All of your Google Play apps have been successfully registered

There was an email from Google saying that Android apps in the Play store (and outside) need to be registered, and we need to register keys if we are signing outside the Play Store.

One of our apps was being signed outside the Play Store, so in the URL

play.google.com/console/u/6/developers/android-developer-verification

clicking the arrow against that app, it asks us to add the public key.

To find the public key,

https://support.google.com/googleplay/android-developer/answer/16641489

where I'm using this method in a github action,

      - name: Extract SHA-256 fingerprint only

        run: |

          BUILD_TOOLS="$ANDROID_HOME/build-tools/34.0.0"

          "$BUILD_TOOLS/apksigner" verify --print-certs app-release.apk \

            | grep -i "SHA-256"

I clicked on Add Key and added the digest, at first it showed Pending verification, in 10 minutes it showed verified.

Here is part of Gemini's reply on why this key is needed - 

To ensure your app functions flawlessly whether it is downloaded from the Play Store, sideloaded by a QA tester, or downloaded directly from your website, your backend services (Firebase, Google Cloud, etc.) should always have both fingerprints registered:

1. The Google Play App Signing SHA-256 (found in Play Console -> Release > Setup > App Integrity).
2. Your Local Keystore SHA-256 (the one generated from yourkey.keystore).

major changes needed for Moodle app

I asked Gemini 3.1 Pro Preview via aistudio.google.com -

Does the Moodle Android App at https://github.com/moodlehq/moodleapp support optimization using R8?

Gemini said, in short, "The short answer is no, not out of the box. The Moodle App is optimized using Angular/JS minification tools (Terser/Webpack) rather than Android's native R8. You should not enable R8 in the Moodle App's Android build configuration, as it will likely break the bridge between the app's JavaScript and native Android plugins."

Then, I asked, 

Then how can this app (and other similar cordova apps) meet the upcoming quality requirements in https://android-developers.googleblog.com/2026/08/app-quality-memory-optimization-secure-onboarding.html ? The play store quality check tool seems to mandate R8 optimization.

Gemini's answer is pasted below.

The recent Google Play announcement from August 2026 (enforcing new memory and

code optimization standards by February 2027) definitely changes the landscape

for hybrid frameworks like Cordova, Capacitor, and Ionic, which power apps like

Moodle.

According to the new Google Play requirements, apps must have a minimum of 25%

coverage across optimization, shrinking, and obfuscation for their native DEX

code using R8 (or a similar tool), and they must stay below strict memory/bitmap

thresholds.

Here is how the Moodle app, and Cordova apps in general, can meet these upcoming

requirements without breaking their architecture:

1. Hitting the 25% R8 DEX Coverage Rule

While blindly enabling R8 (minifyEnabled true) breaks the Cordova JS-to-Native

bridge, it can be enabled safely if properly configured. To meet the 25%

threshold, Cordova apps do not need to obfuscate their entire codebase; they

just need to shrink enough of it.

  - Targeting Heavy Dependencies: In a standard Cordova app, the actual Cordova

    wrapper code and plugins make up a very small percentage of the compiled

    .dex (native Android) file. The vast majority of the native code comes from

    heavy dependencies like AndroidX libraries, Google Play Services, Firebase,

    and other third-party native SDKs.

  - Targeted ProGuard/R8 Rules: Developers will need to enable minifyEnabled

    true but use a highly specific proguard-rules.pro file. They will use

    aggressive -keep rules to protect the Cordova framework (-keep class

    org.apache.cordova.** { *; }) and plugin reflection methods so the app

    doesn't crash.

  - By allowing R8 to shrink and dead-code-eliminate the massive AndroidX and

    Google Play Services libraries while leaving the Cordova bridge alone,

    hybrid apps can easily surpass the 25% optimization threshold required by

    Google Play.

2. Meeting the Dynamic Memory & Bitmap Thresholds

The new requirements aren't just about R8; they strictly monitor dynamic memory

and background bitmap usage. This is actually the bigger challenge for Cordova

apps because they run inside an Android WebView, which is notoriously

memory-heavy.

To prevent the Play Store from penalizing or down-ranking the app, hybrid apps

will have to aggressively optimize their web layers:

  - Background DOM Management: The Moodle Angular app will need to actively

    destroy heavy DOM elements (like large course lists or forums) when the app

    goes into the background, replacing them with placeholders to free up RAM.

  - Bitmap/Image Eviction: The WebView caches images heavily. When the user

    navigates away from an image-heavy course, the app must ensure the WebView

    releases those bitmaps from memory rather than keeping them cached in

    non-visible states.

  - Garbage Collection: Relying more heavily on WeakReferences in JavaScript and

    ensuring Angular observables are cleanly unsubscribed to prevent memory

    leaks in the Node/V8 engine powering the WebView.

3. Implementing the "Zero-Tap Sign-In" (Device Migration)

The blog post also mandates the adoption of the Android Restore Credentials API

for seamless device migration. For the Moodle app, this means updating the

native Android authentication plugins to hook into Android's Credential Manager

API. Instead of relying solely on standard web cookies or isolated local

storage, the app's native layer will need to back up the user's secure token so

that if a student buys a new phone, Moodle logs them in automatically.

The Path Forward for Moodle (and Cordova)

Because the enforcement deadline is February 2027, framework maintainers have

several months to react. You can expect the following to happen across the

ecosystem:

1.  Upstream Updates: The Apache Cordova and Ionic Capacitor teams will likely

    push updates to their Android build templates that include safe, boilerplate

    proguard-rules.pro files out of the box.

2.  Plugin Consumer Rules: Native plugin authors will increasingly embed

    consumerProguardFiles in their Gradle setups. This tells R8 exactly what to

    preserve automatically, taking the burden off the app developer.

3.  Moodle HQ Patches: For the Moodle app specifically, Moodle HQ will update

    their build pipeline before the 2027 deadline. If you are compiling your own

    custom version of the Moodle app, you should wait for Moodle HQ to release

    their compliant ProGuard configurations rather than trying to force R8 on

    your own today.

recovering h5p activites after mod_hvp bug on Moodle

This was noticed on July 24th - lots of pages on our Moodle instances were showing "The version of the H5P library H5P.Column used in this content is not valid. Content contains H5P.Column 1.18, but it should be H5P.Column 1.22."

At that time, I replied that, according to Gemini, this is a known H5P bug - https://github.com/h5p/moodle-mod_hvp/issues/632 - and the H5P core development team is actively working on a fix (Pull Request #633) - https://github.com/h5p/moodle-mod_hvp/pull/633

Gemini private URL for my reference - https://aistudio.google.com/prompts/1Ddl2aYqln8Y8wTIPtlLXG_8Fipeay_5F

Unfortunately, the next version of mod_hvp Moodle plugin was released, but it only had code to prevent such errors in future, but it did not automatically fix the existing problems.

So, took the help of Gemini again, and took steps to fix our Moodle instances. Private URL for my reference - https://aistudio.google.com/prompts/1LJYJaO3R8mjgpsd3w67TDlACd3Ni8JhL

Workflow was:

0. First download a "good copy" of the database backup - Since the buggy mod_hvp was released after Feb 2026, my choice was the backup of 22 Feb 2026. Unfortunately, this backup was 500+ MB as a .sql.gz file, where the logstore_standard_log table had not yet been cleaned up. Setting up this database on my local machine took 4+ hours for the database import. Private URL for my reference - https://chatgpt.com/c/6a8d13c5-1988-83ee-816b-082af1f2a874

sudo apt install mysql-client (was already installed)
sudo apt install mysql-server

systemctl status mysql

sudo mysql

CREATE DATABASE restore_test CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
quit;

zcat your_backup.sql.gz | sudo restore_test

(this took 4+ hours - should probably have done the gunzip separately? Also, 11+ GB database at /var/ from a 9+ GB sql file - sudo du -sb /var/lib/mysql/restore_test)

sudo mysql

CREATE USER 'myuser'@'localhost' IDENTIFIED BY 'your_password_here';

GRANT ALL PRIVILEGES ON restore_test.* TO 'myuser'@'localhost';

FLUSH PRIVILEGES;

Then to fix "Public Key Retrieval is not allowed" error in DBeaver, right-click to edit the connection, 

Go to Driver Properties.

Modify the properties,

allowPublicKeyRetrieval to true

useSSL to false

Then, by using a different port in a tunnel to the remote database, we can copy and paste data with DBeaver.

1. Fix the main library reference (e.g., Column or Interactive Book containers):

UPDATE vv_hvp h

JOIN vv_hvp_libraries old_lib ON old_lib.id = h.main_library_id

JOIN vv_hvp_libraries new_lib ON new_lib.machine_name = old_lib.machine_name

  AND new_lib.major_version = 1 AND new_lib.minor_version = 22

SET h.main_library_id = new_lib.id, h.filtered = NULL

WHERE old_lib.machine_name = 'H5P.Column'

  AND old_lib.major_version = 1 AND old_lib.minor_version = 18;

Updated rows 0

2.  Fix nested library references

UPDATE vv_hvp 

SET json_content = REPLACE(json_content, 'H5P.Column 1.18', 'H5P.Column 1.22'),

    filtered = NULL

WHERE json_content LIKE '%H5P.Column 1.18%';

UPDATE vv_hvp 

SET json_content = REPLACE(json_content, 'H5P.InteractiveVideo 1.27', 'H5P.InteractiveVideo 1.28'),

    filtered = NULL

WHERE json_content LIKE '%H5P.InteractiveVideo 1.27%';

Updated rows 7

3. Recovering "Wiped" Activities (Data Loss)

SELECT id, name, course FROM vv_hvp WHERE json_content LIKE '%"content":{"params":{}}}%';

37 rows on our instance.

4. Fixing one of the data-missing json-content fields - 

SELECT json_content FROM vv_hvp WHERE id = 30851 (from the backup)

to find the current libraries, look for H5P string in the json, 

and add to the ones below.

SELECT machine_name, major_version, minor_version

FROM vv_hvp_libraries

WHERE machine_name IN (

    'H5P.Video', 

    'H5P.MultiChoice', 

    'H5P.AdvancedText',

    'H5P.InteractiveVideo',

'H5P.Column',

'H5P.Image',

'H5P.CoursePresentation'

)

ORDER BY machine_name, major_version DESC, minor_version DESC;

Only had to find/replace CoursePresentation version, others had current versions. Then pasted the "corrected" json content in the same field of the live database.

5. Run a find/replace on the entire live database - starting first with one course,

UPDATE vv_hvp 

SET json_content = REPLACE(json_content, 'H5P.Column 1.18', 'H5P.Column 1.22'),

    filtered = NULL

WHERE course = 606 

  AND json_content LIKE '%H5P.Column 1.18%';

Updated rows 42.

Update main library id just in case.

UPDATE vv_hvp h

JOIN vv_hvp_libraries old_lib ON old_lib.id = h.main_library_id

JOIN vv_hvp_libraries new_lib ON new_lib.machine_name = old_lib.machine_name

SET h.main_library_id = new_lib.id, 

    h.filtered = NULL

WHERE h.course = 606

  AND old_lib.machine_name = 'H5P.Column'

  AND old_lib.major_version = 1 

  AND old_lib.minor_version = 18

  AND new_lib.major_version = 1 

  AND new_lib.minor_version = 22;

Updated rows 0.

Then, did for all courses,

UPDATE vv_hvp 

SET json_content = REPLACE(json_content, 'H5P.Column 1.18', 'H5P.Column 1.22'),

    filtered = NULL

WHERE json_content LIKE '%H5P.Column 1.18%';

Updated 221.

Then asked Gemini if this can be automated for data recovery for the 30+ instances of data loss - private URL for my reference -
 https://aistudio.google.com/prompts/14Bv6L5AfaOglFuUY_VJZ6F7A1cchR-FQ

That resulted in the python scripts at https://github.com/hn-88/fix-hvp/

which seem to have fixed all the data-loss in this instance.

Then, a new problem was reported on another Moodle instance - youtube videos were playing with audio only, and black screen. Putting that in a separate post here.

Moodle H5P Interactive video playing only audio with black screen

It was reported that all the H5P Interactive video activities on one of our Moodle instances were only playing audio, no video visible, black screen instead. My initial reaction was that this seemed to be another symptom of the mod_hvp bug which had prevented activities from being updated as per the previous post. But the fix in this case was slightly different.

Private URL of chat with Gemini for my reference - https://aistudio.google.com/prompts/1sowy1kk_uVUetNXh2Og3WBgVcfGQ-lQy

The query

SELECT machine_name, major_version, minor_version

FROM vv_hvp_libraries

WHERE machine_name IN (

'H5P.Video',

'H5P.MultiChoice',

'H5P.AdvancedText',

'H5P.InteractiveVideo',

'H5P.Column',

'H5P.Image',

'H5P.CoursePresentation',

'H5P.Summary'

)

 had this response.

H5P.AdvancedText 1 1

H5P.Column 1 13

H5P.Column 1 17

H5P.Column 1 18

H5P.CoursePresentation 1 22

H5P.CoursePresentation 1 24

H5P.CoursePresentation 1 25

H5P.CoursePresentation 1 26

H5P.Image 1 1

H5P.InteractiveVideo 1 22

H5P.InteractiveVideo 1 24

H5P.InteractiveVideo 1 26

H5P.InteractiveVideo 1 27

H5P.MultiChoice 1 14

H5P.MultiChoice 1 16

H5P.Summary 1 10

H5P.Video 1 5

H5P.Video 1 6

Gemini said, If you replace 'H5P.Column 1.18' with 'H5P.Column 1.22', Moodle's H5P renderer will look for H5P.Column 1.22 in vv_hvp_libraries, fail to find it, and throw a fatal error. H5P.Column 1.22 is not installed on this instance. 

Primary cause - Outdated H5P.Video Library vs. YouTube Player Changes. Check with

SELECT id, machine_name, major_version, minor_version, patch_version 

FROM vv_hvp_libraries 

WHERE machine_name IN ('H5P.Video', 'H5P.InteractiveVideo')

ORDER BY machine_name, major_version, minor_version;

If H5P.Video 1.6 is below 1.6.67, updating the library will resolve the issue - and gave this thread as the reference,

https://moodle.org/mod/forum/discuss.php?d=482329&parent=1909904

which was discussing the exact same issue.

After some trial and error, the correct solution was:

1. In the Moodle server's config.php, add this line near the bottom before require_once(...)
$CFG->mod_hvp_dev = 1;

2. Download link: https://hub-api.h5p.org/v1/content-types/H5P.InteractiveVideo (save the file as InteractiveVideo.h5p)
3. Go to https://your-moodle-domain/mod/hvp/library_list.php

(Or navigate via UI: Site Administration > Plugins > Activity modules > H5P > H5P Libraries)
and upload the saved InteractiveVideo.h5p in the Upload Libraries box.
4. Verify that the new version is installed with the query 

SELECT id, machine_name, major_version, minor_version, patch_version 

FROM vv_hvp_libraries 

WHERE machine_name = 'H5P.Video';
5. Now in mod/hvp/library_list.php we see Interactive Video (1.27.9) listed, and also a green button at the right to "Upgrade library content". Click on the upgrade library content button to automatically fix all the interactive videos on the site. The page goes to 100% with AJAX updating in less than 30 seconds.
6. Purge caches (sudo php admin/cli/purge_caches.php on CLI ) and test one of the videos to see if it is OK
7. Restore the config.php by commenting out the mod_hvp_dev line we added.

tests of mid-tones brightness reduction on planetarium dome

Tried out reduction of mid-tones using Blender, for reducing the washed-out over-exposed look due to dome reflections. 

For individual textures in a 3D scene, add a RGB Curves node after the texture in Shader Editor. In Blender VSE (Video Sequence Editor), we can add via "Add" menu, choose "Effect Strip," and select "Color" followed by "RGB Curves."

On the M4 Mac Mini, 3840x2160 renders were proceeding at nearly 10 fps from Blender VSE. The output of that was probably not playable smoothly on Raspberry Pi, so ran it through Avidemux with Videotoolbox (GPU assisted) HEVC codec, the default bitrates of 2000 kbps avg and 4000 kbps max are quite low, but quality is fine for simple scenes.

NAVK preferred the previous version of "Unseen Earth" in which I probably either put a mask over the bright parts or left as is - when I reduce mid-tones again, the scene becomes too dark for him. Probably I can redo the overexposed parts of "The Search" with this technique.

Cloudflare Origin Server Certificate for Wordpress instance on Hostinger

After chatting with Hostinger support, the following is the reply.
"Yes. Your WordPress instances on Premium Web Hosting support custom SSL certificates on their virtual hosts"

(Copy-pasting from an email exchange).

So, we could install the cloudflare origin server certificate as per the procedure at https://www.hostinger.com/support/1583785-how-to-install-a-custom-ssl-in-hostinger/ 

Doing this has both Pros and Cons. 

 The pro is that then we can be sure of the certificate being valid for Cloudflare - unlike the letsencrypt certificate currently present, which would need updating every three months. 

 The con is that once the cloudflare origin server certificate is installed, you can only access the wordpress site through cloudflare (or you would get a scary "certificate not trusted" message) and you would be limited by cloudflare's file upload and timeout limits.

(The team opted to not use Cloudflare Origin Certificates.)

removed defunct DNS records

After an email the previous day to verify that none of these services need to be kept, deleted a handful of defunct DNS records from a couple of our domains. One was an MX record which was not active since the migration to Google Workspace in 2019.  

new iOS version of app did not pass review the first time

The post about initially adding the iOS app to the Apple App Store is at https://hnsws.blogspot.com/2025/12/steps-to-creating-ios-app-via.html

When trying to update the logo and re-submit, five days passed, then contacted them via https://developer.apple.com/contact/

Hello App Review Team,

Our app <title of app> (version 1.2.3.4) which is approved for unlisted distribution, had some logo and screenshot image changes. This update was submitted on 22 July and has been in Waiting for Review for over 5 days.

Could you please check whether there are any issues with the submission or if any additional information is required?

Thank you for your assistance.

The next day, there was a reply, 

We noticed an issue with your submission that requires your attention.

And the appstoreconnect.apple.com page showed the details - the demo account for the app was no longer working. Worked with the team to create another demo account (without leaking live data) - a normal user account was sufficient - and submitted. ChatGPT noted that I need not delete the update and start from scratch, just edit the App Review Information section (Demo Account / Notes for Review) with the new credentials and reply to the reviewer with the new credentials. 

Private link to the conversation for my reference - here. 

ChatGPT also told me that currently the App Review Information section can be found at appstoreconnect.apple.com > Apps > our app > left side-bar choose the version which was rejected > scroll down to App Review Information.

Did that, and the next day the update was live.

speed up file transfers on NTFS

 Private URL for my reference - https://chatgpt.com/c/6a814e36-5198-83ee-8072-7555b22d45d7

Related posts - set up file sharing on Mac ,  ntfs write on MacOS

When copying files from a USB SSD on a Mac to a USB HDD on Linux over the network, the files initially start at 9.8 MBps since it is a 100 Mbps network, but later the transfer speed drops to 4.5 MBps and sometimes to 2.5MBps.

ChatGPT asked me the model of the hard disk, and said, "That particular 4 TB Toshiba Canvio Advance is a 5400 RPM 2.5-inch portable HDD powered entirely from USB. A healthy 5400 RPM drive should still sustain roughly 80–120 MB/s sequential writes, which is far above your 100 Mbps network limit (~10 MB/s). So under normal circumstances the HDD alone should not reduce a transfer from 9.8 MB/s to 2.5 MB/s." And suggested

iostat -xm 1

"If you see the HDD at 100% utilization (%util) while the network transfer has slowed, you've found the bottleneck."

But that was not the case. In the next iteration, the NTFS filesystem was narrowed down as the culprit - mount showed 

/dev/sdc2 on /media/sssvv/TOSHIBA EXT type fuseblk (rw,nosuid,nodev,relatime,user_id=0,group_id=0,default_permissions,allow_other,blksize=4096,uhelper=udisks2)

and ChatGPT said, "type fuseblk - This means the drive is not using the newer kernel NTFS3 driver. It is mounted through FUSE, which on Mint 22.1 typically means ntfs-3g (or a compatible FUSE-based NTFS implementation)."

To use the kernel ntfs3 driver instead,

uname -r
cat /proc/filesystems | grep ntfs
modinfo ntfs3

which showed the driver was present, but not loaded. So,

sudo modprobe ntfs3
# and to verify,
cat /proc/filesystems | grep ntfs

sudo mkdir -p /mnt/ntfs-test
sudo mount -t ntfs3 /dev/sdc2 /mnt/ntfs-test

That worked (read-only).

To find why ntfs3 was not loaded,

apt policy udisks2
udisks2:
  Installed: 2.10.1-6ubuntu1.3

"With udisks2 2.10.1-6ubuntu1.3, the built-in defaults already specify: ntfs3, ntfs - meaning udisks2 should try ntfs3 first and only fall back to ntfs (which typically ends up as ntfs-3g/FUSE)."

Verified with

grep -R ntfs_drivers /etc/udisks2 /usr/share/udisks2 2>/dev/null
/etc/udisks2/mount_options.conf:ntfs_drivers=ntfs3,ntfs
/etc/udisks2/mount_options.conf.example:# ntfs_drivers=ntfs3,ntfs

Then I found I had these lines in /etc/fstab - 

# External NTFS disk

UUID=fc6965f0-d088-48df-a082-b413ceb02a1c  /mnt/toshiba  ntfs-3g  rw,uid=33,gid=33,umask=022,allow_other,nofail,x-systemd.automount  0  0

So maybe that was the culprit. ChatGPT asked me to change it to

UUID=fc6965f0-d088-48df-a082-b413ceb02a1c  /mnt/toshiba  ntfs3  rw,uid=33,gid=33,umask=022,nofail,x-systemd.automount  0  0

and noted that

• allow_other is primarily a FUSE option. It's not needed with ntfs3 and may generate warnings if left in place.
  
  
• uid=33,gid=33 means all files will appear owned by user/group 33 (www-data on Ubuntu/Mint). Keep it if that's intentional.
  
  
• If you want your desktop user to own the files, use your UID/GID instead (typically 1000:1000).

So I did that, and found that mount now shows

/dev/sdc2 on /media/sssvv/TOSHIBA EXT type ntfs3 (rw,nosuid,nodev,relatime,uid=1000,gid=1000,iocharset=utf8,uhelper=udisks2)

So the problem was probably due to the fstab entry, which I edited.

Now I get 9.8 MB/s for large files over the network - limited by the 100 Mbps network. Tested with a 2.2 GB file.

Even faster than this would be: copy from the Mac's internal drive to a Mac-formatted external drive, then eject the external drive, mount it on Linux (mounted automatically) and copy from that Mac-formatted external drive to the NTFS formatted external drive mounted on Linux - 70+ MB/s for 2.5 GB. 

move vmware vm to another location on the same computer

On the Mac, I wanted to move out the VMWare VMs from the internal SSD to an external SSD to save disk space. 

(Edit - more about this at this post, https://hnsws.blogspot.com/2026/08/4k-fulldome-frame-saving-speeds.html)

According to this video -

https://www.youtube.com/watch?v=6aaGYtP_jZM

 Just move the folder.

Use "remove" option for the old location inside vmware, and "open" for the new location inside vmware.

(if dialog box gives option of "I moved it / I copied it", can choose "moved", so that a new id is not created.)

URL for images on Google Drive for other websites

Copy-pasting from an email exchange - 

Google Drive makes it a bit difficult to host images there for other websites.

Please see how to do it at

https://joe-walton.com/blog/embedding-google-drive-images-in-html-in-2024/

I have done a couple of test embeddings at

ourwebsite/test.html

to verify that it works.

For the second image, I have used the method given in the link  https://joe-walton.com/blog/embedding-google-drive-images-in-html-in-2024/

For the first image, 

1. I used the Share... menu in google drive to copy the link to the image, from which we get the image id as in the link above

2. I pasted the link as given by the above page, into another window, like https://drive.google.com/thumbnail?id=1W19N7j2i6vGyzHfoLQJjEtl1poEYRHij&sz=w800

3. I then copied the link to which that redirected, like https://lh3.googleusercontent.com/d/1FlbieOeCdifrNLP2ssy73SlfIU9NhD8M=w800?authuser=0

In case this method has problems, we can host the images in ourwebsite.org or ourwebsite2.org in some directory, and then paste those links to the portal settings page.

4k fulldome frame saving speeds - OpenSpace 0.22 ARM on VMWare

Running Win11ARM on VMWare, 12 GB RAM, 5 cores on a Mac Mini M4. 

Running OpenSpace on local drive, was saving 4k frames of ts_002 of "The Search" in around 800 to 1500 ms. 

Running on Z drive, was saving 4k frames of ts_002 in around 5000 to 6000 ms - probably because it is a network drive.

Crashed after 1695 frames. Maybe because screensaver came on? Or maybe not - it would have run for more than two hours before crashing. Maybe out of memory etc.

Edit - So, now I have moved the VMWare VMs to an external SSD formatted with Mac filesystem - Mac OS Extended (Case-sensitive, Journaled) - using Disk Utility on Mac - so that OpenSpace can run and save to local filesystem - possibly faster than the Linux machine with 8 GB RAM and NVidia 1050 graphics card. 

setting up passkeys with keepassxc on linux

Since Microsoft was making passkeys the default for authenticating on Azure as mentioned in a previous post, I wanted to understand more about passkeys and how to use them on Linux. This video was helpful - Convenient and secure: Manage passkeys with KeePassXC - Tutorial

So, with keepassxc, the steps were, for me on Linux Mint,

sudo add-apt-repository ppa:phoerious/keepassxc

sudo apt update
sudo apt install keepassxc

Then,

1. Need to enable browser integration

2. Need to connect browser plugin to keepassxc

3. Need to enable passkeys in the browser extension

4. Test with webauthn.io

5. https://passkeys.directory/ shows which services support

For Google account, passkey creation is via my account - myaccount.google.com/security

Under Security, Passkeys and security button at the bottom.

For Microsoft, currently passkey creation is at

https://mysignins.microsoft.com/security-info

Multiple google accounts are supported by keepassxc. Also, Android 16 phone supports passkeys out of the box. 

For Google Workspace logins, the admin must enable passkeys for users - Choose whether to let users skip their password if they can authenticate their Google Account securely with just a passkey. -  the only downside seems to be for people using security keys - "Users won't have the option to add a security key. They can still create passkeys on security keys, but security keys that support passwordless sign-in can't be added for 2-Step Verification only." 

bundling dependencies in MacOS app

Over several trial-and-error attempts with the help of Claude.ai, these two scripts bundled the dependencies needed to run the OpenSpace app without homebrew - tested by renaming /opt/homebrew to something else. 

https://github.com/hn-88/OpenSpace-AppImage/wiki/OpenSpace-on-Mac

The bundling of dependencies was done using these two scripts, bundle-macos-local.sh and bundle-python.sh.

Passkeys by default and retirement of Microsoft-provided SMS and voice authentication

Microsoft sent us an email and has a blog post where they say

To address these evolving threats, Microsoft Entra ID is updating its authentication experience by making passkeys the default phishing-resistant authentication method, helping customers reduce reliance on phishable methods such as SMS and voice.

I asked Gemini at aistudio.google.com, "How do I Identify users who still use SMS or voice in portal.azure.com?"

Gemini suggested

1. Method 1 - The Authentication Methods Activity Dashboard in Azure portal -  portal.azure.com > Microsoft Entra ID > Security > Authentication methods > Monitoring > Activity, "Click the Usage tab to see a high-level visual chart of which authentication methods are actually being used to sign in across your tenant"
2. Method 2 - Export a Report using Microsoft Graph PowerShell
3. Method 3: Check Actual Usage via Sign-in Logs - portal.azure.com > Microsoft Entra ID > Sign in logs, look at the Authentication Details tab

I asked Gemini,

I get the message "Migrate to the converged Authentication methods policy"

"Please migrate your authentication methods off the legacy MFA and SSPR policies by September 2025 to avoid any service impact."

What does that mean, and how do I do it?

Gemini replied, 

What does this mean?

Historically, Microsoft Entra ID (formerly Azure AD) had two separate, disconnected portals for managing how users prove their identity:

1.  The Legacy MFA Portal: Used to control methods for Multi-Factor

    Authentication (MFA).

2.  The SSPR Portal: Used to control methods for Self-Service Password Reset

    (SSPR).

Because managing these in two different places was confusing, Microsoft created a unified "Authentication methods policy." This new policy is a single, converged dashboard where you manage all authentication methods (Microsoft Authenticator, SMS, Voice, FIDO2, Passkeys, etc.) for both MFA and Password Resets.

Microsoft is retiring the old legacy portals by September 30, 2025. The message you are seeing is a warning that your tenant is still relying on the old legacy settings, and you need to manually flip a switch to tell Microsoft to use the new modern policy instead.

If you don't do this before the deadline, you risk service disruption (users

might not be able to register or use their MFA/SSPR methods properly) once

Microsoft turns off the old portals.

How do I do the migration?

Migrating doesn't mean your users have to set up their MFA again; it simply

means you, as the administrator, are changing where the rules are managed.

Here is the step-by-step process to migrate safely:

Step 1: Audit your existing legacy settings

Before you switch over, you need to see what methods you currently allow so you

can match them in the new portal.

1.  Sign in to the Microsoft Entra admin center as a Global Administrator or

    Authentication Policy Administrator.

2.  Check your Legacy SSPR Settings: Go to Protection > Password reset >

    Authentication methods. Note which boxes are checked (e.g., Mobile app code,

    Email, Mobile phone).

3.  Check your Legacy MFA Settings: Go to Users > All users > Click Per-user MFA

    at the top. On the new page, click service settings at the top. Note which

    verification options are checked (e.g., Text message, Call, Notification).

Step 2: Configure the new Converged Policy

Now, you must replicate those allowed settings in the new unified portal.

1.  In the Entra admin center, go to Protection > Authentication methods >

    Policies.

2.  You will see a list of methods (Microsoft Authenticator, SMS, Voice call,

    FIDO2 security key, etc.).

3.  Click into each method you want to allow (based on your notes from Step 1).

4.  Toggle the Enable switch to Yes, set the Target to All users (or specific

    groups), and hit Save. (Note: It is highly recommended to enable Microsoft

    Authenticator and Temporary Access Pass, as Microsoft is pushing toward

    modern/phishing-resistant methods).

Step 3: Change the Migration State

Once your new policy matches your old settings, you are ready to flip the

switch.

1.  Still in Protection > Authentication methods > Policies, look near the top

    of the page for a banner or a button labeled Manage migration.

2.  A flyout menu will appear on the right side of your screen with three

    options:

      - Pre-migration: (Where you are currently) - Only legacy policies are

        respected.

      - Migration in progress: - Both policies are respected, but the new

        converged policy is evaluated first.

      - Migration Complete: - The legacy policies are completely ignored, and

        only the new converged policy is used.

3.  Select Migration in progress and click Save.

4.  Take a few days to ensure your users can still sign in, use MFA, and reset

    their passwords without issue.

5.  Once you confirm everything works, go back to the Manage migration menu,

    select Migration Complete, and click Save.

That's it! Once you hit "Migration Complete," the warning message in your portal

will disappear, your tenant will be fully modernized, and you will be safe from

the September 2025 deprecation deadline.

It was in the Migration in progress state. And all the methods are shown as not enabled. I asked Gemini if I should enable them.

Gemini said, Yes, absolutely. Because you are in the Migration in progress state, Microsoft is currently looking at both your old legacy settings and the new portal. If a method is turned on in either place, your users can use it.

Here is a screenshot of the authentication methods page, after I enabled some of them. 

I'm detailing the creation and use of passkeys on Linux / Android in another post.

saga of decommissioned UPS

Dec 18, 2025 - email to the top executive officer of one of our institutions, saying that we could possibly make use of a decommissioned 10 kVA UPS

Feb 20, 2026 - email "received with thanks". It takes 20 65Ah lead acid batteries, trying to charge the batteries with 12V charger ordered on 25th Feb.

June 29, 2026 - requesting electrical people to wire up the batteries which were individually charged

July 23-26, 2026 - internal resistance testing shows 11 of the 20 batteries are bad, which makes the UPS trip when input power fails. So, decide to not use it.

July 31, 2026 - sent the good batteries to another institution.