~/

Now

Philipp Kühn — Wed, 11 Feb 2026 00:00:00 +0000

Now</h2>
Working on different projects, including:

Still in the process of getting funding for the verification of Audax Security</a></li>
Networking with companies and the government</li>
Updating our CySecBERT model</a></li> </ul>

Code of Courage: A Comic About Digital Security for Activists

Philipp Kühn — Fri, 07 Nov 2025 00:00:00 +0000

This is a repost of the original page: https://peasec.de/2025/comic/</a>

Code of Courage: A Comic About Digital Security for Activists</h2>
We are excited to announce the release of our comic, Code of Courage: A Comic About Digital Security for Activists. This project draws inspiration from the stories of resilience shared by over 90 activists from Myanmar, Colombia, Costa Rica, Bolivia, Nicaragua, and Cameroon (see e.g., Guntrum 2024 & Guntrum and Reuter 2024). The comic addresses the challenges of technology-facilitated violence and provides strategies to enhance privacy and security. While it offers general guidance, we acknowledge that security is deeply personal, influenced by unique circumstances and constantly evolving risks. Our hope is to spark meaningful conversations and raise awareness, while honoring the expertise of activists who navigate these challenges daily. A heartfelt thanks to the interviewees for sharing their invaluable insights, to Charikleia Livani and Franziska Schraut for their brilliant ideas and illustrations, and to Julian Lawrence for his exceptional guidance and support. Without you the comic would not have been possible!
A new interactive version of the comic is now available at: codeofcourage.dev.peasec.de</a>. There, you can listen to the comic in Spanish, Russian, German, and English, and test your knowledge through short quizzes designed to make learning more engaging.
We encourage you to share the comic, explore new ideas it inspires, and localize or translate it. If you have any feedback, suggestions, or concerns, feel free to reach out to Laura Guntrum at guntrum@peasec.tu-darmstadt.de. Additionally, let us know if you’re interested in acquiring the design files. The comic is licensed under a Creative Commons Attribution-NonCommercial 4.0 International License (CC BY-NC 4.0). The comic was already presented and distributed at RightsCon 2025, a major international summit on human rights in the digital age, which was held in Taiwan and the Night of Libraries at PRIF (Frankfurt, Germany).
What is the comic about?</h2>
A story of activism, digital courage, and resilience.</h3>
Follow four friends as they face surveillance, threats, and censorship—yet stay strong through knowledge, adaptability, and solidarity.

Alex, Sarah, Maria, and Daniel are four friends deeply committed to human rights activism in a country facing rising authoritarianism. As they organize protests and use social media to spread awareness, they’re met with powerful digital threats: internet shutdowns, account hacking, surveillance, and intimidation. When Daniel is arrested, the danger becomes painfully real for the group.
Still, the others don’t give up. Alex, Sarah, and Maria grow more determined. They start learning how to protect themselves: improving their digital security, understanding what information could be used against them, and identifying who might be behind the attacks. They realise that not every app or tool is safe. Some can attract attention even if they are secure. They learn to balance visibility and protection, constantly adapting their strategies and learning how to stay one step ahead.
The comic shows that by sharing knowledge, supporting each other, and adapting fast, activists can keep their voices strong—even under oppression. With courage and teamwork, they prove that the fight for justice can go on. ✊🕊️ </blockquote>
🌍 Our comic on digital security is now available in multiple languages!</h3>

🇺🇸 English version (PDF)</a></li>
🇩🇪 German version (PDF)</a> - Thanks to PRIF & TraCe Knowledge Transfer for the translation.</li>
🇷🇺 Russian version (PDF)</a> - Thanks to Alice Polak for the translation.</li>
🇪🇸 Spanish version (PDF)</a> - Thanks to Christina Fernandez Koch for the translation.</li> </ul>
Interactive Platform</h3>
An online version featuring audio narration in multiple languages and educational quizzes is available at codeofcourage.dev.peasec.de</a>.
Publication Details</h3>

Authors: Charikleia Livani, Franziska Schraut, Laura Guntrum, Julian Lawrence</li>
Year: 2025</li>
Publisher: Universität Darmstadt</li>
DOI: 10.26083/tuprints-00029108</a></li> </ul>
Funding</h3>
This work was supported by Germany's Federal Ministry of Education and Research (BMBF) through the TraCe research center and the ATHENE cybersecurity initiative.
Supporting Resources</h3>
Curated digital security resources:

Holistic Security guide</a></li>
Security in a Box toolkit</a></li>
Access Now Digital Security Helpline</a></li>
Activist Checklist</a></li> </ul>

My MacOS Backup Strategy

Philipp Kühn — Fri, 12 Sep 2025 00:00:00 +0000

As outlined in my last blog post</a>, I failed at my backups again 1</a>, which led me to setting up borgmatic</code></a> again. It is a wrapper for the fantastic toolborg</a>, a command-line tool to create incremental backups of your system. Like every other power-user tool, borgmatic</code> is highly configurable, can back up to different repositories (storage backends) simultaneously, and does automated checks and pruning to keep just the essential bits. However, this should not be an advertisement post about this tool. I want to give an overview of what I want to set up, how I configured it, and what to look for when running custom services on macOS. You find a summary at the bottom of this post.
The Goal</h2> Every backup strategy should follow at least the 3-2-1 rule: 3 copies</li> 2 storage backends</li> 1 off-site backup</li> </ul> This is accomplished by having a storage disk at home for backups and one storage server. With this in mind, I want to set up a remote backup repository (to stay within the naming of borg) and a local, attachable drive for my backups. My system should run borg</code> every 10 minutes, whether the repository is currently available. Ultimately, I want to receive an error if both repositories are unavailable during a run. I usually do not work from home, where my backup drive sits. The Setup</h2> As for the storage server, I already used Hetzner's storage box</a>, which is nearly a steal for remote backups that you do not want to host. They go for 3.2 €/TB to 2.03 €/TB per month, depending on your tier (08/2025), and provide server RAID redundancy. You could order two in different locations (1 in Germany and 1 in Finland). After you decide on the tier you require, you: Set up the access: either via SSH (which allows rsync</code> and borg</code>), WebDAV, or ftp,</li> setup your SSH key (ssh-keygen && cat ~/.ssh/id_ed25519.pub</code>), and</li> Set your box to externally accessible, and that's it. All done in less than 2 minutes.</li> </ol> My local backup drive is already available. I back up my Linux system with it regularly and automatically with borgmatic</code>, which is attached via my monitor at home. In addition, I plan to set up my Raspberry Pi with an m.2 hat to serve as a backup server, but that is a to-do for me in the future. With my two repositories available, I need to configure borgmatic</code>. I adjusted my Linux config, resulting in the config below (comments included for explanations and are prefixed with #</code>) stored at $HOME/.config/borgmatic/config.yaml</code>. # the directories to backup source_directories: - /Users/pkuehn/Documents - /Users/pkuehn/Movies - /Users/pkuehn/Music - /Users/pkuehn/Pictures - /Users/pkuehn/src # all my source code - /Users/pkuehn/var # stuff repositories: # defines the repos, labels are for internal references - path: user@storagbox:23/path/to/repo/dir # url with path label: storagebox - path: user@storagbox:23/path/to/repo/dir # url with path label: storagebox-helsiki archive_name_format: "macbook-{now:%Y-%m-%dT%H:%M:%S.%f}" keep_hourly: 12 keep_daily: 15 keep_weekly: 8 keep_monthly: 6 keep_yearly: 4 exclude_patterns: - '*.pyc' - '**/.cache' - '**/.venv' # python virtual env - '**/.devenv' # devenv (awesome tool) - 'src/**/target' # exclude these big rust dirs - 'Music/Music # just a copy of everything else in the music dir match_archives: '*' exclude_caches: true exclude_if_present: - .nobackup # excludes all dirs with a hidden file `.nobackup` # while I do not like this ad hoc exclusion # it just works checks: # define regular consistency checks - name: repository - name: archives frequency: 1 week encryption_passcommand: 'your pass command' # a command, which returns your password ssh_command: 'your ssh command' # your ssh key, with the keyfile # option for your storage box relocated_repo_access_is_ok: true # don't complain if repo moves</code></pre> With this in place, I need to set up the repositories for this backup with borgmatic init --encryption repo-key</code>, which initializes the repos. Afterward, you run borgmatic key export</code> to extract the repo-keys and store them in your password store. Now you can confirm borgmatic</code> is working by running it and waiting a long time for no feedback (borgmatic</code> is a little weird in this regard, as it does not return any feedback if not using any verbose parameter, unlike borg</code>, which outputs everything). Custom Services on MacOS</h2> Coming from Linux, I used tools like cron or systemd a lot. Both offer ways to run scripts or tools regularly, with cron being the standard since the beginning of Linux, and systemd being the new horse in town since 2010. On macOS, however, cron is deprecated and systemd is not available. MacOS uses a scheduler, LaunchD, which defines services in an XML format. <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>Label</key> <string>backup-service</string> <key>Program</key> <string>/opt/homebrew/bin/borgmatic</string> <key>RunAtLoad</key> <true/> </dict> </plist></code></pre> This service definition is labeled backup-service</code>, and starts the program /opt/homebrew/bin/borgmatic</code> on load. And that's it. It runs the service just once. Depending on where you store it, it runs with different scopes. launchd.info</a> provides an overview of launchd services with this manpage</a> giving a more comprehensive overview. The interesting bits for me are: how to start services with a timer logic (similar to systemd-timers</a> or cron jobs)</li> How to adhere to the macOS power management, as I guessed, there will be a fancy flag for that as well in this user-friendly operating system</li> How to handle a short interval, but no overlapping of service starts. borg</code> (or borgmatic</code>) blocks overlapping runs, but maybe there is a way to disable this in the service definition as well</li> </ul> Starting the service was the easiest part. You can specify a StartInterval</code> as follows. <key>StartInterval</key> <integer>600</integer> # seconds (10mins here)</code></pre> If interested, you could even start the service at a specific time of day with StartCalendarInterval</code>, similar to crontab's. But a simple </code>*/5 1 * * *` like you would have done in cron, which specifies to run the command every five minutes during the second hour of the day, requires you to write the following XML 2</a>: <key>StartCalendarInterval</key> <array> <dict> <key>Minute</key> <integer>0</integer> <key>Hour</key> <integer>1</integer> </dict> <dict> <key>Minute</key> <integer>5</integer> <key>Hour</key> <integer>1</integer> </dict> <dict> <key>Minute</key> <integer>10</integer> <key>Hour</key> <integer>1</integer> </dict> <dict> <key>Minute</key> <integer>15</integer> <key>Hour</key> <integer>1</integer> </dict> <dict> <key>Minute</key> <integer>20</integer> <key>Hour</key> <integer>1</integer> </dict> <dict> <key>Minute</key> <integer>25</integer> <key>Hour</key> <integer>1</integer> </dict> <dict> <key>Minute</key> <integer>30</integer> <key>Hour</key> <integer>1</integer> </dict> <dict> <key>Minute</key> <integer>35</integer> <key>Hour</key> <integer>1</integer> </dict> <dict> <key>Minute</key> <integer>40</integer> <key>Hour</key> <integer>1</integer> </dict> <dict> <key>Minute</key> <integer>45</integer> <key>Hour</key> <integer>1</integer> </dict> <dict> <key>Minute</key> <integer>50</integer> <key>Hour</key> <integer>1</integer> </dict> <dict> <key>Minute</key> <integer>55</integer> <key>Hour</key> <integer>1</integer> </dict> </array></code></pre> Hence, I wrote a simple Python tool</a> to convert crontab entries to simple launchd entries. It does not add any fuzz or fancy, but it should suffice for a starter and for configuring later. But back to the topic. The second part I was interested in was service power management settings. Here I found information in the launchd.plist (5) manual</a> and this launchctl (1) manual</a>. The vital flag is LimitLoadToSessionType</code> LimitLoadToSessionType <string> This configuration file only applies to sessions of the type specified. This key is used in concert with the `-S` flag to `launchctl`.</code></pre> with the launchctl sessiontype being Aqua, LoginWindow, Background, StandardIO, and System. -S sessiontype Some jobs only make sense in certain contexts. This flag instructs launchctl to look for jobs in a differ- ent location when using the -D flag, and allows launchctl to restrict which jobs are loaded into which session types. Currently known session types include: Aqua, LoginWindow, Background, StandardIO and System.</code></pre> This documentation</a> provides a comprehensive overview of the former four session types. The System type seems not to be documented at all (according to this mailing list</a>), so I copied what is written in the mailing list. Aqua (default): Run app when the user is logged in. Has GUI access.</li> StandardIO: Runs only in non-GUI login sessions (most notably, SSH login sessions).</li> Background: Runs in a context that's the parent of all contexts for a given user.</li> LoginWindow: Runs in the login window context.</li> System: Services run in system/root context (requires root privileges).</li> </ul> The session type System</code> is for root services, which I currently do not need. As I want to run a background</code> backup service, where the GUI is not required but should also run in the GUI session if they are up, I went for the SessionType Background</code> (surprise). This does not strictly adhere to the requirement of power management, such as running only when on a power adapter or Wi-Fi.</del> Edit: The background</code> service is a system-wide service and causes problems, when used for user services. Hence I removed the full LimitLoadToSessionType</code> key. The third part I wanted to deal with is the non-overlapping service starts. I started out with using the following snippet: <key>LaunchOnlyOnce</key> <true/></code></pre> After I added it to the plist file, I was surprised that it ran my intervalled service just once. I checked the doc and noticed that this flag overrides any indicated interval services. Fair point, so I removed this flag and let borgmatic</code> deal with it. So this is the plist file I ended up with. <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict>  <key>Label</key> <string>pkuehn.borgmatic</string>  <key>ProgramArguments</key> <array> <string>/opt/homebrew/bin/borgmatic</string> </array>  <key>StartInterval</key> <integer>600</integer>  <key>WorkingDirectory</key> <string>/Users/pkuehn</string>  <key>EnvironmentVariables</key> <dict> <key>PATH</key> <string>/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin</string> <key>HOME</key> <string>/Users/pkuehn</string> </dict> <key>StandardOutPath</key> <string>/Users/pkuehn/Library/Logs/borgmatic-std.log</string> <key>StandardErrorPath</key> <string>/Users/pkuehn/Library/Logs/borgmatic-err.log</string>  <key>RunAtLoad</key> <false/>  <key>KeepAlive</key> <false/>  <key>ProcessType</key> <string>Background</string>  <key>ThrottleInterval</key> <integer>30</integer>  <key>SoftResourceLimits</key> <dict> <key>CPU</key> <integer>3600</integer>  <key>NumberOfFiles</key> <integer>1024</integer> </dict> </dict> </plist></code></pre> But after placing the service in ~/Library/LaunchAgents/pkuehn.borgmatic.plist</code>, I was greeted with this nice pop-up: Python requires Full Disk Access </blockquote> Which I of course denied. I do not want my global Python interpreter to have full disk access, but just borgmatic</code>, which is written in Python. So, I required a wrapper app to deal with the FDA's permission. The solution of this blog post's author was to write a wrapper for borgmatic</code>, which is not written in an interpreted language (here, GoLang), to limit the permission to just this one wrapper-binary. I also went for the simplest possible solution and wrote a Go wrapper. It checks the path of borgmatic</code>, runs the binary, and forwards the I/O to the OS's I/O. package main import ( "log" "os" "os/exec" ) func main () { fname, err := exec.LookPath("borgmatic") if err != nil { log.Fatal(err) } cmd := exec.Command(fname) cmd.Stdout = os.Stdout cmd.Stderr = os.Stderr if err := cmd.Run(); err != nil { log.Fatal(err) } }</code></pre> After a short go build</code> and `cp'ing the binary to the PATH, I corrected the path in the previous plist file to  <key>ProgramArguments</key> <array> <string>/Users/pkuehn/bin/borgmatic-wrapper</string> </array></code></pre> And that's it. After loading and starting the service, I was greeted with the FDA pop-up again -- but now for my wrapper app, and my backups are running regularly 💪 storagebox: Listing archives macbook-2025-08-25T21:30:47.116654 Mon, 2025-08-25 21:30:47 [a51ffcc5f88e0fe68f9e2092558e08d622faaef6b6984b88a755d587875abf42] macbook-2025-08-26T17:05:31.543293 Tue, 2025-08-26 17:05:32 [287f7aae1d9e342233677d01b49ed940eac143423867079e5111b0aca3eebe8a] macbook-2025-08-27T22:14:35.876593 Wed, 2025-08-27 22:14:36 [36e49f6dc52e520b466527200703583231484a8d1825833819a5ece1a19954d8] ... 21 more snapshots macbook-2025-09-10T16:59:04.454872 Wed, 2025-09-10 16:59:05 [693445c4040ddf59b0b89ad09e433481798aaad3107a5bcf4b0d2af3c6f9f317] macbook-2025-09-10T17:32:57.683485 Wed, 2025-09-10 17:32:58 [1e2460041c7894f91b7797e2121ccf53bc4341dc39756f274490684844fb81b0] macbook-2025-09-11T09:40:37.482414 Thu, 2025-09-11 09:40:38 [1432754d70f288e82b76317a0df478978b3c25695253abe3a095bfde4f97840d] storagebox-helsinki: Listing archives macbook-2025-09-04T15:48:58.497271 Thu, 2025-09-04 15:48:59 [6f6204352938aa8c86f6d7ed261c96b2520b60587ab6d2f5f516f57143199437] macbook-2025-09-04T16:40:59.401094 Thu, 2025-09-04 16:41:00 [17d882dbcaecb0ca388039993c3696aaeee8d2ab9c6552bf49af750e597eb92a] macbook-2025-09-05T15:51:06.984910 Fri, 2025-09-05 15:51:08 [385244415e2ba7e175b302dc424de9600254e82e45b4ab8f5f79ba878ce13bb1] ... 12 more snapshots macbook-2025-09-10T14:44:02.471958 Wed, 2025-09-10 14:44:03 [a49ea4c49f2605d508efafc7e864ddb5a75736b6f37f05eb0b095f4c07553fed] macbook-2025-09-10T17:02:22.104919 Wed, 2025-09-10 17:02:23 [a7734cd44fde108b594a048debc09b492efaa93c2947858f80727c194d637059] macbook-2025-09-11T09:44:01.122305 Thu, 2025-09-11 09:44:02 [ea2bba31169e8db51288219ed0c0931f9d4fc09837668268793c221494420100]</code></pre>Summary</h2> Set up borgmatic</code> to your liking and with different repositories to adhere to the 3-2-1 rule</li> Compile a wrapper app for borgmatic to correctly set the Full Disk Access permissions to just the wrapper instead of Python.</li> Write your .plist</code> file and place it in $HOME/Library/LaunchAgents</code>. You find documentation references and my file as an example above.</li> Load and launch your service file and enjoy your automated background service for borgmatic.</li> </ol> ^{1 The last time was in 2019, when I lost some photos after I switched from Linux to (ironically) MacOS for half a year and forgot to back up my photos, before wiping the system as a whole. </div> ^{2 WTF Apple ?!?!?!??!!!?? </div>}}
Another Backup Fail Philipp Kühn — Sun, 24 Aug 2025 00:00:00 +0000 I know, I know... I should have learned my lesson the first time. But no, here I am again, having lost another round of precious pictures due to a backup failure. And it is okay to put all the blame on myself this time (and a tiny "wtf" on MacOS too). What happened?</h1> Yesterday I decided it would be a good time to check the privacy settings on my MacBook. I found that the Apple Cloud completely synced with every other setting. I noticed that the only thing synced was my iPad, but still, I did not want to risk that any of my data would be synced to the cloud. So I disabled the sync for everything, including photos. There was a little pop-up, which asked me to delete all synced Photos on the device. As I did take some photos with my iPad, which might have been synced, I thankfully clicked "Yes". I did not think about the possibility that this would go into my $HOME/Pictures</code> directory and just wipe everything. What I tried to recover</h1> So after I noticed my fuck-up (which was a day after), I checked all my backups, but none had my images. While I installed nix-darwin</a> on this device a month before, none of the services I configured in my flake for home-manager</a> worked, as they are built on top of systemd</a>, which is not available on macOS. There are services in nix-darwin</code> which are using launchd</a>, but none for borg</a>/borgmatic</a>. Hence, I did not have automatic backups yet. As for manual backups, I regularly ran borgmatic, but my config excluded the bulky files such as videos and raw images (CR2 and CR3). Then I found a Lightroom Preview file. But here again, I was not able to extract the pictures either. I found a forum</a> where extraction is discussed, but I might have been too brain-fogged at that moment to follow. Verdict</h1> Nevertheless, my images are gone, the backup routine is in the works (the blog post will follow), and I miss the easy customizability of my system, because macOS seems to get in the way when doing more advanced stuff like automated backups with a script. Be aware of this when turning off your iCloud backups, even when you do not use this stuff! NixOS on Netcup Philipp Kühn — Wed, 20 Aug 2025 00:00:00 +0000 NetCup is a German hosting provider, which offers affordable virtual private servers (VPS) and dedicated servers. It offers way more storage than other providers, like Hetzner, which I used before (and still have a server for now). This increased storage capacity allows me to run other services, and not having to worry about running out of space (which I did with Hetzner and a wrong configuration for the Home Manager Garbage Collection</a>). Installing NixOS on Netcup</h2> The installation on Netcup is straightforward: Wait for a deal on NetCup</a> you are interested in and order it.</li> Log in to the Netcup server control panel and open the server management page.</li> Download the current NixOS ISO image from the NixOS download page</a>.</li> Go to "Media", "DVD Drive", upload the NixOS ISO image at Custom ISOs.</li> Restart the server.</li> </ol> Now you can open the Screen Console in the Netcup server management page and proceed with the NixOS installation instructions. I went with setting up the keymap via loadkeys de-latin1</code>, setting the password, connecting via ssh</code> (because I hate the web console), partitioning the disk using disko</a> with sudo nix --experimental-features "nix-command flakes" run github:nix-community/disko -- --mode disko [disko-config]</code>, generating the NixOS configuration using sudo nixos-generate-config --root /mnt</code>, configuring a basic NixOS configuration which includes a user with authenticated ssh key, and installing NixOS using sudo nixos-install --root /mnt</code>. While I use a flake for my NixOS configuration, it did not work for the NixOS installation, as I was not able to log into the system when installing it like this: sudo nixos-install --root /mnt --flake .#netcup</code>, but I am going to investigate this further, as it worked on a desktop like a charm. Post-Installation</h2> After the installation, I checked if all was working, adjusted my flake to include the new server, and rebuild the system using nixos-rebuild switch --flake .#netcup</code>, which included all my configurations, like the Home Manager configuration and services like taskserver</a>. MacOS Non-Breaking Character Philipp Kühn — Mon, 28 Jul 2025 00:00:00 +0000 Since using MacOS, I was annoyed by the fact that typing a non-breaking space (NBSP) is way too easy. Nearly every time I wanted to type a space after a pipe |</code> (opt+7</code> on MacOS), I accidentally typed a NBSP, as opt+space</code> is the shortcut for it. This resulted in the piped command not being executed, as the NBSP is not recognized as a space, but as first character of the next command. cat example.json | jq . | less</code></pre> Running the above command would result in an error, as jq</code> is not recognized as a command because of the leading NBSP. Instead I always had to type cat example.json |jq . |less</code>, which is not only annoying, but also less readable if the oneliners become longer. To fix this, I updated my ~/Library/KeyBindings/DefaultKeyBinding.dict</code> file with the following content: { "~ " = ("insertText:", " "); }</code></pre> (Source</a>) And after a restart (Noooo, my precious uptime!) the NBSP is gone and I can type spaces after pipes again. What a hassle! Switching to MacOS for now Philipp Kühn — Mon, 30 Dec 2024 00:00:00 +0000 A while ago the display of my ThinkPad T490 started to flicker. It seemed to stopped after a short while, but twice it even persisted for more than 30 minutes. While working docked I didn't notice it, but while giving lectures or working during a train ride this sucked. It distracted me really hard, and I fear that it will break sooner or later. And because this device is from 2019 and the processing unit is even older I decided it is time for a new device. On my NixOS T490 I knew, I will not get through a whole 8-hour workday without ending up with a plastic brick at the end of a day. Even with low backlight settings, while nvim</code>ing</a> (with a pretty light config</a>) on LaTeX or markdown with some LSP actions, Firefox, and light background services1</a>. And once in a while I need to do some heavy lifting by compiling code, testing LLMs, but then I am usually near a power outlet. There might be other efficiency tweaks in NixOS, but I don't want to spend an uncertain amount of hours to find the right knob and maybe get 30 minutes. Thanks to a colleague I came around this nice graphic from xkcd. </a> Don't get me wrong! I love tweaking my systems. Just today I revived my system config, most prominently my nvim config</a> and added new plugins I discovered while working with NixOS and installed all the necessary terminal tools. But scouring the documentation for days just to get my system running for 30 minutes longer than before is not worth the time. Another colleague of mine spoke of his on-battery times with his MacBook, which exceed usually two full days, and this got me hooked. It sounded insane for me, to get more than a day out of my laptop, which surpasses even my phone. Not only does this allow you to go on tour without a charger and without thinking where to find the next power outlet, but it actually consumes less energy and is much more efficient and environmental friendly2</a>. I didn't use a MacBook since 2013, and I guess, a lot have changed (not just the OS, but also my usage). So now, here I am with a M4 MacBook Pro in front of me, charge it once in two or three days and just let it sleep while it is not used. It needs some more tweaking to really make it mine by setting up my isync</code> and neomutt</code> as I noticed Mail and I will not be friends in the near future but besides that, it seems really nice. It just works the way I expect it to work. I also looked into using Nix-Darwin</a>, but for now, I want to maintain a mainly stock experience and just do small adjustments here and there. ^1I ran isync</code></a> for my neomutt</code></a> mail setup, regular backups with borgmatic</code></a>, and a Python session in tmux</code></a>. </div> ^2Newer x86 AMD or Intel processors do claim similar runtimes, but I'm not sure, if this is the case when running Linux. And I know of the Rebound effect</a> </div> Advent of Code Philipp Kühn — Sun, 29 Dec 2024 00:00:00 +0000 It is this time of the year, where you usually have some time to spare, which is either filled with family activities or personal projects. When you are into programming you might have heard of the fantastic Advent of Code</a> which is an Advent calendar contain a bunch of small tasks to solve programmatically. Some of them even contain mathematical problems, which, when solved, speed up your program tremendously. It is similar to Project Euler</a>, but presents new riddles every year, which are wrapped in a small Christmas story, and you can even compete with friends or colleagues on private leaderboards. This year, I use advent of code as an excuse to dive deeper into Rust, after years of using Python and even code-golfing</a> my solutions, and being bored with it. I was invited to a nice group of people at my university, who ran a private leaderboard and set up a benchmarking repository for their solutions. This gave me the necessary boost to give it a try for another year and start over. And it was (is) a good year. I'm not finished with all days yet, but it is a welcoming diversion from the everyday coding during work! If this year's solutions are finished, I might put them online 👍 Connect to your computer Philipp Kühn — Tue, 24 Dec 2024 00:00:00 +0000 When was the last time some broke down in your home, and you had to call a handyman? And have you peeked into the bags with good quality tools they bring with them? I personally have never seen a handyman who dismisses quality tools to get the job done and here is a guess, why this is: they just don't want to pay the bill of not using them in the long run. Sure, you can get your job done with shitty tools that may break after some time. And that may actually be okay1</a> in short term. But in "the long run" it may cost you not just the regular replacement of tools, but you may also get health-wise problems of not using good tools. As a handyman you might cut yourself because the screwdriver skid down, fall of that instable ladder, or suffer from long-term problems, because you used too much brawn while you instead could just have used a nice hammer drill to drill those holes in the concrete. This is one of the reasons, why I think that handymen own those quality tools, they use every day of their lives. But when we change professions and enter office settings, the entire mindset appears to shift. How many of you, upon starting a new job, arrived at the office on your first day to be greeted not only by your new and friendly colleagues, but also by a black block of plastic, a full-size rubber dome keyboard with the standard QWERTY layout, and a USB mouse lacking thumb buttons? Typing on these layouts can be uncomfortable in the long term. In 1932, the Dvorak keyboard layout</a> was created, which could easily be used with ANSI keyboard layouts</a>. There are also numerous alternative ergonomic layouts for ISO keyboards. The search for an ergonomic physical keyboard layout is ongoing. Since 1972, there has been scientific evidence</a> indicating that touch typing on traditional physical keyboards is slower and more uncomfortable. From what I have gathered, there have always been pioneers in the field working to develop ergonomic keyboards for everyone. With the ability to develop and print custom PCBs and keyboard cases, finding the perfect ergonomic keyboard has become a real possibility. This greatly expands the options available to find what works best for you as an individual, but it can also lead down a deep rabbit hole. And if we consider the fact that our brains are wired to utilize patterns we recognize, switching keyboards and layouts becomes a big hassle. Therefore, most people either do not know about other options because they are not exposed to them, or they use what they know due to other obstacles. For me, this was definitely the case until a friend introduced me to Bone, an ergonomic ISO layout designed to replace the German QWERTZ layout. While he committed to learning Bone because he wasn't touch typing before, I stuck with QWERTZ because I was faster with it and couldn't spare the mental capacity to learn a new layout. This was about two years ago. But when I saw this presentation</a>2</a> about 5 months ago, explaining the long term issues with traditional keyboard layouts (and keyboards), I was hooked again and started crawling deeper into this seemingly endless rabbit hole. I researched ergonomic keyboard layouts and decided to stick with the Colemak-DH</a> layout. I have always preferred the ANSI layout over the ISO layout, but all my laptops are equipped with ISO-Keyboards, so of course there are even technical hurdles to overcome. Afterward, the dive into potential keyboards was not far away. I looked into split keyboards and stuck with the Corne</a>, as it seemed the easier one to switch to (and it looks sick!), and actually build my first keyboard from scratch. But the build guide and more details into the used firmware will be something for another day. ^{1 It probably won't be okay since you need to keep buying the tools you need if they break. So the monetary and time-wise value still needs to be invested all the time. </div> ^{3 Or whatever the default layout there is in your country. </div> ^{2 The presentation is in German language. </div>}}} Home Manager Garbage Collection gone wrong Philipp Kühn — Fri, 27 Sep 2024 00:00:00 +0000 I recently ran into a problem with my NixOS server (and apparently my laptop as well). And as a proud and convinced, but novice NixOS user, I use all the fancy features like Flakes</a> and Home Manager</a> to manage my user configuration. Unfortunately, I made a mistake in my configuration which led to a full disk, and the inability to update my server any longer. The Problem</h2> The NixOS garbage collection is configured to run every day and to just keep the last 14 days of generations. It worked well, but still the storage was still filling up. I suspected some services like Mastodon, which I ran at that time, to be the culprit with all the media files and the database. However, after a short investigation, I found out that the root cause was actually the /nix/store</code> directory. As I use flakes to manage my NixOS configuration, I checked on my laptop as well, and noticed a similar problem with nearly 300 GB of /nix/store</code> usage and 295 GB in /nix/store/.links</code> 🤯 While this might not be uncommon on NixOS when installing a lot of packages with a lot of different versions, keeping a lot of generations it still seemed a bit too much for me, as I try to keep my systems as clean as possible. I checked in with my local NixOS community</a> (esp. Atemu</a>) and they pointed me to the Home Manager garbage collection as this needs to be configured separately from the NixOS garbage collection. After a nix-env --list-generations</code> it confirmed, that I had just 7 NixOS generations on my system. But a short nix-store --gc --print-roots | grep -vE "^(/nix/var|/run/\w+-system|\{memory|\{censored|/proc/maps/)"</code></pre> showed a shitload of generations, which I did not expected. The Solution</h2> After some hints, I found out that I had not configured the Home Manager garbage collection. I setup a quick home-manager module, which mirrors my NixOS settings, so that it runs in sync with the NixOS garbage collection and defaults to true</code>! { lib, config, osConfig, ... }: with lib; let cfg = config.custom.gc; in { options.custom.gc.enable = mkOption { description = "Enable home-manager-gc based on nixos gc"; type = types.bool; default = true; }; config = mkIf cfg.enable { nix.gc = { automatic = osConfig.nix.gc.automatic; options = osConfig.nix.gc.options; }; }; }</code></pre> After applying this configuration and nix-collect-garbage --delete-older-than 14d</code>, I was rewarded with the following output: deleting unused links... note: currently hard linking saves 29539.49 MiB 476109 store paths deleted, 201139.22 MiB freed</code></pre> I also ran that on my server, and it cleared up some critical space as well. With the new Home Manager module in place, and in the fashion of NixOS, I will never run into this problem again 🥳 Thanks again to the NixOS community for the help and support! Let's get started Philipp Kühn — Sat, 27 Jul 2024 00:00:00 +0000 This is the usual place to give you some template like looking page, which presents you how everything will look like. But since, I am not settled with the layout yet, and I think, it would be a waste of your time, I would like to rather give you a short introduction of, why I'm starting to blog. The story begins with me wanting to write for my own (and others) a long time now. One may ask "Why? Writing comes naturally, when you seek it out?" but for me, it never came. </blockquote> To this question I can only give you the following answer. I always got caught in some kind of perfectionism, i.e., I never found the right tool for me and then never getting the start. Once I tried hugo</a>, but it was never meant to be for me. Then I tried to build my own static-site-generator but stopped half-way through and deleted, what I had. I never knew what should be the topic, that I would like to spread to the world. I didn't want to give too many details of what I am up to, but wanted to share something. Most of the time I wanted to share all the nerdy tech tools I tinkered with, but without a platform to share, it never had been. When I think back to that time, I would never have worked to publish something. My focus was not there yet, and from what I think now about all of that, is that it should mainly serve me, and that was not, what I though of when thinking about blogging. But with new plans flowing through my family, I wanted to just get this out of my head and document it, in the first place, just for us as a family, but you and all the other readers are of course invited to join us on that journey. Now, some may ask "Will this be yet another blog about tech or travel or something else?" </blockquote> Maybe it will, maybe it won't. But the thing is, that I noticed that I need some kind of volume to empty my head and share my thoughts. No matter, if it is about something that is currently happening in my life or some nice tooling I discovered. Currently, I am even thinking about giving some more details about the research I have done over the years. Moreover, is it meant to document our current situation as a family and the things, that are going to change for us. So, I will write it down and try to keep it up to date as time allows it to be. So the blog will probably span over General writing</li> Tech Nix and NixOS</li> Linux in general</li> Programming</li> Keyboards</li> </ul> </li> Photography But it may also change over time.</li> </ul> If you want to get informed of changes, just subscribe to this page's rss feed</a>. You may also contact me</a>. I try to read every message that is sent to me 😋

Interactive Platform</h3>
An online version featuring audio narration in multiple languages and educational quizzes is available at codeofcourage.dev.peasec.de</a>.</p>

Funding</h3>
This work was supported by Germany's Federal Ministry of Education and Research (BMBF) through the TraCe research center and the ATHENE cybersecurity initiative.</p>

Supporting Resources</h3>
Curated digital security resources:</p>

Holistic Security guide</a></li>
Security in a Box toolkit</a></li>
Access Now Digital Security Helpline</a></li>
Activist Checklist</a></li> </ul>

~/

Now

Now</h2>
Working on different projects, including:</p>

Still in the process of getting funding for the verification of Audax Security</a></li>
Networking with companies and the government</li>
Updating our CySecBERT model</a></li> </ul>

Code of Courage: A Comic About Digital Security for Activists

My MacOS Backup Strategy

Another Backup Fail

NixOS on Netcup

MacOS Non-Breaking Character

Switching to MacOS for now

Advent of Code

Connect to your computer

Home Manager Garbage Collection gone wrong

Let's get started

~/

Now

Now</h2> Working on different projects, including:</p> Still in the process of getting funding for the verification of Audax Security</a></li> Networking with companies and the government</li> Updating our CySecBERT model</a></li> </ul>

Code of Courage: A Comic About Digital Security for Activists

What is the comic about?</h2> A story of activism, digital courage, and resilience.</h3> Follow four friends as they face surveillance, threats, and censorship—yet stay strong through knowledge, adaptability, and solidarity.</p>

A story of activism, digital courage, and resilience.</h3> Follow four friends as they face surveillance, threats, and censorship—yet stay strong through knowledge, adaptability, and solidarity.</p>

Publication Details</h3> Authors:</strong> Charikleia Livani, Franziska Schraut, Laura Guntrum, Julian Lawrence</li> Year:</strong> 2025</li> Publisher:</strong> Universität Darmstadt</li>

Funding</h3> This work was supported by Germany's Federal Ministry of Education and Research (BMBF) through the TraCe research center and the ATHENE cybersecurity initiative.</p>

Supporting Resources</h3> Curated digital security resources:</p>

My MacOS Backup Strategy

The Goal</h2> Every backup strategy should follow at least the 3-2-1 rule:</p> 3 copies</li> 2 storage backends</li>

Another Backup Fail

NixOS on Netcup

MacOS Non-Breaking Character

Switching to MacOS for now

Advent of Code

Connect to your computer

Home Manager Garbage Collection gone wrong

Let's get started

Now</h2>
Working on different projects, including:</p>

Still in the process of getting funding for the verification of Audax Security</a></li>
Networking with companies and the government</li>
Updating our CySecBERT model</a></li> </ul>

Funding</h3>
This work was supported by Germany's Federal Ministry of Education and Research (BMBF) through the TraCe research center and the ATHENE cybersecurity initiative.</p>

Supporting Resources</h3>
Curated digital security resources:</p>

Holistic Security guide</a></li>
Security in a Box toolkit</a></li>
Access Now Digital Security Helpline</a></li>
Activist Checklist</a></li> </ul>