lucaswerkmeister

( function() {
  let list = '';
  for ( let checkbox of document.querySelectorAll( 'input[type=checkbox]' ) ) {
    let checked = checkbox.checked,
        title = checkbox.value,
        labelElement = checkbox.nextElementSibling.querySelector( 'a' ),
        text;
    if ( !labelElement ) {
      labelElement = checkbox.nextElementSibling;
    }

lucaswerkmeister

I use these files to keep my package manager metadata up to date. pacman-update automatically downloads package updates so that I don’t have to wait for the download when I actually go to upgrade the system, pacman-mirrorlist-update makes sure that the mirror list is not too outdated, and the tmpfiles.d configuration makes sure that all the updates downloaded by pacman-update (which may include many intermediate versions if I don’t upgrade for a while) don’t stay around forever.

To set up these files, copy the .service and .timer files into /etc/systemd/system/, and the pacman.conf file into /etc/tmpfiles.d/.

lucaswerkmeister

WDQS Workshops

Basic structure of one of my Wikidata Query Service workshops, or rather, idealized version of it that I hope to get close to :)

• before the workshop: zoom in on all domains you’re likely to visit, at least www.wikidata.org and query.wikidata.org, until text is readable from the back of the audience (I usually go for ~150%).

lucaswerkmeister

# Shape Expression for Diseases in Wikidata
PREFIX wd: <http://www.wikidata.org/entity/>
PREFIX p: <http://www.wikidata.org/prop/>
PREFIX ps: <http://www.wikidata.org/prop/statement/>
PREFIX pq: <http://www.wikidata.org/prop/qualifier/>
PREFIX pr:  <http://www.wikidata.org/prop/reference/>
PREFIX prov: <http://www.w3.org/ns/prov#>
PREFIX xsd: <http://www.w3.org/2001/XMLSchema#>
PREFIX do: <http://purl.obolibrary.org/obo/DOID_>

lucaswerkmeister

[Service]
# read /var/lib/dehydrated/
CapabilityBoundingSet=CAP_DAC_OVERRIDE
# bind port 80 + 443
CapabilityBoundingSet=CAP_NET_BIND_SERVICE
# drop privileges to www-data
CapabilityBoundingSet=CAP_SETUID CAP_SETGID
# call ulimit
CapabilityBoundingSet=CAP_SYS_RESOURCE
# partially mitigate CAP_DAC_OVERRIDE

lucaswerkmeister

• Team members can read previous chat history.
• Team members can delete files created by other people.
• Team members can’t see open invitations.
• Team members can force-push to repositories.
• Writers can create repositories but can’t delete them.

lucaswerkmeister

#!/bin/bash

# connect to memcached
exec 3<>/dev/tcp/"${1:-localhost}"/"${2:-11211}" || exit $?

# get slab numbers
printf 'stats slabs\r\n' >&3
slabnums=()
while IFS=' :' read -r stat slabnum _; do
    if [[ $stat == $'END\r' ]]; then

lucaswerkmeister

3895425	it	categoria di un progetto Wikimedia
3891884	pt	categoria de um projeto da Wikimedia
3888246	nl	Wikimedia-categorie
3888102	en	Wikimedia category
3886361	de	Wikimedia-Kategorie
3861284	fi	Wikimedia-luokka
3855693	pt-br	categoria de um projeto da Wikimedia
3854952	da	Wikimedia-kategori
3854769	nn	Wikimedia-kategori
3854730	nb	Wikimedia-kategori

lucaswerkmeister

From 11877d32d707b9e6e219096a95936239d809cfad Mon Sep 17 00:00:00 2001
From: Lucas Werkmeister <[email protected]>
Date: Sat, 22 Jul 2017 20:57:07 +0200
Subject: [PATCH] Add ProtectSystem=yes to [email protected]
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In the root tmux session, I often view files with Emacs, just for the
syntax highlighting. To make sure I don’t accidentally edit them, let’s

lucaswerkmeister

[Service]
# change user for worker processes
CapabilityBoundingSet=CAP_SETUID CAP_SETGID
# bind to ports 25 and 587
CapabilityBoundingSet=CAP_NET_BIND_SERVICE
# explore /var/spool/postfix subdirectories as root (owned by postfix:root, not accessible to group)
CapabilityBoundingSet=CAP_DAC_OVERRIDE
# chroot to /var/spool/postfix
CapabilityBoundingSet=CAP_SYS_CHROOT