c0smos.dev

UoftCTF Writeup

Sat, 31 Jan 2026 04:06:59 GMT

This is a simple challenge, but I'll talk a bit about angr and symbolic execution for newbies.

Initial Look

For the challenge handout we've been given a simple flag checker binary named checker. When simply running it and testing it, its asks for user input and rejects/accepts it, pretty standard and nothing fancy so far. Running file on this reveals that it's a statically compiled binary but the section header is missing which is not a good sign.

After this I decided to open this in IDA to have a better look at what it's doing, but when I opened it in IDA I noticed something very strange. The binary only has 5-6 functions:

and there is a big blog of bytes possibly our code which has been laid out as bytes, but if we simply try to convert these bytes into code using IDA it gives us obscure instructions, so we're probably missing something.

But if we look at the Strings in this binary it gives away why this binary looks so weird. Looking at this string: $Info: This file is packed with the UPX executable packer we know that the binary is packed with upx and this is why IDA only shows us a tiny stub while the rest of the actual code is compressed and unpacked at runtime.

Now we can simply unpack the file using upx and take a look at the actual file using: upx -d checker

Looking at the actual file

Opening the actual binary in IDA, we can see a whopping 4231 functions!

If we take a look at the decomp of the main function:

int __fastcall main(int argc, const char **argv, const char **envp)
{
  unsigned __int64 i; // [rsp+0h] [rbp-80h]
  char v5[48]; // [rsp+10h] [rbp-70h] BYREF
  char s[56]; // [rsp+40h] [rbp-40h] BYREF
  unsigned __int64 v7; // [rsp+78h] [rbp-8h]

  v7 = __readfsqword(0x28u);
  if ( fgets(s, 46, _bss_start) && strcspn(s, "\r\n") == 42 )
  {
    for ( i = 0LL; i <= 41; ++i )
      v5[i] = s[i];
    f_0(v5);
    return 0;
  }
  else
  {
    puts("No");
    return 0;
  }
}

We see that it takes our input and rejects it if the length is not 42. It then copies it into a buffer and passes it to f_0.

Now looking at function f_0, it modifies the buffer and then passes it to function f_1 and so on until function f_4200. Function f_4200 compares the modified input buffer to pre-existing bytes and if it matches then we're good.

But the problem at hand is that there are 4200 functions and it's really hard to look at each one manually let alone reverse them. So let's try to find a pattern within these functions.

If we take a look at some of these function we can see that all these functions perform byte assignment at some index of the input buffer. There are two important things to note here:

- The byte assignments are independent of each other meaning each function only modifies a single byte in the input buffer.

- These are very trivial operations so should be fairly easy to reverse.

So in theory, we can build a reverse map for each function and call it on the expected bytes to get to the actual flag. But doing that for 4200 is literal insanity.

Enter: Symbolic Execution

Since finding the correct input which gets us the flag is very hard with normal execution we should give symbolic execution a try. If you're new to the concept of symbolic execution I'll try my best to give you a fair gist of it.

Symbolic Execution is a great way to understand program execution and program behavior under different inputs, conversely it also helps us find that input given an execution path. In symbolic execution we don't work with fixed variable values, instead we define symbolic variables which do not have a defined value but rather accumulate constraints throughout the process execution. And at the end present it in the form of an equation which can be solved to get the desired value.

This way symbolic execution let's us explore multiple paths that a binary can take and then let's us choose which path are we interested in and how do we get there.

Time to get angr-y

angr is an excellent framework for symbolic execution on binaries and we'll use that to solve this problem.

First we'll load the binary in angr and create an angr project and define our flag length which we know is 42 bytes long (43 with a newline).

BIN_PATH = "./checker"
FLAG_LEN = 42            # maybe 43 if newline is included; adjust if needed

proj = angr.Project(BIN_PATH, auto_load_libs=False)

Next we'll create symbolic variables for each character of our flag string, for this we'll use claripy which is angr's abstraction layer on top of z3. For each character of the flag we'll create a symbolic variable using claripy.BVS(name, size_in_bits). We can name each character of the flag based on it's index for simplicity and since each character in C takes 1 byte, we'll define these symbolic vars. as 8 bits long.

flag_chars = [claripy.BVS(f'flag_{i}', 8) for i in range(FLAG_LEN)]
flag = claripy.Concat(*flag_chars)

Now we'll create a state for our program in angr, a state let's us access the program's memory, registers and every object during the emulation of the program. If you're curious you might dump a register value in a particular state and find a symbolic variable instead of a concrete value inside it like this: <BV64 reg_48_11_64{UNINITIALIZED}>. We'll choose the state as the entrypoint of the program with .entry_state() and provide our flag (symbolic variable) as the input.

state = proj.factory.entry_state(stdin=flag)

Next we can define some custom constraints on the input flag other than the ones that the binary imposes, and that is to constrain every flag char. variable to be in the ASCII printable range, we can actually further modify them based on the regex of the flag format but this is more generalized. This step isn't necessary but is good practice to include and will tighten our constraints.

for c in flag_chars:
    state.solver.add(c >= 0x20, c <= 0x7e)

Next and very important step is to declare a simulation manager, since symbolic execution goes over multiples states, we need a Simulation Manager to manage all these states so that we can explore and find the path that leads us to the success state. Speaking of which we also need to define a success state and optionally a fail state.

In function f_4200 we accept/reject the block based on a simple compare operation, which makes the binary take one of two paths (correct/incorrect flag). We can use the address of these blocks of code as our success/failure states. Since PIE is enabled we need to make sure add the base address of the binary along with the offset we get from IDA and then we simply tell the simulation manager to find a path which gets us to the success state and avoid all paths which get us to the failed state.

BASE = proj.loader.main_object.mapped_base
print("BASE =", hex(BASE))

ADDR_YES = BASE + 0x40E6F
ADDR_NO  = BASE + 0x40E80

simgr.explore(find=ADDR_YES, avoid=ADDR_NO)

At last if any such paths are found then we use the solver to print the input that was used to reach that path:

if simgr.found:
    found = simgr.found[0]
    solve = found.solver.eval(flag, cast_to=bytes)
    print("FLAG:", solve)
else:
    print("No solution found")

Final solve script

import angr
import claripy

BIN_PATH = "./checker"
FLAG_LEN = 42            # maybe 43 if newline is included; adjust if needed

proj = angr.Project(BIN_PATH, auto_load_libs=False)

BASE = proj.loader.main_object.mapped_base
print("BASE =", hex(BASE))

ADDR_YES = BASE + 0x40E6F
ADDR_NO  = BASE + 0x40E80

print("ADDR_YES =", hex(ADDR_YES))
print("ADDR_NO  =", hex(ADDR_NO))

# Create 42 symbolic bytes
flag_chars = [claripy.BVS(f'flag_{i}', 8) for i in range(FLAG_LEN)]
flag = claripy.Concat(*flag_chars)

# Supply symbolic input on stdin
state = proj.factory.entry_state(stdin=flag)

# Constrain to printable bytes (typical CTF flags)
for c in flag_chars:
    state.solver.add(c >= 0x20, c <= 0x7e)

simgr = proj.factory.simulation_manager(state)

# Explore until we hit the 'Yes' block, avoiding 'No'
simgr.explore(find=ADDR_YES, avoid=ADDR_NO)

if simgr.found:
    found = simgr.found[0]
    solve = found.solver.eval(flag, cast_to=bytes)
    print("FLAG:", solve)
else:
    print("No solution found")

CorCTF 2025

Sun, 21 Sep 2025 02:28:07 GMT

Challenge #1: yourock

Category: rev

Author: jazz

Challenge prompt:

Forget Enigma, forget Caesar. The only cipher you need is 2009's infamous password dump.

Challenge handout has two files inside, one of them is a target ELF named encode and the other one is an encrypted file named encoded.rj. Before we begin decompilation let's see what happens when we run the program:

Usage: ./encode "your message"

So the program expects a string, let's try a random string for now:

Failed to open ./rockyou.txt

So the program needs rockyou.txt to be in the same directory, I'm guessing it uses it to encode the input string. This is also explains what the challenge prompt is referring to "The only cipher you need is 2009's infamous password dump."

So after placing rockyou.txt in the same directory, we pass in a string "random":

cosmos@cosmos-VirtualBox:~/workspace/corctf/yourock$ ./encode random
Encoded output:
hellokitty 00000 qwerty lovely 12345678 12345678 1234567

If we compare this with our encoded.rj file, we can see that both of them have a similar format, where the encoded output has words separated by a space. I think it is safe to assume that the encoded.rj file is encoded output of the flag when it was ran against the given program.

Another interesting thing to notice is that the number of words in the encoded output is always 1 more than the length of the input string, this suggests that the encode program could be doing some kind of byte-by-byte operation on the input string outputting an extra word with it.

DECOMPILATION

Let's look at the program decompilation in IDA:

std::allocator<char>::allocator(&wordlist_map, argv, a3);
std::string::basic_string<std::allocator<char>>(&input, argv[1], &wordlist_map);
std::allocator<char>::~allocator(&wordlist_map);
std::vector<std::string>::vector(&wordlist_lines);
std::unordered_map<std::string,unsigned long>::unordered_map(&wordlist_map);
if ( (unsigned __int8)load_file(&wordlist_lines, &wordlist_map) != 1 )

Looking at this we can safely say that this is a C++ binary and at first it can be hard to read, but let's try to dig in and see what the binary is trying to do.

So the binary allocates an empty string vector named wordlist_lines and an unordered map named wordlist_map. If you don't know what an unordered map is, you can think of it as a python dictionary which holds values in key-value pairs as they are both implementations of hash maps.

Encoding

Upon successfully opening rockyou.txt it generates a key using generate_key and encodes the given string using encode function which takes 4 args.:

- encoded_words (empty vector for now)

- input (input string)

- wordlist_lines (vector containing all passwords from rockyou.txt)

- key (generated from generate_key)

And after execution of this function the binary prints out the encoded_words buffer separated by a space.

Let's look inside the encode function first:

  std::vector<std::string>::vector(encoded_words);
  word = std::vector<std::string>::operator[](wordlist_lines, key);
  std::vector<std::string>::push_back(encoded_words, word);
  for ( i = 0LL; i < std::string::size(input); ++i )
  {
    xored_byte = key ^ *(_BYTE *)std::string::operator[](input, i);
    if ( xored_byte >= (unsigned __int64)std::vector<std::string>::size(wordlist_lines) )
      exit(1);
    new_line = std::vector<std::string>::operator[](wordlist_lines, xored_byte);
    std::vector<std::string>::push_back(encoded_words, new_line);
    key ^= i ^ xored_byte;
  }
  return encoded_words;

so the encode function boils down to this:

- It takes the key and uses it as an index in the wordlist_lines array, grabs the word from that index and puts that word into the encoded_words array. (This is the reason why we always have an extra word in the encoded output)

- After that it kicks off a loop based on the size of the input string, and XOR's every byte of the input string with the key.

- Then it uses the XOR'ed value as an index into the wordlist array and puts that word into the encoded words array.

- Then it updates the key by XOR'ing it with the index and the xored_byte variable

Updating the key is a simple XOR operation which can be reversed if we know the index i and the xored_byte, we already know i but the xored_byte depends on the initial key. So all we need to break this encoding is the initial key, let's see how that is being generated.

Key generation

Key generation is pretty simple, we take a time-based seed and feed it to srand and then generate a random number from it. But we compute the modulus of it with 256 means that the returned value will be within the range [0, 255]

__int64 __fastcall generate_key(__int64 *a1)
{
  unsigned int v1; // eax

  v1 = time(a1);
  srand(v1);
  return (unsigned int)(rand() % 256);
}

Since our key is used as an index in the wordlist array, it means that our initial word will always be within the first 255 words of rockyou.txt. So basically given an encoded output we just need to find the index of the first encoded word and that will be our key.

Looking at encoded.rj the first word is charlie, let's look for its index in rockyou.txt

head -n255 rockyou.txt | cat -n | grep charlie

the output comes out to be 64 charlie, but since this is 1-indexed we can set our key as 63.

Solution

Now that we know our initial key we can reverse the XOR operation and get the actual string back, While encoding the input string we did:

xored_byte = input[i] ^ key

so to reverse this we just need to do:

input[i] = xored_byte ^ key

This is the final solve script:

with open("encoded.rj") as fp:
    encoded = fp.read().strip()

encoded_words = encoded.split(" ")
print(encoded_words)

flag = ""

with open("rockyou.txt", encoding='utf-8', errors="ignore") as fp:
    pwds = [line.strip() for line in fp]

key = pwds.index(encoded_words[0])
encoded_words = encoded_words[1:]

for i in range(len(encoded_words)):
    xored_byte = pwds.index(encoded_words[i])
    flag += chr(key^xored_byte)
    key ^= i^xored_byte

print(flag)

And we get the flag: corctf{r0cky0u_3nc0d1ng_r0cks} 🎉

Challenge #2: tagme

Category: rev

Author: maxster

We are greeted with a dynamically linked, stripped binary. Classic crackme style challenge which takes in a input string and validates it, our input is also our flag.

Looking at the binary in IDA the binary isn't completely stripped, libc functions are there, but we still need to make sense of some functions and rename them:

void __fastcall __noreturn main(int a1, char **a2, char **a3)
{
  char v3; // [rsp+3h] [rbp-3Dh]
  char *lineptr; // [rsp+8h] [rbp-38h] BYREF
  size_t n; // [rsp+10h] [rbp-30h] BYREF
  unsigned __int64 i; // [rsp+18h] [rbp-28h]
  __ssize_t v7; // [rsp+20h] [rbp-20h]
  char *v8; // [rsp+28h] [rbp-18h]
  unsigned __int64 v9; // [rsp+30h] [rbp-10h]
  unsigned __int64 v10; // [rsp+38h] [rbp-8h]

  v10 = __readfsqword(0x28u);
  puts("Enter flag:");
  lineptr = 0LL;
  n = 0LL;
  v7 = getline(&lineptr, &n, stdin);
  if ( v7 == -1 )
    sub_1209("Illiterate");
  if ( v7 <= 8 )
    sub_1209("Short");
  if ( v7 > 39 )
    sub_1209("Long");
  if ( strncmp("corctf{", lineptr, 7uLL) )
    sub_1209("Ineligible");
  if ( strncmp("}\n", &lineptr[v7 - 2], 2uLL) )
    sub_1209("Ineligible");
  sub_126D();
  v8 = lineptr + 7;
  v9 = v7 - 9;
  for ( i = 0LL; i < v9; ++i )
  {
    v3 = v8[i];
    if ( (i & 1) != 0 )
    {
      if ( i % 6 > 3 )
      {
        if ( v3 <= 112 )
          sub_1209("Forbidden");
      }
      else if ( v3 <= 107 || v3 == 115 )
      {
        sub_1209("Forbidden");
      }
    }
    else if ( v3 == 99 || v3 > 108 )
    {
      sub_1209("Forbidden");
    }
    sub_12A4((unsigned int)v3);
  }
  while ( !(unsigned int)sub_13F8() )
    ;
  sub_1209("Boring");
}

We take input from stdin using getline, which returns the number of chars taken input. This means that v7 has the flag_length and lineptr is basically a pointer to the input string.

v8 is flag_ptr + 7, since flag format starts with corctf{, v8 basically points to the first character inside the brackets aka the flag_bytes. v9 is v7 - 9 and since v7 was our flag_length, v9 is the length of our flag_bytes which is the string inside the brackets.

By the looks of it sub_1209() looks like some kind of fail condition function, since it prints Rejected and exits the program.

void __fastcall __noreturn sub_1209(const char *a1)
{
  printf("%s\nRejected\n", a1);
  exit(1);
}

We'll rename sub_1209 to fail for now. We can also rename v8 and v9 to flag_chars and flag_len based on what we discussed above.

Looking at the for loop, we loop until the end of the input string and store the current byte in v3. We can rename v3 as flag_byte. Now if we look inside the for loop it is laid out with traps which instantly trigger the fail condition, if we manage to avoid these we get to a function named sub_12A4

Now let's look at this other function sub_12A4:

__int64 __fastcall sub_12A4(char a1)
{
  __int64 result; // rax

  byte_4060[qword_4048] = a1;
  if ( ++qword_4048 == 4600 )
    qword_4048 = 0LL;
  result = qword_4040;
  if ( qword_4048 == qword_4040 )
    sub_123B("Interesting");
  return result;
}

If we manage to avoid the traps, we pass the flag_byte as input to this function which writes it to a global buffer byte_4060. The index is decided by another value stored in the .bss qword_4048. This global buffer is interesting because it writes upto size 4600 and then loops back around to the start of the buffer by setting the index pointer to 0.

This means that byte_4060 is some kind of circular buffer with length 4600. We also take another pointer qword_4040 and compare it with our index pointer. If these two pointers match then we take this other function sub_123B and if we look inside it we can see that it prints Accepted and exits. This clearly means that this is our success case and we have to somehow reach here to get the flag!

So based on all of this we can re-define:

- byte_4060 to circular_buffer

- qword_4048 to write_ptr

- qword_4040 to read_ptr

- sub_123B to success

There's another interesting function in a while loop at the end, let's uncover that:

__int64 sub_13F8()
{
  size_t j; // rax
  char v2; // [rsp+Ah] [rbp-26h]
  char v3; // [rsp+Bh] [rbp-25h]
  int i; // [rsp+Ch] [rbp-24h]
  size_t v5; // [rsp+10h] [rbp-20h]
  __int64 v6; // [rsp+18h] [rbp-18h]
  char *s; // [rsp+28h] [rbp-8h]

  if ( (unsigned int)sub_138A() )
    return 1LL;
  v2 = sub_1318();
  v6 = sub_13AB((unsigned int)v2);
  if ( v6 == -1 )
    fail("Bizzare");
  for ( i = 1; i <= 1; ++i )
  {
    if ( (unsigned int)sub_138A() )
      return 1LL;
    v3 = sub_1318();
    if ( sub_13AB((unsigned int)v3) == -1 )
      fail("Bizzarre");
  }
  s = (char *)*((_QWORD *)&unk_3CE0 + 2 * v6 + 1);
  v5 = 0LL;
  for ( j = strlen(s); v5 < j; j = strlen(s) )
    sub_12A4(s[v5++]);
  return 0LL;
}

If we look at sub_1318, we check if our write_ptr is the same as qword_4040. If not we use the qword_4040 to read values from the circular_buffer and return it. From this we can rename qword_4040 to be our read_ptr

__int64 sub_1318()
{
  unsigned __int8 v1; // [rsp+Fh] [rbp-1h]

  if ( qword_4040 == write_ptr )
    fail("Dry");
  v1 = circular_buffer[qword_4040];
  if ( ++qword_4040 == 4600 )
    qword_4040 = 0LL;
  return v1;
}

This also makes sense because at the start of the function, we check if read_ptr and write_ptr are not same, otherwise it would mean that the buffer is empty. From this we can also rename sub_138A to is_buffer_empty as it does the same. We can also rename sub_1318 to circular_buffer_read.

Now let's look at sub_13AB:

__int64 __fastcall sub_13AB(char a1)
{
  unsigned __int64 i; // [rsp+Ch] [rbp-8h]

  for ( i = 0LL; i <= 9; ++i )
  {
    if ( a1 == *((_BYTE *)&unk_3CE0 + 16 * i) )
      return i;
  }
  return -1LL;
}

This is comparing a1(char from circular_buffer_read) to a dereferenced value from the global buffer/struct. But it's hard to read like this:

But looking at this we can see a clear defined structure, so let's go ahead and make a custom struct for this so it is more readable. So every entry has:

- 1 byte char

- 7 null bytes

- pointer to a string in .rodata (double-click aNs or aJjj to check)

Let's go over to Local types and make this struct:

we save this and we go over to our data in the global section and we hit y on the unk_3CE0 to change it's type to lookup_entry[10]; since we have 10 entries in total. And BOOM! we get a much more readable version:

From this we can get this mapping:

a ---> "ns"
b ---> "jjj"
c ---> "flag"
d ---> "q"
e ---> "tt"
f ---> "gg"
j ---> "gg"
n ---> "a"
p ---> "cor"
s ---> "aaa"

So if we look closely, the code takes each byte of input and checks it against the keys in this struct, if they don't match, it immediately reverts to a fail case and exits the program. So using this we've constrained our flag_bytes to only these 10 characters.

If we look further into the function it does circular_buffer_read twice that means it gets the current and the next flag_byte, but it only uses the flag_byte at the current index to modify the input string.

s = char_lookup_table[char_index].value;
v5 = 0LL;
for ( j = strlen(s); v5 < j; j = strlen(s) )
	circular_buffer_write(s[v5++]);

This piece of code just appends the value from the lookup_table to the end of the input string. So if our string was anp (assuming we pass the checks in our main function), it would become:

anp --------> npns
npns -------> pnsa
pnsa -------> nsacor
nsacor -----> sacora
sacora -----> acoraaaa
acoraaaa ---> coraaaans
coraaaans --> oraaaansflag
oraaaansflag --> Invalid ❌

Thinking about this we can rule out some more characters from our lookup_entry table as they'll lead to bad input characters i.e. characters which our not present in the lookup table after expansion. Therefore:

Bad input chars: ['b', 'c', 'd', 'e', 'f', 'j', 'p']

Good input chars: ['a', 'n', 's']

Now if we go back and look at the constraints present in the main function, we can maybe shorten our search space even more. The constraints in the main function are for odd/even indices and can be summarized like this:

There are only 3 types of possible input chars, if we hold the above assumption of good chars. to be true:

Odd1 indices ---> [1, 3, 7, 9, 13, 15...]  
these can only have char "n"  

Odd2 indices ---> [5, 11, 17...] 
these can only have char "s"

Even indices ---> [0, 2, 4, 6...] 
these can only have char "a"

Now that we know which indices can have which chars. we still need to know the length of the flag, but we can just try every flag length upto 30 and one of them should be correct. So we just write a simple script which does that.

Final solve script

from pwn import *

PREFIX = "corctf{"
SUFFIX = "}"

def generate_flags(len):
    
    candidate = []

    for i in range(len):
        if i%2 == 0:
            candidate.append("a")
        elif i % 6 > 3:
            candidate.append("s")
        else:
            candidate.append("n")

    return f"{PREFIX}{''.join(candidate)}{SUFFIX}"

for i in range(31):
    flag = generate_flags(i)
    
    with process("tagme", level="CRITICAL") as p:
        p.sendline(flag)
        
        out = p.recvall()
        if b'Accepted' in out:
            print(out)
            print(flag)

Flag: corctf{ananasananasananasananasana} 🎉

Stepping down into the Ocaml Mines - UIUCTF 2025 Writeup

Tue, 05 Aug 2025 23:57:09 GMT

This writeup and solution is a combined effort from me and my teammate “e-” (Elemental) as part of CTF Academy. I decided to keep this writeup a bit comprehensive because it took us embarrassingly long to solve this challenge, but it allowed me to learn a lot about how Ocaml works.

This rev challenge is based around a pretty old functional programming language known as “Ocaml” which I was completely unaware of before this CTF. Personally I found this challenge pretty interesting which helped me discover a niche language, understand it and then reverse the logic to get the flag!

Challenge #1: WeirdCaml

Category: rev
Author: n8

Brief info about the challenge and Ocaml

The challenge gives us a file with a long list of type definitions, which to be honest were a bit hard to understand for me.

type b_true
type b_false
type 'a val_t =
 | T : b_true val_t
 | F : b_false val_t

This snippet represents the first part of the problem, let’s break it down to understand what’s going on. The challenge file declares two empty types called b_true and b_false, at no point in the file are these types used for any variables, these are purely used as empty type markers or boolean flags. You can think of them as undefined macros in C:

#DEFINE b_true
#DEFINE b_false

Then there’s another type definition, ’a val_t. This is interesting because the type definition here is ambiguous and is dependent on type of a hence the apostrophe before it: ’a. This is known as a GADT (Generalized algebraic datatypes) in Ocaml. This pattern allows us to create polymorphic types by passing a ambiguous type parameter.

type 'a val_t =
 | T : b_true val_t
 | F : b_false val_t

T and F are called constructors for this GADT, this means that we can only invoke constructor T when ’a is set to b_true and constructor F only when ’a is set to b_false.

Now let’s look at the next part of the challenge:

type ('a, 'b, 'c, 'd) p1_t =
 | P1_1 : b_true val_t -> ('a, b_true, 'c, 'd) p1_t
 | P1_2 : b_true val_t -> ('a, 'b, b_true, 'd) p1_t
 | P1_3 : b_true val_t -> ('a, 'b, 'c, b_true) p1_t
 | P1_4 : b_true val_t -> (b_false, 'b, 'c, 'd) p1_t

now that we understand how GADT’s work, the challenge defines a ton of GADT’s in the form of px_t where x ranges from 1 to 1435 to be precise, but this time these GADT’s define 4 type parameters, and 4 constructors which determines different constraints on these type parameters.

For example: calling p1_t with constructor P1_1 with value T (b_true val_t) means that among the returned type parameters ’b has to be of the type b_true while ’a, ’c, ’d can be ambiguous types. In the given problem every constructor restricts one output type while the other 3 type parameters can be ambiguous types.

Taking a look at type puzzle

Finally we have one last type definition called puzzle, this defines the core problem in our CTF so let’s have a look at first part of puzzle:

type puzzle =
 Puzzle :
 'flag_000 val_t * 
 'flag_001 val_t * 
 'flag_002 val_t *
 …
 'flag_103 val_t *
 'a val_t * 
 'b val_t * 
 'c val_t *
 …
 'z val_t *
 'a1 val_t * 
 'a2 val_t * 
 'a3 val_t *
 …
 'a147 val_t *

type puzzle is another GADT, and a massive one which starts by defining a single constructor called Puzzle which binds a bunch of type variables divided in 3 parts:

'flag_000 to ‘flag_103 (flag bits encoded in the form of T/F)
‘a to ‘z (idk why there are types from a to z)
‘a1 to ‘a147 (more supporting variable types)

Since there are 104 type variables of the format flag_XXX, we can assume that these constitute individual flag bits, so 104/8 = 13 flag bytes. The other type variables are just supporting variables which help us set constraints for the flag type variables.
PS: Something which bugged me for a long time in this problem was why are there type variables ranging from ’a to ’z when they have nothing to do with the flag directly, before solving the problem I kept thinking they have some connection to the flag which kept putting me off-track.

Now let’s look at next part of type puzzle:

('a, 'flag_016, 'flag_038, 'flag_040) p1_t *
('a, 'flag_016, 'flag_038, 'flag_040) p2_t *
('a, 'flag_016, 'flag_038, 'flag_040) p3_t *

We find a bunch of type annotations, which take some type parameters and match it against the allowed type definitions for that type. For example: if we look at the passed type parameters for this annotation: (‘a, ‘flag_016, ‘flag_038, ‘flag_040) p1_t * this means that for this expression to be valid it has to returned by invoking of the constructors from p1_t’s GADT.

That means this condition has to match against one of these 4 constraints for it to be a valid type:

type ('a, 'b, 'c, 'd) p1_t =
 | P1_1 : b_true val_t -> ('a, b_true, 'c, 'd) p1_t
 | P1_2 : b_true val_t -> ('a, 'b, b_true, 'd) p1_t
 | P1_3 : b_true val_t -> ('a, 'b, 'c, b_true) p1_t
 | P1_4 : b_true val_t -> (b_false, 'b, 'c, 'd) p1_t

Now we have a whole overview of what constructor Puzzle in type puzzle is, by definition it defines a humungous tuple where each type is concatenated by an asterisk * which is like an AND condition.

So for the whole type puzzle to be valid, every single type inside the tuple should be a valid type.

Now this statement has some interesting implications, since all the type variables are defined with val_t they can only be of constructor type T or type F from val_t’s GADT. Now we can resolve this problem by using a constraint solver and putting in all our constraints and try to find a solution which satisfies them.

Solution

For our solve script we’ll use Z3 as our constraint solver, but first we need to set variables and build constraints for Z3 to work.

Making variables

As we saw earlier we have 3 types of type variables, even though we only care about the flag_XXX variables we need to give Z3 all of them as the flag types depend on the other supporting type variables. Since all these types are of type val_t which can only be defined with type T or type F, we can treat them as booleans or more conveniently in Z3 as BitVectors of size 1.

def make_vars():
    flag = {}

    for i in range(104):
    var_name = 'flag_' + str(i).rjust(3, '0')
    flag[var_name] = BitVec(var_name, 1)

    for i in range(1, 148):
    var_name = 'a' + str(i)
    flag[var_name] = BitVec(var_name, 1)

    for i in range(97, 123):
    var_name = chr(i)
    flag[var_name] = BitVec(var_name, 1)

    return flag

flag = make_vars()

For convenience we just bundled them up and put them in a dictionary.

Parsing conditions from constructors

Let’s look at a sample constraint for this type definition: (‘a, ‘flag_016, ‘flag_038, ‘flag_040) p1_t *

Looking at this above constraint for type p1_t we can’t really say much because we don’t know which constructor resulted in this type declaration. But what we do know that for it to be a valid type declaration it has to come from one of the 4 constructors of p1_t i.e. P1_1 to P1_4. Which means we can combine these 4 conditions with a single OR operation.

Since all other type variables are ambiguous we can condense all 4 possible constructors into a single condition by just OR-ing them. Similarly we can do the same for all of the type variables of the form px_t and store them in a dictionary.

def make_constraints(raw_string):
    chunks = raw_string.split("type ")
    chunks = chunks[1:]
    filtered = []
    p_dict = {}
    for i in range(len(chunks)):
        data = chunks[i].lstrip().rstrip().split('\n')
        data[0] = data[0].replace('=', "").lstrip().rstrip()
        temp = data[0].split(" ")
        data[0] = temp[-1]
        key = data[0]
        value = [0] * (len(data)-1)
        for j in range(1, len(data)):
            rules = data[j].split(" ")
            rules = rules[8:12]
 
        for k in range(len(rules)):
            if 'b_true' in rules[k]:
              value[k] = 1
            if 'b_false' in rules[k]:
              value[k] = 0
        
        p_dict[key] = value

    return p_dict

p_dict = make_constraints(raw_px_t)

Building constraints for Z3

After we are done dealing with our polymorphic constructors we can now move on to looking at constraints for our type variables. This part was mostly done by my teammate “e-” so I’ll just try to summarize his approach. Before building the constraints I want to point out something very important he mentioned which will help us later on.

('a, 'flag_016, 'flag_038, 'flag_040) p1_t *
 ('a, 'flag_016, 'flag_038, 'flag_040) p2_t *
 ('a, 'flag_016, 'flag_038, 'flag_040) p3_t *
 ('a, 'flag_016, 'flag_038, 'flag_040) p4_t *
 ('a, 'flag_016, 'flag_038, 'flag_040) p5_t *
 ('a, 'flag_016, 'flag_038, 'flag_040) p6_t *
 ('a, 'flag_016, 'flag_038, 'flag_040) p7_t *
 ('a, 'flag_016, 'flag_038, 'flag_040) p8_t *
 ('a, 'b, 'flag_068, 'flag_071) p9_t *
 ('a, 'b, 'flag_068, 'flag_071) p10_t *
 ('a, 'b, 'flag_068, 'flag_071) p11_t *
 ('a, 'b, 'flag_068, 'flag_071) p12_t *
 ('a, 'b, 'flag_068, 'flag_071) p13_t *
 ('a, 'b, 'flag_068, 'flag_071) p14_t *
 ('a, 'b, 'flag_068, 'flag_071) p15_t *
 ('a, 'b, 'flag_068, 'flag_071) p16_t *
 ('b, 'a60, 'flag_101, 'flag_091) p17_t *
 ('b, 'a60, 'flag_101, 'flag_091) p18_t *
 ('b, 'a60, 'flag_101, 'flag_091) p19_t *
 ('b, 'a60, 'flag_101, 'flag_091) p20_t *
 ('b, 'a60, 'flag_101, 'flag_091) p21_t *
 ('b, 'a60, 'flag_101, 'flag_091) p22_t *
 ('b, 'a60, 'flag_101, 'flag_091) p23_t *
 ('b, 'a60, 'flag_101, 'flag_091) p24_t *
 ('a60) p25_t *

Look at this small snippet which defines constraints on types from p1_t to p25_t, we can definitely see a pattern here where every 8 consecutive types use the same variable but all of them have a type parameter in common, but after this these variables don’t appear. My teammate’s idea was to classify this as a single group since all these type variables are dependent on each other and are bound by a single type variable which we know for sure is T or F i.e. a60 in this case.

PS: I think it’s not necessary to make groups for this challenge, it’s just easier to feed it to Z3 if we do it this way.

Feeding constraints to Z3

Now that we know how to segregate our constraints into groups, we need to parse it and let Z3 know about the constraints. As discussed earlier every line of constraint can be resolved with an Or operator in Z3 since any one constructor needs to be valid. Now we need to chain all these constraints together with an And operator in Z3, since all these type variables need to be valid at the same time. To better visualize it this is how the first 4 constraints would look like without grouping:

Code for parsing groups and feeding constraints to Z3:

def parse_group(input):
    group = []
    
    lines = input.split('*')
    for i in range(len(lines)):
        lines[i] = lines[i].lstrip()
        lines[i] = lines[i].rstrip()
    
    if lines[-1] == "":
        lines = lines[:-1]
 
    for i in range(len(lines)):
        data = lines[i].split(" ")
        for j in range(len(data)):
            data[j] = data[j].replace("(", "").replace(")", "").replace(",", "").replace("'", "")
 
        # px_t member
        px_t = data[-1]
        px_t = p_dict[px_t]
        members = data[:-1]
        for j in range(len(members)):
            members[j] = flag[members[j]]
        group.append(check_px_t(px_t, members))
  
    #print(And(*group))
    return And(*group)

def check_px_t(px_t, nominee): # p1_t = F T T T
    equality = [px_t[i] == nominee[i] for i in range(len(px_t))]
 
    res = Or(*equality)
 
    return res

s = Solver()
s.add(parse_group(raw_input) == True)

Now that we’re done adding our constraints time to let it rip and see if it is even satisfiable!

Final solution:

raw_input = """
 ('a, 'flag_016, 'flag_038, 'flag_040) p1_t *
 ('a, 'flag_016, 'flag_038, 'flag_040) p2_t *
 ('a, 'flag_016, 'flag_038, 'flag_040) p3_t *
 ('a, 'flag_016, 'flag_038, 'flag_040) p4_t *
…
 ('a57) p1435_t
"""
raw_px_t = """
type ('a, 'b, 'c, 'd) p1_t =
 | P1_1 : b_true val_t -> ('a, b_true, 'c, 'd) p1_t
 | P1_2 : b_true val_t -> ('a, 'b, b_true, 'd) p1_t
 | P1_3 : b_true val_t -> ('a, 'b, 'c, b_true) p1_t
 | P1_4 : b_true val_t -> (b_false, 'b, 'c, 'd) p1_t
…
type ('a) p1435_t =
 | P1435_1 : b_true val_t -> (b_false) p1435_t
"""

def make_vars():
    flag = {}

    for i in range(104):
    var_name = 'flag_' + str(i).rjust(3, '0')
    flag[var_name] = BitVec(var_name, 1)

    for i in range(1, 148):
    var_name = 'a' + str(i)
    flag[var_name] = BitVec(var_name, 1)

    for i in range(97, 123):
    var_name = chr(i)
    flag[var_name] = BitVec(var_name, 1)

    return flag

flag = make_vars()

def make_constraints(raw_string):
    chunks = raw_string.split("type ")
    chunks = chunks[1:]
    filtered = []
    p_dict = {}
    for i in range(len(chunks)):
        data = chunks[i].lstrip().rstrip().split('\n')
        data[0] = data[0].replace('=', "").lstrip().rstrip()
        temp = data[0].split(" ")
        data[0] = temp[-1]
        key = data[0]
        value = [0] * (len(data)-1)
        for j in range(1, len(data)):
            rules = data[j].split(" ")
            rules = rules[8:12]
 
        for k in range(len(rules)):
            if 'b_true' in rules[k]:
              value[k] = 1
            if 'b_false' in rules[k]:
              value[k] = 0
        
        p_dict[key] = value

    return p_dict

p_dict = make_constraints(raw_px_t)
# pprint(p_dict)

def parse_group(input):
    group = []
    
    lines = input.split('*')
    for i in range(len(lines)):
        lines[i] = lines[i].lstrip()
        lines[i] = lines[i].rstrip()
    
    if lines[-1] == "":
        lines = lines[:-1]
 
    for i in range(len(lines)):
        data = lines[i].split(" ")
        for j in range(len(data)):
            data[j] = data[j].replace("(", "").replace(")", "").replace(",", "").replace("'", "")
 
        # px_t member
        px_t = data[-1]
        px_t = p_dict[px_t]
        members = data[:-1]
        for j in range(len(members)):
            members[j] = flag[members[j]]
        group.append(check_px_t(px_t, members))
  
    #print(And(*group))
    return And(*group)

def check_px_t(px_t, nominee): # p1_t = F T T T
    equality = [px_t[i] == nominee[i] for i in range(len(px_t))]
 
    res = Or(*equality)
 
    return res

s = Solver()
s.add(parse_group(raw_input) == True)

def bits_to_ascii(bit_string):
    flag = ""
    for i in range(0, 104, 8):
        val = int(bit_string[i:i+8], 2)
        flag+=chr(val)
    return flag
  
bit_string = ""
if s.check() == sat:
    m = s.model()
    for i in range(104):
        bit = m[flag['flag_%.3d' % i]].as_long()
        print(bit, end="")
        bit_string+=str(bit)
    print()
    print(f"Decoded bit string: {bits_to_ascii(bit_string)}")
else:
  print("unsat")

Final flag: uiuctf{sat_on_a_caml}

Something to think about: Why does challenge say flag will be printed to stderr?

This is like a bonus section, but very important to understand how this challenge works under the hood and more importantly why it takes so long to compile.

After our first failed attempt to get the flag, I started wandering in different rabbit holes and one question that prompted in my head was
“Why does the challenge say that the flag will be printed out in stderr?”

Even if the script takes too long why stderr and not stdout. So I decided to explore a bit and using some of the conditions from the original ocaml file I decided to build another toy ocaml file to play around the code a little bit.

Since there were a lot of type definitions and constraints in the original file, I decided to put only a handful to test out how things play out, here’s the toy file:

type b_true
type b_false
type _ val_t =
 | T : b_true val_t
 | F : b_false val_t

type ('a, 'b, 'c, 'd) p1_t =
 | P1_1 : b_true val_t -> ('a, b_true, 'c, 'd) p1_t
 | P1_2 : b_true val_t -> ('a, 'b, b_true, 'd) p1_t
 | P1_3 : b_true val_t -> ('a, 'b, 'c, b_true) p1_t
 | P1_4 : b_true val_t -> (b_false, 'b, 'c, 'd) p1_t
type ('a, 'b, 'c, 'd) p2_t =
 | P2_1 : b_true val_t -> ('a, b_true, 'c, 'd) p2_t
 | P2_2 : b_true val_t -> (b_false, 'b, 'c, 'd) p2_t
 | P2_3 : b_true val_t -> ('a, 'b, b_false, 'd) p2_t
 | P2_4 : b_false val_t -> ('a, 'b, 'c, b_false) p2_t
type ('a, 'b, 'c, 'd) p3_t =
 | P3_1 : b_true val_t -> ('a, 'b, b_true, 'd) p3_t
 | P3_2 : b_false val_t -> (b_false, 'b, 'c, 'd) p3_t
 | P3_3 : b_true val_t -> ('a, b_false, 'c, 'd) p3_t
 | P3_4 : b_true val_t -> ('a, 'b, 'c, b_false) p3_t

type puzzle =
 Puzzle :
 'flag_000 val_t *
 'flag_001 val_t *
 ('a, 'flag_000, 'flag_001, 'flag_002) p1_t *
 ('a, 'flag_000, 'flag_001, 'flag_002) p2_t *
 ('a, 'flag_000, 'flag_001, 'flag_002) p3_t
 -> puzzle

let check1 (f: puzzle) = function
 | Puzzle _ -> .
 | _ -> ()

If we focus on the last 3 lines where we define a function check which takes an argument f of type puzzle, and it returns a function which tries to pattern match constructor Puzzle with _. The . in Ocaml is very interesting because it represents a refutation case in Ocaml, it’s a way of telling the Ocaml compiler that “Prove that this branch is impossible to reach if a type puzzle is passed as an argument”.

Since the value we passed is indeed of type puzzle, the only way to prove it is impossible to reach is to prove that the constructor Puzzle is invalid or that there is no combination of type variables which satisfy this type. The way the Ocaml compiler deals with this is by trying to find a solution to determine if it is actually unreachable and if there is a solution it prints out the combination in stderr.

And since the challenge is designed in a way that it has a solution, this is what we get when we try to compile our toy ocaml file:

This represents a valid combination of types, which in our case would be the bit representation of all the flag type variables. But since, in our original problem we have a massive tuple with a ton of conditions, the Ocaml compiler tries every possible combination to refute that this branch is impossible which takes forever, therefore the goal is to optimize this using Z3 and get the flag!

Challenge #2: Nocaml

Category: misc
Author: n8

This was another Ocaml challenge in the miscellanous category in the CTF, but sadly I could only solve this after the CTF ended. Nevertheless this was another cool challenge which made me dig around Ocaml a bit more to finally get the flag.

The challenge prompt is simple “just cat the flag” using your Ocaml script but there’s a small problem in doing that since the given challenge file starts by setting everything to null, making all the standard library functions impossible to use. Functions such as open_in (Open file), print_endline (write) are basically useless now. The challenge script also sets a lot of core modules like Stdlib, Printf to empty structs which makes them unusable and since most of the I/O functions are defined in Stdlib we’re pretty much cooked without it.

let stdin = ()
let stdout = ()
let stderr = ()
let print_char = ()
let print_string = ()
let print_bytes = ()
let print_int = ()
let print_float = ()
let print_endline = ()
let print_newline = ()

module Stack = struct end
module StdLabels = struct end
module Stdlib = struct end
module String = struct end
module StringLabels = struct end
module Sys = struct e

But since most of these library functions rely on some sort of lower-level C functions to execute, we can still craft our exploit by directly calling into those lower-level functions. During the CTF I had a hard time finding documentation for these functions and gave up on this challenge, but after peeking at the source code I realized this challenge is not that hard.

Solution

As I said earlier, instead of relying on the library functions we need to make our own custom functions which mimic their functionality and call into the lower-level C functions. Let’s look at how the library functions are defined in the first place in Ocaml source code: https://github.com/ocaml/ocaml/blob/trunk/stdlib/stdlib.ml

Let’s dissect how a stdlib function is defined:

external output_char : out_channel -> char -> unit = "caml_ml_output_char"

If you’re unfamiliar with the Ocaml syntax, let me break it down for you. In Ocaml the function definition starts with the function_name and then the type of the parameters it takes separated by a colon and ->, and the last type parameter is for the function output. So this essentially defines a function called output_char which takes 2 args.: first one of type out_channel (similar to a file_descriptor) and second one a character (char to print) and it returns a value of type unit which similar to return void in C.

The external keyword helps Ocaml interface with C functions and I think in this case it uses a lower-level C function called caml_ml_output_char.

Now that we know how it works let’s try to replicate the same logic using our custom functions. Before making our custom functions let’s see how to open/read/write files in Ocaml if these restrictions were not in place to know what things we need to replace.

let file = "flag.txt"
let () =
let ic = open_in file in
while true do
 let char = input_char ic in
 output_char stdout char;
 done

From this we know we at least need custom definitions for open_in, input_char, output_char, and stdout.

Making our custom functions

We can easily replace input_char and output_char with custom_input_char and custom_output_char respectively as a like-to-like replacement.
Looking at the source code open_in recursively keeps using other library functions which are also disabled, so we need to define all of them again. open_in uses open_in_gen which uses open_descriptor_in, open_desc and set_in_channel_name.
Finally those smelly nerds didn’t even leave stdout, so we need to re-define a custom_stdout which uses a custom_open_descriptor_out.

Final solution

let file = "flag.txt"

external custom_input_char : in_channel -> char = "caml_ml_input_char"
external custom_output_char : out_channel -> char -> unit = "caml_ml_output_char"

type open_flag =
 Open_rdonly | Open_wronly | Open_append
 | Open_creat | Open_trunc | Open_excl
 | Open_binary | Open_text | Open_nonblock

external custom_open_desc : string -> open_flag list -> int -> int = "caml_sys_open"
external custom_open_descriptor_in : int -> in_channel = "caml_ml_open_descriptor_in"
external custom_open_descriptor_out : int -> out_channel = "caml_ml_open_descriptor_out"
external custom_set_in_channel_name: in_channel -> string -> unit = "caml_ml_set_channel_name"

let custom_open_in_gen mode perm name =
 let c = custom_open_descriptor_in(custom_open_desc name mode perm) in
 custom_set_in_channel_name c name;
 c

let custom_open_in name =
 custom_open_in_gen [Open_rdonly; Open_text] 0 name

let custom_stdout = custom_open_descriptor_out 1

let () =

  let ic = custom_open_in file in

  try
    while true do
      let char = custom_input_char ic in
      custom_output_char custom_stdout char;
    done
  with End_of_file -> ()

Thank you for reading it, if you made it this far and have a great day! 😅

References

Static Typing in Ocaml: https://www2.lib.uchicago.edu/keith/ocaml-class/static.html
Detailed info on GADT’s: https://dev.realworldocaml.org/gadts.html
Some discussion on Ocaml pattern matching: https://discuss.ocaml.org/t/in-pattern-matching/2676
Ocaml stdlib source code: https://github.com/ocaml/ocaml/blob/trunk/stdlib/stdlib.ml
A bit about CTF Academy: https://ctf.asu.edu/education/ace-ctf-academy/

Pedri's resurgence under Luis de la Fuente

Sun, 30 Jun 2024 15:06:03 GMT

This is going to be a succinct post about something that recently caught my eye and that is Pedri’s role in the national team in the Euros which hasn’t been talked about enough.

Pedri who has been a key player for the La Roja since his breakthrough at Barcelona at a tender age of just 18 years, has often been compared to the likes of Xavi & Iniesta due to the immense talent that he has on display. Despite being pretty young he has been an undisputed starter for club & country when fit and after getting rid of his injuries he is finally back to his best, but something has changed and that is how Luis de La Fuente is using him differently on the pitch as opposed to Luis Enrique. Let’s take a closer look:

According to statistics from Sofascore Pedri averaged around 120 touches per game in the 2022 World Cup, meanwhile in the Euros he has only averaged 39 touches per game so far. So what has changed?

Mainly two things:

First of all Spain’s style of play in the tournament has been very different from their usual self. Usually you would find Spain being patient in their build-up trying to play out from the back and moving the ball through lines of pressure to arrive in the final third. But this time round Spain have played a lot more direct especially to their wingers as they want them to generate more 1v1 chances on the flanks due to their sheer quality. There is a lot more to talk about Spain’s setup and I’ll write a detailed blog if they make it into the final stages of the tournament but for now I’ll limit this blog to Pedri’s role in the team.
Second and the more significant change is Pedri’s role under Luis de la Fuente, from the recent matches one can easily concur that Pedri is no longer involved in the build-up phases instead he operates between the lines as a hole player. Playing further up the pitch means that he is always looking to crash the box looking for a cutback from the wingers, and providing an additional goal threat. This also means that he is no longer looking to progress the ball in the midfield instead he is always looking to receive the ball on a half-turn and pinging through balls to their forwards.

Pedri playing between the lines vs Italy

Heatmaps

The best way to display the difference is by using heatmaps where the darker regions indicate more touches on the left side, while you can easily see that Pedri has played a lot closer to the box in this tournament.

Pedri’s heavy involvement in the build-up phase in 2022 WC vs more box presence in Euro 2024

The Upsides

The obvious upsides of playing Pedri higher up the pitch is that he arrives a lot more than before in the box and plays decisive combinations in the final third. He is not just a great shooter he also has an eye for a killer final pass to set up his teammates in clear goal scoring scenarios. In fact he has averaged more key passes and chance creation with his new role than he did under Luis Enrique despite seeing the ball way less than before.
Apart from this Pedri is known for his great football IQ and positioning to find pockets of space to exasperate the opponents. He has good tight space control and dribbling ability to weave through the final defensive line and take a shot. If needed he can come out of the structure and drop into midfield as he is also excellent at beating the press and technically adept to find an outlet to improve build-up against high pressing teams.

Downsides

Pedri has an exquisite passing range, one of his best skills is to play accurate long balls into the box from the deep to create chances. Also playing long diagonal balls to a winger to switch flanks after creating overload on one side of the pitch in attempt to try and break down a low-block. Since the departure of Busquets he fills that void perfectly by unlocking defenses from the deep with a single pass, but playing upfront means he can’t do it anymore.

Pedri’s one of many accurate long balls vs Costa Rica (2022 WC)

Not really a downside this one, but playing between the lines means that there may be games where Pedri has little to no influence over the midfield and he has to rely on Rodri and Fabian Ruiz to find him between the lines. So far Fabian Ruiz has been excellent for Spain and if he keeps up these performances this will rarely be a problem for Spain.

Luis de la Fuente’s comments on Pedri

“We have been very happy and because he is a very good player and he knows that I have confidence in him and he is going to give us very good things in this competition,”
“I have always talked about it from the point of view of the confidence he has to have. I said that ‘Pedri has to meet Pedri’, in the figurative sense of gaining confidence. The best version of Pedri we don’t know where he is, because he’s so good. We expect so much from him that it’s infinite.”
“It has to be the player who takes that step forward, as he has done, to be sure and confident to do the things that only he can do.”

Though Pedri is a very dynamic player who is immaculate in every phase of the game, it will be very interesting to see how far Spain can progress in the Euros with his brilliance.

It's the Hope that kills you

Mon, 17 Jun 2024 22:12:22 GMT

Last night was a reminder why football can be so cruel at times, no matter how hard you try some things are just inevitable as Dortmund fell short once again at the final hurdle. I can't imagine how heartbreaking it must be for the passionate fans of Borussia Dortmund to see their team crumble in the second half after dominating Madrid in the first half. Contrary to what people thought Dortmund started the game valiantly looking to press higher up the pitch and played so much better all over the pitch in the initial stages of the game. The backline looked solid, midfielders were winning ground duels and the frontline looked energetic by offering runs in behind.

First half overview from Sofascore (Green: Dortmund, Purple: Real Madrid)

But even after a dominant first half display from Dortmund they had nothing to show for it, as missed chances from Karim Adeyemi and Fullkrug proved to be a thorn in their side. Those two missed chances from Adeyemi will definitely haunt him for some time as in a high profile fixture like this it is imperative to be clinical in front of the goal.

But props to Real Madrid as they showed once again why they're the most fearsome team in Europe as even though they looked below par in the first half, after re-emerging from the tunnel they looked like a different team altogether. And when that first goal went in from the corner I honestly turned off the stream because I knew it was already game over, as teams like Madrid feed on momentum and after that there was no way Dortmund could get back in the game.

An Emotional Farewell for Reus

Look up Loyalty in any dictionary/thesaurus and you will definitely see his name, Marco Reus is a name that has been engraved in the hearts and history of Borussia Dortmund where he almost spent his entire youth and professional career. But despite doing "everything right" as he said himself, the dream of walking away with a major trophy eluded him even in his final season.

Reus' final game at the Signal Iduna Park

If you look at his profile you would expect a player who was a regular starter for the German NT, who won the German POTY twice and the Bundesliga POTY thrice to have a stunning trophy cabinet, but you would be totally surprised to know that he does not have single League Title, UCL trophy or even an International trophy! This is because he was probably the unluckiest footballer I've seen in my time as he narrowly missed out on a lot major tournaments, important fixtures just because he was injury-prone, the worst happened when he was at his peak but injured his foot in the last friendly before the 2014 World Cup which Germany eventually won. Nevertheless, as I mentioned earlier football can be a bit cruel sometimes but all in all Reus has enjoyed a stellar career at Borussia Dortmund and is signing off as a Club Legend and has immortalized his name in the history books as a loyal club icon.

But at times like what really begs a question is that "Is it really worth hoping for especially after it kills you time and again?"

Dread it, Run from it, Man City arrive all the same

Wed, 22 May 2024 20:31:09 GMT

How obsessed can one man be to chase absolute perfection is what I think whenever I see Pep Guardiola. Man came to England, as a decorated manager and people still told him that he won't be able to replicate the same kind of success that he had elsewhere, that Premier League is not a "Farmers League", pretty funny when you think about them now. He just came in and obliterated every doubt around him and I've never seen someone who is unanimously hated by all their rival fans.

Though most of the hate does not directly go to Guardiola, most of it is because people don't like Man City as a club. They can't digest the fact that despite having no history they are successful only because of the "Oil Money" put into the club.

Discrediting Man City's Success

Nobody, literally nobody credits Man City for their success, majority of football fans carry the baton of 115 FFP charges while the other part simply doesn't want to accept Guardiola's dominance.

Honestly, I believe that you cannot deny the fact that Man City would be nowhere near good enough without the Oil Money that was put in, but even then you have to acknowledge the fact that they took great sporting decisions all round. Not just around buying star players, they made every signing work barring a couple of them, nurtured players from their academy and created a positive healthy environment to inspire younger ones.

And as opposed to what anyone says, Premier League is still NOT a Farmer's League despite City's unstoppable domination in recent years. The reason I still give Pep the respect he deserves is because even with all the money, resources in the world managers still find a way to fuck it up. At the end of the day you can't disregard Pep's genius, the way he manages tough fixtures throughout and keeps his players motivated every season even after winning so much is astounding. The fact that he manages to win every season by the skin of his teeth also shows that the Premier League is still competitive af, the only difference is being consistent and performing well throughout the season.

Taking a step back to reflect on life

Wed, 22 May 2024 20:10:41 GMT

Life can be pretty overwhelming at times, especially with no sense of certainty or stability it can feel quite challenging. Sometimes there is so much going on, I feel like my brain goes into autopilot at times where I just persistently chase a goal without questioning anything about it. But every now and then, it is good to stop by, take a moment and reflect on life. Reflect on how far you've come and recount the mistakes you made along the way. Don't get me wrong though, I don't mean to get stuck in the past or repent over how I could've done things differently, it is just a way of questioning your decisions to keep yourself in check.

For the last 4 or 5 years I've been pretty disconnected with the outside world, there are times when I've absolutely no idea what is going on. But living solitary also gives you a lot of time to review yourself and makes you less prone to making bad decisions in my opinion.

Finding your own Moral Compass

For me upholding my integrity is imperative and above everything else I do, I can't sleep properly knowing I wronged someone intentionally, mistakes are allowed though because mistakes are genuine. But having a faulty moral compass doesn't work with me at all, and this is why even though I've changed a lot over the years there are some things that remain constant, some core values that I never want to get rid of.

Though every now and then some event will test your morality in unexpected ways and will make you doubt your integrity. And unlike a regular compass a moral one does not deal in absolutes, it is subjective pertaining to what you believe in what you think is right. At times like these the best solution for me has always been listening to what people close to me have to say, not seeking validation from people on the outside, rather than from someone close to you who can give you unbiased advice no matter how harsh it might sound. And I've been blessed with good people all my life that is probably the only thing I've earned, I don't make a lot of friends but I fully intend to hold on to them and keep them close. Apart from all this the realization of knowing that no matter how hard you try there are some things you can never control/change has helped me grow pretty calm over time and at the end of the day it is all that matters.

Intro to Thoughts

Wed, 22 May 2024 20:10:30 GMT

This is Doge

Doge is not happy, anyways welcome to Thoughts a totally different space where I can write about random things. This is a personal space where I can express my unhinged self and talk about my personal observations and experiences so far. The main reason for separating this from my main blog is mostly because the blogs that I write are focused more on quality, I invest a lot of time reading, scouring the internet and watching related content to make them impeccable and easy to read at the same time. This means I may not be able to consistently write blogs when I'm busy. Whereas this space, is mostly about unfiltered, raw thoughts, things that bug me at night or when I'm alone. These posts are supposed are to be succinct and quick so that I can write them from anywhere, anytime so don't expect much quality.

I feel like writing is the second best way to get something off your chest and helps you improve. I used to love writing when I was young but I lost my touch in high school, but now I want to take this opportunity and write about what I learned in life, my opinions, interests and much more. So watch me share my unbiased takes on society, discuss football opinions, critique on cinema, gaming and everything else. Also I know the current UI doesn't really suit the type of content and I'm still working on it (I'm horrible at UI designing 😪) so stay tuned!

End of an Era: Jurgen Klopp

Tue, 21 May 2024 16:55:23 GMT

Before getting on with the blog I just want to mention that writing this piece took a long, long time, it was on my mind since Klopp announced his retirement so please even if you’re someone who isn’t really interested in Football try to stick around till the end and maybe you’ll learn something new. For the uninitiated Jurgen Klopp one of world football’s greatest ever manager has announced his retirement after a 9-year stint at Liverpool and this article is basically a short tribute to honor his Liverpool journey, so strap in and enjoy my version of this beautiful story!

Intro

The title of this blog was supposed to be “This is Anfield!” as if I’m slamming my desk being proven right with Darwin Nunez in the banner image celebrating after scoring a banger against Wolves in their final home game along with Klopp lifting the coveted Premier League trophy and the home fans serenading him by singing “One Kiss” by Dua Lipa.

What a sight that would have been… but sigh I’m too old to daydream now and certainly don’t believe in fairytales any more. I’ve been watching football for a decent amount of time now and as an Indian it can be hard to keep up with the European leagues especially with the time constraints. I’ve sunk in ungodly amount of hours watching late-night fixtures, managers explain their dogma, players talking shit and much more, but if someone were to ask me what was the favorite moment that I witnessed this would definitely be up there:

YT Embed

This is what legacy looks like, this is what victory sounds like, what passion feels like, the ambience, the aura of this resounding stadium is why we watch football, moments like these transcend the game itself and form perpetual memories for any supporter and this is exactly what Jurgen Klopp has earned Eternal Respect.

Inception

Time to roll back the years and begin this article by going back to where it all started, Klopp’s arrival at Anfield in 2015/16. I honestly don’t remember this time, as I was not into football back then and I guess it would take a couple more years before I even started taking interest in football. After a horrid start to Borussia Dortmund’s 14/15 season which even saw them lurking around the drop zone at a point, Klopp announced in April that he’ll be leaving the club in the summer. On the other hand Liverpool also faced a disappointing start to their 15/16 season and had to sack Brendan Rodgers midseason, and just like that action met opportunity and the Liverpool management were somehow able to sign Klopp on a 3-year deal as he was officially announced a few days later.

Introducing the “Normal One”

Klopp’s first press conference was imbued with energy and hope, both of which were nowhere to be found in the Liverpool dressing room in the past one year. Where successful managers came in with inflated egos (Mourinho I’m looking at you ) with the promise that they will take their team to the apex, Klopp came in as a normal, humble guy with the hope that he’ll enjoy his work in England as much as he did in Germany and described himself as the “Normal One”. He said something which stuck by every Liverpool supporter and made them believe once again:

It’s not so important what people think when you come in, it’s much more important what people think when you leave… and please give us the time to work on it.
I don’t wanna say we have to wait for the next 20 years… I know when I sit here in 4 years I think we would’ve won 1 title in that time, I’m pretty sure.

https://www.youtube.com/watch?v=J-Re0BihMy4Klopp’s first press conference in England

Building from scraps

Even though Liverpool miraculously finished second in the league a couple of years ago, they were still lacking star players and a sense of belief that they can achieve something as a team. A lot of fans had lost hope in the team, the manager and the staff, and there was no sense of identity within the club, their public perception deteriorated over time and no rival club really saw them as a threat. A slight simmer of hope which fans clung on to also died after the departure of Suarez and Sterling in the coming seasons, which meant another awful start to the season before Klopp arrived and the bottom line was simply that "this squad is nowhere near good enough" to challenge for titles. The challenge here wasn’t just to manage a below-average side, it was also to induce a psychological shift among the players and fans that they can challenge for titles, this change in mentality as he described was to transform everyone around him from “Doubters to Believers”.

Klopp’s first playing XI at Liverpool

At this point it was simply a question of Pragmatism over his Footballing Philosophy or the other way around, and with Klopp’s first game in-charge he made sure his message was loud and clear, that there is only one way and that is his way. And even though he drew his first game away to Tottenham 0-0 he introduced his style of high intensity football as they covered more ground than they did before in the whole season.

Klopp’s Footballing Philosophy & Style of Play

I’ll just start with a quote from Ralf Rangnick about the importance of a coherent Footballing philosophy:

What is the job of a Football Head Coach or Manager?…
To have a clear idea of how my team should play, this can be a bit of Pep Guardiola style or the Diego Simeone style, these are all variations where some coaches like more technical players while some prefer more intense, hardworking players. But what they all have in common is that they exactly know how this kind of football that they want to play, how it looks like… they have in their brains the video of the perfect game and the job of a football coach is to transform this idea into the heads, hearts, brains, veins of your players.

For Jurgen Klopp his style of play is in a way a reflection of his own personality as he himself defined as “lively” and “entertaining”.

Having memorable games in a row, that people really wanna see the next game, you leave the stadium and you can’t wait to see the next game and for me that is what football should be. And when you can do this very often you will be successful 100 percent.
- Jurgen Klopp

Style of Play: Orchestra vs The Heavy Metal

This is one of the finest interviews from Jurgen Klopp from when he was in-charge at Borussia Dortmund, where he was asked to draw an analogy between his style of play and Arsene Wenger’s brand of football. This single most iconic line where he contrasts between the two by saying “His style of play is more like an orchestra, passing the ball, organized football… but I like the Heavy Metal more.”

https://www.youtube.com/watch?v=Qpv0QXZmq5A

“Heavy Metal Football” is a term that vividly captures his distinctive style of play, emphasizing intensity, energy, and relentless pressure. The goal is to create as many chances as possible through persistent counter-pressing to get hold of the ball as soon as you lose it.

Gegenpressing & Quick transitions

Gegenpressing is a German term which loosely translates to Counter-Pressing which is an imperative part of Klopp’s philosophy. The idea is to press the opponent in numbers higher up the pitch and win the ball back in advanced areas to quickly create quality chances by catching the opposition off guard. But counter-pressing has been a staple part of the game since a very long time, so what makes Klopp’s Gegenpress so distinctive? The key idea of Klopp’s play style here is to disrupt the opponent build-up, force unnecessary errors from the opponent on the ball by quickly closing down on him in numbers so that he can’t find an outlet and eventually lose the ball.

This quote from Pep Lijnders (Liverpool’s Assistant Coach) really sums it up:

Our idea of pressing is not to force them one way, not to force bad passes our idea of pressing is to steal the ball, to attack and to create chances.

In this short clip below Jurgen Klopp himself articulates why he thinks “Gegenpressing is the best playmaker” and how winning the ball back in advanced positions means creating a good chance is just a matter of one key pass with his approach.

https://www.youtube.com/watch?v=XvHT3BJu7g4

Transitions are also a key part of Klopp’s philosophy which explains the various trade-off’s that are involved in this high risk, high reward approach. Every time you commit numbers forward trying to suffocate the opposition in their own half you run the risk of getting exposed by open spaces in your own half, so what player profiles fit Klopp’s system to minimize this risk and gain maximum reward? This question brings me to my next point…

Klopp’s Player Profiles

When thinking about the greatest teams of all times who were triumphant over long spells in football, we often picture World-class technical players who have the ability, the natural gift to be prolific consistently, to influence the game with their silky touches and play near-perfect passes with their immaculate vision. When thinking about midfield trios we often think of Xavi-Iniesta-Busquets or Modric-Kroos-Casemiro or even Pirlo-Seedorf-Gattuso(if you’re a boomer) but what if I tell you a midfield of Jordan Henderson, Gini Wijnaldum, Fabinho, James Milner, Alex-Oxalade Chamberlain and Naby Keita is enough to dominate football at its zenith by winning the Champions League and the Premier League, if someone told me this today I wouldn’t believe them either.

This might seem odd at first because respectfully none of these players are really creative in the final third but all of them have something in common and that is their work rate, their aggression on the pitch, the intent to close down on opponents to win the ball back and that is exactly what Klopp prefers: Highly athletic and hardworking players over technical players who know how to execute his instructions, players who wear their hearts on their sleeves, players who are persistent pressing machines.
This is the reason why Energy and Intensity are the main mantras of a Klopp team and this is what makes them so interesting to watch.

We ran through walls for him… and that was his very least demand, that you work, that you run for him, for the team. And there’s something about that makes you feel at ease as a player… if you give your best the rest kind of takes care of itself.
- Adam Lallana about Klopp

Embracing Chaos over Control

Just like all the other top teams, the goal is to create an ample amount of chances in every game, but unlike other top teams Jurgen Klopp wasn’t very dogmatic with his approach, where others chose to play with control in high profile games Klopp embraced the unpredictability of football to disrupt their natural game plan.

In possession phases and in between transitions the unwavering game plan was to quickly get the ball higher up the pitch as fast as possible, which made them one of the most vertical teams in all of Europe. Even though the idea is pretty single-minded, there are a multitude of ways in which they achieve this: channel balls, through balls, long balls into the box, crosses from wide areas and even balls over the backline, the players were adept at providing service from every part of the field. And when you combine this with prolific forwards you get an everlasting supply of goals.

Developing World Class Fullbacks

Another key ingredient of Liverpool’s success comes from developing their world class fullbacks, where other teams rely on their creative players to play more centrally Klopp uses their fullbacks higher up the pitch as wide playmakers in the form of Trent-Alexander Arnold and Andrew Robertson. This is because the front-three in Klopp’s system is usually very narrow which enables the fullbacks to be brave and work the flanks higher up the pitch. And when these two are at their best, nobody can stop Liverpool from dominating games.

Robertson and Trent pushing forward in possession whereas the front three is narrow

Andy Robertson and TAA at top in the All Time PL Assists List by defenders.

If you look at both of their career trajectories none of them were world class players before, Andy Robertson came from Hull City who were relegated into the Championship the year prior to his signing and Trent was just an academy prospect from Liverpool, but both of them flourished under Klopp and formed the best fullback partnership in the modern era. In fact, Robbo wasn’t even signed as a first choice fullback for Liverpool, he was considered backup for Alberto Moreno who was their regular starter, but after being injured midway through the season, Robertson got his chance and he proved his mettle. From literally nothing he earned his spot in Liverpool’s first team with his work ethic and pressing intensity and in no time he became a menace on the left flank offensively, constantly swinging in crosses for the frontline, but was also smart and athletic enough to contribute defensively.

This is the reason why I always credit Klopp and his coaching staff on how they adapted their game to get the best out of these players.

Incredible Man Manager

We talked about intensity and work rate as the core principles of Klopp’s philosophy, but these things are so easy to talk about for someone watching from the sidelines, it is when you realize that some of the Liverpool players have to play around 40–50 club games a season as well as tend to their international duties. With fixtures coming in thick and fast every week it is hard to give your best and to maintain the same energy levels in each game. So how does Klopp manage that?

I try everything to be as successful as possible, I live 100% for the boys, with the boys and what we do for the club and all that stuff.

Jurgen Klopp has time and again emphasized on building a healthy culture within the clubs he has managed, for him football is not just about tactics on a board, he has a much more emotional connect with the players, his coaching staff and even the people who work at the club. Forming strong interpersonal relationships with the players and giving them the tactical freedom on the pitch means the players wanted to work hard for him, he made them believe in a cause and wanted everyone to express themselves on the pitch.

Welcome to Anfield, "It’s not over yet"

Anfield has been the home of Liverpool FC for more than a century now and holds a lot of significance for any Scouser, it is way more than a football stadium, it is a cultural landmark in Liverpool and for Liverpool FC fans it is their identity. Anfield has also proven to be one of the most hostile atmospheres for any away team and produced a number of historical matches, players and coaches alike have always found it difficult to produce the same kind of performance at Anfield as the ambience is so “electric”, so “intimidating” it almost feels as if Liverpool have a twelfth player on the pitch and that is their fans.

https://www.youtube.com/watch?v=czrH5jfQSO4

I remember watching this episode and couldn’t help but think how frightening it looks from the perspective of the away players in and out of the stadium, the sight of 60,000 fans singing to “You’ll Never Walk Alone” and chanting for their team in unison regardless of how they are performing, I guess this is why people always say “At Anfield nothing is impossible”. And for Jurgen Klopp this is all he needed as he said:

The only reason I’m able to do my job is because the people show so much passion… I know I’m responsible for the performance, but the people are responsible for the atmosphere.
- Jurgen Klopp

An absolute bonkers statistic about the influence of fans can be judged by the fact that since the start of the 2017/18 season, they’ve only lost two (Premier League) games at Anfield in front of fans (Leeds in October 22/23 & Crystal Palace this season)

And without fans, they lost six consecutive league games at Anfield between January and March of 2021 (Burnley, Brighton, City, Everton, Chelsea and Fulham)! This is the biggest proof that fans have had a huge say alongside Klopp in making Anfield an impenetrable fortress.

Unleashing Anfield’s true power

Liverpool’s Champions League run of 2018/19 was one of the most miraculous campaigns I’ve ever witnessed in my time, the whole tournament in fact was marked with memorable moments from start to finish but as the dust settled there is that one match that stands tall and made every Scouser explode with joy, it is that Champions League semi-final night at Anfield against FC Barcelona which was one for the history books.

As a Barca fan myself even thinking about this match evokes traumatic memories (no cap ), whenever someone mentions the phrase “Corner taken quickly!” I’m reminded of that dreadful night at Anfield where Barca lost 4–0 despite having the upper hand in the first leg. I remember sleeping early that day thinking that we have a 3–0 lead and there’s no way we lose this game. And when I woke up I was greeted by the most insane comeback possible (moments like these made me question my loyalty as a Barca fan honestly ).

Barcelona who were firing on all cylinders having the likes of former Liverpool stars Coutinho and Suarez along with an equally star studded roster were looking threatening beyond compare. Though Liverpool were no slouch, it’s just that Barca had the world’s best player as Lionel Messi on their side who was also in red hot form and this matchup was hyped to the moon, and trust me it lived up to it.

I really don’t want to talk about this matchup though because it’s 4:30 A.M. as I’m writing this and I don’t want to cry , but you can watch this video where Pep Lijnders breaks down how they made the impossible possible at Anfield:

https://www.youtube.com/watch?v=zlwVZTtR0zQ

Transfer Strategy

One of the most overlooked aspects of Liverpool’s resurgence under Klopp has been their transfer strategy throughout the years, it is when you know the context you understand why people love teams like Liverpool so much. Since his arrival in midway through 15/16 he did not get the liberty to choose his own transfers or have a proper pre-season, the next year was going to be very crucial. But where rival teams like Man City and Man Utd. were splurging money on marquee signings from top European clubs, Liverpool relied on signings from mid-table/relegated teams and even free transfers, but even though these transfers were not met with a lot of hype they were needed to play Klopp’s heavy metal football. And not just that season it was a common theme for the Liverpool management that they weren’t really concerned with signing the best talent, but the emphasis was more on “nurturing talent”.

Sure they also made some high profile signings along the way, but they were better known for taking players from clubs who didn’t rate them very well, players like Andy Robertson, Alex-Oxalade Chamberlain and Mo Salah all of which were rejected at one point in their career were now thriving under Klopp’s main team. And Klopp once again proved that his decision-making is as astute as ever with Liverpool securing a Champions League spot in their second proper season, where a new front three announced themselves and Andy Robertson came to light as a world-class left back.

Building a World Class Front Three

We already talked about how Liverpool’s midfield worked hard throughout the game to regain possession and counter-attack quickly, but with any world-class team you need a lethal frontline to finish your chances as at the end of the day the aim of the game is to put the ball in the back of the net. And Liverpool built just that, with Mane, Salah and Firmino they probably had the most exciting front-three in the world. The fact that these three players took almost no time to adapt to each other’s game is living proof of why some things are just meant to be, having different attributes they complemented each other on their pitch really well and scored a plethora of goals under Klopp.

Bobby Firmino was the first one to arrive at Anfield in 2015 under Brendan Rodgers as an attacking midfielder and was instrumental for Liverpool in their 4–1 victory over Man City in Klopp’s first season, this match highlighted his ability to play upfront instead of Benteke as a false 9 because of his linking ability and since then he’s only gone on to improve his game.

Sadio Mane was the next one to arrive a year later in 2016, he was signed from Southampton as the most expensive African player of his time and even though there were some doubts people knew he would fit right in Klopp’s system. Even though he was signed as a right winger he quickly found his place on the left side of the pitch and in coming years he also played as an inside forward which favors his stronger right foot, this ability to adapt over the years and still produce massive numbers made him an all-round player. His world class performances have also contributed to one of the best fan memes of all time linked below:

https://www.youtube.com/watch?v=2_O5YHX4urE

I saved the best for the last, as the next one to arrive in 2017 was Liverpool’s club record signing at that time, it was the Egyptian King Mo Salah and in his opening season he took the whole world by storm. His first season saw him obliterating doubters if there were any, as he scored 44 goals and registered 15 assists across all competitions, won the PL golden boot and broke so many records with every game he played that season that I can’t even write it here, so I’ll just link it down.

https://www.espn.in/football/story/_/id/37493125/mohamed-salah-record-breaking-first-season-liverpool

His amazing performances enabled Liverpool to reach the CL final where they eventually lost to Real Madrid, but his effort didn’t go unnoticed as he registered himself as one of the best wingers to grace the Premier league.

The most amazing revelation about this front three was from Ralf Rangnick who had this to say:

Let’s just have a close look at the their(Liverpool) three strikers, they have Salah, Firmino and Mane… three of them from three different countries and all three of them… two of them I had myself (Firmino and Mane), I can tell you all three of them including Mo Salah were not natural born ball winners when they came to Liverpool. They were not the kind of players that people think are “Wow! they pressing machines” no.
So all that things that happened at Liverpool was the job of the coach and their staff, they way they played in the last 3–4 years on that high level, this intense kind of football shows you what is possible and what can happen if a coach with a mindset and a clear idea of how his team should play.

Fan Favourite

Being a Liverpool manager, it’s a hard gig isn’t it because you have to be the best manager in the most competitive league possible and then the extra bit in Liverpool is that you have to be a man of the people.
- A Liverpool fan (The Anfield Wrap)

Apart from his managerial ideas Klopp made a name for himself mostly due to his character and personality, everywhere he worked people were in awe of his infectious positivity and his boundless passion for the game. He single-handedly won over every fan and turned the atmosphere from nervy to optimistic with his congenial smile regardless of the game’s outcome which makes me think he actually has the best set of teeth I’ve ever seen .

I’ve been watching football for a decent amount of time now and even though I’ve seen more triumphant teams like Man City & Real Madrid, I know that Liverpool is the most entertaining football team I’ve witnessed without a shadow of a doubt. In victory and defeat alike they’ve been known to have the most riveting players who give 100% for the manager and for the club. After every game at Anfield he was either seen doing fist pumps when they won or clapping the fans for their unconditional support when they lost.

https://www.youtube.com/watch?v=XayT2yw7dtY

As I mentioned Klopp’s presence does not end on the field or after the match, he was very emotionally invested in the culture of each club and it’s people around the city. This is evident by the fact that he received huge farewells from all the clubs he managed including Mainz, Dortmund and now Liverpool. All of them were very emotional and heartbreaking for the fans which shows that the work he did will never be forgotten. Also on the the 3rd of November 2022 Klopp was officially awarded the Freedom of the City of Liverpool! which is the highest civic honor bestowed by Liverpool’s mayor and this is what he had to say:

I think he means more than a football manager to the city because one of my jobs is to try to attract people to come here and invest and many people who I’ve met in the office next door they wanna talk about Jurgen Klopp.
I think he epitomizes the best qualities of this place, even though he’s not from here… he’s an honorary scouser by the way. The same values and principles that are very much part of the Liverpudlian identity are also Jurgen Klopp’s bedrock.

Greatest Modern Day Rivalry

Like every other great tale, the protagonist needs a proficient villain(metaphorically) someone who can match you for every blow and pushes you to become the best version of yourself. In football many people like to equate this analogy with Messi and Ronaldo, but in managerial terms this analogy also fits perfectly between Jurgen Klopp and Pep Guardiola who have been fierce rivals for as long as I can remember.

Control vs Chaos

Locked in an intense rivalry since their Bundesliga days, this battle was again rejuvenated as Liverpool and Man City were always the top contenders in the Premier League. What fascinates me the most is how contrasting their footballing ideologies are, on one hand Guardiola prefers to control games through high possession, organized football using technical players and on the other hand Klopp favors a more direct approach with more vertical passes, constant pressure to steal the ball back using highly athletic players. Even though the core idea is to create as many chances as possible, the way they implement it using different player profiles is amazing to watch, regardless of what kind of football you prefer to watch you can’t deny they are definitely the greatest modern day managers to exist.

In terms of H2H record Pep & Klopp have met 30 times in all competitions and Klopp edges past him with 12 wins, 11 defeats and 7 draws in total. Regardless of statistics both of them share a great rapport and praise each other every now and then. In fact, when Klopp announced his retirement Pep told the media that he’ll sleep a bit easier knowing that isn’t there anymore.

https://www.youtube.com/watch?v=fO4sFBZvhuY

The Grand Finale

Running out of Energy?

Fast forward to recent times, the day is 26th of January 2024, after 21 match weeks Liverpool are sitting comfortably at the top of the Premier League with a lead of 5 points and suddenly Liverpool drop an official statement along with a video of Jurgen Klopp saying that he will be leaving the club at the end of the season.

I swear to god I was shook to the core just like every other football fan who just heard this news, why on Earth would an elite manager announce his retirement out of nowhere? In the video however he explains that:

I love absolutely everything about this club, I love everything about the city, I love everything about our supporters, I love the team, I love the staff. I love everything. But that I still take this decision shows you that I am convinced it is the one I have to take.
It is that I am, how can I say it, running out of energy. I have no problem now, obviously, I knew it already for longer that I will have to announce it at one point, but I am absolutely fine now. I know that I cannot do the job again and again and again and again.

https://www.youtube.com/watch?v=mHYsAgAx5I4

After listening to what he said in the video it was pretty understandable why he made this decision, you see being a football manager at a top club is certainly of the hardest jobs in the world, considering the amount of press conferences, team meetings, training sessions, personal interviews you have to attend is no joke. Klopp is the kind of manager who wants to give his 100% every single day and if he can’t do it anymore then he certainly doesn’t want to feel like a passenger or prove to be a hindrance to Liverpool’s journey ahead.

The quadruple dream

Since the day he announced his retirement people especially Liverpool fans were very emotional, for some players he was like a father figure for the club, but if the decision has been made that means players would want to give their all in his final season and what better way to send off your manager with a quadruple in his last season.

First up was the Carabao Cup, most of the heavyweights were knocked out early leaving only Chelsea in the Cup final in February. Even though Chelsea having were having a rough season where they found it hard to be consistent, they were still the favorites to win because of Liverpool’s injury crisis where half of their first team players were unavailable and young players had to fill in. What happened in this match was nothing short of a spectacle as the game was locked into a stalemate in normal time and was heading into extra time.
Right before the 90 minute mark Klopp took an audacious decision and took out 4 first team players and subbed on 3 players right from the academy to inject some energy into the game. I remember watching this and thinking there’s no way they win now, but the young lads held on to the game and Klopp’s faith in this youngsters was rewarded as an 118th minute header from their captain Virgil van Dijk was enough to seal the deal. The narrative was insane as Gary Neville described “Liverpool’s kids beat the blue billion pound bottle jobs” as eight academy graduates walked out with a winner’s medal that night.

Falling short in the end

With the Carabao Cup in hand the quadruple dream was looking feasible with each day passing, until Liverpool hit a block which shattered their dreams altogether. In close succession they lost the FA Cup quarter final to Man Utd. (should’ve won this one) despite being the better team then went on to lose against Atalanta in Europa league and if that wasn’t enough lost two league games Crystal Palace and most notably their local rivals Everton. After the loss to Everton away from home fans knew that the PL title has slipped from their grasp and Everton fans put salt to their wounds by taunting them with “You lost the league, at Goodison Park”.

As I said in the beginning I don’t really believe in fairytales or happy endings, but I really wanted Liverpool to win some silverware in Klopp’s final season which they did in the form of a Carabao Cup. In the end though, it wouldn’t matter if he won something or not as he has given priceless memories for fans to cherish about and at the end of the day football is much more about winning and losing it is about the difference one man made, the impact he had on people all around the world including me, the narrative he set that “Believe and you will achieve”.

I didn’t make them believe. I reminded them that it helps when you believe. That’s what I think. Everybody was ready to push the train and that’s what we did for eight-and-a-half years.

Final Words

I feel like I must stop here, honestly I have so much more to say, so many more iconic moments to talk about that I can keep writing for hours. I’ve already spent weeks working on this blog and I really hope you enjoyed reading this piece because editing this whole damn thing was an utter nightmare. If you managed to read till the end, I don’t know how to express my gratitude just know that you’re a real one and I hope you have a great day ahead . Ending this blog with one final thing to say:

Danke Jürgen, Danke schön (I hope I wrote that right) and whatever happens You’ll Never Walk Alone.

References & Additional Content

Pep Lijnders book named Intensity (must read): https://www.amazon.in/Intensity-Our-Story-Pep-Lijnders/dp/1914197488
James Lawrence Scott video essay (must watch): https://www.youtube.com/watch?v=gQ0oLupAbe0&t=325s
Liverpool fan documentaries (insanely high production): https://www.youtube.com/watch?v=t2o_41EGckE&list=PLUJS5vI4B14QZ_foMJK_8lhJtYxWK_fKJ
Jurgen Klopp on his footballing philosophy: https://www.youtube.com/watch?v=MwiULKG7KKg
The evolution of Klopp’s tactics at Liverpool: https://www.coachesvoice.com/cv/jurgen-klopp-tactics-liverpool/
Liverpool’s official tribute to Klopp: https://www.youtube.com/watch?v=vBnC6hl8WR4
Players and Coaches on Klopp: https://www.planetfootball.com/quick-reads/13-quotes-to-explain-jurgen-klopps-philosophy-i-always-want-it-loud

How I set up my Blogsite quickly with AstroJS & Storyblok

Tue, 21 May 2024 16:55:13 GMT

Been a while since I wrote my last blog, well I was mostly procrastinating thinking what to work on next and finally decided to build my own portfolio website. The only problem you ask... is that we are in 2024 and there are a hell lot of tech stacks available to achieve this, my first thought was to use my new Swiss Army Knife (Next JS) and quickly build a portfolio using a template but then, I read about Astro JS and it completely won me over.

Don't get me wrong though I still think Next JS is an insanely good framework to work with it's just sometimes you are better off wielding a fucking lightsaber (Astro JS) than a Swiss Knife. And in this case using Astro JS is more preferable because Astro JS is specifically made for quickly prototyping static sites.

Why Astro JS?

Before getting into development let us try to understand what is Astro and when exactly should you choose Astro.

From the official docs:

Astro is the web framework for building content-driven websites like blogs, marketing, and e-commerce. Astro is best-known for pioneering a new frontend architecture to reduce JavaScript overhead and complexity compared to other frameworks. If you need a website that loads fast and has great SEO, then Astro is for you.

The tradeoff between Performance & Complexity

In general most modern web frameworks excel at building applications with complex functionalities such as admin dashboards, role management, HR portals etc. However, this complexity comes at a great cost of performance and requires a whole lot of optimization to deliver content.

But, not every site needs to be complex in order to fulfill your needs, sites which serve to deliver static content such as Blogs, Portfolios, Attractive Landing pages require little to no interactivity with the user to showcase content and this is where Astro JS shines.

Astro JS delivers fast websites by default as mentioned on their docs:

It should be nearly impossible to build a slow website with Astro.

This is purely because Astro ships websites with ZERO Javascript by default to the browser! You heard me right ZERO Javascript meaning everything is pre-rendered on the server-side so it just aims to ship plain HTML to improve performance. As stated in the docs:

JavaScript is often the culprit, since many phones and lower-powered devices rarely match the speed of a developer’s laptop.

But if everything is HTML what about my Interactive components as they rely on Javascript?

This is where Astro's magic really kicks in because even though Astro components are rendered on the sever by default, you can really opt in and decide which components are to be rendered on the client side. This helps to ship minimal JavaScript to the browser while maintaining performance and interactivity on your website. The ability to enable different components to use static and dynamic rendering on demand is Astro's biggest strength and this architecture is known as Islands.

Astro Islands

The general idea of an “Islands” architecture is deceptively simple: render HTML pages on the server, and inject placeholders or slots around highly dynamic regions […] that can then be “hydrated” on the client into small self-contained widgets, reusing their server-rendered initial HTML.

— Jason Miller, Creator of Preact

Simply put, think of your website as an archipelago (a group of islands) where the islands are your set of different interactive Components floating around in a sea of lightweight, pre-rendered static HTML. This design pattern allows a developer to use different UI frameworks with Astro, which brings me to my next point...

Astro does NOT compete with other Frontend-Frameworks instead it works in tandem with them

The Island architecture allows Astro to support multiple UI frameworks like React, Preact, Svelte, Vue, and SolidJS. Even though developers mostly stick to a particular framework this flexibility allows developers to use all of these at once in the same project!

---
// Example: Mixing multiple framework components on the same page.
import MyReactComponent from '../components/MyReactComponent.jsx';
import MySvelteComponent from '../components/MySvelteComponent.svelte';
import MyVueComponent from '../components/MyVueComponent.vue';
---
<div>
  <MySvelteComponent />
  <MyReactComponent />
  <MyVueComponent />
</div>

Setting up our Website

Portfolio/Landing Page

Now that we know what Astro Js is:

Right off the bat, we'll head on to Astro Themes and pick a template to kickstart our project so that we don't have to build from scratch. Create a new repo for this project and clone it in your local machine then run npm install to install all the required dependencies from package.json. Run npm run dev to start and you're good to go!

You can simply edit content on the Portfolio/Landing Page to quickly display your personal information and that is all, or you can ditch all or some of the components and add your own custom components to style your website.

Setting up our Blog Page

Now this is the more interesting part, before we start designing our Blog Page we first need to choose and set up a CMS. What is a CMS you might ask... don't worry I gotchu 🙃

CMS (Content Management System)

Let's take a small example to simplify why we need a CMS in the first place, imagine the company you're working at (with the ongoing recession, we can only imagine 😅) wants to start a blog page, so your boss assembles a team with 3-4 people including you as the sole tech guy. Unfortunately, the rest of your team does not know how to code and have no idea how to write a blog along with HTML for a website, but they are there as creative writers and UI designers.

Now you’re in a state of deadlock where your writers can’t write content on a webpage since they don’t know how to code and even if they did it is hard to write content in plain HTML.

Example Scenario

This is where a CMS comes in, A content management system (CMS) is an application that is used to manage content, allowing multiple contributors to create, edit and publish. It is divided into two main components:

CMA (Content Management Application): This is basically is a media storage cum editor where the author can write content in a user-friendly interface, think of it as Microsoft Word on Steroids.
CDA (Content Delivery Application): This on the other hand deals with all the behind the scenes stuff that processes all the static content and displays as a webpage.

Segregating work using a CMS

Choosing the Right CMS

As for picking a CMS, there are a plethora of options available in the market which you can choose from, but for the sake of this blog I'll be talking about Storyblok which is an excellent Headless CMS option I used for my website. Storyblok is a component-based headless CMS that allows you to manage your content using reusable components called Bloks. Though Astro provides guides for a lot CMS options, it announced Storyblok as its official CMS integration and trust me when I say this, it really is worth it.

Integrating Astro with Storyblok

First up, we need to sign up for a Storyblok account and set up our own space, I just went with the free plan and it works well. Copy the Preview token from the settings and paste it into your .env file for further use.

Now we need to install the official Storyblok Integration package using npm

npm install @storyblok/astro vite

Connecting Astro to your Storyblok Space

To connect our Astro project to our Storyblok space we just need to modify our astro.config.mjs file as shown below and add the preview token from our .env file.

import { defineConfig } from 'astro/config';
import storyblok from '@storyblok/astro';
import { loadEnv } from 'vite';

const env = loadEnv("", process.cwd(), 'STORYBLOK');

export default defineConfig({
  integrations: [
    storyblok({
      accessToken: env.STORYBLOK_TOKEN,
      components: {
        // Add your components here
      },
      apiOptions: {
        // Choose your Storyblok space region
        region: 'us', // optional,  or 'eu' (default)
      },
    })
  ],
});

Making Bloks in Storyblok

Bloks are literally the "building blocks" of our webpage when we incorporate Storyblok and are stored in the Block Library in your Space. Think of your content on your webpage split into different chunks (Blocks) which you can move around, modify at will and even inject in other blocks.

Right now, we just need three blocks to write content namely BlogPost, BlogPostList and the other one being Page. For every block that we create we need to create its equivalent Astro component, so we create a directory named storyblok inside pages to store all these components.

BlogPost: This is a Content Type block which basically acts as a layout for our blogs where we can define some fixed fields and even add other nestable blocks such as Banner Images, Tables etc. The fixed fields being title, description, image and content.

src/pages/storyblok/BlogPost.astro

---
import { storyblokEditable, renderRichText } from '@storyblok/astro'
const { blok } = Astro.props
const content = renderRichText(blok.content)
---

<article {...storyblokEditable(blok)}>
  <h1>{blok.title}</h1>
  <p>{blok.description}</p>
  <img
      class="w-full h-[360px] lg:h- [450px] object-cover"
      src={`${blok.image.filename}/m/1600x0`}
   />
  <Fragment set:html={content} /> 
</article>

Note: Since our content field is of type Richtext, we need to convert it into HTML first therefore we use <Fragment set:html={content} />

BlogPostList: This will be a nestable block which will contain all the blocks of the type BlogPost and will be displayed as cards. It uses the useStoryblokApi hook to fetch all the stories with the content type of blogPost and then filter as draft/published as required.

src/pages/storyblok/BlogPostList.astro

---
import { storyblokEditable } from '@storyblok/astro'
import { useStoryblokApi } from '@storyblok/astro'

const storyblokApi = useStoryblokApi();

const { data } = await storyblokApi.get('cdn/stories', {
  version: import.meta.env.DEV ? "draft" : "published",
  content_type: 'blogPost',
})

const posts = data.stories.map(story => {
  return {
    title: story.content.title,
    date: new Date(story.published_at).toLocaleDateString("en-US", {dateStyle: "full"}),
    description: story.content.description,
    slug: story.full_slug,
  }
})

const { blok } = Astro.props
---

<ul {...storyblokEditable(blok)}>
  {posts.map(post => (
    <li>
      <time>{post.date}</time>
      <a href={post.slug}>{post.title}</a>
      <p>{post.description}</p>
    </li>
  ))}
</ul>

Page: This is also a nestable type block which will render all the components/blocks inside its body field. It also adds the storyblokEditable attributes to the parent element which will allow us to edit the page in Storyblok.

src/pages/storyblok/Page.astro

---
import { storyblokEditable } from '@storyblok/astro'
import StoryblokComponent from "@storyblok/astro/StoryblokComponent.astro";
const { blok } = Astro.props
---

<main {...storyblokEditable(blok)}>
  {
    blok.body?.map((blok) => {
      return <StoryblokComponent blok={blok} />
    })
  }
</main>

Now, that we have created our bloks, we just need to handle dynamic routes for each webpage that we create for our blogs. Creating dyamic routes with Astro is fairly simple, we just need to create a new directory named blog inside our pages directory and inside it create a new file called [...slug].astro with the code below:

src/pages/blog/[...slug].astro

---
import { useStoryblokApi } from '@storyblok/astro'
import StoryblokComponent from '@storyblok/astro/StoryblokComponent.astro'

export async function getStaticPaths() {
  const sbApi = useStoryblokApi();

  const { data } = await sbApi.get("cdn/stories", {
    content_type: "blogPost",
    version: import.meta.env.DEV ? "draft" : "published",
  });

  const stories = Object.values(data.stories);

  return stories.map((story) => {
    return {
      params: { slug: story.slug },
    };
  });
}

const sbApi = useStoryblokApi();
const { slug } = Astro.params;
const { data } = await sbApi.get(`cdn/stories/blog/${slug}`, {
  version: import.meta.env.DEV ? "draft" : "published",
});

const story = data.story;

---

<html lang="en">
  <head>
    <meta charset="UTF-8" />
    <title>Storyblok & Astro</title>
  </head>
  <body>
    <StoryblokComponent blok={story.content} tags={story.tag_list}/>    {/* Pass on Story taglist along with its content for each Story */}
  </body>
</html>

This way every request starting with blog/ will be handled by this file, as it maps the request URL to the slug generated by each Story that we have in our Library. We can test this out by making a Test Blog in our Storyblok Content Tab, head over to New Story and select Content type as BlogPost. You’ll be greeted with a split screen where on the left side you’ll see what is called the Visual Editor and on the right side a normal editor to write and manage content/media.

Getting the hang of Storyblok’s Visual Editor

I feel Visual Editor from Storyblok is their game changing feature, which makes writing content and visualizing it on the fly an enjoyable experience for any writer/developer.

But to set it up you need to change the preview URL from the default one to your localhost with port number where your dev server is running, in my case it is https://localhost:4321/

Note: By default the dev server runs on HTTP, however Storyblok requires apps to be served via HTTPS so to bypass this install basicSsl and run your app in HTTPS. For more details refer this link: https://www.storyblok.com/faq/setting-up-https-on-localhost-in-astro

And just like that we’re done, now we have our own Content Editor platform that we can use to write content, visualize changes in real-time, manage media using Storyblok’s Asset Library and customize every component using custom Bloks.

Source Code:

https://github.com/NikhilC2209/portfolio

References:

Astro Docs: https://docs.astro.build/en/getting-started/
Storyblok Integration Guide: https://docs.astro.build/en/guides/cms/storyblok/
Astro Syntax: https://docs.astro.build/en/basics/astro-syntax/
Astro Community Guides: https://docs.astro.build/en/community-resources/talks/
RichText vs Markdown: https://www.ssp.sh/brain/markdown-vs-rich-text/

Complete Authentication Guide Using Next-Auth v5 in Next.js 14

Tue, 21 May 2024 16:55:03 GMT

So this is part two of a two-part blog I’m writing about implementing Complete Authentication in Next.js 14 using Next-Auth v5. If you haven’t read the first blog I would highly recommend checking it out first: https://medium.com/@nikhilc2209/client-side-form-validation-with-zod-useformstate-in-next-js-14-dc011a9c44fb

In this blog, I’m going to talk about how easy it is to implement Authentication & OAuth in your Next.js projects using Next-Auth v5.

Setting up Next-Auth

NextAuth.js is an open-source authentication library for Next.js applications which tries to simplify the process of implementing authentication in your Next.js projects by providing a set of utilities, middleware, and strategies for various authentication providers making Authentication hassle-free for developers.

Installing Next-Auth

To include Next-Auth v5 in your Next.js project simply run:

npm install next-auth@beta

since this version is still in beta and not included in the main release.

Changes from Next-Auth v4

The Next-Auth library has been around for a while now and has undergone major changes recently since the introduction of Next-Auth v5, though these changes introduce a lot of new features the publishers have tried their best to minimize the number of breaking changes.

Here is a summary of most of these changes from the official docs:

The most notable change here is that most session related calls are now replaced by a universal auth() call which can be imported in any Server component and makes the code more readable.

Adding Auth handler

First we’ll set up a auth file which will handle all of our authentication based requests, create this file in the src directory so this way we can easily import it anywhere in our application using absolute imports starting with @ . Below is an example of how our auth.js file should look like. Starting off we have two options either login through Credentials(username/password) or login through an OAuth provider, in our case Google.

auth.js

import NextAuth from "next-auth"
import GoogleProvider from "next-auth/providers/google"
import CredentialsProvider from "next-auth/providers/credentials";

export const {
  handlers: { GET, POST },
  auth,
} = NextAuth({
  session: { strategy: 'jwt' },

  providers: [

    CredentialsProvider({

      credentials: {
        username: { label: "Username", type: "text" },
        password: { label: "Password", type: "password" }
      },

      async authorize(credentials) {
        // authorization logic here
      }

    GoogleProvider({
      clientId: process.env.GOOGLE_CLIENT_ID,
      clientSecret: process.env.GOOGLE_CLIENT_SECRET,
    }),
   ]
})

Now we’ll make a folder named api/auth inside the app directory which will contain all our logic for authentication. Inside this folder we create a subdirectory named [...nextauth] with a file named route.js. Interestingly, this naming convention is really important because this way every API request beginning with /api/auth/* will be handled by the code written in the [...nextauth]/route.js file.

Note: In Next-Auth v4 all the authorization logic was handled by the [...nextauth].js file, but since the v5 upgrade we have moved our authorization logic to the root of our repository so that it can be easily imported everywhere.

And now this file becomes a 1-line handler for GET and POST requests for those paths.

app/api/auth/[...nextauth]/route.js

export { GET, POST } from "@/auth"

Setting up Credentials Provider

Setting up Credentials Provider is fairly simple, remember that login form we created in the previous blog, we just need to pass the form data using the signIn function provided by the next-auth library and await for a response.

const response = await signIn("credentials", { 
   username: formData.get("username"),
   password: formData.get("password"),
   redirect: false, 
  });

Now we can handle this request in the authorize function in the Credentials Provider we just created. For the purpose of this blog I’m not going to connect to a database, I’ll just use a dummy.json file to store username & passwords for easier demonstration. So in our authorize function we’ll just loop through the json file and try to find matching credentials for our username and password.

If we manage to find it we return a user object with user.id & user.username and next-auth will create a session using the strategy defined in auth.js else we just return null indicating that the credentials are incorrect.

Similar to signIn function Next-Auth also provides a signOut function which deletes the current session and just like that we can easily login and logout using Next-Auth.

Also, to get our jwt tokens working we need to define a secret key named as NEXTAUTH_SECRET in our .env file, this is important because every jwt token has to be signed by a private key which is not meant to be shared. To generate this simply go to your terminal and run openssl rand -base64 32 to create a random 32-bit base64 string which we’ll use as our private key.

Defining public, protected & auth routes

Now that we have our login page working we can define our public, private and protected routes, the idea is pretty simple:

Public routes should always be accessible by everyone, therefore no sensitive data should be kept here and hence no checks are required if user wants to visit this url. For example: home page.
Protected routes should only be accessible to authenticated users as they might contain user-specific or some other kind of sensitive data, user needs to login to be able to view this and we can verify if the user is logged in by checking if the session token is valid or not. For example: user dashboard page.
Auth routes refer to login/register pages where the user is supposed to login credentials to verify his identity, these pages should only be visible to the user if the user is not logged in. If the user is logged in we redirect him back to the dashboard page, if the user wants to login using a different ID he needs to logout first to access an auth route. For example: login page.

Adding Middleware config

Adding a middleware using Next-Auth is recommended and makes our job much easier, when configured the middleware acts as a filter through which all the requests go through. Here we can check which request belongs to which type of route and can handle them accordingly, below is an overview of how Middleware works.

Condensed view of the Middleware module

import { auth } from "@/auth";
import { privateRoutes, 
         authRoutes, 
         DEFAULT_REDIRECT_LOGIN_URL, 
         DEFAULT_REDIRECT_HOME_URL } from './routes';

export const config = {
  matcher: ["/((?!.+\\.[\\w]+$|_next).*)", "/", "/(api|trpc)(.*)"],
}

We also define a routes.js file along with middleware which contains all our private, public and protected routes.

Note: This crazy looking regex basically matches every single request made to the server, meaning that every request has to go through the middleware checks. You can however define only private routes here, but the former gives you more control and is strongly advisable.

Using Sessions to render data

We can also use the session we created to pass user-specific information such as the username/email of the authenticated user. If we console.log() the session we just created we see:

We get the username that we passed on successful login and the expiry time of the current token, we can also add additional information if we want from the authorize function in auth.js . We can use this information to display which user is logged in on the dashboard page or any other public/protected route.

Adding redirects for protected and Auth routes

The last thing to complete our Credentials Authentication is to set up redirect urls, these will be triggered in middleware.js based on the type of route and if the user session exists or not.

// When user is not logged in and tries to access protected routes redirect to login page
export const DEFAULT_REDIRECT_LOGIN_URL = '/login'

// When user is logged in and tries to access login page redirect to dashboard
export const DEFAULT_REDIRECT_HOME_URL = '/dashboard'

And now, we have successfully configured our Credentials Authentication using Next-Auth v5.

Adding OAuth provider

For our last act we just need to configure the OAuth providers we talked about so the user has the option of logging in via Credentials or through providers like Google, Github etc. With Next-Auth by our side adding OAuth is really a child’s play, Next-Auth provides a ton of OAuth options, but to keep this blog concise I’ll only demonstrate how to set up GoogleProvider.

From the Next-Auth official docs, we need a GOOGLE_CLIENT_ID and a GOOGLE_CLIENT_SECRET to set up our GoogleProvider, we can easily generate these by going to https://console.developers.google.com/apis/credentials and making a new project. From this project we can generate OAuth 2.0 credentials, generate them and paste them in a .env file and don’t expose them anywhere.

While in development use localhost as your URI and http://localhost:3000/api/auth/callback/google as your redirect URI, this way every OAuth request is handled by auth.js file.

Google Console settings for GoogleProvider

To trigger this we define a button for Google OAuth on our login page and when triggered this again invokes the signIn function we used earlier, we pass in the name of our provider along with a callbackUrl to redirect the user on successful login.

signIn("google", { callbackUrl: 'http://localhost:3000/dashboard'});

And with that, we have successfully configured our Login through Credentials & setup OAuth in just minutes Congrats!

As usual, for all those bums who skipped through the blog and are just interested in the code, I’ve attached the source code below.

I hope you enjoyed reading this and I hope you have a great day!

Source Code:

https://github.com/NikhilC2209/Next-Auth-v5

References:

Next.js docs: https://nextjs.org/docs
Next-Auth v5: https://authjs.dev/guides/upgrade-to-v5
Learn about jwt: https://jwt.io/

Client Side Form Validation with Zod & useFormState() in Next.js 14

Tue, 21 May 2024 16:54:48 GMT

Authentication in Web Apps is a crucial aspect for securing any Web Application and is a must-know for every Full-Stack developer out there. Though implementing Authentication for the first time can be an annoying experience for people(including me!) as there are so many libraries and strategies out there. So this is part one of a two-part blog I’m writing about implementing Complete Authentication in Next.js 14 using Next-Auth v5.

In this blog I’m going to talk about the easiest way in which you can handle form data in react and perform Client-side Validation in minutes using Zod.

Creating Next app

We’ll start by creating a Next-app from the terminal using the below command:

npx create-next-app@latest

Note: Make sure you have Node.js 18.17(or higher) installed before running this.

Similarly if you have Bun pre-installed instead of Node.js run this command:

bunx create-next-app

Next.js Project Structure

After creating our next app this is what our folder structure looks like for the project, this may seem overwhelming if you’re new to Next.js, but I’ll walk you through how simple this really is:

node-modules: if you’ve worked with Node.js before then this folder is self-explanatory, but if this is your first rodeo then this is where all the dependencies for our project are stored. Any external dependency we install using npm is imported from here.
public: this folder is where we store all our static assets including images, videos, gifs or any other kind of documents such as pdf’s etc. which are not subject to change, since these files are cached to offer better performance.
src: this folder is the heart of our application as this contains our frontend & backend code in the form of .jsx or .tsx files. The app folder inside this contains all our routes for the application in the form of folders while the components folder contains all the custom reusable UI components such as buttons, cards etc.

Each folder in the app directory denotes a route which can be accessed by going to /folder_name. The content of this page will be rendered from the file named as page.js , the file named layout.js defines a set of styles and UI components which will be rendered in every sub-route.

To know more about other files allowed by the App Router take a look at this from the official docs: https://nextjs.org/docs/getting-started/project-structure#routing-files

.env: this file contains all the secret environment variables such as secret ID’s & keys that are required to confirm your identity. Split this into .env.development.local and .env.production and never share this anywhere!
package.json & package-lock.json: these files keep track of all the packages installed along their versions along with pre-defined scripts to run our project.
tailwind.config.js: this file contains all the configurations which tailwind will look for to define any customizations.

Now that we have this out of our way let’s fire up our server in development mode using npm run dev

PS: this command is a script alias defined in the package.json to run the next server in development mode.

Adding Form page

As discussed above, to create a new route we’ll create a new folder in the app directory named as login containing a file named page.js . Any code that we write here is rendered on /login .

We’ll look to create a simple form with Username & Password to login as Credentials or the user can use Google, Github, Reddit & Twitter as OAuth providers.

To quickly build our form page I’m using Tailwind components from Flowbite linked here: https://flowbite.com/docs/components/forms/

But you can use any component library you want, it really doesn’t matter.

Finally, our page looks like this and now we can start working on it.

Client side Form Validation

This is the first step of validating our form data, this step ensures we perform primitive data validation before sending our data to the server. The easiest way to do this would be by using a third-party library like Zod.

Nope, not my Kryptonian friend over here 😅

Zod is a TypeScript-first schema declaration and validation library and is super-easy to use.

Use npm install zod to quickly include Zod in your project setup

Zod provides a number of primitive values in its documentation for fields such as strings, numbers, boolean, date etc. We only have two fields both of which use string values so we can create separate schemas for both of them.

Zod also provides a lot of options for string validation out of the box as shown below which we can use along with the option of chaining all these arguments to be processed sequentially.

z.string().min(5, { message: "Must be 5 or more characters long" });
z.string().max(5, { message: "Must be 5 or fewer characters long" });
z.string().length(5, { message: "Must be exactly 5 characters long" });
z.string().email({ message: "Invalid email address" });
z.string().url({ message: "Invalid url" });
z.string().emoji({ message: "Contains non-emoji characters" });
z.string().uuid({ message: "Invalid UUID" });
z.string().includes("tuna", { message: "Must include tuna" });
z.string().startsWith("https://", { message: "Must provide secure URL" });
z.string().endsWith(".com", { message: "Only .com domains allowed" });
z.string().datetime({ message: "Invalid datetime string! Must be UTC." });
z.string().ip({ message: "Invalid IP address" });

A schema is an object which basically contains a set of rules defined with a data type that can be used to validate any kind of data passed to it.

const userSchema = z.string()
                    .min(5, { message: "Must be 5 or more characters long" });

const passSchema = z.string()
                    .min(8, { message: "Must be 8 or more characters long" })
                    .regex(new RegExp(".*[A-Z].*"), { message: "Must conatain one uppercase character" })
                    .regex(new RegExp(".*\\d.*"), { message: "Must contains one number" })
                    .regex(new RegExp(".*[`~<>?,./!@#$%^&*()\\-_+=\"'|{}\\[\\];:\\\\].*"), {message: "Must contain one special character"});

Example usage of this schema using .safeParse() method:

userSchema.safeParse("user");         // ❌ { success: false; error: "Must be 5 or more characters long" }
userSchema.safeParse("Random");       // ✅ { success: true; data: Return "Random' }

passSchema.safeParse("pass");         // ❌ { success: false; error: "Must be 8 or more characters long" }
passSchema.safeParse("password");     // ❌ { success: false; error: "Must conatain one uppercase character" }
passSchema.safeParse("Password");     // ❌ { success: false; error: "Must contains one number" }
passSchema.safeParse("Password123");  // ❌ { success: false; error: "Must contain one special character" }
passSchema.safeParse("Password123*"); // ✅ { success: true; data: "Password123*" }

Now once we have defined this we just need to invoke this at every keyStroke for live validation, to do this we can use the onChange event to call a function that uses .safeParse() to validate the input data.

<input type="text" name="username" onChange={checkSchema} />

Getting Form Data

Though there are number of ways of getting form data in React we’ll again talk about the easiest way to get formData in React. Months back React released a new hook called useFormState() which made interacting with forms a walk in the park.

const [state, formAction] = useFormState(fn, initialState)

From the official docs:

The form state is the value returned by the action when the form was last submitted. If the form has not yet been submitted, it is the initial state that you pass.
Parameters
fn : The function to be called when the form is submitted or button pressed. When the function is called, it will receive the previous state of the form (initially the initialState that you pass, subsequently its previous return value) as its initial argument, followed by the arguments that a form action normally receives.
initialState : The value you want the state to be initially. It can be any serializable value. This argument is ignored after the action is first invoked.
Returns
useFormState returns an array with exactly two values:
The current state. During the first render, it will match the initialState you have passed. After the action is invoked, it will match the value returned by the action.
A new action that you can pass as the action prop to your form component or formAction prop to any button component within the form.

To use this hook we just need to define the useFormState() hook with a function called handleCredentials that will be invoked whenever the form is submitted. Then we can simply use formData.get("input") to get data from that input field.

const handleCredentials = async (prevState, formData) => {

  const response = await signIn("credentials", { 
     username: formData.get("username"),
     password: formData.get("password"),
     redirect: false, 
  });
  
  if(!!response.error) {
    setModal(true);
    setErrorMessage("Incorrect Username or Password");
    console.log(response.error);
  }
  else {
    router.push('/dashboard');
  }
}

const [state, formAction] = useFormState(handleCredentials, initialState);

<form action={formAction}>

Once we have our verified our credentials on the client side we can then send it to the server for Server side validation to make sure the credentials entered are correct or not. Based on that request we’ll get a response, if the response contains an error message we’ll use a dismissible modal to display it.

So with this we have successfully configured Client-side Validation with Zod. For all those bums who skipped through the blog and are just interested in the code, I’ve attached the source code below.

I hope you enjoyed reading this and have a great day!

Source Code:

https://github.com/NikhilC2209/Next-Auth-v5

References:

useFormState() hook: https://react.dev/reference/react-dom/hooks/useFormState
Zod: https://zod.dev/
Flowbite: https://flowbite.com/docs/getting-started/quickstart/
Next.js docs: https://nextjs.org/docs

Next up, we’ll look to send form data to the server side and implement Authentication using Next-Auth v5.

A Disappointing Midseason Barcelona Review: By Numbers

Tue, 21 May 2024 16:54:41 GMT

If you watch Barcelona at this point, you would understand how aptly this gif epitomizes the current situation of the club, as we’re halfway through the season its looking like another one of those trophyless outings for the Catalan side. After already being out of the Spanish Super Cup & the Copa Del Rey technically they still have 2 major trophies to fight for including La Liga and the Champions League (yeah good luck with that!) but most fans have lost hope with this season. And now with Xavi leaving the club in the summer things are not looking good this season.

Let’s take a closer look at the underlying issues plaguing this club and how might Barca actually turn this around if they can that is.

Xavi’s tactics at Barcelona

Xavi as a player has been a core part of the Spanish national team and the mighty treble winning Barcelona squad which purely dictates his instinct as a manager and how he means to preserve the Barca DNA.

Since his arrival, Xavi has been using his 3–2–2–3 formation in possession or a 2–3–5 shape to great effect as seen below, this shape offers a lot of advantages in build up from the back and chance creation upfront.

This formation consists of a lone striker upfront as Lewandowski, two inside forwards preferably Pedri/Gavi & Gundogan, two wingers/wide players to hug the touchline preferably Balde & Lamine/Raphinha, two pivots preferably Frenkie & Cancelo/Romeu and 3 centrebacks preferably Christensen, Araujo & Kounde.

Credit: The Purist Football

There is absolutely nothing wrong with Xavi’s approach as he has used the same structure to win the league last season by scoring a lot of goals but also maintaining a solid rest defence at the back. Xavi wants his players to equally spread around the pitch and occupy each zone so that every player has passing options around them and can combine easily to escape pressure. Having 5 players in the front line enables them to frequently pull opposition players from the backline to create space with smart off-the ball movements.

With highly technical players deeper such as Frenkie, Gundogan they create loads of chances every game with balls over the top, line breaking passes, swerving crosses. Having Pedri, Gundogan & Gavi between the lines is important as they can easily receive the ball under pressure and turn in tight spaces to play the final pass. With young players such as Balde & Lamine Yamal in wide areas you get runners in-behind as well as players willing to take on fullbacks everytime. And with 3 solid centre-backs in defence they should (in theory) be able to defend well right?

But that is not the case this season, now let’s take a look at some of the issues holding this team back

Squad depth

After getting rid of Fati, Dembele, Eric Garcia and Ez Abde in the summer window Barcelona were mainly looking to add to their squad depth upfront. But with Barca’s never ending financial struggles, it meant that they can only look for less costly replacements, as a result Oriol Romeu and Inigo Martinez were signed to improve their squad depth at the back.

After showing interest in both João Félix and João Cancelo, Xavi was able to get both on loan, all thanks to them falling out with their respective clubs. Where Félix was looking for a fresh start while Cancelo was purely looking for regular playtime under Xavi. With this Barca capped of a decent summer window as compared to their Spanish rivals who went gung ho to improve their squad as well.

Squad Depth Comparison after the Summer and Winter Transfer Window (Credit: Tribuna.com)

After a bothersome start to the season which saw Pedri & Frenkie getting injured and missing some important games in the first half of the season, Barca mostly relied on its youngsters with Lamine Yamal, Gavi and even Fermin getting some minutes every now and then.

Midway through the season they were hit hard by 2 more major injuries on regular first team players: Gavi and Ter Stegen which would see both of them missing the whole 23/24 season. Both of them were integral to Blaugrana’s success and the way they played last year which makes them difficult to replace.

Lack of finishing in the final 3rd

Source: fbref

A simple search query tells us that Barcelona have recorded the most xG in all of Europe’s top 5 leagues seconded only by Bayern Munich. But their lack of finishing up top has been a major concern as they have failed to hit the mark time and again. Though xG can be deceiving sometimes when teams attempt a lot of shots at goal, but if we look at npxG per shot Barca still ranks the highest in the league along with Girona.

While most top teams have exceeded their xG by scoring more with a fair margin Barcelona have struggled to put the ball in the back of the net, in fact among the top 15 teams in Europe they have the worst (Goals-xG) stat along with Chelsea (which is obviously not great company at the moment!).

Lewandowski’s dwindling numbers

Credit: Forbes.com

Robert Lewandowski who has been a stellar striker throughout his career has been struggling to even make an impact this season, he’s been pretty subpar when it comes to linking up, making incisive runs and even controlling the ball in the penalty area.

Part of this decline is understandable as he is not in his prime any more and is probably enjoying what might be his last few years of playing at the top level. But, with lack of clear striking options for Barcelona where they loaned out Fati in the summer window, and Ferran & Felix both reluctant to fill the #9 position it has become quite tricky and definitely raises questions on the squad depth.

Though Vitor Roque who was signed in the winter as a long-term prospect might be able to challenge Lewandowski and provide cover for him at this moment.

Defensive woes

B-A-C-K The defense in Europe?

Credit: Barca Worldwide (Twitter)

Generally when we think of Barcelona we think of fast free flowing football, a team boasting of highly technical players all over the pitch playing proper Cruyff football. We rarely see Barcelona being associated with the word “defensive solidity”, but that is what happened last season when Barcelona displayed the best defensive record not just in the league but all over Europe!

A big part of this performance was Barcelona’s newly formed Back 4 which consisted of new summer signings Kounde & Christensen along with Araujo and a young academy prospect Alejandro Balde. This back 4 was Xavi’s preferred combination when fit which conceded just 20 goals in 38 league games and 46 goals in 55 matches across all competitions!

But this season, fans have seen a mere hint of past glory achieved by this combination as they’ve failed to keep clean sheets time and again and keep conceding goals to every opposition they play. Defensive errors at the back have become quite common and their defensive structure seems deformed most of the time. But, who is to blame?

Missing Ter Stegen

Credit: Goal.com

Marc Andre Ter-Stegen who has been a loyal servant for the Blaugrana for almost a decade now, a club where he established himself as a world-class keeper and is undoubtedly the best ball-playing goalie in Europe right now is definitely being missed by everyone. He is a core part of the Barcelona defense as he vastly overperformed his expectations last season by keeping the most clean sheets in the league.

But Barca aren’t just missing his spider-like reflexes on the goal line, they are also missing his great passing range and ball playing prowess from the back. His ability to take charge against high pressing sides and playing a pinpoint ball to a free man upfront has been his career highlight and part of what makes him world-class.

Iñaki Peña who is currently filling for him in his absence has been subpar at best with a poor save percentage, he also clearly lacks the skillset Ter-Stegen has and still needs time to develop as a proper first team goalkeeper.

Conceding early goals

Conceding early goals almost every time has been the story so far this season as Barca conceded first in 7 out of 19 games before the winter break, with most of these goals coming just within 10 minutes post kickoff. As a result of the game state, Barca are bound to chase games every now and then which causes a lot of impatience among the players as they look to create chances as soon as possible.

Though this in theory should work in their favor but it has instead worked against them as an impatient pass during build up leaves them outnumbered at the back leading to a turnover at times when the defense isn’t expecting. This coupled with the fact that Barca have no natural ball-winners in midfield meaning their counterpressing has been pretty wasteful this season.

Gavi’s absence

Credit: Goal.com

Of all injuries that have plagued this team, Barca were hit the hardest by Gavi’s absence, yes a 19-year old midfielder from La Masia is literally the heart and soul of this Barcelona team. His pressing intensity and passion for winning the ball back is unmatched not just in Barca but all over Europe.

The Golden Boy winner is already a regular starter for club & country and has been hailed by Xavi as irreplaceable in his side, despite his short stature he is brimming with confidence and always gives his best in every duel despite the odds. With Barcelona boasting of a highly technical midfield in Frenkie and Gundogan, Gavi provides the bite it needs to dominate every game.

After Busquets’ departure, who was arguably the greatest holding midfielder of his generation and someone who perfectly fit the job description and the style of play at Barcelona, Barca have struggled to match his numbers whether it maybe in defensive actions or the ball-playing abilities he had. Gavi definitely does not match his profile but has stepped up his game alongside Busquets and after his departure in the defensive shift he puts in each game. His ability to man-mark Bellingham and nullify his presence for 70 minutes in the El-Clasico is what amazed me the most this season.

Gavi’s still leading the charts in the number of tackles put in by Barca players despite being out for a major part of the season as shown below. In fact, he’s the #1 ball winner for the team in the attacking 3rd phase of the game and significantly reduces the number of turnovers Barca face.

Gavi is a player I personally adore a lot and he is someone whose mere presence would fix a lot of issues with this team right now. My personal favorite memory of him will always be winning an aerial duel against Wout Weghorst in the Champions League who with all due respect towers over him .

The Left-back problem

Credit: Barca Blaugranes

The left-back role provides a tricky problem for the Catalan side in recent times which was sought to be over until the start of this season but instead grows even deeper. A 19-year old academy prospect Alejandro Balde in his breakout season showed the world why he deserves to be on the first-team sheet ahead of veteran full-back Jordi Alba. Balde exceeded everyone’s expectations and completely obliterated his critics with his stellar performances, despite that he has struggled this season and has definitely failed to make the same impact this year. But is it even Balde’s fault?

Balde’s role in Xavi’s system

As discussed earlier Xavi wants to stretch the opposition backline by playing 5 forwards when in possession and in this system Balde is the one who provides width on the left hand side of the pitch. This totally suits Balde’s traits as he is a naturally offensive fullback who can easily slip past defenders relying solely on his pace.

Which brings me to my main point: Balde is an offensive fullback and NOT a WINGER! Look at these stats below comparing wide players from this and last season. Comparing his stats to a proper winger we can see that he attempts less take-ons than actual wingers and instead likes to go around the opposition backline.

Comparing the two wide players per90 minutes in 23/24 season

Comparing the two wide players per90 minutes in 22/23 season

While Balde definitely found success by taking on players last season he has been a shadow of his former self this season and part of the reason is that his game is not about taking on fullbacks or dribbling his way through the opposition backline with the ball. Instead it is more about the off the ball movements and the burst of pace he provides to attack space to play dangerous passes/crosses in the penalty area, which brings me to my final point.

The left half-space problem

Well “A picture is worth a thousand words” and if there is any truth to that adage here it is. Look at this image below, this picture clearly explains some issues with this squad that often go unnoticed.

Barca vs Real Betis Matchday 21 (23/24 season)

This snapshot is from Barca playing against Real Betis which was also Balde’s last game after he was sidelined for the whole season. As we talked about Xavi’s structure before how he wants his players to occupy all zones when in possession so that every player has an outlet to play the ball to, in this case the left-half space is completely empty meaning that Balde has no one to combine with and has to play 1v2 against the two Betis players. This sequence results in Balde trying to take-on the fullback and playing an uncharacteristic cross which finds no one and possession is lost.

This issue is not limited to a particular sequence in this match, it has become a common theme among all matches this season which hinders Balde’s ability. The major issue here is player profiling, since the front five in possession consists of Lewandowski and Ferran playing together, both of whom like to drift into central areas and hence create this gap. Last season, this was not a problem as the front five usually consisted of Gavi and Pedri playing as the interiors so the wide players always found it easy to combine with them under pressure. But with Gavi, out of the picture Balde has been totally isolated on the left flank and can barely prove useful.

Some positives

Lamine Yamal

Credit: FC Barcelona

Barcelona have been blessed to have a Lamine Yamal among their ranks as the youngster has been beyond outstanding in his breakthrough season. In fact, Barca have been heavily reliant on this young prodigy this whole season who has lit up the league and is taking on every player left, right and center.

For me personally, Lamine has been the best forward in this team by a long shot and reminds me why I love watching this team. Despite being a 16-year old he is overflowing with confidence and is ready to take on defenders at will, escape from pressure and mature enough to release the ball at the right time. What amazes me is that he still has a lot of time to develop and with regular playing time in the coming seasons I’m thrilled to see what the future holds for him.

İlkay Gündoğan

Gündoğan has been nothing short of world-class since the start of this season and has easily become the most consistent player in the squad. While all the other midfielders have been ridiculed with some form of injury in different phases of the season Gündoğan has been Xavi’s go-to-man in the middle of the park.

Gundogan’s Heatmap this season (Credit: Sofascore)

Due to his technical brilliance and reliability he has played more minutes than other player in the squad and has contributed in single phase of play. Though his preferred position is as an interior upfront, he has also played as a pivot covering for Frenkie in his absence making him extremely flexible. With the season coming to an end Barca could definitely use his clutch potential and big game mentality to save this season.

Ending Note

Though most of these issues and problems discussed above just seem to be small tactical tweaks & psychological issues with the players and their dropping intensity this season, which is not as bad as it looks. Since, Barca don’t necessarily need new personnel they just need to reinvigorate themselves and a couple of good results might just do that.

I hope this blog was worth your time if you made till the end, this took a lot of time & effort and was also my first attempt at bringing my Football knowledge & Data Analysis skills to the table.

Thank you for reading and have a good day!

Integrating HSV Filtering into our Detection model for Team Identification

Tue, 21 May 2024 16:54:31 GMT

This article is the final part of my 3-part blog series about a project I made recently while learning Computer Vision which is about developing a complete Football Analytics Model using Yolov8 + BotSORT tracking.

Read the previous blogs here:

Objective: This blog is about using the annotated frames from our Yolov8 model and further processing them to split the detected players into their respective teams based on their jersey colors using HSV Filtering.

A Brief look at the HSV Color space

The HSV Color space is an alternative to the popular and frequently used RGB Color space and is widely used in Image Processing and Computer Vision tasks. This is because it offers a lot more control in terms of lighting and brightness which is helpful in separating chromatic information from its intensity.

The HSV model stands for Hue Saturation and Value. Let's break down these 3 components:

Hue: This component is responsible for discriminating between different colors. It is measured on a 360 degree scale which starts from red at 0 degree, green at 120 degrees, blue at 240 degrees and loops back again to red at 360 degrees.
Saturation: Saturation refers to the intensity or purity of the color. A color with high saturation is vivid and rich, while a color with low saturation appears more muted or grayscale. This value is represented as a percentage from 0% to 100%.
Brightness: The Value component represents the brightness or intensity of the color. This is also represented as a percentage value where 0% corresponds to black, while the maximum value 100% corresponds to the brightest possible color.

A condensed view of the HSV Color Space

What is HSV Filtering

HSV Filtering is the process of isolating and extracting specific colors from an image based on a pre-defined threshold of HSV values also known as masks. Let's work on a simple image to understand how this works:

Input Image

Let's use the above image and try to isolate and extract the flower from this image using OpenCV.

First off we need to convert the given image from BGR to HSV color format, this is because OpenCV loads any image in the BGR format by default (yes, BGR not RGB format!). Read this article from OpenCV's CEO Satya Mallick about why OpenCV uses the BGR format by default: https://learnopencv.com/why-does-opencv-use-bgr-color-format/
Next we need to define masks using the cv2.inRange() function which takes the hsv image as input and a pair of tuples with lower and upper threshold of hsv values for the target color. In our case, the target color is red so we'll define the masks accordingly.
Another thing to keep in mind is that OpenCV uses a different range for HSV values, for Hue it is between (0-180), for saturation it is between (0-255) and for value it is again between (0-255).

Condensed view of the HSV Color map in OpenCV

After defining threshold masks using the above image as reference, we can now use the bitwise_and operator from OpenCV to combine the binary mask with the input image to get the target color as the output.

1) Input Image 2) Thresholding Binary mask 3) Output Image after Bitwise_and operation

Using a hsv trackbar

Now we know how to create masks for isolating colors from our target image using the hsv color map, but creating masks for specific non-standard colors can be a bit tricky and can lead to dubious results. Therefore, we can use a hsv trackbar with sliders to change the hsv values of masks in real time to get the best possible output as shown below.

HSV trackbar in action

Ref.: https://stackoverflow.com/questions/44480131/python-opencv-hsv-range-finder-creating-trackbars

Storing all the jersey crops and color codes for each team

For the purpose of our project we'll only be working on teams from the Premier League, we can simply take a crop of jerseys of all the 20 teams and use our trackbar to log these values in a csv file. This way we can store hsv codes for all teams which includes home, away and third kit along with their respective goalkeeper kits.

The main idea behind using this approach to classify detected players into their respective teams is that football matches have teams with easily distinguishable jerseys to avoid clashes due to similar colors. We are simply leveraging this fact to our advantage as this applies to football matches all over the world.

Getting bounding box and label data from Yolov8 model

Now that we have built our color filtering module we'll go back to our tracking module and feed the results from the latter to the former to get the desired output. What we really need is bounding box co-ordinates for each detected player and their confidence score, we can use the bounding box co-ordinates and send crops of players to our hsv filtering module which will run it through all four masks (home & away team jersey, home & away goalkeeper jersey) and compute the output label.

To compute the output label we take masks for both the teams and their goalkeepers, then we can then simply count the number of non-black pixels for each output image resulting from each mask and choose the one with the maximum count.

We can then draw bounding boxes using OpenCV with custom labels that we just computed which represent team names and their confidence scores. Looking at Ultralytics docs, to get the bounding box co-ordinates for each detected object we can use the results Class from each frame and use methods such as boxes.cls(), boxes.xyxy(), boxes.conf() to get the object label, its co-ordinates in xyxy format and its confidence score respectively.

Ref.: https://docs.ultralytics.com/reference/engine/results/

Saving results using OpenCV Videowriter

Now that we have plot our bounding boxes along with their custom labels for each frame we can simply compile these frames to produce the final output in video format. To do this we simply need to use the VideoWriter Class from OpenCV which takes in the following arguments:

result = cv2.VideoWriter('filename.avi', cv2.VideoWriter_fourcc(*'MJPG'), 10, size) 

# cv2.VideoWriter(filename, Codec Compression method, fps, frame_size(w,h))

Final Results

Source Code:

https://github.com/NikhilC2209/Football_Analytics_CV

Player and Ball Detection using Yolov8 + BotSORT tracking on a custom Dataset

Tue, 21 May 2024 16:54:21 GMT

This article serves as part two of a 3-part blog series about a project I made recently while learning Computer Vision which is about developing a complete Football Analytics Model using Yolov8 + BotSORT tracking.

Read the previous blog here: https://medium.com/@nikhilc2209/an-image-annotation-guide-using-roboflow-for-object-detection-a4e30581b5cf

Objective: This blog is about understanding the YOLO architecture and training it on a custom dataset, then fine-tuning the model to get better results and running inference to understand what works best.

What does YOLO stand for?

YOLO(You Only Look Once) is a state-of-the-art Object Detection algorithm which found its fame due to its revolutionary technique of single-pass detection which improved its speed and accuracy to edge over its peers.

YOLOv1 was originally proposed in 2015 by treating Object Detection as a regression problem to compute class probabilities using bounding boxes. It has since undergone a lot of improvements and is currently under the maintained by Ultralytics which have released their latest version Yolov8.

Brief look at how YOLO algorithm works

As the name suggests the YOLO algorithm makes predictions on an image in a single pass, this is better than traditional methods where sliding windows are used over the whole image convolutionally or region proposals are used at multiple locations to localize objects.

The way YOLO does this is by dividing the image into a S x S grid (shown below) where each grid cell is responsible for producing the bounding box and confidence score output.

YOLO divides the input image into a S x S grid

For each grid cell in this image we compute the following:

Format of our target variable for each grid cell

The first cell refers to the confidence value which is nothing but a label which decides if any object lies inside the grid cell or not (0 or 1). If the answer is yes, then we move on to predict the values of the bounding box in xywh format where x & y are the co-ordinates of the center of the bounding box and w & h refers to the width and height of the bounding box. And lastly we have our Class Probability Distribution vector which contains prediction scores for each object label ranging between 0 and 1.

Example output of grid cells using the above image

If we take a look at the above image we can clearly see that the blue bounding box defines the true boundary of the dog object. When we take a look at the output vector of the green grid cell we are trying to predict the center of the blue bounding box which is our true label.

First we decide if there is an object in that grid cell, since the answer is yes we can continue further and assign the xywh values, you may have noticed that the width and height values exceed the 0 and 1 range. This is because the true label of that whole bounding box spans more than the green grid cell and takes a little more than 3 grid cells for height and width. Lastly, about our class probability scores the green grid cell only contains the doog object so we can easily assign the score 1 to the dog object and 0 to the car object.

Also, if we take a look at the yellow grid cell we know that it does not contain any object so we can simply assign confidence value 0 to its output vector. The "x" denotes the don't care term which means we can safely neglect all other values from the output vector.

Training Yolov8 on our custom dataset

Now, let's continue on our Player and Ball Detection Dataset from Roboflow and train it using Yolov8:

Dataset used: https://universe.roboflow.com/nikhil-chapre-xgndf/detect-players-dgxz0

First we need to install Ultralytics which maintains all the Yolo models:

pip install ultralytics

Next we need to set up a yaml file for configuring some training parameters:


path: absolute path to dataset (/path/to/dataset)
train: relative path from dataset (/train)
test: relative path from dataset (/test)
val: relative path from dataset (/val)

# Define Classes and their Labels

names:
  0: Ball
  1: Player
  2: Referee

Next we need to select a Yolov8 model weight to start our training with:

Different versions of the Yolo model with different parameters and use-cases

For our use case we'll be using the Yolov8n (Nano) which is the lightest and the fastest model, it isn't the most accurate model according to the mAP score but with enough training it can yield good results with better fps for video tracking.

from ultralytics import YOLO
import torch
import os

# Load the YOLOv8 model
model = YOLO('yolov8n.pt')

# TRAINING
if __name__ == '__main__':      
    results = model.train(data="config.yaml", epochs=50, patience=5)

As shown above we can simply load the data from the config.yaml file we set up earlier. We'll start training for 100 epochs with a patience parameter spanning 10 epochs, this means that if no improvement is seen over 10 continuous epochs the model will stop the training early.

Upscaling Network Dimensions for better results

The biggest challenge I faced during training was poor mAP score on the 'ball' class and it took me a while to realize what's going wrong. Yolov8 in general expects the input image to be in a square format and in cases of non-square images it defaults all the images to a width of 640px and corresponding height to maintain the aspect ratio unless specified as shown below.

Original Image with 1920x1080 size

Yolov8 resized image to 384x640 size to maintain aspect ratio

Using GIMP to compare size of "Ball" Class

Ball size in pixels in the Original image

Ball size in pixels in the Compressed image

The decrease in quality and size of the object image is easily visible in both the images, therefore leading to poor detection by the model. Increasing the image size while training, results in much better mAP score for not just the "Ball" class but all the other classes as well.

But that means we should always use the highest resolution images for training and inference to get the best results right? Well the answer depends, since increasing the network dimensions of a model will cause the model to use more training resources and make it slower. Therefore, we need to find a sweet spot to balance both speed and accuracy of our model.

Also, keep in mind that the network dimensions can only be a multiple of 32 according to the YOLO documentation. Therefore, after some scribbling I decided to use 1088 as the image size keeping in mind that the minimum image size of the smallest object should be greater than 15x15 pixels.

Model Performance

Condensed view of all metrics involved

Once we finish our training we can view our training/validation results using the metrics shown above, Yolov8 prepares a directory full of graphs and visualizations for each metric in detail along with the model weights, shown above is just a brief summary.

We can now use this training results directory and upload the weights back to Roboflow to deploy as a model, this can be used to assist Image Labeling or can be simply deployed online for public use.

Metrics view on Roboflow

Running Inference using our model weights

Now, instead of using our default weights we can load the best weights that we just trained and use it for tracking video clips along with the BoTSORT tracker available with Ultralytics using the script below.

import cv2
from ultralytics import YOLO

# Load the YOLOv8 model
# model = YOLO('yolov8n.pt')          ### Pre-trained weights

model = YOLO('runs/detect/train2/weights/best.pt')          ### weights from trained model

# Open the video file
video_path = r"path/to/video"
cap = cv2.VideoCapture(video_path)

# Loop through the video frames
while cap.isOpened():
    # Read a frame from the video
    success, frame = cap.read()

    if success:
        # Run YOLOv8 tracking on the frame, persisting tracks between frames
        results = model.track(frame, persist=True, show=True, tracker="botsort.yaml")

        # Visualize the results on the frame
        annotated_frame = results[0].plot()

        # Display the annotated frame
        cv2.imshow("YOLOv8 Tracking", annotated_frame)

        # Break the loop if 'q' is pressed
        if cv2.waitKey(1) & 0xFF == ord("q"):
            break
    else:
        # Break the loop if the end of the video is reached
        break

# Release the video capture object and close the display window
cap.release()
cv2.destroyAllWindows()

Adding tracking to our detection model will help in tracking objects across continuous frames in a video clip, it achieves this by assigning a unique ID to each detected object. Therefore, it can also help in mapping the trajectory of an object such as a football over time and drawing paths based on its movement across frames.

Final Results

Next up, we'll discuss how we can separate the detected players into their respective teams using HSV Filtering

An Image Annotation Guide using Roboflow for Object Detection

Tue, 21 May 2024 16:54:10 GMT

This article serves as part one of a 3-part blog series about a project I made recently while learning Computer Vision which is about developing a complete Football Analytics Model using Yolov8 + BotSORT tracking.

Objective: This blog is dedicated to finding relevant data for our project and annotating it in YOLO format using a well-known annotation tool called Roboflow.

A bit of Backstory

The impetus of starting this project comes from sitting idle at home watching football after finishing my undergrad and reading into how much influence data has had in the Sports ecosystem in recent years.
From scouting to keep track of player profiles to using a dedicated team of football analysts to make tactical reports for the managerial team, data has played a huge role in the past decade.
Around the same time I also started reading into different Computer Vision architectures and implementing them from scratch to get a better understanding about their evolution and thought process behind the changes and differences between them.
While reading about Object Detection using the YOLO architecture, I decided to put my knowledge to use and started working on this project.

Now, that we have our objective out of the way let's dig in to the Main Course.

Collecting Data

Data Sources:

DFL - Bundesliga Data Shootout from Kaggle, this data source contains clips from Bundesliga matches provided publicly by DFL. Data contains both short clips and long full match recordings. Link: https://www.kaggle.com/competitions/dfl-bundesliga-data-shootout/data
SoccerNet: SoccerNet is a large-scale dataset for soccer video understanding, it consists of a large array of tasks based on video data taken from major European leagues. SoccerNet also has its own python package with rich documentation for ease of use. Link: https://www.soccer-net.org/data
Scraping data through Youtube highlights of major leagues from their official channels by directly importing them through Roboflow or using cli tools to download them.
Using self-recorded clips of more recent matches from the Top 5 leagues for clearer quality.
Using clips from games such as Pro Evolution Soccer and FIFA to add diversity to our dataset and make our model more robust. Another advantage here is that we can select the camera angle of our liking to get better, less clustered images.

Choosing the right Annotation Tool

Roboflow, CVAT, MakeSense are some of the most popular Computer Vision Annotation Tools out there.

I chose Roboflow and quickly got on board with most of its functionality, from annotating images to Model Deployment. Its rich documentation and highly curated blogs makes it easy for newbies to understand the workflow manage such projects easily.

Creating a new project dataset and Image Annotation

Since most of our data is in the form of video clips we can simply upload all of them to our project page to create a new dataset. Roboflow provides tons of ways to upload data from local to cloud storages and even from existing applications with annotated data. On top of this it also has a colossal data library known as the "Roboflow Universe" which consists of all publicly available projects' dataset.

While uploading video clips we can also sample the video by frame rate of our choice to manage the size of the dataset. This is particularly useful while uploading longer video clips.

Easily control dataset size by changing the framerate

Another area where Roboflow outshines its peers is by having the added functionality to divide image annotation tasks into groups and easily manage them among teammates if you're working in a group. You can also outsource labeling but it is a paid feature.

Now that we have all the data that we need,

Defining Classes and Bounding Boxes

For our use case we define three classes namely:

Label 0 -> Ball
Label 1 -> Player
Label 2 -> Referee

Robowflow's bounding box tool in action

We’ll simply use Robobflow's bounding box tool to to draw rectangles around objects and label them accordingly. But this task requires a lot of manual work since each image has around 20-25 labels.

Now, let's look into how we can alleviate this workload using Roboflow's inbuilt features

Label Assist

One of the most incredible features Roboflow offers is the Label Assist, this makes annotation so much easier and gives insights into where your model might be lacking.

But to use this we need to manually annotate some of the images in our dataset. After annotating around 100–150 images manually we have two options, either use the existing annotated images to train a model locally and upload the model weights to Roboflow or use Roboflow's native state-of-the-art model to label our images using Roboflow credits.

I chose the former option and trained the small subset of annotated images using Yolov8n (Nano) which is the smallest model. The resultant model was imperfect with a mAP score of mere 57.3% but it proved to be a good starting point for annotating other images.

Once we upload these custom weights back to Roboflow we're all set to use our Label Assist feature and make the rest of our work easier.

Now we're all set to use Label Assist to annotate the rest of our images

Generate a new Version of the Dataset

While exporting our dataset we need to generate a new version of our dataset with all the Pre-requisite steps.

These steps include using a Train/Val/Test split of our choice, adding Pre-processing steps such as grayscaling or resizing all images before using them for training our model.

Another useful step is to add an augmentation step which increases the diversity of dataset by a manifold. This step can help create new training examples from a base image to either increase the size of our dataset if it is too small or add random effects to a base image in every batch governed by a probability factor.

An example on variations produced during Data augmentation

Since, this task does not require any changes in color/contrast or flipping, I decided against adding an augmentation step. The only augmentation step useful in our scenario might be random cropping but I still went with the base images.

Once we've generated our dataset we're good to go, now we can use this dataset to train our Yolov8 model.

Dataset Link: https://universe.roboflow.com/nikhil-chapre-xgndf/detect-players-dgxz0

Downloading Dataset in YOLOv8 format

Roboflow provides a multitude of formats to export your data into, since we're working with Yolov8 we can simply select it while exporting the respective version of our dataset.

Either download directly using a zip file or use terminal commands or use the Roboflow api key to run a script to download the dataset. After downloading the dataset the data is organized separately by images and labels as shown below.

+ - dataset
  |
  + - val
  + - test
  + - train
    |
    + images
    |
    + labels

We will further discuss about the YOLOv8 architecture and its own labels format in detail in the next blog where we will train our own model and run inference.

Arsenal pull off a rare scrappy win against City at the Emirates

Tue, 21 May 2024 16:53:55 GMT

Arsenal have finally broken the pattern and defeated their pesky rivals 1-0 in a dramatic fashion to go top of the league. Here's how the game unfolded:

How both teams lined up:

Both Arsenal and City lined up in a back 4 with traditional fullbacks as opposed to using inverted fullbacks and used a double pivot system during their build up phase.

Both teams almost canceled out each other by playing quite narrow and protecting the center of the pitch, making sure the pivots are not allowed easy build up through the middle.
As a result City and Arsenal both often relied on their fullbacks to provide width where more space was available.

Arsenal vs Man City on a tactical board

An interesting tweak in City's system was made in the absence of Rodri where Guardiola deployed Bernardo deep, playing as a 6 forming a double pivot with Kovacic during build up while Rico Lewis was pressing higher up the field alongside Erling Haaland when out of possession.

Rico Lewis almost playing as a Second Striker

Lackluster quality in Final third from both sides

Despite the hype for this game it might have been a tad bit boring for the fans as Arsenal could manage only 0.39 xG from 2 shots on target vs City's 0.48 xG from just one single shot on target!
A lot of this can be simply explained by the fact that both teams were missing their key players. No Rodri and KDB for City while Arsenal were missing the likes of Saka who was out injured and Martinelli who was benched and came on in the second half.
Instead of focusing on their wing play Arsenal lined up with Trossard and Jesus as narrow forwards to press high and protect the center.

David Raya's nervy first half

David Raya is looking like Arsenal’s first choice keeper this season but he almost gifted City a goal early on in the game as he succumbed against City's high press and was chased down by Julian Alvarez. Fortunately the ball hit the side netting and the Gunners could breathe a sigh of relief.

David Raya's nervy clearance

Raya looked out of place at times with his improper distribution under pressure with his searching long balls not able to find anybody. Also during set pieces he looked very uncomfortable in commanding his own box (first half) and collecting crosses which again could've cost them another goal if not for Declan Rice's goal line clearance.
Though he made amends for his shaky start and improved on all fronts in the second half by making pinpoint long passes to Jesus to clear City's high press and was a lot more bold in his decision-making inside the box.

Substitutions

Substitutions helped breathe life into a cagey game where both teams made triple substitutions to turn the game around. City brought Matheus Nunes, Jeremy Doku and John Stones who played his first Prem match this season.
Meanwhile Arsenal put Kai Havertz, Thomas Partey and Gabriel Martinelli whose availability in this game was doubtful.
It was Arsenal however who got the final say thanks to a lucky deflection from Nathan Ake from Martinelli's long range effort just 4 minutes from Full Time. Interestingly, this chance involved all 3 of Arsenal's substitutions as Havertz teed up Martinelli for the winner after Partey's long ball from deep.

Key players & Talking points from the game

Jesus recorded the most touches(76) out of any Arsenal player since most of Arsenal's attack was focused down the right flank. But playing out of his usual position he didn't look as threatening in the final third as Bukayo Saka who is out injured.
Arsenal's solid centre-back partnership between Gabriel and Saliba ensured that Haaland got no breathing space, they were robust in the aerial duels and calculated enough to not allow space for him to run in behind the backline.

Gabriel & Saliba in training

In the absence of Rodri many expected Guardiola to give Kalvin Phillips a chance of starting this game, but Guardiola instead used Bernardo as a pivot and played Rico Lewis over Phillips. Phillips' role in this squad is still unclear depsite being a crucial starter for Bielsa's squad in the past and Southgate's favorite for the current English squad.

Despite their persistent efforts Arsenal always looked to struggle against Man City in the past and came up short when it mattered the most, but this time they managed to hold their own and seal a historic victory as they defeated Man City for the first time in the Premier League since 2015!

Diving Deep into the World of Bun.js

Tue, 21 May 2024 16:53:24 GMT

The date is September 8, 2023 and Bun is fresh out of the Oven! The arrival of Bun v1.0 has shaken the whole JavaScript community and all of us are aboard the hype train.

Why such hype around Bun?

If we refer to the official docs then it says:

Bun is an all-in-one toolkit for JavaScript and TypeScript apps. It ships as a single executable called Bun

But what does being an all-in-one toolkit mean exactly and what makes it better than the existing JavaScript frameworks?

As stated by the developers:

The JavaScript ecosystem has become unnecessarily complicated, most code we write today has to pass through different plugins, bundlers, transpilers before it is even executable by Node.js

Simply put, Bun aims to reduce this complexity by providing an all-in-one solution thus improving performance manifold. From its versatile toolkit the feature that takes the spotlight is the Bun Js runtime, which comes as a drop-in replacement for Node.js.
Other than this it also includes a native Bundler, Transpiler, Package manager and even its own Test Runner!

Now let's break down all these things one at a time:

JavaScript Runtime

A runtime is simply an environment which provides all the necessary components to run a JavaScript program. It makes use of the JavaScript Engine which basically converts JavaScript code to machine code for the runtime to execute.

Bun boasts of incredible performance over Node.js thanks to its JavaScriptCore Engine developed by Apple for Safari which offers faster start times as compared to the V8 Engine used by Chrome which prioritizes faster execution time.

Transpiler

Node.js does not natively support .ts files, which means TypeScript files have to be transpiled into corresponding JavaScript code to execute using third party libraries.
Meanwhile Bun comes with an integrated transpiler that means it can natively support .ts, .js, .jsx and even .tsx files. This also results in much faster performance than Node.js

ES Modules & Common JS

Common JS is the original way of handling JavaScript code segments in Node.js which uses require() and module.exports for importing and exporting code respectively but is limited by the fact that it is synchronous.
On the other hand ES modules is the modern way of reusing JavaScript code. It uses import and export statements which also support asynchronous module handling.
Bun again stands out here as it provides compatibility to both Common JS and ES modules in the same file which is not possible in Node.js

Bundler

In large web applications, code is typically organized into multiple files and directories to improve maintainability and modularity. Bundlers help bring all these individual files together into a single or a few bundles that can be efficiently loaded by web browsers.

index.tsx

import * as ReactDOM from 'react-dom/client';
import {Component} from "./Component"

const root = ReactDOM.createRoot(document.getElementById('root'));
root.render(<Component message="Sup!" />)

component.tsx

export function Component(props: {message: string}) {
  return <p>{props.message}</p>
}

Using bun build ./index.tsx --outdir ./out where --outdir specifies the output directory for the bundled file. The output file looks something like this:

out/index.js


// Component.tsx
function Component(props) {
  return $jsxDEV("p", {
    children: props.message
  }, undefined, false, undefined, this);
}

// index.tsx
var rootNode = document.getElementById("root");
var root = $createRoot(rootNode);
root.render($jsxDEV(Component, {
  message: "Sup!"
}, undefined, false, undefined, this));

Bundlers help manage dependencies by bundling them together, resolving conflicts, and ensuring that the correct versions are included in the bundle.
Until the advent of Bun, Node.js applications relied on third-party libraries such as Parcel, Webpack, Rollup etc. to for common bundling tasks like minifying code, file conversions and code splitting.
Bun eliminates this need by bringing all these features under its integrated bundler which works for both TypeScript and JavaScript applications.

Bun Roadmap

Bun is a project with an incredibly large scope and is still in its early days. Long-term, Bun aims to provide an all-in-one toolkit to replace the complex, fragmented toolchains common today: Node.js, Jest, Webpack, esbuild, Babel, yarn, PostCSS, etc.

Ref.: https://bun.sh/docs/project/roadmap

Installation & Setup

Bun only has limited Windows support right now and can only be installed using Windows Subsytem for Linux(WSL) by enabling it. Meanwhile it is fully available for macOS and Linux systems.
For the purpose of this blog I'm running Manjaro OS on Vmware which is an Arch-based Linux distribution.
For Mac & Linux Bun can be installed using npm or curl. I already have npm installed so I'll just go ahead with npm install -g bun

Starting a project

bun init will initialize a project with some essential files, also instead of default entry point index.ts we will use index.js.

To test our runtime we can simply run bun run index.js and we get Hello via Bun! as the output.

Adding Modules/Packages

According to official docs bun install installs packages 20-100 times faster than npm install on Linux.
Either use bun install to install all existing packages from the package.json or bun add to add packages to your project.

File Imports & Exports

Even though Common JS modules are discouraged, Bun JS supports both import and require() and can be used in the same file as well, something which is not natively supported in Node.js.
Bun JS also supports custom path re-mapping, this allows to shorten paths by renaming and reusing them which is another major advantage over Node.js which does not support any path re-mapping.

Ref.: https://bun.sh/docs/runtime/modules#importing-packages https://bun.sh/guides/runtime/tsconfig-paths

tsconfig.json

{
  "compilerOptions": {
    "paths": {
      "my-custom-name": ["zod"],
      "@components/*": ["./src/components/*"]
    }
  }
}

import { z } from "my-custom-name"; // imports from "zod"
import { Button } from "@components/Button"; // imports from "./src/components/Button"

Instead of importing components from "./src/components/" everytime we can simply map a name "@components" to this path and reuse this to write neat code. Also we can use rename a path by mapping it to a custom name as shown above.

Environment Variables

Bun reads all types of .env files automatically that means there is no need for packages like dotenv to read .env files. Use bun run env to print all environment variables.
.env file variables can be accessed using process.env.VARIABLE_NAME or Bun.env.VARIABLE_NAME

BUN APIs

Bun also comes with its own set of native APIs implemented directly on the Bun object therefore, there is no need to use external packages to create a HTTP server, read/write files and even use the inbuilt sqlite database.

Bun.serve vs Node.js http module:

Bun.serve({
  fetch(req: Request) {
    return new Response("Bun!");
  },
  port: 3000,
});

require("http")
  .createServer((req, res) => res.end("Bun!"))
  .listen(8080);

According to Bun docs:

Bun.serve server can handle roughly 2.5x more requests per second than Node.js on Linux.

For File Handling Bun.file and Bun.write are the recommended ways of perform file related tasks. Though it is still a partial implementation of the node:fs module and still lacks some key functions.

const txt_file = Bun.file("foo.txt");  // read foo.txt

// Read json files

const json_file = Bun.file("notreal.json", { type: "application/json" }); //change application type to read different file types
notreal.type; // => "application/json;charset=utf-8"

// Copy content from foo.txt and save to a different file

const output = Bun.file("output.txt"); // doesn't exist yet!
await Bun.write(output, txt_file);

These functions for reading, writing files are highly optimized in fact according to Benchmarks using Bun to output file content using stdout works 2x faster than the Linux cat command!

Automatic Reloading

Bun provides two CLI commands for automatic reloading which means there is no need for third party modules like nodemon to refresh changes while development.
--watch mode hard restarts Bun's process when imported files change
--hot flag enables hot reloading where it does not restart every time a change is made instead it performs a soft reload where only new changes are updated and global state is persisted.
This is really important for HTTP connections and Websockets since using packages like nodemon or --watch mode will restart the entire process which results in loss of stateful objects while using --hot mode ensures that the code reloads with updated changes without interrupting the HTTP connections.

Wrapping up

Bun looks like a solid replacement for current Web applications built over current JavaScript frameworks, with its all-in-one functionality it is bound to take over the world of JavaScript and will re-define how modern developers will leverage its power & efficiency.

Though still in its early stages it is a bit rough around the edges, but owing to its great developer support, extensive documentation and constant updates it is improving swiftly and will soon become a staple tool in every developer's arsenal.

c0smos.dev

UoftCTF Writeup

Initial Look

Looking at the actual file

Enter: Symbolic Execution

Time to get angr-y

Final solve script

CorCTF 2025

Challenge #1: yourock

Category: rev

Author: jazz

Challenge prompt:

DECOMPILATION

Encoding

Key generation

Solution

Challenge #2: tagme

Category: rev

Author: maxster

Final solve script

Stepping down into the Ocaml Mines - UIUCTF 2025 Writeup

Challenge #1: WeirdCaml

Category: revAuthor: n8

Brief info about the challenge and Ocaml

Taking a look at type puzzle

Solution

Making variables

Parsing conditions from constructors

Building constraints for Z3

Feeding constraints to Z3

Final solution:

Something to think about: Why does challenge say flag will be printed to stderr?

Challenge #2: Nocaml

Category: miscAuthor: n8

Solution

Making our custom functions

Final solution

References

Pedri's resurgence under Luis de la Fuente

Heatmaps

The Upsides

Downsides

Luis de la Fuente’s comments on Pedri

It's the Hope that kills you

An Emotional Farewell for Reus

Dread it, Run from it, Man City arrive all the same

Discrediting Man City's Success

Taking a step back to reflect on life

Finding your own Moral Compass

Intro to Thoughts

End of an Era: Jurgen Klopp

Intro

Inception

Introducing the “Normal One”

Building from scraps

Klopp’s Footballing Philosophy & Style of Play

Style of Play: Orchestra vs The Heavy Metal

Gegenpressing & Quick transitions

Klopp’s Player Profiles

Embracing Chaos over Control

Developing World Class Fullbacks

Incredible Man Manager

Welcome to Anfield, "It’s not over yet"

Unleashing Anfield’s true power

Transfer Strategy

Building a World Class Front Three

Fan Favourite

Greatest Modern Day Rivalry

Control vs Chaos

The Grand Finale

Running out of Energy?

The quadruple dream

Falling short in the end

Final Words

References & Additional Content

How I set up my Blogsite quickly with AstroJS & Storyblok

Why Astro JS?

The tradeoff between Performance & Complexity

But if everything is HTML what about my Interactive components as they rely on Javascript?

Astro Islands

Category: rev
Author: n8

Category: misc
Author: n8