Quadrante do Giuliano

Would you see a doctor who is wrong 30% of the time?

Sat, 14 Nov 2026 20:30:00 +0000

From patients hospitalized after following ChatGPT dietary and health advice and severe failures in emergency triage to yesterday's nationwide FAA air traffic control shutdown days after expanding a nearly $1 billion AI tool: why 30% to 90%+ hallucination rates make regulating where language models can and cannot operate urgent.

From .restic.sh to .rustic.sh: Adopting Native rustic Profiles and Fixing Silent Traps

Sat, 14 Nov 2026 18:20:00 +0000

How I finally retired the legacy ~/.restic.sh script in favor of ~/.rustic.sh using native TOML profiles, config inheritance, a single backup command per repository, silent exclusion fixes with as-path, and a dual disaster-recovery guide for both rustic and restic.

My new backup routine with rustic

Fri, 13 Nov 2026 19:00:00 +0000

A while ago I presented my backup routine here on the blog using the excellent restic. Now I bring my impressions, installation instructions and a hands-on benchmark of rustic, a Rust reimplementation fully compatible with restic repositories, faster, lock-free and packed with new features that are already running daily on my Manjaro desktop.

Knowing what to remove is design too

Sun, 08 Nov 2026 18:04:22 +0000

The last post in the series about Olha o Bichim!. The kids who didn't get the game, Apple's rejection marathon, what went into and out of the game, and what I take away from it all.

Every bug becomes a rule

Sun, 08 Nov 2026 18:04:11 +0000

The fourth post in the series about Olha o Bichim!. CLAUDE.md files as the project's institutional memory, the bugs that became law, and Ponytail, the lazy senior who writes less code.

Whoever writes does not approve

Sun, 08 Nov 2026 18:03:56 +0000

The third post in the series about Olha o Bichim!. How an approved spec becomes code with TDD, subagents that don't know each other, and a review that doesn't trust what the implementer says.

It all started with a document

Sun, 08 Nov 2026 18:03:38 +0000

Before the first line of code of Olha o Bichim! there was a design document. In this second post of the series, I explain why writing before programming is what keeps the AI from deciding for you.

Look, mom, a critter!

Sun, 08 Nov 2026 18:03:27 +0000

How a phrase said by a child in a park in Rio Branco became a game published on Google Play and the App Store. The first post in the behind-the-scenes series about Olha o Bichim!.

Atuin got even better!

Sun, 01 Nov 2026 23:58:00 +0000

Two years ago, my last post before this blog went offline was "use atuin and browse your shell history", a short introduction to this fantastic tool. Now I'd like to talk about the new features introduced in recent versions and what has improved since that first post.

Reactivating Quadrante do Giuliano

Sun, 01 Nov 2026 01:10:00 +0000

Hi, I am reactivating this blog after two years offline. This time, I intend for it to no longer run the risk of going offline, and to that end I made one crucial change: no more WordPress. All posts were migrated to my own solution, which I built with the Django framework.

It is a two-part solution: an administration side that gives me a reasonable, fit-for-purpose web interface to write posts and manage the blog, and which controls and publishes (via wrangler) the second part, a static site on Cloudflare Pages that is "linked" to the URL you are on. However, this project doesn't even have a proper name: I call the administration "admin" and the static version "blog". Simple, right? But really it is the purest lack of creativity.

Why this split? A static site in pure HTML and JavaScript cannot be hacked directly, because there is no dynamic backend behind it. Besides, Cloudflare Pages is free and has practically unlimited capacity, so not only do I not need to worry about the site's security, I don't need to fear that millions of visits will take this blog down, whether from legitimate traffic or from a DDoS.

Even so, the administration could be hacked, and to prevent that I reduced the attack surface of the monolith that runs the application, using as few libraries as possible and keeping it easy to update; on top of that, it lives at an address I will not disclose.

I believe these measures ensure the blog's security and ease of maintenance, so that it won't be a source of headaches and, above all, won't be discontinued again.

Use atuin and browse your shell history

Sun, 21 Jul 2024 14:42:00 +0000

No matter which shell you use on Linux, macOS or even Windows, with atuin.sh you will never again get lost in the endless universe of commands that all of us who use the shell type every day.

Example:

And that is just one of the features atuin gives you. It has many more, including syncing your history across machines, which lets you see a command that was run on another machine, all encrypted, of course.

More information and examples on the project's official website: https://atuin.sh

SearXNG, an alternative to Google

Mon, 06 May 2024 00:27:00 +0000

Google's results have been getting worse every day lately, especially for searches in English. Since my hobby is selfhosting, I looked for an alternative that could at least partly replace Google.

And I found one: SearXNG is a search engine that uses multiple sources, that is, a metasearch engine.

On top of that, users are not tracked and no profiles are built about them, every search is anonymous, and the code is open: https://github.com/searxng/searxng.

You can freely pick an instance here: https://searx.space/

And if you want, you can use my instance: https://searx.cardoso.work

I find the results better than Bing's, closer to what Google used to be.

Removing an APT from a WordPress Blog

Sat, 16 Mar 2024 17:45:00 +0000

In a recent article I talked about the dangers of using nulled plugins (https://blog.cardoso.work/en/wordpress-and-the-danger-of-nulled-plugins-and-themes/), because they can come with backdoors that let a sufficiently sophisticated adversary, in this case an APT (https://www.kaspersky.com/resource-center/definitions/advanced-persistent-threats), break into your WordPress instance and use it for shady purposes.

In this case, the malware was quite sophisticated: it infected several WordPress files and created randomly named files that were backdoors, so that if the WordPress files were replaced, it would still have multiple paths to reinfection.

It took several tools and manual code editing, plus blocking the IPs that were making the requests, to isolate the threat.

Some of the tools used were Sucuri Scanner (https://wordpress.org/plugins/sucuri-scanner/), together with Wordfence CLI (https://github.com/wordfence/wordfence-cli) and Ninja Scanner (https://wordpress.org/plugins/ninjascanner/).

With these tools, I had the path of each infected file, and I either removed the malicious code or deleted the file. Slow work, but it paid off.

So, even though it is possible to get rid of a threat like this through hard work, the best option is to avoid nulled plugins.

Into the Night: Reflections of an Insomnia Traveler

Tue, 27 Feb 2024 16:10:45 +0000

In the deep silence of the night, where the world seems to hold its breath and shadows dance on the walls at the whim of the moon, lies a stage familiar to many: the theater of insomnia. It is no grand spectacle, with applause and closing curtains; it is more an intimate monologue, staged in the mind, where the deafening silence is the only spectator.

Insomnia, that capricious artist, is not content to visit us now and then; for some, it is a constant presence, a companion every night that, paradoxically, never really lets us rest. With a varied repertoire, it whispers racing thoughts, unexpected memories and worries about the future as easily as a skilled musician plucks the strings of an instrument.

And so, while the world around us sinks into the temporary oblivion of sleep, we insomniacs set off on a peculiar nightly journey. Our minds, refusing to fall silent, become stages where dramas, comedies and tragedies unfold. The bed, far from being a sanctuary of rest, becomes a battlefield where we fight our own thoughts, tossing and turning in the fruitless search for a position that will bring oblivion.

Sometimes insomnia leads us to question life's choices, to go over old conversations or to imagine future scenarios that may never happen. Other times, it keeps us company on a trip down memory lane, revisiting moments we would like to forget or to relive. And, in its cruelest form, it simply keeps us awake, for no apparent reason, robbing us not only of sleep but of peace.

But, as in every chronicle, there is beauty even in adversity. Insomnia, for all its discomfort, also offers moments of deep reflection, of unexpected creativity and of a sharper understanding of our own existence. In the dead hours of the night, we can find a clarity that the noisy day often denies us. It is a chance to get to know ourselves in our rawest form, without the distractions and masks that daily life forces us to wear.

So, while we look for solutions to our sleepless nights — whether through medication, relaxation rituals or lifestyle changes — perhaps we can also learn to appreciate the insights they bring us. Insomnia, with all its exasperation, reminds us that sometimes it is in the stillness of the night that we find the answers that elude us during the day.

And so, as we wait for the sleep that stubbornly refuses to come, we can at least try to make our nightly vigil a moment of introspection and discovery. Who knows, perhaps in the dancing shadows and the speaking silence we will find a different kind of peace — the serenity of being fully present, even in the absence of sleep.

WordPress and the danger of nulled plugins and themes

Mon, 26 Feb 2024 12:01:45 +0000

Nobody told me about it, I saw it myself: a WordPress installation infested by an APT (https://www.kaspersky.com/resource-center/definitions/advanced-persistent-threats) that lives up to its name. Even after deleting the files with the malicious code, they came back within seconds.

This is a very sophisticated threat that uses several techniques to stay in the installation even after an antivirus scan and a manual cleanup, because it has several safeguards and triggers to come back.

On top of that, the malicious code snippets are obfuscated, which makes them impossible to understand.

So far, I believe the only solution is to abandon this instance and install everything from scratch. The catch is that it is an online store, with a lot of very important data and customizations that take a lot of work to bring over to the new installation.

And where did this problem come from? From using nulled plugins.

These plugins, which can be bought for very low prices on dubious websites or found on forums, often contain malicious code and are real Trojan horses that you will be bringing into your WordPress instance.

That is why I recommend everyone avoid falling for the scam: following the maxim that nothing is free on the internet, and if you don't pay for something, you are the product, here you will be the victim and have your infrastructure hijacked by third parties.

The sword of Damocles, or when AI has to avoid being “woke” and “not inclusive” at the same time

Sat, 24 Feb 2024 15:40:10 +0000

This post is a reflection on the Poder360 article Google AI images are part of “woke” culture, says “NY Post” (in Portuguese); I recommend reading it for context.

In short, Google opened access to the new version of its Gemini AI, and image generation was producing some controversial results, to say the least, such as a Black female pope when asked for an image of a Pope.

Credits: Poder360/Gemini

In another case it showed a Black man when asked for an image of the US "Founding Fathers", and when asked to explain why it did so, the AI replied that it wanted to be more inclusive.

So that is what happened, and Google even disabled the feature. Which leads me to speculate about the reasons behind it, which go far beyond wanting to be "woke", an expression that somewhat repels me and that I usually only see people on the right use.

Basically, as I see it, 99% of the times I see the word "woke" it is criticizing a supposed movement made up of people who try to distort even reality in order to be more inclusive or to make historical reparation.

However, I don't see people on the left use the term; I have never seen anyone call themselves "woke", I only see people on the right criticizing it. But anyway, back to the heart of the matter: we have a problem here that must have happened in training, where the aim was to create a more inclusive AI, and it generalized that idea to every case, producing, to the despair of conservatives, images that go against what they hold most sacred.

Let's face it, it also resulted in historically inaccurate depictions, which is also worrying. But mistakes like this have happened before with training data that was not inclusive and generated racist content, or at least racially biased content.

So, as I see it, it is a herculean challenge to create an AI that is balanced enough to be inclusive and, when asked to generate an image, does not fall into racist stereotypes, for example, so that when we ask it for an image of a criminal, the criminal is not Black.

These are considerable challenges: weighing stereotypes and biases while being factually correct when necessary. I believe this is one of the biggest challenges in AI today, because the product will be analyzed and used in narratives both by the progressive left, which champions identity issues, and by conservatives, who will accuse the company of being "woke".

We have to understand that these models only represent what they learned in training. If the datasets have biases, those will be present in the final product. For example, without the right guidance, when asked for an image of a lawyer or an architect, it would never be a Black person. Given that, Google must have done its best to keep the AI from reproducing prejudice and to make it more inclusive, which led to this unexpected result.

These models cannot discern when to apply a rule as complex as weighing when to be historically accurate and when to be inclusive. If their internal prompts also contain the rule that they should strive to be inclusive, they will do so regardless of context. After all, it is just a model.

Now we wait to see what Google will do…

My backup routine with restic

Wed, 07 Feb 2024 23:35:04 +0000

restic is a backup utility that ensures data integrity, and its main feature is the ability to keep data encrypted in a repository structured much like what we see in Git.

That is, versioning is the rule, and that is its second main feature, besides the encryption already mentioned.

Along with versioning we also get deduplication: in a restic repository, a piece of data is stored only once and is just referenced afterwards.

And finally, repositories also support compression. So, to recap, we have an encrypted, deduplicated, versioned and compressed repository.

Currently, my backup routine is a crontab that runs the following script:

#!/bin/sh
repositorio="/backup" #repository path
password_file="/armazem/Sync/senha.txt" #file with the password
# 'unlock' removes any locks left by a previous restic process
restic --password-file=$password_file -r $repositorio unlock
# 'prune' removes from the repository any leftover data belonging to snapshots that were already deleted.
restic --password-file=$password_file -r $repositorio prune
# Here we set the backup retention policy: 7 daily backups, one for each day of the week, two weekly and 1 monthly.
restic --password-file=$password_file -r $repositorio forget --keep-daily 7 --keep-weekly 2 --keep-monthly 1 --keep-tag keep --prune
# Finally, we back up my home folder (giuliano)
restic --exclude-caches --exclude=".cache" --password-file=$password_file -r $repositorio backup /home/giuliano
# And here we finish by backing up the /armazem folder, which is on another disk and holds many relevant files.
restic --exclude-caches --exclude="backup" --exclude="tv" --exclude="downloads" --exclude="movies" --exclude="local"  --password-file=$password_file -r $repositorio backup /armazem

To check the backups, I can run the following command:

restic --password-file=/armazem/Sync/senha.txt -r /armazem/backup snapshots

Which returns the following output:

repository 6359e57a opened (version 2, compression level auto)
ID        Time                 Host        Tags        Paths
---------------------------------------------------------------------------
dac71fa4  2024-01-18 04:01:32  ryzen                   /home/giuliano
c46518e1  2024-01-18 04:03:45  ryzen                   /armazem
81732621  2024-01-19 04:01:13  ryzen                   /home/giuliano
76412b53  2024-01-19 04:03:29  ryzen                   /armazem
e8754b00  2024-01-20 04:01:16  ryzen                   /home/giuliano
fd999edd  2024-01-20 04:03:53  ryzen                   /armazem
af0037f0  2024-01-21 04:01:24  ryzen                   /home/giuliano
baa4f85b  2024-01-21 04:05:19  ryzen                   /armazem
95f5eecb  2024-01-22 04:00:41  ryzen                   /home/giuliano
bfa109cb  2024-01-22 04:03:38  ryzen                   /armazem
f342549a  2024-01-23 04:01:24  ryzen                   /home/giuliano
bd7d291b  2024-01-23 04:04:26  ryzen                   /armazem
c0d67f5a  2024-01-24 04:01:33  ryzen                   /home/giuliano
961f1829  2024-01-24 04:04:14  ryzen                   /armazem
c41d42dd  2024-01-25 04:01:29  ryzen                   /home/giuliano
ad507348  2024-01-25 04:03:10  ryzen                   /armazem
---------------------------------------------------------------------------
16 snapshots

In case of disaster, just run the following command to restore a backup:

restic --password-file=/armazem/Sync/senha.txt -r /armazem/backup restore b1297a9c --target=/

Here b1297a9c is the snapshot's unique ID and the other parameters are the password file and the repository. The target is the root, because restic stores the folder structure starting from the root, so it usually makes the most sense to restore from there.

This is just a quick demo of what restic can do. It is also worth noting that it has native rclone support, as long as both tools are installed, which opens up countless cloud providers as a "backend".

In addition, restic has a considerable list of GUIs and utilities that make it easier to use, which you can check out here: https://github.com/rubiojr/awesome-restic

The combination of these features makes restic a robust and versatile backup tool, serving home users as well as more demanding business environments. Its extensive support for different cloud backends, along with the possibility of integrating with other tools such as rclone, gives unprecedented flexibility in choosing how and where to store your backups.

I encourage everyone interested to explore its features and to consider restic as a backup solution. Whether you are a tech enthusiast looking for a reliable tool to protect personal data, or a company seeking an efficient and secure backup solution, restic offers a powerful combination of simplicity, flexibility and security.

Be sure to check out the community and the available resources to get the most out of restic. The security of your data is essential, and choosing the right tool is the first step to ensuring that security in an increasingly complex digital world.

Croc and Magic-Wormhole

Sat, 09 Dec 2023 13:16:25 +0000

These two utilities are cousins, one was inspired by the other, and they are simply the two most useful little things I have found lately, after atuin.sh.

Say you want to copy a file from one machine on the LAN to another, or to your phone (both have simple Android versions), or to a VPS/VDS, or whatever.

You only need the utility on one side: run programname send filename, it spits out the command you have to type on the receiver, and that's it.

I use both, because when one's protocol fails, the other's works.

Highly recommended.

You can find croc here: https://github.com/schollz/croc

And Magic Wormhole is here: https://github.com/magic-wormhole/magic-wormhole

They differ only in implementation: one is written in Python (Wormhole), the other in Go (Croc). The protocols they use are different too, each takes its own approach to discovering the other end, which is why, if one fails, you use the other. You will find more details on their pages.

Excellent solutions. They remind me of when I discovered syncthing.

The only institution that worked in Brazil is gone

Sat, 09 Dec 2023 13:01:07 +0000

With the end of legendas.tv, its replacements don't come anywhere near the subtitle quality I was used to for more than a decade. Now every translation I see in my sources, except for anime and K-dramas, which have a very strong community, is of terrible quality, because it is made by AI, and in the worst possible ways.

More than once I have caught myself making subtitles with AI and fixing the mistakes, because I wanted to watch with subtitles. It is a pastime, maybe I will publish them, but since I watch things like “Collins from Accounts”, which is so obscure here that I won't even go into detail, I think I deserve my fate, because you can't find it even on those sites.

Anyway, I have always been a consumer; I have posted a torrent only a few times in my life, let alone something so obscure, and I wonder whether people would even want it. But I digress.

Besides, torrent is falling more and more out of use, at least from what I can tell; users prefer other channels, from Telegram to Filewarez. Anyway, I have my responsibilities: I run a Plex instance that I share with friends, for the kind of content that isn't even on the streaming services. Or, if it is, it isn't available to us here in Brazil.

It is hard to maintain, but it is more of a hobby for me.

Anyway, that's it. I just wanted to vent about the lousy quality of the subtitles I find in my sources. If it is going to be done by machines, I'd rather do it myself. Anyone who thinks AI will completely replace human work is a real sucker.

Around the hole, everything is edge

Wed, 06 Dec 2023 15:19:58 +0000

A talk of pure intelligence by the brilliant Ariano Suassuna