michael-stapelberg-ch

The author assesses 12 rsync vulnerabilities against his Go-based gokrazy/rsync. While both he and upstream missed some validation, Go's bounds-checking prevents memory corruption, and the minimal codebase avoids many attack surfaces. He concludes memory-safe languages and minimal implementations significantly reduce security risks.

The article provides debugging tips for hanging Go programs, including using Ctrl+\ (SIGQUIT) to print stack traces and attaching the delve debugger to analyze running processes. It demonstrates these techniques through a real-world example where an rsync receiver was incorrectly expecting uid/gid data.

The author reports experiencing multiple stability issues with an Intel Core Ultra 9 285K CPU on an ASUS Z890 motherboard, including crashes, USB host controller failures, and problems resuming from suspend. Updates later revealed the CPU was faulty, and the replacement also failed, leading the author to switch to AMD.

The author describes using the grobi program to automatically configure X11 monitors, particularly a Dell 8K monitor. Grobi listens for RandR events and runs xrandr to set up monitor resolution and positioning based on a configuration file, solving previous manual configuration issues.

The author details their 2025 high-end Linux PC build with an Intel Core Ultra 9 285K CPU, 64GB DDR5 RAM, 4TB SSD, and RTX 3060 Ti GPU, totaling 2350 CHF. After replacing a faulty CPU, the system is now stable and fast, designed for low idle power and driving an 8K monitor.

The article describes a declarative approach to installing NixOS over the network using nixos-anywhere. It explains how to build a customized NixOS installer ISO with pre-configured SSH access and preferred tools, enabling fully automated remote installation.

The author details migrating their NAS from CoreOS/Flatcar Linux to NixOS, showing the previous Docker-based setup and step-by-step migration to native NixOS modules. The post serves as an example for those interested in using NixOS for network storage configuration.

The article demonstrates using Nix development shells for GoCV projects without permanently installing OpenCV. It shows four approaches: interactive nix-shell commands, shell.nix configuration files, declarative flakes, and reproducible dev environments. The examples work on any Linux system with Nix installed, not just NixOS.

The article explains how to manage secrets on NixOS using sops-nix, which encrypts secrets at rest for secure sharing in Git repositories. It details setup steps including deriving age identities from SSH keys, configuring sops, and integrating with NixOS to make decrypted secrets available at runtime.

The author's Intel 285K CPU died for the second time, leading them to switch to an AMD Ryzen 9950X3D. They cite concerns about Intel CPU stability based on their experience and reviews mentioning frequent replacements. The AMD CPU shows slightly better performance but higher power consumption compared to the Intel models.

The author attended NixCon 2025 at the University of Applied Sciences OST in Rapperswil, Switzerland, with 450 registered attendees. The conference featured technical talks about Nix-based development tools, CI solutions, and enterprise adoption stories, along with lightning talks and a hack day.

The author has used a MacBook Pro M4 for six months and highlights its excellent battery life and silent operation, with the fan rarely activating. They chose the Pro model primarily for its nano-textured display, which significantly reduces reflections compared to standard displays. The 120Hz refresh rate provides noticeable improvements in responsiveness for certain tasks.

The author describes setting up Immich, a self-hosted photo manager, after Google Photos sync tools stopped working. They installed Immich on a NixOS virtual machine using their existing hardware and configured access via Tailscale VPN. The article details the import process using immich-go tool and setup of the iPhone app for automatic photo backups.

The author describes their attempt to use Wayland with Sway on NixOS in 2026, focusing on challenges with NVIDIA graphics drivers and an 8K monitor requiring TILE support. After applying custom patches to wlroots to work around an NVIDIA bug, they successfully ran Sway on their 8K display for the first time.

The article describes using the microvm.nix project on NixOS to create ephemeral virtual machines for safely running coding agents. This approach isolates agents from personal files and allows easy disposal if compromised. The author provides technical configuration steps for network setup and VM declaration.

The author recounts a production incident where lack of version visibility caused delays. They advocate for three steps to improve version reporting: stamping, plumbing, and reporting build information. This approach aims to reduce troubleshooting time during outages.