The Garden on Daniel Genezini

Why coffee tastes sweet without sugar

Sun, 23 Aug 2026 00:00:00 +0000

Green coffee contains sucrose, glucose and fructose; the roasted bean and the cup contain almost none. Black coffee with no sugar added has no meaningful sugar, yet it can taste distinctly sweet.

Where the sugar goes: roasting drives the Maillard reaction and caramelisation, which consume sugars and convert them into hundreds of aromatic compounds. What is left is a trace of sugar-derived molecules — and with bitterness and acidity reduced around them, the brain reads those as sweetness.

USB WiFi adapters that show up as a CD-ROM

Sun, 07 Jun 2026 00:00:00 +0000

A “multi-state” USB WiFi adapter carries on-board storage with a Windows driver, so on first plug it enumerates as a CD-ROM or flash drive. Windows autoruns the installer; other OSes see only a disk and no network interface, so the adapter must be told to switch.

Most mainstream distributions — Ubuntu, Fedora, Debian, OpenSUSE, Arch — ship usb-modeswitch with the adapter in its data files and switch silently; hand-switch only when the package is missing, the data predates the adapter, or the device is a rebadged clone.

DuckDB: SQLite for analytics, not a vector database

Sat, 06 Jun 2026 00:00:00 +0000

An analytical database embedded like SQLite — no server, one file or in memory — but built for scans, aggregations and joins, not transactions: SQLite for analytics.

Where SQLite stores a row together, DuckDB stores each column separately:

row-oriented: [id=1, name=Alice, age=30] [id=2, name=Bob, age=25]
column-oriented: id: [1,2,3] name: [Alice,Bob,Carol] age: [30,25,40]

SELECT AVG(age) FROM users then reads one column, not every column of every row. It also executes vectorized — chunks of around 1024 rows, not one row at a time — using the CPU cache better and allowing SIMD.

Pausing and resuming a process

Sat, 30 May 2026 00:00:00 +0000

The foreground job

Ctrl+Z sends SIGTSTP to the foreground job: frozen, memory and file descriptors kept open.

jobs # list suspended jobs and their numbers
fg # resume the most recent in the foreground
bg # resume it in the background
fg %2 # resume job 2
bg %2

Anything else

Find the PID, then signal:

ps aux | grep <process_name>
pidof <process_name>
sudo kill -STOP <PID> # or kill -SIGSTOP
sudo kill -CONT <PID> # or kill -SIGCONT

SIGSTOP cannot be caught or ignored — reliable when you do not control the process.

Upgrading Alpine to a new release branch

Sat, 30 May 2026 00:00:00 +0000

Three steps in sys mode — edit the repositories file, refresh the index, upgrade everything; in-branch security updates are separate. Back up and read the release notes first.

Point at the new branch

setup-apkrepos

e opens it in vi; or in one line, moving 3.22 to 3.23:

sed -i -e 's/ v3.22 / v3.23 /g' /etc/apk/repositories

http://dl-3.alpinelinux.org/alpine/v3.22/main
http://dl-3.alpinelinux.org/alpine/v3.22/community

latest-stable avoids editing the file each release:

http://dl-3.alpinelinux.org/alpine/latest-stable/main
http://dl-3.alpinelinux.org/alpine/latest-stable/community

⚠️ latest-stable also means an unexpected release upgrade can begin on its own — the trade for never editing the file again.

Atuin: shell history that syncs

Sun, 24 May 2026 00:00:00 +0000

Atuin replaces shell history search: full-text and fuzzy search over a SQLite database rather than a flat history file, per-directory and per-session context, statistics, optional end-to-end encryption, and sync between machines. In zsh it replaces the default Ctrl+R reverse search.

Setup

eval "$(atuin init zsh)"

Near the end of .zshrc, then exec zsh.

fzf

fzf is optional (Atuin has its own fuzzy search) but still covers file finding, git branch switching, process selection, piped input. Atuin for history, fzf for everything else.

fd and plocate: live search versus an index

Sun, 24 May 2026 00:00:00 +0000

fd is a filesystem walker, a modern find replacement: scans on demand, respects .gitignore by default, takes regex or glob patterns, executes per result.

fd config ~/.config
fd . ~/projects | fzf

plocate is a database-backed filename indexer, compatible with locate: queries a prebuilt index, never touches the disk.

plocate firefox

Trade-off: freshness for speed. fd sees the disk now — current, slow on large trees; plocate is near-instant but knows only what updatedb last indexed, usually via a systemd timer or cron.

Analytics basics: layers, parquet, similarity, clustering

Fri, 08 May 2026 00:00:00 +0000

The factory

Analytics turns raw events — a click, an add-to-cart, a purchase, an approval — into trustworthy, queryable data:

Raw logs → Cleaned data → Business metrics → Dashboards

Databricks layer names, same progression:

Layer	Holds	Shape
Bronze	raw files, as received	append-only, untyped
Silver	cleaned, joined, deduplicated	typed tables
Gold	business metrics	aggregated, query-ready

CSV is the starting interchange format; Parquet is where it settles — columnar, compressed, typed, readable by DuckDB, Spark and Trino. A pipeline’s job is movement between layers; the tool is whichever engine does that without becoming maintenance.

A global gitignore for your own machine

Mon, 04 May 2026 00:00:00 +0000

git config --global core.excludesfile ~/.gitignore_global
touch ~/.gitignore_global

Ignored in every repository on the machine: things about your environment, not the project:

.DS_Store # macOS
Thumbs.db # Windows
.vscode/ # VS Code
.idea/ # JetBrains
*.log
.env

A global ignore is personal, machine-wide, shared with no one. A repository’s .gitignore is committed and shared, describing what the project never wants tracked. Editor and OS junk goes global; project tooling’s output goes in the repo.

Find which process holds a port

Mon, 04 May 2026 00:00:00 +0000

ss is the modern default, usually installed:

sudo ss -lptn 'sport = :3000'

LISTEN 0 128 *:3000 *:* users:(("node",pid=12345,fd=18))

lsof gives a clearer PID plus command path:

sudo lsof -i :3000

netstat on older systems, from net-tools:

sudo netstat -tulpn | grep :3000

Killing the holder — a plain kill first, -9 only if it refuses:

sudo kill 12345
sudo fuser -k 3000/tcp

To check a port is open, ignoring the owner:

ss -tuln | grep :3000

Usual cases: a taken port, or a Docker container colliding with a local process; in containers the answer comes from docker ps or the orchestrator, not ss on the host.

GNOME environment variables and login scripts

Mon, 04 May 2026 00:00:00 +0000

Setting a variable without logging out

A modern GNOME session runs under systemd; GUI applications inherit that environment:

systemctl --user set-environment MY_VAR=value
dbus-update-activation-environment --systemd MY_VAR=value

The first sets it for systemd user services and later shell-launched applications; the second makes D-Bus-activated apps see it, how most GNOME apps start.

echo $MY_VAR prints nothing: variables are copied into a process at start, and your shell predates the change. Shell and systemd user session do not propagate:

SQL Anti-joins

Mon, 04 May 2026 00:00:00 +0000

Rows with no match

Both find rows in TableA with no TableB counterpart:

1
2
3
4
5
6
7
8


SELECT a.*
FROM TableA a
LEFT JOIN TableB b ON b.AId = a.Id
WHERE b.AId IS NULL;

SELECT a.*
FROM TableA a
WHERE NOT EXISTS (SELECT 1 FROM TableB b WHERE b.AId = a.Id);

NOT EXISTS is the better default:

Correctness with NULLs. LEFT JOIN breaks when the join condition is not exactly equivalent, with nullable columns, or when a joined-table filter lands in WHERE instead of ON — silently an inner join. Keep every joined-table filter inside ON:

Symlinked .desktop files, and why the window opens behind

Mon, 04 May 2026 00:00:00 +0000

~/.local/share/applications follows symlinks: a .desktop file can live in dotfiles and be linked in:

ln -s ~/dotfiles/desktop/myapp.desktop ~/.local/share/applications/myapp.desktop

xdg-desktop-menu resolves the link, update-desktop-database indexes it, gtk-launch, rofi and dmenu find it. Mode 644, no execute bit:

chmod 644 myapp.desktop
update-desktop-database ~/.local/share/applications
gtk-launch myapp

A broken symlink makes the launcher vanish silently; Exec= paths resolve literally, not via the symlink.

Exec and $HOME

Exec=$HOME/scripts/open-browser.sh %u

Works on GNOME, KDE and XFCE, but the Desktop Entry specification does not guarantee it — a stricter launcher may not expand the variable. An absolute path always works:

Where HISTSIZE actually comes from

Mon, 04 May 2026 00:00:00 +0000

HISTSIZE is interactive-only, so .zshenv is wrong — it runs for every shell, scripts included. It belongs in .zshrc; several files can set the value you see.

grep HISTSIZE ~/.zshrc
grep HISTSIZE ~/.oh-my-zsh/lib/history.zsh
grep HISTSIZE /etc/zsh*

Oh My Zsh keeps history settings in ~/.oh-my-zsh/lib/history.zsh, defaults above the 1000 that usually prompts the question; system-wide values come from /etc/zshrc, /etc/zprofile or /etc/zshenv.

Value and origin:

echo $HISTSIZE
echo $SAVEHIST
zsh -xv # every file sourced, in order

Change it in .zshrc, then source ~/.zshrc:

ZRAM compression: lzo-rle by default, lz4 for CPU

Mon, 04 May 2026 00:00:00 +0000

ZRAM compresses memory pages in RAM instead of swapping to disk; the algorithm sets the trade between CPU time and memory saved.

The default on most modern distributions is lzo-rle: very fast, low CPU overhead, reasonable ratio. Confirm what is active — the bracketed entry is in use:

cat /sys/block/zram0/comp_algorithm

lzo [lzo-rle] lz4 lz4hc zstd

Algorithm	CPU cost	Speed	Ratio
`lz4`	lowest	very fast	worst
`lzo-rle`	low	very fast	medium
`lzo`	low	fast	medium
`zstd`	higher	slower	best
`lz4hc`	high	slow	better than lz4

Pick lz4 when the CPU is weak or loaded and RAM is cheaper than cycles, lzo-rle for the default balance, zstd when memory is scarce and CPU is not.

Zsh completion: compinit, compdef, and custom commands

Mon, 04 May 2026 00:00:00 +0000

Completion is function-based: on Tab zsh finds a completion function matching the command name, and it must exist. Zsh reads no --help.

Minimum setup:

autoload -Uz compinit
compinit

zstyle ':completion:*' menu select
zstyle ':completion:*' matcher-list 'm:{a-z}={A-Z}'

setopt AUTO_MENU
setopt COMPLETE_IN_WORD

compinit loads completion and builds a dump file, ~/.zcompdump. Rebuild it if changes do not appear, or zsh warns about an insecure completion directory:

rm -f ~/.zcompdump*
compinit

Git completion

Git support is zsh’s own _git function: once compinit has run, these complete on Tab with refs, remotes and branches:

Arch setup notes: firmware, libvirt networking, fingerprint login

Sat, 02 May 2026 00:00:00 +0000

Each line was found once and would otherwise be found again; nothing is distribution-specific but the package manager.

Firmware

sudo pacman -S gnome-firmware

The libvirt default network

libvirt ships the default network inactive: NAT, backed by dnsmasq:

sudo pacman -S dnsmasq
sudo virsh net-list --all
sudo virsh net-autostart default
sudo virsh net-start default

net-autostart survives a reboot; net-start covers only this session.

Flameshot on Wayland

Under Wayland, Flameshot cannot grab the screen from a GNOME shortcut: no terminal to attach to. Wrapping it in script supplies one:

Borg restore, partial loss, and silent exits

Fri, 17 Apr 2026 00:00:00 +0000

Restoring

borg list /path/to/repo
borg list /path/to/repo::daily-2026-01-21 home/daniel
borg extract /path/to/repo::daily-2026-01-21 home/daniel/Documents

extract writes into the current directory and recreates the stored path — from /tmp/restore you get /tmp/restore/home/daniel/Documents, not an overwritten live tree. Listing a subpath confirms the path.

Finding a file

borg list /path/to/repo::archive-name | grep savegame
borg list /path/to/repo::archive-name --pattern '**/*filename*'

Across every archive, slow on a large repo but thorough:

for a in $(borg list /path/to/repo); do
 echo "== $a =="
 borg list /path/to/repo::$a | grep filename
done

Borg has no queryable index: searches read archive listings, so --pattern beats piping through grep.

Borg: what a backup contains, and what retention keeps

Fri, 17 Apr 2026 00:00:00 +0000

What takes the space

borg list --format prints raw byte sizes by field: sort and tail to find heavy files:

borg list --format '{size:>12} {path}{NL}' ~/backup::desktop-2026-05-06 | sort -n | tail -50

1200000000 /home/user/videos/movie.mkv
420000000 /home/user/photos/raw.zip

numfmt --to=iec reads them as 1.2G, 850M, 420M; such findings usually mean a directory to exclude, not a Borg problem.

Verifying without restoring

borg check /path/to/repo
borg check user@host:/path/to/repo
borg check --verify-data /path/to/repo::archive-name
borg check --repository-only /path/to/repo

borg check verifies repository structure, metadata and archive consistency. --verify-data also reads and hashes contents — much slower, the only proof the data is intact. --repository-only limits the check to the repository, an archive argument to that archive.

Channeling: what the naked portafilter is telling you

Fri, 17 Apr 2026 00:00:00 +0000

Channeling is water taking the path of least resistance through the puck: it finds a crack or loose patch and drives a channel through it instead of pushing evenly through the coffee. Parts of the puck get too much water and turn bitter, parts too little and stay sour. Both arrive at once — the signature.

A bottomless portafilter does not cause it. It removes the spouts that were hiding it.

Cloudflare Email Routing into Gmail, and the alerts it does not send

Fri, 17 Apr 2026 00:00:00 +0000

Why forwarded mail lands in spam

Cloudflare Email Routing forwards mail from you@yourdomain.com to an inbox. As a forwarder it becomes the sender Gmail sees, so the original domain’s SPF and DKIM results stop matching the delivering server and Gmail defaults to suspicion. Records must be relaxed, not strict.

v=spf1 include:_spf.mx.cloudflare.net ~all

v=DMARC1; p=none; sp=none; aspf=r; adkim=r; rua=mailto:dmarc-reports@yourdomain.com

aspf=r and adkim=r stop a forwarded message being penalised for a check it cannot pass. p=none is the starting policy; quarantine or reject comes later, once delivery is stable.

Dialing in espresso: dose, yield, time

Fri, 17 Apr 2026 00:00:00 +0000

“Dialing in” comes from the analog dial — the knobs on an old radio, later an espresso machine’s pressure gauge. It means tuning the variables until the shot tastes right.

The variables

Grind size is the most sensitive and the one you move; the rest are constants you hold still:

Variable	Value
Dose (double basket)	17–18 g
Yield	36–40 g
Time	25–30 s
Ratio	1:2

A Gaggia Classic Pro with its stock non-pressurized 58 mm basket works at 18 g in, 36 g out. Brew temperature is the fifth variable, and without a PID it is not under your control.

Fingerprint login: PAM decides who gets asked

Fri, 17 Apr 2026 00:00:00 +0000

fprintd owns the reader and answers authentication requests; the attempt count before password fallback is a parameter on the PAM module line that calls it.

Is the reader or the PAM stack the problem

fprintd-list "$USER"
fprintd-verify
systemctl status fprintd
lsusb

fprintd-verify success means the reader and stored prints are fine; the failure is the desktop’s PAM configuration. Fedora generates PAM files from profiles:

authselect current
authselect check
grep -R "pam_fprintd" /etc/pam.d/ /etc/authselect/ 2>/dev/null

That grep lists every service accepting a fingerprint, and by omission those that do not.

Giving containers their own DNS

Fri, 17 Apr 2026 00:00:00 +0000

Editing /etc/resolv.conf in a running container does not stick — Docker overwrites it on start and on networking changes. Configure the resolver at one of three levels:

Per container:

docker run --dns=1.1.1.1 --dns=8.8.8.8 myimage
docker exec -it <container> cat /etc/resolv.conf

Per Compose service:

services:
 app:
 image: myimage
 dns:
 - 1.1.1.1
 - 8.8.4.4

Daemon-wide, in /etc/docker/daemon.json, then sudo systemctl restart docker:

{
 "dns": ["1.1.1.1", "8.8.8.8"]
}

--dns on the container overrides the daemon setting.

GNU Stow for dotfiles

Fri, 17 Apr 2026 00:00:00 +0000

Stow symlinks a central config directory into place; nothing is copied, so editing ~/.zshrc edits the repository file.

sudo apt install stow # Debian, Ubuntu
sudo pacman -S stow # Arch
brew install stow # macOS

Each package mirrors the target:

~/dotfiles/
├── zsh/.zshrc
├── git/.gitconfig
└── nvim/.config/nvim/init.lua

cd ~/dotfiles
stow zsh
stow zsh git nvim
stow */

Exact structure: zsh/zshrc links nothing, zsh/.zshrc does. Preview with a dry run:

stow -n -v zsh

What it links in .config

nvim/.config/nvim/init.lua in the repository makes stow nvim produce:

Honey and Black Honey: how much mucilage stays on the bean

Fri, 17 Apr 2026 00:00:00 +0000

Green coffee is processed three ways: washed (fruit and mucilage stripped before drying), natural (dried whole inside the fruit), or honey — depulped, with some mucilage left on the bean through drying. Honey sits between washed and natural, and the colour name says how much sticky layer was kept.

Type	Mucilage kept	Cup
White Honey	Little	Cleaner, lighter body
Yellow Honey	Some	Sweet, balanced acidity, medium body
Red Honey	More	Sweet, syrupy mouthfeel
Black Honey	~100%	Heavy, creamy, molasses and toffee

Why Black Honey is expensive

The mucilage is sugar, so the bean dries inside a sticky food. The producer must:

rclone: sync versus copy, deletions, and local encryption

Fri, 17 Apr 2026 00:00:00 +0000

The one difference that matters

Command	Copies new/changed	Deletes on target
`rclone copy source/ remote:target/`	yes	no
`rclone sync source/ remote:target/`	yes	yes

sync mirrors the destination exactly: delete a save locally, run sync, and the remote copy goes too. Wrong default for backups — copy leaves anything the source no longer has.

Always preview a destructive run:

rclone sync /path/to/source remote:path/to/dest --dry-run -v

--delete-before changes when deletions happen relative to the transfer, not whether they happen. copy with --delete-excluded is the middle option when exclusions should also propagate.

What to back up on Arch, and a Borg command that does it

Fri, 17 Apr 2026 00:00:00 +0000

/etc is 10–50 MB of mostly text: take the whole directory, not cherry-picked configs:

pacman -Qqe > ~/pkglist.txt # explicitly installed
pacman -Qqm > ~/aur-pkglist.txt # from the AUR

Those two lists make a rebuild an hour, not a weekend. Easy to forget beyond /etc: ~/.config, the shell dotfiles, ~/.ssh, ~/.gnupg, ~/.gitconfig, the bootloader config — /etc/default/grub for GRUB, /boot/loader/ for systemd-boot, outside /etc.

One Borg run covering system, user config and package state:

zsync: updating a big file over plain HTTP

Fri, 17 Apr 2026 00:00:00 +0000

zsync delivers a new version of a file you already have. The server publishes a small .zsync sidecar of block checksums for the target file:

ubuntu.iso
ubuntu.iso.zsync

The client reads it, examines the local file, and fetches only changed blocks:

zsync http://example.com/ubuntu.iso.zsync

For a 4 GB ISO with 300 MB of changes, that is roughly 300 MB transferred instead of 4 GB.

At scale the key property: the server needs nothing special — an ordinary web server or CDN, and no copy of your old file:

inotify limits: instances, watches, and what a monorepo exhausts

Tue, 14 Apr 2026 00:00:00 +0000

Two sysctls, two limits, both per user:

Setting	Limits	Default
`fs.inotify.max_user_instances`	inotify instances one user may create	128
`fs.inotify.max_user_watches`	watches one user may attach	8,192

An instance is one inotify_init() / inotify_init1() file descriptor — an fsnotify group, an event queue, the descriptor, and indexing structures for its watches. A watch is one attachment to an inode, bookkeeping linking watch, instance and inode.

Many tools opening listeners exhaust instances; few listeners over many files exhaust watches.

Reverting a protected branch with git restore

Tue, 10 Jun 2025 00:00:00 +0000

develop and main are usually protected — no reset, no force-push — so undoing means new commits on top. git revert needs a commit range and a -m parent decision per merge commit: many chances to pick wrong.

git revert 4dbcaf5419d5b5aa19776d7ed733a163cacd95fe..dbffeb4da345fd0c66b0b7a8193a6582b409cd4a

The fallback is a second clone: target branch checked out elsewhere, everything but .git deleted, the good branch’s contents copied in, commit — works, miserable.

The one-liner

git restore copies files out of any revision into the working tree without touching the index, unlike git checkout or git reset, which move it — so the desired tree pulls in on the protected branch:

Rebasing a messy branch in one conflict pass

Tue, 18 Apr 2023 00:00:00 +0000

On a branch drifted behind a busy main, git rebase origin/main conflicts on the first commit and again on each remaining one — 16 instead of one. Rebase an empty branch and replay the work as one uncommitted change.

git checkout branch-to-rebase
git fetch --all
git merge-base branch-to-rebase origin/main # last commit before the branch's own work

Reset to it: the branch’s differences return to the working tree, unstaged:

git reset f9fb326cb6cd58e0f31b433389b4a76f60319db1

Stash it; the rebase has nothing to conflict over:

Git aliases: scopes, shell escapes, and the ones I use

Wed, 04 Jan 2023 00:00:00 +0000

An alias is an ordinary config entry: it exists only in the scope where created (git log --graph --oneline → git graph), shell commands included.

Scope	Applies to	Config file
`local`	the current repository	`.git/config` (Windows: `.git\config`)
`global`	the current user	`~/.gitconfig` (Windows: `%USERPROFILE%\.gitconfig`)
`system`	every user on the machine	`/etc/gitconfig` (Windows: `%PROGRAMDATA%\Git\config`)

Creating one

git config --global alias.c "checkout"
git config --global alias.ec "commit --allow-empty -m 'Empty commit'" # single quotes when the command has double quotes

Or under [alias] in the config file:

Git one-liners: prune, empty commits, show, grep, graph

Tue, 27 Dec 2022 00:00:00 +0000

Each deletes a step: four commands, a branch switch, or a commit you did not mean.

Prune on fetch

--prune drops local refs to remote branches deleted upstream:

git fetch --prune

Stale refs accumulate with branch churn; git branch -a --contains <commit> gets verbose and slow.

Merge or rebase without checking out the target

A fetch already placed the remote’s refs locally as origin/…, and a branch is just a commit reference — no checkout, pull or checkout-back: