JokerTech

Subscribe

Minimizing Blast Radius When You Must Use Unstable Internals

Two files in Photo Sweep touch Nextcloud internals that have no public equivalent — OC\Files\Search\* and OCA\Files_Trashbin. Both check what's available first and degrade rather than break.

Absence of a Report Is Not Evidence of a Clean Image

Trivy Operator reports over ~1.5 MiB fail to write, silently. Your largest images — often your riskiest — show zero findings. Here is how to detect it and the trade-offs in fixing it.

The house rules for adding one more app to a crowded VPS

The house rules for adding one more app to a crowded VPS

One folder, one compose file, a .env.example, a setup.sh that writes the secrets, and nothing in git that the server owns. The conventions I add apps by, and where each one came from.

A Two-Phase Commit for File Moves, Without a Database Transaction

Photo Sweep marks a verdict 'applied' only after the file has actually moved — never before. A crash between the move and the write leaves the file gone but the row still pending, and retrying handles that correctly.

Deciding Is Separated From Doing

In Photo Sweep, a verdict is just a database row until one specific action executes it. You can judge a thousand photos, change your mind about any of them, and close the tab having changed nothing.

Resumable Background Indexing Against an API That Doesn't Support What You Need

Nextcloud's file search only accepts eq/in on fileid, not gt — so a keyset cursor for resumable indexing literally cannot be expressed. Order by file id instead, and let a final sweep catch what slipped.

Rejecting Dates That Only Look Like Dates

PHP's date parser doesn't fail on 20241312 — it rolls month thirteen into January 2025. A parse that succeeds is not evidence of a real date, so Photo Sweep formats every result back and requires a match.

Safest First: Ordering a Migration by Blast Radius, Not by Image Count

The nine-registry routing queue is sorted safest-first: gcrmirror touches one scanner, quay touches OpenBao's StatefulSet, and dragonflydb — GitLab's own Redis — comes with a note that skipping it is a reasonable choice.

Figuring Out When a Photo Was Actually Taken

Nextcloud stores no first-class 'date taken' field. Photo Sweep's month-by-month review depends on one, so it walks a four-link chain — EXIF, filename, mtime, upload time — and records which link answered.

Nine Compliance Specs Hidden in the Binary

Trivy 0.73.0 ships nine compliance specs compiled into the binary — CIS for AWS, Docker, EKS, Kubernetes and RKE2, plus NSA and both Pod Security Standards profiles. Nothing in the help output tells you their names.

Standing on Shoulders, Ethically: Crediting Prior Reverse-Engineering Work

The batchexecute rpcids this app relies on were mapped by someone else's open-source project first. No code was copied, but the knowledge came from somewhere — and the README says exactly where.

Exit Codes Are the Cheapest Gate You Will Ship

One flag decides whether a Trivy scan blocks a pipeline. On the same image, --severity CRITICAL exits 0 and HIGH,CRITICAL --ignore-unfixed exits 1 — and the gate that actually fires is the one that costs 115 milliseconds.

The Signing Mismatch That Fails With "App Not Installed" and Wipes Your Data

Debug and release builds of an Android app are signed with two entirely different keys by default. The first time you switch from one to the other on the same device, the install fails — and the fix wipes your local data.

Deploy a Suspended CronJob, Run It Once, Then Trust the Schedule

A nightly job against a fresh secret is how you get pager noise at 03:15 UTC. The GitOps-safe order: deploy suspended, verify by hand, then unsuspend.

Bookmarks, feeds and books on one VPS, and how little I compared

Bookmarks, feeds and books on one VPS, and how little I compared

Why my reading stack is Karakeep, FreshRSS and Kavita, what the choice really rested on, and the parts I still haven't tested.

The Signing Key Lifecycle: Generate, Back Up, Never Commit, Wire Into CI

Losing an Android release signing key means every future update is permanently impossible. Here is the full lifecycle: generate once, back up twice in different failure domains, and wire four secrets into GitHub Actions with an unsigned fallback for forks.

Handling WebView Renderer Death Instead of Pretending It Won't Happen

Android's WebView runs its rendering in a separate process that can be killed under memory pressure at any time. Ignore that and the whole app dies with it. GPhotosSession.kt treats it as a routine, recoverable event.

Uptime Kuma on a single VPS: 23 monitors, three red, and why

Uptime Kuma on a single VPS: 23 monitors, three red, and why

How I set up Uptime Kuma for a one-box self-hosted stack, which endpoints I point it at, how alerts reach my phone, why three monitors went red without anything being down, and the DNS app I kept off the box.

Rejecting User-Installed CAs to Defeat Proxy Interception

Android trusts user-installed certificates by default, which is exactly what lets a proxy CA read your TLS traffic. Photo Cleaner's network security config opts out of that default entirely.

I asked for a Notion clone and ended up living in NocoBase

I asked for a Notion clone and ended up living in NocoBase

Why the database half of my Notion habit moved to a self-hosted NocoBase instead of a Notion look-alike, and what a day of building on it actually produced.

An Encrypted Local Database Backed by the Phone's Secure Hardware

Photo Cleaner's keep/delete decisions live in Room over SQLCipher, keyed by a passphrase that never exists in plaintext on disk — wrapped by a StrongBox-backed Android Keystore key when the device has one.

Creating the Project Is Not Enough: Measuring the Gap Between Can and Does

With the gitlabcom project created, Public and verified, all nine GitLab pods still pulled from registry.gitlab.com directly. Measured on 2026-09-09 — the MR that enables the Kyverno rule is the step that changes anything.

I wanted my phone to buzz without running a mail server, so I picked ntfy

I wanted my phone to buzz without running a mail server, so I picked ntfy

Why ntfy beat Gotify, Pushover, Telegram and e-mail on my single VPS, how its users and tokens live in a .env file, and how alerts still arrive when the VPS is dead.

Rate-Limiting Yourself Before Google Does It For You

Pacer.kt exists for one reason: keep this app's request pattern inside the envelope a real person browsing photos.google.com would produce. Jittered gaps, capped batches, and an exponential cooldown that only decays on success.

Zero of 17 Pods Pin a Digest

A read-only Kyverno run against the real Pods in a namespace found 17 Pods and zero pinning an image by digest. That number is why the digest policy ships as three separate rules instead of one.