Disclaimer: Unofficial article, use at your own risk.
DNS queries and IP+port connections are monitored through OpenWRT dnsmasq and conntrack (NAT table).
SEMS+ iOS app:
*Optional domains, commonly blocked by adblocker.
SEMS+ Web portal:
If browser setting has WebGL enabled but NoScript is configured to restrict it, configure NoScript to allow WebGL on au-semsplus.goodwe.com, otherwise the page freezes in less than a minute. The portal actually works fine without WebGL, but it has to be disabled in the browser setting, which disables for every websites.
GoodWe ESA connected to wifi using WiFi/LAN Kit-20 dongle:
Hostname: GW_WIFILAN_2
MAC address: C0:CD:D6:xx:xx:xx (Espressif)
There’s also DNS traffic to OpenDNS where router can intercept using port forwarding rule.
| IP | Protocol | Port |
|---|---|---|
| 208.67.222.222 | udp | 53 |
Disclaimer: Unofficial article, use at your own risk.
DNS queries and IP+port connections are monitored through OpenWRT dnsmasq and conntrack (NAT table).
Initial wifi SSID: ijai-vacuum-v2_miapxxxx
Hostname: rk3308_robot32
MAC address: 58:B6:23:xx:xx:xx (Beijing Xiaomi Mobile Software)
Xiaomi Home server: Chinese mainland
Mi Robot Vacuum-Mop 2:
Also these IPs without corresponding domains,
| IP | Protocol | Port |
|---|---|---|
| 36.156.49.91 | udp | 80 |
| 110.43.0.83 | tcp | 443 |
| 120.92.158.163 | tcp | 443 |
| 124.251.34.212 | tcp | 443 |
| 39.101.90.191 | udp | 8053* |
| 120.52.181.238 | udp | 8053* |
| 120.52.181.239 | udp | 8053* |
| 120.92.146.6 | udp | 8053* |
| 120.92.65.237 | udp | 8053* |
| 120.92.65.254 | udp | 8053* |
| 121.228.168.18 | udp | 8053* |
| 123.125.102.216 | udp | 8053* |
| 124.251.101.16 | udp | 8053* |
| 220.181.106.199 | udp | 8053* |
| 220.181.106.200 | udp | 8053* |
*Optional port, I don’t notice any issue after blocking it.
Xiaomi Home Android app:
*Optional domains, commonly blocked by adblocker.
]]>I searched around the web and tried this suggestion. I powered it off and unplugged charger, waited around 2 minutes and switched back on. Keyboard and charging then started to work on the far left port with expansion card again. I didn’t have to disconnect the battery
]]>Instead of replicating every public DNS records (A/AAAA/CNAME/MX/TXT/etc) of a subdomain, simply create a CNAME record that point to <fqdn>.cdn.cloudflare.net in the internal nameserver. This works with subdomains that have proxy mode enabled and also those without.
Internal nameserver:
| Domain | Type | Value |
|---|---|---|
a.example.com | CNAME | a.example.com.cdn.cloudflare.net |
However, this CNAME shortcut does not support subdomain that NS to third-party DNS provider, even with CNAME flattening enabled. In the following examples, b.example.com.cdn.cloudflare.net does not return any record.
Cloudflare DNS:
| Domain | Type | Value |
|---|---|---|
b.example.com | NS | ns-xx.awsdns-xx.com |
| Domain | Type | Value |
|---|---|---|
b.example.com | CNAME | b.z.example.com |
z.example.com | NS | b1.example.com |
b1.example.com | A | x.x.x.x |
For those utilising Cloudflare CDN, it is possible to install Cloudflare Origin certificate with 15-year validity on Salesforce. Although Salesforce documentation mentions the certificate must be CA-signed, self-signed certificate including Cloudflare Origin certificate (which is not public CA-signed) is actually acceptable.
custom-domain.com.xxx.live.siteforce.com. Ensure the CNAME record is in Proxied/orange-clouded mode.In the last step, do not select the “Use a third-party service or CDN” option despite Cloudflare being a CDN service. That option will configure the Salesforce site to serve over HTTP, requiring “Flexible” encryption mode in Cloudflare which is not ideal.
]]>During setup of M365 Bookings shared calendar, a company account is created with user principal name (UPN) in the format of name@tenant.onmicrosoft.com. This UPN is used as the sender address when sending out booking notifications. The issue is that *.onmicrosoft.com email domain is often abused for spams and many email providers (notably iCloud) are starting to reject any incoming email with that domain. Microsoft meanwhile has started to throttle usage of that domain for sending email.
There are two ways to update the sender address:
Method (1) is the Microsoft’s recommended method, but I prefer Method (2) due to visibility on Entra ID; anyone with read-only account within the tenant can view the updated UPN in Entra ID whereas only M365 admin can view mailbox policy. If a subdomain (e.g. name@booking.example.com) is preferred over the company’s email domain (example.com), the subdomain will need to be added to M365 with MX (booking-example-com.mail.protection.outlook.com), SPF ("v=spf1 include:spf.protection.outlook.com -all") and DKIM DNS records, regardless of method (1) or (2).
If the booking calendar is embedded in the company website, the iframe link https://outlook.office365.com/owa/calendar/name@tenant.onmicrosoft.com/bookings/ needs to be updated to https://outlook.office365.com/owa/calendar/<new-upn>/bookings/.
Once UPN is updated, it may take at least a day for the change to apply. In my experience, the new UPN is applied to new appointment’s notification within hours, but it only applied to cancellation notification after 24 hours (or longer).
]]># Examples, just choose one.sudo ln -s "/mnt/c/Program Files (x86)/Microsoft/Edge/Application/msedge.exe" "/usr/bin/msedge"sudo ln -s "/mnt/c/Program Files/Google/Chrome/Application/chrome.exe" "/usr/bin/chrome"sudo ln -s "/mnt/c/Program Files/Mozilla Firefox/firefox.exe" /usr/bin/firefox"Programs that rely on OAuth authentication typically listens on a random port to receive credential during the last step of authorisation. Since WSL enables IPv6 by default, the program may listen on IPv6 only. I noticed this behaviour when I check for listening ports netstat -aon | findstr ":port-number" on Windows and the output was [::1]:port-number without any 127.0.0.1. This can cause the program to unable to receive credential and fail authorisation if the Windows host has IPv6 disabled. A workaround for this issue is to also disable IPv6 on WSL to force the program to listen on IPv4. Append this line to “$home\.wslconfig” in Windows and restart WSL wsl --shutdown,
[wsl2]kernelCommandLine=ipv6.disable=1To download the missing intermediate certificate, click on “Not secure” > “Certificate details” > Details tab > “Authority Information Access”, there should be a link next to “CA Issuers”.
The easiest way is to import the downloaded certificate in Chromium/Cromite is to use the built-in Certificate Manager (chrome://certificate-manager/localcerts/usercerts). If you use p11-kit (trust anchor --store interCA.crt) to import, Cromite may not necessarily trust it; in that case, in Certificate Manager (chrome://certificate-manager/localcerts), enable “Use imported local certificates…”.
sudo -svgslvsvgs may show non-zero VFree value meaning the volume group contains unallocated space. lvs lists the volume group and logical volume, the values are used in lvresize; Ubuntu defaults to ubuntu-vg/ubuntu-lv, the slash is not an OR, both values with a slash are required.lvresize -l +100%FREE --resizefs VG-name/LV-namevgslvresize may fail due to corrupted filesystem, skip this step if no error.e2fsck -f /dev/VG-name/LV-nameresize2fs /dev/VG-name/LV-namevgs should now show zero VFree value.pinentry-program "/mnt/c/Program Files (x86)/gnupg/bin/pinentry-basic.exe" which is now an invalid path. I updated it to:pinentry-program "/mnt/c/Program Files/GnuPG/bin/pinentry-basic.exe"
Then run systemctl --user restart gpg-agent.service.
If Git and GnuPG are used in Windows, the gpg config in “$HOME\.gitconfig” should be updated to:
[gpg] program = C:\\Program Files\\GnuPG\\bin\\gpg.exe$ sudo pacman -S grub
pacman detected it conflicts with grub-improved-luks2-git and prompted for removal which is expected. Then, this is the most important part, “/etc/default/grub” config has been restored to the default during installation, so I had to replace it with my config. Thankfully, pacman made a backup at “/etc/default/grub.pacsave”, so I just need to move it back.
$ sudo mv /etc/default/grub.pacsave /etc/default/grub
Reinstall and regenerate the GRUB configuration.
sudo grub-install --target=x86_64-efi --efi-directory=/boot/efi --bootloader-id="Arch Linux" --rechecksudo grub-mkconfig -o /boot/grub/grub.cfgbooloader-id value can be anything. The whole line of grub-mkconfig can be replaced with just update-grub (without any option) if the command is available.
Transfer the csv file to your mobile device.
In NewPipe/Tubular, navigate to Subscriptions > upper-left triple-dot > Import from > YouTube > Import File > choose the csv file.
The import will run in the background with notification. The app’s notification will clear once the import is complete.
]]><nextcloud-domain>/settings/admin/additional) > Maplibre settings. Set the style url as https://tiles.openfreemap.org/styles/liberty.The style url can be set to other map providers. I use OpenFreeMap because it’s free and doesn’t need an API key. It’s available in 4 styles.
Maplibre uses WebGL to render the vector tiles, so if your browser block WebGL by default, your Nextcloud domain (not openfreemap.org) needs to be allowlisted for it.
Each heading or search query is now in a separate page, so once those new pages are indexed by search engine, the search result will lead directly to a page that only contains the relevant search query, e.g. FileFix detection.
from os import chdir, pathfrom re import S, findall, subchdir(path.dirname(__file__))template = """---title: {title}layout: pagedate: 2025-07-27---{content}"""with open("index.md") as f: s = f.read() # https://stackoverflow.com/a/66619938 for title, content in findall(r"(?:^|\n)##\s([^\n]+)\n(.*?)(?=\n##?\s|$)", s, S): # https://stackoverflow.com/a/74260791 fname = sub(r"\W+", "-", title).strip("-").lower() with open(fname + ".md", "w") as w: w.write(template.format(title=title, content=content)) with open("index-new.md", "a") as a: a.write(f"- [{title}]({fname})\n")pacman -Rn linux-firmwarelspcipacman -Rns linux-firmware-nvidiapacman -D --asexplicit $(pacman -Qs -q linux-firmware | sed -z 's|\n| |g')mdatp at least v101.25042.]]>Update: CMC 3.37.1 update reverts it back to “summary” index to allow for gradual transition.
]]>||example.com^ filter in the Opera’s built-in adblocker, it does not block the webpage itself, instead only the secondary resources (e.g. example.com/script.js). This limitation also notably presents in Adblock Plus.]]>ssh-keyscan may return empty result when using the default 5 seconds timeout. A workaround is to increase the timeout, ssh-keyscan -T 10 hostname for 10 seconds.Noticed this issue from host key verification error when mirroring a GitLab repository to an external repository. I could not fix it because I can’t modify the SSH client configuration in GitLab.com to increase ConnectTimeout.