RiaMaria's blog

Learning to organize my work at my new job

2023-06-21T11:30:00-07:00

As a kid, my sister kept drilling into me that I needed to learn skills to cope with my ADHD. It was an annoying thing to keep hearing, mostly because I did not know what she was talking about. It was only later on that I realized that there exists techniques for someone with executive function disorder to get by in a 9-5 workplace somehow.

The allure of organizing your work

I gave a talk at BSides San Francisco a few months ago, specifically highlighting non-technical skills and how we can use that to navigate corporate security in an engineering-like approach. Later on I realized how much importance I placed on non-technical skills in that talk, and how useful those skills are for most, if not all jobs in Information Security.

The gist of what I said in the talk

Identify your stakeholders
Set up your branding
Practice your messaaging
Expand your network
Keep track of your stakeholders with technology
Find and write good documentation
Communicate effectively and thoughtfully with your stakeholders
Just keep doing a good job at this point

A recording of said talk

Lost in Space: Navigating Corporate Security as an Engineer

Perhaps next time I can share some tips and tricks, but for now I'll keep a few tricks up my sleeve.

Body Doubling to Alleviate Work Loneliness

2023-04-09T01:00:00-07:00

I learned a new thing recently from a co-worker about Body Doubling. Honestly I was mind-boggled at first when I heard the term, thinking it was some sort of woo thing to do or perhaps something spooky.

Apparently, Body Doubling is basically just the act of getting on a voice/video call with at least one other co-worker and just working together. It's equivalent to hanging out on a Discord call with other folks and y'all are off doing your own things, or sometimes you're doing things together.

Photo courtesy of Yasmina H

CHADD: Could a Body Double Help You Increase Your Productivity?

More things I could equate it to would be working at a coffee shop (though you might not know people around you), going to the gym with a friend but not always doing the same workouts together, or heck, working at an office (what a novel concept!)

In any case, this body doubling thing is pretty great and I highly recommend it to alleviate work loneliness.

Technically, you can even body double with people you don't go to work with, but be careful not to leak any information under NDA.

Pelican is my friend now

2023-04-07T04:00:00-07:00

Let's face it, I'm probably not going to make a career out of blogging, and a lot of the pricier paid options such as self hosting a full-on CMS doesn't actually make sense for me to do.

I have de-provisioned my Ghost blog in favor of Pelican, a static site generator primarily used for blogging.

It took me approximately 3 hours to:

Provision DNS
Provision a Let's Encrypt Certificate
Fixed all of my static host server issues (second most labor and time intensive thing to do)
Migrate all of my old blog posts into Markdown (this was the most labor and time intensive part)

It would be remiss for me to not thank my guildies for hanging out with me on Discord while I was trying to figure all of this out.

In other news, I'm writing this at 4AM and I really need to get some sleep. So I'll keep it at that.

The volume does not contain a recognized file system. Chkdsk to the rescue!

2023-03-15T00:00:00-07:00

Let's say you were trying to look into your SD card on your computer, then suddenly the drive's like,

My friend just went through this issue. Basically I told him to run: chkdsk E: /f on Command Prompt ran as administrator.

...and poof! It works ✨

Anime Recommendations

2022-11-27T00:00:00-08:00

Some from "The Criterion Collection"

Samurai Champloo - Crunchyroll

About samurai and hip hop. Music slaps. RIP Nujabes.

Cowboy Bebop - Crunchyroll

About space cowboys, bounty hunting, and there's a cute corgi. Music also slaps.

Carole & Tuesday - Netflix

About two girls trying to make it in the music industry. Same universe as Cowboy Bebop. Music definitely slaps.

Akira (movie) - Hulu Plus

It's kinda gory, but it's a classic!

Every Ghibli Movie - HBO Max and wherever else you can find it

They're masterpieces. 'nuff said.

The Eccentric Family - Crunchyroll

This show is pretty interesting and about tanuki. Fantasy set in contemporary times.

Recently Hot Stuff

Frieren: Beyond Journey's End - Crunchyroll

What a banger of an anime! The story is really good.

The Apothecary Diaries - Crunchyroll

Despite being another emperor's palace detective story, I believe the premise is really interesting.

BOCCHI THE ROCK! - Crunchyroll

This anime has some interesting artistic direction, and also really good music.

Spy x Family - Crunchyroll

Great show to watch with the family. PG13 I guess? Two seasons.

Ya Boy Kongming! - HiDive

Reverse Isekai. Fun show to watch, music's not bad. Some great rap and hip hop as well. About people trying to make it in the music industry. Kongming's a great character.

Serious Stuff

Shadows House - Crunchyroll

Interesting mystery-filled anime. Just go in blind. Pretty good show IMO.

Made in Abyss - HiDive

Gory anime, I honestly stopped after a while because I couldn't take it anymore. However, I still recommend people try it out and see if it's for them.

Showa Genroku Rakugo Shinju - Crunchyroll

Great show, recommended for mature-minded audiences. Period drama with some really good Rakugo as well. Music slaps.

Victorian Romance Emma - Crunchyroll

Period romantic drama set in England. It's very charming, and the author is an Anglophile, so be prepared for interesting minute details.

Another - Crunchyroll

Thriller anime. Great if you like spooky stuff.

Boogiepop and Others - Crunchyroll

Supernatural mystery anime set in Tokyo. I don't know how to best describe it, but it's pretty good.

More Light-Hearted Stuff

Kaguya-sama - Crunchyroll

Multiple seasons. Really good and funny rom-com. Music slaps.

Horimiya - Crunchyroll

Cute boy-meets-girl story and about their classmates as well. Must-watch if you're into romance.

Poyopoyo - Crunchyroll

Great for kids and people with short attention spans! Cute cat.

Konosuba - Crunchyroll

Isekai. Very funny show, I highly recommend this one.

Laid-Back Camp - Crunchyroll

About high school girls camping. Very relaxing and educational.

Ghost Stories (dubbed) - Crunchyroll

If you're gonna watch this, watch the English dub. It's pretty funny.

Flying Witch - Crunchyroll

Real light-hearted fun anime about a witch in the countryside of Japan. If you want to just relax and have a good time, this is the show to watch.

Sekko Boys - Crunchyroll

Short-form anime with some really funny skits. I recommend watching it if you have a few minutes to spare every now and then.

Other Gems

The Saint's Magic Power is Omnipotent - Crunchyroll

Romantic Isekai, great for when you just want to watch something easy on the eyes and don't want to think much.

Chihayafuru - Crunchyroll

Multiple seasons. Really refreshing story about a card game named Karuta and the development of the characters in the story about it.

March Comes in Like a Lion - Crunchyroll

Drama about Shogi players. It can be pretty melancholic and uncomfortable at times, but the story is really good IMO.

ODDTAXI - Crunchyroll

Mystery drama, pretty good. Full of animal characters. Don't get spoiled! 10/10 writing.

The Perfect Insider - Crunchyroll

Pretty good murder mystery, music slaps.

Call of the Night - HiDive

About vampires and a teenager that discovers their world. Music slaps IMO.

Raven of the Inner Palace - Crunchyroll

Romantic Chinese show about a consort and a new emperor where the consort mostly deals with ghosts and curses and stuff. Supernatural. Very pretty show.

Chainsaw Man - Crunchyroll

Don't watch with your family! LOL

It's the highlight of its season.

Securing your Self-Hosted Ghost 5.20 instance with NGINX

2022-11-02T00:00:00-07:00

I just set up blog.riamaria.com a few days ago. It's been really fun setting up the server. I looked up some ways to secure my Ghost instance better. Great ideas here and there, and mostly just regular AppSec things.

With this guide, I assume that Ghost handled the NGINX configs for you upon installation. Here are some things that you can do with NGINX to harden your Self-Hosted Ghost instance:

💡 Note that you after saving the NGINX config files, you should run nginx -t before reloading NGINX ( server reload nginx ) to propagate changes gracefully.

Redirect from HTTP to HTTPS

Unfortunately, the default Ghost instance will allow http://yourblog.example to go through to your site. I hope at this point in time people know better than to go to HTTP only sites due to lack of encryption in-transit.

As root, edit /etc/nginx/sites-enabled/yourblog.example.conf:

location / {
       proxy_set_header X-Forwarded-For proxy_add_x_forwarded_for;
       proxy_set_header X-Forwarded-Proto $scheme;
       proxy_set_header X-Real-IP $remote_addr;
       proxy_set_header Host $http_host;
       proxy_pass http://127.0.0.1:2368;
}

/etc/nginx/sites-available/yourblog.example.conf

location / {
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header Host $http_host;
        return 301 https://$host$request_uri;
}

/etc/nginx/sites-available/yourblog.example.conf

This will permanently redirect you from HTTP to HTTPS if you go to the HTTP site.

Removing HTTP headers

One reason to not publish the NGINX version in the response headers of your site is to make it a little more difficult for attackers to sniff what version you are running on. Running on a known vulnerable version will make it more likely for bad actors to try and do something funny on your instance.

As root, edit /etc/nginx/nginx.conf and uncomment server_tokens off;. It should look like this:

        ##
        # Basic Settings
        ##

        sendfile on;
        tcp_nopush on;
        types_hash_max_size 2048;
        server_tokens off;

/etc/nginx/nginx.conf

Another thing is that you might want to remove the X-Powered-By: Express header as well. In both /etc/nginx/sites-enabled/yourblog.example.conf and /etc/nginx/sites-enabled/yourblog.example-ssl.conf, add the following line: proxy_hide_header X-Powered-By;. It should look like this:

    location / {
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header Host $http_host;
        return 301 https://$host$request_uri;
        proxy_hide_header X-Powered-By;
    }

/etc/nginx/sites-available/yourblog.example.conf

    location / {
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header Host $http_host;
        proxy_pass http://127.0.0.1:2368;
        proxy_hide_header X-Powered-By;

    }

/etc/nginx/sites-available/yourblog.example-ssl.conf

Restrict Admin Access to your IP only

This part was a little tricky for me to get. Depending on whether or not you are using Cloudflare, you may have to use a different conditional.

Adapted from: https://www.blakejarvis.com/miscellaneous-articles/how-to-secure-the-ghost-blogging-platform

    location = /ghost/ {
        if ($proxy_add_x_forwarded_for ~* [YOUR_IP_ADDRESS]) {
            proxy_pass http://127.0.0.1:2368$request_uri;
        }
    }

    location = /ghost/api/admin/ {
        if ($proxy_add_x_forwarded_for ~* [YOUR_IP_ADDRESS]) {
            proxy_pass http://127.0.0.1:2368$request_uri;
        }
    }

    location = /ghost/api {
        allow all;
        proxy_pass http://127.0.0.1:2368$request_uri;
    }

Using Cloudflare: /etc/nginx/sites-available/yourblog.example-ssl.conf

As you can see above, we are using the $proxy_add_x_forwarded_for variable to match with the IP address. Below is an example of a server that does not use Cloudflare:

    location = /ghost/ {
        if ($remote_addr ~* [YOUR_IP_ADDRESS]) {
            proxy_pass http://127.0.0.1:2368$request_uri;
        }
    }

    location = /ghost/api/admin/ {
        if ($remote_addr ~* [YOUR_IP_ADDRESS]) {
            proxy_pass http://127.0.0.1:2368$request_uri;
        }
    }

    location = /ghost/api {
        allow all;
        proxy_pass http://127.0.0.1:2368$request_uri;
    }

Not using Cloudflare: /etc/nginx/sites-available/yourblog.example-ssl.conf

Do take note that if you made a mistake and you tested it, your browser may cache the 301 Redirect. Simply turn on your Developer tools (F11) and under Network, tick Disable Cache. That should allow you to go back to http://yourblog.example/ghost and try again.

Configure Security Headers in NGINX

Another thing you can do is add security headers to your NGINX config.

Read the following article for more information: https://webdock.io/en/docs/how-guides/security-guides/how-to-configure-security-headers-in-nginx-and-apache

Note: I have spent a long while to try and establish a proper Content Security Policy, but that doesn't seem to be possible with how Ghost themes are currently made. Your mileage may vary.

Removing an element from a Binary Search Tree in Python

2022-10-24T00:00:00-07:00

💡 Note: Balancing the Binary Search Tree is out of scope for this blog post.

I’ve been taking Codecademy lessons recently and one of the bonus exercises was to figure out how to delete an element from a binary search tree. I figured I’d give it a shot.

class BinarySearchTree:
    def __init__(self, value):
      self.value = value
      self.left = None
      self.right = None

Given a binary search tree, you can imagine our working tree to be this image below:

Example 1: Removing node 15, the parent node (Tree Rotation)

Removing 15 from the tree means that you’ll have two separate trees. To balance this all out, we can do a tree rotation.

First, we will get rid of 15 and make 16 the parent:

Next, because the original left node (14) is orphaned, we would like to move 14 to be the leftmost node of the original tree (which would leave us with node 17).

We then add node 14 and its children to the previous leftmost node which is 17.

Example 2: Removing node 18, a node without children

The work for this is straightforward. We remove Node 18 and we will not have to do any other operations. As you will see in the code below, 16 basically just de-references 18 and we’re good as gold.

Example 3, Removing node 17 (Shift Left)

Removing 17 is pretty simple still because node 17 only has a left child. This means that we move node 14 to node 17’s position and not have to worry about an orphaned right node.

The Code

def remove_dft(self, value) -> bool:
    if self.value == value:
        if self.right:
                # Move right node up to be the parent, then do tree rotation
                self.right_rotation()
            elif self.left:
                # Move left node up to be the parent
                self.left_shift()
            else:
                # No children, this node needs to be de-referenced
                self.value = None
                return True

    if self.left:
        found = self.left.remove_dft(value)
        if found:
            # Dereference empty node
            if self.left.value == None:
            self.left = None
            return True

    if self.right:
        found = self.right.remove_dft(value)
        if found:
            # Dereference empty node
            if self.right.value == None:
                self.right = None
                return True

    return False

def left_shift(self):
    if self.left:
        # Shift left node to be the parent
        self.value = self.left.value
        self.right = self.left.right
        self.left = self.left.left
        return True

    return False

def right_rotation(self):
    if self.right:
        # Rotate right node up
        self.value = self.right.value
        self.right = self.right.right

        # Move orphaned left node into the leftmost node of the new parent
        orphaned_left_node = self.left
        if orphaned_left_node and self.right and self.right.left:
            leftmost_node = self.right.left
            while leftmost_node.left:
                leftmost_node = leftmost_node.left
            leftmost_node.left = orphaned_left_node
        else:
            self.left = orphaned_left_node

        return True

    return False

Runtime

Because the tree isn’t necessarily balanced, the worst case runtime would be O(N) or linear.

Ang Aking Pagiging Nonbinary

2021-06-30T00:00:00-07:00

Ito ang aking pagtangka sa pagpapaliwanag ng aking kasarian.

Gender Identity

Alam ninyo ang babae at saka lalake. Ito ang pinaguusapan pag pinapanganak ang sanggol.

Sa nakasanayan ng marami, ang ari ng tao at saka ang kasarian ay pinagtutugma. Ang ari ng tao kung saan hinahango ang kanyang "kasarian" ay tawag na "assigned sex at birth". Ang aking assigned sex at birth ay Female. AFAB for short, assigned female at birth.

Ang Gender o kaya Gender Identity ay hindi parating nakabase sa ari ng tao.

Homosexual at Transgender

Walang kinalaman ang assigned sex at birth sa gender identity. Maaaring iba ang gender identity sa kanyang assigned sex at birth.

💡Pagusapan natin saglit ang Bakla. Alin dito sa tingin ninyo ang definition ng salitang Bakla?

A. Lalaki na interesado sa kapwa lalaki

B. Pinanganak na lalaki na ngayon ay babae

Sa totoo, hindi ko alam ang tamang sagot. Sa pagkaka alam ko, pinaghalo ang parehong kahulugan sa salitang Bakla, ngunit pwedeng A lamang, B lamang, o pareho.

Definition of Terms

Homosexual - Lalaki na interesado sa kapwa lalaki, o kaya babae na interesado sa kapwa babae
Transgender Woman - Pinanganak na lalaki na ngayon ay babae
Cisgender Woman - Pinanganak na babae at ngayon ay babae pa rin
Transgender Man - Pinanganak na babae na ngayon ay lalaki
Cisgender Man - Pinanganak na lalaki na ngayon ay lalaki pa rin

Ang cisgender woman saka transgender woman ay parehong babae, at parehong lalaki ang cisgender man at saka transgender man.

Nonbinary

Nakasanayan ng marami na dalawa lamang ang alam nilang kasarian. Ngunit marami pang ibang kasarian na ngayon palang napapagusapan ng marami. Kung ang kasarian na babae at lalaki ay binary (hango sa dalawa), ang mga ibang kasarian ay nonbinary. Aking Gender Expression

Ang aking karaniwang gender expression ngayon ay pambabaeng itsura. Habang ang anyo ko ay pambabae, ang aking gender identity ay nonbinary.

Ano Ngayon?

Ang hiling ko po lamang ay respetuhin ang aking SOGIE (sexual orientation, gender identity, and expression).

Kapag nagsasalita ng Ingles, hiling ko po sa inyo na imbes na "SHE", gamitin niyo po "THEY" (kunwari higit sa isang tao ang tinutukoy ninyo).

Kausapin niyo po ako kung may tanong kayo. Basta mabuting intention saka may respeto, sasagutin ko.

Basahin niyo rin po ang mga link sa baba, under Further Reading.

Typing Accented Characters on Windows 10

2021-06-20T00:00:00-07:00

There are words and names that have accents. Sure, you could use alt key codes on Windows, but what if you're on a laptop without a numpad?

Why is this important?

Not only is this good information to have, but by learning and practicing usage of accented letters, you also have the benefit of being respectful of people's names and languages aside from English.

Okay, how do I do this?

Go to Settings and choose Language. Choose Preferred Languages > English (United States) > Options

Next, choose "Add a keyboard", and choose "United States - International"

After that, all you need to do is switch between keyboards. Your taskbar should now have a keyboard indicator (it may say "ENG US"). You can use CTRL + Shift to switch between keyboards.

Okay, but how do I use this?

On an international keyboard, if you wanted to do é (ALT + 0233), you could instead use ' + e to make the character. Try it out!

ñ can be a little bit trickier. Since tildes (~) need shift and shift happens to change the capitalization of a given letter, you would have to turn on caps lock to get to the opposite, desired capitalization. Try it out: caps lock, then ~ + n

You may notice that the accent characters may be a little bit difficult to figure out. You're trying to type a tilde by itself, for example. On the international keyboard, you can simply hit the space bar to make sure that the accent character does not try to accentuate the next character.

RiaMaria's blog

Learning to organize my work at my new job

The allure of organizing your work

The gist of what I said in the talk

A recording of said talk

Body Doubling to Alleviate Work Loneliness

Pelican is my friend now

The volume does not contain a recognized file system. Chkdsk to the rescue!

Anime Recommendations

Some from "The Criterion Collection"

Samurai Champloo - Crunchyroll

Cowboy Bebop - Crunchyroll

Carole & Tuesday - Netflix

Akira (movie) - Hulu Plus

Every Ghibli Movie - HBO Max and wherever else you can find it

The Eccentric Family - Crunchyroll

Recently Hot Stuff

Frieren: Beyond Journey's End - Crunchyroll

The Apothecary Diaries - Crunchyroll

BOCCHI THE ROCK! - Crunchyroll

Spy x Family - Crunchyroll

Ya Boy Kongming! - HiDive

Serious Stuff

Shadows House - Crunchyroll

Made in Abyss - HiDive

Showa Genroku Rakugo Shinju - Crunchyroll

Victorian Romance Emma - Crunchyroll

Another - Crunchyroll

Boogiepop and Others - Crunchyroll

More Light-Hearted Stuff

Kaguya-sama - Crunchyroll

Horimiya - Crunchyroll

Poyopoyo - Crunchyroll

Konosuba - Crunchyroll

Laid-Back Camp - Crunchyroll

Ghost Stories (dubbed) - Crunchyroll

Flying Witch - Crunchyroll

Sekko Boys - Crunchyroll

Other Gems

The Saint's Magic Power is Omnipotent - Crunchyroll

Chihayafuru - Crunchyroll

March Comes in Like a Lion - Crunchyroll

ODDTAXI - Crunchyroll

The Perfect Insider - Crunchyroll

Call of the Night - HiDive

Raven of the Inner Palace - Crunchyroll

Chainsaw Man - Crunchyroll

Securing your Self-Hosted Ghost 5.20 instance with NGINX

Redirect from HTTP to HTTPS

Removing HTTP headers

Restrict Admin Access to your IP only

Configure Security Headers in NGINX

Removing an element from a Binary Search Tree in Python

Example 1: Removing node 15, the parent node (Tree Rotation)

Example 2: Removing node 18, a node without children

Example 3, Removing node 17 (Shift Left)

The Code

Runtime

Ang Aking Pagiging Nonbinary

Gender Identity

Homosexual at Transgender

Definition of Terms

Nonbinary

Ano Ngayon?

Further Reading

Typing Accented Characters on Windows 10

Why is this important?

Okay, how do I do this?

Okay, but how do I use this?

Check out the following guides for more details