Jonathan Hodgson's Blog

The hunt for a phone

Thu, 27 Aug 2026 00:00:00 +0000

My requirements for a phone are fairly different from most people’s. I don’t have, and don’t want a Google account, an Apple account, a Microsoft account or anything else similar. This is largely for privacy reasons, although I also believe these companies already have far too much power, and don’t want to give them any more.

There are a few things my phone needs to do:

Make and receive phone calls reliably
Send and receive SMS messages reliably
Send and receive Signal messages
Easily last a day on battery
Location logging to home assistant

There are also a bunch of apps I would like to be able to use. Doing so in a browser would be fine, but native would be preferable:

Correlation Doesn't Mean Causation

Tue, 15 Jul 2025 00:00:00 +0000

One example

Plenty more at: https://tylervigen.com/spurious-correlations

Xiaozhi Esphome

Mon, 14 Jul 2025 00:00:00 +0000

Found the following ESPHome repo.

https://github.com/thekiwismarthome/xiaozhi-esphome/tree/main

I’ve ordered some of the orbs, lets see what they can do.

Dogs Don't Understand Basic Concepts

Sun, 13 Jul 2025 00:00:00 +0000

https://hyperboleandahalf.blogspot.com/2010/11/dogs-dont-understand-basic-concepts.html

Funny comic about dogs moving house

Modern Day VHS

Sat, 12 Jul 2025 00:00:00 +0000

A 3d printed device to give the feeling of physical media. NFC reader used to select media using home assistant.

My Smart Home Mistakes

Sat, 12 Jul 2025 00:00:00 +0000

On the whole, my smart home is something I am quite pleased with. However, there have certainly been some lessons learned whilst building it.

Passwords Most Fowl

Thu, 26 Dec 2024 00:00:00 +0000

Warning: Contains Spoilers!

If you caught the latest episode, “Vengeance Most Fowl,” you know, they were once again up against the sneaky Feathers McGraw, who pulls off a pretty clever hack involving a “smart gnome.” The twist? The gnome’s password was super easy to guess! While it’s all in good fun, it’s a great reminder of why we should all be using password managers.

In the episode, Feathers McGraw’s ability to crack the gnome’s password highlights a real issue we face today: weak passwords. Let’s be honest, are you still using simple passwords like birthdays or pets’ names? Or maybe your pets name with a 1 and an exclamation mark? It’s way too easy for hackers to figure those out, and that puts our personal info at risk.

I Got a Van

Sat, 24 Aug 2024 00:00:00 +0000

So, as you’ve probably gathered from the title, I’ve bought a van. Or, at least, reserved it, I actually pick it up in a couple of weeks. It’s a 2019 Fiat Ducato L4H2 which means it’s long and quite tall.

There will be 3 of us using the van. Me, my wife, and our lurcher, Rumple. One of the biggest requirements we have is that the van is both comfortable and safe for him to live and travel in. We have some ideas and thoughts around this, but you will hopefully see what that looks like in future posts.

Setting a good Content Security Policy

Thu, 22 Aug 2024 00:00:00 +0000

The Content Security Policy (CSP) is a powerful security feature that helps protect your website from cross-site scripting (XSS) attacks and other types of code injection vulnerabilities. There are some directives that do other things, but the bulk of this blog post will cover using the fetch-directives, or the elements of the CSP that allow you to specify a allow-list of approved sources from which resources This helps prevent malicious code from being executed on your site.

My New Home - Alarm Clock

Sun, 26 Feb 2023 00:00:00 +0000

I recently picked up a Lenovo Clock 2 on offer. I got it for around £25. I knew it ran Android and thought that for that price, it was worth picking one up to mess with.

After a couple of searches, I found a guide to installing other android apps on it.

https://forum.xda-developers.com/t/guide-installing-android-apps-on-the-lenovo-smart-clock-2.4393271/

Once I’d installed a custom launcher, I was able to get into the android settings and start disabling apps. I disabled the vast majority of them although I was unable to disable the Google Assistant app. At the time of writing, there doesn’t appear to be a reliable root method for the device. There is also no USB interface so even an adb shell was unachievable.

My New Home - Network

Wed, 08 Feb 2023 00:00:00 +0000

So, we have finally moved into our new home. The buying process took far too long, I am sick to death of dealing with solicitors, but we are now in. I hope this will become a series of blog posts in which I detail the setup process. This particular post will be the network.

My initial intention had been to buy some land and build a house. However, the process of doing so in the UK was … annoying, so instead we went for a new build. We found the property early enough in the build process that we were able to make various requests. One of which was for the electrician to run Cat-6 ethernet cable throughout the house before the walls were plastered. The cables all run into our under-stairs cupboard which I managed to convince my wife to give me as a server room.

I Got a Robot Vacuum

Sat, 31 Dec 2022 00:00:00 +0000

So, you have probably seen or heard about robot vacuums. I had, although honestly thought they were a bit of a gimmick. However, a few people I know have them and sung their praises so I thought I’d see what the fuss was about.

I did some research and settled on the Dreame L10 Pro (Non-Associates link). This was in no small part because it is known to work with Valetudo which allows for fully local control of the robot. As well as a very usable web interface, it also provides MQTT control which I use for Home Assistant control.

Why can't I buy a dumb TV?

Sat, 31 Dec 2022 00:00:00 +0000

Our old TV is showing it’s age a bit. It’s an old Samsung. About 30" and 1080p. It works fine, but certainly isn’t what you’d call modern. I think it dates from around 2010.

I thought I’d look and see how much it would cost to replace it – allowing me to use it as a monitor. I spend the majority of my time in a terminal, I don’t game and as such 4k, high refresh rate, wide screen monitors are of little interest to me. What is of interest to me is how many terminal windows I can tile and still use.

Multipart Emails in Neomutt

Fri, 27 May 2022 00:00:00 +0000

It recently came to my attention that mutt now supports sending multipart emails. I thought that this would mean that in half an hour or so I would have html emails working. Turns out, I was wrong. What instead happened was weeks of trial and error and reading RFCs.

I now have a system I am happy with. I write an email in markdown and mutt (along with some surrounding scripts) will convert that markdown to html, attach inline images and create a multipart email.

Advent of Code: Day 1

Wed, 01 Dec 2021 00:00:00 +0000

So, it’s December all ready. I haven’t written anywhere near as many blogs this year as I would like to. Hopefully the Advent of Code this year will give me some things to write about and make this years list of blogs look better.

This is the first year I am doing the Advent of Code so don’t really know what to expect. However, with day 1 done, I think I’ll probably enjoy it.

XSS Through the Referer Header

Thu, 14 Oct 2021 00:00:00 +0000

XSS is a vulnerability in which a malicious actor is able to run JavaScript in an unsuspecting clients browser session. Normally, this is done via input fields whose values are reflected back to the user without proper sanitisation.

In this blog, I demonstrate a method I recently used that injected the payload via the Referer [sip] header.

Only do this on websites you own or have permission to do so no. It is illegal in most places to do this without permission.

Writing Prose in Vim

Wed, 06 Oct 2021 00:00:00 +0000

If you know me at all, you probably know I am a fan of vim. I have written more than a few blog posts on it already.

Most vim users use vim for programming. That is, after all, what most people use plain text editors for. However, since learning vim, I have tried to use it for as much as I can. Everything from emails to blog posts to letters. Of course, programming as well, but certainly not only that.

Before you start with Home Assistant

Fri, 19 Mar 2021 00:00:00 +0000

If you are considering getting into home automation, Home Assistant is a great way to start. My current setup consists mostly of lighting, sensors and buttons, and a few small appliances. I Before you start, there are a few things that you might want to consider.

Server

So, currently, I have home assistant installed on an old laptop that works as a server. Alternatively, you could use a Raspberry PI or any similar single board computer.

My Setup at the beginning of 2021

Fri, 08 Jan 2021 00:00:00 +0000

Inspired by The Orange One’s State of the Apps, I thought I would document the tools I use to get my job done. If for no other reason than to look back next year and see what has changed.

OS

I’m running Arch Linux on all my computers. This is because it works well for me. All the packages I could ever need are available and there is no reason for me to change.

Enumerating Users on WordPress

Sat, 05 Sep 2020 00:00:00 +0000

WordPress is an extremely popular Content Management System (CMS) and as a result receives a lot of interest from hackers. WordPress has a bad reputation in some circles for being insecure, however if you are selective about the themes / plugins you install and keep it up to date, it is my belief that it is a nice system for both developers and users.

However, assuming you keep everything up to date, in many cases the biggest security weakness is your credentials. If a malicious actor guesses your username and password, it doesn’t matter how recently you did your updates, they are probably going to get in.

Upgrading reverse shells

Mon, 01 Jun 2020 00:00:00 +0000

So, you’ve managed to get a reverse shell through one means or another. Unfortunately, it’s pretty basic. You can’t use your arrow keys, the line gets overwritten if your command is too long and you can’t backspace properly. All in all, it’s not a nice experience.

Pseudo terminal

The first thing I like to do is spawn a TTY. This tells terminal tools that they can be run interactively. For example, if you run ls in a normal terminal, you are likely to see it output the files in columns:

Current Word Completion

Tue, 26 May 2020 00:00:00 +0000

Tab completion is one of the main reasons I decided to make the switch to ZSH. Being able to see descriptions and cycle between options makes finding options a breeze:

However, there are times that I would prefer to have completion options based on the current word I have typed, regardless of the command I am running. I suppose this is more like an extension of ZSH’s global aliases, but with the ability to choose from multiple options. An example of this is for word lists. There are a lot of commands I use that require word lists and it is a pain to write out the full path before I am able to tab-complete. My solution is what I have been calling Current Word Completion. My current iteration of it relies on FZF for the completions, although in the long term, I would like to make it work with ZSH’s built in completion system. Here is a demonstration using wl for wordlists and myip for my local machines ip addresses.

My Email Setup using Mutt and Vim

Mon, 04 May 2020 00:00:00 +0000

My email system is based around my email client of choice, Mutt; or more specifically NeoMutt, a fork of Mutt with several of the most common patches applied. I will refer to Mutt throughout this blog although, unless otherwise stated, I am referring to NeoMutt.

In this blog post I will document how Mutt and the many surrounding cogs interlock, to get my emails the way I like them. My goals for setting up my email were as follows:

3 Simple Steps to Improve Your Freelance Business's Security

Thu, 09 Apr 2020 00:00:00 +0000

All too often, security advice is aimed at large companies who can afford to spend hundreds or thousands of pounds on security procedures. What follows is hopefully advice that anyone can follow.

That being said, if you can afford to hire a security professional, do so. They will be able to target advice at your business specifically.

I work as a security consultant. I am often tasked with trying to break into a website or computer system to identify a client’s risks. A huge proportion of my successful attacks would have been unsuccessful if the following procedures were followed.

Making Firefox the browser to rule them all

Sat, 04 Apr 2020 00:00:00 +0000

We spend a lot of time these days in a browser. Given that , I thought it might be worth sharing some of the changes I have made to my browser. I use Firefox with a very select few extensions. As a general rule, I don’t like extensions, although there are a couple of open source ones that I run, as well as a few I have made myself.

Since using Qutebrowser, I have loved having the ability to browse the web from my keyboard. There are times that I use the mouse, but they are rare now. Until recently, I was using a fork of Vim Vixen. This fork didn’t do much more than change the colour scheme and I added the ability to set a proxy server using it. However, I have recently been experimenting with Tridactyl. I plan to write a blog post about it in the near future but if you are looking for a browser plugin to give you Vim-like navigation, both Vim-Vixen and Tridactyl are excellent choices.

Terminal tools that make my life easier

Fri, 20 Mar 2020 00:00:00 +0000

The terminal is often seen as a “hipster” tool that people only use to make their lives difficult. I disagree with that sentiment. I can honestly say that I am more productive due to the efficiency boost I get from using command line tools.

That is not to say I do everything in the terminal, I don’t. There are graphical tools that I rely on and I would struggle to do a days work without. I am a proponent of people using the tools that they want to use. The purpose of this post is to shed light on some of the tools I use, not to evangelise you into using them.

Using Mutt with Exchange

Tue, 10 Mar 2020 00:00:00 +0000

Update: Although everything in this post is (to the best of my knowledge) correct, a more comprehensive setup guide for mutt and exchange can be found here: https://jonathanh.co.uk/blog/mutt-setup.html.

Mutt is an extremely powerful, vim like email client. If your company uses Exchange for email and calenders, you may have a hard time making them work together. As a Linux user, I can’t (and don’t want) to install outlook and I don’t want to have to open a web browser, every time I want to check an email. My mission was to find a way to manage my work emails using Mutt.

The switch to ZSH

Sat, 29 Feb 2020 00:00:00 +0000

ZSH is an alternative to shells like sh, bash or fish. I have nothing against any of them but I choose to use ZSH. There are hundreds of articles that cover the benefits, but very few that I have found also cover the downsides. In this blog, I will discuss some of the reasons I use ZSH and some of the annoyances I face. I work as a penetration tester, so some of the annoyances are specific to that. I am not going to pretend that this is a comprehensive list, it is the things that made my decision.

Fuzzy Search Hashcat Modes

Mon, 24 Feb 2020 00:00:00 +0000

There is little doubt that Hashcat is an amazing tool for cracking hashes. Unfortunately, the command syntax leaves quite a lot to be desired. My focus today is on Hashcat’s modes. Here is a snippet from the help page:

 - [ Hash modes ] -
 
 # | Name | Category
 ======+==================================================+======================================
 900 | MD4 | Raw Hash
 0 | MD5 | Raw Hash
 5100 | Half MD5 | Raw Hash
 100 | SHA1 | Raw Hash
 1300 | SHA2-224 | Raw Hash
 1400 | SHA2-256 | Raw Hash
 10800 | SHA2-384 | Raw Hash
 1700 | SHA2-512 | Raw Hash
 17300 | SHA3-224 | Raw Hash
 17400 | SHA3-256 | Raw Hash
 17500 | SHA3-384 | Raw Hash
 17600 | SHA3-512 | Raw Hash
 17700 | Keccak-224 | Raw Hash

I don’t know about you, but remembering the hash numbers for more than 2 or 3 of the most common hash types is not something I can do. My old solution was to run hashcat --example-hashes | less -i then search for the hash I was looking for. This worked, but still felt inefficient.

Help Me Out

Mon, 01 Jan 0001 00:00:00 +0000

I hate websites tracking me so I won’t be tracking you if you visit my website. This makes monetizing the website almost impossible. If you like what I do, and want to support the content I put on this website, there are a few ways you can do it.

Directly

PayPal Me: https://paypal.me/jab2870

Amazon Associates Links

In some blog posts, I include links to products that are part of the Amazon Associates program. At no cost to you, I receive a small commission based on any sales that are made using the link. I would appreciate it if you could use these links when making purchases, although understand fully if you choose not to. I will aim to include a non-associates link along side the associates one.

Other stuff you might like

Mon, 01 Jan 0001 00:00:00 +0000

I consume a lot more content than I produce. If you are interested in similar stuff to me, you might like some of it too. I have tried to categorise the content although there is often overlap. I hope this is helpful to you.

Linux

HexDSL

Used to do a lot of videos on Linux. Those old videos still great. Now probably falls more under general interest.

Side note: He is a great guy. Got to meet him in real life and talk quite a bit on Discord.

Rumple

Mon, 01 Jan 0001 00:00:00 +0000

Rumple is a lurcher. He has no known health concerns or dietary needs. He is generally a very friendly dog although may be snappy if scared or nervous.

His microchip number is: 966000100881284

Have you found our dog?

Please call us on:

Jonathan Hodgson: 07753 492267

Rebecca Hodgson: 07582 546606

Email us at:

Jonathan Hodgson: jonathan@jonathanh.co.uk

Rebecca Hodgson: rebecca.hodgson@protonmail.com

Registered Vets

Holmer Vets

Phone Number: 01432 272468

Wishlist

Mon, 01 Jan 0001 00:00:00 +0000

This is a list of things I’d like. I’ll probably get around to getting some of them at some point. If you are looking to get me something, this might be a good place to look

Van

Magnetic Door Locks (<£10 on offer)

I’m thinking I’ll use these to hold draws and doors shut in the van whilst driving so will need a few of them. Don’t need to be super big though.

Jonathan Hodgson's Blog

The hunt for a phone

Correlation Doesn't Mean Causation

Xiaozhi Esphome

Dogs Don't Understand Basic Concepts

Modern Day VHS

My Smart Home Mistakes

Passwords Most Fowl

I Got a Van

Setting a good Content Security Policy

My New Home - Alarm Clock

My New Home - Network

I Got a Robot Vacuum

Why can't I buy a dumb TV?

Multipart Emails in Neomutt

Advent of Code: Day 1

XSS Through the Referer Header

Writing Prose in Vim

Before you start with Home Assistant

Server

My Setup at the beginning of 2021

OS

Enumerating Users on WordPress

Upgrading reverse shells

Pseudo terminal

Current Word Completion

My Email Setup using Mutt and Vim

3 Simple Steps to Improve Your Freelance Business's Security

Making Firefox the browser to rule them all

Vim Navigation

Terminal tools that make my life easier

Using Mutt with Exchange

The switch to ZSH

Fuzzy Search Hashcat Modes

Help Me Out

Directly

Amazon Associates Links

Other stuff you might like

Linux

HexDSL

Rumple

Have you found our dog?

Please call us on:

Email us at:

Registered Vets

Wishlist

Van

Magnetic Door Locks (<£10 on offer)