sizeof(cat)

VPN killswitch and Windows 7

sizeofcat.nospam@riseup.net (sizeof(cat)) — Tue, 20 Feb 2024 10:27:07 +0000

Lately I’ve been having fun with my Nokia Booklet netbook and Windows 7, and I wanted all Internet traffic blocked when there is no active VPN connection (VPN killswitch); this can be done with just Windows Firewall.

There are several steps involved:

Download and install OpenVPN GUI for Windows 7 (make sure you don’t install OpenVPN Connect by mistake).
Get a OpenVPN profile from a VPN provider (Proton, Njal.la, Riseup).
Setup all VPN traffic to be allowed.
Setup all other network traffic to be blocked.
Fine-tune the firewall rules.

Go to Start Menu -> All Programs -> Administrative Tools -> Windows Firewall with Advanced Security. In the left panel click on Outbound Rules and once the outbound firewall rules are listed, click on New Rule in the right panel.

On the Rule Type screen select the Program radio button and click the Next button.

On the Program screen click on Browse and select the path to the openvpn.exe program (and not openvpn-gui.exe), make sure the This program path radio box is selected and after that click the Next button.

On the Action screen select the Allow this connection radio box and after that click the Next button.

On the Profile screen make sure you select all the three checkboxes (Domain, Private, Public) so that the rule applies to all the profiles. Click the Next button, give the rule a simple name like OpenVPN traffic allow and click Finish.

Basically now we have a rule that allows all VPN traffic under all network profiles, and now we need to block all the other traffic. Click on the Windows Firewall with Advanced Security item in the left panel and from the middle panel select the Windows Firewall Properties link.

A new dialog box with multiple tabs will open. On the Domain Profile tab select Block on the Outbound connections option. On the Private Profile tab select Block on the Outbound connections option. On the Public Profile tab select Allow (default) on the Outbound connections option. Click the OK button when you’re done.

Make sure you’re not connected to a VPN server, open Command Prompt and ping an external IP address. This should be the result, singnalling that all outgoing traffic is blocked:

c:\> ping 9.9.9.9
Pinging 9.9.9.9 with 32 bytes of data:
General failure.
General failure.
General failure.
General failure.

Ping statistics for 9.9.9.9:
 Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),
c:\>

Now you can select a OpenVPN profile from OpenVPN GUI, to connect to the specified server, and once the connection is established ping (and all network traffic) should be working again.

If your OpenVPN profile doesn’t do any DNS resolution (the remote field has an IP adress and not a hostname) you can disable DNS resolution outside VPN traffic too. Clic on Outgoing Rules in the left panel, find the Core Networking - DNS (UDP-Out) rule, right click on it and select Disable Rule.

If your VPN traffic gets interrupted (laptop sleep, network problems) there will be no Internet connections afterwards until you reconnect to the VPN server.

Future

sizeofcat.nospam@riseup.net (sizeof(cat)) — Sat, 17 Feb 2024 12:09:22 +0000

My great-grandmother had ten children, eight of whom lived to adulthood. When none had yet left the household, she used to bake golden-brown dinner rolls before dinnertime, cooling them in a towel-lined basket from which the smell of the rolls inside would waft through her whole house, announcing that the meal was almost ready to eat. Afterwards, if any of the rolls remained, the children would grab them out of the basket as a snack or to eat at lunch.

My grandmother had six children. Her mother passed down the recipe for those same dinner rolls down to her, and in the same fashion, she would bake them in the early afternoon and leave them in a basket on her kitchen countertop after meals were done. The table in her and my grandfather’s house, in time, hosted dozens of family friends, guests, and cherished extended family members, all of whom would end up having one of my grandmother’s dinner rolls at one point or another. Each of her children, just like she did when she was younger, would sneak a roll from the basket throughout the day, until all that was left was a pile of crumbs lining the bottom.

When my father married my mother, his parents passed down to him a family recipe book, a hundred fifty pages of jumbled, handwritten-and-copied notes on the dishes he had grown up with and how to make them just so. At the back of this book was the original dinner roll recipe, passed down from his mother’s mother to my grandmother, to him, and my mother. As a child, I often saw my mother kneading bread dough on a floured countertop on days when guests were expected, holidays, and special occasions, and on those days the warmth of the oven would dissipate throughout the house after what we knew as Mom’s dinner rolls had been pulled out and left to cool on a wire rack by the kitchen windowsill. I remember being able to make several of the buttery, crusty rolls disappear - as if by magic.

When I moved out, my parents passed a family cookbook on to me, which reproduced in photocopy a great deal of the recipes their families had handed down to them over the generations. At the back was my great-grandmother’s dinner roll recipe, slightly smudged with repeated copying but still legible.

There will be no one for me to pass the recipe down to. My house is quiet at dinnertime. There are no guests, no visiting relatives, no children. I rarely bake anything these days, much less a recipe for dinner rolls which could feed a dozen people. The recipe book my parents gave to me has, for the most part, simply collected dust on a shelf in my bedroom, crammed in between a notebook I haven’t touched since I was a child and a guide to photography I opened twice before realizing that taking pictures of things wasn’t as interesting as it had seemed.

Sometimes I take it down and hold it for a moment without opening the cover, then replace it on the shelf.

Website wordcloud

sizeofcat.nospam@riseup.net (sizeof(cat)) — Fri, 02 Feb 2024 06:10:33 +0000

It has come to my attention that thousands of years ago, all the cool kids had pretty wordclouds on their blogs, so here is mine; though a bit late, mainly because I’m not one of the cool kids.

The image was generated from the JSON feed of my website (with a temporary change to output all the website articles in that feed and not just the latest 20), using this Python module. Doesn’t include notes, bookmarks, projects or special pages (search, links, about, etc).

Click on the image for a bigger version.

Block ChatGPT from scraping your website

sizeofcat.nospam@riseup.net (sizeof(cat)) — Sun, 21 Jan 2024 06:08:28 +0000

OpenAI is generous enough to provide us mortal AI-feeders with IP ranges for the GPTbot, so make sure you add them to your firewall rules.

52.230.152.0/24
52.233.106.0/24

The IP ranges for the ChatGPT-User bot are:

23.98.142.176/28
40.84.180.224/28
13.65.240.240/28

If you’re using ufw (Uncomplicated Firewall), it’s easy to block them.

$ sudo ufw deny from 52.230.152.0/24
$ sudo ufw deny from 52.233.106.0/24
$ sudo ufw deny from 23.98.142.176/28
$ sudo ufw deny from 40.84.180.224/28
$ sudo ufw deny from 13.65.240.240/28
$ sudo ufw enable

Also, even though crawling-prevention via robots.txt might not be respected by the bot, add the following rules to your robots.txt file:

User-agent: GPTBot
User-agent: GPTBot-User
User-agent: ChatGPT
User-agent: ChatGPT-User
Disallow: /

Please don’t feed your website content to the so-called “AI overlords”.

Offline media (and computing)

sizeofcat.nospam@riseup.net (sizeof(cat)) — Fri, 19 Jan 2024 13:07:01 +0000

This is a really small “article”, the premise is that you should have some offline media so that you can (re)install the operating system on your machines, and locating what and how to download it is really complicated these days. Save the ISOs somewhere and don’t touch them until shit hits the fan.

Note

When downloading files from non-official websites, make sure you compare the hashes with the original files so you don’t get malware. Exercise caution when downloading, installing and running files.

Debian

Debian, also known as Debian GNU/Linux, is a Linux distribution composed of free and open-source software and proprietary software developed by the community-supported Debian Project, which was established by Ian Murdock on August 16, 1993.

download page, i386, amd64, arm64

Devuan

Devuan is a fork of the Debian Linux distribution that uses sysvinit, runit or OpenRC instead of systemd. Devuan aims to avoid “lock-in” by projects like systemd and aims to maintain compatibility with other init systems to avoid detaching Linux from other Unix systems.

download page, i386, amd64

Windows 11

Windows 11 is the latest major release of Microsoft’s Windows NT operating system, released on October 5, 2021. It succeeded Windows 10 (2015) and is available for free for any Windows 10 devices that meet the new Windows 11 system requirements.

Don’t create a Microsoft Account when installing it (for obvious reasons), activate it using MAS or KMS.

Windows 10

Windows 10 is a major release of Microsoft’s Windows NT operating system. It is the direct successor to Windows 8.1, which was released nearly two years earlier. It was released to manufacturing on July 15, 2015, and later to retail on July 29, 2015.

Don’t create a Microsoft Account when installing it (for obvious reasons), activate it using MAS or KMS.

Windows 7

Windows 7 is a major release of the Windows NT operating system developed by Microsoft. It was released to manufacturing on July 22, 2009, and became generally available on October 22, 2009.

official download not available anymore
download page, x86 en, x64 en

Activate it using KMS.

The Shamen: Axis Mutatis / Arbor Bona Arbor Mala

sizeofcat.nospam@riseup.net (sizeof(cat)) — Fri, 12 Jan 2024 07:46:27 +0000

The Shamen were a Scottish psychedelic band, formed in 1985 in Aberdeen, who became a chart-topping British electronic dance music act by the early 1990s. The founding members were Colin Angus, Derek McKenzie and Keith McKenzie. Peter Stephenson joined shortly after to take over on keyboards from Angus. Several other people were later in the band. Angus then teamed up with Will Sinnott, and together they found credibility as pioneers of rock/dance crossover. When rapper Mr. C joined, the band moved on to international commercial success with “Ebeneezer Goode” and their 1992 Boss Drum album.

I think The Shamen were awesome, not just awesomely cheesy but awesomely good too. They had a clear vision of what their music was supposed to be about, which in turn led to a definite blueprint for how they should sound. For radio, they allowed the record company to smooth the weirder edges by handing over their singles to remixers like The Beatmasters so they could be prepared for mass consumption. Meanwhile, the albums themselves a great deal of deeper material that allowed the band to indulge in the more experimental side of their music.

Axis Mutatis is front loaded with Beatmasters versions of the two lead singles and another track MK2A (probably the best pop song ever written about the astronomical telescopes on top of Mauna Kea in Hawaii). Almost every song with vocals has a production credit that implies that it has been remixed for radio.

Arbor Bona Arbor Mala is an almost entirely instrumental ambient techno album that is continuously mixed. I am used to long form ambient music, albeit stuff that varied quite quickly in the thematic sense (like albums by Mike Oldfield) or crammed with (often humorous) vocal samples that helped to tell the story. It shifts between its moods slowly and surely, from a beautiful ambient opening to a rather dark middle to a pulsating ending. A younger me would definitely fall asleep at night during the dreamier parts of “Sefirotic Axis” or “Entraterrestial”, only to be woken up by the woozy gales of found sound in “Beneath the Underworld” or failing that, later on during the pounding beats of the similarly titled “West of the Underworld”.

What is also compelling about Arbor Bona Arbor Mala is not just the style of music but also the nature of the sounds themselves. The Shamen had some good kit, there are some really wonderfully physical sounds here that have been built with analogue synths rather than existing as digital shadows within the computer. It is this physicality of the sound that makes Arbor Bona Arbor Mala so enjoyable to listen to: when the music drifts you really feel the sounds drifting; when the music becomes propulsive you get knocked off your feet (or woken up); when synth lines drift from left to right, you to turn to look at where they are going. Ambient music isn’t any good if it is inert, it needs to provide something for the listener to interact with.

The album is pretty much closed out by a very upbeat trio of tunes: “A Moment In Dub”, “Pizarro In Paradise” and “West of the Underworld”. I think that “Pizarro In Paradise” is probably as poppy as Arbor Bona Arbor Mala gets and is almost certainly from the same lineage as “Conquistador” on Axis Mutatis. It is an interesting game to think of Arbor Bona Arbor Mala as a remixed version of its parent album, though if that really is the case then it really is a radical collection of remixes. There are very few recognisable hooks from tracks of Axis - and then only if you know a few of the band’s own remixes of the tracks, as taken from the singles. One example is the Escacid remix of Destination Eschaton that underpins the penultimate track “Be Ready for the Storm”.

“Out in the Styx” returns the listener to the outside world on shanty boat along a river of silt. At least that’s how it has always sounded to me, it returns to the ambient sounds of earlier in the album but much faster and in a harsher way, like the end of a bad dream.

Track listing

Axis Mutatis

“Destination Eschaton”
“Transamazonia”
“Conquistador”
“MK2A”
“Neptune”
“Prince Of Popocatapetl”
“Heal (The Seperation)”
“Persephone’s Quest”
“Moment”

Arbor Bona Arbor Mala

“Axis Mutatis (A Tellos B Xibalba C Nemeton D Eternal Return)”
“Eschaton Omega (Deep Melodic Techno)”
“Asymptotic Eschaton”
“Sefirotic Axis (A Tellos B Creation C Formation D Eternal Return)”
“Entraterrestrial”
“Demeter”
“Beneath The Undeworld”
“Xochipili’s Return”
“Rio Negro”
“Above The Otherworld”
“A Moment In Dub”
“Pizarro In Paradise”
“West Of The Underworld”
“Anticipation Eschaton (Be Ready For The Storm)”
“Out In The Styx”

Nokia Booklet retro-station - Windows 7

sizeofcat.nospam@riseup.net (sizeof(cat)) — Fri, 05 Jan 2024 12:11:09 +0000

The Nokia Booklet 3G is a premium netbook by Nokia and if you want more info about it make sure you read my project page to get an insight in the device and its hardware. It’s my favorite netbook and despite the fact that it has only 1GB of RAM and is powered by a ultra low voltage Intel Atom CPU, plenty of stuff can be done with it. I actually have two of them, one running Devuan Linux and one with Windows 7 and I plan to get another and install Mac OS X Snow Leopard on it.

All Nokia Booklets came with Windows 7 Starter preinstalled and you really don’t want to use that, so let’s install something better, like Windows 7 Professional. You can update your Starter edition if you have an original installation and it will keep the preinstalled Nokia software, if you want so.

Note

Also, this is work in progress, I will update the article with more information as I dig through my personal RAM to recover memories of what software I used on it in 2010.

Operating System

Download Windows 7 Professional from this page, burn it to a USB stick with Rufus, dd or whatever tool you like. Start your Booklet, press F12 and select the USB disk to boot from it. Install Windows normally to the built-in HDD (or SSD, if you opted to change the slow Toshiba disk with a more powerful SSD).

Activate your copy of Windows 7 Pro using this activation script.

Nokia Booklet running various software

Drivers

The Booklet and Windows 7 will coexist by default but you need to install drivers for all the devices in your netbook, expecially the driver for the Intel GMA 500 video card. You can find all the drivers here, I suggest you install each one of them EXCEPT Nokia_Booklet3G_Intel_Graphics.zip because that version will have some issues with Microsoft Office (and probably other software, I didn’t had time to dig). Instead, install the official Intel GMA 500 video driver (and the Option WWAN driver for Booklet’s modem).

Reboot the netbook when you’re done.

Hardware

To maximize the possibilities of using your retrobook in case you have no WiFi connection or you HAVE TO browse a floppy disk, some additional hardware might be required:

Connectivity

[3G] - built-in on the Nokia Booklet, pop a SIM card into the SIM tray.
[GPS] - built-in, you will need an active SIM card inside the Booklet.
[Bluetooth] - built-in (2.1 +EDR).
[WiFi] - built-in, although a bit slow (b/g/n only).
[Ethernet] - TP-Link UE200 or any other USB network card with driver support for Windows 7 32bit. Useful when there are no WiFi connections but there is a cable connection nearby. Or when you don’t trust the WiFi providers (hotels or DefCONs).
[DialUp] - USRobotics 5637 or any other USB dialup fax-modem with driver support for Windows 7 32bit. Useful for when you want to connect to a BBS old-school-style.

External media

[SD card] - built-in, you can use normal-sized SD card as well as micro SD cards with a proper adapter.
[floppy drive] - any USB floppy drive.
[CD/DVD drive] - any USB CD/DVD drive.

Others

[RTL-SDR adapter] - RTL-SDR Blog V4 R828D RTL2832U for those times when you want to listen to police radio comms or aircraft traffic control conversations.
[USB-to-serial adapter] - FTDI Basic, useful when you need to attach a serial console to another device.

Updates

Windows Update is screwed since Windows 7 is no longer supported, but luckily Legacy Update exists. Open Internet Explorer on your Booklet and point it to legacyupdate.net. It will do all its magic and update your Windows installation to the last updates available and will reboot your machine several times.

Applications

What’s an old machine without old software (or new old software)?

[web browser] Brave 1.47.186 - download, last version available for Windows 7.
[web browser] Mozilla Firefox 115 ESR - download, last version available for a 32bit OS.
[web browser] Tor Browser 13.0.9 - download, last version available for a 32bit OS.
[email client] - Sylpheed 3.7 - download, it’s the current version.
[archiver] WinRAR 7b3 - download, it’s the current version.
[archiver] 7-Zip 24.01 - download, it’s the current version.
[irc client] HexChat 2.16.1 - download, it’s the current version.
[irc client] AdiIRC 4.4 - download, it’s the current version.
[text editor] Sublime Text 3 build 3211 - download, last version available for a 32bit OS.
[cd/dvd emulator] UltraISO 9 - download, it’s the current version.
[audio player] foobar2000 2.1 - download, it’s the current version.
[audio player] Winamp 2.95 - download.
[video player] VLC 3.0.20 - download, it’s the current version.
[ftp/scp file manager] WinSCP 6.1 - download, it’s the current version.
[image viewer] IrfanView 4.66 - download, it’s the current version.
[console emulator] Cmder 1.3.24 - download, it’s the current version.
[terminal emulator] PuTTY 0.80 - download, it’s the current version.
[pass manager] KeepassXC 2.6.6 - download, last version available for a 32bit OS.
[telnet client] SyncTerm 1.1 - download, it’s the current version.

Check the Retro System Revival website for more applications and utilities to install on your machine. If you want to install the pre-provided Nokia software on your netbook, visit this page but most of the software is not working anymore since it depends on Nokia’s servers being online.

If you want to experiment with the old Netscape Communicator suite or just the Netscape Navigator browser, browse to the Netscape Archive on the Internet Archive and you can download the last version of Netscape Communicator (7.2) or Netscape Navigator (9.0.6). Be cautious when using the old browsers to connect to the Internet (disable Flash, Java, Javascript, addons, toolbars).

If you want/need Telegram you should install an older version (like 3.7.3) with less bells and whistles (and lower memory footprint), but be aware that it will open your system to a new world of possible exploits.

Adobe

Adobe Photoshop CS6

The last version of the Adobe CC suite available for the 32bit architecture is Adobe CC 2018. All the links below come from Adobe’s official servers, they are strictly for 32bit and they’re trial versions (it’s up to you to decide if you want to buy or crack them).

Software	Size	Download
Photoshop CC 2018	1.3 GB	download link
Lightroom CC 2018	809 MB	download link
Lightroom Classic CC 2018	1.2 GB	download link
Illustrator CC 2018	1.9 GB	download link
InDesign CC 2018	877 MB	download link
InCopy CC 2018	864 MB	download link
Dreamweaver CC 2018	936 MB	download link
Adobe Muse CC 2018	771 MB	download link
Animate CC 2018 (Flash Pro)	1.5 GB	download link
Dimension CC 2018	1.4 GB	download link
Audition CC 2018	572 MB	download link
Prelude CC 2018	731 MB	download link
Bridge CC 2018	822 MB	download link
SpeedGrade CC 2015	339 MB	download link
Edge Animate CC 2015	149 MB	download link
Fuse CC 2017	3.8 GB	download link
Adobe Scout CC	18 MB	download link
CC Desktop App	326 MB	download link
Adobe Acrobat Pro DC 2018	786 MB	download link
Adobe Camera Raw 12.2.1	460 MB	download link
Flash Builder 4.7 Prem.	1.0 GB	download link
Fireworks CS6	438 MB	download link
Encore CS6	1.1 GB	download link
ExtendScript Toolkit CC	94 MB	download link
Adobe Gaming SDK 1.4	296 MB	download link
Touch App Plugins	4 MB	download link
Creative Cloud Packager	356 MB	download link

As an alternative, you can use Adobe Creative Suite 6 (CS6). The files are from official Adobe servers and they are trial (but can be cracked for full version with an “altered” amtlib.dll).

Software	Size	Download
Illustrator CS6	1.8 GB	download link
Photoshop CS6	1.1 GB	download link
Dreamweaver CS6	272 MB	download link
Fireworks CS6	438 MB	download link
InDesign CS6	879 MB	download link
InCopy CS6	638 MB	download link
Flash Pro CS6	1.1 GB	download link
Flash Builder 4.7	1.0 GB	download link
Premiere Pro CS6	1.1 GB	download link
After Effects CS6	997 MB	download link
Audition CS6	223 MB	download link
Prelude CS6	488 MB	download link
SpeedGrade CS6	95 MB	download link
Adobe Muse	32 MB	download link
Edge Animate 1.5	143 MB	download link
Acrobat X Pro	465 MB	download link
Camera Raw 9.1.1	220 MB	download link

JetBrains IDE

JetBrains IDEs last version with 32bit support is the 2021.1 one, so make sure you download it and never upgrade. As an extra perk, this version can have the trial extended indifinitely, so there’s that.

You’ll need to add some VM options to your bin/<IDE>.exe.vmoptions file, where <IDE> can be clion, webstorm, phpstorm or whatever JetBrains IDE you are using.

--add-opens=java.base/java.lang=ALL-UNNAMED
--add-opens=java.base/java.util=ALL-UNNAMED
--add-opens=java.desktop/java.awt=ALL-UNNAMED
--add-opens=java.desktop/java.awt.event=ALL-UNNAMED
--add-opens=java.desktop/java.awt.peer=ALL-UNNAMED
--add-opens=java.desktop/javax.swing=ALL-UNNAMED
--add-opens=java.desktop/javax.swing.plaf.basic=ALL-UNNAMED
--add-opens=java.desktop/javax.swing.text.html=ALL-UNNAMED
--add-opens=java.desktop/sun.awt=ALL-UNNAMED
--add-opens=java.desktop/sun.awt.X11=ALL-UNNAMED
--add-opens=java.desktop/sun.font=ALL-UNNAMED
--add-opens=java.desktop/sun.swing=ALL-UNNAMED
--add-exports=java.desktop/sun.awt.X11=ALL-UNNAMED
--add-exports=java.desktop/sun.awt.datatransfer=ALL-UNNAMED
--add-exports=java.desktop/sun.awt.image=ALL-UNNAMED
--add-exports=java.desktop/sun.font=ALL-UNNAMED

Resetting the IDEs trial status can be done with a simple script (that can be ran when the trial expires):

#!/bin/sh

rm -r ~/.config/JetBains/*/eval/*
sed -i 's/<property name="evlsprt.*>//' ~/.config/JetBrains/*/options/other.xml

Won’t run fast but they are usable. If you like the IDEs buy them, but it’s not worth if you’re using an expired version from several years ago.

Borland Delphi 7

What is a Windows 7 retro machine without some developer tools? No Microsoft Visual Studio (it can be installed but I severely dislike Visual Basic), but Borland Delphi? Yespls.

Download the archive from here, extract it and mount the ISO file using UltraISO. Make sure you read the text file inside the archive, it has the activation data, and you will need to replace dent.slip inside the directory where you installed Delphi, before you run Delphi for the first time.

Also, you will need to allow the users of the laptop to modify the contents of the main Delphi directory (in this case C:\Program Files\Borland\Delphi7 unless you installed in a different directory), so right click the specified directory in Windows Explorer, choose Properties, go to Permissions and give Full Control access to your user.

Starting Delphi after installing will display a “Program Compatibility Assistant” window that will warn you that “This program has compatibility issues” but you can check the “Don’t show this message again” checkbox and click the “Run program” button. It will only bug you once.

Visual Studio

If you need Microsoft’s Visual Studio for some reason I cannot grasp right now, you can install any version before 2019, included. Visual Studio 2022 doesn’t have support for Windows 7 anymore, so that’s a no-no. You can download the old versions of Visual Studio from Microsoft’s website (but you will need a MSDN subscription), you can use a trusted torrent or the Internet Archive. If you want to install Visual Studio 2019, make sure you read the system requirements (the 2GB of RAM might be a stop-gap, the Booklet only has 1GB). The 2015 version might be better suited for the retrobook.

I can’t tell how slow it will work on the Booklet because I don’t need Visual Studio. Drop me an e-mail if you installed it.

IDA Pro

Last version of Hex Rays IDA Pro that works on a 32bit architecture is 6.8, so if you need to disassemble and/or debug binary code you should definitely get that version. Beware of the cracked versions.

IDA Pro 6.8 works snappy and fast on the Booklet, and let’s be honest, it’s not like any of the alternatives can compare to IDA Pro.

Cygwin

Cygwin is a Unix-like environment and command-line interface for Windows, last version that works on Windows 7 32bit is 2.923, so download and run it from Command Prompt with the -X option (skips the lookup of the security signature, since we’re not using the default packages).

When prompted by the setup, enter http://ctm.crouchingtigerhiddenfruitbat.org/pub/cygwin/circa/2022/11/23/063457 as the User URL, click the Add button to add it to the Available Download Sites and proceed to package selection screen. Save the setup file somwhere on your machine since you’ll need it if you want to install other packages.

You might also want to install apt-cyg from its repo.

lynx -source rawgit.com/transcode-open/apt-cyg/master/apt-cyg > apt-cyg
install apt-cyg /bin

Microsoft Office 2016

Microsoft Word 2016

Office 2016 is the latest version that is supported on Windows 7, so download and install it. Everything works as expected, quick and snappy.

Security

Basically make sure you run a firewall in front of your netbook, enable Windows Firewall on your netbook, you should block dangerous ports, disable all the services that aren’t needed or used, disable insecure SMB protocols, and do not download files that you are not sure what they actually are. Control the places you visit and the stuff you are downloading. And never download and execute “random” executable files that you found on shady sites, proper security mandates that you execute them in a virtual machine on another computer, and once you’re absolutely sure it’s not malware, you install/run them on your Windows 7 machine. Especially if you don’t have an antivirus installed.

Inspect the processes in Task Manager and look for fishy items. That nVidiaGPU.exe process on your system that doesn’t have an nVidia GPU? Especially if it launches from a temporary directory? Ding dong, we have malware.

Ports that should be blocked:

53 (Domain Name System)
111 (Remote Procedure Call)
135 (Microsoft End Point Mapper)
138 (NetBIOS Datagram Service)
139 (Server Message Block (SMB))
161 (Simple Network Management Protocol)
389 (Lightweight Directory Access Protocol)
445 (Microsoft-DS SMB file sharing)
3389 (Remote Desktop Protocol)

Services that can be disabled safely:

Desktop Window Manager Session Manager
Distributed Link Tracking Client
Function Discovery Provider Host
Function Discovery Resource Publication
HomeGroup Listener, HomeGroup Provider
Offline Files
Remote Registry
Shell Hardware Detection
Volume Shadow Copy
WebClient
Windows Backup
Windows Biometric Service

Services that can be disabled if not used:

Bluetooth Support Service
Fax
Group Policy Client
Indexing Service
Print Spooler
Telephony
Themes
Windows Image Acquisition (WIA)
Windows Search
Windows Time

Disable insecure SMB protocols to protect your computer against EternalBlue attack:

C:\Windows\System32> sc config lanmanworkstation depend= bowser/mrxsmb20/nsi
C:\Windows\System32> sc config mrxsmb10 start= disabled
C:\Windows\System32> sc config lanmanworkstation depend= bowser/mrxsmb10/nsi
C:\Windows\System32> sc config mrxsmb20 start= disabled

Consider turning off Internet access when you don’t need it.

Standard user accounts must not be granted elevated privileges. Enabling Windows Installer to elevate privileges when installing applications can allow malicious persons and applications to gain full control of a system.

HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Installer\
Value Name: AlwaysInstallElevated
Type: REG_DWORD
Value: 0

The Kerberos v5 authentication protocol is the default for authentication for domains. NTLM which is less secure, is retained in later Windows versions for compatibility with standalone systems as well as applications that may still use it. Earlier versions of the LM/NTLM protocol are particularly vulnerable to attack and must be prevented.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\
Value Name: LmCompatibilityLevel
Value Type: REG_DWORD
Value: 5

Autoplay begins reading from a drive as soon as you insert media in the drive. As a result, the setup file of programs and the music on audio media starts immediately. By default, autoplay is disabled on removable drives, such as the floppy disk drive (but not the CD-ROM drive) and on network drives. If you enable this policy, you can also disable autoplay on all drives.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\
Value Name: NoDriveTypeAutorun
Type: REG_DWORD
Value: 0x000000ff (255)

Allowing anonymous logon users (null session connections) to list all account names and enumerate all shared resources can provide a map of potential points to attack the system.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\
Value Name: RestrictAnonymous
Value Type: REG_DWORD
Value: 1

Allowing anonymous logon users (null session connections) to list all account names, thus providing a list of potential points to attack the system.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\
Value Name: RestrictAnonymousSAM
Value Type: REG_DWORD
Value: 1

Allowing autorun commands to execute may introduce malicious code to a system. Configuring this setting prevents autorun commands from executing.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\
Value Name: NoAutorun
Type: REG_DWORD
Value: 1

Solicited Remote Assistance should not be allowed. This setting controls whether or not solicited remote assistance is allowed from this computer. Solicited assistance is help that is specifically requested by the user. This is a Category 1 finding because it may allow unauthorized parties access to the resources on the computer.

HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Terminal Services\
Value Name: fAllowToGetHelp
Type: REG_DWORD
Value: 0

Privacy

Telemetry

Windows operating system is leaking more than a one-legged hooker in Singapore (so I’ve heard) but there are ways to stop some of the leaking (unlike the case of the aforementioned hooker).

Delete telemetry services:

C:\Windows\System32> sc stop RemoteRegistry
C:\Windows\System32> sc delete RemoteRegistry
C:\Windows\System32> sc stop DiagTrack
C:\Windows\System32> sc delete DiagTrack
C:\Windows\System32> sc stop dmwappushservice
C:\Windows\System32> sc delete dmwappushservice

Delete telemetry tasks:

C:\Windows\System32> schtasks /delete /tn "\Microsoft\Windows\Application Experience\AitAgent" /f
C:\Windows\System32> schtasks /delete /tn "\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser" /f
C:\Windows\System32> schtasks /delete /tn "\Microsoft\Windows\Application Experience\ProgramDataUpdater" /f
C:\Windows\System32> schtasks /delete /tn "\Microsoft\Windows\Autochk\Proxy" /f
C:\Windows\System32> schtasks /delete /tn "\Microsoft\Windows\CloudExperienceHost\CreateObjectTask" /f
C:\Windows\System32> schtasks /delete /tn "\Microsoft\Windows\Customer Experience Improvement Program\Consolidator" /f
C:\Windows\System32> schtasks /delete /tn "\Microsoft\Windows\Customer Experience Improvement Program\KernelCeipTask" /f
C:\Windows\System32> schtasks /delete /tn "\Microsoft\Windows\Customer Experience Improvement Program\UsbCeip" /f
C:\Windows\System32> schtasks /delete /tn "\Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticDataCollector" /f
C:\Windows\System32> schtasks /delete /tn "\Microsoft\Windows\IME\SQM data sender" /f
C:\Windows\System32> schtasks /delete /tn "\Microsoft\Windows\Maintenance\WinSAT" /f
C:\Windows\System32> schtasks /delete /tn "\Microsoft\Windows\NetTrace\GatherNetworkInfo" /f
C:\Windows\System32> schtasks /delete /tn "\Microsoft\Windows\Shell\FamilySafetyMonitor" /f
C:\Windows\System32> schtasks /delete /tn "\Microsoft\Windows\Shell\FamilySafetyRefresh" /f

More cleaning up:

C:\Windows\System32> takeown /f "C:\Windows\System32\EOSNotify.exe"
C:\Windows\System32> icacls "C:\Windows\System32\EOSNotify.exe" /grant administrators:F
C:\Windows\System32> icacls "C:\Windows\System32\EOSNotify.exe" /inheritance:r /deny SYSTEM:F /grant Administrators:F
C:\Windows\System32> del /f "C:\Windows\System32\EOSNotify.exe"
C:\Windows\System32> takeown /f "C:\ProgramData\Microsoft\Diagnosis\ETLLogs\AutoLogger\AutoLogger-Diagtrack-Listener.etl"
C:\Windows\System32> icacls "C:\ProgramData\Microsoft\Diagnosis\ETLLogs\AutoLogger\AutoLogger-Diagtrack-Listener.etl" /grant administrators:F
C:\Windows\System32> icacls "C:\ProgramData\Microsoft\Diagnosis\ETLLogs\AutoLogger\AutoLogger-Diagtrack-Listener.etl" /inheritance:r /deny SYSTEM:F /grant Administrators:F
C:\Windows\System32> echo "" > C:\ProgramData\Microsoft\Diagnosis\ETLLogs\AutoLogger\AutoLogger-Diagtrack-Listener.etl

Place the following Microsoft domains into your hosts file (c:\windows\system32\drivers\etc\hosts):

click for a list

0.0.0.0 vortex.data.microsoft.com
0.0.0.0 vortex-win.data.microsoft.com
0.0.0.0 telecommand.telemetry.microsoft.com
0.0.0.0 telecommand.telemetry.microsoft.com.nsatc.net
0.0.0.0 oca.telemetry.microsoft.com
0.0.0.0 oca.telemetry.microsoft.com.nsatc.net
0.0.0.0 sqm.telemetry.microsoft.com
0.0.0.0 sqm.telemetry.microsoft.com.nsatc.net
0.0.0.0 watson.telemetry.microsoft.com
0.0.0.0 watson.telemetry.microsoft.com.nsatc.net
0.0.0.0 redir.metaservices.microsoft.com
0.0.0.0 choice.microsoft.com
0.0.0.0 choice.microsoft.com.nsatc.net
0.0.0.0 df.telemetry.microsoft.com
0.0.0.0 reports.wes.df.telemetry.microsoft.com
0.0.0.0 wes.df.telemetry.microsoft.com
0.0.0.0 services.wes.df.telemetry.microsoft.com
0.0.0.0 sqm.df.telemetry.microsoft.com
0.0.0.0 telemetry.microsoft.com
0.0.0.0 watson.ppe.telemetry.microsoft.com
0.0.0.0 telemetry.appex.bing.net
0.0.0.0 telemetry.urs.microsoft.com
0.0.0.0 telemetry.appex.bing.net:443
0.0.0.0 settings-sandbox.data.microsoft.com
0.0.0.0 vortex-sandbox.data.microsoft.com
0.0.0.0 survey.watson.microsoft.com
0.0.0.0 watson.live.com
0.0.0.0 watson.microsoft.com
0.0.0.0 statsfe2.ws.microsoft.com
0.0.0.0 corpext.msitadfs.glbdns2.microsoft.com
0.0.0.0 compatexchange.cloudapp.net
0.0.0.0 cs1.wpc.v0cdn.net
0.0.0.0 a-0001.a-msedge.net
0.0.0.0 statsfe2.update.microsoft.com.akadns.net
0.0.0.0 sls.update.microsoft.com.akadns.net
0.0.0.0 fe2.update.microsoft.com.akadns.net
0.0.0.0 65.55.108.23
0.0.0.0 65.39.117.230
0.0.0.0 23.218.212.69
0.0.0.0 104.41.219.140
0.0.0.0 134.170.30.202
0.0.0.0 137.116.81.24
0.0.0.0 diagnostics.support.microsoft.com
0.0.0.0 corp.sts.microsoft.com
0.0.0.0 statsfe1.ws.microsoft.com
0.0.0.0 pre.footprintpredict.com
0.0.0.0 204.79.197.200
0.0.0.0 i1.services.social.microsoft.com
0.0.0.0 i1.services.social.microsoft.com.nsatc.net
0.0.0.0 feedback.windows.com
0.0.0.0 feedback.microsoft-hohm.com
0.0.0.0 feedback.search.microsoft.com
0.0.0.0 s0.2mdn.net
0.0.0.0 view.atdmt.com
0.0.0.0 2.22.61.43
0.0.0.0 2.22.61.66
0.0.0.0 157.56.106.189
0.0.0.0 65.52.108.33
0.0.0.0 64.4.54.254
0.0.0.0 onesettings-bn2.metron.live.com.nsatc.net
0.0.0.0 onesettings-cy2.metron.live.com.nsatc.net
0.0.0.0 onesettings-db5.metron.live.com.nsatc.net
0.0.0.0 onesettings-hk2.metron.live.com.nsatc.net
0.0.0.0 settings.data.glbdns2.microsoft.com
0.0.0.0 telecommand.telemetry.microsoft.com.nsatc.net
0.0.0.0 v10.vortex-win.data.microsoft.com
0.0.0.0 v10.vortex-win.data.metron.live.com.nsatc.net
0.0.0.0 vortex.data.glbdns2.microsoft.com
0.0.0.0 vortex.data.metron.live.com.nsatc.net
0.0.0.0 vortex-bn2.metron.live.com.nsatc.net
0.0.0.0 vortex-cy2.metron.live.com.nsatc.net
0.0.0.0 vortex-db5.metron.live.com.nsatc.net
0.0.0.0 vortex-hk2.metron.live.com.nsatc.net
0.0.0.0 vortex-win.data.metron.live.com.nsatc.net
0.0.0.0 a-0001.dc-msedge.net
0.0.0.0 a-0002.a-msedge.net
0.0.0.0 a-0003.a-msedge.net
0.0.0.0 a-0003.dc-msedge.net
0.0.0.0 a-0004.a-msedge.net
0.0.0.0 a-0005.a-msedge.net
0.0.0.0 a-0006.a-msedge.net
0.0.0.0 a-0007.a-msedge.net
0.0.0.0 a-0008.a-msedge.net
0.0.0.0 a-0009.a-msedge.net
0.0.0.0 a-0010.a-msedge.net
0.0.0.0 a-0011.a-msedge.net
0.0.0.0 a-0012.a-msedge.net
0.0.0.0 a-msedge.net
0.0.0.0 a.ads1.msn.com
0.0.0.0 a.ads2.msads.net
0.0.0.0 a.ads2.msn.com
0.0.0.0 a.rad.msn.com
0.0.0.0 ac3.msn.com
0.0.0.0 activity.windows.com
0.0.0.0 adnexus.net
0.0.0.0 adnxs.com
0.0.0.0 adl.windows.com
0.0.0.0 ads.msn.com
0.0.0.0 ads1.msads.net
0.0.0.0 ads1.msn.com
0.0.0.0 aidps.atdmt.com
0.0.0.0 aka-cdn-ns.adtech.de
0.0.0.0 array101-prod.do.dsp.mp.microsoft.com
0.0.0.0 array102-prod.do.dsp.mp.microsoft.com
0.0.0.0 array103-prod.do.dsp.mp.microsoft.com
0.0.0.0 array104-prod.do.dsp.mp.microsoft.com
0.0.0.0 array201-prod.do.dsp.mp.microsoft.com
0.0.0.0 array202-prod.do.dsp.mp.microsoft.com
0.0.0.0 array203-prod.do.dsp.mp.microsoft.com
0.0.0.0 array204-prod.do.dsp.mp.microsoft.com
0.0.0.0 array401-prod.do.dsp.mp.microsoft.com
0.0.0.0 array402-prod.do.dsp.mp.microsoft.com
0.0.0.0 array403-prod.do.dsp.mp.microsoft.com
0.0.0.0 array404-prod.do.dsp.mp.microsoft.com
0.0.0.0 array405-prod.do.dsp.mp.microsoft.com
0.0.0.0 array406-prod.do.dsp.mp.microsoft.com
0.0.0.0 array407-prod.do.dsp.mp.microsoft.com
0.0.0.0 array408-prod.do.dsp.mp.microsoft.com
0.0.0.0 b.ads1.msn.com
0.0.0.0 b.ads2.msads.net
0.0.0.0 b.rad.msn.com
0.0.0.0 bingads.microsoft.com
0.0.0.0 bl3301-a.1drv.com
0.0.0.0 bl3301-c.1drv.com
0.0.0.0 bl3301-g.1drv.com
0.0.0.0 bn2b-cor001.api.p001.1drv.com
0.0.0.0 bn2b-cor002.api.p001.1drv.com
0.0.0.0 bn2b-cor003.api.p001.1drv.com
0.0.0.0 bn2b-cor004.api.p001.1drv.com
0.0.0.0 bn2wns1.wns.windows.com
0.0.0.0 bn3p-cor001.api.p001.1drv.com
0.0.0.0 bn3sch020010558.wns.windows.com
0.0.0.0 bn3sch020010560.wns.windows.com
0.0.0.0 bn3sch020010618.wns.windows.com
0.0.0.0 bn3sch020010629.wns.windows.com
0.0.0.0 bn3sch020010631.wns.windows.com
0.0.0.0 bn3sch020010635.wns.windows.com
0.0.0.0 bn3sch020010636.wns.windows.com
0.0.0.0 bn3sch020010650.wns.windows.com
0.0.0.0 bn3sch020011727.wns.windows.com
0.0.0.0 bn3sch020012850.wns.windows.com
0.0.0.0 bn3sch020020322.wns.windows.com
0.0.0.0 bn3sch020020749.wns.windows.com
0.0.0.0 bn3sch020022328.wns.windows.com
0.0.0.0 bn3sch020022335.wns.windows.com
0.0.0.0 bn3sch020022361.wns.windows.com
0.0.0.0 bn4sch101120814.wns.windows.com
0.0.0.0 bn4sch101120818.wns.windows.com
0.0.0.0 bn4sch101120911.wns.windows.com
0.0.0.0 bn4sch101120913.wns.windows.com
0.0.0.0 bn4sch101121019.wns.windows.com
0.0.0.0 bn4sch101121109.wns.windows.com
0.0.0.0 bn4sch101121118.wns.windows.com
0.0.0.0 bn4sch101121223.wns.windows.com
0.0.0.0 bn4sch101121407.wns.windows.com
0.0.0.0 bn4sch101121618.wns.windows.com
0.0.0.0 bn4sch101121704.wns.windows.com
0.0.0.0 bn4sch101121709.wns.windows.com
0.0.0.0 bn4sch101121714.wns.windows.com
0.0.0.0 bn4sch101121908.wns.windows.com
0.0.0.0 bn4sch101122117.wns.windows.com
0.0.0.0 bn4sch101122310.wns.windows.com
0.0.0.0 bn4sch101122312.wns.windows.com
0.0.0.0 bn4sch101122421.wns.windows.com
0.0.0.0 bn4sch101123108.wns.windows.com
0.0.0.0 bn4sch101123110.wns.windows.com
0.0.0.0 bn4sch101123202.wns.windows.com
0.0.0.0 bn4sch102110124.wns.windows.com
0.0.0.0 bs.serving-sys.com
0.0.0.0 by3301-a.1drv.com
0.0.0.0 by3301-c.1drv.com
0.0.0.0 by3301-e.1drv.com
0.0.0.0 c-0001.dc-msedge.net
0.0.0.0 c.atdmt.com
0.0.0.0 c.msn.com
0.0.0.0 cache.datamart.windows.com
0.0.0.0 cdn.atdmt.com
0.0.0.0 cds10.stn.llnw.net
0.0.0.0 cds1203.lon.llnw.net
0.0.0.0 cds1204.lon.llnw.net
0.0.0.0 cds1209.lon.llnw.net
0.0.0.0 cds1219.lon.llnw.net
0.0.0.0 cds1228.lon.llnw.net
0.0.0.0 cds1244.lon.llnw.net
0.0.0.0 cds1257.lon.llnw.net
0.0.0.0 cds1265.lon.llnw.net
0.0.0.0 cds1269.lon.llnw.net
0.0.0.0 cds1273.lon.llnw.net
0.0.0.0 cds1285.lon.llnw.net
0.0.0.0 cds1287.lon.llnw.net
0.0.0.0 cds1289.lon.llnw.net
0.0.0.0 cds1293.lon.llnw.net
0.0.0.0 cds1307.lon.llnw.net
0.0.0.0 cds1310.lon.llnw.net
0.0.0.0 cds1325.lon.llnw.net
0.0.0.0 cds1327.lon.llnw.net
0.0.0.0 cds177.dus.llnw.net
0.0.0.0 cds20005.stn.llnw.net
0.0.0.0 cds20404.lcy.llnw.net
0.0.0.0 cds20411.lcy.llnw.net
0.0.0.0 cds20415.lcy.llnw.net
0.0.0.0 cds20416.lcy.llnw.net
0.0.0.0 cds20417.lcy.llnw.net
0.0.0.0 cds20424.lcy.llnw.net
0.0.0.0 cds20425.lcy.llnw.net
0.0.0.0 cds20431.lcy.llnw.net
0.0.0.0 cds20435.lcy.llnw.net
0.0.0.0 cds20440.lcy.llnw.net
0.0.0.0 cds20443.lcy.llnw.net
0.0.0.0 cds20445.lcy.llnw.net
0.0.0.0 cds20450.lcy.llnw.net
0.0.0.0 cds20452.lcy.llnw.net
0.0.0.0 cds20457.lcy.llnw.net
0.0.0.0 cds20461.lcy.llnw.net
0.0.0.0 cds20469.lcy.llnw.net
0.0.0.0 cds20475.lcy.llnw.net
0.0.0.0 cds20482.lcy.llnw.net
0.0.0.0 cds20485.lcy.llnw.net
0.0.0.0 cds20495.lcy.llnw.net
0.0.0.0 cds21205.lon.llnw.net
0.0.0.0 cds21207.lon.llnw.net
0.0.0.0 cds21225.lon.llnw.net
0.0.0.0 cds21229.lon.llnw.net
0.0.0.0 cds21233.lon.llnw.net
0.0.0.0 cds21238.lon.llnw.net
0.0.0.0 cds21244.lon.llnw.net
0.0.0.0 cds21249.lon.llnw.net
0.0.0.0 cds21256.lon.llnw.net
0.0.0.0 cds21257.lon.llnw.net
0.0.0.0 cds21258.lon.llnw.net
0.0.0.0 cds21261.lon.llnw.net
0.0.0.0 cds21267.lon.llnw.net
0.0.0.0 cds21278.lon.llnw.net
0.0.0.0 cds21281.lon.llnw.net
0.0.0.0 cds21293.lon.llnw.net
0.0.0.0 cds21309.lon.llnw.net
0.0.0.0 cds21313.lon.llnw.net
0.0.0.0 cds21321.lon.llnw.net
0.0.0.0 cds299.lcy.llnw.net
0.0.0.0 cds308.lcy.llnw.net
0.0.0.0 cds30027.stn.llnw.net
0.0.0.0 cds310.lcy.llnw.net
0.0.0.0 cds38.ory.llnw.net
0.0.0.0 cds54.ory.llnw.net
0.0.0.0 cds405.lcy.llnw.net
0.0.0.0 cds406.lcy.llnw.net
0.0.0.0 cds407.fra.llnw.net
0.0.0.0 cds416.lcy.llnw.net
0.0.0.0 cds421.lcy.llnw.net
0.0.0.0 cds422.lcy.llnw.net
0.0.0.0 cds425.lcy.llnw.net
0.0.0.0 cds426.lcy.llnw.net
0.0.0.0 cds447.lcy.llnw.net
0.0.0.0 cds458.lcy.llnw.net
0.0.0.0 cds459.lcy.llnw.net
0.0.0.0 cds461.lcy.llnw.net
0.0.0.0 cds468.lcy.llnw.net
0.0.0.0 cds469.lcy.llnw.net
0.0.0.0 cds471.lcy.llnw.net
0.0.0.0 cds483.lcy.llnw.net
0.0.0.0 cds484.lcy.llnw.net
0.0.0.0 cds489.lcy.llnw.net
0.0.0.0 cds493.lcy.llnw.net
0.0.0.0 cds494.lcy.llnw.net
0.0.0.0 cds812.lon.llnw.net
0.0.0.0 cds815.lon.llnw.net
0.0.0.0 cds818.lon.llnw.net
0.0.0.0 cds832.lon.llnw.net
0.0.0.0 cds836.lon.llnw.net
0.0.0.0 cds840.lon.llnw.net
0.0.0.0 cds843.lon.llnw.net
0.0.0.0 cds857.lon.llnw.net
0.0.0.0 cds868.lon.llnw.net
0.0.0.0 cds869.lon.llnw.net
0.0.0.0 ch1-cor001.api.p001.1drv.com
0.0.0.0 ch1-cor002.api.p001.1drv.com
0.0.0.0 ch3301-c.1drv.com
0.0.0.0 ch3301-e.1drv.com
0.0.0.0 ch3301-g.1drv.com
0.0.0.0 ch3302-c.1drv.com
0.0.0.0 ch3302-e.1drv.com
0.0.0.0 compatexchange1.trafficmanager.net
0.0.0.0 continuum.dds.microsoft.com
0.0.0.0 cy2.settings.data.microsoft.com.akadns.net
0.0.0.0 db5.settings.data.microsoft.com.akadns.net
0.0.0.0 dev.virtualearth.net
0.0.0.0 ec.atdmt.com
0.0.0.0 ecn.dev.virtualearth.net
0.0.0.0 eu.vortex.data.microsoft.com
0.0.0.0 flex.msn.com
0.0.0.0 fs.microsoft.com
0.0.0.0 g.msn.com
0.0.0.0 geo.settings.data.microsoft.com.akadns.net
0.0.0.0 geo-prod.do.dsp.mp.microsoft.com
0.0.0.0 geover-prod.do.dsp.mp.microsoft.com
0.0.0.0 h1.msn.com
0.0.0.0 h2.msn.com
0.0.0.0 hk2.wns.windows.com
0.0.0.0 hk2sch130020721.wns.windows.com
0.0.0.0 hk2sch130020723.wns.windows.com
0.0.0.0 hk2sch130020726.wns.windows.com
0.0.0.0 hk2sch130020729.wns.windows.com
0.0.0.0 hk2sch130020732.wns.windows.com
0.0.0.0 hk2sch130020824.wns.windows.com
0.0.0.0 hk2sch130020843.wns.windows.com
0.0.0.0 hk2sch130020851.wns.windows.com
0.0.0.0 hk2sch130020854.wns.windows.com
0.0.0.0 hk2sch130020855.wns.windows.com
0.0.0.0 hk2sch130020924.wns.windows.com
0.0.0.0 hk2sch130020936.wns.windows.com
0.0.0.0 hk2sch130020940.wns.windows.com
0.0.0.0 hk2sch130020956.wns.windows.com
0.0.0.0 hk2sch130020958.wns.windows.com
0.0.0.0 hk2sch130020961.wns.windows.com
0.0.0.0 hk2sch130021017.wns.windows.com
0.0.0.0 hk2sch130021029.wns.windows.com
0.0.0.0 hk2sch130021035.wns.windows.com
0.0.0.0 hk2sch130021137.wns.windows.com
0.0.0.0 hk2sch130021142.wns.windows.com
0.0.0.0 hk2sch130021153.wns.windows.com
0.0.0.0 hk2sch130021217.wns.windows.com
0.0.0.0 hk2sch130021246.wns.windows.com
0.0.0.0 hk2sch130021249.wns.windows.com
0.0.0.0 hk2sch130021260.wns.windows.com
0.0.0.0 hk2sch130021264.wns.windows.com
0.0.0.0 hk2sch130021322.wns.windows.com
0.0.0.0 hk2sch130021323.wns.windows.com
0.0.0.0 hk2sch130021329.wns.windows.com
0.0.0.0 hk2sch130021334.wns.windows.com
0.0.0.0 hk2sch130021360.wns.windows.com
0.0.0.0 hk2sch130021432.wns.windows.com
0.0.0.0 hk2sch130021433.wns.windows.com
0.0.0.0 hk2sch130021435.wns.windows.com
0.0.0.0 hk2sch130021437.wns.windows.com
0.0.0.0 hk2sch130021440.wns.windows.com
0.0.0.0 hk2sch130021450.wns.windows.com
0.0.0.0 hk2sch130021518.wns.windows.com
0.0.0.0 hk2sch130021523.wns.windows.com
0.0.0.0 hk2sch130021526.wns.windows.com
0.0.0.0 hk2sch130021527.wns.windows.com
0.0.0.0 hk2sch130021544.wns.windows.com
0.0.0.0 hk2sch130021554.wns.windows.com
0.0.0.0 hk2sch130021618.wns.windows.com
0.0.0.0 hk2sch130021634.wns.windows.com
0.0.0.0 hk2sch130021638.wns.windows.com
0.0.0.0 hk2sch130021646.wns.windows.com
0.0.0.0 hk2sch130021652.wns.windows.com
0.0.0.0 hk2sch130021654.wns.windows.com
0.0.0.0 hk2sch130021657.wns.windows.com
0.0.0.0 hk2sch130021723.wns.windows.com
0.0.0.0 hk2sch130021726.wns.windows.com
0.0.0.0 hk2sch130021727.wns.windows.com
0.0.0.0 hk2sch130021730.wns.windows.com
0.0.0.0 hk2sch130021731.wns.windows.com
0.0.0.0 hk2sch130021754.wns.windows.com
0.0.0.0 hk2sch130021829.wns.windows.com
0.0.0.0 hk2sch130021830.wns.windows.com
0.0.0.0 hk2sch130021833.wns.windows.com
0.0.0.0 hk2sch130021840.wns.windows.com
0.0.0.0 hk2sch130021842.wns.windows.com
0.0.0.0 hk2sch130021851.wns.windows.com
0.0.0.0 hk2sch130021852.wns.windows.com
0.0.0.0 hk2sch130021927.wns.windows.com
0.0.0.0 hk2sch130021928.wns.windows.com
0.0.0.0 hk2sch130021929.wns.windows.com
0.0.0.0 hk2sch130021958.wns.windows.com
0.0.0.0 hk2sch130022035.wns.windows.com
0.0.0.0 hk2sch130022041.wns.windows.com
0.0.0.0 hk2sch130022049.wns.windows.com
0.0.0.0 hk2sch130022135.wns.windows.com
0.0.0.0 hk2wns1.wns.windows.com
0.0.0.0 hk2wns1b.wns.windows.com
0.0.0.0 i-bl6p-cor001.api.p001.1drv.com
0.0.0.0 i-bl6p-cor002.api.p001.1drv.com
0.0.0.0 i-bn3p-cor001.api.p001.1drv.com
0.0.0.0 i-by3p-cor001.api.p001.1drv.com
0.0.0.0 i-by3p-cor002.api.p001.1drv.com
0.0.0.0 i-ch1-cor001.api.p001.1drv.com
0.0.0.0 i-ch1-cor002.api.p001.1drv.com
0.0.0.0 i-sn2-cor001.api.p001.1drv.com
0.0.0.0 i-sn2-cor002.api.p001.1drv.com
0.0.0.0 inference.location.live.net
0.0.0.0 lb1.www.ms.akadns.net
0.0.0.0 live.rads.msn.com
0.0.0.0 m.adnxs.com
0.0.0.0 mobile.pipe.aria.microsoft.com
0.0.0.0 msedge.net
0.0.0.0 msntest.serving-sys.com
0.0.0.0 nexus.officeapps.live.com
0.0.0.0 nexusrules.officeapps.live.com
0.0.0.0 preview.msn.com
0.0.0.0 rad.live.com
0.0.0.0 rad.msn.com
0.0.0.0 schemas.microsoft.akadns.net
0.0.0.0 secure.adnxs.com
0.0.0.0 secure.flashtalking.com
0.0.0.0 settings-win-ppe.data.microsoft.com
0.0.0.0 settings-win.data.microsoft.com
0.0.0.0 settings.data.microsoft.com
0.0.0.0 sn3301-c.1drv.com
0.0.0.0 sn3301-e.1drv.com
0.0.0.0 sn3301-g.1drv.com
0.0.0.0 share.microsoft.com
0.0.0.0 maps.windows.com
0.0.0.0 spynet2.microsoft.com
0.0.0.0 spynetalt.microsoft.com
0.0.0.0 spyneteurope.microsoft.akadns.net
0.0.0.0 ssw.live.com
0.0.0.0 storecatalogrevocation.storequality.microsoft.com
0.0.0.0 t0.ssl.ak.dynamic.tiles.virtualearth.net
0.0.0.0 t0.ssl.ak.tiles.virtualearth.net
0.0.0.0 tele.trafficmanager.net
0.0.0.0 teredo.ipv6.microsoft.com
0.0.0.0 test.activity.windows.com
0.0.0.0 tsfe.trafficshaping.dsp.mp.microsoft.com
0.0.0.0 version.hybrid.api.here.com
0.0.0.0 web.vortex.data.microsoft.com
0.0.0.0 win10.ipv6.microsoft.com
0.0.0.0 win1710.ipv6.microsoft.com
0.0.0.0 win8.ipv6.microsoft.com
0.0.0.0 www.msedge.net
0.0.0.0 alpha.telemetry.microsoft.com
0.0.0.0 apac1.notify.windows.com.akadns.net
0.0.0.0 api.cortana.ai
0.0.0.0 asimov-win.settings.data.microsoft.com.akadns.net
0.0.0.0 browser.events.data.microsoft.com
0.0.0.0 browser.pipe.aria.microsoft.com
0.0.0.0 cy2.vortex.data.microsoft.com.akadns.net
0.0.0.0 db5.settings-win.data.microsoft.com.akadns.net
0.0.0.0 db5.vortex.data.microsoft.com.akadns.net
0.0.0.0 db5-eap.settings-win.data.microsoft.com.akadns.net
0.0.0.0 eu.vortex-win.data.microsoft.com
0.0.0.0 eu-v10.events.data.microsoft.com
0.0.0.0 eu-v20.events.data.microsoft.com
0.0.0.0 events.data.microsoft.com
0.0.0.0 geo.settings-win.data.microsoft.com.akadns.net
0.0.0.0 geo.vortex.data.microsoft.com.akadns.net
0.0.0.0 hk2.settings.data.microsoft.com.akadns.net
0.0.0.0 i-sn3p-cor001.api.p001.1drv.com
0.0.0.0 ieonlinews.microsoft.com
0.0.0.0 ieonlinews.trafficmanager.net
0.0.0.0 mobile.events.data.microsoft.com
0.0.0.0 modern.watson.data.microsoft.com.akadns.net
0.0.0.0 onecollector.cloudapp.aria.akadns.net
0.0.0.0 self.events.data.microsoft.com
0.0.0.0 sg2p.wns.windows.com
0.0.0.0 telemetry.remoteapp.windowsazure.com
0.0.0.0 umwatsonc.events.data.microsoft.com
0.0.0.0 us-v10.events.data.microsoft.com
0.0.0.0 us-v20.events.data.microsoft.com
0.0.0.0 us.vortex-win.data.microsoft.com
0.0.0.0 v10.events.data.microsoft.com
0.0.0.0 v10c.events.data.microsoft.com
0.0.0.0 v20.events.data.microsoft.com
0.0.0.0 v10-win.vortex.data.microsoft.com.akadns.net
0.0.0.0 v20.vortex-win.data.microsoft.com
0.0.0.0 vortex-win-sandbox.data.microsoft.com

OpenVPN

If you want to tunnel your connections through a VPN server, and you want to opt for a free VPN provider, your alternatives are RiseupVPN or ProtonVPN. Download the latest version of the OpenVPN software (make sure you don’t download the OpenVPN Connect) for Windows 7, download the ProtonVPN OpenVPN profiles from your account and import them into OpenVPN GUI.

If you want to use RiseupVPN, skip their software because it’s not compatible with Windows 7 and instead use my conversion tool to obtain a OpenVPN profile that can be imported into OpenVPN GUI.

You can create a VPN killswitch that will only allow Internet connections through the VPN server and drop all connections outside (as much as Windows and Windows Firewall allow it, there are always exceptions).

Wireguard

If you want to use Wireguard instead of OpenVPN, download the latest version and install it. Download the ProtonVPN Wireguard configuration files from your account and import them into the Wireguard client.

File transfer

File transfer can be securely done between your main computer and the Booklet by using Tor transport (Ricochet Refresh is amazing for that, install a 32bit release). Just make sure you don’t use SMB Network shares under any circumstances.

Mozilla Firefox

Remember to install uBlock Origin on your Firefox, and tweak your Firefox installation to not leak so much telemetry data.

Open about:config in Firefox and make sure the settings below are setup as below (they should be if you’re on ESR):

toolkit.telemetry.archive.enabled = false
toolkit.telemetry.enabled = false
toolkit.telemetry.unified = false
toolkit.telemetry.unifiedIsOptIn = false
toolkit.telemetry.bhrPing.enabled = false
toolkit.telemetry.firstShutdownPing.enabled = false
toolkit.telemetry.hybridContent.enabled = false
toolkit.telemetry.newProfilePing.enabled = false
toolkit.telemetry.reportingpolicy.firstRun = false
toolkit.telemetry.shutdownPingSender.enabled = false
toolkit.telemetry.updatePing.enabled = false
browser.newtabpage.activity-stream.feeds.telemetry = false
browser.newtabpage.activity-stream.telemetry = false
browser.ping-centre.telemetry = false
browser.vpn_promo.enabled = false
devtools.onboarding.telemetry.logged = false
datareporting.healthreport.uploadEnabled = false
datareporting.policy.dataSubmissionEnabled = false
experiments.activeExperiment = false
experiments.enabled = false
experiments.supported = false
network.allow-experiments = false
toolkit.telemetry.rejected = true
toolkit.telemetry.coverage.opt-out = true
datareporting.sessions.current.clean = true
toolkit.telemetry.server = ""
toolkit.telemetry.prompted = 2
app.normandy.enabled = false
extensions.pocket.enabled = false
identity.fxaccounts.enabled = false

For improved security you should also keep JavaScript disabled:

javascript.enabled = false

WebGL should be disabled for privacy reasons:

webgl.disabled = true

Some more settings that should be disabled for security and privacy reasons:

beacon.enabled = false
privacy.firstparty.isolate = true
privacy.resistFingerprinting = true
device.sensors.enabled = false
device.sensors.motion.enabled = false
device.sensors.orientation.enabled = false
dom.battery.enabled = false
geo.enabled = false
dom.event.contextmenu.enabled = false
dom.event.clipboardevents.enabled = false
dom.gamepad.enabled = false
dom.push.enabled = false
dom.push.connection.enabled = false
dom.webnotifications.enabled = false
media.eme.enabled = false
media.peerconnection.enabled false
network.predictor.enabled = false
permissions.default.camera = 2
permissions.default.geo = 2
permissions.default.microphone = 2
permissions.default.desktop-notification = 2
permissions.default.xr = 2
browser.eme.ui.enabled = false

Games

Sid Meier's Alpha Centauri

Good old Games is your best friend, the old games work without a problem, the only thing to consider is that some of the old games are looking for a fixed resolution, like 1024x768 or 800x600, and Booklet’s atypical resolution of 1280x720 will make some games complain. Don’t be afraid to use Compatibility mode!

Tips

To uninstall a specific KB:

C:\Windows\System32> wusa /uninstall /kb:30000000 /quiet /norestart

To run some Windows 8+ applications on Windows 7, install Windows 7 API Extensions.

To create a system restore point from the command prompt:

C:\Windows\System32> wmic.exe /Namespace:\\root\default Path SystemRestore Call CreateRestorePoint "System Restore", 100, 7

I'll Read It

sizeofcat.nospam@riseup.net (sizeof(cat)) — Wed, 27 Dec 2023 03:22:38 +0000

Manuel Moreale started a cool project, saying:

If you decide to start a blog in either English or Italian, I’ll read it. I don’t care about the topic. Start a blog, write something, send it to me, and I’ll read it. And you’ll have your first reader. If you add an RSS feed to your blog, I’ll add you to my reading list, and I’ll keep reading what you post.

So, if you write in English or Catalan, I’ll read it. Send it to my email address.

Advice

sizeofcat.nospam@riseup.net (sizeof(cat)) — Sat, 23 Dec 2023 20:17:44 +0000

If there’s any single bit of advice I could give to younger people it would be this: Do not leave your youth without having: 1. a “thing” that you do or a “skill” at which you are better than everybody else, and 2. an overarching project or project that you would rather die than not finish, that makes use of that thing or skill.

Love, sex, family, children, a comfortable life, hedonism, all of these things are potentially good but if your life isn’t “for the sake of something” AND if you don’t feel like you have something you do every day (or at least most of the time), in which you are at your peak form and you feel like your whole soul is being actualized for its true purpose, you will be unhappy. Unless you are a normie, then maybe you can get by with just a big TV, newest phone and a mediocre family, I don’t know.

I think this viewpoint has been badly skewed by modern culture which distorts it into “Make enough money to live well” as well as “Have ‘hobbies”. Fuck hobbies, like I said the idea of not engaging in this life-long project needs to be terrifying to you and you need to be willing to suffer greatly for it, or it’s just another subset of hedonism.

Listen to your soul and figure out what it is for you. Sometimes it starts by just listening to what pisses you off. Ask yourself, why does it piss me off that all existing operating systems suck? Why does it piss me off that I have this haphazard insight into the true meaning of this sacred text but all these so-called experts with 40 years of philological experience miss the forest for the trees? If you follow this feeling, you’ll find your calling. Unfortunately so many people these days are instinctive materialists who can’t even conceptualize anything beyond satisfying the material needs of their meaningless organism, let alone conceptualize the universe, human destiny, etc., as a whole. If people could see those things again, they would find it easier to connect the dots latent in themselves and project their itinerary.

Happy New Year!

2023 in review

sizeofcat.nospam@riseup.net (sizeof(cat)) — Mon, 11 Dec 2023 13:28:37 +0000

It’s that time of the year again, when you count your blessings and retweets, and claim the moral high-ground on social media.

The wildest era of the old West is over. With the creation, publication and global adoption of normatives, processes and regulatory bodies aiming to the international global homologation of knowledge and procedures (e.g. The Information Technology Infrastructure Library), Information Systems are controlled to the detail by huge corporations and nation-states.

Long gone are the days when foreign actors offered Saddam Hussein remote access to the US railroad system, or a minor disgruntled insider wiring millions of dollars to bank accounts outside country. There’s little space for cowboys and shinobis, you live in a world of contractors and certifications, schedules to meet and reports to complete. Cyberpunk life is here, it’s just not as good as we expected it to be.

But rejoice, my little friend, the long shadow of war is upon us. As if waiting for spring, it is possible in the short-term that from the flesh of thousands of anonymous heroes dying in Eurasian and Middle Eastern trenches, the foundations of a new, more dynamic, fluid, compartmentalised and intrinsically decentralised international order will rise. Let’s raise our glasses for that.

This year can be summed up this way:

The line between stupid people and animals becomes more and more blurred every day.

Best

Movie watched this year: Charly, 1968, the story of an intellectually disabled man undergoes an experiment that gives him the intelligence of a genius. Based on the Flowers for Algernon short story by Daniel Keyes.
Movie of the year: I don’t usually watch movies made after 2015 (especially Western-made) unless I have very good reasons, but Three-Body was an amazing TV series. Just don’t watch the new Netflix junk, kids.
Music album listened this year: Эхопарк by Sirotkin.
Song of the year: Black Seminole by Lil’ Yachty, with Выше домов by Sirotkin a very close second.
Book read this year: The Betrayal of the West, by Jacques Ellul.

Worst

People, social media, art, literature, cinema, society, governments, po{RN}litics, the Internet.

Website

91 articles, 61,898 words worth, up from 82 articles and 35,578 words in 2022, including posts, projects, reviews, music and excluding links and notes, of course.
816 notes posts, 43,414 words worth, up from 464 posts and 30,270 words in 2022.
used 1,15GB of disk space, up from 609MB in 2022.
more website statistics.

As for me, I believe in whatever political ideology kills the most people. I’m joking, or so you’d think. Onward to the new year.

Oh, and pray for a world where our children become wolves.

A cat

sizeofcat.nospam@riseup.net (sizeof(cat)) — Wed, 06 Dec 2023 02:10:05 +0000

Last week I noticed there’s a cat outside, so I buy a bag of dry food and a can of chicken, but the cat’s gone. Couple nights later the cat’s back. I give her the chicken. She came back tonight.

I sit next to the cat on the stairwell as she eats. A few things come to mind. How does she survive out here alone? I guess from eating the odd garbage here, few rodents there. But also from people like us. I’ve known for years that cats are just opportunists. When they rub themselves against your calf or sniff your hand, or you run your hand on and along their smooth backs into that surprisingly stiff tail muscle, it’s all for show. They learned to do this because we like it and reward them with food – nothing more. Because it looks like love, they do it for us, and we give them food. Thousands of years later, this relation stands unchanged. The Egyptians even revered them as gods. But really, they’re just cats. They sit, they eat, they shit, they sleep. And this is all just a transaction.

I didn’t know this as a kid, but I do now.

The cat appears to relax. She places a paw on my foot and extrudes her claws. A minute later, she runs through my crisscrossed legs, a sign of comfort. When I lean back on the stairwell door, it creaks and she briefly freezes. For all she knows her death is right around the corner. But nothing happens. Seconds later she relaxes and goes back to eating.

The sky is black and all I hear is rain. I get up, and go back inside.

Zivert: В мире весёлых

sizeofcat.nospam@riseup.net (sizeof(cat)) — Mon, 04 Dec 2023 02:27:04 +0000

В мире весёлых (In the World of Fun) is a departure from Zivert’s vintage sounds and a search of those forms and genres that today reflect her inner world and state of mind. This album takes Zivert a little into the world of African percussion, into the world of disco house, jazz house, New York garage house from the 80s and house with vocals in the spirit of the Moloko song “Sing It Back”.

I had a difficult year when I literally fell to the emotional bottom, but I found the strength to revive myself — both physically and mentally. Now I am super charged, full of inspiration to write new music. That’s my goal. I want to please people who love my work with new songs, new music videos and all that is actively born in my head every day. I write songs to people who need them at a given time in their lives. The most important thing is that music helps them, and in some situations it is for them a small separate world, a fictional island of happiness, where they can escape from their problems and everyday routine. That’s my mission. Zivert

Track listing

“Место”
“Бери И Беги”
“Мятные Поцелуи”
“Очень Одна”
“Счастье”
“Над Крышами”
“Любовь”
“Джин”
“Джокер”
“Думайдумай”
“Птицы Летят За Музыкой”
“На Свет”
“Карма-Киллер”
“Выживут Человеки”

Shitty feelings

sizeofcat.nospam@riseup.net (sizeof(cat)) — Fri, 17 Nov 2023 09:02:17 +0000

Shitty feelings, in no particular order:

realizing your current wage or salary isn’t enough to afford a decent place to live.
realizing you’re turning into your parents.
realizing your parents had many more flaws than you could see when you were younger.
realizing the career or skillset you’ve spent years of your life on, is worthless.
realizing you have nothing to offer anyone in a relationship besides being yet another somewhat desperate 20-something whose bank account isn’t empty.

Сироткин: Эхопарк

sizeofcat.nospam@riseup.net (sizeof(cat)) — Sun, 24 Sep 2023 00:03:15 +0000

There are days when I don’t need anything at all except the emptiness of consciousness and Sirotkin’s songs pouring out of my headphones. Sometimes I’m outside, in a bad mood, and I want something that will level the pits of resentment, fatigue, loneliness and uncertainty. Don’t we all have such days?

And sometimes it’s also so annoying this adult life that made me forget who I am. You have to work, work, and there is no time and opportunity to admit to yourself that everything is not going the way you want, and how I imagined it when I was younger. And then I want someone to understand, just understand and accept this melancholy.

Sirotkin’s performances are what the performances of real musicians should be – his own. He doesn’t pretend to be a star, or a tortured rock musician, he just sings the songs he composed. Give a chance to a young guy with a guitar while he still sings what he wants, not what the producers want, and let’s hope together that everything will be the same for him in the future!

Track listing

“Выше домов”
“Рассвет”
“Лисы волки”
“Лилии”
“В пламени ракет”

Have the courage to be a loner

sizeofcat.nospam@riseup.net (sizeof(cat)) — Sat, 16 Sep 2023 15:21:17 +0000

Life is just the intersection of fate and free will. We call that destiny.

The fate part can be hard to swallow depending on what it is, and free will can sometimes feel more of a burden than a joy. But we should recognise it for what it is and understand that we are the captains of our ship. We can’t change the weather but we can steer the ship. And there’s some comfort in knowing that we have a bit of control and aren’t simply fated to be tossed around by the waves of life. If you feel like you’re being dragged down under, maybe it’s time to shift your focus to the steering wheel. You could be missing safe harbour just off the horizon and all you’ve got to do is turn hard. Do something different with your life.

Have the courage to be a loner. Maybe things will work out for you better than you could ever have imagined.

What did hermits of the past do when they got soul sick for companionship? When you long for something, usually you make do with a poor alternative of the thing. The body always finds a way to re-establish homeostasis.

If the possibility of human interaction being regarded as a negative really seems that alien, you must be way too social for your own good.

Read Kierkegaard, learn that regardless of what you pick, solitude or companionship, you will regret it. Now, instead of despairing at it, this should be freeing. Regardless of what you do, you will regret it, the result will always be the same. That miserable stability, once properly rationalized, will give you foundational security and from that paradox of the truth of life you can begin to hope.

The world is comedically cruel and absurd in that way.

Getting the Mi Band authkey from an iOS device

sizeofcat.nospam@riseup.net (sizeof(cat)) — Fri, 08 Sep 2023 20:51:04 +0000

If you want to play with your Xiaomi Mi Band{4,5,6,7} without using the official application (Zepp/MiFit) you can do that, but there are some steps before you can pair your band/watch to your favorite Linux distro.

New devices (and older devices with updated firmware) require server based pairing. This means, that you absolutely must use the original MiFit/Amazfit/Zepp app to make the initial pairing, retrieve the pairing key and then use this key.

Currently, Mi Band 4, Mi Band 5, Mi Band 6 and Mi Band 7 are known to be the first devices with this enabled from the beginning. You must not unpair the band/watch from the original application (Zepp, MiFit) because that will change the device’s Bluetooth MAC address and a new auth key will be required (auth keys are based on the device’s MAC). Every time you hard reset the band/watch, the Bluetooth MAC address will be changed and you must get a new key.

As prerequisites, you should have Zepp Life installed on your device, create an account and pair the band/watch with your Apple device.

There are multiple ways of retrieving the authkey if you’re using an Android device (rooted or not), but if you want to do the same thing on an iOS device (iPhone), things get more complicated: you will need to jailbreak the device.

I won’t talk about a specific way of jailbreaking your device because it depends on the device hardware and the installed iOS version, but this site will help you alot in your Apple-freedom quest. Basically it’s either palera1n, checkra1n or unc0ver.

When your device is jailbroken and you have SSH access to it, next you need to figure out Zepp Life’s uuid and you can do that by grepping for a specific string inside the place where applications are stored on iOS: /var/mobile/Containers/Data/Application/. This part is done on the device itself via SSH command, so ssh mobile@192.168.x.x first, replacing 192.168.x.x with your device’s IP address.

$ ssh mobile@192.168.x.x
mobile@192.168.x.x's password:
iPhone:~ mobile% grep -rli "Zepp Life" /var/mobile/Containers/Data/Application/
/var/mobile/Containers/Data/Application/3BDFBA67-9BC4-47EC-B1DC-738AE491CC32/Library/Preferences/HM.wristband.plist

Now that you know the uuid (3BDFBA67-9BC4-47EC-B1DC-738AE491CC32), use scp to retrieve the SQLite database from the iOS device, replace 192.168.x.x with your device’s IP address. Also, keep in mind that the uuid changes each time you reinstall the application, Zepp Life in this case, so the uuid will be different for you.

$ scp mobile@192.168.x.x:/var/mobile/Containers/Data/Application/3BDFBA67-9BC4-47EC-B1DC-738AE491CC32/Documents/HMDBDeviceInfoDataBaseV2.sqlite HMDBDeviceInfoDataBaseV2.sqlite
mobile@192.168.x.x's password:
HMDBDeviceInfoDataBaseV2.sqlite

Make sure you have the sqlite3 package installed.

$ sqlite3 HMDBDeviceInfoDataBaseV2.sqlite
SQLite version 3.39.5 2022-10-14 20:58:05
Enter ".help" for usage hints.
sqlite> select deviceOAuthKey, deviceID, macAddr, serialNumber from device_info;
BEF16FB4835124FF77FAE01A35CAEBAF|FFFBA9FFFE77B0CD|FFFBA977B0CD|17445/40431977
sqlite>

You will only need the first part, BEF16FB4835124FF77FAE01A35CAEBAF in my example (it’s all fake data anyway), that’s the auth key. If you want to retrieve all the application data you can use scp to recursively download all the needed files.

$ scp -r mobile@192.168.x.x:/var/mobile/Containers/Data/Application/3BDFBA67-9BC4-47EC-B1DC-738AE491CC32 3BDFBA67-9BC4-47EC-B1DC-738AE491CC32/

Notice the -r (recursively) flag. You might be interested in the Documents directory, and inside it will be a numeric directory with your uid (similar to 7149747118, for example) which will hold the SQLite databases containing your band/watch data.

Once you have the auth key you can use various applications and libraries to interact with your band/watch and will no longer require the original Zepp Life (or MiFit) application.

One line password generator

sizeofcat.nospam@riseup.net (sizeof(cat)) — Thu, 07 Sep 2023 13:17:22 +0000

Quick guide for people who want to have a quick way to generate a random password without unlocking their favorite password manager. The only requirement (if you want clipboard copy) is xclip which can be installed on your distro from its package manager.

$ < /dev/urandom tr -dc "A-Za-z0-9_+$?=/\@!%&#()-" | head -c 32

The above command takes output (redirects) from /dev/random, passes it through tr by filtering all characters except the ones explicitly defined and cuts the resulted string after 32 characters. If you want more/less than 32 characters, adjust that part.

To copy the resulting string to clipboard:

$ /bin/sh -c '< /dev/urandom tr -dc "A-Za-z0-9_+$?=/\@!%&#()-" | head -c 32 | xclip -sel clip'

You can manually configure a menu item for Gnome/Xfce applications menu by copying this snippet of code to ~/.local/share/applications/passgen.desktop:

[Desktop Entry]
Name=Random password generator
Terminal=false
Type=Application
Comment=Random password generator
Icon=gdu-encrypted-lock
Exec=/bin/sh -c '< /dev/urandom tr -dc "A-Za-z0-9_+$?=/\@!%&#()-" | head -c 32 | xclip -sel clip'

From a Globalping probe to ... something else

sizeofcat.nospam@riseup.net (sizeof(cat)) — Sat, 02 Sep 2023 18:07:35 +0000

A friend who read my how to turn a Ripe.net probe into a OpenWRT router article gave me a Globalping hardware probe to play with, two conditions attached: don’t expose any private information that might be hardcoded into the probe and return it with the same firmware. Because of his request, I’ll do this the “paranoid” way (no boot logs, no SD card manufacturer shown, no default firmware upload, etc) so this will basically be a short tutorial of how to connect one device to another via serial console and various hardware information about the probe.

What is a Globalping hardware probe, you might be asking yourself right now. Well, it’s pretty simple:

Globalping is a platform that allows anyone to run networking commands such as ping, traceroute, dig, curl and mtr on probes distributed all around the world. Our goal is to provide a free and simple service for everyone out there to make the internet faster. You can use it to optimize your anycast network, monitor your latency, debug routing issues and even check for censorship in different countries. source

Globalping is a service from jsDelivr and allows users to perform network tests (such as ping, mtr, dig, etc.) on probes all over the world through a simple HTTP RESTful API. It’s very similar to a much older RIPE Atlas hardware probe and people who know me would understand that I will not connect such a device to the Internet from my LAN unless heavily sedated (which is not the case right now) but it is what it is. It mostly likely doesn’t do anything nefarious but it definitely opens your local network to a whole new world of pain.

It does have a serial number and it’s probably tied to the identity of the person it’s sent to.

The probe seems secure, there is no shell access on it and you can only ssh into the logs user account to view … logs. Once you connect it to the Internet and power it up, figure out its IP from your home router and connect to it:

$ ssh logs@x.x.x.x

Package

probe inside a tiny metal case that’s quite pretty
1x 32GB SD card.
1x short CAT5e Ethernet cable
1x USB-A to MicroUSB power cable
1x AC adapter
instructions
some stickers for your laptop if you’re into that kind of fetish

Hardware

Opening the metal case can be done easily, there are 4 screws on each side and you only need to remove one side-panel to slide out the heatsink with the board secured on top. No glue involved!

The Globalping probe is actually a generic NanoPI NEO V1.4 SBC with 512MB RAM.

Component	Description
CPU	Allwinner H3, Quad-core Cortex-A7 Up to 1.2GHz
RAM	512MB DDR3
Ethernet	10/100M
MicroSD slot	✓
GPIO	2.54mm pitch 36pin. It includes UART, SPI, I2C, IO etc
Power supply	DC 5V/2A

Guide

I have to admit I didn’t expect to have serial console pins on the board (not really familiar with the NanoPi hardware) and I was prepared to dump the flash from the uBoot prompt but fortunately the pins were present and usable.

You should make a copy of the original SD card, just in case. Pop it inside a computer and use dd to make a copy image (and make sure you have 32GB of free space on the disk):

$ sudo dd if=/dev/sdb of=globalping.img bs=4M status=progress

Zip it somewhere for safekeeping and binwalking, but there is nothing special about that image.

Start by downloading a Linux image: you can use DietPI, Armbian, Debian, Ubuntu, OpenWRT, Android, etc. I decided to use the FriendlyWRT “distro” provided by FriendlyElec. Unzip the h3_sd_friendlywrt_4.14_armhf_20210512.img.zip file to reveal a ~1GB image file that will be written to a new SD card. Make sure your SD card is /dev/sdb or adjust the line below.

$ sudo dd if=h3_sd_friendlywrt_4.14_armhf_20210512.img of=/dev/sdb bs=2M conv=fsync

Eject the SD card when it’s done writing.

Since NanoPi NEO does not have a HDMI connector you will need to find a USB-to-Serial converter (like a Sparkfun FTDI Basic 3.3V for example) and connect 3 pins (RX, TX and GND) from your probe to the USB-to-Serial board.

For the Sparkfun FTDI Basic 3.3V board, the connection is done like this: RX to TX, TX to RX, GND to GND.

NanoPI NEO	Sparkfun FTDI
1 (GND)	GND
3 (UART0_TX)	RXI
4 (UART0_RX)	TXO

Connect the USB-to-Serial board to a free USB port on your computer and install minicom.

$ sudo apt update && sudo apt install minicom

Figure out which of the connected serial devices is your USB-to-Serial converter:

$ sudo dmesg | grep tty
[ 43013.659214] usb 2-1: FTDI USB Serial Device converter now attached to ttyUSB0

Start minicom and connect it to your serial device:

$ sudo minicom -D /dev/ttyUSB0 -b 115200

Insert the newly-written SD card into the microSD slot on the NanoPI, connect the MicroUSB power cable and you will get serial output from the board after few seconds. After it’s done booting press ENTER and you’ll get into the root console, use the ip utility to find out NanoPI’s IP address (if you didn’t forget to plug the Ethernet cable into your router).

Once you have the IP it’s just a matter of entering that address into a browser on a machine that’s on the same LAN and you’ll get inside the OpenW… I mean FriendlyWRT’s LuCi interface.

Important

Do not forget to pick a new root password when you first login into LuCi else the Russian and Chinese (never the American ones, no sir!) hackers will spread your nudes all over the Internet.

Also, if you installed a stock OpenWRT firmware you will need to resize the root partition and filesystem else it won’t use the whole SD card (provided you have a SD card bigger than 256MB). FriendlyWRT doesn’t have this problem but you will need to upgrade a bucketload of stuff with opkg if you use FriendlyElec’s alternative.

# opkg update
# opkg install parted losetup resize2fs
# parted -s /dev/mmcblk0 resizepart 2 100%
# losetup /dev/loop0 /dev/mmcblk0p2
# resize2fs -f /dev/loop0
# reboot

If you use the squashfs OpenWRT image the steps above won’t work.

Globalping API

I didn’t bother too much with the API (like I said, I will not connect the probe to the Internet under any circumstances) but if you want to play with it use Postman, Globalping’s interface or cURL to perform API requests. Assume all requests are logged.

To do a ping to google.com from Brazil (BR country code) first do a request to https://api.globalping.io/v1/measurements to get a request ID.

$ curl --location 'https://api.globalping.io/v1/measurements' \
 --header 'Content-Type: application/json' \
 --data '{"type":"ping","target":"google.com","measurementOptions":{},"locations":[{"country":"BR","limit":1}],"inProgressUpdates":true}'
{
 "id": "8J5o398DhgRea92H",
 "probesCount": 1
}

And afterward do a GET request to https://api.globalping.io/v1/measurements/REQUEST_ID where REQUEST_ID is the id from the previous API call.

$ curl --location 'https://api.globalping.io/v1/measurements/8J5o398DhgRea92H'
{
 "id": "8J5o398DhgRea92H",
 "type": "ping",
 "status": "finished",
 "createdAt": "2023-04-20T12:09:05.125Z",
 "updatedAt": "2023-04-20T12:09:06.312Z",
 "target": "google.com",
 "probesCount": 1,
 "locations": [
 {
 "country": "BR"
 }
 ],
 "results": [
 {
 "probe": {
 "continent": "SA",
 "region": "South America",
 "country": "BR",
 "state": null,
 "city": "Sao Paulo",
 "asn": 47787,
 "longitude": -46.6361,
 "latitude": -23.5475,
 "network": "EDGOO NETWORKS LLC",
 "tags": [],
 "resolvers": [
 "private"
 ]
 },
 "result": {
 "status": "finished",
 ...
 }
 }
 ]
}

If you’re wondering by now if there are any probes inside North Korea, no there aren’t, feel free to check, the ISO 3166 country code for North Korea is KP. But there are probes in Russia and China.

Photos

Additional links

Yesterday

sizeofcat.nospam@riseup.net (sizeof(cat)) — Thu, 31 Aug 2023 17:03:35 +0000

I no longer believe that I will get to live in the future I dreamed of when I was growing up.

I grew up in a low-to-middle class suburban area, just few kilometers outside my country’s capital city. On a warm summer night, if I listened hard enough, I could hear the city buzzing - a siren from a police car, an occasional motorcycle screaming down the street, a helicopter sometimes, an airplane if we were lucky. But that’s the city.

I grew up in a two story house that my father and my grandfather built themselves. We had a nice backyard where mother used to plant flowers, a garage for the family car. The whole street was like that. I was a kid. There were so many kids, I couldn’t even count them all.

Everyone took care of everyone.

I could go to my best friend’s house and just walk in there, up the stairs and into her room. We’d take turns playing on her computer, I believe it was Diablo. Her mom would always bring us snacks and icecream.

Our parents all had cars.

My parents certainly remember a time when nearly everyone they knew would watch the same primetime TV at the same hour, and the next day everyone would talk about that particular episode. That’s definitely gone, with streaming and personalised recommendations and the decline of conventional TV.

This is your life, is it everything you dreamed that it would be when the world was younger and you had everything to lose? Switchfoot

Even though I never learned how to ride one, everybody had bicycles, we’d go to the local abandoned places and explore. There used to be an old and abandoned excavator, it was huge and powerful and at the same time had a very comfortable feeling. Perhaps the person who used to operate it in the past would sit there, move some dirt, perhaps drink some coffee, read the paper and at the end of the day go back to his family.

It was as big as a house.

Back then I thought that when I grow up and have my own house and my own kids, they would get to experience all the same things and they would get to dream and play and grow up… But no, the same type of house that I grew up in, now would cost me an insane amount. I am not okay with this but then again I have no idea how to change anything about the situation.

When I was a kid there were older men in my neighbourhood that would just work on their cars in their front yards, smoke cigars, hang around drinking beer and talking about football. They seemed so happy.

I can’t imagine ever having that again.

When I look back

I see the landscapes
That I have walked through
But it is different

All the great trees are gone
It seems there are
Remnants of them

But it is the afterglow
Inside of you

Of all those you met

Who meant something in your life. Olav Rex, August 1977

Captain Blackbeard Radio #18

sizeofcat.nospam@riseup.net (sizeof(cat)) — Mon, 28 Aug 2023 22:15:17 +0000

#18: Bet Yer Life, CaptainBlackbeard!

In this episode, we follow America’s number one game show host, Wink Payola. As we find out what America’s favorite son, does with the other twenty three hours of their day?

This episode is the most ambitious thing we have ever attempted. Bet Yer Life, CaptainBlackbeard is a hilarious, wild and darkly fascinating story that explores Media, Consumerism, Greed, Fame. And what it is to live on the dark side of the internet. The highs and lows that come from it. This story is also strongly about AI technology, how incredible it is and the consequences of how fast it’s progressing.

Bet Yer Life, CaptainBlackbeard was a whole lot of fun to make for ye! This story ties up a lot of different things in the CaptainBlackbeard Universe, and marks the beginning of a new era for CaptainBlackbeard Radio. It is challenge to create the right balance for ye, mates. When we come up with an idea for the show, it evolves into deeply rich universes that could span many hours to tell the full story of. However, we respect yer time and do not wish to Tommy and Pam ye. So we hope ye enjoy this wild and darkly hilarious story that we promise ye, everything works out in the end.

Your browser does not support the audio element.

This episode also features a number of the wild humor and short pieces ye have come to know and love CaptainBlackbeard Radio for. As well as the best soundtrack on either side of the Dark Seas!

We view CaptainBlackbeard Radio, as existing and being created in different eras. We feel a new era began with #17 and has exploded with this episode. This is truly the most exciting and ground breaking time for this project. When we started, we loved bringing ye classic film epics, because we wanted to give ye the best possible auditory thrill ride and hopefully have ye feel the wonderful feelings we did when we experienced those epics. However, now, with this new technology. We can create everything, ourselves. Everything ye hear in this episode, outside of the opening, was created with current generation or the previous generation technology. This is game changing in every way imaginable.

We had a lot of fun, pushing our AI Voice Actors to their limits. We hope ye enjoy it as well. As with all our broadcasts, this one is highly experimental. But we think this is one of the best stories and productions we have ever put together.

Mates, this is the most exciting and wonderful thing we could be doing in right now. The technology used in this project has exploded into a golden age. This project has advanced from beginning with completely archaic, difficult to understand, 1980s technology. To now mind bending, reality shattering incredible technology that is advancing so quickly, with each generation being game changing. This technology will change the world and completely shift the creative balance away from the current monopolized power structures. Much like how animation is an altered medium where anything is possible visually. This new technology is exactly that but with sound. We hope ye give this episode a listen, if for nothing else, just to hear and experience what is possible now and how incredible, mindbending and game changing this new technology is!

Music From

Floydshayvious
President of the United States
Viagra Boys
Franz Ferdinand
Charles Bradley Featuring Menahan Street Band
Nightbus
Perturbator
Wooden Shjips
The Moody Blues
Kid Machine
Jim Johnston
Pylot
Fun Lovin’ Criminals
Taylor Swift
Notice
Digitalism
RE-PLUS
FEARCITY
The Oh Sees
Pulp
The Echocentrics (Feat. Alex Maas)
…And so many more!

Guest Stars

Taylor Swift
Joe Pesci
Alex Jones
Michael Jackson
Billy Mays
Joe Biden
Barack Obama
Joe Rogan
John Madden
Sir David Attenborough
Tucker Carlson
Heath Ledger
Klaus Schwab
Bill Gates
Mario Lopez
…And so many more!

Links

https://endchan.org/.media/a27ce30e8d584663738cfc76af3e0e4d-audiompeg.mp3

https://redcircle.com/shows/CaptainBlackbeard

Magnet

The (currently) complete collection, contains EP 1-17 (MP3), all corresponding poster art and additional art, total download size 3.02GB.

magnet:?xt=urn:btih:65b8065e7ad108c728c32dda9871177b1c06b1db&dn=Captain%20Blackbeard%20Radio%20Ep%201%20-%2017&tr=udp%3a%2f%2ftracker.opentrackr.org%3a1337%2fannounce&tr=http%3a%2f%2fopenbittorrent.com%3a80%2fannounce

CaptainBlackbeard Radio is a universal pirate radio humor and music broadcast unlike anything ye have ever heard, for the lads and lasses of action across the Dark Seas.