tait.tech/_site/feed.xml

<?xml version="1.0" encoding="utf-8"?><feed xmlns="http://www.w3.org/2005/Atom" ><generator uri="https://jekyllrb.com/" version="4.0.0">Jekyll</generator><link href="http://localhost:4000/feed.xml" rel="self" type="application/atom+xml" /><link href="http://localhost:4000/" rel="alternate" type="text/html" /><updated>2020-08-18T23:00:11+00:00</updated><id>http://localhost:4000/feed.xml</id><entry><title type="html">How to Solve The Django Deployment Puzzle</title><link href="http://localhost:4000/2020/08/16/django-deployment.html" rel="alternate" type="text/html" title="How to Solve The Django Deployment Puzzle" /><published>2020-08-16T00:00:00+00:00</published><updated>2020-08-16T00:00:00+00:00</updated><id>http://localhost:4000/2020/08/16/django-deployment</id><content type="html" xml:base="http://localhost:4000/2020/08/16/django-deployment.html">&lt;p&gt;A few days ago I had a Django project I wanted to put on a real server.
This project is still in its infancy, but I thought it would be nice to put it on my resume and show my friends.
Little did I know the headache coming my way.
Here are some tips to help you not make the same mistakes as me.&lt;/p&gt;

&lt;h3 id=&quot;asgi-servers&quot;&gt;ASGI Servers&lt;/h3&gt;

&lt;p&gt;Because my project used the ASGI (Asynchronous webServer Gateway Interface),
I needed to find a good production ASGI server to handle all the incoming requests.
The best thing I found was &lt;a href=&quot;http://www.uvicorn.org/&quot;&gt;uvicorn&lt;/a&gt;.
It focuses on speed, which is a priority, especially when using the ASGI protocol.&lt;/p&gt;

&lt;p&gt;To run uvicorn on the command line for testing purposes, use something like the following:&lt;/p&gt;

&lt;pre class=&quot;terminal&quot;&gt;
$ uvicorn --reload myapp.asgi:application
&lt;/pre&gt;

&lt;p&gt;The &lt;code class=&quot;highlighter-rouge&quot;&gt;--reload&lt;/code&gt; option says to reload the server if any of the files get updated.
This is not recommended in production.
Sadly, I thought this meant I would need to do a hard shutdown of the server process every time I wanted to update.
This turned out to not be the case.&lt;/p&gt;

&lt;h3 id=&quot;workload-managers&quot;&gt;Workload Managers&lt;/h3&gt;

&lt;p&gt;There is another equine-named program called &lt;a href=&quot;https://gunicorn.org/&quot;&gt;gunicorn&lt;/a&gt;
which can hold a number of processes under its control.
An interesting feature of &lt;code class=&quot;highlighter-rouge&quot;&gt;gunicorn&lt;/code&gt; is that it will gracefully switch from an old to a new deployment,
replacing the subprocesses one-by-one and eventually having only the new deployment active on all subprocesses.
The greatest part? Zero down time.
The server keeps any old processes open if there is communication with them,
then shift and new connections to the new deployment.
This was a very cool feature I wanted to take advantage of.&lt;/p&gt;

&lt;p&gt;“Now hold on!” you might protest.
“gunicorn is a WSGI server!” … oh you got me there!
Yes, that’s right, &lt;code class=&quot;highlighter-rouge&quot;&gt;gunicorn&lt;/code&gt; is paired with &lt;code class=&quot;highlighter-rouge&quot;&gt;uvicorn&lt;/code&gt; to serve my files.&lt;/p&gt;

&lt;h3 id=&quot;systemd&quot;&gt;systemd&lt;/h3&gt;

&lt;p&gt;Love it or hate it, the majority of Linux distributions use the &lt;code class=&quot;highlighter-rouge&quot;&gt;systemd&lt;/code&gt; init system.
I decided it would be very convenient to have a .service file for my Django application to run automatically at boot.
&lt;code class=&quot;highlighter-rouge&quot;&gt;Systemd&lt;/code&gt; allows me to do this with a file like the following one I stored in &lt;code class=&quot;highlighter-rouge&quot;&gt;/lib/systemd/system/lamegames.service&lt;/code&gt;.&lt;/p&gt;

&lt;pre class=&quot;file&quot;&gt;
[Unit]
Description=Gunicorn/Uvicorn (lamegames.io)

[Service]
WorkingDirectory=/home/lame/lamegames.io
Type=simple
RemainAfterExit=yes
ExecStart=/home/lame/lamegames.io/env/bin/gunicorn lamegames.asgi:application -w 2 -k uvicorn.workers.UvicornWorker
ExecStop=/bin/kill -HUP $MAINPID
Restart=always

[Install]
WantedBy=multi-user.target
&lt;/pre&gt;

&lt;h3 id=&quot;nginx&quot;&gt;nginx&lt;/h3&gt;

&lt;p&gt;NGINX (pronounced engine-X) is a performance web server designed for speed and simplicity.
For the front facing side of the site, I do need a production web server like nginx.
Gunicorn simply doesn’t need all the features that nginx provides, but I do.
To configure my nginx installation, I used the following few directives to:&lt;/p&gt;

&lt;ol&gt;
  &lt;li&gt;Redirect most traffic towards the gunicorn server.&lt;/li&gt;
  &lt;li&gt;Redirect statically served files (CSS, JS, images) to the directory specified in the STATIC_ROOT variable of my &lt;code class=&quot;highlighter-rouge&quot;&gt;settings.py&lt;/code&gt; file.&lt;/li&gt;
  &lt;li&gt;Use TLS to enable https://&lt;/li&gt;
&lt;/ol&gt;

&lt;p&gt;Serving the static files from nginx as opposed to the &lt;code class=&quot;highlighter-rouge&quot;&gt;gunicorn&lt;/code&gt; server is necessary.
Gunicorn and other production A/WSGI web server will not set the proper MIME type over TLS.
This will cause your browser to not load the Javascript/CSS.&lt;/p&gt;

&lt;p&gt;This is the important part of my nginx config.&lt;/p&gt;

&lt;pre class=&quot;file&quot;&gt;
server {
    location / {
        proxy_set_header Host $http_host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        # these two lines ensure that WebSocket, and HTTP2 connection are forwarded correctly
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection &quot;Upgrade&quot;;
        proxy_redirect off;
        proxy_buffering off;
        # this forwards all traffic to the local server on port 8000
        proxy_pass http://localhost:8000;
    }

    # This forwards all static requests to Django's STATIC_ROOT set in settings.py; it is generated using the collectstatic command.
    location /static {
        autoindex on;
        alias /home/lame/lamegames.io/static_generated;
    }
}
&lt;/pre&gt;

&lt;h3 id=&quot;setup&quot;&gt;Setup&lt;/h3&gt;

&lt;p&gt;After all that, I was able to do the following:&lt;/p&gt;

&lt;pre class=&quot;terminal&quot;&gt;
# systemctl enable lamegames
&lt;/pre&gt;

&lt;p&gt;This enabled my &lt;code class=&quot;highlighter-rouge&quot;&gt;gunicorn&lt;/code&gt; server to run once the server started.
NGINX is that way be default.&lt;/p&gt;

&lt;p&gt;And tada! You now have a working Django project on a production server!&lt;/p&gt;

&lt;h4 id=&quot;notes&quot;&gt;Notes&lt;/h4&gt;

&lt;ul&gt;
  &lt;li&gt;If using ws:// websockets, change them to wss:// for secure web sockets.&lt;/li&gt;
  &lt;li&gt;Make sure to use channels.routing.get_default_application() instead of django.get_asgi_application() if your’re wanting to use channels/redis WebSockets.&lt;/li&gt;
&lt;/ul&gt;</content><author><name></name></author><summary type="html">A few days ago I had a Django project I wanted to put on a real server. This project is still in its infancy, but I thought it would be nice to put it on my resume and show my friends. Little did I know the headache coming my way. Here are some tips to help you not make the same mistakes as me.</summary></entry><entry><title type="html">BSD Journey, Part 1</title><link href="http://localhost:4000/2020/08/15/openbsd1.html" rel="alternate" type="text/html" title="BSD Journey, Part 1" /><published>2020-08-15T00:00:00+00:00</published><updated>2020-08-15T00:00:00+00:00</updated><id>http://localhost:4000/2020/08/15/openbsd1</id><content type="html" xml:base="http://localhost:4000/2020/08/15/openbsd1.html">&lt;p&gt;As Linux becomes controlled by corporate sponsors and becomes more full of proprietary blobs, drivers, and even closed-source software like Steam,
One may wonder if there are other options out there.
For me, somebody that is intensely interested in security, there is one option: OpenBSD.&lt;/p&gt;

&lt;p&gt;Now, my interest in OpenBSD has been going on for a long time.
I started poking around for Linux alternatives way back a few years ago when Linus Torvalds decided to leave after he got in trouble for some
&lt;a href=&quot;https://arstechnica.com/information-technology/2013/07/linus-torvalds-defends-his-right-to-shame-linux-kernel-developers/&quot;&gt;unprofessional behaviour&lt;/a&gt;.
That said, Linus did come back to Linux development,
but I knew that his abrasive style is what brought good code to the Linux kernel.
I also knew that his ability to be critical would be hurt by the new
&lt;a href=&quot;https://itsfoss.com/linux-code-of-conduct/&quot;&gt;code of conduct&lt;/a&gt;.
It would become a tool for the SJW types to hammer on Linus for being a “white male, et al.”;
It would become a tool for the easily offended to use to get their dumb code into Linux;
It would become a tool for the corporatization, the HR-ification of Linux.
Frankly, this does not interest me.&lt;/p&gt;

&lt;p&gt;Now I’m sure that OpenBSD has its own internal policies that I disagree with.
That said, Theo De Raadt is still at least known for calling Firefox an “amorphous peace of garbage” due to its lack of privilege separation.
And, in their &lt;a href=&quot;https://openbsd.org/goals.html&quot;&gt;project goals&lt;/a&gt; page, they specifically mention:&lt;/p&gt;

&lt;blockquote&gt;
  &lt;p&gt;Be as politics-free as possible; solutions should be decided on the basis of technical merit.&lt;/p&gt;
&lt;/blockquote&gt;

&lt;p&gt;Now that’s something I can get behind!
Bet you that’s not in the Linux COC?&lt;/p&gt;

&lt;p&gt;He also went to university in my hometown, so that’s pretty cool!
I can support a local madman who thinks he can make a better operating system than all those corporations.
Maybe he was right, maybe not. What I know is I am excited to find out!&lt;/p&gt;

&lt;p&gt;Wish my luck on my OpenBSD journey. I will post updates here along the way.&lt;/p&gt;

&lt;p&gt;Happy hacking!&lt;/p&gt;</content><author><name></name></author><summary type="html">As Linux becomes controlled by corporate sponsors and becomes more full of proprietary blobs, drivers, and even closed-source software like Steam, One may wonder if there are other options out there. For me, somebody that is intensely interested in security, there is one option: OpenBSD.</summary></entry><entry><title type="html">Know How Your Representative Votes In Parliament</title><link href="http://localhost:4000/2020/07/30/canadian-parliament.html" rel="alternate" type="text/html" title="Know How Your Representative Votes In Parliament" /><published>2020-07-30T00:00:00+00:00</published><updated>2020-07-30T00:00:00+00:00</updated><id>http://localhost:4000/2020/07/30/canadian-parliament</id><content type="html" xml:base="http://localhost:4000/2020/07/30/canadian-parliament.html">&lt;p&gt;As an advocate for openness, I had an idea to make a project out of the government of Canada’s &lt;a href=&quot;https://open.canada.ca/en/open-data&quot;&gt;Open Data&lt;/a&gt;
initiative to take a look at how my local MP voted on various pieces of legislation.
It turns out though that this was not necessary due to how easy it was to find this information on the government’s own website.
In this article, I will explain how you can do the same.&lt;/p&gt;

&lt;h3 id=&quot;1-find-your-representative&quot;&gt;1. Find Your Representative&lt;/h3&gt;

&lt;p&gt;The first step in this process is to find who your representative is.
To do so, go to the government’s own website
&lt;a href=&quot;https://www.ourcommons.ca/Members/en&quot;&gt;ourcommons.ca’s search tool&lt;/a&gt;.&lt;/p&gt;

&lt;p&gt;Simply type in your postal code in the search box to find out who your MP is.&lt;/p&gt;

&lt;h3 id=&quot;2-their-voting-record&quot;&gt;2. Their Voting Record&lt;/h3&gt;

&lt;p&gt;Every MP’s voting record is public knowledge,
and it is available nice and simple in a table on that MP’s page.
For example, this is a link to
&lt;a href=&quot;https://www.ourcommons.ca/Members/en/pierre-poilievre(25524)/votes&quot;&gt;Pierre Poilievre’s voting record&lt;/a&gt;.&lt;/p&gt;

&lt;p&gt;To find your MP’s voting record, do step one, then:
After the &lt;strong&gt;Overview&lt;/strong&gt;, and &lt;strong&gt;Seat in The House&lt;/strong&gt; sections,
there are three tabs, &lt;strong&gt;Roles&lt;/strong&gt;, &lt;strong&gt;Work&lt;/strong&gt;, and &lt;strong&gt;Contact&lt;/strong&gt;.
Click on work.
At the bottom of that tab is a link which says &lt;strong&gt;Chamber Votes&lt;/strong&gt;.
This will open a small window with some recent votes by this politician.
If you want to see all their votes, there is a button at the bottom named &lt;strong&gt;All Votes by This Member&lt;/strong&gt;.&lt;/p&gt;

&lt;p&gt;Tada! You can now keep your local MP accountable for anything you do or do not support.&lt;/p&gt;

&lt;h3 id=&quot;3-bill-details&quot;&gt;3. Bill Details&lt;/h3&gt;

&lt;p&gt;If you want to get into the nitty gritty,
once you open a specific bill, you can actually find out the status of said bill,
or read the actual text by clicking the &lt;strong&gt;View this Bill on LEGISinfo&lt;/strong&gt; button.&lt;/p&gt;

&lt;p&gt;Both the status of the bill, and a link to a PDF document containing the bilingual text of the bill are visible in the main body of the page.&lt;/p&gt;

&lt;h4 id=&quot;conclusion&quot;&gt;Conclusion&lt;/h4&gt;

&lt;p&gt;I thought this was pretty cool!
It was &lt;em&gt;way&lt;/em&gt; simpler than I thought it would be.&lt;/p&gt;

&lt;p&gt;Thanks, Canada!&lt;/p&gt;</content><author><name></name></author><summary type="html">As an advocate for openness, I had an idea to make a project out of the government of Canada’s Open Data initiative to take a look at how my local MP voted on various pieces of legislation. It turns out though that this was not necessary due to how easy it was to find this information on the government’s own website. In this article, I will explain how you can do the same.</summary></entry><entry><title type="html">Installing MultiCraft on Gentoo Linux</title><link href="http://localhost:4000/2020/07/19/multicraft-php-gentoo.html" rel="alternate" type="text/html" title="Installing MultiCraft on Gentoo Linux" /><published>2020-07-19T00:00:00+00:00</published><updated>2020-07-19T00:00:00+00:00</updated><id>http://localhost:4000/2020/07/19/multicraft-php-gentoo</id><content type="html" xml:base="http://localhost:4000/2020/07/19/multicraft-php-gentoo.html">&lt;p&gt;In a very odd combination of requirements,
I needed to install &lt;a href=&quot;https://multicraft.org&quot;&gt;MultiCraft&lt;/a&gt; on a Gentoo Linux system.
The PHP &lt;code class=&quot;highlighter-rouge&quot;&gt;USE&lt;/code&gt; flags are important so you don’t have to recompile it three times like I did.&lt;/p&gt;

&lt;p&gt;Here are some useful tips I came across:&lt;/p&gt;

&lt;h3 id=&quot;php-use-flags&quot;&gt;PHP &lt;code class=&quot;highlighter-rouge&quot;&gt;USE&lt;/code&gt; flags&lt;/h3&gt;

&lt;p&gt;In &lt;code class=&quot;highlighter-rouge&quot;&gt;/etc/portage/package.use/php&lt;/code&gt; I placed the following line:&lt;/p&gt;

&lt;pre class=&quot;terminal&quot;&gt;
dev-lang/php cgi mysql mysqli fpm pdo gd truetype
&lt;/pre&gt;

&lt;p&gt;This should give you enough for a mysql backended MultiCraft installation.
The &lt;code class=&quot;highlighter-rouge&quot;&gt;cgi&lt;/code&gt; option may not be required as &lt;code class=&quot;highlighter-rouge&quot;&gt;fpm&lt;/code&gt; stands for &lt;em&gt;FastCGI Process Managment&lt;/em&gt;.
I don’t know for sure though.&lt;/p&gt;

&lt;h3 id=&quot;paper&quot;&gt;Paper&lt;/h3&gt;

&lt;p&gt;This will grab the latest version of the Paper jar file using &lt;a href=&quot;https://yivesmirror.com&quot;&gt;YivesMirror&lt;/a&gt;.
I’m not sure how reputable it is,
but my buddy who works with this stuff more often than me seemed to recognize it.&lt;/p&gt;

&lt;pre class=&quot;terminal&quot;&gt;
## See the default craftbukkit.jar.conf for a detailed documentation of the
## format of this file.
[config]
name = Paper 1.16.1 Latest
source = https://yivesmirror.com/files/paper/Paper-1.16.1-latest.jar
category = Mods

[encoding]
#encode = system
#decode = system
#fileEncoding = latin-1

[start]
command = &quot;{JAVA}&quot; -Xmx{MAX_MEMORY}M -Xms{START_MEMORY}M -XX:MaxPermSize=128M -Djline.terminal=jline.UnsupportedTerminal -jar &quot;{JAR}&quot; nogui
&lt;/pre&gt;

&lt;h3 id=&quot;other-tips&quot;&gt;Other Tips&lt;/h3&gt;

&lt;p&gt;Do not use the option to setup a separate user for each server.
This completely stalled any work getting done with a ton of ‘permission denied’ errors.&lt;/p&gt;

&lt;h4 id=&quot;security&quot;&gt;Security&lt;/h4&gt;

&lt;p&gt;If the panel is in the root directory of your NGINX web server,
use the following in your server block to deny access to the &lt;code class=&quot;highlighter-rouge&quot;&gt;/protected&lt;/code&gt; directory.&lt;/p&gt;

&lt;pre class=&quot;terminal&quot;&gt;
location /protected {
  deny all;
  return 404;
}
&lt;/pre&gt;

&lt;h5 id=&quot;mysql&quot;&gt;MySQL&lt;/h5&gt;

&lt;p&gt;It is always good practice to separate privileges.
The MultiCraft daemon should have one SQL login,
with one database allocated to it.
The MultiCraft panel should have a separate SQL login,
with a separate database allocated to it.&lt;/p&gt;

&lt;p&gt;You can do this with the following commands in your MySQL prompt:&lt;/p&gt;

&lt;pre class=&quot;terminal&quot;&gt;
sql&amp;gt; CREATE DATABASE multicraft_daemon_database;
Query OK, 0 rows affected (0.01 sec)

sql&amp;gt; CREATE DATABASE multicraft_panel_database;
Query OK, 0 rows affected (0.01 sec)

sql&amp;gt; CREATE USER 'muilticraft_daemon'@'localhost' IDENTIFIED BY 'strong password here';
Query OK, 0 rows affected (0.01 sec)

sql&amp;gt; CREATE USER 'multicraft_panel'@'localhost' IDENTIFIED BY 'different strong password here';
Query OK, 0 rows affected (0.01 sec)

sql&amp;gt; GRANT ALL PRIVILEGES ON multicraft_daemon_database . * TO 'multicraft_daemon'@'localhost';
Query OK, 0 rows affected (0.01 sec)

sql&amp;gt; GRANT ALL PRIVILEGES ON multicraft_panel_database . * TO 'mutlicraft_panel'@'localhost';
Query OK, 0 rows affected (0.01 sec)

&lt;/pre&gt;

&lt;p&gt;During setup, make sure the proper credentials are used for each step.
Database 1 is the panel database.
Database 2 is the daemon database.&lt;/p&gt;

&lt;p&gt;Happy hacking :)&lt;/p&gt;</content><author><name></name></author><summary type="html">In a very odd combination of requirements, I needed to install MultiCraft on a Gentoo Linux system. The PHP USE flags are important so you don’t have to recompile it three times like I did.</summary></entry><entry><title type="html">Independence</title><link href="http://localhost:4000/2020/07/12/independence.html" rel="alternate" type="text/html" title="Independence" /><published>2020-07-12T00:00:00+00:00</published><updated>2020-07-12T00:00:00+00:00</updated><id>http://localhost:4000/2020/07/12/independence</id><content type="html" xml:base="http://localhost:4000/2020/07/12/independence.html">&lt;blockquote&gt;
  &lt;p&gt;“When given a choice between independence and dependence, always choose independence; you will never regret that choice!”—Luke Smith&lt;/p&gt;
&lt;/blockquote&gt;

&lt;p&gt;Whatever you may believe about the YouTube personality Luke Smith,
the quote above summarizes a core principle of mine.
Much like many people have religious principles, I have &lt;em&gt;Independence&lt;/em&gt;.&lt;/p&gt;

&lt;p&gt;My choice to use Linux as my primary operating system,
host my own website,
own my own domain name—all of these are directly related to this core principle of independence.&lt;/p&gt;

&lt;p&gt;I never want a man, or a company to have too much power over my life.
Just like I would not trust just any person to be able to read my emails,
know where I live, where I am going, who are my friends, what do I believe; in the same way, I do not trust a company with that same information.&lt;/p&gt;

&lt;blockquote&gt;
  &lt;p&gt;“If you want to find out what a man is to the bottom, give him power. Any man can stand adversity — only a great man can stand prosperity.”—Robert Ingersoll&lt;/p&gt;
&lt;/blockquote&gt;

&lt;p&gt;Take control of your own digital life:&lt;/p&gt;

&lt;ol&gt;
  &lt;li&gt;Own your own domain.&lt;/li&gt;
  &lt;li&gt;Hookup an email and a website to that.&lt;/li&gt;
&lt;/ol&gt;

&lt;p&gt;That’s it!&lt;/p&gt;

&lt;p&gt;Without this, any of your internet privileges can be revoked at any time by Google, Facebook, YouTube, Twitter, or even an angry Twitter Mob. Maybe because they hate your skin colour, maybe they hate your religious/political views, or maybe you got caught on a technicality.&lt;/p&gt;

&lt;p&gt;If you own your own domain, however:&lt;/p&gt;

&lt;p&gt;Your email provider goes down/bans you: change your provider; keep the email.&lt;/p&gt;

&lt;p&gt;Your website is pulled for controversial views: switch hosts.&lt;/p&gt;

&lt;p&gt;Protect yourself; give yourself choices.
Why give others that power when you could have it for yourself?&lt;/p&gt;</content><author><name></name></author><summary type="html">“When given a choice between independence and dependence, always choose independence; you will never regret that choice!”—Luke Smith</summary></entry><entry><title type="html">How to use tmux to send and receive things from your Minecraft server</title><link href="http://localhost:4000/2020/06/25/tmux-minecraft.html" rel="alternate" type="text/html" title="How to use tmux to send and receive things from your Minecraft server" /><published>2020-06-25T00:00:00+00:00</published><updated>2020-06-25T00:00:00+00:00</updated><id>http://localhost:4000/2020/06/25/tmux-minecraft</id><content type="html" xml:base="http://localhost:4000/2020/06/25/tmux-minecraft.html">&lt;p&gt;So recently I had problem.
I run a Minecraft server on a big Linux computer I have running in my room.
Now, as a system administrator it is very helpful to be able to run some simple commands without needing to login with my key, password, TFA, etc.
It is, frankly, a lot of work.
Especially when I really just want to be playing games but I just need to check something quickly.&lt;/p&gt;

&lt;p&gt;So for simple things like finding out of the network, CPU, memory or disk usage is my bottleneck, I wrote this really nifty script to connect the world of Minecraft and the Linux shell.&lt;/p&gt;

&lt;p&gt;My completed solution for what I needed can be found at &lt;a href=&quot;https://github.com/TTWNO/termcraft/&quot;&gt;https://github.com/TTWNO/termcraft&lt;/a&gt;.&lt;/p&gt;

&lt;p&gt;If you want some of the implementation details, stick around.&lt;/p&gt;

&lt;h2 id=&quot;solution&quot;&gt;Solution&lt;/h2&gt;

&lt;p&gt;So to solve this interesting problem, I decided to use &lt;code class=&quot;highlighter-rouge&quot;&gt;tmux&lt;/code&gt;.
&lt;code class=&quot;highlighter-rouge&quot;&gt;tmux&lt;/code&gt; is a &lt;strong&gt;t&lt;/strong&gt;terminal &lt;strong&gt;mu&lt;/strong&gt;ltiple&lt;strong&gt;x&lt;/strong&gt;er.
This allows you to run a terminal session, then detach fromc it while it  still runs in the background.&lt;/p&gt;

&lt;p&gt;This is very valuable when running command line applications that need to have an active console connection, like a Minecraft server.&lt;/p&gt;

&lt;p&gt;So first I looked at the &lt;code class=&quot;highlighter-rouge&quot;&gt;tmux&lt;/code&gt; command &lt;code class=&quot;highlighter-rouge&quot;&gt;send-keys&lt;/code&gt;.&lt;/p&gt;

&lt;h4 id=&quot;send-keys&quot;&gt;&lt;code class=&quot;highlighter-rouge&quot;&gt;send-keys&lt;/code&gt;&lt;/h4&gt;

&lt;p&gt;&lt;code class=&quot;highlighter-rouge&quot;&gt;send-keys&lt;/code&gt; allows you to send text, and key presses to a &lt;code class=&quot;highlighter-rouge&quot;&gt;tmux&lt;/code&gt; session.
Now assuming this &lt;code class=&quot;highlighter-rouge&quot;&gt;tmux&lt;/code&gt; session is attached to a Minecraft server,
there is no reason you could not run a command like this:&lt;/p&gt;

&lt;pre class=&quot;terminal&quot;&gt;
$ tmux send-keys &quot;tell @a This is a Test&quot; Enter
&lt;/pre&gt;

&lt;p&gt;This will send the text “tell @a This is a Test” to the Minecraft server.
Then, it will hit the newline character, this will execute the command.&lt;/p&gt;

&lt;p&gt;So now we can send information to the server and have it tell the users something.&lt;/p&gt;

&lt;p&gt;But how do we get information about who is typing what in the Minecraft chat?&lt;/p&gt;

&lt;h3 id=&quot;tmuxs-capture-pane-is-painful&quot;&gt;&lt;code class=&quot;highlighter-rouge&quot;&gt;tmux&lt;/code&gt;’s &lt;code class=&quot;highlighter-rouge&quot;&gt;capture-pane&lt;/code&gt; is painful&lt;/h3&gt;

&lt;p&gt;So in the manual page for &lt;code class=&quot;highlighter-rouge&quot;&gt;tmux&lt;/code&gt; I can see a section recorded below for options I can give to the &lt;code class=&quot;highlighter-rouge&quot;&gt;capture-pane&lt;/code&gt; subcommand.&lt;/p&gt;

&lt;pre class=&quot;terminal&quot;&gt;
  -S and -E specify the starting and ending line numbers,
  zero is the first line of the visible pane and negative
  numbers are lines in the history.  ‘-’ to -S is the start
  of the history and to -E the end of the visible pane.  The
  default is to capture only the visible contents of the pane.
&lt;/pre&gt;

&lt;p&gt;What it seems to be saying is I can start at line &lt;code class=&quot;highlighter-rouge&quot;&gt;-S n&lt;/code&gt; and end at line &lt;code class=&quot;highlighter-rouge&quot;&gt;-E n&lt;/code&gt;.
Negative numbers start from the bottom, so &lt;em&gt;in theory&lt;/em&gt; I can do the following: &lt;code class=&quot;highlighter-rouge&quot;&gt;tmux capture-pane -S -1&lt;/code&gt; should capture only the last line, because I’m starting from the last line. Right?&lt;/p&gt;

&lt;p&gt;No. It just doesn’t work. Negative numbers do &lt;em&gt;not&lt;/em&gt; work with the &lt;code class=&quot;highlighter-rouge&quot;&gt;tmux capture-pane&lt;/code&gt; subcommand.&lt;/p&gt;

&lt;p&gt;So I did some simple UNIX piping, like so, to get just the last thing in the chat.&lt;/p&gt;

&lt;pre class=&quot;terminal&quot;&gt;
$ tmux capture-pane -p -t steve | tail -n1
[SERVER] [ExtraDebuggingInfoHere]: &amp;lt;TaterTheTot&amp;gt; MY_MESSAGE
&lt;/pre&gt;
&lt;p&gt;TaterTheTot is my Minecraft username :)&lt;/p&gt;

&lt;p&gt;&lt;code class=&quot;highlighter-rouge&quot;&gt;-p&lt;/code&gt; prints the result to the terminal/stdout.&lt;/p&gt;

&lt;p&gt;&lt;code class=&quot;highlighter-rouge&quot;&gt;steve&lt;/code&gt; is the name of the tmux session I’m trying to pull form.&lt;/p&gt;

&lt;p&gt;So that’s done! Beauty!&lt;/p&gt;

&lt;p&gt;Now that we have that, how can we extract the username and the message from the latest line?&lt;/p&gt;

&lt;h3 id=&quot;grep&quot;&gt;&lt;code class=&quot;highlighter-rouge&quot;&gt;grep&lt;/code&gt;&lt;/h3&gt;

&lt;p&gt;&lt;code class=&quot;highlighter-rouge&quot;&gt;grep&lt;/code&gt; is a command to find patterns of text.
&lt;code class=&quot;highlighter-rouge&quot;&gt;grep&lt;/code&gt; has an option to only show a matching pattern of text.
This option is &lt;code class=&quot;highlighter-rouge&quot;&gt;-o&lt;/code&gt;.&lt;/p&gt;

&lt;p&gt;Let’s see how we can use this in conjunction with our latest line of server output to get our results.&lt;/p&gt;

&lt;pre class=&quot;terminal&quot;&gt;
$ echo &quot;[DEBUG] [SERVER] blah blah: &amp;lt;TaterTheTot&amp;gt; MY_MESAGE&quot; | grep -o &quot;&amp;lt;.&amp;ast;&amp;gt;&quot;
&amp;lt;TaterTheTot&amp;gt;
&lt;/pre&gt;

&lt;p&gt;Now, that’s my name with the &amp;lt; and &amp;gt; attached. Not bad!
We can use the &lt;code class=&quot;highlighter-rouge&quot;&gt;sed&lt;/code&gt; command to clean it up a bit.&lt;/p&gt;

&lt;p&gt;The syntax is like so: &lt;code class=&quot;highlighter-rouge&quot;&gt;select/somepattern/replacewith/global&lt;/code&gt;&lt;/p&gt;

&lt;p&gt;So the following command is: &lt;code class=&quot;highlighter-rouge&quot;&gt;s/[&amp;lt;&amp;gt;]//g&lt;/code&gt;&lt;/p&gt;

&lt;p&gt;Select any characters that are either &amp;lt; or &amp;gt;.
Replace with nothing.
Do so globally (as in, don’t stop after you replace only one character).&lt;/p&gt;

&lt;p&gt;Take two!&lt;/p&gt;

&lt;pre class=&quot;terminal&quot;&gt;
$ echo &quot;[DEBUG] [SERVER] blah blah: &amp;lt;TaterTheTot&amp;gt; MY_MESAGE&quot; | grep -o &quot;&amp;lt;.&amp;ast;&amp;gt;&quot; | sed 's/[&amp;lt;&amp;gt;]//g'
TaterTheTot
&lt;/pre&gt;

&lt;p&gt;Beautiful!&lt;/p&gt;

&lt;p&gt;Now what about that pesky message?&lt;/p&gt;

&lt;h3 id=&quot;more-grep-more-sed&quot;&gt;more &lt;code class=&quot;highlighter-rouge&quot;&gt;grep&lt;/code&gt;; more &lt;code class=&quot;highlighter-rouge&quot;&gt;sed&lt;/code&gt;&lt;/h3&gt;

&lt;p&gt;Simple: capture everything after the &amp;gt;. Leaving the user’s message entirely in tact.&lt;/p&gt;

&lt;pre class=&quot;terminal&quot;&gt;
$ echo &quot;[DEBUG] [SERVER] blah blah: &amp;lt;TaterTheTot&amp;gt; MY_MESAGE&quot; | grep -o &quot;&amp;gt;.&amp;ast;$&quot; | sed 's/&amp;gt; //'
MY_MESSAGE
&lt;/pre&gt;

&lt;p&gt;So now we have a way to get the username of someone typing in the Minecraft server chat.
We have a way to find out what they said.
And, we have a way to respond.&lt;/p&gt;

&lt;p&gt;You can imagine how these might go together for your own use case.&lt;/p&gt;

&lt;h3 id=&quot;conclusion&quot;&gt;Conclusion&lt;/h3&gt;

&lt;p&gt;This shows some pretty fun stuff you can do with a few simple Linux commands and a Minecraft server.&lt;/p&gt;

&lt;p&gt;I hope you learned something and found my explanations not horrific haha!&lt;/p&gt;

&lt;p&gt;Remember to checkout the git repository to see what I did with it: &lt;a href=&quot;https://github.com/TTWNO/termcraft&quot;&gt;https://github.com/TTWNO/termcraft&lt;/a&gt;.&lt;/p&gt;

&lt;p&gt;Happy hacking!&lt;/p&gt;</content><author><name></name></author><summary type="html">So recently I had problem. I run a Minecraft server on a big Linux computer I have running in my room. Now, as a system administrator it is very helpful to be able to run some simple commands without needing to login with my key, password, TFA, etc. It is, frankly, a lot of work. Especially when I really just want to be playing games but I just need to check something quickly.</summary></entry><entry><title type="html">Site Update</title><link href="http://localhost:4000/2020/06/04/site-update.html" rel="alternate" type="text/html" title="Site Update" /><published>2020-06-04T00:00:00+00:00</published><updated>2020-06-04T00:00:00+00:00</updated><id>http://localhost:4000/2020/06/04/site-update</id><content type="html" xml:base="http://localhost:4000/2020/06/04/site-update.html">&lt;p&gt;I updated the site with some easier to identify information about me and my projects :)&lt;/p&gt;

&lt;p&gt;Also, Clue has been delayed due to my partner in crime on the project wokring too many hours.&lt;/p&gt;

&lt;p&gt;I also posted a new project called &lt;em&gt;&lt;a href=&quot;https://github.com/TTWNO/caesar-cipher&quot;&gt;Caesar Cipher&lt;/a&gt;&lt;/em&gt; in C. It will be an intermediate example of how to use build systems like &lt;code class=&quot;highlighter-rouge&quot;&gt;make&lt;/code&gt;.&lt;/p&gt;</content><author><name></name></author><summary type="html">I updated the site with some easier to identify information about me and my projects :)</summary></entry><entry><title type="html">New Game: Clue (coming soon)</title><link href="http://localhost:4000/2020/05/19/clue-announcement.html" rel="alternate" type="text/html" title="New Game: Clue (coming soon)" /><published>2020-05-19T00:00:00+00:00</published><updated>2020-05-19T00:00:00+00:00</updated><id>http://localhost:4000/2020/05/19/clue-announcement</id><content type="html" xml:base="http://localhost:4000/2020/05/19/clue-announcement.html">&lt;p&gt;Ooo! Exciting!
Today I want to announce a new project I’ll be working on which should be live within the month of May:
Clue.&lt;/p&gt;

&lt;p&gt;The original board game, implemented in an accessible format via the web.&lt;/p&gt;

&lt;p&gt;It uses a Node.js backend and standard Javascript/HTML frontend.
Nothing fancy.&lt;/p&gt;

&lt;p&gt;All the code will be hosted here: &lt;a href=&quot;https://github.com/TTWNO/clue&quot;&gt;https://github.com/TTWNO/clue&lt;/a&gt;&lt;/p&gt;

&lt;p&gt;It will be licensed under the BSD-3 license, meaning it can be used for any reason—even commercially and without source-code disclosure—without prior authorization, but it &lt;em&gt;must&lt;/em&gt; acknowledge that I helped build the end product.&lt;/p&gt;

&lt;p&gt;Once the project is live, it will be located at: &lt;a href=&quot;&quot;&gt;Lame Games&lt;/a&gt; (currently a dead link).&lt;/p&gt;</content><author><name></name></author><summary type="html">Ooo! Exciting! Today I want to announce a new project I’ll be working on which should be live within the month of May: Clue.</summary></entry><entry><title type="html">How to use NGINX as a reverse-proxy server for a Node.js application using socket.io</title><link href="http://localhost:4000/2020/05/01/nginx-socket-io-projects.html" rel="alternate" type="text/html" title="How to use NGINX as a reverse-proxy server for a Node.js application using socket.io" /><published>2020-05-01T00:00:00+00:00</published><updated>2020-05-01T00:00:00+00:00</updated><id>http://localhost:4000/2020/05/01/nginx-socket-io-projects</id><content type="html" xml:base="http://localhost:4000/2020/05/01/nginx-socket-io-projects.html">&lt;p&gt;Despite the long name of the article, I have a feeling this may apply to more people than I might think.
If you have a Node.js application which needs socket.io connections that you want to pass throgh nginx’s &lt;code class=&quot;highlighter-rouge&quot;&gt;reverse_proxy&lt;/code&gt; directive then this is the article for you!&lt;/p&gt;

&lt;p&gt;You &lt;em&gt;must&lt;/em&gt; seperate the socket.io sockets and the static resources.&lt;/p&gt;

&lt;ul&gt;
  &lt;li&gt;The socket connections can be routed through the default &lt;code class=&quot;highlighter-rouge&quot;&gt;$host/socket.io&lt;/code&gt; if you want to ease modifications to the source code.&lt;/li&gt;
  &lt;li&gt;The connections to your main npm Node.js application can be routed through the relevant directory.&lt;/li&gt;
&lt;/ul&gt;

&lt;p&gt;Here is the relevant part of my &lt;code class=&quot;highlighter-rouge&quot;&gt;projects.tait.tech.conf&lt;/code&gt; file:&lt;/p&gt;

&lt;pre class=&quot;terminal&quot;&gt;
location /socket.io {
  proxy_pass http://localhost:8080/socket.io/;
  proxy_set_header Upgrade $http_upgrade;
  proxy_set_header Connection &quot;upgrade&quot;;
  proxy_http_version 1.1;
  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  proxy_set_header Host $host;
}

location /ttrpg {
  proxy_pass http://localhost:8080/;
  proxy_set_header Host $host;
  proxy_set_header X-Real-IP $remote_addr;
  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
&lt;/pre&gt;

&lt;h3 id=&quot;explaination&quot;&gt;Explaination:&lt;/h3&gt;

&lt;p&gt;For this application,
I needed the &lt;code class=&quot;highlighter-rouge&quot;&gt;/ttrpg&lt;/code&gt; directory to connect to my main Node.js instance. This was going to be the root of a ttrpg project.
It was to have static files served form my Node.js application.&lt;/p&gt;

&lt;p&gt;I also needed &lt;code class=&quot;highlighter-rouge&quot;&gt;/socket.io&lt;/code&gt; to conenct to my running &lt;code class=&quot;highlighter-rouge&quot;&gt;npm&lt;/code&gt; instance.
When I tried to route all the traffic through the &lt;code class=&quot;highlighter-rouge&quot;&gt;/trrpg&lt;/code&gt; location directive
I had no luck whatsoever;
&lt;code class=&quot;highlighter-rouge&quot;&gt;$host/ttrpg/socket.io/*&lt;/code&gt; calls &lt;em&gt;always&lt;/em&gt; failed with a 404.&lt;/p&gt;

&lt;p&gt;Having two seperate blocks forwarding in different ways seems to fix this.
I am not knowledgable enough to understand how.&lt;/p&gt;

&lt;p&gt;For now, the project is alive!!!&lt;/p&gt;

&lt;p&gt;Happy hacking!&lt;/p&gt;

&lt;p&gt;&lt;em&gt;P.S. I forgot to mention I also symbolically linked the &lt;code class=&quot;highlighter-rouge&quot;&gt;socket.io.js&lt;/code&gt; file (that node is supposed to serve automatically) to the static client dir.
For some reson the node instance would not serve this file without that.&lt;/em&gt;&lt;/p&gt;

&lt;pre class=&quot;terminal&quot;&gt;
$ pwd
/home/user/ttrpg.co/client
$ ln -s ../server/node_modules/socket.io-client/dist/socket.io.js .
&lt;/pre&gt;

&lt;p&gt;&lt;em&gt;Happy hacking 2.0!&lt;/em&gt;&lt;/p&gt;</content><author><name></name></author><summary type="html">Despite the long name of the article, I have a feeling this may apply to more people than I might think. If you have a Node.js application which needs socket.io connections that you want to pass throgh nginx’s reverse_proxy directive then this is the article for you!</summary></entry><entry><title type="html">What is XSS?</title><link href="http://localhost:4000/2020/04/25/xss.html" rel="alternate" type="text/html" title="What is XSS?" /><published>2020-04-25T00:00:00+00:00</published><updated>2020-04-25T00:00:00+00:00</updated><id>http://localhost:4000/2020/04/25/xss</id><content type="html" xml:base="http://localhost:4000/2020/04/25/xss.html">&lt;p&gt;I found a cross-site scripting (XSS) attack
in a well-known quiz hosting website.
I disclosed the vulnerability to them years ago, so I thought
now might be a good time to write about it.&lt;/p&gt;

&lt;p&gt;In this first article I will explain what XSS is.&lt;/p&gt;

&lt;p&gt;In the next article I will explain how I found this attack.&lt;/p&gt;

&lt;h2 id=&quot;what-is-cross-site-scripting-xss&quot;&gt;What is cross-site scripting (XSS)&lt;/h2&gt;

&lt;p&gt;Cross-site scripting, XSS for short,
is a technique to execute arbitrary Javascript code on a user visiting a website
by linking to Javascript code stored on another server.&lt;/p&gt;

&lt;p&gt;So for example:&lt;/p&gt;

&lt;p&gt;I have a file on my website called &lt;a href=&quot;/assets/js/hacked.js&quot;&gt;hacked.js&lt;/a&gt;.
If I was able to run this javascript file on anybody visiting a certain website &lt;em&gt;that is not mine&lt;/em&gt;, this would be called cross-site scripting.&lt;/p&gt;

&lt;p&gt;Click the above &lt;code class=&quot;highlighter-rouge&quot;&gt;hacked.js&lt;/code&gt; link to view the code I use to “hack” this website.
It’s safe, I promise ;)&lt;/p&gt;

&lt;p&gt;Now, how can we get this code to execute when a user visits this site?
To explain, I will start with some of the underlying technologies.&lt;/p&gt;

&lt;h3 id=&quot;escape-characters&quot;&gt;Escape Characters!&lt;/h3&gt;

&lt;p&gt;No, this is not a Sherlock Holmes novel!&lt;/p&gt;

&lt;p&gt;If we suppose that a website is built with sequences like these (called “tags”):
&lt;code class=&quot;highlighter-rouge&quot;&gt;&amp;lt;body&amp;gt;&lt;/code&gt;, &lt;code class=&quot;highlighter-rouge&quot;&gt;&amp;lt;p&amp;gt;&lt;/code&gt; (for paragraph), &lt;code class=&quot;highlighter-rouge&quot;&gt;&amp;lt;link&amp;gt;&lt;/code&gt; and &lt;code class=&quot;highlighter-rouge&quot;&gt;&amp;lt;b&amp;gt;&lt;/code&gt; for bold,
then why can you &lt;em&gt;see&lt;/em&gt; the left and right angle bracket characters?
Don’t they mean something? Shouldn’t they be telling the browser:
&lt;em&gt;“Hey! Make me bold!”?&lt;/em&gt;
Why &lt;em&gt;doesn’t&lt;/em&gt; everything after me typing &lt;code class=&quot;highlighter-rouge&quot;&gt;&amp;lt;b&amp;gt;&lt;/code&gt; turn bold?&lt;/p&gt;

&lt;p&gt;The answer is:&lt;/p&gt;

&lt;p&gt;There are special characters in HTML to type a visible left (&amp;lt;)
and visible right angle bracket (&amp;gt;) in a website.
If I use the left and right brackets on my keyboard however,
things will indeed &lt;b&gt;show up bold&lt;/b&gt;.&lt;/p&gt;

&lt;p&gt;This is the code for the sentence I wrote above:&lt;/p&gt;
&lt;pre class=&quot;terminal&quot;&gt;
There are special characters in HTML to type a visible left (&amp;amp;lt;)
and visible right angle bracket (&amp;amp;gt;) in a website.
If I use the left and right brackets on my keyboard however,
things will indeed &amp;lt;b&amp;gt;show up bold&amp;lt;/b&amp;gt;.
&lt;/pre&gt;

&lt;p&gt;Notice how all visible left angle brackets use an &lt;code class=&quot;highlighter-rouge&quot;&gt;&amp;amp;lt;&lt;/code&gt; to show them?&lt;/p&gt;

&lt;p&gt;These are called &lt;a href=&quot;https://en.wikipedia.org/wiki/Escape_character&quot;&gt;escape characters&lt;/a&gt;.
They tell a system, in this case your web browser:
&lt;em&gt;“Hello! Please show me off! I don’t want to be hidden.”&lt;/em&gt;&lt;/p&gt;

&lt;h4 id=&quot;sanitization&quot;&gt;Sanitization&lt;/h4&gt;

&lt;p&gt;Most of the time XSS attacks are done using poorly sanitized HTML &lt;code class=&quot;highlighter-rouge&quot;&gt;&amp;lt;input&amp;gt;&lt;/code&gt; elements.&lt;/p&gt;

&lt;p&gt;Sanitization is when a program (usually on the server side),
will remove characters like &lt;code class=&quot;highlighter-rouge&quot;&gt;&amp;lt;&lt;/code&gt; and replace them with the aforementioned “escape characters”.
Internally this would be something like &lt;code class=&quot;highlighter-rouge&quot;&gt;&amp;amp;lt;&lt;/code&gt;,
but they would show up to a user as &lt;code class=&quot;highlighter-rouge&quot;&gt;&amp;lt;&lt;/code&gt;.&lt;/p&gt;

&lt;p&gt;When inputs are not properly sanitized &lt;em&gt;and&lt;/em&gt; the input is shown to the user in another part of the website,
then a malicous user can type in HTML that will run whenever anybody tries to look at what they typed.
For example: a name for a quiz website (input) and the leaderboard for said quiz (display).&lt;/p&gt;

&lt;p&gt;HTML, by itself is not very dangerous.
The worst thing you could do is probably put a link on your name,
and then point it to a porn site.
Make your name bold, italic. Maybe make the background a funny color.
Although this may annoy your victim it is not dangerous security wise.&lt;/p&gt;

&lt;p&gt;There is one tag however, that &lt;em&gt;is&lt;/em&gt; scary…&lt;/p&gt;

&lt;h2 id=&quot;script&quot;&gt;&lt;code class=&quot;highlighter-rouge&quot;&gt;&amp;lt;script&amp;gt;&lt;/code&gt;&lt;/h2&gt;

&lt;p&gt;The &lt;code class=&quot;highlighter-rouge&quot;&gt;&amp;lt;script&amp;gt;&lt;/code&gt; tag allows you to write code that can:&lt;/p&gt;

&lt;ol&gt;
  &lt;li&gt;Change the page contents.&lt;/li&gt;
  &lt;li&gt;Redirect the user to a new page automatically.&lt;/li&gt;
  &lt;li&gt;Get a user’s location.&lt;/li&gt;
  &lt;li&gt;Open a user’s microphone/webcam.&lt;/li&gt;
  &lt;li&gt;With the &lt;code class=&quot;highlighter-rouge&quot;&gt;src&lt;/code&gt; &lt;a href=&quot;https://www.w3schools.com/htmL/html_attributes.asp&quot;&gt;attribute&lt;/a&gt; you can also load a script from another site. (This is XSS)&lt;/li&gt;
&lt;/ol&gt;

&lt;p&gt;Those last two will ask for permission from the user (if their browser isn’t insanely insecure).&lt;/p&gt;

&lt;p&gt;In my next article I’ll talk about a website I found which is vulnerable to this attack.
And, show you how you can run your own XSS attack.&lt;/p&gt;</content><author><name></name></author><summary type="html">I found a cross-site scripting (XSS) attack in a well-known quiz hosting website. I disclosed the vulnerability to them years ago, so I thought now might be a good time to write about it.</summary></entry></feed>