From 7ff1b70ad9e1b46795a9502a520286c12af132e4 Mon Sep 17 00:00:00 2001
From: Ralf Jung <post@ralfj.de>
Date: Fri, 29 Sep 2023 18:01:18 +0200
Subject: [PATCH 01/16] tweak image behavior on small screens

---
 personal/_sass/_layout.scss | 14 ++++++++++++++
 research/index.html         |  2 +-
 2 files changed, 15 insertions(+), 1 deletion(-)

diff --git a/personal/_sass/_layout.scss b/personal/_sass/_layout.scss
index 8859ce1..90cc579 100644
--- a/personal/_sass/_layout.scss
+++ b/personal/_sass/_layout.scss
@@ -192,3 +192,17 @@ body { /* This centers us in the page, and handles the "too wide" case */
         margin-top: 0.8em;
     }
 }
+
+/* Images (~350px wide) floating to the right but only if there is enough space */
+.float-right-350 {
+  float: right;
+  margin-left: 0.8em;
+  margin-bottom: 0.3em;
+}
+@media screen and (max-width:550px) {
+    .float-right-350 {
+        text-align: center;
+        float: none;
+        margin: 0;
+    }
+}
diff --git a/research/index.html b/research/index.html
index b20242f..6a16288 100644
--- a/research/index.html
+++ b/research/index.html
@@ -2,7 +2,7 @@
 title: Ralf Jung
 ---
 
-<div style="float:right; margin-left:0.8em; margin-bottom: 0.3em"><img src="me.jpg" srcset="me.jpg, me-2x.jpg 2x"></div>
+<div class="float-right-350"><img style="max-width: 350px; width: 100%;" src="me.jpg" srcset="me.jpg, me-2x.jpg 2x"></div>
 
 <p>I am assistant professor at <a href='https://ethz.ch' target="_blank">ETH Zürich</a> as part of the <a href='https://pls.inf.ethz.ch/' target="_blank">Institute for Programming Languages and Systems</a>.</br>
 Previously, I completed my <a href="thesis.html">PhD</a> at <a href="https://www.mpi-sws.org/">MPI-SWS</a> and <a href="https://www.uni-saarland.de/" target="_blank">Saarland University</a> in Saarbrücken, Germany; my advisor was <a href="https://people.mpi-sws.org/~dreyer/">Derek Dreyer</a>.
-- 
2.30.2


From b9a80b4343be6e58bf7775958bea4b8ff7169732 Mon Sep 17 00:00:00 2001
From: Ralf Jung <post@ralfj.de>
Date: Fri, 29 Sep 2023 18:07:48 +0200
Subject: [PATCH 02/16] further tweak image

---
 personal/_sass/_layout.scss | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/personal/_sass/_layout.scss b/personal/_sass/_layout.scss
index 90cc579..0054a61 100644
--- a/personal/_sass/_layout.scss
+++ b/personal/_sass/_layout.scss
@@ -199,10 +199,10 @@ body { /* This centers us in the page, and handles the "too wide" case */
   margin-left: 0.8em;
   margin-bottom: 0.3em;
 }
-@media screen and (max-width:550px) {
+@media screen and (max-width:600px) {
     .float-right-350 {
-        text-align: center;
+        max-width: 300px;
         float: none;
-        margin: 0;
+        margin: auto;
     }
 }
-- 
2.30.2


From bdddd73b66cc754f40b338a9ed56b8db8b7bdf3a Mon Sep 17 00:00:00 2001
From: Ralf Jung <post@ralfj.de>
Date: Wed, 22 Nov 2023 17:47:24 +0100
Subject: [PATCH 03/16] add Grove

---
 research/publications.html | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/research/publications.html b/research/publications.html
index 1993fb6..902fb52 100644
--- a/research/publications.html
+++ b/research/publications.html
@@ -7,6 +7,13 @@ slug: Publications
 
 <h3>2023</h3>
 
+<ul><li>
+  <b>Grove: a Separation-Logic Library for Verifying Distributed Systems</b><br/>
+  Upamanyu Sharma, Ralf Jung, Joseph Tassarotti, M. Frans Kaashoek, Nickolai Zeldovich <br>
+  <i>In <a href="https://sosp2023.mpi-sws.org/index.html">SOSP 2023</a></i><br>
+  [<a href="https://iris-project.org/pdfs/2023-sosp-grove.pdf">paper</a>] [<a href="https://arxiv.org/abs/2309.03046">extended version</a>]
+</li></ul>
+
 <ul><li>
   <b>Verifying vMVCC, a high-performance transaction library using multi-version concurrency control</b><br/>
   Yun-Sheng Chang, Ralf Jung, Upamanyu Sharma, Joseph Tassarotti, M. Frans Kaashoek, Nickolai Zeldovich <br>
-- 
2.30.2


From 62f098270581ff12f0f71c8448a9b4a0041ff4f4 Mon Sep 17 00:00:00 2001
From: Ralf Jung <post@ralfj.de>
Date: Wed, 22 Nov 2023 17:48:37 +0100
Subject: [PATCH 04/16] link to group website

---
 research/index.html | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/research/index.html b/research/index.html
index 6a16288..d335f56 100644
--- a/research/index.html
+++ b/research/index.html
@@ -4,7 +4,8 @@ title: Ralf Jung
 
 <div class="float-right-350"><img style="max-width: 350px; width: 100%;" src="me.jpg" srcset="me.jpg, me-2x.jpg 2x"></div>
 
-<p>I am assistant professor at <a href='https://ethz.ch' target="_blank">ETH Zürich</a> as part of the <a href='https://pls.inf.ethz.ch/' target="_blank">Institute for Programming Languages and Systems</a>.</br>
+<p>I am assistant professor at <a href='https://ethz.ch' target="_blank">ETH Zürich</a>, leading the <a href="https://plf.inf.ethz.ch/" target="_blank">Programming Language Foundations Lab</a>.
+We are part of the <a href='https://pls.inf.ethz.ch/' target="_blank">Institute for Programming Languages and Systems</a>.</br>
 Previously, I completed my <a href="thesis.html">PhD</a> at <a href="https://www.mpi-sws.org/">MPI-SWS</a> and <a href="https://www.uni-saarland.de/" target="_blank">Saarland University</a> in Saarbrücken, Germany; my advisor was <a href="https://people.mpi-sws.org/~dreyer/">Derek Dreyer</a>.
 I also did a post-doc in the <a href="https://pdos.csail.mit.edu/">PDOS group</a> at <a href="https://www.csail.mit.edu/" target="_blank">MIT CSAIL</a>.
 </p>
-- 
2.30.2


From d3547e5fc5186be997e4f09bb4a21d50fb0dcf7f Mon Sep 17 00:00:00 2001
From: Ralf Jung <post@ralfj.de>
Date: Wed, 27 Dec 2023 19:52:50 +0100
Subject: [PATCH 05/16] add Google OSPB post

---
 .../_posts/2023-12-27-open-source-peer-bonus.md     | 13 +++++++++++++
 1 file changed, 13 insertions(+)
 create mode 100644 personal/_posts/2023-12-27-open-source-peer-bonus.md

diff --git a/personal/_posts/2023-12-27-open-source-peer-bonus.md b/personal/_posts/2023-12-27-open-source-peer-bonus.md
new file mode 100644
index 0000000..00fd3dd
--- /dev/null
+++ b/personal/_posts/2023-12-27-open-source-peer-bonus.md
@@ -0,0 +1,13 @@
+---
+title: "Google Open Source Peer Bonus"
+categories: rust
+---
+
+We are all used to spam emails, supposedly from Google, that say "You won" and I just need to send all my data to somewhere to receive my lottery payout.
+When I recently received an email about Google's "Open Source Peer Bonus" program, I almost discarded it as yet another version of that kind of spam.
+But it turns out sometimes these emails are real!
+Meanwhile the [official announcement](https://opensource.googleblog.com/2023/12/google-open-source-peer-bonus-program-announces-second-group-of-2023-winners.html) has been released which lists me as a recipient of this bonus as a thank you for my work on Rust.
+So this one time, it wasn't spam after all!
+
+Thanks a lot to Google for this program at the $250 reward; it is great to see open source work honored this way.
+I have donated the amount in full to [noyb](https://noyb.eu/en), who I'm sure will be using it [for good](https://noyb.eu/en/noyb-win-first-major-fine-eu-1-million-using-google-analytics).
-- 
2.30.2


From aef7fcc9e6b69ee09cc3fede332b7125494723d4 Mon Sep 17 00:00:00 2001
From: Ralf Jung <post@ralfj.de>
Date: Sun, 7 Jan 2024 18:00:30 +0100
Subject: [PATCH 06/16] mention the first OSPB as well

---
 personal/_posts/2023-12-27-open-source-peer-bonus.md | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/personal/_posts/2023-12-27-open-source-peer-bonus.md b/personal/_posts/2023-12-27-open-source-peer-bonus.md
index 00fd3dd..788c42e 100644
--- a/personal/_posts/2023-12-27-open-source-peer-bonus.md
+++ b/personal/_posts/2023-12-27-open-source-peer-bonus.md
@@ -11,3 +11,10 @@ So this one time, it wasn't spam after all!
 
 Thanks a lot to Google for this program at the $250 reward; it is great to see open source work honored this way.
 I have donated the amount in full to [noyb](https://noyb.eu/en), who I'm sure will be using it [for good](https://noyb.eu/en/noyb-win-first-major-fine-eu-1-million-using-google-analytics).
+
+**Update (2024-01-07):**
+In fact, this is already my second Google Open Source Peer Bonus.
+The first was in the [first half of 2023](https://opensource.googleblog.com/2023/05/google-open-source-peer-bonus-program-announces-first-group-of-winners-2023.html).
+Due to issues with the payment process, it took a while for that bonus to be transferred, but I can confirm that it has now arrived in my bank account.
+I will have to find a suitable non-for-profit to donate this to... or it might be noyb again, we will see.
+**/Update**
-- 
2.30.2


From 3e50252f4490a68c06515616e115a130f8ade901 Mon Sep 17 00:00:00 2001
From: Ralf Jung <post@ralfj.de>
Date: Sun, 7 Jan 2024 18:01:24 +0100
Subject: [PATCH 07/16] dont show the full post on the overview page

---
 personal/_posts/2023-12-27-open-source-peer-bonus.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/personal/_posts/2023-12-27-open-source-peer-bonus.md b/personal/_posts/2023-12-27-open-source-peer-bonus.md
index 788c42e..6214be7 100644
--- a/personal/_posts/2023-12-27-open-source-peer-bonus.md
+++ b/personal/_posts/2023-12-27-open-source-peer-bonus.md
@@ -9,6 +9,8 @@ But it turns out sometimes these emails are real!
 Meanwhile the [official announcement](https://opensource.googleblog.com/2023/12/google-open-source-peer-bonus-program-announces-second-group-of-2023-winners.html) has been released which lists me as a recipient of this bonus as a thank you for my work on Rust.
 So this one time, it wasn't spam after all!
 
+<!-- MORE -->
+
 Thanks a lot to Google for this program at the $250 reward; it is great to see open source work honored this way.
 I have donated the amount in full to [noyb](https://noyb.eu/en), who I'm sure will be using it [for good](https://noyb.eu/en/noyb-win-first-major-fine-eu-1-million-using-google-analytics).
 
-- 
2.30.2


From 97ca6b88a6d9e86dd2ccc78cb512036af8c7c112 Mon Sep 17 00:00:00 2001
From: Ralf Jung <post@ralfj.de>
Date: Mon, 11 Mar 2024 08:19:47 +0100
Subject: [PATCH 08/16] contact: use my ETH email address

---
 research/contact.html | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/research/contact.html b/research/contact.html
index f825928..d43ad95 100644
--- a/research/contact.html
+++ b/research/contact.html
@@ -3,7 +3,7 @@ title: Contact
 sort: 2
 ---
 
-<p><b>Email:</b> research AT ralfj DOT de</p>
+<p><b>Email:</b> ralf DOT jung AT inf DOT ethz DOT ch</p>
 
 <p><b>Phone:</b> +41 44 632 5598</p>
 
-- 
2.30.2


From b9e09bc6c289a4fb5cdcf71d5cb46e0bf4cc9484 Mon Sep 17 00:00:00 2001
From: Ralf Jung <post@ralfj.de>
Date: Thu, 21 Mar 2024 19:53:05 +0100
Subject: [PATCH 09/16] update website

---
 research/index.html | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/research/index.html b/research/index.html
index d335f56..bd7b174 100644
--- a/research/index.html
+++ b/research/index.html
@@ -17,10 +17,13 @@ Please explain why you are interested in a PhD in this field and what your prior
 Note that doing a PhD at ETH Zürich generally requires a Master's degree, but there is a <a href="https://inf.ethz.ch/doctorate/direct-doctorate-computer-science.html">direct doctorate program</a> that you can enter with a Bachelor's degree (application deadline December 15th).</i></p> -->
 
 <p>My two main lines of work are about <a href="https://www.rust-lang.org/">Rust</a> and <a href="https://iris-project.org/">Iris</a>.<br>
-On the Rust side, I am working (also in collaboration with the Rust language team) towards a solid formal foundation for the language, including in particular the unsafe parts.
-One key result here is our <a href="https://plv.mpi-sws.org/rustbelt/popl18/">type safety proof</a>, which also describes a methodology for establishing type safety of well-encapsulated unsafe code.
-My goal is to make unsafe Rust just as safe as safe Rust by means of formal verification.<br>
-On the Iris side, besides continuing development of its logical foundations, I am interested in applying Iris to new problem domains; recently I started working on modular verification of fault-tolerant distributed system components.<br>
+On the Rust side, me and my group are working (also in collaboration with the Rust language team) towards a solid formal foundation for the language, including in particular the unsafe parts.
+As part of this we are developing <a href="https://github.com/rust-lang/miri/">Miri</a>, a practical tool for detecting Undefined Behavior bugs in unsafe Rust code, which has become a part of the standard toolbox of unsafe code authors.
+Meanwhile, <a href="https://github.com/minirust/minirust">MiniRust</a> is our work-in-progress proposal for a precise specification of unsafe Rust, that I hope to integrate into an official Rust specification eventually.
+My long-term goal is to make unsafe Rust just as safe as safe Rust by means of formal verification based on rigorous foundations for all key components of the language.<br>
+On the Iris side, I am continuing development of its logical foundations.
+We are making Iris fit for specifying and verifying programming languages at scale using a more modular approach.
+The long-term goal is for Iris to be able to handle the full scale of complexities that arise when doing foundational verification of real languages.<br>
 For some more information, check out my <a href="https://www.ralfj.de/blog/categories/research.html">research blog</a>, my <a href="cv.pdf">CV</a>, and my <a href="research-statement.pdf">research statement</a>.</p>
 
 <p>In my free time, I like to run internet services myself and work on free software.
-- 
2.30.2


From 5a209269bef4653c72996235995eb0742a886f1a Mon Sep 17 00:00:00 2001
From: Ralf Jung <post@ralfj.de>
Date: Sun, 14 Apr 2024 13:09:18 +0200
Subject: [PATCH 10/16] projects: sort alphabetically

---
 personal/_config.yml       |  8 ++++----
 personal/projects/index.md | 10 +++++-----
 2 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/personal/_config.yml b/personal/_config.yml
index d63d639..f2c5c2a 100644
--- a/personal/_config.yml
+++ b/personal/_config.yml
@@ -12,13 +12,13 @@ readmes:
     src_base: "/home/r/src"
     out_base: "projects"
     projects:
-      - name: "lilass"
       - name: "dyn-nsupdate"
-      - name: "zonemaker"
-      - name: "schsh"
+      - name: "git-mirror"
+      - name: "lilass"
       - name: "rust-101"
         src: "rust/rust-101"
-      - name: "git-mirror"
+      - name: "schsh"
+      - name: "zonemaker"
 
 defaults:
   - scope:
diff --git a/personal/projects/index.md b/personal/projects/index.md
index c5d3f4a..988c471 100644
--- a/personal/projects/index.md
+++ b/personal/projects/index.md
@@ -7,17 +7,17 @@ To solve some issue I was having, or to facilitate my daily computer usage.
 The tools were usually not written with general re-usability in mind.
 But maybe you are having just the same problem as I did, in which case I hope they can be helpful.
 
+* [dyn-nsupdate](dyn-nsupdate/): A tool to dynamically and securely update DNS zones via CGI.
+  This provides self-hosted DynDNS services.
+* [git-mirror](git-mirror/): This can keep multiple git repositories of the same project in sync automatically.
 * [LiLaSS](lilass/): A simple xrandr-based application to configure laptop screens on Linux. If you are using a
   Laptop, frequently work both with and without an external screen, and you are not happy with
   the configuration options your desktop provides, this may be for you.
-* [dyn-nsupdate](dyn-nsupdate/): A tool to dynamically and securely update DNS zones via CGI.
-  This provides self-hosted DynDNS services.
-* [zonemaker](zonemaker/): A small script to generate DNS zone files from Python.
+* [Rust-101](rust-101/): A small tutorial for the [Rust language](https://www.rust-lang.org).
 * [schsh](schsh/): A collection of scripts and configuration files which can be used to grant
   someone secure (SSH-based) access to a machine, without giving them a shell or read access
   to the entire file system.
-* [Rust-101](rust-101/): A small tutorial for the [Rust language](https://www.rust-lang.org).
-* [git-mirror](git-mirror/): This can keep multiple git repositories of the same project in sync automatically.
+* [zonemaker](zonemaker/): A small script to generate DNS zone files from Python.
 
 For some more of my projects, check out the [public git repositories](https://www.ralfj.de/git/)
 hosted on my server and my [GitHub profile](https://github.com/RalfJung/).
-- 
2.30.2


From 43307ef533738f9b108a6daa91541692f396a725 Mon Sep 17 00:00:00 2001
From: Ralf Jung <post@ralfj.de>
Date: Sun, 14 Apr 2024 16:53:11 +0200
Subject: [PATCH 11/16] add bubblebox and blog about it

---
 personal/_config.yml                    |  1 +
 personal/_posts/2024-04-14-bubblebox.md | 68 +++++++++++++++++++++++++
 personal/projects/index.md              | 13 ++---
 3 files changed, 76 insertions(+), 6 deletions(-)
 create mode 100644 personal/_posts/2024-04-14-bubblebox.md

diff --git a/personal/_config.yml b/personal/_config.yml
index f2c5c2a..959b104 100644
--- a/personal/_config.yml
+++ b/personal/_config.yml
@@ -12,6 +12,7 @@ readmes:
     src_base: "/home/r/src"
     out_base: "projects"
     projects:
+      - name: "bubblebox"
       - name: "dyn-nsupdate"
       - name: "git-mirror"
       - name: "lilass"
diff --git a/personal/_posts/2024-04-14-bubblebox.md b/personal/_posts/2024-04-14-bubblebox.md
new file mode 100644
index 0000000..85dc684
--- /dev/null
+++ b/personal/_posts/2024-04-14-bubblebox.md
@@ -0,0 +1,68 @@
+---
+title: "Sandboxing All The Things with Flatpak and BubbleBox"
+categories: sysadmin
+---
+
+A few years ago, I have [blogged]({% post_url 2019-03-09-firejail %}) about my approach to sandboxing less-trusted applications that I have to or want to run on my main machine.
+The approach has changed since then, so it is time for an update.
+
+<!-- MORE -->
+
+Over time I grew increasingly frustrated with Firejail: configurations would frequently break on updates,
+and debugging Firejail profiles is extremely hard. When considering all the included files, we are talking
+about many hundred lines of configuration with a subtle interplay of allowlists and blocklists.
+Even when I knew which folder I wanted to give access to, it was often non-trivial to ensure that
+this access would actually be possible.
+
+Now I am instead using a combination of two different approaches: Flatpak and BubbleBox.
+
+## Flatpak
+
+The easiest sandbox to maintain is the sandbox maintained by someone else.
+So when a Flatpak exists for software I want to or have to use, such as Signal or Zoom, that is generally my preferred approach.
+
+Unfortunately, Flatpaks can come with extremely liberal default profiles that make the sandbox mostly pointless.
+The following global overrides help ensure that this does not happen:
+```
+[Context]
+sockets=!gpg-agent;!pcsc;!ssh-auth;!system-bus;!session-bus
+filesystems=~/.XCompose:ro;xdg-config/fontconfig:ro;!~/.gnupg;!~/.ssh;!xdg-documents;!home;!host
+
+[Session Bus Policy]
+org.freedesktop.Flatpak=none
+org.freedesktop.secrets=none
+```
+
+## BubbleBox
+
+However, not all software exists as Flatpak.
+Also, sometimes I want software to run basically on my host system (i.e., to use the regular `/usr`), just without access to literally *everything* in my home directory.
+Examples of this are Factorio and VSCodium.
+The latter doesn't work in Flatpak as I want to use it with LaTeX, and realistically this means it needs to run the LaTeX on my host.
+The official recommendation is to effectively disable the Flatpak sandbox, but that entirely defeats the point, so I went looking for alternatives.
+
+[bubblewrap] provides a very convenient solution: it can start an application in its own private filesystem namespace with full control over which part of the host file system is accessible from inside the sandbox.
+I wrote a small wrapper around bubblewrap to make this configuration a bit more convenient to write and manage;
+this project is called [BubbleBox].
+This week-end I finally got around to adding support for [xdg-dbus-proxy] so that sandboxed applications can now access particular D-Bus functions without having access to the entire bus (which is in general not safe to expose to a sandboxed application).
+That means it's finally time to blog about this project, so here we go -- if you are interested, check out [BubbleBox];
+the project page explains how you can use it to set up your own sandboxing.
+One day I should probably rewrite this in Rust...
+
+I should also note that this is not the only bubblewrap-based sandboxing solution.
+[bubblejail] is fairly similar but provides a configuration GUI and a good set of default provides;
+it was a very useful resource when figuring out the right bubblewrap flags to make complex GUI applications work properly.
+(Incidentally, "bubblejail" is also how I called my own script originally, but then I realized that the name is already taken.)
+Joachim Breitner also recently [blogged](https://www.joachim-breitner.de/blog/812-Convenient_sandboxed_development_environment) about his own bubblewrap-based sandboxing script.
+There are many ways to do this, and it was fun to figure out my own solution.
+
+Using bubblewrap and xdg-dbus-proxy for this was an absolute joy.
+Both of these components came out of the Flatpak project, but the authors realized that they could be independently useful,
+so in best Unix tradition they turned them into tools that provide all the required mechanism without hard-coding any sort of policy.
+Despite doing highly non-trivial tasks, they are both pretty easy to use and compose and very well-documented.
+Thanks a lot to everyone involved!
+
+[bubblewrap]: https://github.com/containers/bubblewrap
+[BubbleBox]: {{ site.baseurl }}/projects/bubblebox
+[xdg-dbus-proxy]: https://github.com/flatpak/xdg-dbus-proxy
+[bubblejail]: https://github.com/igo95862/bubblejail
diff --git a/personal/projects/index.md b/personal/projects/index.md
index 988c471..f872845 100644
--- a/personal/projects/index.md
+++ b/personal/projects/index.md
@@ -7,17 +7,18 @@ To solve some issue I was having, or to facilitate my daily computer usage.
 The tools were usually not written with general re-usability in mind.
 But maybe you are having just the same problem as I did, in which case I hope they can be helpful.
 
-* [dyn-nsupdate](dyn-nsupdate/): A tool to dynamically and securely update DNS zones via CGI.
+* [BubbleBox](bubblebox): A simple script to sandbox Linux applications.
+* [dyn-nsupdate](dyn-nsupdate): A tool to dynamically and securely update DNS zones via CGI.
   This provides self-hosted DynDNS services.
-* [git-mirror](git-mirror/): This can keep multiple git repositories of the same project in sync automatically.
-* [LiLaSS](lilass/): A simple xrandr-based application to configure laptop screens on Linux. If you are using a
+* [git-mirror](git-mirror): This can keep multiple git repositories of the same project in sync automatically.
+* [LiLaSS](lilass): A simple xrandr-based application to configure laptop screens on Linux. If you are using a
   Laptop, frequently work both with and without an external screen, and you are not happy with
   the configuration options your desktop provides, this may be for you.
-* [Rust-101](rust-101/): A small tutorial for the [Rust language](https://www.rust-lang.org).
-* [schsh](schsh/): A collection of scripts and configuration files which can be used to grant
+* [Rust-101](rust-101): A small tutorial for the [Rust language](https://www.rust-lang.org).
+* [schsh](schsh): A collection of scripts and configuration files which can be used to grant
   someone secure (SSH-based) access to a machine, without giving them a shell or read access
   to the entire file system.
-* [zonemaker](zonemaker/): A small script to generate DNS zone files from Python.
+* [zonemaker](zonemaker): A small script to generate DNS zone files from Python.
 
 For some more of my projects, check out the [public git repositories](https://www.ralfj.de/git/)
 hosted on my server and my [GitHub profile](https://github.com/RalfJung/).
-- 
2.30.2


From e6148fff016bf85c5e4b559a4d69f2deaac0e7ed Mon Sep 17 00:00:00 2001
From: Ralf Jung <post@ralfj.de>
Date: Sun, 14 Apr 2024 17:01:25 +0200
Subject: [PATCH 12/16] mention cargo-script

---
 personal/_posts/2024-04-14-bubblebox.md | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/personal/_posts/2024-04-14-bubblebox.md b/personal/_posts/2024-04-14-bubblebox.md
index 85dc684..cc8aa88 100644
--- a/personal/_posts/2024-04-14-bubblebox.md
+++ b/personal/_posts/2024-04-14-bubblebox.md
@@ -38,7 +38,7 @@ org.freedesktop.secrets=none
 However, not all software exists as Flatpak.
 Also, sometimes I want software to run basically on my host system (i.e., to use the regular `/usr`), just without access to literally *everything* in my home directory.
 Examples of this are Factorio and VSCodium.
-The latter doesn't work in Flatpak as I want to use it with LaTeX, and realistically this means it needs to run the LaTeX on my host.
+The latter doesn't work in Flatpak as I want to use it with LaTeX, and realistically this means it needs to run the LaTeX installed via `apt`.
 The official recommendation is to effectively disable the Flatpak sandbox, but that entirely defeats the point, so I went looking for alternatives.
 
 [bubblewrap] provides a very convenient solution: it can start an application in its own private filesystem namespace with full control over which part of the host file system is accessible from inside the sandbox.
@@ -46,8 +46,9 @@ I wrote a small wrapper around bubblewrap to make this configuration a bit more
 this project is called [BubbleBox].
 This week-end I finally got around to adding support for [xdg-dbus-proxy] so that sandboxed applications can now access particular D-Bus functions without having access to the entire bus (which is in general not safe to expose to a sandboxed application).
 That means it's finally time to blog about this project, so here we go -- if you are interested, check out [BubbleBox];
-the project page explains how you can use it to set up your own sandboxing.
-One day I should probably rewrite this in Rust...
+the project page explains how you can use it to set up your own sandboxing.[^1]
+
+[^1]: One day I should probably rewrite this in Rust... maybe this will be my test project for when [cargo-script](https://rust-lang.github.io/rfcs/3424-cargo-script.html) becomes available.
 
 I should also note that this is not the only bubblewrap-based sandboxing solution.
 [bubblejail] is fairly similar but provides a configuration GUI and a good set of default provides;
-- 
2.30.2


From fabd70c35d0fa85dc1efc714678f67618bd269ba Mon Sep 17 00:00:00 2001
From: Ralf Jung <post@ralfj.de>
Date: Mon, 15 Apr 2024 14:42:38 +0200
Subject: [PATCH 13/16] link to flatseal

---
 personal/_posts/2024-04-14-bubblebox.md | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/personal/_posts/2024-04-14-bubblebox.md b/personal/_posts/2024-04-14-bubblebox.md
index cc8aa88..6a90b06 100644
--- a/personal/_posts/2024-04-14-bubblebox.md
+++ b/personal/_posts/2024-04-14-bubblebox.md
@@ -33,6 +33,10 @@ org.freedesktop.Flatpak=none
 org.freedesktop.secrets=none
 ```
 
+[Flatseal] is an amazing application that helps to check which permissions applications get, and change them if necessary.
+
+[Flatseal]: https://flathub.org/apps/com.github.tchx84.Flatseal
+
 ## BubbleBox
 
 However, not all software exists as Flatpak.
-- 
2.30.2


From b3391a7aa88717959dddfef6178de815b09ffa90 Mon Sep 17 00:00:00 2001
From: Ralf Jung <post@ralfj.de>
Date: Mon, 15 Apr 2024 14:43:15 +0200
Subject: [PATCH 14/16] wording

---
 personal/_posts/2024-04-14-bubblebox.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/personal/_posts/2024-04-14-bubblebox.md b/personal/_posts/2024-04-14-bubblebox.md
index 6a90b06..cd8f050 100644
--- a/personal/_posts/2024-04-14-bubblebox.md
+++ b/personal/_posts/2024-04-14-bubblebox.md
@@ -33,7 +33,7 @@ org.freedesktop.Flatpak=none
 org.freedesktop.secrets=none
 ```
 
-[Flatseal] is an amazing application that helps to check which permissions applications get, and change them if necessary.
+I also use [Flatseal], an amazing application that helps to check which permissions applications get, and change them if necessary.
 
 [Flatseal]: https://flathub.org/apps/com.github.tchx84.Flatseal
 
-- 
2.30.2


From 75454324a78c1fb97500bee0e53adfc613f0fbb3 Mon Sep 17 00:00:00 2001
From: Ralf Jung <post@ralfj.de>
Date: Mon, 15 Apr 2024 16:18:26 +0200
Subject: [PATCH 15/16] link to sloonz's script

---
 personal/_posts/2024-04-14-bubblebox.md | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/personal/_posts/2024-04-14-bubblebox.md b/personal/_posts/2024-04-14-bubblebox.md
index cd8f050..56a23a6 100644
--- a/personal/_posts/2024-04-14-bubblebox.md
+++ b/personal/_posts/2024-04-14-bubblebox.md
@@ -59,7 +59,9 @@ I should also note that this is not the only bubblewrap-based sandboxing solutio
 it was a very useful resource when figuring out the right bubblewrap flags to make complex GUI applications work properly.
 (Incidentally, "bubblejail" is also how I called my own script originally, but then I realized that the name is already taken.)
 Joachim Breitner also recently [blogged](https://www.joachim-breitner.de/blog/812-Convenient_sandboxed_development_environment) about his own bubblewrap-based sandboxing script.
-There are many ways to do this, and it was fun to figure out my own solution.
+sloonz has a similar [script](https://gist.github.com/sloonz/4b7f5f575a96b6fe338534dbc2480a5d) as well, with a nice yaml-based configuration format and [great explanations](https://sloonz.github.io/posts/sandboxing-1/) for what all the flags exactly do.
+Had their script existed when I started what eventually became BubbleBox, I would have used it as a starting point.
+But it was also fun to figure out my own solution.
 
 Using bubblewrap and xdg-dbus-proxy for this was an absolute joy.
 Both of these components came out of the Flatpak project, but the authors realized that they could be independently useful,
-- 
2.30.2


From ae834f8d77aeb11c5e502e02e1706bd128aade37 Mon Sep 17 00:00:00 2001
From: Ralf Jung <post@ralfj.de>
Date: Wed, 22 May 2024 17:05:59 +0200
Subject: [PATCH 16/16] Tree Borrows post: fix link

---
 personal/_posts/2023-06-02-tree-borrows.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/personal/_posts/2023-06-02-tree-borrows.md b/personal/_posts/2023-06-02-tree-borrows.md
index 8c82a20..4905aa3 100644
--- a/personal/_posts/2023-06-02-tree-borrows.md
+++ b/personal/_posts/2023-06-02-tree-borrows.md
@@ -7,7 +7,7 @@ reddit: /rust/comments/13y8a9b/from_stacks_to_trees_a_new_aliasing_model_for_rus
 Since last fall, [Neven](https://perso.crans.org/vanille/) has been doing an internship to develop a new aliasing model for Rust: Tree Borrows.
 Hang on a second, I hear you say -- doesn't Rust already have an aliasing model?
 Isn't there this "Stacked Borrows" that Ralf keeps talking about?
-Indeed there is, but Stacked Borrows is just one proposal for a possible aliasing model -- and it [has its problems](https://github.com/rust-lang/unsafe-code-guidelines/issues?q=is%3Aopen+is%3Aissue+label%3AA-stacked-borrows).
+Indeed there is, but Stacked Borrows is just one proposal for a possible aliasing model -- and it [has](https://github.com/rust-lang/unsafe-code-guidelines/issues/133) [its](https://github.com/rust-lang/unsafe-code-guidelines/issues/134) [fair](https://github.com/rust-lang/unsafe-code-guidelines/issues/256) [share](https://github.com/rust-lang/unsafe-code-guidelines/issues/274) [of](https://github.com/rust-lang/unsafe-code-guidelines/issues/276) [problems](https://github.com/rust-lang/unsafe-code-guidelines/issues/303).
 The purpose of Tree Borrows is to take the lessons learned from Stacked Borrows to build a new model with fewer issues, and to take some different design decisions such that we get an idea of some of the trade-offs and fine-tuning we might do with these models before deciding on the official model for Rust.
 
 Neven has written a detailed introduction to Tree Borrows [on his blog](https://perso.crans.org/vanille/treebor/), which you should go read first.
-- 
2.30.2