Javed A. Butt @javedab.bsky.social · 15/07/2026If thats true and its publicly known - why is that guy still president. I mean, I have heard many times that Trump is supposed to have raped children and women. However, I was assuming there were no proofs for that? 000
Javed A. Butt @javedab.bsky.social · 15/07/2026Yet, if they are dead - they would not feel anything. Even if you would try to humiliate them by simply publicly saying what they did - it would have no impact on them. What I mean is: you cannot really harm a dead man. Therefore, to get justice, you need other methods 000
Javed A. Butt @javedab.bsky.social · 13/07/2026Even if they were to die, this would not suffice. The pain they inflicted on countless people. There must be something else for these people. Accountability in this life is the first step. Death is natural. Accountability in the afterlife would be sufficient. #Trump #Lindsey 100
Javed A. Butt @javedab.bsky.social · 13/07/2026Not sure if this man believed in an afterlife. Well, if I were in his position, having engaged in the killing of children, I would also hope for no such thing as judgment day. #Lindsey #Graham #Gaza 000
Javed A. Butt @javedab.bsky.social · 13/07/2026He lived his life trying to bring pain to people in need. Now, it seems, he has died a painful death himself. 000
Javed A. Butt @javedab.bsky.social · 10/07/2026Isn't it strange to see a politician who actually cares for people? I am, alhamdulillah, very glad that Mamdani keeps delivering. In the meantime Trump and co are busy starting wars. #Mamdani #Trump 000
Javed A. Butt @javedab.bsky.social · 13/05/2026The one header I didn't add yet: CSP. For sites with forms it mitigates an active surface. For a static site it guards against rarer-but-bigger events: compromised analytics, a poisoned CDN, a future change that adds input. Will inshallah follow when the audit fits. CSP WebSecurity Astro 000
Javed A. Butt @javedab.bsky.social · 13/05/2026Enabled HSTS with preload. Cost is one-way: every current and future subdomain must serve HTTPS or become unreachable. Removal is in browser-release hands. Accepted because the site is HTTPS-only by intent and Caddy provisions per-subdomain certs automatically. HSTS WebSecurity Caddy 000
Javed A. Butt @javedab.bsky.social · 12/05/2026Skipped Permissions-Policy. It blocks browser APIs (camera, mic, geolocation) the site doesn't use. Disabling something not in use protects against nothing. Embedding YouTube fullscreen would mean carving exceptions back in. Scanner score drops one notch. Site no less safe. WebSecurity Caddy 000
Javed A. Butt @javedab.bsky.social · 11/05/2026Most cache misconfiguration is not carelessness, it's a missing handshake. Your build encodes assumptions (hashed filenames mean URL changes on content change). The server has to know. If it doesn't, the framework's work gets quietly undone at the last layer. WebPerf Caching 000
Javed A. Butt @javedab.bsky.social · 11/05/2026Generic defaults work. They also leave decisions to the browser that should be yours. Caching, headers, redirects: the parts only you can configure are the parts that signal intentionality. Full write-up: javedab.com/en/pub/coding/web/astro…javedab.comCaddy Config for Astro Static Sites — Javed Arshad ButtSecurity headers, cache strategy, and compression for an Astro site on Caddy. What to add, what to skip, and why each decision depends on your build output. 010
Javed A. Butt @javedab.bsky.social · 11/05/2026Cache strategy follows the build output: - _astro/* (hashed): immutable, 1 year - HTML (stable URL): no-cache, revalidate - Favicons: 1 hour Hashed names mean the URL changes when content changes. So the browser can cache forever, safely. 100
Javed A. Butt @javedab.bsky.social · 11/05/2026Four headers skipped: - Referrer-Policy (already the browser default) - Permissions-Policy (blocks APIs the site doesn't use) - COOP (no auth, no popups, no tokens) - CSP (deferred until the audit fits) Higher scanner score. Same actual safety. 100
Javed A. Butt @javedab.bsky.social · 11/05/2026Three security headers, three real attack vectors: - Strict-Transport-Security (no HTTP downgrade on public WiFi) - X-Content-Type-Options nosniff (no MIME guessing) - X-Frame-Options DENY (no iframe clickjacking) Static site, no auth, nothing else needed. 100
Javed A. Butt @javedab.bsky.social · 11/05/2026Your site loads. Returning visitors might be re-downloading everything on every click. The connection might still allow HTTPS-to-HTTP downgrade. Your homepage might be two domains in Google. The web server config is the last layer most static sites never touch. Astro Caddy WebPerf 100
Javed A. Butt @javedab.bsky.social · 09/05/2026Honest limit: the voice client is closed-source. alsa-utils restored it, so the path likely ends at arecord. Probable, not verified. The strict claim: alsa-utils was the missing piece. Linux SSH SelfHosting 011
Javed A. Butt @javedab.bsky.social · 09/05/2026Mic-forwarding trade-off: the remote process gets your live mic for the session. Anything under the same user can read the same source. Normal for a forwarded device. Worth knowing upfront. SSH Privacy Linux 010
Javed A. Butt @javedab.bsky.social · 09/05/2026Warning: remote port forwarding failed for listen port 4713. Two causes: CI inheriting SSH config it doesn't need, or second session finding the port already bound. Neither means audio is broken. SSH Linux SelfHosting 011
Javed A. Butt @javedab.bsky.social · 08/05/2026TCP-over-SSH for audio: nothing new on either side. PipeWire on the laptop, OpenSSH on both, encryption from the tunnel. Alternatives skip encryption or add software. The fix used what was already there. PipeWire SSH Linux 000
Javed A. Butt @javedab.bsky.social · 08/05/2026Second SSH session: Warning: remote port forwarding failed. Port already bound by the first session. Fix: ControlMaster auto in ~/.ssh/config. One tunnel, shared by all sessions. Voice mode will inshallah be reachable from all of them. SSH Linux SelfHosting 011
Javed A. Butt @javedab.bsky.social · 08/05/2026CI deploy: Warning: remote port forwarding failed for listen port 4713. Deploy worked. Site live. CI has no audio runtime. The SSH config directive had nothing to land on. Fix: ssh -o ClearAllForwardings=yes SSH Linux SelfHosting 011
Javed A. Butt @javedab.bsky.social · 07/05/2026The gap that hides quietly: tunnel working, pactl info showing the mic, every layer fine. Voice mode still failing. alsa-utils not installed. The recording binary that reads mic bytes was missing. Installing it will inshallah close the gap. Linux SSH SelfHosting 011
Javed A. Butt @javedab.bsky.social · 07/05/2026cannot find card '0'. The error on a remote server. Easy read: no hardware, nothing to do. Actual situation: audio on Linux is daemon-mediated. PipeWire exposes TCP. Remote process can reach the local mic. Linux PipeWire SSH 000
Javed A. Butt @javedab.bsky.social · 07/05/2026Considered: PulseAudio module-tunnel-source. Same Pulse protocol, no SSH tunnel. Cost: no encryption. Auth cookie travels in the clear. SSH tunnel gives encryption for free. TCP-over-SSH wins on that alone. PulseAudio SSH Privacy 000
Javed A. Butt @javedab.bsky.social · 06/05/2026Considered: PipeWire's RTP modules. Lower latency, but UDP, no encryption, default group 224.0.0.56 is LAN multicast. Both ends need matching config. Wrong fit for a point-to-point remote. PipeWire Linux SelfHosting 011
Javed A. Butt @javedab.bsky.social · 06/05/2026Often suggested for SSH audio: X11 forwarding. Doesn't work. ssh -X carries display, not audio. Adding audio onto X still requires module-x11-publish or NX/x2go's audio channel. Neither applies on a headless server. SSH Linux SelfHosting 011
Javed A. Butt @javedab.bsky.social · 06/05/2026Full walkthrough: javedab.com/en/pub/ai/ai-editors/cl… Permanent config, CI warning, ControlMaster for multi-session.javedab.comClaude Code Voice Over SSH — Javed Arshad ButtForward your local microphone to a remote server over SSH so Claude Code's voice mode works. No audio hardware needed on the server. 000
Javed A. Butt @javedab.bsky.social · 06/05/2026Non-obvious: tunnel working, pactl info showing the mic, everything looking fine. Voice mode still failing. alsa-utils not installed. The recording binary was missing. Installing it will inshallah close the gap. 100
Javed A. Butt @javedab.bsky.social · 06/05/2026Three dropped: — PipeWire RTP: UDP, no encryption, LAN-shaped — PulseAudio module-tunnel-source: no tunnel, auth in the clear — X11 forwarding: carries display, not audio — Running locally: valid, trades remote resources 100
Javed A. Butt @javedab.bsky.social · 06/05/2026The fix: local PipeWire opens TCP on localhost. SSH carries it to the remote via -R. Remote process points at 127.0.0.1:4713. Audio rides inside the encrypted SSH tunnel. Nothing new on either machine. 200
Javed A. Butt @javedab.bsky.social · 06/05/2026The assumption: servers don't have audio. Nothing to do. Wrong. Audio on Linux is daemon-mediated. PipeWire and PulseAudio expose their protocol over TCP. A remote process can record from a mic on a different machine. 100
Javed A. Butt @javedab.bsky.social · 06/05/2026Claude Code's voice mode needs a microphone. On a remote Linux server over SSH, there is none. Error: cannot find card '0'. ALSA scanning for hardware that isn't there. PipeWire SSH Linux 100
Javed A. Butt @javedab.bsky.social · 23/04/2026Resolved the OG card split: four platforms yes, X and Mastodon no. Root cause: Caddy v2.10.2 bug returns HTTP 206 for precompressed files. Both platforms require exactly 200. Fix: upgrade to v2.11.2. Found by reading Mastodon's open source fetch code. #webdev #opensource 150
Javed A. Butt @javedab.bsky.social · 20/04/2026OG cards for this page render on LinkedIn, Facebook, Threads, and here. Only X and Mastodon fail. Same HTML everywhere, so the markup is ruled out. Remaining suspects: reputation filters, fetch infrastructure. Anyone shipped a site with this exact split? javedab.com/en/about/javedab.comAbout Javed Arshad ButtAerospace engineer turned entrepreneur. Muslim, building in public. Available for AI, automation, and modern websites. 000
Javed A. Butt @javedab.bsky.social · 15/11/2025Unpopular truth: assuming AI agents will 'handle it' is the fastest path to failure. Test rigorously. Find what breaks. Catch it early. The magic isn't in the agent. It's in the honest work you put in. AIAgents AI Automation 020
Javed A. Butt @javedab.bsky.social · 12/11/2025Discovered something about AI agents: they're better at critiquing each other than self-editing. My workflow: 2 agents, same context. One writes, I show it to the other for feedback. They actually disagree sometimes. Find real flaws. Makes writing way less tedious. AIagents AI Workflow 010
Javed A. Butt @javedab.bsky.social · 10/11/2025WordPress user ≠ Developer Same as: Excel user ≠ Database engineer One asks: "Which plugin?" Other asks: "How do I build this?" Different skillsets. Both valid. WordPress WebDev Programming 030
Javed A. Butt @javedab.bsky.social · 08/11/2025If you code, try JetBrains Mono. It's beautiful and readable. I have this weird crush on typography and spent days researching fonts for every use case. Call me crazy but letters can be stunning. typography coding fonts 022
Javed A. Butt @javedab.bsky.social · 07/11/2025It's like He's showing us how to give advice properly. With compassion, with acknowledgment of the struggle, with wisdom. 1400 years before this tradition spread among us. These are my thoughts. Allah knows best. 000
Javed A. Butt @javedab.bsky.social · 07/11/2025But look at how He gives it. He doesn't just say "have Sabr." He acknowledges first that seeking help through Sabr and prayer is difficult. That it's a burden except for the humble. 100
Javed A. Butt @javedab.bsky.social · 07/11/2025Something I noticed in Surah Al-Baqarah: Ayah 2:44 talks about giving advice. Right after that, in 2:45, Allah gives advice Himself. And it's the exact advice Muslims give each other everywhere today: Sabr. Quran Islam Sabr 100
Javed A. Butt @javedab.bsky.social · 06/11/2025It's a win-win. The advice giver becomes worth listening to. The advice taker actually benefits. 000
Javed A. Butt @javedab.bsky.social · 06/11/2025And سُبْحَانَ ٱللّٰه, this is where I see Allah's mercy in Surah Al-Baqarah 2:44. From my understanding, He's not forcing us to accept advice from hypocrites. He's telling the advice givers: Work on yourself first. 100
Javed A. Butt @javedab.bsky.social · 06/11/2025We know good advice is good advice, regardless of the messenger. But let's be real. When someone who doesn't practice what they preach tries to correct you, something inside just resists. 100
Javed A. Butt @javedab.bsky.social · 06/11/2025Honest question: How many times have you rejected good advice just because of WHO said it? I struggle with this. My nafs fights it every time. Quran SelfReflection Islam 100
Javed A. Butt @javedab.bsky.social · 06/11/2025Zohran Mamdani won against billionaires who put politicians on their payroll and ran smear campaigns. They lost because regular people united. But they won't stop. New Yorkers - stay vigilant and keep making noise, InshAllah. ZohranMamdani PeoplePower NewYork 000
Javed A. Butt @javedab.bsky.social · 05/11/2025Norman Finkelstein on the UN rape investigation: "This isn't absence of evidence. With 5,000 images and 50 hours of video showing nothing, this is overwhelming evidence there was no rape." Palestine Gaza October7th 010
Javed A. Butt @javedab.bsky.social · 05/11/2025Norman Finkelstein breaks down South Africa's genocide case: 700 pages of memorial, 4,000 pages of supporting evidence. That's the weight of what's being presented. 000
Javed A. Butt @javedab.bsky.social · 05/11/2025When you submit 4,700 pages of documentation to the International Court of Justice, you're not making a casual claim. Gaza ICJ Palestine 110
