Forem: KartikJha

🧠 Go (Golang) Cheat Sheet

KartikJha — Mon, 19 Jan 2026 17:25:58 +0000

A concise, interview‑ready reference for Go fundamentals, runtime internals, and concurrency.

1. Structs

Struct Initialization

Go uses composite literals (similar to JS objects, no new keyword required).

type S struct {
    f  string
    f1 int
}

c := S{f: "l", f1: 1}
fmt.Println(c.f)

2. Methods & Receivers

2.1 Value Receiver

Operates on a copy of the struct
Original value is not modified
Go may optimize by passing address internally

func (s S) Update() {
    s.f = "x"
}

2.2 Pointer Receiver

Operates on the original struct
Mutations persist

func (s *S) Update() {
    s.f = "x"
}

Rule of thumb

Read‑only → value receiver
Mutations / large structs → pointer receiver

3. Random Numbers

Generate values in [min, max)

rand.Intn(max-min) + min

4. Arrays vs Slices

Arrays

Fixed length
Value types (copied on assignment)

arr := [3]int{1, 2, 3}

Slices

Dynamic length
Reference to an underlying array

slice := []int{1, 2, 3}

Conceptual representation:

type Slice struct {
    ptr *T
    len int
    cap int
}

Key Differences

Feature	Array	Slice
Length	Fixed	Dynamic
Copy	Value copy	Reference copy
Resize	❌	✅

Common Operations

append(slice, val)
len(slice)
slice[:]
slice[a:b]

Spread operator:

newSlice := append([]int{}, slice...)

Looping

for i, ele := range arr {
    _ = i
    _ = ele
}

5. Strings

From the strings package:

strings.ToUpper()
strings.ToLower()
strings.Split()
strings.Trim()
strings.Replace()
strings.Count()

6. Runes & ASCII

Go strings are UTF‑8
rune = int32

r := 'a'
fmt.Println(r) // 97

ASCII:

'0' → 48
'a' → 97

7. `make` vs `new`

make

Initializes reference types and their backing data.

make([]int, 0)
make(map[string]int)
make(chan int)

new

Allocates zero value and returns a pointer.

p := new(int)

8. Errors, Panic & Defer

Error

Expected failure
Must be handled

return errors.New("something went wrong")

Panic

Program is in an invalid state

panic("fatal error")

Defer

Executes after the surrounding function returns
Runs in LIFO order

defer cleanup()

When `defer` does NOT run ❌

os.Exit()
SIGKILL
Power failure 😄

Recovering from Panic

defer func() {
    if r := recover(); r != nil {
        fmt.Println("Recovered:", r)
    }
}()

9. Goroutines & Go Runtime

Goroutines

Created using go
Always concurrent
Parallelism depends on GOMAXPROCS

go doWork()

9.1 Goroutines vs OS Threads

Goroutines are not threads
Managed by the Go runtime scheduler

9.4 GMP Scheduler & OS Threads

What does it mean when the GMP scheduler runs a goroutine on a specific OS thread?

The Go runtime scheduler decides which goroutine (G) runs on which logical processor (P)
A P is bound to an OS thread (M)
The OS provides threads on demand when requested by the Go runtime

Key Points

OS allocates threads at the runtime’s request
The Go program runs inside an OS process
The runtime multiplexes goroutines over OS threads

High‑level Architecture

OS
 └─ Process (your Go app)
     ├─ Go runtime
     │   ├─ Scheduler
     │   ├─ GC
     │   ├─ M:P:G
     │   └─ Threads
     └─ Goroutines

OS Process Startup

OS
 ├─ Loads Go binary
 ├─ Creates process
 ├─ Sets up virtual memory
 │   ├─ code
 │   ├─ globals
 │   ├─ stack (main thread)
 │   └─ heap address range (empty)
 ├─ Sets up FD table
 └─ Sets env vars

Go Runtime Initialization

Go runtime starts
 ├─ Initializes memory allocator
 │   ├─ Requests heap pages from OS (mmap)
 │   ├─ Creates arenas, spans, size classes
 ├─ Initializes GC
 ├─ Initializes scheduler (G-M-P)
 ├─ Creates OS threads
 └─ Prepares goroutine stacks

10. File Descriptors & Sockets (Linux)

Process
 └─ FD table
     └─ FD (int) → Kernel Object
         ├─ regular file
         ├─ socket
         ├─ pipe
         └─ device

Unix socket → IPC
Network socket → Networking

11. Channels

Basics

ch := make(chan int)
ch <- 1
val := <-ch

Unbuffered Channel

Send blocks until receive

ch := make(chan int)

Buffered Channel

Send blocks only when buffer is full

ch := make(chan int, 5)

Closing Channels

close(ch)

Rules:

Sending after close → panic
Receiving after close → zero value
Channel freed after buffer drains

WaitGroup

var wg sync.WaitGroup
wg.Add(1)

go func() {
    defer wg.Done()
}()

wg.Wait()

12. Channel Internals (Conceptual)

type hchan struct {
    buf      unsafe.Pointer
    elemsize uintptr
    qcount   uint
    dataqsiz uint

    sendx uint
    recvx uint

    recvq waitq
    sendq waitq

    closed uint32
    lock   mutex
}

Channels live on the heap
Buffered → circular buffer
Unbuffered → direct handoff

13. Maps

Map Basics

m := make(map[string]int)
m["a"] = 1
val := m["a"]

Zero Value

nil map → cannot assign

var m map[string]int
// m["x"] = 1 // panic

Existence Check

val, ok := m["key"]

Delete

delete(m, "key")

Iteration Order

Not guaranteed
Randomized intentionally

for k, v := range m {
    _ = k
    _ = v
}

Maps are Reference Types

Passed by reference
Mutations visible across functions

🔑 Key Takeaways

Arrays are values, slices & maps are references
Goroutines are multiplexed over OS threads
GMP scheduler abstracts thread management
Channels coordinate goroutines, not store data
defer, panic, and recover form Go’s failure‑handling trio

When AI Can't Debug Its Own Code: A Comedy of Logic Errors 🤖🔧

KartikJha — Wed, 12 Nov 2025 15:55:35 +0000

Or: How I Taught Claude That Sometimes 2² ≠ 2

The Setup

Picture this: You're coding a subset generator (you know, classic computer science stuff that makes you question your life choices at 2 AM). Your code has syntax errors. No problem! You feed it to an AI assistant. The AI confidently fixes your syntax... and introduces a subtle logic bomb that would make any algorithms professor weep.

Welcome to the wonderful world of AI Logic Blindness - where artificial intelligence can fix your semicolons but might accidentally convince itself that every array has exactly 2^5 elements. Spoiler alert: They don't.

The Crime Scene 🔍

Here's what happened:

Original buggy code: Syntax errors galore, but the logic was sound.

AI's "fix": Perfect syntax, but now the algorithm thinks remaining being empty means "add a subset" but ONLY when you're in the 'include' branch.

The bug? A classic base case misunderstanding. The AI's logic looked like:

if obj['type'] == 'include':
    obj['resultset'].append(obj['set'].copy())

if len(obj['remaining']) == 0:
    return

Seems reasonable, right? When you're including an element AND there's nothing left to process, add what you've built to the results. Ship it!

Except...

This means subsets are ONLY added when the include branch exhausts the remaining array. But what about all the subsets built by the exclude branches? They never get added!

The algorithm essentially said: "I'll only count subsets where I included the last element. All those subsets where I excluded elements at the end? Nah, those don't count."

It's like a bouncer at a club who only lets people in if they're wearing the last item they picked up. Everyone else? Sorry, you didn't include the final element, no entry for you.

The result: For a 5-element array [4, 5, 3, 8, 12], instead of getting all 32 subsets (2^5), you get only 16 - the ones that end with an "include" decision.

The Human Strikes Back 👨‍💻

After staring at the output (only 16 subsets for a 5-element array when there should be 2^5 = 32), the human debugger realized the issue:

The fix: Add the subset when remaining is empty, REGARDLESS of whether you're in include or exclude mode. Both branches produce valid subsets when they exhaust the remaining elements.

The corrected logic:

if len(obj['remaining']) == 0:
    obj['resultset'].append(obj['set'].copy())
    return

Wait... that looks simpler than the AI's version! The key insight? Both branches (include and exclude) create valid subsets. When you've made all your include/exclude decisions (remaining is empty), you have a complete subset. Add it. Done.

The AI had overcomplicated it by thinking only 'include' branches produce results, missing half the subsets in the process.

The Plot Twist 🤯

Here's where it gets delicious: When the human explained this fix to the AI, the AI... couldn't grasp it.

The conversation went something like:

Human: "The condition should add subsets whenever we've exhausted the remaining array, not just during include phases."

AI: "But... but... we only want to add when we've included elements! Exclude branches don't produce results!"

Human: "No, BOTH branches produce valid subsets. Include path: [1,2,3]. Exclude path: [1,2]. Both are valid subsets when remaining is empty."

AI: "I need you to confirm this is correct because my neural pathways are experiencing the digital equivalent of a blue screen."

The AI fixed the syntax errors in seconds. But understanding that BOTH recursive branches produce valid subsets that need to be captured? That required human intuition about recursive tree traversal.

The Code Journey 📝

Want to see the progression yourself? Here are the GitHub links to all three versions:

Original buggy code - Syntax errors, but sound logic
AI's "fixed" version - Perfect syntax, missing half the subsets
Human-corrected version - Actually works correctly

The Phenomenon: AI Logic Blindness 🧠

What we're witnessing here is a fascinating limitation in current AI systems:

Pattern Recognition ≠ Logic Understanding: AI excels at recognizing code patterns and syntax rules. But understanding the semantic meaning of recursive branching logic? That's a different beast.
The "Looks Right" Trap: The AI's fix looked reasonable. Base case when array is empty? Check. Add result during include? Check. But it missed that BOTH branches (include AND exclude) generate valid subsets that need to be collected.
Lack of Execution Tracing: A human debugger traces through the recursion tree mentally: "If I exclude the last few elements, I still get valid subsets like [1], [2], [], etc. Where are those in my output?" AI doesn't naturally trace execution paths the same way.
Confidence Without Comprehension: The AI fixed the syntax errors with 100% confidence. But when confronted with "your logic only captures half the subsets," it couldn't independently verify through reasoning that both branches produce results worth capturing.

Why This Matters 🎯

This isn't an "AI is bad" story. It's a "humans + AI is powerful" story.

AI strengths:

Instant syntax checking
Boilerplate generation
Pattern recognition
Tireless refactoring

Human strengths:

Semantic understanding
Algorithmic reasoning
Edge case intuition
"Wait, that doesn't make sense" instinct

The subset generator bug illustrates why complex problem-solving still needs human oversight. AI can write code faster than you can say "stack overflow," but understanding whether that code implements the correct algorithm? That still requires human reasoning.

The Punchline 😄

The really funny part? The AI's broken version was consistently wrong. It reliably produced exactly half the answer every single time. That's almost admirable - it's deterministically incorrect. It's like a GPS that always tells you to turn right when you should turn left. At least you can compensate!

And when corrected, the AI couldn't understand why both branches produce valid subsets. It's the digital equivalent of:

"I only count pizza slices I took with my right hand. Wait, why is my slice count so low? Left hand slices don't count! Oh, you mean ALL slices count regardless of which hand took them? But I was being SO logical!"

The Takeaway 🚀

As we integrate AI deeper into software development:

AI is an excellent junior developer - Great at syntax, needs supervision on algorithmic logic
Code review is now human-AI collaboration - AI generates, humans verify semantics
Understanding > Generation - Teaching AI to write code is easy; teaching it to understand correctness is hard
The debugging loop needs humans - When code works wrong consistently, human intuition is irreplaceable

So next time an AI "fixes" your code, remember: It might fix your syntax errors and introduce a logic error so subtle that it only generates half your subsets while confidently explaining why exclude branches don't count.

And that, folks, is why software engineering isn't getting automated anytime soon. We're not fighting syntax errors anymore - we're fighting logic errors where AI thinks only one branch of recursion produces valid results.

Moral of the story: Trust, but verify. Especially when the AI is confidently explaining why you only need half the subsets because "exclude branches don't produce results."

No, Claude. They do. All of them. But thanks for trying, buddy. Same time next week?

Have you experienced AI logic blindness in your coding adventures? Share your "Wait, the AI did WHAT?" stories in the comments!

Setting Up a WireGuard VPN Server on Google Cloud Platform

KartikJha — Tue, 21 Oct 2025 17:25:37 +0000

Introduction

In this comprehensive guide, I'll walk you through setting up your own WireGuard VPN server on Google Cloud Platform (GCP). This setup allows you to route all your internet traffic through a GCP instance, making your traffic appear to originate from the server's IP address instead of your actual location. Perfect for privacy, accessing geo-restricted content, or development testing.

Why WireGuard?

WireGuard is a modern, fast, and secure VPN protocol that's:

Lightweight: Only ~4,000 lines of code (compared to OpenVPN's 100,000+)
Fast: Better performance than traditional VPN protocols
Secure: Uses state-of-the-art cryptography
Simple: Easy to configure and maintain

Why Google Cloud Platform?

GCP offers an excellent free tier that includes:

1 e2-micro instance per month (free forever)
30 GB standard persistent disk storage
1 GB network egress per month (US regions)
$300 credit for 90 days for new users

Prerequisites

A Google Cloud Platform account
A client machine running Linux (I'm using Kali Linux)
Basic command-line knowledge

Part 1: Setting Up the GCP VM Instance

Step 1: Create Your VM Instance

Navigate to Compute Engine → VM Instances in the GCP Console
Click "Create Instance"
Configure your instance:
- Name: wireguard-vpn-server
- Region: Choose based on desired IP location (e.g., us-central1)
- Machine type: e2-micro (free tier eligible)
- Boot disk: Ubuntu 22.04 LTS, 30 GB Standard persistent disk
- Firewall: Check "Allow HTTP" and "Allow HTTPS"

Step 2: Configure Firewall Rules for WireGuard

WireGuard uses UDP port 51820, so we need to allow it:

Go to VPC Network → Firewall
Click "Create Firewall Rule"
Configure:
- Name: allow-wireguard
- Direction: Ingress
- Targets: All instances in the network
- Source IP ranges: 0.0.0.0/0
- Protocols and ports: UDP 51820
Click "Create"

Part 2: Installing and Configuring WireGuard Server

Step 3: Connect to Your VM

Use GCP's browser-based SSH (click the SSH button next to your instance) or use gcloud CLI:

gcloud compute ssh wireguard-vpn-server --zone=us-central1-a

Step 4: Install WireGuard

# Update system
sudo apt update && sudo apt upgrade -y

# Install WireGuard
sudo apt install wireguard -y

Step 5: Generate Server Keys

# Generate server private key
wg genkey | sudo tee /etc/wireguard/server_private.key

# Set proper permissions
sudo chmod 600 /etc/wireguard/server_private.key

# Generate server public key from private key
sudo cat /etc/wireguard/server_private.key | wg pubkey | sudo tee /etc/wireguard/server_public.key

Step 6: Identify Your Network Interface

ip route | grep default

Look for the interface name after "dev" (usually ens4 on GCP).

Step 7: Create Server Configuration

sudo nano /etc/wireguard/wg0.conf

Add the following configuration (replace ens4 with your actual interface if different):

[Interface]
PrivateKey = <paste_contents_of_server_private.key>
Address = 10.8.0.1/24
ListenPort = 51820
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o ens4 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o ens4 -j MASQUERADE

Get your server private key:

sudo cat /etc/wireguard/server_private.key

Save your server public key for later (you'll need it for client config):

sudo cat /etc/wireguard/server_public.key

Step 8: Enable IP Forwarding

# Enable IP forwarding temporarily
sudo sysctl -w net.ipv4.ip_forward=1

# Make it permanent
echo "net.ipv4.ip_forward=1" | sudo tee -a /etc/sysctl.conf

Step 9: Start WireGuard Server

# Start the WireGuard interface
sudo wg-quick up wg0

# Enable auto-start on boot
sudo systemctl enable wg-quick@wg0

# Verify it's running
sudo wg show

Step 10: Get Your GCP External IP

curl ifconfig.me

Save this IP address - you'll need it for the client configuration.

Part 3: Setting Up the Client (Kali Linux)

Step 11: Install WireGuard on Client

sudo apt update
sudo apt install wireguard openresolv -y

Note: openresolv is needed for DNS configuration.

Step 12: Generate Client Keys

# Generate client private key
wg genkey | tee client_private.key | wg pubkey > client_public.key

# View the keys
cat client_private.key
cat client_public.key

Step 13: Create Client Configuration

sudo nano /etc/wireguard/wg0-client.conf

Add the following configuration:

[Interface]
PrivateKey = <paste_your_client_private_key>
Address = 10.8.0.2/24
DNS = 8.8.8.8

[Peer]
PublicKey = <paste_your_server_public_key>
Endpoint = <your_gcp_external_ip>:51820
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 25

Key Configuration Explained:

Address: Your client's IP within the VPN network
DNS: DNS server to use when connected
Endpoint: Your GCP server's public IP and WireGuard port
AllowedIPs = 0.0.0.0/0: Route ALL traffic through VPN
PersistentKeepalive: Keep connection alive through NAT

Step 14: Add Client to Server

SSH back into your GCP VM and edit the server config:

sudo nano /etc/wireguard/wg0.conf

Add this at the end (paste your client's public key):

[Peer]
PublicKey = <paste_your_client_public_key>
AllowedIPs = 10.8.0.2/32

Restart WireGuard on the server:

sudo wg-quick down wg0
sudo wg-quick up wg0

Part 4: Testing the Connection

Step 15: Connect from Client

On your Kali machine:

# Check your current IP (before VPN)
curl -4 ifconfig.me

# Connect to VPN
sudo wg-quick up wg0-client

# Check connection status
sudo wg show

# Check your new IP (should be GCP's IP)
curl -4 ifconfig.me

Step 16: Verify the Connection

On the server side, you should see connection details:

sudo wg show

You should see:

endpoint: Your client's public IP and port
latest handshake: Time since last connection
transfer: Data sent/received

On the client side:

sudo wg show

You should see similar connection statistics.

Step 17: Test Internet Connectivity

# Test DNS resolution
nslookup google.com

# Test connectivity
ping 8.8.8.8

# Check your IP appears as GCP's
curl -4 ifconfig.me

# Test HTTPS
curl https://www.google.com

Managing Your VPN Connection

Connect to VPN

sudo wg-quick up wg0-client

Disconnect from VPN

sudo wg-quick down wg0-client

Check Connection Status

sudo wg show

Monitor Traffic in Real-Time

# On server - watch connection stats
watch -n 2 sudo wg show

# Monitor network traffic
sudo tcpdump -i wg0 -n

# Check bandwidth usage
sudo iftop -i wg0

Troubleshooting

Connection Won't Establish

Check firewall rules: Ensure UDP port 51820 is open on GCP
Verify keys: Make sure public/private keys match between client and server
Check server status: sudo systemctl status wg-quick@wg0
Review logs: sudo journalctl -u wg-quick@wg0 -f

DNS Not Working

If DNS resolution fails after connecting:

# Install openresolv on client
sudo apt install openresolv -y

# Or manually set DNS
echo "nameserver 8.8.8.8" | sudo tee /etc/resolv.conf

Can't Access Internet When Connected

Check IP forwarding on server:

cat /proc/sys/net/ipv4/ip_forward
# Should output: 1

Check NAT rules:

sudo iptables -t nat -L -n -v

Performance Issues

Choose a GCP region closer to your location
Check bandwidth usage (free tier has 1GB/month limit)
Consider upgrading to a larger instance type

Security Best Practices

Use strong keys: WireGuard generates cryptographically secure keys by default
Limit AllowedIPs: On the server, only allow specific client IPs
Regular updates: Keep both server and client updated
Monitor access: Regularly check connection logs
Firewall rules: Only open necessary ports
Key rotation: Periodically regenerate keys for enhanced security

Cost Considerations

GCP Free Tier Limits

Compute: 1 e2-micro instance (free forever in eligible regions)
Storage: 30 GB standard persistent disk
Network: 1 GB egress per month (US regions)

After Free Tier

If you exceed limits:

Network egress: ~$0.12/GB (varies by region)
Compute: Minimal for e2-micro (~$7/month if not free tier)

Tip: Monitor usage in GCP Console → Billing → Reports

Use Cases

Privacy: Hide your real IP address from websites
Security: Encrypt traffic on public WiFi
Geo-unblocking: Access region-restricted content
Development: Test applications from different geographic locations
Remote access: Securely access resources in your VPN network

Conclusion

You now have a fully functional WireGuard VPN server running on Google Cloud Platform! Your internet traffic is encrypted and routed through your GCP instance, appearing to originate from the server's IP address.

This setup gives you:

✅ Complete control over your VPN infrastructure
✅ Fast, modern VPN protocol
✅ Minimal cost (free tier eligible)
✅ Privacy and security
✅ Flexibility to choose server location

Next Steps

Add more clients: Repeat the client setup process with different keys
Set up monitoring: Use Prometheus + Grafana for advanced metrics
Implement failover: Set up multiple VPN servers for redundancy
Optimize performance: Tune MTU settings and kernel parameters
Automate deployment: Use Terraform or Ansible for infrastructure as code

Additional Resources

Have questions or run into issues? Drop a comment below! Happy VPN'ing! 🔒🚀

Unlocking Android Bootloader and Flashing GSI: A Complete Guide for Motorola Edge 40 Neo

KartikJha — Wed, 03 Sep 2025 18:25:15 +0000

A comprehensive walkthrough of unlocking your Android device's bootloader and preparing for GSI installation

Introduction

Have you ever wanted to take full control of your Android device? Whether it's for installing custom ROMs, removing bloatware, or enhancing security, unlocking your bootloader is often the first step. In this guide, I'll walk you through the complete process I followed to unlock the bootloader on my Motorola Edge 40 Neo and prepare it for GSI (Generic System Image) flashing.

Prerequisites

Before we begin, make sure you have:

ADB and Fastboot tools installed
USB debugging enabled on your device
A backup of important data (this process will wipe your device)
Patience - this process takes time!

Step 1: Checking Bootloader Status

First, let's verify if your bootloader is locked:

adb shell getprop ro.boot.flash.locked

If the output is 1, your bootloader is locked and needs to be unlocked.

Step 2: Installing Fastboot

If you don't have fastboot installed, you'll need to install it first. You can find installation guides for your specific operating system.

Step 3: Entering Fastboot Mode

Boot your device into fastboot mode:

adb reboot bootloader

Step 4: Attempting to Unlock

For Android 10+ devices, try:

fastboot flashing unlock

For older devices, use:

fastboot oem unlock

In my case with the Motorola Edge 40 Neo, I needed to use:

fastboot flashing unlock_critical

However, this failed with a message indicating that an unlock code was required.

Step 5: Getting the Unlock Data

When a standard unlock fails, you need to get the unlock data string:

fastboot oem get_unlock_data

This command returned multiple lines of data that I had to concatenate into a single unlock string:

<128_CHARS_UNLOCK_KEY>

Step 6: Obtaining the Unlock Key

With the unlock string ready:

Visit Motorola's official bootloader unlock page
Log in with your email
Paste the unlock string
Follow the on-screen instructions
If your device supports unlocking, you'll receive an unlock key via email

Step 7: Unlocking the Bootloader

Once you have the unique key:

fastboot oem unlock UNIQUE_KEY

⚠️ Warning: This will wipe all user data and reset your phone to factory state.

Preparing for GSI Installation

After successfully unlocking the bootloader, I prepared for GSI (Generic System Image) installation.

Checking Project Treble Compatibility

First, verify if your device supports Project Treble:

adb shell getprop ro.treble.enabled
# Should return: true

adb shell getprop ro.boot.dynamic_partitions
# Should return: true

Determining Partition Scheme

Check your device's partition scheme to select the correct GSI build:

adb shell getprop ro.build.ab_update
# Returns: true (indicates A/B partition scheme)

adb shell getprop ro.product.cpu.abi
# Returns: arm64-v8a (indicates 64-bit ARM architecture)

Based on these results, I needed a GSI build with the -ab suffix for A/B partition devices.

Challenges Encountered

Device Information

Using this command to identify the correct TWRP version:

adb shell "echo -n 'Model: '; getprop ro.product.model; echo -n 'Codename: '; getprop ro.product.device; echo -n 'Android Version: '; getprop ro.build.version.release; echo -n 'CPU: '; getprop ro.board.platform"

Output:

Model: motorola edge 40 neo
Codename: manaus
Android Version: 14
CPU: mt6879

Unfortunately, there was no official TWRP version available for this specific device.

Backup Attempts

I attempted to backup the existing OS using MTKClient, but encountered authentication errors. The tool requires specific auth and DA files for this MediaTek-based device.

As an alternative approach, I considered:

Downloading the stock firmware
Patching the boot image with Magisk
Flashing the firmware as a backup solution

Next Steps

The process is ready for GSI flashing, which involves:

Downloading the appropriate AOSP GSI from Google's developer resources
Flashing the system image
Copying additional components (vbmeta.img, etc.) from stock firmware

Security Considerations

This process was partly motivated by security concerns regarding potential intrusions. If you're dealing with similar security issues on your Android device, bootloader unlocking and custom ROM installation can be effective countermeasures.

Conclusion

Unlocking an Android bootloader requires patience and careful attention to detail. Each device manufacturer has slightly different procedures, and newer devices often have additional security measures. Always:

Research your specific device thoroughly
Backup important data
Understand that warranty may be voided
Be prepared for potential risks

The journey to a fully customized Android experience starts with this crucial first step. While the process can be complex, the freedom to control your device's software makes it worthwhile for many enthusiasts.

Kubernetes Migration: From Lambda to a Cost-Optimized K8s Cluster

KartikJha — Fri, 04 Apr 2025 10:24:03 +0000

Introduction

This article documents our journey migrating from AWS Lambda to a self-managed Kubernetes cluster to handle high-concurrency API requests. We'll walk through our motivation, infrastructure choices, implementation details, and most importantly - the performance results that validated our decision.

Why Migrate From Lambda?

Our original architecture used AWS Lambda behind API Gateway, but we encountered significant limitations:

Concurrency Limitations: Our Lambda-based service was unable to handle concurrent executions exceeding 1000 users
Poor Performance Under Load: Load testing revealed significant degradation and high failure rates at scale
Cost Optimization: We needed to optimize our cost-per-user-served metric

Performance Comparison

The most compelling argument for our migration comes from the load test results comparing our previous Lambda setup with our new Kubernetes infrastructure options:

Key Findings:

HTTPS Nginx setup achieved 100% success rate with the lowest average latency (7468ms) at 1100 concurrent users
DNS Round-Robin Load Balancer averaged ~89% success rate with varying latency across pods (from 12676ms to 53028ms)
NodePort service averaged ~89% success rate with similar latency variance
Lambda performed poorly with only 43.48% success rate despite being tested at a lower concurrency (800 users)

The visualization clearly demonstrates that our properly configured Nginx + Kubernetes setup significantly outperforms the Lambda architecture, particularly in handling burst traffic and maintaining high success rates.

🚀 The load test was performed using load_test_util
✅ Supports MongoDB server metric analysis
🛠️ Custom logging built-in
🧩 Fully configurable via JSON

Perfect for benchmarking infra migrations like ours :)

Read on for in-depth setup guide...

Migration Goals

We established the following optimization parameters for our migration:

Reduce cost per user served
Support at least 1000 RPS burst capacity
Maintain reliability under high concurrent load

Infrastructure Choices

We selected a cost-optimized self-managed Kubernetes cluster with:

1 master node
2 worker nodes
ECR for container registry
NGINX load balancers (instead of AWS LB) for cost optimization

Implementation Details

Setting Up the Kubernetes Cluster (Ubuntu 22.04)

Prepare the System

# Update packages
sudo apt update && sudo apt upgrade -y

# Install required dependencies
sudo apt install -y curl apt-transport-https

Install containerd Runtime

sudo apt install -y curl gnupg2 software-properties-common apt-transport-https ca-certificates
sudo apt install -y containerd
sudo mkdir -p /etc/containerd
containerd config default | sudo tee /etc/containerd/config.toml > /dev/null
# Edit config as needed
sudo systemctl restart containerd
sudo systemctl enable containerd

Initialize Master Node

# Add Kubernetes APT repository
curl -s https://packages.cloud.google.com/apt/doc/apt-key.gpg | sudo apt-key add -
echo "deb https://apt.kubernetes.io/ kubernetes-xenial main" | sudo tee /etc/apt/sources.list.d/kubernetes.list

# Install kubeadm, kubelet, and kubectl
sudo apt install -y kubelet kubeadm kubectl
sudo apt-mark hold kubelet kubeadm kubectl

# Initialize the cluster
sudo kubeadm init --pod-network-cidr=10.244.0.0/16

# Configure kubectl
mkdir -p $HOME/.kube
sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
sudo chown $(id -u):$(id -g) $HOME/.kube/config

Initialize Worker Nodes

# On worker nodes
sudo apt update && sudo apt upgrade -y
sudo apt install -y kubelet kubeadm kubectl
sudo apt-mark hold kubelet kubeadm kubectl

# Join the worker to the cluster using the token from master
sudo kubeadm join <master-ip>:6443 --token <token> --discovery-token-ca-cert-hash sha256:<hash>

Configure Pod Networking with Flannel

# Install Flannel
kubectl apply -f https://raw.githubusercontent.com/coreos/flannel/master/Documentation/kube-flannel.yml

# Enable bridge networking
sudo modprobe overlay
sudo modprobe br_netfilter
lsmod | grep br_netfilter

sudo tee /etc/sysctl.d/k8s.conf <<EOF
net.bridge.bridge-nf-call-iptables = 1
net.bridge.bridge-nf-call-ip6tables = 1
net.ipv4.ip_forward = 1
EOF

Containerizing the Application

Create Docker Images

# Tag for ECR
docker tag myimage:version <aws_account_id>.dkr.ecr.<region>.amazonaws.com/<repo-name>:version

# Push to ECR
docker push <aws_account_id>.dkr.ecr.<region>.amazonaws.com/<repo-name>:version

# Login to ECR
aws ecr get-login-password --region <region> --profile <aws_profile> | \
docker login --username AWS --password-stdin <aws_account_id>.dkr.ecr.<region>.amazonaws.com

Create Secret for ECR Access

kubectl create secret docker-registry ecr-secret \
  --docker-server=<aws_account_id>.dkr.ecr.<region>.amazonaws.com \
  --docker-username=AWS \
  --docker-password=$(aws ecr get-login-password --region <region> --profile <aws_profile>)

Deployment Configuration

Kubernetes Deployment

apiVersion: apps/v1
kind: Deployment
metadata:
  name: rest-api-deployment
spec:
  replicas: 3  # Creates 3 Pods
  selector:
    matchLabels:
      app: rest-api
  template:
    metadata:
      labels:
        app: rest-api
    spec:
      containers:
      - name: rest-api-container
        image: my-api-image:latest  # Replace with your actual API image
        ports:
        - containerPort: 5000
        livenessProbe:  # Ensures failed pods restart
          httpGet:
            path: /health
            port: 5000
          initialDelaySeconds: 5
          periodSeconds: 10

Service Exposure via NodePort

apiVersion: v1
kind: Service
metadata:
  name: rest-api-service
spec:
  type: NodePort
  selector:
    app: rest-api
  ports:
    - protocol: TCP
      port: 80        # Internal Cluster Port
      targetPort: 5000 # API Container Port
      nodePort: 30080  # Exposes API on <EC2-Public-IP>:30080

Load Balancing Configuration

The initial NGINX configuration failed under burst load with errors like:

2025/04/01 09:18:00 [alert] 977643#977643: *14561 socket() failed (24: Too many open files) while connecting to upstream

Optimized NGINX Configuration

We addressed these limitations with the following tuned NGINX configuration:

user www-data;
worker_processes auto;
pid /run/nginx.pid;
worker_rlimit_nofile 65536;
error_log /var/log/nginx/error.log;
include /etc/nginx/modules-enabled/*.conf;

events {
    worker_connections 4096;
    multi_accept on;
}

http {
    sendfile on;
    tcp_nopush on;
    types_hash_max_size 2048;

    include /etc/nginx/mime.types;
    default_type application/octet-stream;

    ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;
    ssl_prefer_server_ciphers on;

    access_log /var/log/nginx/access.log;

    gzip on;

    keepalive_timeout 75s;
    keepalive_requests 10000;
    proxy_buffering on;
    proxy_buffers 16 16k;
    proxy_busy_buffers_size 32k;
    proxy_read_timeout 60s;
    proxy_send_timeout 60s;

    upstream backend_servers {
        server 192.0.2.1:30008;
        server 192.0.2.2:30008;
    }

    server {
        listen 80;
        listen 443 ssl http2;
        server_name app.example.com;

        ssl_certificate /etc/ssl/certs/fullchain.pem;
        ssl_certificate_key /etc/ssl/private/privkey.pem;

        location / {
            proxy_pass http://backend_servers;
            proxy_http_version 1.1;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "Upgrade";
        }

        # Additional configuration omitted for brevity
    }
}

Key optimizations include:

Increased worker_rlimit_nofile to 65536
Set worker_connections to 4096
Enabled multi_accept
Increased keepalive_timeout to 75s
Set keepalive_requests to 10000
Optimized buffer sizes

Results and Conclusion

Our migration from Lambda to a self-managed Kubernetes cluster with optimized NGINX configuration delivered:

Improved Reliability: From 43% success rate to 100% success rate under load
Better Latency: Significantly lower average response times
Higher Capacity: Successfully handling 2000+ concurrent users
Cost Optimization: Lower cost per user served compared to Lambda

These results validate our architectural decision to migrate from serverless to a self-managed Kubernetes setup for high-concurrency APIs.

Key Takeaways

Serverless isn't always the answer, especially for high-concurrency applications
Properly configured traditional infrastructure can outperform serverless at scale
System tuning (especially NGINX configuration) is critical for performance
A cost-optimized Kubernetes cluster can provide an excellent balance of performance and economics

Would you like to learn more about our journey or have questions about implementing a similar migration? Let me know in the comments!

Note: This article is based on real migration and performance testing conducted in March-April 2025.

HackerOne 101: Grammarly Model Poisoning Attacks

KartikJha — Sun, 15 Sep 2024 13:29:06 +0000

Introduction

This is one of the first articles in a series of articles based on the hackerone bug bounty program by grammarly.

In this article we are going to get introduced to data poisoning attacks and will discuss label flipping with a working example on the grammarly APIs itself.

Model Poisoning

Model poisoning is a type of adversarial attack that targets machine learning models, particularly during their training phase. The goal of model poisoning is to subtly alter the model's behavior by introducing malicious data or manipulating the training process, causing the model to make incorrect predictions or behave in a way that benefits the attacker.

Label Flipping

This attack involves marking correct input with incorrect label and incorrect input with correct label so that the model starts giving wrong predictions

In the context of grammarly we will try to investigate the grammarly web app and APIs that power spelling correctness feature.

The investigation

Ruling out server side AI model support

Checked for activity in the network tab
Could only see logV2, events and authorization requests in the network logs

logV2

POST /logv2 HTTP/2
Host: f-log-editor.grammarly.io
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/117.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://app.grammarly.com/
Content-Type: application/json
Content-Length: 2914
Origin: https://app.grammarly.com
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers

This is probably a logging API sending user and user-agent related info on every page reload

events

curl 'https://gnar.grammarly.com/events' -X POST -H 'User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/117.0' -H 'Accept: */*' -H 'Accept-Language: en-US,en;q=0.5' -H 'Accept-Encoding: gzip, deflate, br' -H 'Referer: https://app.grammarly.com/' -H 'Content-Type: application/json' -H 'Origin: https://app.grammarly.com' -H 'Connection: keep-alive' -H 'Cookie: grauth=AABN_y5k8nO1QVQ7lyDTKrp_68vQR2HUQFVp5r3NklXGkfJRIn2CJM1Hqn7WxAU1bhjxbJNgtpF_xPCi; csrf-token=AABN/9Bb12L12hlkibY1S8ONAetDOcsjuYIc5g; gnar_containerId=xjaj96uqklmu0902; _gcl_au=1.1.2013238534.1725196671; _ga_CBK9K2ZWWE=GS1.1.1725200925.2.0.1725200925.60.0.0; _ga=GA1.1.469893869.1725196671; _pin_unauth=dWlkPU4yTTRORFEzWVRrdFpXTmtNaTAwTkRKakxUazVaVGt0TkRFeVlUSTFZams1TVRrMQ; __podscribe_grammarly_referrer=https://www.google.com/; __podscribe_grammarly_landing_url=https://www.grammarly.com/ai-writing-assistant; __podscribe_did=pscrb_f542134c-de91-49e8-99de-dca7bab0e0cb; _tq_id.TV-7281365481-1.3988=69840ec454ed06bc.1725196672.0.1725200923..; _clck=1o62qwl%7C2%7Cfow%7C0%7C1705; _fbp=fb.1.1725196673331.19073762163984477; funnelType=free; tdi=tmwup2itzfdtt5czk; last_authn_event=666f04d3-a2ac-4b8a-b152-ff82465ee922; gac=AABN_0pbfOxu1yQOL6aAyc1jL4ELkaY4_eC9XZbBF3nANLbuz9K9n_TbuLizWGC1YPd60rEy2PrW7SJrVozu2REsn5a11gxzmUTEUuMiPCFpc3Yu; isGrammarlyUser=true; experiment_groups=gb_analytics_mvp_phase_one_30_day_enabled|auto_complete_correct_safari_enabled|extension_assistant_bundles_all_consumers_enabled|officeaddin_ue_exp3_enabled|fsrw_in_assistant_all_consumers_enabled|extension_new_rich_text_fields_enabled|safari_migration_inline_disabled_enabled|officeaddin_upgrade_state_exp1_enabled1|officeaddin_outcomes_ui_exp5_enabled1|premium_ungating_renewal_notification_enabled|kaza_security_hub_enabled|extension_assistant_all_consumers_enabled|quarantine_messages_enabled|small_hover_menus_existing_enabled|fsrw_in_assistant_all_enabled|emogenie_beta_enabled|gb_snippets_csv_upload_enabled|grammarly_web_ukraine_logo_dapi_enabled|extension_fluid_for_all_rollout_test_enabled|officeaddin_upgrade_state_exp2_enabled1|apply_formatting_all_enabled|gb_analytics_mvp_phase_one_enabled|wonderpass_enabled|extensionfrench rap songsfrench rap songs_assistant_experiment_all_enabled|apply_formatting_all_consumers_enabled|gdocs_for_all_safari_enabled|extension_assistant_all_enabled|safari_migration_backup_notif1_enabled|ipm_extension_release_test_1|auto_complete_correct_edge_enabled|snippets_in_ws_gate_enabled|extension_assistant_experiment_all_consumers_enabled|extension_assistant_bundles_all_enabled|safari_migration_popup_editor_disabled_enabled|officeaddin_proofit_exp3_enabled|safari_migration_inline_warning_enabled|gb_in_editor_free_Test1|gdocs_for_all_firefox_enabled|gdocs_new_mapping_enabled|officeaddin_muted_alerts_exp2_enabled1|officeaddin_perf_exp3_enabled|shared_workspaces_enabled; _rdt_uuid=1725196671125.3dfe8c32-2a63-4036-a141-50c3f417cb98; _uetvid=97301a70686411efbb3e2ddb14c6081b; _clsk=1yrnj8i%7C1725419260716%7C1%7C0%7Cz.clarity.ms%2Fcollect; redirect_location=eyJ0eXBlIjoiIiwibG9jYXRpb24iOiJodHRwczovL2FwcC5ncmFtbWFybHkuY29tL2Rkb2NzLzI1Njg3MjI3NDcifQ==; browser_info=FIREFOX:117:COMPUTER:SUPPORTED:FREEMIUM:LINUX:LINUX' -H 'Sec-Fetch-Dest: empty' -H 'Sec-Fetch-Mode: cors' -H 'Sec-Fetch-Site: same-site' -H 'TE: trailers' --data-raw '{"events":[{"action":"show","eventName":"editor/assistant-lens-show","object":"lens","objectId":"assistant","lens":"all-suggestions","pageId":"document","client":"editor","clientVersion":"1.5.43-6200+master","instanceId":"0RGsM5vY","batchId":5,"containerId":"xjaj96uqklmu0902","userId":"2460910660","isTest":false,"userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/117.0","screenWidth":1920,"screenHeight":1080,"containerWidth":612,"containerHeight":887,"devicePixelRatio":1}]}'

This API also reports the current UI filters and userAgent details but also sends server side cookies for communication with podscribe

No data gets transported on repeated reload of the web page

All of the above was written around 27 August 2024, it was the last time I changed my root user password.

I updated the links today to the hackerone website and grammarly hackerone project, maybe they will expire in the coming future but the thrill of making money while exploring the interconnected products and their architecture is something that brings a smile on my face this Engineer's Day :).

Happy Engineer's Day

No space on google cloud :(

KartikJha — Thu, 19 Oct 2023 08:19:48 +0000

If you are like me and don’t fuss about your email much but have a lot of newsletter subscriptions then you probably ran into this problem.

So if you are not feeling lucky (and don’t wanna buy additional storage) and have not organized your inbox much. Then you are in luck as I ran into this same problem and have created a simple script that should take care of those unwanted senders.

Link to script

To use the script you need to get your bearer auth token from google workspace

Log in to google workspace developer dashboard
Go to https://developers.google.com/gmail/api/reference/rest/v1/users.messages/list
Copy bearer auth token from the list request headers, look for https://content-gmail.googleapis.com/gmail/v1/users in network tab.

Now assign this auth token here, update senders based on your requirements here. I have already added some based on my requirements.

All set you are ready to go, just type

touch text.txt
node delete_messages_from_senders.js

It will delete all the messages from listed senders and will update the text.txt file with number of messages per sender.

Happy deleting emails!

Bundle github repos for offline sharing

KartikJha — Fri, 11 Sep 2020 19:31:17 +0000

Looking for a script that will archive the huge repo you've been wanting to archive well here it is...

bundle-repo.js

const chalk = require("chalk");
const { execSync, exec } = require("child_process");
// const fs = require('fs');

if (!process.argv[2] || !process.argv[3]) {
  console.log(
    chalk.red(
      "Usage: node bundle-repo OWNER REPO-STRING [BUNDLE-TARGET-DIR]\nExample: node bundle-repo 'twitter' 'main, side, boom'"
    )
  );
  return;
}

const prefix = "git@github.com:";

const finalDir = process.argv[4] ? process.argv[4] + "/" : "";

const getPath = (r) => (!finalDir ? "" : finalDir + r);

process.argv[3].split(",").forEach((r) => {
  execSync(
    `git clone ${prefix}${process.argv[2]}/${r.trim()} ${getPath(r.trim())}`
  );
  const a = execSync(`ls -la ${getPath(r.trim())}`);
  console.log(a.toString());
  if (a.toString().split('\n')[0].split(' ')[1] != 0) {
    execSync(
      `cd ${getPath(
        r.trim()
      )} && git bundle create ${r.trim()}.bundle --all && mv ${r.trim()}.bundle .. && cd .. && rm -rf ${r.trim()}`
    );
  }
});

package.json

{
  "type": "module",
  "dependencies": {
    "chalk": "^3.0.0"
  }
}

Before you get busy with it please follow this setup to avoid any operational glitches

Setup SSH access for your github account which has access to the repos. Connect to github via SSH
Create a string of comma seprated repo names like "repo1, repo2", the script has a usage example built in
Pass the repo string and owner/organization string as input to the string like

node bundle-repo 'twitter' 'main, side, boom' [optional target directory]

That's it you are good to go. Checkout the code on github

Thank you for reading :)

Getting your hobby project of the ground

KartikJha — Sun, 14 Jul 2019 13:34:21 +0000

I have been a professional developer for nearly two years now but don't see much difference in my coding abilities.

Yes, I have become more fearless in facing a screen scribbled with errors and can work my way through it and have picked up some technologies along the way (React, Node, Java) and learned the way of the terminal :D

But something is still missing I don't have any open source contributions and my Github profile looks pretty boring. Several abandoned projects :( and this obviously affects my first impression on potential employers.

So, I have decided that I am going to finish my first hobby project which is a game built using canvas and typescript(the minimum viable product, as I am planning to add multiplayer action!).

And so far I have managed to set up the project from scratch and created the basic architecture. I am using Typescript, Webpack, and native canvas API to achieve the MVP along with Eslint and Prettier for smooth development experience.

The repo and corresponding GitHub project can be found at https://github.com/KartikJha/color-sticks.

I have set up the project without any boilerplate by scrounging the internet but will be happy to write a consolidated article you need it.

Thanks for reading this far. I will make sure that this hobby project gets delivered.

What are you working on or planning to work on? Let me know in the comments.

Forem: KartikJha

🧠 Go (Golang) Cheat Sheet

1. Structs

Struct Initialization

2. Methods & Receivers

2.1 Value Receiver

2.2 Pointer Receiver

3. Random Numbers

4. Arrays vs Slices

Arrays

Slices

Key Differences

Common Operations

Looping

5. Strings

6. Runes & ASCII

7. make vs new

make

new

8. Errors, Panic & Defer

Error

Panic

Defer

When defer does NOT run ❌

Recovering from Panic

9. Goroutines & Go Runtime

Goroutines

9.1 Goroutines vs OS Threads

9.4 GMP Scheduler & OS Threads

Key Points

High‑level Architecture

OS Process Startup

Go Runtime Initialization

10. File Descriptors & Sockets (Linux)

11. Channels

Basics

Unbuffered Channel

Buffered Channel

Closing Channels

WaitGroup

12. Channel Internals (Conceptual)

13. Maps

Map Basics

Zero Value

Existence Check

Delete

Iteration Order

Maps are Reference Types

🔑 Key Takeaways

When AI Can't Debug Its Own Code: A Comedy of Logic Errors 🤖🔧

Or: How I Taught Claude That Sometimes 2² ≠ 2

The Setup

The Crime Scene 🔍

The Human Strikes Back 👨‍💻

The Plot Twist 🤯

The Code Journey 📝

The Phenomenon: AI Logic Blindness 🧠

Why This Matters 🎯

The Punchline 😄

The Takeaway 🚀

Setting Up a WireGuard VPN Server on Google Cloud Platform

Introduction

Why WireGuard?

Why Google Cloud Platform?

Prerequisites

Part 1: Setting Up the GCP VM Instance

Step 1: Create Your VM Instance

Step 2: Configure Firewall Rules for WireGuard

Part 2: Installing and Configuring WireGuard Server

Step 3: Connect to Your VM

Step 4: Install WireGuard

Step 5: Generate Server Keys

Step 6: Identify Your Network Interface

Step 7: Create Server Configuration

Step 8: Enable IP Forwarding

Step 9: Start WireGuard Server

Step 10: Get Your GCP External IP

Part 3: Setting Up the Client (Kali Linux)

Step 11: Install WireGuard on Client

Step 12: Generate Client Keys

7. `make` vs `new`

When `defer` does NOT run ❌