Reposted by beat
It's very exciting that AI can now take substantial real-world software like zlib and prove it correct (github.com/kim-em/lean-...).
@kirancodes.me found a bug by fuzzing, but it was outside of the boundary of what was verified (kirancodes.me/posts/log-wh...). That doesn't diminish the excitement!
kirancodes.me
Lean proved this program was correct; then I found a bug.
AI agents are getting very good at finding vulnerabilities in large-scale software systems.
![Over the last week, I learned that it's possible to have multiple desktop portals (_implementations_, I guess?) for Wayland active, and even specify which one to choose for which to choose which one.
This is what this looks like:
```nix title="home.nix"
# ...
xdg.portal = {
enable = true;
extraPortals = [
pkgs.xdg-desktop-portal-gtk
pkgs.xdg-desktop-portal-gnome
];
config.common = {
# for files, mainly, since my nautilus takes ages to load
default = "gtk";
# screen sharing doesn't work otherwise on GNOME
"org.freedesktop.impl.portal.ScreenCast" = "gnome";
"org.freedesktop.impl.portal.RemoteDesktop" = "gnome";
};
};
# ...
```
Link to the config](https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:fzyhtjbjqeoj2pmjajl5ehou/bafkreihdijatrw2m4zfkpgz5nhsvp77v5c7nuelqxmjr3wg4khp54mj6om)
![Today I finally tackled something that has annoyed me for a while since switching most of my editing/digital gardening/second brain-writing over to Emacs.
Whenever I took 30 minutes and tried to get title fetching of links to work, I couldn't get it to work in this self-allotted time. So I asked Opus to do the dumbest thing possible: Just fetch it via curl, and then apply stuff asynchronously.
(Obviously the other, non-dumb way should work too, but I've spent way to much time on this now either way.)
(And apparently there's also `url-insert-file-contents`, maybe I'gonna try that some other time.)
```elisp
(defun flt--url-at-point ()
"Get URL at point, or nil."
(thing-at-point 'url))
(defun flt--url-from-kill-ring ()
"Get URL from kill ring if it looks like one, or nil."
(let ((text (current-kill 0 t)))
(when (and text (string-match-p "\\`https?://" text))
(string-trim text))))
(defun flt--get-url ()
"Get URL from point first, then kill ring. Nil if neither has one."
(or (flt--url-at-point)
(flt--url-from-kill-ring)))
(defun flt--extract-title (html)
"Extract <title> content from HTML string."
(when (string-match "<title[^>]*>\\([^<]*\\)</title>" html)
(string-trim (match-string 1 html))))
(defun flt--insert-markdown-link (url title marker)
"Replace URL at MARKER with a markdown link, or insert at MARKER."
(with-current-buffer (marker-buffer marker)
(save-excursion
(goto-char marker)
;; If there's a raw URL at point, replace it
(let ((url-bounds (thing-at-point-bounds-of-url-at-point)))
(if url-bounds
(progn
(delete-region (car url-bounds) (cdr url-bounds))
(insert (format "%s" title url)))
(insert (format "%s" title url)))))))
(defun flt-fetch-link-title ()
"Fetch the title of a URL (at point or kill ring) and insert a markdown link.
If point is on a URL, replaces it. Otherwise inserts at point."
(interactive)
(let ((url (flt--get-url)))
(if (not url)
(message "No URL found at point or in kill ring.")
(let ((marker (point-marker))
(buf (generate-new-buffer " *flt-curl*")))
(message "Fetching title for %s..." url)
(make-process
:name "flt-curl"
:buffer buf
:command (list "curl" "-sL" "-m" "10"
"-H" "User-Agent: Emacs"
"--" url)
:sentinel
(lambda (proc _event)
(when (eq (process-status proc) 'exit)
(let ((title
(with-current-buffer (process-buffer proc)
(flt--extract-title (buffer-string)))))
(if title
(progn
(flt--insert-markdown-link url title marker)
(message "Inserted: %s" title url))
(message "Could not extract title from %s" url)))
(kill-buffer (process-buffer proc))
(set-marker marker nil))))))))
(map! :leader
:desc "->title" :nv "d f" #'flt-fetch-link-title)
```
And in the meantime, I also learned that _markers_ exist!
So now, I can fetch link titles again, like I'm used to :)](https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:fzyhtjbjqeoj2pmjajl5ehou/bafkreibd6gt3rjjg3jwc36prm3tew6scsri5wetrfto7jckquw7opoveae)
![An entry point for Nix stuff.
# Writing your first flake
Your flake is the entry point to your application built and run with nix.
Your flake is a function from `inputs` (which consist of urls for getting package sets) to `outputs`, with outputs being one big _attribute set_.
This `outputs` _attribute set_ looks something like this (very much like a JSON object):
```nix
# outputs
{
apps = { ... };
checks = { ... };
devShells = { ... };
formatter = { ... };
legacyPackages = { ... };
nixosConfigurations = { ... };
nixosModules = { ... };
overlays = { ... };
packages = { ... };
}
```
Every key in here is a special, magic key that Nix interprets in a certain way.
For the minimal (non-functional) flake:
```nix
{
inputs = {};
outputs = {...}: {};
}
```
all of them are empty.
Through populating them, we give our Nix Flake additional capabilities.
The first capability to give our Nix Flakes is normally a _development shell_.
In Nix Language, we create this like this:
```nix title="flake.nix"
{
inputs = {
nixpkgs.url = "github:nixos/nixpkgs?ref=nixos-unstable";
};
outputs = { nixpkgs, ... }: {
devShells.x86_64-linux.default = nixpkgs.legacyPackages.x86_64-linux.mkShell {};
};
}
```
And run it via `nix develop` (getting it? The `devShells` output gets run by `nix develop`):
```shell
> nix develop
(nix-shell-env)>
```
But that doesn't do anything yet.
For it to do something we need to add something into the devshell:
```nix title="flake.nix" del={7} ins={8-10}
{
inputs = {
nixpkgs.url = "github:nixos/nixpkgs?ref=nixos-unstable";
};
outputs = { nixpkgs, ... }: {
devShells.x86_64-linux.default = nixpkgs.legacyPackages.x86_64-linux.mkShell {};
devShells.x86_64-linux.default = nixpkgs.legacyPackages.x86_64-linux.mkShell {
packages = [ nixpkgs.legacyPackages.x86_64-linux.hello ];
};
};
}
```
(Run `nix develop`, and then we have the `hello` executable available.):
```shell
> nix develop
(nix-shell-env)> hello
Hello, world!
```
Let's clean this up a bit, and then we're done for now.
There's lots of repetition in the current file, and the solution to this is not as easy as inserting a `let` block.
The accepted and easily extensible solution for this is flake-parts, but their homepage is pretty hard to understand at first.
We want to translate our example to this:
```nix title="flake.nix"
{
inputs = {
nixpkgs.url = "https://github.com/nixos/nixpkgs?ref=nixos-unstable";
};
outputs = inputs@{ flake-parts, ... }:
flake-parts.lib.mkFlake { inherit inputs; } {
systems = [ "x86_64-linux" "aarch64-linux" "aarch64-darwin" "x86_64-darwin" ];
perSystem = { pkgs, ... }: {
devShells.default = pkgs.mkShell {
packages = [ pkgs.hello ];
};
};
};
}
```
This even has the benefit that it will work on all the systems specified.
<Draft>
# Evaluated Flake top level
You can inspect your flake like this:
```shell
nix repl .
> :load-flake . # shorthand ':lf .'
```
```nix
{
_type = "flake";
inputs = { ... };
outputs = { ... };
sourceInfo = { ... };
}
```
</Draft>
<References>
<ReferenceLink href="https://www.youtube.com/watch?v=JCeYq72Sko0">vimjoyer flakes guide</ReferenceLink>
</References>](https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:fzyhtjbjqeoj2pmjajl5ehou/bafkreifjretp7fvufhufqv2hnfgdfcuykkpse7saigqzsdfq4vhnqcaeru)
![After getting annoyed by the default sqlite Command Line Interface (it doesn't even support `arrow up` ≙ last typed command), I found `litecli`
```nix title=flake.nix
# ...
packages = [
# ...
pkgs.litecli
# ...
];
# ...
```
in every sqlite project from now on :)](https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:fzyhtjbjqeoj2pmjajl5ehou/bafkreigs23yuc2f52ikekxhgx746pclcnxp3yngg5wt6pdy3ljehtdvhha)
![# 1. Getting the server
As with most things, setting up a server is relatively straighforward once you know what you're doing.
So, what you want is:
- a machine that runs on the internet for you, awaiting your requests and which
- you can reach from anywhere.
Since both the 'is reachable' and the 'runs constantly' parts are relatively hard to provide when you're just starting out (and probably only have a laptop/phone), you want to go to someone who's _job_ is to provide these two things for this (That's called a _Hosting Provider_).
For starting out, the thing you're looking for is the cheapest option of a _Virtual Private Server_ (called VPS).
So for finding what you're looking for, google something like `hosting provider vps cheap reddit`, and see what's currently in store.
(This should be about 5€/month)
Then go onto the site of your choice, create an account, and rent the VPS you want.
For Hetzner in 02/2026 (the provider I'm currently using), this is something like:
- [x] Cost-optimized
- [x] CX23
- [x] Somewhere in the EU, preferably close to where you are
- [x] Ubuntu (but we're gonna change that later)
- [x] both a IPv4 and IPv6
- [ ] your _ssh keys_ (You might be wondering: What are _those_?)
- [x] and a name
That's it.
> Except for the ssh keys.
## Generating ssh keys
An _ssh key_ is a thing you can use to verify you're you to someone else.
For now, the only thing that's important about them is that our server can let us login without a password if we have the correct ssh key available on our system.
So what we need to do is generating a key pair (a private key with a matching public 'lock', confusingly also called a key), and then depositing the _public_ key of the pair (so the _lock_) on the server.
With this, the server will be able to tell that we're allowed to login whenever we log in from a system that has the private key of this specific key pair.
With this knowledge:
<Il href="/setting-up-git#1-generating-the-ssh-key-pair">Generate the ssh key pair</Il>
And then upload the public key to the hetzner.
You can check that everything worked by `ssh`ing onto your server:
If you're _not_ prompted for a password, everything worked.
# 2. Put NixOS on the server with Clan
Now for the important part. Just having a server means manual, stateful configuration, and we're not going to do that.
Instead, we're going to use NixOS with Clan.
Follow Creating your first Clan.
And that's it.](https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:fzyhtjbjqeoj2pmjajl5ehou/bafkreicjs4e7ws2cjdryx2snoomebckxhqvbboedmm6kbzsb2ehcsdbfgq)
![Today, I spent some time getting my photo setup together, (and away from manually uploading them to my storage box from time to time 😬).
So I've decided I'd give Immich (as a self-hostable photo solution on my server) a try.
<Callout type="info">
In case you don't know yet how to get and set up a server, take a look here: Setting Up A Server (with NixOS and Clan)
</Callout>
# Setting up Immich
Setting Immich up with NixOS is relatively straightforward, at least at first glance:
```nix
services.immich = {
enable = true;
host = "photos.example.ts.net";
};
```
But since I'm not running a Tailscale network (yet, I guess?), I need to make my immich service reachable from the outside.
This looks like this:
```nix
services.immich = {
enable = true;
};
services.caddy = {
enable = true;
virtualHosts."photos.your.domain" = {
extraConfig = ''
reverse_proxy 127.0.0.1:2283
'';
};
};
```
<Callout type="info">
For this to work, you need to:
- own a domain
- set a DNS A record to `photos` -> "IPv4 IP of your server", e.g. `1.12.234.45`
If you don't know how to do that, take a look here: Setting A DNS Record On A Domain
</Callout>
Now we've got a machine running Immich that's reachable from the outside via a domain.
Meaning: You should be able to go to `https://photos.your.domain`, and see the Immich login screen.
So that's it—almost.
# Mounting a storage box
We've still got one problem:
The machine this is running on is the smallest Hetzner VPS: powerful enough to run Immich, but not large enough to host all the photos.
It's got only 40GB of disk space, and upgrading that gets expensive fast.
So you probably don't want to store photos on there.
Thankfully, Hetzner also has a service called a _Storage Box_.
A Storage Box has the opposite characteristics to a VPS: It's pretty cheap per TB, but you can't really run anything on it.
So, let's match the two.
What we're going to do is the following:
We will mount the storage box as a file system into the folder in which Immich is going to store its data in.
For this, you need to:
1. Have a Storage Box (so rent one)
2. Create a new sub-account (with corresponding subfolder) on it. _Save the password for this into your password manager_
3. Mount the subfolder into our server
Mounting the subfolder looks like this:
<Draft>
```nix
services.immich = {
enable = true;
};
services.caddy = {
enable = true;
virtualHosts."photos.your.domain" = {
extraConfig = ''
reverse_proxy 127.0.0.1:2283
'';
};
};
environment.systemPackages = [ pkgs.cifs-utils ];
fileSystems."/var/lib/immich" = {
device = "//uXXXXXX-subX.your-storagebox.de/uXXXXXX-subX";
fsType = "cifs";
options = [
"x-systemd.automount"
"noauto"
"x-systemd.device-timeout=5s"
"x-systemd.mount-timeout=5s"
"credentials=${config.clan.core.vars.generators.storagebox-immich-secret.files."credentials".path}"
"uid=immich"
"gid=immich"
];
};
```
- vars setup
- add the secret to vars
- issues
- immich can't write or read the files
- with disabled machine learning the server dies, and I don't know why
</Draft>
# Notes
<References>
<ReferenceLink href="https://forums.linuxmint.com/viewtopic.php?t=333084">Samba Storage Share </ReferenceLink>
</References>](https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:fzyhtjbjqeoj2pmjajl5ehou/bafkreih3ncd5v6bq63d63qsr27mbgi4cxlxup7v652gls5wzxakkgjvrji)
![> Lexical Scoping refers to when the location of a function's definition determines which variables you have access to. On the other hand, Dynamic Scoping uses the location of the function's invocation to determine which variables are available.
```racket title=dyn-scope.rkt
#lang smol/dyn-scope-is-bad
(defvar y 2)
(deffun (times-2 x)
(* y x))
(let ([y 3])
(times-2 2))
(times-2 2)
```
Evaluation:
```racket
6
4
```
Well, this is bad.
<References>
<ReferenceLink href="https://youtu.be/b1MvKYHCdno?si=O6qEgfY2QtH_HtqG&t=2330">Programming Languages Lectures</ReferenceLink>
<ReferenceLink href="https://www.plai.org/3/2/PLAI%20Version%203.2.2%20printing.pdf"><KB>Ctrl+f</KB> for 'dynamic scope'</ReferenceLink>
</References>](https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:fzyhtjbjqeoj2pmjajl5ehou/bafkreibzdaly6q7h24ypx643hrjn6jvxs3srb44zrrpjsxn6dt2wxwx7mq)
![The idea is pretty simple:
We write code, and sometimes we repeat ourselves there. So why not write code that abstracts over this repetition?
That is what _Macros_ are.
# C Macros
The lowest sophistication level (and the worst to work with) is something like C preprocessor macros. There, you do the easiest thing possible: A string replacement over the full following program text, irrespective of anything else.
So a Macro in C has this type signature:
```haskell
CMacro :: String -> String
```
---
```c title=simple.c
#define LALA "hohohoho"
char laugh[] = LALA
```
->
```c title=simple.c
char laugh[] = "hohohoho"
```
A standard C Macro usage looks like this:
```c title=min.c
#define min(X, Y) ((X) < (Y) ? (X) : (Y))
x = min(a, b); → x = ((a) < (b) ? (a) : (b));
y = min(1, 2); → y = ((1) < (2) ? (1) : (2));
z = min(a + 28, *p); → z = ((a + 28) < (*p) ? (a + 28) : (*p));
```
But since this is just doing straight string replacement, anything can happen (There's just no rules whatsoever for the expansion, so you can have unbalanced parentheses and other weird stuff).
They're still powerful, and you probably want to use them in C, but we can do better.
# Lisp Macros
Lisp Macros do better: They're not doing string replacement, but operate on the _syntax tree_.
```haskell
LispMacro :: Syntax -> Syntax
```
The also have a second pretty helpful property: They use _the same syntax as the base language_.
So their type is actually this:
```haskell
LispMacro :: LispSyntax -> LispSyntax
```
This is what they look like:
```lisp
> (defmacro the-macro (a b)
`(+ ,a (* ,b 3)))
> (the-macro 4 5) ;; => 19
```
This makes them way more generally useful (for example)
But they, too, have a problem: They're not _hygienic_.
That is, they're introducing variables into their target program that could be referenced both from the inside and outside.
This possibly couples the macro source code to the location it's being used in, which, if you squint, is the one unambigiously bad (default) feature in programming languages (again): Dynamic Scoping
There's an easy fix for this, however: gensym
But this makes for a relatively bad default, and we shouldn't rely on programmers knowing all the ways in which they could fuck up, and then having the mental workload left to fix them.
<Draft>
# Scheme Macros
Scheme was the first language that didn't have the problem of accidental scope leaking. They introduced _hygienic macros_.
# Racket Macros
Racket escalates this completely, and has facilities to define whole new languages.
</Draft>
# Notes
- I've skipped procedural macros#Procedural_macros) (never heard of them before)
- Damn, are those AI Memos badly scanned sometimes: https://dspace.mit.edu/bitstream/handle/1721.1/6111/AIM-057.pdf?sequence=2&isAllowed=y](https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:fzyhtjbjqeoj2pmjajl5ehou/bafkreihcqnlk5min237iswmxu4ysvavtzbuhnt44xzmhgxybnn74gwqqxu)
![# Correct Types in TypeScript
Don't forget to install your types:
```shell
bun install @bun/types
```
And then, add them to your `tsconfig.json`:
```json title=tsconfig.json
{
"compilerOptions": {
"types": ["node", "types/bun"],
"skipLibCheck": true,
}
}
```](https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:fzyhtjbjqeoj2pmjajl5ehou/bafkreig3h6toxj5xzkoczpwrwlgdjz6b7s7tl56cpnafcb7hr5e325yrdm)
![_The_ tool to manage homelabs.
Provides a really nice CLI over standard NixOS stuff, like setting up a new server, `ssh`ing onto the server, handling secrets management for all of your machines, setting up users everywhere, backing up state from your machines, and so on.
`Clan services` (services that span multiple machines are also pretty nice.)
Secrets are handled via the `var` abstraction. This lets us write _generators_ for secrets so that they mostly already come prepackaged with the service one is using.
# Useful commands
```yaml
machines: [formenos]
```
## ssh onto a machine
```shell
clan ssh formenos
```
## Show machines
```shell
clan machines list
```
## Update a machine
```shell
clan machines update formenos
```
## Show the value of a secret
```shell
clan vars list formenos
# (pick one)
clan vars list root-password/password
```](https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:fzyhtjbjqeoj2pmjajl5ehou/bafkreiaqkufxtpdxjbuf6veu467odnuwojv4kl2faicpr6bf765jevcx54)
![Over the last time, I've pretty regularly had Screen Freezes that appeared out of nowhere (maybe together with faster screen movement/resource usage, but not in a reproducible way).
It had the following characteristics:
1. The screen froze out of nowhere
2. Although the screen didn't show anything anymore, all input still worked (so typing went on, the mouse could still click on stuff, and so on)
3. Among them, locking my screen via GNOME's <KB>Super-l</KB> still worked
4. As soon as the error appeared once, it tended to appear again and again until a restart
5. After a restart, it was good for a while
6. It only appeared on my internal laptop screen, not on an external display
This is what it looked like (yep, bad video, I know 😬):
<video controls="controls" preload="auto">
<source src="amd-screen-errors.mp4" type="video/mp4"/>
</video>
All of the above mostly .. confused me.
- <ListMarker>2.</ListMarker> and <ListMarker>3.</ListMarker> strongly pointed into the direction of GNOME being the problem, and maybe my session crashing in a weird way
- <ListMarker>4.</ListMarker> and <ListMarker>5.</ListMarker> pointed into the direction of a resource exhaustion problem (but there wasn't higher resource usage at all), while
- <ListMarker>6.</ListMarker> pointed in the direction of it being a hardware/firmware problem, or at least towards it being hardware/firmware induced.
These findings left me relatively clueless, since they didn't really point towards anything specific (without also pointing away from it).
So I googled.
At first, I didn't really find anything, but then I came upon some other Framework users experiencing similar issues.
Among them was this post: https://www.reddit.com/r/framework/comments/1goh7hc/anyone_else_get_this_screen_flickering_issue/
Which pointed to an AMD power-saving technology that has pretty regular regression bugs.
So I tried that fix out (and first needed to learn how to enable Kernel Parameters on NixOS), and .. I didn't have any further screen freezes since then. (Well, only whole GNOME session crashes on Bluetooth Headphones / Unmute, but that's for another post)
This is the fix:
```nix title=hardware.nix
config.boot.kernelParams = [
# https://www.reddit.com/r/framework/comments/1goh7hc/anyone_else_get_this_screen_flickering_issue/
"amdgpu.dcdebugmask=0x410"
];
```
<References>
## Probably different
<ReferenceLink href="https://community.frame.work/t/screen-keeps-flickering-on-lower-brightness/70138/5">Screen keeps flickering on lower brightness - Framework Laptop 13 / Linux - Framework Community</ReferenceLink>
<ReferenceLink href="https://community.frame.work/t/flickering-when-using-firefox-under-kde-wayland-on-ryzen-ai-300/69599/3">Flickering when using Firefox under KDE Wayland on Ryzen AI 300 - #3 by trumee - Linux - Framework Community</ReferenceLink>
<ReferenceLink href="https://community.frame.work/t/framework-13-amd-7040-some-screen-flicker-still/75766">Framework 13 AMD 7040: some screen flicker still - Linux - Framework Community</ReferenceLink>
<ReferenceLink href="https://community.frame.work/t/responded-screen-issues-on-fedora/40772/7">[RESPONDED] Screen issues on Fedora - #7 by dimitris - Linux - Framework Community</ReferenceLink>
## Maybe related
<ReferenceLink href="https://community.frame.work/t/screen-flickers-after-logging-in-and-at-random-times/39192">Screen flickers after logging in and at random times - Framework Laptop 13 - Framework Community</ReferenceLink>
<ReferenceLink href="https://discourse.nixos.org/t/nixos-hard-locks-driving-my-crazy/72210/7">NixOS hard locks driving my crazy! - Help - NixOS Discourse</ReferenceLink>
## Resolved the issue
<ReferenceLink href="https://www.reddit.com/r/NixOS/comments/1hjruq1/graphics_corruption_on_kernel_6125_and_up/">Graphics corruption on kernel 6.12.5 and up : r/NixOS</ReferenceLink>
<ReferenceLink href="https://www.reddit.com/r/framework/comments/1goh7hc/anyone_else_get_this_screen_flickering_issue/">Anyone else get this screen flickering issue? : r/framework</ReferenceLink>
<ReferenceLink href="https://jonathanmfung.com/setting-kernel-parameters-in-nixos">Setting Kernel Parameters in NixOS</ReferenceLink>
<ReferenceLink href="https://gitlab.freedesktop.org/drm/amd/-/issues/3827">Making sure you're not a bot!</ReferenceLink>
<ReferenceLink href="https://community.frame.work/t/solved-my-screen-flickers-sometimes/26270/2">[SOLVED] My screen flickers sometimes - #2 by Anachron - Linux - Framework Community</ReferenceLink>
</References>](https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:fzyhtjbjqeoj2pmjajl5ehou/bafkreicizkgjrd23ghmwl3dzqnzvjmxmrqyazgctowrncophzvuz3wik54)
