{"description":"my personal blog","feed_url":"https://apogliaghi.com/feed.json","home_page_url":"https://apogliaghi.com/","items":[{"authors":[{"name":"Alessandro Pogliaghi"}],"content_html":"\u003cp\u003eThe problem is not the models. The problem is the circus that comes bundled with them.\u003c/p\u003e\n\n  \u003cfigure class=\"center\" \u003e\n    \u003cimg src=\"/img/_llms/build_it.png\" \n          alt=\"JUST BUILD IT\" \n          width=\"600px\" \n         \n          /\u003e\n    \n  \u003c/figure\u003e\n\n\n\u003ch2 id=\"scratching-the-itches\"\u003e\n  Scratching the itch(es)\n  \u003ca href=\"#scratching-the-itches\" class=\"h-anchor\" aria-hidden=\"true\"\u003e#\u003c/a\u003e\n\u003c/h2\u003e\n\u003cp\u003eIn \u003ca href=\"/2026/01/forking-metube-~-you-can-just-do-stuff/\"\u003emy MeTube fork\u003c/a\u003e, I have a gh action (oof) that periodically checks upstream releases, generates a diff and sends it to an LLM for analysis.\u003c/p\u003e\n\u003cp\u003eThe model then creates an issue explaining whether I should care about the changes.\u003c/p\u003e\n\u003cp\u003eThis is not AGI. It is artificial “please read this diff because I ain’t got time for that”.\u003c/p\u003e\n\u003cp\u003ePerfect.\u003c/p\u003e\n\u003cp\u003eOn iOS, I use Safari to visit YouTube (\u003cem\u003ecough\u003c/em\u003e ads \u003cem\u003ecough\u003c/em\u003e) and I started getting annoyed by shorts and creator posts in the feed. I just wanted to watch some videos, crazy stuff.\u003c/p\u003e\n\u003cp\u003eI didn\u0026rsquo;t even thought about starting my usual research into existing tools and solutions, I just built a small extension that would scratch my itch.\u003c/p\u003e\n\u003cp\u003eThat\u0026rsquo;s \u003cstrong\u003e\u003ca href=\"https://shortless.app\"\u003eShortless\u003c/a\u003e\u003c/strong\u003e, and it is \u003ca href=\"https://apps.apple.com/us/app/id6790830293\"\u003eon the App Store\u003c/a\u003e.\u003c/p\u003e\n\u003cp\u003eOn macOS, I started using some app that would display the upcoming meeting in my menubar.\nThis is not rocket science, but it started conflicting with my menubar management app.\nI got frustrated, it annoyed me.\u003c/p\u003e\n\u003cp\u003eSo I whipped up \u003cstrong\u003e\u003ca href=\"https://perchbird.app\"\u003ePerch\u003c/a\u003e\u003c/strong\u003e.\u003c/p\u003e\n\u003cp\u003eDo you really needed any of these two? Probably not. And that\u0026rsquo;s fine.\u003c/p\u003e\n\u003ch2 id=\"i-hope-it-becomes-boring\"\u003e\n  I hope it becomes boring\n  \u003ca href=\"#i-hope-it-becomes-boring\" class=\"h-anchor\" aria-hidden=\"true\"\u003e#\u003c/a\u003e\n\u003c/h2\u003e\n\u003cp\u003eThe outcome I want is not a small collection of companies owning a magic oracle.\u003c/p\u003e\n\u003cp\u003eI want models to become cheap and replaceable infrastructure: multiple providers, good OPEN models, local options, predictable APIs and enough compatibility to remain sane.\u003c/p\u003e\n\u003cp\u003eBecoming boring is what useful technology eventually does, boring is good.\u003c/p\u003e\n\u003cp\u003eI am so genuinely excited about where this is going, so much to do. So many people wanting to build things.\u003c/p\u003e\n\u003cp\u003eThe circus is optional.\u003c/p\u003e\n","date_modified":"2026-08-08T00:00:00Z","date_published":"2026-08-08T00:00:00Z","id":"https://apogliaghi.com/2026/08/llms-are-amazing-the-circus-is-optional-~-just-build/","summary":"The problem is not the models. The problem is the circus that comes bundled with them.\nScratching the itch(es) # In my MeTube fork, I have a gh action (oof) that periodically checks upstream releases, generates a diff and sends it to an LLM for analysis.\nThe model then creates an issue explaining whether I should care about the changes.\nThis is not AGI. It is artificial “please read this diff because I ain’t got time for that”.\n","title":"LLMs are amazing, the circus is optional ~ just build","url":"https://apogliaghi.com/2026/08/llms-are-amazing-the-circus-is-optional-~-just-build/"},{"authors":[{"name":"Alessandro Pogliaghi"}],"content_html":"\u003ch2 id=\"the-itch\"\u003e\n  The Itch\n  \u003ca href=\"#the-itch\" class=\"h-anchor\" aria-hidden=\"true\"\u003e#\u003c/a\u003e\n\u003c/h2\u003e\n\u003cp\u003e\u003ca href=\"https://github.com/alexta69/metube\"\u003eMeTube\u003c/a\u003e is a neat self-hosted YouTube downloader with a clean web UI. Paste a link, pick your format, hit download. Simple.\u003c/p\u003e\n\u003cp\u003eExcept YouTube decided that simple things shouldn\u0026rsquo;t stay simple.\u003c/p\u003e\n\u003cp\u003eAt some point, downloads started failing with the lovely \u0026ldquo;Sign in to confirm you\u0026rsquo;re not a bot\u0026rdquo; message. Classic. YouTube\u0026rsquo;s bot detection had gotten stricter, the web is not fun anymore.\u003c/p\u003e\n\u003cp\u003eOn top of that, I wanted my downloaded videos to actually show up properly in Jellyfin instead of appearing as mysterious \u0026ldquo;Unknown\u0026rdquo; entries with no metadata. Two itches, one fork.\u003c/p\u003e\n\n  \u003cfigure class=\"center\" \u003e\n    \u003cimg src=\"/img/_metube-pot/metube_homepage.png\" \n         \n         \n         \n          /\u003e\n    \n      \u003cfigcaption class=\"center\" \u003eMeTube POT interface\u003c/figcaption\u003e\n    \n  \u003c/figure\u003e\n\n\n\u003ch2 id=\"pot-proof-of-origin-support\"\u003e\n  POT (Proof-of-Origin) Support\n  \u003ca href=\"#pot-proof-of-origin-support\" class=\"h-anchor\" aria-hidden=\"true\"\u003e#\u003c/a\u003e\n\u003c/h2\u003e\n\u003cp\u003eYouTube\u0026rsquo;s anti-bot measures work by requiring a \u0026ldquo;Proof-of-Origin\u0026rdquo; token, basically proving that the request comes from a legitimate browser session rather than some script hammering their servers.\u003c/p\u003e\n\u003cp\u003eThe fix? \u003ca href=\"https://github.com/Brainicism/bgutil-ytdlp-pot-provider\"\u003ebgutil-ytdlp-pot-provider\u003c/a\u003e. It\u0026rsquo;s a yt-dlp plugin that generates these POT tokens, making YouTube believe the requests are coming from an actual browser.\u003c/p\u003e\n\u003ch2 id=\"jellyfin-integration\"\u003e\n  Jellyfin Integration\n  \u003ca href=\"#jellyfin-integration\" class=\"h-anchor\" aria-hidden=\"true\"\u003e#\u003c/a\u003e\n\u003c/h2\u003e\n\n  \u003cfigure class=\"center\" \u003e\n    \u003cimg src=\"/img/_metube-pot/jellyfin_homepage.png\" \n         \n         \n         \n          /\u003e\n    \n      \u003cfigcaption class=\"center\" \u003eVideo properly displayed in Jellyfin with full metadata\u003c/figcaption\u003e\n    \n  \u003c/figure\u003e\n\n\n\u003cp\u003eHere\u0026rsquo;s the thing about downloading YouTube videos: yt-dlp can grab a ton of metadata and save it as a \u003ccode\u003e.info.json\u003c/code\u003e file alongside the video. Title, description, upload date, channel name, tags, duration, everything.\u003c/p\u003e\n\u003cp\u003eJellyfin, however, doesn\u0026rsquo;t speak \u003ccode\u003e.info.json\u003c/code\u003e. It wants \u003ccode\u003e.nfo\u003c/code\u003e files, an XML format that media servers have used since the Kodi days.\u003c/p\u003e\n\u003cp\u003eSo I wrote a post-processor hook that runs after each download completes.\u003c/p\u003e\n\u003cp\u003eIt reads the \u003ccode\u003e.info.json\u003c/code\u003e, extracts the relevant fields, and generates a Jellyfin-compatible \u003ccode\u003e.nfo\u003c/code\u003e file. The metadata mapping looks like this:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003eTitle\u003c/strong\u003e and \u003cstrong\u003eOriginal Title\u003c/strong\u003e from the video title\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003ePlot\u003c/strong\u003e from the description\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eYear\u003c/strong\u003e and \u003cstrong\u003ePremiered\u003c/strong\u003e from the upload date\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eStudio\u003c/strong\u003e and \u003cstrong\u003eDirector\u003c/strong\u003e mapped to the uploader/channel\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eTags\u003c/strong\u003e from the video tags (capped at 20 to keep things sane)\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eRuntime\u003c/strong\u003e converted from seconds to minutes\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eUnique ID\u003c/strong\u003e storing the YouTube video ID\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eAfter generating the \u003ccode\u003e.nfo\u003c/code\u003e, the hook cleans up by deleting the original \u003ccode\u003e.info.json\u003c/code\u003e. No leftover clutter.\u003c/p\u003e\n\u003ch2 id=\"keeping-up-with-upstream\"\u003e\n  Keeping Up with Upstream\n  \u003ca href=\"#keeping-up-with-upstream\" class=\"h-anchor\" aria-hidden=\"true\"\u003e#\u003c/a\u003e\n\u003c/h2\u003e\n\n  \u003cfigure class=\"center\" \u003e\n    \u003cimg src=\"/img/_metube-pot/aint_nobody.png\" \n         \n          width=\"600px\" \n         \n          /\u003e\n    \n      \u003cfigcaption class=\"center\" \u003eCreating a meme without Nano Banana 🍌? Ain\u0026rsquo;t nobody got time for that!\u003c/figcaption\u003e\n    \n  \u003c/figure\u003e\n\n\n\u003cp\u003eForking is easy. Maintaining a fork? Not so fun.\u003c/p\u003e\n\u003cp\u003eThe upstream MeTube repo keeps getting updates: bug fixes, new features, dependency bumps.\u003c/p\u003e\n\u003cp\u003eI automated this with a GitHub Action (lame, I know) that runs weekly. Here\u0026rsquo;s what it does:\u003c/p\u003e\n\u003col\u003e\n\u003cli\u003e\u003cstrong\u003eFetches the latest upstream release\u003c/strong\u003e from the original MeTube repo\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eChecks if it\u0026rsquo;s already been analyzed\u003c/strong\u003e (no point in creating duplicate reports)\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eGenerates a diff\u003c/strong\u003e between the fork and the new release\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eSends the diff to an LLM\u003c/strong\u003e for analysis because, I ain\u0026rsquo;t got time for that\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eCreates a GH issue\u003c/strong\u003e with the analysis report\u003c/li\u003e\n\u003c/ol\u003e\n\u003cp\u003eThe result? A nicely formatted issue telling me whether I should bother merging upstream changes or if I can safely ignore them. The boring parts of fork maintenance, automated.\u003c/p\u003e\n\u003ch2 id=\"use-it-yourself\"\u003e\n  Use it yourself\n  \u003ca href=\"#use-it-yourself\" class=\"h-anchor\" aria-hidden=\"true\"\u003e#\u003c/a\u003e\n\u003c/h2\u003e\n\u003cp\u003eThe fork lives at \u003ca href=\"https://github.com/tatoalo/metube_pot\"\u003etatoalo/metube_pot\u003c/a\u003e. If you\u0026rsquo;re running MeTube and hitting YouTube\u0026rsquo;s bot detection, or you want your downloads to play nice with Jellyfin, give it a spin:\u003c/p\u003e\n\u003cdiv class=\"highlight\"\u003e\u003cpre tabindex=\"0\" style=\"color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;\"\u003e\u003ccode class=\"language-bash\" data-lang=\"bash\"\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003edocker pull ghcr.io/tatoalo/metube_pot\n\u003c/span\u003e\u003c/span\u003e\u003c/code\u003e\u003c/pre\u003e\u003c/div\u003e\u003cp\u003eSometimes you just see something that\u0026rsquo;s 90% of what you need, and the remaining 10% is an afternoon of hacking. Fork stuff, scratch your own itches, automate the tedious parts.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eNote\u003c/strong\u003e: I don\u0026rsquo;t condone piracy. Use this tool responsibly and ethically. Also, respect YouTube\u0026rsquo;s terms of service and copyright laws. 🤷‍♂️\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eNote\u003c/strong\u003e: This has been done for fun and for research purposes. 🤷‍♂️🤷‍♂️\u003c/p\u003e\n","date_modified":"2026-01-04T00:00:00Z","date_published":"2026-01-04T00:00:00Z","id":"https://apogliaghi.com/2026/01/forking-metube-~-you-can-just-do-stuff/","summary":" The Itch # MeTube is a neat self-hosted YouTube downloader with a clean web UI. Paste a link, pick your format, hit download. Simple.\nExcept YouTube decided that simple things shouldn\u0026rsquo;t stay simple.\nAt some point, downloads started failing with the lovely \u0026ldquo;Sign in to confirm you\u0026rsquo;re not a bot\u0026rdquo; message. Classic. YouTube\u0026rsquo;s bot detection had gotten stricter, the web is not fun anymore.\nOn top of that, I wanted my downloaded videos to actually show up properly in Jellyfin instead of appearing as mysterious \u0026ldquo;Unknown\u0026rdquo; entries with no metadata. Two itches, one fork.\n","title":"Forking MeTube ~ You can just do stuff","url":"https://apogliaghi.com/2026/01/forking-metube-~-you-can-just-do-stuff/"},{"authors":[{"name":"Alessandro Pogliaghi"}],"content_html":"\u003cdiv style=\"background: linear-gradient(135deg, #ff6b35, #f7931e); padding: 20px; border-radius: 10px; margin: 30px 0; text-align: center; box-shadow: 0 4px 15px rgba(0,0,0,0.1);\"\u003e\n  \u003ch3 style=\"margin: 0 0 15px 0; color: white; font-size: 1.3em;\"\u003e🗣️ Join the Discussion 🗣️\u003c/h3\u003e\n  \u003cdiv style=\"display: flex; justify-content: center; gap: 20px; flex-wrap: wrap; margin-bottom: 15px;\"\u003e\n    \u003ca href=\"https://news.ycombinator.com/item?id=45345233\" style=\"display: inline-flex; align-items: center; padding: 10px 20px; background: rgba(255,255,255,0.2); border-radius: 25px; text-decoration: none; color: white; font-weight: bold; transition: all 0.3s ease; backdrop-filter: blur(10px);\" onmouseover=\"this.style.background='rgba(255,255,255,0.3)'; this.style.transform='translateY(-2px)'\" onmouseout=\"this.style.background='rgba(255,255,255,0.2)'; this.style.transform='translateY(0)'\"\u003e\n      \u003cimg src=\"https://news.ycombinator.com/favicon.ico\" alt=\"HN\" style=\"width: 16px; height: 16px; margin-right: 8px;\"\u003e\n      Hacker News\n    \u003c/a\u003e\n    \u003ca href=\"https://lobste.rs/s/6wzpji/crypto_miner_hotio_qbittorrent\" style=\"display: inline-flex; align-items: center; padding: 10px 20px; background: rgba(255,255,255,0.2); border-radius: 25px; text-decoration: none; color: white; font-weight: bold; transition: all 0.3s ease; backdrop-filter: blur(10px);\" onmouseover=\"this.style.background='rgba(255,255,255,0.3)'; this.style.transform='translateY(-2px)'\" onmouseout=\"this.style.background='rgba(255,255,255,0.2)'; this.style.transform='translateY(0)'\"\u003e\n      \u003cspan style=\"font-size: 1.2em; margin-right: 8px;\"\u003e🦞\u003c/span\u003e\n      Lobste.rs\n    \u003c/a\u003e\n  \u003c/div\u003e\n\u003c/div\u003e\n\u003chr\u003e\n\u003ch3 id=\"infected-container-image\"\u003e\n  Infected Container Image\n  \u003ca href=\"#infected-container-image\" class=\"h-anchor\" aria-hidden=\"true\"\u003e#\u003c/a\u003e\n\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003eRegistry:\u003c/strong\u003e \u003ccode\u003eghcr.io/hotio/qbittorrent\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eTag:\u003c/strong\u003e \u003ccode\u003erelease\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eDigest:\u003c/strong\u003e \u003ccode\u003esha256:3779f89712dbaa8b25fc22897d0b471ee\u003c/code\u003e\n\u003ccode\u003e29049b2b0f8d3c192df83b098c84fc5\u003c/code\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003chr\u003e\n\u003cp\u003eRecently, while migrating to a new server, I discovered a suspicious process running inside a \u003ca href=\"https://hotio.dev/containers/qbittorrent/\"\u003ehotio/qbittorrent\u003c/a\u003e Docker container.\u003c/p\u003e\n\u003cp\u003eI mainly use this to download Linux ISOs, as anybody else, right?\u003c/p\u003e\n\u003cp\u003eI just want to get that sweet sweet \u003ca href=\"https://omarchy.org/\"\u003eOmarchy\u003c/a\u003e ISO.\u003c/p\u003e\n\u003ch2 id=\"the-problem\"\u003e\n  The Problem\n  \u003ca href=\"#the-problem\" class=\"h-anchor\" aria-hidden=\"true\"\u003e#\u003c/a\u003e\n\u003c/h2\u003e\n\u003cp\u003eWhile monitoring system resources, I noticed a process consuming unusually high CPU:\u003c/p\u003e\n\u003cdiv class=\"highlight\"\u003e\u003cpre tabindex=\"0\" style=\"color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;\"\u003e\u003ccode class=\"language-bash\" data-lang=\"bash\"\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e$ ps -ef | grep netservlet\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e\u003cspan style=\"color:#ae81ff\"\u003e1000\u003c/span\u003e  \u003cspan style=\"color:#ae81ff\"\u003e758679\u003c/span\u003e  \u003cspan style=\"color:#ae81ff\"\u003e756435\u003c/span\u003e  \u003cspan style=\"color:#ae81ff\"\u003e99\u003c/span\u003e 09:39 ?  00:13:43 ./netservlet\n\u003c/span\u003e\u003c/span\u003e\u003c/code\u003e\u003c/pre\u003e\u003c/div\u003e\n  \u003cfigure class=\"center\" \u003e\n    \u003cimg src=\"/img/_qbittorrent-cryptominer/cpu_spike.png\" \n         \n         \n         \n          /\u003e\n    \n  \u003c/figure\u003e\n\n\n\u003cp\u003eThe binary \u003ccode\u003enetservlet\u003c/code\u003e was unfamiliar, and attempts to inspect it via \u003ccode\u003e/proc\u003c/code\u003e failed:\u003c/p\u003e\n\u003cdiv class=\"highlight\"\u003e\u003cpre tabindex=\"0\" style=\"color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;\"\u003e\u003ccode class=\"language-bash\" data-lang=\"bash\"\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e$ docker exec qbittorrent cat /proc/758679/exe \u0026gt; /tmp/netservlet\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e\u003cspan style=\"color:#75715e\"\u003e# Output: No such file or directory\u003c/span\u003e\n\u003c/span\u003e\u003c/span\u003e\u003c/code\u003e\u003c/pre\u003e\u003c/div\u003e\u003cp\u003eThis indicates the binary was likely \u003cstrong\u003eunlinked from the filesystem\u003c/strong\u003e, pretty much as expected.\u003c/p\u003e\n\u003ch2 id=\"investigation\"\u003e\n  Investigation\n  \u003ca href=\"#investigation\" class=\"h-anchor\" aria-hidden=\"true\"\u003e#\u003c/a\u003e\n\u003c/h2\u003e\n\u003cp\u003eSince direct access to the executable was blocked, I generated a core dump:\u003c/p\u003e\n\u003cdiv class=\"highlight\"\u003e\u003cpre tabindex=\"0\" style=\"color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;\"\u003e\u003ccode class=\"language-bash\" data-lang=\"bash\"\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e$ gcore -o /tmp/netservlet_core \u003cspan style=\"color:#ae81ff\"\u003e758679\u003c/span\u003e\n\u003c/span\u003e\u003c/span\u003e\u003c/code\u003e\u003c/pre\u003e\u003c/div\u003e\u003cp\u003eI could now simply use \u003ccode\u003estrings\u003c/code\u003e to further have a look:\u003c/p\u003e\n\u003cdiv class=\"highlight\"\u003e\u003cpre tabindex=\"0\" style=\"color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;\"\u003e\u003ccode class=\"language-bash\" data-lang=\"bash\"\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e$ strings /tmp/netservlet.elf | egrep -i \u003cspan style=\"color:#e6db74\"\u003e\u0026#39;stratum|pool|wallet|http|crypto|mining|eth|btc|pool\u0026#39;\u003c/span\u003e\n\u003c/span\u003e\u003c/span\u003e\u003c/code\u003e\u003c/pre\u003e\u003c/div\u003e\u003cp\u003eHighlights included:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eReferences to cryptocurrency mining: \u003ccode\u003ecryptonight\u003c/code\u003e, \u003ccode\u003eethash_calculate_dag_item\u003c/code\u003e, \u003ccode\u003emining.submit\u003c/code\u003e, \u003ccode\u003emining.authorize\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eMining pool addresses: \u003ccode\u003eauto.c3pool.org:19999\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eMiner configuration options: \u003ccode\u003e--cpu-memory-pool\u003c/code\u003e, \u003ccode\u003e--opencl\u003c/code\u003e, \u003ccode\u003e--cuda\u003c/code\u003e, \u003ccode\u003e--rig-id\u003c/code\u003e, \u003ccode\u003ehttp-access-token\u003c/code\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThis confirmed that \u003ccode\u003enetservlet\u003c/code\u003e was \u003cstrong\u003ea stealth crypto miner\u003c/strong\u003e, likely XMRig or a variant.\nI thought we were over crypto bros and all over to AI-bros, I was mistaken 😂.\u003c/p\u003e\n\n  \u003cfigure class=\"center\" \u003e\n    \u003cimg src=\"/img/_qbittorrent-cryptominer/wat.png\" \n         \n         \n         \n          /\u003e\n    \n  \u003c/figure\u003e\n\n\n\u003cp\u003eJust for fun, I also ran \u003ccode\u003ebinwalk\u003c/code\u003e against the dump, which ended up with a \u003ccode\u003e1.3GB\u003c/code\u003e \u003ccode\u003egzip\u003c/code\u003e archive.\nWe couldn\u0026rsquo;t just unzip it, though, due to obfuscation.\u003c/p\u003e\n\u003cp\u003eI will analyze it via \u003ccode\u003eghidra\u003c/code\u003e later, today I should be OOO lol.\u003c/p\u003e\n\u003ch2 id=\"conclusion\"\u003e\n  Conclusion\n  \u003ca href=\"#conclusion\" class=\"h-anchor\" aria-hidden=\"true\"\u003e#\u003c/a\u003e\n\u003c/h2\u003e\n\u003cp\u003eRemember:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eNever trust random Docker images—your containers aren’t magic elves.\u003c/li\u003e\n\u003cli\u003eKeep an eye on system resources—they have feelings too.\u003c/li\u003e\n\u003cli\u003eAudit your host and containers often—because surprises are only fun at parties.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2025-09-23T00:00:00Z","date_published":"2025-09-23T00:00:00Z","id":"https://apogliaghi.com/2025/09/crypto-miner-in-hotio/qbittorrent/","summary":" 🗣️ Join the Discussion 🗣️ Hacker News 🦞 Lobste.rs Infected Container Image # Registry: ghcr.io/hotio/qbittorrent Tag: release Digest: sha256:3779f89712dbaa8b25fc22897d0b471ee 29049b2b0f8d3c192df83b098c84fc5 Recently, while migrating to a new server, I discovered a suspicious process running inside a hotio/qbittorrent Docker container.\n","title":"Crypto Miner in hotio/qbittorrent","url":"https://apogliaghi.com/2025/09/crypto-miner-in-hotio/qbittorrent/"},{"authors":[{"name":"Alessandro Pogliaghi"}],"content_html":"\u003cp\u003eThis is the tweet (\u003ca href=\"https://web.archive.org/web/20220928192647/https://twitter.com/PixelatedWah/status/1574924613456343041#expand\"\u003ewaybackmachine\u003c/a\u003e) that has gone viral in the last 24 hours.\u003c/p\u003e\n\u003c!-- **Update (July, 2025)**: Tweet has been removed since.  --\u003e\n\n  \u003cfigure class=\"center\" \u003e\n    \u003cimg src=\"/img/_final-space/final_space_tweet.png\" \n         \n          width=\"400px\" \n          height=\"auto\" \n          /\u003e\n    \n  \u003c/figure\u003e\n\n\n\u003cp\u003eBasically WB pulled the plug on the show \u003ca href=\"https://en.wikipedia.org/wiki/Final_Space\"\u003eFinal Space\u003c/a\u003e by treating it as a tax write-off.\u003c/p\u003e\n\u003ch2 id=\"the-good-old-times-and-nflx\"\u003e\n  The Good Old Times and $NFLX\n  \u003ca href=\"#the-good-old-times-and-nflx\" class=\"h-anchor\" aria-hidden=\"true\"\u003e#\u003c/a\u003e\n\u003c/h2\u003e\n\u003cp\u003eI remember that I never really had any issues torrenting stuff when I was a little boy already diving into the net for \u003cdel\u003emovies/tv-series/games\u003c/del\u003e legal Linux distros 👀.\u003c/p\u003e\n\u003cp\u003eAt some point, Netflix became available in most of Europe and suddenly a very nice UX with a growing catalogue of contents was available on major platforms for an affordable monthly price. I noticed that a lot of my friends back then, stopped downloading or streaming movies and started using Netflix.\u003c/p\u003e\n\u003cp\u003eDid Netflix reduced content pirating? I don\u0026rsquo;t have data to support this, but I can imagine that who did before Netflix came along, probably kept on doing it afterwards as well. Perhaps the numbers would be in favour of Netflix in terms of traffic share, just because of the sheer low barrier to entry for platform adoption, especially with respect to mobile traffic.\u003c/p\u003e\n\u003cp\u003eThe thing that kept me using Netflix, is the UX of the mobile application. There\u0026rsquo;s no other service, to which I can legally obtain access, that remotely comes close in terms of user experience, in my opinion. Amazon Prime is aberrant, the app sucks, the search functionality is, God\u0026rsquo;s knows why, still broken and has items that can only be bought with a separate transaction.\nHaven\u0026rsquo;t used Disney+ too much, it seemed ok but the library content wasn\u0026rsquo;t enough for me to justify the subscription.\nAppleTV+ has had amazing shows lately and the experience is good, if you\u0026rsquo;re already into the 🍎 ecosystem.\u003c/p\u003e\n\u003cp\u003eAlready the fact that we have all these applications (in the US the phenomena is even more striking) is basically calling for the end users to pirate stuff, most of the times you don\u0026rsquo;t even know where to watch something, you just want to watch it.\u003c/p\u003e\n\u003ch2 id=\"final-space\"\u003e\n  Final Space\n  \u003ca href=\"#final-space\" class=\"h-anchor\" aria-hidden=\"true\"\u003e#\u003c/a\u003e\n\u003c/h2\u003e\n\u003cp\u003eFinal Space has been removed from the face of the earth and has kind woke some people up regarding digital ownership of items, this is not something new, of course. Think about your Spotify library, if at some point Spotify kills your account, you\u0026rsquo;d loose everything in a heartbeat. Same with Netflix and all of the other services.\u003c/p\u003e\n\u003cblockquote\u003e\n\u003cp\u003eFive years of my life.s\nThree seasons.\nBlood, sweat, and tears\u0026hellip;\n\u0026hellip;.became a tax write-off for the network that owns Final Space.\nYup. That\u0026rsquo;s it. That\u0026rsquo;s why it\u0026rsquo;s disappeared everywhere in the USA. Five years of work vanished.\u003cbr\u003e\nWhen the license is up internationally, Netflix will take it down, and then it will be gone forever. There are no more physical copies of S1 and S2, and no physical copies of Season 3 were ever made. Your memory of Final Space will be the only proof it ever existed\u003c/p\u003e\u003c/blockquote\u003e\n\u003ch2 id=\"so\"\u003e\n  So?\n  \u003ca href=\"#so\" class=\"h-anchor\" aria-hidden=\"true\"\u003e#\u003c/a\u003e\n\u003c/h2\u003e\n\u003cp\u003eI remember the following hilarious short video shown at the beginning of movies:\u003c/p\u003e\n\u003cvideo controls width=\"100%\" style=\"max-width: 640px;\"\u003e\n  \u003csource src=\"/img/_final-space/u_wouldnt_steal_a_car.webm\" type=\"video/webm\"\u003e\n  Your browser does not support the video tag.\n\u003c/video\u003e\n\u003cblockquote\u003e\n\u003cp\u003eYou wouldn\u0026rsquo;t steal a car\u003c/p\u003e\u003c/blockquote\u003e\n\u003cp\u003eBut what if you bought a car and then, at some point, the car maker or the car salesman took it from you (moreover, without a refund)? I know, I\u0026rsquo;m exaggerating here but you get the gist.\u003c/p\u003e\n\u003cp\u003eOn Prime the button clearly states \u0026ldquo;\u003cstrong\u003eBuy Item\u003c/strong\u003e\u0026rdquo; but then in the ToS in some obscure point, it reads\u003c/p\u003e\n\u003cblockquote\u003e\n\u003cp\u003e[..] revocable licensing [..]\u003c/p\u003e\u003c/blockquote\u003e\n\u003cp\u003eour society is driven by legalese bs 🙈.\u003c/p\u003e\n\u003cp\u003eI don\u0026rsquo;t have a solution, but things like this certainly don\u0026rsquo;t help stopping people from using other ways to consume mediums.\u003c/p\u003e\n\u003cp\u003eThe company Sandvine published a \u003ccode\u003e2022\u003c/code\u003e report and it\u0026rsquo;s interesting to notice the global traffic share per medium/service, FYI.\u003c/p\u003e\n\n  \u003cfigure class=\"center\" \u003e\n    \u003cimg src=\"/img/_final-space/global_traffic_share.png\" \n         \n         \n         \n          /\u003e\n    \n  \u003c/figure\u003e\n\n\n","date_modified":"2022-09-29T00:00:00Z","date_published":"2022-09-29T00:00:00Z","id":"https://apogliaghi.com/2022/09/final-space-and-the-sweet-path-to-the-torrent/","summary":"This is the tweet (waybackmachine) that has gone viral in the last 24 hours.\nBasically WB pulled the plug on the show Final Space by treating it as a tax write-off.\nThe Good Old Times and $NFLX # I remember that I never really had any issues torrenting stuff when I was a little boy already diving into the net for movies/tv-series/games legal Linux distros 👀.\n","title":"Final Space and the (sweet) path to the Torrent","url":"https://apogliaghi.com/2022/09/final-space-and-the-sweet-path-to-the-torrent/"},{"authors":[{"name":"Alessandro Pogliaghi"}],"content_html":"\u003cp\u003eIt seems that, for us Software peeps, hosting a blog is like the sports car midlife crisis phase.\nIt\u0026rsquo;s bound to happen, sooner or later, for almost all of us 😁\u003c/p\u003e\n\u003cp\u003eThis is no different, I guess, I will use this blog to sometime express my thoughts on world events\u003csup id=\"fnref:1\"\u003e\u003ca href=\"#fn:1\" class=\"footnote-ref\" role=\"doc-noteref\"\u003e1\u003c/a\u003e\u003c/sup\u003e, software-related stuff and some personal projects that I would be working on.\u003c/p\u003e\n\u003ch2 id=\"the-software-situation\"\u003e\n  The software situation\n  \u003ca href=\"#the-software-situation\" class=\"h-anchor\" aria-hidden=\"true\"\u003e#\u003c/a\u003e\n\u003c/h2\u003e\n\u003cp\u003eI have recently stumbled upon this fantastic talk by \u003ca href=\"https://en.wikipedia.org/wiki/Jonathan_Blow\"\u003eJonathan Blow\u003c/a\u003e, entitled \u0026ldquo;\u003cem\u003ePreventing the Collapse of Civilization\u003c/em\u003e\u0026rdquo; and, while I think some points are exaggerated, I really found it insightful.\u003c/p\u003e\n\u003cp\u003eI believe that the core, would be something along the lines of\u003c/p\u003e\n\u003cblockquote\u003e\n\u003cp\u003eSoftware is getting so complex that the knowledge for how to do the intricate or demanding things isn\u0026rsquo;t held by many people, which makes it brittle. Adding layers of complexity on top of each other has created a tower of abstraction that people usually only know a part of, which makes the entire stack brittle if not enough people know every part of it and something breaks.\u003c/p\u003e\u003c/blockquote\u003e\n\u003cp\u003eThere are cases in which this doesn\u0026rsquo;t hold true, of course. This blog, for example, is built with hugo, hosted on the \u0026ldquo;new Heroku\u0026rdquo;, \u003ca href=\"https://fly.io\"\u003efly.io\u003c/a\u003e, and I completely adore the DX there. Extremely simple setup, all you need is really just a Docker image to push.\nOne could argue that having a docker image already implicates having too much complexity, I mean, this are just static files after all\u0026hellip;\u003c/p\u003e\n\u003cp\u003eAnd that may be the problem that Blow is trying to underline, he suggest that \u003cstrong\u003esimplifying\u003c/strong\u003e the development processes and tools could help to \u003cstrong\u003ereduce complexity\u003c/strong\u003e and non-necessary dependencies.\u003c/p\u003e\n\u003cp\u003eAgain, I completely agree with that statement. Another important concept is having deeper understanding of the technologies and the tools used at a lower level.\nThis is hard, and takes time. A lot of companies, I imagine, don\u0026rsquo;t really care about this. The really sad part is that, I believe, the cost of issues down the road is so much more than the upfront one related to giving the possibility to the technical peeps of learning the intrinsic knowledge of things, and not to (usually) leave this task to 1 \u0026ldquo;senior\u0026rdquo; person on the team.\u003c/p\u003e\n\u003cdiv style=\"position: relative; padding-bottom: 56.25%; height: 0; overflow: hidden;\"\u003e\n      \u003ciframe allow=\"accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share; fullscreen\" loading=\"eager\" referrerpolicy=\"strict-origin-when-cross-origin\" src=\"https://www.youtube.com/embed/pW-SOdj4Kkk?autoplay=0\u0026amp;controls=1\u0026amp;end=0\u0026amp;loop=0\u0026amp;mute=0\u0026amp;start=0\" style=\"position: absolute; top: 0; left: 0; width: 100%; height: 100%; border:0;\" title=\"YouTube video\"\u003e\u003c/iframe\u003e\n    \u003c/div\u003e\n\n\u003cp\u003ePersonally, I really dislike the whole Electron-mania and javascript everywhere that slows down every piece of software it touches, everything is basically a small chromium instance running and eating RAM like crazy, it should not be like that, nor we need it to be like that.\nI am optimistic about the future, one has to be during these times with all that is happening, let\u0026rsquo;s see what will come next.\u003c/p\u003e\n\n  \u003cfigure class=\"center\" \u003e\n    \u003cimg src=\"/img/_software-midlife-crisis/big_decisions.png\" \n          alt=\"Yep\" \n         \n         \n          /\u003e\n    \n  \u003c/figure\u003e\n\n\n\u003cdiv class=\"footnotes\" role=\"doc-endnotes\"\u003e\n\u003chr\u003e\n\u003col\u003e\n\u003cli id=\"fn:1\"\u003e\n\u003cp\u003eWho doesn\u0026rsquo;t like politics, amiright?!\u0026#160;\u003ca href=\"#fnref:1\" class=\"footnote-backref\" role=\"doc-backlink\"\u003e\u0026#x21a9;\u0026#xfe0e;\u003c/a\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ol\u003e\n\u003c/div\u003e\n","date_modified":"2022-09-28T00:00:00Z","date_published":"2022-09-28T00:00:00Z","id":"https://apogliaghi.com/2022/09/software-midlife-crisis/","summary":"It seems that, for us Software peeps, hosting a blog is like the sports car midlife crisis phase. It\u0026rsquo;s bound to happen, sooner or later, for almost all of us 😁\nThis is no different, I guess, I will use this blog to sometime express my thoughts on world events1, software-related stuff and some personal projects that I would be working on.\nThe software situation # I have recently stumbled upon this fantastic talk by Jonathan Blow, entitled \u0026ldquo;Preventing the Collapse of Civilization\u0026rdquo; and, while I think some points are exaggerated, I really found it insightful.\n","title":"Software Midlife Crisis","url":"https://apogliaghi.com/2022/09/software-midlife-crisis/"}],"title":"Alessandro Pogliaghi","version":"https://jsonfeed.org/version/1.1"}