Linus的FUN天地 (English)

Why Is the New Blog So Fast? From Stack Choice to Every Byte

Linus Xiong — Wed, 21 Oct 2026 01:00:00 GMT

I rebuilt the blog. The most obvious change is that any page appears almost the moment you open it. That did not come from a more expensive server. It came from removing, at every layer, everything that was not needed, starting with the choice of stack. This article explains the trade-offs: why a static site and why Astro, what the build pipeline looks like, what CSS, JavaScript, fonts, images, page transitions and SEO each do, and the numbers that show the effect.

The result first

Production numbers for a typical post page (mobile Lighthouse with simulated slow network):

Metric	Value
HTML (gzipped)	16–18 KB, styles included
CSS	about 20 KB, inlined in the page, zero extra requests
JavaScript on first paint	about 6 KB (theme switch, search launcher, copy button, link prefetch)
Web fonts	0 bytes
Third-party requests on first paint	0
Lighthouse	Performance 100 · Accessibility 100 · Best Practices 100 · SEO 100
CLS (layout shift)	0

None of this comes from one trick. It is the sum of doing a little less at every layer.

Why a static site, and why Astro

A blog is finished writing handed to readers; the content is fixed the moment I commit it. So there is no reason to render it on a server for every visit, and even less reason to make the reader's browser download an application framework and "hydrate" the article. The first decision was therefore: generate all HTML at build time and let the server, really a CDN, only send files.

While choosing, I built several candidates and measured how much JavaScript each ships on a prerendered post page:

Stack	JS on a post page (gzip)	Notes
Astro 7 (static output)	0 B	zero JS by default; "islands" load on demand when interaction is needed
TanStack Start 1.0 (React)	about 108 KB	still hydrates the whole page after prerendering; no zero-JS mode
TanStack Start (Solid)	about 48 KB	same, with a smaller runtime
Next.js App Router	tens of KB plus the RSC payload	an archived page of a well-known blog weighed 645 KB of HTML, 61% of it inline component data

The TanStack family is excellent for applications, but its Markdown package has only just reached 1.0 and its official example parses Markdown in the browser, the opposite of what a content site wants. In Astro, content collections, image optimisation, Shiki highlighting, sitemap and RSS are first-class, and a page ships not a single byte of JavaScript unless asked. That is exactly what I needed.

I also measured a React component library in the HeroUI style: one button island costs 96 KB, about 70 KB of which is React. In the end I borrowed only its visual language; every button, chip and card is a zero-JS Astro component.

The build pipeline

graph LR
  A[content/posts/*.md] --> B[content collection + Zod validation]
  B --> C[remark plugins<br/>excerpt · reading time]
  C --> D[rehype plugins<br/>heading anchors · code-block chrome · tables · sections]
  D --> E[Shiki highlighting<br/>light + dark]
  E --> F[page HTML<br/>CSS inlined]
  F --> G[dist/ + Pagefind index + OG images + sitemap]

A post is a Markdown file under content/posts/, and its frontmatter is validated with Zod: a malformed date or a slug containing Chinese or spaces fails the build instead of surfacing after deployment. Markdown goes through a remark/rehype pipeline: everything before  becomes the excerpt; reading time counts Chinese at 300 characters per minute and English at 200 words per minute, separately; every heading gets a stable id and an anchor; code blocks are wrapped in a shell with a language label and a copy button; each h2 section becomes a <section> with content-visibility: auto, so a long article only lays out what is visible.

Syntax highlighting happens at build time. Shiki emits both the light and the dark palette as CSS variables on every token, so switching themes only swaps a set of variables and no highlighter ever runs in the browser.

CSS: 20 KB, inlined, no flash

Styles use Tailwind v4 with design tokens (colours, type sizes, radii) in @theme; components reference tokens only. At build time Tailwind emits only the utilities actually used, about 20 KB for the whole site, and inlineStylesheets: 'always' writes them straight into every page: one request fewer, and the first paint waits for no external file.

I set a hard budget: the inlined CSS of a post page must stay under 20 KiB, re-measured after every style change. It nearly broke twice, and both causes are instructive. Tailwind scans source files for anything that looks like a class name, so property names such as transition or grid written inside component styles were emitted as utilities into the global stylesheet; the fix is an exclusion list for those words. The other time, styles needed only on post pages ended up in the global stylesheet, because Astro bundles component styles by the import graph, not by whether a component rendered.

Dark mode is applied by an inline script of under 1 KB in <head> that sets data-theme before the first paint, so there is no light-then-dark flash. The dark background is a near-black #121214 rather than pure black, which is easier on the eyes for long reads, and hierarchy is expressed with lighter surfaces instead of outlines.

JavaScript: on demand, and small

A post page carries four small scripts: the theme switch (1.0 KB), the search launcher (1.4 KB), code copying (0.5 KB) and link prefetching (2.4 KB). Everything heavy is deferred:

Comments (Disqus): the embed script is injected only when the comment area comes within 600 px of the viewport.
Search (Pagefind): the static index is built at build time; the UI and index chunks load when the search box opens.
Diagrams (Mermaid): the library is several megabytes, so it is dynamically imported only on pages that contain a diagram, when the diagram nears the viewport, and it re-renders after a theme switch.

No React, no client-side router, no Markdown parsing in the browser.

Fonts: not a single byte downloaded

Chinese web fonts easily reach several megabytes, and even subset they weigh on the first paint. The site uses the device's own font stack instead: SF Pro and PingFang on Apple platforms, Microsoft YaHei on Windows, Noto Sans CJK on Linux and Android. Icons are inline SVG, not icon fonts.

Images: prepared at build time

Images in a post folder are converted to WebP by sharp at build time, with a srcset at several widths from 640 to 1280 px; sizes matches the 832 px text column, so a phone never downloads the desktop size. Every image carries its intrinsic width and height, so the page never jumps while images load, which is what keeps CLS at zero. The cover is the largest element above the fold (the LCP), so it loads eagerly with fetchpriority="high"; body images use native lazy loading.

Page transitions: like turning a page

Three things stack up:

Links are prefetched on hover (Astro's prefetch, 2.4 KB).
Chromium's Speculation Rules: a block of JSON that lets the browser prerender the next page in the background on hover, with zero JavaScript.
Cross-document View Transitions: pure CSS, @view-transition { navigation: auto }, for a crossfade between pages.

The third one hid a trap. The browser captures the new page at its first rendering opportunity, and Chromium renders before the <body> is fully parsed, so the crossfade landed on a blank page and the content popped in afterwards. The fix is a single tag that makes rendering wait until the end of the page has been parsed:

html

<link rel="expect" href="#page-end" blocking="render">

Pages are only a few dozen kilobytes, so this line costs no first-paint time and buys a complete transition.

SEO and URLs

ASCII URLs only: Chinese titles become pinyin slugs automatically; the old Hexo links (with spaces and Chinese) are kept in the frontmatter aliases. The build writes a redirect page with a canonical link for each old URL, and on Vercel they become real 308 redirects, so search rankings migrate smoothly.
An Open Graph image per post is rendered at build time with satori and resvg (the Chinese font is downloaded as a per-text subset and cached), so shares on social platforms get a picture.
Sitemap with lastmod, full-content RSS, Atom and JSON Feed, and JSON-LD BlogPosting and breadcrumb markup.
Chinese and English: the English version is a .en.md file next to the source, with hreflang and its own feeds. Translations can be written by hand or generated in bulk through DeepL, Google or a language-model API; each one records a hash of the source and is flagged as stale when the source changes.

Hosting

The site is deployed on Vercel, with static files served from the CDN. Hashed assets under /_astro/* are cached for a year and marked immutable; HTML uses must-revalidate; security headers and the trailing-slash policy live in vercel.json. CI runs pnpm build together with type checking and more than five hundred unit tests.

Trade-offs and things left undone

Disqus's iframe prevents bfcache (the browser's back/forward cache). That is the price of third-party comments; loading it only when scrolled into view keeps the impact minimal.
Mermaid is large, so it loads on demand; if diagrams become common, rendering them to SVG at build time would be the next step.
Pagefind has no Chinese stemming; substring search is good enough.
Pinyin slugs read worse than English ones, so there is a command that generates English slugs with a language model and turns the old slugs into aliases.
No runtime UI library at all. Should a HeroUI-style interactive component ever be needed, it will live in an island that loads only after a click.

How it is measured

Every change is followed by a mobile Lighthouse run, plus a script that measures the inlined CSS bytes and the total script size of a post page; exceeding the budget counts as a failure. The tools are simple. The hard part is keeping "do less" as a rule.

The whole codebase is open source. If you want to build your own, a single pnpm build turns the Markdown in content/ into a site like this one.

Binding an IPv6 Address Pool to a New NIC on a BIRD2 Host and Enabling Multi-Source IPv6 Outbound Traffic

Linus Xiong — Wed, 15 Apr 2026 14:00:00 GMT

Preface

The goal this time is very clear:

The machine is already running BIRD2 and is correctly advertising IPv6 prefixes via BGP
Now I want to use a /47 IPv6 prefix as an IPv6 address pool usable locally
At the same time, to keep the structure clearer, I plan to "attach" this address range to a new logical network interface
The final result should be:
- Applications can bind any IPv6 address within this /47
- Traffic still leaves through the real physical network interface
- BIRD is only responsible for advertising and does not interfere with the system default route or address management

Note: In this article, IPv4, IPv6, ASN, BGP neighbors, authentication passwords and other information have all been replaced with documentation example values, to record the configuration approach and avoid exposing real production environment information.

Review of the Existing BIRD2 Configuration

The BIRD2 configuration on the current machine has roughly a few key points:

protocol direct Only tracks dummy* interfaces
protocol kernel Is import none; export none; for both IPv4 and IPv6
In protocol static static_v6, the IPv6 prefixes to be advertised are put into the BIRD RIB via reject
BGP only exports the IPv6 prefixes of RTS_STATIC to the outside

In other words, this design itself already separates responsibilities very clearly:

BIRD is responsible for advertising
The kernel is responsible for real forwarding and local address binding
BIRD will not modify the kernel's default route

This approach is correct and should be kept.

To state the conclusion first: this task should not only involve changing BIRD

When many people first do this kind of configuration, they intuitively think "since it's an advertised prefix, just bind it to the interface in BIRD."

In reality, that's not how it works.

The Role of BIRD

BIRD only needs to do one thing:

Keep announcing the target /47 prefix

The Role of the Linux Kernel

What truly allows this /47 to:

You can run it locally with bind()
Be used as source addresses when initiating connections
Send traffic out through the real physical network interface

is the Linux network stack, not BIRD.

So the final plan is:

Create a new dummy interface, for example dummy47
Assign it an "anchor address" from the pool
Use ip -6 route add local ... to tell the kernel that this entire /47 belongs to the local host
Enable net.ipv6.ip_nonlocal_bind=1 to allow applications to bind addresses that were not explicitly added to an interface

Why Use a Dummy Interface

Rather than directly putting the entire /47 onto the real physical interface, I created a separate logical interface dummy47, for three reasons:

Clearer responsibilities
- dummy47 indicates "this is a locally managed business address pool"
- The physical interface is only responsible for actually sending and receiving packets
Easier troubleshooting
- When looking at the interface configuration, you can tell at a glance what this address pool is specifically for
Compatible with the existing BIRD configuration
- The current protocol direct already matches dummy*
- No major changes are needed after creating dummy47

Note the following:

dummy47 is not the actual outgoing network interface.
Actual packet transmission still goes through the physical interface corresponding to the default route, such as eth0 or ens3.

Reference Approach: local route + ip_nonlocal_bind

The core idea of this configuration is:

Don't enumerate and add large numbers of static addresses
Don't directly addr add the entire prefix as ordinary addresses
Instead, through:

bash

ip -6 route add local 2001:db8:4700::/47 dev lo
sysctl net.ipv6.ip_nonlocal_bind=1

Let the kernel consider:

This entire /47 as "locally receivable" addresses
Processes can directly bind to any address within it

These are the two most critical steps.

Sanitized BIRD2 Configuration Example

Below is a sanitized configuration skeleton, used to illustrate the key parts relevant to this article.

bird

################################################
#                 Variables                     #
################################################

define OWNAS   = 64500;
define OWNIP   = 198.51.100.10;
define OWNIPv6 = 2001:db8:100::10;

define OWNNETSET_V4 = [];

define OWNNETSET_V6 = [
    2001:db8:4700::/47
];

################################################
#                 Global                        #
################################################

router id OWNIP;

protocol device {
    scan time 10;
}

################################################
#                  Direct                       #
################################################

protocol direct {
    ipv4;
    ipv6;
    interface "dummy*";
}

################################################
#              Kernel isolation                 #
################################################

protocol kernel krt_ipv4 {
    scan time 20;

    ipv4 {
        import none;
        export none;
    };
}

protocol kernel krt_ipv6 {
    scan time 20;

    ipv6 {
        import none;
        export none;
    };
}

################################################
#              Static announcements             #
################################################

protocol static static_v6 {
    route 2001:db8:4700::/47 reject;

    ipv6 {
        import all;
        export none;
    };
}

################################################
#               BGP template                    #
################################################

template bgp tpl_bgp {
    local as OWNAS;
    path metric 1;
    graceful restart;

    ipv4 {
        import none;
        export filter { reject; };
        export limit 100 action disable;
        extended next hop on;
    };

    ipv6 {
        import none;
        export filter {
            if source != RTS_STATIC then reject;
            accept;
        };
        export limit 100 action disable;
    };
}

################################################
#                 Upstream BGP                  #
################################################

protocol bgp bgp_upstream_v4 from tpl_bgp {
    source address OWNIP;
    neighbor 169.254.0.1 as 64496;
    multihop 2;
    password "REDACTED_PASSWORD";
}

protocol bgp bgp_upstream_v6 from tpl_bgp {
    source address OWNIPv6;
    neighbor 2001:db8:ffff::1 as 64496;
    multihop 2;
    password "REDACTED_PASSWORD";
}

Does the BIRD2 Configuration Need Changes?

Conclusion

In most cases, almost no changes are needed.

Because there are already:

bird

protocol direct {
    ipv4;
    ipv6;
    interface "dummy*";
}

So as long as the new logical interface is named dummy47, it will naturally be matched.

And the IPv6 static advertisement part is itself correct:

bird

protocol static static_v6 {
    route 2001:db8:4700::/47 reject;

    ipv6 {
        import all;
        export none;
    };
}

Why not change `/47` from reject

Because the reject route here is only for:

Getting the prefix into the BIRD RIB
Satisfying the BGP export conditions
Serving as a declaration that "I own and advertise this prefix"

It is not meant for real forwarding or local address binding by the Linux kernel.

So it is reasonable to keep the /47 approach with reject.

Actual Configuration Steps

Next, we start the Linux network configuration.

Step 1: Create the New Dummy Interface

First load the module and create the logical interface:

bash

modprobe dummy

ip link add dummy47 type dummy
ip link set dummy47 up

After execution, you can confirm with the following command:

bash

ip link show dummy47

Step 2: Add an anchor address to dummy47

Although we will use the entire /47 address pool, it is still recommended to place an explicit single address on dummy47 as an "anchor":

bash

ip -6 addr add 2001:db8:4700::1/128 dev dummy47

Using /128 is enough here. There is no need to add the entire /47 as a regular interface address.

Why not do that:

bash

ip -6 addr add 2001:db8:4700::/47 dev dummy47

Because this does not achieve the goal of "the host can bind the entire /47."
It only gives the interface connected route semantics, which does not make the whole prefix a directly bindable local address pool.

Step 3: Add the entire `/47` as a local route

This step is the most critical.

bash

ip -6 route replace local 2001:db8:4700::/47 dev lo

With this, the kernel will consider:

2001:db8:4700::/47 as a whole belonging to the host's local address space

In other words, as long as applications later bind any IPv6 address within this range, the kernel will accept it.

Why attach it to `lo`

Because this is a local route, which does not mean "send packets from loopback" but rather:

This prefix is treated as a local address
It is held by the local host

This is the standard way Linux handles this kind of scenario.

Step 4: Enable ip_nonlocal_bind

Even with local route in place, many programs still by default cannot freely bind addresses that are not explicitly assigned to an interface.

So you also need to enable:

bash

sysctl -w net.ipv6.ip_nonlocal_bind=1

For persistence, it is recommended to write it into a separate sysctl configuration file:

bash

cat >/etc/sysctl.d/99-ipv6-pool.conf <<'EOF'
net.ipv6.ip_nonlocal_bind = 1
EOF

sysctl --system

Step 5: Reload BIRD2

If the BIRD configuration itself has not changed, this step is theoretically unnecessary.
However, if you made any configuration adjustments along the way, reloading once is the safest option:

bash

birdc configure

Then check whether the route is in the BIRD RIB:

bash

birdc show route for 2001:db8:4700::/47

Verification

Check the addresses on dummy47

bash

ip -6 addr show dev dummy47

You should see at least:

text

inet6 2001:db8:4700::1/128 scope global

Check the local route

bash

ip -6 route show table local | grep '2001:db8:4700::/47'

You should see something similar to:

text

local 2001:db8:4700::/47 dev lo

Test outbound connectivity using a specified source IPv6 address

Do not specify the interface name dummy47 here; instead, bind directly to the specific source address:

bash

curl -6 --interface 2001:db8:4700::100 https://ipv6.ip.sb
curl -6 --interface 2001:db8:4700::200 https://ipv6.ip.sb
curl -6 --interface 2001:db8:4701::1234 https://ipv6.ip.sb

If the returned values are the source addresses you specified, the configuration is successful.

A pitfall to watch out for: binding to an "interface" is not the same as binding to a "source address"

Many people instinctively test it like this:

bash

curl -6 --interface dummy47 https://ipv6.ip.sb

This testing method is not suitable here.

This is because dummy47 is not a physical egress NIC; it is just a logical carrier interface.
Actual outbound traffic still depends on the system default route, which generally goes out through a real physical NIC such as eth0 or ens3.

So the correct approach is:

Bind to the specific source IPv6 address
rather than binding to the dummy47 interface name

That is:

bash

curl -6 --interface 2001:db8:4700::100 https://ipv6.ip.sb

About ndppd: generally not needed in this scenario

Some articles on "binding and directly using an entire IPv6 range" additionally mention ndppd.
That is usually because the upstream provides the IPv6 prefix to the machine as an on-link network, requiring NDP neighbor discovery for each address.

But the scenario here is different:

The machine already advertises this prefix via BGP
The upstream is more like routing this prefix to this machine
rather than requiring the host to respond to NDP for each address across the whole range at Layer 2

So in this design, generally:

ndppd is not needed
You only need:
- BIRD to advertise the prefix normally
- The kernel to have local route
- ip_nonlocal_bind to be enabled

Only when the provider explicitly requires that this prefix be Layer 2 directly connected and that neighbor discovery be performed for target addresses should you additionally consider ndppd or proxy_ndp.

Persistence solution: systemd service

To avoid losing the configuration after a reboot, I finally wrote this setup into a simple systemd service.

Create the file:

bash

vim /etc/systemd/system/dummy47-v6pool.service

The content is as follows:

ini

[Unit]
Description=IPv6 pool on dummy47
After=network-online.target
Wants=network-online.target

[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart=/sbin/modprobe dummy
ExecStart=/sbin/ip link add dummy47 type dummy
ExecStart=/sbin/ip link set dummy47 up
ExecStart=/sbin/ip -6 addr add 2001:db8:4700::1/128 dev dummy47
ExecStart=/sbin/ip -6 route replace local 2001:db8:4700::/47 dev lo
ExecStart=/sbin/sysctl -w net.ipv6.ip_nonlocal_bind=1

ExecStop=/sbin/ip -6 route del local 2001:db8:4700::/47 dev lo
ExecStop=/sbin/ip -6 addr del 2001:db8:4700::1/128 dev dummy47
ExecStop=/sbin/ip link del dummy47

[Install]
WantedBy=multi-user.target

Then run:

bash

systemctl daemon-reload
systemctl enable --now dummy47-v6pool.service

A summary of the complete operation commands

For easy copying, the full steps are summarised here in one block:

bash

modprobe dummy

ip link add dummy47 type dummy || true
ip link set dummy47 up

ip -6 addr add 2001:db8:4700::1/128 dev dummy47 || true
ip -6 route replace local 2001:db8:4700::/47 dev lo

sysctl -w net.ipv6.ip_nonlocal_bind=1

birdc configure
birdc show route for 2001:db8:4700::/47

Verification:

bash

ip -6 addr show dev dummy47
ip -6 route show table local | grep '2001:db8:4700::/47'

curl -6 --interface 2001:db8:4700::100 https://ipv6.ip.sb
curl -6 --interface 2001:db8:4700::200 https://ipv6.ip.sb
curl -6 --interface 2001:db8:4701::1234 https://ipv6.ip.sb

My final understanding

After completing this configuration, the overall structure becomes very clear:

What BIRD2 does

Continues to advertise the target /47 via BGP
Continues to place the prefix into the BIRD RIB using static ... reject
Does not import or export Linux kernel routes

What the Linux kernel does

Provides the logical carrier via dummy47
Marks the entire /47 as local address space via local route
Allows applications to bind any IPv6 address in the pool via ip_nonlocal_bind

How applications use it

Do not bind to dummy47
Instead, bind to a specific IPv6 address within the target /47 as the source address
Traffic still ultimately follows the system default route and exits through the real physical interface

Afterword

At first, I also easily confused "prefix advertisement" with "local address binding" as one and the same thing.
But once I separated them, it became clear that these are actually two different layers of concern:

Control plane for routing: BIRD/BGP
Data plane on the host: Linux network stack

With these two handled separately, the overall setup becomes very stable and is easier to maintain and troubleshoot.

If I later expand this machine to host more IPv6 address pools, I would prioritize continuing with this approach:

BIRD is only responsible for advertising
The business address pool is managed through dummy + local route + ip_nonlocal_bind

This keeps the structure the cleanest.

Hands-on Notes on AWS Services and a Kafka Cluster

Linus Xiong — Thu, 12 Jun 2025 15:41:55 GMT

Introduction

A recent project of mine needed AWS services. Since this was my first time getting hands-on with AWS and its services, I thought it worth writing a post to record the technologies I came across, some of my understanding and takeaways, and a few real operations, so that I can look back and reuse some of the commands.

The project involved

Amazon MSK, i.e. Fully Managed Apache Kafka — put simply, a Kafka cluster
Amazon IoT Core, something similar to an MQTT broker
Amazon Lambda, a serverless platform that supports many programming languages
Amazon S3, Scalable Storage in the Cloud
Amazon IAM for access control
Amazon CloudWatch - a platform similar to Grafana

This journal walks through the services above and chains them all into one data flow

Walkthrough

Business flow

We start where the data enters and follow it step by step, tying together every service it passes through.

IoT Core is the entry point: it accepts data from IoT devices or other services that speak MQTT, and uses the Rules feature of Message routing to forward it to a Kafka topic, or to send it to Lambda, which processes it and writes it into JSON files on S3.

graph LR
A[mqtt message]-- Message Rule --->B[Kafka Cluster topic]
A-- Message Rule --->C[Lambda - Process Data] ---> D[S3]

IAM access control

When IoT Core runs into an error, it writes the log to CloudWatch. To make all of this work, you first configure Policies for several services and assign them to various Roles; the services then use the permissions a Role grants to operate on other AWS services. In short, a Policy is a set of individual permissions — s3:ListBucket, for example, is one of the permissions in a Policy.

A Role, in turn, is a set of one or more Policies: an S3 Admin Policy and a CloudWatch Write Policy, for example, become the Policies of a Role. Only when a Role with the right permissions is assigned to an instance of an AWS service can that instance operate on and access resources — a key prerequisite.

MSK configuration

MSK comes in two types, Provisioned and Serverless, and Serverless supports no authentication method other than IAM. So if you want IoT Core to work with MSK, you must use the provisioned version, because IoT Core rules only support SASL/SCRAM or SSL authentication.

There are several ways to reach the nodes of the MSK cluster from outside to create topics. I used an EC2 client machine — a virtual machine acting as a jump host — and ran a proxy on it, so that from outside I could connect through the proxy to nodes inside Amazon on the same VPC network as the EC2 instance. One very important point: do not overlook whether the MSK and EC2 firewall rules let the traffic through; if they do not, you cannot connect. I spent a long time troubleshooting here before finding out it was the firewall

For how to set up the jump host, see the official documentation https://docs.aws.amazon.com/msk/latest/developerguide/create-client-machine.html

With access covered, let us go deeper into connections and permissions. First make sure the IAM Role of the EC2 instance may access the nodes and topics of the MSK cluster; then, on the jump host, the following commands create a topic, subscribe to it and send messages to it

console

# subscribe topic
./kafka-console-consumer.sh \
  --bootstrap-server url:port,url2:port \
  --topic topic \
  --consumer.config client.properties

# push data to topic, producer
./kafka-console-producer.sh \
  --bootstrap-server url:port,url2:port \
  --topic topic \
  --producer.config client.properties

# check all the topic
./kafka-topics.sh --list \
  --bootstrap-server url:port,url2:port \
  --consumer.config sasl.properties

# create a topic
./kafka-topics.sh --create \
  --bootstrap-server url:port,url2:port \
  --topic topic \
  --partitions 6 \
  --replication-factor 2 \
 --command-config sasl.properties

If you see something like Error while executing topic command : The AdminClient thread has exited. Call: createTopics, it is almost certainly a permissions problem: first check that your IAM and SASL/SCRAM/SSL settings are correct. For IAM on EC2, as long as the IAM role is configured correctly in the console, that IP can connect directly with IAM.

console

[ec2-user@ bin]$ ./kafka-topics.sh --create --bootstrap-server url:port --topic your_topic --partitions 6 --replication-factor 2
WARNING: Due to limitations in metric names, topics with a period ('.') or underscore ('') could collide. To avoid issues it is best to use either, but not both.
Error while executing topic command : The AdminClient thread has exited. Call: createTopics
[2025-06-11 05:00:49,875] ERROR org.apache.kafka.common.errors.TimeoutException: The AdminClient thread has exited. Call: createTopics
 (org.apache.kafka.tools.TopicCommand)
[2025-06-11 05:00:49,890] ERROR Uncaught exception in thread 'kafka-admin-client-thread | adminclient-1': (org.apache.kafka.common.utils.KafkaThread)
java.lang.OutOfMemoryError: Java heap space
        at java.base/java.nio.HeapByteBuffer.<init>(HeapByteBuffer.java:61)
        at java.base/java.nio.ByteBuffer.allocate(ByteBuffer.java:348)
        at org.apache.kafka.common.memory.MemoryPool$1.tryAllocate(MemoryPool.java:30)
        at org.apache.kafka.common.network.NetworkReceive.readFrom(NetworkReceive.java:103)
        at org.apache.kafka.common.network.KafkaChannel.receive(KafkaChannel.java:462)
        at org.apache.kafka.common.network.KafkaChannel.read(KafkaChannel.java:412)
        at org.apache.kafka.common.network.Selector.attemptRead(Selector.java:694)
        at org.apache.kafka.common.network.Selector.pollSelectionKeys(Selector.java:596)
        at org.apache.kafka.common.network.Selector.poll(Selector.java:501)
        at org.apache.kafka.clients.NetworkClient.poll(NetworkClient.java:596)
        at org.apache.kafka.clients.admin.KafkaAdminClient$AdminClientRunnable.processRequests(KafkaAdminClient.java:1542)
        at org.apache.kafka.clients.admin.KafkaAdminClient$AdminClientRunnable.run(KafkaAdminClient.java:1473)
        at java.base/java.lang.Thread.run(Thread.java:829)

IoT Core setup

Open AWS IoT - Message routing - Rules to add a new rule. Here I record how I used a Rule to forward data to Kafka. First choose Kafka as the Rule action and add a VPC under Destination, which again needs a matching IAM Role. Then set the Kafka topic to the topic you created earlier. For the Key I entered ${clientid()}, mainly so that Kafka can partition the data; if one key carries too much, a single partition may end up with too much content and become skewed.

Pay special attention to the SASL Configuration: the username and password must first be stored as a key-value pair in AWS Secrets Manager and bound to a key generated in Key Management Service (KMS). Later, when you connect with SASL/SCRAM, the key-value pair set here is your username and password

Then we use the following to read the value stored in Secrets Manager. This one is the username; for the password, simply replace username ${get_secret('AmazonMSK_iot', 'SecretString', 'username', 'you role arn')} You can of course set some headers to make messages easier to identify, but too many may slightly affect performance

Lambda setup

Just add a Function in Lambda, then give the IoT Core rule an action pointing to that function, and the IoT data is sent there too. In the function I merge the MQTT data it receives and upload it to S3. If the IoT Core rule forwarded the data straight to S3, it would create one file per message, which is inconvenient to manage and inspect — that is why Lambda does the forwarding here.

However, since Lambda uploads the data to S3 directly without any buffering, a large volume of data might cause problems

Conclusion

That is every AWS service I have picked up recently. If anything new comes along, I will add it later

Migrating Typecho Posts to Hexo

Linus Xiong — Sun, 03 Nov 2024 09:24:00 GMT

Preface

Migrating my Typecho posts to Hexo: it has been far too long, but I have finally picked my blog up again. The last time I wrote anything here was five years ago, and in the blink of an eye I am about to graduate from university. Looking back, the "Ten-Year Pact" blog project I joined back then was a bit of a joke — keeping a server paid for year after year is not cheap. Still, now that I am older and know more, this blog should be able to make it to ten years.

Enough rambling. This post is about how I moved my blog from Typecho to Hexo. It is actually simple — a single Python file does the job — but switching comment systems makes the old comments hard to carry over, so I had to make trade-offs. For now I have migrated all the posts and mapped their tags; as for images, I used object storage from the start, so they should be fine.

Here is the code:

Migration code

python

# -*- coding: utf-8 -*-

import os
import pymysql
import arrow
from box import Box


def create_data(db):
    cursor = db.cursor()
    # 创建文章
    cursor.execute("select cid, title, slug, text, created, modified from ty_contents where type='post'")
    # 创建分类和标签
    entries = cursor.fetchall()
    for e in entries:
        e = Box(e)
        title = e.title
        title = title.strip(' ')
        print(title)
        content = str(e.text).replace('<!--markdown-->', '')
        # 文章太长截断
        max_length = 150  # Set the maximum content length here
        if len(content) > max_length:
            content = content[:max_length] + "\n<!--more-->\n" + content[max_length:]
        tags = []

        cursor.execute("select type, name, slug from `ty_relationships` ts, ty_metas tm where tm.mid = ts.mid and ts.cid = %d" % e.cid)
        metas = cursor.fetchall()

        for m in metas:
            m = Box(m)
            if m.type == 'tag':
                tags.append(m.name)
        path = 'data/_posts/'
        if not os.path.exists(path):
            os.makedirs(path)
        filename = arrow.get(e.created).format('YYYY-MM-DD') + " " + title.replace('/', '-')
        f = open(f"{path}/{filename}.md", 'w', encoding="utf-8")
        f.write("---\n")
        f.write("title: '%s'\n" % title)
        f.write("date: %s\n" % arrow.get(e.created).format('YYYY-MM-DD HH:mm:ss'))
        f.write("updated: %s\n" % arrow.get(e.modified).format('YYYY-MM-DD HH:mm:ss'))
        f.write("tags: [%s]\n" % ','.join(tags))
        f.write("published: true\n")
        f.write("lang: zh-cn\n")
        f.write("---\n")
        f.write(content)
        f.close()


def main():
    # 把数据库连接信息

    db = pymysql.connect(host='localhost',
                                 user='root',
                                 password='xxxxx',
                                 database='typecho',
                                 cursorclass=pymysql.cursors.DictCursor)

    create_data(db)


if __name__ == "__main__":
    main()

Not all of this code is my own: I found it online and adapted it to my setup. If you need to migrate more, feel free to modify it yourself.

Closing thoughts

I am finally back. From the flashy themes of my younger days to chasing page speed and a clean design today — quite a change.

Adding Two-Step Verification to Typecho

Linus Xiong — Sat, 16 May 2020 20:23:00 GMT

Foreword

Today I discovered a very handy app, Google's Authenticator. It is a two-step verification client based on time and hash algorithms, and it complies with the RFC 6238 and RFC 4226 standards. Since the security of a blog is still very important, after all it concerns the server, two-step verification is quite necessary here. Conveniently, Typecho has a Google Authenticator plugin, open-sourced on GitHub. Those who question its security can review it themselves: project address

Usage

Rename the file to GAuthenticator, place it in the /usr/plugins directory, and then enable it in the admin panel.

The plugin is disabled by default. When you enable it for the first time, you need to scan the QR code to bind it, then enter the code displayed on your phone. It can only be enabled after the verification succeeds.

Download link here: click me

Installing the Client

Compatible with any AuthOTP software that conforms to the RFC6238 specification:

Microsoft Authenticator
Google Authenticator
1Password
Authy
KeePass
LastPass
...

Here, I personally use Google's Authenticator. It takes up relatively little system resources and is simple and convenient.

Building a Mini Program Version of Typecho

Linus Xiong — Mon, 20 Apr 2020 18:35:00 GMT

Foreword

Recently I've seen quite a few bloggers publish WeChat Mini Program versions of Typecho, but the quality varies. Some open-source ones have unattractive interfaces, and the attractive ones charge fees. Being frugal, after trying many projects on GitHub, I finally found one that actually runs. Setting aside what the interface looks like, at least it runs. Other projects had more or less problems with my theme, though that may have been debugging issues on my side. After all, it was my first time touching WeChat Mini Programs, and at first I wasn't very familiar with how the project is built. Only after spending more time did I gradually figure out the specific steps. Precisely because the open-source program's interface isn't very attractive, and because it's difficult for them to work with the handsome theme (for example, the loss of header images and post excerpts), I chose to modify the front-end pages on top of a version that runs.

Project Address

WeChat-Typecho

Please, dear experts, give it a Star, I'm humbly begging

Scan to Preview

Mini Program Code

Special Thanks

I put acknowledgements at the very beginning because I'm also a ~~coder~~ humble programmer myself, so I deeply understand how hard writing code is, and I would like to express special thanks here

WeTypecho——Expert from Chengdu, the "Seventh Handsome," author of the blog-side plugin

Pisces-Mini-Program——Modified by the author based on WeTypecho

ColorUI——CSS library for Mini Programs

Notes

Why didn't I choose other authors' projects on GitHub?

Because I want my WeChat Mini Program to not only allow browsing but also interaction, so users can use the Mini Program to comment and express their views and thoughts on articles. If in the future I have the ability to write back-end JS, I will improve the projects on GitHub that I think look good.

For example, WxappForTypecho

The letter-based function naming in the project was not written by me!!!

Mini Program Publishing Requirements

Domain name has been registered with ICP filing
Domain name has HTTPS enabled
Be an adult, or have a WeChat payment-linked account for users 18 and over

WeChat Domain Configuration

Add your domain to it. If your image and other resources are stored at an address that is not the domain you set above,

you also need to add your image resource domain, otherwise the Mini Program may be unable to display resources.

Features

The currently supported basic features are as follows:

Browse articles by category directory
Display of the About personal page
Homepage article carousel
Comment on articles
Automatically fetch article header images
Display of images and videos
Support for Markdown and HTML parsing
Recommended reading articles
Search articles
Custom character display of different card styles

Custom Characters

style (display style of homepage articles, default value is 3, I haven't tested the others)

Large image card form for code
Small image card display form for representative
Background card form for representative

isPay (whether the article requires an ad launch, default is 0) 1: Yes 0: No

thumb (article thumbnail)

Tutorial

On line 236 of /common/vendor.js, modify your information. I didn't write this function naming convention, so don't hit me.

When debugging in the WeChat Developer Tools, you need to check the options in Details: "Do not validate legal domains" and "web-view", otherwise articles won't display during debugging.

Modify r and i and make them correspond with the back-end Mini Program

On line 6 and line 8 of /pages/about/home/home.wxml, modify your blog name and description.

On the third line of /pages/index/index.wxml, modify the name at the very top of the Mini Program.

On line 57 of /pages/index/index.js, modify the author information under each article.

On line 16 of /app.json, modify your blog name.

On line 2 of /pages/about/home/home.wxss, modify the avatar address on the About page.

On line 4 of /pages/about/home/home.wxml, modify the avatar address.

On /pages/about/home/home.js第73 and line 74, modify the image address of the WeChat reward code.

On line 157 of /pages/details/details.wxml, modify the image that appears after you like something; anyway, modify it yourself.

Typecho Plugin Side

Copy WeTypecho to the plugin directory, then activate and configure it in the backend. The name must be correct, otherwise an error will occur.

APISEC
Blog author name
Blog URL

These three items are required; the rest is optional (I guess).

It must be consistent with the API_SECRET field in the Mini Program side config.js, otherwise data cannot be read from the server.

Code Explanation

app.js is the initial entry file. wxss is equivalent to CSS in an HTML project. If you add new code in js, you need to declare it in the json file.

static is where resource files are placed. You can modify the materials yourself, but it seems not all of them are referenced, so look around on your own.

pages contains all the pages, which can be referenced and navigated to. For example, to jump to the About page, the address is pages/about/home/home about under the home directory's home method, roughly speaking. I'm also touching WeChat Mini Programs for the first time..

This project introduces Color UI. You can download the demo and ~~copy~~ write your own.

Below line 26 of /pages/index/index.js is where you modify the two jump buttons on the homepage.

text

	categories: [{
		cuIcon: "write",//这个是图标，可以自己去color ui的小程序找名称修改
		color: "white",//这个是文字颜色
		bg_color: "bg-gradual-green",//这个是背景颜色，可自行修改
		badge: 1,//小红点文章个数，填1就是一个小红点，大于1就是显示数字，大于99显示99+
		mid: "24",//这个是分类id
		title: "随笔",
		name: "Essay"
	}，

You can add parameters yourself. The calling method is as follows {{item.title}}. You must declare wx:for="{{categories}}" before use.

Please reward me

How to Turn an Entire Website Grayscale and the CSS Code to Implement It

Linus Xiong — Sat, 04 Apr 2020 08:24:00 GMT

Preface

To express the deep mourning of the people of all ethnic groups for the martyrs who sacrificed themselves and the compatriots who died in the fight against the COVID-19 epidemic, the State Council has decided to hold a national mourning day on April 4, 2020.

In response to the General Office of the State Council's notice on holding a national mourning event for the martyrs and compatriots who died in the COVID-19 epidemic, and in accordance with requests from some of our clients, we turned some client websites black and white from 0:00 to 24:00 on April 4. At the same time, the official website of Weijie is also being turned grey in sync, to mourn the martyrs and compatriots who died in the fight against the COVID-19 epidemic. Below is a brief description of how to turn a website grey.

Main Text

CSS Method

Add a line of style in the head section of the page that needs to be turned grey.

html

<style type="text/css">html {-webkit-filter: grayscale(100%);}</style>

The above code works with mainstream browsers, such as the latest versions of Chrome and Edge.

html

<style>
    html {
        -webkit-filter: grayscale(100%);
        -moz-filter: grayscale(100%);
        -ms-filter: grayscale(100%);
        -o-filter: grayscale(100%);
        filter:progid:DXImageTransform.Microsoft.BasicImage(grayscale=1);
        _filter:none;
    }
</style>

The above code is compatible with the vast majority of browsers, including QQ Browser, 360 Speed Browser, Internet Explorer, and others.

Embedding the Chrome Offline Dinosaur Game in a Blog

Linus Xiong — Tue, 31 Mar 2020 17:22:00 GMT

Preface

Recently, while browsing other bloggers' sites, I came across someone embedding Chrome's offline dinosaur game into their blog. I found it quite interesting and wanted to do the same. However, I found the original blog's implementation and source code rather rough, so I located the source code on GitHub and further refined it to make it easier to embed in a blog. Now let me walk through the steps.

Come try mine first click here to start playing

Main Text

First, the project source code is here: Github

General Web Pages

Usage is very simple. If you're using it on a regular web page, just add

html

<div id="container"></div>
<script src="runner.js"></script>
<script>
 initRunner('#container');
</script>

where runner.js can be any address. You can place the runner locally, or store it on OSS (Alibaba Cloud Object Storage) or similar storage.

Typecho Blog

We can also embed this code into the blog. Of course, for convenience here, I directly use the iframe method to include it, which is simpler. Here is my approach:

html

<iframe align="center" width="100%" height="200px" src="https://cdn.xsiy.ltd/site/typecho/game/index.html"  frameborder="no" border="0"  scrolling="no" marginwidth="0" marginheight="0" ></iframe>

It's very simple, just one line is enough. Of course, you can also choose the conventional way to embed it.

My approach is to include the html file stored on my OSS (Alibaba Cloud Object Storage), so make sure your OSS (Alibaba Cloud Object Storage) lasts as long as your website does.

The source code of index.html is as follows:

html

<!DOCTYPE html>
<html lang="zh-CN">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, minimum-scale=1, user-scalable=no">
    <title>Runner</title>
</head>
<body>
<div id="test"></div>
<script src="https://cdn.xsiy.ltd/site/typecho/game/runner.js"></script>
<script>
    initRunner( '#test' );
</script>

</body>
</html>

You can store it on your own local server and reference it there. The same goes for the js.

Notes

The markdown syntax in Typecho !!!你的代码!!! like this embeds code. Remember to use an English exclamation mark.

Do not copy my code directly for use, because a Referer whitelist has been set up to prevent hotlinking, so using it directly will not work.

This method supports playing on mobile phones, computers, and other devices.

Visual Studio Remote Development

Linus Xiong — Mon, 02 Mar 2020 16:24:00 GMT

Preface

Recently I built a remote development project Visual Studio Code Remote Development. It moves the VS Code client to the cloud,

letting you use a fully featured development environment inside containers, on remote devices, or even on the Linux subsystem for Windows (WSL).

Official description

Develop on the same operating system you deploy to, or use bigger or more specialized hardware.

Sandbox the development environment so it does not affect the configuration of your local machine.

Make it easy for new contributors to get started, and keep everyone on a consistent environment.

Use tools or runtimes that are unavailable on your local operating system, or manage multiple versions of them.

Develop Linux-deployed applications using the Windows Subsystem for Linux.

Access an existing development environment from multiple machines or locations.

Debug applications running in other locations, such as a customer site or the cloud.

How to install

System requirements

Local: a supported OpenSSH-compatible SSH client must also be installed.

Remote SSH host: an SSH server running on:

x86_64 Debian 8 and later, Ubuntu 16.04 and later, CentOS / RHEL 7 and later.

ARMv7l (AArch32) Raspbian Stretch / 9+ (32-bit).

ARMv8l (AArch64) Ubuntu 18.04+ (64-bit).

Experimental SSH host support (VS Code Insiders only):

Windows 10 / Server 2016/2019 (1803+), using the official OpenSSH Server and enabling remote.SSH.useLocalServer in VS Code settings.

Ubuntu 18.04

First, download the package from GitHub download link

text

wget https://github.com/cdr/code-server/releases/download/2.1698/code-server2.1698-vsc1.41.1-linux-x86_64.tar.gz
tar xvzf code-server2.1698-vsc1.41.1-linux-x86_64.tar.gz
cd code-server2.1698-vsc1.41.1-linux-x86_64
# 设置密码
export PASSWORD=password
./code-server --auth password

Process daemon

text

sudo nano /etc/systemd/system/code-server.service

Add the following configuration:

text

[Unit]
Description=Code Server IDE
After=network.target
[Service]
Type=simple
User=root
Restart=on-failure
RestartSec=10
 
Environment="PASSWORD=password"
 
ExecStart=/path/to/code-server --auth password 
 
StandardOutput=file:/var/log/code-server-output.log
StandardError=file:/var/log/code-server-error.log
[Install]
WantedBy=multi-user.target

Start the service

text

systemctl start code-server

Dongting Lake Field Study – Day 3

Linus Xiong — Sat, 16 Nov 2019 04:53:00 GMT

On the last day of the three-day study tour, we set off at 7:20 in the morning. After nearly two hours on the road, covering 90 kilometers, we arrived at the final stop of our journey: the Yangtze finless porpoise waterway protection station.

After a brief rest, we began the river patrol. The whole class stood on the boat watching for any sign of finless porpoise activity. We not only saw porpoises leaping out of the water, but also saw rare birds soaring across the sky. It was, as the saying goes, a rich harvest.

Standing at the bow, feeling the river wind blow across us, the water surging beneath our feet and waves constantly lapping against the hull, breathing in clean, unpolluted air, we came to realize from the bottom of our hearts how important environmental protection is. We also resolved to lead by example and consciously protect the ecological environment.

After the patrol, we were fortunate to meet the station director. As someone who has been on the front line of protecting the Yangtze's environment for many years, the director has very distinctive insights and profound knowledge about protecting the finless porpoise. So we asked several questions we had prepared for a long time, such as whether protecting the finless porpoise conflicts with economic development, and whether the finless porpoise can hybridize with related species, among others. The director answered our questions with great enthusiasm. His answers were unique and opened up new ways of thinking for us, and we benefited greatly.

Before leaving, to commemorate this patrol activity, we took the initiative to ask the director for a group photo. He readily agreed, and took a remarkably meaningful photo with all of us students and our accompanying teachers.

After leaving, we had lunch at a nearby restaurant, which marked the official end of the last activity. We then began the journey back to Changsha East high-speed railway station. After four hours by bus and two hours by train, we arrived safely back in Nanchang at 7:00, concluding the final day of our trip.

Looking back on the three days, we were honored to see the finless porpoise, a creature we had never really known before. We got to know the study tour leader, Dao Ge, Director Li of the Elk Nature Reserve, Da Ming Ge, a civil conservationist of Dongting Lake, and Director Deng of the Hua Rong Chengjiang Ancient Yangtze Channel in Hunan. Thanks to them, we learned about the finless porpoise, the elk, and migratory birds from many angles. Over these three days of study, we came to understand how important it is to protect the finless porpoise. The seed of protecting the finless porpoise has taken root in our hearts, and improving the porpoise's living environment requires everyone to take action.

Though the three-day study tour on the finless porpoise was short, these memories will last forever!

Dongting Lake Field Trip – Day 2

Linus Xiong — Thu, 14 Nov 2019 21:14:00 GMT

On November 14, 2019, we arrived at Yueyang, Hunan, for the second day of our study tour. Here is Dongting Lake, the birthplace of traditional Chinese culture. Our group boarded a yacht to get close to the Yangtze finless porpoise, a Class I nationally protected animal.

The Yangtze finless porpoise is an endangered species in the world, and only about 300 remain in Dongting Lake. But under the protection of the goddess of luck, we were fortunate enough to see the porpoises and to record the moment they surfaced.

On the yacht, with the sea breeze blowing, blue sky and white clouds overhead, we unexpectedly spotted two black arcs on the water. "Those are porpoises!" the classmates shouted with delight. In the instant the porpoises broke the surface, several classmates took out their cameras and captured their graceful posture.

On the small island where the lookout tower stands, the classmates met two "guardians." They were two dogs adopted by the staff. While feeding them, several classmates, all for the great cause of "study tour," sank into the marsh and sacrificed their shoes. After these small mishaps, we prepared to head back.

Suddenly, a huge vessel appeared. Brother Dao said, "Look over there. Ahead is probably illegal sand dredging. Sand dredging is strictly prohibited across the entire Dongting Lake waterway." Hearing this, we were indignant yet helpless. All we could do was report it to the relevant national authorities. But then I thought: the witness of the public is the best deterrent to illegal sand dredgers. Through us, they felt society's attention, and we truly contributed to the cause of protecting the porpoises!

The sound of a siren rang out. We knew the maritime safety staff had arrived and believed the lawbreakers would be severely punished. However, the maritime staff explained to us: "That is a dredging vessel with legal permits." We only held our cameras, said nothing, and quietly recorded this scene: sand shoveled up bucket by bucket, money banked bundle by bundle. All we could do was this.

Human nature is complex, and merchants pursue profit. But the world is not always dark. That ray of light will be lit by us. In the darkness, we light a lamp to illuminate the darkness and warm people's hearts.

After lunch we rested briefly, cleaned the mud off our shoes and clothes, and began the two experimental surveys of the afternoon.

The first experiment was on benthic organisms. We used the professional instrument Mr. Liu brought along, the Peterson grab sampler. After we hauled up the bottom sediment, we went through layers of filtering and multiple procedures to screen out samples suitable for collecting organisms. Then we used tweezers to collect snails, freshwater snails, dragonfly larvae, and other organisms into bottles. In this way, we could judge whether the water quality was good based on the organisms collected.

Through Mr. Liu's explanation, we learned that when dragonfly larvae appear in a body of water, it indicates good water quality, while leeches appearing indicates severe pollution. In the experiment, our group was lucky enough to collect dragonfly larvae, along with some shells and freshwater snails. This shows that the water quality of Dongting Lake is relatively good.

The second experiment was to judge water quality by using pH test strips and data on ammonia nitrogen and potassium permanganate in the sample water. We compared samples from a sewage discharge point and from the lake's surface water, and found that the water at the sewage outlet was seriously polluted and far exceeded the standard. This shows that it is no wonder some factories cause such harm to the environment. Unfortunately, even though we discovered this problem, we could not stop the polluting behavior and could only return the samples to the lake.

After dinner, we drove back to the hotel and went to the second-floor conference room for the summary meeting of the day. First, Mr. Liu introduced the plan for tomorrow: visiting the Institute of Hydrobiology and the translocation protection area, and told us the goals and precautions for tomorrow. Then he summarized today's schedule. Through this meeting we realized that a study tour emphasizes "study" rather than "tour." We must look through phenomena to the essential problems and offer suggestions on the corresponding issues. Finally, today's itinerary came to a close with a documentary Mr. Liu had made earlier, on his survey of the porpoises during the Yangtze River cruise.

Tomorrow is both a new beginning and the day we return home. We will surely cherish the opportunity to visit the Institute, and we hope there will be no regrets tomorrow!

Dongting Lake Field Trip - Day 1

Linus Xiong — Wed, 13 Nov 2019 18:26:00 GMT

On November 13 at 10:08 a.m., the high school international class students of Nanchang Xinyuan School set out from Nanchang for a three-day dolphin research and investigation trip to Yueyang, Hunan. The first day of the activity concluded successfully. The dynamic report is as follows:

After a two-hour drive in the morning, we arrived at Changsha East Railway Station. After a short rest, we set off again for Yueyang and arrived at 12:56 p.m. After lunch, we followed Teacher Liu to the milu nature reserve managed by Station Master Li, where we observed at close range the national first-class protected animal, the Père David's deer (milu), named Dian Dian.

We actively asked Station Master Li about the morphological characteristics, habitat, living habits, distribution range, reproductive methods, and the current status of the species of milu, and Station Master Li responded to us enthusiastically.

We not only learned specific information about milu, but every one of our classmates also personally fed food to Dian Dian under Station Master Li's guidance.

Through our investigation and research from first-hand experience, we felt Station Master Li's perseverance and determination in protecting wildlife and the natural environment. This made us resolve to learn from Station Master Li, take him as a role model, and build awareness of protecting wildlife.

Before leaving, we took the initiative to ask Station Master Li for a group photo. Station Master Li readily agreed, so we took a large group photo with him and Dian Dian as a souvenir and memory of this research trip.

After concluding our investigation of Dian Dian, we drove to the East Dongting Lake Nature Reserve.

At the Wetland Biological Science Museum of the East Dongting Lake National Nature Reserve, we watched a documentary on protecting the Dongting Lake environment. Lines in the documentary such as "it supports the water use of all of Hunan and once turned countless Yangtze floods into harmless events" and "Dongting Lake is named for its water and flourishes because of its birds" helped us more deeply appreciate the importance of Dongting Lake. We also saw eight categories of real specimens, including birds, wild plants, freshwater fish, and finless porpoises.

Under Teacher Liu's guidance, we used professional telescopes to observe migratory birds such as geese and ducks. On Caisang Lake, a flock of ducks was relaxing and playing on the water. Teacher Liu told us that identifying migratory bird species involves three steps: first look at the beak, then the legs, and finally the plumage. We also learned that some tourists, in order to take beautiful photos, forced migratory birds to fly up, which injured their wings. We realized that observing migratory birds requires not only looking at their appearance and identifying their species, but also learning to protect their environment and habits, and trying not to disturb their lives while observing them. After dinner, we concluded the first day's itinerary.

This day brought unfamiliar experiences, surprises, and some disappointments. We learned a great deal and also realized that our every action affects the environment. As night falls, we look forward to the Dongting Lake finless porpoise journey tomorrow, and hope for even more new discoveries!

Life Before the Zhongkao

Linus Xiong — Wed, 19 Jun 2019 19:41:00 GMT

Now that I'm finished as of noon, the only thing still limiting me is the Constitution of the People's Republic of China. Finishing the exams really does feel great, and now I finally have time to write this post. Let me start with the time before the exams. Those days were brutal. For the ten days before the exam I stopped going to school and went to a tutoring center to cram physics, chemistry, and English. Those ten days were really miserable, but I did give it everything, I suppose. I imagine this is how top students spend every weekend. Thinking about that, I feel a bit ashamed. If you don't work hard normally, you can only cram at the last minute.

Let me describe how I spent these ten days. Every day had courses that were no less intense than regular school classes. From 8 to 10 in the morning was English, then physics, then chemistry from 2 to 4 in the afternoon, and after that I'd do practice papers, usually two physics papers and one chemistry paper, plus English listening and reading comprehension. That was the daily training load. In the end, the conversion was weakest for English, and chemistry went up about 20 points. You can imagine how poor my earlier scores were. Physics went up about 10 points. Sometimes you don't know what you're capable of until you push yourself. Maybe this is what "bitterness before sweetness" means! Although these ten days were exhausting, I experienced the joy that working people feel when they reap the rewards of their labor. I can only say it felt wonderful. People need to set goals for themselves, but I tend to prefer carrying things out rather than directing them, so I don't really set goals for myself.

Even though it was only ten days, a lot happened. The first day still felt fresh, but after the second day there was only pain. So I often went up to the rooftop alone to clear my head, and that feeling was really nice.

It seems that in the end I also had a bit of a clash with a teacher. That's fine, though. After this time I won't see her again. How should I put it? Some people think I'm a bit stubborn. Thinking about it carefully, maybe I am a little, but I'm only stubborn about things I firmly believe in, and I don't think I did anything wrong. For example, if someone tries to grab my snacks, I won't give them up even if I have to throw them away, but if they ask politely, I will give them some (except of course for people I'm close to). After all, taking someone's property infringes on a citizen's property rights, right? So I don't think I did anything wrong. If anything, his behavior violated my property rights.

I also really hate being threatened. If someone pointed a knife at me and wanted to stab me, I would fight back without hesitation. That's probably a human instinct. But in everyday life, if someone threatens me, I will definitely get back at them, and I'll do it quietly. I'll keep a smile on my face toward my enemy while stabbing them in the back. I think that's the best way, since after all, a gentleman handles things with dignity, right?

This post is a bit scattered. I basically wrote whatever came to mind. Sorry about that!

Recently I also did something else. My brother came to my house recently and complained that he kept getting 460 ms of ping when playing games. I figured it must be the mesh router's fault, so I listed my router on Xianyu for over 400 yuan, then spent 300 yuan on a Phicomm K3 and a heat-dissipation mod kit.

Here's the finished product! It should have lowered the temperature by more than 10 degrees, and the effect is pretty obvious! But I still need to wait for my brother to come over and test it for real. Not that I play games myself (mutters quietly).

I've also filmed a few videos. Nobody watches them, but I think I should keep going, since it's a hobby I love. So I'll probably post a lot of videos during this vacation. There will be far fewer technical things, and most of them will be real-life documentary videos. The vacation came too fast and feels a little unreal. Soon I'll be entering a completely new environment, high school, and I can't help feeling a little lost. I'm used to this road from home to school!

But people have to learn to step outside their comfort zone and change things. I'm an optimist by nature (maybe because I've been through too many bad experiences). So a new environment means new teachers and new classmates, and I'll meet better people too. I also hope that on this new journey I can do more, have more fun, and, most importantly, study harder!

I don't really have anything else to write. That's it for now. Thanks for reading all of my rambling.

Installing ImgURL Image Hosting

Linus Xiong — Sat, 27 Apr 2019 12:46:00 GMT

Preface

The previous article covered solutions for Sina image hosting failures. But our many bloggers were unwilling to remain constrained by Sina and at the mercy of its whims, which affected their blogs. So this article was written specifically to keep bloggers' image assets safe!

ImgURL is a simple, pure image hosting program, developed with PHP + SQLite 3.

Key Features

Supports drag-and-drop upload, multi-image upload, Ctrl + V paste upload, and URL upload
Supports image cropping and automatic thumbnail generation
Limits the number of uploads by visitors
Image compression / batch compression
Image adult-content detection / batch detection
API support
Online update
External storage

Environment Requirements

PHP >= 5.6
PDO_SQLite
GD2
ImageMagick
fileinfo
pathinfo

Main Content

Without further ado, let's get started.

Configuring Pseudo-Static Rewrites

Nginx

text

location / {
try_files $uri $uri/ /index.php?$query_string;
}
location ~* \.(db3|json)$ {
  deny all;
}
location ~* ^/(temp|upload|imgs|data|application|static|system)/.*.(php|php5)$ {
    return 403;
}

Add the above rules into the Nginx server block, and don't forget to reload Nginx once.

Apache

The .htaccess rules are included by default, so no setup is needed.

Installation

Visit https://github.com/helloxz/imgurl/releases to download the latest source code, and extract it to the site root directory. (Mind the directory permissions, mind the directory permissions, mind the directory permissions.)

Visit your domain http(s)://domain.com/install/?setup=1 and follow the prompts to install. If the environment check fails, please resolve the environment issues yourself.

Installing fileinfo & ImageMagick

If you have not installed them, read on.

(The demonstrations all use the BT Panel.)

In the BT Panel backend - Software Management - find the PHP version for your site - Settings for PHP - Install Extensions - tick fileinfo and imagemagick, as shown in the screenshot below.

PS: ImageMagick is not mandatory. This operation requires your ImgURL version to be v2.1 or above.

Final Words

Wishing you a pleasant experience. Hehe, do share generously!

Solutions for Sina Image Hosting Failure

Linus Xiong — Sat, 27 Apr 2019 12:31:00 GMT

Foreword

Recently, Sina Cloud added Referer anti-hotlinking verification to its image hosting service, which broke the referenced images in many bloggers' articles that use Sina as their image host, so they can no longer be displayed. To work around this, we can bypass the Referer anti-hotlinking check through relaying or spoofing.

What is Referer anti-hotlinking

The HTTP Referer is part of the header. When a browser sends a request to a web server, it usually includes the Referer, telling the server which page the request was linked from. The server can use this information for processing. For example, if you link to a friend's site from your homepage, your friend's server can count from the HTTP Referer how many users click the link on your homepage each day to visit their site.

Based on the Referer, the server side can tell which requests come from "allies" and which come from external links, thereby filtering requests and saving server resources.

Our solution is to access resources without sending a Referer, so we need to disguise or relay the request. Without further ado, here are the solutions.

Solutions

PHP File Relay

php

<?php
header('Content-type: image/jpeg');
echo file_get_contents(isset($_GET["url"])?$_GET["url"]:'');

Principle: Pass in the URL and then output the image to display it.

Pros and cons: Statistics components can be used, but efficiency is low, and it requires replacing links in bulk.

Usage: Create a PHP file on a server.

http(s)://your-domain/img.php?url=image-address

Example:

php

<img src="https://your-domain-name/img.php?url=https://ws3.sinaimg.cn/large/006tNbRwly1fyq4yujgssj30jg0jgmxg.jpg" />

(Verified to work)

Using iframe

html

<script>window.sc="<img src='https://blog.xsy.fun/en/posts/2019-04-27-xin-lang-tu-chuang-shi-xiao-jie-jue-fang-an/%E5%9B%BE%E7%89%87%E9%93%BE%E6%8E%A5?%22%3C/span%3E%3Cspan%20style=%22--shiki-light:#D73A49;--shiki-dark:#F97583%22%3E+%3C/span%3E%3Cspan%20style=%22--shiki-light:#24292E;--shiki-dark:#E1E4E8%22%3EMath.%3C/span%3E%3Cspan%20style=%22--shiki-light:#6F42C1;--shiki-dark:#B392F0%22%3Erandom%3C/span%3E%3Cspan%20style=%22--shiki-light:#24292E;--shiki-dark:#E1E4E8%22%3E()%3C/span%3E%3Cspan%20style=%22--shiki-light:#D73A49;--shiki-dark:#F97583%22%3E+%3C/span%3E%3Cspan%20style=%22--shiki-light:#032F62;--shiki-dark:#9ECBFF%22%3E%22'>";</script>  
<iframe id="imiframe" src="javascript:parent.sc" style="border:none; overflow: hidden;" scrolling="no" frameborder="0" onload="javascript:var x=document.getElementById('imiframe').contentWindow.document.images[0];this.width=x.width+10;this.height=x.height+10;"></iframe>

Principle: Reference through an iframe.

Pros and cons: Slow, meh.

(Not verified)

Curl

php

<?php  
$url = $_GET["url"];  
$dir = pathinfo($url);  
$host = $dir['dirname'];  
$refer = $host.'/';  
  
$ch = curl_init($url);  
curl_setopt ($ch, CURLOPT_REFERER, $refer);  
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);//激活可修改页面,Activation can modify the page  
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);  
curl_setopt($ch, CURLOPT_BINARYTRANSFER, 1);  
$data = curl_exec($ch);  
curl_close($ch);  
  
$ext = strtolower(substr(strrchr($img,'.'),1,10));  
$types = array(  
            'gif'=>'image/gif',  
            'jpeg'=>'image/jpeg',  
            'jpg'=>'image/jpeg',  
            'jpe'=>'image/jpeg',  
            'png'=>'image/png',  
);  
$type = $types[$ext] ? $types[$ext] : 'image/jpeg';  
header("Content-type: ".$type);  
echo $data;

Principle: Do not send the Referer.

Pros and cons: Statistics components can be used, but slow, and it requires replacing links in bulk.

Usage: Create a PHP file on a server.

http(s)://your-domain/img.php?url=image-address

Example:

php

<img src="https://your-domain-name/img.php?url=https://ws3.sinaimg.cn/large/006tNbRwly1fyq4yujgssj30jg0jgmxg.jpg" />

(Verified to work)

Meta Tag

html

<meta name="referrer" content="never">

Principle: Do not send the Referer by specifying a meta tag with name set to referrer.

Pros and cons: Statistics components cannot be used, because statistics also rely on this mechanism.

(Not verified)

CSP Response Header

html

<meta http-equiv="Content-Security-Policy" content="referrer">

Principle: CSP (Content Security Policy) is a specification related to page content security. Over HTTP, the Content-Security-Policy field in the response header tells the browser which CSP policy the current page should use.

(Not verified)

Referer Attribute on `<a>` Tags

html

<a href="https://www.xsy.fun" referrer="no-referrer">XSY的FUN天地</a>

Principle: Add a no-referrer policy to the <a> tag.

Pros and cons: This method only affects this single link.

In addition, only three Referrer policies are available for <a> tags: no-referrer, origin, and unsafe-url.

Also, a policy set on an individual link takes precedence over CSP.

Emmm

The best approach is to build your own image host or use object storage.

I recommend Alibaba Cloud OSS: low cost and fast, and it supports global acceleration via CDN (charged separately).

Cloud product universal red envelope: click here

Also, migration solutions have already been shared by experts.

See GitHub: link

Just 3 Lines of Code to Make Thunder Ignore "Download Unavailable Due to a Copyright Holder's Request"

Linus Xiong — Thu, 28 Mar 2019 18:12:00 GMT

Preface

Wow, it's been a long time since I last wrote a post. I've been really busy lately, with homework and everything. This test environment is limited to Thunder Speed Edition (迅雷极速版); it is not guaranteed to work with all clients.

If that really doesn't work, just use Thunder 5 instead. No files need to be modified, you can use it directly, and there are no copyright restrictions.

In fact, the process is quite simple: just modify the hosts file directly.

Tutorial

Step 1

Open the hosts file. The specific file location:

C:\Windows\System32\drivers\etc\hosts

Step 2

Right-click the hosts file, and choose 记事本 to open it.

Step 3

Don't change anything inside. Just add the following three lines of code at the very bottom, then save.

text

127.0.0.1 hub5btmain.sandai.net 
127.0.0.1 hub5emu.sandai.net 
127.0.0.1 upgrade.xl9.xunlei.com

Step 4

Refresh DNS (don't type the corner quotation marks below)

Press the shortcut key Win + R to open the Run dialog, type "cmd", and click OK to open the command prompt window.

In the command line window, type ipconfig /flushdns and press Enter to refresh the local DNS cache data.

PS

If it says administrator permission is required, move the file to the desktop, modify and save it there, then drag it back. That's all!

The blog has been running for one year!

Linus Xiong — Mon, 25 Mar 2019 17:11:00 GMT

The author wrote a short commemorative post marking one full year of stable operation of the personal blog, and published a belated anniversary note.

Uninstalling Alibaba Cloud Monitoring and Blocking Cloud Shield IPs

Linus Xiong — Thu, 07 Feb 2019 12:46:00 GMT

Preface

I'm sure you've all noticed that after booting a cloud server bought from Alibaba Cloud, the processes include AliYunDun, aliyun-service, and AliYunDunUpdate.

These are actually Alibaba Cloud Security (Aegis, 安骑士). They monitor whether the cloud server is secure, can automatically scan for and kill viruses, and can also detect whether the server is running prohibited processes. As for the "Cloud Shield IP" — it is a vulnerability scanner from Alibaba Cloud, mainly used to check whether your server has known vulnerabilities. Alibaba Cloud Security (Aegis) has its benefits and drawbacks. The benefit is that it guarantees your server's security to some extent (though probably not by much). The drawback is that it monitors your cloud server around the clock, so you have essentially no privacy at all — it not only monitors for viruses but also monitors the content you store.

So uninstall the built-in Alibaba Cloud Security (Aegis)! The method is simple: just run the following three commands.

Commands

Uninstall Aegis:

text

wget http://update.aegis.aliyun.com/download/uninstall.sh
chmod +x uninstall.sh
./uninstall.sh
wget http://update.aegis.aliyun.com/download/quartz_uninstall.sh
chmod +x quartz_uninstall.sh
./quartz_uninstall.sh

Delete leftover files:

text

pkill aliyun-service
rm -fr /etc/init.d/agentwatch /usr/sbin/aliyun-service
rm -rf /usr/local/aegis*

Block the Cloud Shield IP:

text

iptables -I INPUT -s 140.205.201.0/28 -j DROP
iptables -I INPUT -s 140.205.201.16/29 -j DROP
iptables -I INPUT -s 140.205.201.32/28 -j DROP
iptables -I INPUT -s 140.205.225.192/29 -j DROP
iptables -I INPUT -s 140.205.225.200/30 -j DROP
iptables -I INPUT -s 140.205.225.184/29 -j DROP
iptables -I INPUT -s 140.205.225.183/32 -j DROP
iptables -I INPUT -s 140.205.225.206/32 -j DROP
iptables -I INPUT -s 140.205.225.205/32 -j DROP
iptables -I INPUT -s 140.205.225.195/32 -j DROP
iptables -I INPUT -s 140.205.225.204/32 -j DROP

Zhongkao (High School Entrance Exam)

Linus Xiong — Fri, 21 Dec 2018 18:34:00 GMT

The blogger is about to take the high school entrance exam (zhongkao), so many issues on the blog have not been dealt with yet. Sorry for the inconvenience.

Clean Mobile WPS

Linus Xiong — Sun, 11 Nov 2018 14:17:00 GMT

I extracted the HTC custom-ROM version of WPS from a certain "ham sausage" phone. It's clean and ad-free. Remember to uninstall the original before installing it!

https://cdn.xsiy.ltd/share/hTC 预装版WPS.apk