ariedro's page

I've got mail

2025-02-02T00:00:00+00:00

Recently I've started to notice that I'm getting my mail notifications late, I used to get the inbox directly with the atom.xml</code> that Gmail provides and be notified by checking my RSS feed, the problem is that this only gets updated every 20 minutes or so.</p>

The obvious solution would be to have a mail app that is constantly updating the inbox and getting notified that way, but this is costly for my phone, which is kind of old and not in the best debloated shape.</p>

So for this I wanted to make something like I've already done previously</a>, which is a way to relay this to a server process and be notified via Telegram.</p>

IMAP</h2> Internet Message Access Protocol is one of the two standard protocols for retrieving mails from a remote mail server. Being the most used one I chose it over POP3, but this could have been done with POP3 as well.</p> It works like normal application layers old internet protocols such as SMTP, in the way that the session is managed via plain text querying commands and retrieving the results.</p> Programming the solution</h2> For my purposes, I only wanted to get the latest unread mails, so the only query that I need to do is to fetch the mails on the inbox. However, being that this is a little more complicated than SMTP, this time I will be using an external library, so no hardcoding commands this time.</p> I used NodeJs for this and used the node-imap</a> library. The code for this is kind of ugly as it's event-based so it doesn't follow a sequential flow.</p> Basically what I did was:</p> Establish a connection</li> Open the inbox</li> Fetch the messages, filtering only the headers fields SUBJECT</code> and FROM</code></li> For each message do some parsing, both of its headers as well as its metadata</li> If the message doesn't have a \\Seen</code> flag and hasn't already been cached, send it to Telegram</li> Save the message to the cache</li> Exit</li> </ol> You can check out the full code here</a>.</p> Seeing it in action</h2> On Telegram I've created yet another bot for this specific purpose, that way I can customize its notification sound to be the iconical "You've got mail" voice alert each time I get a new mail.</p> </audio> The iconical voice alert</figcaption> </figure> And here's a censored screenshot of it in action:</p> </figure> Now I can get notified for my mails right away, without having bloat running on my phone!</p>



Hacking my health insurance security token generation
2024-09-01T00:00:00+00:00
Following up with my quest to clean my phone from apps that I was forced to
install by living in a civilization that doesn't care about bloated software.
This time it was the turn of my health insurance app.</p>
I have OSDE. On there, in order to have a medical appointment, purchase
discounted medications and other related actions, you MUST have installed the
OSDE app, not only for presenting the card credential number, but for it to
give you a "token" that generates every 5 minutes.</p>
You show this token to the person who is taking your medical appointment or
purchase, thus validating that you are authorized to do it.</p>

  
    
    
      OSDE App with generated token, in this case is 602 and it will be valid for 2 minutes</figcaption>
    
  </figure>

I don't think this seem like a particularly bad way to validate your authority
to use the service, but I'd rather not have an app installed for something
that could be a card. And I knew this could be circunvented because it works
offline.</p>
So here we go with the hack.</p>
OTP</h2>
Asking to a friend about this, I realized that this app implements a
cryptographic
One-Time Password (OTP)</a>
just like Google Authenticator.</p>
In short this takes a static identity seed, the current timestamp (mod by
5 minutes), and hashes it, producing a number that should guarantee the user's
identity in that moment.</p>
Knowing this, and having my phone rooted, I could grep the app's storage and
find the needed seed.</p>
After a few attempts I found what I was looking for:</p>
$</span> strings /data/data/ar.com.osde.ads/databases/credencialDigitalSqlite | </span>grep</span> OTP
</span>credenciales</span>"</span>[ ... ,</span>\"</span>semilla</span>\"</span>:</span>\"</span>( This is it )</span>\"</span> ... ]</span>"</span>/
</span></code></pre>
Matching the token</h2>
Having the seed, all I had to do was replicate the same encodings and options
that the app uses.</p>
After a few failed attempts with publicly available OTP libraries, I realized
that it would be easier to decompile the app and take a look at how the app is
actually hashing the seed.</p>
As with the trains app hack</a>, I used the jadx program
and took a peek inside.</p>
Quickly I found it:</p>
otplib_otplib_browser__WEBPACK_IMPORTED_MODULE_4__</span>["</span>totp</span>"].options = {
</span>    digits: </span>3</span>,
</span>    step: </span>300</span>,
</span>    algorithm: '</span>sha256</span>',
</span>    </span>createHmacSecret</span>: </span>function </span>(</span>secret</span>, </span>params</span>) {
</span>        </span>return </span>secret</span>;
</span>    }
</span></code></pre>
With this I've got both the encodings and the js library used (otplib</a>).</p>
And finally I was able to reproduce the same token generation as the app:</p>
const </span>{ </span>totp </span>} = </span>require</span>('</span>otplib</span>');
</span>
</span>const </span>seed </span>= "</span>...</span>";
</span>
</span>totp</span>.options = {
</span>    digits: </span>3</span>,
</span>    step: </span>300</span>,
</span>    algorithm: "</span>sha256</span>",
</span>    </span>createHmacSecret</span>: </span>function </span>(</span>secret</span>, </span>params</span>) {
</span>        </span>return </span>secret</span>;
</span>    }
</span>};
</span>
</span>console</span>.</span>log</span>(</span>totp</span>.</span>generate</span>(</span>seed</span>));
</span></code></pre>
$</span> node index.js
</span>602
</span></code></pre>
Minimizing the code</h2>
From previous work experience, I have had major problems relying on external
cryptographic libraries. So this time I would like to not depend on otplib and
have it to manually generate the token by myself.</p>
By scrapping the otplib code and minimizing it to only do the generation for
this type of token, I ended up with a compact version of it:</p>
const </span>{ </span>createHmac </span>} = </span>require</span>("</span>crypto</span>");
</span>
</span>const </span>seed </span>= "</span>...</span>";
</span>
</span>const </span>generateToken </span>= (</span>secret</span>) </span>=> </span>{
</span>  </span>const </span>counter </span>= Math.</span>floor</span>(new Date().</span>getTime</span>() / </span>300000</span>)
</span>    .</span>toString</span>(</span>16</span>)
</span>    .</span>padStart</span>(</span>16</span>, "</span>0</span>");
</span>  </span>const </span>digest </span>= </span>createHmac</span>("</span>sha256</span>", </span>secret</span>)
</span>    .</span>update</span>(</span>Buffer</span>.</span>from</span>(</span>counter</span>, "</span>hex</span>"))
</span>    .</span>digest</span>();
</span>  </span>const </span>offset </span>= </span>digest</span>[</span>digest</span>.length - </span>1</span>] & </span>0xf</span>;
</span>  </span>const </span>binary </span>=
</span>    ((</span>digest</span>[</span>offset</span>] & </span>0x7f</span>) << </span>24</span>) |
</span>    ((</span>digest</span>[</span>offset </span>+ </span>1</span>] & </span>0xff</span>) << </span>16</span>) |
</span>    ((</span>digest</span>[</span>offset </span>+ </span>2</span>] & </span>0xff</span>) << </span>8</span>) |
</span>    (</span>digest</span>[</span>offset </span>+ </span>3</span>] & </span>0xff</span>);
</span>  </span>const </span>tokenNumber </span>= </span>binary </span>% Math.</span>pow</span>(</span>10</span>, </span>3</span>);
</span>  </span>return </span>tokenNumber</span>.</span>toString</span>().</span>padStart</span>(</span>3</span>, "</span>0</span>");
</span>};
</span>
</span>console</span>.</span>log</span>(</span>generateToken</span>(</span>seed</span>));
</span></code></pre>
OSDE-CLI</h2>
For the final touch I ended up adding a few optional parameters and printing
extra information. This way anyone could use this "terminal version of the OSDE
app", without the need to use the official one.</p>

  
    
    
      Running it on Termux, much faster than the OSDE app</figcaption>
    
  </figure>

I published it on a github repository</a>,
so anyone can use it freely.</p>
I hope you liked this blogpost, until next time.</p>


Self-hosting my alarm clock radio
2023-12-30T00:00:00+00:00
I don’t like waking up, before going to sleep I tend to schdule many alarms and the next morning I turn off each one of them.</p>
When I was younger I remember having an old radio alarm that would turn on at a scheduled time, I used it as an wake up alarm and I remember being effective.</p>
Maybe because hearing people talking would be less numbing that hearing the same song every day, and it would motivate me more to not turn off the alarm, maybe, I don’t know.</p>
But I wanted to try this.</p>
Radio</h2>
The trivial solution would be to just buy a radio with an alarm, but I discarded this from the start because</p>

I don't like the radio static, and even less when I can listen to a live broadcast on the internet very clearly.</li>
I didn’t want to spend money</li>
</ol>
Mobile</h2>
My first attempt was downloading an app that would do this. As I’m already waking up with my cellphone I might as well continue using it.</p>
I tried the RadioDroid</a> app, it seems like it has the features I want, it connects to a radio URL and can be used as an alarm clock. But upon using a few nights I’ve noted that the alarm doesn’t always go off. I guess it might be because it’s trying to attempt an active connection and Android goes into idle mode after a while?</p>
Besides I like to turn Wi-Fi off at night, and I realise that it lacks some other nice-to-haves, like adjusting the volume incrementally.</p>
I tried others apps but this was the more promising, I don't want payware, and I surely didn’t feel like programming in Android, so it seemed like I would need another option.</p>
Raspberry Pi</h2>
I have a couple of raspberry pis through the house, one of them I use it as a server for various services that are running all day long. So I thought about using it for this purpose as well.</p>
I moved the raspi to the bedroom and connected to it some old PC speakers I had.</p>

  
    
    
      Ignore the poor state of the raspberry</figcaption>
    
  </figure>

Having the interface of a whole computer now I had much more control, as I can program it however I want. All I had to do is play audio through the speakers at a certain time.</p>
The player</h3>
The core of the schedule is to just to reproduce audio through the raspberry’s speakers, so I needed an audio player for it.</p>
My priorities were that I needed a program that would be lightweight, CLI so I could run it directly on the terminal, and that could also play radio files.</p>
I wasn’t going to install anything fancy like VLC or MPV just to play an audio file. So after searching around I found mpg123</a>, which fullfilled my needs perfectly, it is extremely lightweight, is CLI, doesn’t have an interface and reproduces radio files directly from the URL.</p>
The radio</h3>
As I said on the beginning, I wanted to hear people talking, so I searched for an AM radio. The most popular here regardless of political spectrum is Radio Mitre, which I don't find it entirely despicable, so it works for me.</p>
I scrapped it’s web and found a link for a MP3 file that could be reproduced directly</p>
http://27323.live.streamtheworld.com/AM790_56.mp3</code></p>
And after executing the following on the raspberry pi.</p>
$ mpg123 http://27323.live.streamtheworld.com/AM790_56.mp3
</span>High Performance MPEG 1.0/2.0/2.5 Audio Player for Layers 1, 2 and 3
</span>	version 1.26.4; written and copyright by Michael Hipp and others
</span>	free software (LGPL) without any warranty but with best wishes
</span>
</span>Directory: http://27323.live.streamtheworld.com/
</span>
</span>Terminal control enabled, press 'h' for listing of keys and functions.
</span>
</span>Playing MPEG stream 1 of 1: AM790_56.mp3 ...
</span>ICY-NAME:
</span>ICY-URL: https://radiomitre.com.ar/
</span>
</span>MPEG 1.0 L III cbr96 44100 j-s
</span>
</span>ICY-META: StreamTitle='SEP WHATSAPP MITRE -SMD';
</span></code></pre>
It’s working! The live radio is coming out from the speakers.</p>
Off button</h3>
Now that it works, I need a way to turn it off when I’m already awake.</p>
As I was thinking about how I could attach a physical button to the raspi and having to attach wires and other electronical things and such. I thought to myself</p>
”Wait, I’m a Node.js developer, I don’t need buttons, I can host a bloated express server just to listen for an action, and then send a HTTP request from my phone to trigger it.”</em></p>
So I had all the elements to start programming.</p>
Programming</h2>
I started with the core functionality, spawning the radio process.</p>
const </span>{ </span>spawn </span>} = </span>require</span>('</span>node:child_process</span>');
</span>
</span>const </span>play </span>= </span>spawn</span>('</span>mpg123</span>', ['</span>http://27323.live.streamtheworld.com/AM790_56.mp3</span>']);
</span></code></pre>
And then handling the process killing on an express endpoint.</p>
const </span>express </span>= </span>require</span>('</span>express</span>');
</span>
</span>const </span>app </span>= </span>express</span>();
</span>
</span>app
</span>  .</span>get</span>('</span>/apagar</span>', (</span>_req</span>, </span>res</span>) </span>=> </span>{
</span>    </span>try </span>{
</span>      </span>play</span>.</span>kill</span>(</span>9</span>);
</span>      </span>res</span>.</span>send</span>('</span>Apagado</span>\n</span>');
</span>      process.</span>exit</span>(</span>0</span>);
</span>    } </span>catch </span>(</span>error</span>) {
</span>      </span>res</span>.</span>status</span>(</span>500</span>).</span>send</span>(</span>error</span>);
</span>      process.</span>exit</span>(</span>1</span>);
</span>    }
</span>  })
</span>  .</span>listen</span>(</span>3000</span>);
</span></code></pre>
On my phone, I created a termux shortcut script that does the HTTP request.</p>
curl </span>$</span>RASPBERRY_IP</span>:3000/apagar
</span></code></pre>
From this I can turn the alarm off with a single tap on my phone.</p>
And the core functionality is done!</p>
Cron job</h4>
All I had to do now is set the alarm in motion each morning, which I simply added a cron job to execute it at a determined time. In this case at 08:30.</p>
30 8 * * * cd radespertador && npm run start
</span></code></pre>
Increasing volume and parametrizing</h3>
One last feature I’d like to have is to the volume being increasing slowly, I don’t want to get startled all of the sudden of my sleep.</p>
I had to spawn another child process with a call to control the volume, and in intervals call the controller with smaller increments of the percentage for the volume.</p>
const </span>setVolume </span>= </span>volume </span>=> </span>spawn</span>('</span>amixer</span>', ['</span>sset</span>', "</span>'Headphone'</span>", `</span>${</span>volume</span>}%</span>`]);
</span>
</span>setVolume</span>(</span>0</span>);
</span>let </span>currentVolume </span>= </span>0</span>;
</span>setInterval</span>(() </span>=> </span>{
</span>  </span>setVolume</span>(</span>currentVolume </span>> </span>99 </span>? </span>currentVolume </span>: ++</span>currentVolume</span>);
</span>}, </span>2000</span>);
</span></code></pre>
And of course it would be a bad practice to leave all of this with literals and magic numbers, so I had everything parameterized, and the values can be tweaked on the config file.</p>
You can see the final code here</a>.</p>
Final result</h4>
Here’s a recording of how it works, for demostration purpose the increment for the volume is way more frequent than it is in reality</p>

  

    
      
    </video>
   
      Wait for it</figcaption>
    
  </figure>

Conclusion</h2>
Did it work? Kind of, I still struggle to wake up. But at least now I can listen to boomers say random things on the morning before turning off the alarm, and I can say that I build that.</p>


Hacking my local trains schedules API
2022-11-21T00:00:00+00:00
Here in Buenos Aires we rely mainly on 3 modes of public transportation:
buses, subways and trains. Buses are often the primary choice because they're
everywhere, but in terms of efficiency and speed subways and trains are
by far the best choice, if you can take advantage of the proximity of
a railroad branch line.</p>
Say you want to take a train somewhere, and you want to make sure
you are on time, you can download the android app "
Trenes Argentinos</a>
" from the Google Play store, developed by the private company SOFSE,
and check the time schedules there.</p>
Upon installing it you'll see right away that the app starts requiring
permissions, permissions that a simple app for checking the trains schedule
shouldn't require, like GPS location and file storage access.</p>
If you deny these requests it would still prompt you every time you select a station.</p>

  

    
    
      Shady dialogs in the app, the right one appears everytime you select
a station</figcaption>
    
  </figure>

If you're like most people you probably wouldn't care much about these things
because the app in the end actually fulfills its purpose.</p>
You don't mind having your privacy being invaded any more than it already is
every day, or having to navigate to a horrible UX by closing a dozen
of pop-ups like it's the early internet days.</del></p>
Thankfully I'm not, so I began searching for the API behind it so
I could just write a bash script and curl</code> it away.</p>
Research</h2>
Being a public transportation service, I expected the API to also be public.</p>
For example, in the internal jurisdiction of the city of Buenos Aires they implemented an
unified public transport API specification</a>
that provides information on buses, subways and even the status of the city's
traffic lights.</p>
However, this does not seem to be the case for trains, after googling
a little bit I didn't find anything, and everything pointed to this
being a private service. Even in violation of the
national law 27,275</a>
that guarantees the right of access to public information.</p>
This leaves me with only one option.</p>
Hacking the App</h2>
I downloaded the app's raw apk to my pc with a generic apk downloader,
and after researching a little bit about how to decompile an android app file,
I ended up using a program called jadx</code>.</p>
>: jadx com.mininterior.trenesenvivo.apk
</span>INFO  - loading ...
</span>INFO  - processing ...
</span>ERROR - finished with errors, count: 8
</span></code></pre>
I didn't care much about those errors because I wasn't going to recompile
the app anyway, I just wanted to look for the internal service it used.</p>
So I started browsing the decompiled codebase and found the URL right away.</p>
<</span>string </span>name</span>="</span>trenesApiUrl</span>">https://apiarribos.sofse.gob.ar/</</span>string</span>>
</span></code></pre>
And the endpoint's paths and params.</p>
@</span>GET</span>("</span>v1/estaciones/buscar</span>")
</span>Call</span><</span>PaginationContainer</span><</span>Estacion</span>>> </span>buscarEstaciones</span>(@</span>Query</span>("</span>nombre</span>") </span>String</span> str, @</span>Query</span>("</span>lineas</span>") </span>RetrofitArray</span><</span>Integer</span>> retrofitArray, @</span>Query</span>("</span>ramales</span>") </span>RetrofitArray</span><</span>Integer</span>> retrofitArray2, @</span>Query</span>("</span>exclude</span>") </span>RetrofitArray</span><</span>Integer</span>> retrofitArray3, @</span>Query</span>("</span>limit</span>") </span>Integer</span> num, @</span>Query</span>("</span>orderBy</span>") </span>String</span> str2);
</span>
</span>@</span>GET</span>("</span>v1/alertas</span>")
</span>Call</span><</span>List</span><</span>AlertaResponse</span>>> </span>getAlertas</span>();
</span>
</span>...
</span></code></pre>
Before I started testing, and thinking I had everything I needed,
to my suprise I also found a little file called TokenAuthenticator.java</code>.</p>
Thinking to myself: "Well, they probably added an authentication token
that is freely obtainable with an endpoint, in order to avoid getting
spammed".</p>
But after browsing the file a little bit:</p>
String</span> userApi = </span>getUserApi</span>();
</span>String</span> codificar = </span>encode</span>(userApi);
</span>...
</span>tokenRequest.</span>setUsername</span>(userApi);
</span>tokenRequest.</span>setPassword</span>(codificar);
</span></code></pre>
Why would there be a user and a password, if the app
doesn't require a login or anything like that?</p>
And then I found it:</p>
public static </span>String </span>getUserApi</span>() {
</span>  </span>Date</span> date = </span>new </span>Date</span>();
</span>  </span>return </span>Base64</span>.</span>encodeToString</span>(
</span>    (</span>new </span>SimpleDateFormat</span>("</span>yyyyMMdd</span>").</span>format</span>(date) + "</span>sofse</span>").</span>getBytes</span>(),
</span>    </span>2
</span>  );
</span>}
</span>
</span>public static </span>String </span>encode</span>(</span>String</span> str) {
</span>    </span>String</span> stringBuffer = </span>new </span>StringBuffer</span>(
</span>    </span>Base64</span>.</span>encodeToString</span>(
</span>      </span>new </span>StringBuffer</span>(
</span>        </span>Base64</span>.</span>encodeToString</span>(str.</span>getBytes</span>(), </span>2</span>)
</span>          .</span>replace</span>("</span>a</span>", "</span>#t</span>")
</span>          .</span>replace</span>("</span>e</span>", "</span>#x</span>")
</span>          .</span>replace</span>("</span>i</span>", "</span>#f</span>")
</span>          .</span>replace</span>("</span>o</span>", "</span>#l</span>")
</span>          .</span>replace</span>("</span>u</span>", "</span>#7</span>")
</span>          .</span>replace</span>("</span>=</span>", "</span>#g</span>")
</span>      )
</span>        .</span>reverse</span>()
</span>        .</span>toString</span>()
</span>        .</span>getBytes</span>(),
</span>      </span>2
</span>    )
</span>      .</span>replace</span>("</span>a</span>", "</span>#j</span>")
</span>      .</span>replace</span>("</span>e</span>", "</span>#p</span>")
</span>      .</span>replace</span>("</span>i</span>", "</span>#w</span>")
</span>      .</span>replace</span>("</span>o</span>", "</span>#8</span>")
</span>      .</span>replace</span>("</span>u</span>", "</span>#0</span>")
</span>      .</span>replace</span>("</span>=</span>", "</span>#v</span>")
</span>  )
</span>    .</span>reverse</span>()
</span>    .</span>toString</span>();
</span>}
</span></code></pre>
Up until this point I thought that maybe they didn't publish their API because
they were lazy, or because they did not see the need to do so.</p>
But no, not only did they fill their app with shady storage and GPS accesses,
not only did they not publish their API specification evading a national law,
but they also obscured the access to it with some encoding, being 100% assholes.</p>
I felt that I had a moral obligation to not only circumvent this, but also
to publish it so anyone can use it freely.</p>
Remaking it</h2>
I wanted to make a public proxy that would bypass all of this, so I made a simple
nodejs program using express</code></p>
The core of the program would just be something like:</p>
const </span>app </span>= </span>express</span>();
</span>app</span>.</span>get</span>('</span>*</span>', </span>redirection</span>)
</span>app</span>.</span>listen</span>(</span>PORT</span>);
</span></code></pre>
And in the redirection</code> middleware it would be located the generation
and maintenance of such obscured tokens, of which they should be made in the
same way as in the app.</p>
After a bit of trial and error, after having to root my phone in order to
be able to sniff HTTP requests, because I couldn't get to replicate the same
exact encoding, I finally did it, I was able to bypass the token generation
and make direct use of the API.</p>
You can find the full source code here</a>.</p>
Publication and usage</h2>
I set up a public instance of this proxy service on the same server where
this blog is hosted, by the path /api-trenes</code>.</p>
With this service anyone can make request to it, and it would take care
of the internal authentication, without the user having to worry about it.</p>
For example you can get the lines information:</p>
curl </span>'</span>https://ariedro.dev/api-trenes/lineas</span>'
</span></code></pre>
Or the schedules to go from "Drago" to "Miguelete"
(Previously you would need to find the corresponding ids for such stations):</p>
curl </span>'</span>https://ariedro.dev/api-trenes/estaciones/236/horarios?hasta=271</span>'
</span></code></pre>
You can find more info and the full endpoints specification
in the repository</a>.</p>
Having all this live, I can finally make scripts on for example Termux
and be able to get the schedules information instantly, without having to
go through all the spyware in the app.</p>
Further things</h2>
I wanted to give a big shout-out to Tincho Mika</a> for using this to make
a fully featured web application to view all the information that this API
provides in a properly formatted way. Be sure to check out Trencitos</a>.</p>
I hope you liked this blogpost, and I look forward to keep posting other
interesting stuff like this more often.</p>


I'm using Zola
2022-10-08T00:00:00+00:00
Hi! I'm now using Zola</a>.</p>
I've decided that I don't have the time or inclination to deal with CSS and
responsiveness hell that requires me to learn in order to maintain a plain
HTML page.</p>
So now, thanks to Enzo</a>, I'm now using
this framework that only requires me to write markdown files and it
does the rest for me.</p>
Stay tuned for the updates with the new
RSS feed</a>.</p>


How I tricked my camera into believing it was sending mails
2022-03-04T00:00:00+00:00
The problem</h2>
I've got a security camera, it's kind of old and limited in the amount of
features it has. I recently installed it on my front yard, and I wanted a
motion detection alert. This camera actually supports that feature, but it
has one problem:</p>
The alerts can only be sent via mail.</p>

  
    
    
      Camera config page</figcaption>
    
  </figure>

Now, this wouldn't be an issue if I actually paid attention to mails as soon
as they come, but I don't, I relay them to a RSS feed and I do not read it
until I log on to the internet and start browsing the feed.</p>
Possible solutions</h2>
If recieving mails is not the most convenient thing to do, another way to get
notifications that I know i'll be reading them as soon as they come is a
telegram bot, this is easy since the API is pretty simple and it could be
simplified to sending a single HTTP request.</p>
In order to achieve this, the first thing that it occurred to me was mounting
a full SMTP server and somehow hook a curl command in there when it detects
that an email is coming from the camera.</p>
But then I realized it wasn't necessary, since if I could simply emulate a
SMTP server, then I would receive the data directly and handle it as I wish.</p>
Emulating a SMTP server</h2>
So I opened up the RFC 5321</a>
to see what were the standard steps in the communication for receiving an email.
And SMTP lives up to its name since it is extremely simple.</p>
Basically it comes down to this:</p>

Send a greeting message with 220 code identifying ourselves</li>
Get a EHLO</code> command with the client's identity</li>
Reply with 250 OK</code></li>
Get a MAIL</code> command with the mail's sender</li>
Reply with 250 OK</code></li>
Get a RCPT</code> command with the mail's reciever</li>
Reply with 250 OK</code></li>
Get a DATA</code> command</li>
Reply with 354 telling the client to start sending the data</li>
Get the data, ending with a CRLF.CRLF</code></li>
Reply with 250 OK</code></li>
Get a QUIT</code> command</li>
Reply with 221 Bye</code></li>
</ul>
Since all of this is just text, I can test a mail send directly
by typing in netcat:</p>

  

The content of the mails is in MIME, so in the motion detection mails with the
attachments are just text encoded in base64.</p>
Implementation</h2>
I wrote a short nodejs program, you can check the full source code
here</a>. It all comes
down to emulating the same communication described above, parsing the
attachments and send them to a telegram bot or any other service you'd want.</p>

  

    
    
      A screenshot of the telegram bot sending me a photo everytime someone passes on the street, while Tiburcio rests</figcaption>
    
  </figure>

Further things</h2>
I've discovered that the mail sending feature only supports sending photos
when the motion detection happens. So it would be nice to instead have a
full video of the detection.</p>
According to the
camera manual</a>,
this would be possible if instead the file got recorded with a FTP server.
So I think it would be more or less the same procedure I did with this
but with the FTP protocol.</p>
Or I may just end up buying a newer camera.</p>

ariedro's page

I've got mail

Hacking my health insurance security token generation

OSDE-CLI</h2> For the final touch I ended up adding a few optional parameters and printing extra information. This way anyone could use this "terminal version of the OSDE app", without the need to use the official one.</p>

Self-hosting my alarm clock radio

Radio</h2> The trivial solution would be to just buy a radio with an alarm, but I discarded this from the start because</p>

Mobile</h2> My first attempt was downloading an app that would do this. As I’m already waking up with my cellphone I might as well continue using it.</p>

Cron job</h4> All I had to do now is set the alarm in motion each morning, which I simply added a cron job to execute it at a determined time. In this case at 08:30.</p>

Conclusion</h2> Did it work? Kind of, I still struggle to wake up. But at least now I can listen to boomers say random things on the morning before turning off the alarm, and I can say that I build that.</p>

Hacking my local trains schedules API

Remaking it</h2> I wanted to make a public proxy that would bypass all of this, so I made a simple nodejs program using express</code></p> The core of the program would just be something like:</p>

I'm using Zola

How I tricked my camera into believing it was sending mails

Further things</h2> I've discovered that the mail sending feature only supports sending photos when the motion detection happens. So it would be nice to instead have a full video of the detection.</p>

Conclusion</h2>
Did it work? Kind of, I still struggle to wake up. But at least now I can listen to boomers say random things on the morning before turning off the alarm, and I can say that I build that.</p>