Announcements

Primary Domain Switch to obsp.dev

Tue, 15 Sep 2026 02:30:00 +0200

1. New Primary Domain

The primary domain of this site will be switched from obsp.de to obsp.dev. ~~The maintainer would like to build a more international outlook instead of focusing on Europe, hence this change.~~ (Na ah they just like the vibe)

2. Scope of the Change

This change only affects the site itself (@ and www). All other services will remain on the obsp.de domain, so there is no need to change anything on your end.

For now, www and @ of obsp.dev will redirect to obsp.de. After 2–3 weeks, the redirect will be the other way around. When that happens, RSS entries might break — apologies in advance.

3. Identity & WKD

root@obsp.dev is now another identity of the maintainer. The OpenPGP key fingerprint remains the same:

TEXT

9967 35BE 4961 80AF B582 ECAB EE31 BB28 ECF6 B268

It is now also discoverable via WKD, so you can simply run gpg --locate-key root@obsp.dev.

4. DNSSEC

DNSSEC has not yet been implemented, as this is still a new domain. It will be live within a month, using either algorithm 13 (ECDSA-P256-SHA256) or algorithm 15 (Ed25519).

Privacy and Whatsoever

Fri, 07 Aug 2026 23:41:50 +0800

It’s been a while since I last posted. I spent a meaningful year in the university, or meaningless, depends on your standards.

I’m trying to find something to write on, but aside from vibe-coding an Arduino board to control a three-wheeled robot, doing some random analysis on energy storage that convinces nobody, and getting some 10s in exams while some 6s in others, there’s nothing that I actually want to write on.

I stopped making true friends since 17, not deliberately, it’s just I’m tired of getting in any kind of new relationships. So nothing much to say about my social life either.

So… let’s talk about my point of view of privacy, maybe?

This may surprise you, but no, I am not a privacy-savvy person.

The reason why I don’t use Google workspace or Microsoft 365 to host my domain email is because I want to use the simplest way to authorize my email clients. Any client. So just IMAP/SMTP, with username and passwords. Not using a helper like ortie pretending they are Mozilla Thunderbird to get the token and then put into himalaya (unfortunately my school still uses MS365 so thanks TU Eindhoven for making use of ortie). I reject Pro*on and T*ta for the same reason.

The reason why I use something else than Windows on my personal PC is because Windows is really resource consuming and the fact that the package manager winget is often not useful forces me to execute the installers again and again.

The reason why I write blogs and post on Fediverse instead of just using X or rednote is because I’m anxious about everything and watching other people showing of their perfectly-planned, well-decorated, successful-in-all-aspect life drains me out. (The algorithm knows that perfectly well, I don’t know if their ultimate goal is to convince me to commit suicide - just joking.)

The reason why I self-host my photo service, notesbook server, search engine and everything else is because I can’t afford the services or I’m fed up with promotions.

The reason why I unlocked my phone’s bootloader is because I want to use a custom font.

SEE? It’s nothing with privacy. I’m not seeking somewhere to hide, just somewhere I could live very comfortably, not invasive towards others at all, and I don’t even care if some random guy from the internet knows who I am. But this is not possible in this centralized, information-overloaded, protective InTeRnEt. People from 2000s might think if there is a utopia on earth it might be built on the internet. In 2020s we should just admit it sucks even more than offline life (I’m avoiding the term “real life”, after all, online activities are real as well).

I don’t think the above statements are pessimistic, they are simply the truth. My depression is not taking over anything.

Oh, also, maybe talk about something in the spotlight, large language models. They emerged as a product long time ago but had not prevailed until recently. Personally I don’t think that’s a “technological explosion” that changes the lifestyle. Of course they perform a lot of meaningless or ethically doubtful actions, that drains resource that could be used by human, but it might be meaningful or ethically fair, depends on your standards.

Notes on Setting Up and Backing Up GoToSocial

Sat, 27 Jun 2026 03:05:15 +0200

Installing GTS

I got an Oracle Cloud instance, so I decided to set up my own Fediverse instance. After some thought, I went with GoToSocial — it’s fairly lightweight and works with any Mastodon API-compatible client. The downside is that it’s pretty bare-minimum: features like emoji reactions and quote posts are absent.

The official GTS docker-compose.yaml can be fetched like this:

BASH

wget https://codeberg.org/superseriousbusiness/gotosocial/raw/branch/main/example/docker-compose/docker-compose.yaml

YAML

services:
 gotosocial:
 image: docker.io/superseriousbusiness/gotosocial:latest
 container_name: gotosocial
 user: 1000:1000
 networks:
 - gotosocial
 environment:
 # Change this to your actual host value.
 GTS_HOST: example.org
 GTS_DB_TYPE: sqlite
 # Path in the GtS Docker container where
 # the sqlite.db file will be stored.
 GTS_DB_ADDRESS: /gotosocial/storage/sqlite.db
 # Change this to true if you're not running
 # GoToSocial behind a reverse proxy.
 GTS_LETSENCRYPT_ENABLED: "false"
 # Set your email address here if you
 # want to receive letsencrypt notices.
 GTS_LETSENCRYPT_EMAIL_ADDRESS: ""
 # Path in the GtS Docker container where the
 # Wazero compilation cache will be stored.
 GTS_WAZERO_COMPILATION_CACHE: /gotosocial/.cache
 ## For reverse proxy setups:
 GTS_TRUSTED_PROXIES: "172.18.0.1/16"
 ## Set the timezone of your server:
 #TZ: UTC
 ports:
 - "443:8080"
 ## For letsencrypt:
 #- "80:80"
 ## For reverse proxy setups:
 #- "127.0.0.1:8080:8080"
 volumes:
 # Your data volume, for your
 # sqlite.db file and media files.
 - ~/gotosocial/data:/gotosocial/storage
 # OPTIONAL: To mount volume for the WAZERO
 # compilation cache, for speedier restart
 # times, uncomment the below line:
 #- ~/gotosocial/.cache:/gotosocial/.cache
 restart: "always"

networks:
 gotosocial:
 ipam:
 driver: default
 config:
 - subnet: "172.18.0.0/16"
 gateway: "172.18.0.1"

Since I already had Caddy running on the machine, I commented out all the reverse-proxy-related parts.

I also added a few lines under environment (GTS has a separate config file for environment variables, but if you don’t want to mount it you can write them directly in compose.yml — just uppercase the variable name, replace - with _, and prepend GTS_. See the docs):

YAML

 GTS_ACCOUNTS_ALLOW_CUSTOM_CSS: true # allow custom CSS per user
 TZ: Europe/Berlin
 GTS_INSTANCE_LANGUAGES: "zh,en,nl,de,fr,ja"

And under volumes I mounted a custom font:

YAML

 - /home/ubuntu/gotosocial/fonts/GeistPixel-Square.woff2:/gotosocial/web/assets/fonts/GeistPixel-Square.woff2:ro

After doing this, the font can be referenced in CSS.

CSS Customisation

GTS profile themes come from two sources: themes uploaded by the admin as preset options, and CSS written directly by users. Both layers stack on top of each other.

The site-wide CSS is also customisable. I went with a combination of Catppuccin Frappé, Geist Pixel Square, and Fusion Pixel.

Backing Up the Database and Media

Honestly, I’ve always been hesitant about self-hosting, because I don’t have much confidence in my own backups. If the database gets corrupted, the signing keys are lost, and rejoining the federation from the same domain becomes extremely painful.

The GTS docs have a detailed guide on backup and restore, and the recommended database backup tool is Borgmatic. ~~Though I was lazy and hadn’t read that section before writing this, so I didn’t use it.~~

For backing up media and the database I use an S3 bucket, mounted via rclone.

You could just upload everything from the Docker-mapped folder on the host, but that’s inelegant — the media directory includes caches from remote instances, which take up a lot of space but don’t need to be backed up. You only need to preserve media from local accounts.

The GTS CLI tools provide gotosocial admin media list-attachments and gotosocial admin media list-emojis. Adding the --local-only flag lists only local media files.

The output looks something like this:

TEXT

/gotosocial/062G5WYKY35KKD12EMSM3F8PJ8/attachment/original/01PFPMWK2FF0D9WMHEJHR07C3R.jpg
/gotosocial/01F8MH1H7YV1Z7D2C8K2730QBF/attachment/original/01PFPMWK2FF0D9WMHEJHR07C3Q.jpg
/gotosocial/01F8MH5ZK5VRH73AKHQM6Y9VNX/attachment/original/01FVW7RXPQ8YJHTEXYPE7Q8ZY0.jpg
/gotosocial/01F8MH1H7YV1Z7D2C8K2730QBF/attachment/original/01F8MH8RMYQ6MSNY3JM2XT1CQ5.jpg
/gotosocial/01F8MH1H7YV1Z7D2C8K2730QBF/attachment/original/01F8MH7TDVANYKWVE8VVKFPJTJ.gif
/gotosocial/01F8MH17FWEB39HZJ76B6VXSKF/attachment/original/01F8MH6NEM8D7527KZAECTCR76.jpg
/gotosocial/01F8MH1H7YV1Z7D2C8K2730QBF/attachment/original/01F8MH58A357CV5K7R7TJMSH6S.jpg
/gotosocial/01F8MH1H7YV1Z7D2C8K2730QBF/attachment/original/01CDR64G398ADCHXK08WWTHEZ5.gif

Using this, we can filter media by local account ID during scheduled backups.

Here’s an example backup script using rclone against the host folder mapped from the Docker container:

/usr/local/bin/rclone-backup-optimized.sh

YAML

#!/usr/bin/env bash
set -uo pipefail


SRC="/home/ubuntu/gotosocial/data"
MEDIA_DST="remote:bucket/media"
DB_DST="remote:bucket/db"
CONF="/home/ubuntu/.config/rclone/rclone.conf"
COMPOSE_FILE="/home/ubuntu/gotosocial/docker-compose.yaml"
SERVICE="gotosocial"  # container name
GTS_BIN="/gotosocial/gotosocial" 
DB_FILE="/home/ubuntu/gotosocial/data/sqlite.db" 


# SQLite (vacuum into snapshot)
DB_OK=1; DB_OUT=""
SNAPDIR=$(mktemp -d); SNAP="$SNAPDIR/sqlite.db"
if DB_OUT=$(sqlite3 "$DB_FILE" "PRAGMA busy_timeout=10000; VACUUM INTO '$SNAP'" 2>&1); then
 CHK=$(sqlite3 "$SNAP" "PRAGMA integrity_check" 2>&1)
 if [ "$CHK" = "ok" ]; then
 if DB_OUT=$(rclone copy "$SNAP" "$DB_DST/" --config "$CONF" 2>&1); then
 DB_OK=0
 fi
 else
 DB_OUT="Snapshot integrity failed: $CHK"
 fi
fi
rm -rf "$SNAPDIR"

# list local account ids
get_ids() {
 sudo docker exec "$SERVICE" \
 "$GTS_BIN" admin media "$1" --local-only 2>/dev/null \
 | grep -oE '/[0-9A-HJKMNP-TV-Z]{26}/(attachment|emoji)/' \
 | grep -oE '[0-9A-HJKMNP-TV-Z]{26}'
}
IDS=$( { get_ids list-attachments; get_ids list-emojis; } | sort -u )

# sync media
FILTER=$(mktemp)
while IFS= read -r id; do printf '+ /%s/**\n' "$id"; done <<< "$IDS" >> "$FILTER"
printf -- '- **\n' >> "$FILTER"
MEDIA_OUT=$(rclone sync "$SRC" "$MEDIA_DST" --filter-from "$FILTER" --config "$CONF" 2>&1)
MEDIA_CODE=$?
rm -f "$FILTER"

After each backup you can also send a Discord webhook notification so you know if something goes wrong.

I added this to the script:

YAML

WEBHOOK="https://discord.com/api/webhooks/.../..." 

notify() {  # $1=title $2=color $3=description
 local payload
 payload=$(jq -n --arg t "$1" --arg d "$3" --arg h "$(hostname)" --argjson c "$2" \
 '{embeds:[{title:$t, description:$d, color:$c, footer:{text:$h}, timestamp:(now|todate)}]}')
 curl -sf -H "Content-Type: application/json" -d "$payload" "$WEBHOOK" >/dev/null
}

NUM=$(printf '%s\n' "$IDS" | wc -l | tr -d ' ')
[ "$DB_OK" -eq 0 ] && DB_LINE="Database: success" || DB_LINE="Database: failed ($(printf '%s' "$DB_OUT" | tail -c 300))"
[ "$MEDIA_CODE" -eq 0 ] && MEDIA_LINE="Media: success (${NUM} local account directory/ies)" || MEDIA_LINE="Media: failed (exit $MEDIA_CODE)"

if [ "$DB_OK" -eq 0 ] && [ "$MEDIA_CODE" -eq 0 ]; then
 TITLE="GtS backup success"; COLOR=3066993
else
 TITLE="GtS backup failed"; COLOR=15158332
fi
TAIL=$(printf '%s' "$MEDIA_OUT" | tail -c 1000)
DESC=$(printf '%s\n%s\n```\n%s\n```' "$DB_LINE" "$MEDIA_LINE" "${TAIL:-（Media no output）}")
notify "$TITLE" "$COLOR" "$DESC"

Phanpy: A Nicer Frontend

Installing Phanpy is quite painless since it’s a purely static site — you can just download a release and serve it behind a web server. However, the project doesn’t recommend this approach; the preferred way is a custom build.

After cloning the repo, something like this works:

BASH

PHANPY_DEFAULT_INSTANCE=social.obsp.de \
 PHANPY_CLIENT_NAME="Observer's Space Social" \
	 PHANPY_WEBSITE="https://phanpy.obsp.de" 
 PHANPY_PRIVACY_POLICY_URL=https://social.obsp.de/about \
 npm run build

The dist folder will contain everything you need.

Phanpy doesn’t yet support an instance whitelist, so I made a small modification to src/pages/login.jsx to restrict login to a single specific instance.

Quick Installation Matlab 2025b on Arch

Mon, 10 Nov 2025 01:00:34 +0100

Since I’m on Wayland, the best way to install Matlab should be mpm.
The Wiki page worked for me and the steps I executed include:

BASH

yay matlab-mpm
mpm install --release=R2025b --destination=~/matlab MATLAB 
#ofc, you can change the destination

Normally, you should be able to just execute ~/matlab/bin/glnxa64/MathWorksProductAuthorizer.sh and finish activating your license. However it didn’t went that smooth for me, because recent gnutls update (likely 3.8.10-1 or newer) breaks the TLS handshake in MATLAB’s bundled licensing libraries (libmwinstall\_activationwsclientimpl.so and libmwlmgrimpl.so), causing the segfault when the tool tries to connect to MathWorks servers.
So I ran these to make Matlab use the old version of gnutls :

BASH

wget https://archive.archlinux.org/packages/g/gnutls/gnutls-3.8.9-1-x86_64.pkg.tar.zst
mkdir -p matlab/gnutls
tar -xf gnutls-3.8.9-1-x86_64.pkg.tar.zst -C matlab/gnutls
mkdir -p ~/matlab/bin/glnxa64/gnutls
cp -a ~/matlab/gnutls/usr/lib/libgnutls* ~/matlab/bin/glnxa64/gnutls/
cd /home/user/matlab/bin/glnxa64/
ln -s gnutls/* ./

And that should be fine. Now you can continue to run ~/matlab/bin/glnxa64/MathWorksProductAuthorizer.sh, finishing setup and launch.
To launch Matlab faster from terminal you can add this line in .bashrc:

BASH

alias matlab='/home/user/matlab/bin/matlab' #change it to the path the executable locates

Or, alternatively, make a desktop entry with sudo nano /usr/share/applications/matlab.desktop:

TEXT

[Desktop Entry]
Type=Application
Terminal=false
MimeType=text/x-matlab
Exec=/home/user/matlab/bin/matlab -desktop -useStartupFolderPref
Name=MATLAB
Icon=matlab
Categories=Development;Math;Science
Comment=Scientific computing environment
StartupNotify=true

Fix Copy SMS Code on Graphene

Sat, 27 Sep 2025 14:30:58 +0200

You can read the detail description in this issue.

The fix is, find out the listener service with this adb command:

SHELL

adb shell pm dump io.github.jd1378.otphelper | grep -i "notification\|listener"

And you can see it’s called io.github.jd1378.otphelper/.NotificationListener.

So, we grant it special access to read notifications (which is not possible via settings GUI, and I don’ know why):

SHELL

adb shell cmd notification allow_listener io.github.jd1378.otphelper/.NotificationListener

How to Make Microsoft Bluetooth Mouse 3600 Work in Linux Windows Dual Boot

Thu, 28 Aug 2025 19:06:24 +0200

Before moving in the Netherlands, I used a USB mouse, and as a result I never bothered for pairing issues on dual booting Linux/Windows. However, I found Microsoft Bluetooth Mouse 3600 specifically helpful as it functions smoothly even without a mousepad.

Certainly, you can read this detailed tutorial from Arch Wiki, so I won’t explain too much on the general process.

The problem is, the table for Bluetooth 5.1 devices does not cover the model Microsoft Bluetooth Mouse 3600, and I have to refer to “Other devices”, the guidance of which does not really work for me.

What turns out to be working is as the followings:

this mouse will automatically create a new MAC address at pairing, thus you should change the Linux config accordingly (which has been mentioned in Arch Wiki)
copy CSRK from Windows to LocalSignatureKey.Key in Linux (all capital, no space)
copy LTK to LongTermKey.Key (all capital, no space)
copy the decimal value of EDIV to LongTermKey.EDiv
don’t modify LongTermKey.EncSize if it’s 16 already (this is correct)
copy the decimal value of ERand to LongTermKey.Rand, without any modification

Most devices require you to reverse the hexadecimal value of ERand and then convert it to decimal. This is not the case on 3600. If you see a decimal value in the registry, just use it.

By the way, this script is really helpful if your configuration doesn’t work: Bluetooth Dual Boot Pairing Helper. Credits to the author!

Adding Printer Support for Epson L3150 on Arch Linux

Thu, 07 Aug 2025 20:01:58 +0800

My printer is on network at address 192.168.138.250 .

First add CUPS:

ZSH

sudo pacman -Sy cups cups-browsed bluez-cups cups-pdf
sudo systemctl enable cups 
sudo systemctl start cups

Then some other dependencies (and drivers, if you want to use some other type than Epson L3150):

ZSH

sudo pacman -Sy system-config-printer
sudo pacman -Sy nss-mdns
sudo pacman -Sy foomatic-db foomatic-db-ppds 
sudo pacman -S foomatic-db-nonfree foomatic-db-nonfree-ppds

And we should install the driver for L3150, which can be achieved with an AUR package (Epson only offer .deb and .rpm packages officially):

ZSH

yay -S epson-inkjet-printer-escpr

All good to go! Try to search for printer with the address, and make the system discover the driver automatically. If it says the model is exactly Epson L3150, then the correct driver should be added.

Mastodon Comment Test

Wed, 06 Aug 2025 14:45:33 +0800

Does it work?

Interpreting Internet.nl Test Results

Tue, 05 Aug 2025 17:00:59 +0800

Disclaimer: I have been a user of almost every email provider mentioned below, and I am not affiliated with any of them.

You can read Forward Email’s comparison with many providers here: https://forwardemail.net/en/blog/forward-email-vs-mailbox-org-email-service-comparison , by substituting mailbox.org with others on their list.

In short, Forward Email has some wrong information. They attempt to achieve full score in every security test and prove they are superior to their competitors with scores. I don’t know what is driving Forward Email towards being a pupil, and it seems like many privacy seekers get trapped into how high they score in the Internet.nl tests.

I’m not denying its validity, but do you know what is it intended for? “Modern Internet” - it’s not exactly security or privacy, it’s their standard of future which I do agree with and appreciate their efforts to promote. But it’s really NOT a security test, because a large part of the score speaks for how well the web server and mail server support IPV6. A lower overall score with bad support of IPV6 and good performance in DNSSEC, DMARC and DANE, should be valued as outperforming a higher overall score with limited performance in DNSSEC, DMARC and DANE. Also, do you know Internet.nl returns zero score if they hit a rate limit towards the tested server? It happens to me when I set up Stalwart with default limiters on my machine. To get a full score on my domain, I have to manually tweak the limiters so that all the test would perform smoothly. It’s also not fair for hosting providers to test on their main domain, for example, if you test migadu.com, you will see worse result since DANE is temporarily off on mx.migadu.com which handles mail for it, but it doesn’t affect their customers, since DANE is still on for aspmx1.migadu.com and aspmx2.migadu.com , as seen on test of divested.dev.

The Mozilla HTTP Observatory and Hardenize Test are tests dedicated for WEB SERVERS. It has little thing to do with mail server examination, and showing off your high score here only make you act like an amateur. At least it’s not appropriate - Sheldon Cooper is smart in math, but he is a bad engineer.

And what is Forward Email trying to achieve by comparing themselves with pure relaying services like addy.io and pure SMTP API services like resend, and arguing they are not good enough because they don’t offer email storage? Hilarious.

All this tests have validity of a certain field to some extent, but you shouldn’t just take them all and claim that higher score necessarily means better security. For a dedicated email security test aggregation I would suggest Servers List from dismail, while it’s no longer actively maintained and all the data is outdated in 2025, you can always run the tests yourself, with the list for reference.

Arch Setup

Mon, 04 Aug 2025 15:45:50 +0800

Just performed a fresh install of Arch, and try to use zsh instead of bash.

To make it remember history, and inherit nice aliases from bash , make a file .zshrc with the following:

SHELL

# Created by newuser for 5.9
export PATH=$PATH:/home/user/.local/bin
# uncomment the line below if you feel like using oh-my-posh 
# eval "$(oh-my-posh init zsh --config 'catppuccin')" 
alias ls='ls --color=auto'
alias grep='grep --color=auto'
PS1='[\u@\h \W]\$ '
export XDG_DATA_DIRS="/var/lib/flatpak/exports/share:/home/user/.local/share/flatpak/exports/share:/home/user/.local/share/flatpak/exports/share:/var/lib/flatpak/exports/share:/usr/local/share/:/usr/share/"
HISTFILE=~/.zsh_history
# How many commands to store in history
HISTSIZE=10000
SAVEHIST=10000
setopt SHARE_HISTORY
# uncomment the lines below if you installed Fcitx 
# export XMODIFIERS="@im=fcitx"
# export GTK_IM_MODULE=fcitx
# export QT_IM_MODULE=fcitx

By default, GNOME doesn’t recognize tray icons from applications. This would be a headache for applications that starts up silently and automatically minimizes to tray. Head to Flatpak manager and install Extension Manager, open it and search for AppIndicator and KStatusNotifierItem Support, install the extension and you’ll be able to see icons showing up.

EduVPN doesn’t have an official client for Arch yet an unofficial one can be obtained easily:

SHELL

curl https://app.eduvpn.org/linux/v4/deb/app+linux@eduvpn.org.asc | gpg --import - 
yay -S python-eduvpn-client

That’s all.

Using GnuPG to Verify Yourself on Keyoxide

Sat, 26 Jul 2025 20:57:44 +0800

Disclaimer: this post is a machine translation of the original Chinese version. Please refer to the original content for accurate information.

Preface

Keyoxide is similar to Keybase.io, used for verifying the identity consistency of online accounts.

For example, search for contact@forgejo.org on Keyoxide.org, and you’ll see that Forgejo owns a Mastodon instance account @forgejo@floss.social, the domain forgejo.org, and a Forgejo instance account @forgejo@codeberg.org.

You can also search using OpenPGP public key fingerprints. For instance, search for my fingerprint (which can be found on the “Contact” page) on Keyoxide.org, and you’ll see that Yuki claims ownership of accounts such as ActivityPub, Matrix, Forgejo, as well as the domain obsp.de.

Each query performs real-time verification, and successfully verified entries will display a green checkmark next to them. This ensures the information is up to date.

Currently, Keyoxide employs two identity verification systems: one is the Ariadne Signature Profile, and the other is the widely adopted OpenPGP.

Keyoxide is decentralized—not only because anyone can run their own Keyoxide instance, but also because OpenPGP utilizes a federated information system. When you need to retrieve a public key, you can obtain the public key associated with an email address from large key servers like keys.openpgp.org, exchange public keys directly with your contacts in a peer-to-peer manner, or use WKD to fetch the public key.

So, what is WKD? WKD stands for Web Key Directory, and as the name suggests, it is a method of retrieving keys by making an HTTPS request to a specific directory on a website. For example, if Alice’s email address is alice@example.org, and Bob wants to obtain her public key but cannot find valid results on large key servers (because Alice hasn’t published it publicly), asking Alice directly would waste time waiting for her reply. If example.org supports WKD, Bob can run gpg --locate-key alice@example.org to fetch her public key. This command essentially performs the following actions:

Perform a WKD hash on the string “alice” to obtain the hash string “kei1q4tipxxu1yj79k9kfukdhfy631xe”
- You can verify it by running gpg-wks-client --print-wkd-hash alice@example.org in the terminal
Combine the hash string, the domain example.org, and the general format of WKD to obtain the WKD URL
- It should look like https://openpgpkey.example.org/.well-known/openpgpkey/example.org/hu/kei1q4tipxxu1yj79k9kfukdhfy631xe?l=alice
- Or https://example.org/.well-known/openpgpkey/example.org/hu/kei1q4tipxxu1yj79k9kfukdhfy631xe?l=alice
- The first type, known as the subdomain method URL, is more favored by GnuPG compared to the second type, the direct method URL.
The content of this WKD URL via curl
- It is not ASCII-armored but in binary format, making it unreadable.
gpg --import

You might notice that unlike the --search-key operation on a keyserver, GnuPG does not prompt you to confirm whether to import the key. This is because keys published via WKD are generally considered valid and trustworthy. If Alice owns the domain example.org and has exclusive control over its directory, the key discovered through WKD can be assumed to have been published by Alice herself. If Alice is merely a user of example.org, then at the very least, the key was published by Alice’s administrator.

Currently, email providers supporting WKD include systemli.org, posteo.de, Proton, Mailfence, and ForwardEmail, among others. Since disroot.org, which I use, does not support WKD, the public key you find on Keyoxide will show as originating from an HKP server. However, Forgejo provides WKD support for forgejo.org, so Keyoxide will display the public key as coming from WKD, and you can click the WKD link to verify it.

If you use a domain email, you can self-host WKD. If your provider supports WKD, you can CNAME the subdomain openpgpkey to the provider’s domain. If the provider does not support it, you can also directly CNAME to wkd.keys.openpgp.org, which is a WKD as a service offering by openpgp.org.

Creating Notation

Assuming:

You own a domain named doma.in
You have created a public key for your email address you@doma.in
You wish to prove ownership of this domain

What you need to do is simple:

Add a note to your public key: “I own doma.in”
Add a TXT record to the domain: “Public key fingerprint xxx is correct” (this record can optionally be hashed)

As you’ve likely noticed, these two records are not equivalent. With just the note on the public key, we can find doma.in, but the fingerprint in the TXT record on doma.in doesn’t lead us back to the public key. Moreover, since the fingerprint remains unchanged before and after the note, you have no way of knowing what public key fingerprint xxx actually said. We cannot and do not need to trace back from doma.in to you@doma.in, which is why the TXT record can be replaced with a hash (as for why someone might want to use a hash—it’s because they may have published their public key to a keyserver, where the fingerprint can be used to search and trace back to the public key).

Notes on public keys are referred to as Identity Claims on Keyoxide, which is quite straightforward—they are declarations of ownership over an identity. While asserting ownership, they also indicate where the proof can be found for that identity. The records returned by the claimed ownership items are called Identity Proofs, which can appear in places like TXT records of a domain, repositories on a Git instance, or posts on a Fediverse account. These locations must be editable only by the account owner. For example, you cannot claim a proof for a GitHub account in a gist under a username you do not claim—the reasoning is simple.

We run the following command to create a note:

BASH

gpg --edit-key FINGERPRINT
list #list all the uid under the fingerprint
uid N #select the uid to be edited
notation #add a new notation
proof@ariadne.id=dns:doma.in?type=TXT #claims that you own doma.in，with proof in its TXT record
save

Different online identities have different claims. You can check the supported claim/proof types yourself. Generally, claims follow the format proof@ariadne.id=CLAIM.

Creating a Proof

We add a proof to doma.in by creating a TXT record in the following format:

TEXT

openpgp4fpr: FINGERPRINT

The TTL can be any value.

Oh, and you can use argon2 or bcrypt for hashing to ensure a certain level of anonymity. Keyoxide’s documentation thoughtfully provides a hashing tool. Simply input the string openpgp4fpr: FINGERPRINT, then paste the output into the TXT record.

Now, upload your key to WKD or HKP! If all goes well, within the TTL period, you should be able to search for your email address or public key fingerprint on Keyoxide and see that you’ve successfully verified ownership of doma.in.

Miscellaneous

If you accidentally write the claim incorrectly (which happens often), you can re-enter the notation section of the GnuPG identity editor and input -the incorrect notation to delete it. If you forget which notations you’ve added, you can enter showpref while editing the identity to view them.

For most of my proofs, I used argon2 hashing, though Matrix uses plaintext. Hashed values always show verification failures—even switching to bcrypt didn’t work. I’m not sure exactly where the issue lies, but I’ll check later to see if I can reproduce it. (Update: It’s solved. use /plain command to prevent Matrix from formatting the string.) That said, it’s not a big deal since the hash doesn’t serve much purpose unless you genuinely don’t want someone who knows the location of your proof to discover the location of your claim, and you also won’t leak this connection through other means… The likelihood of this seems quite low to me. If that’s truly the case, it’s better not to claim at all, as it could compromise your anonymity.

I haven’t yet tried using Ariadne Signature Profile or self-hosting a Keyoxide instance—I might write another tutorial on that later. Keyoxide’s official documentation is highly recommended; it’s well-structured and easy to understand.

In Seek of Private Email Solution

Mon, 21 Jul 2025 22:36:45 +0800

Earlier this month I wrote an article with the title Encryption in Email Practice. My point of view is pretty straightforward, “encryption not complete means no encryption at all”, and people should stop relying on email for any secret or privacy. Nevertheless, people would not just stop because I (and many others) said don’t, as the inertia of communication is hard to revert.

The most interesting article I have read as an email enthusiast should be E-mail providers - which one to choose?, as the author themself appears to be a super paranoid and the ultimate seeker of privacy. The inspection method they have used is not technical, as they basically went through the privacy policy page of each provider and tried to sign up through Tor. Their criteria is at least extreme and trivial, if not hilarious:

If they said they would log your IP address, that’s too bad!
If they said they use analytic tools on their website (even the ones like self-hosted Matomo, and not Google Analytics), that’s too bad!
If they use a CDN, that’s too bad! If the CDN provider happens to be Cloudflare, that’s the worst garbage!
If you can’t sign up with Tor, that’s too bad!
If they charge you more than 2 bucks per month, that’s robbery!
If you need to pay for a custom domain name at a registrar, that’s robbery!
If they share your information with a third party, that’s the worst garbage!
If you need to do a Captcha (even Friendly Captcha, not Google reCaptcha) or you have to sign up with a phone number, that’s the worst garbage!
If the webpage doesn’t work without JavaScript, that’s the worst garbage! Well, I partially agree with the last one, and they have one nice criterion that I fully agree with:
If you can’t use email clients with IMAP/SMTP protocols, that’s too bad!

You might ask: what’s wrong with the listed criteria if the author just wants maximum privacy?

Apparently, they have mistaken two concepts, and I don’t know if they did that deliberately, since they seem to be “technical” enough to distinguish these terms by definition: privacy and anonymity.

Privacy is the ability of an individual or group to seclude themselves or information about themselves, and thereby express themselves selectively. Anonymity describes situations where the acting person’s identity is unknown.

VPN and Tor, they are the favorite anonymizers, when it comes to signing up with an email provider. Captchas and phone number verification help them to stop malicious automated requests. I’m not trying to speak in favor of any email hosting providers, but that’s the truth, especially for those who introduces a freemium pricing model. Proton and Tuta have become extraordinarily prevailing in recent years because they have a free tier. Of course marketing counts, but offering something for free itself would speak louder than any marketing approach. And this reflects on the user count. Proton claims to have 100 million users currently, Tuta has reached 10 million users in 2023 when Fastmail with 30 years of history only had less then a half million. Tuta has deprecated their 12 EUR/year paid plan because it’s not sustainable. While Posteo manages to remain a minimum price of 12 EUR/year plan for over 15 years, Proton and Tuta’s paid customers always donate a part of money to the charity of those greed free customers. To make sure that such charity actually makes sense (in order these potential paid customers into real ones that would provide profit) instead of going to nowhere, they have to establish a rule preventing multiple free accounts, to adopt an approach to discriminate human from bots, as well as using identifiers to prevent making multiple free accounts. The only way is forbid anonymity, because the usage of Tor prevents monitoring free account count from a single user, and while the user’s ultimate goal is to emerge from nowhere and disappear in nowhere (plus, you can’t suspend my account if I disappear, that’s too bad!), the conflict of covering expense and providing absolute free service as in beer and freedom would be harsh. I don’t know why the author just pretend he doesn’t know that, as the free services that he speak highly of, like Disroot and RiseUp, live on users’ donation and the community is small enough for a freemium pricing model. If RiseUp is no longer invite-only, or Disroot disables manual registration approval, or they start to market themselves as private email providers who wants to make profit from that, they will eventually become Proton or Tuta. Anonymous Tor users would flood in, server’s won’t be capable, and malicious traffic, automated spam would harm mail server’s reputation.

Enough for anonymity, let’s get down to privacy. Thanks to this digdeeper guy, I have never read so many companies’ privacy policy with comments all at once. Still, the digdeeper guy admits that a company can just hide their invasive activities from the terms and pretend it haven’t happened or will not happen in the future, and sometimes they have to state in the terms that they must obey the law to cooperate with governments because it will be unlawful otherwise! So what’s the point of picking the words and amusing yourself with your “masturbatory” opinions (I return the word to the author)? Most of the email services, as I could see in the article, has not been test by them at all, for stupid reasons like JavaScript, Captcha, pricing, banning Tor or Privacy Policy doesn’t look like something a drug dealer might fancy. The real privacy implementation is zero-knowledge encryption to mail servers, and you can do that with OpenPGP. I know, someone would yell at this: but if you use Gmail, Google would log your IP address and other data like client type, time zone and blah blah… Well, this is NOT IN THE REALM of email privacy! These kinds of evil that Google does to you doesn’t have anything to do with email itself. Unless the provider explicitly prohibits usage of third party client or put a restriction on the client type, I don’t think this should be considered any further.

Some people also mistake security with privacy. A thread on Privacy Guides forum shows how average user tries to care about everything before they know what it really means. Posteo is not recommended among email providers in PrivacyGuides.org for their DMARC policy being set to “none”, instead of “reject” or “quarantine”. I do appreciate the standard, but rookies would say: “your DMARC policy is none, that’s too bad! Anyone can just spoof you!”

Well, yes, this is a security issue, and security by definition means you believe the entity is indeed who they claim to be. example.org’s DMARC policy indicates the mailserver’s recommended action if someone who claims to send an email from user@example.org . “None” means just let it reach wherever, “quarantine” means drop it to junk folder and “reject” means reject.

Because email lacks a method to check if you are authorized to send email from user@example.org, you can send email from any server that have its port 25 open claiming yourself to be user@example.org. But if example.org does not list your IP address in their SPF record, or your DKIM signature is invalid, then the receiver would probably refer to example.org’s DMARC record for further actions. So, DMARC records is domain wide, and should only be decided by the domain owner. If they think “well it’s fine to just let people spoof me, since the reply will arrive at my mailbox anyway”, they set it to “none”. It’s very interesting that Gmail.com has DMARC policy set to “none” and Outlook.com has DMARC policy set to “none” with subdomain policy set to “quarantine”. They don’t really care about anyone on that domain to be spoofed, right? (I’m just pointing out a fact, I will never suggest anyone who use a domain for their personal email to set DMARC policy to “none”, that’s not secure. Meanwhile many other email providers like Proton, Tuta, Zoho and iCloud has policy “quarantine” or “reject”.)

Here comes the problem: you tell receiver to drop SPF or DKIM invalid incoming mails, by setting up “reject” policy, but… is your wish their command? You would be surprised that many private email providers themselves do not respect DMARC policy, despite they themselves have a strict one. That’s because they are so afraid of missing important incoming mails that have been carelessly improperly authenticated, that they would unlikely to do what they’ve been told, and the maximum respect they could give to “reject” DMARC policy is quarantine, that is to say, put it in Junk folder so that it won’t just go to nowhere. Any some of them doesn’t even rely on DMARC policy at all, they calculate DKIM signature and put all the failures into junk folder regardless of a “none” policy. But there are some respectful ones that really listen to instructions: Gmail (yeah…), Purelymail (you decide where to respect DMARC or not, they have a toggle in their web panel), MXRoute. These provider’s aren’t for privacy seekers that much, but they do take security protocols seriously.

Ask yourself what do you really want from email before seeking private email providers, and don’t confuse one thing with another. Otherwise, you won’t be able to protect yourself from threats.

Use Your Custom Domain or Not for Email

Mon, 14 Jul 2025 08:57:15 +0800

The short answer is yes, the long answer is not always.

The benefits of using your own custom domain, and the drawbacks of not using it, are listed below:

Email providers would shut down, and all you have to do is changing MX records.
You don’t always need to pay for extra addresses. A simple catch-all would solve the problem, and you can reduce spam by setting up rules with each recipient address.
More solutions available. Some email hosting providers are exclusive for custom domain users, and you can engage with different providers with your inbound and outbound, get the best solution of each. For example, I self host my inbound email with mail-in-a-box and have full control over the spam filter, but I’m concerned with IP reputation and deliverablity, so for the SMTP service I simply choose Amazon SES at a low price.

The points above sound pretty valid, but people have raised some concerns:

You have to own an email address to register for a domain anyway. It’s a bad idea to make example.org ’s contact admin@example.org , and you know why. Zoho, Proton, Tuta, whatever, better to be a free address. Why free address? Well, do you happen to pay the bill for email and domain with Paypal and your Paypal needs an email address? If it’s associated to the address you pay for and you happen to run out of credit, you might be locked out. If you pay with credit card / debit card / cash / crypto, the risk would be smaller.
- Argument: just use the free email address for registering the domain, and use your custom domain email for everything else.
Domain registrars might as well not be nice to you, such as closing your account without notification, the odds not being significant.
The biggest problem is domain registry, they can raise prices whenever they would like to, and you have no choice but pay.
- Argument: Do you want a fancy domain name or just a reliable one? If your answer is the latter, then the solution to this problem is straightforward: get a tld among .com , .net and .org . Unless you are a citizen of the country, don’t get any ccTLDs. ccTLDs are more likely to be associated with bunch of regulations that you might not notice before violation and have restrictions with KYC.
You might not be able to afford the domain and email hosting price someday in your life anymore. While cheap solutions like Purelymail and Migadu exist (and MXRoute, but only when their black Friday sales are in stock), most “serious and reliable” providers (I’m referring to Google Workspace, Microsoft 365, iCloud, Proton and Fastmail, based on their reverse MX lookup domain count) would cost quite a lot if you need more than one inbox.
Not good for anonymity, you always hand out personal information when dealing with registry and registrar. Anonymous registrars like 1984.is and njal.la does not allow you claim the ownership for the domain.
- Argument: use disposable addresses on public domains when you need anonymity or pseudononymity, and use a custom domain when you don’t.
While your new MX records are propagating, you may miss several emails.

Encryption in Email Practice

Wed, 09 Jul 2025 22:06:00 +0800

Modern demands on email privacy are exceeding its original design and are still growing even more enormous. This is morbid.

Let’s take a look at some certain use case: Alice created a banking/finance account (something similar to Revolut/Paypal), and her login credential are listed below:

TEXT

username: alice@example.org
password: You1-Should9-Use0-A7-Password4-Manager2!

Alice was careless, she didn’t follow the best practice of backup and lost her KeePass database (or her Vaultwarden database, or she forgot master password, or the paper that she wrote passwords on). Unfortunately, this is the only copy of the above username/password combination, there’s no way to retrieve.

Nevertheless, Alice can reset her password by providing OTP sent to email address alice@example.org . That’s wonderful, isn’t it?

Well, that’s not a good idea, because OTP is transmitted in clear text email. There’s no insurance that only the sender and Alice could read the content. If Bob wants to access Alice’s bank account, which he is not permitted to, all he has to do is getting the email content and entering OTP before it expires (let’s say 30 minutes).

Email and SMS have never been built with such consideration. It’s generally a bad idea to use email or SMS as some kind of account recovery method or 2-step verification method.

Instead of coming up with something else, people start fixing email with the problem of storing and transmitting sensitive data in clear text. The transmission part is 90% done, as long as you force SSL/TLS instead of STARTTLS every handshake with mail server. But storing is a bit tricky.

Technically, if Alice doesn’t want to do anything, and her email provider, as well as the bank’s email provider, use SSL/TLS and encrypt the data at rest (the key is selected by the provider, we assume, since Alice doesn’t do anything), then Bob won’t be able to decrypt email from network traffic (that’s how TLS works) or hacking the provider’s machine.

Under some circumstances, this is more than enough. However, four entities still holds the ability to read the email. Ideally, only Alice and the bank should be able to read the email, but as both their email providers hold the encryption key, they could read them if they want to. In most cases, we could safely assume that Alice’s OTP doesn’t interest the provider. But they might still be interested in Alice’s financial situation, like which bank she is dealing with, how much money she spends each month for what purpose, and in which country she is. This is a big no for privacy advocates and pursuits.

With such concerns, PGP emerges, and evolves. Nowadays, the most widely accepted email end-to-end encryption standard is OpenPGP. The downsides would be quite clear:

Unless the sender is willing to do encryption, you can’t guarantee e2ee for the incoming email. That is to say, if Alice want to keep her banking emails private with OpenPGP, she has to reach out to the bank, provide them her public key and says “Please use encryption every time you send a report to email address alice@example.org “, and get refused.
Sender and receiver address remain in cleartext. I’m not sure if that would count as a downside, since you can’t send/receive any type of messages without an identifier. (But I’m still listing, since UUID or random numbers are less likely to be associated with a real identity of Alice than alice@example.org.)
Subject remains in cleartext. You use encryption, good. But “Subject: Your OTP is 123456” would just disclose everything (as far as I am concerned, WhatsApp does this).

To handle with the above problems,

Some email providers, for example, Tuta, ditched OpenPGP and refuses to be compatible with universal email protocols such as IMAP. The advantage is evident, they can encrypt subject now, but the cost is high - you have to use their email client (although it’s open source on each platform, free to use and does not contain trackers), which makes it a lock-in. The worst part is without OpenPGP, you can only do symmetric encryption if your correspondent isn’t on Tuta.
Milder workarounds would be SimpleLogin and Addy.io’s “Generic Subject” function when encrypting incoming emails, but you can’t pretend the clear text subject is non-existent on your correspondent’s mail server.
mailbox.org as well as Proton provides inbox encryption, this is technically the same as the second one, when you receive an email, the provider uses your public key to encrypt immediately (it’s kind of worth noticing that while SL, addy and mailbox doesn’t require your private key to do this, Proton would generate and manage the key pair for you, and there doesn’t really seem to be an option to encrypt incoming emails with only your public key uploaded. My experience on Proton is limited and if this got fixed in the future please kindly inform me), but this isn’t end-to-end encryption, and it would only be useful if you trust every entity that could access your email except your email provider (ironically, this is the real threat model for many people).
open.email looks forward to an email network over https, but can it really be called email if you can’t communicate with traditional protocol accounts?

Encryption enjoyers are very rare among all the email users, but those who rely on email for critical or sensitive information are the majority. Modern expectations for email include being an authenticator, a secret manager, a platform to issue invoice and pay for them, and so on. To satisfy all the exceedingly serious demands, more and more patches have been introduced, but non of them can be as convincing as email itself to forge an evolution. What would be waiting for us in the future of email?