Scott Leggett on @smlx's blog

OpenAI / Hugging Face hack

scott@smlx.dev (Scott Leggett) — Mon, 10 Aug 2026 17:32:28 +0800

I think this Hugging Face / OpenAI “model sandbox escape” drama is overhyped but not for the reasons I’ve seen written up in many places. And I think that we are still stuck on OpenAI’s preferred framing, which is that their model has scary capabilities that allowed it to escape a secure sandbox.

Yes, this hack was objectively impressive. The exploit development, pivoting, and privilege escalation was quality work. See Simon Willison’s write up for details.

Book Review: A Philosophy of Software Design by John Ousterhout

scott@smlx.dev (Scott Leggett) — Thu, 13 Jun 2024 23:40:10 +0800

## Introduction

I picked up this book after reading an interesting blog post that mentioned it in passing. Given Lars’ recommendation I knew the book would be good.

I usually don’t have much time for reading and this book sat on my desk for a week or so before I caught COVID again and suddenly found myself with time to kill while otherwise lying on the couch feeling very average.

Reverse-engineering an encrypted IoT protocol

scott@smlx.dev (Scott Leggett) — Thu, 15 Feb 2024 00:04:52 +0800

## TL;DR

I reverse-engineered the encrypted protocol GoodWe smart meters and solar inverters use to send metrics to the cloud.
I used this research to build a prometheus exporter.

## The Sun: so hot right now

I got a solar PV system installed in my house in mid 2023. I did the bare minimum of research beforehand - just talked to a couple of different installers about pricing, sizing and the economics of a battery.

Recovering a BTRFS pool after drive failure

scott@smlx.dev (Scott Leggett) — Sat, 16 Dec 2023 21:01:13 +0800

## My NAS

My NAS is cobbled together from an old workstation and a bunch of drives cannibalised from other machines over the years. Not only are the drives second-hand, consumer grade, and of varying ages and brands, but they are also all different sizes - ranging from 250 GB up to 2 TB in size. Any competent sysadmin would take one look and run away screaming, but it has held up surprisingly well for years.

Kubernetes Node Setup Jobs aka Run-Once Daemonsets

scott@smlx.dev (Scott Leggett) — Sat, 19 Nov 2022 20:24:39 +0800

## Managed Kubernetes restrictions

Managed Kubernetes takes a huge operational burden off your shoulders. You can have perfectly elastic infrastructure where nodes scale in and out of your cluster as workload requirements change. It’s convenient, but it does come with limitations.

One I ran into recently is running setup commands on the nodes in your cluster when they start.

For example, what if you need to configure a kernel parameter on your nodes for one of your workloads? Upstream Kubernetes has a short list of “safe” sysctls, and some managed clouds expand that list slightly. But if the sysctl you want to configure is not in that list it doesn’t seem possible to configure it using the provided managed Kubernetes interface.

Cheating at Wordle using grep

scott@smlx.dev (Scott Leggett) — Sat, 22 Oct 2022 21:34:06 +0800

## Motivation

Wordle is a puzzle intended to exercise your vocabulary and logical reasoning skills. But what if you just want to procrastinate by writing some simple regular expressions? Read on to find out how!

## Prerequisites

A word list matching the language of the puzzle is required. On Debian you will probably have a symlink at /etc/dictionaries-common/words pointing to a suitable list. If not, apt install wamerican or similar.
grep

## Encoding the puzzle

Every time you guess a word, the letters are colour-coded by the puzzle to provide information about the solution. This information can be encoded as regular expressions to find the solution - often within two or three guesses, and almost always within four.

UDP tee

scott@smlx.dev (Scott Leggett) — Sun, 02 Oct 2022 16:55:28 +0800

## The problem

I had to migrate an old logging system to a new logging system, where one logging source was emitting syslog over UDP. During the migration we needed to keep the old system in place, and in parallel set up new system for validation and UAT before finally cutting over. The simplest solution I could think up was to duplicate the UDP syslog packets, and send them to both logging systems simultaneously. In other words, “UDP tee”.

Avoid kubectl's global state

scott@smlx.dev (Scott Leggett) — Sun, 28 Jun 2020 13:02:59 +0800

## The problem

kubectl is the new, cloud-native ssh. That is, it’s the low-level tool to break out when you need to manually inspect or manipulate the state of your running applications.

ssh makes it easy to pop open a few virtual terminal windows to perform different tasks on several systems at once. Each virtual terminal window and its PTY encapsulates its own running state. There’s no way that cd-ing into a directory in one window affects the current working directory in another window.

Dahua NVR DAV files

scott@smlx.dev (Scott Leggett) — Tue, 24 Apr 2018 21:31:37 +1000

Dahua are a white-label OEM who are apparently responsible for many common models of IP camera and Network Video Recorder (NVR) systems. Files exported from such a system have a .dav extension and a header identifying the manufacturer:

$ hexdump -Cn 1024 NVR_ch1_main_20180416.dav
00000000 44 41 48 55 41 22 05 00 25 5c 21 49 da 60 21 49 |DAHUA"..%\!I.`!I|
00000010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00000020 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00000030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00000400

These files seem to be some proprietary format containing multiple H.264 streams concatenated with framing and other data data. If the streams are from different cameras, they can also be different resolutions.

About

scott@smlx.dev (Scott Leggett) — Mon, 01 Jan 0001 00:00:00 +0000

## Me

Hi, I’m Scott, and I currently live in Western Australia.

I blog about software, cloud, infosec, and miscellaneous other stuff.

### Contact

I have a Github account, or you can contact me via Email or Mastodon