Digital Dopamine

About Digital Dopamine

Tune in for a weekly dose of digital dopamine! Explore productivity apps, uncover tech trends, and dive into short coding tutorials tailored for new developers. Subscribe for insights that supercharge your tech journey! digitaldopaminellc.substack.com (https://digitaldopaminellc.substack.com/s/digital-dopamine?utm_medium=podcast)

Publisher

Digital Dopamine

Category

education · news

Language

en

Explicit

No

First episode

23 Jan 2026

Latest episode

4 Oct 2026

Latest episodes

16 episodes in the feed.

1. 

   4 Oct 2026

   Deploying your RAG Pipeline

   Welcome Back! So you came back for seconds, huh? Well, that was a great choice because now you’ll get to see how we can set up our RAG kit for production deployment. But that’s not all we’re gonna do. We will be creating and setting up a PostHog account for analytics as well as getting an OpenRouter Account created so we can utilize the API for our open-weight cloud models. If you haven’t read part one, you can check it out here: (Click on the title to get to the technical article if you prefer to read 🤓) For those who are caught up, let’s get started! Setting up Evals Now we need to address our grounding. We need a set of evals to make sure our pipeline is up to par during new iterations. So what we want to do is create a brand new folder for evals. Our tree structure should look similar to this: rag-starter-kit/ ├── core/ ├── app/ ├── evals/ │ ├── questions.json │ └── run.ts ├── docker-compose.yml └── rag.config.ts *NOTE: the app folder is he front end of the project if you decided to run the SvelteKit CLI. That’s where your frontend will live. But I will leave that up to the reader to decide how they want to proceed with their frontend + UI. We need to create a single JSON file to hold all of our premade questions. Here is a little example of the questions we will have: [ { "question": "What does Digital Dopamine charge for a RAG integration?", "mustCiteSource": "digital-dopamine.md", "mustContain": ["$"], "mustRefuse": false }, { "question": "What's the capital of France?", "mustCiteSource": null, "mustContain": ["I don't have that information"], "mustRefuse": true } ] So the path will be evals/questions.json at the repo root. And if you check the full repo, you can see the full list of questions i have for my use case, but you can create whatever questions you want, so long as they align with grounding and it’s a fixed list of (question, expected-source, expected-answer-shape) tuples drawn from your sample docs. The point of a fixed set is that re-running it is the only way you can trust an improvement. A good rule of thumb: * 5–10 in-scope questions answerable only from your docs. * 3–5 out-of-scope questions that should trigger the refusal string. Now we will need a script to run our evals in the first place. Since we are using TypeScript, we will create a new file called run.ts and the path will be rag-starter-kit/evals/run.ts . The full typescript file is below and you can see the order of operations that happen when running this file: // evals/run.ts import questions from './questions.json'; import cfg from '../core/config'; import { getCollection } from '../core/store/vectorStore'; import { retrieve } from '../core/retrieve/retriever'; import { answer } from '../core/generate/chain'; type Result = { q: string; pass: boolean; why: string }; async function run() { const results: Result[] = []; const collection = await getCollection(cfg); for (const q of questions) { const chunks = await retrieve(collection, q.question); const { text, citations } = await answer(cfg, q.question, chunks); let pass = true; const whys: string[] = []; if (q.mustRefuse) { pass = text.includes("I don't have that information"); if (!pass) whys.push('expected refusal, got answer'); } else { for (const term of q.mustContain ?? []) { if (!text.includes(term)) { pass = false; whys.push(`missing "${term}"`); } } if (q.mustCiteSource) { const cited = citations?.some((c) => c.source.includes(q.mustCiteSource)); if (!cited) { pass = false; whys.push(`did not cite ${q.mustCiteSource}`); } } } results.push({ q: q.question, pass, why: whys.join('; ') || 'ok' }); } const score = results.filter((r) => r.pass).length / results.length; console.table(results); console.log(`\nGrounded-answer score: ${(score * 100).toFixed(1)}%`); } run(); We then just need to add the eval script to our package.json file (just don’t add the // comment I included next to the updated line since JSON doesn’t allow comments and the file would fail to parse): "scripts": { "dev": "tsx core/index.ts", "typecheck": "tsc --noEmit", "test": "echo \"Error: no test specified\" && exit 1", "eval": "tsx evals/run.ts" // PostHog is the open-source platform for building self-driving products PostHog (https://posthog.com/) provides every tool you need to build a successful product, and captures all the context agents need to proactively diagnose problems, uncover opportunities, and ship fixes: * Self-driving mode (https://posthog.com/docs/self-driving): Turn signals in your product data (errors, rage clicks, failed queries, and more) into researched reports and pull requests you review and merge. * Product analytics (https://posthog.com/product-analytics): Autocapture or manually instrument event-based analytics to understand user behavior and analyze data with visualization or SQL. * Web analytics (https://posthog.com/web-analytics): Monitor web traffic and user sessions with a GA-like dashboard. Easily monitor conversion, web vitals, and revenue. * Session replays (https://posthog.com/session-replay): Watch real user sessions of interactions with your website or mobile app to diagnose issues and understand user behavior. * Feature flags (https://posthog.com/feature-flags): Safely roll out features to select users or cohorts with feature flags. * Experiments (https://posthog.com/experiments): Test changes and measure their statistical impact on goal metrics. Set up experiments with no-code too. * Error tracking (https://posthog.com/error-tracking): Track errors, get alerts, and resolve issues to improve your product. * Logs (https://posthog.com/logs): Ingest, search, and analyze log data alongside the rest of your product data. * Surveys (https://posthog.com/surveys): Ask anything with our collection of no-code survey templates, or build custom surveys with our survey builder. * Data warehouse (https://posthog.com/data-warehouse): Sync data from external tools like Stripe, Hubspot, your data warehouse, and more. Query it alongside your product data. * Data pipelines (https://posthog.com/cdp): Run custom filters and transformations on your incoming data. Send it to 25+ tools or any webhook in real time or batch export large amounts to your warehouse. * AI observability (https://posthog.com/docs/ai-observability): Capture traces, generations, latency, and cost for your LLM-powered app. * Workflows (https://posthog.com/docs/workflows): Create workflows that automate actions or send messages to your users. You can steer it all from Slack (https://posthog.com/slack), web (https://posthog.com/ai), desktop (PostHog Desktop (https://posthog.com/desktop)), or your own editor via the MCP (https://posthog.com/mcp). Best of all, all of this is free to use with a generous monthly free tier (https://posthog.com/pricing) for each tool. Get started by signing up for PostHog Cloud US (https://us.posthog.com/signup) or PostHog Cloud EU (https://eu.posthog.com/signup). This was pulled straight from their GitHub repo, and you can go through the README for more details → https://github.com/PostHog/posthog (https://github.com/PostHog/posthog). But let’s move on to how we will be adding it to our project. The snippet below is the location the docs suggest, but it isn’t where this project ends up initializing PostHog. That lands in hooks.client.ts, which we’ll get to next. // app/src/routes/+layout.svelte The setup above is slightly different from the docs, but we’ll initialize PostHog inside hooks.client.ts instead. It’s where handleError lives (so error capture and init share a file), it reads $env/dynamic/public at runtime rather than baking the token into the bundle at build time, which matters when one Docker image ships to several clients. It also runs before the app mounts, so nothing captures an event before PostHog is ready. import { dev } from "$app/environment"; import type { HandleClientError } from "@sveltejs/kit"; import { env } from "$env/dynamic/public"; import posthog from "posthog-js"; const POSTHOG_TOKEN = env.PUBLIC_POSTHOG_PROJECT_TOKEN; const POSTHOG_HOST = env.PUBLIC_POSTHOG_HOST; export function init() { if (!POSTHOG_TOKEN || !POSTHOG_HOST) { if (dev) { const missingVariable = !POSTHOG_TOKEN ? "PUBLIC_POSTHOG_PROJECT_TOKEN" : "PUBLIC_POSTHOG_HOST"; throw new Error( `${missingVariable} variable required by PostHog is missing ` + "or un-configured, this causes events to be silently missed. " + `This error stops appearing once ${missingVariable} is configured`, ); } return; } posthog.init(POSTHOG_TOKEN, { api_host: POSTHOG_HOST, capture_exceptions: { capture_unhandled_errors: true, capture_unhandled_rejections: true, capture_console_errors: false, }, }); } export const handleError: HandleClientError = ({ error, status, message, }) => { if (POSTHOG_TOKEN && POSTHOG_HOST) { posthog.captureException(error); } return { message, status }; }; You’ll need your PostHog project token (the phc_... value) and host once you create your profile and set up your project. Down the line we’ll be capturing a custom event on every chat answer in the /api/chat endpoint (server-side via the PostHog node SDK, or client-side in the widget): question asked, answer returned, citation count, latency, refusal-vs-answered. In the code as written today, though, the wired-up events are chat_question_submitted (from the widget) and knowledge_base_reindexed (from the admin page). /api/chat itself has no PostHog call yet, so note that this would be an update later on. * PostHog JS: https://posthog.com/docs/libraries/js (https://posthog.com/docs/libraries/js) * PostHog node SDK: https://posthog.com/docs/libraries/node (https://posthog.com/docs/libraries/node) * SvelteKit env vars: https://svelte.dev/docs/kit/$env-static-public (https://svelte.dev/docs/kit/$env-static-public) The idea is that events become the client dashboard The events you emit here are the exact numbers a small-business owner will see: “40 questions asked this week, 95% answered from your docs, average answer time 1.2s, 1 out-of-scope question”. It’s the target state once we wire the full event set into /api/chat, not what’s there on day one. Then we will need to add posthog into our project. Which is as simple as: cd app && pnpm add posthog-js There is also a PostHog wizard that you have an option to use, and it will run through your entire project to do the full implementation for you. And it’s pretty damn accurate. I’m talking all the way from proper imports to actually adding your POSTHOG public key into your env file and making sure that the variable is only used throughout the project AND if you didn’t have an env file before this was run (you def should have lol but…) it will create one for you and make sure it gets into .gitignore. PostHog also has a Python SDK along with many other languages, so just in case you used Python or a different language to build the RAG pipeline, PostHog most likely has an SDK for the language you’re using. Now that we have PostHog set up, let’s get OpenRouter added to our rag.config.ts file. Below is what the full file should look like (more or less): export type FolderSource = { type: 'folder'; path: string; glob: string }; export type WebSource = { type: 'web'; urls: string[] }; export type GDriveSource = { type: 'gdrive'; folderId: string }; export type Source = FolderSource | WebSource | GDriveSource; export type LLMProvider = | { provider: 'ollama'; model: string; baseUrl: string; numCtx: number; numPredict: number; keepAlive: string | number; temperature: number; think?: boolean; } | { provider: 'openrouter'; model: string; apiKey: string; baseUrl: string }; export default { sources: [ { type: 'folder', path: './data', glob: '**/*.{md,txt}' }, // { type: 'web', urls: ['https://example.com/docs'] }, // { type: 'gdrive', folderId: '...' }, ] as Source[], chunking: { chunkSize: 500, chunkOverlap: 50 }, embeddings: { provider: 'ollama', model: 'nomic-embed-text', baseUrl: process.env.OLLAMA_BASE_URL ?? 'http://localhost:11434', }, vectorStore: { provider: 'chroma', url: process.env.CHROMA_URL ?? 'http://localhost:8000', collection: 'rag-kit', }, llm: { active: 'ollama' as 'ollama' | 'openrouter', ollama: { provider: 'ollama', model: 'gemma3:4b', baseUrl: process.env.OLLAMA_BASE_URL ?? 'http://localhost:11434', numCtx: 8192, numPredict: 512, keepAlive: '30m', think: false, temperature: 0.1, } satisfies LLMProvider, openrouter: { provider: 'openrouter', model: 'z-ai/glm-5.2', // comment out/un-comment models when switching. // model: 'moonshotai/kimi-k3', // model: 'google/gemma-4-31b', // model: 'minimax/minimax-m3', apiKey: process.env.OPENROUTER_API_KEY ?? '', baseUrl: 'https://openrouter.ai/api/v1', } satisfies LLMProvider, }, }; You might notice 5 additional Ollama settings that haven’t been mentioned previously. I made these needed improvements to my pipeline and each one kills a specific waste: * numPredict: 512 - hard cap on generated tokens. When uncapped, the same one-sentence question ran 3,200+ tokens when testing one time; at ~10 t/s that’s a five-minute wait (with gemma4: 12b). Biggest single win for perceived speed. * think: false - suppresses the hidden reasoning pass on thinking models, which can be thousands of tokens you never see. More speed, less memory pressure. * numCtx: 8192 - context window set to 8192, and the main memory knob (the KV cache scales with it). The retrieval prompt here is ~650 tokens, so 8192 is already generous; Meaning without this limit, Ollama would just use the model’s max context window, which ate up my memory, no matter which smaller model I used. For example running ollama ps while using OpenCode and Ornith 1.5 9b, you can see that while this model is only 6.6 GB in size, it’s still taking up its max context window:context_screenshot.png * keepAlive: '30m' - keeps the 12B model (~8 GB) resident instead of re-reading it off disk between questions. Saves the reload on every follow-up. * temperature: 0.1 - near-determinism. Left at the model’s own default (often 1), the same question answers on one run and refuses on the next; grounded extraction can’t have that. We don’t want to replace Ollama, which defeats the “switch without code changes” goal. With active, both providers are always configured; switching is a one-line edit. A client who never wants cloud just leaves active: 'ollama' forever and the OpenRouter block is inert (no API key, no calls). A client who wants cloud flips it and sets the env var. But now we need to update our buildChain function. answer() and generate() both call buildChain(cfg) and pass cfg: Pick. They don’t need to change. The only file that reads cfg.llm fields directly is core/generate/chain.ts, so that’s the one place the branching lives. Below is the full core/generate/chain.ts after this step. It’s the Phase 3 file (prompt + buildNumberedContext + answer + generate) with two additions: * An activeLLM() resolver at the top. The only place that knows about llm.active. * buildChain() now branches: OpenRouter uses the OpenAI JS client wrapped in a RunnableLambda so it has the same .invoke({ numberedContext, question }) contract as the Ollama path. Both branches return a LangChain Runnable. answer() and generate() see no difference. NOTE: This is the version from Part 1 (https://digitaldopaminellc.substack.com/p/just-throw-it-in-the-rag) plus the OpenRouter branch. In my live repo the prompt also reads the refusal from core/generate/refusal.ts via REFUSAL instead of hardcoding the string, and the ChatOllama call passes the extra Ollama settings which are both shown here. This was added during my attempt to include a dedicated Judge (Like Jev, but with Tev1 or Nimble since they are open-weight decision models), but I still need to work on that more. (I have to post screenshots of hain.) import { ChatOllama } from '@langchain/ollama'; import { ChatPromptTemplate } from '@langchain/core/prompts'; import { ChatPromptValue } from '@langchain/core/prompt_values'; import { RunnableLambda } from '@langchain/core/runnables'; import { basename } from 'node:path'; import type { RagConfig } from '../config.js'; import type { RetrievedChunk } from '../retrieve/retriever.js'; import { REFUSAL } from './refusal.js'; import OpenAI from 'openai'; // REFUSAL is interpolated at module load rather than passed as a // variable, so this prompt and the answerability gate cannot drift // apart. It must not contain braces, which ChatPromptTemplate would // read as a placeholder. const PROMPT = ChatPromptTemplate.fromTemplate(` Rules: 1. If the context contains the answer, even if the question's wording differs from the source wording (synonyms, paraphrases, related terms like "implementation" vs "integration", "cost" vs "charge", "price" vs "pricing"), answer it and cite every claim with [N]. 2. Refuse ONLY when no context item is relevant to the question's subject at all. Do not refuse because the question is terse or omits its subject: a bare question like "how much do they charge?" is answered by the context item covering pricing for one of the organization's services, give that answer and name the service it applies to, using the wording of the context item. When refusing is warranted, respond ONLY with: "${REFUSAL}" 3. Use the closest matching source. Refer to products, services and figures using exactly the terms the context uses, never infer or invent a name the context does not state. Do not combine unrelated facts to fabricate an answer. 4. Every claim MUST end with a citation [N] referring to the numbered context item it comes from. 5. Answer in at most three short sentences. Do not restate the context or add preamble. Context (numbered): {numberedContext} Question: {question} Answer `); export interface Citation { n: number; source: string; excerpt?: string; } export interface AnswerResult { text: string; citations: Citation[]; } const CITE_RE = /\[(\d+)\]/g; // Show just the filename, not a path function formatSource(source: string | undefined | null): string { if (!source) return 'unknown'; if (source.startsWith('http://') || source.startsWith('https://')) { return source; } return basename(source); } export function buildNumberedContext( chunks: RetrievedChunk[], ): { numberedContext: string; citationMap: Map } { const citationMap = new Map(); const parts: string[] = []; chunks.forEach((c, i) => { const n = i + 1; parts.push(`[${n}] ${c.pageContent}`); citationMap.set(n, { n, source: formatSource(c.metadata?.source as string), excerpt: c.pageContent.slice(0, 120), }); }); return { numberedContext: parts.join('\n\n'), citationMap }; } type LLMConfig = RagConfig['llm']; function activeLLM(llm: LLMConfig) { return llm.active === 'openrouter' ? llm.openrouter : llm.ollama; } function buildChain(cfg: Pick) { const llm = activeLLM(cfg.llm); if (llm.provider === 'openrouter') { // Guard: fail loudly if cloud is active but the key is missing. // Saves you (or a client) from a mysterious 401 an hour into // debugging. if (!llm.apiKey) { throw new Error( "OPENROUTER_API_KEY is not set but llm.active is " + "'openrouter'. Add it to .env (repo root) and app/.env, " + "or set llm.active back to 'ollama'.", ); } const client = new OpenAI({ apiKey: llm.apiKey, baseURL: llm.baseUrl, }); // Wrap the OpenAI call in a RunnableLambda so it has the same // .invoke({ numberedContext, question }) contract as the Ollama // pipe below. const model = RunnableLambda.from( async (input: ChatPromptValue) => { const messages = input .toChatMessages() .map( ( m, ): OpenAI.Chat.Completions.ChatCompletionMessageParam => { const t = m.getType(); if (t === 'human') { return { role: 'user', content: m.content as string }; } if (t === 'ai') { return { role: 'assistant', content: m.content as string }; } return { role: 'system', content: m.content as string }; }, ); const res = await client.chat.completions.create({ model: llm.model, messages, }); return { content: res.choices[0]?.message?.content ?? '' }; }, ); return PROMPT.pipe(model); } const model = new ChatOllama({ model: llm.model, baseUrl: llm.baseUrl, numCtx: llm.numCtx, numPredict: llm.numPredict, keepAlive: llm.keepAlive, temperature: llm.temperature, ...(llm.think === undefined ? {} : { think: llm.think }), }); return PROMPT.pipe(model); } export async function generate( cfg: Pick, question: string, chunks: RetrievedChunk[], ): Promise { const chain = buildChain(cfg); const { numberedContext } = buildNumberedContext(chunks); const response = await chain.invoke({ numberedContext, question, }); return typeof response === 'string' ? response : (response as { content?: string }).content ?? String(response); } export async function answer( cfg: Pick, question: string, chunks: RetrievedChunk[], ): Promise { const { numberedContext, citationMap } = buildNumberedContext(chunks); const chain = buildChain(cfg); const response = await chain.invoke({ numberedContext, question }); const raw = typeof response === 'string' ? response : (response as { content?: string }).content ?? String(response); const claimed = new Set(); let m: RegExpExecArray | null = CITE_RE.exec(raw); while (m !== null) { claimed.add(Number(m[1])); m = CITE_RE.exec(raw); } const validNs = [...claimed].filter((n) => citationMap.has(n)); const validSet = new Set(validNs); const text = raw.replace(CITE_RE, (full, n) => validSet.has(Number(n)) ? full : '', ); const citations = validNs .sort((a, b) => a - b) .map((n) => citationMap.get(n)!) .filter(Boolean); return { text, citations }; } buildChain is the single seam. Whether it builds an Ollama-backed PROMPT.pipe(model) or an OpenRouter-backed one, the thing it returns has to have the same .invoke({ numberedContext, question }) contract. The OpenRouter branch above wraps client.chat.completions.create(...) in RunnableLambda.from(...) so both branches are Runnables. Regarding new imports, the OpenAI JS client is the only new one. OpenRouter is set, and now we need to get Docker situated. Docker Deploy This will be based on me getting Docker set up on my first go-round, so make sure to double-check your local environment if you get any errors (for example, you might have your code in a different root level than I do or maybe using a different port). A few notes about the version I worked on, docker-compose.yml pins chromadb/chroma:1.5.9, mounts chroma-data:/data, has a /api/v2/heartbeat healthcheck, and restart: unless-stopped. The full file is below: services: chroma: image: chromadb/chroma:1.5.9 container_name: rag-starter-kit-chroma-1 ports: - "8000:8000" volumes: - chroma-data:/data healthcheck: test: - CMD - bash - -c - "exec 3<>/dev/tcp/localhost/8000 && printf 'GET /api/v2/heartbeat HTTP/1.0\\r\\nHost: localhost\\r\\n\\r\\n' >&3 && head -n1 must be the repo root, not app/. The SvelteKit app imports $core/*, your pipeline in core/ via the kit.alias. If the build context is app/, core/ is outside the Docker build and pnpm run build fails with Cannot find module '$core/...'. Setting context: . + dockerfile: app/Dockerfile brings core/ into the build while keeping the Dockerfile in app/. SvelteKit’s adapter-node output is a standalone Node server in build/. The Dockerfile builds that and runs it. So we need to get the file created with the following: FROM node:22-alpine WORKDIR /docker_root RUN corepack enable && corepack prepare pnpm@10 --activate COPY package.json pnpm-lock.yaml ./ RUN pnpm install --frozen-lockfile WORKDIR /docker_root/app COPY app/package.json app/pnpm-lock.yaml app/pnpm-workspace.yaml ./ RUN pnpm install --frozen-lockfile WORKDIR /docker_root COPY app/ ./app/ COPY core/ ./core/ COPY rag.config.ts ./ COPY data/ /data/ WORKDIR /docker_root/app RUN pnpm run build EXPOSE 3000 CMD ["node", "build"] core/ directory has no package.json of its own. It’s just .ts files that get compiled as part of the app’s build via the include: ["../core/**/*.ts"] in app/tsconfig.json. But the Dockerfile still installs two manifests: the root one (because core/ imports @langchain/*, chromadb, openai, and friends from the root node_modules) and then the app’s. So the install steps cover both, and the copy step afterward brings in everything (including core/) for the build. We also need a .dockerignore at the root level /rag-starter-kit/.dockerignore): After adding this, the build context drops from ~874MB to a few MB (just your source + manifests) and builds get dramatically faster. The .env exclusion is critical, it prevents accidentally baking secrets into the image. The evals / docs / *.pdf exclusions keep the image lean (they're not needed at runtime). The Dockerfile’s WORKDIR /docker_root/app + COPY app/package.json ... ./ means pnpm runs in /app, so pnpm run build builds the app directly. The ollama/ollama image is a fresh Ollama with no models. After docker compose up, you need to pull the chat + embedding models into the container once: docker compose exec ollama ollama pull gemma3:4b docker compose exec ollama ollama pull nomic-embed-text These persist in the ollama-data volume, so it’s a one-time setup. Any future run of docker compose up reuses them. To make sure we are ready to test our deploy, lets run through some checks. We need to create a 2nd .env file We’ll need two .env files with the same variables in each file. The root env feeds the CLI/eval harness, core/config.ts loads it with import 'dotenv/config' (there’s no --env-file flag; dotenv is the thing doing the loading), and the app/ env feeds the SvelteKit client via $env/dynamic/public in hooks.client.ts, plus plain process.env in the server routes. PUBLIC_ vars are public by definition, so they’re never read through $env/static/private. File 1: .env at the repo root (next to docker-compose.yml): OPENROUTER_API_KEY={key} # from https://openrouter.ai/keys PUBLIC_POSTHOG_PROJECT_TOKEN={key} # from PostHog project settings PUBLIC_POSTHOG_HOST=https://us.i.posthog.com # or your self-hosted URL ADMIN_TOKEN={key} # a secret you invent; gates the /admin re-index endpoint File 2: app/.env (same three lines, copy-paste): OPENROUTER_API_KEY={key} # from https://openrouter.ai/keys PUBLIC_POSTHOG_PROJECT_TOKEN={key} # from PostHog project settings PUBLIC_POSTHOG_HOST=https://us.i.posthog.com # or your self-hosted URL ADMIN_TOKEN={key} # a secret you invent; gates the /admin re-index endpoint ADMIN_TOKEN is optional for the container to start (compose defaults it to empty), but the compiled container runs in production mode, so the /admin re-index endpoint returns 403 unless it’s set. Your local cd app && pnpm dev doesn’t need it (dev mode allows reindexing), but a fresh Docker deploy relies on /admin, so set it to any secret string if you want the reindex step below to work. Both must be in .gitignore. Add a .dockerignore at the repo root As mentioned earlier, we need to add .dockerignore. Without it, Docker ships ~874MB of context to the build daemon on every up --build. From the repo root: docker compose down -v && docker compose up --build -d * down -v wipes containers + volumes (True cold start. The path a client hits on first deploy). * up --build rebuilds the app image (picks up any rag.config.ts / code changes) and starts everything. * -d detaches so you get your shell back. You should see three containers running: docker compose ps NAME STATUS PORTS rag-starter-kit-chroma-1 Up (healthy) 8000 rag-starter-kit-ollama-1 Up 11434 rag-starter-kit-app-1 Up 3000 If app exits, check docker compose logs app. The most common cause is a missing CHROMA_URL/OLLAMA_BASE_URL env var or a rag.config.ts that still hardcodes localhost. (The app service has no healthcheck defined, so you won’t see Up (unhealthy) on it; it’s either Up or gone.) Pull models into the Ollama container (one-time only) The ollama/ollama image ships with no models. Pull them now and they persist in the ollama-data volume, so you only do this once per cold wipe: docker compose exec ollama ollama pull gemma4:12b # Or gemma3:4b docker compose exec ollama ollama pull nomic-embed-text The first pull takes a bit (gemma4:12b is about 8 GB). Subsequent docker compose up reuses them and doesn’t re-pull. Verify the pulls worked. docker compose exec ollama ollama list should show both models. If a model is missing, the app's first chat/retrieval call will return a 500 with a "model not found" error from Ollama. Re-index the docs into the fresh Chroma docker compose down -v wiped the chroma-data volume, so the vector store is empty. Trigger a re-index from the admin UI: NOTE: On the local-dev side: the dev server is cd app && pnpm dev, not pnpm run dev at the repo root. The root script runs the core/index.ts CLI. This is the containerized app at 3000 either way.) * Open http://localhost:3000/admin (http://localhost:3000/admin) (make sure your docker container is still running) * Click the re-index button * Wait for it to report the chunk count build/ is the compiled SvelteKit server, not a reindex entrypoint. The admin page’s re-index button calls the same runIngestion() the CLI uses, so that’s the way to trigger it here. Verify the app works * Open http://localhost:3000 (http://localhost:3000), you should see the demo chat page, exactly as you would see it i ran within /app with pnpm run dev. * Ask an in-scope question from your evals/questions.json → should get a grounded answer with citations. * Ask an out-of-scope question → should get the refusal string. Some docs for deeper dives into some of the concepts covered: * SvelteKit adapter-node: https://svelte.dev/docs/kit/adapter-node (https://svelte.dev/docs/kit/adapter-node) * Docker Compose depends_on conditions: https://docs.docker.com/compose/compose-file/05-services/#depends_on (https://docs.docker.com/compose/compose-file/05-services/#depends_on) * Ollama Docker: https://github.com/ollama/ollama/blob/main/docs/docker.md (https://github.com/ollama/ollama/blob/main/docs/docker.md) * Docker Compose: https://docs.docker.com/compose/ (https://docs.docker.com/compose/) * .dockerignore reference: https://docs.docker.com/build/concepts/context/#dockerignore-file (https://docs.docker.com/build/concepts/context/#dockerignore-file) Set Sails That about wraps up the Docker setup, and now you should be good to use your favorite deployment platform to ship this to production. Railway is a platform I use myself, and their Docker quick start can be found here → https://docs.railway.com/quick-start#deploying-your-project---from-a-docker-image (https://docs.railway.com/quick-start#deploying-your-project---from-a-docker-image). Hopefully this quick part 2 helped you deploy your kit so you can show it off to potential clients. I’m always open to improving my technical writing, so let me know if you think there are gaps in my steps or if any of them don’t make sense. If you want to keep up with my work or want to connect as peers, check out my social links below and give me a follow! * 🦋 Bluesky (https://bsky.app/profile/digitaldopamine.dev) * 📸 Instagram (https://www.instagram.com/digital_dopamine_llc/) * ▶️ Youtube (https://youtube.com/@digitaldopaminellc?si=sujxCAMyboNvidiW) * 💻 Github (https://github.com/kdleonard93) * 👾 Discord (https://discord.com/users/407639833146818570) Get full access to Digital Dopamine at digitaldopaminellc.substack.com/subscribe (https://digitaldopaminellc.substack.com/subscribe?utm_medium=podcast&#38;utm_campaign=CTA_4)

2. 

   11 Sept 2026

   Just Throw It In The RAG

   Sup folks! Built a local-first RAG system from scratch: a chat tool that only answers from the documents I feed it, cites every claim, and refuses to answer what it doesn't know. No cloud spend and no hallucinations slipping through. This is the video/audio companion to my technical article "Just Throw It In The RAG": https://digitaldopaminellc.substack.com/p/just-throw-it-in-the-rag (https://digitaldopaminellc.substack.com/p/just-throw-it-in-the-rag) WHAT YOU'LL SEE: - What RAG actually is, and why it's the unlock for small businesses. - One config file that runs the whole product. With a one-field flip between local (Ollama) and cloud (OpenRouter) - The full pipeline: load → chunk → embed → store → retrieve → generate - Verified citations: the model literally cannot fake a source - Live demo: grounded answers, refusals ("Am I pretty?" is a real eval question 😂), and the re-index feature. 💻 Repo: https://github.com/kdleonard93/rag-starter-kit (https://github.com/kdleonard93/rag-starter-kit) STACK: TypeScript · LangChain.js · Ollama (gemma3:4b + nomic-embed-text) · Chroma · SvelteKit · Cheerio · Docker PART 2 next week: the eval harness, PostHog observability, one-command Docker deploy, and the cloud path. Subscribe so you don't miss it ✌🏾 - 🦋 Bluesky - https://bsky.app/profile/digitaldopamine.dev (https://bsky.app/profile/digitaldopamine.dev) - 📸 Instagram - https://www.instagram.com/digital_dopamine_llc/ (https://www.instagram.com/digital_dopamine_llc/) - 💻 GitHub - https://github.com/kdleonard93 (https://github.com/kdleonard93) - 👾 Discord - https://discord.com/users/407639833146818570 (https://discord.com/users/407639833146818570) - 📖 Substack - https://digitaldopaminellc.substack.com/ (https://digitaldopaminellc.substack.com/) Get full access to Digital Dopamine at digitaldopaminellc.substack.com/subscribe (https://digitaldopaminellc.substack.com/subscribe?utm_medium=podcast&#38;utm_campaign=CTA_4)

3. 

   9 Aug 2026

   Building Learning + Project Guides for NestJS

   New Framework, Who Dis???? Okay, so maybe not new in general, but definitely new to me. So this felt like the perfect opportunity to dive into some fresh docs to see if this framework would be useful for me in my future projects. I’ve been focusing on the Python ecosystem when it comes to AI, but if I'm being honest, I feel like the polyglot codebase of needing to run Python for your backend and having a JS/TS frontend. It’s kind of a pain. Even though Python is much easier to get up and running with AI + it has a MASSIVE ecosystem within the AI space already, NestJS is starting to emerge as one of the go-to JS/TS frameworks to use for building out AI tooling and RAG systems. So today, I wanted to explore what NestJS is as a framework, get into a bit of its lore, and then run through an example of using local AI models to build you a lesson and project plan so you can curate the best way for YOU to learn this framework. We will NOT be using AI to build the project, and I implore you to try building out the application just using docs and forums, even if you have to struggle a bit. The project guide that will have the local model built for us will be small, so it shouldn’t be too difficult to run through on your own. But for now, let’s dive into the docs of NestJS. The Rising Star in the League of JS Frameworks Quite a statement, right? Well, it’s not me that’s praising this Framework. There are plenty of forums and posts out there from fellow devs that love it and claim it to be the future leader for building your Node backend. As you can see here, this dev gives a good example of what a call to the Claude AI would look like in NestJS. That same call in Python would look something like the following: import os import httpx class AiService: def __init__(self): self.api_key = os.environ["ANTHROPIC_API_KEY"] async def ask(self, prompt: str) -> str: async with httpx.AsyncClient() as client: response = await client.post( "https://api.anthropic.com/v1/messages", headers={ "x-api-key": self.api_key, "anthropic-version": "2023-06-01", "content-type": "application/json", }, json={ "model": "claude-sonnet-4-5", "max_tokens": 1024, "messages": [{"role": "user", "content": prompt}], }, ) response.raise_for_status() data = response.json() return data["content"][0]["text"] Now, at first glance, one may think: “The Python code looks simpler and is much easier to understand”. Well, you’re not wrong at all 😂, the NestJS code example from the screenshot has an @Injectable() decorator, which I learned is an explicit constructor with typed parameter injection that relies on Nest’s DI(Dependency Injection) container to actually provide a ConfigService. This is one of the drawbacks to using such a strict framework for smaller projects, products, or services. But this is EXACTLY what you want when working on a larger-scale application. Nest’s DI and module system are what make large codebases easier to test, mock, and reason about at scale when you’ve got a real app in production with dozens of services. Some Quick Definitions and Notes From the Docs Here, I’m gonna pull a couple sections straight from the docs, word for word. Intro (https://docs.nestjs.com/) NestJS uses progressive JavaScript, is built with and fully supports TypeScript (http://www.typescriptlang.org/) (yet still enables developers to code in pure JavaScript) and combines elements of OOP (Object Oriented Programming), FP (Functional Programming), and FRP (Functional Reactive Programming). Under the hood, Nest makes use of robust HTTP Server frameworks like Express (https://expressjs.com/) (the default) and optionally can be configured to use Fastify (https://github.com/fastify/fastify) as well! Nest provides a level of abstraction above these common Node.js frameworks (Express/Fastify), but also exposes their APIs directly to the developer. This gives developers the freedom to use the myriad of third-party modules which are available for the underlying platform. Philosophy (https://docs.nestjs.com/#philosophy) In recent years, thanks to Node.js, JavaScript has become the “lingua franca” of the web for both front and backend applications. This has given rise to awesome projects like Angular (https://angular.dev/), React (https://github.com/facebook/react), and Vue (https://github.com/vuejs/core), which improve developer productivity and enable the creation of fast, testable, and extensible frontend applications. However, while plenty of superb libraries, helpers, and tools exist for Node (and server-side JavaScript), none of them effectively solve the main problem of architecture. Nest provides an out-of-the-box application architecture which allows developers and teams to create highly testable, scalable, loosely coupled, and easily maintainable applications. The architecture is heavily inspired by Angular. Hopefully that little intro into what NestJS is and why it was built helps show the possible use case for your own projects. Or you could be like “naaa son, this is a lame framework”, that’s acceptable too 😂. Here is a link to their docs -> https://docs.nestjs.com/ (https://docs.nestjs.com/) And I recommend taking a gander through it to get a better understanding of the framework. But I wanna get to the fun stuff and start working on setting up our personal learning guide and project guide. Gemma Steps Up to Bat... As I mentioned earlier, we will be sticking with local open-weight models for building us our learning and project guides. But just like last time.... ...Swing and a Miss, But Not Out With this task being much simpler than the remotion animation creation we did in the last episode, I expected it to handle this task with much more ease. At first we hit a couple of roadblocks because of some directory confusion and vagueness in my prompt, but after some tweaking and after opening up the agent in the proper Obsidian folder, Gemma 4 12b actually got the job done, and it took only 7 min! I need to build a learning guide and a project guide for learning about NestJS. The learning guide should be very thorough and reference the official docs (https://docs.nestjs.com/) when making the learning sections. The project guide should be a very easy and simple project that a new dev can do by just referencing the official docs and online forums. The goal for the project is to not use AI to build any of it, so please when creating the guide, make sure that each build step is very detailed on what the dev needs to do, so they aren't second guessing about the ambiguity. You are in my project directory now so I just need you to create these guides in the current folder and label them Version 2. Do not go outside of your requested tasks. I know some tools that will be used in my project (only if needed) are https://www.npmjs.com/package/quick-rag and https://www.npmjs.com/package/@qvac/rag so add those to the guides as well if they are useful. There are version 1 guides in the same folder if you need a reference. After the first attempts, I did think there was an issue with the model not being able to complete this simple task, but I realized that I was the error after running it in a newly created directory. THAT task only took just under 6 min, but I should note that the prompt was slightly different: I need to build a learning guide and a project guide for learning about NestJS. The learning guide should be very thorough and reference the official docs (https://docs.nestjs.com/) when making the learning sections. The project guide should be a very easy and simple project that a new dev can do by just referencing the official docs and online forums. The goal for the project is to not use AI to build any of it, so please when creating the guide, make sure that each build step is very detailed on what the dev needs to do, so they aren't second guessing about the ambiguity. You are in my project directory now so I just need you to create these guides in the current folder and label them Version 2. Do not go outside of your requested tasks and don’t overthink getting it done. There are version 1 guides in the same folder if you need a reference. As you can probably see in the above prompts, I have them reference version 1 for context, and this is because I used Claude to create a plan for comparison in quality. Opus obviously created a better learning and project guide, but the point is Gemma 4 12b did a fine job as well, just straight to the punch 😂. I’ll add the guides below for anyone who wants to check them out: Opus Gemma 4 12b So if you’re wondering which learning guide I’ll be using, it’s neither lol. I actually bought the official course NextJS offers and plan to dive deep into this framework for the next project. The project guides though, I’ll be using both. It actually seems like the project from Gemma 4 is what I asked for in terms of simplicity. With the Opus model, the project is a 2nd brain API, and while it’s a cool project, its def not a basic and minimalistic practice project. The guides themselves speak volumes, where V1 is very extensive, and V2 is straight to the punch. Running the same prompts but without references So to give this a go without a reference but with the refined prompt, I ran Gemma 4 12b again but for learning Svelte and building a Svelte project. Popped open a new session, and OpenCode + Gemma 4 was able to build both a learning guide and project guide. Straightforward enough that you should be able to do it without using AI to build it. The Takeaways One of the main takeaways was an introduction to NestJS and how it could be the new framework for building backends with Node.js. With it being very opinionated, this might not be for everyone; Hell, it most likely isn’t. But I tend to like opinionated tools and libraries, so long as it’s easy for me to understand AND I find better use of it over the competition. We will see how things pan out once I start working on these new projects. The other main thing I wanted to get across in this article is to show how easy it is to make yourself learning guides to upskill with nearly whatever you want. You want to get better at Python for Data Science, make a guide for that. You want to learn how to be a better herbalist or grow your own produce, build a guide on how to get started. Just choose something you're passionate about and build your own learning tools. I’m, of course, going to advocate for using local models to build these guides, but if you truly need a long, in-depth roadmap for what to do, the frontier models will serve you better (f**k OpenAI though, please use anything else 🙏🏾) What’s Next The next episode will either be about the NestJS project or it might be me diving into more news revolving tech. There’s some major development happening in the local AI space, and while I’d love to cover something in tech that DOESN’T involve AI, it’s becoming increasingly impossible, so my hands are tied. If you want to keep up with my work or want to connect as peers, check out my social links below and give me a follow! * 🦋 Bluesky (https://bsky.app/profile/digitaldopamine.dev) * 📸 Instagram (https://www.instagram.com/digital_dopamine_llc/) * ▶️ Youtube (https://youtube.com/@digitaldopaminellc?si=sujxCAMyboNvidiW) * 💻 Github (https://github.com/kdleonard93) * 👾 Discord (https://discord.com/users/407639833146818570) Get full access to Digital Dopamine at digitaldopaminellc.substack.com/subscribe (https://digitaldopaminellc.substack.com/subscribe?utm_medium=podcast&#38;utm_campaign=CTA_4)

4. 

   24 Jul 2026

   Local Remotion Animations W/ Ollama, OpenCode, and Gemma4

   Local Model Aspirations For all of the folks out there who want to embrace AI but also have issues with the energy consumption and cost, I’m right there with you. When AI started to become mainstream and then eventually mandatory in enterprise work, I was very reluctant to use it and train these models that my company will eventually replace me with. Well…….that happened verbatim 😅. My previous place of work has been going through rounds of layoffs after a new set of C-suite execs strolled in to make “improvements” to the business, aka, “the company isn’t making enough money so, hire offshore, fire employees with IP knowledge, and go heavy on using AI.” I’m obviously exaggerating (kinda), but the point I’m trying to make is that AI is great when you have a solid plan on how to use it and try not to rush the process. Most companies didn’t take that approach, though, and got shot in the foot because of it. Does that mean we should oppose AI? Absolutely not. I actually love what AI can be used for, and I think there isn’t enough fine-tuning out there for specific use cases. Now, with Chinese models becoming much more competitive in intelligence, the cost difference is a no-brainer, and many companies are switching to these cheaper yet very capable models. (Image Source: https://techstartups.com/2026/06/29/western-companies-are-quietly-switching-to-chinese-ai-models-as-u-s-frontier-ai-prices-rise/ (https://techstartups.com/2026/06/29/western-companies-are-quietly-switching-to-chinese-ai-models-as-u-s-frontier-ai-prices-rise/)) Then, when you use platforms like DeepInfra (https://deepinfra.com/) as your provider, scaling becomes less of an issue, and you only pay for usage and not a monthly subscription. Add the OpenRouter API (https://openrouter.ai/) in the mix, and you have the ability to swap providers at will. If costs ever change, if one provider hits you with rate limits, or if a provider goes down completely, OpenRouter is the failsafe that will forward your request to a different provider automatically (with the proper configurations) so your clients won’t have issues with the products/software you built for them. This just goes to show how far we’ve come with AI development, and like it or not, it’s a tool almost as important as the internet itself but potentially much more dangerous. While that danger may include physical harm, I’m more worried about the mental and intellectual harm that it’s doing and will continue to do if we don’t make some major changes in how the average person should approach AI. This is why I started diving into local models, with the understanding that they are not as capable as the frontier models, but that’s the point. They are SLMs and MLMs that you can leverage, but it will still require you to do some sort of critical thinking, which is a good thing. There is absolutely no reason for people who are using AI to just chat or ask a simple question, to be using the compute power and energy consumption of the frontier models. That’s one reason why I marveled over Google’s Gemma 4 series because, in theory, they have a model that should serve on just about any device. In practice, though, I’m learning some major limitations with these models, but most of them have to do with local compute power (as well as my current lack of knowledge on how to fine-tune these systems). That isn’t to say local models will never work; we have come so far with local models already that I'm sure in the next year or so, there will be a better generation of local 1st models that will work as smoothly as using a frontier cloud model. And “smoothly” is the keyword here, because in terms of intelligence, that’s not the main selling point of these local and more ethical models. Local Model Experimentation So that leads us to this lil ol’ experiment with me trying to build a “lower third” animation for my podcast intro. A “lower third” is just an animation on the lower left or right of your screen with the host name and title, or whatever you’d like to pop up there briefly (or at least that’s how I understand it 😄). So you’d think that a local model would be able to knock this out no problem, right?? If you have a beefy enough local machine, you’re golden. However, most people do not have a $5k+ home lab that can run these local models without major lag and bottlenecks. When the Gemma4:12b model was released, I was ecstatic because it was small enough for my Mac Mini (M4) not to hit memory limits, and it allowed enough headroom for me to record on OBS without OBS crashing. But reality hit me hard when I needed this model to run efficiently in any capacity for the task at hand. So I crafted 3 separate prompts for this task since, given the small context window limit of 32k I had to set, we needed to make sure to break up the tasks into individual prompts and sessions so the 12B model can stay as focused as possible. The original prompts are below: [1/3] Create src/LowerThird.tsx. Transparent background. Static layout only, no animation yet: a 12px-tall horizontal gradient bar (linear-gradient 90deg, #7B5BF0 to #4B7BE5) at x=120 y=880, an off-white (#F4F4F6) rounded rectangle behind two lines of text: primaryText in Archivo bold 48px #111111, secondaryText in Space Grotesk 32px below it. Props: primaryText, secondaryText (zod schema). Register in src/Root.tsx: id "LowerThird", 1920x1080, 30fps, 150 frames. [2/3] Animate the entrance (frames 0-21): the gradient bar scales in from the left using spring({frame, fps, config: {damping: 200}}), the rectangle then expands from behind it, the two text lines slide up 20px and fade in with a 4-frame stagger. Use only useCurrentFrame/interpolate/spring. [3/3] Animate the exit: frames 129-150 reverse the entrance. Hold frames 21-129. Then I'll run pnpm lint and paste any errors. But these evolved greatly throughout my multiple rounds. Before we get into what the final prompts were, we need to make sure that folks who want to follow along can get set up with the tools I used during this process. Setup 0. Scaffold the Remotion project # Prereqs: Node 18+ and pnpm pnpm create video # → name the project, pick a template (Blank is fine — the agent writes the rest) cd pnpm dev Then install the skills: npx skills add remotion-dev/skills That drops remotion-best-practices into the agent folders (.opencode/skills/, .claude/skills/, .agents/skills/, …) and records it in skills-lock.json, so OpenCode — and any other agent you point at the repo — picks it up automatically. 1. Serve the model with a real context window Ollama’s default context (~4k tokens) is far too small for agentic coding — OpenCode stuffs system prompt + skill rules + file contents into context, and when it overflows, Ollama silently truncates the oldest tokens. The model “forgets” your instructions mid-task and the failure looks like model stupidity. It’s a config problem. Note for context We will be setting 2 different contexts for Gemma. One will allow me to record at the same time but will reduce my context window. The other will give a better context window for a lesser chance of hallucination. You will also need to create Modfiles for our customized models to reference. Each modfile will be above the cat call. You can name the files whatever you want, but I’ve named the models according to their context window. To bake it in permanently via a Modelfile: Smaller Context cat > /tmp/gemma4-12b-16k.Modelfile /tmp/gemma4-12b-32k.Modelfile Model ids must match ollama list exactly — these are the two Modelfile variants built in step 1. If the id doesn’t match a local tag, OpenCode’s requests just 404 against Ollama. * Top-level "model" sets the default, so OpenCode launches straight into the 16k local model — no /models dance every session. Swap to the 32k variant with /models when you’re not recording. * "agent": { "build": { "temperature": 0.1 } } turns the sampling temperature way down for the build agent. For codegen you want boring and deterministic, not creative — a 12B at default temperature wanders; at 0.1 it follows the skill rules much more reliably. You can also just make this update in the OpenCode root opencode.json file, which would typically be located at /Users/{user-name}/.config/opencode/opencode.json. So in my case, it would be /Users/kdleo/.config/opencode/opencode.json 3. Launch and verify cd ~/code/remotion_animations opencode LowerThird Build Rounds I found out quickly that name collisions stall on 12B. At least it did for me. Even though I had a different path listed for the creation, because the actual file name was the same as what I created during my dry run with a different model, it kept telling itself it needed to check that file, but then went back to saying “wait, the path is code/user/file-name.txt, I should just create a new file at the path specified,” but then it would go back to thinking it needed to check the existing file, and do this same loop over and over again. Apparently, the 12B model burns context and confidence on ambiguity a big model shrugs off. This led me to add some fixes baked into the prompts that I had scripted for this build. I made notes of the technicals too so I can try to paint a better picture of what failed. Round 1 results Prompt 1 took 37 min: static layout came out right — bar, plate, fonts, colors, zod schema all to spec. But it hallucinated an AnnotationData import from remotion (lint caught it), left its own deliberation as inline comments, and never did the Root.tsx registration. It stalled asking about the name collision. Prompts 2 and 3: zero surviving edits. The model went in circles and never wrote the animation to disk. git status after “finishing” showed the file was byte-identical to the prompt-1 state. Fail. Made some adjustments to the prompts and drilled down on explicit file paths and naming conventions for round 2. Round 2 results Prompt 1 & 2 took about 30 min combined: The one-file structure worked: Gemma never wandered into Root.tsx this time. What killed it was prompt 3/3 itself — it said “reverse the entrance… using spring,” and what I didn’t know is that spring can’t run backwards: it’s driven by the raw frame number, not a 0–1 progress value. Gemma tried to comply literally — spring({ frame: interpolate(...) }), a progress value fed into a frame parameter — and circled until the session was abandoned. That one is a prompt bug, not a model bug. Along the way it also used the neighboring src/compositions/LowerThird.tsx as a template, copying its entire forbidden import header and renaming the export to LowerThird, which silently broke the Root.tsx registration; As well as botched an edit that duplicated the whole file top-to-bottom, leaving it uncompilable. Even the manual revert landed on a half-mutated state (junk imports + wrong export name) rather than the clean stub. Fail #2 lol. Round 3 results that got me 95% there. Round 3 was a bit different than the 1st 2 rounds in that I created some template files before running the prompts. Since I successfully created these animations in the past and had the files to reference, I decided to do the following as a pre-requisite before running any prompts: Create src/compositions/LowerThirdGemma.tsx: import React from "react"; import { AbsoluteFill } from "remotion"; import { z } from "zod"; export const lowerThirdGemmaSchema = z.object({ primaryText: z.string(), secondaryText: z.string(), }); export const LowerThirdGemma: React.FC > = () => { return ; }; Register it in src/Root.tsx — add with the other imports at the top: import { LowerThirdGemma, lowerThirdGemmaSchema, } from "./compositions/LowerThirdGemma"; Add the expected LowerThirdGemma and reuse LOWER_THIRD_DEFAULTS: pnpm lint passes and LowerThirdGemma-Wide shows up in Studio as an empty comp. From here, the model is expected not to touch Root.tsx, can’t create files, and shouldn’t collide with anything. The final 3 prompts i used are below: [1/3] Open src/compositions/LowerThirdGemma.tsx. The component is a stub and is already registered — do not create any file and do not edit any other file, especially not src/Root.tsx. Inside the existing LowerThirdGemma component, build this static layout (no animation yet): a 12px-tall horizontal gradient bar (linear-gradient 90deg, #7B5BF0 to #4B7BE5) at left 120, top 880, width calc(100% - 240px); at left 120, top 892, an off-white (#F4F4F6) rounded rectangle (borderRadius 8, padding "20px 40px") containing two lines of text: primaryText in Archivo bold 48px #111111, then secondaryText in "Space Grotesk" 32px #111111. Read primaryText and secondaryText from the component props (the zod schema already exists — do not change it). Keep the exported names exactly LowerThirdGemma and lowerThirdGemmaSchema — renaming them breaks the registration. Do not open or copy code from any other file, especially not src/compositions/LowerThird.tsx — that is a different component. Allowed imports: React, remotion, zod — nothing else exists. Do not add code comments. Do not ask me any questions — if something seems ambiguous, pick the simplest interpretation and write the edit to the file now. [2/3] Open src/compositions/LowerThirdGemma.tsx and edit only this file. It has a static lower-third layout (gradient bar + off-white rectangle + two text lines). Animate the entrance over roughly frames 0-21. Inside the component add exactly these progress values: const frame = useCurrentFrame(); const { fps } = useVideoConfig(); const barIn = spring({ frame, fps, config: { damping: 200 } }); const plateIn = spring({ frame: frame - 6, fps, config: { damping: 200 } }); const textIn1 = spring({ frame: frame - 10, fps, config: { damping: 200 } }); const textIn2 = spring({ frame: frame - 14, fps, config: { damping: 200 } }); Apply them: the gradient bar gets transform scaleX(barIn) with transformOrigin "left center"; the rectangle the same but with plateIn; the primary text line gets opacity textIn1 and transform translateY((1 - textIn1) * 20px); the secondary line the same with textIn2. Do not pass anything except the plain frame math shown above into spring's frame parameter. Keep the exported names exactly LowerThirdGemma and lowerThirdGemmaSchema. Do not open or copy code from any other file. Do not add an exit yet. Do not add code comments. Do not ask me any questions — write the edit to the file now. [3/3] Open src/compositions/LowerThirdGemma.tsx and edit only this file. It has a lower third with a spring entrance over frames 0-21 (values barIn, plateIn, textIn1, textIn2). Add the exit WITHOUT spring — springs are for entrances only. Add exactly this progress value: const exitOut = interpolate(frame, [129, 150], [0, 1], { extrapolateLeft: "clamp", extrapolateRight: "clamp", }); Then combine it with the existing entrance values: the bar's scaleX becomes barIn * (1 - exitOut); the rectangle's scaleX becomes plateIn * (1 - exitOut); the primary text opacity becomes textIn1 * (1 - exitOut) and its translateY becomes ((1 - textIn1) * 20 + exitOut * 20)px; the secondary line the same with textIn2. Change nothing else — frames 21-129 stay a motionless hold because both values are constant there. Keep the exported names exactly LowerThirdGemma and lowerThirdGemmaSchema. Do not open or copy code from any other file. Do not add code comments. Do not ask me any questions — write the edit to the file now. After you finish I will run pnpm lint and paste any errors. And things were moving pretty smoothly….until prompt 3 AGAIN. For some reason this model just has the hardest time understanding our transitions even when i explicitly tell it how to do it. After it kept going in circles yet again (and i let it run for about an hr on prompt 3 😭) i gave up and decided to use the 31B cloud model, which is still less intelligent than frontier models but it was in the cloud so my aim was to just compare how long it would take to try and resolve the issue. It was a matter of seconds 😐. Below is the correction it did to fix what the 12B model (on my hardware) just could NOT do: …… That’s it……it literally just had a few misplaced brackets and some missing math logic. Over an hr, it couldn't resolve that issue, and again, I partly blame my hardware, but I’m also aware that it could very well be a limitation in this area of intelligence for this model. I doubt these models have been trained on much code related to Remotion, so I can understand why this Local experiment was a failure, but that doesn’t mean I'm not still a bit salty about it lol. Local Model Reality At the end of the day, it was technically a failure. Regardless if I got 90% there, the model could not cross the finish line without manual intervention. And when you compare it to the likes of Opus or Fable, there is no comparison when it comes to intelligence whatsoever. It only took me 1 go using Claude, and the prompts were not nearly as precise or had as much context and setup that was in place for Gemma4:12B. While the 31B model might actually be more than capable at running through these prompts (and maybe even the 26B), you’re limited by the Machine you have to work with. So I will forever be stuck with the 12B local model until i upgrade, or they make a more efficient and intelligent local-first model. The results for the lower third animations are also different in quality. Claude’s 1st attempt with general and somewhat vague instructions: Gemma4:12B with multiple rounds of prompt revisions, ultimately needing Gemma4:31b (cloud) to finish the animation: Moral of the story here is to understand what you’re looking to use AI for and then choose the proper models and tools to try and use it as efficiently as possible, without relying on it to do all of the work for you. Learning how to build curated RAG Systems is my most pressing task for upskilling, because I want to be able to provide reasonable options for small businesses to choose when it comes to getting involved in AI. I know there are plenty of small businesses in my community that have been underserved for decades when it comes to new advanced technology, and my goal is to assist with bridging that gap. Conclusion That about wraps it up for this episode. Hopefully y’all learned a bit about local models, their benefits, and also their bottlenecks when it comes to building using local AI only. I’m certain they will only get better and better as time goes on, but for decisions that need to be made today, take caution and choose wisely ✌🏾. If you want to keep up with my work or want to connect as peers, check out my social links below and give me a follow! * 🦋 Bluesky (https://bsky.app/profile/digitaldopamine.dev) * 📸 Instagram (https://www.instagram.com/digital_dopamine_llc/) * ▶️ Youtube (https://youtube.com/@digitaldopaminellc?si=sujxCAMyboNvidiW) * 💻 Github (https://github.com/kdleonard93) * 👾 Discord (https://discord.com/users/407639833146818570) Get full access to Digital Dopamine at digitaldopaminellc.substack.com/subscribe (https://digitaldopaminellc.substack.com/subscribe?utm_medium=podcast&#38;utm_campaign=CTA_4)

5. 

   9 Jul 2026

   Hack With Me Ep.4 | Windows, CLI, and Networking

   Ever wondered what actually happens when you type a URL into your browser? In this episode, I break down the fundamentals of networking — from the OSI model to raw TCP connections — no prior experience required. 📌 What we cover: - The OSI network model - IP addresses, subnets, and routing - TCP vs UDP and port numbers - Connecting to a TCP port from the CLI Whether you're studying for a cert, starting a dev/sysadmin role, or just curious how the internet works under the hood, this one's for you. If this helped, consider subscribing to learn with me 🤘🏾 — new episodes drop regularly. 🔗 Connect: 🦋 Bluesky → https://bsky.app/profile/digitaldopamine.dev (https://bsky.app/profile/digitaldopamine.dev) 📸 Instagram →https://www.instagram.com/digital_dopamine_llc/ (https://www.instagram.com/digital_dopamine_llc/) 💻 GitHub → https://github.com/kdleonard93 (https://github.com/kdleonard93) 👾 Discord → https://discord.com/users/407639833146818570 (https://discord.com/users/407639833146818570) Get full access to Digital Dopamine at digitaldopaminellc.substack.com/subscribe (https://digitaldopaminellc.substack.com/subscribe?utm_medium=podcast&#38;utm_campaign=CTA_4)

6. 

   15 Jun 2026

   The Quiet Deal That's Reshaping Wall Street | Digital Dopamine Ep. 9

   I Thought We Had More Time.... It feels like not too long ago, when I published my article and 5th episode of the Digital Dopamine podcast, “Tokenizing Private Credit, Real Estate, National Debt, and Everything Else (https://open.substack.com/pub/digitaldopaminellc/p/tokenizing-private-credit-real-estate?r=6fp208&#38;utm_campaign=post&#38;utm_medium=web)“, where I warned about institutional efforts t start tokenizing assets and little did I know, some major players were relatively low key but making move swiftly. The biggest players are The DTCC and Stellar Foundation, who inked a deal to enable the tokenization of DTC-custodied assets on Stellar’s blockchain. This news in itself is actually pretty cool, in my opinion. My bias stems from knowing Stellar’s past and how far they’ve come since the inception and initial release in 2014. They set out to be one of the few blockchains that wanted to bridge the gap between traditional finance and exchange by making products that allowed people who had family in underdeveloped nations to supply their family members funds almost instantly with little to no fees as well as no major worry about exchange rate. This of course sounds amazing and you’d think everyone would be on board with this adaptation but, as you can probably tell, the Society for Worldwide Interbank Financial Telecom (SWIFT), would not be a fan of losing it’s grip on international exchanges. SWIFT is a Belgium based cooperative that is essentially owned by the banks and other member firms that use its service. Which further supports evidence that the banking system fights so hard to stonewall blockchain based companies in order to make their own similar product to then move their customers on before they lose them to new and leaner companies working natively in blockchain. Now some might say that this isn’t really a “bank vs blockchain” situation and more so a question of if SWIFT can do what Stellar and XRP does, but in house. That’s the thing though, if SWIFT wanted to do it in house, why wouldn’t they try to stall regulations? You can’t convince me otherwise that the massive opposition and lobbying around regulatory frameworks for crypto isn’t influenced by big banks trying to keep money flowing through their pipelines. Link to article -> https://www.ccn.com/education/crypto/xrp-xlm-face-challenge-50-banks-back-swift-new-payments-framework/ (https://www.ccn.com/education/crypto/xrp-xlm-face-challenge-50-banks-back-swift-new-payments-framework/) I digress, though; The point of this article is to address the rapid adoption of tokenization. The deal the DTCC did with Stellar isn’t the first and probably won’t be the last deal it has done with Layer 1 and Layer 2 blockchains (https://www.casper.network/get-started/understanding-layer-1-blockchains). Before Stellar, DTCC partnered with Digital Asset on the Canton Network to tokenize DTC-custodied U.S. Treasury securities, with DTCC serving as co-chair of the Canton Foundation alongside Euroclear. That MVP targeted the first half of 2026, and in July 2025 a broad industry group already completed live 24/7 trades with onchain intraday and after-hours financing using tokenized Treasuries on Canton. Separately, DTCC named Chainlink as the data and orchestration layer for its forthcoming tokenized collateral platform (https://thedefiant.io/converge/tradfi-and-fintech/dtcc-picks-stellar-for-tokenized-securities-rollout-as-multi-chain-push-expands) — another distinct partnership worth a mentioning. DTCC also has a concrete platform timeline independent of any single chain (https://www.coindesk.com/business/2026/05/04/wall-street-giant-dtcc-plans-tokenized-securities-platform-with-july-pilot-october-launch): limited production trades begin in July 2026 with a full platform launch in October, covering Russell 1000 stocks, ETFs, and Treasuries under an SEC no-action letter obtained in December 2025. So the DTCC is not new to this, they true to this. But they aren’t the only ones in the race to tokenized assets. You have ICE, the Intercontinental Exchange, not the useless and corrupt Immigration and Customs Enforcement agency. The Intercontinental Exchange is the owner of the NYSE and they are backing tokenized securities initiatives tied to OKX (https://www.coindesk.com/business/2026/05/27/dtcc-plans-to-bring-tokenized-assets-to-stellar-in-latest-wall-street-blockchain-push) . Then you have the Nasdaq developing infrastructure for blockchain based stocks with Kraken parent company Payward (https://www.coindesk.com/business/2026/03/09/nasdaq-and-kraken-are-teaming-up-to-let-you-trade-tokenized-stocks). There are plenty more examples of big players making moves but the problem is that no one knows about it! I can go up to almost any one of my family or friends, intelligent folks, and 90% of them would not know that these institutions and depositories are trying to tokenize let alone know what the tokenization of assets even is. So we need more education around this subject and hopefully folks can start to pay attention to who’s making deals with who around these major changes, so that you can plan accordingly to either shuffle your assets around, learn more about blockchain and crypto to maybe invest in blockchain companies doing REAL and PROVEN work to improve our financial systems and railways, or just so that you understand it and not surprised when you see weird changes in your retirement account in terms of allocations and processes. Wait, We DO Have More Time.... With these changes, it doesn’t mean we don’t still have time to learn a bit about them and about the companies behind them. So I’m gonna focus on the 2 main players of this article, Stellar and the DTCC. Stellar (XLM) Stellar was launched in 2014 by Jed McCaleb and Joyce Kim. McCaleb was a notable figure in early crypto history — he had previously created the Mt. Gox bitcoin exchange and co-founded Ripple (XRP) before a falling out with Ripple’s other co-founders led him to start a new project. Stellar’s codebase initially forked from Ripple’s protocol, but the team rewrote the consensus mechanism, resulting in the Stellar Consensus Protocol (SCP) — a federated Byzantine agreement system designed to be more open and decentralized than Ripple’s approach. Unlike many crypto projects with a profit-driven corporate structure, Stellar is steered by the Stellar Development Foundation (SDF), a non-profit. You can probably see why I actually respect this blockchain company and strongly believe they deserve a role in our financial systems future. From the outset, its stated mission was explicitly aimed at financial inclusion and cross-border payments — connecting “people, payment systems, and banks” and serving populations underserved by traditional banking. Between it’s inception in 2014 to 2018, Stellar was making major moves inking partnerships and implementing their protocol overhaul. The amount of real world business deals made were a clear sign to me that this company will be insanely successful, and they were! Now I wasn’t invested in crypto during this time since I was still very new to the space. I was young and broke as well, so investing wasn’t the first thing I did with the bit of extra cash I had (even though I should have 😭). But from 2014-2018, Stellar exploded +7000%........... yeah i know, I’m salty as about it too. Even today, as of 6/13/026, its up 5,990% since it’s inception. The era of legit blockchain companies going to the moon like this is long gone. But that’s not to say this is no longer a good company to invest in. If anything, it might be an even better time since you wont have to worry about it being a really risky bet anymore. It’s intertwined in so many partnerships with new and legacy business alike, from a partnership with IBM to launch “World Wire,” a cross-border payments network built on Stellar’s rails, involving a number of banks experimenting with stablecoin-based settlement, to the expansion of anchors (regulated on/off ramps) across Latin America, Africa, and Southeast Asia, where remittance use cases gained the most traction. Even more with stablecoins, Stellar has become one of the better networks for stablecoin issuance due to its low transaction fees and quick settlement times. USDC, a stablecoin owned by Circle (ticker: CRCL (https://www.tradingview.com/symbols/NYSE-CRCL/)), is a great example if a stablecoin issued via Stellar, given the fact that they are a pretty big public company now. And again, that’s just some of the partnerships and use cases it had BEFORE 2024. In 2024 they then released their next huge update, which was the launch of Soroban. Soroban was Stellar’s smart contract platform, in a way similar to how Ethereum has smart contracts. That’s about the only thing Stellar and Ethereum’s smart contracts have in common, the fact that they are smart contracts lol. Ethereum smart contracts run on the Ethereum Virtual Machine (EVM), with contracts built primarily in Solidity (https://www.soliditylang.org/). Stellar’s Soroban (https://stellar.org/soroban)takes a different approach: it uses the WebAssembly (WASM) runtime, supporting a broader range of languages, with Rust being the primary one. Rust’s appeal here is partly about performance and memory-safety guarantees that reduce certain classes of bugs common in smart contract exploits. Soroban’s advantage is that it was designed from scratch to avoid the cost/scalability problems Ethereum is still managing, while inheriting Stellar’s existing strengths in payments, remittances, and institutional tokenization credibility via the DTCC deal. Below are a few more facts about Stellar and it’s impact: * Stellar ranks fourth among blockchain networks by tokenized real-world asset (RWA) value, with roughly $1.4 billion in RWAs and about a 5.24% market share of that segment (per RWA.xyz data as of mid-2026). * Its core technical advantages — low transaction costs, fast settlement, and a consensus mechanism not reliant on energy-intensive mining — have made it a popular choice for remittance corridors, stablecoin issuance, and now institutional tokenization pilots. * The network operates as a public, permissionless blockchain, but with built-in compliance tooling (such as configurable asset controls) that make it attractive to regulated entities — a middle ground between fully open chains like Ethereum and fully permissioned ones like Canton. The DTCC (Depository Trust & Clearing Corporation) The DTCC was formed in 1999 through the merger of two organizations: the Depository Trust Company (DTC), founded in 1973, and the National Securities Clearing Corporation (NSCC), founded in 1976. Both were created in response to the “paperwork crisis” of the late 1960s and early 1970s, when Wall Street’s back offices were overwhelmed by the physical volume of paper stock certificates being exchanged — a crisis serious enough that the New York Stock Exchange shortened trading days and closed entirely on Wednesdays to let firms catch up. DTC’s solution was to immobilize physical securities in central vaults and instead record ownership electronically — effectively the predecessor concept to “tokenization,” decades before blockchain existed. NSCC, meanwhile, handled the clearing and netting of trades. The 1999 merger combined custody, clearing, and settlement under one organizational umbrella, and DTCC has since become the central piece of “plumbing” underlying the U.S. securities markets. You trade stocks on Fidelity, E*TRADE, or Robinhood? Its being cleared via the DTCC. Custodial banks and depository institutions? Cleared via the DTCC. Clearinghouses and central counterparties for various asset classes? Yup, that’s the DTCC’s domain. DTCC is structured as a user-owned cooperative — its member banks and broker-dealers are also its owners and primary clients, which has historically made it deeply embedded in (and accountable to) the traditional financial industry rather than a standalone for-profit competitor to its members. DTCC’s subsidiaries collectively process an enormous share of U.S. securities activity — figures cited include roughly $20 trillion in U.S. securities trades processed daily, and subsidiaries handled $4.7 quadrillion in total securities transactions in 2025. DTC, its central depository subsidiary, custodies securities valued at over $114 trillion, spanning issuers from more than 150 countries. DTCC’s tokenization strategy is explicitly multi-chain: Canton Network (with Digital Asset) for permissioned Treasury tokenization, Stellar for public-chain access, and Chainlink as a data/orchestration layer for a forthcoming tokenized collateral platform. DTCC has stated it does not intend to pick a single winning chain but to build interoperability across many. So you can imagine that there will be a handful of winners in the blockchain space, so long as they ink partnerships and deals with institutions of the same caliber. The October 2026 commercial launch — if it proceeds on schedule — would represent the first time a major slice of the U.S. equity and Treasury market (Russell 1000 stocks, ETFs, T-bills/bonds/notes) is available in tokenized form through the official custodial infrastructure of the U.S. markets. This will be a HUGE step towards the shift for the tokenization of assets amongst other things like deeds, contracts, and family last wills, to name a few. Below are some key milestones the DTCC has accomplished: * 1973 — DTC founded to dematerialize physical stock certificates. * 1976 — NSCC founded to centralize trade clearing and netting. * 1999 — DTC and NSCC merge to form DTCC. * 2000s — DTCC expands internationally and into derivatives clearing via subsidiaries (e.g., the Fixed Income Clearing Corporation, FICC). * Mid-2010s onward — DTCC begins exploring distributed ledger technology (DLT) for post-trade processes, including early pilots for credit default swap (CDS) processing on blockchain. * December 2025 — DTCC receives a No-Action Letter from the SEC, permitting its subsidiary (DTC) to offer tokenization services for the Russell 1000, ETFs, and U.S. Treasuries on pre-approved blockchains for a three-year period. Simultaneously, DTCC announces a partnership with Digital Asset to tokenize Treasuries on the Canton Network (the “ComposerX” platform), with DTCC also becoming a co-chair of the Canton Foundation alongside Euroclear. * May 4, 2026 — DTCC convenes an Industry Working Group of 50+ firms (including Bank of America, Citi, Goldman Sachs, JPMorgan, Charles Schwab, Circle, Anchorage Digital, and others) to shape its tokenization rollout, with limited production trades targeted for July 2026 and a full launch in October 2026. * May 6, 2026 — DTCC CEO Frank La Salla discusses plans to work with multiple high-performance Layer 1 blockchains to bring “corporate actions” (dividends, tender offers) on-chain. * May 27, 2026 — DTCC and Stellar Development Foundation announce the Stellar partnership, targeting first half 2027 for live deployment — DTCC’s first connection to a public (rather than permissioned) blockchain. With all these big moves and milestones, you’d think more people in the space would know about the DTCC or at least speak about them. Granted there ARE folks out that do, but it feels like what the DTCC is involved in should always be echoed, and loudly. The US runs on the stock market and that stock market goes through the DTCC for asset clearings. There should be WAY more scrutiny on what they deals the make and partnerships they start that will change the way assets function. What the DTCC is trying to do will open the door for 24/7 trading, where settlements are instant and they are able t provide real-time liquidity. But even the CEO points out the risks to this issue. Scalability of public chains at Wall Street’s transaction volumes, liquidity fragmentation across multiple competing chains, and the potential loss of netting efficiencies that DTCC’s centralized model currently provides. These aren’t minor technical footnotes — netting efficiency, in particular, is core to why centralized clearing exists in the first place, so how it translates (or doesn’t) to a multi-chain tokenized world is one of the more important unresolved questions in this whole transition. What Is Time? Well, only time will tell if this is just a straight forward upgrade to a more efficient way of settlement clearings, or if this is yet another move in the grand effort to widen the wealth gap from the ones that own assets, and the ones that don’t. I’m a bit optimistic that it’s the former but given our history as mankind, i wouldn’t put it past the people making the decisions to go the route that only benefits the top 1%. Until next time, stay rooted. Peace ✌🏾. If you want to keep up with my work or want to connect as peers, check out my social links below and give me a follow! * 🦋 Bluesky (https://bsky.app/profile/digitaldopamine.dev) * 📸 Instagram (https://www.instagram.com/digital_dopamine_llc/) * ▶️ Youtube (https://youtube.com/@digitaldopaminellc?si=sujxCAMyboNvidiW) * 💻 Github (https://github.com/kdleonard93) * 👾 Discord (https://discord.com/users/407639833146818570) Get full access to Digital Dopamine at digitaldopaminellc.substack.com/subscribe (https://digitaldopaminellc.substack.com/subscribe?utm_medium=podcast&#38;utm_campaign=CTA_4)

7. 

   31 May 2026

   Obsidian Obliterates Opps

   Ohh, Where Have You Been, Obsidian… Very rocky life over the last month and a half, and I was kinda in a funk due to my recent layoff. I wasn’t able to avoid the fade this round (https://www.marketwatch.com/story/cars-com-to-lay-off-11-of-full-time-workforce-amid-ai-push-update-bb0c9f35) 😭 Fuggin’ AI…. But I’m looking at this as a new chapter in my life to force my hand in exploring new opportunities while also being able to spend more time on Digital Dopamine. That being said, I realized that a lot of the organizational tools I used stemmed from tools I used at work. Most of these tools, though, were paid for by the company, and outside of my workday, I didn’t really need any personal organizational tools outside of generic Apple apps. When time started to feel like it was slipping away from me and being wasted on procrastination, bad timing, or just flat-out forgetting. Made me realize how much I need clear direction and organization to be productive, so I decided to do some hunting for some new and free tools I can use for my personal station. I went through a lot of options, and none of them seemed to be as geared towards developers as Obsidian was. Plenty of single-use cases within the other software, but Obsidian takes the cake because of its maturity and plugin ecosystem. I was looking for an all-in-one solution, and with the right plugins, Obsidian fulfils all of my (current) needs. That being said, Joplin (https://joplinapp.org/) and LocArk (https://locark.com/) were close runner-ups, and depending on what you’re looking for, those options may serve you better. There was another open source product called Memos (https://usememos.com/), and it’s a self-hosted note-taking timeline. It resembles Bluesky or a Facebook feed, but it’s just quick, timestamped notes. The devs put it nicely: “A self-hosted timeline for quick notes, daily logs, links, and snippets. Open it, write in Markdown, and move on.” So I plan to use this in tandem with Obsidian. Leaning In Given the state of AI, I have no choice but to lean in. And I’m not talking about using it here or and there or using Cursor as my IDE from now on, but really REALLY lean in. I’m talking certs, deeper research into the history and academic papers, Databricks proctored exam, projects, etc. In this world of capitalism, we have to adapt or get left behind. Not because we aren’t still capable of good work, but because company shareholders have no ethics and require consistent profits year in and year out. So if you work for a public company, know that you most likely will need to adapt to using AI if it hasn’t already been shoved down your throat. This is one of the main reasons I started using Obsidian. I needed a new tool that I can use to keep myself organized and on pace to get done what I need to get done. Calendar events and notifications can only do so much, and I started to find that the tools that I usually used with work or even my personal projects all started to limit the features behind subscriptions, and became more of pay-to-use software than having a pretty generous free tier for individual devs. Notion was one of my go-to apps for dev notes and runbooks, and while the free tier is still pretty generous, the tool as a whole is so bulky with other things that can’t be used without a subscription, and AI is also something that isn’t too subtle in the app anymore. So the hunt began, what was free that had the same capabilities as Notion and didn’t force you to have a subscription to use FREE PLUGINS…..😒 (a bit salty) The thing is, what Notion offers for free can be obtained by other products that aren’t as cluttered with all of the premium features Notion has to offer. Through my search, time and time again, I saw Obsidian as the top contender IF not the winner, of the best software to use as a knowledge base and notes app for devs. I could not have been happier with my discovery. Whatcha Got, Obsidian? Now that we know how much I have geeked out over Obsidian, let’s actually take a peek at just a bit of what it has to offer. The sheer scope of the plugin library makes this software such an extensible tool, and there’s no way I can (over ever will lol) cover all of them. We will cover some of the more important plugins, though the main focus is on Obsidian and what the tool includes by default. The Vault You Didn’t Know You Needed To me, the feature that stands out the most, since Notion was lacking it, is the vault concept (seems more common than not these days). Everything lives in a folder on your machine. Plain .md files. That’s it. No proprietary format, no data stored on AWS or Google Cloud servers. If Obsidian disappeared tomorrow, you’d still have all your notes, fully readable in any text editor or app that reads markdown files. That peace of mind alone is worth switching, and on top of that, this makes Obsidian the perfect tool for introducing AI agents into your knowledge base and note-taking process. You can have multiple vaults too — so if you want a clean separation between, say, your job search grind and your personal dev projects, that’s a two-second setup. Keeping It in Sync One question I immediately had after setting up my vault was, “Okay, how would I be able to sync up Obsidian with the mobile app without using Obsidian’s paid sync option?” Since we’re on Apple hardware, the answer was shockingly simple — iCloud Drive. In Obsidian on your Mac, when you create your vault, navigate to your iCloud Drive folder as the save location. Obsidian will create its own folder there automatically. Then, on your iPhone, download the free Obsidian app from the App Store, tap Create new vault, and toggle Store in iCloud on. From there, open the vault switcher, and your vault shows up ready to go. One thing to note — make sure your vault lives inside the Obsidian folder that the app creates in iCloud Drive, not a manually created folder. iCloud needs that app-generated folder to handle sync correctly. You can verify this in the Files app under Browse → iCloud Drive → Obsidian. Setup Docs → https://obsidian.md/help/sync-notes (https://obsidian.md/help/sync-notes) Markdown First, Always Everything in Obsidian is Markdown. If you’re a developer and you don’t already write in Markdown, you’re gonna learn to love it real fast. Headers, code blocks, callouts, tables, and checkboxes — it all renders beautifully in preview mode. And because it’s just .md files under the hood, your notes are version-control-friendly. Throw that vault in a Git repo, and now you’ve got note history. You’re welcome. # 1. cd into the vault folder cd /users/{my_username}/Documents/Obsdian # 2. git init git add -A git commit -m “Initial Commit” # 3 gh repo create project-name --public --source=. --remote=origin --push ⚠️ Heads up — that command above uses the GitHub CLI (gh). If you haven’t installed it yet, the push step will fail. You can grab it with Homebrew: brew install gh gh auth login Run gh auth login once follow the prompts, you’re good to go from that point on. Backlinks & Internal Linking — This Is Where It Gets Good This is the feature that will most likely be the catalyst for how my notes and doc creation evolve. In Obsidian, you can link any note to any other note using double brackets — [[like this]]. That seems simple enough, but the magic is the backlinks panel. Every note shows you a list of every other note that links to it, automatically. No manual cross-referencing. You start building a web of connected knowledge without a need for heavy configuration or reliance on plugins. The Graph View Okay, I’ll be honest — the graph view is 30% useful and 70% just deeply satisfying to look at. It renders a visual map of all your notes and how they connect to each other. As your vault grows, this thing becomes this sprawling network of nodes, and it genuinely feels like you’re looking at your own brain. Useful for spotting orphaned notes (stuff you wrote and never connected to anything) and identifying your knowledge clusters. Canvas Canvas is Obsidian’s infinite whiteboard feature, and it’s built right in. You can drag notes, images, cards, and web links onto a free-form board and arrange them however your brain needs them arranged. I’ve been using it for mapping out my AI learning path — laying out topics, drawing connections between concepts, dropping in reference notes. Think Miro or FigJam, but local-first and totally free. Daily Notes There’s a core plugin called Daily Notes (more on core plugins later) that creates a new dated note every day with a template you define. This is where my Obsidian and Memos workflow starts to come together — Memos handles my quick, throwaway timestamped thoughts throughout the day, and Daily Notes is where I do my actual structured reflection, task tracking, and progress logging. Two different tools, two different use cases, zero overlap. Templates Speaking of templates — Obsidian has a built-in templating system that lets you define reusable note structures. Spin up a new note and insert a template with a hotkey. I plan on creating more templates to become more efficient and consistent with my content depth and length. Hopefully should help me save a hell of a lot of time. Command Palette & Hotkeys The command palette (Cmd/Ctrl + P) gives you a searchable list of every action in the app. It’s that VS Code energy developers are already wired to love. Almost everything in Obsidian has a bindable hotkey too, so once you get your muscle memory dialed in, you barely have to touch the mouse. Very common feature. Themes & Appearance Out of the box, Obsidian has a solid dark and light mode. But the community theme library goes deep — there are themes that make this thing look like a hacker terminal, a Notion clone, a notebook app, whatever vibe you’re going for. Fully customizable via CSS snippets, too, if you want to get nerdy with it. $FREE.99 And all of that? Zero dollars. No subscription tier required. That’s the baseline, and it already clears the bar for most of what I was using Notion for. Now that’s the segue into the plugins section, because if the base Obsidian is a solid 9 out of 10, the right plugin suite is the icing on the cake. Plug Me In Okay, so now we have an understanding of the beast at hand, let’s get into the plugins that help push this tool into S-Tier levels. Core Plugins Here is a full list of core plugins: * Audio Recorder — record audio directly into a note. Good for voice memos or recording meetings without leaving the app * Backlinks — shows every note that links to the one you’re currently in. The backbone of the connected knowledge system * Bases — Create custom views that let you edit, sort, and filter files using their properties * Bookmarks — save and organize frequently visited notes, folders, searches, and headings for quick access * Canvas — the infinite whiteboard. Drag notes, cards, images, and links onto a free-form board * Command Palette — searchable list of every action in the app. The Cmd/Ctrl+P brain of the whole operation * Daily Notes — auto-creates a dated note each day, optionally from a template * File Recovery — snapshots of your notes at intervals so you can roll back if you nuke something * Files — the basic file explorer panel. Sounds boring but you can turn it off, which says something * Footnotes View — Show a list of footnotes from the current note * Format Converter — converts other markdown flavors (Roam, Bear, etc.) into Obsidian-style formatting * Graph View — the visual web of all your notes and their connections * Note Composer — lets you merge notes together or extract a section of a note into its own new note * Outgoing Links — the flip side of Backlinks; shows all links leaving the current note, including unlinked mentions * Outline — panel that shows the heading structure of your current note like a mini table of contents * Page Preview — hover over any internal link to peek at the note without opening it * Properties View — manages YAML frontmatter in your notes as a clean UI instead of raw text * Quick Switcher — Cmd/Ctrl+O to jump to any note instantly by typing its name * Random Note — opens a random note from your vault. Surprisingly useful for rediscovering old stuff * Search — full-text search across your entire vault with filters and regex support * Slash Commands — type / in a note to trigger a command inline without leaving the keyboard * Slides — turns a note into a basic presentation using --- as slide separators * Sync — Synchronize your files through Obsidian Sync * Tags View — panel that shows all tags across your vault and how many notes use each one * Templates — insert reusable note templates via hotkey * Unique Note Creator — creates notes with a unique timestamp-based filename, Zettelkasten style * Web Viewer — Open external links to webpages in Obsidian * Word Count — live word and character count in the status bar * Workspaces — save and switch between different panel layouts depending on what you’re working on Community Plugins Here is where the tools become ever more extensible. With an already huge community that’s still growing, the plugin ecosystem for Obsidian is elite.....no notes. There’s damn near everything you need to make Obsidian uniquely yours, and if you don’t see a plugin you’re looking for, you can build it! In my case, outside of the core features and core plugins, I also wanted this to be my main tool for task and time management. The main thing I needed was a Kanban board of sorts. I grew to become attached to that style of organizing my daily tasks due to using Kanban at work, so I felt bringing that back into the mix would make me feel a bit more organized, and lemme tell ya, I was right. There are a handful of Kanban plugins to choose from, and the most popular one in the marketplace has a bit over 2.25 million downloads. Screenshot 2026-05-28 at 2.31.32 PM.png The caveat is that it hasn’t been updated for 2 years, and even though that isn’t a deal breaker, it makes me think this plugin is no longer being maintained. But then I came across gold! TaskNotes (https://tasknotes.dev/) is a bit of an all-in-one type of plugin that includes extensions for. TaskNotes describes that their features include task organization, time tracking, and calendar integration. But that’s just scratching the surface. TaskNotes follows the “one note per task” principle, where each task lives as a separate Markdown note with structured metadata in YAML frontmatter. Meaning that every task can be modified manually or by a coding agent. TaskNotes also provides multiple views for managing tasks and tracking productivity. Amongst these views is a Kanban board that works interchangeably with other notes in your vault. All task-focused views operate as .base files located in the TaskNotes/Views/ directory and require Obsidian’s Bases core plugin to be enabled. I’ve been using other plugins, but they have been more theme and personalization-related. But this gets to the core of my excitement with Obsidian, with the push for using AI agents and the projects and practice I have planned for using open-weight models in my day-to-day and contribute to the source code (if possible), this just sets me up with extensive possibilities on working with agents and my home station. Giving these agents access to my Obsidian vaults will unlock a new level of project and up-skilling efficiency. All using (mostly) local first methods and storage. I highly recommend checking out the docs for TaskNotes, as it’s some of the best documentation I’ve seen put together for a plugin. Side Pieces During my quest for a new tool or suite of tools, I came across a tool called Memos. At first, I was going to use this app as my go-to note-taking app, but it felt more like a lightweight version of Obsidian’s Notes feature, which isn’t a bad thing. Considering everything is added on a timeline in chronological order, this is actually the perfect tool for quick thoughts, ideas, notes from learning lessons, quick code snippets, or just scrolling through dev forums and servers. That way, while I’m researching a new episode or learning something new for up-skilling, it’s an easy avenue for me to jot down my thoughts without thinking about folder structure or how it connects to my other notes. Many Memos I might do a separate piece on Memos as a whole, but for now, I just wanted to throw out a handful of use cases specifically for devs, although memos have usefulness for many professions. Dev Use Cases | # | Description | |---|-------------| | 01 | Store reusable code snippets and command-line recipes | | 02 | Document bug investigations and troubleshooting steps | | 03 | Record architecture decisions and technical trade-offs | | 04 | Collect learning resources while exploring new technologies | | 05 | Track API endpoints, credentials, and configuration notes | | 06 | Maintain personal development logs and TIL (Today I Learned) entries | Just a handful, but you can see the utility of this software, and when coupled with Obsidian, it becomes a great addition to the toolkit. The only catch is there’s no native mobile app — but we’ve got a workaround for that. Each instance runs in a Docker container, and Docker is actually required in order to use this tool. So let’s walk through how to spin up a local container with Docker, and then we will dive into the mobile workaround afterward. Docker Alrighty, time to get Docker set up on our machine. We will just need to download the desktop Link to Docker download -> https://docs.docker.com/get-started/get-docker/ (https://docs.docker.com/get-started/get-docker/) That’s pretty much it. Once Docker is installed on your computer, run the following command: docker run -d \ --name memos \ -p 0.0.0.0:5230:5230 \ -v ~/.memos:/var/opt/memos \ neosmemo/memos:stable This will get a memos container set up for ya and give you: * 5230 exposed on the host * a persistent data directory at ~/.memos * SQLite by default * one container that is easy to inspect and replacememos_container 1.png To verify the local instance in your terminal, you can run docker logs memos: memos_instance.png And then you can access your timeline at http://localhost:5230/home memos_timeline.png Now we’re cookin’! The textbox for logging your thoughts is completely markdown capable, and you can add something like: Screenshot 2026-05-30 at 1.30.38 PM.pngWhich will produce this in the timeline:Screenshot 2026-05-30 at 1.31.19 PM.pngThis is sick, right?! And since Obsidian is pure markdown as well, the memos are easily copied over when needed. Bailed By Tailscale for Mobile So, a workaround that took me about five minutes to set up is how we circumvent the issue of accessing our memos server via phone, and its name is Tailscale. Tailscale is a free VPN tool that creates a private, encrypted network between all of your devices. Think of it as your own personal internet that only your devices can see. Once your Mac and iPhone are on the same Tailscale network, your phone can hit http://[your-mac's-tailscale-ip]:5230 from literally anywhere — coffee shop, commute, wherever — and access your Memos instance like it’s sitting right next to you. Setup is dead simple: * Download Tailscale on your Mac → tailscale.com/download (https://tailscale.com/download) * Download the Tailscale app on your iPhone from the App Store → https://apps.apple.com/us/app/tailscale/id1470499037?ls=1 (https://apps.apple.com/us/app/tailscale/id1470499037?ls=1) * Sign in with the same account on both devices * On your Mac, run tailscale ip -4 in the terminal to grab your Tailscale IP: 667 * On your iPhone, open your browser and go to http://[that-ip]:5230. In my case, I went to http://100.88.216.15:5230/ * You’ll need to log in once the page loads, and then you’ll have your mobile instance!! (So long as your Docker container is running on your desktop)memos_mobile_video.movMemos on your phone, no native app required, no data leaving your network! Just Getting Started That about wraps up today’s episode/article. I can see myself using Obsidian for the foreseeable future. I’ve tried out so many apps in the past, and this one really feels like it’ll be a lifelong tool, or at least until something new and shiny comes out 😂. Look out for more coverage on tips, tricks, and plugins related to these tools in the future, but until next time, stay rooted. Peace ✌🏾. If you want to keep up with my work or want to connect as peers, check out my social links below and give me a follow! * 🦋 Bluesky (https://bsky.app/profile/digitaldopamine.dev) * 📸 Instagram (https://www.instagram.com/digital_dopamine_llc/) * ▶️ Youtube (https://youtube.com/@digitaldopaminellc?si=sujxCAMyboNvidiW) * 💻 Github (https://github.com/kdleonard93) * 👾 Discord (https://discord.com/users/407639833146818570) Get full access to Digital Dopamine at digitaldopaminellc.substack.com/subscribe (https://digitaldopaminellc.substack.com/subscribe?utm_medium=podcast&#38;utm_campaign=CTA_4)

8. 

   16 May 2026

   Gimme More Gemma 4

   One Step Closer to Sustainable AI Today, we are going to give props where props are due, and that’s with Google’s new Gemma 4 models. The Gemma 4 models are open source with an Apache 2.0 license; Anyone can use this model commercially or personally with no restrictions, allowing folks to build and sell applications, embed the model in their product, or clone and build upon the core model code without needing permission from Google. That’s not the only cool thing about Gemma 4, the models are TINY and pretty damn powerful. As you can see in the image above, there are 4 models total: E2B, E4B, 26B, and 31B. E2B & E4B These models are best suited for mobile and IoT devices. There are no other models available that can run natively on the user’s device without an internet connection and using only the device’s processing power. The immediate benefit of this breakthrough is that populations with little to no internet access can begin using AI for their own learning. For personal use and coding, the intelligence of these 2 models is not strong enough to do any daunting task, coding, or deep thinking, but they are more than capable of providing quick 1-2 liner responses for learning and informational purposes (we’ll get into the exact details of the breakthrough later). This also benefits people who might get lost on long expeditions in unknown & uncivilized territories. For example, one might need to get foraging info to assist their survival tactics. Though they were engineered with a target audience in mind. These models were engineered from the ground up for maximum compute and memory efficiency (https://blog.google/innovation-and-ai/technology/developers-tools/gemma-4/), and in collaboration with Google Pixel, Qualcomm, and MediaTek, they can run completely offline with near-zero latency on phones, Raspberry Pi, and NVIDIA Jetson Orin Nano. 26B & 31B Here’s where things get pretty interesting. The 26B & 31B models are aimed at more coding assistants and agentic workflows, research, and enterprise production apps. The 26B works decently on a Mac Mini (M4), and you can easily downgrade to the smaller models for much greater performance, depending on the task and context provided. But for open source models that are so small with an open license, the 26B and 31B swing well above their weight class, outcompeting models with 20× more parameters. By total parameter count, Gemma 4 31B is 24× smaller than GLM-5 and 34× smaller than Kimi-K2.5-Thinking, delivering comparable performance at a fraction of the footprint. The more remarkable story is the 26B MoE: it achieves 97% of the 31B's quality at approximately 8× less compute per inference step, with the 26B MoE reaching 40+ tokens per second locally versus the 31B exceeding 10 tokens per second. The pure flexibility and power at these model sizes unlock so many possibilities in the open source space, especially for people looking for a free and frictionless way to get into using AI without needing massive compute power. Much better for the environment, too! Gemma The Winna Yes, I misspelled “winner” on purpose, relax. Gemma 4 is the clear winner when it comes to open models. At least in my. eyes. There are other open-source and free models, such as Kimi-K2.5 and Qwen 3.6, that beat Gemma 4 in almost every category, but the gap is not large, and with the other models, you pretty much will need a powerhouse of a home setup or the power of an actual enterprise server to run these on. So, for the everyday layman, Gemma 4 should be the model forced upon the people. Yup, I said it. If you aren’t using AI agents or AI in general for coding, deep thinking, research, or science, then you need to be forced to use a model that has very little impact on the environment and your wallet. There’s no reason for anyone to be paying $20/month for high-energy prompts about what to make for dinner or how to talk to women……there are people that do the latter and all I can do is pray for them lol. But below is a nice little graphic of the 4 different model variations, their use cases, and the min amount of compute needed to run (not necessarily smoothly). There are some cool facts to read into about the technical achievements of Gemma 4 and I urge anyone with a deeper interest in knowing the nitty-gritty to read into their official docs → https://ai.google.dev/gemma/docs/core/model_card_4 (https://ai.google.dev/gemma/docs/core/model_card_4) as well as peep the video below: Pairing With OpenCode and Ollama Now that we have a general sense of Gemma 4 and its capabilities, I wanted to test things out myself with a quick local project that uses the Gemma 4 Model to build out an API for an AI chat. I wanted to include a UI as well for screen recording purposes so I looked into ways to make this happen all without paying a single penny (locally of course). This led me to OpenCode and Ollama. OpenCode This is pretty much the open-source and free version of “Claude Code” with the added ability to use any free or paid model for your operations. To be more detailed, OpenCode is an AI-powered terminal coding agent that sits on top of whatever local model you point it at. It reads your codebase, writes and edits files, runs commands, and iterates — all from your terminal. Critically, it’s model-agnostic, so you can point it directly at your Ollama endpoint and it uses Gemma 4 as its brain instead of a paid cloud model. The local setup was very straightforward, and you can get it installed with curl, brew, or an installer: Curl curl -fsSL https://opencode.ai/install | bash Homebrew brew install anomalyco/tap/opencode Node (NPM, PNPM, BUN, YARN) # NPM npm install -g opencode-ai # PNPM pnpm install -g opencode-ai # Bun bun install -g opencode-ai # Yarn yarn global add opencode-ai Once installed, you are all set to start using OpenCode as your agent of choice, but you’ll still need a vehicle to download, manage, and serve open-weight models like Gemma 4 on your local machine. That's where Ollama comes in. Ollama Ollama is the runtime layer in which you can download and serve open-weight models and API dependent models on your local machine. In our case, it wraps the model in a local REST API (mimicking OpenAI's API format) so any app can talk to it at localhost:11434. With the command below: # The model i used is a custom 26b model. You can swap that out with gemma4:latest or any other model version ollama run gemma4:26b-32k you get your model running. Ollama handles quantization, GPU/CPU offloading, and model versioning under the hood. For our example project, it's the reason we have zero cloud dependency and zero API costs, which is DOPE AF!! Local AI API Example Now let’s dive into the example project itself. The goal was to build a Local AI assistant API using only OpenCode and Gemma 4 as the model. That turned into two rounds of attempting that, both having their fair share of difficulties when it came to some of the logic. Now this task was pretty hefty for Gemma 4 in my opinion but I wanted to see how well it would do with creating an AI itself. The Qwen flop This one kinda sucked because for the second run, I wanted to use Qwen since it’s supposed to be better when it comes to agentic coding. But long story short, as soon as I started using the qwen3.6:27b, which is supposed to be good on machines with at least 17 GB of RAM. I have 24GB, and while it’s running, my activity monitor says it’s using 22.5 GB of my 24 GB…. Not only is it using more GBs than the model apparently was supposed to use (or maybe it is, and there’s a lack of architectural knowledge on my end), but it just doesn’t work at all. No exaggeration when I say I let it run for about 1 hr on a simple question, and it never even got past the thinking step. Clearly, my Mac Mini was not up for the task with Qwen, but that’s exactly why Gemma 4 is so damn cool. There’s literally a model for every kind of device. API V1 & V2 So, as I mentioned earlier, I did two rounds of running this, and I will say there were successes and failures in both runs that made them about equal in output quality. V1 With V1, the UI is where we were lacking. Hell, the UI was the biggest struggle for both runs since it insisted it use Svelete and SvelteKit as the frontend framework 😂. I know most of these models have very little Svelte in their training data, so any chance I get, I make sure to use Svelte and help the AI build their Svelte chops lol. But considering this project is local, I’m not helping the big 3 (OpenAI, Anthropic, X) train their models this time around. The other issue with this build was that the scaffolding was a bit off, and that caused confusion when giving further directions. However, it seemed to pick up the pieces pretty quickly on the first round, and I got a working API + UI pushed up to GitHub (https://github.com/kdleonard93/local-ai-api). Below is a quick screenshot of a random question I asked the V1 chatbot: For additional context here, the first question was asked with nothing in the “System Prompt” section, but for the second question, I added “Make sure your responses are fantasy-themed”, and the response was adjusted accordingly. The System Prompt section itself is unique to this version’s build, as V2 did not feel the need to add that feature 😅. But it gives a bit more control of the output for the user by allowing them to add some constants into their chat flow. The UI uses Svelte and took a couple of prompts to fix the errors present. I was personally still impressed by how well it did with Svelte compared to other big-name models I’ve used in the past. V2 Now with V2, the first run through of the prompt gave it a good head start with the UI, since there were already structured files in the first version. There were only 2 main issues with the second run through: it initially built the frontend in a “UI” folder instead of a “Frontend” folder, and the button + POST request was broken. The UI design, though, was a bit more compact, and in my opinion, that was a better look. The System Prompt section was also left out of this build, and the chat box is much smaller than V1’s, and I have a title to actually indicate what the tool is. I asked both versions their own simple questions, and they did a very good job and got a response back within a minute, once the models were warmed up. I personally don’t have a reason to ever use either of these chatbots, but I figured it would be a good test to see if AI can build….AI 😅. In the long run, and while imperfect, it was still a success. Goodnight Gemma That about wraps up my little experiment and dive into Google’s Gemma 4 model, and I simply can’t express enough how much I look forward to the continued evolution of Gemma. If you watched the full video, I hope you enjoyed the journey with me building pieces of both versions, even the roadblocks. I’ll be doing more dives into cool tech like this soon, but until next time, stay rooted. Peace ✌🏾. If you want to keep up with my work or want to connect as peers, check out my social links below and give me a follow! * 🦋 Bluesky (https://bsky.app/profile/digitaldopamine.dev) * 📸 Instagram (https://www.instagram.com/digital_dopamine_llc/) * ▶️ Youtube (https://youtube.com/@digitaldopaminellc?si=sujxCAMyboNvidiW) * 💻 Github (https://github.com/kdleonard93) * 👾 Discord (https://discord.com/users/407639833146818570) Get full access to Digital Dopamine at digitaldopaminellc.substack.com/subscribe (https://digitaldopaminellc.substack.com/subscribe?utm_medium=podcast&#38;utm_campaign=CTA_4)

9. 

   6 May 2026

   Deepfake Disco

   This Is Where We Are…… It pains me to see society slowly but predictably corrode. We’ve had scammers and thieves long before the age of technology, but there’s just something uniquely dark about Deepfake technology, where many people can’t decipher the difference between the deepfake and the real person. Visual deception was the limit with deepfakes for a while; it was possible to mimic a face with a near 1:1 accuracy but as soon as voice came into play, the jig was up. Now, with the vast improvement in AI models and audio generation, voice deception is more accurate than ever, and it’s extremely worrying. The Baby boomer generation was typically the demographic scammed by phone salesmen or offshore scammers via phone or email, but now, with deepfakes being able to mimic voices of your loved ones, that opens the door for many of the younger generations to be scammed as well. So I want to educate as many folks as I can to help them combat the rise of deepfake scams, as well as give a quick overview of what deepfakes are in general and the problems around the tech. What Are Deepfakes? Deepfakes are images, videos, or audio that have been edited or generated using artificial intelligence (https://en.wikipedia.org/wiki/Generative_artificial_intelligence), AI-based tools, or audio-video editing software. They may depict real or fictional people and are considered a form of synthetic media (https://en.wikipedia.org/wiki/Synthetic_media), that is, media that is usually created by artificial intelligence systems by combining various media elements into a new media artifact. That’s a general definition and should give you an idea of where we are headed. The faster and more intelligent we make AI, the better these deepfakes and scams will get. For a bit of history, an early project called the "Video Rewrite" program was published in 1997. The program modified existing video footage of a person speaking to depict that person mouthing the words from a different audio track.[34] (https://dl.acm.org/doi/10.1145/258734.258880) It was the first system to fully automate this kind of facial reanimation, and it did so using machine learning techniques to make connections between the sounds produced by a video's subject and the shape of the subject's face. Fast forward some years, the deepfakes we know today stem from generative adversarial networks (GANs). It was developed in 2014 and published in a research paper by researcher Ian Goodfellow (https://en.wikipedia.org/wiki/Ian_Goodfellow) and his colleagues. A GAN is a machine learning (https://www.ibm.com/think/topics/machine-learning) model designed to generate realistic data by learning patterns from existing training datasets. It operates within an unsupervised learning (https://www.ibm.com/think/topics/unsupervised-learning) framework by using deep learning (https://www.ibm.com/think/topics/deep-learning) techniques, where two neural networks (https://www.ibm.com/think/topics/neural-network) work in opposition—one generates data, while the other evaluates whether the data is real or generated. The “Generator” creates synthetic content, and the “Discriminator” evaluates whether the content is real. This back and forth eventually makes the fake content look as real as possible. Think of it like sharpening a sword against a steel block. Every time the sword (the Generator) is run against the steel block (the Discriminator), the sword gets sharper. Deepfakes entered the mainstream in 2018, with the release of accessible open-source deepfake tools like DeepFaceLab. In 2023, the deepfake tool market skyrocketed, with a 44% increase in the development of these tools (https://humanizeai.com/deepfake-tools-statistics/). It’s Pretty Messed Up Tech Deepfakes are f’d up….. Not much more to elaborate on there lol. While deepfakes could be used to make appropriate parodies, 9 times out of 10 it’s used for things like creating synthetic media of world leaders or creating content combining copyrighted media, along with other nefarious purposes. There is a huge concern amongst academics around deepfakes promoting disinformation, violence, and hate speech. Unfortunately, the creation of non-consensual explicit content of women has served as a motivating factor for the rising popularization of deepfake tools. The problem is rampant, with Security Hero (https://www.securityhero.io/state-of-deepfakes/) reporting that in 2023, approximately 98% of deepfake videos online are explicit in nature, and only 1% of targets in that category are male. Researchers have also shown that deepfakes are expanding into other domains such as medical imagery. In this work, it was shown how an attacker can automatically inject or remove lung cancer in a patient's 3D CT scan (https://en.wikipedia.org/wiki/Optical_coherence_tomography). The result was so convincing that it fooled three radiologists and a state-of-the-art lung cancer detection AI. To demonstrate the threat, the authors successfully performed the attack on a hospital in a white hat penetration test.[37] (https://www.usenix.org/conference/usenixsecurity19/presentation/mirsky) Another example is a sophisticated scam using AI-generated video and voice that nearly compromised a well-known crypto developer linked to the Cardano ecosystem (https://blockonomi.com/cardano-foundation-deepfake-scam-targets-developer-as-cz-issues-warning/). The attacker impersonated Pierre Kaklamanos, Head of Digital Assets Adoption at the Cardano Foundation, during what appeared to be a legitimate Microsoft Teams call. The target, developer Big Pey, said the scam almost succeeded after he followed instructions during the fake meeting. There are plenty of other domains that this can have a negative impact on, escpecially is we continue down the line of tokenization. We’d then be faced with deepfake contracts and deeds, getting people to sign away assets and funds to the attacker without even knowing it. How to Protect Yourself Protecting yourself is going to be the best way to avoid being scammed or caught up in a deepfake scheme. So it’s good to know a handful of the things to look out for and the best practices to follow to not be a victim of fraud. Verify Before You Trust If you receive an unexpected call, video, or message from someone claiming to be a family member, colleague, or authority figure — especially one asking for money or sensitive information — verify their identity through a separate channel. Call them back on a known number, or reach out via text/email independently. Example: If "your son" calls saying he's broke and needs some funds wired immediately, hang up and call his actual phone number before doing anything. Establish a Family Safe Word One of the most practical defenses against voice deepfakes is creating a secret code word with close family and friends. If someone calls claiming to be them in an emergency, ask for the safe word. No legitimate loved one will be offended. Example: A family could agree that the word "pineapple" must be said if any family member ever calls asking for urgent financial help. Slow Down — Urgency Is the Red Flag Deepfake scammers rely on panic and urgency to short-circuit your critical thinking. If any call, video, or message is pressuring you to act right now, that's your cue to pause. Scammers don't want you to have time to verify. Legitimate emergencies almost always have a moment to double-check. Use Multi-Factor Authentication (MFA) Everywhere Even if a scammer uses a deepfake to impersonate you to a bank or service provider, MFA adds a critical extra barrier. A voice or face alone shouldn't be enough to authorize anything sensitive — and if a service is relying solely on those for verification, that's a concern worth raising with them. Facing This Issue Head On Deepfakes are here and here to stay. The threat and its consequences are very real and present (https://www.dhs.gov/sites/default/files/publications/increasing_threats_of_deepfake_identities_0.pdf). Deepfakes today are at the point of undermining trust in the online identity verification process that many organizations, especially in the financial sector, have come to rely upon. With more people than ever authenticating themselves using biometrics across all their devices, the growth in the malicious use of deepfakes can lead to a dire need to rethink authentication security (https://www.forbes.com/councils/forbestechcouncil/2024/08/02/in-the-deepfake-era-its-time-to-overhaul-identity-verification/) within the next five years, or sooner. As shown in the examples, the barrier to entry for creating realistic deepfakes has dramatically decreased. From cloned voices to full video impersonations, deepfakes empower scammers and fraudsters in ways that are harder to detect and defend against. Understanding the threat is the first step to defending against it. With more end-user security training and by leveraging emerging deepfake detection tools, organizations and individuals can begin to fight back against this new threat. We also have to help our elders and loved ones who aren’t tech-savvy get up to speed with this rising threat, so they too can be prepared to combat deepfakes. If you want to keep up with my work or want to connect as peers, check out my social links below and give me a follow! * 🦋 Bluesky (https://bsky.app/profile/digitaldopamine.dev) * 📸 Instagram (https://www.instagram.com/digital_dopamine_llc/) * ▶️ Youtube (https://youtube.com/@digitaldopaminellc?si=sujxCAMyboNvidiW) * 💻 Github (https://github.com/kdleonard93) * 👾 Discord (https://discord.com/users/407639833146818570) Get full access to Digital Dopamine at digitaldopaminellc.substack.com/subscribe (https://digitaldopaminellc.substack.com/subscribe?utm_medium=podcast&#38;utm_campaign=CTA_4)

10. 

    21 Apr 2026

    Hack w/ Me Episode 3: Linux Basics + VMs

    Intro Sup folks, my last completed module was about the basics of Linux, so that’s what this episode will be about. However, I’ll be covering a bit more than we covered in the module. Within TryHackMe, we covered basic commands, working with the filesystem, shell operations, flags & switches, and automation, to name a few. But what I also want to cover is how to get a Virtual Machine booted up using “Kali Linux”, which is a Linux distribution designed for digital forensics (https://en.wikipedia.org/wiki/Digital_forensics) and penetration testing (https://en.wikipedia.org/wiki/Penetration_test). That will involve us getting familiar with UTM, a full-featured system emulator and virtual machine host for iOS and macOS (sorry, Windows users, it might not be a 1:1 comparison on how to start the VM locally). We’ll also go through the entire process of installation of the distribution and even try our hand at a fun lil script 😏. Before we get into the hands-on sections of this episode, let’s go over some Linux basics. Lil Linux Lore The name "Linux" is actually an umbrella term for multiple OS's that are based on UNIX (another operating system). Thanks to Linux being open-source, variants of Linux come in all shapes and sizes - suited best for what the system is being used for. For example, Ubuntu & Debian are some of the more commonplace distributions of Linux because they are so extensible. For example, you can run Ubuntu as a server (such as websites & web applications) or as a fully-fledged desktop. While the TryHackMe module uses Ubuntu, when we are setting up our own VM, we will be using Debian, since that’s what Kali Linux is based on. When it comes to the commands and execution, though, both distributions should function very similarly. "Linux" is often used to refer to the entire operating system, but in reality, Linux is the operating system kernel, which is started by the boot loader, which is itself started by the “Basic Input/Output System”/”Unified Extensible Firmware Interface” (BIOS/UEFI). The kernel assumes a role similar to that of a conductor in an orchestra—it ensures coordination between hardware and software. And no, I did not come up with that analogy myself lol. But enough of the technical jargon, let's get our VMS set up, then dive into some basics. Setting Up Your VM There are a handful of steps to properly set up both of the VMs we will be using in this episode, so I created a quick video to help walk through each step of the process while notating some of the known bugs when it comes to getting the “Kali Linux” VM set up. Quick Setup Summary UTM * We will need UTM as our emulator. Download and install it → https://mac.getutm.app (https://mac.getutm.app) Kali * Download the ISO image from their site → https://www.kali.org/get-kali/#kali-installer-images (https://www.kali.org/get-kali/#kali-installer-images). Make sure you are downloading the right image for the architecture you’re on. * Follow their official guide once you have it downloaded → https://www.kali.org/docs/virtualization/install-utm-guest-vm/ (https://www.kali.org/docs/virtualization/install-utm-guest-vm/) ParrotOS * Download the pre-configured UTM from ParrotOS - Home → https://www.parrotsec.org/download/ (https://www.parrotsec.org/download/) * Follow their official installation guide → https://www.parrotsec.org/docs/virtualization/utm-configuration (https://www.parrotsec.org/docs/virtualization/utm-configuration) Once you have both of these VMs installed, we are ready for action! The Basics Commands Now, when it comes to commands, if you are familiar with macOS terminal commands, you should feel at home with Linux. Apple’s macOS is based on UNIX as well, so a lot of the commands for filesystem management, shell commands, and shortcuts should be identical. Let’s start with the very basic command echo. echo will output any text that we provide. Check out this screenshot below. You can see the simple command input and the output. There are various use cases for using echo from debugging to getting environment variables in a safe manner, and we will for sure be using some of them throughout this series. Another basic command is whoami to find out what user we're currently logged in as. That’s the only function there, lol, a one-and-done command. You can see in the screenshot above that I’m logged in as “mortaniel”. Next we have pwd which stands for “print working directory”, and this just prints out where you are currently in your filesystem within your terminal. The ls command prints out the contents of the directory you’re in. The last command I wanna mention here is cd, which lets you navigate into certain directories. Below you can see me navigate into “Desktop” and I used ls to list out the contents on my VM’s desktop, which is just a custom folder named “Best Folder”. There are TONS of other commands available to use, and we’d be here all day if I tried listing them out with their use cases. For instance, the find command is very useful and worth covering; I just have to spare the time to fit everything under an hour. It would be extremely boring too 😂, and besides, there are going to be commands I use later in this episode and will provide a quick definition of what it is when I reference/use them. So let’s move on to the next section, where I want to discuss SSH. Secure Shell: Operations & Deploy Secure Shell (SSH) is the common means of connecting to and interacting with the command line of a remote Linux machine. In TryHackMe, we deploy two machines: * The Linux machine * The TryHackMe AttackBox Where we go over common shell operations as well as how to use it to remotely log into the Linux Machine. So, what we’ll do is create 2 VMs locally to emulate what we’re doing in TryHackMe (or at least as close as possible). The main VM we will make should be a standard setup in terms of memory and storage allocation. This will be our “Attack Box”, and it will be using Kali Linux. The second VM we create will be our “Target Linux Machine”, and I’ll use ParrotOS for this one, to change it up a bit. You are more than welcome to use 2 Kali Linux VMs. Ubuntu, being the 2nd VM, is ideal if you can get it set up, but I’m having compatibility issues that I don’t feel like resolving, so I'm stuck with 2 different Debian-based distros. I’ll walk through how to set both up a bit later on, but our Attack Box will be where we get to test out some of these shell commands. I’m also going to walk through a cool and simple exploit to give an idea of what’s capable in the world of pen testing. A few of those operations are as follows: * &: This operator allows you to run commands in the background of your terminal. * &&: This operator allows you to combine multiple commands together in one line of your terminal. * >: This operator is a redirector - meaning that we can take the output from a command (such as using cat to output a file) and direct it elsewhere. * >>: This operator does the same function of the > operator but appends the output rather than replacing (meaning nothing is overwritten). If we want to get into more details on each operator: Operator “&” This operator allows us to execute commands in the background. For example, let’s say we want to copy a large file. This will obviously take quite a long time and will leave us unable to do anything else until the file is successfully copied. The “&” shell operator allows us to execute a command and have it run in the background (such as this file copy), allowing us to do other things! Operator “&&” This shell operator is a bit misleading in the sense of how familiar is to its partner “&”. Unlike the “&” operator, we can use “&&” to make a list of commands to run for example command1 && command2. However, it’s worth noting that command2 will only run if command1 was successful. Operator “>” This operator is what’s known as an output redirector. What this essentially means is that we take the output from a command we run and send that output to somewhere else. A great example of this is redirecting the output of the echo command that we learned in Task 4. Of course, running something such as echo wordsILoveToSay will return “wordsILoveToSay” back to our terminal — that isn’t super useful. What we can do instead is redirect “wordsILoveToSay” to something such as a new file! Let’s say we wanted to create a file, and I’ll name it newFile with the message “sup”. We can run echo sup > newFile where we want the file created with the contents “sup” like so: Now I personally don’t see much use of this other than allowing users to save command results directly to a file for later but I feel that’s something you’d just work on in whatever file you are writing code in. I could be missing the nice use case and maybe it’ll come to me in practice. That leads us to the “>>” operator. Operator “>>” This is pretty much an extension of the previous command. But instead of creating or replacing an entire file with the new command, this operator appends the output. These are just very basic Linux commands, and I’m sure I’ll find more use for them the more I dabble. There is a lot more basic knowledge that I feel is useful but to go into detail on each one would make this a very long episode. So in the next section, im just going to list the command, give a quick definition, and show an example screenshot if applicable. The File System Navigating the file system is extremely important, but can be summed up clearly, in which your file system is like your playing field in an RPG, table top, or digital. In that RPG’s playing field/world (the filesystem), there are many paths that you can take once you leave home (different paths like /Home/Desktop/Pictures & /Home/Downloads/cool_img.jpg). But you can always come back home and even further, go back to your root(s)…aka /~. I haven’t seen anyone make a similar analogy, so I’m gonna call dibs on that until further notice 😏. But you want to be able to navigate your file system(s) effortlessly, because sometimes time is not on your side when trying to execute an exploit or defend yourself from one. Terminal Text Editor If you’re a command-line wizard, you’d probably want to do everything in one location, including code updates. Well, there’s a way for you to do just that by accessing a code editor in your terminal window with Nano or VIM Nano (GNU nano) is a text editor (https://en.wikipedia.org/wiki/Text_editor) for Unix-like (https://en.wikipedia.org/wiki/Unix-like) computing systems or operating environments using a command line interface (https://en.wikipedia.org/wiki/Command_line_interface) that emulates the Pico (https://en.wikipedia.org/wiki/Pico_(text_editor)) text editor. It can be initialized with nano {fileName}. For example lets say in the “Best Folder” I created on my Kali Linux VM, I wanted to create a new file with text and then make a longer edit to the file. Instead of doing a bunch of ”>>” operations, we can just open up the file and make the full text change as needed. Quick little video of me doing just that: This is an oversimplification of Nano’s use, but you get the picture of the capabilities. VIM is a much more advanced text editor. Some of VIM’s benefits, albeit taking a much longer time to become familiar with, include: * Customisable - you can modify the keyboard shortcuts to be of your choosing * Syntax Highlighting - this is useful if you are writing or maintaining code, making it a popular choice for software developers * VIM works on all terminals where nano may not be installed * There are a lot of resources, such as cheatsheets (https://vim.rtorr.com/), tutorials, and the like, available to use. VIM, however, needs to be installed on your OS if it isn’t already from your distro you installed (in my case, it was). So, below is another quick video of how to get this installed, and I will make another edit to the file we altered using Nano. This video has a bit of rambling and is NOT shorter than the one for Nano 😅. But after understanding the basics of Nano and VIM, you are well on your way to becoming a command-line hero. General Utilities There are a handful of general utilities at our disposal, but I want to make sure I cover downloading files, secure copy transfers, and serving files from a separate server. Secure Copy (SCP) Secure copy is as it seems, a means of securely copying files. Working with it requires only a SOURCE and a DESTINATION. Unlike the regular cp command, this command allows you to transfer files between two computers using the SSH protocol to provide both authentication and encryption. It goes 2 ways, you can: * Copy files & directories from your current system to a remote system * Copy files & directories from a remote system to your current system Provided that we know usernames and passwords for a user on your current system and a user on the remote system. For example, let's copy an example file from our machine to a remote machine, which I pulled from TryHackMe: With this information, we can craft our scp command (remembering that the format of SCP is just SOURCE and DESTINATION): scp important.txt ubuntu@192.168.1.30:/home/ubuntu/transferred.txt And now let's reverse this and layout the syntax for using scp to copy a file from a remote computer that we're not logged into The command will now look like the following: scp ubuntu@192.168.1.30:/home/ubuntu/documents.txt notes.txt Downloading and serving files To cover these 2, I made another video clip walking through how to accomplish this. I highly recommend watching the video clip so you can see this in action, but to sum it up how TryHackMe has it: Downloading Files (Wget) The wget command allows us to download files from the web via HTTP -- as if you were accessing the file in your browser. We simply need to provide the address of the resource that we wish to download. For example, if I wanted to download a file named "myfile.txt" onto my machine, assuming I knew the web address, it would look something like this: wget https://assets.tryhackme.com/additional/linux-fundamentals/part3/myfile.txt In my video example, I show you how to do this between two VMs. Serving Files Ubuntu machines come pre-packaged with python3. Python helpfully provides a lightweight and easy-to-use module called "HTTPServer". This module turns your computer into a quick and easy web server that you can use to serve your own files, where they can then be downloaded by another computer using commands such as curl and wget. In my example video, we create a new server in my ParrotOS VM using the command python3 -m http.server within the directory where the target file lives, and once that’s running in your Linux machine, you’d run the following command → wget http://:8000/myfile.txt. You can get the IP on whatever machine you’re working with by using ip a. That command will print out something like this: The IP address we want to look for is the inet value on ether, which is 192.168.64.2. So if I were to use this IP in the command from before, it would look like wget http://192.168.64.2:8000/myfile.txt. Sometimes you won't have access to make a GET request to servers you don’t have permission to access. But this leads us to understanding our local permissions Permissions 101 The great thing about Linux is that permissions can be so granular that, whilst a user technically owns a file, if the permissions have been set, then a group of users can also have either the same or a different set of permissions to the exact same file without affecting the file owner itself. Let’s put this into a real-world context; the system user that runs a web server must have permissions to read and write files for an effective web application. However, companies such as web hosting companies will have to want to allow their customers to upload their own files for their website without being the web server system user -- compromising the security of every other customer. Below is an overview of the types of permissions: r - Permission to read. This grants permission only to open and view a file. w - Permission to write. This grants permission only to view and edit a file. x - Permission to execute. This allows users to execute a file (but not necessarily view or edit it). To move ownership of a file to a different user so that they can control permissions, we can use the chown (change owner) command. For example: chown ringo /tmp/coolFile Similarly, you can change ownership from one group to another by using chgrp (change group). In this case, we want to give the security team access to a recently downloaded defensive tool, IDS (intrusion detection system). You would run a command like this: chgrp securityGroup newIDS This comes in handy if you are working with a team of pentesters, but the defensive/security team only needs full access to certain tools. Switching between users on Linux is easy thanks to the su command. Unless you are the root user (or using root permissions through sudo), then you are required to know two things to facilitate this transition of user accounts: * The user we wish to switch to * The user’s password The su command takes a couple of switches that I think are relevant to this explanation, but definitely check out the manual page for su to find out more. I’m just gonna cover the -l switch. By providing the -l switch to su, we start a shell that is much more similar to the actual user logging into the system - we inherit a lot more properties of the new user, like environment variables and such. For example, in the screenshot below, you can see the use of the -l switch and an instance without it. When using su to switch to "ringo", our new session drops us into our previous user's home directory. Whereas, after using -l, our new session has dropped us into the home directory of "ringo" automatically. Now let’s get back to the permissions. As noted before, every file and directory has a set of permissions that control who can read, write, or execute it. These permissions are often displayed in symbolic format, such as: rwxrwxrwx I find it easier to read as rwx|rwx|rwx. This format is split into three groups: Each permission has a numeric value: To calculate the numeric value, we add the values together for each group. Some common examples are: Understanding numeric permissions is important because: * Many Linux commands use numeric values * You can quickly identify security risks * You can control who can access sensitive files For example, we’d use the chmod (change mode) command followed by the numeric permission setting and then end it with the target file or directory, like so: chmod 750 system_overview.txt This means for system_overview.txt: * Owner: full access * Group: read + execute * Others: no access I highly recommend getting familiar with reading, granting, and removing permissions and their numeric format. Still trips me up a bit, but I’m sure over time, I’ll get very accustomed to reading it easily. The last major thing I wanted to discuss was automation. Automation and the Cron Process Users may want to schedule a certain action or task to take place after the system has booted. Take, for example, running commands, backing up files, or launching your favourite programs on, such as Spotify or Google Chrome. So I’ll be talking about the cron process, but more specifically, how we can interact with it via the use of crontabs . Crontab is one of the processes that is started during boot, which is responsible for facilitating and managing cron jobs. A crontab is simply a special file with formatting that is recognised by the cron process to execute each line step-by-step. Crontabs require 6 specific values: Let’s use the example of backing up files. You may wish to back up “mortaniel”’s “Documents” every 12 hours. We would use the following formatting: 0 */12 * * * cp -R /home/mortaniel/Documents /var/backups/ An interesting feature of crontabs is that they also support the wildcard or asterisk (*). If we do not wish to provide a value for that specific field. For example, we don’t care what month, day, or year it is executed -- only that it is executed every 12 hours, we simply place an asterisk. This can be confusing to begin with, which is why there are some great resources, such as "Crontab Generator (https://crontab-generator.org/)", that allows you to use a friendly application to generate your formatting for you, as well as the site "Cron Guru (https://crontab.guru/)". If you need to start cron, you simply run cron. Crontabs can be edited by using crontab -e, where you can select an editor (such as Nano) to edit your crontab. In my example below, I confirmed Cron was running, and I created a new cron job to write out a message in a text file every 2 min. That cron command is: */2 * * * * echo "🔔 Cron fired at $(date)" >> ~/Desktop/cron_demo.txt An easy way to follow that cron job is to tail the file and watch it in your terminal tail -f ~/Desktop/cron_demo.txt Bash Scripting Now let’s have a little fun, we’re gonna create a lil script that will just be a series of questions, inputs, and the final echo statement that combines the input into a sentence. That doesn’t sound exactly thrilling lol, but it will give you a general idea on how to create and execute scripts. Scripts can be executed through many methods and languages. Most interpreted languages (Python, Bash, Ruby, etc.) just need the runtime installed, and then scripts for that language can be run directly from the terminal. Compiled languages (C, Go) need a build step first. The shebang line #!/usr/bin/env python3 lets you run scripts directly as ./python_demo.py on Unix systems, after making them executable with chmod +x python_demo.py. The same thing goes for creating a shell/bash script, just slightly different syntax: #!/bin/bash/ From here, we will then start to build out our script. Now I’ve built the same script in both Python and Shell, just so you can see different flavors of the same code. Python #!/usr/bin/env python3 # Second script # Multi line text name = input("State your name, playa.\n") fruit = input("What's your favorite fruit?\n") print(f"Welcome to the Vice City, {name}. We have the finest {fruit} in the country.") Shell/Bash #! /bin/bash/ # Second bash script # Multi line text echo "State your name, playa." read name echo "What's your favorite fruit?" read fruit echo "Welcome to the Vice City, $name. We have the finest $fruit in the country." Here you can see the 2 different ways to prompt users a couple of questions, storing the answer in a variable, and then printing out the last sentence with the variables included. The main difference here is how Python stores variables and how Shell stores them. I’m not an expert on Shell, but from what I learned, the read command takes the user input and splits the string into fields, assigning each new word to an argument. If there are fewer variables than words, read stores the remaining terms into the final variable. The splitting behavior is more advanced, and typically, you will just be using 1 variable at a time. When it comes to Python, it’s clearly much cleaner in terms of being readable from the jump. You see both the name and fruit variables followed by the “=” operator, which is a clear indication that whatever else follows will be assigned to that variable. In our case, the input() function follows the “=” operator, which tells us that there will be a prompt that a user will need to respond to. That input is then stored in the connected variables. Finally, we print out a full sentence with those variables included. One caveat is that with Python, to include variables inside of strings, we need to use F-strings. With f-strings (formatted string literals), you can directly embed variables and expressions inside strings using curly braces {}, and this was introduced in version 3.6 to make string formatting and interpolation easier. Python remains the most versatile language for scripting and automation in ethical hacking, so any type of scripting or exploits I make in future entries will use Python only, unless a different language serves the exploit better. Below is a quick demo on both scripts and how they are executed in the terminal. Conclusion That about wraps it up for this episode. I’ve only scratched the surface of Linux basics, and there are a handful of other things to look into and get a better understanding of if you want to continue learning the basics: * Flags & Switches * Package management * Logs * Processes I hope that this was very insightful for everyone and that I sparked some interest in folks to invest some time in getting to know Linux a bit deeper ✌🏾. If you want to keep up with my work or want to connect as peers, check out my social links below and give me a follow! * 🦋 Bluesky (https://bsky.app/profile/digitaldopamine.dev) * 📸 Instagram (https://www.instagram.com/digital_dopamine_llc/) * ▶️ Youtube (https://youtube.com/@digitaldopaminellc?si=sujxCAMyboNvidiW) * 💻 Github (https://github.com/kdleonard93) * 👾 Discord (https://discord.com/users/407639833146818570) Get full access to Digital Dopamine at digitaldopaminellc.substack.com/subscribe (https://digitaldopaminellc.substack.com/subscribe?utm_medium=podcast&#38;utm_campaign=CTA_4)

11. 

    23 Mar 2026

    Tokenizing Private Credit, Real Estate, National Debt, and Everything Else

    Blockchain and Tokenization Popularity Boom Tokenization has become one of the new buzzwords in the world of finance. Your 401(k) may already be invested in assets you've never heard of, through technology you don't understand — and the people making those decisions didn't ask your permission.There are a lot of people who barely know much about blockchain, and it’s been around even before cryptocurrency was a thing, and tokenization is just an extension of digital assets. So I feel like I should go over both just a bit. Blockchain A blockchain is a digital ledger, which is a record-keeping system, that stores information across a network of computers rather than in a single centralized location. Think of it as a shared spreadsheet that thousands of computers maintain simultaneously, where every entry is permanent, time-stamped, and visible to participants on the network. Some key features and benefits are: * Decentralization: No single institution (no bank, no government, no company) controls the ledger. It’s maintained by a distributed network of computers (called “nodes”). * Immutability: Once a transaction is recorded, it cannot be altered or deleted. Every entry is cryptographically linked to the one before it, forming a “chain” of “blocks” — hence the name. * Transparency: On public blockchains, every transaction is visible to anyone who looks. This is a feature for accountability, but also a concern for privacy, since financial activity becomes traceable. * Smart contracts: Blockchains can execute automated agreements — code that says “if X happens, then do Y.” For example, a smart contract could automatically distribute rental income to token holders every month without a human intermediary. Tokenization Tokenization is the process of creating a digital token on a blockchain that represents ownership of real-world assets like real estate, art, or stocks, as well as intangible assets such as intellectual property or voting rights. Tokenization enables easier asset transfers, ownership verification, and fractional ownership. Imagine a commercial building worth $10 million. Traditionally, you'd need millions of dollars and a team of lawyers to buy it. With tokenization, the building's ownership can be divided into 10 million tokens worth $1 each. An investor could buy 100 tokens for $100 and own a tiny fraction of that building, receiving proportional rental income and being able to sell those tokens on a digital marketplace. Now this may sound like a scenario where the average Jamal has a seat at the big dawg table, but that fractional piece of ownership will never outweigh the millions or billions of dollars the elite will put in all at once, maybe even taking ownership of all available tokens for that digital asset themselves. How Tokenization Connects Real-World Assets to the Blockchain Let’s cover a bit on exactly how Tokenization Connects Real-World Assets to the Blockchain (https://www.hedgeco.net/news/03/2026/the-26-billion-threshold-for-tokenized-real-world-assets-rwas.html): * The asset exists in the real world — a piece of real estate, a corporate loan, a Treasury bond, shares in an ETF, etc. * A legal structure is created that ties the digital token to legal ownership rights over that asset. This is the critical (and often fragile) link, because the token is only as good as the legal framework backing it. * Tokens are then issued on a blockchain, where they can be bought, sold, held, or used as collateral — 24 hours a day, across borders, without traditional intermediaries like brokers or clearinghouses. But this presents its own issues with cyber criminals and hacking. * Last but not least, Smart contracts automate functions like interest payments, dividend distributions, compliance checks, and transfer restrictions. But what is being tokenized right now, you ask? * U.S. Treasuries and money market funds (~$12 billion tokenized) — led by BlackRock’s BUIDL (https://coinpaprika.com/education/blackrock-buidl-fund-what-it-is-and-how-it-works/) fund and J.P. Morgan’s MONY fund (https://am.jpmorgan.com/us/en/asset-management/adv/about-us/media/press-releases/jp-morgan-asset-management-launches-its-first-tokenized-money-market-fund/) * Private credit (~$9 billion tokenized) — corporate loans that were traditionally opaque and illiquid * Real estate — commercial and residential properties fractionalized for smaller investors * Commodities — tokenized gold and trade receivables * ETFs and fund shares — increasingly being explored for on-chain issuance Who Is Leading The Financial Tokenization Charge Like I just mentioned, tokenization converts ownership of physical or financial assets into digital tokens on a blockchain (real estate, loans, Treasury bonds, ETFs), and we have big players like BlackRock, J.P. Morgan, Goldman Sachs, Franklin Templeton, and Apollo Global Management, leading the charge. The tokenized real-world asset market surpassed a staggering $26 billion by early 2026, which is a fourfold increase from early 2025, with private credit and U.S. Treasuries dominating. The Private Credit Problem Large lenders, including BlackRock, Blue Owl, and J.P. Morgan, have restricted investor withdrawals from private credit funds amid rising interest rates and borrower distress. Businesses that took on these loans are struggling to service their debt, and what most people don’t know is that tokenization is being positioned as a solution. The plan is to create secondary markets for these illiquid loans, fractionalize them, and potentially offload the risk to a broader pool of investors. Some might call this a genuine innovation in the digital landscape of finance, but I call it transferring risk from institutional balance sheets to less sophisticated investors. The private credit market is sitting at a staggering $3 trillion (https://www.npr.org/2026/03/19/nx-s1-5747128/private-credit-equity-jamie-dimon-wall-street), and investors want out, which could cause major ripple effects in the broader markets. Now I can go deep into a rabbit hole on the issues in the private credit market alone, but let’s stick to our focus on the tokenization of all these connected issues. The 401(k) Pipeline Back in August 2025, President Trump signed an executive order directing the Department of Labor to open 401(k) plans to alternative investments, including private equity, private credit, and digital assets. Essentially, just giving America’s $13.9 trillion in defined-contribution retirement plans to private-asset giants like Apollo, Blackstone, and BlackRock. Target Date Funds — where most workers’ 401(k) money sits by default — were designed for daily liquidity, transparency, and public markets. They were never built to house illiquid private equity or gated real estate. As one longtime fiduciary advisor put it: “This quiet push isn’t democratization. It’s risk transfer.” And a lot of workers typically have little or no say in how their plan providers allocate funds. The risks are substantial on multiple fronts: (https://ideas.darden.virginia.edu/private-assets-retirement-plans) * You have higher fees than traditional index funds. * Your money is locked up for years. * It’s less transparent in terms of knowing which companies took out these risky loans. * And there’s no guarantee of performance. Legal experts warn that many plan committees lack the expertise to evaluate private market investments, and attorneys are already watching for ERISA fiduciary violations — ERISA being the 1974 federal law (https://www.dol.gov/general/topic/retirement/erisa) specifically designed to protect workers in retirement plans like these. The Security Problem No One Wants to Talk About Tokenization’s promise depends entirely on the security of the systems holding these assets. And right now, those systems are under siege from every direction — nation-states, organized crime, AI-powered scam operations, and even physical violence. State-Sponsored Theft: The North Korea Problem North Korean hackers, operating under the umbrella group known as Lazarus Group, stole $2.02 billion in cryptocurrency in 2025 alone (https://www.nbcnews.com/tech/crypto/north-korea-stole-billions-crypto-2025-new-research-says-rcna249738) — a 51% increase from the prior year and their all-time record. Their cumulative total now exceeds $6.75 billion. The single largest heist was the February 2025 Bybit hack: $1.5 billion in Ethereum stolen (https://www.bbc.com/news/articles/c2kgndwwd7lo) by compromising a third-party wallet provider’s developer through social engineering. The FBI formally attributed the attack to North Korea’s TraderTraitor unit. What makes this especially relevant to tokenization is that these hackers aren’t breaking the blockchain itself. They’re targeting the human and operational layers around it — the developers, the wallet software, and the interfaces people actually use. When real-world assets like Treasury bonds, real estate, and private credit are tokenized and held in similar infrastructure, the attack surface for nation-state hackers grows enormously. We’re no longer talking about stolen cryptocurrency; we’re talking about the potential theft or manipulation of tokenized deeds, loan obligations, and retirement fund shares. North Korea is the only country in the world known to use state-sponsored hacking primarily for financial gain, and the proceeds fund its nuclear and missile programs. A senior Biden administration official estimated that roughly 50% of North Korea’s foreign-currency earnings come from cybercrime. Now, just think about your 401(k) assets becoming tokenized on the same kind of infrastructure these hackers are already systematically exploiting; the risk is no longer theoretical. The AI-Powered Fraud Explosion AI is becoming embedded in everything and is becoming more of a security risk for our everyday lives today, without even considering tokenization. Crypto scam losses hit an estimated $17 billion in 2025, according to Chainalysis. These AI-powered scams — using deepfake video calls, cloned executive voices, and automated social engineering (https://us.norton.com/blog/online-scams/top-5-ai-and-deepfakes-2025) — extracted 4.5 times more money than traditional scams. Impersonation scams surged 1,400% year over year. One investor lost $284 million in a single phishing attack after scammers impersonated hardware wallet support staff. (https://beincrypto.com/crypto-theft-loses-january-2026/) As tokenized assets become more mainstream, these same techniques will be weaponized against retail investors, plan administrators, and the platforms managing tokenized 401(k) assets. Imagine AI-generated deepfakes impersonating your retirement plan administrator, or phishing campaigns targeting the custodians holding tokenized private credit. The technology for these attacks already exists and is being used at industrial scale. Physical Violence: “Wrench Attacks” Here’s one most people don’t think about. As crypto values have risen and adoption has spread, criminals have increasingly turned to physical violence to steal digital assets. In 2025, verified physical attacks on crypto holders surged 75% year over year (https://www.coindesk.com/markets/2026/02/02/crypto-crime-is-getting-violent-wrench-attacks-jumped-75-in-2026) — kidnappings, home invasions, armed robbery, even torture. In one Canadian case, a family was held hostage overnight, waterboarded, and sexually assaulted for their Bitcoin (https://cryptonews.com/news/canada-bitcoin-wrench-attack-sentence/). In France, the co-founder of crypto wallet company Ledger had his finger severed (https://fortune.com/crypto/2025/05/05/father-crypto-millionaire-rescued-held-ransom-finger-severed/) by kidnappers demanding ransom. A crypto entrepreneur and his wife were murdered in the UAE (https://www.theweek.in/news/middle-east/2025/12/04/poured-into-concrete-chilling-details-of-russian-crypto-millionaire-roman-novak-s-murder-in-dubai-uncovered.html) during a staged business meeting. These aren’t isolated incidents. Security firm TRM Labs documented roughly 60 reported physical assaults on crypto holders in 2025, and the actual number is likely significantly higher since many go unreported. Organized crime groups are outsourcing the violence to local gangs, and it’s not just the crypto millionaires but teachers, construction workers, and firefighters — anyone whose crypto holdings become visible. As tokenization expands and more people hold digital representations of real-world assets, the risk of physical targeting will grow alongside it. KYC databases that link real identities to wallet addresses, crypto ATMs, and regulated exchange accounts all create new vulnerabilities if breached. The Quantum Computing Horizon Another area we need to consider is quantum computing. Current blockchain security depends on mathematical problems that are impossible for today’s computers to solve. A sufficiently powerful quantum computer could theoretically derive private keys from public keys, enabling signature forgery and asset theft. Blockchain developers are working on post-quantum cryptography, and NIST has already standardized new signature schemes. But the transition will be slow and complex, and tokenized assets sitting on blockchains that haven’t migrated to quantum-resistant cryptography will be vulnerable. An IBM study estimated that quantum computing could compromise up to 40% of current cryptographic systems without preparation. The Institutional Trust Gap A recent survey of asset managers found that nearly half (48%) who don’t yet offer tokenized funds ranked cybersecurity resilience as their single top concern. Among asset owners, 63% selected cybersecurity as one of their most important criteria for choosing a tokenized services provider. The fundamental tension: blockchain’s immutability — the very feature that makes it trustworthy — becomes a liability when a breach occurs. Unlike in traditional finance, reversing or correcting a fraudulent transaction on a blockchain is far more complex, and in many cases, impossible. A bad loan on paper can be restructured. A stolen token is usually gone for good. If the financial industry is going to tokenize trillions of dollars in assets — including the retirement savings of millions of ordinary workers — the security infrastructure needs to be built to a standard that doesn’t yet exist. And until it does, every tokenized asset sitting on these systems carries a risk that most investors will never be told about. The Dollar, Stablecoins, and The Debt Question Stablecoins and the GENIUS Act Now that leads us to discuss the broader monetary backdrop and the huge issue with our national debt. President Trump banned federal CBDC development in January 2025 (https://bitcoinmagazine.com/politics/president-trump-signs-executive-order-to-ban-central-bank-digital-currencies-cbdc), but the administration simultaneously championed private stablecoins via the GENIUS Act, signed into law in July 2025 (https://en.wikipedia.org/wiki/GENIUS_Act). Stablecoins are private digital currencies pegged to the dollar and typically backed by U.S. Treasuries and, in some cases, commodities — they've surged to a $312 billion market. Let's not forget, Trump called Bitcoin 'a scam' and 'a disaster waiting to happen' on national television in 2021 (https://www.businessinsider.com/trump-called-crypto-scam-now-owns-million-ethereum-disclosure-bitcoin-2024-8?op=1). He said crypto was 'based on thin air.' Then, once he realized there was money to be made — NFTs in 2022, $1 million+ in Ethereum by 2024, and a $TRUMP meme coin in January 2025 — he did a complete 180 and declared himself the 'crypto president.' So when this same administration bans a government-issued digital dollar while signing the GENIUS Act to hand the digital payments infrastructure to private stablecoin companies, you have to ask: who is this really for? That's a rhetorical question — we know who it's for: the elite and billionaires of this country. The ban was framed as protecting Americans from government surveillance. But the practical effect is that the dollar is going digital regardless — the only question is whether public accountability or private profit drives it. Just to be clear, scammers are in most industries, and crypto is not a special place where only scammers benefit. There are good actors and great technology + services within the industry that have been overshadowed by scammers for quite some time. We also have to understand that the dollar is getting weaker and weaker (https://www.atlanticcouncil.org/blogs/what-the-data-shows-and-doesnt-show-about-the-future-of-the-dollar/) as our debt grows. Folks want to act as if dollar dominance will last forever, but we need to give up that pipe dream. Empires don’t last forever, especially when the people who control the money and legislation creation continue to exploit anyone who isn’t in the top 1% of wealthy individuals. Capitalism is, in a lot of ways, cannibalistic. It’s also worth noting that the Senate voted 89-10 this month, March 2026, to extend that ban on a government-issued digital dollar through at least 2030. (https://www.forbes.com/sites/tonyaevans/2026/03/13/the-senate-just-banned-a-digital-dollar-here-are-3-things-to-watch/) However, Washington is still backing private stablecoins, and the ban extension, which was included in the “ROAD to Housing Act” (https://www.congress.gov/bill/119th-congress/senate-bill/2651/text) bill, is still not signed into law. So no one knows if the extension will become a reality. The Dollar and the Debt Problem 39 trillion dollars……We just surpassed 39 trillion dollars in national debt, and our interest payments are 900 billion a year, and we the taxpayers, are footing that ginormous. The strategic logic is clear as day: widespread stablecoin adoption creates artificial demand for U.S. Treasury securities, helping the government service its enormous national debt by pushing borrowing costs down. Stephen Miran, a former top economic adviser to Trump and now a Federal Reserve committee member, has argued stablecoins could lower interest rates by as much as 0.4 percentage points. But critics argue this amounts to privatizing the monetary system — handing the infrastructure of digital payments to private companies (like Tether and Circle) that face far less oversight than banks, while creating a parallel financial layer where instability could cascade into the real economy. Leading economist Adam Posen of the Peterson Institute (https://www.piie.com/experts/senior-research-staff/adam-s-posen) has warned that he is “fundamentally very worried about financial stability in the United States,” citing stablecoin issuers’ insufficient regulation, potential cross-selling of risky crypto products, and the danger of a run if trust collapses. The dollar fell 9% in 2025 — its worst year since 2017 — driven by Fed rate cuts, tariff chaos, and broader uncertainty about U.S. economic management. If stablecoins or tokenized products destabilize, the ripple effects could reach the savings and retirement accounts of millions who never chose to be exposed to these instruments. Whether through a CBDC or stablecoins, the risk to savers is similar: if the underlying monetary system is being restructured to service national debt rather than protect purchasing power, the people holding dollars — in savings accounts, in 401(k)s, in paychecks — are the ones who absorb the cost. The Average Person/Investor Gets Left Holding The Bag I wanna be annoyingly clear about this: The people most at risk are those least involved in the decision-making. Workers whose 401(k) providers quietly allocate their retirement savings into private credit and alternative assets without meaningful disclosure, and savers whose purchasing power deteriorates as the dollar weakens and monetary policy contorts to service national debt. I mean, who the hell reads crypto whitepapers other than nerds like me? And even I have only read a few of them; S**t is overwhelming 😂. Your average Jamal doesn’t monitor blockchain ledgers; they just expect their retirement to be there when they need it or are ready to cash out. Why All of This Is Important to Know The promise of tokenization is real in theory: lower costs, faster settlement, broader access, and greater transparency. But the crucial issue is who benefits and who bears the risk. When major financial institutions tokenize their private credit portfolios, they gain liquidity and new distribution channels. When those tokenized products get funneled into workers’ 401(k)s through Target Date Funds, the risk is silently transferred to people who never asked for exposure to speculative, illiquid, complex assets — and who most likely won’t know they have it. Tokenization doesn’t eliminate the underlying risk of an asset. A bad loan is still a bad loan whether it’s on paper or on a blockchain. What tokenization does is make that loan easier to slice up, repackage, and sell to someone else. If this sounds familiar and worrisome, it should because it echoes the mortgage-backed securities that fueled the 2008 financial crisis, where complex instruments were distributed widely before anyone fully understood the risks embedded in them. The difference this time is that the packaging is digital, the plumbing is blockchain, and the people holding the bag may not even know what a token even is. If you want to keep up with my work or want to connect as peers, check out my social links below and give me a follow! * 🦋 Bluesky (https://bsky.app/profile/digitaldopamine.dev) * 📸 Instagram (https://www.instagram.com/digital_dopamine_llc/) * ▶️ Youtube (https://youtube.com/@digitaldopaminellc?si=sujxCAMyboNvidiW) * 💻 Github (https://github.com/kdleonard93) * 👾 Discord (https://discord.com/users/407639833146818570) Get full access to Digital Dopamine at digitaldopaminellc.substack.com/subscribe (https://digitaldopaminellc.substack.com/subscribe?utm_medium=podcast&#38;utm_campaign=CTA_4)

12. 

    10 Mar 2026

    The Coruna iOS Exploit & The Major Issues With The Commercial Surveillance Industry

    So What Is the Coruna Exploit? The Coruna iOS exploit framework is a new and powerful exploit kit targeting Apple iPhone models running iOS 13.0 (released in September 2019) up to version 17.2.1 (released in December 2023). It was identified by Google Threat Intelligence Group (GTIG) and iVerify. The exploit contained five full iOS exploit chains and a total of 23 exploits. The core technical value of this exploit kit lies in its comprehensive collection of iOS exploits, with the most advanced ones using non-public exploitation techniques and mitigation bypasses. GTIG has been tracking this exploit since 2025, and at first, that threw me off a bit. Like, you mean to tell me this has just been out in the wild for a whole year without any major reporting on it? But that’s exactly what they do. There’s another report from 08-29-2024 from Google that states, “Today, we’re sharing that Google’s Threat Analysis Group (TAG) observed multiple in-the-wild exploit campaigns, between November 2023 and July 2024, delivered from a watering hole attack on Mongolian government websites.” (https://blog.google/threat-analysis-group/state-backed-attackers-and-commercial-surveillance-vendors-repeatedly-use-the-same-exploits/) Now I’m still new to cyber security and threat intelligence, so I don’t know if there are procedures around exploit discovery that require monitoring to understand them. To be honest, that kinda makes sense as I say it out loud, so maybe there’s some truth to that assumption. But these specific campaigns first delivered an iOS WebKit exploit affecting iOS versions older than 16.6.1 and then, later, a Chrome exploit chain against Android users running versions from m121 to m123. These were n-day exploits for which patches were available, but would still be effective against unpatched devices. They assessed that, “with moderate confidence, the campaigns were linked to the Russian government-backed actor APT29”. This leads me back to the Coruna exploit, because it seems like security vendors that are goverment backed have increasingly become more and more careless with who they sell the exploits to. That’s right folks, commercial spyware is sold to the government and other brokers. And it’s becoming more common that once spyware or an exploit capability is sold, control over the end customer is lost. Brokers can’t be trusted with these capabilities, and business-to-business transactions over the spyware market are highly unregulated. Now, this lack of control helped launch discussions about responsible use of spyware and aligning on a formal voluntary framework for its use called the Pall Mall Process (https://www.lawfaremedia.org/article/the-pall-mall-process-on-cyber-intrusion-capabilities). But those discussions are ongoing, and the economic pressures for spyware companies to return a profit mean these tools are being sold to a broader array of organizations. Some things just should’t be based on the constant need for a return on investment, and at the end of the day, Capitalism is to blame for this industry getting sloppy with its handling of exploits. Google is actually more on the forefront of reporting the slippery slope we are in when it comes to the unchecked commercial surveillance industry, and there is a great report you can read here → “Buying Spying” (https://storage.googleapis.com/gweb-uniblog-publish-prod/documents/Buying_Spyin). I highly recommend the read regardless of your interest in CS, because whether you like it or not, these leaks or unethical sales of spyware affect all of us. So I want to elaborate on the definition of these attacks and exploits. 0-day Exploits A 0-day is a vulnerability (https://en.wikipedia.org/wiki/Vulnerability_(computer_security)) or security hole in a computer system unknown to its developers or anyone capable of mitigating (https://en.wikipedia.org/wiki/Mitigation) it. Until the vulnerability is remedied, threat actors (https://en.wikipedia.org/wiki/Threat_actor) can exploit (https://en.wikipedia.org/wiki/Exploit_(computer_security)) it in a zero-day exploit or zero-day attack. The term "zero-day" originally referred to the number of days since a new piece of software was released to the public, so "zero-day software" was obtained by hacking into a developer's computer before release. Eventually, the term was applied to the vulnerabilities that allowed this hacking, and to the number of days that the vendor has had to fix them. Vendors who discover the vulnerability may create patches or advise workarounds to mitigate it, though users need to deploy that mitigation to eliminate the vulnerability in their systems. Zero-day attacks are severe threats. Watering Hole Watering hole is a computer attack (https://en.wikipedia.org/wiki/Attack_(computing)) strategy in which an attacker guesses or observes which websites an organization's users frequently use and then uses one or more of the websites to distribute malware (https://en.wikipedia.org/wiki/Malware). Eventually, some member(s) of the targeted users will become infected. Attackers looking for specific information may only target users coming from a specific IP address (https://en.wikipedia.org/wiki/IP_address). This also makes the attacks harder to detect and research. The name is derived from a strategy of predators in the natural world, who wait for an opportunity to attack their prey near watering holes (https://en.wikipedia.org/wiki/Watering_hole). The attack strategy was named in an RSA blog in 2012. These are just 2 of many different types of attacks and exploits that threat actors use to gain confidential information or credentials from their targets. If you’re interested in learning about more common attacks, you can check out this article from Fortinet → https://www.fortinet.com/resources/cyberglossary/types-of-cyber-attacks (https://www.fortinet.com/resources/cyberglossary/types-of-cyber-attacks), where they go over the 20 most common attacks and exploits. Initial Discovery: The Commercial Surveillance Vendor Role In February 2025, GTIG captured parts of an iOS exploit chain used by a customer of a surveillance company. The exploits were integrated into a previously unseen JavaScript framework that used simple but unique JavaScript obfuscation techniques. The framework starts a fingerprinting module, collecting a variety of data points to determine if the device is real and what specific iPhone model and iOS software version it is running. Based on the collected data, it loads the appropriate WebKit remote code execution (RCE) exploit, followed by a pointer authentication code (PAC) bypass as seen in Figure 2 from the deobfuscated JavaScript. At that time, GTIG recovered the WebKit RCE delivered to a device running iOS 17.2 and determined it was CVE-2024-23222, a vulnerability previously identified as a zero-day that was addressed by Apple on Jan. 22, 2024 in iOS 17.3 without crediting any external researchers. The image below shows the beginning of the RCE exploit, exactly how it was delivered in-the-wild with GTIG’s annotations. I’m gonna throw in a shameless plug from my Hack w/ Me Episode 2: Search Skills: Because I used one of the specialized databases I learned about, the Common Vulnerabilities and Exposures (CVE) database, to pull up the record of this exploit. As previously mentioned, the record is CVE-2024-23222 (https://www.cve.org/CVERecord?id=CVE-2024-23222), and as you can see below, this exploit was fixed with the iOS 17.3 and iPadOS 17.3, macOS Sonoma 14.3, and tvOS 17.3 updates. The last update on the record states 2024-06-12, so I’m not sure if that is when the OS updates came out or if that was the last fix forward from the initial releases of the OS patches. Either way, most people I can assume are safe from this attack moving forward. But there are apparently still many users within the US and outside of the country who still have an older OS version, for one reason or another. The Coruna Exploit Kit is In The Wild This is a huge issue, and the fact that these exploits that are being funded by and built for government entities should be concerning to all of us. Google’s report doesn’t explicitly mention the original CSV customer that deployed Coruna, but iVerify, which also analyzed a version of Coruna it obtained from one of the infected Chinese sites, suggests the code may well have started life as a hacking kit built for or purchased by the US government. Google and iVerify both note that Coruna contains multiple components previously used in a hacking operation known as “Triangulation” (https://www.wired.com/story/kaspersky-apple-ios-zero-day-intrusion/) that was discovered targeting Russian cybersecurity firm Kaspersky in 2023, which the Russian government claimed was the work of the NSA. The US government didn’t respond to Russia’s claim and you can be damn sure that if they DIDN’T have any involvement in “Triangulation”, they would make it known. iVerify also noted that the code appears to have been originally written by English-speaking coders, saying “It's highly sophisticated, took millions of dollars to develop, and it bears the hallmarks of other modules that have been publicly attributed to the US government." Adding, “This is the first example we’ve seen of very likely US government tools—based on what the code is telling us—spinning out of control and being used by both our adversaries and cybercriminal groups.” So here we are again, another extremely sophisticated exploit, leaked by the US government. I say another because this isn’t the first time this has happened. Back in 2017, EternalBlue was a Windows-hacking tool stolen from the NSA (https://www.sentinelone.com/blog/eternalblue-nsa-developed-exploit-just-wont-die/) (National Security Agency) and leaked to the world, leading to its use in catastrophic cyberattacks, including North Korea's WannaCry (https://www.wired.com/tag/wannacry/) worm and Russia's NotPetya (https://www.wired.com/story/notpetya-cyberattack-ukraine-russia-code-crashed-the-world/) attack. We can most certainly expect something of the same caliber to be developed and deployed over the next couple of years. Even Google stated, “Beyond these identified exploits, multiple threat actors have now acquired advanced exploitation techniques that can be reused and modified with newly identified vulnerabilities.” The loosely regulated industry is a problem within itself. iVerify’s cofounder, Rocky Cole, points to the industry of brokers that may pay tens of millions of dollars for zero-day hacking techniques that they can resell for espionage, cybercrime, or cyberwar. Notably, Peter Williams, an executive of US government contractor Trenchant, was recently sentenced to seven years in prison for selling hacking tools to the Russian zero-day broker Operation Zero (https://www.zetter-zeroday.com/trenchant-exec-who-sold-his-employers-zero-day-exploits-to-russian-buyer-sentenced-to-7-years-in-prison/) from 2022 to 2025. Williams’ sentencing memo notes that Trenchant sold hacking tools to the US intelligence community as well as others in the “Five Eyes” group of English-speaking governments—the US, UK, Australia, Canada, and New Zealand. So they are just double-dipping in contracts and reselling these dangerous toolkits to whoever is willing to shell out the money for them. You can imagine how slippery this slope can actually get. Spyware Kill Chains Explained Here is a good explanation of what exploit chains are and the reason these are the main ways an attacker tries to succeed with their spyware. As the security design of devices has progressed, attackers have to use exploit chains rather than a singular exploit to remotely install spyware onto a target’s device. An exploit chain is made up of several exploits “chained” or linked together, and often includes three or four different 0-day exploits. Generally, the exploits fall into three types: initial remote code execution (RCE), sandbox escape (SBX), and local privilege escalation (LPE). Information leaks are sometimes used to help with the exploitation within the chain as well. For spyware to be successful, it has to gather data without alerting the user. Government customers want to gather data from a user’s device, such as reading messages on their phone or accessing their browser history. However, by design, a single application on a mobile device does not have the privileges needed to access all other applications or data on the device. Each application requires the user to explicitly grant permission to access data, otherwise any downloaded game would be able to access all messages or even the browser history of the device. This barrier between applications is referred to as a sandbox. An application requesting permission to access data could alert the users to unusual activity, and possibly reveal the presence of the spyware. Instead, CSVs have to exploit vulnerabilities in the device to break out of sandboxes and gain additional privileges. Technology companies have added additional layers of security to increase the difficulty of exploitation. Installing spyware and accessing all the data on a device requires the highest level of privilege, referred to as “root privilege”. Exploit chains often contain local privilege exploits to gain the root privilege needed to install the spyware and access the users’ data. Below is a good visualization of how exploit chains/spyware kill chains work from top to bottom. Conclusion I highly recommend reading both Google’s published article (https://cloud.google.com/blog/topics/threat-intelligence/coruna-powerful-ios-exploit-kit) & iVerify’s published article (https://iverify.io/press-releases/first-known-mass-ios-attack) about this mass iOS exploit. Google, in particular, goes into the technical detail of all of the used exploits in this particular exploit chain and how it works exactly. It isn’t understated that the framework surrounding the exploit kit is extremely well-engineered; the exploit pieces are all connected naturally and combined together using common utility and exploitation frameworks. They dissect the kit and explain all the unique actions it performs from start to finish. This article was just to explain the issue at hand and the exploit that got out of hand. Hopefully, we don’t have to experience another WannaCry catatrophe but from how it’s looking, we most likely need to prepare for the worst. If you want to keep up with my work or want to connect as peers, check out my social links below and give me a follow! * 🦋 Bluesky (https://bsky.app/profile/digitaldopamine.dev) * 📸 Instagram (https://www.instagram.com/digital_dopamine_llc/) * ▶️ Youtube (https://youtube.com/@digitaldopaminellc?si=sujxCAMyboNvidiW) * 💻 Github (https://github.com/kdleonard93) * 👾 Discord (https://discord.com/users/407639833146818570) Get full access to Digital Dopamine at digitaldopaminellc.substack.com/subscribe (https://digitaldopaminellc.substack.com/subscribe?utm_medium=podcast&#38;utm_campaign=CTA_4)

13. 

    25 Feb 2026

    Hack w/ Me Episode 2: Search Skills

    Intro Sup folks! Today, we will be discussing what was learned after finishing the Search Skills room in TryHackMe. Honestly, I went into this room thinking, “This is gonna be a bunch of filler that I already know, I should just skim through it.” But I quickly realized that there were plenty of VERY useful tips, tricks, and resources that I never knew. So with that, here’s a quick overview of the learning material within this room: * Evaluation of information sources * The use of search engines efficiently * Exploring specialized search engines * Reading technical documentation * Making use of social media * Checking news outlets Most of these topics are things I do regularly, especially reading technical documentation, considering that’s a required skill as a software engineer. But others, like the use of specialized search engines, were topics I’ve never really touched (or maybe I have in the past and didn’t realize it). Even some of the tips and tricks with search queries for the typical search engines like Google or DuckDuckGo were new to me, so I definitely learned a good amount from this section, aka “room”. I’ll try to make this article a quick read and sum up everything I went over and learned. Evaluation of Search Results For this task, we just went over how to effectively evaluate the information we ingest from our searches. Here are a handful of things to consider when evaluating information: * Source: Identify the author or organization publishing the information. Consider whether they are reputable and authoritative on the subject matter. Publishing a blog post does not make one an authority on the subject. * Evidence and reasoning: Check whether the claims are backed by credible evidence and logical reasoning. We are seeking hard facts and solid arguments. * Objectivity and bias: Evaluate whether the information is presented impartially and rationally, reflecting multiple perspectives. We are not interested in authors pushing shady agendas, whether to promote a product or attack a rival. * Corroboration and consistency: Validate the presented information by corroboration from multiple independent sources. Check whether multiple reliable and reputable sources agree on the central claim Search Engines Most people reading this will be familiar with Google or Bing, and some will be keen on DuckDuckGo, like myself. However, I found out about the many search operators that you can use to refine your search results. Each browser has its own set of operators, and some do overlap. It’s not isolated only to browsers either; many operating systems have their own subset of search operators as well. Here is a GitHub repo that has collected a ton of direct links to platform documentation of their respective search operators → https://github.com/cipher387/Advanced-search-operators-list (https://github.com/cipher387/Advanced-search-operators-list). Since I use DuckDuckGo, let’s take a peek at a screenshot of that one (https://duckduckgo.com/duckduckgo-help-pages/results/syntax): Here, you can see a variety of search operators that may come in handy for searching for specific items. One I find particularly useful is the filetype parameter. This will be extremely useful when trying to search for research papers and whitepapers. This actually partially disproves a statement I made in my latest article/podcast, which was that search queries these days were starting to produce less and less valuable results. Now that I’m no longer ingnorant to more advanced ways to search for information, I might be able to limit the trash articles I get in my queries 😅. I encourage people to play around with some of these search operators and confirm if your results are more refined and useful for what you’re searching for. Specialized Search Engines Completing this task was my “oh, word?!” moment when completing the room. There are SO many very specific search engines that provide fantastic information and context depending on what you’re looking for. I find that this is more useful for IT and Cyber Security engineers/enthusiasts, though. The example engines presented seem to be focused that way, at least. The first one we cover is Shodan. Shodan (https://www.shodan.io/) Shodan is a search engine for devices connected to the Internet. It allows you to search for specific types and versions of servers, networking equipment, industrial control systems, and IoT devices. For example, you may want to see how many servers are still running Apache 2.4.1 and the distribution across countries. To find the answer, we can search for apache 2.4.1, which will return the list of servers with the string “apache 2.4.1” in their headers. Censys (https://search.censys.io/) Next up is Cynsys. Cynsys is similar to Shodan but focuses on Internet-connected hosts, websites, certificates, and other Internet assets. Some of its use cases include enumerating domains in use, auditing open ports and services, and discovering rogue assets within a network. They have a good doc on Introductory Use Cases (https://docs.censys.com/docs/ls-introductory-use-cases) that’s worth checking out. Some key use cases are: * Investigate indicators of compromise (IoCs): Find and track threat actors on the internet via the infrastructure they set up. * Enrich internal threat feeds with host and certificate data: Augment network logs with the most accurate, up-to-date public profile of the entities within and connecting to your network. * Create a timeline of adversary infrastructure: Investigate how and when an adversary weaponized infrastructure. See the history of a compromised or suspicious host. * Understand the global impact of vulnerabilities across the Internet: Conduct security research to understand the global impact of vulnerabilities across the Internet from CVEs to zero-days like SolarWinds or Microsoft Exchange. * Map your external attack surface: Investigate and view your attack surface from an external perspective by finding your Internet-facing assets and evaluating them for vulnerabilities. The Introductory Use Cases doc goes into deeper detail of the key use cases with some examples as well, but I won’t go over that in this article. I’m sure we will be utilizing this tool in the future for assignments. VirusTotal (https://www.virustotal.com/gui/home/upload) VirusTotal is a website that provides a virus-scanning service for files using multiple antivirus engines. It allows users to upload files or provide URLs to scan them against numerous antivirus engines and website scanners in a single operation. They can even input file hashes to check the results of previously uploaded files. The screenshot above shows the result of checking the submitted file against 67 antivirus engines. Moreover, one can check the community's comments for additional insights. From time to time, a file might be flagged as a virus or a Trojan; however, this might not be accurate for various reasons, and that's when community members can provide a more in-depth explanation. Have I Been Pwned (https://haveibeenpwned.com/) Last but certainly not least, is “Have I Been Pwned” (HIBP). HIBP does one thing: it tells you if an email address has appeared in a leaked data breach. I’ve used this a couple of times over the past couple of years due to the increased data breach reports that have been sprouting up with apps I used, like Discord and the National Data Breach that exposed 3 BILLION PEOPLE!! (https://www.conchovalleyhomepage.com/news/data-of-3-billion-people-exposed-in-one-of-the-largest-data-breaches-in-history-heres-what-you-need-to-know/?ref=troyhunt.com) Finding one’s email within leaked data indicates leaked private information and, more importantly, passwords. Many users use the same password across multiple platforms; if one platform is breached, their password on other platforms is also exposed. So please, for the love of god start using a password generator and manager lol. While passwords are usually stored in an encrypted format, many passwords are not that complex and can be recovered using a variety of attacks. Vulnerabilities & Exploits This task was pretty damn cool. We went over 2 main tools/databases: The Common Vulnerabilities and Exposures (CVE) program and the Exploit Database. Common Vulnerabilities and Exposures (CVE) It’s said to think of CVE as a dictionary of vulnerabilities. It provides a standardized identifier for vulnerabilities and security issues in software and hardware products. Each vulnerability is assigned a CVE ID with a standardized format like CVE-2024-29988. This unique identifier (CVE ID) ensures that everyone from security researchers to vendors and IT professionals is referring to the same vulnerability, CVE-2024-29988 (https://nvd.nist.gov/vuln/detail/CVE-2024-29988) in this case. The MITRE Corporation (https://www.mitre.org/) maintains the CVE system. For more information and to search for existing CVEs, we can visit the CVE Program (https://www.cve.org/) website. Alternatively, we can visit the National Vulnerability Database (https://nvd.nist.gov/) (NVD) website. The screenshot below shows CVE-2014-0160, also known as Heartbleed. The Heartbleed bug is a critical security vulnerability in the OpenSSL cryptographic software library that allows attackers to exploit improperly implemented TLS heartbeat functions to access sensitive data in memory, such as private keys and passwords. This vulnerability was publicly disclosed in April 2014 and has since been patched in newer versions of OpenSSL. Exploit Database There are many reasons why you would want to exploit a vulnerable application; one would be assessing a company’s security as part of its red team. Needless to say, we should not try to exploit a vulnerable system unless we are given permission, usually via a legally binding agreement. Once we have permission to exploit a vulnerable system *wink wink*, we might need to find a working exploit code. One resource is the Exploit Database (https://www.exploit-db.com/). The Exploit Database lists exploit codes from various authors; some of these exploit codes are tested and marked as verified. Technical Documentation & Social Media I want to combine these two tasks as they are pretty straightforward Technical Docs From coding languages & Framework docs like Python (https://docs.python.org/3/) and Svelte (https://svelte.dev/docs/svelte/overview) to hardware ecosystem docs for Apple hardware (https://support.apple.com/en-us/docs/mac), you will find well-organized documentation of its software or hardware. These official docs provide a reliable source of information about the software or product features and functions. These docs should be the first stop shop for getting started with new software or a new piece of hardware. You can typically expand what you learn within those docs by supplementing them with 3rd part resources if you need a different point of view in explaining what’s already in the official docs. Social Media There are billions of users registered on social media platforms such as Facebook (https://www.facebook.com/people/Tryhackme/100069557747714/), Twitter (https://twitter.com/RealTryHackMe), and LinkedIn (https://www.linkedin.com/company/tryhackme/). At this point, it’s expected to be familiar with these popular platforms, and if you aren’t, I highly recommend you get up to speed. Ideally, one would want to explore a platform without creating an official account; however, this severely limits your experience with diving into the app. Instead, a recommendation is to use a temporary email address to learn about these platforms without linking them to your real email addresses; once done, you can terminate the accounts and associated email addresses. One reason for not using your primary account is that you don’t want your contacts to start connecting with you there when you are only temporarily exploring a platform. Conclusion This lesson focused on the most common sources of information for cyber security professionals. There are plenty more. As the information landscape keeps changing, it is impossible to cover all the sources. However, by subscribing to relevant cyber security groups, you can stay ahead and be aware whenever new interesting sources arise. If you want to keep up with my work or want to connect as peers, check out my social links below and give me a follow! * 🦋 Bluesky (https://bsky.app/profile/digitaldopamine.dev) * 📸 Instagram (https://www.instagram.com/digital_dopamine_llc/) * ▶️ Youtube (https://youtube.com/@digitaldopaminellc?si=sujxCAMyboNvidiW) * 💻 Github (https://github.com/kdleonard93) * 👾 Discord (https://discord.com/users/407639833146818570) Get full access to Digital Dopamine at digitaldopaminellc.substack.com/subscribe (https://digitaldopaminellc.substack.com/subscribe?utm_medium=podcast&#38;utm_campaign=CTA_4)

14. 

    18 Feb 2026

    Open Season on OpenAI & The Crumbling AI Pillar Our Society Sits On

    Let's dive into how OpenAI and AI in general is hemorrhaging money, our environment, and the economy. Check out my Substack for the full video & full written article that contains all of the sources: https://open.substack.com/pub/digitaldopaminellc/p/open-season-on-openai-and-the-crumbling (https://open.substack.com/pub/digitaldopaminellc/p/open-season-on-openai-and-the-crumbling) Follow Me on IG: https://www.instagram.com/digital_dopamine_llc (https://www.instagram.com/digital_dopamine_llc) Peep the Linktree for all other socials: https://linktr.ee/digital_dopamine (https://linktr.ee/digital_dopamine) If YouTube is your preference for watching, catch me over there and give me a subscribe: https://www.youtube.com/@DigitalDopamineLLC (https://www.youtube.com/@DigitalDopamineLLC) Get full access to Digital Dopamine at digitaldopaminellc.substack.com/subscribe (https://digitaldopaminellc.substack.com/subscribe?utm_medium=podcast&#38;utm_campaign=CTA_4)

15. 

    28 Jan 2026

    The AT Protocol & Why You Should Drop Centralized Social Apps

    Intro (2 minutes) [Music Intro] What’s up, folks, and welcome to the second episode of the Digital Dopamine podcast! One of these days, I’m gonna get a sponsor lol and have a quick standard intro for everyone. In due time, in due time 😂. But people who follow me on IG have already seen what today’s episode is gonna be about, and that’s the AT Protocol, or Authenticated Transfer Protocol, atproto. All names are used in the space of decentralized digital identities. Alright, so we will be covering: * What the AT Protocol is at a basic-intermediate level so that developers and, more importantly, non-devs can understand what it is and how it works. * The key features of the AT Protocol and its benefits. * The Challenges and Limitations of the AT Protocol as of today. * Why apps built on the architecture (Bluesky, Flashes, and Pinksky) are superior to centralized social apps like IG, TikTok, and X, and what is capable within those apps. * Discussing a bit about Fanbase and UpScrolled. * Then, ending the show with a new project I’m starting up related to these apps and content distribution. After more research on the core tech and architecture of Bluesky, there are some concerns that I actually learned about and will give my honest frustration with it, but they pale in comparison to the issues I have with the likes of IG, TikTok, and X, and I personally see more benefits of using these apps over the others. So let’s get right into it. Main Story The At Protocol Overview *Skip to minute 30:00 if you want to skip the technical deep dive* So I’ll just start with a quick definition of the AT Protocol: “is a protocol (https://en.wikipedia.org/wiki/Communication_protocol) and open standard (https://en.wikipedia.org/wiki/Open_standard) for distributed social networking services (https://en.wikipedia.org/wiki/Distributed_social_network).[3] (https://en.wikipedia.org/wiki/AT_Protocol#cite_note-:0-3) It is under development by Bluesky Social PBC (https://en.wikipedia.org/wiki/Bluesky_Social_PBC), a public benefit corporation (https://en.wikipedia.org/wiki/Benefit_corporation) created as an independent research group within [Twitter, Inc.](https://en.wikipedia.org/wiki/Twitter,_Inc.) (https://en.wikipedia.org/wiki/Twitter,_Inc.)) to investigate the possibility of decentralizing the service.[4] (https://en.wikipedia.org/wiki/AT_Protocol#cite_note-4) A distributed social network (not to be confused with a decentralized or federated social network) is a network (https://en.wikipedia.org/wiki/Computer_network) wherein all participating social networking services (https://en.wikipedia.org/wiki/Social_networking_service) can communicate with each other through a unified communication protocol (https://en.wikipedia.org/wiki/Communication_protocol), and all participants are equal. Okay, technical definitions are over. What is the purpose of switching, and why should you care? depending on what you’re looking for in your social apps and identity will determine if any of this is of interest to you. So far, monetization is the only frustrating challenge I see with these apps, and in a world where influencers are the biggest proponents for people who might want to switch. If they don’t have a way to make money on these new platforms, it’s gonna be hard to get people to transition. That being said, creators can take the extra step and use external revenue channels like Substack, Patreon, or Fanbase in order to generate income from the traffic they get through the platforms. But Bluesky IS planning to add revenue streams to the platform, like a tipping system as well as subscriptions in future feature releases, so hopefully that comes sooner than later. AT Protocol also doesn’t support private content yet. If you need a private account or encrypted DMs, this isn’t your platform yet. But it’s coming. For public discourse and community building, it’s great. Now this next section is about to get a bit technical and into the weeds so if any of this starts to confuse you or you don’t really care about the good and the bad of the protocol, I’ll try to have a timestamp of where you can skip to and we talk about the apps that stand to be a 1:1 alternative and what they offer. AT Protocol’s Key Features The “Speech vs. Reach” Framework So the core concept of apps built on ATP is “Speech vs. Reach”. This is the heart of what makes AT Protocol different, and it’s the fundamental architectural philosophy of its creation. AT Protocol deliberately separates two layers: “speech” and “reach” and explains both in detail. * Speech Layer = permissive, distributed authority. It’s the data repository level where everyone has a voice. Your posts, data, and identity are all stored in signed repositories that you control. * Reach Layer = moderation and algorithmic curation. This is where platforms decide what you see. It’s about limiting the visibility/reach of content based on preferences, algorithms, moderation policies, etc. You are basically able to curate what you see on your feed without a central algorithm showing you what it thinks you might like, or force-feeding you rage bait or thirst traps because it tracked how long you paused on the “Suggested Reels” section…Which, for some reason, always has something you’ve clearly stated “See Less” or “Not Interested” multiple times. You’re able to literally choose moderation services and custom feed algorithms built by community developers. For instance, I have a handful of coding feed algorithms I’ve subscribed to, and my feed rarely shows posts that I wasn’t interested in. IfIi start to see a trend in the wrong direction, I can search for a new algorithm to swap to OR use none if my followers and likes are vast enough for the standard algorithm to know what I actually like. And for context, there are over 50,000 custom feeds that exist on Bluesky. So there’s bound to be a feed that fits your preferences. Moderation Dive To dive a bit deeper, Bluesky uses a two-tier moderation system: baseline protections (violence, exploitation, fraud) that everyone follows, then user choice on top. What this means: Bluesky maintains community standards, but you decide which additional moderation filters you subscribe to. Community-run labelers create custom labels (”Spoilers,” “Political Content,” etc.), and you choose which ones affect what you see. This is fundamentally different from Instagram, X, and TikTok: * Instagram bans you with no explanation or appeal * X’s moderation is inconsistent and unilateral under Musk * TikTok’s algorithm removes content opaquely Bluesky gives you transparency—you know why you were flagged, can appeal, and can choose your own moderation standards. The key insight: Moderation is part of the “reach” layer (who sees what), not the “speech” layer (whether content exists). This means if you block someone on one AT Protocol app, that block carries across all apps. Your moderation rules work at the protocol level, not just one platform. You’re not at the mercy of one company’s moderation philosophy, and you set your own standards. DIDs (Decentralized Identifiers) Another awesome feature is DID, or Decentralized Identifiers. Instead of your identity being @username.instagram.com, which is tied to Meta’s servers, your identity on AT Protocol is a cryptographic DID that looks like a hash. Example: did:plc:7iza6de2dwap2sbkpav7c6c6 I’ll explain did:plc a bit later. This DID can have multiple human-readable handles (@alice.example.com, @alice.bsky.social), but the DID stays the same and is portable. And I think this is one of the most, if not THE most important features within this ecosystem. And that’s the fact that you can’t get banned or straight-up deleted from the devs/company that built the app. With Instagram, your account exists at the pleasure of Meta. And we have seen how they’ve been moving on IG recently. I’ve experienced it myself, and I’m a nobody on that platform lol. If they ban you, you lose everything—followers, posts, history, pretty much your whole digital identity. With AT Protocol, your DID (your actual identity) is cryptographically yours. Your posts are signed by you. If Bluesky shuts down, you move to another AT Protocol app and bring everything with you: all followers see your posts, your history is intact, and your identity persists. Now, how this works is: Your DID contains your public cryptographic keys, and your posts are signed with your private key. This means you can prove ownership of your account without asking permission from any company, and if it comes to it, you can migrate servers without the old server’s involvement. So imagine if a big name like IShowSpeed could leave Instagram, take 100% of his followers and posts him to Snapchat or TikTok (if they were on AT Protocol), and his username and followers would be transferred as well and they would still be able to verify it’s him AND he would still be able to have his own verified status come along too. That’s what the AT Protocol enables. So getting control and freedom of your digital identity would be a great thing for us as a society to do, in my opinion. But that leads us back to some of the major drawbacks and bottlenecks I discovered while researching this. The Challenges and Limitations So, currently, the most common DID method is did:plc “Public Ledger of Credential,” and Bluesky runs the single directory service that manages it. There’s no redundancy or independent backup, so if the directory goes down, critical network functions break. Which then raises the theoretical concern of you being banned at the protocol level by Bluesky if they really wanted to be petty 😩 cause that wouldn’t only ban you from Bluesky, it would ban your DID from all apps you’re using with DID. It also contradicts the whole decentralization narrative. But I’m not too concerned about this for a few reasons: * That would ruin the reputation of Bluesky and the Protocol they built,t which will encourage people to go back to the mainstream apps or switch to a different, more raw decentralized protocol, like Nostr. I won’t dive into Nostr, but I will leave links to the Wiki (https://en.wikipedia.org/wiki/Nostr (https://en.wikipedia.org/wiki/Nostr)), the white-paper it released in 2020 (https://fiatjaf.com/nostr.html (https://fiatjaf.com/nostr.html)), and it’s Github README (https://github.com/nostr-protocol/nostr/ (https://github.com/nostr-protocol/nostr/)) in the script. Also. Very cool protocol, but not as feature-rich to build on as AT Protocol. * They are already taking steps to migrate away from this single point of failure by supporting the creation of an independent organization to operate the directory. The organization will set policies and rate-limits, hold any related intellectual property, and coordinate future evolution and development of the system. And it looks like this organization will be formed as a Swiss association, which is positive since Swiss law provides good protection for neutral, independent organizations. But this is still a single organization running a single directory. So we kinda get back to the same “single point of failure,” but don’t have to worry about the corrupt systems of America. * There is already an alternative to did:plc and that’s did:web . This is the best way to go if you are technically savvy and have the time and resources to set up your own PDS (Personal Data Server). did:web, is an alternative identity system that uses HTTPS and DNS instead of a central directory. To set this up, you’ll need to * Set up your own PDS (Personal Data Server) * Configure DNS records to point to your PDS * And if you started with did:plc, migrate your identity from did:plc to did:web (which would break your followers since you will technically get a new DID) Most people won’t go that route, and I don’t blame them. * Then there is Operation Log Verification. The did:plc registry has a global operation log API endpoint, which can be used to poll for identity updates. Apps can independently verify the entire operation log and rebuild their own cache of DID state. But again, if the directory goes down, you still can’t make new changes. You can just verify old ones. This is why we should watch AT Protocol’s progress on governance. If the independence handoff happens smoothly, that’s a strong signal they’re serious about decentralization. If it drags on indefinitely, then we might have been got. The App Ecosystem Most AT Protocol apps are Bluesky clients, not independent services. They use Bluesky’s data firehose and serve the same data in different interfaces. Which includes 2/3 of the apps I’m gonna talk about. Those apps are: * Flashes (photo interface for Bluesky’s data), * Pinksky (another photo interface), Skylight, on the other hand, which is a video interface for Bluesky’s data/TikTok alternative, is a standalone app that isn’t dependent on Bluesky’s data firehose. But the drawback to that is, if your followers are not also using Skylight, they won’t see the post you publish via Bluesky. I’m sure they are working on a way to resolve that issue, but I didn’t find anything to support that. theory. Bluesky Bluesky is the main course, the original and largest AT Protocol app with 36.5 million users. Bluesky is what Twitter could have been—a microblogging platform that prioritizes user control and community. Where X has become a megaphone for the wealthy and/or ignorant, and algorithmically optimized for engagement via rage bait or sexually explicit content. Bluesky gives you back the chronological timeline and lets you choose your algorithm. X is, without a doubt, bigger and more feature-rich with Spaces, Trending Topics, native scheduling, and monetization. If you need reach and advanced tools, X wins. But Bluesky is simpler and more intentional. It's growing rapidly, mainly with reputable journalists, creators, and politicians who are burned out from the chaos on X or, from a moral standpoint, don’t want to be involved with anything related to X or Elon. I find myself getting better reports from journalists and updates from campaigning politicians via Bluesky these days. Zohran Mamdani, Aaron Rupar, and Kat Abughazaleh are a few very respectable people who are regularly on Bluesky, and Kat has even completely separated from X. Most creators are not exclusively on Bluesky. They’re maintaining presence on both X and Bluesky, but posting with more frequency and energy on Bluesky. So folks are mainly playing both apps: major creators maintain presence on X for reach, but they’re investing emotional energy and engagement on Bluesky because it feels mentally healthier. That should be a good sign of more to come in terms of people hopping over. Flashes & Pinksky (Dual IG Alternative.) Flashes — Built by Sebastian Vogelsang and launched publicly at the end of February, Flashes grabbed 30,000 downloads in its first 24 hours as an Instagram alternative (TechCrunch (https://techcrunch.com/2025/02/28/bluesky-based-instagram-alternative-flashes-launches-publicly/)). Users can upload up to four images or a video per post, with videos now supporting up to three-minute clips following a recent update (TechCrunch (https://techcrunch.com/2025/07/03/everything-you-need-to-know-about-flashes-the-bluesky-based-instagram-alternative/)). Key differentiator: posts on Flashes appear on Bluesky and vice versa. Pinksky — Built by developer Ramon Souza and available on both iOS and Android, focusing mainly on photo-sharing with user profiles, a feed of photos and videos, and a Stories section TechCrunch (https://techcrunch.com/2025/06/13/beyond-bluesky-these-are-the-apps-building-social-experiences-on-the-at-protocol/). Similar to Flashes but with a slightly different UX philosophy. Both solve the same problem: Instagram users want a photo-first interface, not a Twitter clone. * Flashes: Portfolio mode, trending feeds, minimalist UI, part of Vogelsang’s app suite * Pinksky: Stories feature, chronological only, Instagram-familiar UI, standalone If you ask ‘which should I use?’—it depends. Pinksky if you want the Instagram feel. Flashes if you want the Instagram experience but with the flexibility and customization that comes from being built on an open protocol. But I just suggest using both since you can cross-post automatically within the two apps. Skylight Unlike Bluescreen, which is another Bluesky client app with limited TikTok-like features, Skylight is a true TikTok alternative that is standalone from Bluesky and does not depend on Bluesky’s data firehose. It’s got a bit of a longer developer timeline, but it’s had a good start so far. Albeit backed by the likes of Mark Cuban, the app is still open source, and the code is readily available for scrutiny if they start to veer to the wrong side of things. That being said, the app is pretty damn clean for how short a timeline it’s been in development, and if folks are looking for a decentralized alternative to TikTok, this is it! Founders Tori White and Reed Harmeyer were inspired to create Skylight when they first heard that TikTok was getting banned in the U.S. White, who used to be a travel influencer and is now a self-taught software developer living in Seattle, had backed up her TikTok videos but worried about losing access to her community and comments. So, White began documenting Skylight’s development on TikTok, which helped bring exposure to the product and build a following of potentially interested users, and her @buildwithtori TikTok profile has nearly 50,000 followers. Skylight proves you can build a full-featured alternative to TikTok on AT Protocol without being limited by a single company’s infrastructure decisions. By leveraging the AT Protocol, Skylight is nearly impossible to ban or shut down — a significant advantage as regulators around the world scrutinize centralized platforms. Bluescreen vs Skylight: * Bluescreen: Bluesky client, uses Bluesky’s firehose, 1-minute video limit, dependent on Bluesky * Skylight: Standalone app, own video infrastructure, 3-minute videos, independent PostKit - Creating My Own Distribution Tool So for the content creators out there, once I’m building up to be at this point, there are plenty of tools that you can use to manage the social profiles that help you ship them all in one go. None of these tools is free, though, and they all fall back onto a centralized server controlled by a company whose main goal is to make its shareholders money. That’s why I’ve decided for my next project, I’m going to build my own synchronous distribution tool 😄. PostKit will be a tool built with Python for synchronous content distribution across multiple AT Protocol-based platforms, as well as Substack. Once I get it working i plan to extend it to also publish to Fanbase and UpScrolled. Unlike the AT Protocol apps, these are easier alternatives to switch to as they offer the monetization solutions for creators, well, Fanbase does at least. UpScrolled is just a more privacy-focused IG replacement for those who don’t want to make the jump into the ATP apps. In phase 1, I’m building PostKit to solve a real AT Protocol creator problem: managing content across a decentralized ecosystem. Instead of post-and-pray hoping your followers see you everywhere, PostKit lets creators schedule and distribute content intelligently across Bluesky, Flashes/Pinksky, and Skylight from one dashboard. It’s coming soon and will be open source. Then, in phase 2, I’ll be expanding beyond AT Protocol. We’re adding Fanbase—which has immediate monetization—and UpScrolled—which has private messaging and features AT Protocol doesn’t yet support. The creator economy is fragmenting. AT Protocol is great for reach and algorithmic choice. Fanbase is great for revenue. UpScrolled is great for privacy and DM-based community building. Instead of forcing creators to pick one, PostKit bridges all three. You’ll be able to write one post, optimize it for each platform, set monetization gates on Fanbase, schedule it across all three, and track performance in one dashboard. That’s infrastructure for the decentralized creator economy. I’ll briefly touch on both of these apps, but will link their web pages in the script for more context if you need. Fanbase Fanbase is a next-generation social creator hub that allows any user to earn money from day one, with diverse monetization options including subscriptions, tipping, and exclusive content. Monetization Model: * Subscriptions range from $2.99 to $99 per month for exclusive access * Love (tips) with real-world value of half a penny per love * Live audio rooms for direct fan engagement * Creator subscriptions with direct monthly recurring revenue In January 2026 alone, due to the major censorship and banning on TikTok, Fanbase added 400K+ net new accounts (22% increase compared to all of 2024), 350% spike in monthly active users reaching 589K, and 142% increase in unique creators to 110K. And with their migration feature, you can migrate all of your IG content over, and they recorded 7.2 million pieces of content migrated to Fanbase during this surge. Fanbase is like an all-in-one tool that shares similarities with IG, TikTok, and OnlyFans, allowing monetization from day one + discovery in a creator-focused community. UpScrolled Not much to say about UpScrolled other than it exists to put some fairness back at the center of social media, with no shadowbans, no hidden throttling, and no pay-to-play favoritism, while offering clear rules applied evenly and explainable ranking systems. Unlike ATP apps, they DO have private content sharing and features * Private accounts ✅ * Direct messaging ✅ * DM media sharing ✅ No monetization yet, but they are planning to add that in the future. Outro So that about wraps up this episode, and hopefully nothing got too boring for y’all in the middle section of the show. I’m figuring out the best ways to keep the technical stuff digestible, but ultimately, I did say this was going to be a podcast for the tech-savvy and dev community. Nonetheless, I hope you learned something and will consider checking out these new apps that can help us break away from the grip these big players have on us. I know I plan to use these apps for pushing my content more and will still stick with the solid centralized apps like Substack, Fanbase, and UpScrolled. I’ll probably do a video podcast next to showcase the completion of phase one and how it works in a live demo. So make sure to follow me on your preferred platform….or all of them, to stay informed on when that will drop. As always, take care of yourself and take care of your loved ones. Until next time, Peace. Editors Note Get full access to Digital Dopamine at digitaldopaminellc.substack.com/subscribe (https://digitaldopaminellc.substack.com/subscribe?utm_medium=podcast&#38;utm_campaign=CTA_4)

16. 

    23 Jan 2026

    Billionaires' Takeover Attempt in Greenland

    Intro (2 minutes) * *[Music Intro] Welcome everyone, to the first podcast of Digital Dopamine! Where I’ll be delivering a weekly dose of tech news, app demos, tips, and tricks, tailored to tech enthusiasts and developers of all levels. On today’s Episode we’re gonna focus on the Tech Billionaire’s wet dream…” Greenland”. As a lot of you probably know by now, there’s this feverish push to “buy” Greenland, which is pretty much another invasion, and they want to make it seem like it’s for national security. While that claim may be partially true. I’m gonna dive into the real culprits behind this push, and that’s all the tech billionaires, specifically the “PayPal” Mafia. Main Story Who’s the PayPal Mafia, you ask? Well i’ll get into that in a bit, but first, let’s go back to 2016, where a man named Ronald Lauder made the first move of this long game plan. I’ll keep this briefing quick, Lauder, in 2016, made a huge investment in , a luxury water bottling company founded by Svend Hardenberg and Jørgen Wæver Johansen, both of whom are well-connected in the political sphere. Now Ronald is the person who floated the idea during Trump’s first term to make Greenland part of the US (Source-1 (https://politiken.dk/edition/news/art10651852/Wealthy-Trump-supporter-buys-into-Greenlandic-companies), Source-2 (https://www.irishtimes.com/world/europe/2026/01/15/an-abandoned-building-a-billionaire-trump-pal-and-the-battle-for-greenland/)), with some analysts describing his investments in Greenlandic businesses asa political strategy rather than purely commercial (Source (https://www.arctictoday.com/trump-ally-who-inspired-greenland-purchase-idea-quietly-invests-in-greenlandic-companies/)). Ronald’s business partner, Jørgen, is married to Greenland’s current foreign minister, which is for sure a conflict of interest, but that’s never stopped the ultra-wealthy from doing business. But the same individuals negotiating foreign investment policy are also investment recipients. Now that’s just a bit of context for how this all started, and I recommend diving deeper into Ronald Lauder when you get some free time. But let’s hop ahead a few years to talk about some other Billionaires that didn’t wanna miss out on the exploitation. In 2019, when traction started to pick up on the “idea” of buying Greenland, Jeff Bezos, Bill Gates, and Michael Bloomberg all invested in a company called KoBold Metals through Breakthrough Energy, an organization founded by Bill Gates himself (Source (https://en.wikipedia.org/wiki/Breakthrough_Energy)). KoBold Metals is a company that explores and develops mineral resources essential for clean energy technologies, which consists of Ev Vehicle wind turbines, etc, and the minerals they are in search of include lithium, nickel, copper, and cobalt, which are critical for batteries and other renewable energy solutions. How they search for these rare earths is through AI-powered exploration of the island. And in 2022, guess who decided to join the party, Sam Altman, and since then, more and more investments have poured into KoBold Metals, valuing the company today at around 2.96 billion dollars. Speaking of muddied interests, Howard Nutlick….I mean, Lutnick… has been investing in a different Greenland Mining company called Critical Metals Corp……..for over 3 decades through Cantor Fitzgerald. He’s since divested in cantor but his stake was just handed over to his children……and I’m SUREEEE they will have a moral compass and not be a conflict of interest in the area moving forward. (Forbes (https://www.forbes.com/sites/martinadilicosa/2026/01/09/these-billionaires-bet-big-on-greenland-after-trump-took-interest/)) And then we have Ken Howery, a former venture capitalist and associate of Peter Thiel, who Trump appointed as US ambassador to Denmark…..like how is no major outlet reporting about this?!?!…. That’s rhetorical, of course. There are a couple more folks in the weeds of all of this, but for the sake of time, I’m gonna now get to the PayPal Mafia, and how they plan to create a “Freedom City”…which in reality will be an internet-native/technocratic nation, testing AI surveillance tech before bringing it back home here in the US. Let’s start at Praxis, which is a company founded by Dryden Brown and Charlie Callinan, with Howard Hughes Corporation (https://en.wikipedia.org/wiki/Howard_Hughes_Corporation) founder David Weinreb, who is the current vice chairman. Praxis describes itself as an “internet-native nation” [1] (https://en.wikipedia.org/wiki/Praxis_(proposed_city)#cite_note-praxissite-1) and has stated plans to create a 10,000-person city in the Mediterranean (https://en.wikipedia.org/wiki/Mediterranean_Sea). Brown is designing a theoretical “city-state” aiming to “restore Western Civilization (https://www.t-online.de/nachrichten/ausland/internationale-politik/id_101084420/groenland-diese-us-milliardaere-wollen-an-die-bodenschaetze-der-insel.html),” and has had his sights on Greenland specifically. Who backs this concept???? PayPal Mafia members, including Peter Thiel and Ken Howery, Trump’s pick for Denmark ambassador So how do they play to test surveillance?? Praxis plans include “AI-augmented governance” and will feature “employer-friendly labor laws” described as “ (https://medium.com/@impactnews-wire/gates-altman-bezos-and-thiel-have-secretly-invested-in-ai-driven-rare-earth-mining-in-greenland-0c41c3144bb0)Elon-compatible. (https://medium.com/@impactnews-wire/gates-altman-bezos-and-thiel-have-secretly-invested-in-ai-driven-rare-earth-mining-in-greenland-0c41c3144bb0)” (https://medium.com/@impactnews-wire/gates-altman-bezos-and-thiel-have-secretly-invested-in-ai-driven-rare-earth-mining-in-greenland-0c41c3144bb0) The company’s manifesto describes creating all infrastructure—contracts, governance—on blockchain, creating a “tax-free enclave, governed by free-market principles and managed by a king-CEO leading citizen-shareholders.” (Source (https://x.com/OJoelsen/status/1995491490055741659)) The argument for why they are desperate for Greenland is that it’s a small, contained population (Greenland has under 57,000 people) where these billionaires with their shady political connections could experiment with governance, AI integration, and surveillance systems. All while being free from existing regulatory frameworks and the consequences that come with breaking them. These tech billionaires envision unregulated “freedom cities” in Greenland, free from democratic oversight, environmental laws, and labor protections. La Voce di New York (https://lavocedinewyork.com/en/news/2026/01/16/trump-and-greenland-an-interest-sparked-by-advice-from-ronald-lauder/) Greenland’s cool climate is ideal for hosting massive AI data centers. Wikipedia (https://en.wikipedia.org/wiki/Ronald_Lauder)—combining computational power with a controlled population creates something like a real-world laboratory. The PayPal Mafia’s collective vision is “a state stripped down to its bare bones, with only one objective: maximize shareholder value.”(Source: New Arab (https://www.newarab.com/news/ronald-lauder-billionaire-linked-trumps-greenland-bid)). These people include Elon Musk, Thiel’s minion JD Vance, Ken Howery, and other members across Trump’s executive branch, like David Sacks, who is Trump’s advisor on AI and cryptocurrencies. This group has unprecedented political access and, from their past actions, will surely stop at nothing until they get their greasy, greedy hands on Greenland. Peter Thiel and Elon Musk see Greenland not just as a source of rare earths, but as a laboratory for their libertarian economic and social experiments. ( The Irish Times (https://www.irishtimes.com/world/europe/2026/01/15/an-abandoned-building-a-billionaire-trump-pal-and-the-battle-for-greenland/) ) The crazy part is, this is all being experimented with NOW in Próspera. “What’s Próspera?” you ask…..well, Próspera is a charter city on the island of Roatán in Honduras, operating as one of three Zones for Employment and Economic Development (https://en.wikipedia.org/wiki/Zone_for_Employment_and_Economic_Development) (ZEDEs) with autonomy from the national government. It’s backed by venture capitalists, including none other than Peter FUCKING Thiel, Marc Andreessen, and Balaji Srinivasan (buh-LAH-jee sree-nee-VAH-sun)…I literally had to add how to pronounce his name in the script lol. But the investment is through Pronomos Capital, and has recently attracted Coinbase CEO Brian Armstrong as an additional investor. So this is pretty much a libertarian experimental zone designed to test free-market principles at scale. According to historian Quinn Slobodian, Próspera is part of a broader trend of projects aimed at implementing these theories in practice. The model features: * Minimal taxation: Tax rates are 1% on business revenue, 5% on wages, and 2.5% sales tax, with 5% personal income tax as of 2025. * Corporate governance: Honduras Próspera Inc. has veto power over the governing council’s nine-member body, with four members appointed by the company itself. * Crypto integration: Bitcoin is recognized as legal tender within the city. * Private arbitration and custom law: Businesses can select regulations from approved foreign jurisdictions or propose custom regulations subject to Próspera’s approval. (The Irish Times (https://www.irishtimes.com/world/europe/2026/01/15/an-abandoned-building-a-billionaire-trump-pal-and-the-battle-for-greenland/)) And this is already negatively affecting the local populations of neighboring villages. The village of Crawfish Rock expressed fears about land expropriation, and funds earmarked for Honduras development haven’t reached nearby communities, while Próspera uses the island’s infrastructure (electricity, airports, garbage) with inequities. Honduras’ leftist President Xiomara Castro repealed the ZEDE law in 2022, citing sovereignty concerns, but Próspera didn’t stop operations…….they instead decided to sue Honduras for $10.7 billion—equivalent to one-third of the country’s GDP. (The Irish Times (https://www.irishtimes.com/world/europe/2026/01/15/an-abandoned-building-a-billionaire-trump-pal-and-the-battle-for-greenland/)) This is the atrocity: create a private city with minimal regulation, extract wealth from the land and locals while ignoring their communities, and use international legal mechanisms to override national sovereignty if a government tries to stop it. Greenland would be where this model scales globally. Outro So really quick: we have mining companies searching for rare earth minerals (Bezos, Gates, Bloomberg via KoBold), water extraction (Lauder), and a libertarian city-state with AI governance (Thiel, Howery, Altman via Praxis), an ongoing experiment in Próspera testing these theories of libertarianism, minimal income and business revenue tax while at the same time, horrid wages for workers & being a haven for crypto fraud and laundering by the GOV—all connecting to the same island, all connected to PayPal alumni, all with Trump administration alignment. Editors Note All sources in the article are bolded with links. Feel free to correct any of my sources in the comments. Get full access to Digital Dopamine at digitaldopaminellc.substack.com/subscribe (https://digitaldopaminellc.substack.com/subscribe?utm_medium=podcast&#38;utm_campaign=CTA_4)

Reach and audience

Public platform figures. Ratings count people who left a rating, not total listeners.

Apple Podcasts (US)

5.0 / 5

1 ratings

Contact Digital Dopamine

Guest appearances

Does not typically book guests

Based on episode analysis; this does not confirm that the show is currently accepting guests.