Ken Shibata

I added Wireless Charging to my A4 E-Reader

2026-10-07T00:00:00Z

Some Motivation

I have a Fujitsu Quaderno A4 (Gen.2) e-reader that I’ve been using for a few years now. It’s light and thin enough that it feels like ten sheets of cardstock and has a paper-like textured screen. There’s also an open-source library which can sync a local directory with it (Thanks to everyone who worked on it!). I take notes¹, reading papers and books, and to quickly sketch designs with it, and it mostly works great (ignoring the closed-source firmware).

However, it’s not without downsides. I usually use up the battery in a few days. That is, not a constant number of days but sometimes 3, often 4, and rarely 7. Having to unlock it and see how much charge it’s at or having to charge it every night is cumbersome not counting the following reason. More importantly, the device’s build quality is not great. It’s bendy and a thin plastic piece around the USB-C port broke off.

Disassembly

Opening the Quaderno up seems quite scary (given how frail it feels), but it’s actually quite easy to losslessly disassemble. Slide in a couple credit cards (three to be safe) in the bottom corners (and middle). Then, making sure that the entire bottom few centimetres of the plastic are out of the way, smear the display down and off the plastic cover. After a few centimetres more, the two halves should come apart.

The electronics are all on the display side.

Adding the Receiver Coil

I got a set of Qi receiver coils with a PCB that outputs DC 5V. I sacrificed a USB-A to USB-C cable, and took the power lines and soldered it to the coils’.

Initially, I placed the coils on the battery. However, it didn’t charge well (i.e., even with the coil as close as it could be). Also…turns out the battery was the thickest part of the internals, and the case didn’t close…good thing I didn’t force the case closed!

I found a better spot, above the battery, and it fortunately didn’t conflict with the plastic fins (or the plastic cover, probably for structural integrity). I realized while writing that putting the coil against the diecast is not optimal. While testing the setup, I found it gets quite hot and it stops charging (!) after half an hour or so—presumably due do some thermal cutoff. Instead, I put the coil against the plastic case so that it’s close as possible to the charging coil, hopefully reducing thermal loss.

Now, time to close the cover (for real this time)!

Charging Performance

I left it on the charger overnight and jotted down the battery percentage whenever I happened to glance at it. Charging is fairly linear, at roughly 13 percentage points an hour, and it topped out at 100% a bit under four hours after starting at 51%.

Battery percentage over time while charging wirelessly. Started charging from 51%.

I’ll spend a few months with this setup, and write another post on how it’s like using it. Be sure to subscribe to the Atom feed so you don’t miss it! (*´∀｀)ﾉ ♪

¹I think it’s a great for digital notes at meetings without seeming inattentive. The third person can see that I’m not reading an email while pretending to take notes.

Blazingly Fast GT VPN

2026-09-24T00:00:00Z

Georgia Tech’s VPN is required to access quite a few on-campus services, including the networked printers, virtual desktops, and the supercomputers (PACE). However, connecting to the VPN requires 2FA (which is good, to be clear!), which can be cumbersome fumbling with the phone, opening Duo, and clicking the green circle. This is especially frustrating when I have my phone in my bag, around a metre away! I got a YubiKey over the summer to try to connect with just one button press, command, and a few seconds, and the following will be a list of steps to get it working.

Getting Set Up with a YubiKey

The YubiKey quiz is great for figuring out which YubiKey to get. Just make sure to get one that can connect to your device via USB, as the specific method used will require the YubiKey to act as a USB keyboard (so YubiKey OTP must be used). I got the YubiKey 5C Nano, since I was using a MacBook over the summer.¹

Once you get a YubiKey, you can set it up by going to the 2FA page on Passport, clicking the “Add (another) token” button, selecting “YubiKey,” and following the wizard there.

Setting up the VPN

I’m on Linux, and that means I use OpenConnect as my client program to connect (GT uses GlobalProtect AFAIK). I also expose the VPN connection via a local SOCKS proxy, which lets me choose which apps to route through the VPN. This helps keep my personal communications fast and secure (note that there is no expectation of privacy on Institute networks).

First, get started by installing OpenConnect and ocproxy (turns the VPN connection into a SOCKS proxy).

Next, set up a systemd service (ocproxy.service) like the following (Arch Linux Wiki page on writing systemd service):

# /etc/systemd/system/ocproxy.service
[Unit]
Description=OpenConnect VPN proxy

[Service]
CapabilityBoundingSet=
ExecStart=/path/to/your/script
LoadCredential=password:/path/to/your/password.txt
# ↑ or encrypt it with systemd-creds(1)
LockPersonality=true
MemoryDenyWriteExecute=yes
NoNewPrivileges=true
PrivateDevices=true
PrivateTmp=true
PrivateUsers=true
ProtectClock=true
ProtectControlGroups=true
ProtectHome=true
ProtectHostname=true
ProtectKernelLogs=true
ProtectKernelModules=true
ProtectKernelTunables=true
ProtectProc=invisible
ProtectSystem=strict
RemoveIPC=true
RestrictAddressFamilies=AF_UNIX
RestrictAddressFamilies=AF_INET
RestrictAddressFamilies=AF_INET6
RestrictNamespaces=yes
RestrictRealtime=true
RestrictSUIDSGID=true
StandardError=journal
StandardInput=socket
StandardOutput=journal
SystemCallArchitectures=native
SystemCallFilter=@system-service
User=ocproxy

And a socket unit as well (we’ll get back to this):

# /etc/systemd/system/ocproxy.socket
[Unit]
Description=OpenConnect VPN proxy socket for OTP

[Socket]
ListenFIFO=/run/ocproxy-otp
SocketMode=0600
SocketUser=root

[Install]
WantedBy=multi-user.target

Write a shell script somewhere (replace /path/to/your/script with the path to the script below):

#!/usr/bin/env sh
set -eu

read -r OTP
export PASSWORD_FILE_PATH="$CREDENTIALS_DIRECTORY/password"
{ cat "$PASSWORD_FILE_PATH"; echo; echo "$OTP"; } | \
openconnect \
  --verbose \
  --protocol=gp \
  --user=gburdell3 \
  --script-tun --script 'ocproxy -D 11080' \
  dc-ext-gw.vpn.gatech.edu

# NOTE: there is also ni-ext-gw.vpn.gatech.edu as well

Once you have that set up, you can just open a terminal:

$ sudo tee /run/ocproxy-otp

And long tap⁴ the gold button on your YubiKey. This will enter an OTP key, which is sent to the /run/ocproxy-otp FIFO, which will in turn start ocproxy.service with the OTP key. All of this completes in a few seconds on my laptop!

Now we have a local SOCKS proxy server we can point any program to. In the next two sections, we’ll see how to redirect some programs to use this proxy server, so it seems as if it’s connected to the VPN directly.

SSH Proxy

Getting SSH to connect to PACE through the proxy can be done with a single option in your SSH client config (cf. ssh_config(5)):⁵

Host *.pace.gatech.edu
  ProxyCommand nc -X 5 -x 127.0.0.1:11080 %h %p

Firefox

Firefox has a feature called Multi-Account Containers which—most importantly for this post—lets you set a proxy for a group of tabs. Since it can map certain sites to a container, I’ve set it up to open the “GT VPN” container for network printing and PACE.

To set it up, install the feature and make a container for the VPN. Then, in the configuration window, go to “Advanced proxy settings” and set the proxy to socks://127.0.0.1:11080. Once that the container is set up, you can to go any website (e.g., OnDemand) then press the extension to “always open this site in GT VPN.” This will set the site to always open with the GT VPN container, and so will always use the proxy!

Happy Blazingly Fast Connecting!!!

Your YubiKey can also be used as a Passkey (i.e., a FIDO2 resident key)! It’s the only phish-proof authentication method widely available (I wish more banks would support it), making it a great choice for important webapps and accounts. I use it to login to my wiki, as well as numerous other webapps I use. Since the passkey “lives” in a tangible object, it’s easier to grasp than platform keys (i.e., passkeys tied to your phone or laptop). From a server-side perspective, implementation is far simpler than U2F (a.k.a. WebAUthn) or TOTP.⁶ All that is to say, I would say a YubiKey is a great device to have in general.

Lastly, thank you to the lovely person at OIT who answered my questions about setting up YubiKey on Passport and using it with Duo.

I hope this helps!

¹My ThinkPad was having hinge issues.
²I’m transitioning to Colemak, and I’m on Tarmak stage 2 now.
³this encoding format is called ModHex.
⁴Try just tapping it if a long tap doesn’t work.
⁵I also set ForwardAgent yes so I can do git clone without leaving an SSH keypair on PACE.
⁶For example, with TOTP, you have to worry about replay attacks and clock drift.

How to Connect to GT Eduroam with a Client Certificate

2025-07-20T00:00:00Z

This is a living document; content will be updated as necessary (after the initial post date).

Georgia Tech has been rolling out a new TLS client certificate-based (instead of a username and password) authentication method for eduroam.

As a supplement to the guide on ServiceNow, this page provides a walkthrough for NetworkManager, using nm-connection-editor.

Generate a Certificate using the SecureW2 JoinNow Advanced Portal

Note: This section is essentially the same as the ServiceNow page.

Get your Wi-Fi interface’s MAC address (or choose a random MAC address to use):

nmcli

You’ll get something like this:

wlp0s20f3: connected to eduroam (GT cert)
  "Intel Something Something"
  wifi (iwlwifi), AA:AA:AA:AA:AA:AA, hw, mtu 1234
  ip4 default
  inet4 1.2.3.4/23
  route4 1.2.3.4/23 metric 600
  route4 default via 1.2.3.4 metric 600
  inet6 fe80::/64
  route6 fe80::/64 metric 1024

lo: connected (externally) to lo
  "lo"
  loopback (unknown), 00:00:00:00:00:00, sw, mtu 65536
  inet4 127.0.0.1/8
  inet6 ::1/128

DNS configuration:
  servers: 137.82.1.1 142.103.1.1 137.82.1.2 142.103.1.42
  domains: wireless.ubc.ca
  interface: wlp0s20f3

Use "nmcli device show" to get complete information about known devices and
"nmcli connection show" to get an overview on active connection profiles.

Consult nmcli(1) and nmcli-examples(7) manual pages for complete usage details.

Open the SecureW2 JoinNow Advanced Portal. Note: make sure to enter the correct MAC address.
Download the P12 file. (Make sure to keep the passphrase you used here.)
Download the USERTrust RSA Certification Authority.

Setup NetworkManager

Name	Value
Security	WPA/WPA2 Enterprise
Authentication	TLS
Identity	gburdell3@gatech.edu
Domain	lawn.gatech.edu
CA certificate	usertrustrsaca [jdk].cer¹
CA certificate password	None
User certificate	gburdell3@gatech.edu.p12²
User certificate password	None
User private key	gburdell3@gatech.edu.p12² (auto-filled when entering User certificate)
User key password	passphrase given in SecureW2 portal

Done!

¹Downloaded in step 3.
²This is the PKCS 12 file you downloaded in step 2.

Link-Local Connection to Raspberry Pi

2025-02-24T00:00:00Z

This is a living document; content will be updated as necessary (after the initial post date).

I needed to have a Ethernet connection from my laptop to a Raspberry Pi without any extra hardware (e.g. a router). Turns out this isn’t as smooth as I expected (especially with NetworkManager), so the following is a list of steps to get it working.

A few notes:

Steps below have been tested on a Raspberry Pi 3B with a ThinkPad X1 Carbon Gen 10 (running NixOS with NetworkManager).
The Ethernet cable type (patch/crossover) doesn’t seem to matter (I suppose this is because the USB-to-Ethernet adapter and Pi both support Auto-MDI-X).

On The Raspberry Pi

Note: If you ever try to use USB Ethernet with g_ether on a Raspberry Pi, let it be known that you must reload the kernel module after boot otherwise sometimes it will just get stuck and only send but not receive… -Thanks to Sam!

Make a new connection profile that uses Link-Local configuration for IPv4. You can either do this using the nmtui terminal interface, or through nmcli:

nmcli connection add type ethernet con-name "Link-Local Ethernet" ifname eth0 ipv4.method link-local ipv6.method ignore autoconnect yes

Note: If you’re running the Pi headless, you should specify autoconnect yes, so NetworkManager retries without any interaction.

Make sure there are no other (competing) Ethernet connections (or they have a lower priority) (nmcli connection | grep -E ‘TYPE|ethernet’ or by using the TUI). If there are, you can either delete them with nmcli connection delete or change their priority with nmcli connection modify connection.autoconnect-priority .

On A Linux Laptop

Make a new connection profile that uses Link-Local configuration for IPv4. Essentially, we do the same but our make sure you have the correct Ethernet interface: ifconfig should list all interfaces the device has. If you’re using a USB-C-to-Ethernet adapter, try plugging it into different USB ports. In my case, the USB port that the adapter works in is not idempotent (!).

On a Mac

Make sure to unplug and other Ethernet cables. Then, plug in the Ethernet cable to the Raspberry Pi and your Mac. macOS should prompt you to connect to the new network.

If it doesn’t work, make sure there aren’t any other network connections that are interfering: go to Network Settings → Other Services and delete ones that you aren’t using at this moment. If you’re prompted to “re-add on connection,” you can click either option.

The same troubleshooting tip for Linux applies: try plugging it in again, and make sure to try other Ethernet ports!

All-Wayland Setup on a Touchscreen-only Tablet

2025-01-30T00:00:00Z

The Premise

I managed to dig out a ThinkPad X1 Tablet Gen 3. Since the keyboard was broken, I decided to take this as a challenge to setup a usable Wayland environment on a touchscreen-only device.

This entry is composed of a semi-chronological description of each layer, starting from the BIOS to the window manager (desktop environment). Although each section builds on previous ones, each can-be read separately.

Secure Boot and Disk Encryption

Since a tablet is the child of a smartphone and a laptop, it is certainly intended for mobile usage. Therefore, I needed to get disk encryption (to protect data from thieves) and Secure Boot (to protect the kernel from backdoors) working first. After installing NixOS with disk encryption and my standard Sway-based layer-shell, I started on Secure Boot. A while ago, I read that NixOS Secure Boot wasn’t really ready nor usable. However, to my surprise the fantastic contributors nanaged to develop an easy solution. I just followed the directions on the Lanzaboote README, and everything worked the first try (quite a surprise for Linux users like me)!

Display Manager and Greeter

It was surprisingly smooth so far. Now is where the real yak shaving starts. The first problem was the display manager. Most of the common options (lightdm, tuigreet, etc) didn’t support on-screen keyboards. Although there were a few that did, they did not work on the ThinkPad Tablet for one reason or another. SDDM’s keyboard just didn’t show up, even when the button was pressed. GDM’s keyboard actually worked, but either Mutter or GTK (the problem was common on GNOME) had a problem with the touchscreen. After a minute or so, it would not stop responding to touch input. However, mouse input worked perfectly.

While looking for other options, I found greetd. Since it can launch basically any program as a greeter, I figured it could also run gtkgreet with an on-screen keyboard, wvkbd. As it turns out, this worked great. Since I used Sway in the greeter too, I could also run wlsunset to have “night light” on the login screen (especially useful when rebooting your tablet in the middle of the night…).

An aside: Although configuration tends not to be straightforward for low-layer things like display managers, greetd made it very simple - just run sway with a few startup commands:

{
  services.greetd = {
    enable = true;
    settings.default_session =
      let
        swayConfig = pkgs.writeText "greetd-sway-config" ''
          exec "${pkgs.greetd.gtkgreet}/bin/gtkgreet -l; swaymsg exit"
          exec "${pkgs.wvkbd}/bin/wvkbd-mobintl -L 256"
          exec "${pkgs.wlsunset}/bin/wlsunset -L -79.38 -T 6500 -g 1.000000 -l 43.65 -t 2000"
        '';
      in
      {
        command = "${pkgs.sway}/bin/sway --config ${swayConfig}";
        user = "greeter";
      };
  };
  environment.etc."greetd/environments" = {
    enable = true;
    text = ''
      sway
    '';
  };
}

Window Manager

Now, we’ve gotten everything until the window manager working well on touch. Although I’ve already used Sway for the greeter, now it has to handle moving windows around, and not just have a single layout. As it turns out, Sway’s dragging doesn’t really work well on touch (the touch area is not extended beyond the visual border), and gestures weren’t really a thing.

I figured I don’t use it in tablet mode when managing multiple windows (as that usually means I’m developing something with a keyboard). Maybe in a future blog post…

Touchscreen Gestures using lisgd

lisgd is a nice little tool that reads touchscreen input events (from e.g. /dev/input/event9) and runs commands based on them. Excited, I added swipe gestures to move workspaces:

lisgd -d '/dev/input/event9' -v -m 800 \
  -g '1,LR,L,*,*,swaymsg workspace prev' \
  -g '1,RL,R,*,*,swaymsg workspace next'

And it worked…until the next reboot. As it turns out, the path was reset every boot, and the touchscreen device would be /dev/input/event9 one boot, and /dev/input/event13 the next.

I ended up running libinput list-devices during startup to find the touchscreen by name:

device=$(libinput list-devices | grep -A 1 '${cfg.touchscreenDeviceName}' | grep /dev/input | awk '{print $2}')
lisgd -d "$device" -v -m 800 \
  -g '1,LR,L,*,*,swaymsg workspace prev' \
  -g '1,RL,R,*,*,swaymsg workspace next'

It’s not…the most elegant solution, but it works.

I also added a swipe from the top to close a window. The final command is:

device=$(libinput list-devices | grep -A 1 '${cfg.touchscreenDeviceName}' | grep /dev/input | awk '{print $2}')
lisgd -d "$device" -v -m 800 \
  -g '1,LR,L,*,*,swaymsg workspace prev' \
  -g '1,RL,R,*,*,swaymsg workspace next' \
  -g '1,UD,U,*,*,swaymsg kill'

Package this as a user service, and you’re good to go!