John Maguire's Blog

How to configure a Weechat ignore list toggle

Tue, 13 Feb 2024 00:00:00 GMT

I spend a bit too much time on IRC. Spend enough time and you'll run into someone you'd rather not engage with.

While Weechat offers the ability to ignore users, until recently you couldn't retroactively disable the ignore to see what was said. This can be a problem if you've ignored someone who ends up involved in a conversation you're actually interested in.

Helpfully, Weechat 4.2.0 added a new option irc.look.ignore_tag_messages which allows you to tag messages from ignored users instead of removing them. You can then add a manual filter for the tagged messages, which can be enabled or disabled dynamically.

To enable the feature, you can run the following in Weechat:

/set irc.look.ignore_tag_messages on
/filter add ignored * irc_ignored *

Then manage your ignores as usual (e.g. /ignore add <nick>) and messages from those users will be hidden. The following commands will toggle visibility of ignored users' messages:

/filter disable ignored
/filter enable ignored

Or, for quicker access, bind toggle to a key (hint: run /key bind meta-i first to make sure it's not already bound):

/key bind meta-i /filter toggle ignored

Happy idling!

Camera App Connection Issues and VPNs on Android Phones

Thu, 09 Jan 2025 00:00:00 GMT

TL;DR: When connected to a VPN app, such as Nebula, Wireguard, or Tailscale, camera apps used to download photos may be unable to access the camera's network. Some VPN apps may offer the ability to exclude these apps from the VPN connection—otherwise, you must temporarily disconnect from the VPN when using the camera app.

As a software engineer working on mesh overlay networks (a type of VPN product) I typically have a VPN process running on my Android phone (usually a Pixel.) I'm also a hobbyist photographer, and have owned cameras from a variety of manufacturers, including Sony, Fujifilm, Ricoh, and GoPro.

A constant over the years, regardless of which ecosystem I'm a part of, is user complaints around the app which downloads photos from the camera to a phone. The specifics vary: usually poor UX, performance issues, or finicky file transfers. I personally found the Ricoh app to be so unreliable that I finally broke down and wrote my own Android app. But I have noticed one issue that is constant among camera brands and seems to be a bug inherent to Android itself.

When a VPN is active, Android apps—even those configured only to route IP addresses outside of the WiFi network range—are unable to access the local network (i.e. the camera's WiFi network.)

I've seen some argue that this is the correct behavior, noting that a VPN should sit between your phone and the rest of the Internet, for privacy's sake. However, a local area network is not the Internet, and VPNs are used for purposes outside privacy-focused "exit nodes"—after all, they are just Virtual Private Networks. When a VPN registers a route for 100.64.0.0/10, it shouldn't affect traffic flowing to the 192.168.0.0/16 subnet.

This bug even affects Google applications which use the WiFi IoT APIs, such as Stadia, RCS, and Android Auto (see for example this Tailscale pull request to fix the aforementioned services). While VPN apps can resolve this issue on a per-app basis by excluding the app from the network, camera manufacturers can't work around the issue in their own app. While some VPNs such as Tailscale and Wireguard allow you to configure apps to exclude in their settings, others do not—and in this case the only known workaround is to temporarily disable the VPN.

For further reading, here are some examples of this issue on Reddit. I have a foggy memory of an Android issue tracker bug on the matter as well, but I can no longer find it.

How to clean dust from a Ricoh GR III / IIIx sensor or lens

Tue, 21 Mar 2023 00:00:00 GMT

I absolutely adore my Ricoh GR camera. It's small enough to fit in my pants pocket, so it goes everywhere with me. And, as the saying goes, the best camera is the one you have with you.

Unfortunately these cameras tend to be susceptible to dust which can cause artifacts in your images, especially when using narrow apertures (e.g. f/8-f/16.)

Some owners of this camera try to avoid dust entering the camera through the use of lens caps, protective cases, and other accessories, but this makes it difficult to carry the camera in your pocket. Even with careful use of the camera, dust has a habit of sneaking in. Thankfully, it's neither difficult nor time consuming to remove the dust with the right tools!

Disclaimer

If your camera is under warranty, following this guide may void it. Cameras contain sensitive electronics which can easily be damaged. It is possible to cause irreparable damage to your camera by attempting this repair.

By following this guide you acknowledge that I am in no way responsible for any damage that occurs to your camera. If you are not confident in your repair skills please consider finding a qualified technician to remove the dust for you.

That being said there's nothing inherently difficult about this process. Pay attention, take photos to remind yourself how everything fits together, and your camera will be dust-free before you know it.

Prerequisites

This process can be completed in approximately 15 minutes once you know how it's done. Expect your first repair to take about an hour.

You'll need the following tools:

PH00 screwdriver
Rocket blower
A small flathead screwdriver
A safe spot to store your screws
Optional - APS-C sensor cleaning kit

You will be removing screws of different lengths, so it's a good idea to lay them out in such a way that you'll remember where they came from. Be sure to use the correct bit (PH00) to avoid stripping screws.

A sensor cleaning kit is usually unnecessary because, unlike an interchangeable lens camera, the sensor is never directly exposed to the elements. However, if your sensor is severely dirty a cleaning kit may help to remove stubborn deposits. In my experience a rocket blower is all you need.

Test Photo

Before you begin, take a photo of a white wall or piece of paper at f/16 with macro mode on. This will make all the dust on the sensor visible, and will help you determine you've removed all the dust.

Disassembly

Throughout this guide I will refer to the sides of the camera as if you are holding it in your hands with the LCD screen on the back of the camera visible. Therefore, the movie button is on the left side of the camera, the USB port is on the right side of the camera, the lens is at the front of the camera, the shutter button is on the top of the camera, and so on.

Step 1: Remove any accessories from the camera.

Begin by removing any wrist or neck strap, battery, SD card, and hotshoe cover on the camera.

Step 2: Removing chassis screws

Starting with the left side of the camera, remove the screw located at the bottom right corner (closer to the LCD screen.)

Facing the LCD screen, there is a recessed screw in the upper left corner, next to the "RICOH" text. Remove it.

There are two screws to remove from the right side of the camera. The first is located center-top, just left of the wrist strap loop. The second is hidden behind a piece of rubber just below and slightly to the left of the first screw. Peel back the rubber piece which straddles the play/review button starting from the top right corner to reveal it. (It won't lose its stickiness.)

Orient the bottom of the camera so that the writing on the labels is right-side up and remove the two upper screws.

Looking at the top of the camera, remove the screw under the hotshoe. Use a small flathead screwdriver or a spudger tool to pop out the clip from the hotshoe (see image below.) Finally, remove the four screws holding the hotshoe and mount in place, and lift out the hotshoe mount.

Step 3: Opening the chassis

You should now be able to pop the top plate up and off of the camera. Be careful of the hotshoe ribbon cable when doing so.

Open the USB charging port flap and, working from the left side of the camera first, gently pry the back case of the camera away from the rest of the chassis. Be careful, as there is a ribbon cable connecting the two pieces (see image below.)

While it is possible to finish this procedure without disconnecting the ribbon cable as I have done in the following images, you may find it safer and easier to disconnect the cable now. Gently pry the ribbon cable connector on the main chassis from the edges to loosen it and then pull straight up to disconnect it.

Step 4: Reveal the sensor

Remove the three silver screws holding the sensor mount to the camera body, and flip it over to reveal the sensor. Note the three springs used on each screw - do not lose them!

Now that the sensor is exposed, be very careful not to scratch or damage it in any way!

Cleaning

Warning: Do not use any cleaning products which are not made specifically for cleaning camera sensors! Do not touch the sensor with anything other than a sensor cleaning swab appropriately sized for an APS-C sensor.

Warning: Do not substitute a can of compressed air for a rocket blower! Canned air is propelled at high pressure by a liquefied gas which can spray onto the sensor as a freezing liquid residue.

With the sensor exposed, use your rocket blower to blast the sensor and lens clean. If you opted to use an APS-C sensor cleaning kit, follow the included instructions.

You can see in the above image that there is a large speck of dust on the sensor near the top right corner. I find the dust is usually on the sensor rather than the lens itself. A few blasts from the rocket blower was enough to remove it and some other smaller pieces of dust.

Reassembly

Carefully re-seat the sensor, ensuring that all three springs are still in place, and reinstall the three silver screws, being mindful of any ribbon cables. Reconnect the display ribbon cable if you disconnected it earlier.

Pull the hotshoe cable through the top plate and seat the hotshoe.

Replace the hotshoe mount and install the four under-hotshoe screws you removed earlier (the longer two screws are installed on the front, or lens side, of the camera) plus the fifth screw that sits under the hotshoe. Push the hotshoe clip back into place.

Reinstall the two longer screws on the bottom front of the camera.

Hint: Now is a good time to retake your test photo to ensure all the dust is gone! If the test photo doesn't show any dust, continue on...

The shortest screw, with the wider head, goes behind the rubber cover near the play/review button. Of the three remaining screws, the medium-length one is installed just above it.

The long screw goes into the recessed hole near the text "RICOH" on the back of the camera.

The final short screw should be reinstalled on the left side of the camera.

With all the screws back in place, make sure that the battery door swings open on its own when the toggle is switched to "OPEN". The battery door spring can be maneuvered into the correct position using a small flathead screwdriver or a pick.

Congrats, you're all done! Enjoy your Ricoh GR!

Acknowledgements

I learned how to perform this repair by watching this video by DIGI SERVICE on YouTube. However, the video includes some unnecessary steps, and I personally prefer text/photo tutorials to video tutorials, so I wrote one. I hope it helps!

P.S. If you have a Ricoh GR II, the process is very similar. Jamie Collinson's guide is a great resource.

Thanks for stopping by! While you're here, I'd like to mention <a href="https://play.google.com/store/apps/details?id=me.johnmaguire.eureka" data-umami-event="play-store-click">Eureka</a>, an Android app I built to download photos from your Ricoh GR camera after struggling with Ricoh's official Image Sync app. If that sounds like it could be useful, please give it a try.

Configuring Let's Encrypt for nginx with Automatic Renewal

Sat, 05 Dec 2015 00:00:00 GMT

This post was originally published in December 2015. Let's Encrypt and certbot have matured significantly since then — modern setups handle renewal automatically. This is preserved for historical interest.

Let's Encrypt is a new Certificate Authority that offers free certificates and automatic renewal through a new standard known as ACME (Automated Certificate Management Environment.)

It recently entered public beta, but nginx support is somewhat lacking. However, it's really not that difficult to get started.

Note that these instructions are for Debian, but can probably be easily modified to suit your favorite distro.

First, you'll need to install Let's Encrypt. I downloaded the v0.1.0 release from Github and ran python setup.py install, but you can use whatever method you prefer.

Next, let's create a couple helper scripts. The first one will help us to generate new certificates, while we can use the second one to renew our certificates. This will come in handy when we setup a cron job later. I saved these two scripts in /usr/local/bin as letsencrypt_gen and letsencrypt_renew.

#!/usr/bin/env bash
if [[ -z "$DOMAINS" ]]; then
  echo "Please set DOMAINS environment variable (e.g. \"-d example.com -d www.example.com\")"
  exit 1
fi

if [[ -z "$DIR" ]]; then
  export DIR=/tmp/letsencrypt-auto
fi

mkdir -p $DIR && letsencrypt certonly \
  --server https://acme-v01.api.letsencrypt.org/directory \
  --webroot \
  --webroot-path=$DIR \
  $DOMAINS
service nginx reload

The second script is almost identical to the first but passes a --renew flag.

#!/usr/bin/env bash
if [[ -z "$DOMAINS" ]]; then
  echo "Please set DOMAINS environment variable (e.g. \"-d example.com -d www.example.com\")"
  exit 1
fi

if [[ -z "$DIR" ]]; then
  export DIR=/tmp/letsencrypt-auto
fi

mkdir -p $DIR && letsencrypt --renew certonly \
  --server https://acme-v01.api.letsencrypt.org/directory \
  --webroot \
  --webroot-path=$DIR \
  $DOMAINS
service nginx reload

However, before we can use these scripts we need to add a location block in our nginx config. This will allow Let's Encrypt to verify that we own the domains we're trying to generate certificates for.

server {
    # ...

    location /.well-known/acme-challenge {
        default_type "text/plain";
        root /tmp/letsencrypt-auto;
    }

    # ...
}

The scripts we created earlier will automatically generate the files necessary to validate our identity in /tmp/letsencrypt-auto, and so the rest is taken care of for us. The only thing we need to do is reload the nginx configuration so the changes take effect. On Debian, run service nginx reload.

Now it's time to generate our SSL certificate! We can call the script we saved earlier like so: DOMAINS="-d johnmaguire.me -d www.johnmaguire.me" letsencrypt_gen.

I also created a DH parameter file inside my /etc/nginx directory using OpenSSL: openssl dhparam -out dhparams.pem 2048

At this point, we just need to configure an SSL-enabled server block. Mine looks like this, but you can customize it to your needs:

server {
    listen 443 ssl;
    server_name johnmaguire.me www.johnmaguire.me;

    # certificates from letsencrypt
    ssl_certificate /etc/letsencrypt/live/johnmaguire.me/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/johnmaguire.me/privkey.pem;
    ssl_session_timeout 1d;
    ssl_session_cache shared:SSL:50m;
    ssl_session_tickets off;

    # Diffie-Hellman parameter for DHE ciphersuites
    ssl_dhparam /etc/nginx/dhparam.pem;

    # modern configuration
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK';
    ssl_prefer_server_ciphers on;

    # HSTS (ngx_http_headers required) - 6 months
    # add_header Strict-Transport-Security max-age=15768000;

    # OCSP stapling
    ssl_stapling on;
    ssl_stapling_verify on;

    # verify chain of trust of OCSP response
    ssl_trusted_certificate /etc/letsencrypt/live/johnmaguire.me/chain.pem;

    # ...
}

Mozilla has an excellent SSL configuration generator. You can verify that SSL is working properly using this tool from Qualys.

Once everything is setup correctly, we can create a cron job to automatically renew our certificate. Run crontab -e and add the following:

0 2 1 * * DOMAINS="-d johnmaguire.me -d www.johnmaguire.me" /usr/local/bin/letsencrypt_renew >> /var/log/le-renewal.log 2>&1

This will set cron up to renew your domain every month, on the first, at 2am. The process will be appended to a log file at /var/log/le-renewal.log.

You can also test out certificate renewal by running the above command manually, and viewing the certificate as reported by your browser. It will only be valid beginning at the time you created the certificate.

Finally, if you'd like to send users who access your site via HTTP over to your HTTPS endpoint, you can create a catch-all location block in nginx like so:

server {
    listen 80;
    server_name johnmaguire.me www.johnmaguire.me;

    # ...

    location / {
        return 301 https://$server_name$request_uri;
    }
}

If everything is working correctly, consider uncommenting the HSTS line in the above configuration. It will allow your users' browsers to remember that they've connected with SSL before, and refuse to use non-SSL connections. Please understand that this is a fairly permanent choice.

If you do decide to use HSTS, you can also add your website to browser vendors' HSTS preload list, which will let the browser know your site has SSL before a user even hits it. Use extreme caution with this tool. Please read the entire page and make sure you understand what it means before submitting your domain.

Eureka: Alternative Android app for Ricoh GR cameras

Thu, 12 Oct 2023 00:00:00 GMT

For years, I've suffered with the "Image Sync" app that Ricoh offers for its GR line of cameras: I find that if it will connect at all, it's often too slow to be usable.

On iOS, users have had a few alternatives to choose from (e.g. GRImageViewer, GR Linker, and GR Remote Viewer to name a few) while on Android, we're stuck with the official app — that is, until now.

I spent a few free afternoons getting up to speed with Android development in order to create a simple app capable of showing thumbnails of your JPEGs & RAWs, downloading them with a tap. Ricoh GR II, GR III, and GR IIIx cameras are supported.

If you've had trouble with Image Sync, it may be worth a try. Check out <a href="https://play.google.com/store/apps/details?id=me.johnmaguire.eureka" data-umami-event="play-store-click">Eureka on the Play Store</a>.

Firefox Starter Pack: Recommended Add-ons

Wed, 07 Feb 2024 00:00:00 GMT

I'm a big fan of the Firefox browser and have been using it as my daily driver for a few years now. Over time, I've honed my workflow with some useful add-ons and features. I thought I'd share them in case they're useful to you too!

Must Have

I install these add-ons on every Firefox profile I use.

uBlock Origin

uBlock Origin is hands down my favorite ad blocker. It's fast and lightweight, and just works.

Protip: After installing uBlock Origin, enable one of the "Annoyances" lists (I recommend the one from EasyList.) This will remove all kinds of annoying content, such as popups for mailing lists and GDPR cookie notices.

SponsorBlock

While ad blockers are a must, I also recommend SponsorBlock. Using community-sourced data, it skips over sponsored content in YouTube videos. You can also configure it for other categories, such as skipping intros and outros, or non-music sections of music videos.

1Password

If you don't already use a password manager, you need to start. 1Password is my favorite and works well on all platforms. It's not free, but worth it to me. If you're looking for a free alternative, I've heard good things about Bitwarden.

Bypass Paywalls Clean

Unlisted on Monzilla's add-on store and Github due to DMCA Takedown Notices, you can still find a download link (on a site called GitFlic) on this Github repository. Even though it's not listed on by Mozilla, it is still checked and signed by Mozilla.

It won't get past every paywall, but it's a great start. For the rest, archive.ph or archive.is tends to work.

Pushbullet

Pushbullet seems like it's on life support, but it's still the easiest way I know of to quickly send a link to my Android phone from Firefox.

Simple Translate {#simple-translate-}

Firefox added a website translation feature in Firefox 118, released in 2023. However, it only appears when Firefox detects a supported language other than your system language. At times, it is useful to manually translate a page. This add-on adds a "Translate this page" option to the page context menu.

Extra Customization

These aren't always useful, and are more for power users. I usually won't install them unless I have a specific reason to.

Violentmonkey

Back in the day, Greasemonkey was the go-to for customizing websites with user scripts. However, Violentmonkey seems to be more actively maintained. Another alternative is Tampermonkey, but it's closed source.

You can find premade user scripts on Greasy Fork.

Stylus

Stylus is similar to Violentmonkey, but for customizing websites with user styles. Stylish used to be used for this but after they added invasive tracking most users switched to Stylus.

You can find some premade user styles here.

Dark Reader

Dark Reader is simpler than Stylus - instead of installing user scripts, it automatically darkens websites. It's great for night time browsing.

Tree Style Tab

I no longer use Tree Style Tab, but it's a neat way to organize tabs that you might prefer. Give it a try and see what you think!

Other Suggestions

Even more specific, these add-ons are useful for certain workflows.

Enhancer for YouTube

Extra control over playback quality, speed, autoplay, and more. If you use YouTube often, it's worth a look.

DeArrow

Created by the same author of SponsorBlock, Ajay Ramachandran, DeArrow removes annoying clickbait titles and thumbnails from YouTube.

ClearURLs

Removes tracking elements from URLs. I much prefer sending links to others with tracking parameters removed, and this add-on takes care of it automatically.

Refined Github

Refined Github greatly enhances my Github workflow. Since I use Github every day at work, it's a must-have for me.

Old Reddit Redirect

I prefer the old Reddit design (yes, still!) and this add-on automatically redirects me to it whenever I click on a Reddit link.

linkding extension

Instead of paying for Pinboard, I self-host linkding. This extension makes it easy to save links.

linkding injector

Adds relevant linkding bookmarks to search results. In all honesty, I'm not so sure this has provided me much value yet. Still, it's cool when my bookmarks show up on the Google results page.

Useful built-in features

These are not add-ons, but they are super handy!

Reader View

Reader View is a built-in feature that removes all the clutter from around articles and blog posts. It's great for long-form content, poorly designed pages, and night time reading.

Also, sometimes it can be used to get around a paywall. If you're hit with a paywall, try clicking the Reader View icon. If that still doesn't work, try refreshing the page. If all else fails, try the Bypass Paywalls Clean add-on.

HTTPS-Only Mode

In the past, it was necessary to install the HTTPS Everywhere add-on created by the EFF. Nowadays, this functionality is baked in. I highly recommend enabling it as most websites today support HTTPS!

Conclusion

Well, I hope you found something useful! Is there a glaring omission? Let me know! My email is contact@ojohnmaguire.me.

Changelog

Mar 1, 2024 - Removed Nitter Redirect as it no longer works.

IPv6 is not insecure because it lacks a NAT

Tue, 20 Jan 2026 00:00:00 GMT

I recently saw a discussion where someone argued that IPv4 is more secure than IPv6 because "the NAT-by-default of IPv4 effectively means that I get the benefit of a default-deny security strategy." This is a common misconception that I think is worth addressing.

The fundamental issue here is conflating NAT (Network Address Translation) with security. NAT isn't actually a security feature—it's an address conservation mechanism that became necessary because we ran out of IPv4 addresses. (Although it is totally possible to use a NAT with IPv6 too!)

NAT allows multiple devices on a home network to share a single IP address on the public Internet by rewriting the destination IP of a packet based on its destination port. It chooses a new destination IP based on the "port mappings" or "port forwards" configured by the network admin.

The consequence of this is that when receiving inbound traffic to a NAT'd IP, packets with an unexpected destination port (one which has not been forwarded) will keep the destination IP of the public machine and will not be routed to another machine on the network.

But the security benefits people attribute to NAT actually come from the stateful firewall that's typically bundled with NAT routers. Modern routers ship with firewall policies that deny inbound traffic by default, even when a NAT is not being used. The firewall will drop packets with an unexpected destination before even considering whether to rewrite or route the packets. For example, UniFi routers ship with these default IPv6 firewall rules:

Allow Established/Related Traffic (outbound return traffic)
Block Invalid Traffic
Block All Other Traffic

Therefore, in order to allow unsolicited inbound traffic to any IPv6 device hosted behind the router, you must explicitly add a firewall rule to allow the traffic, whether using a NAT or not.

Discussion on Hacker News

How to uncrop Ricoh GR III, IIIx, and IV photos

Tue, 25 Feb 2025 00:00:00 GMT

If you own a Ricoh GR camera then you may know about crop mode—a mode which allows you to treat the built-in lens a bit as though you had three lenses of different focal lengths by cropping the sensor's image in to one of two predefined fields of view.

This can be a big help when framing a shot you plan to crop anyway, but occasionally I've found myself wishing I could recover a wider field of view than the crop mode captured. This is possible!

The GR always records data from across the entire sensor—even when crop mode is enabled. The crop is simply embedded as a property of the image's EXIF data. So, you can use the following exiftool commands at the terminal to recover the edges:

exiftool -DefaultCropOrigin="5 6" R0004690.DNG
exiftool -DefaultCropSize="6000 4000" R0004690.DNG

Actually, the cameras record a little more information than is visible even in the native crop. You can access these pixels via the following:

exiftool -DefaultCropOrigin="0 0" R0004690.DNG
exiftool -DefaultCropSize="6010 4012" R0004690.DNG

Of course, running terminal commands can be a bit tedious. If you are a Lightroom user, you are in luck! Long ago, Adobe created a plug-in called DNG Recover Edges that does the exact same thing. Unfortunately, they no longer offer it on their website, but it still works perfectly. Thanks to the fine folks at the Internet Archive, you can still download it via the Wayback Machine.

The download page is here but the download button does not work when clicked directly. Instead, right click "Get file", select "Copy link" and paste it into your URL bar--or just click here for a direct download.

Then, open Lightroom and navigate to File > Plug-in Manager..., click the Add button, find the plugin in your Downloads folder and open it.

With the plugin added, navigate to a DNG from your Ricoh GR camera taken in crop mode and click File > Plug-in Extras > DNG Recover Edges > Apply.

At this point, on macOS, you will probably see the following security message:

To resolve it, open System Settings, find the Security tab, and then scroll down to the bottom until you see the following message, and click "Allow Anyway."

Apply the plugin again. macOS will give another warning but this time you will be able to tell macOS to run the plugin anyway.

When run, the plugin will create a new file with the suffix "_full.dng". The new file will initially show the same crop as the original, but now when you set the crop in Lightroom to "As Shot," the full 6010 x 4012 resolution will be shown.

P.S. If you're an Android user struggling to download images from your Ricoh GR using the official Image Sync app, consider trying <a href="https://play.google.com/store/apps/details?id=me.johnmaguire.eureka" data-umami-event="play-store-click">Eureka</a>, an app I built to deal with connection issues I experienced with the original app.