m4.rkw.io

l0destar

2026-05-10T20:19:00Z

I have begun a project to create the world's best open-source vehicle tracker.

Read about it here: https://l0destar.com

GL.iNet GL-RM1 Comet KVM over IP

2026-04-20T18:39:38Z

I bought one of these recently at the suggestion of Casey Liss of atp.fm.

Firstly I will say it's a great device, very useful and has native Tailscale support. I got the non-PoE version which is slightly different to the one that was recommended on ATP but it's nonetheless very good.

Refreshing: a workaround to fix kernel panics on macOS with refresh rates higher than 120Hz

2026-03-05T18:21:21Z

Refreshing

A macOS menu bar app that prevents kernel panics (DCPEXT PANIC) on Apple Silicon Macs with external monitors running above 120Hz.

The Problem

MacOS Tahoe rounded corner fix

2026-02-21T20:26:04Z

I couldn't cope with those corners anymore. This requires disabling SIP but it makes the corners like Sequoia system-wide. I don't like to disable SIP but those corners hurt my eyes too much. Enough is enough. This uses DYLD injection to patch the NSThemeFrame methods that determine the corner radius.

https://github.com/m4rkw/macos-corner-fix

made my own night mode

2026-02-09T20:13:26Z

It seemed a shame that the night mode on the latest WatchOS was so good yet we're stuck with the same display in sleep mode. So I made my own focus mode, used Shortcuts automations to make it activate with the sleep schedule and made a custom watch face in night mode.

Remotely executing shortcuts on iOS

2026-02-06T19:21:54Z

This isn't an exploit, I just wanted to be able to execute a shortcut on iOS via a remote trigger. Specifically I wanted to dynamically change the complications on my Apple watch depending on context, for example if I have calendar events later today then show the calendar as a complication but if I don't then show something else.

Stateful workout shortcut

2026-01-17T20:52:37Z

I made a stateful shortcut for the Apple Watch Ultra action button: Stateful Workout Shortcut

It starts an outdoor walk workout and then enables the water lock to avoid humidity from my clothing causing unexpected inputs. Press the action button again and it stops the workout and disables the water lock.

Not sure why the action button works while water locked but it's very handy, I hope they don't change that.

How to run Tailscale on AWS Lambda

2025-06-24T18:41:31Z

Just in case anyone thought I was joking about running Tailscale on AWS Lambda, this is how: aws-lambda-python312-tailscale

Tailscale ephemeral nodes as the ultimate MMORPG superweapon

2025-06-22T12:46:42Z

People often talk about Tailscale but don't seem to mention its ephemeral nodes and their awesome power as an MMORPG weapon so I thought I'd address that. There are many MMORPGs but my all-time favourite is AWS which I play as an extremely stingy but also quite rich and entitled hacker. This character choice works well within the game dynamic as the object of the game is obviously to run your workload for as little financial outlay as possible.

The bog standard default way of running things on AWS is to use EC2, but one glance at the in-game pricing for this will make you quickly realise this is not a viable way to win. Managed services can sometimes be a good cost-effective alternative, but for those of us playing super stingy characters who just want their personal stuff to run for as close to free as possible, these too are usually unviable options. Serverless is therefore where the real action is at and how you can truly win at this game.

It's not without its limitations though and there are many crafty ways the game monetises its side channels and ancillary services in order to extract profit from the player. Take for example AWS Lambda, on the surface for smaller workloads this can be close to essentially free compute. That only works until you need a state store though, and depending on what you're doing pay-as-you-go DynamoDB can quickly add up to unacceptable costs. My in-game bill was recently creeping over the $5/month mark so I decided to have a think about my strategy and see if I could level up by levelling down my bill. The observant reader might wonder if hours of my time are really worth the potential cost savings here, all I can say is that some people will just never understand gaming.

How to run Tailscale on a Synology rt6600ax router

2025-02-25T09:00:48Z

Steps for installing Tailscale on a Synology rt6600ax. The same steps will probably work on the 2600 but I haven't tried it.

1) SSH to the router as root

2) Retrieve the package for DSM7 / ARMv8:

Synology SRM 1.3.1, a thoughtful review of the latest software release

2025-02-05T00:00:00Z

Originally posted on the Synology Community forum.

It's great to see the new SRM release - 1.3.1 - has recently dropped. Although a minor update, apparently adding only optimisations to the network connectivity check mechanism, this is a testament to the stability and resiliency of the SRM software in that dramatic changes are no longer required in order for their products to continue to operate well.

Those of us with Synology routers may cast our minds back to the late summer of 2022 when SRM 1.3.1 was released, adding much-wanted VLAN support for the older devices including the RT2600ac router. This update was unfortunately slightly problematic, resulting in an additional update - 1.3.1 - being pushed out on the same day.

How to auto-refresh LetsEncrypt certificate on Synology routers

2024-06-21T09:08:20Z

I've been manually monitoring and renewing it like a chump. Turns out it's trivially easy to automate the renewal:

```` curl https://gist.githubusercontent.com/m4rkw/6c9b65dcd4914e1aa03188d2b5d5c5b8/raw/09632a5be4dddf029916367dd9fa463cd3d3b9ae/gistfile1.txt -o /usr/local/bin/renew_cert.py

chmod 755 /usr/local/bin/renew_cert.py

Sim swap defence

2024-03-16T00:00:00Z

Several organisations still support SMS for OTP, often making it mandatory, and even when it isn't mandatory as the primary 2FA method it's often still enabled as a fallback, leaving you vulnerable. An attacker will always take the easiest path, you may have a passkey set up or even a hardware fido token but if it's possible to revert to sms-based OTP then you're just as vulnerable to a sim-swap as you would be without these extra tokens.

Defending against iCloud takeover if your phone is stolen

2023-10-24T21:02:00Z

Another security issue that's been rising in recent years is the advent of organised criminals shoulder-surfing iPhone passcodes in order to then later steal the phone and take over the iCloud account.

Unfortunate victims are then locked out of their account forever, losing precious iCloud data such as photos of their kids.

There are some steps you can take to protect yourself, such as using a longer/more complex passcode and being very careful where you type it to ensure nobody can see over your shoulder.

Defending against sim swap attacks

2023-10-24T20:46:00Z

Although for most people it's pretty unlikely, the thought of getting sim-swapped is pretty scary.

This is where an attacker manages to convince your mobile carrier to transfer your number to a new sim card that they control. When this happens your original sim card will lose service and they will obtain your number - and any SMS OTP codes it's configured to receive.

Unfortunately despite many improvements in online security there are still several providers who either rely on SMS OTP or make it a mandatory fallback option if your primary OTP mechanism doesn't work. You're only secure as the weakest link and nothing will stop an attacker from using the fallback mechanisms if they can't bypass your primary one.

Bye bye ProtonMail

2022-06-08T21:10:00Z

I recently blogged about my ProtonMail issues, the weird glitches with their bridge IMAP interface and their apparent lack of care that it might be silently deleting customer data - proton-bridge issue #220

I have now finally gotten around to kicking ProtonMail out of my life and I could not be happier. Gone are the days of having to run some janky Go software just to get an unstable IMAP interface. Gone are randomly changing message UIDs invalidating backups. Gone is the totally batshit way that messages can become orphaned from any folder and not show up anywhere other than "All Mail".

Suddenly I have normal IMAP that works, it even works on iOS (!) and in the webmail I can operate on more than 50 messages at once. I can in fact perform a quick operation on the entire resultset of a search. Try doing that in Proton's webmail. I have lost hours of my life to messing around just try to carry out basic operations on their platform and I'm so glad to be rid of it.

PSA: your ProtonMail backups might not be safe

2022-06-05T12:16:00Z

I was a fan of the ProtonMail email service until I was casually linked to this issue while discussing something else:

proton-bridge issue #220

TL;DR message UIDs returned by proton-bridge are unstable and subject to change without UIDVALIDITY changing. This is not only bad because it violates the RFC but also because it can lead to data loss in at least a couple of scenarios:

LuLu firewall hardening

2022-02-26T21:21:00Z

I'm a big fan of Patrick Wardle's free mac utilities but I noticed something odd about LuLu recently. It seems that it only filters egress traffic when LuLu.app is running. Since it normally runs as the local user rather than root, this makes it somewhat trivial for malware to defeat as it can simply kill the process and then connect to whatever it wants.

This can be mitigated by running the app as root, but since it's not installed root-owned the first thing to do is change that:

``` $ sudo chown -R root:wheel /Applications/LuLu.app/

Linux server hardening guide

2022-02-23T00:00:00Z

After working for some time as an engineer at a very security-obsessed company I decided it would be a good exercise to note down and organise all the things I've learned both at work and in my spare time related to Linux server security. This guide will focus on Linux in a server context but many of the ideas here are applicable to other systems.

The full guide is also available on GitHub: linux-server-hardening-guide

Guiding principles

TouchID over SSH part 2 - Secretive agent

2022-02-19T13:46:00Z

For some time I've been using a hand-rolled solution for touchID over ssh which I previously blogged about. Up until recently it's been a somewhat loosely-compiled scattering of config that wasn't really in a releasable form but with a pending security talk on the horizon I thought it would be worth tidying it up and making it releasable so I could mention it in my talk.

That code can be found here: touchid-remote

However when I was compiling it I was under the impression that one of the tools it relies on - touch2sudo - was merely a standalone binary for authenticating sudo commands locally. I didn't realise that the author had also noted in the README that it's possible to use it over SSH. The solution presented there involves forwarding the local ssh agent over the SSH connection and then configuring touch2sudo as the askpass agent.