Small dose of nothing

Blitception

2026-08-02T00:00:00Z

I've been working on blit, which streams terminals and graphical apps to your browser with very low latency. Naturally, I had to see how deep it goes.

This is blit in my browser in France, connected to a server on the US East Coast. The two bottom panes show the same video, arriving through two very different routes.

On the left, blit streams a remote Chromium. That Chromium loaded another blit instance, which shows yet another browser playing the video in fullscreen. Every frame is decoded and re-encoded at each hop before crossing the Atlantic.

On the right, that same inner blit instance is loaded in an iframe, with its networking tunneled through the outer blit. Same fullscreen browser at the bottom of the stack, one less video hop, one more layer of plumbing.

Both panes play smoothly, in sync, with subtitles. Blit all the way down, Rick all the way up.

Vanity SSH keys at 300M/s on OpenCL

2026-07-18T00:00:00Z

A few years ago I published vanity-keygen, a small Go program that brute-forces ed25519 SSH keypairs until the public key matches a regex. It did about 250k keys per second on my 32-core machine: a minute for love$, days for [pP][cC][aA][rR][rR][iI1][eE][rR].

This week an LLM rewrote it from scratch in Rust, with all of the cryptography hand-rolled in a single OpenCL kernel. I provided direction, benchmarks on my hardware, and an RTX 4090; every line of code, including the test suite, is its. Kudos Kimi K3! It now does 300 million keys per second, 1200× faster, and my pattern lands in minutes.

Everything on the device

Each work item derives candidates end-to-end in kernels/vanity.cl, with no library code:

SHA-512 of a 32-byte seed, specialized to a single block;
clamping, then scalar multiplication against the ed25519 basepoint;
field arithmetic mod 2^255−19, donna-style, 5 unsigned 64-bit limbs in radix 2^51;
compressed-point encoding, SSH blob, base64;
matching against a compiled filter.

A GPU can't run an arbitrary regex, so the host compiles the pattern (through regex-syntax's HIR) into per-position bitmasks over the base64 alphabet: literals become singleton masks, [pP] a 2-bit mask, love$ a suffix-anchored window. The kernel only uses that as a prefilter; the host re-derives every survivor with ed25519-dalek and applies the real regex. A kernel filter bug can cost speed, never correctness.

Wrong in ways ref10 knew about

The first kernels produced plausible-looking but wrong public keys. The trail (right scalar, wrong point, encoding off by exactly 19) led to two transcription errors:

In fe_mul, it wrote the schoolbook product with a uniform 19·g_j factor on wrap-around terms. The alternating 26/25-bit radix means products with both indices odd carry an extra factor of 2, so those wraps need 38, not 19. That's why ref10 doubles the odd f limbs (f1_2, f3_2, …).
In fe_tobytes, it added a h0 += 19 * carry9 that ref10 deliberately drops. The canonicalization already accounts for it, so outputs came out as y − 19.

Both were caught in minutes: the test suite it had written compares the kernel against ed25519-dalek on scalars, public keys, and edge cases (0·B, L·B, 0xff…). I wouldn't let it hand-roll crypto without one.

Making it fast

The naive kernel (double-and-add, generic square-and-multiply inversion) did 6.4M keys/s. Classic tricks, applied one benchmark at a time, multiplied that by 47:

A fixed-window table of precomputed basepoint multiples in (y+x, y−x, 2d·xy) form, generated on-device at startup, so no host-side bignum. 32 unsigned 8-bit windows: 98.5M keys/s.
ref10's fe_sq and an addition-chain inversion: 146M keys/s.
Montgomery batch inversion, one field inversion shared across the 32 keys each work item derives (64 spills registers and halves throughput): 167M keys/s.
Radix 2^51 limbs, 5×u64 with mul_hi for 128-bit products: 175M keys/s.
Signed 12-bit windows, down to 22, negating table points by swapping (y+x, y−x) and flipping 2d·xy: 230M keys/s.
Signed 16-bit windows, down to 16 lookups, with a bug the tests caught immediately: 16 windows cover exactly 256 bits, the recode's final carry escapes, and the computed point loses 2^256·B. One more table slot adds that point back when the carry fires: 300M keys/s.

Even pocl on CPU went from 117k to 3M keys/s, 12× the old Go version without a GPU.

Fine print

Patterns must compile to the mask form: literals and character classes over the base64 alphabet, optional ^/$ anchors. I believe this covers everybody's needs; alternation and repetitions get a clear error.

Build and run with the included flake (nix build, or nix develop for a shell with cargo, clinfo and pocl). The binary picks your first GPU; -device N overrides. cargo test runs the kernel comparisons on any available OpenCL device, pocl included, so CI works too. The default launch is 1M candidates wide, 64k on CPU runtimes after pocl choked on the private-memory footprint.

$ vanity-keygen 'zz$'
2026/07/18 18:08:58Z Looking for a public key matching zz$ on NVIDIA GeForce RTX 4090
2026/07/18 18:08:58Z Public key:
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILV3mLbw7VC7VLOkTxGQkyogoGFTq4fbZpJbsRZv5hzz

The code is on GitHub, ISC-licensed, small enough to read in one sitting.

I'm alive

2026-07-15T00:00:00Z

It's been quiet here, but I'm alive! Work is keeping me busy these days, and what's left over is split between building new stuff and writing about it. Writing gets very little.

The building side shows over on xmit.dev: cc.me, and found.as grows a contact page and four more utilities on cc.me. Building in public what I need when I need it is super enjoyable.

Work also produced blit.sh, terminal streaming to the browser in a single binary. And for my own productivity, I built zz.surf, a tiling browser for iPad, and moo.pcarrier.com, my web-based coding agent. Combined, they allow a nice workflow on an iPad Pro.

I also redesigned my home page, now a cleaner map of everything I make, and much lighter to load as I moved from iframes to baked screenshots, tailored PragmataPro to only the glyphs I need. And I now carry an NFC keyfob that points to found.as/p, so I'm drinking my own champagne.

More here when time allows.

AYN Odin 3: NixOS SD

2026-01-26T00:00:00Z

This assumes your Odin 3 can boot on EFI thanks to my previous post.

We use Nix flakes to build an image. Everything is defined in flake.nix at pcarrier/sys. The most important part is in hw/odin3.nix as we need a custom kernel today.

Being careful to target the right device, we generate an ISO and write it to the microSD card:

nix build .#nixosConfigurations.odin3iso.config.system.build.isoImage
lsblk # find the SD card device for the next command
sudo dd if=result/iso/nixos-minimal-….iso of=/dev/sd… bs=4M
sync

AYN Odin 3: Rocknix ABL

2026-01-25T00:00:00Z

This assumes your Odin 3 can boot on EFI thanks to my previous post.

ROCKNIX-ABL describes itself as a custom Qualcomm ABL created specifically for the emulation community and Qualcomm-based devices.

It allows dual-booting betwen Android and an EFI loader like systemd-boot.

Before we switch bootloaders, let's back up the current one:

edl-ng --loader iqoo_13.melf read-part abl_a abl_backup.img

Then download abl_signed-SM8650.elf and flash it with:

edl-ng --loader iqoo_13.melf write-part abl_a abl_signed-SM8650.elf

You can now boot Android by holding volume up and pressing power.

In the next installment, we'll boot NixOS from a microSD card.

AYN Odin 3: backup

2026-01-24T00:00:00Z

I acquired an AYN Odin 3 Ultra in the hopes to run a complete Linux environment on it.

This starts my explorations with a full backup of the stock Android storage.

I needed:

edl-ng
iqoo_13.melf from AYN's Discord
A udev rule to let users access USB devices

After powering the device while pressing volume up and volume down at the same time (display goes black after flashing AYN's logo), I could examine the partition tables in my fish shell with:

for lun in (seq 0 5); echo === $lun ===; edl-ng --loader iqoo_13.melf printgpt --lun $lun; end

The full map is available as a gist.

To back up, I ran:

for lun in (seq 0 5); edl-ng --loader iqoo_13.melf dump-rawprogram --lun $lun $lun/; end

From there I can mess with the system as much as I want, and to restore it to stock Android whenever needed with:

for lun in (seq 0 5); edl-ng --loader iqoo_13.melf rawprogram --lun $lun $lun/rawprogram0.xml $lun/patch0.xml; end

Thanks to gio on the AYN and Rocknix Discord servers for all the help.

In the next installment, we'll switch to a bootloader that supports systemd-boot.

xmit galore

2025-12-01T00:00:00Z

Made a bunch of improvements to xmit as I've found myself with plenty of time to spare.

Faster site uploads

A few improvements behind the scenes (mostly parallelization) to make sure your sites upload faster than ever.

UI revamp

From the overall page structure and landing page to the admin interface split into more pages, through the docs completely rethought to guide you through the process. The fastest path is a lot shorter thanks to…

Oncle Bob

A simple and lightweight graphical interface to start, build, and launch your site. It's not particularly tied to xmit other than not supporting any other providers yet. You can find it at onclebob.com.

Analytics

Long awaited feature, analytics let you analyze your site's traffic in hits or bytes. You can slice and dice by domain, path, client type, referrer, HTTP status, content type, and response size. Available at xmit.co/analytics.

Reliable storage

2025-09-19T00:00:00Z

I've been storing a lot of data somewhat reliably at home, but with my family now entrusting me with their photographs, it was time to up my game.

I'm setting up an HDD NAS for offsite backups. My home storage and media server was already running NixOS, ZFS, sanoid & syncoid (between a zpool of 4 SSDs and a zpool of 8 HDDs and 1 L2ARC SSD partition). A little bit of copy-pasting in my flake repository, nixos-install --flake github:pcarrier/sys#hare, and I'm now mirroring the most critical data to this cheap device over tailscale.

It'll relocate to a family member this week end. At that point I'll have a fast raidz regularly snapshot, with snapshots mirrored to a local raidz and a remote RAID1.

If you're serious about self-hosting and would like a similar setup, I can help you get started. Feel free to reach out!

≤255-byte HTML

2025-09-17T00:00:00Z

tantek suggested building tiny pages.

I made two: one valid HTML5, one not.

Dispensing iron

2025-09-15T00:00:00Z

Imagine a push‑button soldering iron that feeds molten solder right from the tip. Press the handle button and a controlled bead flows exactly where you need it. No separate wire to juggle. You get one‑handed precision, faster work, and cleaner joints, especially in tight spaces or field repairs.

Make it work. Make it affordable. Send me one.