Posts on AveryanAlex's blog

PicSavBot: a bot for saving and searching images

Tue, 02 Apr 2024 12:59:30 +0300

Why PicSavBot?

Have you ever wanted to send a pic in a chat, you remember what was on it, but you can’t find it in your gallery? I have. That’s exactly why I created the Telegram bot @picsavbot to solve this problem. Just send it the images you like (as well as stickers and videos) and it will save them to your personal library. Now you can use that very pic at the perfect moment in any chat by simply typing @picsavbot description of the pic in the input field.

How to write good queries

If you type “fat cat”, first (provided you have such images) you will see fat cats, then just cats, and then, most likely, other animals. The CLIP neural network is not very good at reading text, but it does understand some English. On the other hand, it often recognises logos — for example, Minecraft or the SCP Foundation — quite well. But it knows almost nothing about memes, so write descriptions of what is in the picture as if you were explaining it to your grandma.

What you want to find	Good search query
Shlyopa	Cat with big ears
Gigachad	Muscular man
Gachi meme	Fight in a locker room
Mental hospital	Orderly reaching out his hand
It’s Wednesday my dudes	Frog
Among Us	Red astronaut

How the bot works

You send an image/sticker/video to the Telegram bot @picsavbot; it passes it to the neural network CLIP (the model used is LAION’s CLIP-ViT-H-14-laion2B-s32B-b79K) and saves the resulting multi-dimensional vector representing the image content to a PostgreSQL database extended with the pgvector plugin for vector storage and search. When saving an animated sticker or video, the preview frame (usually the first frame) is taken.

To find the desired pic among the saved ones, you can type @picsavbot picture description in the message field of any chat. Using Yandex.Translate, the bot will translate the entered description into English, analyse it with CLIP and find the most suitable images in the database by their cosine similarity.

When you send one of the found images, the bot increases its usage count in its database, and if there is no search query (you type @picsavbot without anything else) it will first show the most frequently used pics and stickers.

About the project

Source code: averyanalex/picsavbot.

Programming languages: Rust, Python.

Key libraries: tokio (asynchronous runtime), teloxide (framework for building Telegram bots), seaorm (database interaction).

How Laziness and Curiosity Saved Me Dozens of Hours

Tue, 26 Mar 2024 23:08:36 +0300

About the Project

Source code: github.com/averyanalex/matetech-answers-bot.

Programming languages: Rust, SQL.

Key libraries:

tokio (asynchronous runtime)
reqwest (HTTP client)
sqlx (database driver)
teloxide (framework for building Telegram bots)

Creation Story

In 9th grade I enrolled in an “olympiad” school—a good one with almost no “extra” subjects, so you could peacefully prepare for competitions. Many non-core subjects, like biology, were given as so-called distance courses that worked roughly like this: open the e-learning site, watch a 10–15-minute lecture, take a quiz while ~~searching the answers online~~, and get your well- earned 80–100 % score.

The Idea and the First Version

The process was honestly pretty boring. And what do you do when it gets boring with a browser tab open? Right—you open the developer tools. Poke at the elements and show your friends how you got 200 % on a quiz in 3 seconds. Open the Network tab and watch what the site sends where while you’re doing the quiz. Finish a quiz and open the results…

And it turns out the JSON with the results contains the correct answers, even though the site itself doesn’t show them! Interesting. Let’s dig deeper. Copy the request as curl and run it in the terminal. Great, we can see that JSON. Start a new quiz, change the attempt ID in the request, and… we get a response from the server! With the quiz results (and the right answers) before finishing the quiz itself.

The find was interesting, of course. But I also wanted to help my classmates and not have to open the console every time. I asked a friend to send me the attempt ID of one of his quizzes, substituted it… it worked! I removed the authorization header from the request—access error. So the genius developers of the platform did check for the presence of authorization (as I recall, a valid one—a random token won’t work), but completely skipped the permission check. Well, good job guys, at least you did something.

The rest was just engineering. I wrote a simple Telegram bot in Python that, given a quiz ID, sent all the answers. But I didn’t want to “out” that the answers were essentially public on the site, or reveal the bot. I rewrote the bot—now when it sees an attempt ID it hasn’t encountered before it posts the answers to a public Telegram channel, as if the quiz had been solved manually and the site had no bugs.

Word-of-mouth did its job—in a year the channel had several hundred subscribers.

The Second Version

The vulnerability—actually a gaping hole—was so obvious that many people found it. By the next year one ~~brilliant~~ weird student of the math-IT track made a project titled something like “Vulnerabilities of the Distance Course Platform.” I don’t know what exactly was in it, but some issues were fixed afterwards. First, fetching somebody else’s quiz results became impossible. Second, for multiple-choice questions the correct answer stopped being displayed in the results.

It was clear the bot needed to become more sophisticated, and I didn’t want to develop that Python prototype further (it had already worked for more than a year). A friend and I decided to write a new version in Rust since we knew it better. We implemented login with token saving to the database, so we could get quiz results for different users.

The only remaining problem was with multiple-choice questions—unlike text input ones, there were no answers. But after carefully looking at the JSON I noticed a score field. It turned out to be 0 if the current saved answer is wrong and

0 if it’s correct. Perfect, we can simply iterate over all options until the score changes.

Of course, this required teaching the bot to answer questions on its own. In general it wasn’t too hard, and as a bonus we gained the ability to automatically complete the quiz, not just fetch the answers. Cool—now “quizzes are solved automatically for everyone, and nobody even opens them!” (A reference to a sketch at the 9th-grade graduation. Back then it wasn’t true yet.)

That’s roughly how, after a couple of evenings of Rust coding, the second version of the bot for getting distance-course answers was written. We released it, posted a link in the Telegram channel. Not everyone rushed to sign up—many were afraid to send their login/password from the course site to our bot. But, as they say, that’s their problem: if they don’t want to use it—they don’t have to.

Attempts to Shut the Bot Down

Soon some enterprising school students decided to try making money off it. They created their own similar bot (with pay-per-use) and started messaging me with proposals to shut mine down. Actually, I think they first tried back when instead of a bot there were Telegram channels, but less actively.

They offered super “profitable” (not) deals: make my bot paid with the same price as theirs, or shut it down and get up to 10 % of their profit. I of course refused and jokingly offered them a price of 300 k. For some reason they weren’t happy. I thought that was it, but no…

They created a channel where they started claiming that I, allegedly, made the bot to steal account credentials and complete quizzes for 0 points. They created a fake profile of me, screencapped chats supposedly with me where “I” say that cheating is bad and therefore I completed their quizzes with zeros. I don’t know who believed them—seems almost no one. I still don’t know who those people were and frankly I don’t care.

Examples of Platform Bugs

Installing Yggdrasil on Windows

Wed, 14 Dec 2022 23:33:19 +0300

What is Yggdrasil?

Yggdrasil is a decentralized mesh network where every participant is equal. Each computer in the network (a node) is assigned a static public IPv6 address, and any other participant can reach it directly.

This can be used, for example, to play network games across different local networks. One player runs a Minecraft server without paying for an external (“white”) IP address, and another player from a different city connects to it via Yggdrasil.

Installation

Let’s get started: we’ll download and install Yggdrasil, configure peers to connect to the rest of the network, check that everything works, and obtain our own IP address.

Download the installer

Open the page with the latest Yggdrasil release on GitHub.

Find the file yggdrasil-x.y.z-x64.msi (for version 0.4.7 this is yggdrasil-0.4.7-x64.msi). If you have a 32-bit system (from the 2000s), download yggdrasil-x.y.z-x86.msi instead.

Installing the MSI

Open the downloaded MSI file.

Confirm the launch by clicking Run.

When prompted, grant the installer administrator rights.

The installer window will open and no additional questions will be asked. After installation finishes (it takes only a few seconds) the window will close automatically.

That’s it for the installation process, now let’s proceed to configuration.

Error 2503

Sometimes the 2503 error appears when installing MSI files. Open the properties of the folder C:\Windows\Temp, go to the Security tab and make sure that the Administrators group and your user (add it if it isn’t listed) have full permissions. Information taken from Microsoft Community.

Configuring peers

Peers are the servers Yggdrasil connects to in order to reach the rest of the network.

It is better to choose one common, stable peer for all players – this minimizes ping and prevents other people’s traffic from passing through your connection (public peers are responsible for forwarding traffic).

Choosing peers

There is a repository with a list of public peers on GitHub. Peers are grouped by continent, country and city. Choose peers that are geographically closer to the host – this will reduce ping for all players.

For example, you can use my peer (Moscow): tls://ygg-msk-1.averyan.ru:8363 or quic://ygg-msk-1.averyan.ru:8364 (the quic variant is preferable if it works for you and isn’t blocked).

However, not all of them may work – you can check the list of available peers on the developer’s website.

Editing the config

Press Win+R to open the Run dialog. Enter the path to the config: %ALLUSERSPROFILE%\Yggdrasil\yggdrasil.conf

Click OK. If Windows asks how to open the file, choose Notepad.

Insert the peers you chose into the Peers list:

1
2
3
4


Peers: [
 tls://ygg.averyan.ru:8362
 tcp://box.paulll.cc:13337
]

Save the file with Ctrl+S or via the File menu.

Restarting Yggdrasil

For Yggdrasil to apply the new settings, it needs to be restarted. The most obvious (but slow) way is to reboot the computer. Instead, we’ll restart it via Task Manager.

Open Task Manager with Ctrl+Shift+Esc or by right-clicking the Windows icon (Start button) on the taskbar.

If the simplified Task Manager opens, click More details.

Open the Services tab, find Yggdrasil at the very bottom, right-click it and choose Restart.

Final steps

Installation and configuration are complete – let’s check that everything works and find out our IP address.

Checking functionality

Open Command Prompt.

Enter the command "C:\Program Files\Yggdrasil\yggdrasilctl.exe" getPeers to view the list of connected peers. There should be as many as you configured. If there are fewer, some peers are unavailable.

If an error occurs when entering this command, try rebooting the computer.

Try opening and pinging the Yggdrasil website (available only from the Yggdrasil network and may load quite slowly):

1

ping [319:3cf0:dd1d:47b9:20c:29ff:fe2c:39be]

Getting your IP address

To find out your own IP address, enter the command "C:\Program Files\Yggdrasil\yggdrasilctl.exe" getSelf:

The highlighted line will show your IPv6 address in the Yggdrasil network.

You’ll notice that the ping to your own address is practically zero.

Configuring games

Yggdrasil is now installed on your computer and running. Let’s use it for network games.

Minecraft

Install Yggdrasil on the device that will host the server and on those that will connect to it.

Start a LAN game on the host (Open to LAN) and note the port:

Find out the host’s IP address. (In my case it is 200:d08:17f6:af6e:b285:16de:d3ba:387a)

Connect to the server (enter the IP in square brackets and specify the port after the colon):

If you can’t connect, try configuring the Windows Firewall or turning it off completely, and also check the ping to the host.

Done! Now you can play Minecraft with your friends at any time.

Nix flakes for Hugo site

Tue, 29 Nov 2022 15:31:37 +0300

Advantages of managing Hugo website with Nix

Reproducible builds: Nix allows you to reproducible build your Hugo website across multiple machines.
Dependency management: Nix makes it easy to manage theme, other dependencies and even Hugo itself for your website.
Easy deployment: just set root of your nginx virtualHost to site’s package.

Setup your site

Write flake.nix

This is an example of flake.nix I use for this blog, adapt it for your needs.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58


{
 description = "AveryanAlex's personal blog";

 inputs = {
 nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
 flake-utils.url = "github:numtide/flake-utils";

 # Import theme
 stack = {
 url = github:CaiJimmy/hugo-theme-stack;
 flake = false;
 };
 };

 outputs = { self, nixpkgs, flake-utils, stack }:
 flake-utils.lib.eachDefaultSystem (system:
 let
 pkgs = nixpkgs.legacyPackages.${system};

 blog = pkgs.stdenv.mkDerivation {
 name = "blog";
 # Exclude themes and public folder from build sources
 src = builtins.filterSource
 (path: type: !(type == "directory" &&
 (baseNameOf path == "themes" ||
 baseNameOf path == "public")))
 ./.;
 # Link theme to themes folder and build
 buildPhase = ''
 mkdir -p themes
 ln -s ${stack} themes/stack
 ${pkgs.hugo}/bin/hugo --minify
 '';
 installPhase = ''
 cp -r public $out
 '';
 meta = with pkgs.lib; {
 description = "AveryanAlex's personal blog";
 platforms = platforms.all;
 };
 };
 in
 {
 packages = {
 blog = blog;
 default = blog;
 };

 devShells.default = pkgs.mkShell {
 buildInputs = with pkgs; [ hugo ];
 # Link theme to themes folder
 shellHook = ''
 mkdir -p themes
 ln -sf ${stack} themes/stack
 '';
 };
 });
}

Setup direnv

1
2
3


echo use flake >> .envrc
echo .direnv >> .gitignore
direnv allow

Add result to .gitignore

Result folder is a symlink to built website created by nix build command.

1

echo result >> .gitignore

Preview and build

Run development server:

1

hugo server -D

Build production release with nix:

1

nix build

Deploying to nginx webserver

Now we will create nginx virtualHost config for the site.

Add website to server’s flake inputs:

1
2
3


{
 inputs.blog.url = "github:averyanalex/blog";
}

Setup nginx virtualHost to serve your site:

1
2
3
4
5
6
7
8
9


{ inputs, pkgs, ... }:

{
 services.nginx.virtualHosts."averyan.ru" = {
 root = inputs.blog.defaultPackage.${pkgs.hostPlatform.system};
 useACMEHost = "averyan.ru";
 forceSSL = true;
 };
}

How to Check FLAC Quality?

Sun, 28 Aug 2022 18:19:11 +0300

How can we tell apart lossy codecs such as MP3?

I will not go into detail about how lossy audio codecs work—you can read about it in the Wikipedia article on audio data compression. To spot fake FLAC files created by converting from MP3 we will take advantage of the fact that lossy compression chops off high frequencies. For example, a 320-kbit MP3 removes everything above 20 kHz (for lower bitrates the cutoff is even lower). In lossless formats such as FLAC the audio remains in its original form.

Installing the spectrum analysis program Spek

Spek is a free, open-source spectrum analyzer for audio files that runs on Windows, Linux and macOS. It will help us identify fake FLAC.

Windows, macOS: spek.cc.

On Linux, most distributions provide the package spek.

Checking FLAC files for authenticity

Open the audio file you are interested in with Spek and look at its frequency spectrum.

As examples we will use Status Quo – “In The Army Now”, transcoded from a 320-kbit MP3, and AC/DC – “T.N.T.” preserved in lossless quality.

Example spectrum of a genuine FLAC

Example spectrum of a fake FLAC transcoded from MP3

The MP3 spectrum cutoff at 20 kHz is clearly visible.