Posts
Replace a Lenovo ThinkPad X220's BIOS with an open-source UEFI-capable firmware
Have an X220 lying around? Sick of the proprietary firmware that limits you in what you can do with your own hardware? This guide is for you!Arch Linux ARM on a Raspberry Pi 5 Model B
The Raspberry Pi 5 has been released, but it is not yet supported by Arch Linux ARM. But that won't stop you, right?Chromecast casting support across IP networks
'Casting' to a Chromecast work great (well, it works OK) in a single network, but can be a bit daunting to configure across different networks. This short reference explains what is needed.VPN as WAN for guest network on OpenWRT - 2021 edition
Sometimes it is required or socially expected to offer an internet connection to untrusted devices. Segmentation in a guest network keeps these away from trusted devices. However, letting untrusted devices use the internet connection directly can have unforeseen consequences, especially for the owner of the connection. In this guide an outgoing VPN connection on the router is configured as a mandatory WAN interface for a guest network. Traffic from and to the guest network will seemingly enter and exit the internet at the VPN server.Arch Linux ARM on a Pinebook Pro
Arch Linux ARM was not available for the Pinebook Pro. Now it is.Pinebook Pro eMMC factory image
Download an unmodified Pinebook Pro eMMC factory image here. This is useful for restoring a Pinebook Pro to its original state.64-bit Arch Linux ARM on a Raspberry Pi 4 Model B with 8 GB of RAM (May 2021 update)
Using 64-bit ('aarch64') Arch Linux ARM on a Raspberry Pi 4 with 8 GB of RAM presents several challenges related to headless (no HDMI) boot, USB support, and a wireless network adapter that sometimes fails to initiate. This short guide can help in overcoming these challenges.Installing Arch Linux ARM on an Iomega ix2-200
The Iomega ix2-200 is an old NAS, of which the original software has been stuck in the year 2008. In this post the aging stock software is replaced with a state-of-the-art Linux distribution.Integrating a Signal TLS Proxy in an existing site using HAProxy
The official Signal TLS Proxy implementation uses NGINX. This guide uses HAProxy instead, and explains how to integrate it in an existing website without impairing the function of the site.64-bit Arch Linux ARM on a Raspberry Pi 4 Model B with 8 GB of RAM
Using 64-bit ('aarch64') Arch Linux ARM on a Raspberry Pi 4 with 8 GB of RAM presents several challenges related to headless (no HDMI) boot, USB support, and a wireless network adapter that sometimes fails to initiate. This short guide can help in overcoming these challenges, while also providing more background information.Extending the functionality of a Denon AV receiver
Some network supporting Denon AV receivers have functionality that allows them to interact with other devices (such as 'trigger out' ports and RS-232C support). Cheaper AVR models sometimes miss these. In this guide, a Raspberry Pi is used to extend the functionality of a Denon AVR-X2700H, to allow the AVR to turn other devices on and off based on certain events (power on/off, switched input, etc.). My use case involves an active subwoofer that lacks an energy saving (standby) mode.Installing a PinePhone from scratch
An installation guide that is particularly useful for early PinePhone owners who upgraded their mainboard, and for those who have a bricked PinePhone.VPN as WAN for guest network on OpenWRT
Sometimes it is required or socially expected to offer an internet connection to untrusted devices. Segmentation in a guest network keeps these away from trusted devices. Hpwever, letting untrusted devices use the Internet connection directly can have unforeseen consequences, especially for the owner of the connection. In this guide an outgoing VPN connection on the router is configured as a mandatory WAN interface for a guest network. Traffic from and to the guest network will seemingly enter and exit the Internet at the VPN server.Clonezilla Live, legacy BIOS and UEFI USB boot
Official documentation only notes how to make a bootable USB medium for either legacy BIOS or UEFI systems. This guide covers how to make a single USB medium that boots on both. In addition, any leftover space on the USB medium can be used to store Clonezilla images.Arch Linux ARM network boot on Raspberry Pi 4
Network booting a Pi 4 is different compared to its predecessors. This post also notes the differences between the older and newer Pi models.Offer an existing site as an onion service
Making an existing site available inside the onion network is not hard, but there are some tricky parts to keep in mind. Read all about it in this post.Controlling Android TV and Kodi with Logitech Harmony and Flirc
Using a Flirc with a infrared remote control on an Android TV box is not hard, but requires some background research on the commands to feed to Android TV. With this guide the background research can be skipped, and the whole chain of devices will work together in no time.Arch Linux ARM network boot on Raspberry Pi
A guide for network booting the B(+) models of the Raspberry Pi 1, 2 and 3.Arch Linux quick start guide
The official installation instructions of Arch Linux are tightly condensed to the bare essentials. This is useful for quickly getting an Arch Linux virtual machine up and running when you start with nothing.OpenVPN configuration stacking
A small trick for managing a large number of OpenVPN configuration files.Let's Encrypt certificates in Arch Linux
How to have free automatically renewed TLS certificates in a free operating system.A reference guide to ZFS on Arch Linux
Covers both setting up ZFS and a handy command cheat sheet.Setting up a lightweight authentication back end
How to set up an LDAP server for authenticating (web) services.Routing traffic through OpenVPN using a local SOCKS proxy
OpenVPN can be used with an obfuscation proxy, such as obfsproxy or obfs4, to avoid identification of VPN traffic through deep packet inspection. In this post I explain a connectivity problem that client-side OpenVPN faces when such a proxy is approached as a local SOCKS proxy by OpenVPN. A solution is provided, of course.Maintaining SSL/TLS is hard...
Even the greatest SSL/TLS experts sometimes make mistakes.My doctoral thesis is available online
See 'PhD thesis' in the menu bar at the top of this page.Installing Arch Linux ARM on an Iomega ix2-200
The Iomega ix2-200 is an old NAS based on 2008 software. In this post the aging stock software is replaced with a state-of-the-art Linux distribution that will keep the system up to date for a long time.Talk at SECRYPT 2016
A post about conference where I presented my paper 'User-friendly Manual Transfer of Authenticated Online Banking Transaction Data'.Use your own email server with Ghost
Documentation for the Ghost blogging platform lacks a description of how to use a custom mail server instead of one of the pre-defined entries. This post describes how to do this.Speaking at SAI 2016
An announcement for a conference where I will speak about my paper 'Towards a Virtual Bank for Evaluating Security Aspects with Focus on User Behavior'.