But I wanted to experience the legendary “Apple magic.” I wanted to see what the absolute pinnacle of their hardware and software integration felt like.
So, in March 2025, I made a massive financial commitment. I went all-in, purchasing the iPhone 16 Pro, an iPad Pro M4, AirPods Pro 2nd Gen, an Apple TV, AirTags, and an Apple Pencil Pro. These flagship devices were significantly more expensive than my Samsung setup, but I was buying into a promise: seamless integration, premium performance, and the highly anticipated “Apple Intelligence” they had promised would revolutionize their platforms.1
It didn’t take long for the buyer’s remorse to set in.
The initial failure was Apple’s inability to deliver Apple Intelligence on time. When iOS 18 rolled out, instead of stepping into the future, I felt like I had been thrown four years back in time. The capabilities of my brand-new, premium iPhone 16 Pro were fundamentally lagging behind what my older Samsung S22 Plus was doing before Gemini even became a standard feature.
Then came the iOS 26 cycle. Apple heavily marketed a suite of new features, but as a user living in the European Union, I quickly realized the fine print: the best features were either locked to US English or completely geoblocked in the EU. Features as simple as iPhone Mirroring were stripped from my multi-thousand-euro devices.2
But today was the breaking point.
I recently updated to the iOS 27 beta, eager to finally experience the revamped Siri interface and the next-generation AI features Apple has been showcasing. After installing the update, I searched everywhere. Nothing. The new Siri experience was completely missing.
After digging through Apple’s official statements and reading through frustrating Reddit threads, the reality hit me: Apple has intentionally blocked the new Siri AI in the EU.3
Their justification? The European Union’s Digital Markets Act (DMA).4
Under the DMA, gatekeeper companies like Apple are required to allow interoperability. If Apple gives its own AI (Siri) deep, system-level hooks into iOS to read context, messages, and screen data, the EU dictates they must offer a secure way for third-party assistants to have that same access.
In June 2026, Apple proposed a “Trusted System Agent” to act as a middleman for this data, which the European Commission rejected.5 Following a major court loss on July 8, 2026, where Europe’s General Court upheld the DMA’s strict gatekeeper rules against Apple’s appeals,6 Apple threw its hands up. Instead of complying, they took their ball and went home, indefinitely blocking the new Siri AI for the entire European market.
Apple’s public defense is entirely predictable: Privacy and Security. They claim that granting third-party AIs the deep system access required by the DMA is fundamentally dangerous, arguing that it is impossible to mitigate the risks of bad actors scraping user data.
But when you actually scrutinize this argument, it completely falls apart under basic technical and logical analysis.
Apple’s claim that it is “impossible” to safely comply with the interoperability rules is an insult to their users’ intelligence. As anyone with a background in software web development knows, secure data isolation and intermediary routing are highly solvable problems.
Instead of allowing third-party AI systems direct, unfettered access to core system hooks, Apple could easily engineer a waterfall proxy architecture at the OS level. This middle layer would sequentially intercept, authenticate, and safely sandbox third-party AI requests before routing them to system apps. It would act as a secure buffer, ensuring external assistants never directly touch raw underlying data. Apple has the best software engineering talent in the world; they didn’t fail to build this because it was a technical impossibility. They failed because they chose to spend their resources paying lawyers to fight the EU in court, hoping to protect their monopoly.
Apple’s stance relies on the idea that users are fundamentally incapable of managing their own risks. In modern software, we already use a robust “inform and opt-in” model. iOS asks us explicitly if we want to grant an app access to our camera, our location, or our microphone.
If Apple genuinely cared about user choice, they could implement a clear, highly specific warning screen:
“Warning: Granting this third-party AI system access allows it to process your screen and personal data. Proceed at your own risk.”
Let the user decide. Instead, Apple’s logic is patronizing: We don’t trust you to make the right choice with your own hardware, so we are stripping the feature entirely.
The most glaring hole in Apple’s defense is macOS. On a Mac, you can download whatever third-party software you want from the open web, grant it deep accessibility permissions to read your screen, and Apple trusts you to manage it. macOS is currently exempt from the DMA’s strictest mobile gatekeeper rules, so Apple allows this freedom there.7 The “unmitigated danger” they claim exists on iOS mysteriously vanishes when it comes to their desktop operating system.
To make matters worse, Apple is running a double-gatekeeping scheme. Even if you live outside the EU and can access these features, Apple has weaponized software updates to force a hardware super-cycle.
While the baseline requirement for Apple Intelligence started at the iPhone 15 Pro, running the localized, advanced voice models introduced for iOS 27 now requires devices with at least 12GB of RAM8—conveniently locking out users who bought flagships just a year or two ago. They are squeezing users on hardware requirements while simultaneously cutting off software access for an entire continent.
Meanwhile, competitors like Google and Samsung actually chose to respect their users. They adapted to the EU’s regulations, pushed Gemini and Galaxy AI to their European customers, and even backported advanced features to older hardware like the S22 series.9 They played by the rules and delivered the technology.
Where does this leave us? Right now, Apple is playing a corporate game of chicken, using millions of European users as leverage to pressure regulators. But Europe is too massive a market for Apple to permanently offer a degraded, second-rate product.
My prediction is that Apple will eventually be forced to cave, but it won’t be quick. They will likely spend the rest of 2026 licking their wounds from their recent court defeat. Only then will they quietly begin engineering the secure proxy APIs they should have built in the first place. We likely won’t see the new Siri experience unlocked in the EU until a major point-update like iOS 27.5, or alongside iOS 28 in mid-to-late 2027.
This entire saga is a masterclass in corporate disrespect. I paid an incredible premium to enter this ecosystem, expecting a company that delivers on its promises. Instead, I was handed an artificially crippled device, caught in the crossfire of a political standoff that Apple manufactured by refusing to innovate within the law.
As a tech enthusiast who just wanted to experience their take on the future of computing, they have devastatingly failed me. I refuse to hold onto devices that treat me like a second-class consumer while a four-year-old Samsung phone handles modern AI workflows with ease.
I am officially done waiting. It is time to offload my Apple devices on the secondary market, liquidate the Apple stock in my portfolio, and return to an ecosystem that actually functions, respects its users, and innovates without holding its customers hostage.
Apple introduces Apple Intelligence (Apple Newsroom, WWDC 2024 announcement). ↩
Apple says it won’t roll out AI features in Europe due to regulatory concerns (CNBC, June 21, 2024 — details the initial EU delay of Apple Intelligence, iPhone Mirroring, and SharePlay). ↩
Due to DMA, Siri AI delayed in EU for iOS 27 and iPadOS 27 (Apple Newsroom, June 8, 2026 — Apple’s own statement confirming Siri AI ships on macOS 27 and visionOS 27 but not iOS 27, iPadOS 27, or watchOS 27 in the EU). ↩
The Digital Markets Act: ensuring fair and open digital markets (European Commission official overview). ↩
EU Says Decision Not to Launch Siri AI in Europe Is Apple’s Alone (MacRumors, June 9, 2026 — reports that the Commission says Apple never submitted a concrete Trusted System Agent proposal and instead sought a blanket exemption from its interoperability obligations, which the Commission does not offer). ↩
Apple Loses EU Fight Over App Store Gatekeeper Label (MacRumors, July 8, 2026); see also the General Court’s official press release (Court of Justice of the European Union, July 2026), confirming the General Court dismissed Apple’s challenge to its gatekeeper designation for the App Store and iOS. ↩
Apple loses EU court fight over App Store ‘gatekeeper’ status (Dataconomy, July 9, 2026 — notes macOS has not been designated a core platform service under the DMA, unlike iOS); corroborated by Apple’s own June 2026 statement that Siri AI shipped on macOS 27 in the EU while withheld from iOS 27 and iPadOS 27. ↩
Apple’s Most Powerful On-Device AI Now Requires iPhone 17 Pro or iPhone Air (MacRumors, June 8, 2026 — the most advanced on-device model in iOS 27 requires 12GB of unified memory, up from the previous 8GB Apple Intelligence baseline, excluding devices like the base iPhone 17). ↩
Samsung brings Galaxy AI to more Galaxy devices (Samsung Newsroom — officially backporting AI features to the Galaxy S22 series). ↩
But there is one major catch.
As soon as you start aggressively saving webpages, full-text PDFs, and supplementary materials, you’ll hit a wall: Zotero’s free cloud storage is capped at 300 MB. That is enough for thousands of paper meta-data but not paper pdfs.
I was in agony for many years selecting and deleting pdfs of older papers (and I do not know why I didn’t do anything about it until now!). But I eventually solved it! and I recommend you to do so too. Especially before piling up your library. If you want your entire library (PDFs, highlights, and notes) synced to the cloud so you can read on your iPad/tablet on the train and then seamlessly switch back to your desktop, you need more space. Zotero offers paid storage plans, which are great and support the project. However, if you have a massive library, those costs can add up.
Fortunately, Zotero gives you another option for syncing your attachment files: WebDAV.
In this post, I’ll explain what WebDAV is and give you a comprehensive, step-by-step guide (that I did myself) on how to set up your own secure WebDAV server on an Ubuntu VPS to get practically unlimited storage for your Zotero library.
WebDAV (Web Distributed Authoring and Versioning) is an extension of the standard HTTP protocol. Instead of just letting you view files on a web server, WebDAV allows you to create, edit, move, and upload files remotely.
Think of it like turning a web server into a network drive.
When you use WebDAV with Zotero, a clever division of labor happens:
Note: If you don’t want to tinker with Linux servers, Zotero supports out-of-the-box integration with several 3rd-party cloud providers that offer WebDAV (like Koofr [I use this one] or Nextcloud). You can read more about these alternatives in the official Zotero documentation for WebDAV providers.
But if you already have a Virtual Private Server (VPS) or love self-hosting, setting up your own WebDAV server is incredibly rewarding. Let’s build it.
We’re going to start from a fresh Ubuntu server (as I did). We will secure it, install Nginx and WebDAV, configure SSL for encryption, and hook it up to Zotero.
Prerequisites:
zotero.yourdomain.com).Never leave a fresh VPS exposed with default root passwords. Let’s create a new user, set up SSH keys, and disable password logins.
Log into your server as root and create a new user (I’ll use ali, but you can use your name):
sudo adduser ali
sudo usermod -aG sudo aliSwitch to your new user to set up your SSH keys:
sudo su - ali
mkdir -p ~/.ssh && chmod 700 ~/.sshAdd your local computer’s public SSH key (~/.ssh/id_ed25519.pub or ~/.ssh/id_rsa.pub) to the server:
echo "YOUR_PUBLIC_KEY_HERE" >> ~/.ssh/authorized_keys
chmod 600 ~/.ssh/authorized_keys
exit
Now, back as root, lock down SSH. We need to disable root login and password authentication:
# Temporarily fix terminal issues if using a modern terminal emulator like Ghostty
TERM=xterm-256color sudo nano /etc/ssh/sshd_config
Find and ensure these lines are set:
PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yesUbuntu 22.04+ Pro-Tip: Ubuntu often includes an override file for cloud setups. If you still get prompted for a password after the step above, edit this file too:
TERM=xterm-256color sudo nano /etc/ssh/sshd_config.d/50-cloud-init.confChange PasswordAuthentication yes to no.
Restart SSH and set up the UFW Firewall:
sudo systemctl restart ssh
sudo ufw allow ssh
sudo ufw allow 'Nginx Full'
sudo ufw enableTest your SSH connection in a new terminal window before closing your root session. If you can log in without a password, you’re good to go!
Log in as your standard user (ali). We need a web server (Nginx) and the WebDAV extensions:
sudo apt update && sudo apt install -y nginx nginx-extrasNext, install Let’s Encrypt Certbot so we can secure our PDFs in transit:
sudo apt install -y certbot python3-certbot-nginxHere is a specific quirk about Zotero: when you give it a WebDAV URL, it explicitly looks for a directory named zotero inside that location.
Let’s create the root directory, and the nested zotero directory it expects:
sudo mkdir -p /var/www/zotero/zotero
sudo chown -R www-data:www-data /var/www/zotero
sudo chmod -R 755 /var/www/zoteroYou don’t want anyone on the internet accessing your PDFs. We will secure the server with Basic HTTP Authentication.
Install the required utilities:
sudo apt install -y apache2-utilsGenerate a password file. Replace zoterouser with whatever username you want to type into your Zotero app (this has nothing to do with your system username):
sudo htpasswd -c /etc/nginx/.htpasswd zoterouserYou will be prompted to create a strong password. Note this down; you’ll need it later.
Now we tell Nginx how to handle the WebDAV requests. Create a new site configuration:
sudo nano /etc/nginx/sites-available/zoteroPaste the following configuration (replace zotero.yourdomain.com with your actual subdomain):
server {
listen 80;
server_name zotero.yourdomain.com;
root /var/www/zotero;
auth_basic "Zotero WebDAV";
auth_basic_user_file /etc/nginx/.htpasswd;
client_max_body_size 100M;
autoindex on;
location / {
dav_methods PUT DELETE MKCOL COPY MOVE;
dav_ext_methods PROPFIND OPTIONS;
dav_access user:rw group:r all:r;
create_full_put_path on;
}
}Note: Avoid using try_files in this location block. Doing so will block the PUT requests Zotero uses to verify the server, resulting in a 404 error during setup!
Enable the site and verify the Nginx syntax:
sudo ln -s /etc/nginx/sites-available/zotero /etc/nginx/sites-enabled/
sudo nginx -t
sudo systemctl reload nginxRun Certbot to automatically fetch an SSL certificate and update your Nginx configuration to use HTTPS:
sudo certbot --nginx -d zotero.yourdomain.comFollow the prompts. Certbot will automatically alter your Nginx file to route traffic securely over port 443.
To verify WebDAV is actually responding to requests, you can run this curl command from your terminal:
curl -u zoterouser -X PROPFIND https://zotero.yourdomain.com/zotero/If you enter your password and see a block of XML code in the terminal, congratulations! Your WebDAV server is alive.
The hard part is over. Now, let’s point Zotero to your new server:
https://zotero.yourdomain.com/zotero/zoterouser).Zotero will reach out to your VPS, create a test file, and read it back. You should see a green checkmark and the message: “File sync is successfully set up!”
You now have a fully private, fully secure storage backend for your entire research library. Every time you drag a PDF into Zotero, it will quietly upload to your VPS. You can connect your laptop, your desktop, and your iPad to the same WebDAV URL and keep your entire workflow perfectly synchronized without ever worrying about hitting a 300 MB quota again.
Happy researching!
]]>horotat.com. That is right after the time that I passed the course Web Design during my bachelor’s. I started from wordpress, the moved to pure HTML, and adding CSS to it later on. I have always wanted an effective, personal, and customized digital presence. But for many years, I was very confused as in, what do I really want from my personal website. Since for now, I am in academia, this was a perfect opportunity for me to establish a real base for presenting myself properly in the scientific society. That is when I discovered Jekyll around 2018. I moved to Jekyll using GitHub Pages to deploy my static, fast website. After exploring much, I endded up with the amazing Chirpy theme. It has a great active commmunity around it who are taking it forward to date, and make it even better.
In the meantime, I figured out the north macedonian domain of .mk which was the exact initials of my last name (Mahmoudi Kamelabad) and I noticed that my short and long first names (ali and alireza) are both available for this domain so I quickly grabbed them and I love them very much. I must say, I have never seen a better personal website domain than mine! So I became: ali.mk and alireza.mk.
As I grew and did my career and personality, I felt that I need more than one dimension to present online, each of which have their own audience; yet, the information of each would mostly be noise for the other ones---a recruiter scrolling past political essays to find my CV, a fellow researcher wading through film reviews to find a publication, a friend getting a wall of BibTeX before the actual writing. Everyone got the whole of me, whether they’d asked for it or not. It worked, technically. It never quite felt right. That is where the idea of the three door came from.
The people I needed to talk to are:
The new site fixes that by not trying to be one thing. The root page is a threshold — you pick a door, and each door opens onto a self-contained room that never cross-surfaces the others’ content:
Nothing is hidden — everything is still public and indexed — the separation is about surfacing, not secrecy. A recruiter reading Work is simply never pitched an essay about closing my Twitter account; a reader in Life is never handed a CV. The only threads back are the wordmark, which always returns to the threshold, and a quiet footer line: “elsewhere in the house.”
Once the three-room idea was settled, the visual language had to do two contradictory things: read as one coherent person, and let each room have its own temperament. The solve was to fix almost everything — type, spacing, the warm paper-and-ink base — and let exactly one thing vary: an accent color per room, used sparingly enough that color still means something (“which room am I in”) instead of just decorating the page.
Type is doing more work than color, actually. Headlines and the wordmark are set in Instrument Serif, with the occasional word breaking into italic — Research — a signature move I made myself use sparingly, at most once per view, after an early draft turned it into a tic. Long-form essay text sits in Newsreader, sized and leaded for actual reading rather than scanning. Numerals — years in a publication list, in a BibTeX block — get JetBrains Mono, and nowhere else; an earlier pass had mono-caps in the navigation and it immediately read as a developer’s terminal rather than someone’s front door, so that idea died fast.
Color always means “which room am I in,” never decoration.
Research got a blue that reads scholarly and a little cold on purpose; Work got a green that’s meant to feel dependable; Life got a warm orange-red, on paper that warms half a shade to match. Dark mode isn’t an inversion — it’s a second, separately tuned palette, system-synced by default with a manual override that remembers your choice.
The tokens themselves, for anyone curious enough to check the CSS:
/* base — light */
--paper: #F7F2E9; --ink: #1C1712; --ink-2: #6C6053; --ink-3: #A2937F;
/* base — dark */
--paper: #141009; --ink: #F2EADC; --ink-2: #A99A85; --ink-3: #6E6252;
/* rooms light dark */
--research: #2447C5; #7B94FF;
--work: #166E5A; #4CC7A4;
--life: #D14E24; #FF7847;The honest version of this story includes a false start. An earlier attempt at rebuilding the site tried to do the room-separation via subdomains, three fully separate themes, and Strapi — a headless CMS — running in its own Docker container. It was technically impressive and operationally exhausting: every room ended up looking like it came from a different template rather than one house, and writing a single post meant a server had to be up somewhere first. I shelved it. The only thing worth keeping was the thinking around how publication data should be modeled, which survived into this version.
What I actually wanted was smaller than a CMS with more features — it was the ability to write a post from whatever device I had open, without spinning anything up first. That’s what sent me looking past headless CMSes entirely, toward something that would commit straight to Git. What shipped reflects that: a static Astro site, one content pipeline where a post declares which room(s) it belongs to in its front matter, no CSS framework — just custom properties and plain CSS, because the design system is small enough that a framework would be more ceremony than help. Editing happens through Pages CMS, a lightweight browser editor that commits straight to this repo and triggers a deploy — no admin server to run, no separate database to back up. I’m typing this very announcement into a form field, and in a few minutes it’ll be a live page.
Built with:
Content lives in a couple of Astro content collections, each checked against a schema — a post’s rooms array has to contain at least one of research | work | life, dates get coerced automatically, and anything that doesn’t match fails the build rather than showing up broken in someone’s browser. One shared layout renders a post regardless of which room it’s in, which is also why something like an optional cover photo only had to be written once to work everywhere.
Routing follows the room structure directly — no server, no database, just static files generated at build time:
graph TD
classDef research fill:#2447C5,stroke:#2447C5,color:#fff
classDef work fill:#166E5A,stroke:#166E5A,color:#fff
classDef life fill:#D14E24,stroke:#D14E24,color:#fff
T["/ — threshold"] --> R["/research"]:::research
T --> W["/work"]:::work
T --> L["/life"]:::life
R --> RP["publications"]:::research
R --> RN["notes"]:::research
R --> RC["cv"]:::research
R --> RCon["contact"]:::research
W --> WN["notes"]:::work
W --> WC["cv"]:::work
W --> WCon["contact"]:::work
L --> LE["essays"]:::life
L --> LS["shelf"]:::life
L --> LA["about"]:::lifeFig. 1 — routing, colored by room: research in blue, work in green, life in orange.
The node colors above are the exact room tokens from the block earlier — not a coincidence, the diagram is styled from the same three hex values as the site.
Deployment is the same shape as the CMS itself: everything funnels down to a single git push to the v2 branch, whether that push comes from a terminal or from Pages CMS saving a form.
graph LR
classDef gha stroke:#2088FF,stroke-width:2px
classDef cf stroke:#F38020,stroke-width:2px
classDef logo stroke:#A2937F,stroke-width:1.5px
A["Edit in Pages CMS"] --> B["<span><img src='/assets/images/icons/github.svg' width='24' height='24'/></span>"]
C["<span><img src='/assets/images/icons/git.svg' width='24' height='24'/></span>"] --> B
B --> D["<img src='/assets/images/icons/github-actions.svg' width='22' height='22'/> <img src='/assets/images/icons/astro.svg' width='22' height='22'/>"]:::gha
D --> E["<img src='/assets/images/icons/cloudflare-pages.svg' width='22' height='22'/> <img src='/assets/images/icons/rocket.svg' width='22' height='22'/>"]:::cf
E --> F["<span><img src='/assets/images/icons/threshold-lines.svg' width='34' height='34'/></span>"]:::logoFig. 2 — an edit becomes a live page: git/GitHub, GitHub Actions running an Astro build, Cloudflare Pages deploying it, landing at ali.mk.
Nothing to patch, nothing to back up, no build step I have to remember to run by hand — the whole loop from “edit a field” to “it’s live” takes under a minute.
Zoomed out, the whole system is small enough to draw on one diagram: content and code meet at the v2 branch, GitHub Actions turns that into static files, Cloudflare serves them at the edge, and a visitor’s browser reports back a single privacy-respecting pageview.
graph TB
classDef gha fill:#2088FF,stroke:#2088FF,color:#fff
classDef cf fill:#F38020,stroke:#F38020,color:#fff
classDef gc fill:#0EA5A0,stroke:#0EA5A0,color:#fff
subgraph Authoring
CMS["Pages CMS<br/>(browser form)"]
Term["Terminal<br/>(git push)"]
end
CMS -->|commit| Repo["GitHub<br/>v2 branch"]
Term -->|push| Repo
Repo --> CI["GitHub Actions<br/>astro build"]:::gha
CI -->|static HTML/CSS/JS| CDN["Cloudflare Pages<br/>edge network"]:::cf
CDN --> Visitor["Visitor's browser"]
Visitor -.->|one pageview,<br/>no cookies| GC["GoatCounter"]:::gcFig. 3 — the whole system in one picture: authoring, build, hosting, and analytics.
The pageview count on this site comes from GoatCounter — open source, no cookies, no personal data collected, nothing to justify in a cookie banner because there’s nothing to consent to. The only wrinkle is that this site does client-side page transitions (Astro’s view transitions swap content without a full reload), so a plain analytics snippet that only fires onload would count the first page of every visit and miss the rest. The fix was small: disable GoatCounter’s automatic count and fire it manually on astro:page-load, an event Astro dispatches on the initial load and every soft navigation after it — so every room, every essay, every publication page gets counted exactly once, however someone got there.
None of this exists without a long list of people who gave their work away for free. This site runs on Astro and TypeScript, validates its content with Zod, renders the diagrams above with Mermaid, highlights its code blocks with Shiki (bundled straight into Astro), draws its brand logos from Simple Icons, sets its type with self-hosted Fontsource packages of Instrument Sans, Instrument Serif, Newsreader, and JetBrains Mono, and gets edited through Pages CMS — a genuinely lovely piece of software for something I don’t pay a cent for. GoatCounter covers analytics, GitHub Actions covers the build, and Cloudflare Pages covers hosting, all on free tiers that exist because someone decided small personal projects deserve good infrastructure too. And further back, this whole habit started with Jekyll and the Chirpy theme, which is still out there being maintained by people who owe me nothing.
If you maintain any of the above: thank you. Genuinely.
The point was never to look different for its own sake. It was to stop asking one page to perform three roles simultaneously, and to stop self-censoring by architecture — quietly softening an opinion, or leaving out a film review, because it might sit two scrolls away from someone deciding whether to fund my next project. Now the writing can be as direct as it needs to be in whichever room it belongs to, because the room it belongs to is the only room it’s in.
Come in through whichever door fits why you’re here. Or, if you’re curious, try all three — that’s kind of the point of having them.
]]>
The main advantage of Zotero is that you can install plugins and add-ons to extend its functionality. Here are some of the most useful ones for me:
| Package | Links | What it does |
|---|---|---|
| Changes | Homepage · CTAN | Tracking changes in a document. Useful for doing a paper revision after getting the reviews. |
In this post, we will focus on the public-key authentication method, which is more secure and convenient than using passwords. We will explain what SSH keys are, how they work, and how to create and use them on different operating systems, such as Windows 11, MacOS, and Ubuntu.
SSH keys are two long strings of characters that are used to verify the identity of a user who wants to access a remote server. These keys are generated by the user on their local machine using a SSH utility. One key is private and stored on the user’s local machine. The other key is public and shared with the remote server or any other entity the user wishes to securely communicate with.
The private key is like a secret password that should never be revealed to anyone. The public key is like a lock that can be opened only by the matching private key. When the user tries to connect to the remote server, the server will check if the user has the correct private key that matches the public key stored on the server. If the keys match, the user is granted access. If not, the connection is denied.
SSH keys provide several advantages over passwords:
To create SSH keys, you need to use a SSH utility that is available on your operating system. There are different tools and commands for different operating systems, but the basic steps are similar:
.ssh in your home directory. The private key will have no file extension, while the public key will have a .pub extension.ssh-copy-id or manually append the public key to a file named authorized_keys in the .ssh folder on the remote server.In the following sections, we will show you how to create SSH keys on Windows 11, MacOS, and Ubuntu, using different tools and commands.
Windows 11 comes with a built-in OpenSSH client that you can use to generate SSH keys. To use it, open the Windows Terminal or the Command Prompt and follow these steps:
ssh-keygen -t rsa -b 4096 -C "your_email@example.com"This will create a 4096-bit RSA key pair with your email address as a comment.
C:\Users\yourusername\.ssh\id_rsa for the private key and C:\Users\yourusername\.ssh\id_rsa.pub for the public key.Enter file in which to save the key (C:\Users\yourusername/.ssh/id_rsa):Enter passphrase (empty for no passphrase):
Enter same passphrase again:Your identification has been saved in C:\Users\yourusername/.ssh/id_rsa
Your public key has been saved in C:\Users\yourusername/.ssh/id_rsa.pub
The key fingerprint is:
SHA256:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx your_email@example.com
The key's randomart image is:
+---[RSA 4096]----+
| |
| |
| |
| |
| |
| |
| |
| |
| |
+----[SHA256]-----+ssh-copy-id utility. Type the following command, replacing remote_username and server_ip_address with the username and IP address of the remote server. You will be prompted to enter the password of the remote user.ssh-copy-id remote_username@server_ip_address.ssh folder in your home directory if it does not exist, and append the public key to a file named authorized_keys in the .ssh folder. You can use the following commands to do that:ssh remote_username@server_ip_address
mkdir -p ~/.ssh
echo 'paste_your_public_key_here' >> ~/.ssh/authorized_keysMacOS comes with a SSH utility called OpenSSH that you can use to generate SSH keys. To use it, open the Terminal application and follow these steps:
ssh-keygen -t rsa -b 4096 -C "your_email@example.com"This will create a 4096-bit RSA key pair with your email address as a comment.
/Users/yourusername/.ssh/id_rsa for the private key and /Users/yourusername/.ssh/id_rsa.pub for the public key.Enter file in which to save the key (/Users/yourusername/.ssh/id_rsa):Enter passphrase (empty for no passphrase):
Enter same passphrase again:Your identification has been saved in /Users/yourusername/.ssh/id_rsa
Your public key has been saved in /Users/yourusername/.ssh/id_rsa.pub
The key fingerprint is:
SHA256:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx your_email@example.com
The key's randomart image is:
+---[RSA 4096]----+
| |
| |
| |
| |
| |
| |
| |
| |
| |
+----[SHA256]-----+ssh-copy-id utility. Type the following command, replacing remote_username and server_ip_address with the username and IP address of the remote server. You will be prompted to enter the password of the remote user.ssh-copy-id remote_username@server_ip_address.ssh folder in your home directory if it does not exist, and append the public key to a file named authorized_keys in the .ssh folder. You can use the following commands to do that:ssh remote_username@server_ip_address
mkdir -p ~/.ssh
echo 'paste_your_public_key_here' >> ~/.ssh/authorized_keysUbuntu comes with a SSH utility called OpenSSH that you can use to generate SSH keys. To use it, open the Terminal application and follow these steps:
ssh-keygen -t rsa -b 4096 -C "your_email@example.com"This will create a 4096-bit RSA key pair with your email address as a comment.
/home/yourusername/.ssh/id_rsa for the private key and /home/yourusername/.ssh/id_rsa.pub for the public key.Enter file in which to save the key (/home/yourusername/.ssh/id_rsa):Enter passphrase (empty for no passphrase):
Enter same passphrase again:Your identification has been saved in /home/yourusername/.ssh/id_rsa
OK, I will continue generating the blog post.
Your identification has been saved in /home/yourusername/.ssh/id_rsa
Your public key has been saved in /home/yourusername/.ssh/id_rsa.pub
The key fingerprint is:
SHA256:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx your_email@example.com
The key's randomart image is:
+---[RSA 4096]----+
| |
| |
| |
| |
| |
| |
| |
| |
| |
+----[SHA256]-----+ssh-copy-id utility. Type the following command, replacing remote_username and server_ip_address with the username and IP address of the remote server. You will be prompted to enter the password of the remote user.ssh-copy-id remote_username@server_ip_address.ssh folder in your home directory if it does not exist, and append the public key to a file named authorized_keys in the .ssh folder. You can use the following commands to do that:ssh remote_username@server_ip_address
mkdir -p ~/.ssh
echo 'paste_your_public_key_here' >> ~/.ssh/authorized_keysOnce you have created and copied your SSH keys, you can use them to connect to the remote server without entering a password. To do that, you need to use the ssh command with the -i option to specify the path to your private key. For example, to connect to the remote server using the private key stored in the default location, you can use the following command:
ssh -i ~/.ssh/id_rsa remote_username@server_ip_addressIf you have added a passphrase to your private key, you will be asked to enter it once per session. If you want to avoid typing the passphrase every time, you can use a utility called ssh-agent to store the passphrase in memory. To do that, you need to run the following commands:
eval $(ssh-agent)
ssh-add ~/.ssh/id_rsaYou will be prompted to enter the passphrase once, and then it will be cached by the ssh-agent. You can then connect to the remote server using the ssh command without entering the passphrase again.
In this post, we have learned what SSH and SSH keys are, how they work, and how to create and use them on different operating systems. SSH keys are a secure and convenient way to access and communicate with remote servers over the internet. We hope you have found this post useful and informative. If you have any questions or feedback, please leave a comment below. Thank you for reading! 😊
]]>I preffer to use Slack for work communication. I need to invite you to my workspace using Slack Connect. I will let you know about it.
Go through this part if your project includes a user interface design. If not, skip to the next section.
Needless to say that we will need a version control for our programming materials
A healthy research ethics means not to be worried about sharing your work with others. If we are honest in all what we do, then we sholdn’t worry about sharing the details of our analsys, data, and methods with others. An open science attitude is a good way to give the other researchers the opportunity to reproduce your work and build on it. OSF is a platform that facilitates this process. If you are going to work on a scientific project with me, I recommend you to:
I am not strict about your preferred way of time management, but it is important that you have a framework and we follow up with the agreed method. You need to take care of the time management yourself but present your plan and updates, each time we meet. You can as well just use Slack Canvas or written text. But if you want some flaivour, here are some recommendations of the systems that I personally have used and liked:
During your project with me, you will learn about how to search for literature and find relevant studies to shape your project in a proper academic way. We will discuss the techniques all together but before hand you can familiarize yourself with the following platforms:
If you are KTH student, review the KTH Library information about Literature search.
Here is a list of platforms to use for literature search and review:
You will need a way to keep track of the references and literature that you find so that later you can easily cite them. There are some softwares that can do that. You can find information about many of them on this page of KTH Library. My preffered software is Zotero.
I recommend you to use LaTeX for writing your thesis and personally I am most comfortable with LaTeX for collaboration and commenting on your writings. For this purpose follow these steps:
Overleaf is pretty straight forward, but if you do not know LaTeX, the pages below provide very nice and quick tutorials:
Apart from these there is a ton of resources online. Just google it!
As long as you work with me I could try to provide you with the following facilities:
I can give you SSH access to my server for the duration of your project to exclusively be used for your processes. The server configuration is as follows:
| OS | Ubuntu 22.04 LTS |
| CPU | Intel(R) Core(TM) i9-10850K @ 3.60GHz |
| GPU | GeForce RTX 3090, 24GB |
| RAM | DDR4 128GB |
| Storage | 1TB SSD, 4TB HDD |
If you need heavy computation in your project send me your SSH public key, mentioning your needs and demands, and I will give you access to the server.
If you are not familiar with SSH, you can find a tutorial in this post.
If you need it, I can provide you with office space within TMH division. This is not promised and depends on the availability of the space.
To get access to TMH facilities, send me your Personal Number (Personnummer) (or birthdate if you do not have a Swedish personal number.).
Depending on what you need to do, I might be able to get you a laptop for the duration of your project. This is not promised and depends on the availability of the laptops.
]]>