Chameth.com - posts like the-meaning-of-life, thinking-more-about-backups, why-you-should-be-using-https

The meaning of life

2026-01-18T00:00:00Z

Now that’s a grandiose title for a blog post! Blame Jeremiah Lee, who selected it as the theme for January’s IndieWeb Carnival. I’ve not taken part in this before, but it’s basically a shared writing prompt. One person selects a theme, other people write about it on their own sites, and then the host does a round-up linking to all the various responses. I’ve come across it a few times before, but the topics have never really engaged me; they don’t feel like the sort of thing I’d write about. But… why not?

A Guide to the Good Life

The thing that actually tipped the scales for this particular topic was a book I was reading: A Guide to the Good Life by William B. Irvine. It’s basically a modern introduction to Stoicism. Not only is there a strong overlap between that and the meaning of life, one particular idea resonated with me:

In ancient Greece, when schools of philosophy were still prominent features of the cultural landscape, there were any number of schools to which parents could send their children. Suppose we could travel back in time to 300 bc and take a thinking person’s walking tour of Athens. We could begin our tour in the Agora, where Socrates a century earlier had philosophized with the citizens of Athens. On the northern side of the Agora we would see the Stoa Poikile, or Painted Porch, and holding forth there might be Zeno of Citium, the founder of the Stoic school of philosophy. This “porch” was actually a colonnade decorated with murals.

The idea that you could just wander around a city and come across people giving their considered opinions on philosophy is… something. Do we have any actual equivalent of that in the modern ages? Obviously you do get people espousing their views on the street, but they tend to either be proselytising or grinding a particular axe. And even if there was a modern day Socrates talking in Speaker’s Corner, would anyone actually stop to listen? We do have books, and speaking engagements, and so on, but they feel a lot more impersonal, and in a lot of cases motivated by money or politics or some other agenda. The philosophers of ancient Greek and Rome seemed to actually practice what they preached; as well as talking in public, and instructing in their schools, they’d write letters helping and advising people, or debating points of philosophy.

Some of that behaviour exists in academia, I’m sure, but it’s not really accessible to the person on the street in the way that it once was. But we do have personal websites and blogs. People just exchanging ideas, speaking out in public, with (generally) no expectation of reward or recognition for it. Is the “IndieWeb” the modern Agora? Probably not, but maybe it gives us some aspects of it that we otherwise wouldn’t have?

The Stoic approach to life

The Stoics believed in living a virtuous life; living as we were designed to live, in accordance with nature. A lot of those terms might be a bit loaded to the modern ear, and “designed to live” is awfully vague. I think this quote expands on it pretty well, though:

And for what function were people designed? To answer this question, the Stoics thought, we need only examine ourselves. On doing this, we will discover that we have certain instincts, as do all animals. We experience hunger; this is nature’s way of getting us to nourish ourselves. We also experience lust; this is nature’s way of getting us to reproduce. But we differ from other animals in one important respect: We have the ability to reason. From this we can conclude, Zeno would assert, that we were designed to be reasonable.

And if we use our reason, we will further conclude that we were designed to do certain things, that we have certain duties. Most significantly, since nature intended us to be social creatures, we have duties to our fellow men. We should, for example, honor our parents, be agreeable to our friends, and be concerned with the interests of our countrymen.

It all seems eminently reasonable. But in a world of fake news, social media, culture wars, and everything else, our ability to reason often seems forgotten. Hell, even being agreeable seems like it’s out of vogue at the moment. Would the Stoics despair if you transported one of them to the present day? Probably not. One of the other tenets they held was, well, being stoic. There was a concept of tranquility:

Stoic tranquility was a psychological state marked by the absence of negative emotions, such as grief, anger, and anxiety, and the presence of positive emotions, such as joy.

To get to this magical state, you need a form of detachment. Not in the sense of being completely passive and impartial as you float through life; that’s not how we’re “designed to life”. But in the sense of not letting outside events influence your inner state. When someone says something horrible, they don’t have the power to actually make you feel bad; that’s something you do. And I fully accept that it’s very easy to say that, and very hard to actually practice it.

This is actually a concept shared with many other religions and philosophies. Buddhism has the idea of Nekkhamma, Jainism and Hinduism have Vairāgya, and so on. Even if you don’t put any stock at all into religious teachings, it’s interesting that this concept comes up again and again.

If you’re like me, you probably have thoughts on all this. Sure, anxiety-free, anger-free life is probably nice, but how does that relate to the meaning of life and, anyway, shouldn’t you be angry about some things? The Stoics (particularly the Roman ones, who tended to not be so into physics and ethics) believed that this tranquility made it easier to focus on being virtuous. That makes sense to me; if we manage to get off the hedonistic treadmill of wanting shiny new things, of hoping people like our posts, and so on, then there’s surely more time in life for other pursuits. As for anger, I think the point is you don’t let the emotions drive your behaviour. There’s a difference between getting angry at what someone is saying and punching them in the face, and hearing someone, calmly and rationally assessing matters, and then punching them in the face. Maybe it’s best for society to punch certain people in the face. The Stoics were certainly not pacifists. Marcus Aurelius is one of the most well known, and he was Emperor of Rome. He’s hailed as one of the few good emperors, but you can bet he had an awful lot of blood on his hands even so.

Putting it into practice

It’s all well and good going on about not letting things bother you, but it’s very much easier said than done. The book introduces the concept of “negative visualisation”: imagining the negative things that could happen in your life, and thus starting to accept them. It also helps you to appreciate things that you do have, that you otherwise taken for granted. I’m sure everyone’s imagined what would happen if you lost your home, or your job, or so on… but what if you didn’t have your favourite mug? A particular tool? A certain piece of art?

I’ve heard of gratitude journals before. I’ve even tried keeping one for a while. There’s science showing it’s beneficial for mental health. But I always faded off after a short while. Once you tick off the big things: friends, family, food, etc, it feels like a stretch. Negative visualisation feels like a much better approach to me. I’m about to eat an apple; at the end of the day I’m not going to think back and write about an apple in a gratitude journal. But I can think briefly, in the moment, about not having the apple. Do I need to prepare myself for an apple-less life? Not really. But do I now appreciate the apple a little bit more, and take it for granted a little bit less? Yes. Does that make me a bit more tranquil? A bit less likely to wish I had something tastier than an apple? Also yes.

This process dovetails into the concept of impermanence, another concept found in Buddhism and elsewhere. Each apple could be the last one you ever have. If you knew that in advance, how would it change your approach? You’d probably savour it a bit more, appreciate it a bit more, and most of all not take it for granted. There’s a lot of pithy sayings about treating each day as if it’s your last, but at that level they’re a lot more nebulous than helpful; appreciating an apple, though? That’s something I can do.

It seems at first glance that thinking about negatives should be depressing or anxiety inducing. There are only so many reasons that this could be my last apple, and most of them involve something pretty unideal happening to me. But I don’t think it’s actually that glum. You don’t dwell on the negative, instead you use it to inspire a positive. And the alternative is to just sleepwalk through the process, not really paying attention, not gaining any enjoyment from it.

Bringing it back

Thanks for sticking with me on that tangent. You’ll be glad to know I’ve finished eating my apple now. The topic for this post was meant to be “the meaning of life”, not “thoughts on eating apples” or “living a Stoic life”, so allow me to try to tie it all together and pretend that I had a plan.

Life has no inherent meaning, it’s just a biological process. But that doesn’t mean we can’t seek to have a meaningful existence. The Stoics believed that involved being reasonable, and one of the approaches to give the reasoning room to happen is to strive towards an inner state of tranquility.

Obviously the Stoic approach isn’t the only one. And I’m not sure I did their philosophies any justice in my writing here. If it sparked your interest, though, I highly recommend picking up the book. If not, other approaches to life are available…

Be excellent to each other… and party on, dudes.

Thinking more about backups

2025-11-01T00:00:00Z

The Backblaze logo

Almost a year ago I wrote about how I do backups with Restic and Hetzner. That system has been ticking along well ever since, but recently I had some… thoughts. These backups are all well and good if I accidentally delete a file, or a database gets corrupted, or something, but there are two glaring issues:

Firstly, I’m backing up my Hetzner server to Hetzner cloud storage. If something happens to Hetzner — or my Hetzner account — then all my eggs go down with that basket. Obviously Hetzner are a big organisation and aren’t likely to just vanish overnight, but I’m less confident about my account. Could a false abuse report get it suspended? What if the UK passes even more dumb laws and Hetzner decide it’s easier just to not do business with people here? This is the same sort of concern I have about Google accounts: if you have half of your life in Google Drive and Google Mail, what happens if you comment on a YouTube video, get flagged by an AI moderation process, and your account gets suspended? It’s probably not very likely, but these are things my brain likes to dwell on.

Secondly, the credentials to access the backups sit on each machine that is backed up. If someone malicious gained access to the machine, they’d also have access to delete or tamper with all the backups. It feels a little silly that the same attack could take down both the originals and the backups. There’s no way to avoid that with Hetzner’s S3 implementation, as far as I can tell.

Exploring options

I toyed with the idea of making local copies of the backups, but the only way to avoid the same problems would be to keep them offline and do a manual copy every now and then. I didn’t really want to do that, and was concerned that if I did a monthly offline backup then I stood to lose up to a month of data in the worst case.

I then looked around at other S3 providers. Amazon’s glacier offering is tempting due to its very low storage costs, but you pay for that if you ever want to restore anything. There are also lots of weird pricing edge cases around moving data between storage classes, minimum file sizes, and so on. A much better option is Backblaze’s B2 product. Their pricing is much more straight-forward, and they have an interesting feature that’s particularly useful in this case: lifecycle rules. Coupled with the ability to create API keys that don’t have access to delete files (just “hide” them), this allows for what’s effectively an append-only store.

This works more-or-less out of the box with Restic. Joseph Price has a guide that goes into the setup in a bit more depth. Basically, whenever Restic would delete a file (e.g. during a “forget” or “prune” operation), it instead gets hidden and is only deleted when the B2 lifecycle rules decide it should be. I’ve kept the existing Hetzner S3 backups for now, and just added an extra step to the end of my script: a simple restic copy and a restic forget. B2 actually works out cheaper than the Hetzner storage, as they don’t bill you for a minimum of 1TB storage; my current usage is around $3/month. Not a bad price for some extra peace of mind!

Simple backups with Restic and Hetzner Cloud

2024-12-06T00:00:00Z

Restic’s mascot, who’s dual-wielding umbrellas to save you from a rainy day.

I have a confession: for the past few years I’ve not been backing up any of my computers. Everyone knows that you should do backups, but actually getting around to doing it is another story.

Don’t get me wrong: most of my important things are “backed up” by virtue of being committed to remote git repositories, or attached to e-mails, or re-obtainable from the original source, and so on. I don’t think any machine failing completely would be a disaster for me, but it would certainly be a pain.

This week I finally got around to doing something, and it ended up being a lot more straight forward than my previous forays into backup-land.

Restic

After soliciting a few opinions, the choice of backup software came down to either Borg or Restic. I’m pretty sure either would have done what I want, but I leaned towards Restic for a few reasons: it has a more informative website, it’s written in Go rather than Python¹, and Borg seems to be transitioning between major releases at the moment².

The way Restic works is pretty simple: you initialise a ‘repository’, and can then call restic backup /some/path and it’ll get backed up to the repository. Restic handles keeping different backups separate, and only sending data that’s changed, and deduplicating, and so on. You basically point it at a thing you don’t want to lose, and it sorts it out for you. Perfect.

There are equally straight-forward commands for removing old snapshots (restic forget) and verifying backups (restic check). One of the nice things about modern backup solutions is they support a whole range of backends. I was originally going to spin up a small VPS to host my backups, but noticed that Restic supported S3-compatible stores…

Hetzner Cloud Object Storage

I host my servers with Hetzner, and was going to use them to spin up a VPS as well. Despite the “Cloud” branding on a bunch of products, they offer reasonable prices and good service. A couple of months ago, they started offering S3-compatible object storage.

The pricing isn’t totally straight forward, but for continuous use the “free quota” amounts to 1TB of storage and 1TB of egress a month. Ingress is free, as is traffic within the eu-central region (where all my servers are). That quota is only awarded when you pay the “base price”, though, which is €4.99 a month. So basically it’s €5 a month for 1TB of storage and enough egress to fully restore every single byte. That’s better value than any VPS I can find, much cheaper than Amazon S3, and about the same as Backblaze B2.

Getting them to work together

Now you’d think making the tool that supports S3-compatible object storage work with your S3-compatible object storage would be easy, right? Well not quite. The library Restic uses to deal with S3 backends has some strange logic for figuring out the bucket name given a URL. It doesn’t quite seem to work right, though…

Hetzner buckets have URLs like s3://bucketname.hel1.your-objectstorage.com³, but just passing that to Restic gives an error that the bucket is not specified. The docs mention there’s an advanced option to make it use the virtual host for the bucket name: -o s3.bucket-lookup=dns. But that… also doesn’t work. What I ended up doing was specifying the URL as s3://hel1.your-objectstorage.com/bucketname, and also passing in the dns option. The library then seems to muddle its way back to a real, working URL. I’m not sure why it works like this: maybe it’s just a weird aspect of S3 that I’m oblivious to?

The next fun part is that you can configure Restic entirely by using environment variables, except for that -o s3.bucket-lookup=dns argument. That has to go on the command line. I ended up making a little wrapper script to invoke Restic correctly:

#!/bin/sh

# The password restic will use to encrypt your data. You should generate
# something nice and secure.
export RESTIC_PASSWORD=repo-password

# The path to the repository where restic will save the backup. In our case
# this takes the form `s3:<endpoint>/<bucket>`. Your endpoint might be different
# to mine depending on the region your bucket is in.
export RESTIC_REPOSITORY=s3:hel1.your-objectstorage.com/bucket-name

# The access and secret key generated in the 'S3 credentials' section of the
# Hetzner Cloud Console
export AWS_ACCESS_KEY_ID=hetzner-access-key-id
export AWS_SECRET_ACCESS_KEY=hetzner-access-key

# Pass any arguments on to the restic command, along with the magic
# `s3.bucket-lookup` option we need to resolve the S3 URL properly.
exec restic -o s3.bucket-lookup=dns "$@"

Then in the backup script I just alias restic to use the script:

#!/bin/bash

set -eu

# This means any time we use `restic` below, we'll actually execute our special
# script which supplies all the env vars and arguments needed to find the
# repository. Make sure the path matches where you saved the script!
alias restic='~/.bin/restic'

# Actually do the backup. Each directory in the list below will be backed up
# separately.
dirs=(
	"/some/path/to/backup/"
	"/some/other/path/"
)
for i in "${dirs[@]}" 
do
	echo $i
	(cd $i && restic --verbose backup .)
done

# Prune our snapshots. You can tweak the numbers here. Run with `--dry-run` to
# see what effect any changes would have before actually committing to them. 
restic forget --keep-daily 7 --keep-weekly 10 --keep-monthly 24 --keep-yearly 10

The only other notable thing here is that the script changes into the directory to be backed up. If you give Restic an absolute path, it will create a new snapshot if the metadata of any folder in the path changes, which is not what I want.

If it wasn’t for the S3 URL issues, the whole thing would’ve probably taken me about half an hour. That’s including setting up the object storage, installing Restic, and so on. It’s painfully easy. Why didn’t I do this three years ago?!

Addendum: a step-by-step guide

If you want to do this yourself, here’s a quick step-by-step guide:

Log in to the Hetzner Cloud Console, and create a project.
On the “Object Storage” tab, create a new bucket. Note the name and the endpoint.
On the “Security” tab, go to “S3 Credentials” and generate new credentials. Note down the access key and the secret key.
Copy the first shell script above, fill in the password (you can pick!), endpoint, bucket name, access key and secret key.
Run the script with the init argument (e.g. ~/.bin/restic init). This will create a new repository, and only needs to be done once even if you backup multiple machines.
Copy the second shell script above, making sure the restic alias points at the script you saved in step 4. Change the list of directories to whatever you want to backup.
Schedule the script to be run automatically, using crontab or systemd timers or however you prefer.

To check everything is working, you can use the snapshots subcommand to see a list of saved snapshots. You might also want to try to restore a snapshot using the restore subcommand.

I’m not trying to be a language snob, but given the choice between two otherwise equal projects one in Go and one in Python, I’ll take the Go one. I know I’m not going to have weird library issues down the line, and I’m much more comfortable rummaging around the source. ↩︎
With a “Don’t use this in production!” notice on the shiny new version. ↩︎
Aside: I really hate URLs like that. What is with the trend for completely generic domains divorced from the service they’re a part of? ↩︎

Why you should be using HTTPS

2016-06-17T00:00:00Z

The EFF’s HTTPS Everywhere logo

One of my favourite hobbyhorses recently has been the use of HTTPS, or lack thereof. HTTPS is the thing that makes the little padlock appear in your browser, and has existed for over 20 years. In the past, that little padlock was the exclusive preserve of banks and other ‘high security’ establishments; over time its use has gradually expanded to most (but not all) websites that handle user information, and the time is now right for it to become ubiquitous.

Why use HTTPS?

There are numerous advantages to using HTTPS, both for the users of a website and for the operator:

Privacy

The most obvious advantage is that HTTPS gives your users additional privacy. An insecure (HTTP) request can potentially be read by anyone on the same network, or the network operators, or anyone who happens to operate a network along the path between the user and the server.

Users on shared WiFi networks (such as those in coffee shops, hotels, or offices) are particularly vulnerable to passive sniffing by anyone else on that network. If the network is open (as is frequently the case) then anyone in radio range can see exactly what the user is up to.

Integrity

HTTPS also helps to maintain the integrity of your site. With a plain HTTP request, there’s nothing to stop anyone in between the server and the user from modifying the content of the request or the response. This is a frequent tactic used by annoying WiFi gateways (such as the ones you’d find in a hotel), dubious ISPs who want to serve you extra adverts, or just plain old nefarious attackers.

If you’re trying to convey some kind of information to users (and if you aren’t, why exactly are you running a website again?) it seems beneficial to both you and them if the information arrives as you intended, rather than in a modified form due to someone or something tampering with it.

Security

If your website has any kind of authentication, or session identifiers, it becomes extremely vulnerable to an attacker monitoring the traffic and stealing the credentials. This was starkly demonstrated in 2010 when Firesheep was released. This tool allowed anyone to quickly and automatically hijack social media accounts of anyone on the same network who was using HTTP to access them.

Even if your login pages are served over HTTPS, if you send a single session ID cookie over HTTP (such as a page you decided wasn’t particularly ‘important’) then an attacker can probably spoof the user’s session and gain full access to their account. Again, in the case of open WiFi networks that could be anyone in radio range.

Search engine rankings

Some search engines use HTTPS as a signal in their ranking algorithms. Google announced in 2004 that it was using the presence of HTTPS as a small positive signal, but that it may strengthen that signal over time as more and more websites switch to using a secure transport. It’s not unthinkable that at some point in the future there will be HTTPS-only search engines.

But… But… But…

There are lots of excuses for not implementing HTTPS. Most of them are either misguided or outdated.

It’s too expensive and/or complicated

In the past, getting HTTPS certificates was a pain. A number of free suppliers have existed for a while but the process for getting their certificates wasn’t particularly straight forward, and many imposed arbitrary restrictions on the certificate parameters. Even once you had the certificate, you had to fiddle about with your HTTP server configuration to make it work, remember to manually get a new certificate when the old one expired, and lots of other annoying busywork.

With the arrival of Let’s Encrypt, all that changed. You can retrieve and deploy a free HTTPS certificate with two or three commands. Renewal can be handled completely automatically with a single command executed by cron.

There’s no point; nothing on my site is sensitive

You might not think your content warrants privacy, but can you speak for everyone who accesses it? Even content that seems mundane to you — such as travel advice, or technical writing — could be used to build up a profile of a user. If an attacker is monitoring traffic in a coffee shop and sees a user looking at travel advice and weather forecasts for a foreign country, he could use that information to plan a burglary knowing that the user will be away. Similarly, some content which is perfectly mundane to you may actually be very sensitive in other countries with repressive governments. HTTPS makes it much harder for these people to snoop on traffic.

From another angle, if you’re offering any kind of information, instructions, or especially file downloads, there’s a severe risk to users if the content is modified on its way to them. An evil sysadmin could rewrite your travel advice to suggest visiting the local drug dealer’s hangout, or replace your download with a malware-infested version.

HTTPS is slower, uses more resources, etc

Back in 1995 this might have been a valid argument. Enabling HTTPS on a modern server will make an almost negligible difference to performance. If you also enable HTTP/2 (which most implementations only support over HTTPS), it’s likely to actually use fewer resources, and result in a faster, smoother experience for your users. HTTP/2 was designed to work with HTTPS, and designed with modern requirements and networking techniques in mind.

CloudFlare have an excellent demonstration of the benefits of HTTP/2, and it can show speed improvements of 2-3x in a typical environment. On top of being faster, HTTP/2 uses fewer connections which results in less resource overhead on both the server and the client.

So what are you waiting for?

If you run a website and aren’t using HTTPS, give it a try.