Mr. Blue Coat

MOVED

noreply@blogger.com (Mr. Blue Coat) — Fri, 16 Oct 2026 01:07:10 +0000

This blog has moved to https://mrbluecoat.vivaldi.net/

Best Android spam call/text blocker

noreply@blogger.com (Mr. Blue Coat) — Mon, 12 Oct 2026 01:43:50 +0000

After testing a bunch of open source options, CallShield was the best. Install it and keep it updated via Obtanium.

Useful tool to remove Microsoft spying from Windows: O&O ShutUp10

noreply@blogger.com (Mr. Blue Coat) — Sat, 05 Sep 2026 15:36:41 +0000

We all know corporate tech giants spy on their users but we often don't realize the extent of that spying. The free ShutUp10 tool from O&O is a great way to not only disable that spying but become aware of it in the first place. Use it, disable all the recommended settings (except maybe not hiding the search bar) and spread the word!

Network stress test a DietPi system

noreply@blogger.com (Mr. Blue Coat) — Thu, 25 Jun 2026 20:33:03 +0000

apt install screen stress-ng htop

screen -d -m stress-ng --class network --seq 0 --exclude dccp,sctp --cpu-load 80 --timeout 1m

while true; do cpu; sleep 10; done

-----

Notes:

DCCP is defined in RFC 4340 as a proposed standard, though its implementation in the Linux kernel has been marked deprecated and was removed in version 6.16 due to lack of maintenance.
The SCTP module is often blacklisted by default in distributions like RHEL 8+ and Ubuntu for security reasons.

Radxa Dragon Q6A - a surprisingly good SBC

noreply@blogger.com (Mr. Blue Coat) — Mon, 18 May 2026 03:42:02 +0000

The SBC world is in a bit of a slump right now due to international tensions and inflationary pressure so I haven't spent much time in the space, but I recently came across this positive review for the Radxa Dragon Q6A and decided to try it out. I was able to grab the 6 GB version for $79 before it went out of stock at Arace Tech. The eMMC module and UFS module are sold out nearly everywhere so I opted for an NVME drive (M.2 M Key 2230 slot). For $79 in today's economy, the device is surprisingly agile thanks to its Qualcomm QCS6490 octa-core CPU. If you're in the market for a small ARM device, this is probably your best option at the moment. P.S. Make sure to also include the Armor Case 7056A heatsink, which works great for this device.

New unofficial MTG format: Destitute

noreply@blogger.com (Mr. Blue Coat) — Sat, 16 May 2026 13:40:23 +0000

I love playing Magic: The Gathering but I'm also competitive and am hard-wired not to lose if at all possible. That becomes problematic when teaching my kids the game because I generally win, which is not fun for them and they quickly lose interest. I've been looking for a 'handicap' that could level the playing field and came up with Destitute: cards that are legal in both Pauper and Modern formats:

Pauper	Modern	Destitute

Legal in Pauper but not Modern so NOT Destitute legal	Legal in Modern but not Pauper so NOT Destitute legal	Legal in Pauper and Modern so IS Destitute legal

I let my kids play Modern decks but I restrict myself to Destitute decks as a handicap. It has the right balance of challenge for me since it takes more work to develop a good Pauper deck and even though I don't win as often my competitive side is assuaged knowing it was only because I was limited in my options. As a bonus, Destitute decks are cheaper so I can make more of them!

Here are a few Destitute decks to give you some starting ideas:

Brave Origin on Linux

noreply@blogger.com (Mr. Blue Coat) — Wed, 06 May 2026 14:39:00 +0000

To install Brave Origin on EndeavourOS:

yay -S brave-origin-beta-bin

Then run SlimBrave Neo to further de-bloat.

P.S. If you want something more privacy extreme, try LibreWolf or Helium

Best Windows / Android antivirus for home protection

noreply@blogger.com (Mr. Blue Coat) — Wed, 15 Apr 2026 14:50:00 +0000

Trying to be as objective as possible, here are sources I trust:

Other options can be found here.

Note: other reputable sources, like PCMag and Cybernews and SoftwareLab, don't release full details of their internal testing so I don't include their recommendations in my scoring.

Each vendor gets 1 point for each perfect score given by the sources above. Each vendor gets -1 point for each non-perfect score given by the sources above. Vendors that are only included in a single source above are excluded.

Net results:

6 Kasperksy: +1 AV Comparitives, +1 AV Test, +1 AVLab, +1 SE Labs, +1 Testing Ground Labs, +1 AppEsteem

2 BitDefender: -1 AV Comparitives, +1 AV Test, +1 AVLab, +1 MRG Effitias

2 Elastic Security: +1 AVLab, +1 Virus Bulletin VB100

2 EmsiSoft: +1 AVLab, +1 Virus Bulletin VB100

1 F-Secure: -1 AV Comparitives, +1 AV Test, +1 AVLab

1 McAfee: +1 AV Test, -1 MRG Effitias, +1 SE Labs, -1 Testing Ground Labs, +1 AppEsteem

1 Microsoft Defender: -1 AV Comparitives, +1 AV Test, +1 AVLab, +1 SE Labs, -1 AppEsteem

1 Norton: +1 AV Comparitives, +1 AV Test, +1 AVLab, -1 MRG Effitias, +1 SE Labs, -1 Testing Ground Labs, -1 AppEsteem

1 Panda: -1 AV Comparitives, -1 SE Labs, +1 AppEsteem

1 Sophos: -1 MRG Effitias, +1 SE Labs, +1 AppEsteem

0 K7: -1 AV Comparitives, -1 AV Comparitives, +1 AVLab, +1 AppEsteem

0 TotalAV: -1 AV Comparitives, +1 AV Test, -1 SE Labs, +1 AppEsteem

-1 AVG: -1 AV Comparitives, -1 AV Comparitives, +1 AppEsteem

-1 ESET: +1 AV Comparitives, -1 AV Comparitives, +1 AVLab, -1 MRG Effitias, +1 Testing Ground Labs, -1 Venak Security, -1 AppEsteem

-1 GData: -1 AV Comparitives, +1 AV Test, -1 MRG Effitias, +1 Venak Security, -1 AppEsteem

-1 Malwarebytes: -1 AV Comparitives, +1 AVLab, +1 MRG Effitias, -1 Venak Security, -1 AppEsteem

-1 Quick Heal: -1 AV Comparitives, +1 Venak Security, -1 AppEsteem

-1 Webroot: +1 AVLab, -1 SE Labs, -1 AppEsteem

-2 AhnLab: -1 AV Test, -1 AV Comparitives, -1 Testing Ground Labs, +1 Virus Bulletin VB100

-2 Avast: -1 AV Comparitives, +1 AV Test, -1 AVLab, -1 MRG Effitias, +1 SE Labs, -1 Testing Ground Labs, -1 Venak Security, +1 AppEsteem

-2 Avira: -1 AV Comparitives, -1 AV Comparitives, -1 Testing Ground Labs, +1 AppEsteem

-2 Dr.Web: -1 Testing Ground Labs, -1 AppEsteem

-2 SpyHunter: -1 AV Comparitives, -1 AppEsteem

-2 Total Defense: -1 AV Comparitives, -1 Testing Ground Labs

-2 VIPRE: -1 AV Comparitives, -1 AppEsteem

-4 Trend Micro: -1 AV Comparitives, -1 AV Comparitives, -1 AVLab, -1 AppEsteem

Count of malware found in personal tests (using my own files and those from 1, 2, 3):

17,781 EmsiSoft (cleanup worked but "Processing Selected Files" msg for 5 hours - rebooted)

17,773 Total Defense ("Scanner process is not responding, try again later" at 4 hour mark)

17,741 BitDefender

17,447 G DATA (cancelled scan cleanup run after 5 hours)

9,358 Avira

8,959 Quick Heal

5,344 Webroot

3,540 Microsoft Defender

2,627 ESET (4 couldn't be cleaned)

827 VIPRE (inconsistent trial behavior - many threats found but not removed)

811 K7

541 SpyHunter

535 Malwarebytes

0 Avast

0 AVG

0 Sophos

X AhnLab (no trial available)

X Dr.Web (crashed computer while scanning)

X Elastic Security (not sold for home use)

X F-Secure (requires credit card for trial)

X Kasperksy (banned in the U.S.)

X McAfee (requires credit card for trial)

X Norton (requires credit card for trial)

X Panda (crashed computer while scanning)

X Total AV ("An error occurred during the antivirus scan")

X Trend Micro (selected trial but after install said "Invalid Activation Code")

USB bootable antivirus scanner

noreply@blogger.com (Mr. Blue Coat) — Mon, 13 Apr 2026 05:01:00 +0000

A lot of USB bootable antivirus tools have been discontinued, leaving users with limited options. After testing most out there, I found UALinux RescuePack to work the best. You can download it here and prepare a bootable USB using Balena Etcher. They're not a familiar name in the U.S. but are a silver partner with the reputable company Proxmox, vouching for their authenticity. RescuePack includes a variety of security scanning tools, although BitDefender seems to be the most reliable at updating malware signatures before running a scan.

P.S. Before booting RescuePack, make sure to disable BitLocker (takes a while to complete) and reboot into Windows to verify it has been fully disabled.

P.P.S. If you plan to run Vba32, make sure to first open a terminal, go to Preferences and on the General tab check Unlimited scrollback.

Windows Video / Audio Editing Tools

noreply@blogger.com (Mr. Blue Coat) — Sat, 24 Jan 2026 19:03:00 +0000

VLC
Shutter Encoder
Topaz Video AI
MKVToolnix
Avidemux
Lossless Cut
Davinci Resolve
Tenacity

Other useful apps:

Explorer
Settings
MyAsus
MSI Afterburner
NVIDIA app
iCue
Brave
Task Manager
HWmonitor

EndeavourOS install notes

noreply@blogger.com (Mr. Blue Coat) — Sat, 24 Jan 2026 18:56:00 +0000

Start the installer
Online
Plasma KDE
NVIDIA GPU fix
Include printing support / remove Firefox
Use Grub for bootloader (systemd was buggy)
Select 'replace a partition' and select the partition set up previously from Windows

Some apps:

Brave (with extensions BitWarden, GoFullPage, and uBlock Origin)
Thunderbird
OnlyOffice
Featherpad
code-oss (with extensions ESLint, Prettier, One Dark Pro)
GitHub Desktop
pCloud
Trayscale
Transmission QT
VLC
Epson

Install software on EndeavourOS

noreply@blogger.com (Mr. Blue Coat) — Sun, 04 Jan 2026 18:59:00 +0000

First try pacman, then yay with "-bin" suffix:

$ sudo pacman -Sy github-desktop

error: target not found: github-desktop

$ yay -S github-desktop-bin

EndeavourOS fix for laggy behavior after install

noreply@blogger.com (Mr. Blue Coat) — Sun, 04 Jan 2026 04:52:00 +0000

If you perform a fresh install of EndeavourOS and the system is laggy (mouse cursor delayed dragging effect) and you have an NVIDIA GPU, follow these instructions.

Best tool to wipe hard drive

noreply@blogger.com (Mr. Blue Coat) — Sat, 27 Dec 2025 15:04:00 +0000

ABAN is a useful solution to wipe a hard drive. Works as a bootable USB or CD.

Update EndeavourOS package manager mirrorlist

noreply@blogger.com (Mr. Blue Coat) — Sat, 13 Dec 2025 23:43:00 +0000

sudo reflector -p https --sort rate -c US --verbose --save /etc/pacman.d/mirrorlist

Install VLC on EndeavourOS

noreply@blogger.com (Mr. Blue Coat) — Sat, 13 Dec 2025 23:32:22 +0000

sudo pacman -S vlc vlc-plugins-all

Add Epson printer to EndeavourOS

noreply@blogger.com (Mr. Blue Coat) — Thu, 11 Dec 2025 21:13:00 +0000

If the official instructions don't work for your needs, then do the following:

sudo pacman -S yay

yay -S epson-inkjet-printer-escpr epson-inkjet-printer-escpr2

sudo pacman -Syu cups cups-browsed cups-filters cups-pdf system-config-printer --needed

sudo systemctl enable --now cups

# get IP address of printer

# search for "Printers" in the EndeavourOS settings, then click "Add..."

# click "AppSocket/HP JetDirect", then enter the address as "socket://PRINTER_IP_ADDRESS" and click "Continue with Address..."

# find the printer model in the list, then save and print test page

Play MP3 files on an Amazon Alexa Echo device

noreply@blogger.com (Mr. Blue Coat) — Thu, 04 Dec 2025 22:49:00 +0000

1. Open a web browser and go to either Dropbox or Google Drive. Create a folder and edit the share settings to allow Anyone with the link Viewer permissions.

2. Upload mp3 files to the folder.

3. Open a web browser and go to https://www.amazon.com/XdreaM-PlayListPlayer/dp/B079NCQW4W/ and click "Enable"

4. On your Amazon Echo device, say "Alexa, open PLP and create the playlist Example". Amazon will tell you an access code.

5. Open a web browser and go to https://xdream2000.com/alexa/plp/ , enter the Playlist name 'Example' and Access code provided by Alexa and then click 'Edit playlist'

6. In the 'Playlist' section, paste the share link for each mp3 file from Step 2.

7. (optional) Add your email and password to the account section near the bottom of the page.

8. Save the playlist and wait a minute for the platform to analyze all the songs.

9. On your Amazon Echo device, say "Alexa, open PLP and play Example"

Enjoy!

Image sharing site

noreply@blogger.com (Mr. Blue Coat) — Fri, 28 Nov 2025 16:21:17 +0000

A reminder to myself: https://catbox.moe/

EndeavourOS Tip: update pacman to fastest mirrors

noreply@blogger.com (Mr. Blue Coat) — Tue, 04 Nov 2025 23:56:00 +0000

sudo reflector --latest 5 --sort rate --save /etc/pacman.d/mirrorlist

P.S. Also install EOS Update Notifier for system updates:

sudo pacman -Suy eos-update-notifier

Concatenate multiple MKV videos (or MP4, etc.)

noreply@blogger.com (Mr. Blue Coat) — Mon, 13 Oct 2025 00:00:00 +0000

ffmpeg -loglevel info -f concat -safe 0 -i <(for f in *.mkv; do echo "file '$(pwd)/$f"; done) -c copy output.mkv

~ Source

Self-Hosted VPN Options

noreply@blogger.com (Mr. Blue Coat) — Sat, 09 Aug 2025 23:25:00 +0000

As a follow-up to my 2021 test, I wanted to compare various VPN options in regards to bandwidth speed performance. My requirements: self-hosted Linux-based server/exit node (Debian 12, amd64, 1 Xeon Gold CPU @ 3.0 GHz, 1 GB RAM, 10 Gbps bandwidth [real-world average 353 Mbps]) and an Android client (Pixel 8, Android 16, always-on VPN, block connections without VPN). The Android device was 775 miles away from the Linux exit node to stress test the latency. Note: all tests were performed as root with no firewall -- in production you would want to apply appropriate security and control measures.

________________________________________________________________________

WireGuard + dsnet

apt install -y nano wget iptables wireguard qrencode

wget https://github.com/naggie/dsnet/releases/download/v0.8.1/dsnet-linux-amd64 -O /usr/local/bin/dsnet

chmod +x /usr/local/bin/dsnet

dsnet init

nano /etc/dsnetconfig.json

# Add "0.0.0.0/0" to the 'Networks' array and "8.8.8.8" as the 'DNS' setting

echo "net.ipv4.ip_forward = 1" >> /etc/sysctl.conf

sysctl -p

NETDEV=$(ip -o route get 8.8.8.8 | cut -f 5 -d " ")

iptables -t nat -A POSTROUTING -o $NETDEV -j MASQUERADE

iptables -A FORWARD -i dsnet -o $NETDEV -j ACCEPT

iptables -A FORWARD -i $NETDEV -o dsnet -m state --state RELATED,ESTABLISHED -j ACCEPT

dsnet up

dsnet add example | qrencode -t ansiutf8

# Android device: download WireGuard app from Play Store and scan QR code

Results:

VPN off: 580, 530, 560, 570, 550 = average 558 Mbps

VPN on: 87, 79, 98, 78, 62 = average 81 Mbps

________________________________________________________________________

Headscale + Tailscale

Warning: if you use the commercial Tailscale platform always run with "--no-logs-no-support", otherwise they monitor your traffic.

apt install -y wireguard-tools networkd-dispatcher ethtool

curl -sLO https://github.com/juanfont/headscale/releases/download/v0.26.1/headscale_0.26.1_linux_amd64.deb

apt install ./headscale*.deb

echo '{"acls":[{"action":"accept","src":["*"],"dst":["*:*"]}]}' > /etc/headscale/acl.hujson

chmod 644 /etc/headscale/acl.hujson

umask 077

wg genkey > /etc/headscale/private.key

systemctl enable headscale

nano /etc/headscale/config.yaml

# make these edits:

server_url: https://vpn.mydomain.com:443
listen_addr: 0.0.0.0:443
grpc_listen_addr: 0.0.0.0:50443
allocation: random
acme_email: "youremail@mydomain.com"
tls_letsencrypt_hostname: "vpn.mydomain.com"
policy > path: "/etc/headscale/acl.hujson"
base_domain: mydomain.com
magic_dns: false

systemctl restart headscale && sleep 10 && systemctl status headscale

headscale users create example

curl -fsSL https://tailscale.com/install.sh | sh

echo 'net.ipv4.ip_forward = 1' | tee -a /etc/sysctl.d/99-tailscale.conf

echo 'net.ipv6.conf.all.forwarding = 1' | tee -a /etc/sysctl.d/99-tailscale.conf

sysctl -p /etc/sysctl.d/99-tailscale.conf

printf '#!/bin/sh\n\nethtool -K %s rx-udp-gro-forwarding on rx-gro-list off \n' "$(ip route show 0/0 | cut -f5 -d" " | head -n1)" | tee /etc/networkd-dispatcher/routable.d/50-tailscale

chmod 755 /etc/networkd-dispatcher/routable.d/50-tailscale

/etc/networkd-dispatcher/routable.d/50-tailscale

tailscale up --advertise-exit-node --accept-dns=false --login-server=https://vpn.mydomain.com:443

# It will provide a URL for you to open. Click on it and copy the command to authenticate the request. Paste the command into your Headscale server terminal (changing USERNAME to the user you created in the step above).

headscale nodes approve-routes --identifier 1 --routes 0.0.0.0/0

# Android device: install Tailscale from the Google Play Store, open it. Tap "Get Started". Tap "OK" at the VPN prompt. At the screen with the "Log in" button, quickly tap the gear icon in the top-right corner. (If you wait too long and it redirects you to a login page with various SSO options, tap the back button to go back to the prior screen). On the Settings page, tap Accounts. On the Accounts page, tap the three vertical button icon in the top-right corner and select 'Use an alternate server'. Type https://vpn.mydomain.com and then tap "Add account". Copy the resulting command shown to your Headscale server to authenticate. Once you get the Node yournode registered message, go back to the mobile app. In the EXIT NODE dropdown, select the exit node you created above. It should now appear in blue at the top of the Tailscale app screen and you should now be connected!

Results:

VPN off: 550, 600, 590, 620, 570 = average 586 Mbps

VPN on: 86, 90, 78, 110, 94 = average 92 Mbps

________________________________________________________________________

OpenConnect ocserv (or AnyLink) + Cisco Secure Client (AnyConnect)

apt install -y iptables-persistent certbot ocserv

tee -a /etc/sysctl.conf <<EOF

# Enable routing

net.ipv4.ip_forward = 1

# Protect from IP Spoofing

net.ipv4.conf.all.rp_filter = 1

net.ipv4.conf.default.rp_filter = 1

# Ignore ICMP broadcast requests

net.ipv4.icmp_echo_ignore_broadcasts = 1

# Protect from bad icmp error messages

net.ipv4.icmp_ignore_bogus_error_responses = 1

# Disable source packet routing

net.ipv4.conf.all.accept_source_route = 0

net.ipv6.conf.all.accept_source_route = 0

net.ipv4.conf.default.accept_source_route = 0

net.ipv6.conf.default.accept_source_route = 0

# Block SYN attacks

net.ipv4.tcp_syncookies = 1

net.ipv4.tcp_max_syn_backlog = 2048

net.ipv4.tcp_synack_retries = 2

net.ipv4.tcp_syn_retries = 5

# Log Martians

net.ipv4.conf.all.log_martians = 1

net.ipv4.icmp_ignore_bogus_error_responses = 1

# Ignore send redirects

net.ipv4.conf.all.send_redirects = 0

net.ipv4.conf.default.send_redirects = 0

# Ignore ICMP redirects

net.ipv4.conf.all.accept_redirects = 0

net.ipv6.conf.all.accept_redirects = 0

net.ipv4.conf.default.accept_redirects = 0

net.ipv6.conf.default.accept_redirects = 0

net.ipv4.conf.all.secure_redirects = 0

net.ipv4.conf.default.secure_redirects = 0

EOF

sysctl -p

iptables -t nat -A POSTROUTING -j MASQUERADE

iptables-save > /etc/iptables/rules.v4

mkdir /root/certificates

chmod 700 /root/certificates

cd /root/certificates

tee ca.template <<EOF

organization = OID-6eec9b9f

cn = Example CA

serial = `date "+%s"`

expiration_days = -1

signing_key

cert_signing_key

crl_signing_key

EOF

sleep 1

tee example.template <<EOF

organization = OID-6eec9b9f

cn = Example Router

dns_name = vpn.mydomain.com

ip_address = $(curl -4 ifconfig.me)

serial = `date "+%s"`

expiration_days = -1

signing_key

encryption_key

tls_www_server

EOF

certtool --generate-privkey --outfile ca-privkey.pem

certtool --generate-self-signed --load-privkey ca-privkey.pem --template ca.template --outfile ca-certificate.pem

certtool --generate-privkey --outfile example-privkey.pem

certtool --generate-certificate --load-privkey example-privkey.pem --load-ca-certificate ca-certificate.pem --load-ca-privkey ca-privkey.pem --template example.template --outfile example-certificate.pem

mkdir -p /etc/ocserv/

cp ca-certificate.pem example-certificate.pem example-privkey.pem /etc/ocserv/

tee /etc/ocserv/ocserv.conf <<EOF

# ocserv config options: https://ocserv.gitlab.io/www/manual.html#files

auth = "certificate"

tcp-port = 443

udp-port = 443

run-as-user = nobody

run-as-group = daemon

use-occtl = true

isolate-workers = false

socket-file = /run/ocserv-socket

server-cert = /etc/ocserv/example-certificate.pem

server-key = /etc/ocserv/example-privkey.pem

ca-cert = /etc/ocserv/ca-certificate.pem

# read user id from cert

cert-user-oid = 0.9.2342.19200300.100.1.1

# read organization from cert

cert-group-oid = 2.5.4.11

# log level

# 0 default (same as basic)

# 1 basic

# 2 info

# 3 debug

# 4 http

# 8 sensitive

# 9 TLS

log-level = 1

ipv4-network = 10.20.30.0/24

ipv4-netmask = 255.255.255.0

# set router as internet gateway

default-domain = vpn.mydomain.com

predictable-ips = true

route = default

restrict-user-to-routes = true

tunnel-all-dns = true

dns = 8.8.8.8

# tun name

device = example

# gnutls priority string: https://gnutls.org/manual/html_node/Priority-Strings.html

tls-priorities = "SECURE128:+SECURE192:-VERS-SSL3.0:-VERS-TLS1.0:-VERS-TLS1.1:-DHE-RSA"

# DoS protection

min-reauth-time = 300

max-ban-score = 80

ban-reset-time = 1200

cookie-timeout = 300

deny-roaming = true

rekey-time = 172800

rekey-method = ssl

# prevent legacy CISCO clients and openconnect clients < 7.08

cisco-client-compat = false

dtls-legacy = false

client-bypass-protocol = false

# other various settings

auth-timeout = 240

idle-timeout = 1200

session-timeout = 86400

mobile-idle-timeout = 2400

rate-limit-ms = 100

stats-report-time = 360

server-stats-reset-time = 604800

keepalive = 32400

dpd = 90

mobile-dpd = 1800

switch-to-tcp-timeout = 25

# unused settings

#mtu = 1420

#max-clients = 50

#max-same-clients = 2

EOF

systemctl start ocserv.service

systemctl status ocserv.service

systemctl enable ocserv.service

ocpasswd -c /etc/ocserv/ocpasswd jdoe <<< `openssl rand -base64 47`

certtool --generate-privkey --outfile jdoe-privkey.pem

tee jdoe.template <<EOF

organization = OID-6eec9b9f

cn = John Doe

uid = jdoe

tls_www_client

signing_key

encryption_key

# Apple cert expiration max is 397: https://support.apple.com/en-us/HT211025

expiration_days = 397

EOF

certtool --generate-certificate --load-privkey jdoe-privkey.pem --load-ca-certificate ca-certificate.pem --load-ca-privkey ca-privkey.pem --template jdoe.template --outfile jdoe-certificate.pem

# iOS supported ciphers: AES128, DES, 3DES, CAST, RC4

# https://opensource.apple.com/source/CommonCrypto/CommonCrypto-36064/CommonCrypto/CommonCryptor.h

# Cisco client supported ciphers: AES, 3DES, MD5, SHA1

# https://www.cisco.com/c/en/us/td/docs/iosxr/ncs5500/security/72x/b-system-security-cg-ncs5500-72x/implementing-secure-shell.html#concept_79A76470F2C24487844E3B42F0B7B1B7

# Triple DES is deprecated for all new applications and usage is disallowed after 2023

# https://www.cryptomathic.com/news-events/blog/3des-is-officially-being-retired

# ...so we'll use aes-128

certtool --to-p12 --load-privkey jdoe-privkey.pem --load-certificate jdoe-certificate.pem --pkcs-cipher aes-128 --outfile jdoe.p12 --outder --password=YOURCERTPASSWORDHERE --p12-name=jdoe

# Copy the jdoe.p12 file to the Android device. Install the Cisco Secure Client-AnyConnect from the Play Store and open it. Tap the three dots in the top-right and choose 'Settings' then uncheck 'Block Untrusted Servers'. Go back to the main screen and tap on 'Connections' then the plus sign (+). Add a description, then the server address vpn.mydomain.com. Tap on 'Advanced Preferences' then 'Certificate' then the blue 'Import' button at the bottom then 'File' then select the jdoe.p12 certificate. After the certificate is imported into the Cisco app storage, tap on it in the list to select it, then tap 'Done' twice and the back button to get to the main app screen. Tap the 'AnyConnect VPN' slider to enable the VPN.

Result: I couldn't get this to work with the Cisco Secure Client 5.1.9.115 in the Play Store

________________________________________________________________________

OpenZiti

echo "net.ipv4.ip_forward = 1" >> /etc/sysctl.conf

sysctl -p

apt install -y jq

export ZITI_NETWORK="example"

export ZITI_CTRL_EDGE_ADVERTISED_ADDRESS=vpn.mydomain.com

export ZITI_CTRL_EDGE_ADVERTISED_PORT=8800

export ZITI_ROUTER_ADVERTISED_ADDRESS=vpn.mydomain.com

export ZITI_ROUTER_PORT=9090

source /dev/stdin <<< "$(wget -qO- https://get.openziti.io/ziti-cli-functions.sh)"; expressInstall

startController

startRouter

zitiLogin

mv /root/.ziti/quickstart/example/ziti-bin/ziti-v*/ziti /usr/local/bin/

ziti edge create identity "NewUser" -o NewUser.jwt

# Android device: copy the NewUser.jwt file to the device and then install the 'Ziti Mobile Edge' app from the Play Store and open. Tap the 'Add Identity' icon in the top-right corner and choose 'Select JWT File' and locate the NewUser.jwt file.

Result: Says connected but no Internet access on the Android device.

________________________________________________________________________

NetBird

echo "net.ipv4.ip_forward = 1" >> /etc/sysctl.conf

sysctl -p

apt install -y jq

curl -fsSL https://get.docker.com | sh

export NETBIRD_DOMAIN=vpn.mydomain.com; curl -fsSL https://github.com/netbirdio/netbird/releases/latest/download/getting-started-with-zitadel.sh | bash

# Follow the instructions from the output of the prior command to login to the NetBird portal and change the default admin password

curl -fsSL https://pkgs.netbird.io/install.sh | sh

netbird up --management-url https://vpn.mydomain.com

# Click the three dots to the right of the newly added peer and choose 'Set Up Exit Node' then in the groups dropdown choose All.

# Android device: install the NetBird app from the Play Store and open. Tap the three-bar icon in the top-left corner and choose 'Change Server' (tap Yes when prompted for confirmation). In the Server textbox set https://vpn.mydomain.com:443 Once verified, you can tap the big grey circle in the middle of the app to connect. If you get an error, disable Always-On VPN and then try again and you should be prompted to login with your admin credentials. After you authenticate you can restore the Always-On VPN settings.

Results:

VPN off: 600, 550, 590, 630, 550 = average 584 Mbps

VPN on: 79, 89, 91, 35, 64 = average 72 Mbps

________________________________________________________________________

Outline VPN

echo "net.ipv4.ip_forward = 1" >> /etc/sysctl.conf

sysctl -p

iptables -I INPUT -j ACCEPT

SB_IMAGE=oreoluwa/shadowbox:daily sudo --preserve-env bash -c "$(wget -qO- https://raw.githubusercontent.com/EricQmore/installer/main/install_server.sh)" install_server.sh

# on desktop:

# https://s3.amazonaws.com/outline-releases/manager/linux/stable/Outline-Manager.AppImage

# ./Outline-Manager.AppImage --no-sandbox

# click on "Set Up" on "Set up Outline anywhere tile

# paste code from Oracle instance terminal

# click on the share icon on one of the keys in the Access Keys list

# download Outline VPN app from Play Store and paste access key into it to connect

Results:

VPN off: 610, 580, 610, 600, 590 = average 598 Mbps

VPN on: 15, 12, 15, 31, 15 = average 18 Mbps

________________________________________________________________________

Netmaker

# add a Wildcard DNS record to your domain (i.e. an 'A' record of '*' with IP address of your server IP address)

wget -qO /root/nm-quick.sh https://raw.githubusercontent.com/gravitl/netmaker/master/scripts/nm-quick.sh && sudo chmod +x /root/nm-quick.sh && sudo /root/nm-quick.sh

# Select option 2 to use a custom domain and enter mydomain.com

# After the installation completes, you will be prompted to login to the dashboard with a provided URL. Create a login and verify the server is listed as a Gateway

# Android device: install the Netmaker RAC app from the Play Store and open. Ensure the 'Self-hosted' box is highlighted and then enter server api.mydomain.com with the username and password you created in the previous step to login to the dashboard.

Result: throws a generic error message; if I use an IP address instead of the domain it says failure in SSL library

________________________________________________________________________

ZeroTier

Result: their documentation says "You can host your own roots ("moons") in addition to ZeroTier's, but we can't provide support for removing ZeroTier's roots except to enterprise customers. The mobile apps don't currently support custom roots."

________________________________________________________________________

n3n + Hin2n

apt install -y iptables

echo "net.ipv4.ip_forward = 1" >> /etc/sysctl.conf

sysctl -p

iptables -t nat -A POSTROUTING -j MASQUERADE

useradd -m -s /bin/bash n3n

echo "n3n ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers

cd /tmp

wget https://github.com/n42n/n3n/releases/download/3.4.4/n3n_3.4.4-1_amd64.deb

apt install ./n3n_3.4.4-1_amd64.deb

systemctl start n3n-supernode && systemctl enable n3n-supernode && systemctl status n3n-supernode

tee /etc/n3n/examplenetwork.conf <<EOF

[community]

name=examplenetwork

key=examplepassword

supernode=$(curl -s -4 ifconfig.me):7654

EOF

sed -i 's/%i/%i -r/' /usr/lib/systemd/system/n3n-edge@.service

systemctl start n3n-edge@examplenetwork && systemctl enable n3n-edge@examplenetwork && systemctl status n3n-edge@examplenetwork

n3nctl -s examplenetwork supernodes

n3nctl -s examplenetwork edges

ip a

# Note the non-routable IP address of the 'examplenetwork' network interface (e.g. 10.1.2.3)

# Android device: install the Hin2n apk file from GitHub and open. click + in top right, give VPN name, set N2N version to "v3", set supernode address to public IP of your server and port 7654, community is examplenetwork and encrypt key is examplepassword, and check 'Get IP from supernode'. Check the box 'More settings' and set the Gateway IP address to the 'ip a' value above and set a DNS server IP address (e.g. 8.8.8.8), then Save. Click on link icon to connect and it will say '[OK] edge'.

Results:

VPN off: 630, 600, 560, 630, 560 = average 596 Mbps

VPN on: 28, 35, 37, 18, 18 = average 27 Mbps

________________________________________________________________________

AmneziaWG + WG Tunnel

apt update

apt full-upgrade -y

reboot

apt install -y software-properties-common python3-launchpadlib gnupg2 linux-headers-$(uname -r) iptables qrencode openresolv

apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 57290828

echo "deb https://ppa.launchpadcontent.net/amnezia/ppa/ubuntu focal main" | tee -a /etc/apt/sources.list

echo "deb-src https://ppa.launchpadcontent.net/amnezia/ppa/ubuntu focal main" | tee -a /etc/apt/sources.list

apt update

apt install -y amneziawg

reboot

echo "net.ipv4.ip_forward = 1" >> /etc/sysctl.conf

sysctl -p

mkdir -p /etc/amnezia/amneziawg/clients

umask 077

awg genkey | tee /etc/amnezia/amneziawg/server.key | awg pubkey > /etc/amnezia/amneziawg/server.key.pub

awg genkey | tee /etc/amnezia/amneziawg/clients/mobile.key | awg pubkey | tee /etc/amnezia/amneziawg/clients/mobile.key.pub

# server

tee -a /etc/amnezia/amneziawg/wg0.conf <<EOF

[Interface]

PrivateKey = $(cat /etc/amnezia/amneziawg/server.key)

Address = 10.0.0.1/32

ListenPort = 51820

DNS = 8.8.8.8, 8.8.4.4

PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

SaveConfig = true

Jc = 4

Jmin = 8

Jmax = 80

S1 = 25

S2 = 75

H1 = 123

H2 = 456

H3 = 789

H4 = 101112

[Peer]

PublicKey = $(cat /etc/amnezia/amneziawg/clients/mobile.key.pub)

AllowedIPs = 10.0.0.0/24

PersistentKeepalive = 25

EOF

awg-quick up wg0

systemctl enable awg-quick@wg0

# client

tee -a /etc/amnezia/amneziawg/clients/mobile.conf <<EOF

[Interface]

PrivateKey = $(cat /etc/amnezia/amneziawg/clients/mobile.key)

Address = 10.0.0.2/32

DNS = 8.8.8.8, 8.8.4.4

Jc = 4

Jmin = 8

Jmax = 80

S1 = 25

S2 = 75

H1 = 123

H2 = 456

H3 = 789

H4 = 101112

[Peer]

PublicKey = $(cat /etc/amnezia/amneziawg/server.key.pub)

AllowedIPs = 0.0.0.0/0, ::/0

Endpoint = $(curl -s -4 ifconfig.me):51820

PersistentKeepalive = 25

EOF

qrencode -t ansiutf8 < /etc/amnezia/amneziawg/clients/mobile.conf

# Android device: install the WG Tunnel app from the Play Store and open. Tap the plus (+) button to load the configuration via QR code. You should then be able to connect.

Results:

VPN off: 560, 630, 550, 600, 550 = average 578 Mbps

VPN on: 79, 89, 91, 35, 64 = average 72 Mbps

Note: AmneziaWG has their own app on the Play Store but I found it to be slower than WG Tunnel.

________________________________________________________________________

OpenVPN

wget https://git.io/vpn -O openvpn-install.sh && bash openvpn-install.sh

# select UDP mode

# transfer client ovpn file to Android device

# Android device: download OpenVPN Connect app from Play Store, open, and agree to terms. On the 'Upload File' tab, tap 'Browse' and select the ovpn file you downloaded in the prior step. Then tap 'Connect'.

Results:

VPN off: 610, 620, 590, 570, 580 = average 594 Mbps

VPN on: 58, 61, 69, 52, 62 = average 61 Mbps

________________________________________________________________________

Libreswan + strongSwan

wget https://get.vpnsetup.net -O vpn.sh && sh vpn.sh

# transfer vpnclient.sswan file to Android device

# Android device: download strongSwan VPN Client app from Play Store, open, and tap the three dots in the top-right corner and choose 'Import VPN profile' and select the vpnclient.sswan file in the prior step. Tap 'Import Certificate From VPN Profile', keep default of 'VPN & app user certificate' option and then tap 'OK' twice. Then a new screen will prompt to 'Choose certificate' and you'll be given the option of the newly imported certificate; choose it and tap 'Select' then tap 'Import' in the top-right corner. Finally, tap the newly added VPN option in the list and accept all the prompts. You should now be connected.

Results:

VPN off: 580, 610, 580, 640, 570 = average 596 Mbps

VPN on: 67, 68, 57, 68, 31 = average 58 Mbps

________________________________________________________________________

VpnHood

su -c "bash <( wget -qO- https://github.com/vpnhood/VpnHood.App.Server/releases/latest/download/VpnHoodServer-linux-x64.sh)"

/opt/VpnHoodServer/vhserver gen

# copy the '--- AccessKey ---' string that starts with 'vh://' to a secure location

# Android device: download the 'VpnHood! Client' app from Play Store (not the 'VpnHood! Connect' app) and open. Tap on 'Server' at the bottom then tap 'Add server' and paste the 'vh://....' value from the previous step. If you get an error while initializing, temporarily disable Always-on VPN in the Android settings and retry.

Results:

VPN off: 590, 540, 630, 590, 590 = average 588 Mbps

VPN on: 75, 77, 80, 63, 73 = average 74 Mbps

________________________________________________________________________

Brook

echo "net.ipv4.ip_forward = 1" >> /etc/sysctl.conf

sysctl -p

bash <(curl https://bash.ooo/nami.sh)

nami install joker brook

joker brook server --listen :9999 --password hello

# Android device: download the Android APK file and install it. A free account via email is required (you can use an anonymous email service like TempMail). Once logged in, tap the plus (+) icon in the top-right corner. Enter the IP address of the server and the port the server is listening on (9999 in this example) as well as the password indicated in the server command above ('hello' in this example), then tap 'Add'. Tap 'Connect' and you should see an astronaut sitting on a rocket indicating the connection was successful.

Note: the app crashed once during my testing but otherwise seemed stable.

Results:

VPN off: 560, 570, 460, 460, 590 = average 528 Mbps

VPN on: 300, 282, 252, 298, 321 = average 291 Mbps

gokrazy: a minimal OS for Go programs (and containers)

noreply@blogger.com (Mr. Blue Coat) — Fri, 04 Jul 2025 21:08:00 +0000

In addition to an adorable mascot, gokrazy has some cool features:

An entire operating system that can run on AMD64/ARM64 bare metal with only five system executables (dhcp, heartbeat, init [which starts a lightweight web interface], ntp, randomd) and then your choice of userland programs -- common options include:

hello: simple example hello world program
mkfs: to automatically expand the optional permanent partition
serial-busybox: a statically compiled standalone busybox binary, for debugging on the serial port
fbstatus: graphically shows the gokrazy system status on the Linux frame buffer, which is typically available via HDMI
breakglass: a debugging executable that allows for SCP and SSH access
podman: container engine
tailscale: VPN
caddy: HTTP server
minio: object storage
prometheus: monitoring system and time series database

Immutable (read-only) root filesystem and no C runtime dramatically reduce your security vulnerability footprint
Current Linux kernel (new versions are typically available < 24h after upstream release)
Native update capability with A/B partitioning scheme
Minimal state and configuration

Here's a basic example on an x86 AMD64 NUC device (which I'll call the "production machine"):

On another Linux machine (which I'll call the "build machine"), make sure you have Go version 1.24 or higher installed: go version
If they don't exist already, create an SSH keypair on the build machine: ssh-keygen
Fork https://github.com/gokrazy/hello and then modify the go.mod file to indicate the new repo name, then create a new release of the hello example app as v1.0.0
Install gok, the gokrazy CLI tool: go install github.com/gokrazy/tools/cmd/gok@main
Create a configuration directory for your new instance, which I'll call "example": gok -i example new
Since we're targeting an AMD device and by default gokrazy expects an ARM device, you need to edit the newly created ~/gokrazy/example/config.json file and do the following:

Add this line above the line that says "Hostname": "KernelPackage": "github.com/gokrazy/kernel.amd64",
In the "Environment" section, change the "GOARCH=arm64" line to say "GOARCH=amd64"
In the "Packages" section, replace the "github.com/gokrazy/hello" line with your forked version
Save and close the file

To deploy to the production machine we can either create an image file and then use a tool like dd to overwrite the eMMC drive or we can use a USB thumb drive to boot and load gokrazy into memory:

Image file: gok -i example overwrite --full example.img --target_storage_bytes 1258299392
USB thumb drive (assuming /dev/sda is your thumb drive device -- verify your setup with lsblk): gok -i example overwrite --full /dev/sda

In this example, we'll use the USB thumb drive approach. After running that command, the output shows a unique URL, like: "http://gokrazy:nY54bft6kxwwdLPMRL3u@example/" Make a note of that for later.
Unplug the USB thumb drive from the build machine, plug it into the production machine and boot into it on the production machine. (Notice how fast it boots!)
Once booted, either note the IP from the screen (if shown) or use a port scanning tool on the build machine to identify it. In my example, it was 192.168.31.192 Add this to your hosts file as an alias to the app name: echo "192.168.31.192 example" | sudo tee -a /etc/hosts
Open link from Step 8. In the "Services" section, you'll see a "/user/hello" link. Click on it and you'll see the stdout says "Hello, 世界". Click the "run once" button and another hello will occur. Cool, huh! In theory, this could be any Go program you create statically with CGO_ENABLED=0
Now click the "gokrazy" link in the top-left corner to view the list of services again and this time click on the "/user/breakglass" link and then click the "supervise" button. You can now SSH into the production device from the build device: ssh 192.168.31.192
If you're curious, you can use this command to find all the executables on the OS: find / -type f -executable
Now, make a change to your hello example app on GitHub and then perform another release as version v1.0.1
On the build machine, all you need to do to update the production machine remotely is to run: gok -i example get github.com/YOUR_ACCOUNT/hello && gok -i example update
This will pull the latest version of your hello example app to the build machine, then update your example instance and push the newly updated instance to the production machine which will install it and reboot automatically. All this happens super fast!

P.S. gokrazy can even help you with your non-Go needs.

Conclusion: while other similar solutions exist, such as Talos Linux and Fedora Internet of Things, I enjoy the simplicity and elegance of gokrazy ...not to mention their adorable mascot :)

Best image red-eye remover

noreply@blogger.com (Mr. Blue Coat) — Sat, 24 May 2025 06:10:00 +0000

After trying a number of free tools, this one works pretty well: https://makeup.pho.to/red-eye-remover/

Edit video on Linux (for non-pros)

noreply@blogger.com (Mr. Blue Coat) — Mon, 12 May 2025 18:26:00 +0000

Occasionally I need to edit a video. I'm not a professional videographer with Adobe Premier working with terabytes of RAW, ProRes, or DNxHD video footage. I just need a format less compressed than the common streaming codecs for small edits between keyframes. Here's the solution I came up with that works for me:

If you need a simple edit of a file without subtitles:

1. Download and run Avidemux

2. File > Open and select your target video

3. In the Video Output section, select Ut Video (ffmpeg) from the dropdown

Note: This is a lossless codec but creates extremely large files. For example, a 10-minute 4K source video was 604 MB but when converted to Ut video codec it became a 53.8 GB file! If you don't have disk space for converting a 2 hour movie into a 646 GB file, you can use the lossy Mjpeg Encoder option then click the "Configure" button under that and choose YUV422 - which resulted in a 14.7 GB file for the same clip.

4. In the Audio Output section, select PCM from the dropdown, then click the "Configure" button under that and choose LPCM

5. In the Output Format section, select MKV Muxer

6. File > Save to save the video (note: this will take a while and create a very large file)

7. Once complete, you can open that new file in Avidemux and make any desired edits. If you need to make edits to the audio you can choose Audio > Save Audio from the menu and edit it in Tenacity

8. When your edits are done, apply these settings to save a compressed video for distributing:

In the Video Output section, select Mpeg4 AVC (x264) from the dropdown
In the Audio Output section, select AAC (lav) from the dropdown, then click the "Configure" button under that and choose 224 bitrate
In the Output Format section, select MP4v2 Muxer
File > Save to save the video

______________________________________________________

If you need to make edits but the video has subtitles:

1. Use Shutter Encoder to convert to FFV1 (lossless archival format) or ProRes (lossy)

2. Export audio using Avidemux and edit using Tenacity (highlight swear words, then Generate > Silence...), then export to WAV format

3. Use Subtitle Edit to extract the subtitles and edit (to remove swear words), then export to SRT format

4. Use MKVToolNix to combine the FFV1 video, WAV audio, and SRT subtitles

5. Use LosslessCut to edit any additional scenes from the new file

6. Use Shutter Encoder to convert to H.264 with MKV extension and in the "Advanced" features select "Preserve Subtitles", then set hardware acceleration along the bottom before clicking the "Start Function" to export.

______________________________________________________

If you need to make complex edits:

1. Use MKVToolNix to extract just the video portion of the file

2. Use the free version of Davinci Resolve to perform color correction, then export in ProRes HQ (or ProRes 422 if you don't have enough drive space)

3. Use Topaz Video AI Pro to denoise the video-only file (export as ProRes as well)

4. Use MKVToolNix to combine the color-corrected, denoised video file with the original video file's audio and subtitles

5. If audio/subtitle adjustments are needed, see above

6. Once all edits are done, use Shutter Encoder to export to H.264 (since it has the widest hardware and player support). Make sure to use the MKV extension and also expand "Advanced Features" and select "Preserve Subtitles", then set hardware acceleration along the bottom before clicking the "Start Function" to export.