutorial, but you can use any other package that already exist in your distribution’s package repository. Depending on the complexity of the RPM package and how agreeable upstream are, you should have no problem updating it yourself. You’ll not potentially break your system (well, the package you’re updating) until the very last step of the tutorial. You can follow along and consider how comfortable you feel with installing your RPM package at the very end.

I’ll refer to Fedora Linux and the Fedora repository in this tutorial, but there’s very little here that don’t also apply to other RPM based distributions such as CentOS, openSUSE, and Qubes OS. You may need to supplement the `dnf` command with your distribution’s equivalent.

### Prerequisites

You’ll need to meet the following prerequisites to proceed.

- Your distro already provides an RPM package for the software you want to update out-of-cycle.
- Your distro provides up-to-date versions of all build dependencies needed by the new software version.
- A little faith in your abilities to solve problems.

You’ll also need to install some build tool and dependency packages as the root user. When you’re done with the two commands below, drop out of the root shell and use an un unprivileged user for the rest of this tutorial. You’ll not need root access again until the very end of this tutorial. I’ll use the nginx package throughout this tutorial. Supplement nginx for the name of the package you want to update.

```shell
dnf install rpm-build rpmdevtools
dnf builddep nginx
```

Now you’ve got an RPM-build-capable environment for your package. Congratulations! Now, let’s get started.

#### Getting the RPM `spec` and current sources from the repository

We next need to set up the RPM development directory tree. You’ll end up with a new `~/rpmbuild/` directory in your home folder. Next, you’ll populate it with the sources for the package you want to update.

```shell
rpmdev-setuptree
cd ~/rpmbuild/
dnf download --source nginx
rpm -ivh ./nginx-*.src.rpm
```

Your `~/rpmbuild/` directory should now contain folders with the source of nginx. You may get a bunch of warnings about missing something called “mockbuild”, but you can safely ignore these.

If you want to test and verify that you can build the current version of the source RPM, then skip over the next section and proceed to the one after it. After completing that section, you can return to the following section.

#### Updating the RPM `spec` file version and obtaining the new sources

Open up the spec file, located in `~/rpmbuild/SPECS/nginx.spec` in your favorite editor. You’ll need to make the following two changes to the file:

- Update the `Version` field to match the new upstream version number exactly.
- Change the `Release` field to 0. When your distrobution release an updated version of the package in their repository, it will be given a release number of 1 or higher. Setting your home-brewed RPM package to a lower number ensures you’ll get updates from your distribution’s repository as they become available in the future.

Now, assuming you’re building a package for your environment and assuming nothing too much has changed upstream. This is all you need to do! Run the following command to attempt to download the new sources from upstream.

```shell
spectool -g -R ~/rpmbuild/SPECS/nginx.spec
```

Did the command succeed? Proceed to the next section. If not read on in this section for the most common troubleshooting tips.

Double check the `Version` field number in the spec file. Locate the upstream source tarball from their website. Look for the version number in the file name.

Check to see if there’s a `Source#` field that provides a link to the upstream sources. If not, then this is a special package that requires manual changes to update. This tutorial doesn’t cover such packages.

Check the URL `Source#` field. You’ll see that the version number is substituted from the `Version` field. Is this the correct download path? If not, you may cheat a bit and set this address manually.

### Building the binary RPM

Before building the sources, you’ll need to apply any patches from your distribution that was included with source RPM package from the previous version to the updated source version. These patches help ensure the software runs smoothly on your distribution and integrates with the rest of the system.

```shell
rpmbuild -bp ~/rpmbuild/SPECS/nginx.spec
```

If all patches applied correctly, then you’re ready to attempt to build. (Feeling a bit excited? That is normal at this stage.) The command for building is almost the same for applying patches:

```shell
rpmbuild -bb ~/rpmbuild/SPECS/nginx.spec
```

You may have a bunch of working RPMs at this point, or building may have failed entirely.

It’s out of scope for this tutorial to handle cover how you debug a failing build or old patches that no longer will apply cleanly. You’ll need to review the source and patches yourself to make any headway at this point.

### Testing!

Since you’re doing all the work yourself, you’ve also volunteered to test the new package and to become your one-man quality assurance department. Maybe you didn’t realize that this what you signed up for when you started, but here we are.

But how exactly do you test your RPM package? You should install and test that it works, of course. You can install it and make sure everything got installed in the correct locations. You should also test that the software works as expected.

You probably want to perform the testing in a disposable virtual machine from your PC, or possibly on a cheap pay-by-the-hour virtual private server provider like [Linode](https://www.linode.com/?r=bded785ca36b951af61a1af005c7d4a947298f76&ref=ctrl.blog). This isolates your main machine if there were any unintended problems with the new version.

### Installing the final product

You install or uninstall it just like you do with any other package.

```shell
dnf install ~/rpmbuild/RPMS/nginx-*.rpm
```

Did you’ve fun along the way? Your distribution is more than likely very interested in having you along as a contributor to the packaging process. You can help by testing and verifying new package versions, or by updating existing packages, or packaging new software. Ask on your distribution’s IRC channel for where your time and contributions would be most useful.

#### Sources

- dnf man page
- rpmbuild man page
- spectool man page
### Internet connected devices should be sold with best before dates
URL: https://www.ctrl.blog/entry/device-best-before-dates/
Last updated: 2026-08-23T22:04:58.000Z
How do you decide which phone or smart light bulb you buy? You may look at its features, design, price, and possibly compare it to other similar products if it’s an expensive product. But how do you judge the durability of any internet connected product? It’s not like its written on the box or price chart — but maybe it should be.

Would you buy a 200 USD phone or a comparable 205 USD model if you knew the more expensive version would receive software and security updates longer than the cheaper option?

An informed customer would probably opt for the phone that gave them the most value for their money — possibly a phone model that would receive updates for two years longer than the competition. Do you want to be buying a new smartphone every year to get the latest software features?

Today, customers have no idea how to ascertain how long an internet connected product will receive critical updates. Manufacturers don’t make any commitments or guarantees for how long their product is expected to work.

You can pick up a smart light bulb in a store today that has a security vulnerability that’s known to the manufacturer, and yet never receive a security update for the product. If you pick up a similar product from another manufacturer, the vulnerability would be patched the minute it connected to the manufacturer’s update servers. The trouble is: customers has no way of knowing which product will continue working in two years.

Devices that connect to the internet, whether it be light bulbs or other Internet-of-Things devices, or smartphones, game systems, and laptops should be **sold with best before labels** indicating how long customers will receive updates for the device, including firmware and any bundles software.

Such labels would empower customers do better purchasing decisions which would benefit their personal economy as well as the security of the entire internet and help the environment by reducing waste. That is a lot of benefits from a single label.

We need **legislation** to get manufacturers to commit to providing software updates. I don’t want legislation that limits innovation or puts an undue burden on manufacturers.

However, requiring them to put a sticker on the box saying “Best Before 2022-March” and having them commit to “provide timely updates that resolves security and stability issues” isn’t asking all that much. It would require device manufacturers to rework their contracts with component vendors to provide firmware updates, and software vendors to provide updates for the device until at least a given date sometime in the future.

Manufacturers could put any date they want on the label, however this would **create an incentive to label products with Best Before dates long into the future** as a competitive advantage.

Online retailers could present this Best Before date as yet-another-metadata field per product, or just include it in the product description. Again, this isn’t a unreasonable requirement. Online retailers already fill in hundreds of metadata field per product to make them searchable for customers and to help them manage inventory.

This all sounds fantastic! But **what kind of updates do you expect** to see? From a legislation point of view, all I’d like to see is a requirement to commit to providing “security and stability updates” — meaning proactive updates to security, fixes for known security vulnerabilities, and updates required for the product to remain operational — within “a timely fashion”.

Project Zero, a security research incentive by Google, has already set the industry standard for how long software vendors have to fix security updates: **90-days after being notified of a security vulnerability**.

If a manufacturer fails to provide updates before the product has expired, then it would be considered a contract breach and a breach of the sales contract. This would open the manufacturer for lawsuit by consumer protection agencies as well as customers.

Local legislation would probably vary quite a bit on this point, but needless to say: the legal landscape would be difficult for manufacturers who played loosely with the security of their devices.

I’m hoping some consumer protection agency somewhere in the world will follow up and push through on this idea. **We’re creating an enormous technological security debt** for the internet with outdated and insecure devices that are hijacked from their owners and used in botnets.

Customers need to be able to make informed purchase decisions to get the most value out of their money, and the internet needs legislation to help ensure devices that connect to it remain secure — at the very least for a few years after purchase.
### WordPress plugin adds Google Analytics UTM parameters to feeds
URL: https://www.ctrl.blog/entry/wordpress-feed-utm-plugin/
Last updated: 2026-08-23T22:25:45.000Z
My latest plugin for WordPress lets you easily add click-through link tracking to all of your WordPress website’s feeds. There’s no configuration required. After installing and activating the plugin, subscribers and syndicated platforms will appear in Google Analytics as originating from “Feeds” rather than unidentified “Direct” traffic.

You can download the UTM for Feeds plugin from the [WordPress Plugin Directory](https://wordpress.org/plugins/utm-for-feeds/?ref=ctrl.blog).

The plugin will append two query parameters to all self-referencing links (links to the post itself) in your WordPress site’s feeds. These parameters are `utm_medium` and `utm_source` and are used by Google Analytics (and other analytics platforms) to identify where visitors are coming to your website from.

Here are two full examples of rewritten links to blog posts as they may appear in your feed with added tracking parameters:

```
https://example.com/?p=50&utm_medium=Feed&utm_source=Syndication
https://example.com/2017/post-name/?utm_medium=Feed&utm_source=Syndication
```

The query parameters in the feed can be customized as needed by appending them to the feed request itself. This can be very useful when you syndicate your feeds with services like Hootsuite, Flipboard, Apple News, or MailChimp. Here’s an example:

```
https://example.com/feed?utm_medium=Email&utm_source=Newsletter
```

Likewise, you can disable tracking if you need a “clean” feed by setting the two parameters to `0`. This is useful when you want to submit your feed as a sitemap to a search engine or have other special needs.

The plugin fully supports `Do Not Track` (DNT) requests, an option for privacy conscious subscribers who don’t want to be tracked. As far as I know, there are currently only two feed readers that support requesting feeds with DNT as of 2017 April. More as a joke than anything else, the plugin also supports opt-in to more extensive tracking using the `Do-Track` preference (DNT: 0.)

The plugin does, of course, properly handles caching of DNT request header [variance](https://www.ctrl.blog/entry/http-vary-explained/).

You can download the UTM for Feeds plugin for free from the [WordPress Plugin Directory](https://wordpress.org/plugins/utm-for-feeds/?ref=ctrl.blog). You’ll also find the freely available source code there. Note that the plugin may not be compatbile with your version of WordPress.

Please note that you must install the Google Analytics tracking code in your WordPress theme by following the instructions provided on the Google Analytics website. This plugin will not work properly if you haven’t installed the Google Analytics script correctly.

Check out my other feed-enhancing plugins for WordPress, including [Feed Delta Updates](https://www.ctrl.blog/entry/wordpress-feed-delta-updates/) and [Cache-Control](https://www.ctrl.blog/entry/wordpress-cache-control-plugin/).
### I’ve turned off on the comment section
URL: https://www.ctrl.blog/entry/regarding-comments/
Last updated: 2026-08-23T22:16:50.000Z
**Update** (2021-12-08): I’ve reopened the comment section. I get too many emails about my articles these days. A quarter of the emails are complaints about the lack of a comment system. I need a place to respond to questions publicly without referring people to Reddit, Twitter, or Hacker News. Look for the new comment button at the bottom of each article!

The rest of this article is left as it was written in 2017.

---

Readers who spend the most active time on the page never leave comments. So, if the comment section isn’t for avid readers, who is it for?

All things considered, this isn’t a community website. It’s my own personal blog where I share things I’ve learned and find interesting. It’s a way for me to express myself and share the things that interest me. There’s no “target audience” or anything like that. When I look at the analytics for this blog, it seems like many do find what I’ve to share interesting and return every week. Plus the daily rush of people landing here from web searches, of course.

The current form of comments allow readers to react to something I’ve written after the fact. It’s not very inclusive nor does it encourage discussion. There are more than a hundred more comments per article on various social networks than there have ever been in the comment section. The best comments over the last year have been sent to me personally over email rather than being posted to the comment section.

### So, why am I turning off comments?

The average comment has terrible grammar, don’t discuss the subject matter of the article, and people don’t use their real names or email addresses. Many submitted comments to machine-translated versions of my articles, and I don’t even recognize the language they used to comment.

More than half the comments submitted are personal support requests for unrelated products. I don’t have an Ask-Me-Anything section. Although I enjoy sharing what I know and learn about various technologies, I’m not your email provider and can’t help you configure your email client.

There have been a few gems among the comments, but these are few and far between. These are the comments that have been published on the blog, as I’ve been manually reviewing each and every comment.

Only 1 in 24 comments were approved. Only 1 in 16 approved comments had request to be notified of replies. Only 1 in 17 commenters ever return to the same page \[using the same device/cookiejar\] to see if there have been any replies. More interestingly, the average time spent on the page is **significantly lower for those who comment** than the average reader.

The most frequent commenters have been marketers trying to twist the subject of the comment field to promote their own product. These weren’t automated spam comments, but more misguided attempts at “building links” while adding next to nothing to the conversation. Although I’ve seen some truly remarkable topic-leaps and segways, I never approved any of these comments.

Ultimately, moderating the comment section has been more work than it has been worth. I also want the freedom to update old content without making every existing comment sound uninformed or out of date. That is just doing a disfavor to everyone who’d left comments on anything I publish.

I’m working on a **replacement for the comment section** in the form of a correction-submission form. I do go back and update old articles as software and products change, and I’d value help from readers to flag when information becomes stall or incorrect.

I’m not going to turn my blog into some sort of wiki, though I’ll certainly keep a changelog and attribute anyone who contribute through the corrections form.

I’ve no time schedule for when this will be in place, but I’m hoping to have it available before the end of the year.

**Update** (2017-05): It took less than a month to get the corrections system in place! You’ll now find it at the bottom of every article.

All existing comments — including associated email addresses, names, and other metadata — have been deleted. Deleting this data significantly simplifies this website’s compliance with the General Data Protection Regulation (EU GDPR) which goes in effect in May 2018.

There have been some gems among the comments, and these have been incorporated into the main articles where they were submitted. Thank you to everyone who’ve commented over the last year! I hope you’ll all continue to read what I’ve to share every week.
### Review: ASUSWRT router firmware
URL: https://www.ctrl.blog/entry/review-asuswrt/
Last updated: 2026-08-23T22:17:31.000Z
Are you considering getting an ASUS wireless network product? This will be a fairly lengthy and in some places technical review of the many shortcomings of the ASUSWRT firmware that might change your mind about choosing ASUS networking products.

I’m not reviewing the router I used for testing, a higher-end ASUS RT-AC87U, but rather the [ASUSWRT](https://web.archive.org/web/20170516165001/https://www.asus.com/ASUSWRT/) (ASUS’ “Wireless Receiver/Transmitter”) firmware. The same firmware is used on all recent wireless network products from ASUS, but feature availability may differ from router to router. (Routers with more memory will have more features available.)

#### Contents

1. [Web administration interface](#section-asuswrt-webadmin)
2. [Local network services](#section-asuswrt-network)
3. [Built-in OpenVPN server](#section-asuswrt-vpn)
4. [Network management and Deep Package Inspection](#section-asuswrt-privacy)
5. [Security](#section-asuswrt-security)
6. [The ASUS Router app](#section-asuswrt-app)
7. [The minute before midnight](#section-asuswrt-midnight)
8. [Conclusion](#section-asuswrt-conclusion)

**Preamble:** ASUSWRT is built on a Linux kernel running a standard GNU/Linux toolset. To users, ASUSWRT appears as an app or web administration interface to a minimal Linux server. In this review, I’ll focus on the front-end but will dip in to some of the underlying programs when more details are needed.

### Web administration interface

The user interface looks promising at first glance! It has all the features you might want, and even seems quite easy to configure — assuming you know what you want. The first time you log into the web interface, you’re guided through an “Internet Setup” followed by a “Router Setup” wizard that sets you up with a basic router configuration.

![Full set of menu options in ASUSWRT](https://cdn.synaps.media/control/content/images/2026/08/asuswrt-menu-options.png)

After completing the initial setup, you’re bumped out to the main administrative interface and presented with a lot of options. I suspect that most customers will be done at this point, as they’re already online and probably have no need for any of the other features available in ASUSWRT. However, as my router cost 190 EUR, I’d like to put the remaining features to the test.

Every section presents a tabbed interface with tons of different options in each category. Some options have hidden tooltips/help text if you hover your mouse cursor on the option, but about ⅓ of options don’t. There’s no way to know before you try.

The English translations are pretty shoddy in places. You might smile when you’re asked to watch an “Introduce video” for an advanced feature, but you might be frustrated when you realize that “Connect to DNS Server automatically” means “Overwrite the below DNS server settings with DNS servers broadcast by your ISP”. Likewise, if you switch between different languages – you might notice that some “dos” are translated as “don’ts” in other languages.

My favorite badly translated sentence is found on the Parental Control settings page: “Block adult content can prevent child from visiting sexy violence and illegal related content.” Whatever the reason for the poor translations, it sure isn’t a sign of quality.

One of my largest gripes with ASUSWRT is that **you can’t copy-and-paste data to any input fields** using the keyboard. This can be frustrating when you want to copy MAC addresses to assign static IP addresses or copy-and-paste DNS settings from your ISP. You also can’t undo using the good old Ctrl+Z.

The problem here’s a simple case of badly written JavaScript client validation of key events that happens too early and causes **all keyboard shortcuts to break**. Client-side validation is, as every developer should know, hard and shouldn’t be relied upon to provide any data directly to a backend system without also validating it on the backend. You can force the router to accept inputs and apply settings it won’t accept through the web interface by bypassing the web interface and submitting them directly to the backend.

Overall, ASUSWRT’s web interface is quite capable but there are weird exceptions. I’ll get into those in more details in the next couple of sections.

### Local network services

Earlier this year, two years after I first purchased the RT-AC87U, a new line of text appeared in the user interface for configuring the LAN DHCP server:

> “RT-AC87U supports up to 253 IP addresses for your local network.”

This new limitation says you can only delegate a single /24 subnet. This limitation isn’t mentioned anywhere in the manual, product spec sheet, nor in marketing. It’s also interesting to note that I’ve had the router for almost two years before this limitation was introduced retroactively.

However, there **isn’t any such limitation!** You can configure the DHCP server to assign IPv4 addresses for an entire IPv4 class A address space (a /8 subnet) of 16,7 million addresses, and it will happily give out addresses until it runs out of memory. I’ve tried using 16 different subnets and have had the router delegate addresses in all subnets and had devices communicate between the subnets.

The new limitation refers to an old limitation that has been in ASUSWRT since at least 2015 April and isn’t documented anywhere. The /24 subnet limitation only applies to the Deep Package Inspection (DPI) tool that powers features like the Network Map, Network Analyzer, Quality-of-Service, and Bandwidth Monitor. I’ll cover the DPI and these features more extensively in the next two sections.

You also can’t configure the router to use an IPv6\-only DNS server by setting an IPv6 address as the DNS server. The backend fully supports it, but the ASUSWRT web front end will only let you type in an IPv4 address. The router is full of restrictions like this, imposed by ASUS’ interface, that can limit what you can do with an otherwise capable router.

ASUSWRT has a simple Dynamic DNS (DynDNS) client that would work with just about any DynDNS service, if ASUS hadn’t decided to hard-code a list of 10 providers. If your DNS provider isn’t on the list, you’re out of luck.

In most other DynDNS clients, you’ll have the option to enter a username, password, and the web address that should be notified on IP address changes. This is also how ASUSWRT’s client works, but you can’t manually configure the web address of the service provider.

There are other local network services on offer, including simple network attached storage from a USB disk, media streaming, and network sharing of a printer. I’ll not go in to these services in any detail, but I’ll look more closely at some strictly network related services in the next two sections.

### Built-in OpenVPN server

ASUSWRT makes for a surprisingly good virtual private network (VPN) server. You can think of a VPN server as a remote router you connect to over the internet. Rather than routing your traffic through the local network, you can configure your devices to encrypt all traffic and send it through your router at home.

You probably want to set up your router as a VPN and configure your smartphone and other luggable devices to connect to it while you’re outside your home. You can most likely trust your ISP more than you should trust any random hotel or café free Wi-Fi option. Having a VPN server available even if you don’t normally need to use one is a good tool to have in your security toolbelt.

The OpenVPN server is enabled by flicking a switch in the web administration interface. After that, you can click ‘Export’ and get a .ovpn configuration profile file. You copy this file onto your devices and open it with any OpenVPN client (clients available for all major desktop and mobile operating systems), and you’re done. Be sure to keep this file safe as it allows access in to your local homenet.

The router is running a recent version of OpenVPN with a conservative configuration and security policy. However, the .ovpn configuration profile sets the current external IP as the “remote” option even when a DynDNS hostname has been configured as a reliable way to reach the router. This means the profile will stop working if your ISP assigns you a new IP address.

It’s an easy problem for ASUS to fix, especially when they’ve already implemented a possible solution for it, but the VPN service doesn’t appear to have been a priority.

### Network management and Deep Package Inspection

ASUSWRT comes with some advanced network management and traffic shaping tools that can be surprisingly useful even in a regular household with just a couple of devices.

Devices and known network services can be prioritized using the Quality-of-Service service to ensure a Chromecast or other streaming device has network priority over devices. Time scheduling let you set which hours and days of a week a given device is allowed to connect to the internet.

There is, however, a catch in using these services. ASUSWRT will **collect and transmit data about which websites you visit** to Trend Micro, if you use any of the following features in ASUSWRT:

- Apps/traffic Analysis
- Bandwidth Monitor
- Network Analyzer
- Network Protection (AiProtection), blocks known malware domains
- Parental Controls, including time scheduling
- Quality-of-Service
- Web History

To use any of these functions, you’ll be asked to agree to a long-winded End-User License Agreement (EULA) from Trend Micro. At the very bottom of the EULA, you’ll find a section devoted to \[the lack of\] privacy. Here are some snippets from that EULA:

> “\[…\] certain information (“Forwarded Data”) to be sent to Trend Micro-owned or -controlled servers for security scanning and other purposes as described in this paragraph. This **Forwarded Data may include information on potential security risks as well as URLs of websites visited** that the Software deem potentially fraudulent and/or executable files or content that are identified as potential malware. Forwarded Data may also include email messages identified as spam or malware that contains personally identifiable information or other sensitive data stored in files on Your router. \[…\]”  
>  
> \[…\] “Trend Micro **reserves the title, ownership and all rights and interests to any intellectual property or work** product resulting from its use and analysis of Forwarded Data.”

Now this is a real bummer! Most people will not expect their router to be prying in to their network traffic! — I mean, not beyond what is needed to route the traffic to the correct destination and back again.

The EULA also contains language holding the router’s owner responsible for notifying their friends, family, and house guests who connect to the internet through the ASUS router that any network activity may be recorded and shared with Trend Micro. This clause is laughable and I highly doubt any friend, family member, or guest has ever been informed about this nonsense in the course of human history. **People simply don’t make their friends sign waivers before connecting to their wifi or lending them their restrooms.**

Strictly speaking, you also need to agree to the EULAs when using the Network Map feature. The various device icons that can identify operating systems and some 250 known devices also uses data and \[on-device\] analysis from Trend Micro. The ASUSWRT firmware doesn’t enforce that you agree to the EULA before you use this feature, so Trend Micro and ASUS seem to have agreed on an exception for this feature.

ASUS’ license with Trend Micro makes Quality-of-Service (QoS) accessible to regular users. Configuring a QoS ruleset can be quite complicated and requires indepth knowledge of networking protocols and the services and applications you wish to handle in QoS. Early versions of ASUSWRT let users get in the thick of things and make manual adjustments to the QoS policies, and even let users create their own rules.

However, this feature has been removed in later updates, leaving some 540 predefined apps and services. You can no longer manually prioritize any one service over others but are limited to sorting a list of generic categories including: Gaming, VoIP and IM, Audio/Video Streaming, Web Surfing, File Transfers, and Others. Almost every network enabled service that isn’t web browsing or a game from the early 2000’s will end up in the “Others” category.

### Security

ASUS releases security and feature updates to ASUSWRT at random intervals. Updates are released on average every 10 weeks, but there was no update for over half a year in 2016\. Customers are unlikely to be running the latest version of the firmware anyway, as there’s no automated updates nor a system for notifying them of any updates.

There’s no push-notification to the mobile app, email list where you can be notified, appcast (an RSS feed with updates), or any other method to be notified of updates. Users are expected to regularly visit the router’s web administration interface or app and click “check for updates”.

The lack of any kind of update notifications is a serious problem considering that the updates regularly contain patches for remotely exploitable vulnerabilities.

ASUSWRT contains various features which are hyped as security and protection tools. The trouble is of course, that most operating systems and web browsers already provide the same functionality. (Assuming they’re not using a [fringe web browser without these protections](https://www.ctrl.blog/entry/fraud-protection-alternate-browsers/).)

The only slightly useful feature, powered by the Trend Micro DPI module, offers to block devices that try to communicate with known botnets.

Any website blocked due to parental controls or that were believed to be malicious, or any device trying to communicate with a known botnet can be reported by email. This requires your email to be hosted with either AOL, Google Mail, Tencent QQ, or 163\. Your router will act as a standard SMTP client and use your email provider to send the notifications. It also requires you to save your email password in plain-text on the router and thus exposing it to anyone exploiting one of the many known remote access vulnerabilities. This is a bigger security concern than these notification emails could ever make up for.

The number of remote access and arbitrary code execution vulnerabilities that regularly shown up in ASUSWRT’s changelog is worrying. The same type of attacks is fixed in release after release. Don’t get me wrong — bugs will happen!

However, many of the issues ASUS have to repeatedly fix would have turned up early during a security audit. They’re the kind of issues you’d see informatics students try to identify and exploit as part of a training assignment.

Speaking of security audits, there’s clearly no security audits and only minimal — if any — security testing before release. Enabling the Telnet and SSH services would expose these to the public internet with no brute-force login protection.

Neither service is enabled by default, but one would expect that as part of release testing — ASUS would turn on every service and verify that they aren’t exposed to the public internet as a bare minimum!

ASUS doesn’t seem to have the routines nor the required security culture to ship a secure networking product, and that shows through in ASUSWRT.

### The ASUS Router app

A fake sci-fi UI? No, its the ASUS app.

The [ASUS Router app](https://www.asus.com/content/asus-router-app/?ref=ctrl.blog) does look a bit like a fake mock-up user interface for a sci-fi movie, but it’s a greatly simplified version of the web interface for Android and iOS. It appears to have been developed by a separate team at ASUS who have never logged in to the web administration interface, and instead decided on doing everything their own way.

This simplified interface is probably better for most users, but as an advanced user I find it frustrating that they’ve diverged so greatly in terms of naming and presentation. In the web interface, you can assign devices icons from a list of generic product icons to help identify them.

These icons aren’t shared in the app; which instead encourages its users to take photos of each device. These photos does, of course, not show up in the web interface.

While the app has an option called “Wi-Fi ECO Mode” with a green “eco-looking” icon that you can toggle on and off, the web administration interface has the same setting hidden away in “Wireless: Professional: Tx power adjustment”. The app has an app/feature like list of options that give access to a subset of the functionality exposed on the web administration interface.

I believe ASUS would have had a better product for everyone if they’d taken some of the design and development effort sunk into the app and spent it on improving the web interface instead. Making it mobile-friendly, and potentially wrapping that up as an app seems like a better way to go.

### The minute before midnight

Some of ASUSWRT’s many features inexplicably only work for 1439 minutes out of the day’s 1440 minutes. One minute to midnight every day, the router turns off a seemingly random set of features to observe a one-minute break from user demands.

The wireless scheduler function allows users to disable Wi-Fi for periods of the day to preserve power, or to encourage the access point’s users to head home from work, leave the café table they’ve been occupying for hours, or maybe find their way to bed. Older firmware versions would by default enable this feature between 23:59 and 00:00 every day.

During this time period, every wireless device is disconnected while wired devices continue to operate normally. The feature is still present in the most recent versions of the firmware, but isn’t on by default.

Another new feature that’s on by default in newer firmware models is a new “Time of Day to Reboot” option which is also set to 23:59\. This time is user-configurable, so customers who enjoy late night gaming or Netflix can find — if they dig through all their router’s options — the option and reschedule it to some more sensible time like 04:00.

The “URL Filter” firewall ruleset — built on iptables’ webstr extension; meaning it only works for uncompressed and unencrypted HTTP — inexplicably also creates time sensitive blocklist rules.

The URL filters are only active between 00:00 and 23:59\. This is non-configurable, and there’s no documentation that indicates that the filter isn’t active for one minute out of the day.

The VPN service also kicks all clients at a minute to midnight.

I’m not entirely sure what is going on with the minute before midnight. ASUS support haven’t been able to give me any details about why this one-minute service stop is necessary. My best theory is that it has to do with memory usage, which consistently drops at midnight, but I can’t tell for sure what the purpose might be.

### Conclusion

ASUSWRT is probably not the ideal router firmware, but it gets the job done. The web interface requires a lot of existing knowledge of how local area networking works once you go beyond the initial setup wizard. What concerns me the most is the overall lack of quality in the web interface and what is clearly a relaxed security culture at ASUS.

I **recommend that you *don’t* buy any network product from ASUS**, and advice that you also stay away from any other router advertising Trend Micro security solutions. Network security doesn’t seem to be a priority for ASUS, and they clearly didn’t set their A-team to develop the web administration interface.

Be sure to review the terms of service and privacy policy of any router you consider purchasing. I certainly will! You can consider it a red flag if the router requires you to agree to any terms from third-party (or indeed any) online services.

#### Sources

- ASUSWRT 3.0.0.4.380\_7378 firmware and sources
- ASUSWRT changelogs

This review is based on ASUSWRT 3.0.0.4.380\_7378 released in 2017 April and provides historical comparisons against version 3.0.0.4.378.5134 released in 2015 April.

Screenshots may have been compacted for more efficient use of space, but aren’t otherwise modified.

**Reviewed:** [ASUSWRT](https://www.asus.com/content/asuswrt/?ref=ctrl.blog)

**Review rating:** 5 / 10
### WordPress’ Jetpack plugin broke IPv6 support
URL: https://www.ctrl.blog/entry/jetpack-protect-ipv6-port/
Last updated: 2026-08-23T22:12:19.000Z
You shouldn’t split a socket address at the colon to separate an IP address from the port number. Doing so uncritically breaks IPv6 support. That is what just happened in Jetpack version 4.8\. Jetpack is a popular plugins for WordPress.

Here is another installment of my semi-regular feature of IPv6 Shaming. This week: the Jetpack plugin for WordPress. The Jetpack plugin is one of Automattic’s hosted-services-upsell schemes for monetizing WordPress. Jetpack adds additional features to WordPress that requires other online services and partnerships. One of these add-on features is called Protect. Protect is a login brute-force protection system that can either challenge users who want to login or block IPs of suspicious users. This feature requires that Jetpack is able to correctly identify visitors’ IP address.

The changelog for Jetpack 4.8 include the following change “\[…\] removes port number when server returns a port alongside a stored IP address.” So lets break this down. Jetpack sources the IP address from the PHP superglobal variable `$_SERVER['REMOTE_ADDR']`. This variable should be set to the source IP address, whether that be an IPv4 or IPv6 address, and shouldn’t contain any other information. However, some server somewhere incorrectly set this variable to a socket address notation, which is to say an IP address followed by a colon followed by a port number (or `<ip>:<port>`.) For example, 10.20.10.20:90.

It might be very tempting to extract the IP address from the string by splitting the string at the colon. Even widely used libraries like [android.net.Uri](https://www.ctrl.blog/entry/android-uri-ipv6/) (part of the core Android operating system) make this mistake, and I’m sure you’ll find thousands of example code snippets that do the exact same thing.

The problem here is, of course, that you’ll cut off most — if not the entirety — of an IPv6 address. In most common IPv6 address notations, groups are divided by colons rather than dots. Socket address notations for IPv6 enclose the IP address with square brackets to separate the address from port numbers. For example, \[2001:db8::a11:beef:7ac0\]:90. You can probably see how cutting off the address at the first colon might cause some compatibility problems for IPv6!

In other words, this was a bad fix to work around someone’s misconfigured server somewhere where PHP’s superglobals were incorrectly set. A fix for an issue that resulted from a incorrectly configured server came at the expense of IPv6 support for every other user. That is a pretty bad trade-off. However, it also highlights that Jetpack lacks tests for their IPv6 support.

If you need a quick solution to the problem of separating IP addresses and ports, add some extra checks. You can start by counting dots. If you’ve exactly four dots means you can assume \[for now\] thay you’ve an IPv4 address and can safely drop everything following the first colon character. If you’ve two or more colons, on the other hand, you can assume \[for now\] that you’ve an IPv6 address. In that case, you can check if the first character is \[, strip it off, and drop everything after the first \] character.

Whenever you manipulate IP addresses like this, you’ll want to validate that the string you end up with is in fact a valid IPv4 or IPv6 address afterward. Don’t blindly trust libraries either, as demonstrated by the long-standing fault in android.net.uri! The world’s most popular operating system can neither perform the socket address splitting operation for you nor even reliably validate a valid a IP address!

#### Sources

- [Jetpack 4.8: Major Settings Update](https://github.com/Automattic/jetpack/releases/tag/4.8?ref=ctrl.blog), 2017-04-04, Derek Smart, Jetpack project page, GitHub
### Workaround for black screen in Unity games under Linux with glibc 2.25
URL: https://www.ctrl.blog/entry/glibc225-unity-black-screen/
Last updated: 2026-08-23T22:08:23.000Z
The smell of a new The GNU C Library (glibc) release … it’s the smell of software compatibility issues! This time, as so many times before, it has badly affected proprietary games released for Linux. The glibc mentality of “let’s just recompile all the things so they work with our library” doesn’t work for software that isn’t released in source format. Here is how you work around a problem that causes all games using the Unity Engine to stall on a black screen after launch.

glibc is a library used in almost all programs and among other things contain functions for working with multi-threaded programs, files, and memory management. In version 2.25, a change to the thread-local storage (TLS) model in glibc caused an incompatibility with the Unity 3D game engine. —or actually, the issue looks to be with Mono, a library from cross-platform .Net development, as distributed with many Unity games for Linux. I’m not entirely sure exactly what broke and where, but I do know how you can work around the problem.

Version 2.25 of glibc is currently shipping in Arch Linux, Fedora Linux 26, and openSUSE tumbleweed.

**Update** (2017-08): This issue will be fixed in glibc version 2.26\. Some distributions, like Fedora Linux, have backported the fix to their 2.25 packages (2.25-7 on Fedora Linux.)

### Affected games

The bug affects 64-bit games built on the Unity Engine 5.6 and older with glibc version 2.25 on a 64-bit operating system. 32-bit games running on a 64-bit operating system aren’t affected.

Affected games get stuck on a black screen. The mouse cursor is visible, often skinned by the game, but you can’t do much more than play cat and mouse with the cursor.

Here is an incomplete list of affected games:

- Besiege
- Cities Skylines
- Enter the Gungeon
- Firewatch
- Gone Home
- Hatoful Boyfriend
- Mini Metro
- RimWorld
- Robocraft
- Superhot

### The workaround

One of the fun things about Linux, not that I’m suggesting that anything about this bug is fun, is that you can often solve problems yourself. In this instance, we have a problem with memory allocation (malloc) in glibc causing problems for a multi-threaded program. As a stop-gap solution until the Unity Engine/Mono can resolve this issue and until game developers start shipping updated version of these, you can simply **use another malloc implementation.**

You can install jemalloc from your package repository and then run Steam, or individual games, using it rather than glibc’s malloc implementation.

Install jemalloc from your package repository. Here are commands for popular distributions:

```shell
# Fedora Linux
dnf install jemalloc
# Debian / Ubuntu
apt-get install libjemalloc1
# openSUSE
zypper install libjemalloc2
```

This installs the jemalloc libraries. The next steps is to use the libraries. Until this is resolved, launch Steam — or the game executable directly — prefixed with an environmental variable causing libjemalloc to be loaded before — and thus be preferred over — glibc’s malloc implementation.

Start Steam or your game binaries directly with instructions to preload jemalloc. This example demonstrates how to open Steam (and any game started from it) with this library:

```shell
# Fedora Linux / openSUSE
LD_PRELOAD=/usr/lib64/libjemalloc.so.2 steam
# Debian / Ubuntu
LD_PRELOAD=/usr/lib/x86_64-linux-gnu/libjemalloc.so.1 steam
```

You should periodically try loading your games without the LD\_PRELOAD variable. Eventually, this bug will be resolved and your games with be updated to run with glibc’s version of malloc again. Some games may never be updated, so you may need to use this workaround for quite a while. You shouldn’t notice any difference running a game with libjemalloc instead of glibc. However, unexpected incompatibility issues can occur when running this somewhat unusual setup.

If you start Steam, as suggested above, you may get an error stating that “ERROR: ld.so: object '/usr/lib64/libjemalloc.so.2' from LD\_PRELOAD can’t be preloaded (wrong ELF class: ELFCLASS64): ignored.”. This error simply says that you tried loading a 64-bit library in a 32-bit application (Steam is 32-bit only.) You can safely ignore this error. The LD\_PRELOAD variable will be inherited by any subprocess/games you start from Steam, causing them to use the variable.

#### Sources

*Thanks to Elad Alfassa for identifying this issue.*

- [glibc release 2.25](https://sourceware.org/glibc/wiki/Release/2.25?action=recall&rev=66&ref=ctrl.blog), revision 66, glibc wiki
- [Getting Started](https://github.com/jemalloc/jemalloc/wiki/Getting-Started/c475ae41a81b67c5a5c51c2851a10bff75c6563f?ref=ctrl.blog), revision c475ae41a8, jemalloc wiki
- [Bug 1440287 - glibc: Access to \_\_thread variable may call malloc](https://bugzilla.redhat.com/show%5Fbug.cgi?id=1440287&ref=ctrl.blog), 2017-04-07, Elad Alfassa, Red Hat Bugzilla
### How to disable Cortana and restore Windows Search in the Start menu
URL: https://www.ctrl.blog/entry/how-to-disable-cortana/
Last updated: 2026-08-23T22:09:37.000Z
Have you just installed *Windows 10 Creator’s Update* and realized that Microsoft has removed all the controls for disabling its Cortana online-assistant service? Fear not for your privacy nor your autonomy over your Windows PC! You can still disable Cortana and restore Windows Search on the taskbar and in the Start menu. All it takes is a tiny tweak to the Windows Registry.

Microsoft wants you to use Cortana, and by extension their Bing web search service. There are vast riches to be made by being a dominant search engine — just ask Google! — and Microsoft want to increase their share of the market. To that end, Cortana is now aggressively pushed by Windows in the latest feature update to Windows 10, colloquially known as the “Creator’s Update”. The installation wizard wants you to turn it on, the upgrade assistant wants you to turn it on, “helpful hints” push you to do the same, and it’s quite easy to turn it on by accident later on.

Some users may not want everything they type in to their Start menu to be sent to Microsoft’s servers and may prefer the good old days when their Windows PCs managed to perform local-device searches without “enhancing” the search results by adding ads from the Windows Store and Groove Music Store.

Here is how you revert back to on-device Windows Search and disable Cortana:

1. Open up the Registry Editor by searching for “regedit” in search field at the bottom of the screen. This will be the last time you use Cortana before waving her goodbye.
2. Click at the location bar, right underneath the toolbar, type in the following, and press Enter: Computer\\HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows
3. From the toolbar, go to Edit: New: Key. You should see a blue border and a blinking cursor indicating a text input field to the left in the window; in the folder tree underneath the Windows folder.
4. Type in “Windows Search” in the selected field and press Enter to confirm.
5. From the toolbar, go to Edit: New: DWORD (32-bit) Value. You should see a blue border and a blinking cursor indicating a text input field to the right in the window.
6. Type in “AllowCortana” to this field and press Enter. Leave the key’s default value (0) as-is.
7. Reboot your Windows device.

For reference, the end result in the Registry editor should look like the below screenshot:

![showing Registry modifications to the Windows Search: AllowCortana key](https://cdn.synaps.media/control/content/images/2026/08/regedit-windows-search-allowcortana.png)

If you ever change your mind in the future, you can delete the AllowCortana key from the registry. From the toolbar, go to Favorites: Add to Favorites to make it easier to find your way back to this registry key in the future.

I think it’s an unfortunate situations that it’s so easy to enable Cortana in Windows 10, and frustrating that Microsoft has made it near impossible for regular users to disable the feature again. There’s no good reason why users shouldn’t be able to easily turn the feature off again if they’re uncomfortable with it or just plain don’t like it.

It’s also possible for Windows 10 Enterprise and Professional users to disable Cortana using a Group Policy. However, this option isn’t available to Windows 10 Home users. The System Registry method outlined above works for disabling Cortana in all Windows 10 variants.

If you’re concerned about the privacy implications of using Cortana or even Windows Search, you can consider using another desktop search program altogether. I prefer [FileLocator](https://www.ctrl.blog/entry/review-filelocator/) to just about any other search program available on Windows 10\. It’s entirely offline and can do deep-searches across all your files and file types without needing to transmit any data to a server somewhere on the internet. Why don’t you give it a try?
### Why are Facebook and Twitter so bad at parsing RDFa metadata?
URL: https://www.ctrl.blog/entry/rdfa-socialmedia-metadata/
Last updated: 2026-08-23T22:16:40.000Z
Facebook and Twitter both chose to use RDFa for their “optimized link sharing” metadata formats. Well, it would seem Twitter didn’t realize that was what they’d done until a later stage. In any case, why are both of these social media platforms with vast engineering resources at their disposal so bad at parsing RDFa data from webpages?

The gist of this article is to highlight how Facebook chose RDFa — and Twitter walked backwards into it, but don’t even implement a minimal RDFa parser to retrieve metadata from websites.

This means that, for example, a meta tag that stores a `content` attribute applicable in multiple vocabularies (Twitter Cards and Open Graph) must needlessly be duplicated, and that even the meta elements themselves are redundant. But I’m getting ahead of myself, let me get back on track.

### RDFa “ultra-light”

‘**Twitter Cards**’ is Twitter’s name for their tiny metadata format for enabling rich-snippets in shared links. These snippets can include details such as a thumbnail and the title of the link being shared among the platform’s users. Twitter Cards rely on markup that appears to be RDFa at first glance, but is the apparent results of [cargo-cult copying](https://en.wikipedia.org/wiki/Cargo%5Fcult%5Fprogramming?ref=ctrl.blog) something resembling a metadata format without a real understanding of their purpose nor context on the web.

Facebook’s ‘**Open Graph Protocol**’ (OGP) is more technically capable, if only in theory, as its based on an “ultra-light” variant of RDFa. From the available documentation, the main differences between RDFa and whatever OGP is using is that the latter can only be set on `meta` elements inside the `head` element. This isn’t a restriction from RDFa nor necessary for OGP’s purposes, but it’s an arbitrary limitation set by Facebook’s engineers.

Speaking of RDF attributes (RDFa), you should be at least somewhat familiar with [RDFa Core syntax](https://www.w3.org/TR/2008/REC-rdfa-syntax-20081014/?ref=ctrl.blog) to follow along with this article. Here is a quick refresher: RDF attributes allow embedding semantically meaningful content within HTML tags. The syntax relevant to this article is limited to embedded key-value pairs of metadata using the `property` attribute (key) and `content` attribute (value):

> “[@content](https://www.w3.org/TR/2008/REC-rdfa-syntax-20081014/?ref=ctrl.blog#A-content): a string, for supplying machine-readable content \[…\].”
> 
> “[@property](https://www.w3.org/TR/2008/REC-rdfa-syntax-20081014/?ref=ctrl.blog#A-property): a white space separated list of \[terms.\]”

Note that there’s no mention of the `name` attribute as this holds no significance in RDFa whatsoever. When used in examples in this article, it’s for the benefit of non-RDFa metadata consumers and legacy systems (and to make a point.) I’ll get back to this in the next section.

For brevity, please just imagine that all the examples in this article have already declared the following namespaces. Neither Twitter nor Facebook care about namespaces and only support their own hardcoded namespace prefixes. That is a discussion for another time, however.

```html
<html prefix="dc: http://purl.org/dc/terms/#
              og: http://ogp.me/ns#
              twitter: https://dev.twitter.com/cards/markup#"> …
```

Twitter hasn’t published or documented a namespace URL for its Twitter Cards vocabulary. However, it has one which is broadly used by convention (as shown in the above example).

I’ve done some experiments to see how Twitter and Faceboook’s bots process metadata in Twitter Cards and Open Graph Protocol format. The next two section deals with extracting the page title using these formats.

### Let’s observe Twitterbot *parsing*

Even though Twitter incorrectly [recommends](https://developer.twitter.com/en/docs/twitter-for-websites/cards/guides/getting-started?ref=ctrl.blog#started) specifying the key-values in `name` attributes, I’ll disregard those in favor of the `property` attribute in all the examples. Twitter supports both variants.

The `property` attribute is the correct choice as per the RDFa standard and it’s also [supported by Twitterbot](https://developer.twitter.com/en/docs/twitter-for-websites/cards/guides/getting-started?ref=ctrl.blog#opengraph). The decision to use `name` is likely based on a poor design decision that I suspect is rooted in having engineers not being familiar with RDFa when they designed their RDFa-imitation format.

Let’s just look at some non-working but perfectly valid examples:

```html
<meta content="Great Title" name="title" property="twitter:title">
<meta content="Great Title" property="dc:title twitter:title">
<meta content="Great Title" data-sub="marine" property="twitter:title">
```

Then please compare the above examples to these working examples:

```html
<meta content="Great Title" property="twitter:title" name="title">
<meta property=" twitter:title " name="title" content="Great Title">
```

**All five examples are perfectly valid** and should have worked. Yet, Twitter can only read the metadata from the last two examples. Worryingly, significance seems to be placed in the order of the element attributes. The contents of the `property` attribute is also treated as an exact-match key rather than a list of tokens.

There’s only two conclusions that can be drawn from the differences between the working and non-working examples:

1. Twitter engineers didn’t know anything about HTML and RDFa when they designed Twitter Cards.
2. Twitterbot is committing the greatest sin imaginable when parsing HTML! They’re **regex-soup-matching tags and attributes** rather than parsing the markup! They’re doing it quite badly too.

So, what does this mean for the web? More redundant markup. In a perfect world every metadata consumer would have agreed on a common core of metadata descriptors. In lieu of one metadata standard, every metadata consumer should at least be expected to parse RDFa data in a sensible manner. The following example should have covered all bases:

```html
<meta content="Great Title" property="dc:title og:title twitter:title">
```

### Let’s observe Facebot *parsing*

But wait — **what about Facebook?** Their Open Graph Protocol implementation seems to be designed around an understanding of RDFa syntax and not just cargo-culting (imitating) the syntax like we see in Twitter Cards. Facebook’s facebookexternalhit bot, lovingly known as Facebot, seems to be somewhat more competent than Twitterbot and it’s error messages indicate that it’s parsing the markup. However, the implementation still leaves a lot to be desired.

Let’s look at some non-working but perfectly valid examples:

```html
<meta content="Great Title" property="dc.title og:title">
<meta content="Great Title" property="  og:title  ">
<meta content="Great Title" name="title" property="og:title">
```

Then please compare the above examples to these working examples:

```html
<meta content="Great Title" property="og:title">
<meta content="Great Title" property="og:title" name="title">
```

Facebot, exactly like Twitterbot, seems to not have got the memo about the `property` attribute being a space-separated list of terms. Facebot will only do an exact match of `property="og:title"`, without even handling any whitespace stripping. Twitterbot at least handles whitespace stripping even though it doesn’t understand that it can be a space separated list.

Like Twitterbot, Facebot treats the `name` property as significant even though it holds no significance in RDFa parsing. The two bots only has a problem with any unexpected attributes if they appear before a `property` in the element. Again, I’d like to remind readers that the order of attributes holds no significance in either RDFa nor HTML.

Wouldn’t you know … the `facebookexternalhit` bot is also **regex-soup-matching tags and attributes** rather than properly parsing the metadata. This lazy approach introduces unnecessary inculpabilities with other products. Facebook only gets away with its sloppy work because of its near-monopoly position in the market.

### How should this have been solved?

The answer to this question is almost always to *use XPath on a parsed XML representation like DOM or XDM*. Parsing raw HTML documents with XPath is unlikely to succeed as authors write in HTML and XPath only operate on well-formatted XML documents.

Luckily, there are standardized processes for processing HTML into a parsed XML representation like the DOM or XDM. This document as displayed in your web browser right now is an example of that process. There are plenty of libraries for developers to choose from that can create such representations from HTML documents.

The following XPath will read out Open Graph Protocol title metadata from a document and respecting the current limitations in the OGP standard:

```
meta[contains(concat(
  ' ', normalize-space(@property), ' '),
  ' og:title ')]/@content
```

Or if you want full RDFa support, then this will let you parse the value from either the `content` attribute or fallback to the element text node if no `content` attribute is set. This can read the data from any element (the `title` element seems appropriate, or maybe a `h1` element somewhere further down on the page) and not just the meta element.

```
(
  *[contains(concat(
    ' ', normalize-space(@property), ' '),
    ' og:title ')]/@content
  |
  *[contains(concat(
    ' ', normalize-space(@property), ' '),
    ' og:title ')]/@text()
)[position() = 1]
```

The above XPath would return the string “Great Title” in accordance with the RDFa standard from all of following examples:

```html
<title content="Great Title" property="og:title">Okay Title</title>
<meta name="title" property="og:title" content="Great Title">
<meta content="Great Title" name="title" property="dc:title og:title">
<h1 property="og:title">Great Title</h1>
```

The following DOM `querySelector` manages the same feat:

```html
document.querySelector(
  'meta[property~="og:title"], *[property~="og:title"]'
);
```

### In conclusion

—so is XPath the right tool for Twitterbot and Facebot? Well, yeah. Probably. Why don’t they use it? They don’t care in the slightest. Publishers will adjust their markup to work with the weak implementations that are in actual use.

To answer the leading question of the headline: Facebook and Twitter are bad at extracting metadata from websites in their own standard formats because **they’re not parsing the data** but rather use metadata extraction techniques based on wishful thinking. If their solution had been suggested as an answer to this problem on the StackOverflow coding forum, it would have been down-voted to oblivion.

Now that you’ve read this article and are better informed, there’s no excuse for you not to implement proper document parsing in your projects. Don’t repeat the mistakes of Facebook and Twitter.
### How to use same Host header for origin and proxy in Apache mod_proxy
URL: https://www.ctrl.blog/entry/how-to-httpd-reverseproxy-hostheader/
Last updated: 2026-08-23T22:10:08.000Z
An origin server should use the same hostname as any \[caching\] reverse-proxy gateways that are made available to the public web. Otherwise, you can end up leaking the hostname or IP address of the origin server, and get unexpected results in error pages and interpreted output.

The solution discussed in this article is specifically for the Apache Web Server’s `mod_proxy` module, but the concepts apply to other reverse proxy servers such as Nginx and Traffic Server as well.

The configuration discussed in this article can be applied on a `Server` or `VirtualHost` blocks in your Apache configuration file.

### A tale of two hosts responding to different names

Let us assume you’ve got a reverse proxy setup in front of your backend origin server. Both are running Apache, and the reverse proxy gateway responds to the hostnames `example.com` and `www.example.com`, and the backend origin server responds to `wphost1.example.com`. A simple configuration for this could look like:

Proxy:

```apacheconf
ServerName "www.example.com"
ServerAlias "example.com"
ProxyPass "/" "https://wphost1.example.com/"
```

Origin:

```
ServerName "wphost1.example.com"
```

In this setup, requests to the server at `www.example.com` would be transparently relayed to the server at `wphost1.example.com`. This simple setup is the starting point for a caching proxy that can work as a load balancing and geographical distribution of server load — see [mod\_proxy documentation for details](https://httpd.apache.org/docs/current/mod/mod%5Fproxy.html?ref=ctrl.blog).

Incoming requests to the proxy will arrive with the HTTP `Host` header set to either `Host: example.com` or `Host: www.example.com`. The relayed requests sent from the proxy to the origin server will be rewritten as `Host: wphost1.example.com`, and also gets a second header called `X-Forwarded-Host: www.example.com`.

The origin server is thus not aware that the preferred hostname is `www.example.com`, and the request will be processed as it was sent to `wphost1.example.com` instead. Error pages and interpreters (like PHP) will be configured to use the processed hostname and be unaware of the `X-Forwarded-Host` header.

### Same name, an alias, and name canonicalization

Let us next look at a bit more complex setup where both the proxy and origin will treat requests as they were sent to `www.example.com`:

Proxy:

```apacheconf
ServerName "www.example.com"
ServerAlias "example.com"
UseCanonicalName on
ProxyPreserveHost on
ProxyPass "/" "https://wphost1.example.com/"
```

Origin:

```
ServerName "www.example.com"
ServerAlias "wphost1.example.com"
UseCanonicalName on
```

The configuration options are named kind of self-explanatory, but I’ll go through each of them, in turn, to explain how they work together.

The reverse proxy server is made aware that the `ServerName` is the canonical name of the server and all requests, even to the server’s IP, is to be treated as if they were made to the canonical name. This behavior is managed by the `UseCanonicalName` option.

Next, the `ProxyPreserveHost` option tells Apache to not use the proxy server’s hostname in requests to the proxy, but rather to make a connection to that host and then relay the original hostname in the HTTP Host header. The `UseCanonicalName` option rewrites the incoming Host header to its canonical version before relaying, meaning that the `example.com` alias, is treated as `www.example.com` as well.

The origin server is altered similarly, setting the actual hostname as an alias and the canonical name to the public-facing hostname. The `UseCanonicalName` option is used to ensure error pages and interpreters will always use the preferred hostname.

### Alternatively, fix it on the origin

You can always fix this on the origin by rewriting all incoming requests so that they appear to have the correct `Host` header.

Origin:

```apacheconf
RequestHeader set "Host" "www.example.com"
```

This approach can cause issues for the rewrite module, caching module, GnuTLS module, as well as other modules that work with the actual hostname submitted to the server. This requires a lot of testing to verify that it doesn’t cause any problems.

### Leaking information about the origin server

A recent [blog post by Chris Knight](https://web.archive.org/web/20190504164946/https://chris-knight.net/blog/2017/02/effectively-hiding-behind-cloudflare) reminded me of the importance of hiding the hostname and IP of the origin server. He wrote about it in the context of Cloudflare, which is a commercial caching reverse-proxy service provider, but the principle also applies to non-Cloudflare proxies.

For example, if this website came under attack, I could turn off the forward-facing reverse proxies that handle incoming requests and change my DNS to hide behind a commercial proxy service.

It’s important to keep any potential attack directed at the proxy servers so that the origin server can remain relatively isolated. Chris Knight goes through other measures you can take to hide your origin server in his blog post.

Apache’s `mod_cache` will by default expose the origin server’s IP or hostname on any error page. It’s thus important to not serve any error pages from the origin server with its actual hostname exposed.

Hostname canonicalization, as discussed above, can hide the hostname on any 4xx client errors. However, 5xx server errors can possibly leak the IP address as these kinds of errors can appear when Apache isn’t correctly configured and your options thus isn’t in effect.

You can mitigate this somewhat if you use `mod_cache` with `mod_proxy` on your reverse proxies. By enabling the `CacheStaleOnError on` option, Apache will serve cached variants of requests if the origin server responds with a 5xx error code.

#### Sources

- [Effectively Hiding Behind Cloudflare](https://web.archive.org/web/20190504164946/https://chris-knight.net/blog/2017/02/effectively-hiding-behind-cloudflare), 2017-02-20, Chris Knight
- [Apache Core Features](https://httpd.apache.org/docs/2.4/mod/core.html?ref=ctrl.blog), Apache 2.4 documentation
- [Apache Module mod\_proxy](https://httpd.apache.org/docs/2.4/mod/mod%5Fproxy.html?ref=ctrl.blog), Apache 2.4 documentation
- [Apache Module mod\_cache](https://httpd.apache.org/docs/2.4/mod/mod%5Fcache.html?ref=ctrl.blog), Apache 2.4 documentation
### The standard language codes for “World English” and “European English”
URL: https://www.ctrl.blog/entry/en-001/
Last updated: 2026-08-23T22:05:51.000Z
Did you know that there are standard language codes for European English and World/International English? I certainly didn’t! The language codes can be used for webpages and some software stacks including Windows 10 and Android. These implementations include support for date and number formatting information.

The language code for World English is “en-001” and European English is “en-150”. The rest of this article tries to explain how that came to be and what the consequences of using these language codes in the real world might be.

Language codes are used by authors to indicate the language of a document or other resource. Users use them to signal to software which languages they can understand. Software tries to use them to assist their users in getting language variants of document and resources that they can understand. But where do they come from and what do they mean?

#### Contents

1. [The origins of ‘language codes’](#section-en001-history)
2. [Where do the language codes used in software come from?](#section-en001-linguafranca)
3. [The end of the US locale’s hegemony in CLDR](#section-en001-inheretance)
4. [Web browser and software support](#section-en001-software)
5. [What *is* International and World English anyway?](#section-en001-languages)

### The origins of ‘language codes’

In computer communication and engineering, you’ll often come across standardized two–three letter or numeric codes for countries and a similar set of codes for languages. These two sets of codes are used together to indicate the locale and formatting preference of a document author or of a user.

These codes as used in computer systems today mostly originate from an international standard known as ISO 3166 Country Codes by the International Organization for Standardization (ISO). These codes are based on the older UN M.49 Standard Country or Area Codes for Statistical Use from the United Nations Statistics Division. 

For example, the language code “en-AU” combines the language code for English and the country code of Australia to form the language Australian English. You can combine any language with any country, but software is unlikely to recognize and support uncommon combinations.

ISO 3166 doesn’t include any codes for geographical regions that aren’t nations. The continents and the planet itself thus doesn’t have a standardized code in ISO 3166\. If we go back to the source material instead, the M.49, we’ll find a specially designated code “001” which is designated for the geographical region “World” plus other codes for other larger geographical regions such as continents. The ISO 3166 standard has left these region codes unassigned and has avoided any collisions with M.49\. I’ll get back to these non-nation region codes later.

### Where do the language codes used in software come from?

The Unicode Consortium has combined language, country, and region codes with the officially recognized locale and formatting rules for numbers, dates, and more into the Common Locale Data Repository (CLDR). The locale data in the CLDR is sourced from many current internet and international standards. This data repository is in turn sourced by many leading software and operating systems vendors including Adobe, Apple, Google, IBM, Microsoft.

Data from the CLDR repository is sourced directly in to the popular International Components for Unicode (ICU) library, and is the source data for the locale library in the GNU C Library (glibc). ICU is included with web browsers like Safari, Firefox, and Chrome and is also found in operating systems like MacOS and iOS. glibc is found in “everything Linux”.

ICU was developed by IBM since the late 90’s. Development has been governed by the international Unicode Consortium since the middle of 2016. The mission aligns closely with the consortium’s other work on providing universal software internationalization.

Locale data found in many popular language and formatting processing libraries also originate from the CLDR dataset. This includes languages like Babel for Python, Microsoft .NET.

Notably, continental and non-nation geographical region variants of any language including English hasn’t been assigned Windows Language Code Identifier (MS-LCID). These languages are thus not recognized in Windows or most Microsoft products. This means that Windows can’t provide locale and formatting information for these types of locales.

**Update** (2017-04-19): Windows 10 “Anniversary Update” lets you choose English (Europe), English (World), and several other broader-region locales!

### The end of the U.S. locale’s hegemony in CLDR

To keep the CLDR dataset more manageable, many locales inherit data from a similar or familiar locale that makes similar choices for formatting. Most English locales used to inherit from English (United States), but in CLDR version 24 this was changed in favor of having all English base languages inherit from either English (World) or English (Europe).

This change significantly reduced the U.S. technological and cultural hegemony over the CLDR dataset. I believe this was a good decision as U.S. companies are often overly focused on the need of the U.S. market at the expense of the international market.

This change in how the CLDR is organized also explicitly added two new language tags into the CLDR: en-001 (International English) and en-150 (European English).

These languages have been technically and conceptually possible to construct using CLDR language and region tags since the beginning of that project. However, their inclusion as explicit datapoints that other languages could inherit rules from meant that CLDR consumer software now would know these two locales as equals to other world languages.

Through CLDR’s efforts to reduce dependency on the en-US locale, they inadvertently also introduced en-001 and en-150 as meaningful options in thousands of software projects.

Although many programs and libraries will recognize locales like en-021 for North-American English, and en-053 for Australian and New Zealand English; they won’t provide locale and formatting data for these languages.

### Web browser and software support

Firefox, Google Chrome, and Safari are built using ICU libraries. Recent versions of these browsers, and browsers built upon them, should have full support for at least World English as well as European English. By full support, I mean to say they can be configured to send these language tags in their `Accept-Language` request headers, as well as support formatting rules using JavaScript functions like `(DateObj).toLocaleDateString()`, `(DateObj).toLocaleTimeString()`, and `(Number).toLocaleString()`.

Older versions and other unsupported web browsers will still get a partial match on the en bit of these language tag. It will match “en” as English even if it can’t recognize “en-150” as European English.

The default locale for en is up to the implementation, but you’ll usually find en-US. I expect en-001 will take the place of en-US in at least some implementations in the not so distant future. The algorithm for partial matches is specified in [section 3,4 of RFC 4647](https://www.rfc-editor.org/rfc/rfc4647.html?ref=ctrl.blog#section-3.4).

The algorithm that allows for partial matches is also the saving grace for any users, content authors, and programmers who either produce or consume webpages in European or International English. If a web browser or server doesn’t understand or provide content in the preferred language, the fallback language “English (unspecified)” or even a different regional variant like (English Australia) will be returned instead depending on the exact server configuration.

Older versions of Microsoft Internet Information Services (IIS) server doesn’t properly implement the partial match algorithm correctly, and can return unexpected results if the web browser is configured to accept more than four different language tags. I once could have produced a long list of other broken implementations here, but I no longer have any more data on this subject.

It should be pretty safe to use en-001 and en-001 on documents the web. The ICU website lists Google Search as one of their users, which should be reassuring to most skeptics worried about the potential impact of changing their language tags on their search rankings.

### What *is* International and World English anyway?

I left this to the end because I don’t know how to answer it. There isn’t an authorative right answer to the question. What *is* any language? Ask a hundred people and you’ll get a hundred different answers.

Linguistically speaking, I haven’t got the faintest idea of what International English means. Neither languages are formally defined anywhere. But what language is formally defined anywhere? Language is ever changing based on their use. The concept of “International English” can have different meanings to different people.

My own personal definition goes like this: English as used internationally were the speaker or author knows they’re addressing an international audience, and take measures to avoid regional or complicated vocabulary to be better understood by people with different levels of comprehension of English. You could compare my definition to “Simplified English”.

Technically speaking, “English (World)”, or en-001, as defined in CLDR is almost equivalent to “English (United States)”, except for some locale and formatting differences including these:

- Uses dd MM YYYY instead of MM dd YYYY date formatting.
- First day of the week is Monday instead of Sunday.
- Currency symbol is US$ instead of $.

“English (Europe)”, or en-150, as defined in CLDR is equivalent to “English (world)” with the following exceptions:

- Uses a comma instead of a period for decimal separator.
- Uses a 24-hour instead of 12-hour time format.
- Currency symbol is ¤ instead of US$.

For a more complete understanding of what formatting and locale data is included with a given locale, please refer to the CLDR.

Both International and European English are well suited for users who want one formatting or the other, but who don’t feel like they’ve any connection to a nation state. Netizens of the interwebs might feel compelled to prefer International English, or maybe European English if they want sensible formatting that follows international standards.

#### Sources

- [ISO 3166 Country Codes](https://www.iso.org/iso-3166-country-codes.html?ref=ctrl.blog), International Organization for Standardization (ISO)
- [UN M.49 Standard Country or Area Codes for Statistical Use](https://unstats.un.org/unsd/methodology/m49/?ref=ctrl.blog), The United Nations Statistics Division
- [English Inheritance](https://cldr.unicode.org/development/development-process/design-proposals/english-inheritance?ref=ctrl.blog), Design proposal, Unicode Common Locale Data Repository
- [ICU joins the Unicode Consortium](http://blog.unicode.org/2016/05/icu-joins-unicode-consortium.html?ref=ctrl.blog), 2016-05-18, Unicode Blog
- [CLDR 22 Release Notes](https://web.archive.org/web/20170508054330/http://cldr.unicode.org/index/downloads/cldr-22), 2013-09-18, Unicode Common Locale Data Repository
- [CLDR 24 Release Notes](https://web.archive.org/web/20170507124808/http://cldr.unicode.org/index/downloads/cldr-24), 2012-09-10, Unicode Common Locale Data Repository
- [Locale Data Summary for English](https://home.unicode.org/basic-info/projects/?ref=ctrl.blog#!/repos/cldr-aux/charts/31/summary/en.html), CLDR Version 31, Unicode Common Locale Data Repository
- [English (World)](https://web.archive.org/web/20190504165712/https://ssl.icu-project.org/icu-bin/locexp?%5F=en%5F001&d%5F=en&d%5Fr=001) in the International Components for Unicode: Locale Explorer
- [English (Europe)](https://web.archive.org/web/20190504165516/https://ssl.icu-project.org/icu-bin/locexp?%5F=en%5F150&d%5F=en&d%5Fr=150) in the International Components for Unicode: Locale Explorer
- [Locales in GLIBC](https://sourceware.org/glibc/wiki/Locales?ref=ctrl.blog), glibc wiki
- [Windows Language Code Identifier (LCID) Reference](https://learn.microsoft.com/en-us/openspecs/windows%5Fprotocols/ms-lcid/926e694f-1797-4418-a922-343d1c5e91a6?ref=ctrl.blog), Microsoft Developer Network
- [RFC 5646: Tags for Identifying Languages](https://www.rfc-editor.org/rfc/rfc5646.html?ref=ctrl.blog), 2009-09, Network Working Group, The Internet Society
- [RFC 4647: Matching of Language Tags](https://www.rfc-editor.org/rfc/rfc4647.html?ref=ctrl.blog), 2006-09, Network Working Group, The Internet Society
### Mine yourself some Bitcoin with the Bitcoin Miner app for Windows 10
URL: https://www.ctrl.blog/entry/windows-bitcoin-miner-app/
Last updated: 2026-08-23T22:24:54.000Z
Are you new to Bitcoin? Maybe you’ve already [chosen and setup a Bitcoin wallet](https://bitcoin.org/en/choose-your-wallet?ref=ctrl.blog) for yourself but have no cryptocurrency to put in it yet?

The free *Bitcoin Miner* app for Windows won’t make you rich and will probably cost more in electricity than it will make you back in Bitcoin. However, it will set you up with some fractions of a Bitcoin to experiment with Bitcoin software.

Your puny little computer can’t possibly compete against the very competitive server farms that dominate the Bitcoin blockchain nowadays. Cracking the tough cryptographic proof required by the Bitcoin blockchain is statistically very improbable for an individual computer. By joining a Bitcoin mining pool and working together with other amateur miners, you can get some fractions of a Bitcoin back for your effort. The *earnings* will let you perform a few small test transactions but not much else.

You can start mining immediately after installing and opening the app. After you’ve started the app, there will be a big Start button in the middle of the screen that will get you going right away — no configuration needed!

You can then set up your payout address (any Bitcoin wallet address) from the left side menu at any time. You won’t lose any of the Bitcoin you’ve mined if you choose not to input a payout address right away.

The app is [available in the Windows Store](https://apps.microsoft.com/store/detail/bitcoin-miner/9WZDNCRDHXB6?ref=ctrl.blog) for free but with ads.

You must **leave the program running for several hours** or possibly days, depending on your PC, to meet the minimum payout requirement of 0,00005 BTC. Payments are made automatically once a week. The app can’t be minimized because of restrictions in the Universal Windows Platform but you can put other apps and windows in front of the app while it’s running. Considering that the absolute minimum transaction fee is currently at 0,0001 BTC, the Bitcoin Miner app certainly isn’t a get rich quick scheme! If you’ve several computers, you can assign all of them the same payout address and they’ll all work together on reaching the minimum payout requirement.

The group behind the app, GroupFabric, and their mining pool are also working on an Xbox One version of the mining app. That would indicate that developers are starting to take advantage of the Universal Windows Platform that allows apps to run on Windows 10, Windows 10 Mobile, and Xbox One. The Bitcoin Miner app is currently available for Windows 10 and 10 Mobile. However, running the app on a mobile device is entirely pointless pursuit due to the limited processor capacity on a mobile device.

The economics of this app would suggest that the in-app advertisement is subsidizing the tiny amounts of Bitcoin paid out to its users. I don’t know for sure that this is the case, but I would be very surprised if such a small mining pool could otherwise make enough of a return to pay its users a fixed per-hash fee.

Bitcoin Miner app for Windows 10 supports GPU and CPU mining, depending on your system capabilities. You should make sure to update the drivers of your graphic card for increased performance.

If you prefer spending your hard-earned traditional bank-issued money to purchase Bitcoins instead of mining it out of bit dust; you can have a look at my reviews of the [Cubits.com](https://www.ctrl.blog/entry/review-cubits-bitcoin-exchange/) and [Cex.io](https://www.ctrl.blog/entry/review-cexio-bitcoin-exchange/) Bitcoin exchanges.

*Happy mining!*
### Stop CAs from misissuing certifi­cates for your domains with CAA
URL: https://www.ctrl.blog/entry/dns-caa/
Last updated: 2026-08-23T22:05:12.000Z
Certification Authority Authorization records, or `CAA` records, is a new DNS entry type that informs certificate authorities (CA) about which CAs are allowed to issue a certificate for a given domain name. It’s a way for domain owners to block unaffiliated CAs from unknowingly issuing a certificate to a third-party against the expressed wishes of the domain owner.

The `CAA` records were formally standardized in 2013, but not until early 2017 did CAs agreed to check these records before issuing a certificates. By September 2017, all CAs must check and verify any `CAA` records before issuing a certificate. (This policy change applies to the 51 members of the CA/Browser Forum, with other CAs to follow).

It’s voluntary for domain owners to set these DNS records, but having them can add an extra level of protection against anyone who seek to impersonate their servers.

Here is an example section from a BIND zone file that shows what would be a common CAA resource record deployment:

```
example.com.  IN  CAA  0 issue "digicert.com"
example.com.  IN  CAA  0 issue "letsencrypt.org"
example.com.  IN  CAA  0 issuewild ";"
example.com.  IN  CAA  0 iodef "mailto:security@example.com"
```

These four records instructions compliant CAs in the following ways:

- Only the two CAs, Let’s Encrypt and DigiCert — as identified by their domain names, are allowed to issue certificates for the domain.
- No CA is allowed to issue a wildcard certificate for the domain. (`";"` represents an empty string — meaning no one.)
- Any CA other than Let’s Encrypt and DigiCert are encouraged to report any attempts at having them issue a certificate for the domain to security@example.com by email.

The value 0 isn’t a priority score as seen in other DNS record types, but a options flag. The value of 0 means it’s a regular record that should be processed if supported. A value of 1 means the CA must process the record or cancel the issuance process if the record isn’t understood. Setting this value to 1 in the above example would mean that neither DigiCert nor Let’s Encrypt could issue a certificate for the domain as neither has both identities.

The syntax of a `CAA` record is defined in full in RFC 6844\. **Check with your certificate authority about the correct values**, domain names, and any additional options you may be required to set before deploying CAA records.

Here are a few points to consider and some general recommendations when deploying `CAA` record:

- Allow your current CA plus one fallback CA to issue certificates. It’s a good practice to have a fallback option for any eventualities or disputes with your current CA.
- Use multiple name servers from DNS multiple providers. If one DNS server or provider is compromised, than the other may still hold the correct `CAA` records and would block any certificate issuance request. (This depends on the CA’s DNS lookup implementation.)
- Set long TTL of up to a week, as these records aren’t expected to change often. Long-lived caching can be considered a security feature when it comes to `CAA` records.
- Certificates can be issued to subdomains. Be sure you set `CAA` records for common high-value target subdomains, even if you don’t use them, like www, web, secure, mail, shop, etc. Additionally, you can set up a wildcard record (`*`).
- Sign your `CAA` records using DNSSEC to prevent any in-transit tampering.

### Current adoption

Out of Alexa Internet’s list of top one million domains, only 307 domains had deployed one or more `CAA` records as of 2017-04-03. `CAA` is a fairly new record type, and CAs only recently committed to honoring it.

A few of Google’s domain has `CAA` records, including `google.com`, `googleusercontent.com`, and `appspot.com`. They haven’t created records for their regional domains (like `google.com.au`) nor `youtube.com`.

A handful of certificate authorities have also created `CAA` records for their own domains comodo.com, including entrust.net, and symantec.com. Branded variations of these CAs don’t necessarily have `CAA` records. There was no correlation between which CAs support `CAA` checks and which have `CAA` records on their own domain names as of April 2017.

I believe it’s fair assessment to say that one of the largest barriers to `CAA` record adoption is that many managed DNS service providers don’t provide many standard DNS record types, and few of the web’s most used providers support it.

### Support from managed DNS providers

Recent versions of popular DNS server software, including BIND and PowerDNS, all support `CAA` records. When it comes to managed DNS hosting providers, things don’t look as good. Several of the most used DNS providers don’t support creating `CAA` records. Below is a break down of the most common managed DNS hosting providers.

The following managed DNS hosting providers **support creating `CAA` records**:

- Amazon AWS Route 53
- Cloudflare
- Constellix DNS /  
DNS Made Easy DNS
- DNSimple
- Dyn DNS
- Gandi
- GoDaddy DNS
- Google Cloud DNS
- UltraDNS
- Zilore DNS

The following managed DNS hosting providers does **not support creating `CAA` records**:

- Akamai DNS
- Network Solutions DNS

**Update** (2018-03-01): The above overview was updated to reflect that Cloudflare, Dyn, Gandi, and GoDaddy DNS now support `CAA` records.

These are some of the world’s most popular DNS providers and they’ve historically been very slow to adopt new DNS entry types (if at all). We can only hope that more of them will add support for the `CAA` record type.

As the [recent certificate misissuance from Symantec](https://www.bbc.com/news/technology-39365315?ref=ctrl.blog) show, CAs aren’t beyond misissuing certificates. If your DNS provider support creating `CAA` records, I’d recommend you create `CAA` records for your domain. The administrative overhead of adding some extra DNS records is very low, and when used together with other security tools, `CAA` records might help thwart a potential future malicious coup of your website.

#### Sources

- [Configuring CAA Records](https://web.archive.org/web/20180511021618/https://support.cloudflare.com/hc/en-us/articles/115000310792-Configuring-CAA-Records-), 2018-01-06, Cloudflare Support, Cloudflare
- [Add a CAA record](https://www.godaddy.com/help/add-a-caa-record-27288?ref=ctrl.blog), 2017-09-01, GoDaddy Help, GoDaddy
- [Amazon Route 53 now supports CAA records](https://aws.amazon.com/about-aws/whats-new/2017/08/amazon-route-53-now-supports-caa-records/?ref=ctrl.blog), 2017-08-21, About Amazon Web Services, Amazon
- [Zone Records](https://help.dyn.com/zone-records/?ref=ctrl.blog), 2017-08, Product Knowledge Base, Dyn Help Center, Dyn
- Querying DNS responses from the top one million domain names as tracked by [Alexa Internet](https://web.archive.org/web/20180302202456/https://support.alexa.com/hc/en-us/articles/200449834), 2017-04-03
- [Google and Symantec clash on website security checks](https://www.bbc.com/news/technology-39365315?ref=ctrl.blog), 2017-03-24, BBC News
- [The Latest on Certification Authority Authorization](https://pkic.org/2017/03/21/the-latest-on-certification-authority-authorization/?ref=ctrl.blog), 2017-03-21, Jeremy Rowley, CA Security Council blog
- [Ballot 187 – Make CAA Checking Mandatory](https://cabforum.org/2017/03/08/ballot-187-make-caa-checking-mandatory/?ref=ctrl.blog), 2013-01, CA/Browser Forum
- [RFC 6844: DNS Certification Authority Authorization (CAA) Resource Record](https://www.rfc-editor.org/rfc/rfc6844.html?ref=ctrl.blog), 2013-01, Internet Engineering Task Force
### Always care for old links after moving domain and reorganizing URLs
URL: https://www.ctrl.blog/entry/rewriting-urls-reorganizing/
Last updated: 2026-08-23T22:20:27.000Z
At the same time as I [moved this blog to a new domain](https://www.ctrl.blog/entry/rebrand-ctrlblog/), I took the opportunity to restructure and reorganizing all the existing URLs. This in turn gave me the opportunity to jot down some thoughts on things you can do to help make sure your old addresses keep working for a very long time.

I usually agree with the recommendations of the World Wide Web Consortium (W3C) in all things. However, even the W3C have chosen to change the URL of their [Cool URIs don’t change](https://www.w3.org/Provider/Style/URI.html?ref=ctrl.blog) URI-style recommendation document. (They moved it from HTTP to HTTPS, but redirected the old address to the new page.)

This blog is [built with WordPress](https://www.ctrl.blog/entry/static-to-wordpress/), but I’ve customized it heavily to structure the blog more like a website built with [Textpattern](https://www.ctrl.blog/entry/textpattern-allure/). This involved a lot of custom code, and while moving domain I took the opportunity to simplify things and get rid of the added complexity of mimicking another content management system. As part of this work I’ve chosen to rewrite a few hundreds links. The exact details aren’t whats important here, other than the fact that a lot of URLs have changed and some content and navigational structures were removed.

### Mapping old URLs and creating redirects

I started by carefully mapping out every URL that I’d created plus every URL that were in active use \[from external websites that had mislinked\] on the old domain. I then went through all URLs that stuck around from my [old static CMS from before WordPress](https://www.ctrl.blog/entry/aeyoun-becomes-slight-future/).

With a complete map of ever existing URL, I mapped each and every URL to their new home and setup `HTTP 301 Permanent Redirects`. I’d removed some navigational structures (all sections and most tags), so there was quite a lot of manual work involved. I didn’t have exact equivalents for every of the old pages, especially for the section archives, and marked these as removed with a proper `HTTP 410 Gone` response.

I took care to redirect everything else with a 301 redirect where the content had just moved to a new address, and a `HTTP 303 See Other` redirect where the content had been replaced by something that wasn’t the exact replica of the old content. Sending the correct redirect responses means clients (well, search engine crawlers) can have a high confidence in my redirects.

Every redirect leads directly to the new location without having to hop through a chain of redirects. This speeds up page loading times as well as help reinforce the new canonical address. I’ve often seen webmasters end up with long and intricate redirect chains as they move through CMSes or domains over the years. I thought this was undesirable for everyone involved, and it only took a few minutes extra to test that every old address only required one redirect to get where they were going.

The redirection is handled by a separate system from my CMS that answers connections coming in to the old domains. I chose to handle the redirects outside of WordPress or the server instance WordPress is hosted on as to not slow down Apache’s URL-pre-processing on the new main domain.

It’s important to keep an eye on your server logs for the first couple of weeks when rewriting many addresses to monitor for any unexpected `HTTP 404 Not Found` hits. After a week, it seemed like I’d only missed a single URL!

### Informing search engines

The vast majority of traffic to my blog undeniably originates from search engines. This, of course, made it a priority to make sure I didn’t upset these Gods of the internet. I was quite concerned when I wanted to both changing up my URL structures and domain at the same time.

Search engines can follow web-standards redirects just as well as any other client. However, they also provide dedicated tool for notifying them when you move origin (whether it be to go from HTTP to HTTPS or from one domain to another.)

The trick here is, to use disgusting SEO\-lingo: *preserve the domain authority and keep the link juice flowing through the redirects.* This shouldn’t be a problem with regular redirects, but you can risk loosing out on traffic while the search engines work out that you’ve moved everything to a new home.

The major search engines all have dedicated tools for this:

- [Google’s Change of address tool](https://web.archive.org/web/20170328005644/https://support.google.com/webmasters/answer/83106?hl=en)
- [Bing’s Site Move tool](https://web.archive.org/web/20170314131523/https://www.bing.com/webmaster/help/how-to-use-the-site-move-tool-bb8f5112)
- [Yandex’s Relocate site tool](https://yandex.com/support/webmaster/yandex-indexing/moving-site.html?ref=ctrl.blog#moving-site%5F%5Fmove)

Maybe you don’t care about Bing and Yandex because Google has ≈90 % global market share. However, even thinking about ignoring 1 in 10 potential visitors means you should reconsider this stance. Both Bing and Yandex license their search results to … ehm, *better liked* search engines such as the popular upstart DuckDuckGo.

After I began redirecting everything to the new URLs and notified the search engines at the same time; I noticed a dip in traffic from Google for five weeks. Bing stopped sending any traffic to the blog for about two weeks. Traffic from both Bing and Google recovered to the old levels pretty fast, and are now even trending upwards compared to the previous numbers.

### Let the librarians know

The Internet Archive tries to preserve the entire web by keeping copies of as many webpages they can possibly get their spiders on.

I seem to be somewhat worried about my own mortality, and try to help the Internet Archive out by submitting copies of everything I publish using my [Internet Archive plugin for WordPress](https://www.ctrl.blog/entry/wordpress-internet-archive-plugin/). This kind of makes my articles, as unimportant as they may be, immortal as they can be retrieved from the Internet Archive if I keel over and no one is around to pay the hosting bills. (Morbid, I know.)

However, what about pages that move URLs? Like a proper netizen, the Internet Archive supports following redirects. Meaning that if you’re armed with an old URL you can see the page as it appear on the website it was originally published on. You can also track changes and updated to articles through the years, CMSes, and the domains I’ve moved between through. That is pretty cool.

To make sure this would work, I submitted every one of the old URLs I’d mapped out earlier to the Internet Archive for archival. This had the effect of not only preserving the redirects, but submitting the articles under their new addresses at the same time.

Unfortunately, it would seem like the Internet Archive is having some issues with availability lately. The save-function in the Wayback Machine has been unreliable as of early January. I know about half my archival requests failed, so I’ll wait a bit and resubmit all the requests in a few weeks. Hopefully, they’ll have addressed whatever issues they’re having by then.

### Syndication feeds

All feed readers follow redirects, so you never loose any subscribers. Some clients will sensibly enforce a limit on how many redirects they’ll follow, but I’ve already taken care to ensure there wouldn’t be more than one redirect from an old URL to the new website.

Although, I’d appreciate it if more feed readers were to fully implement the HTTP 301 Permanent Redirect status code and [update the subscription address](https://www.ctrl.blog/entry/feed-caching/) instead of blindly following redirects with every refresh. Clients that encounter 301 redirects are supposed to update their link references and start using the new address rather than the address that returned a 301\. This speeds up feed refreshes as well as helps ensure the subscription keeps working as old redirects have a tendency to stop working after a while.

This isn’t specific to feed readers, of course. As part of regular quality control for any website, you should regularly check links for decay and redirects and update the links accordingly.

Another aspects with syndication feeds that can cause unique challenges with URLs is that they require that each feed entry has a universally unique identifier. These UUIDs have to be a valid URI as per the Atom and RSS standards. By default, WordPress uses the blog address and the post’s ID number in the database to construct a URL it uses for these identifiers.

The problem here’s that these identifiers should never change even when the URL for the blog entry changes. Foreseeing that I’d want to change my blog’s URL without leaving behind identifiers referring to the old domain; I’ve been **using actual UUIDs** through the officially registered urn:uuid:<uuid> URI scheme.

Using URNs here can cause problems with some stupid clients that expose the UUID and assume it’s a URL instead of getting the URL from the correct element. These clients are luckily few and far in between. On the other hand, using an URN here removes the ambiguity of whether its a bad idea to use the ID as a URL. Other stupid clients that extract a feed entry’s URL by finding the first match for http or https in the entry (yes, these do exist) now finds the correct URLs as there’s no ambiguity with the UUID.

For anyone interested in this solution, check out the [urn:uuid as the\_guid](https://wordpress.org/plugins/urn-uuid/?ref=ctrl.blog) plugin for WordPress.

To recount the main points in this article:

- Moving domain doesn’t loose you any search traffic any longer assuming every old URL us mapped correctly. Go get a new domain if you want one!
- Avoid redirect chains, and update links to eliminate redirects.
- Pay attention to logs after redirecting a many addresses.
- All the major search engines have tools for letting them know about domain-changes.
- Let the Internet Archive know so they get the latest version of your pages in their new home.
- You don’t loose feed subscribers when you redirect the old feed address to the new address.
- Don’t use site-specific URLs as IDs, go with a URN.

I hope these notes might come in handy for someone some day. I wrote this article as I was planning what I needed to do for my own website.

#### Sources

- [Site Move](https://web.archive.org/web/20170314131523/https://www.bing.com/webmaster/help/how-to-use-the-site-move-tool-bb8f5112), Webmaster Help, Bing
- [Use the change of address tool](https://web.archive.org/web/20170328005644/https://support.google.com/webmasters/answer/83106?hl=en), Search Console Help, Google
- [RFC 4122: A Universally Unique Identifier (UUID) URN Namespace](https://www.rfc-editor.org/rfc/rfc4122.html?ref=ctrl.blog), 2015-07, Network Working Group, Internet Engineering Task Force
- [Cool URIs don’t change](https://www.w3.org/Provider/Style/URI.html?ref=ctrl.blog), 1998, Tim Berners-Lee, W3C
### Review: Managed GeoDNS on a budget
URL: https://www.ctrl.blog/entry/review-cheap-geodns/
Last updated: 2026-08-23T22:17:45.000Z
You can rent VPSes locations all over the world very cheaply. Adding all your different servers’ IP addresses to a domain doesn’t route users to their nearest location. For that you need a smarter DNS server providing GeoDNS services. Here is a quick overview of five managed DNS service providers offering GeoDNS functionality on a budget starting at just 1,06 USD per month.

The list is **sorted by price per month and not recommendation.** The price example is for one domain with 750 000 queries in a month. Every provider in the list has a network of anycast DNS servers in at least ten geographically dispersed locations around the world. None of these providers offer GeoDNS with DNSSEC.

### [Route 53 by Amazon Web Services](https://aws.amazon.com/route53/?ref=ctrl.blog)

One domain with 750 000 queries: 1,03 USD per month.

Route 53 is focused on the needs of websites hosted on Amazon Web Services (AWS) infrastructure. It’s hard to configure for externally hosted customers and require some knowledge of AWS network infrastructure and the physical locations of Amazon data centers in relation to your hosting provider.

This is **not a good choice** if you’re servers are located far away from AWS datacenters, or if you’re unfamiliar with GeoDNS and haven’t used a similar service in the past. I’d recommend you configure and use Constellix for a month or two to familiarize yourself with the concepts and practical implications of GeoDNS. Only then should you consider going back and trying Route 53 as a cost-cutting alternative or maybe as a secondary DNS failover.

Supports [CAA records](https://www.ctrl.blog/entry/dns-caa/).

Route 53 is the cheapest option and has a 100 % SLA. More detailed price information:

- 0,50 USD per domain per month
- 0,70 USD per million queries per month – first 1 billion queries
- 0,35 USD per million queries per month – over 1 billion queries

### [Zilore DNS](https://zilore.com/en/dns?ref=ctrl.blog)

One domain with 750 000 queries: 5 USD per month.

**Update** (2018-06-24): Zilore has raised their prices and GeoDNS is no longer include with their basic service. You can still get GeoDNS starting at 25 USD per month.

This is the price point I was personally out to find. However, Zilore is new to the market and are priced suspiciously cheaply. How can they maintain good performance without having any query limits? Worryingly, Zilore has **no SLA** on the cheapest subscription level.

Zilore has — and this is only a guesstimate — two employees. They’re a “virtual company” incorporated in the United Kingdom to front a Russian company. **I don’t feel great** about Zilore, but haven’t got much more to say about them as they don’t have a control panel demo, screenshots, or credit-card-free trial.

There’s no documentation about supported DNS record types.

- 25 USD per domain per month – first domain
- 2 USD per domain per month – additional domains
- 0,00 USD per query per month
- 250 USD per domain per month – first domain for a 100 % SLA

### [Constellix GeoDNS](https://constellix.com/products/geodns?ref=ctrl.blog)

One domain with 750 000 queries: 6,55 USD per month.

Great design and control panel with unique features such as free vanity NS records (your domain appears to be the DNS server.) The real-time query statistics page is reassuring when you’re just setting up things — and offers unique insight into what queries are costing you money. Domain configuration is complex, but good and easy to follow documentation of even the smallest things make Constellix a considerably better than the competition.

They’re new to the market, but appears to be a rebranding of another established player called DNS Made Easy. Constellix offer a 100 % SLA.

Supports [CAA records](https://www.ctrl.blog/entry/dns-caa/).

More detailed price information:

- 5,05 USD per domain per month – first domain
- 0,55 USD per domain per month – first 25 domains
- 2,00 USD per million queries per month – first 1 billion queries
- 0,80 USD per million queries per month – over 1 billion queries

### [ClouDNS](https://www.cloudns.net/geodns/?ref=ctrl.blog)

ClouDNS wants to sell you add-on services. Their basic GeoDNS service is a good option if your traffic is just below 100 million queries per month per domain name, but other options offer better prices at lower loads. Notably, they only have 4 server locations around the planet — so expect higher latency than with their competitors from some locations. There’s no SLA, but they promise you 10 minutes of free service per 1 minute of downtime without you having to file a claim.

It doesn’t support CAA records.

More detailed price information:

- 9,95 USD per domain per 100 million queries month

### [EdgeDirector](http://edgedirector.com/?ref=ctrl.blog)

One domain with 750 000 queries: 11,25 USD per month.

The website design, services, and prices seems to have remained **unchanged for the last decade**. The service and company appears to be left on auto-pilot. No SLA or uptime guarantee, but has more than a decade of good track record to its name.

It doesn’t support CAA records.

No monthly minimum cost or per-domain fee. Potentially a very cheap option if you’ve practically no traffic but are hellbent on having good DNS and page load performance. More detailed price information:

- 0,00 USDper domain per month
- 15 USD per million queries per month

### [easyDNS Enterprise](https://easydns.com/dns/enterprise/?ref=ctrl.blog)

One domain with 750 000 queries: 12,75 USD per month.

Excruciatingly painful to configure. easyDNS Enterprise is the only provider where you must pay for a full year in advance. It doesn’t accept signups from new generic top level domains (such as my own .blog domain.) Very limited in terms of which DNS records can be configured. easyDNS seems to have taken the easy-road when developing their service and haven’t kept up to date on developments in the DNS. Offers a 100 % SLA.

It doesn’t support CAA records.

More detailed price information:

- 153 USD per domain per year
- Up to 5 million queries per month. No information on overage charges nor policies.

Sales tax may apply depending on the provider and your region.
### Fluxfonts 2.0 for Windows 10
URL: https://www.ctrl.blog/entry/fluxfonts-for-windows/
Last updated: 2026-08-23T22:07:26.000Z
Fluxfonts is a unique tool that cloaks your device’s unique font fingerprint by continuously installing and uninstalling new fonts that are generated on the fly. Version 2.0, released some days ago, is the first release of Fluxfonts that lets you protect your Windows 10 devices.

I started the [Fluxfonts project](https://www.ctrl.blog/entry/fluxfonts/) in 2013 when web browsers, and especially the Adobe Flash Player plugin, could leak information about the fonts installed on your system. Browsers have since made it more difficult to detect installed fonts; primarily by removing support for the Adobe Flash Player plugin.

However, device fingerprinting using fonts are still achievable using CSS introspection. A site applies different fonts to an element and measures if it changes size on the page. The method is difficult to block without breaking core web technologies.

Additionally, any programs you install that run on your local computer also have unfettered access to the list of installed fonts. It’s not just websites that want to fingerprint your device, after all.

**Update** (2022-07-15): The Font Enumeration API, newly added to Chromium browsers (like Google Chrome and Microsoft Edge) has reintroduced font fingerprinting. However, the new API requires a per-domain permission prompt, so it’s not as leaky as the old Flash Player based method.

The original post I wrote about Fluxfonts holds [more information about how it all works](https://www.ctrl.blog/entry/fluxfonts/). You can test your browser’s fingerprint at [Am I Unique?](https://amiunique.org/fingerprint?ref=ctrl.blog) Note that not all browsers are subject to font-based fingerprinting.

You can download the [latest release of Fluxfonts from GitHub releases](https://github.com/da2x/fluxfonts/releases/latest?ref=ctrl.blog). You can also find a new binary installer for Windows. Fluxfonts also supports Linux, MacOS, and FreeBSD.

[![Get this app on Windows](https://cdn.synaps.media/control/content/images/2026/08/get-windows-app.svg)](https://github.com/da2x/fluxfonts/releases/latest/download/fluxfonts%5Finstall.exe?ref=ctrl.blog)[![Get source on GitHub](https://cdn.synaps.media/control/content/images/2026/08/get-github-source.svg)](https://github.com/da2x/fluxfonts?ref=ctrl.blog) 

Note that the installer just sets up a background task. There’s no app or anything to open or anything to configure afterward. It just works by itself in the background.

Fluxfonts is only made available for Windows 10 as Microsoft’s latest version of their operating system made it significantly easier to port a POSIX oriented program to Windows APIs. It only supports 32-bit apps, but those still run on 64-bit based systems.

The inclusion of the Clang C compiler in Visual Studio 2017 also removed the need to dumb down the code by introducing support for the older C99 standard. I won’t add support for older Windows version as it would simply demand too much of my time.

There isn’t anything new in 2.0 for users on Linux and FreeBSD except a slightly more aggressive font deletion mechanism. The large version number jump from 1.2 to 2.0 is purely for marketing the Windows port.
### How to get Firefox to check for extension updates more often
URL: https://www.ctrl.blog/entry/how-to-firefox-extension-autoupdate/
Last updated: 2026-08-23T22:10:06.000Z
You may want to configure your browser to check for extension updates more often than once per day if you’re using security-critical browser extensions like the popular LastPass password manager.

This week, [three vulnerabilities were discovered](https://www.theregister.com/2017/03/21/lastpass%5Fvulnerabilities/?ref=ctrl.blog) and quickly fixed in various versions of the LastPass extension that allowed an attacking website to execute arbitrary code or steal a complete copy of the user’s password keychain. This highlights how important it’s to keep your browser extensions up to date with the latest security patches.

Google Chrome checks for updates every five hours by default, which seems like a reasonable default. On the other hand, Firefox only checks for updates once per day. When I checked on six systems where I’ve LastPass installed in Firefox, only one of the systems had received and install the updated LastPass extension. The extension had been released some nine hours earlier. That is an unacceptable long time window to leave such critical issues unpatched.

Firefox allows its users great control over most functionality, including the auto-update system for extensions and add-ons. The following steps will show you how to increase the update frequency from once to six times per day:

1. Type in about:config in Firefox’s address field, and press Enter.
2. Accept the warning, and search for “extensions.update.interval” in the list of options.
3. Double-click on the entry and change the value from “86400” (24 hours in seconds) to “14400” (4 hours in seconds.)

The new setting won’t come in effect until after Firefox next checks for updates (up to 24 hours.) You can force it to take effect immediately by going to the extensions manager in Firefox, clicking the settings/gear icon, and then click on Check for updates.

There’s probably very little point in checking too often, but you can make up your mind about how often you want your browser to poll for updates to your extensions. As I mentioned at the start, it might be a good idea to check more frequently if you rely on any security related extensions.

**Chrome’s default** of checking for updates every 5 hours can’t be changed in permanent configuration. However, it can still be done using the \--extensions-update-frequency=14400 runtime flag. You can append this flag to the shortcut file you use to launch Chrome. This still won’t ensure that the flag is always used as the system may launch Chrome directly, bypassing the flag you’ve added to the shortcut file.

Please consider switching to Firefox if you want a browser that gives you more control.

This runtime flag *may* also work on other Chromium based browsers including Vivaldi and Opera. The more diverged/unique the alternate distribution is from upstream Chromium, the less likely it’s that the flag will have any effect. Ask your browser vendor for specific details.

Avid readers of my blog may recall that I mentioned that I’m [not entirely comfortable with the auto-update mechanism](https://www.ctrl.blog/entry/lastpass-client-trust/) used by browser extensions — and maybe that I don’t trust LastPass either. Despite my reservations, I’ve since moved all my password over to LastPass. Thus, I was also affected by LastPass’ latest security vulnerabilities.

LastPass for Firefox uses their own servers to deliver auto-updates rather than using the Firefox Add-ons Catalog hosted by the Mozilla Foundation. This means LastPass doesn’t have any external checks or balances in place for the updates they deliver.

They could, potentially, deliver targeted attacks to certain users through their auto-update system. I’m obviously of two minds regarding auto-updating of extensions. However, at the end of the day I much prefer receiving critical security updates than not to.

#### Sources

- [Important Security Updates for Our Users](https://blog.lastpass.com/2017/03/important-security-updates-for-our-users/?ref=ctrl.blog), 2017-03-22, Lauren VanDam, LastPass blog
- [What should password managers not do? Leak your passwords? What a great idea, LastPass](https://www.theregister.com/2017/03/21/lastpass%5Fvulnerabilities/?ref=ctrl.blog), 2017-03-21, Iain Thomson, The Register
- chromium/src/extensions/common/constants.cc, Chromium source code revision c5df996c07.
- chromium/src/chrome/common/chrome\_switches.cc, Chromium source code revision c5df996c07.
### The allure of Textpattern: Why I never chose it as my CMS
URL: https://www.ctrl.blog/entry/textpattern-allure/
Last updated: 2026-08-23T22:23:16.000Z
In this review I’ll be comparing Textpattern vs WordPress. [Textpattern](https://textpattern.com/?ref=ctrl.blog) is a content management system (CMS) that I’ve kept my eyes on for a number of years. I’ve yet to deploy it on any projects, however. Here are my thoughts about some of the aspects of Textpattern that makes it a good candidate to be your next linear publishing CMS.

#### Contents

1. [Organizing content](#section-textpattern-structure)
2. [Writing content](#section-textpattern-writing)
3. [Templates](#section-textpattern-txp)
4. [Responsive images](#section-textpattern-imgsrc)
5. [Plugins](#section-textpattern-plugins)
6. [Conclusion](#section-textpattern-conclusion)

### Organizing content

Textpattern’s way of organizing content is pretty straight forward: You’ve got articles stored in sections. Article can be tagged into categories. When comparing this to WordPress, things can get a bit confusing.

Sections in Textpattern are like categories in WordPress but play a more significant role; whereas categories in Textpattern are like tags in WordPress. I’ll stick with the Textpattern terminology when talking about these two organizational structures.

Posts are the main content type in WordPress, but you also have another kind of content called pages. Pages are excluded from syndication feeds and the front page, and are meant for independent secondary content, e.g. privacy policy, about page, etc.

In Textpattern, there’s no differentiation between posts and pages: they’re both articles. The difference is whether an article is put into a section that’s included in syndication feeds and goes on the main stream on the front page or not.

You could have multiple sections in Textpattern that could be organized by broad categories like “video”, “sports”, and “tutorial”. Each of these gets their own syndication feeds, archives, and can have their own style and appearance.

The front page can easily be set up to display individual columns with the latest content from each section or use the default of having one main stream with all the newest content across sections set to publish to the front page. This is much more flexible than WordPress’ “everything goes in the same content bucket” approach.

This blog was previously organized like a Textpattern site where the section played a part in the URL. This was done by heavily customizing WordPress to behave more like Textpattern. I stopped doing this since [the recent rebranding](https://www.ctrl.blog/entry/rebrand-ctrlblog/), but the idea and appeal of organizing things like this all came from Textpattern.

Textpattern doesn’t offer dated archives like WordPress does; there are no separate archive pages per month or year. This can make migrating from WordPress difficult as there’s no equivalent pages to redirect traffic to the old URLs to. Dated archives aren’t extremely useful, but based on this blog I can say that they do see a fair bit of traffic from search engines.

Textpattern has decent support for multiple authors with individual indexes for each author just like WordPress. However, there’s no support for author bios in articles or on the author archive pages which would be nice to have.

### Writing content

The writing experience in Textpattern is put front and center; you’re put right in the editor after signing in rather than landing on a dashboard page like with most CMSes. WordPress especially falls short when it comes to providing a good writing environment, which you can clearly see in the comparison screenshots provided below:

[![“Write” UI in Textpattern mobile](https://cdn.synaps.media/control/content/images/2026/08/textpattern-ui-mobile.png)](https://cdn.synaps.media/control/content/images/2026/08/textpattern-ui-mobile.png?ref=ctrl.blog) 

[![“Add new post” UI in WordPress mobile](https://cdn.synaps.media/control/content/images/2026/08/wordpress-ui-mobile.png)](https://cdn.synaps.media/control/content/images/2026/08/wordpress-ui-mobile.png?ref=ctrl.blog) 

Writing content in Textpattern (left) and WordPress (right) on mobile.

The above screenshot serves as a good representation of both Textpattern’s and WordPress’ administrative interfaces. There are more bells and whistles in WordPress, but Textpattern focuses on what is important.

WordPress provides a mobile app to compensate for the fairly bad mobile web experience of their administration interface, something Textpattern doesn’t do. Textpattern’s administration area is as well adapted to small screens as can be. It can be cumbersome to work with tall text areas in mobile web browsers, but that comes down to how poorly mobile browsers work with the soft keyboards in such situations.

I find it annoying that WordPress interferes with what I’m writing by substituting "dumb quotes" with “curly quotation marks” and substitutes smileyfaces and Unicode emoticons with its own emoticons. Textpattern doesn’t do any of that –in fact, it doesn’t touch your content at all except for properly wrapping paragraphs.

Textpattern can use Textile markup, paragraph-wrapping-only, or leave content untouched which can be set as options in the administrative interface. That is refreshing compared to WordPress which forces its defaults to be the only way to do things, unless you intercept and disable the functionality through plugins.

My one gripe with writing content in Textpattern is that the preview article button doesn’t show the article using the site’s design.

### Templates

In WordPress, themes and assets (like stylesheets) are saved in a special directory on the file system. Textpattern stores templates and assets in the database. There’s only one template that can be installed at any time, as such there aren’t installable themes in Textpattern like there’s with WordPress. While there are themes you can install ontop of and replacing the default theme available, you can’t preview your website with a new theme before committing to it.

What you get instead with Textpattern, is a much more easily customized templating system. WordPress requires knowledge of PHP programming and a couple of dozen WordPress theming functions to get any theme going. Textpattern will let you get away with some knowledge of HTML and CSS, and will guide you through including any dynamic content using a *tag builder*.

The tag builder lets the user create `txp` elements which act as placeholders in the template for where dynamic content is inserted. The tag builder can create anything ranging from just the article title to lists of articles with the same tags to article titles. If you’d need anything more powerful, you could use the `<txp:php>print("Hello press!");</txp:php>` tag to execute custom PHP.

These tags also work inside articles. You could for example create an article called “Most commented articles” and construct a tag using the tag builder that would list out said articles.

WordPress publishes every entry on the front page in a chronological list. This is the default in Textpattern too, but using the tag builder you can quickly construct more elaborate content structures such as including several lists on the front page containing the latest articles from specific sections and categories. What takes a few minutes to set up in Textpattern using web standards plus the tag builder could take you an hour to reproduce in a WordPress theme.

### Responsive images

Mobile devices want small images that are quick to download, and PCs want higher and higher resolution images to fill their steadily growing pixel counts. You can serve a mobile user a giant image and scale it down on the device, but this makes the download slow and possibly expensive.

You can’t serve a small image to a desktop user and scale it up as that would look like trash. The solution to this problem is called responsive images, and involves offering the browser lots of choice of different image sizes so they can get the one that best fits their screen size.

WordPress has decent support for responsive images, although it can be a bit difficult to configure with your theme. WordPress can resize and crop multiple image sizes and aspect ratios based on the desired image sizes specified in the active theme.

Textpattern on the other hand only has support for one thumbnail size and there’s no support for constructing the quite complex set of tags required for responsive images.

Manually rescaling, uploading, and constructing image responsive image tags would be very time-consuming. Getting away from that was one of my main reasons for [doing away with a static site-generator in favor of WordPress](https://www.ctrl.blog/entry/static-to-wordpress/).

I’ve looked into creating a plugin for Textpattern for adding responsive image support, but there’s little hope for doing that with the current plugin API limitations. I’d have to replace much of the image handling in Textpattern core before I could even start working on such a plugin. This would have been far too much work to commit to for the moment.

In my opinion, not having support for responsive images basically **disqualifies Textpattern as an CMS option** for any site that uses imagery to go with their regularly published content. It would create too much manual labor.

### Plugins

The plugin architecture in Textpattern is underdeveloped and can be insecure.

Plugins are stored in the database and are installed by pasting a Base64-encoded text blob into a text field in the administration area. There’s no auto-update system for plugins, and plugins have to implement their own update checkers and notifiers if they want to deliver maintenance and security updates to their users.

WordPress stores plugins as individual files; which is probably better performance-wise than reading and decoding several potentially huge blobs of text out from the database on every page load. WordPress also provides a code hosting, revision control system, developer tools, and auto-update ecosystem to plugin authors.

WordPress is broadly extensible with some 610 filter and action API hooks throughout WordPress core. Textpattern has some 90 callbacks available for plugin authors, with an over-representation of admin-side callbacks compared to public ones.

WordPress is more extensible and more friendly to plugins. However, WordPress plugins are the most common way for security vulnerabilities to sneak in to the system. On the other hand, when a security vulnerability is noticed – it can be patched and users can quickly be informed of and deploy the updates on their systems. A Textpattern plugin author doesn’t have the same ability to correct mistakes and have their users apply the patches.

If I switched to Textpattern today, I could immediately let go of half the 30 or so plugins I currently use with WordPress if I switched to Textpattern. Some of the default behavior I’ve altered in WordPress just isn’t an issue with Textpattern.

Textpattern is more in line with how I organize my content, and it interferes less with what I write and how I publish too. However, I’ve tried recreating some of my must-have plugins from WordPress, but **Textpattern doesn’t expose any APIs** that would allow me to write the plugins in the first place. Plugins with Textpattern is a bit of a mixed bag, to say the least.

I also have some remaining technical concerns and some positive notes about Textpattern that didn’t fit in any of the above categories. Here they are in no particular order:

- Unusual set of MySQL query construction and custom escaping functions. Should be rewritten to use prepared PDO statements and drop the MySQL dialect requirement.
- Really not built to allow for database replication and load balancing.
- Storing PHP code blobs (templates and plugins) in the database prevents the use of OPcache and similar systems that improves PHP performance by storing precompiled scripts in shared memory.
- Built-in visitor logging system can be used to easily construct a “Top articles” list.
- Good cache handling by default and support for [delta syndication feeds](https://www.ctrl.blog/entry/feed-delta-updates/). I wrote [a WordPress plugin](https://www.ctrl.blog/entry/wordpress-feed-delta-updates/) for this if anyone is interested.

### Conclusion

There are good ideas and good execution all throughout Textpattern. It’s a good CMS choice for anyone who just wants to write and don’t want to deal with maintenance. For many bloggers, it’s probably a far better choice than WordPress. However, Textpattern is starting to show its age and needs to step up on performance and scalability work. It needs to get on top of better image and multimedia management to stay on top of the needs of today’s creative publishers and the multitude of form factors site-visitors can be expected to use.

Textpattern has been around for more than a decade, but hasn’t seen the success of similar platforms like WordPress and Drupal. According to BuiltWith, only some 2800 websites currently deploy Textpattern; down from 4000 deployments just two years ago.

The development team is quite small, with some 16 people contributing any code in the period 2004–2016. I’m currently the number ten top contributor on that list with just 9 small commits.

Before I finished writing this I thought the conclusion would be “Textpattern is nice, but I’m not going to use it.” After going through it again in more detail for this article, I’m not sure anymore.

Textpattern is to me in many ways what WordPress should have been. However, the plugin platform isn’t well enough developed and the multimedia management just isn’t there. Multimedia management in WordPress or Drupal isn’t great out of the box, but these platforms have plenty of plugins that provide more than adequate media file management and publishing.

In conclusion, WordPress is more extensible but Textpattern will get the job done \[except for responsive images\]. Textpattern is a better structural starting point than WordPress, but limitations in the plugin API limits how far you can go with it. I continue to find Textpattern quite alluring, but I’ll stick with WordPress for now.

#### Sources

- [The Oleg effect](https://textpattern.com/weblog/the-oleg-effect?ref=ctrl.blog), 2016-12-28, Stef Dawson, Textpattern Weblog
- [Websites using Textpattern](https://trends.builtwith.com/cms/Textpattern?ref=ctrl.blog), BuiltWith Trends (historical data via the Internet Archive)
- Textpattern and WordPress source code, master branches, as of 2017-01-20
### How to reset and reinstall the OneDrive app in Windows 10
URL: https://www.ctrl.blog/entry/how-to-reset-onedrive-app/
Last updated: 2026-08-23T22:10:54.000Z
The OneDrive app on Windows 10 simply loves throwing up annoying error messages, complains its up to date and not up to date or [claims you’re already logged in and not logged in](https://cdn.synaps.media/control/content/images/2026/08/onedrive-app-logged-in-to-empty-string-account.png?ref=ctrl.blog) at the same time. Rather than wasting time trying to identify what has upset OneDrive *this time*, it’s best just to wipe it off your system and start anew with a fresh configuration. (I’m not one to recommend this approach to such problems lightly.)

It’s possible to reset and reinstall OneDrive using nothing but point-and-click tools. However, the instructions to achieve this would fill a small book on its own so I’ll show you how to do it with just a few commands in Windows PowerShell instead. Go ahead and open Windows PowerShell from the Start menu. You can just copy and paste each of the below commands verbatim (each command is one line separated by an empty line), but please read along to understand what each command does.

The first step is to stop OneDrive’s background process and then tell OneDrive to reset itself. This will often not work, but as you can see from the command arguments we’ll tell PowerShell to give it its best shot and ignore any error that might occur. We’ll deal with resetting everything properly in the next few steps anyway.

```powershell
Stop-Process -processname "OneDrive" -ErrorAction SilentlyContinue
Start-Process "$env:LOCALAPPDATA\Microsoft\OneDrive\OneDrive.exe" /reset -ErrorAction SilentlyContinue
```

Next, we’ll delete all the system registry keys (settings) and files that OneDrive has installed. This is just modifying things belonging to your user account, and isn’t modifying the operating system itself.

```powershell
Remove-Item -Path "HKCU:\Software\Microsoft\OneDrive" -Force -Recurse
Remove-Item -Path "$env:LOCALAPPDATA\Microsoft\OneDrive" -Force -Recurse
```

You can ignore any errors from the first command. However, if the second command issues any errors you’ll need to address them. Find Windows PowerShell in the Start menu again, right-click on it and choose Run as administrator. You then rerun the last of the two above commands in the administrative PowerShell. Once that’s done, you can close the administrative PowerShell and continue in the regular PowerShell window you opened initially. You may sometimes need an administrative PowerShell to do this step because of a bug in how older versions of OneDrive were installed.

As you’ve now cleared out all settings and installed files, you should move aside the old OneDrive folder. This assures that you’ve a backup of the files and that OneDrive can start syncing to a new empty folder. You can copy over files from the backup folder and over into the OneDrive folder if you notice anything missing after completing the tutorial.

```powershell
Move-Item -Path "$env:ONEDRIVE" -Destination "$env:ONEDRIVE Backup"
```

Lastly, you can initiate the OneDrive setup process. You should see a progress bar that tracks the installation process. This can take a few minutes.

```powershell
try {Start-Process "$env:SYSTEMROOT\System32\OneDriveSetup.exe"} catch {Start-Process "$env:SYSTEMROOT\SysWOW64\OneDriveSetup.exe"}
```

Once the installation is complete, you’ll either be logged in to OneDrive automatically if you log in to Windows with a Microsoft Account or you’ll be prompted to login manually if you use a local Windows account. In any case, you should be done at this point. Don’t be alarmed if you see the OneDrive icon disappear and reappear several times from the systray; it’s just busy restarting a few times on its own to complete the installation and configuration.
### The not always Simplenote
URL: https://www.ctrl.blog/entry/review-simplenote/
Last updated: 2026-08-23T22:20:00.000Z
Simplenote is a minimalist and simple to use note-taking app for web as well as all the major operating systems. This will partially be a review of Simplenote for jotting down notes and partially a case-study in an inconsistent user experience across platforms.

#### Contents

1. [Look and feel](#section-simplenote-look)
2. [Writing notes](#section-simplenote-writing)
3. [Publishing notes](#section-simplenote-publish)
4. [Revision history](#section-simplenote-history)
5. [Losing notes](#section-simplenote-dataloss)
6. [Conclusion](#section-simplenote-conclusion)

### Look and feel

In essence, Simplenote is an open-source app for keeping your notes in sync between all your different devices. Notes are synced through Simplenote’s proprietary server-software, so the open-source commitment only goes so far. The service is operated free of charge by Automattic, the company behind the WordPress.com blogging platform.

The interface is organized as a simple list of recent notes on the left side, with a search field at the top. The right side is a big empty slate for you to type your notes on. There’s a row of icons at the top, and everything uses large and readable fonts. It’s just simple.

![Screenshot of Simplenote with some simple notes](https://cdn.synaps.media/control/content/images/2026/08/simplenote-screenshot-windows.jpeg)

The app looks almost the same on all platforms. Except for MacOS where the toolbar is missing. You only have the global menu bar and an overflow icon. No features exposed in the menu bar, which MacOS users don’t appreciate (limited Automator and keyboard navigation.)

However, if you’re anything like me and you use more than one platform then you might want to take notes on more than one platform. Slight differences between the various platforms make the app harder to use for its most dedicated multi-device users. Icons are slightly different and the same features are named differently and are found in different locations in the user interface. These inconsistencies are annoying and I find myself hunting for features that *I know exist* but sometimes have a hard time finding.

### Writing notes

Notes can be jotted down in either plain-text or in Markdown format. You can preview Markdown formatted note with the push of a toggle. However, you must first go in to the circled-i menu and turn on the Markdown formatting option on a per-note basis. The first line of each note is automatically designated to be the title of the note.

You can work on a note from multiple locations as edits show up almost instantaneously on multiple devices. I’ve found it very useful to start jotting down a note on my mobile only to continue it a few seconds later from a full-sized device.

Simplenote is primarily focused on being a personal notebook. However, hidden away in the app you’ll also find collaborative editing so that you can work on a note with others. You simply tag a note with someone’s email address, and it will show up in their notebooks.

There’s no confirmation dialog or anything indicating how this works, you just sort of have to know about it. When you tag someone’s email address, they’re automatically notified by emailed. People must have a Simplenote account under the email address you shared the note with to be able to open it. For people with more than one email address, this can be somewhat annoying if someone shares to the wrong address – but it’s the way most other services work too.

People can untag themselves from your shared noted by deleting your note from their notebooks. If either you or the note’s creator untags you from a note, the note will disappear and the sharing link will begin returning a blank page.

There aren’t any writing-assistive technologies in Simplenote besides the one you get from the host operating system. This means there’s no spell-checker in some versions of the app including the Linux and Windows apps.

This is a pretty huge omission that can either lower the quality of your writing or boost your productivity; depending on your stance on spelling assistants while taking notes.

There’s a word and character counter hidden away in the circled-i icon or in the overflow menu. The Windows, Linux, and web variants all agree on the same word count for the same notes.

However, iOS and MacOS both have their own unique way of counting that offsets its count from the three other platforms by a couple of words per 1000 words or so. The Windows app also is off by one character on the character count compared to the other apps except. The iOS variant doesn’t have a character count at all, only a word count. It would seem counting is hard.

### Publishing notes

You’ve some limited ability to publish a note on Simplenote. Published notes support Markdown, and both formatting styles will be presented as a paper-sheet-width sized note on a plain page. When you publish a note, you’re given a read-only link to the note that you can share with others on the web.

The sharing is limited to link-only audience, as search engines are excluded from indexing shared notes. Notes may still show up in some search engines like Google with a notice saying they can’t show a preview of the page, but indicate that the page otherwise does match the search query.

The published note page doesn’t contain any OpenGraph Protocol or other metadata to enable detailed previews of the link when shared to social media networks and other link sharing platforms.

Other than your note, the published page only contains a discrete notice at the bottom saying the note was “Published with Simplenote.” There’s also no reference to the user’s account name or email address anywhere. The publishing is done entirely anonymously, unless you say who you are in the note itself. There are no ads on your published pages **yet**, however the page markup indicates that there’s intent to put ads on them at some point in the future.

If you’re curious, you can [see an example note](https://app.simplenote.com/publish/PC05Sv?ref=ctrl.blog) that I’ve published with Simplenote.

Simplenote’s publishing feature isn’t any better than just copying the note into an email and send it off to whoever you want to read it. However, if you need to send someone a link-copy that updates as you’re working on a note — then Simplenote has got you covered.

### Revision history

Automatic versioning is fantastic. It means you can be bold and experiment without having to fear that you’ll lose anything as you can revert to an older iteration of your notes at any time. If you click the clock-icon, you get a slider that you can use to scroll through the note’s history.

That clock icon is one of the things that differ between platforms. On Android, Linux, and Windows, it’s a clock with a circle-arrow that indicates time is going forward even though the feature is literally all about going back in time. On iOS, the circle is correctly indicating that time is being turned backwards with this feature. On the web, it’s just a clock with no arrows — and finally on MacOS the icon isn’t even there: the feature is hidden away in an overflow menu. Likewise, the feature is called “History” in all the apps but “Versions” on the web.

In most user-friendly implementations of revision history, you choose to “Restore a copy” when you find something you want to bring back from the past. This gives you the opportunity to cherry-pick from both copies of your note without losing either. Simplenote simply replaces the current note with its previous incarnation.

Simplenote works when you’re offline, but if you edit the same note in two locations — only the version you’ve edited the most recently is kept. The older of the two revisions is unceremoniously pushed into the revision history. When you’re online, Simplenote is so fast at pushing changes between apps that are open at the same time that you wouldn’t usually have a problem with situations where both apps aren’t in sync. (Exceptions apply. Continue reading.)

The article search function only searches the current revision of your notes, which can be limiting when you’re absolutely sure that you’ve written something down at some time.

Lastly, you can browse revisions of deleted notes on Android, but not in any of the other apps. This feature has proven quite useful to me. However, it’s difficult to use this on a small-screen Android device, and it would have been even more useful on desktop.

Overall, this is a powerful feature that can be very beneficial as well as reassuring.

### Losing notes

I’ve lost some notes while using Simplenote. I’d guesstimate it to be roughly 1 in 100 notes. It‘s unacceptable for any note-taking app to lose data like this.

In [a bug from 2014](https://github.com/Automattic/simplenote-android/issues/246?ref=ctrl.blog), two engineers causally chat about server logs indicating that the Android app is deleting notes that it shouldn’t have. The issue has been left unresolved. As I’m using the Android app all the time, I can only speculate that this is what is happening to me.

However, there are more situations that can cause you to seemingly and lose some notes. If you’ve Simplenote installed on multiple devices, but you don’t open the app for a few weeks on one of them: the app can then have problems getting back in sync with the server. If you create a new note without being in sync, I’ve seen two different behaviors:

1. As the app suddenly catches up with new notes, your new note is moved to trash.
2. After a little while, every note disappears until I restart the app or reload the website. Notes created in this time window are deleted.

Its kind of a funny thing too, because Simplenote will even put empty notes with no revision history in the trash. There’s no point in not immediately deleting these ‘unused noted’, but to keep up the appearance of not losing anything ever — they keep it around.

I’ve also randomly found notes I worked on a few hours earlier in the trash. I’m positive that I haven’t deleted them, because they’re valuable enough that I panic a bit when I can’t find them and I’ve definitely not been done with them. It’s no big problem when I can just restore them, but … it’s not confidence inspiring.

### Conclusion

I like Simplenote and **I use it every day.** I’m not super-happy about the many tiny issues and inconsistencies, but it’s one of the better note-taking platforms available. Simplenote’s many apps need to iron out their differences and become a little more uniform. The differences mostly seem to be caused by one team not knowing/caring what the other was doing. The **features and design are excellent** but the execution isn’t uniform across platforms and leaves something to be desired on all of them.

I’d **recommend Simplenote to pretty much anyone**, but with the caveat that they’d take the time to learn about note-recovering methods (restore-from-trash, revision history, backups, hope) before committing to the platform.

Speaking of platform, I wish Automattic would release the backend server for Simplenote as an open-source project. Just releasing the clients as open-source software but not the essential sync engine is showing more than a little lack in their commitment to open-source.

**Reviewed:** [Simplenote](https://simplenote.com/?ref=ctrl.blog)

**Review rating:** 7 / 10
### How to protect SSH logins in Fedora Linux with SSHGuard and FirewallD
URL: https://www.ctrl.blog/entry/how-to-sshguard-firewalld/
Last updated: 2026-08-23T22:11:01.000Z
[SSHGuard 2](https://www.ctrl.blog/entry/sshguard2/) introduced a new FirewallD backend that makes it easier to work with in Linux distributions that use FirewallD tools. Here is how you install and configure SSHGuard on a distribution with FirewallD (like Fedora Linux, CentOS, RHEL.)

You can reduce the number of scripted attacks against SSH significantly by [changing the default port number](https://www.ctrl.blog/entry/how-to-alternate-ssh-port-fedora/). Obscuring where the SSH service is accessed shouldn’t be your only line of defense, however. This is where SSHGuard comes in: it will add the IP addresses of repeated attackers to the system firewall to drop the connections before they even reach your SSH service.

#### Contents

1. [Build and install](#sshguard-section-install)
2. [Configuring SSHGuard](#sshguard-section-config)
3. [Configuring your FirewallD zone](#sshguard-section-firewalld)
4. [Starting the service](#sshguard-section-service)
5. [Test and verify](#sshguard-section-verify)

### Build and install

SSHGuard isn’t packaged for Fedora Linux yet (I’ll see what I can do about that), so you’ll have to compile and install it yourself. Luckily, that isn’t a very complicated process so you should have SSHGuard up and running on your system in a few minutes by following this tutorial.

Start by installing the build dependencies using the below command. If you’re using Ubuntu or another distribution, you’ll find the appropriate `apt` command in the `INSTALL` file. You can follow along in this tutorial even if you don’t use Fedora Linux, but choose the appropriate firewall backend for your distribution.

```shell
dnf install byacc flex gcc make wget
```

Next, you need to download and uncompressed the source from the latest release tarball from [SourceForge](https://sourceforge.net/projects/sshguard/files/sshguard/?ref=ctrl.blog). The example commands below downloads [version 2.1](https://www.ctrl.blog/entry/sshguard2p1/), extracts it from the package, and changes the working directory to the source directory.

```shell
wget "https://sourceforge.net/projects/sshguard/files/sshguard/2.1.0/sshguard-2.1.0.tar.gz"
tar -xzf sshguard-2.1.0.tar.gz
cd sshguard-2.1.0/
```

Make sure you get the latest release version. Once you’ve got your very own copy of the source code from the release tarball, you can proceed to configure and build SSHGuard:

```shell
./configure --prefix="/usr/local/"
make
```

Unless you see error messages, you should be ready to install the final program as well as some example configuration resources. The following commands needs to be executed as root, and will copy the files you need to where they need to go:

```shell
make install
cp ./examples/sshguard.conf.sample /usr/local/etc/sshguard.conf
cp ./examples/sshguard.service /etc/systemd/system/
```

### Configuring SSHGuard

The example configuration file has enough inline documentation to guide you through the required configuration options. You’ll only need to configure the `BACKEND` and `LOGREADER` options. For Fedora Linux, we’ll work with FirewallD as the firewall backend and systemd journal as the log reader. Make the following changes in `/usr/local/etc/sshguard.conf`:

```ini
BACKEND="/usr/local/libexec/sshg-fw-firewalld"
LOGREADER="LANG=C /usr/bin/journalctl -afb -p info -n1 -t sshd -o cat"
```

All those `journalctl` switches tells the journal to pipe out all messages from the `sshd` process with priority info or higher with basic formatting (`syslog`\-like.)

You can look through the other configuration options in the file to see if you want to make any other changes. You may want to double the `DETECTION_TIME` code if you’re experiencing slow-paced brute-force attacks.

Next, you’ll need to make one small change in the systemd unit service file to account for the installation prefix we made during the build process. Change the `ExecStart` option in `/etc/systemd/system/sshguard.service` to the following:

```ini
ExecStart=/usr/local/sbin/sshguard
```

As you’re all done configuring the systemd unit file for SSHGuard, run the following command to let systemd know that there’s a new unit file:

```shell
systemctl daemon-reload
```

### Configuring FirewallD zone

The FirewallD backend in SSHGuard relies on the ipset feature of iptables. Blocked attackers are added to either the `sshguard4` for IPv4 or `sshguard6` for IPv6 ipsets. Additionally, SSHGuard will add a firewall rule to FirewallD that tells it to drop connections from any source IP found in either one of these ipsets.

By default, SSHGuard’s drop-rule will be added to the default FirewallD zone. Depending on your firewall zone configuration, you may want to add additional drop rules to other zones. If you only use the default `public` zone **then no further configuration is needed.** The following command would add the default rule to the `home` zone:

```shell
firewall-cmd --permanent --zone="home" --add-rich-rule="rule source ipset=sshguard4 drop"
firewall-cmd --permanent --zone="home" --add-rich-rule="rule source ipset=sshguard6 drop"
firewall-cmd --reload
```

You can inspect the blocked entries in each ipset using the following commands:

```shell
firewall-cmd --permanent --info-ipset="sshguard4"
firewall-cmd --permanent --info-ipset="sshguard6"
```

You can unblock a blocked attacker, in this example `10.10.1.10`; using the following command:

```shell
firewall-cmd --ipset="sshguard6" --permanent --remove-entry="10.10.1.10"
```

Note that SSHGuard’s two ipsets are deleted when SSHGuard flushes its own firewall rules (on exit.) This may cause a problem if FirewallD rules are loaded when the ipsets don’t exist yet. To work around this, you can either add the creation of these two ipsets to your permanent FirewallD configuration or you may want to take more control of SSHGuard’s FirewallD backend script. You can copy and modify the `sshg-fw-firewalld` script (it’s an easy to follow bash script) and configuring the `BACKEND` option to use your custom firewall backend.

### Starting the service

Now that SSHGuard is installed and configured, you can start the service and check up on it’s status with these commands:

```shell
systemctl start sshguard
systemctl status sshguard
```

Verify that it says `active (running)` in the output and that you don’t have any errors or warnings in the log output.

To have SSHGuard start at systemboot, run one last command:

```shell
systemctl enable sshguard
```

### Test and verify

At this point SSHGuard should be installed, configured, and protecting your machine. But how can you be sure that it’s working? Run the following command to follow the systemd journal log entries from sshd and sshguard:

```shell
journalctl -ef -t sshguard -t sshd
```

From another machine (or at least IP), try to login to the protected system over SSH using invalid credentials. On the protected system you should see log entries from both SSHGuard and SSH about the unsuccessful login attempts.

Continue the login attempts with invalid credentials until it stops working, and look in the log output. It should say that the IP was blocked and for how long. If you want for the block duration timeout to expire, and then continue to attempt more logins you should see that the block time gets doubled.

You should see login attempts to `sshd` and log messages from SSHGuard like “Attack from "client8.homenet.example.com" on service 100 with danger 10.” After five attacks sshguard should block the attacker with an error saying “Blocking "client8.homenet.example.com" for 600 secs (3 attacks in 75 secs, after 1 abuses over 75 secs.)”

You can repeat the test and first use the `ssh -4` switch and then repeat the test with the `ssh -6` switch when attempting to pretend login to your protected system to verify that both IPv4 and IPv6 protections are working.

You can tweak the `BLOCK_TIME` and `DETECTION_TIME` duration options in `sshguard.conf` to your liking. Note that the `BLOCK_TIME` is doubled on every subsequent block per source IP.

Reboot the system and repeat the test.

If you’ve accidentally locked yourself out, you can find the commands for releasing yourself from the block in the FirewallD section above.
### What’s new in SSHGuard 2.0
URL: https://www.ctrl.blog/entry/sshguard2/
Last updated: 2026-08-23T22:22:23.000Z
[SSHGuard](https://www.sshguard.net/?ref=ctrl.blog) is an intrusion prevention utility that parses logs and automatically blocks misbehaving IP addresses with the system firewall. It’s less configurable than the better-known *Fail2Ban* but has a smaller resource footprint and ships with full IPv6 support.

The newly released SSHGuard version 2.0 have been made easier to configure for new users. It also gained support for FirewallD, ipset, and ipfilter firewall backends on Linux; as well as Capsicum sandboxing support on \*BSD.

While we’re still waiting for the next release of [Fail2Ban with IPv6 support](https://www.ctrl.blog/entry/fail2ban-ipv6/), I took a look around at some of the alternatives and found an interesting option in SSHGuard.

I needed to address some Linux compatibility issues when getting started with SSHGuard as the development team was mostly focused on FreeBSD. I submitted patches for those issues and got more involved in the development and release of SSHGuard 2.0 in the process.

New in SSHGuard 2 is that all configuration should be done in **a new configuration file** rather than modifying the init script or adjusting runtime flags. The new `LOGREADER` option makes it easier to configure log reading from the systemd journal on Linux and the os\_log on MacOS.

The new permanent configuration scheme should make it easier for distributions to provide a better out-of-the-box experience for their users as well as make it easier for users to change their configuration.

The ipfilter firewall backend for Linux was removed in SSHGuard version 1.7, but has been resurrected in version 2.0.

Also new in SSHGuard 2 is two new firewall backends: **FirewallD and ipset** for Linux, both contributed by yours truly. The FirewallD backend will add blocked attackers to an ipset and drop them on the default public firewall zone by default.

See the companion tutorial for [configuring SSHGuard with FirewallD on Fedora Linux](https://www.ctrl.blog/entry/how-to-sshguard-firewalld/) for more details. The ipset backend will add blocked attacks to an ipset, but will not take any actions against these entries by default. (Attackers aren’t blocked!) The ipset backend is intended to be used as a source in custom ipfilter configurations.

SSHGuard 2’s blocker and attack parser have been hardened using the **Capsicum capability and sandboxing** framework on FreeBSD and OpenBSD. Not all features are available in Capsicum mode, including working with allow and block list files.

You can get the latest release of SSHGuard from [Sourceforge](https://sourceforge.net/projects/sshguard/files/sshguard/?ref=ctrl.blog), read [the 2.0.0 release highlights](https://web.archive.org/web/20180610105012/https://www.sshguard.net/litenewz/feeds/14), or learn more on the [SSHGuard website](https://www.sshguard.net/?ref=ctrl.blog).
### Windows 10 decides its a good idea to ask before rebooting for updates
URL: https://www.ctrl.blog/entry/windows-update-prompts/
Last updated: 2026-08-23T22:25:28.000Z
It’s almost 1,5 years overdue, but Windows 10 will soon ask its users whether they’re done with their work before restarting the system to perform updates. Updates may still be disruptive, but users will have more warnings and have more opportunities to delay updates.

I’ve been [somewhat critical](https://www.ctrl.blog/entry/software-update-tyranny/) of [Windows Update](https://www.ctrl.blog/entry/software-updates-suck/) in [Windows 10](https://www.ctrl.blog/entry/windows-active-hours/) over the last few months, calling it both disrespectful and rude for closing everything I’m doing to restart and install updates.

> “Windows 10 made most of the decisions for you regarding when updates would be installed and didn’t provide ways to tailor the timing to your specific needs. What we heard back most explicitly was that you want more control over when Windows 10 installs updates. We also *heard that unexpected reboots are disruptive* if they happen at the wrong time.”

John Cable, Microsoft

Users will be prompted whether they want to restart immediately, snooze the update for up to three days, or pick a specific time and date to perform the update. The changes will arrive in the Windows 10 ‘Creator’s Update’ (or ‘Service Pack 2’, as it would be called using 2000’s Microsoft product naming conventions.)

I’m happy to see that users will be put back in control of how their devices operate. It will be a definite improvement to be able to leave my PC for a bathroom break and not come back to a PC that have lost all my work and is busy installing updates. This is without a doubt the single most impactful improvement in the upcoming Creator’s Update.

Windows 10’s update scheme was incredibly ambitions for an operating system that doesn’t preserve the state of running programs after a reboot. There’s no way to implement anything like automatic reboots and updated without being disruptive when they would be so disruptive to running programs and actual work being done on the device.

#### Sources

- [Providing customers with more choice and control in the Creators Update](https://blogs.windows.com/windows-insider/2017/03/01/providing-customers-choice-control-creators-update/?ref=ctrl.blog), 2017-03-01, John Cable and Michael Fortin, Windows Experience Blog
### Windows 10 supports Cal­DAV/​Card­DAV but limits provider-support
URL: https://www.ctrl.blog/entry/windows-pim-sync-partnersonly/
Last updated: 2026-08-23T22:25:21.000Z
Windows 10’s Email and app accounts system let you sync your email, contacts, and calendars with your hosted service provider and the Windows platform. After syncing your data, you get more out of your device as the built-in Calendar and People (Address Book) apps come to life along with the lock screen, and action and notification center. It’s a better Windows experience when it has your data.

Assuming your data is hosted by Google, Apple iCloud, Yahoo!, or Microsoft Outlook, you’re all set to go! Despite the fact that all leading service providers use the same open standards for syncing this kind of data, you’re all out of luck if your service provider isn’t on Windows’ “nice list” (which only includes U.S. companies.)

I wrote earlier this week on how Windows has locked-down its implementation of the open iCalendar standard [to only Microsoft curated calendars](https://www.ctrl.blog/entry/windows-icalendar-app/). Today, I’ll continue by writing about two other open standards that have been locked down to a approved set of service providers in Windows 10: CalDAV and CardDAV.

CalDAV and CardDAV are open standards for syncing calendar appointments and contacts data between devices. If you’ve ever setup an email client, you might be more familiar with (or at least seen) the IMAP and SMTP standards for sending and receiving email. Google, Yahoo!, and iCloud sync with Windows using CalDAV, CardDAV, IMAP, and SMTP.

These four open standards are also supported by all the other leading email/calendar/contacts providers including AOL Mail, FastMail, GMX (Germany), Mail.ru (Russia), Tencent QQ Mail (China), Yandex (Russia), and ZoHo. They’re also supported by groupware suites like Horde and ZoHo used by businesses worldwide and by Nextcloud, the self-hosted geek’s favorite home-server solution.

Yet, in Windows you can only choose between four predefined branded partners. There are no options for either automatically (using [another set of open standards](https://www.ctrl.blog/entry/dns-srv-usage/)) or manually configuring a custom service provider or just specifying the server addresses yourself.

This effectively **blocks competitors** from letting their customers sync their data with Windows and the Windows core communications applications. People who want to get the most out of Windows 10 either have to migrate to one of the short list of approved service providers to host their email, calendar, and contacts — or use a [potentially insecure work-around](https://www.ctrl.blog/entry/how-to-win10-webdav-syncengine/) to stay with their current preferred service provider.

Windows has everything in place to add support for syncing with every CalDAV and CardDAV service provider. The Email and app account system in Windows 10 has a generic account type which includes full auto-configuration using /.well-known/ URIs — although not using [SRV records in DNS](https://www.ctrl.blog/entry/dns-srv-usage/) that would work automatically for many — and with manual configuration for the rest of the hosted or self-hosted sync providers.

The underlying data store and sync engine has an unused and undocumented `WebDavServerType.Generic` server type identifier which can be associated with a generic account for syncing data with IMAP, SMTP, CalDAV, and CardDAV. Windows 10 does have one account type that supports specifying IMAP and SMTP server address for email. Everything required for specifying a [CalDAV server URL](https://learn.microsoft.com/en-us/uwp/api/windows.applicationmodel.userdataaccounts.systemaccess.deviceaccountconfiguration?view=winrt-16299&ref=ctrl.blog#Windows%5FApplicationModel%5FUserDataAccounts%5FSystemAccess%5FDeviceAccountConfiguration%5FCalDavServerUrl) and a [CardDAV server URL](https://learn.microsoft.com/en-us/uwp/api/windows.applicationmodel.userdataaccounts.systemaccess.deviceaccountconfiguration?view=winrt-16299&ref=ctrl.blog#Windows%5FApplicationModel%5FUserDataAccounts%5FSystemAccess%5FDeviceAccountConfiguration%5FCardDavServerUrl) is already in place.

The only piece of the puzzle that’s missing is [exposing a generic account type in the API](https://learn.microsoft.com/en-us/uwp/api/windows.applicationmodel.userdataaccounts.systemaccess.deviceaccountconfiguration?view=winrt-16299&ref=ctrl.blog#Windows%5FApplicationModel%5FUserDataAccounts%5FSystemAccess%5FDeviceAccountConfiguration%5FDeviceAccountTypeId) and adding that account type to the user interface.

![Advanced settings of Add iCloud account dialog in Windows 10](https://cdn.synaps.media/control/content/images/2026/08/windows10-add-icloud-account-webdav.jpeg)

Microsoft could even [recycle the existing user interface it already implemented for iCloud](https://cdn.synaps.media/control/content/images/2026/08/windows10-add-icloud-account-webdav.jpeg?ref=ctrl.blog). In my estimate Microsoft, it’s just a matter of changing about six variables in the code and adding some text strings!

Maybe Microsoft doesn’t want to clutter up the user interface by introducing a new account type. However, Windows already have the “Other account” option. **All the pieces are there for full calendar, contact, and email sync from any of provider** using open standards.

It’s worth noting that there’s a one more account type available in Windows 10: Microsoft Exchange. Exchange is Microsoft’s own proprietary alternative, with a rather hefty licensing fee, to the open standards protocols discussed in this article. Microsoft Exchange is used by Outlook.com and enterprises committed to Microsoft services.

Artificial “problems” like this one reminds me [why I love Free software](https://www.ctrl.blog/entry/ilovefs-2017/). It would have been so easy for anyone with half a gram of interest in any of this to take all the almost-but-not-quite bits Microsoft have made and turn them into a great product.

Instead, Microsoft is trying to control the market and in effect gets to pick winners and losers in the market based on which providers they choose to support or not. This isn’t made any better by the fact that they’ve added support for open standards, but hide away their configuration options so people can’t use them.

You can configure a custom CalDAV/CardDAV server setup by [modifying an iCloud account](https://www.ctrl.blog/entry/how-to-win10-webdav-syncengine/). This work-around introduces a security issue and doesn’t address the core issue I wanted to address here: A generic account type should be the core feature; with popular branded options being a secondary option.

I believe this is a hubristic self-promoting business decision by Microsoft, and has nothing to do with design nor technical challenges. The exclusion of a system for configuring open standards and competing service providers in Windows 10 **smells suspiciously like a scheme for selling more licenses of Microsoft Exchange**.

Providing Microsoft Exchange services are expensive for service providers compared to free and open standards. However, service providers may feel pressured to make that investment when their customers can’t get their data into Windows 10\. The whole thing feels more like the old 1990’s and 2000’s Microsoft than the new Microsoft who’ve embraced the Linux application in the Windows kernel.

Sniggering Linux users who believe in open code and open standards can take a hike. The Online Accounts systems in GNOME, Ubuntu Unity, Plasma, and MATE **do the exact same thing** as Window 10\. There are underlying CalDAV and CardDAV sync engines (Evolution Data Server, Akonadi) that power them but the user interface only expose two–three providers like Google and Yahoo! with no option to auto-discover or manually configure any other providers.

There are workarounds available, but the primary method for adding accounts exclude everyone but the largest U.S. service providers by default. That their favorite desktops have [chosen to promote hosted services from Google and Yahoo!](https://www.ctrl.blog/entry/gnome-caldav/) over open standards that any vendor can support should make any Linux user cringe just a little. MacOS and iOS get top marks for having supported and actively worked on this as an open standard for years.

The only ones who get a free pass on this is MacOS and iOS users. These two platforms have excellent support for and let users and businesses setup CalDAV and CardDAV accounts on their devices without pretending to be, ironically enough, an Apple iCloud account. Apple even maintains an open-source [CalDAV and CardDAV server project](https://www.calendarserver.org/?ref=ctrl.blog). When Apple is beating your product on being an open and welcoming platform, you know for sure that you’re doing something wrong.

#### Sources

- [RFC 5785 Defining Well-Known Uniform Resource Identifiers (URI)](https://www.rfc-editor.org/rfc/rfc5785.html?ref=ctrl.blog), 2010-04, Internet Engineering Task Force
- Various Microsoft Developer Network articles, linked inline
- Windows 10 libraries and executables, Windows 10.1607 build 15031
- [Compare Exchange Online plans](https://web.archive.org/web/20170228002023/https://products.office.com/en-us/exchange/compare-microsoft-exchange-online-plans), Microsoft Office website
### How to add CalDAV and CardDAV accounts and sync with Windows 10
URL: https://www.ctrl.blog/entry/how-to-win10-webdav-syncengine/
Last updated: 2026-08-23T22:11:16.000Z
Windows 10 fully supports syncing contacts and calendar data to the built-in Calendar, People, and Mail apps with a CalDAV and CardDAV server. However, this functionality is normally [limited to select Microsoft partners only](https://www.ctrl.blog/entry/windows-pim-sync-partnersonly/). However, you can use a work-around to add any CalDAV and CardDAV service provider.

You can’t add a generic CalDAV/CardDAV server account in Windows 10 as it imposes limits to syncing only with Google, iCloud, and Yahoo! accounts. The WebDAV Sync Engine in Windows has [implemented support for generic accounts](https://www.ctrl.blog/entry/windows-pim-sync-partnersonly/), but adding such an account isn’t an option available to users.

However, you can still get syncing up and running by adding an iCloud account and modifying its server addresses. Before I explain how to go about this, I’ve to put up a warning with a shrieking yellow background.

Note that there’s an inherent **security risk** in following this tutorial. As of Windows version 10.0.1607, I’ve done all I can to verify that your DAV account password isn’t being sent to Apple if you follow these instructions. However, future changes to Windows may change the implementation in a way that may share your DAV account password with Apple.

If Windows adds support for two-factor logins for Apple IDs in the future, your logins could be sent to Apple’s servers. Similarly, Windows may remove the option to modify the DAV server addresses and hardcode Apple server addresses.

**Don’t use this tutorial with any login credentials** that unlocks any accounts you’d not want to share with Apple. Apple are unlikely to log incorrect login details that are sent to their servers — or caring about them in the slightest — but there’s always the risk.

If your DAV account doesn’t contain personal information (its your calendar and address book –, of course, its personal information) or you’re okay with Apple potentially getting a copy of you password, you can proceed with following this tutorial.

There’s one last caveat: Your DAV username **has to be an email address** for this to work. Most are, but this will depend on your server or service provider.

To configure a custom CalDAV and CardDAV account, first add a placeholder iCloud account in Windows.

1. Open the Windows Settings app, and go to Accounts: Email and app accounts.
2. Click Add new account and choose iCloud.
3. Enter your DAV account username as the email address.
4. Enter **NOTPASSWORD** as your password. Make sure not to enter your real password. The password you enter here’s sent to Apple.
5. Click Sign in.

At this point, you’ve a non-functioning iCloud account which we’ll use as a template for configuring your generic CalDAV and CardDAV account.

![Advanced settings of Add iCloud account dialog in Windows 10](https://cdn.synaps.media/control/content/images/2026/08/windows10-add-icloud-account-webdav.jpeg)

1. Select your account from the Email and app accounts list and click Modify account.
2. Click Advanced mailbox settings.
3. Enter “localhost” in the IMAP and SMTP server fields. This will prevent your account password from being sent to Apple’s email servers.
4. Enter your CalDAV and CardDAV server addresses in the appropriate fields. More details below.
5. Click Done.
6. Now enter your real account password in the Password field.
7. Click Save.

The initial sync can take several minutes depending on how much data needs to be synced. Your calendar and contacts data should eventually being popping up in the Calendar and People apps, as well as on the lock screen and in the Action Center.

As you can probably tell from the big yellow warning above, this method isn’t recommended. It’s the best that Windows 10 offer for the time being.

#### Details for WebDAV server administrators

The username has to be an email address, because the user interface doesn’t allow users to input anything else. There’s probably no harm in supporting email addresses in addition to non-domained logins if this is your current setup.

Windows will auto-discover your CalDAV endpoint by going to `https://dav.example.com/.well-known/caldav` and your CardDAV endpoint by going to `https://dav.example.com/.well-known/carddav`.

These URIs should simply redirect to the actual endpoint addresses. Windows will also guess some common endpoint targets if the `.well-known` auto-discovery method fails. You shouldn’t rely on this, but rather implement the `.well-known` URIs.

The User-Agent string for Windows’ WebDAV Sync Engine is “`MSFT-WIN-3/<windows-version>.<windows-build> (gzip)`” (Yes, it does oddly enough include “`(gzip)`”.)

#### Sources

- RFC 5785 Defining Well-Known Uniform Resource Identifiers (URI)
- Windows 10 libraries and executables, Windows 10.1607 build 15031
### Windows 10’s “Interesting Calendars” feature is powered by webcal/iCal
URL: https://www.ctrl.blog/entry/windows-icalendar-app/
Last updated: 2026-08-23T22:24:57.000Z
Microsoft announced a slew of updates to the built-in Calendar app for Windows 10 last week. Among the new features was something called “Interesting Calendars” (interchangeably branded as “Bing Calendars.”) What *is interesting* about this feature isn’t the curated selection of calendars you can subscribe to but rather how this is yet another open technology that has been implemented exclusively in a locked down manner. I’ll explain what is going on with this latest iCalendar implementation.

The ‘new’ Interesting Calendars feature that popped up in the Windows 10 built-in Calendar app is nothing more than a curated collection of iCalendar links that the Calendar app can subscribe to. Sure Bing does some big data and other fancy buzzwords on the backend to generate the calendars.

However, the method that pulls in and updates these calendars in the Calendar app is a standard file format loaded from a standard web server. The calendar files will be retrieved periodically to pull in new information like updated TV program schedules, sports, concerts, and other events.

This can be a useful tool that allows you to pull in data you care about directly in to your calendar. It’s built on open web and industry standards. The only problem is, of course, that **you can’t subscribe to any other calendar providers** than the curated list Windows deems to be “interesting.”

In other calendar apps, including Microsoft’s own Outlook Calendar or even Outlook.com, you can type in the link to any public iCal/webcal calendar you want and have it appear in your calendar.

The late Steve Jobs of Apple Inc. stood on stage at Macworld Expo in 2003 talking about how cool iCalendar was and how you could go out to websites like [iCalShare.com](https://web.archive.org/web/20170303050922/http://icalshare.com/) to discover new calendars that suited your interests.

It’s interesting to note how the Calendar app for MacOS to this day supports users subscribing to whatever calendar link they want, and will even support calendar subscriptions from direct clicks on webcal: links. This is also supported by Outlook and many other competent calendar programs.

The Windows 10 Calendar app is technically capable of retrieving iCalendar subscriptions (this is how the built-in National Holidays and the new Interesting Calendars feature works after all), but user’s are bared from accessing the thousands of calendars that are on offer on the web.

You can work around the limitation, kind of, by [syncing an iCalendar subscription to Outlook.com](https://www.ctrl.blog/entry/how-to-win10-calendar-app-ics/) and then syncing your Microsoft Account with the Calendar app. However, you’re then locked in to Microsoft’s online platform and not using the capabilities that exist in the Calendar program itself.

I find it very interesting to observe how Windows is obscuring technology and pushing it more and more to the background. Bing Calendars is a nice enough feature on its own. I don’t mind it being added at all, and I believe it can bring value to many users. However, implementing a client syncing technology and only allowing your calendars as data providers isn’t something I want to see in Windows.

There’s a worrying trend with more and more **lock-downs of general-purpose operating systems and programs** in favor of turning tools previously open to anyone in to tools for promoting the company’s own services and products. Making a good and capable calendar client has become a secondary priority to promoting Microsoft’s other products.

#### Sources

- [Announcing updates to Windows 10 Mail & Calendar apps](https://blogs.windows.com/windowsexperience/2017/02/22/announcing-updates-windows-10-mail-calendar-apps/?ref=ctrl.blog), 2017-02-22, Lynn Ayres, Windows Experience Blog
- RFC 5545 Internet Calendaring and Scheduling Core Object Specification (iCalendar)
- [Steve Jobs on iCalShare](https://www.youtube.com/watch?v=ZJhLY9perRo&ref=ctrl.blog), 2003-01-07, Steve Jobs, Macworld Expo Keynote
- [Mail and Calendar – Windows Apps](https://apps.microsoft.com/store/detail/mail-and-calendar/9WZDNCRFHVQM?ref=ctrl.blog), Microsoft Store
### How to add an iCal/​webcal calendar to the Calendar app in Windows 10
URL: https://www.ctrl.blog/entry/how-to-win10-calendar-app-ics/
Last updated: 2026-08-23T22:11:09.000Z
An empty calendar app is a useless calendar app. Here is how you can fill up the built-in Calendar app in Windows 10 with your favorite iCalendar/webcal subscriptions.

The Calendar app that comes built-in to Windows 10 does support iCalendar/webcal subscriptions. This is [how the Holiday Calendars and Interesting Calendars features work](https://www.ctrl.blog/entry/windows-icalendar-app/). Unfortunately, there’s no way to configure a custom iCalendar address at this time.

However, you can add and sync an Outlook.com account (or any Microsoft Account) with the Calendar app, and through that channel can then pull in an iCalendar subscription from the web. The calendar will be pulled in through Outlook.com and into the Calendar app on your Windows devices. This is a bit backward, but it will get your iCalendar subscription into Windows.

The setup process is normally a bit complicated, but you can use this tutorial to skip through most of the process.

1. Add your iCalendar source address in the form below:

iCalendar URL:

You’ll be prompted to login to Outlook.com. Use the same Microsoft Account as you use to login to your PC (or just use any Microsoft Account.) Once you’ve added the iCalendar subscription to the Outlook.com Calendar, you can move on to verify or configure syncing with the Windows 10 Calendar app.

1. Go to the Windows Settings app: Accounts: Email and app accounts. Verify that the Microsoft Account you used above is on the list. If not, click Add an account and add this account to your Windows account.

**After a few minutes**, the iCalendar subscription you added on Outlook.com will appear in the Calendar app. The subscription is updated at least once per day, but Outlook.com may begin to update it more frequently if it changes frequently.

Please note that you can only add public calendars that don’t require password authentication. Any iCalendar address you add to Outlook.com should be considered public, so please don’t use this method to sync any calendars that may contain private information.

This solution should work for Windows 10 as well as Windows 10 Mobile devices.

You’re not sharing your Microsoft Account password with Ctrl blog or anyone else. Once you fill in the above form, you’re sent to a Microsoft login page hosted by Microsoft and continue on to Outlook.com Calendar where you’ll be prompted to add your iCalendar.
### Take control over AdSense Matched content recommendations
URL: https://www.ctrl.blog/entry/adsense-matched-content-exclusions/
Last updated: 2026-08-23T22:01:08.000Z
AdSense hates documentation, or have at least chosen to not document how you can exclude articles from appearing in the AdSense Matched content sections. Luckily, there’s in fact a system for it and I’ll even tell you how to use it.

*Matched content* is a article recommendation system from AdSense that tries to suggest relevant and interesting articles to your website’s visitors. It’s currently only available to publishers with many pages and high levels of traffic. You’ve probably seen many of these content recommendation systems all around the web. The one thing they all have in common is that they [most often make bad recommendations](https://www.ctrl.blog/entry/poorly-recommended-articles/).

Not all AdSense publishers are [eligible to use Matched content](https://www.ctrl.blog/entry/adsense-matched-content-eligibility/). Many publishers are interested in the system, however, as it has all of Google’s knowledge and personal personalization experience behind their recommendations.

Sometimes, however, it chooses to feature something you’d rather not have put in front of too many people. These are articles that may be aren’t all that flattering to your business, they may be outdated or otherwise no longer relevant, or may be they’re just boring legal pages. Whatever the reason, it’s sometimes desirable to exclude certain pages from the becoming recommended reading for your visitors.

You can exclude a page using the standard `/robots.txt` file, but this will also exclude your page from search engines which maybe isn’t what you want.

If you’re running Matched content units from AdSense, a.k.a. “Recommended by Google”, you may have noticed some new bot activity from Google. Roughly once per day, a robot identifying itself as “`Mediapartners-Google`” originating from an IP address belonging to Google requests the following three files:

```
/google_matched_content_rules.xml
/google_matched_content_blacklist.txt
/google_matched_content_whitelist.txt
```

In standing with the finest AdSense traditions, the formats of these files aren’t documented anywhere.

These files are placed at the top level/root of your web server. Their purpose is made clear from their names, however, and their format can be determined with some trial and error. But please do keep in mind that as the following information isn’t documented by AdSense, it could mean that AdSense may change it up or stop supporting it at any time.

The two text files was are enough to work out: List one URL per line that you wish to exclude in the blocklist, and list exceptions to broader exclusion rules in the allow-list. You can make a broad matching rule using wildcard expressions wit the `*` character. For example, `https://www.example.com/documents/` doesn’t exclude other pages underneath /documents/ unless you add a wildcard at the end like this: `https://www.example.com/documents/*`.

If you’ve excluded a directory using wildcards, you can still allow certain pages to appear in content recommendations by including i in the allow-list file. The longest URL (in number of characters) in either your blocklist or allow-list seem to take precedence. There’s no point in including rules for allowed URL in the allow-list, as this is the default policy anyway.

The `/google_matched_content_rules.xml` file was a bit trickier to work out. In the end I set up a crawler to retrieve this file from the Alexa Top 1 Million websites, hoping that some publishers would have this file available. Six out of a million websites had this file, but that was enough for me to work out the format and options.

Here is a simple sample rules file:

```
<?xml version="1.0" encoding="utf-8"?>
<rules>
  <blacklist>
    <uri>https://example.com/about/*</uri>
    <uri>https://example.com/privacy-policy</uri>
  </blacklist>
  <whitelist>
    <uri>https://example.com/about/mobile-apps</uri>
  </whitelist>
</rules>
```

So far, I’ve only shown the same capabilities in the rules file as you’ve got with the plain text block and allow list files. However, I’ve also identified some more powerful features, though **I’m not entirely sure on how they’re supposed to work.** The sample size was rather small and I’ve had more trouble verifying these, although I do my guesses as to their application are pretty spot on. Some documentation from AdSense would be of great help here! I’ll provide a more complex example, and then move on to *speculate* about how it all hangs together afterward.

```
<?xml version="1.0" encoding="utf-8"?>
<!-- SPDX-License-Identifier: CC0-1.0 -->
<rules>
  <section>
    <source>
      <uri>https://example.com/reviews/movies/*</uri>
    </source>
    <target>
      <uri>https://example.com/celebrities/*</uri>
      <uri>https://example.com/culture/*</uri>
      <uri>https://example.com/entertainment/*</uri>
    </target>
  </section>
  <section>
    <source>
      <uri>https://example.com/technology/*</uri>
    </source>
    <target>
      <uri>https://example.com/gadgets/*</uri>
      <uri>https://example.com/science/*</uri>
      <uri>https://example.com/technology/*</uri>
    </target>
  </section>
  <whitelist>
    <rss>https://example.com/feed.rss2</rss>
  </whitelist>
</rules>
```

As I’ve already mentioned, I can only speculate on the exact purposes of the `section`, `source`, `target`, and `rss` elements. However, my **educated guesses** as to their purposes are as follows:

A section’s source identifies a partial URL that your readers visit on your website. While on this section, as identified by their source, matched content should preferably recommend content that match the URLs of the identified target addresses. This seems correct given the format, but I’ve been unable to confirm that this is how it works. Recommendations seem to still be at AdSense’s discretion.

This can be a powerful feature to many publishers who publish frequently and on diverse topics.

The last element, `rss`, seem to specify the URL of a syndication feed. I presume this feed is fetched more often than once per day like the main rules files, and I further guess that links in the feed may be prioritized above other links when they’d provide relevant recommendations. I haven’t been able to confirm this either, but I can’t see any other use this tag would have.

Google AdSense doesn’t have any contact options, so I was unable to inquire for any input for this article.

I’ll update this post later as more information from AdSense becomes available.

#### Sources

- Crawling the Alexa Top 1 Million websites for the three file paths requested by AdSense to identify websites that have already implemented the feature.
- [Now you can also earn money with Matched content](https://adsense.googleblog.com/2016/03/earn-money-with-matched-content.html?ref=ctrl.blog), 2016-03-18, Tobias Maurer, Inside AdSense
- [Introducing Matched content: a new way to help your visitors discover content on your site](https://adsense.googleblog.com/2015/04/introducing-matched-content.html?ref=ctrl.blog), 2015-04-22, Tobias Maurer, Inside AdSense
- [About the Matched content feature](https://web.archive.org/web/20170221042945/https://support.google.com/adsense/answer/6111336), AdSense Help
### Keep worthless ads off your web­site with AdSense Ad Balance
URL: https://www.ctrl.blog/entry/adsense-adbalance/
Last updated: 2026-08-23T22:01:02.000Z
**Update** (2020-07-01): Google has [stopped supporting the ad balance](https://support.google.com/adsense/answer/9834657?ref=ctrl.blog) option. They’ve not published any details explaining the change. The article is left unchanged for those interested in how this featured worked historically.

Google has introduced a new Ad balance setting for AdSense publishers in mid January. With its introduction, AdSense made some vague claims about it “improving the user experience” without clarifying what that meant. Here are my experienced with the new feature to help you understand and get the most out of the new setting as a publisher.

Unlike AdSense, I like to clarify things: The settings and details I refer to in this article applies to your whole account and all registered websites. Unless stated otherwise, it’s currently not possible to apply anything discussed here per ad-unit or per domain. This information was accurate as of the time of publication, but AdSense may change things up in the future as they hasn’t committed publicly to anything described in this text.

So, what is the new ad balance setting all about? AdSense explains the feature like this:

> “Focus on your best-performing ads  
>  
> “Only show the ads that make you the most money, improving the overall visitor experience of your site at minimal cost to you.”

Ad balance essentially gives publishers the same tool as [users gets with Google Contributor](https://www.ctrl.blog/entry/google-contributor/) —a subscription program that lets users support their favorite websites by outbidding the least interesting ads. With ad balance, publishers can now opt-out of the least interesting and least profitable ads when there are no better ads available that AdSense believes would turn a profit. Instead of filling the ad space with a low-paying untargeted and unattractive ad unit, the ad space can be left blank.

It’s interesting to note that the ad balance feature became available to publishers just weeks after the Google Contributor program [temporary kicked out all existing subscribers and shut down](https://www.ctrl.blog/entry/google-contributor-no-new-signups/) pending major changes to the service and a relaunch in “early 2017”. It could be that AdSense wants publishers to carry the cost of improving online ads rather than users.

#### Adjusting your ad balance

Publishers can adjust their ad balance for all their ad units by logging in to their AdSense account and going to My ads: Ad balance: Ad fill rate. The slider will suggest a recommended range that will provide a “better user experience”. This range is unique per account and is based on the account’s historical and predicted future performance.

The “Better user experience range” is also an indicator of how well your website is performing in the AdSense network. A high upper range on the “better user experience range” indicates that a large percentage of the ads shown on your website are deemed to be well targeted and of a high value, whereas a lower range indicates that there are few ads that fit with your content and audience.

A low ratio here may mean its high time to rethink your content strategy or maybe look for an alternative ad network. It could also mean that you should consider changing your ad units and formats to see whether this will bring in more targeted ads.

The ad fill rate range slider isn’t something you should set-and-forget. AdSense Help warns that it may change over time, and notes specifically that its estimates may be off for webpages and sites with low traffic. The better user experience range is updated daily.

> “If your site has low traffic, then our predictions for your revenue behavior may not be an accurate representation of your revenue performance over a longer period of time. \[…\] As your traffic increases over time, these high-value ads will result in less skew in your data and our revenue predictions will become more accurate.”

By setting ad balance very low, a website can also control its own *premium feel* by excluding lower paying advertisers. The ad units won’t be guaranteed to be of exclusive watches or expensive cars regardless of your ad balance setting.

However, if your audience consist of people who’re likely to see those kind of ads — you can exclude the occasional cheaper ad unit from sneaking onto your page and lowering your visitors impressions of your website. This kind of control has previously not been possible without committing to the very time-consuming manual ad approval system in AdSense.

#### What happens to the removed ads?

AdSense says: “When we remove an ad, your ad unit will show as blank.” Things aren’t that simple, however.

For your ad units with a backup ad configuration other than the default “show blank space”, you’ll get your backup ads instead of a blank space. If you’ve configured another URL to load backup ads from, these are shown instead. This ad unit won’t be removed or shown as blank.

This makes sense as AdSense says that backup ads are used specifically if it can’t fill up an ad unit, but this isn’t spelled out anywhere in connection with the ad balance feature. Publishers may end up with just the same amount of ads, but just of even poorer quality than those AdSense would otherwise have served.

For ad units set to “show blank space” (the default), the ad will return a blank space for fixed-size ad units. For newer responsive ad units, the ad space may be hidden/collapse entirely if your layout allows for it. The behavior for responsive ad units depends on exactly how your layout is constructed and specifically on whether you assign a fixed size to the ad unit or its containing element.

This is absolutely something AdSense should mention in their documentation, but considering it can *only break a publisher’s website layout* they haven’t considered it important.

It would also seem that AdSense’s matched content ad units are excluded from the ad balance setting, as setting your ad balance to 0 % hides all ads except those in matched content units.

#### Better user experience — *how?*

What does AdSense mean when they say that a lower ad balance will result in a better user experience? The one example AdSense provides is that seeing fewer ads will leave visitors with a better impression of your website, and that they’ll hopefully be more likely to return later.

My take on this is that they’re referring to two separate ares of improvement:

1. Loading fewer ads means the page will load faster and consume less mobile data. A low performing ad unit far down on a page may not even be loaded if the ad balance allows for it not to be. This is in line with users and Google’s stated preference for faster and smaller mobile and webpages.
2. Excluding lower paying ads means a website can appear more appealing and “higher end” to their visitors. At AdSense’s discretion, publishers grant them the freedom to not only show fewer ads, but to drop the lower quality ads altogether.

Let us not forget that reducing the number of ad spaces that are available online will enable AdSense to charge advertisers more as fewer ad spaces becomes available. I’ll not be surprised if AdSense start forcing publishers to accept a default ad balance of 90 % or even lower in the not so distant future. In general, this would be good for publishers, user experience, and the web in general. Low budget advertisers might get hurt in the process, but the *price for online ads is already ridiculously low* as it is.

Improving the online ad experience for visitors should a key priority for AdSense and publishers alike. The ongoing rise of ad-blockers didn’t come out of nowhere.

I think it’s super interesting to see how AdSense are trying to improve the quality of their ad network by enabling publishers to make more decisions about what kind of ads they’re willing to accept on their sites. This has been a long over-due change of focus, and I hope publishers will experiment with lower ad fill rates. AdSense suggests many websites can drop as much as 50 % of their ads at the cost of less than 1 % of their revenue. Regardless of how publishers feel about this feature overall, *dropping 20 % of their under-performing ads at an estimated loss of 0 %* of their revenue should be a done deal for any publishers.

#### Sources

- [Introducing “Ad balance” – focus on your best-performing ads](https://blog.google/products/adsense/introducing-ad-balance-focus-on-your/?ref=ctrl.blog), 2017-01-13, Inside AdSense
- [Optimize the ad balance on your site](https://web.archive.org/web/20171109231303/https://support.google.com/adsense/answer/7215246), AdSense Help
- [Backup ads](https://web.archive.org/web/20170306034828/https://support.google.com/adsense/answer/113262), AdSense Help
- [About responsive ad units](https://web.archive.org/web/20170302114443/https://support.google.com/adsense/answer/3213689), AdSense Help
### Requirements for eligibility for AdSense Matched content
URL: https://www.ctrl.blog/entry/adsense-matched-content-eligibility/
Last updated: 2026-08-23T22:01:06.000Z
Google AdSense are being their usual mysterious selves and don’t share what the specific requirements are to be approved for their *Matched content* recommendation units anywhere in their official help documents. However, the exact requirements have been revealed in a comment from an AdSense support representative.

Matched content is an AdSense feature that will show contextually relevant and recommended articles at the bottom of your webpages. The feature is meant to increase how much time your readers spend on your website as they’ll be presented with more \[hopefully\] interesting content to read when they’re done with reading one story.

The feature isn’t available to every AdSense publisher, however.

> “Matched content is available for sites with multiple pages and high volumes of traffic.”

> “The Matched content feature is available to select publishers. To be eligible, you must have a site that meets our minimum requirements for traffic volume and number of unique pages.”

Typically non-specific communication from AdSense

Reading statements like this can be more than a little frustrating if your website hasn’t been approved to use the now matched content recommendation units with your AdSense account. Some good concrete numbers are much more appreciated than vague generalizations with no frame of reference.

Luckily, AdSense staff aren’t as silent as AdSense’s documentation department, or maybe they’re not as good at keeping secrets. Whatever the case, they’ve let slip the specific requirements (as the only valuable piece of information to come out from a) a Q&A session early last year:

> “The Matched content feature can be activated for all pubs who meet the following minimum thresholds:1,000 unique pages1,000 daily page visitsA unique image on most of the pages of their site”

This answer can be hard to discover as Google seem to be having technical difficulties with indexing comments on Google+. Or maybe they’ve deemed them of so little value that they’re not worth indexing? Whatever the case, it took some digging to find this.

The same numbers where later reposted verbatim by a Google AdSense employee as late as last September on Quora.

I’d take these number with a grain of salt, however. This blog is eligible for matched content recommendations units with and without ads. But it doesn’t have over a thousand articles, only around 300\. This blog does have a whole lot of readers visiting every day, though — so the numbers may not be all that accurate nor a strict requirement after all.

I also suspect that your AdSense account’s historic revenue performance will play a role in whether or not your websites is eligible for Matched content recommendations. I’d also hazard to guess that Google search’s secret recipe for what makes for high-quality content could also have an effect on a publisher’s eligibility.

Although AdSense Matched content’s recommendations aren’t all that bad within a [service category with a bad track record](https://www.ctrl.blog/entry/poorly-recommended-articles/), I’ve opted to only show them to a small fraction of my readers.

The majority of readers will instead see recommendations from a system I wrote myself. As I’ve been able to tune this system for the content that are on my site, it has proven very effective with higher click-through rates than anything I get with a third-party service like Matched content by AdSense.

#### Sources

- [What are the requirements for AdSense’s Matched Content program?](https://www.quora.com/What-are-the-requirements-for-AdSense%E2%80%99s-Matched-Content-program/answer/Symone-Gamble?ref=ctrl.blog), 2016-08-29, Symone Gamble, Quora
- [Q&A on #MatchedContent](https://web.archive.org/web/20170221033625/https://plus.google.com/+AdSense/posts/1mq91HHpVjq), 2016-05-04, +Google AdSense, Google+
- [Introducing Matched content](https://adsense.googleblog.com/2015/04/introducing-matched-content.html?ref=ctrl.blog), 2015-04-22, Tobias Maurer, Inside AdSense
- [About the Matched content feature: Eligibility to use Matched content](https://web.archive.org/web/20170221042945/https://support.google.com/adsense/answer/6111336), AdSense Help
### Navigate around dead links with the Wayback Machine browser extension
URL: https://www.ctrl.blog/entry/wayback-machine-extension/
Last updated: 2026-08-23T22:24:12.000Z
Do you think most of the people around you know at least a few HTTP status codes? Unfortunately, if any – they’re likely to familiar with at least 404 Not Found and 500 Server Error. If you spend enough time on the web, you may encounter these errors quite often – if not daily. The Internet Archive’s new *Wayback Machine* extension for Firefox and Chrome can help you get to the page you were looking for even after it has been removed from the web.

The Internet Archive have been archiving copies of webpages for almost 15 years. They don’t have every webpage ever created in their collection, but if you’re looking for a page that was available publicly for some time and was of any notoriety to anyone: there’s a fair chance that the page will be part of their collection.

The whole collection of webpages is available to anyone through the [Wayback Machine](https://web.archive.org/) where you can lookup any page by its URL. I do this at least a dozen times per month when encountering pages or whole websites that have disappeared off the public web.

When links stop working and pages go off the web, we call it “link rot”. A large portion of the blame for link rot falls on webmasters who [don’t care properly for their old links](https://www.ctrl.blog/entry/rewriting-urls-reorganizing/) when moving, restructuring, or changing publishing platform. Server decay, bankruptcies, link rot, an aging online population, and marketers who recommend their clients to “delete all old pages!” or attempt to [rewrite their company’s history](https://www.ctrl.blog/entry/patreon-bitcoin-extortion/) all contribute to link rot.

One thing is for sure; link rot is a real problem that affects us all and it’s only going to get worse over time.

### Dead link revival built in to the web browser

The Internet Archived and Mozilla started working together on integrating the Wayback Machine in Firefox around February 2016. Mozilla was evaluating whether they can deliver a better web experience without link rot and with access to long-dead pages by partnering with the Internet Archive and baking the feature directly in to Firefox. In dreadful institutionalized language:

> “The Internet Archive is interested in promoting the development, and support the operation of, browser functionality to show archived versions of webpages that are no longer available or otherwise return an error, e.g. a 404.”

The result of this cooperation was the [No More 404s experiment](https://addons.mozilla.org/en-US/firefox/addon/wayback-machine%5Fnew/?ref=ctrl.blog), part of Firefox’s Test Pilot program. Users who’ve opted in to the experiment would see a dialog offering to serve an archived version of the current page if the page was unavailable on the web but a copy existed in the Internet Archive’s collection.

Screen ruler demonstration video.

The original plugin version only detected and offer archived versions for 404 Not Found error pages. However, I contributed [a small patch](https://github.com/internetarchive/wayback-machine-firefox/commit/399b814a7f1bcd268a8cd26091a1f7476ed35977?ref=ctrl.blog) that expanded its coverage to include common server-side, cache-proxy, and temporary error situations as well. This greatly increased the usefulness of the plugin as it covers more reasons that can make pages become unavailable. The experiment’s original name lost its meaning in the process, however.

The Test Pilot experiment is still being evaluated in Firefox, but a new version of the plugin (actually runs practically the exact same WebExtension code as the Firefox experiment) was renamed *Wayback Machine* and released as an extension for Google Chrome five months later. The plugin is only offered through Test Pilot for Firefox, and isn’t available as a stand-alone extension for Firefox through the Add-ons Catalog.

The Chrome extension get 22 % of the total number of users who use the Firefox extension after 5,5 months in just one month without any marketing push from the browser vendor. If Mozilla decides to bake Wayback Machine lookups into Firefox, then we might see a lot more interest in the feature from Firefox users and privacy researchers.

**Update** (2020-07-01): The Wayback Machine extension is no longer available in the Google Chrome Store. There are other extensions available with similar functionality.

You can get the Wayback Machine extension in the ~~Google Chrome Store~~ or from the [Firefox Add-Ons Directory](https://addons.mozilla.org/en-US/firefox/addon/wayback-machine%5Fnew/?ref=ctrl.blog).

Using the plugin has some implications for your browsing privacy. The address of any broken page, as identified by its HTTP status code, will be sent to the Internet Archive so that they may determine whether they’ve an archived copy of the page available or not. The Internet Archive have a long-winded and [archaic privacy policy](https://archive.org/about/terms.php "Privacy Policy for the Internet Archive") not updated since 2001 that covers access to their collections. The plugin uses HTTPS to communicate with the archive and all archived pages are retrieved over HTTPS.

#### Sources

- [Wayback Machine Chrome extension now available](https://blog.archive.org/2017/01/13/wayback-machine-chrome-extension-now-available/?ref=ctrl.blog), 2017-01-13, Mark Graham, Internet Archive Blog
- [No More 404s! Resurrect dead webpages with our new Firefox add-on](https://blog.archive.org/2016/08/09/no-more-404s-resurrect-dead-web-pages-with-our-new-firefox-add-on/?ref=ctrl.blog), 2016-08-09, Mark Graham, Internet Archive Blog
- [Test Pilot: Wayback Machine](https://web.archive.org/web/20170216234849/https://wiki.mozilla.org/Test%5FPilot/Wayback%5FMachine), MozillaWiki
### Feed your log files to the systemd journal
URL: https://www.ctrl.blog/entry/logfiles-to-systemd-journal/
Last updated: 2026-08-23T22:13:36.000Z
Not everything integrates with the systemd journal. Here is how you can force-feed log files from programs that don’t work with systemd into the journal.

Let’s assume you want to import the `/var/log/awesome.log` written by the `awesomed` example service process to the journal. The `awesomed`, like most services, is managed by the systemd init system and such has a service unit file.

You’ll need to modify the systemd service file by adding a single line. However, you shouldn’t modify the system provided service files as these may be overwritten during system updates. To preserve your changes during updates, make a copy to your local `/etc/` directory. Locate and copy over the service file using the below command, and make sure the target and destination file names are exactly the same.

```shell
cp /usr/lib/systemd/system/awesome.service \
  /etc/systemd/system/awesome.service
```

Then open up the copied file at `/etc/systemd/system/awesome.service` and add the following line under the `[Service]` section:

```ini
ExecStartPost=/bin/sh -c \
  'tail -f -n 15 "/var/log/awesome.log" | \
  systemd-cat -t "awesomed" '
```

Proceed by running the `systemctl daemon-reload` command so the system know to look for the new and modified service file, and finally run `systemctl restart awesome` to update the running service.

You can now use your regular tools for interacting with the journal to read from the log. For example, `journalctl -t "awesomed"` to get the log of the `awesomed` service.

Note that since log forwarding only begins after the main process `ExecStart` has started successfully, you may loose some start-up logging messages. You can increase the number in the `-n` argument to catch more backlog at startup, but this may lead to message duplication. It might seem tempting to change the log forwarder pipe to use `ExecStartPre` instead, but that would block `ExecStart` from ever executing.

You can manipulate the `ExecStartPre` pipe in many ways. Some immediately useful ways include filtering the output between `tail` and `systemd-cat` through `grep`, or assigning a different log message priority using the `-p` argument on `systemd-cat`.

As a closing note, I’d like to remind you that may be it isn’t the best idea in the world to feed messages from extremely chatty programs into the systemd journal. Then again, it isn’t a bright idea to begin with to store super-chatty logs in files the first place.

#### Sources

- systemd-cat man page
- systemd.service man page
- [Creating and modifying systemd unit files](https://web.archive.org/web/20171028233648/https://access.redhat.com/documentation/en-us/red%5Fhat%5Fenterprise%5Flinux/7/html/system%5Fadministrators%5Fguide/sect-managing%5Fservices%5Fwith%5Fsystemd-unit%5Ffiles), Red Hat Enterprise Linux 7: System Administrator’s Guide
### Why I Love Free Software
URL: https://www.ctrl.blog/entry/ilovefs-2017/
Last updated: 2026-08-23T22:11:50.000Z
*Here is my contribution to this year’s annual* [*I Love Free Software-day*](https://fsfe.org/activities/ilovefs/?ref=ctrl.blog) *campaign by Free Software Foundation Europe. It’s also a roundup of much of what I’ve written about Linux and Windows over the last year.*

I’m a Linux desktop user, because Linux doesn’t try to [lock me into their platform and services](https://www.ctrl.blog/entry/edgedeflector-default-browser/) only to [abandon me halfway through the journey](https://www.ctrl.blog/entry/ipod-5gen-iosx/).

Instead of having my access to [remote management features](https://www.ctrl.blog/entry/how-to-rdpwrapper-win10-home/), [convenient encryption features](https://www.ctrl.blog/entry/how-to-file-history-network-storage/), and even [how long I’m allowed to use my own device](https://www.ctrl.blog/entry/windows-active-hours/) be restricted by how much I’ve paid for my operating system edition; I’m free to [choose whichever edition I want](https://www.ctrl.blog/entry/migrated-to-fedora/) based on my needs of the moment.

Rather than being [annoyed](https://www.ctrl.blog/entry/software-update-tyranny/) and [upset](https://www.ctrl.blog/entry/software-updates-suck/) with the heap of garbage that’s Windows Update; I’m fascinated by the [innovations and configurability of my update platform](https://www.ctrl.blog/entry/how-to-fedora-drpm-network-bandwidth/). Instead of being frustrated by the lackluster error messages and logs when Windows Update refuses to install updates; I feel the joy of having my [patch that improves error messages](https://github.com/rpm-software-management/dnf/pull/708?ref=ctrl.blog) approved and included in my operating system.

When core system features breaks, which they [always](https://www.ctrl.blog/entry/how-to-reconnect-file-history-drive/) [seem](https://www.ctrl.blog/entry/windows-network-data-usage-stuck/) to [do](https://www.ctrl.blog/entry/idle-task-scheduler-powershell/), I can better identify and either correct — or work around — the issue more easily when I can study and improve the code.

Sure, I’ve had my share of issues on Linux too. Contrary to popular beliefs, hardware compatibility issues happen on Linux and Windows. Yet, I can always [find](https://www.ctrl.blog/entry/linux-wifi-dpm-latency/) a [solution](https://www.ctrl.blog/entry/replace-broadcom-wifi-with-intel/) on Linux whereas I’m [left wondering](https://www.ctrl.blog/entry/troubleshooting-esata-pmp/) on Windows.

I still can’t sync my contacts and calendar between Windows Mail/Calendar and Contacts with my other devices, but Linux has [no problem syncing](https://www.ctrl.blog/entry/gnome-caldav/) with MacOS, iOS, and Android. Sure, despite the efforts of the GNOME team and even with [patches provided by yours truly](https://www.ctrl.blog/entry/met-norway-api-endpoints/) to keep operations running smoothly, [other people’s servers sometimes stop working](https://www.ctrl.blog/entry/gnome-apps-web-api/). You don’t usually run into issues like that on Windows.

I do appreciate Windows’ friendly gestures and attempts at [embracing Linux](https://www.ctrl.blog/entry/lxss-lxrun/) as a [powertool](https://www.ctrl.blog/entry/rmrf-in-wsl/). Though, I sincerely wish Microsoft will do more work on support for [running my favorite programs](https://www.ctrl.blog/entry/how-to-x-on-wsl/). It’s a great start with lots of potential none the less.

[I’m a Linux desktop user](https://www.ctrl.blog/entry/choose-linux/), and [I show off my love with pride](https://www.ctrl.blog/entry/review-unixstickers/). Although Windows is still a part of my life, I prefer [sticking it in a box](https://www.ctrl.blog/entry/how-to-win10-in-gnome-boxes/) and forgetting all about it.

I use Linux every day, and I love it. #ilovefs

I’d like to say a big great **thank you!** to everyone who contribute and help make Linux the greatest operating system on the planet. A special thank you to everyone — and especially project maintainers — who’ve help review one of the 150+ small patches that I’ve submitted to various projects in the free software world over the last year. I’ve felt welcome and valued just about everywhere. I sincerely appreciate your time commitment and work every day!
### EdgeDeflector enforces your default browser setting in Windows
URL: https://www.ctrl.blog/entry/edgedeflector-default-browser/
Last updated: 2026-08-23T22:05:38.000Z
Microsoft wants its Windows customer base to use its new Microsoft Edge web browser. Users don’t even need to choose it as their default browser. Seemingly normal-looking web links all over Windows 10, the Cortana digital assistant, and Microsoft apps like Mail, News, and Your Phone force-open in Microsoft Edge rather than in your system defined default web browser. Comtraya!

*EdgeDeflector* is a tiny new helper program I developed that says “that isn’t cool!” to Windows. It lets you use your default web browser even when Windows normally force-opens Microsoft Edge instead. The app is tiny and it’s free to install and use.

I don’t hate Microsoft Edge — maybe you do! — but I do believe users who have bothered to configure a different default web browser should be allowed to keep using that default web browser. Edge is a portal for Microsoft to push its own features and services, and to [collect personal data about people’s browsing habits](https://www.ctrl.blog/entry/ie11-flip-out-privacy/). Understandably, Microsoft wants to push their own web browser. But this isn’t the way to do it.

[![Get this app on Windows](https://cdn.synaps.media/control/content/images/2026/08/get-windows-app.svg)](https://github.com/da2x/EdgeDeflector/releases/latest/download/EdgeDeflector%5Finstall.exe?ref=ctrl.blog)[![Get source on GitHub](https://cdn.synaps.media/control/content/images/2026/08/get-github-source.svg)](https://github.com/da2x/EdgeDeflector?ref=ctrl.blog) 

**Update** (2021-11-10): EdgeDeflector does **not work in Windows 11** build 22494 and newer! Microsoft made [changes to Windows to block it](https://www.ctrl.blog/entry/microsoft-edge-protocol-competition/). It still works in older Windows versions.

### How does it work and what does it do?

There’s no complicated logic or magic to how EdgeDeflector works. Cortana and some of the core apps for Windows 10 use a special URI protocol to mask normal URIs and have them open in Microsoft Edge. Instead of the regular `https://example.com/` link, Microsoft apps and services uses its own `microsoft-edge:https://example.com/` link schema.

As no other browser recognize this protocol and the protocol isn’t configured by the default web browser setting, Microsoft Edge is left as the only program that can open the link even when there are other browsers installed on the system.

EdgeDeflector registers itself as a program capable of opening these special `microsoft-edge` URIs. When you click one of these links after installing EdgeDeflector, Windows will ask you how you want to open the link. By choosing EdgeDeflector, EdgeDeflector will rewrite the link to become a regular web link and pass it back to Windows. Windows will then open the link with your default web browser — whether that’s Firefox, Chrome, Vivaldi, something else, or indeed Microsoft Edge.

![Open link with EdgeDeflector](https://cdn.synaps.media/control/content/images/2026/08/twinui-openwith-microsoft-edge-deflector.png) 

How *indeed* do you want to open this web link?

### Standards and URIs

You can’t change the default web browser away from Safari on iOS. To get around this, Google Chrome and pretty much every other web browser started adding their own browser vendor URI prefixes that worked the same way as the `microsoft-edge` URI on Windows 10.

This allowed other app vendors and other apps by the browser vendor to open links in their browser of choice. It’s a neat little work around for something that wouldn’t ever have been an issue if Apple had allowed a greater level of customization on iOS.

The special vendor URIs on iOS and now Windows 10 are all about vendor lock-in. As a user, your choices for what software you want to run are limited by corporate interests that conflict with your ability to choose your preferred web browser. This is unhealthy for the mobile web as a whole, and it’s an unhealthy and undesirable development on desktop operating systems.

I don’t believe the other browser vendors should register and attempt to hijack this vendor specific browser schema by default. Although it’s technically possible, as evidenced by the existence of EdgeDeflector, this would only instigate an undesirable war with Windows where ultimately even more lockdown is the most probable end result.

If you agree with me and want Windows to stop forcing the use of Microsoft Edge and rather have it respect your choice of default browser, please let Microsoft know [in the Windows Feedback Hub](windows-feedback:?CategoryId=5) (requires Windows 10.)

Microsoft Edge has two and a half custom URI protocols in addition to the standard `http` and `https`. These are the mostly undesirable `microsoft-edge` and the as of yet unused `microsoft-edge-holographic`, plus the `read` schema. It’s unclear what `microsoft-edge-holographic` is supposed to do; as of now it creates an infinite loop of opening tabs in Windows preview builds.

The `read` protocol for Edge’s reading view, e.g. <read:/entry/edgedeflector-default-browser>, is more interesting but I’ve already [covered it in a separate article](https://www.ctrl.blog/entry/browser-reading-view-uri/). I believe that the `read` URI is quite a good innovation and would love to see other web browsers implement this URI schema. Firefox, Safari, and Vivaldi all have their own reading views with their own URIs – and they’re all terrible in comparison with Edge’s neat little `read:` links.

### Wait— doesn’t this program of yours already exist?

Only after completing the programming on EdgeDeflector as a weekend project, did I discover that there already was a program that tries to do the exact same trick as EdgeDeflector. (I was using Bing for search that week, go figure.) *SearchWithMyBrowser* seems to be quite popular based on the number of articles written about it.

However, after quickly reading through the code I discovered serious problems such as a **arbitrary code execution vulnerabilities** (e.g. `microsoft-edge:calc.exe` would open the Calculator app rather than a browser) and unwittingly executing invalid commands on the system level for some of the `microsoft-edge` URIs that are found in Windows.

I’d already thought of and addressed these problems to the best of my ability in EdgeDeflector. I’ve contacted the author of SearchWithMyBrowser to let him know about the problems. Another of these programs has received quite a lot of media attention in the tech press in the past, so there should be quite a few vulnerable systems out there. Ouch.

**Update** (2017-02-17): SearchWithMyBrowser has since been updated to version 1.0.0 which patches most attack vectors for the vulnerability mentioned above. This version also introduces usability improvements like a binary distribution package.

Note on responsible disclosure of security vulnerabilities: I’d problems getting in touch with the developer privately, and ended up posting about the vulnerability on the public bug tracker for lack of a private communication channel.

As SearchWithMyBrowser doesn’t have auto-update nor any way to notify users of new versions, the vulnerability will probably remain unpatched for the majority of users for the lifetime of their Windows installation whether an updated version of the software had been made available or not.

#### Sources

- AppxManifest.xml, from Microsoft Edge version 15.15031
- [SearchWithMyBrowser issue #18](https://github.com/sylveon/SearchWithMyBrowser/issues/18?ref=ctrl.blog), 2017-02-13, Daniel Aleksandersen, SearchWithMyBrowser project on GitHub

P.S.: The program is named “EdgeDeflector” and not “Edge Deflector.”
### Reduce the bandwidth requirements for keeping Fedora Linux up to date
URL: https://www.ctrl.blog/entry/how-to-fedora-drpm-network-bandwidth/
Last updated: 2026-08-23T22:10:00.000Z
Keeping your Fedora Linux installation up to date can become a problem if your ISP imposes a strict datacap or if you’re stuck with only an expensive mobile data connection. Here are a few tricks for lowering Fedora Linux’s system update bandwidth requirement.

#### Contents

1. [Uninstall unused programs](#section-fedora-drpm-network-bandwidth-uninstall)
2. [Enable low-savings delta updates](#section-fedora-drpm-network-bandwidth-smalldrpms)
3. [Disable PackageKit](#section-fedora-drpm-network-bandwidth-packagekit)
4. [Throttle download speeds](#section-fedora-drpm-network-bandwidth-throttle)
5. [Multiple computers? Setup a caching proxy!](#section-fedora-drpm-network-bandwidth-cache)
6. [Check for updates less frequently](#section-fedora-drpm-network-bandwidth-checks)

### Uninstall unused programs

This may seem obvious but if you uninstall programs and packages that you’re not using; then they’ll no longer require any network resources to keep up to date.

Unsure where to start? Go through your programs and remove all the ones you’ve never opened or not opened more than once. Do you need three instant messaging programs and four web browsers?

### Enable low-savings delta updates

Fedora Linux introduced delta update packages (“Delta RPMs”) in Fedora Linux 22\. Delta updates only download the bits of a package that has changed from the installed version rather than the full package. This can save significant amounts of bandwidth, depending on what packages you’ve installed.

By default, Fedora Linux will download a delta update package over a full update package when the delta is at least 25 % smaller than the full package. This logic is applied regardless of the actual savings, so it could be 1 KB or 1 GB dependent on the page.

I compared the delta update packages to the full update packages available in Fedora Linux 25’s main update repository on 2017-01-01. 72 % of all delta updates met the 25 % savings requirement. By dropping the minimum saving requirement to 10 %, it takes this number up to 94 % of all updates. You can change the percentage saving required for a delta update to be used by setting the `deltarpm_percentage` option in `/etc/dnf/dnf.conf` to 90 (which changes the requirement from at least 25 % smaller to 10 % smaller).

But are these smaller savings worth anything? At the time I made the repository comparison, the mean savings in the 75–90 % band saved a mean of 607 KB per package with a median of 52 KB. This may not sound like much, but actual savings per package can vary from 0,5 KB to 5 MB based on what packages you’ve installed. If you’re paying by the megabyte, it all adds up! Historical data from Fedora Linux 24 shows delta updates saving as much as 400 MB on a single package!

The drawback with using delta updates are that the system needs to sacrifice extra CPU time to process delta updates compared to full updates. If bandwidth savings is your main concern, then you may want to accept delta updates with smaller savings.

### Disable PackageKit

Fedora Workstation has two update managers: dnf and PackageKit. You [don’t want to use](https://www.ctrl.blog/entry/packagekit-dnf/) the latter. Both maintain separate caches of available updates; so you’re downloading the updating the package repositories twice.

The only option for PackageKit is to uninstall it by running `dnf remove PackageKit`. Disabling the background daemon doesn’t help as other programs will start it on demand. PackageKit doesn’t have any options and just does what it wants to. Uninstalling it will break desktop integrations with programs like GNOME Software, KDE Discover, and [cockpit-packagekit](https://www.ctrl.blog/entry/cockpit-packagekit/). You can also uninstall these program when you remove PackageKit.

### Multiple computers? Setup a caching proxy!

If you’ve got more than one computer running Fedora Linux on your network, then you can cut the bandwidth requirement for keeping both systems up to date in half by configuring a web proxy.

A web proxy will act as an intermediary between your Fedora Linux instances and the public internet. When new packages are downloaded on one machine, they’ll be kept in the local cache on the proxy so that the secondary machine. If the two have the same packages installed and use the same repository mirrors, then your bandwidth usage should be cut in half!

Configuring a web proxy is out of scope for this article. [Squid](http://www.squid-cache.org/?ref=ctrl.blog) is a popular choice on Linux servers. Note however, that any HTTP caching proxy should do the job without any special configuration needed to work on RPM packages.

To use a caching proxy in dnf, set the `proxy` option in `/etc/dnf/dnf.conf` to the URL of your caching proxy.

If you don’t intend to use a proxy server, you can benefit from adding `fastestmirror=True` to the configuration file instead. This option will try to determine which of the available mirrors is the fastest.

### Throttle download speeds

Trying to stream a video while dnf is updating your system? You can configure dnf to throttle its bandwidth usage if you’ve some information about the expected available bandwidth.

To throttle bandwidth used for updates, set the `throttle` option in `/etc/dnf/dnf.conf` to 2M (2 MB/s.) The value is in bytes per second, and you can use the suffixes ‘k’, ‘M’, and ‘G’.

### Check for updates less frequently

One strategy that can reduce update overhead a little is to check for updates less often. By default, repository metadata is considered fresh for two days, yet it will be automatically updated every hour (by the `dnf-makecache.timer` systemd unit.) You can extend this time by increasing the cache expiration time. This isn’t recommended for systems with high security requirements.

To check for updates less often, set the `metadata_expire` and the `metadata_timer_sync` options in `/etc/dnf/dnf.conf` to 172800 (2 days in seconds.)

#### Sources

- [Configuring DNF and DNF Repositories](https://web.archive.org/web/20161231232946/https://docs.fedoraproject.org/en-US/Fedora/25/html/System%5FAdministrators%5FGuide/sec-Configuring%5FDNF%5Fand%5FDNF%5FRepositories.html), 2016, Fedora 25 Documentation
### How to enable, login to, or disable Microsoft SSH Server in Windows 10
URL: https://www.ctrl.blog/entry/how-to-win10-ssh-service/
Last updated: 2026-08-23T22:11:13.000Z
**Update** (2021-07-22): There are now better ways to install and manage the Windows SSH Server. Refer to the [official documentation](https://learn.microsoft.com/en-us/windows-server/administration/openssh/openssh%5Finstall%5Ffirstuse?ref=ctrl.blog) instead. This article is now only interesting for historical reasons.

Windows 10 comes with a built-in secure shell (SSH) server for remote login and command-line access to your files and programs.

A word of caution: To use the *Microsoft SSH Server for Windows*, which is the full formal name of the service, your Windows device must be put in Developer mode. Changing your device’s security level from regular user to developer mode will have implications for how Windows enforces security policies

Be sure to read up on and understand how this change will affect your device before proceeding.

#### Contents

1. [Enabling the SSH Server service](#section-mssshserv-enable)
2. [Logging in to the SSH Server](#section-mssshserv-login)
3. [Protecting the SSH Server](#section-mssshserv-security)
4. [Disabling the SSH Server service](#section-mssshserv-disable)

### Enabling the SSH Server service

1. Open the Windows Settings app and go to Update and Security: For developers.
2. Switch to Developer mode and wait for it to finish downloading any packages.
3. If you’re asked to reboot after the previous step, do so now.
4. Turn on the Device discovery option.
5. Turn off the Device discovery option again, unless you want this feature (which adds mDNS support to Windows and allows for remote debugging.)

This will enable the SSH Server Broker (`SshBroker.dll`) and SSH Server Proxy (`SshProxy.dll`) background services which will handle incoming connections to TCP port 22.

The Windows Firewall on your device is automatically configured to allow the service to **listen for incoming connections from both private and public networks.** Read on to learn how to restrict access from trusted networks and block connections from the public internet.

### Logging in to the SSH Server

You can use any standard SSH client to log in to your device.

You log in using your Windows Account name and either your Microsoft Account password or your local Windows Account password. Please note that your Windows Account name isn’t the same as your Microsoft Account or domain email address.

You can connect to your device’s IPv4 or IPv6 address, or use the device’s given NetBIOS name. You can find your device’s given name as well as your Windows Account name by executing the “whoami” command in PowerShell or Command Prompt. The first part of the command output is your NetBIOS name followed by a forward slash, and then your Windows Account name.

Note that you’re logged in to the Command Prompt by default and not the Bash shell for Windows. You can type in one of bash or powershell after logging to switch to either the Bash shell or PowerShell.

### Protecting the SSH Server

There are currently no brute-force login protection mechanisms built into the SSH Server, and Group Policies for rate-limiting login attempts are bypassed for the SSH Server service. This means a remote attacker can make as many guesses of your login credentials as they can possibly push through the network.

Linux and MacOS utilities for thwarting brute-force login attempts like SSHGuard and Fail2Ban aren’t available on Windows. Although they both run in the Windows Subsystem for Linux, they don’t have access to nor parsers for the Windows Event Log nor backends for the Windows Firewall.

Without any brute-force login ~~mechanism~~ protections, you’re left with depending on a strong account password that you change regularly.

You can limit the risk of a brute force attack by disabling login from remote networks. This will limit the service to only accept logins from what is identified in Windows as a local and private network source.

To disable remote network logins, follow the following instructions:

1. Open the Start menu and search for “allow firewall”. Open Allow an app through the Windows Firewall.
2. Authenticate yourself to modify the firewall rules by clicking the Change settings button.
3. Locate “Ssh Server” in the list and disable the checkbox in the Public column.
4. Click the OK button to apply the changes.

This does depend on having the correct trust levels configured for the networks your computer connects to. Explore the Network section of the Windows Settings app to see the currently configured level of trust in the various networks your device is connected to.

### Disabling the SSH Server service

There’s no on or off switch for the SSH server itself. As you might have guessed from the above section on how to enable the service, it was clearly a bit of an afterthought. To properly disable the service, follow these steps:

1. Open the Windows Settings app and go to Update and Security: For developers.
2. Turn off the Device discovery option if it was previously enabled.
3. Switch to Windows Store apps mode.
4. Switch back to Developer mode, if desired.

Microsoft SSH Server for Windows isn’t the same as Microsoft Win32-OpenSSH for PowerShell! Microsoft’s SSH Server isn’t a full SSH server implementation and is meant to be used for cross-device communication for development purposes.

The Microsoft SSH Server doesn’t support all SSH authentication methods and features like compression and multiplexing. However, it has more than enough features for most light use cases.

Developer mode and the SSH Server is available for all editions of Windows 10 including Home and Professional starting with Windows 10 Anniversary Edition (released in August 2016.)

#### Sources

- [Enable your device for development](https://learn.microsoft.com/en-us/windows/apps/get-started/enable-your-device-for-development?ref=ctrl.blog), 2016-12-14, Windows Dev Central
- [A comment](https://github.com/Microsoft/WSL/issues/777?ref=ctrl.blog#issuecomment-237842110) on BashOnWindows issue #777, 2016-08-15, Rich Turner, GitHub
### Tutorial: Configuring zones bound by source IPs in FirewallD
URL: https://www.ctrl.blog/entry/how-to-firewalld-zone-by-ip/
Last updated: 2026-08-23T22:10:08.000Z
Some network services should only be exposed to other computers on the same trusted network. Here is how you set that up with trusted zones in FirewallD for centOS, Fedora Linux, and RHEL.

You can use the predefined zones, get a complete list of the default zones by running the command `firewall-cmd --list-all-zones`, or create a new zone with the command `firewall-cmd --permanent --new-zone="myownzone"` (avoid special characters and spaces when naming for simplicity.) For this article, I’ll use the predefined zones `home` and `public` to represent a trusted and an untrusted network.

FirewallD uses zones to manage networks. You can bind a zone to a network interface or a set of source IP addresses. You can have multiple active zones, and when no zone is applicable to an incoming connection, the default zone (`public`) is used. Having too many active zones can impact network performance, but for many cases you’ll only need one trusted an untrusted network.

I’ll now go through how to configure a trusted and untrusted zone step-by-step, and then demonstrate how you can add services to the two zones.

First off, add your IPv4 and IPv6 subnet(s) to your trusted zone (`home`.) Rules in the `home` zone will be applied to any source IPs from these subnets.

```shell
firewall-cmd --permanent --zone="home" --add-source="198.51.100.0/24"
firewall-cmd --permanent --zone="home" --add-source="2001:0DB8::/32"
firewall-cmd --reload
```

You can then verify that the zones are correctly associated with the source IP/subnets you specified by querying for information about the currently active zones:

```shell
firewall-cmd --get-active-zones
```

You should see your source IPs listed under the desired zones.

If you try to assign the same source IPs to different zones, you’ll run into a Error: ZONE\_CONFLICT error. It’s undesirable to assign the same source IPs to different zones: a network can’t be both trusted and untrusted at the same time. Instead, you’ll want to configure more granular zones with varying levels of trust for each IP address range.

Now that you’ve configured your trusted zones and bound them to your IP subnets, you’ll want to configure different service availability for your different network zones. Start by listing the services that are already associated with your zones:

```shell
firewall-cmd --permanent --zone="home" --list-services
firewall-cmd --permanent --zone="public" --list-services
```

To manage services, all you’ve to do is to specify which zone they belong to. For example, assuming that the SSH service is available on the `public` untrusted zone, and you want to make it accessible only to hosts coming from the `home` trusted zone:

```shell
firewall-cmd --permanent --zone="home" --add-service="ssh"
firewall-cmd --permanent --zone="public" --remove-service="ssh"
firewall-cmd --reload
```

That’s all there’s too it. Configuring zones in the `firewall-config` GUI program can be a bit fiddly so I recommend sticking with one of the command-line tools.

#### Sources

- [Using Firewalls](https://access.redhat.com/documentation/en-us/red%5Fhat%5Fenterprise%5Flinux/7/html/security%5Fguide/sec-using%5Ffirewalls?ref=ctrl.blog), Red Hat Enterprise Linux 7: Security Guide
- [firewall-cmd man page](https://firewalld.org/documentation/man-pages/firewall-cmd.html?ref=ctrl.blog)
### Blog gets a new name: Ctrl blog
URL: https://www.ctrl.blog/entry/rebrand-ctrlblog/
Last updated: 2026-08-23T22:16:44.000Z
You may have noticed that you’re reading this under a new (domain) name. The old name “Slight Future” lasted some 14 months and has now been fully replaced by “Ctrl blog” (“Control blogl.”)

“Ctrl” is a bit of a mangled letter soup, but most PC users should be familiar with it and will have a visual reminder of the spelling on their keyboards. The mobile web may be growing, but at least for this blog: most visitors use desktop screen-sized devices.

I feel the new name covers the topics I usually discuss quite nicely, as most of my writing whether it be tutorials or opinions are about controlling technology in one way or the other.

I wasn’t ever super-stoked about the name Slight Future, which was somewhat quickly chosen to [resolve ambiguity with the previous name](https://www.ctrl.blog/entry/aeyoun-becomes-slight-future/) and South Korean pop-singers who’d suddenly begun dominating the search result pages. I wasn’t happy about the previous name before that either, so having a name which I like is a nice change.

A short domain name definitely performs better on search result pages and many other situations where the address is \[partially\] displayed. A shorter address allows for more of the URL to be seen by people before it gets clipped. For the same reason I’ve dropped the “www.” prefix, even though I consider it an accessibility aid as everyone will immediately recognize it as a web address.

Lately, the same thing that happened with the old *Aeyoun* name also started happening with the *Slight Future* name. If you searched for “slight future”, you’d often see results for “light future” instead. I believe that the new name should be better protected against this type of effect as its pretty far from any other English words at least in terms of [Levenshtein distance](https://en.wikipedia.org/wiki/Levenshtein%5Fdistance?ref=ctrl.blog).

I did get to register [daniel.blog](https://daniel.blog/?ref=ctrl.blog) during the landrush period for the new .blog top level domain. However, Daniel Rey López got the domain as an employee perk. I could have paid 200 EUR extra during the sunrise period to secure the domain, but I believe I’m happier with ctrl.blog than sticking my own name on the blog.

I’ll share [some notes about redirecting traffic](https://www.ctrl.blog/entry/rewriting-urls-reorganizing/) from the old domain and the complete reorganization of most URLs on this blog in a few days time.
### How to remove the Adobe Acrobat Update service
URL: https://www.ctrl.blog/entry/how-to-delete-adobearmservice/
Last updated: 2026-08-23T22:09:31.000Z
For reasons unknown, Adobe leaves its *Acrobat Update service* running even after you’ve uninstalled Adobe Acrobat Reader. The updater service seems to become a bit confused when the program it’s supposed to update has been uninstalled. It can even slow down your computer’s start-up time.

Here is how you finish the job and get rid of the Acrobat Update service.

The Adobe Acrobat Update service has a practically immeasurable impact on system performance when it’s working as it should. However, if you uninstall Adobe Acrobat Reader, the service will report high storage I/O activity when you login to Windows.

You’ve probably uninstalled Acrobat Reader DC to get rid of it. You don’t need its updater service anymore and want to can remove it from your system as well.

You can follow the below instructions to remove the service, assuming you’ve already uninstalled Adobe Acrobat Reader DC either from Windows Settings: System: Apps and programs, or Control Panel: Programs: Uninstall a program. Please do this before continuing!

1. Open up an administrative PowerShell by searching for “PowerShell” in the Start menu, right-clicking on the program, and choosing “Run as administrator”. You can also use an administrative Command Prompt.
2. Disable and delete the service by typing in these two commands. Press Enter after each command:  
```shell  
sc.exe stop AdobeARMservice  
sc.exe delete AdobeARMservice  
```
3. Delete the left-over files from your disk to get rid of it completely. Press Enter after carefully typing in the command:  
```shell  
del "%PROGRAMFILES(X86)%\Common Files\Adobe\ARM\"  
```
4. Close the PowerShell window.

All you’ve to do if you want to restore the service is to reinstall Acrobat Reader from Adobe’s website.

I don’t know why the service is left on the system after Acrobat Reader is uninstalled. It’s possible that Adobe decided to leave it in case you changed your mind and reinstalled it later.

However, this doesn’t make much sense as the service would be replaced and updated if you reinstalled Acrobat Reader. Other Adobe software all use their own updater services, so leaving this service behind on the system just looks like a bug in the uninstall program.

I’ve reported this problem to Adobe twice already, but have yet to hear back from them. Come to think of it, I think I’m still waiting on to hear back from Adobe on bugs I submitted to them back in 2008! Until they sort out the issue with their uninstaller, this tutorial should help people get rid of the software.

This tutorial was last updated for Adobe Acrobat Reader DC version 2015.020.20039.
### Best practices for syndication feed caching
URL: https://www.ctrl.blog/entry/feed-caching/
Last updated: 2026-08-23T22:06:25.000Z
Feed readers can be quite wasteful when it comes to bandwidth. A good implementation of HTTP caching, compression, and feed deltas can save both power and bandwidth for users and servers alike. Here is my detailed list of best practices for Atom/RSS feed publishers and feed readers.

#### Contents

1. [Compressed responses](#feed-caching-section-compression)
2. [Cache revalidation](#feed-caching-section-revalidation)
3. [Feed delta updates](#feed-caching-section-deltas)
4. [Server-hinted next-pull interval](#feed-caching-section-nextpull)
5. [Permanent updates to subscription endpoints](#feed-caching-section-301)
6. [Support WebSub](#feed-caching-section-websub)

These best practices are aimed at feed readers that store feed entries in a database and is only interested in new or changed feed entries. This is a guide to advanced caching techniques put in context, and only a few are specific to syndication feeds. Some familiarity with HTTP headers is assumed.

I’ll now go through each of the bandwidth-saving techniques listed above in order.

### Compressed responses

Let us start out big by making everything smaller. Compression is a method where the server and feed reader agrees on a common format for exchanging data in a minimized format. This significantly reduces the bandwidth needed on both ends to update feeds.

A feed reader should include the Accept-Encoding: gzip, deflate request header to announce support for gzip and deflate compression methods. (Bonus points for reading up on and implementing support for newer and more efficient compression methods too!) Likewise, a server announces support by sending the Vary: Accept-Encoding response header with every response.

When a server sees a response with an encoding it supports (like gzip), it should apply that compression format to the response body (not the headers), set the Content-Encoding: gzip header, and process the request as normal. Most modern web servers will perform this automatically by default (or with a little configuration). There’s likely very little need to change anything in an application.

### Cache revalidation

When pulling a feed for updates, there will quite often not be any new entries available. Rather than transferring the full contents of the feed again, the feed reader and server can agree that the version of the feed that the feed reader have already got stored is still good enough and abort the transfer. This is achieved using a method called cache revalidation.

When a server wants to indicate that it supports cache revalidation, it will set either or both of the Last-Modified and ETag response headers. A feed reader should store these headers’ values and return them in subsequent requests to the same server as the values of the If-Modified-Since and If-None-Match request headers.

Servers shouldn’t bother with sending an ETag response header. They’re inelegant, cumbersome, and more feed readers support Last-Modified than ETags, so I’ll focus on the more common for reasons that will become apparent in the next section. The Last-Modified header is quite intuitive, and represents the datetime that any of the entries in the feed was last published or modified.

A feed reader should calculate the datetime to set in the If-Modified-Since request header in one of three ways: Either by storing the Last-Modified value from the last successful request. HTTP status codes 200–299 plus 304 indicate successful requests. Don’t just check for 200 OK! Or by storing the time that it last successfully pulled the feed. Or by sorting all the datetimes included in the feed itself, and returning the newest datetime. Which of these methods are used is up to the implementer, but the first is preferred and the two others are good options when the first method can’t be implemented for whatever reason.

When a server sees a request with the If-Modified-Since request header set, it should evaluate whether the feed has indeed been modified since the datetime sent by the feed reader. If the feed haven’t been altered, the server should respond with a 304 Not Modified response status, and abort the request without sending the feed’s contents. This can save a significant amount of bandwidth, especially with feed readers set to pull feeds often. Of the feed have been modified, the full feed is returned as it would be with a normal request. In both scenarios, updated Last-Modified and Cache-Control response headers (covered later) should be returned with the response so that the feed reader will know what to do next.

### Feed delta updates

Expanding even further on cache revalidation, a server can use the datetime in the If-Modified-Since request header combined with the A-IM: feed header to filter out undeeded entries from a feed: just needing to transfer the changes since the feed was last modified. This method is called [feed delta updates](https://www.ctrl.blog/entry/feed-delta-updates/).

A feed reader should announce support for delta feeds by including the A-IM: feed request header when at least one of If-Modified-Since or If-None-Match are also set. If the server supports delta feeds, just the modified entries and the newly published entries will be returned. Feed readers should treat a 226 IM Used response status as it was a regular 200 OK response status.

A server should announce support for feed deltas by including the Vary: A-IM, If-Modified-Since and Cache-Control: im response headers. Usually, you wouldn’t include If-Modified-Since in the Vary header, but when working with delta update; we need to preserve the exact value of this request header as a variant qualifier to ensure everyone will get the correct variant from any intermediary proxies or web caches.

When a server receives a request with both the A-IM: feed and the If-Modified-Since header set, it can use what is known as instance manipulation to modify the contents of the feed itself. The datetime from the If-Modified-Since should be used to determine if any entries have been modified or published since said datetime. If no entries are found, the server should respond with a 304 Not Modified response status and abort without sending back the feed contents.

However, if the sever does have new or modified entries things start to get interesting. Older/stale entries from before the client provided datetime should be filtered out so that only the new and modified entries will be included. This list of only new and modified entries makes up a delta update to the feed. A delta feed should return the IM: feed response header along with either the 226 IM Used or regular 200 OK response status. This reduces the size of the transfer by not retransferring entries that the feed reader have already cached. This can be a significant bandwidth reduction for feeds that publish “full content” or include a lot of embedded media assets.

A server should take care not to resurface too outdated entries when considering which modified entries to include. Consider excluding entries that were published more than a month ago (or maybe ten days) from reappearing in the feed even when it has been modified: it probably isn’t newsworthy anymore, right?

If you’re publishing with WordPress, check out my [Feed Delta Updates plugin for WordPress](https://www.ctrl.blog/entry/wordpress-feed-delta-updates/).

### Server-hinted next-pull interval

Feed readers traditionally update every feed about at the same time on a fixed schedule. This is a great fallback strategy, but many feeds tell the feed reader when they should next pull for updates. This is communicated through the Cache-Control: max-age=seconds response header, or optionally through Expires: datetime.

A server should send either or both the Cache-Control or the Expires response headers (the “freshness interval headers”). The value of Cache-Control should be set to max-age=seconds, e.g. max-age=14400 for four hours in seconds. This communicates to the feed reader that it doesn’t need to schedule another pull of the same feed until after either now + max-age or the expiration datetime.

Feed readers should apply their default freshness policies (“update every nth hour”) for all feeds, but adjust it on a per-feed basis to accommodate the freshness interval headers that was last returned by the server. Be aware that these change, and that they should be updated for responses that either return a valid feed with status codes in the 2xx range or 304 Not Modified response status.

The freshness interval headers are merely suggestions for when the feed should be pulled next, so feed readers are free to concatenate multiple expired feeds and pull them all in batches. This reduces the feed readers network chattiness, allows wireless communication antennas to enter sleep mode, and saves on battery by limiting CPU and network activities to batches rather than an inefficient low background tricky.

When a server has new entries scheduled to be published in the future, it can lower its max-age responses beforehand the publication time to make sure feed readers will get the scheduled entry sooner. However, be sure to introduce an element of random time drift to avoid having every feed reader pull the feed at the exact same second! This is know as the “thundering horde”. If you’re publishing with WordPress (or want to see a reference implementation), check out my [Cache-Control plugin for WordPress](https://www.ctrl.blog/entry/wordpress-cache-control-plugin/) that implements the described behavior.

See [RFC 7234§4.2](https://www.rfc-editor.org/rfc/rfc7234.html?ref=ctrl.blog#section-4.2) for more details about freshness and caching.

### Permanent updates to subscription endpoint

Feed readers fetch the address their told to, and that’s usually what users want them to be doing. However, sometimes websites move domains, change protocol, or settle in to a new publishing system. Most of the time, this also involves permanently redirecting the feed address to a new location.

**Update** (2018-01-22): Read the followup article [Permanent redirects are supposed to be permanent](https://www.ctrl.blog/entry/permanent-redirects/) for more details.

The server will signal that the feed reader should update the subscription endpoint with either a 301 Moved Permanently or a 308 Permanent Redirect response status. The same response will include the new address in the Location: URI response header.

Feed readers should follow the redirected location and verify that the new URI endpoint is a working and valid feed. After confirming the new destination is a working feed, the existing subscription endpoint should be update with the new address. This improves pull performance and increases the robustness of the subscription by eliminating the need for repeating meaningless redirects. A feed reader should perform this maintenance task on its own without involving the user. However, if the origin (protocol+domain) changes, the user should be prompted. For example, a dialog saying “A feed subscription from ‘old-domain.com’ has requested to be changed to ‘new-domain.blog’. \[Confirm\] \[Unsubscribe\]”.

A feed reader might want to keep track of a redirect, and only update the subscription endpoint after the redirect has been in place for a week or two of days. This is to mitigate the risks of any configuration mistakes or potential “subscription-hijacking” scenarios on the server.

Many feed readers will follow the same redirect on every update several times per day for years on end, even when the server has provided a newer endpoint. This is incredibly pointless as well as a violation of the HTTP specification. Chances are you’ve never heard of permanent redirects being used like this. That is a clear indication that you’ve been exposed to nothing but poor HTTP implementations in the past. To put your mind at ease, here’s the relevant section from RFC 7538 (also applicable to 301 statuses!):

> “The 308 (Permanent Redirect) status code indicates that the target resource has been assigned a new permanent URI and any future references to this resource ought to use one of the enclosed URIs.”  
>  
> “Clients with link editing capabilities ought to automatically re-link references to the effective request URI to one or more of the new references sent by the server, where possible.”

### Support WebSub

Feed readers and publishers should support [WebSub](https://www.w3.org/TR/websub/?ref=ctrl.blog). WebSub turns feed distribution on its head; making it a push instead of pull media. Feed readers can register their subscriptions with a WebSub hub, and the hub will be responsible for pushing updates to the reader.

Feed publishers either need to maintain a hub server or use one of the many freely available hub services. There are many free and open-source hub implementations available. The publisher also needs to notify the hub about udates to their feeds. The update pings can be automated by the publisher.

A WebSub subscription is more efficient for every party, but requires that the feed reader can maintain a public web server. This makes it ideal for web clients, but client apps may have trouble receiving WebSub.

---

As a closing note, I’d like to point out that there are more headers sent by the server than are being picked up and used on the client side by feed readers. These extra headers, like Vary, are there to support “web accelerators”, reverse-proxies, corporate/network web proxies, and other middleware that needs to be aware of and accommodate for caching.

Please note that every header mentioned in this article that’s being set multiple times (like Vary, Cache-Control, A-IM, and Accept-Encoding) can either be sent individually as duplicates or be combined in to a comma-separated list in a single header. The latter is the **strongly preferred** for compatibility.

#### Sources

- [WebSub specification](https://www.w3.org/TR/2018/REC-websub-20180123/?ref=ctrl.blog)
- [RSS 2.0 Specification](https://cyber.harvard.edu/rss/rss.html?ref=ctrl.blog)
- [RFC 4287](https://www.rfc-editor.org/rfc/rfc4287.html?ref=ctrl.blog) The Atom Syndication Format
- [RFC 5005](https://www.rfc-editor.org/rfc/rfc5005.html?ref=ctrl.blog) Feed Paging and Archiving
- [RFC 3229](https://www.rfc-editor.org/rfc/rfc3229.html?ref=ctrl.blog) HTTP: Delta encoding in HTTP
- [Using RFC 3229 with Feeds](https://web.archive.org/web/20080212002248/http://bob.wyman.us/main/2004/09/using%5Frfc3229%5Fw.html), Bob Wyman, 2004-09-22
- [RFC 7232](https://www.rfc-editor.org/rfc/rfc7232.html?ref=ctrl.blog) HTTP: Conditional Requests
- [RFC 7234](https://www.rfc-editor.org/rfc/rfc7234.html?ref=ctrl.blog) HTTP: Caching
- [RFC 7538](https://www.rfc-editor.org/rfc/rfc7538.html?ref=ctrl.blog) HTTP: Status Code 308 (Permanent Redirect)
### Linode DNS Manager pitfall: No TXT record normalization
URL: https://www.ctrl.blog/entry/linode-dns-manager-txtquotes/
Last updated: 2026-08-23T22:13:24.000Z
[Linode](https://www.linode.com/?r=bded785ca36b951af61a1af005c7d4a947298f76&ref=ctrl.blog) includes DNS hosting services to customers at all price tiers. This lets you manage the domains for your VPS’ in the Linode Manager on the web and app. Linode’s distributed DNS services have great performance and a good track record when it comes to uptime and availability. The Linode DNS Manager, however, leaves some things to be desired. Input validation and normalization is one of those things.

Say you want to add a `TXT` record to your DNS zone to contain SPF, DKIM, or any one of the many other types of data records that are kept in such DNS records. If you’ve ever done any work on DNS, you know that values in `TXT` records must be surrounded by quotes. All of the web based management tools I’ve used for DNS have refused to save records that don’t have the `"` character as the first and last character in `TXT` records.

Let’s say I create two new records in the Linode DNS Manager. I enter the exact input values `"test"` and `"test" `(the last one with a trailing space character.)

Other than the fact that it looks like you’ve an exact duplicate `TXT` record – which isn’t allowed; the two records looks correct in the Linode DNS Manager:

![TXT records in the Linode DNS Manager](https://cdn.synaps.media/control/content/images/2026/08/linode-dns-manager-txt-record-test.jpeg)

The above representation, quotes and all, is how `TXT` records are displayed in the DNS managers of other service providers including GoDaddy, Hurricane Electric, Uniregistry, Amazon AWS Route 53, cPanel, and Dyn. It’s also an accurate representation of the entry in the DNS zone file.

The generated DNS zone file for these two entries will reveal that things aren’t quite as dandy as they appear:

```
ctrl.blog.  604800  IN  TXT  "\34test\34"
ctrl.blog.  604800  IN  TXT  "\34test\34 "
```

I’ve never managed to create anything like the above mess in my two decades of maintaining websites and DNS. There are two obvious issues:

1. Anyone who know their ASCII tables will immediately recognize `\34` as a decimal representation of `"`. In other words, the dumb quotation mark I entered earlier is being escaped and included as part of the `TXT` record’s value.
2. You can also see that the second entry isn’t an exact match as leading and trailing whitespace isn’t stripped from user input.

If I’d used a DNS manager from a *\*cough\** competent DNS provider, I wouldn’t have been able to create these entries without escaping the quotes myself to willingly create a strange `TXT` record.

I won’t claim this would never have been an issue with other DNS service providers I’ve used have all had their own unique quirks. None of the alternatives I’ve used would have let me create this particular mess, however. I did some quick tests in the web interfaces of some other DNS providers, and they all strip away whitespace — as people copy-paste examples — and either require me to remove or insert quotes, or handles both variants without raising any warnings.

I’ll count this one up as a strike against using DNS services from DNS providers who aren’t strictly in the DNS business. Specialized services and tools can indeed do a better job than a free service that’s bundled in with another service as a convenience.

#### Testing `TXT` records

You can quickly verify that your `TXT` records look like they should using the following command on FreeBSD, Linux, and MacOS:

```shell
dig example.com TXT
```

…or in Windows PowerShell:

```powershell
Resolve-DnsName -name example.com -type TXT
```

The `dig` program prints the DNS records verbatim, but the `Resolve-DnsName` commandlet will substitute the wrapping `"…"` characters with `{…}`.

### Closing thoughts on Linode DNS

As you can tell from [my review of Linode VPS](https://www.ctrl.blog/entry/review-linode-2gb/), I mostly like the Linode Manager. I’ve now had more time to explore the Linode Manager, and my initial impressions still stand with some reservation. I still find that the service and return on investment is better at [Linode](https://www.linode.com/?r=bded785ca36b951af61a1af005c7d4a947298f76&ref=ctrl.blog) than comparable alternatives such as DigitalOcean.

I wish Linode DNS would support geographical/latency based DNS responses (“Geo DNS.”) Such a service addition would allow customers to more easily direct traffic to the nearest Linode data center without relying on a third-party DNS service provider like Amazon AWS Route 53\. To me, this sounds like an obvious feature as Linode customers would be [incentivized to buy more VPS instances in different data centers](https://www.ctrl.blog/entry/managed-anycast-vps/) if they could more easily deploy Geo DNS.

Based on the sub-optimal DNS Manager and the [problems I’d figuring out how to restore from a backup](https://www.ctrl.blog/entry/how-to-restoring-linode-backup/), I now have some more reservations about recommending Linode. Entry level customers may want to [choose DigitalOcean](https://www.ctrl.blog/entry/server-move-digitalocean/) instead of Linode.

#### Sources

- RFC 1035 Domain Names, section 3.3.14\. TXT RDATA format
### Review: Neato D3 Connected robot vacuum
URL: https://www.ctrl.blog/entry/review-neato-botvac-d3-connected/
Last updated: 2026-08-23T22:19:39.000Z
Neato’s new BotVac D3 Connected app-controlled robot vacuum’s “laser guided room mapping and navigation” doesn’t help much when the robot sees furniture that isn’t there and spends up to a minute correcting loops and navigational mistakes.

I had a trusted Samsung NaviBot that kept my floors dust-free for five years before its sensors stopped working, and I sent it away to live on a robot farm. Bought in 2010, the NaviBot used cameras and sensors pointed at the ceiling to map out rooms and navigate around my apartment. It worked great!

My NaviBot and I’d a gentleman’s agreement where I’d keep the floor free of cables and obstacles, and it would keep it free of dust. In any case, my NaviBot was well overdue for replacement and I’d not come to miss manual vacuuming over the last five years.

My first choice for a replacement fell on the Neato BotVac D3 Connected. It’s the budget variant in the Neato Connected series of robot vacuum. The BotVac series is controlled by the Neato app for Android and iOS, uses the same laser-guided navigation system, had received great reviews, and accessories and filters were cheaper compared to the competition.

The main differences between the robots in the BotVac Connected range are the motor and battery power. The more expensive BotVac D5 Connected model also has a rotating brush on the right side that can help when cleaning furniture legs and along walls. My place isn’t huge and I don’t have any pets, so I thought the cheaper D3 would be sufficient.

### Laser guided mapping and navigation

My 50 ㎡ apartment proved to be quite the challenge for Neato’s LaserSmart room mapping and navigation system. Neato Robotic’s line of robot vacuums all have a rotating sensor housed in the top-mounted turret. This turret continuously scans the room to make it aware of its location and immediate surroundings.

![Neato’s LaserSmart mapping and navigation versus traditional random cleaning pattern](https://cdn.synaps.media/control/content/images/2026/08/neato-lasersmart-mapping-navigation-versus-random.jpeg)

Random pattern versus smart navigation pattern.

In theory, this should be more effective than the go-in-a-random-direction-and-change-direction-randomly-on-collisions navigation approach used by most robotic vacuums in the market. Smarter navigation should also allow Neato robots to clean multiple rooms without getting lost in hallways.

The smarter navigation system was one of my primary reason for choosing the Neato D3 Connected over a Roomba or some of the other cheaper alternatives.

### “I’m stuck!”

Unfortunately, the Neato LaserSmart navigation system couldn’t cope with my apartment. The D3 would drive in a straight line, come to a sudden stop, and send a push notification saying “I’m stuck! Please clear my path.” There would be no objects in its path, it had plenty of room around it, and it seemingly had done no attempt at freeing itself. It was like it just suddenly panicked and needed rescuing.

I only needed to press the Start button to get it going again. As this kept happening every few minutes it took away from the promise of the all autonomous cleaning robot. Playing hide-and-seek with a robot vacuum isn’t as fun as it might sound. Retrieving it from the farthest corner underneath the bed definitely isn’t my idea of fun.

![Scratched turret top surface on Neato D3 model](https://cdn.synaps.media/control/content/images/2026/08/neato-laser-turret-self-inflicted-damage.jpeg)

I found it quite interesting that it would give up without trying to free itself when this happened. I talked with Neato’s support staff who suggested that it might have registered a drop from the drop sensor.

However, this doesn’t make much sense as the robot’s response to detecting a drop in front of it’s to stop and back away from the edge it discovered. I don’t have any complicating factors like rugs nor have I covered my walls with mirrors or reflective surfaces that might have confused the D3’s sensors.

On the other hand, I once discovered that it had managed to get itself stuck somewhere in the bedroom, scratched up the top of the turret quite badly, and managed to free itself and came back out of the bedroom without complaining about being stuck!

This didn’t damage the turret, but it left unattractive scratches on top of the turret. The turret is quite a bit taller than the rest of the robot, but it looks like the sensors weren’t configured to detect and avoid tight squeezes.

I recorded a video (below) of the Neato D3 repeatedly banging against the leg of a table. In the video, you can see that the D3 doesn’t try to change its approach but just keeps on banging into the table again and again. During this minute, it didn’t stop and notify me it was stuck; which makes the behavior where it would stop without making any effort to free itself even weirder.

Neato robot repeatedly bumping against a table leg

### Ghost furniture legs

The Neato D3 has a sensor on its right side that’s used to follow along walls. The same sensor is used to lock on to furniture legs so that the vacuum can drive around the leg of your furniture to give it a more through cleaning. This is also where the side-brush of the BotVac D5 would have proven useful as the brush could help sweep loose dust that gathers underneath furniture legs.

This system is great in principle, and sets the Neato BotVac Connected series apart from competing products like the iRobot Roomba or Samsung PowerBots.

The only trouble being that the D3 kept thinking it had detected furniture legs that weren’t there. In the below video you can clearly see it lock on to several furniture legs that clearly aren’t there. I talked to Neato support staff about this problem, and they kept suggesting I move the charging station and reset the robot.

Neato side-sensor locking on to non-existing furniture legs

The little “quacking” you hear at the end of the video is a push notification coming in to my phone/recording device about the BotVac being stuck again.

In summary, the Neato D3 can’t see furniture legs that it repeatedly bumps into for a full minute – yet it does see furniture legs that humans can’t see. I tried cleaning the side-sensor, but that had no effect on the behavior.

### Charging station

The BotVac Connected series can find their way back to their charging station when they’re done cleaning. Besides emptying its dust bin and cleaning its filters; it’s supposed to be entirely autonomous.

The charging station have to be placed against a wall and have 90 cm of clearance to the left, right, and in front of it. This 3,2 ㎡ requirement can be hard to accommodate in a small apartment. Especially since the area has to be completely empty. You can’t hide it under a side table or sofa as the legs would be in that 3,2 ㎡ zone.

Placing the charging station is also made more difficult by the ridiculously short 45 cm power cable that’s included in the box. I suspect the short power cable is meant to prevent you from leaving any loose cables on the floor — which is the Kryptonite of any robot vacuum — but it just comes off as an unnecessarily annoying way for Neato to save money on the unit. I’ve measured every appliance in my apartment, and none of them came with a power cable shorter than 1,2 m.

The placing of the charging station is apparently very important. When I talked to Neato support staff about the navigational issues, they kept telling me to move the charging station and reset the D3 unit. The problems remained even after trying out two–three different locations in all three rooms of my apartment. Support’s solution was still to reset the BotVac and move its charging station.

As for returning to its charging station, this feature wasn’t fully baked at the time I wrote this review. The “Dock” button in the app was disabled “pending a future firmware update.” When the robot vacuum started cleaning from its charging station, it was still supposed to work, however.

At the end of a cleaning session (or whenever it got bored), the D3 would send me push notifications to my phone saying “Finished! I’m returning to base for charging.” It then drove up to the charging station, turned its back to it and the one of two things would happen: 1) it reversed and wiggled until it hit the charger successfully, or 2) it would send another notification saying “Please return me to my base.” With 10 % battery left and sitting right in front of the charging station, I would have to walk over and manually push it backwards and on to the charger.

### Creating boundaries

With any robotic vacuum, there will be areas you don’t want it to go into like wet rooms or a balcony. Most other brands of robot vacuums use small battery powered infrared (IR) or radio frequency (RF) towers to project “virtual walls” to zone off rooms and areas as off-limits.

Neato’s BotVac products all use the Neato boundary marker system: a simple magnetic strip similar to a regular insulation strip. No boundary marker strip is included with the Neato D3, but is sold separately.

Despite being quite expensive for what it’s (a strip of plastic and magnets), Neato choose to cut costs again by not including a layer of mounting tape with the strip. You’ll have to buy mounting tape extra if you want to line a door or the fence off the cable nest behind your media setup or computer.

I think the boundary marker is a great idea, and found it to be much more discreet than the traditional RF towers. The product demo videos for the boundary marker demonstrates that the marker can just be put down on the floor in front of a water bowl for your pet. However, in practice the D3 pushed the marker around little by little as it encountered it. I found that it worked quite well once it was fixed in place with tape.

### Cloud connected

The BotVac D3 is an “internet of things” device. Meaning it requires a constant connection to the internet to function. I’m generally no fan of this dependency on someone else’s computers, as it means Neato could shut down the supporting service whenever they want — leaving me with a non-functional vacuum. I don’t know about you, but I don’t feel like my vacuum needs to be exposed to the internet all the time.

I did a little bit of investigating, and found that the BotVac unit sends and receives 60 bytes of data per second throughout the day, even when it’s idling on its charger or just sitting out on the floor. This constant data connectivity means that the BotVac discharges ≈60 % in just 8 hours when the robot is just sitting out on the floor away from its charger.

I didn’t see any evidence that it would try to reduce its connectivity or otherwise go into a power saving mode when it was stopped and sitting away from its charger. During cleaning, the traffic goes up to ≈9 KB per second.

For the curious, this data traffic works out to about 5,2 megabytes per day or 156 MB per month. All data is encrypted and end up on Amazon AWS.

### Conclusion

I’ve no complaints about the robot’s behavior or how well it cleaned *when it worked*. I didn’t go into any details about its cleaning abilities in this review. It filled the dust bin every time I put it on, so it most certainly got that part right! Like any robotic vacuum, I expected it to miss some spots occasionally and then revisit them on its next run. However, I was much more concerned about its ability to get around after watching the D3 spend 20 minutes skitting back and forth widthwise in a 6 ㎡ hallway like a distressed squirrel … .

I probably received a defective unit. I mean, they can’t all be as problematic as the one I got? Reviews from the major tech and review websites are all mostly favorable; although most of them reviewed the more expensive BotVac D5 and not the cheaper D3 model.

I’m saying *got* in the past tense, as I returned my Neato BotVac D3 to the store after just a few days. It didn’t perform as advertised and was unable to reliably clean even one 20 ㎡ room. My old Samsung NaviBot did a better job at navigating around my apartment than the BotVac D3 even after the NaviBot’s sensors had begun giving out!

As mentioned throughout this review, I’ve had several interactions with Neato support staff in multiple languages about the problems I’ve experienced. I found Neato’s support staff unwilling to move past their scripted responses to any problem. The nail in the coffin for my D3 was that whenever I suggested that I might have received a defective unit, they ignored the remark or simply changed the topic.

I got the impression they were instructed to never acknowledge that there could be a fault with the shipped unit. Their vague suggestions of a firmware update that would fix the problems, not that there was any problem, coming at some indeterminate time in the future (three months was suggested but no firm date committed to) didn’t make me feel any better about the robot’s performance. As a cleaning tool, it proved itself to be entirely unreliable as it needed manual intervention with every cleaning cycle.

Neato support did eventually suggest I investigate electromagnetic interference, which turns out not to have been a problem, and to record videos to help them debug the problem. Unfortunately, I felt this was too expensive of an appliance to be beta testing for Neato. I expect my coffee makers and vacuum cleaners to just work.

I **can’t recommend this product** at this time, based on my own experiences with what was possibly a defective unit. If you look around the web, you’ll find nothing but positive reviews like I did. However, if you skim through forums, comments on reviews, and product reviews on Amazon and other stores you start seeing more mixed experiences including mentions of some of the same problems that I’ve mentioned in this review.

I’ll be looking for a different vacuuming companion as Neato BotVac D3 simply didn’t do its job as advertised.

**Reviewed:** D3 Connected

**Review rating:** 3 / 10

_Includes the latest 500 public posts. Use `/sitemap.xml` for the complete archive of public content._