For a few years I used a Raspberry Pi 4 (RPi) as a Pi-hole and Wireguard server on my home network. An RPi 4 is overpowered for that sort of thing, but I had it, so I figured I might as well use it.

Over the last few weeks I noticed increasing problems with it. The best I can tell is that the RPi Micro SD card reading/writing hardware was somehow broken. The Micro SD card I had in it originally proved bad when I tried imaging it with a fresh OS install. A different card could successfully be imaged, but when I booted the RPi from it, some programs wouldn't run because they were corrupt.

I thought about buying a replacement RPi, but because of the RAMpocalypse, prices have gone through the roof. An equivalent new RPi 4 would cost $55, when I'm sure I purchased the original one for much less than that. With shipping it was looking like a $70-80 purchase, which seemed ridiculous.

In the end, I decided to simply run the Pi-hole and Wireguard services as Docker containers on the Mac Mini M4 I use as a media center. I leave the Mac Mini running all the time anyway, it uses only 4 Watts at idle, and it's more than capable of running these services.

Looking at pricing of new RPis, including the newest RPi 5, it got me thinking about the value proposition of the RPi 5 at the moment. The RPi was developed to be a low-cost, versatile single-board computer with many applications. All RPis can be used for various general and specialty computing projects, see the wide variety of RPi HATs available. However, with the newest RPi 5, they are trying to make the argument that it's becoming a general purpose computer for everyday use. They even highlight that the RPi 5 can drive dual 4K monitors at 60 Hz, not something I would associate with cheap computing.

Let's look at this complete RPi 5 kit. It comes with all you need to get up and running, minus a monitor, keyboard, and mouse. A 256GB SSD kit with 8GB of RAM costs $320. The kit includes active cooling, which is required to achieve maximum performance. A base RPi 5 with 8Gb of RAM costs $175, which means the rest of the kit costs $145.

Let's compare this to a base Mac Mini M6. This comes with 256 GB of SSD storage and 16GB of RAM for $899. Like the RPi kit, it comes with everything you need save a monitor, keyboard, and mouse.

Using a $305 RPi 5 with 16GB of RAM to match the Mini (making the RPi kit $305 + $145 = $450), below I compare the speeds of these computers. I'm using this Mac Mini M6 benchmark and this RPi 5 benchmark.

We can see that the Mac Mini is over 5x faster in single core, and almost 10x faster in multicore, while the Mini costs only 2x more. That is a devastating price to performance ratio for the RPi. But wait!, you say, you can still buy two RPis for one Mini, which if you're on a limited budget (say, in a school), it really helps. But wait!, I respond, you still need to buy monitors, keyboards, and mice, which cost the same regardless if they're connected to a Mini or a RPi. The price savings with RPis isn't as big as you might think.

The true value proposition of an RPis are the GPIO pins which enables tons of fun and interesting computing projects. My solar water heater uses a RPi 3B+ and its GPIO pins to collect data and act as the thermostat. The tough spot that the RAMpocalypse has put RPi 5s is that this value proposition has been overtaken by component pricing, making the RPi 5 a poor choice for a general purpose computer. There might be situations where a faster RPi is needed when using the GPIO pins, but that's getting potentially niche. I would guess that most things you would need an RPi for could be done with one of the older and less expensive models.

Perhaps once the RAMpocalypse has passed the RPi 5 will again become an economical choice for hobby computing, but sadly, it isn't right now.

I recently wrote about some useful command line utilities, and here are a few more I either forgot to add, or just discovered.

fd

I've never liked the find command. It's clunky to use, and worst of all often prints out hundreds of permission error lines. A good replacement is fd, which is faster and much nicer to use. For example, here's a search for this website's name starting from the root "/" of this Linode using find and fd, passed through wc (which counts characters and lines):

You can see that find printed out 1,301 lines in 2.5 seconds, while fd output only 19 in 1.5 seconds. All of those 19 are useful lines, while most of those 1,301 lines are telling me where I can't search.

By the way, notice the red lock 🔒 symbol in the terminal above? That's Starship (which I mentioned previously) telling me that the user does not have write permission inside the current directory.

delta

Both mercurial and git feature the diff command, which shows you the difference in content between the current files on disk and the most recent commit. This is very useful as a way to see what's changed before you make a new commit. delta is a tool that (amazingly) works with both (mercurial is the often forgotten redheaded stepchild) and supercharges the diff command. It's language aware (like bat which I mentioned before), and offers a side-by-side viewing option. I haven't used it much, but I'm optimistic it will prove useful.

duf

For showing what disks are attached, and how much free space there is, duf is a pretty replacement for df.

Dust

The command "du" is used to sum up the disk spaced used in a directory. Dust does the same thing, but faster, and shows a hierarchical and sorted view of what files and subdirectories are taking the most space. Of all the tools I've featured here, this is the one I'm least sure about. I could see using it on a remote computer, but on my Mac I think prefer using something like OmniDiskSweeper that has a nice GUI and allows you to delete things interactively.

I've already posted twice about using AI/LLMs, and buckle up for another exciting installment. But! Before I get into the meat of the topic, I need to lay some groundwork.

The company I work for uses Amazon Web Services (AWS) for compute and storage. Within AWS you're very much encouraged to set up a Virtual Private Cloud (VPC) which is a way of isolating your cloud infrastructure away from the internet and other AWS users. Part of the VPC is a firewall that prevents outside access to the Virtual Private Network. Of course, as an employee, I need to be able to get inside the firewall, so we have a VPN Gateway that allows outside users on the public internet to access resources inside the VPC, but only if you can successfully authenticate with the gateway.

Below is a diagram showing this. My laptop connects to the VPN gateway, and from the gateway I can access a Linux machine. For example, if I want to ssh into a Linux box, that connection gets wrapped via the VPN connection to the gateway, which then unwraps it and passes the ssh connection to the Linux box.

                 ┌─────────────────────────────────────────┐
                 │                VPC                      │
                 │                                         │
┌─────────┐      │ ┌──────────────┐       ┌──────────────┐ │
│ Laptop  ├──────┼►│ VPN Gateway  ├──────►│  Linux Box   │ │
└─────────┘      │ └──────────────┘  ssh  └──────────────┘ │
         VPN(ssh)└─────────────────────────────────────────┘

For reasons that are not important here, we are overhauling how we do various things with respect to security. One part of this is we are turning off the ability to ssh into Linux machines in favor of AWS SSM. SSM gives you an encrypted shell/terminal connection to a host, just like ssh, but it doesn't use ssh at all. One motivation is that AWS SSM allows convenient logging of who connected to a particular machine, when they did, and what shell commands they ran. Another is that access to resources can be defined at the AWS permissions level, away from the individual Linux machines. With SSM we don't need a gateway to access things inside the VPN. It works like this: When the Linux box boots, an agent on the machine registers itself with SSM, which lives outside the VPN (it's run by AWS, not us). Next, when I wish to connect to the box, my laptop authenticates with SSM, which checks if I'm allowed to connect. If I am, SSM connects me to the machine inside the VPN by forwarding data between my laptop and the Linux box. At the same time, logs are kept of the connection and commands I run. See the diagram below.

                    ┌─────────────┐  ┌─────────────┐
      ┌────────────►│   AWS SSM   ├─►│  AWS Logs   │
      │             └─────────▲───┘  └─────────────┘
      │                       │                     
┌─────┴─────┐                 │                     
│  Laptop   │    ┌────────────┼───────┐             
└───────────┘    │   VPC      │       │             
                 │  ┌─────────┴────┐  │             
                 │  │  Linux Box   │  │             
                 │  └──────────────┘  │             
                 └────────────────────┘             

The official way to connect is via the AWS CLI tool, which is written in Python. Somewhat oddly, the command to connect, aws ssm start-session --target instance-id --profile somename --region us-east-1, actually hands off to the Go binary session-manager-plugin after authentication is completed. This all works, but it wasn't satisfactory. I found it clunky and inconvenient — just compare the long aws ssm command above to the much shorter command ssh user@host-ip!

Much of that clunky command can be scripted away, but the official client has some broken functionality. For example, I don't use the nano text editor often, but it's useful for quick edits (I also use vi, if you're wondering). It uses "Ctrl-key" actions, such as searching ("Ctrl-w"), saving ("Ctrl-o"), and quitting ("Ctrl-x"). There may be something wrong on my end I never diagnosed, but I couldn't get any of those "Ctrl-key" commands to work. Additionally, ssh has its companion program scp that transfers files between computers. You can imagine that this is a useful feature, and it's something that SSM doesn't include.

Because of this I decided to see what an LLM (Claude) could do. I asked it to write a program that worked with AWS SSM but acted more like ssh. I named it sshaws. I told it to write it in Rust because Rust is fast, secure, and I figured that all the required crates would already exist. To give away the ending, the LLM did a fine job! The program doesn't have any of the odd quirks (no "Ctrl-key" problems) that aws ssm start-session does. But more than that, I tailored it to work well with my workflow, and it's now more convenient than ssh ever was, amazingly. Here are a few examples of neat features it has:

• I had it add a Terminal User Interface (TUI) that auto discovers all the Linux boxes I have access to (see the screenshot below¹). It shows if the instance is running, or if I can access the instance (perhaps the SSM agent isn't set up on the Linux machine). Other metadata can also shown, such as instance type, IP address, or environment. I can filter the instances list with a simple text search. The instance listing is especially useful for me because much of my workflow uses temporary Linux machines that exist for minutes to hours, so being able to quickly narrow down to one is great.

• There is a "recent" hosts pane that is useful for reconnecting to a host I've worked with recently (bottom left). Instances I have connected to that have been deleted are shown with strike through text, while those simply powered off use greyed out text.

• The application has a config file that allows me to define quick shortcuts for machines I access frequently. These shortcuts are available in a TUI pane (top left), and also from the command line, e.g. sshaws webhost.

• Unlike VPN/ssh connections, SSM connections can time out after as little as six hours due to AWS authentication rules. Having a session die while using it is very annoying, so I added a feature where sshaws will auto-connect to a running tmux session, or start one if needed. This way, if you're cut off, what you were doing on the host is uninterrupted, and you can pick up where you left off by reconnecting.

• To replace scp I had the LLM add flags to transfer files: sshaws put file.txt webhost:/home/user/ or sshaws get webhost:/home/user/file.txt .. But even better, I had it add a second TUI (see below) that allows me to browse my local machine and remote, and mark files and directories for transfer either direction. It auto compresses and decompresses files and directories transparently to speed up transfers.

• I added a command each which will run a command on more than one host in parallel and return the result, for example sshaws each 'boxname*' 'uptime' will print out the result of running the uptime command on all hosts that match boxname*, e.g. boxname01, boxname02, and boxname-prod would all match.

Why was the LLM so successful at this? The answer is simple: LLMs are advanced prediction engines, like Google autocomplete, but fancier. If you tell it where to start and where to go, you're giving it a path to follow, and that's when they work best. In this case I asked it to put to things together (SSM & ssh) that it knows about because it's all open source, and what functionality I wanted. It didn't have to invent anything new, it just had to mix two things together by following my instructions.

Am I okay with using LLM like this? Yes, yes I am. My job is not writing tooling for accessing AWS SSM. As I said above, nothing new is being created here; existing things were just smooshed together. My job as a human is to create new things with my biological creativity, and offloading this task to an LLM was a win.

Finally, I don't know if I will try to make sshaws open source. There's nothing proprietary about it, so I could. I'm not super worried about major issues. I've passed it through Claude Fable², which has been reported as being excellent at finding code bugs, and it fixed a few minor ones. While the tool might be useful for people outside my company, I would feel more comfortable about releasing it if I and a few other humans went through it and audited it for hallucinations and confusing comments, Fable's findings notwithstanding.

1. All the screenshots use fake data ↩︎
2. I mainly used Claude Opus to write the code because it's cheaper than Fable ↩︎

Recently I've been doing a little tuning of my shell environment, swapping old tools for new ones and tweaking various settings. I thought I'd highlight a few of them.

Ghostty

For years I used iTerm2 as a replacement for the default Mac OS Terminal app. Recently I've switched to Ghostty. It's just as configurable in the ways I care about as iTerm2, but much, much faster. I sometimes have reason to paste a decent amount of text into the terminal and Ghostty handles it much faster than iTerm2. Overall it just feels more modern and slicker than iTerm2.

Starship

In the screenshot above you can see a few shell prompts showing what Starship can do. For example, when you're in a folder containing a programming project, it will show you the language in use. For example in the "sshaws_rust" folder you can see "🦀 v1.97.1", which shows my current version of Rust installed. Similarly you can see "☕️ v17.0.8" for Java, "🆂 v3.8.4" for Scala, and "🐍 v3.12.12" for Python. It also shows you stats about your machine (e.g. free RAM), what directory you're currently in, or how long a command took to run.

In the screenshot below, you can see the "🌏 marzipan" which shows that this is a remote machine named "marzipan," which helps prevent confusion about what machine you're on.

zoxide

I haven't been using this very long, and I'm still getting used to it, but zoxide is a handy way to navigate around your folder hierarchy. In the first screenshot above you can see that z core took me straight to that directory and zi opens an interactive search function.

fzf

Like most, I'm sure, I end up typing the same or very similar commands repeatedly. "Ctrl-r" is the standard way of searching for previous commands. fzf turbo-charges this and works very well.

bat

The Unix/Linux command cat is over fifty years old, and I've been using it for almost thirty. bat replaces it and includes syntax highlighting and line numbers. Because I've been using cat for so long, and have muscle memory for cat, I've set an alias from cat to bat.

eza

Combined with a Nerd Font (I use "Inconsolata Nerd Font Mono"), eza replaces the built in ls and ls -l with a much fancier directory listing. In the screenshot above you can see that each document type gets a little icon, and there are far more color codes than plain ls. The columns shown in the -l view can also be customized much more than vanilla ls.

ripgrep

Many years ago I started using grin which is (was?) a recursive grep utility. Being a Python 2 utility and Python 2 reached end-of-life in 2020, I switched to grin3. Now I'm getting used to using ripgrep, which A) is faster than grin3, and B) is maintained while grin3 is not.

oh my zsh

I've been using zsh for years, and oh my zsh helps configure it with all kinds of goodies.

Raycast

It's not a command line utilty, but Raycast has proven invaluable. It's a supercharged Spotlight replacement. It has many useful features, not least of which is the Clipboard History. The Calculator is great for quick math and unit conversion.

Confguration Files

If you want to see my configuration files, just drop me a line!