KV Tech Tips

Removing a Hybrid MBR from a GUID-Partitioned Disk

2026-08-07T19:49:20Z

Today I learned about hybrid MBR/GUID partition tables, where the GPT (not that kind) on a disk is duplicated in an MBR table for compatibility purposes. Those reasons are probably outdated, unless you’re running a really old operating system, because GUID partitions have been around a very long time now.

Fun fact 1: This means a disk can have an MBR pointing to a partition that MBR doesn’t support, like a multi-terabyte filesystem!

Fun fact 2: If Windows sees an MBR, it doesn’t bother with the GUID table, and it insists that partition is invalid! (Yes, even if you specifically formatted it with exFAT so Windows could read it.)

macOS at least used to automatically create these when adding FAT filesystems, and if it still does, that probably explains how this external drive ended up with the hybrid MBR on it. Though if it does so when creating a >2TB system, I’d consider that a bug.

Repair by Removing the Extra MBR

Fortunately, it turned out to be easy to fix using the directions in this SuperUser post from 2012, because we don’t need the duplicate MBR for anything here in 2026.

We used gdisk to create a new protective MBR table, leaving the GUID table unchanged. It fixed the problem and took less than a minute. We didn’t even have to jump through hoops to install it since we had a Fedora box handy and installing was just a matter of dnf install gdisk.

Here’s what gdisk’s author suggested for converting the hybrid MBR disk to a standard GPT disk:

Download GPT fdisk from its Sourceforge page and install it. (Versions are available for Linux, OS X, and Windows. I’ll assume you’ll do this from OS X.) Alternatively, you could run it from a Linux emergency disc like Parted Magic. [KV Note: If you have a Linux system already, check whether gdisk or gptdisk is available directly from your distro’s package manager.]

Launch gdisk on your disk by typing sudo gdisk /dev/disk1 in a Terminal window. (Change the device identifier if it’s not as you presented earlier or if you use another OS for the job.)

Type p to view the partition table to verify you’re working on the correct disk. If not, type q to quit without saving your changes and try again with another device.

Type x to enter the experts’ menu.

Type n to create a fresh protective MBR. Note that gdisk won’t confirm a change; it’ll just show you a new experts’ prompt.

Type w to save your changes. You’ll be asked to confirm this action. Do so.

With any luck this will fix the problem. If it doesn’t, though, you can use gdisk’s v option (on any menu) to have gdisk look for partition table problems. It can fix some minor problems automatically, but other times you’ll need to make explicit changes. See the GPT fdisk documentation on GPT repairs for details.

I also looked up what a protective MBR is: On a regular GUID-partitioned disk, a protective MBR covers the whole disk to prevent older tools that don’t know about GPTs from clobbering the real partition table.

What is rel="bookmark"?

2026-08-07T04:50:09Z

While looking for linking conventions regarding permalink locations, I found a reference on Wikipedia to <a rel="bookmark" href="..."> being used for permalinks. I’m not sure I’ve ever noticed or used that. I didn’t find any mentions of people actually using it that way.

Mostly I found secondhand references to other references to the HTML spec (yes, it’s official!), which has this clear as mud description:

The bookmark keyword may be used with a and area elements. This keyword creates a hyperlink.

The bookmark keyword gives a permalink for the nearest ancestor article element of the linking element in question, or of the section the linking element is most closely associated with, if there are no ancestor article elements.

So, should I use this on the permalink, well, link on my post, or not? Should I use it only on multi-post pages like tag/category archives? Or in a table of contents?

The best reference I found, rel="bookmark" also does not mean what you think it means is more clear: It should go anywhere you would link to a permalink from the same material. So:

Single blog post on a page, linking to itself? Yes!
Time or category archive pages, with complete posts or significant chunks of them, linking to each individual post’s page? Yes!
Table of contents listing just titles and summaries? NO!
Long page with multiple posts, where the permanent versions of those posts are on that same page, each with a permalink pointing to that section on that page? Yes!

The same article also points out that it’s effectively obsolete, since just about everyone uses permalinks now, but hardly anyone puts rel="bookmark".

I decided to add it when I updated my templates, because why not?

Count Upgradable Packages on Alpine Linux

2026-07-26T01:32:08Z

I like to use Alpine Linux for cloud servers because it’s extremely small, so I don’t have to add extra RAM just to run the operating system. But I like knowing when updated packages are available.

You need root to update the local list of available packages first, but that can be automated safely (see below):

doas apk update

Just asking Alpine is easy, and doesn’t require extra permissions:

apk list -u

That gives you a detailed list of upgradable packages. Or to get a quieter result with just the names:

apk list -uq

And this being Linux, it’s easy to get a word count with wc (yes, it’ll count hyphenated package names as a single word):

apk list -uq | wc -w

Automating the List Updates

To get APK to update its package list daily, I’ve put the following in /etc/periodic/daily/apk-update.sh:

#!/bin/sh
apk update

That doesn’t install anything, so it’s safe to let it check on a daily basis. Of course that doesn’t tell me anything, it just makes sure the list is relatively current when I ask it.

I assume if you’re using Alpine you know how to set file ownership/permissions. Scripts in /etc/periodic/daily should be owned by root, executable, and not writeable by other users. For example:

doas chown root:root apk-update.sh && doas chmod 755 apk-update.sh

Friendly Reports on Login

For the actual report, I’ve written a short shell script (kept simple so it’ll run in busybox) called count-apk.sh to give me the count and names, but only if there aren’t too many of them:

#!/bin/sh                                                                                      
UPGRADABLE=`apk list -qu`
COUNT=`echo "$UPGRADABLE" | wc -w`
if [ $COUNT -gt 9 ]; then
	echo $COUNT packages available to upgrade.
elif [ $COUNT -gt 1 ]; then
	echo $COUNT packages available to upgrade:
	printf '%s\n' "$UPGRADABLE"
elif [ $COUNT -gt 0 ]; then
	echo 1 package available to upgrade:
	printf '%s\n' "$UPGRADABLE"
else
	echo No packages available to upgrade.
fi

And to get that reported every time I log in, I’ve put it in my ~/.profile.

~/bin/count-apk.sh

Meanwhile I’ve been trying to decide how much I want to automate maintenance on these systems. I don’t want to auto-update everything and risk breaking changes, but I don’t want to have to log into every internet-reachable virtual server on a weekly basis to keep it current either.

Hide Related Posts by Post Format

2026-07-16T19:32:22Z

I finally got around to re-customizing the related posts on my blog. Specifically: hiding related posts on asides and links.

Years ago I had this set up when the site was running WordPress and Jetpack. I’ve since moved it to Contextual Related Posts (in order to keep it local on my server), and later to ClassicPress.

Neither plugin has features to skip based on post formats, but you can use hooks, actions and filters to write your own.

Contextual Related Posts

The plugin has options to exclude displaying by post type (post, page, or media), by category, or on individual post IDs…but not by tag or post format. So I dug around in the docs a bit, looking for ways to filter CRP’s input or output.

The simplest approach I came up with was to turn off automatically adding it to any page/feed/archive type in the CRP plugin’s general tab, then manually add it to the post’s output when and only when I want it included.

Option 1: Modify Your Theme

The CRP admin file suggests putting <?php if ( function_exists( 'echo_crp' ) ) { echo_crp(); } ?> in your theme template where you want it to display. To make it only display under some conditions, you’ll extend the if statement like this:

<? php
	if (
		get_post_format() != 'aside'
		&& get_post_format() != 'link'
		&& function_exists( 'echo_crp' )
	) {
		echo_crp();
	}
 ?>

echo_crp() sends the plugin’s output to straight to the page being rendered.

get_post_format() is self-explanatory.

Option 2: Use a Plugin or Functions.php

I put a lot of my blog customizations in a local functionality plugin, so I can switch themes without losing my changes. (Admittedly, it’s been a long time since I last switched themes on my blog.) This should also work if you put it in a functions.php file in your theme.

The idea here is that you add a filter to the_content and decide whether or not to add the related posts lists to the end.

// Manually show Contextual Related Posts output, so we can skip displaying it on asides and linkposts
function exampleprefix_manual_crp($content) {
	if (
		in_the_loop()
		&& is_main_query()
		&& is_single()
		&& get_post_format() != 'aside'
		&& get_post_format() != 'link'
		&& function_exists( 'get_crp' )
	) {
		$content .= get_crp();
	}
	return $content;
}
add_filter('the_content', 'exampleprefix_manual_crp', 999);

in_the_loop() and is_main_query() will ensure it’s only shown on the web view, not on an ActivityPub view from the Fediverse.

is_single() will ensure it’s only shown on individual post views, not in feeds or category pages or the home page.

get_crp() is similar to echo_crp(), but instead of pushing the output to the page, it returns the output so you can work with it.

999 is the placement of this filter, and a convenient number to make sure it’s all the way at the end.

Jetpack Related Posts

I forget where I found this since it was probably a decade ago. Maybe on the Jetpack support forum, maybe on StackExchange.

The approach I used was to check the post conditions, find Jetpack’s related posts filter, and then remove it from the active filters on the_content.

// Don't show Jetpack Related Posts on asides or links
function exampleprefix_hide_jetpack_related_on_asides() {
	if ( class_exists( 'Jetpack_RelatedPosts' )
		&& (get_post_format() == 'aside' || get_post_format() == 'link')
	) {
		$jprp = Jetpack_RelatedPosts::init();
		$callback = array( $jprp, 'filter_add_target_to_dom' );
		remove_filter( 'the_content', $callback, 40 );
	}
}
add_action( 'wp', 'exampleprefix_hide_jetpack_related_on_asides', 20 );

It turns out there’s a simpler way to do it now. (Maybe there was back at the time, and I just found the complicated one first.) The Jetpack Related Posts Developer Reference has an example where you just turn off the feature when it checks the options:

// Don't show Jetpack Related Posts on asides or links
function exampleprefix_hide_related_posts_jetpack( $options ) {
    if ( get_post_format() == 'aside' || get_post_format() == 'link' ) {
        $options['enabled'] = false;
    }
    return $options;
}
add_filter( 'jetpack_relatedposts_filter_options', 'exampleprefix_hide_related_posts_jetpack' );

/dev/null: Permission denied on Alpine Linux

2026-06-10T19:34:35Z

I upgraded two virtual machines to Alpine Linux 3.24 last night. One worked perfectly. The other came back up after reboot, but the services it runs didn’t start up (reminder to self: this is why you don’t run upgrades late at night), and when I logged in (fortunately SSH was still working!) I saw that some of the scripts were throwing errors like this:

 -ash: can't create /dev/null: Permission denied

Wait, what?

Sure enough:

ls -l /dev/null
crw-rw----    1 root     root        1,   3 Jun 10 10:52 /dev/null

The obvious solution was to fix the permissions on /dev/null:

doas chmod a+rw /dev/null

But that didn’t persist when I rebooted, because devtmpfs isn’t on disk, it’s in memory. Besides, I needed to check for other devices that might have broken permissions. I re-ran the upgrade, followed by repair…

doas apk upgrade --available
doas apk fix --directory-permissions
doas apk fix -x

But that didn’t work either. Because /dev isn’t built from packages, it’s built by a device manager. I found a bunch of forum and Stack Exchange posts on how to fix the problem in udev on distros like Arch or Gentoo, but Alpine doesn’t use udev, so none of those suggestions were even relevant.

The Fix

What did fix the problem was just resetting Alpine’s device manager, in this case mdev:

doas setup-devd mdev

Permissions stayed fixed when I rebooted it again, and everything started up correctly!

I assume doing the same with mdevd or eudev would have worked if a system using one of those broke the same way.

Possible Cause

I’m not sure why one of them broke and the other was fine.

It’s an older VM, and I started it on an older version of Alpine, so it may have been something left over that didn’t break on 3.23, but broke on 3.24.

I also forgot to add --available to the apk upgrade command the first time through, and I don’t remember if I re-ran it before rebooting the first time or after. It may have broken during the reboot with the partial upgrade.

It could be either of those, or something else entirely.

Tech Tips have moved to KVibber.com

2026-05-23T15:00:00Z

Last month I moved all the tech tips from my old site at Hyperborea.org to KVibber.com. Along with the move, it needed a new name since it’s not at Hyperborea anymore. I went with “KV Tech Tips” because it’s both my initials and a common abbreviation for Key-Value, programming terms for a data structure that has a bunch of names (“keys”) each pointing to the real data (“values”).

I chose the old name from a mythical location in a half-remembered movie from the 1970s, back in 2000. The newer site has been an IndieWeb-style profile for a few years, and I finally decided to move things over.

Old links will keep redirecting to the new one as long as I hang onto the domain name.

If you subscribe to the RSS feed, you may want to update it to https://kvibber.com/tech-tips/feed.xml
If you have a site that links here, I’d appreciate it if you update your links to point to the new location.

Thanks for reading!

Adding External S3 Storage on Nextcloud Using OCC

2026-04-27T04:21:46Z

Nextcloud can use external sources like S3 or SFTP (or other Nextcloud servers!) for additional storage, which you can mount as a folder for all users or for a specific user. These folders will work just like regular folders on your Nextcloud server, except the data is stored somewhere else, like a remote backup service or an object storage bucket. (Useful if you want to store large files or media libraries without filling up the server’s main drive.)

For all users, or for your own login, it’s easier to set it up through the GUI. To set up an external folder for a specific user, you can use the occ command-line tool.

OCC is run on the server, as the webserver account. Depending on your setup you may need to use sudo, su, runuser, etc. and you may need to point it to the right php location. (See the previous link for reference.)

Or if you’re using the Nextcloud Snap, it’ll just be this:

sudo nextcloud.occ

Anyway, I cobbled together this config from an example that had the wrong authentication method, and extrapolating from a working config I’d set up for my own login using the GUI (checked via occ files_external:list):

WRAPPER_TO_OCC files_external:create FOLDER_NAME \
  amazons3 \
  amazons3::accesskey \
  --user=USER_NAME \
  --config bucket="YOUR_BUCKET" \
  --config hostname="YOUR_HOST" \
  --config port="443" \
  --config use_ssl="true" \
  --config use_path_style="true" \
  --config key="YOUR_KEY" \
  --config secret="YOUR_SECRET"

It worked just fine on Linode’s object storage. And yes, it still has to say amazons3 even if you’re using a different S3 provider.

Minimal User Setup for Debian Cloud

2026-04-12T16:28:00Z

Debian offers cloud images that you can plug into a hosting provider and run instead of spending time going through the installer. Most of them assume you’re going to use the host’s system to set up the your login credentials.

There’s also a “nocloud” image intended to run on a local setup, so you can toss a qcow2 image onto Qemu (directly or with or your favorite GUI wrapper like UTM or Boxes). It ships with a passwordless root user to get you started quickly.

You don’t want to keep running it as root. Especially without a password!

So here’s a set of quick steps to set up a regular user for admin and put a password on root. (Why am I writing this down? Because I always forget which Linux distributions use useradd and which use adduser.)

Optional: Set a Hostname

Debian 11 ships with the name set to “debian,” but it’s not set in the hosts file. Sudo will complain that it can’t find this “debian” machine when you run it, though it will run.

So if you’re setting up a new oldoldstable for some reason, you probably want to start by setting a hostname and adding it to /etc/hosts (on the same line as localhost).

hostname HOSTNAME
nano /etc/hostname
nano /etc/hosts

You can of course use vi instead, or install another text editor like emacs using apt, assuming the image connected to the network.

Debian 12 doesn’t set a hostname in the cloud images, so it doesn’t have this problem, though of course you’ll probably want to set one anyway if you plan on keeping the machine around!

Set Up The User

Next, create the user, add them to the sudoers group, and set their password.

useradd -m -s /bin/bash USERNAME
usermod -aG sudo        USERNAME
passwd                  USERNAME

Some notes on the options used here:

You can of course choose a different shell than bash here.
useradd -m will also create the home directory.
usermod -aG will add a group to the user’s list of groups, rather than moving them entirely.
Debian pre-configures a “sudo” group and gives its members permission to run sudo with their own password, which is exactly what I want here.

Other distros vary in whether they set up a group and what they call it (ex. Red Hat/Fedora call it “wheel”), or whether you need to set up access manually using visudo or putting something in /etc/sudoers.d

Now you can set a password for root.

passwd

Congratulations! You should be able to log out of root now, log in with your regular user, and use sudo when needed.

Bonus: Lock Out Root

Once you’ve logged in with your regular user and verified that it can sudo, lock the root account so no one can log into it in the first place. It’ll still be there running things behind the scenes, but it won’t be open.

sudo passwd -l root

Connect macOS Calendar, Contacts and Reminders to NextCloud

2026-03-13T00:39:43Z

Nextcloud Calendar and Contacts are solid cross-platform alternatives to iCloud’s equivalents, and Tasks is good enough I’ve been using it for several years.

On macOS, System Settings > Internet Accounts manages logins for all the built-in applications like Apple Mail, Calendar, Reminders and Contacts. Setting these up with Nextcloud is easy, but it’s not intuitive, because Apple has been optimizing the setup process for all-in-one services like iCloud, Google or Microsoft.

Option 1: Download a Device Profile

On your Nextcloud server’s website, open your account settings, then go to the Mobile & Desktop section. Below the app store links, look for “Download macOS/iOS configuration profile.” That link will download a config with all the info except your password. (You should generate an app-specific one, but it’s not necessary.)

On your Mac, open System Settings, go to General > Device Management and approve the Nextcloud profile. It’ll ask for the password twice because you’re still technically logging into two services, one for calendar and one for contacts.

Option 2: Add the Accounts Manually

If you don’t want to use Device Management, or run into trouble getting it to work, you can still set up the accounts in System Settings > Internet Accounts. The process is simple, if a little misleading.

First: Starting with macOS 26 (Tahoe), it only asks you for an email address when you press Add Account. To add a contacts/calendar account:

Click on “choose from a list.”
Scroll down and click on “Add other account…”
Now you can add a CalDAV (Calendar/Reminders) or CardDAV (Contacts) account.

Alternatively: go through the Apple Calendar or Contacts apps’ settings and add the account there. It’ll still get added to the central set of accounts.

Second: It still asks you for an email address when you tell it to add one of those account types!

You can switch from Automatic to Manual in the dropdown, and it’ll ask for a username and server… or you can just enter the equivalent of username@server.example.com (even if it isn’t a real email address) and your (preferably app-specific) password, and it’ll find the right details for your server.

Easy, but not obvious!

Using Unicode Half-Stars Symbols in Ratings

2026-03-03T01:01:17Z

When I started collecting reviews in one section of my website, I decided to stick with the goals I had here on the Tech Tips section: Keep the pages small, avoid loading scripts or extra images where styles or font symbols would do. So I kept using emoji for category icons, and used the outlined and filled star symbols (☆★) for ratings. They’ve been in Unicode forever, so they’re supported almost everywhere.

Halfway There

Every once in a while, I really want to rate something between a whole number of stars. I let it round down for a while until I went looking to see if there were half-filled star symbols. And there are! Half-stars and half-filled stars (in both directions) were proposed in 2016 and added to Unicode 11 in 2018. You can see them here:

⯨⯩⯪⯫

…or maybe you can’t, because even after eight years, font support for them is still spotty.

As of March 2026:

Windows 11 shows the symbols.
Linux distros might, depending on what fonts are installed. Modern distros at least have fonts that support these symbols, in packages like noto-fonts (Arch), fonts-noto-core (Debian) or google-noto-sans-symbols-2-fonts (Fedora), but whether they’re installed by default seems to vary.
Windows 10, macOS/iOS 26 and Android don’t, even though they include newer emoji than Unicode 11.

So if you’re trying to use these on a web page, it’s really hit and miss whether your readers will be able to see the half-star symbols or not.

The good news is, you can embed a font on your page (or app) that does support the missing symbols! Noto Sans Symbols 2 contains the full set, and can be used freely. Embedding that font and using it for the ratings solves the problem.

⯨⯩⯪⯫

That said, it is an extra 200 KB or so, which is a bit overkill for adding one very simple bit of line art. (See the Subset and Alternatives sections below.)

Adding Font Support

The simplest thing to do, if you’re not worried about Google potentially tracking visitors to your site (see self-hosting below for an alternative), is just embed the font from Google by putting this in the <head> section of your page:

<meta charset="UTF-8">
<link rel="preconnect" href="https://fonts.googleapis.com">
<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
<link href="https://fonts.googleapis.com/css2?family=Noto+Sans+Symbols+2&display=swap" rel="stylesheet">

Then in your stylesheet, write something like this:

.stars {font-family: "Noto Sans Symbols 2"}

And you can write your star ratings like this:

<span class="stars">★★★⯪☆</span>

★★★⯪☆

I actually go a bit further on mine for accessibility and microformats:

<abbr class="stars p-rating"
  title="3.5 stars out of 5"
  aria-label="3.5 stars out of 5."
  value="3.5">★★★⯪☆</abbr>

★★★⯪☆

HTML Codes

If you’re writing on a system that doesn’t support all the star characters natively, you can use numeric HTML entities. It’ll be just as unreadable as the tofu, but you’ll be able to tell them apart from each other.

★ or ★ ★ Black star
☆ or ☆ ☆ White Star
⯨ or ⯨ ⯨ Left half black star
⯩ or ⯩ ⯩ Right half black star
⯪ or ⯪ ⯪ Star with left half black
⯫ or ⯫ ⯫ Star with right half black

Self-Hosting the Font

The Google Fonts Privacy Policy states that they don’t do any tracking on the font requests and keep them completely separate from any account-related traffic. But if you want to be absolutely certain, or need to comply with regulations like GDPR, you can host your own copy.

They don’t make it easy, though.

Option 1: Download and Convert from TTF

If you download the font from Google Fonts, you get the complete TrueType font, which in this case is about 6 times as big as the WOFF2 font for web embedding. The .zip at the font’s GitHub page also includes smaller versions, closer to 400KB, in the “hinted” and “unhinted” folders. (In this case they’re the same, but for other fonts you’ll probably want the version with hinting.)

You can use an online TrueType to WOFF2 converter, or you can use an offline tool.

The command-line woff2_compress tool is available in Homebrew for macOS and various Linux distributions in the woff2 (Debian, Alpine, Homebrew, etc) or woff2-tools (Fedora) packages.

woff2_compress NotoSansSymbols2-Regular.ttf

Option 1A: Create a Subset First

If you’re only going to use this font for the star glyphs, you can create a subset of the font, which can be much smaller. Again, there are plenty of online tools, but I used a Node-based commandline tool called glyphhanger:

mkdir fonts
cd fonts
cp /path/to/NotoSansSymbols2-Regular.ttf .
npm install glyphhanger
npx glyphhanger --whitelist="⯨⯩⯪⯫☆★" --subset=NotoSansSymbols2-Regular.ttf
mv NotoSansSymbols2-Regular-subset.ttf noto-stars-subset.ttf
woff2_compress noto-stars-subset.ttf

This creates a font with only the characters in the whitelist. The TrueType file is only 1.6KB, and the WOFF2 is only 780 bytes!

Then I copied the files out, and deleted the whole folder because glyphhanger seems to depend on some vulnerable packages.

Option 2: Find a Pre-Built WOFF2 file

Or you can grab a copy of the WOFF2 file from Google Fonts. The simplest way is to open their font stylesheet (the one in the third <link> above) directly, scroll down to the /* symbols */ section, copy the URL from that, and save the .woff2 file. Preferably giving it a name you can recognize later on.

Embedding Your Copy

You won’t need the entire set of font definitions and Unicode ranges, because you’re using it in narrow circumstances. And you won’t need the <link> elements pointing to Google. Though you may need to keep the <meta charset="UTF-8"> depending on your hosting setup. In any case, you’ll want to add this to your stylesheet:

@font-face {
  font-family: "Noto Sans Symbols 2";
  font-display: swap;
  src: url(/path/to/your/copy/of/NotoSansSymbols2-Regular.woff2);
}

The font-display: swap tells browsers to keep rendering the page if it takes a while to load the font, and swap it in when it’s ready.

On larger pages especially, you may also want to preload the font so the browser will start downloading it as soon as it can, instead of waiting until it’s downloaded and parsed the stylesheet.

Alternatives

Use images instead of font symbols. (PNGs or SVGs would be tiny.)
Use an icon font like Font Awesome that provides its own symbols. (Download size is comparable to embedding Noto Sans Symbol 2, but you can also use their icons as SVGs, which can be a lot smaller if you only need a handful.)
Embed the font, but only on the individual pages that need it. (That’s what I’ve done for this page, even before subsetting just the stars.)
Use a more widely-supported symbol like ½ instead. (This is what I initially did on my reviews.)
Use a fraction symbol, and then use JavaScript to check whether the half-star is supported in the current font, and swap it in if it’s available. (Or the other way around, but this is more backward compatible.)

Then again, ~200 KB is a fraction of the average page size these days. More than a drop in the bucket, but hardly a dealbreaker. Even if it is 10 times the size this page would be without it.