One host. blue and green are two guests on the same machine. This survives a bad deploy, not a bad machine.

The witness cannot detect deletion. Its manifest is regenerated from the same source it validates, so removing the witness file just selects the next one. That case belongs to the content-sanity check, which compares against history rather than against itself.

A checker’s first failure is usually itself. The witness probe’s first run reported 14 of 21 names broken. The server was fine; the probe built its URL without the port, so it never reached the guest under test and hit whatever serves those names publicly instead. Worth remembering before trusting a new assertion’s first alarm.

The itys.net unikernel

2026-09-10T00:00:00+00:00

itys.net is not served by a web server on a machine. It is served by a Go program that is the operating system, running as a KVM guest with the entire site compiled into its disk image. Thirty-three sites share it.

Guest OS</dt>
Nanos 0.1.55</dd></div>
Built by</dt>
Ops 0.1.46</dd></div>
Payload</dt>
Go 1.22.2</dd></div>
Resources</dt>
4 vCPU · 2 GB</dd></div>
Image</dt>
141 MB</dd></div>
Sites</dt>
33</dd></div> </dl>
What a unikernel is doing here</h2>
An ordinary static host runs Linux, then nginx, then reads files from a filesystem. This one collapses those layers. The Go program in /opt/unik-sites/site/server.go</code> — 723 lines — is linked against Nanos, a kernel that supports exactly one process and has no shell, no package manager, no users, and no way to log in. Ops builds that pairing into a bootable image; qemu runs it under KVM.
The attack surface is the argument. There is nothing on the guest to escalate to. A flaw in the request path yields control of a process that already has no neighbours, no persistence, and no writable content — the image is rebuilt from scratch on every start.
How a request arrives</h2> The allowlist check happens before any content lookup. That ordering is deliberate: an attacker sending unknown Host</code> headers cannot force cache entries and evict the warm set, because their request is refused before it can allocate anything. The one decision everything follows from</h2> Content and certificates are baked into the image at build time by MapDirs</code> in config.json</code>. There are no 9p mounts. Nothing is read from the host while the guest runs. Why not mount the directories instead?</h3> Because it crashes. The service unit records the finding plainly: on Nanos 0.1.55, a 9p --mount</code> combined with a baked image page-faults the guest on boot. Baking sidesteps that, and has a second benefit — it keeps the request path off 9p entirely, which was the original performance problem. Verified, not assumed Writing a file directly into /var/www/itys.net/dist</code> on the host and waiting 70 seconds — past both the content-cache and allowlist rescan intervals — does not make it appear. The guest serves its baked copy until the image is rebuilt. </aside> Serving from RAM</h2> The server reads each path from its filesystem once, on first request, then answers from memory forever. Concurrent misses for the same path collapse into a single read. Compression happens at that moment, not per request: the gzip variant is stored beside the raw bytes and the hot path just picks one by Accept-Encoding</code>. Responses carry a content-hash ETag, so warm clients get 304s. Setting</th> Value</th> What it governs</th></tr></thead> MAX_CACHE_BYTES</code></td> 512 MB</td> LRU eviction ceiling — a flood of cold keys cannot evict the warm set</td></tr> MAX_CACHE_ENTRIES</code></td> 16,384</td> Entry count ceiling</td></tr> MAX_FILE_BYTES</code></td> 32 MB</td> Largest single cacheable file</td></tr> GZIP_MIN_BYTES</code></td> 1,024</td> Below this, compressing costs more than it saves</td></tr> CONTENT_TTL_SECONDS</code></td> 0</td> No periodic flush — baked content cannot change under a running guest</td></tr> </tbody></table> The elaborate caching exists because Nanos’ 9p client serialises round-trips: per-request stat</code> and open</code> against a mounted filesystem pegged the CPU under concurrent HTTPS. That was the wedge that motivated the design. Under the current baked configuration there is no 9p on the request path at all — so the cache is now belt-and-braces rather than load-bearing. Worth knowing before anyone “simplifies” it: the machinery becomes essential again the moment someone reintroduces a mount. Operating it</h2> Publishing</h3> Get files into /var/www/<site>/dist</code>, then restart. For itys.net that is automated — an hourly timer pulls a tarball from Backblaze B2, verifies its checksum against a published manifest, swaps the tree by rename, and restarts the unit only when the content actually changed. systemctl restart unik-sites.service </code></pre> Certificates</h3> The guest re-reads /certs</code> every 30 seconds and skips unchanged files — but /certs</code> is baked, so a renewal on the host is invisible until a rebuild. A certbot deploy hook, sync-unik-certs.sh</code>, restarts the unit for exactly this reason. That restart also re-bakes whatever is currently in /var/www</code>, which is worth remembering if a half-finished change is sitting there. Hardening, and three deliberate omissions</h3> The unit is tightly confined — ProtectSystem=strict</code>, DevicePolicy=closed</code> with only /dev/kvm</code> and /dev/net/tun</code> allowed, NoNewPrivileges</code>, RestrictNamespaces</code>, LockPersonality</code>. Three obvious directives are left off on purpose, each documented in the unit: PrivateDevices</code> would hide /dev/kvm</code>, so the guest could not boot at all.</li> ProtectHome</code> would empty /root</code>, where the Ops image cache lives.</li> MemoryDenyWriteExecute</code> breaks qemu, which maps writable-executable memory.</li> </ul> Sharp edges</h2> Blast radius One image holds all 33 sites, so a restart takes them all down together. It is only about two seconds, but it is not scoped to the site being published. </aside> Soft 404s Path resolution follows try_files semantics ending in /index.html</code>, so a missing URL returns the site’s home page with HTTP 200 rather than a 404. Crawlers and readers are both told the page is fine. A site’s own 404.html</code> is unreachable. Changing this means editing the shared binary, which every site depends on. </aside> Image growth Every site’s bytes are in the image, so one site’s weight is everyone’s boot cost. Adding 38 MB of slide decks to itys.net took the image from 102 MB to 141 MB — a 38% increase to publish one site’s archive. </aside> Compiled from the running configuration on mia-01 — the systemd unit, config.json</code>, the header commentary in server.go</code>, and a live test of whether host writes reach the guest. Verified 10 September 2026. TX: TAR eXtender for resilient archives 2025-11-29T00:00:00+00:00 TX (TAR eXtender) is a tiny, dependency-light utility for building, moving, and verifying tar archives at internet scale. It sits between classic tar</code> and modern backup systems, adding manifests, chunking, and integrity checks without pulling in a full database or heavyweight agent. If you want reproducible tarballs that can be resumed mid-transfer, diffed across sites, and verified long after they leave your machine, TX is the glue. You can grab the latest build at tx.itys.net</a>. 🔺</a> Why another archive helper?</h2> Plain tar</code> lacks durable manifests and integrity metadata.</li> Whole-archive retries are painful when a 40 GB upload drops at 98%.</li> Long-haul transfers (home lab -> cloud, colo -> cold storage) need easy resume and post-copy verification.</li> We wanted something you could curl</code> and run without Rust/Cargo already present.</li> </ul> 🔺</a> What TX adds</h2> Chunked output: splits archives into fixed-size parts (e.g., 256 MiB) so you can resume uploads and retry only the missing pieces.</li> Signed manifest header: writes the JSON manifest (hashes, sizes, tree metadata) into the first bytes of the archive (Track 1) ahead of the tar stream, so you do not lose it as a sidecar.</li> Streaming-friendly: reads from stdin, writes to stdout by default; no temp staging required.</li> Integrity-first: tx verify</code> replays hashes and sizes; tx repair</code> can refetch only the corrupted chunk.</li> Boring dependencies: static build, no runtime services or databases.</li> </ul> 🔺</a> Quick start</h2> Create a chunked archive with an embedded manifest: tx pack \ --input ./data \ --output ./exports/site.tx.tar \ --chunksize 256MiB </code></pre> Verify the archive later (either side of a transfer): tx verify \ --input ./exports/site.tx.tar </code></pre> Extract after verification: tx unpack --input ./exports/site.tx.tar --output ./restore </code></pre> 🔺</a> Recipes</h2> Remote pushes: pipe into ssh</code> to avoid local disk writes. tx pack --input ./data --chunksize 128MiB \ | ssh user@remote "cat > /srv/archive.tx.tar" </code></pre> </li> Object storage: upload chunks in parallel; the embedded manifest rides in Track 1, so you do not have to chase a separate file for audits. </li> Cold storage audits: schedule tx verify</code> against a mounted bucket to catch bit-rot without restoring the data. </li> </ul> 🔺</a> How it works</h2> Reads the file tree, writes tar entries in a stable, sorted order.</li> Emits fixed-size chunks and SHA-256 per chunk plus whole-archive digests.</li> Records metadata in manifest_version</code>, chunks</code>, tree</code>, and digests</code> keys inside the JSON prelude at the start of the file (Track 1).</li> Keeps the tar stream portable: the payload after Track 1 is a standard tar stream; TX reads the manifest first, then hands off extraction.</li> </ul> 🔺</a> Operational notes</h2> TX prefers deterministic inputs: run with a consistent --mtime</code> when you want byte-identical outputs across builders. </li> For huge trees, set --chunksize</code> to your network’s sweet spot; 64–256 MiB works well for S3-compatible uploads. </li> Memory footprint stays near the chunk size; TX streams rather than buffering entire archives. </li> Builds are published at tx.itys.net</a> with SHA-256 sums in sha256.txt</code>. Verify the binary before first use: curl -O https://tx.itys.net/tx-linux-amd64 curl -O https://tx.itys.net/sha256.txt grep tx-linux-amd64 sha256.txt | sha256sum --check chmod +x tx-linux-amd64 sudo mv tx-linux-amd64 /usr/local/bin/tx </code></pre> </li> </ul> 🔺</a> Roadmap</h2> Optional Blake3 digests for faster verification on low-power hardware.</li> Built-in push</code> helper with retry/backoff for S3 and rsync targets.</li> TUF-style signed release metadata to harden binary distribution.</li> </ul> TX keeps tar simple while adding the reliability knobs long-haul transfers deserve. If you kick the tires, feedback is welcome—open an issue or drop a note via tx.itys.net</a>.*** 🌀 Spiral Burst 128 2025-11-23T00:00:00+00:00 🔺</a> SB128 - Spiral Burst 128</h1> SB128 is a deterministic “data-bearing snowflake” that pairs a central Data Matrix with six spiral arms. Each arm carries 64 bands; a simple burst mark encodes a bit (bright disk + tiny diamonds) and a faint dot marks zero, so the arms stay visible even in monochrome. A 128‑bit SF128 identifier is encoded three times (repetition code), plus a CRC16 in the Data Matrix for cross‑checks. 🔺</a> What’s inside</h2> Payload: user string.</li> SF128: first 16 bytes of SHA‑256(payload).</li> CRC16: CRC‑16/CCITT of the SF128 bytes.</li> Data Matrix (center): payload, SF128 (hex), CRC16 (hex), using the smallest fitting ECC200 symbol.</li> Arms: 6 arms × 64 bands = 384 bits, carrying 3×SF128 (majority vote per bit).</li> </ul> 🔺</a> Encoding geometry</h2> Image: 1152×1152 px, radial gradient background.</li> Arms: Archimedean spirals, inner radius 0.25 (norm to corner), outer 0.70, mild twist.</li> Band mark (bit=1): bright disk with dark outline and four micro‑diamonds along ±tangent/±perp.</li> Band mark (bit=0): faint dot only.</li> No randomness; positions are fixed per (arm, band).</li> </ul> 🔺</a> Decoding approach</h2> Recompute (arm, band) positions from image size and shared constants.</li> Sample a small luma patch at each band center to get an energy value.</li> Otsu split → threshold = μ0 + 0.55·(μ1–μ0); classify energies to bits.</li> Majority vote each bit across the 3 repetitions → SF128; compute CRC16.</li> Optionally decode the central Data Matrix and cross‑check SF128/CRC16.</li> Optional --search</code> tries small rotate/scale/translate transforms if needed.</li> </ol> 🔺</a> CLI usage</h2> Encode: python encode_snowflake.py "Your payload"</code> (add --verify</code> to arm‑decode after render).</li> Decode: python decode_snowflake.py snowflake.png --search</code> (or without --search</code> for speed).</li> Robustness smoke (blur/rot/scale/noise, optional search): python robustness_test.py</code>.</li> </ul> 🔺</a> Constraints & robustness</h2> Works in grayscale/black‑and‑white; outlines and burst contrast survive binarization.</li> Repetition code tolerates isolated bit errors; CRC16 covers SF128.</li> Keep central DMX mostly unobstructed; extreme occlusion of multiple arms will break recovery.</li> </ul> 🔺</a> Example</h2> A walk‑through and sample render are available here: /posts/sb128/ 🔺</a> Files</h2> encode_snowflake.py</code> — SB128 encoder (PNG output).</li> decode_snowflake.py</code> — SB128 decoder (arms, optional DMX cross‑check).</li> robustness_test.py</code> — quick perturbation tests.***</li> </ul> Moderate friction gates 2025-11-17T00:00:00+00:00 🔺</a> Building Delphi’s PoH / PoW Gateway for SearXNG</h1> This document describes how the Proof‑of‑Human (PoH) / Proof‑of‑Work (PoW) gate in front of SearXNG on delphi</code> was built and wired up, from a clean state to the current Tailscale‑aware deployment. Why Tailscale, it’s WireGuard with a nice admin interface and is easy to deploy. Audience: experienced operators / developers who are comfortable with Linux, systemd, Python, and Caddy. The examples are written to be copy/paste‑friendly and assume: Hostname: delphi.example.com</code></li> Tailscale hostname: delphi.abc123.ts.net</code></li> SearXNG running under uWSGI, listening on 127.0.0.1:8888</code> (HTTP)</li> PoH app running under uvicorn on 127.0.0.1:9000</code></li> </ul> Adjust paths and hostnames to taste. 🔺</a> 1. Overview</h2> The master plan: All traffic to https://delphi.example.com/</code> (and the Tailscale name) lands on a PoH page.</li> The page shows a “Don’t Panic” logo and a Tron‑style traveling border and a single instruction to “Hold to enter”.</li> Holding on the logo runs a client‑side PoW (SHA‑256 based on a server challenge), signs the result with a browser ECDSA key, and sends it to the backend for verification.</li> On success, the backend: Verifies the PoW and signature.</li> Issues a short‑lived session cookie (poh_session</code>) bound to the client IP / User Agent.</li> </ul> </li> Caddy only proxies /searxng/*</code> (SearXNG) when the poh_session</code> cookie is present; otherwise it sends the user back to the PoH gate.</li> </ul> 🔺</a> The bot friction layers:</h3> PoW with adjustable difficulty based on interaction.</li> Per‑IP rate limiting on PoH challenge creation.</li> Session TTL shortened for “suspicious” clients (those that never fetched favicon.ico</code>).</li> Tailscale DNS name terminates TLS via a Tailscale‑issued cert, but shares the same routing and gate.</li> </ul> 🔺</a> 2. PoH App: Python / FastAPI Setup</h2> To replicate this build, create a dedicated directory and virtualenv on the server: sudo mkdir -p /opt/poh sudo chown "$USER":"$USER" /opt/poh cd /opt/poh python3 -m venv venv ./venv/bin/pip install --upgrade pip ./venv/bin/pip install fastapi "uvicorn[standard]" cryptography </code></pre> Create the app layout: mkdir -p /opt/poh/app/static </code></pre> Create /opt/poh/app/main.py</code>: from datetime import datetime, timedelta, timezone import base64 import hashlib import secrets from pathlib import Path from typing import Any, Dict from fastapi import FastAPI, HTTPException, Request, Response from fastapi.responses import HTMLResponse, FileResponse from pydantic import BaseModel from cryptography.hazmat.primitives import hashes from cryptography.hazmat.primitives.asymmetric import ec from cryptography.hazmat.primitives.asymmetric.utils import encode_dss_signature app = FastAPI() class StartResponse(BaseModel): challenge: str difficulty: int timestamp: str class VerifyRequest(BaseModel): challenge: str counter: int hash: str signature: str public_key: Dict[str, Any] timestamp: str | None = None CHALLENGE_TTL = timedelta(minutes=5) DEFAULT_DIFFICULTY = 20 SESSION_TTL = timedelta(minutes=20) _challenges: Dict[str, Dict[str, Any]] = {} _sessions: Dict[str, Dict[str, Any]] = {} _rate_starts: Dict[str, list[datetime]] = {} _favicon_hits: Dict[str, datetime] = {} def _now() -> datetime: return datetime.now(timezone.utc) def _client_ip(request: Request) -> str: fwd = request.headers.get("x-forwarded-for") if fwd: return fwd.split(",")[0].strip() if request.client: return request.client.host or "?" return "?" def _b64url_decode(data: str) -> bytes: padding = "=" * ((4 - len(data) % 4) % 4) return base64.urlsafe_b64decode((data + padding).encode("ascii")) def _public_key_from_jwk(jwk: Dict[str, Any]) -> ec.EllipticCurvePublicKey: if jwk.get("kty") != "EC": raise ValueError("Unsupported key type") crv = jwk.get("crv") if crv not in ("P-256", "secp256r1"): raise ValueError("Unsupported curve") x_b = _b64url_decode(jwk["x"]) y_b = _b64url_decode(jwk["y"]) x = int.from_bytes(x_b, "big") y = int.from_bytes(y_b, "big") curve = ec.SECP256R1() public_numbers = ec.EllipticCurvePublicNumbers(x, y, curve) return public_numbers.public_key() def _leading_zero_bits_from_hex(h: str) -> int: b = bytes.fromhex(h) bits = 0 for byte in b: if byte == 0: bits += 8 else: bits += 8 - byte.bit_length() break return bits def _rate_limit_start(ip: str) -> None: now = _now() window = timedelta(minutes=1) entries = _rate_starts.setdefault(ip, []) entries[:] = [t for t in entries if now - t < window] if len(entries) >= 20: raise HTTPException(status_code=429, detail="Too many PoH starts from this IP") entries.append(now) @app.get("/poh/start", response_model=StartResponse) async def start_poh(request: Request) -> StartResponse: ip = _client_ip(request) _rate_limit_start(ip) now = _now() seen = _favicon_hits.get(ip) suspicious = True if seen is not None and now - seen < timedelta(minutes=10): suspicious = False difficulty = DEFAULT_DIFFICULTY + 4 if suspicious else DEFAULT_DIFFICULTY challenge = secrets.token_hex(16) _challenges[challenge] = { "created_at": now, "difficulty": difficulty, "used": False, "suspicious": suspicious, } return StartResponse( challenge=challenge, difficulty=difficulty, timestamp=now.isoformat(), ) @app.post("/poh/verify") async def verify_poh(request: Request, response: Response, body: VerifyRequest): meta = _challenges.get(body.challenge) if not meta: raise HTTPException(status_code=400, detail="Unknown challenge") if meta["used"]: raise HTTPException(status_code=400, detail="Challenge already used") created_at: datetime = meta["created_at"] if _now() - created_at > CHALLENGE_TTL: raise HTTPException(status_code=400, detail="Challenge expired") difficulty = int(meta["difficulty"]) data = (body.challenge + str(body.counter)).encode("utf-8") digest = hashlib.sha256(data).hexdigest() if digest != body.hash: raise HTTPException(status_code=400, detail="Hash mismatch") leading_bits = _leading_zero_bits_from_hex(digest) if leading_bits < difficulty: raise HTTPException(status_code=400, detail="Insufficient difficulty") try: pub = _public_key_from_jwk(body.public_key) except Exception as exc: # noqa: BLE001 raise HTTPException(status_code=400, detail=f"Invalid public key: {exc}") from exc message = (body.challenge + str(body.counter) + body.hash).encode("utf-8") try: sig_bytes = base64.b64decode(body.signature.encode("ascii")) except Exception as exc: # noqa: BLE001 raise HTTPException(status_code=400, detail="Invalid signature encoding") from exc if len(sig_bytes) != 64: raise HTTPException(status_code=400, detail="Unexpected signature length") r = int.from_bytes(sig_bytes[:32], "big") s = int.from_bytes(sig_bytes[32:], "big") der_sig = encode_dss_signature(r, s) try: pub.verify(der_sig, message, ec.ECDSA(hashes.SHA256())) except Exception as exc: # noqa: BLE001 raise HTTPException(status_code=400, detail="Signature verification failed") from exc meta["used"] = True now = _now() session_id = secrets.token_urlsafe(32) ip = _client_ip(request) ua = request.headers.get("user-agent", "?") suspicious = bool(meta.get("suspicious")) ttl = SESSION_TTL if not suspicious else timedelta(minutes=5) _sessions[session_id] = { "created_at": now, "expires_at": now + ttl, "ip": ip, "ua": ua, } response.set_cookie( "poh_session", session_id, max_age=int(ttl.total_seconds()), httponly=True, secure=True, samesite="Lax", path="/searxng/", ) return {"status": "ok"} @app.get("/", response_class=HTMLResponse) async def root() -> HTMLResponse: html = """<!DOCTYPE html> <html lang=\"en\"> <head> <meta charset=\"utf-8\" /> <title>Proof of Human</title> <style> :root { color-scheme: dark; } body { margin: 0; min-height: 100vh; display: flex; align-items: center; justify-content: center; background: radial-gradient(circle at top, #3b82f6 0, #1e3a8a 45%, #020617 100%); font-family: system-ui, -apple-system, BlinkMacSystemFont, \"Segoe UI\", sans-serif; color: #e0f2f1; } .shell { text-align: center; } #holder { position: relative; display: inline-block; cursor: pointer; } #dontpanic-logo { display: block; max-width: 260px; width: 70vw; height: auto; border-radius: 18px; filter: drop-shadow(0 0 16px rgba(15, 23, 42, 0.85)); } #glow { position: absolute; left: -4px; top: -4px; width: calc(100% + 8px); height: calc(100% + 8px); pointer-events: none; } #glow-rect { fill: none; stroke: #00f2ff; stroke-width: 4; stroke-linecap: round; stroke-linejoin: round; filter: drop-shadow(0 0 6px #00f2ff); opacity: 0.95; } #hint { margin-top: 0.75rem; font-size: 0.95rem; letter-spacing: 0.06em; text-transform: uppercase; color: #cbd5f5; } #status { margin-top: 0.75rem; font-size: 0.95rem; opacity: 0.9; } #attempts, #eta { margin-top: 0.3rem; font-size: 0.9rem; opacity: 0.85; } </style> </head> <body> <div class=\"shell\"> <div id=\"holder\"> <img id=\"dontpanic-logo\" src=\"/dontpanic.png\" alt=\"Don't Panic logo\" /> <svg id=\"glow\" aria-hidden=\"true\"><rect id=\"glow-rect\" x=\"2\" y=\"2\" width=\"100\" height=\"100\" rx=\"18\" /></svg> </div> <div id=\"hint\">Hold to enter</div> <div id=\"attempts\"></div> <div id=\"eta\"></div> <div id=\"status\"></div> </div> <script src=\"/poh.js\"></script> </body> </html> """ return HTMLResponse(content=html) JS_PATH = Path(__file__).parent / "static" / "poh.js" IMG_PATH = Path(__file__).parent / "static" / "dontpanic.png" FAVICON_PATH = Path(__file__).parent / "static" / "favicon.ico" @app.get("/poh.js") async def poh_js() -> FileResponse: return FileResponse(JS_PATH, media_type="application/javascript") @app.get("/dontpanic.png") async def dontpanic_png() -> FileResponse: return FileResponse(IMG_PATH, media_type="image/png") @app.get("/favicon.ico") async def favicon_ico(request: Request) -> FileResponse: ip = _client_ip(request) _favicon_hits[ip] = _now() return FileResponse(FAVICON_PATH, media_type="image/x-icon") </code></pre> 🔺</a> 3. Frontend PoH / PoW Script (poh.js</code>)</h2> So with the back-end handling the verification, the browser-side logic lives in /opt/poh/app/static/poh.js</code>. It: Ensures a persistent ECDSA P‑256 keypair (stored in localStorage</code> as JWK).</li> Fetches a challenge from /poh/start</code> when the user holds the logo.</li> Runs the PoW loop (SHA-256(challenge + counter)</code>) until the hash meets the difficulty.</li> Signs (challenge + counter + hash)</code> with the private key using WebCrypto (ECDSA</code> + SHA-256</code>).</li> Sends the signed payload to /poh/verify</code> and redirects to /searxng/</code> on success.</li> </ul> 🔺</a> Minimal version:</h3> (async () => { const holder = document.getElementById("holder"); const statusEl = document.getElementById("status"); const attemptsEl = document.getElementById("attempts"); const etaEl = document.getElementById("eta"); const glowSvg = document.getElementById("glow"); const glowRect = document.getElementById("glow-rect"); if (!holder || !statusEl) { console.error("PoH UI elements not found"); return; } let holding = false; function setStatus(text) { statusEl.textContent = text; } function setAttempts(count) { if (attemptsEl) attemptsEl.textContent = `Attempts: ${count.toLocaleString()}`; } function setEta(text) { if (etaEl) etaEl.textContent = text; } function toHex(buffer) { const bytes = new Uint8Array(buffer); return Array.from(bytes) .map(b => b.toString(16).padStart(2, "0")) .join(""); } async function sha256Hex(str) { const enc = new TextEncoder(); const data = enc.encode(str); const digest = await crypto.subtle.digest("SHA-256", data); return toHex(digest); } function leadingZeroBitsFromHex(hex) { const bytes = new Uint8Array(hex.length / 2); for (let i = 0; i < bytes.length; i++) { bytes[i] = parseInt(hex.substr(i * 2, 2), 16); } let bits = 0; for (let i = 0; i < bytes.length; i++) { const byte = bytes[i]; if (byte === 0) bits += 8; else { bits += 8 - byte.toString(2).length; break; } } return bits; } const STORAGE_KEY = "poh-keypair"; async function storeKeyPair(keyPair) { const privJwk = await crypto.subtle.exportKey("jwk", keyPair.privateKey); const pubJwk = await crypto.subtle.exportKey("jwk", keyPair.publicKey); localStorage.setItem(STORAGE_KEY, JSON.stringify({ privateKey: privJwk, publicKey: pubJwk })); } async function loadKeyPair() { const raw = localStorage.getItem(STORAGE_KEY); if (!raw) return null; try { const payload = JSON.parse(raw); const priv = await crypto.subtle.importKey( "jwk", payload.privateKey, { name: "ECDSA", namedCurve: "P-256" }, true, ["sign"], ); const pub = await crypto.subtle.importKey( "jwk", payload.publicKey, { name: "ECDSA", namedCurve: "P-256" }, true, ["verify"], ); return { privateKey: priv, publicKey: pub, publicJwk: payload.publicKey }; } catch (e) { console.error("Failed to load keypair", e); return null; } } async function getOrCreateKeyPair() { const existing = await loadKeyPair(); if (existing) return existing; const generated = await crypto.subtle.generateKey( { name: "ECDSA", namedCurve: "P-256" }, true, ["sign", "verify"], ); await storeKeyPair(generated); const pubJwk = await crypto.subtle.exportKey("jwk", generated.publicKey); return { privateKey: generated.privateKey, publicKey: generated.publicKey, publicJwk: pubJwk }; } // Tron glow let glowLen = 0; let glowOffset = 0; let glowAnimating = false; let bestBits = 0; function layoutGlow() { if (!glowSvg || !glowRect || !holder) return; const w = holder.offsetWidth + 8; const h = holder.offsetHeight + 8; glowSvg.setAttribute("viewBox", `0 0 ${w} ${h}`); glowSvg.setAttribute("width", String(w)); glowSvg.setAttribute("height", String(h)); glowRect.setAttribute("x", "2"); glowRect.setAttribute("y", "2"); glowRect.setAttribute("width", String(w - 4)); glowRect.setAttribute("height", String(h - 4)); glowRect.setAttribute("rx", "18"); try { glowLen = glowRect.getTotalLength(); } catch { glowLen = w * 2 + h * 2; } glowRect.style.strokeDasharray = `0 ${glowLen}`; glowRect.style.strokeDashoffset = "0"; } function setProgress(progress) { if (!glowRect || !glowLen) return; const p = Math.max(0, Math.min(1, progress)); const lit = Math.max(12, Math.floor(glowLen * p)); glowRect.style.strokeDasharray = `${lit} ${glowLen - lit}`; } function tickGlow() { if (!glowAnimating || !glowRect || !glowLen) return; glowOffset = (glowOffset + 6) % glowLen; glowRect.style.strokeDashoffset = String(-glowOffset); requestAnimationFrame(tickGlow); } window.addEventListener("resize", layoutGlow); async function runPoW(challenge, difficulty) { setStatus("Running proof-of-work..."); setAttempts(0); setEta("Estimating hold time..."); layoutGlow(); glowAnimating = true; bestBits = 0; setProgress(0); requestAnimationFrame(tickGlow); let counter = 0; const batchSize = 1000; const start = performance.now(); let lastUpdate = start; // eslint-disable-next-line no-constant-condition while (true) { if (!holding) { setStatus("Released; PoH paused. Hold to resume."); glowAnimating = false; return null; } const hash = await sha256Hex(challenge + String(counter)); const bits = leadingZeroBitsFromHex(hash); if (bits > bestBits) { bestBits = bits; if (difficulty > 0) setProgress(bestBits / difficulty); } if (bits >= difficulty) { const now = performance.now(); const elapsedSec = (now - start) / 1000; setAttempts(counter); setEta(`Done in ${elapsedSec.toFixed(1)}s`); glowAnimating = false; setProgress(1); return { challenge, counter, hash, difficulty }; } counter++; if (counter % batchSize === 0) { const now = performance.now(); if (now - lastUpdate >= 250) { lastUpdate = now; const elapsedSec = (now - start) / 1000; setAttempts(counter); if (elapsedSec > 0) { const rate = counter / elapsedSec; const expectedTotal = Math.pow(2, difficulty); const remaining = Math.max(expectedTotal - counter, 0); const etaSec = remaining / rate; const clamped = Math.max(0, Math.min(3600, etaSec)); setEta(`Estimated time remaining: ${clamped.toFixed(1)}s`); } else { setEta("Estimating hold time..."); } await new Promise(resolve => setTimeout(resolve, 0)); } } } } function arrayBufferToBase64(buffer) { const bytes = new Uint8Array(buffer); let binary = ""; for (let i = 0; i < bytes.length; i++) { binary += String.fromCharCode(bytes[i]); } return btoa(binary); } async function signPoW(privateKey, result, publicJwk) { const message = result.challenge + String(result.counter) + result.hash; const enc = new TextEncoder(); const data = enc.encode(message); const sig = await crypto.subtle.sign({ name: "ECDSA", hash: "SHA-256" }, privateKey, data); const signatureB64 = arrayBufferToBase64(sig); return { challenge: result.challenge, counter: result.counter, hash: result.hash, signature: signatureB64, public_key: publicJwk, timestamp: new Date().toISOString(), }; } async function sendVerification(payload) { setStatus("Sending verification..."); const res = await fetch("/poh/verify", { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(payload), }); if (!res.ok) { const text = await res.text(); throw new Error(`Verify failed: ${res.status} ${text}`); } return res.json(); } async function startPoH() { try { setStatus("Requesting challenge..."); const kp = await getOrCreateKeyPair(); const startRes = await fetch("/poh/start"); if (!startRes.ok) throw new Error(`Failed to start PoH: ${startRes.status}`); const startData = await startRes.json(); const { challenge, difficulty } = startData; const powResult = await runPoW(challenge, difficulty); if (!powResult) return; setStatus("Signing proof-of-work result..."); const signed = await signPoW(kp.privateKey, powResult, kp.publicJwk); const verifyRes = await sendVerification(signed); if (verifyRes.status === "ok") { setStatus("Proof-of-human completed. Redirecting to search..."); window.location.href = "/searxng/"; } else { setStatus("Verification failed."); console.error("Verification error", verifyRes); } } catch (e) { console.error("PoH error", e); setStatus("Error during PoH: " + (e && e.message ? e.message : String(e))); glowAnimating = false; } } function handlePointerDown(e) { e.preventDefault(); if (holding) return; holding = true; startPoH().finally(() => { holding = false; }); } function handlePointerUp(e) { e.preventDefault(); holding = false; } holder.addEventListener("pointerdown", handlePointerDown); holder.addEventListener("pointerup", handlePointerUp); holder.addEventListener("pointercancel", handlePointerUp); holder.addEventListener("pointerleave", handlePointerUp); layoutGlow(); })(); </code></pre> The JS is entirely optional from the server’s perspective: any client that can solve the PoW, sign the result, and call /poh/verify</code> with the correct payload will be accepted. The point is to make that cheap for human browsers and unattractive for bot automatons. 🔺</a> 4. Static Assets and Favicon Behaviour</h2> “So what’s with the favicon.ico behavior, guv?” “Well the truth is, bots don’t download favicon.ico’s because they don’t need them, humans want them.” 🔺</a> 4.1. Don’t Panic logo</h3> Yes, I am a Hitchikers Guide to the Galaxy type of person. Locally stored at /opt/poh/app/static/dontpanic.png</code>.</li> Served via GET /dontpanic.png</code>.</li> Used as the visual “button” inside the PoH page.</li> </ul> 🔺</a> 4.2. Towel favicon and heuristic</h3> Locally stored at /opt/poh/app/static/favicon.ico</code>, built from a towel PNG.</li> Served by GET /favicon.ico</code>.</li> Each favicon request records _favicon_hits[ip] = _now()</code>.</li> /poh/start</code> looks up _favicon_hits</code>: If the IP hasn’t fetched the favicon in the last 10 minutes, the PoW difficulty is bumped by 4 bits and the session TTL is later shortened.</li> 4 bits may not sound like much, but it’s orders of magnitude harder.</li> </ul> </li> </ul> This adds a low‑cost behavioural signal: most browsers fetch the favicon automatically, whereas many simple HTTP clients do not. 🔺</a> 5. Systemd and Caddy Integration (Summary)</h2> For quick reference: PoH app Code lives under /opt/poh/app</code>.</li> venv at /opt/poh/venv</code>.</li> Service: poh.service</code> running uvicorn on 127.0.0.1:9000</code>.</li> </ul> </li> SearXNG Still managed by uWSGI, now also exposing HTTP on 127.0.0.1:8888</code> via http-socket</code>.</li> </ul> </li> Caddy Uses a delphi-common</code> snippet containing: Shared headers.</li> PoH cookie gating for /searxng*</code>.</li> Reverse proxy to PoH app for everything else.</li> </ul> </li> Two site blocks: delphi.example.com</code> (Let’s Encrypt).</li> delphi.abc123.ts.net</code> (Tailscale cert via tailscale cert</code>).</li> </ul> </li> </ul> </li> </ul> This keeps the routing picture simple while allowing both public DNS and Tailscale names to share the same gate and SearXNG backend. 🔺</a> 6. Complete Config Reference</h2> This section pulls together the key files so someone can reproduce the exact setup. 🔺</a> 6.1. /opt/poh/app/main.py</code></h3> This file is shown in full in section 2 and can be copied as‑is. It provides: /poh/start</code> and /poh/verify</code> endpoints.</li> PoW verification and WebCrypto signature checking.</li> Session cookie issuance with TTL depending on suspicious</code> flag.</li> HTML shell, static file routes, and favicon heuristic.</li> </ul> If you want to regenerate it quickly on a new host, you can copy the entire code block from section 2 into /opt/poh/app/main.py</code>. 🔺</a> 6.2. /opt/poh/app/static/poh.js</code></h3> The full, working script is in section 3. To deploy: mkdir -p /opt/poh/app/static cat > /opt/poh/app/static/poh.js << 'EOF' <paste the script from section 3 here> EOF </code></pre> 🔺</a> 6.3. /etc/systemd/system/poh.service</code></h3> [Unit] Description=Proof-of-Human FastAPI After=network.target [Service] User=mjh Group=mjh WorkingDirectory=/opt/poh Environment=PATH=/opt/poh/venv/bin:/usr/bin ExecStart=/opt/poh/venv/bin/uvicorn app.main:app --host 127.0.0.1 --port 9000 Restart=always RestartSec=2 [Install] WantedBy=multi-user.target </code></pre> Enable and start: sudo systemctl daemon-reload sudo systemctl enable --now poh.service </code></pre> 🔺</a> 6.4. /etc/uwsgi/apps-enabled/searxng.ini</code> (excerpt)</h3> [uwsgi] uid = searxng gid = searxng env = LANG=C.UTF-8 env = LANGUAGE=C.UTF-8 env = LC_ALL=C.UTF-8 chdir = /usr/local/searxng/searxng-src/searx env = SEARXNG_SETTINGS_PATH=/etc/searxng/settings.yml disable-logging = true chmod-socket = 666 single-interpreter = true master = true lazy-apps = true plugin = python3,http enable-threads = true workers = %k threads = 4 module = searx.webapp virtualenv = /usr/local/searxng/searx-pyenv pythonpath = /usr/local/searxng/searxng-src socket = /usr/local/searxng/run/socket http-socket = 127.0.0.1:8888 buffer-size = 8192 offload-threads = %k </code></pre> After editing: sudo systemctl restart uwsgi </code></pre> 🔺</a> 6.5. /etc/caddy/Caddyfile</code></h3> # Caddyfile for SearXNG + PoH (delphi-common) { encode zstd gzip header { X-Frame-Options "SAMEORIGIN" X-Content-Type-Options "nosniff" Referrer-Policy "no-referrer-when-downgrade" } # Match SearXNG requests with PoH cookie present @searx_poh { path /searxng* header Cookie *poh_session=* } # Match all SearXNG requests @searx_all { path /searxng* } # Allow SearXNG only when PoH cookie exists handle @searx_poh { reverse_proxy http://127.0.0.1:8888 { header_up Host {host} header_up X-Forwarded-Proto {scheme} header_up X-Script-Name /searxng header_up X-Real-IP {remote} header_up X-Forwarded-For {remote_host} } } # Otherwise, bounce back to the PoH gate handle @searx_all { redir / 302 } # Everything else (/, /poh, JS, images, favicon, etc.) goes to PoH app handle { reverse_proxy http://127.0.0.1:9000 } } delphi.example.com { import delphi-common } delphi.abc123.ts.net { tls /etc/caddy/delphi-tail.crt /etc/caddy/delphi-tail.key import delphi-common } </code></pre> Reload Caddy: sudo systemctl restart caddy </code></pre> 🔺</a> 6.6. Tailscale certificate commands</h3> On the Delphi host (already joined to your Tailscale tailnet): sudo tailscale cert delphi.abc123.ts.net sudo mv delphi.abc123.ts.net.crt /etc/caddy/delphi-tail.crt sudo mv delphi.abc123.ts.net.key /etc/caddy/delphi-tail.key sudo chown caddy:caddy /etc/caddy/delphi-tail.* sudo chmod 600 /etc/caddy/delphi-tail.key </code></pre> Then restart Caddy as shown above. With these concrete configs in place, a second environment should be able to reproduce what Delphi is currently running: PoH/PoW gate, favicon‑aware difficulty, cookie‑gated SearXNG, and dual hostnames (public + Tailscale) sharing the same routes. If you don’t intend public access, you can now remove the Caddyfile entry for the public host and just use Tailscale. Why your job turned against you 2025-11-05T00:00:00+00:00 🔺</a> Why your job turned on you (and why it wasn’t personal)</h1> 🔺</a> by Icy-Anything5841</h3> I’m a lawyer, 25 years in practice. I’ve been eliminated from institutions five times in my career — not for failing, but for succeeding in ways that apparently made me incompatible with the system. Each time it happened, I spent months trying to figure out what I did wrong. Therapy, self-analysis, the whole thing. Eventually I stopped asking “what did I do wrong?” and started asking “what pattern keeps repeating?” Here’s what I think is actually happening. The Mechanism In hierarchical systems, independent competence creates a pressure imbalance. The hierarchy depends on people needing each other in predictable ways — subordinates need direction, managers need validation, departments need coordination. When someone operates independently, they expose how unnecessary some of these dependencies are. That creates stress on the structure itself. The system responds by eliminating the source of imbalance. Not consciously, not maliciously, but automatically — the way your body fights off foreign cells. You become incompatible with the system’s need to maintain its interdependent structure. This happens faster when the system is already under strain. Budget cuts, leadership changes, political pressure, or economic contraction make the hierarchy fragile. A fragile system eliminates tension, and independent thinkers are tension. The fastest way to restore equilibrium isn’t solving the problem you’re pointing out — it’s removing you. What That Looks Like You stop getting invited to meetings. You’re left off emails or “restructured.” Suddenly your performance is “an issue” even though nothing changed. You’re told you’re “not a team player” for raising the same concerns that once earned praise. Your clarity didn’t make you expendable — it made you incompatible with a system protecting its dependency structure. They didn’t eliminate you because you were wrong. They eliminated you because you were right too soon, and too clearly. Why This Feels Personal (And Isn’t) Being forced out feels like moral judgment. You replay conversations, second-guess every move, question your worth. But what happened was structural, not personal. It feels personal because the rejection came from people you trusted, the system once praised you for your strengths then turned on you, and you were left without closure, sometimes blamed for your own ousting. But from a systemic view, what happened was predictable. You represented too much clarity during instability, too much initiative during consolidation, too much autonomy in a hierarchy craving control. You were eliminated to preserve the system’s interdependence — not because of moral failure but because of structural reflex. If you’ve been through this more than once, it’s not because you’re flawed. It’s because you’re consistently independent in systems that penalize that trait. The Exception There is one condition where systems tolerate independence: existential crisis. When survival is genuinely threatened, hierarchies need independent competence. They’ll accept the pressure imbalance because eliminating you would kill the organization. Think of generals during wartime, turnaround specialists in failing companies, or crisis managers during genuine emergencies. But once the existential threat passes, the selection pressure returns. The independence that saved the system becomes the independence that threatens it. The elimination you avoided during crisis comes afterward — because the system is now stable enough to restore its preferred equilibrium. The only lasting protection is structural — legal safeguards, tenure systems, or institutional checks that make elimination costly enough to override the reflex. Without those protections or an existential crisis, the pressure to eliminate independence is constant and predictable. What This Means If you’ve been eliminated for competence rather than failure, you now have the framework to understand why. The system didn’t fail to recognize your value — it recognized that your independence threatened its structure. That’s not a bug. That’s the feature. You can stop searching for what you did wrong. The answer is you were structurally incompatible with a hierarchy defending itself. Understanding that won’t undo what happened, but it might stop you from internalizing a systemic problem as a personal failure. Originally from: Why your job turned on you (and why it wasn’t personal)</a> 3-2-1-1-0 Backup Automation 2025-11-02T00:00:00+00:00 This is the full version of Matthew’s 3-2-1-1-0 Backup Automation Makefile. It’s formatted for correct rendering in Codex / Zola Markdown without overflow. # =========================================== # WRITING BACKUP AUTOMATION — 3-2-1-1-0 # =========================================== include .env DATE := $(shell date +%F_%T) RESTORE_DIR := /tmp/writing-restore-test .PHONY: all git-save backup-local mirror-local backup-cloud backup-cloud-scaleway manifest verify verify-restore offline-copy cron-install full # Run everything all: git-save backup-local mirror-local backup-cloud backup-cloud-scaleway manifest verify full: all verify-restore # ------------------------------------------------- # Git auto-commit and push # ------------------------------------------------- git-save: @echo "[GIT] Auto-committing changes..." cd $(SRC_DIR) && \ git add . && \ git commit -m "Auto backup $(DATE)" || echo "No changes to commit." && \ git push origin main || echo "Push skipped/offline." # ------------------------------------------------- # Local backups (encrypted via restic + unencrypted mirror) # ------------------------------------------------- backup-local: @echo "[LOCAL] Syncing to CF-Express card (encrypted restic sync)..." rsync -avh --delete --exclude=".git" $(SRC_DIR)/ $(LOCAL_BACKUP)/ && sync mirror-local: @echo "[LOCAL] Creating unencrypted rsync mirror to CF-Express..." mkdir -p $(LOCAL_BACKUP)/unencrypted rsync -avh --delete $(SRC_DIR)/ $(LOCAL_BACKUP)/unencrypted/writing-latest/ @echo "[LOCAL] Creating versioned timestamped copy..." rsync -avh --delete $(SRC_DIR)/ $(LOCAL_BACKUP)/unencrypted/writing-$(DATE)/ sync @echo "[LOCAL] Unencrypted mirror complete: $(LOCAL_BACKUP)/unencrypted/writing-$(DATE)" # ------------------------------------------------- # Backblaze B2 Cloud Backup # ------------------------------------------------- backup-cloud: @echo "[CLOUD] Backing up to Backblaze B2..." . $(PWD)/.env; \ RESTIC_PASSWORD_FILE=/etc/restic/restic_pass \ restic -r $$RESTIC_REPOSITORY backup $$SRC_DIR --verbose && \ RESTIC_PASSWORD_FILE=/etc/restic/restic_pass \ restic -r $$RESTIC_REPOSITORY forget --keep-daily 7 --keep-weekly 4 --prune # ------------------------------------------------- # Scaleway Paris Cloud Backup # ------------------------------------------------- backup-cloud-scaleway: @echo "[CLOUD] Backing up to Scaleway Paris..." bash -c '\ set -e; \ source "$(PWD)/.env"; \ export RESTIC_PASSWORD_FILE=/etc/restic/restic_pass; \ export AWS_ACCESS_KEY_ID="$$AWS_ACCESS_KEY_ID_SCL"; \ export AWS_SECRET_ACCESS_KEY="$$AWS_SECRET_ACCESS_KEY_SCL"; \ echo "[SCL] Repository: $$RESTIC_REPOSITORY_SCL"; \ restic -r "$$RESTIC_REPOSITORY_SCL" backup "$$SRC_DIR" --verbose; \ restic -r "$$RESTIC_REPOSITORY_SCL" forget --keep-daily 7 --keep-weekly 4 --prune; \ ' # ------------------------------------------------- # Manifests (SHA-256) # ------------------------------------------------- manifest: @echo "[MANIFEST] Generating SHA256 manifest..." find $(SRC_DIR) -type f -print0 | xargs -0 sha256sum > $(SRC_DIR)/MANIFEST-$(DATE).sha256 cp $(SRC_DIR)/MANIFEST-$(DATE).sha256 $(LOCAL_BACKUP)/ || true . $(PWD)/.env; \ RESTIC_PASSWORD_FILE=/etc/restic/restic_pass \ restic -r $$RESTIC_REPOSITORY backup $(SRC_DIR)/MANIFEST-$(DATE).sha256 bash -c '\ source "$(PWD)/.env"; \ export RESTIC_PASSWORD_FILE=/etc/restic/restic_pass; \ export AWS_ACCESS_KEY_ID="$$AWS_ACCESS_KEY_ID_SCL"; \ export AWS_SECRET_ACCESS_KEY="$$AWS_SECRET_ACCESS_KEY_SCL"; \ restic -r "$$RESTIC_REPOSITORY_SCL" backup "$(SRC_DIR)/MANIFEST-$(DATE).sha256"; \ ' # ------------------------------------------------- # Verify repository integrity (both clouds) # ------------------------------------------------- verify: @echo "[VERIFY] Checking repository integrity..." . /home/mjh/writing/.env; \ echo " - Backblaze B2"; \ restic -r $$RESTIC_REPOSITORY check --with-cache; \ echo " - Scaleway Paris"; \ AWS_ACCESS_KEY_ID=$$AWS_ACCESS_KEY_ID_SCL AWS_SECRET_ACCESS_KEY=$$AWS_SECRET_ACCESS_KEY_SCL restic -r $$RESTIC_REPOSITORY_SCL check --with-cache # ------------------------------------------------- # Verify restore & file integrity (using manifests) # ------------------------------------------------- verify-restore: @echo "[VERIFY] Testing restore from both clouds..." rm -rf $(RESTORE_DIR) mkdir -p $(RESTORE_DIR) . $(PWD)/.env; \ RESTIC_PASSWORD_FILE=/etc/restic/restic_pass \ restic -r $$RESTIC_REPOSITORY restore latest --target $(RESTORE_DIR)/b2 bash -c '\ source "$(PWD)/.env"; \ export RESTIC_PASSWORD_FILE=/etc/restic/restic_pass; \ export AWS_ACCESS_KEY_ID="$$AWS_ACCESS_KEY_ID_SCL"; \ export AWS_SECRET_ACCESS_KEY="$$AWS_SECRET_ACCESS_KEY_SCL"; \ restic -r "$$RESTIC_REPOSITORY_SCL" restore latest --target "$(RESTORE_DIR)/scaleway"; \ ' @echo "[VERIFY] Comparing manifests..." @if ls $(SRC_DIR)/MANIFEST-*.sha256 >/dev/null 2>&1; then \ LATEST_MANIFEST=$$(ls -t $(SRC_DIR)/MANIFEST-*.sha256 | head -n 1); \ echo " - Using manifest $$LATEST_MANIFEST"; \ cd $(RESTORE_DIR)/b2 && sha256sum -c $$LATEST_MANIFEST || true; \ cd $(RESTORE_DIR)/scaleway && sha256sum -c $$LATEST_MANIFEST || true; \ else \ echo "No manifest found, skipping file verification."; \ fi @echo "[VERIFY] Restore verification complete." # ------------------------------------------------- # Offline cold copy # ------------------------------------------------- offline-copy: @echo "[OFFLINE] Creating offline tarball..." tar -czf /media/mjh/0000/writing-$(DATE).tar.gz -C $(SRC_DIR) . sync @echo "[OFFLINE] Safely eject the CF-Express card for cold storage." # ------------------------------------------------- # Cron (every 6 hours) # ------------------------------------------------- cron-install: @echo "0 */6 * * * cd $(PWD) && make full >> $(PWD)/backup.log 2>&1" | crontab - @echo "[CRON] Installed job (runs every 6 hours, full backup)" </code></pre> NGINX Hardening 2025-11-02T00:00:00+00:00 🔺</a> 1 OS baseline (before NGINX)</h1> Must Patch OS, minimal packages only; enable unattended security updates.</li> Create dedicated user/group: nginx:nginx</code> (no shell, no home): useradd --system --no-create-home --shell /usr/sbin/nologin nginx</code></li> Set system-wide umask 027</code> (CIS).</li> Time sync (chrony/ntpd), correct time zone.</li> Enable a host firewall to allow only 80/443 (and 22 from admin IPs).</li> Install AIDE or similar; include /etc/nginx/**</code>, cert paths, and unit overrides.</li> </ul> Should Separate partitions for /var/log</code>, /var/www</code>, /var/cache/nginx</code>.</li> SELinux/AppArmor enforcing (configure for httpd_t or nginx profile).</li> </ul> 🔺</a> 2 Install and file permissions</h1> Must Install from vendor or trusted repo; pin versions. </li> Ownership/permissions: /etc/nginx</code>: root:root, 750</code></li> /etc/nginx/nginx.conf</code> and included confs: root:root, 640</code></li> /var/log/nginx</code>: root:adm (or root:nginx), 750</code>; logs 640</code></li> Web roots owned by deploy user, readable by nginx</code> (no write).</li> </ul> </li> Remove default/example sites and autoindex</code> configs. </li> </ul> Should Move any secret files (JWT keys, upstream creds) to root-only dir and load via env or include with ro</code> perms.</li> </ul> 🔺</a> 3 Systemd hardening (STIG-leaning)</h1> Create /etc/systemd/system/nginx.service.d/hardening.conf</code>: [Service] User=nginx Group=nginx AmbientCapabilities= CapabilityBoundingSet=CAP_NET_BIND_SERVICE NoNewPrivileges=true PrivateTmp=true ProtectHome=true ProtectSystem=strict ProtectKernelTunables=true ProtectKernelModules=true ProtectControlGroups=true ProtectClock=true MemoryDenyWriteExecute=true LockPersonality=true RestrictSUIDSGID=true RestrictNamespaces=true RestrictRealtime=true RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX SystemCallFilter=@system-service @file-system @network-io ReadWritePaths=/var/log/nginx /var/cache/nginx ReadOnlyPaths=/etc/nginx /var/www RuntimeDirectory=nginx RuntimeDirectoryMode=0750 UMask=0027 </code></pre> Then: systemctl daemon-reload && systemctl restart nginx</code> 🔺</a> 4 Core NGINX security options</h1> In /etc/nginx/nginx.conf</code>: user nginx; worker_processes auto; events { worker_connections 1024; } http { # CIS: minimize info leakage server_tokens off; more_clear_headers Server; # if using headers-more-nginx-module; otherwise rely on server_tokens off # Logging (structured, includes request ID) log_format main '$remote_addr - $remote_user [$time_local] "$request" ' '$status $body_bytes_sent "$http_referer" "$http_user_agent" ' 'rt=$request_time ua="$upstream_addr" urt="$upstream_response_time" ' 'rid="$request_id"'; access_log /var/log/nginx/access.log main; error_log /var/log/nginx/error.log warn; # Timeouts (reduce resource abuse) send_timeout 10s; client_body_timeout 10s; client_header_timeout 10s; keepalive_timeout 30s; keepalive_requests 100; # Request size and buffering client_max_body_size 10m; # tighten per app large_client_header_buffers 2 8k; # MIME sniffing and compression safety types_hash_max_size 4096; include mime.types; default_type application/octet-stream; gzip off; # prefer upstream or safe compression settings if needed # Proxy sane defaults (if reverse proxying) proxy_http_version 1.1; proxy_set_header Connection ""; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; proxy_connect_timeout 5s; proxy_read_timeout 30s; proxy_send_timeout 30s; # Rate limiting / DoS control (tune) limit_req_zone $binary_remote_addr zone=req_per_ip:10m rate=10r/s; limit_conn_zone $binary_remote_addr zone=conn_per_ip:10m; # Include sites include /etc/nginx/conf.d/*.conf; } </code></pre> Per vhost (/etc/nginx/conf.d/site.conf</code>): server { listen 443 ssl http2; listen [::]:443 ssl http2; server_name example.com; # TLS (STIG/CIS modern) ssl_protocols TLSv1.2 TLSv1.3; ssl_prefer_server_ciphers on; # If OpenSSL 1.1.1+/3.x, use modern suites: ssl_ciphers 'TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256:HIGH:!aNULL:!MD5:!DES:!3DES:!RC4:!RC2:!SEED:!IDEA'; ssl_session_timeout 10m; ssl_session_cache shared:SSL:10m; ssl_session_tickets off; # HSTS (enable after validating HTTPS is permanent) add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; # OCSP stapling (provide resolvers) resolver 1.1.1.1 9.9.9.9 valid=300s; ssl_stapling on; ssl_stapling_verify on; # Security headers (tune CSP for your app) add_header X-Content-Type-Options "nosniff" always; add_header X-Frame-Options "DENY" always; # or SAMEORIGIN if needed add_header Referrer-Policy "no-referrer" always; add_header Permissions-Policy "geolocation=(), microphone=(), camera=()" always; # Content-Security-Policy example (tighten for your assets) add_header Content-Security-Policy "default-src 'self'; object-src 'none'; frame-ancestors 'none'; base-uri 'self'" always; # Request limits limit_req zone=req_per_ip burst=20 nodelay; limit_conn conn_per_ip 20; # App root root /var/www/example; index index.html; # No directory listings autoindex off; access_log /var/log/nginx/example_access.log main; error_log /var/log/nginx/example_error.log warn; } </code></pre> 🔺</a> 5 Certificates and keys</h1> Must Private keys owned by root:root</code> with 600</code> perms; store under /etc/ssl/private</code>.</li> Use 2048-bit+ RSA (or ECDSA P-256/384). Prefer ECDSA + RSA dual certs if client mix.</li> Rotate certs; enforce OCSP stapling; monitor expiry.</li> Generate strong DH params (if using DH): openssl dhparam -out /etc/ssl/dhparam.pem 4096</code> and ssl_dhparam</code> in vhost (only if needed).</li> </ul> 🔺</a> 6 Logging, rotation, and monitoring</h1> Must Log format includes timing and request_id (shown above).</li> Logrotate with strict perms:</li> </ul> /var/log/nginx/*.log { weekly rotate 8 missingok compress delaycompress notifempty create 0640 root adm sharedscripts postrotate /bin/systemctl kill -s USR1 nginx || true endscript } </code></pre> Forward logs to a central SIEM (STIG).</li> </ul> Should Enable journald</code> rate limits; ensure time sync.</li> </ul> 🔺</a> 7 Access control and auth</h1> Must Avoid HTTP Basic wherever possible; if used, protect with rate-limits and fail2ban</code> (nginx-http-auth, nginx-badbots jails).</li> Restrict admin paths by IP and/or mTLS.</li> Remove default and sample configs/sites; 404 on unknown hosts.</li> </ul> 🔺</a> 8 Content, uploads, and temp paths</h1> Must Set client_body_temp_path</code> and proxy_temp_path</code> to dirs owned by nginx</code> with 750</code> perms, on a partition with nodev,nosuid,noexec</code> mount options if feasible.</li> Validate and limit upload sizes (client_max_body_size</code>) and types server-side.</li> </ul> 🔺</a> 9 SELinux/AppArmor (pick one)</h1> SELinux Enforcing mode.</li> Typical booleans (as needed): setsebool -P httpd_can_network_connect 1</code> (reverse proxy) httpd_can_sendmail 0</code>, httpd_enable_cgi 0</code> unless needed.</li> Correct file contexts under /var/www</code> and /var/log/nginx</code>.</li> </ul> AppArmor Enforce profile usr.sbin.nginx</code>; permit read of /etc/ssl/**</code>, /var/www/**</code>, write to /var/log/nginx/**</code>, /var/cache/nginx/**</code>.</li> </ul> 🔺</a> 10 Optional but strong</h1> WAF (ModSecurity v3 with OWASP CRS) in detection → blocking mode.</li> Bot and scan throttling with map</code> + limit_req</code>.</li> mTLS for admin/API subpaths.</li> Subresource Integrity (SRI) for third-party assets.</li> Immutable deploys: serve static files from read-only dirs; use content-addressed paths.</li> </ul> 🔺</a> 11 Verification and recurring checks</h1> Commands nginx -t && systemctl reload nginx nginx -T | sed -n '1,120p' # quick render of active config ss -ltn | grep -E '(:80|:443)' openssl s_client -connect example.com:443 -servername example.com -tls1_3 </dev/null 2>/dev/null | openssl x509 -noout -text | sed -n '1,20p' curl -I https://example.com </code></pre> Automated Weekly oscap</code>/OpenSCAP scan (CIS/STIG profiles if available).</li> Monthly TLS scan (testssl.sh or sslyze).</li> Quarterly restore from backup of /etc/nginx</code>, certs, and a sample site.</li> </ul> 🔺</a> Quick “diffable” checklist (Must)</h2> OS minimal, patched, firewall on; SELinux/AppArmor enforcing.</li> nginx</code> system user, no shell; umask 027.</li> /etc/nginx</code> 750, confs 640; logs 640/750 dirs; webroot read-only to nginx.</li> systemd hardening override applied (ProtectSystem=strict, etc.).</li> server_tokens off</code>; no default/autoindex.</li> TLS 1.2/1.3 only; modern ciphers; HSTS; OCSP stapling.</li> Security headers (X-CTO, XFO, RP, PP, CSP).</li> Rate limits and sane timeouts; request/body size limits.</li> Log format with request_id; logrotate with 0640 and USR1 reopen.</li> Secrets (keys) 600 root:root; DHparams if used.</li> Recurring verification: nginx -t</code>, TLS scan, OpenSCAP, AIDE checks.</li> </ul> 🔺</a> Script Usage</h2> sudo bash harden-nginx.sh –domain example.com –webroot /var/www/example –owner deploy –email admin@example.com nginx-hardening.sh</a> Concerning the Fourth Age of Man 2025-11-01T00:00:00+00:00 🔺</a> Concerning the 4th Age of Man</h1> 🔺</a> by Matthew J. Harmon</h4> In the fading of the Third Age, when the long shadows of the elder kingdoms had withdrawn and the memory of wonders was already dim in the hearts of men, there came a quieter time. The seas had calmed, and the tongues of fire that once licked the mountains were stilled. Yet beneath the surface of peace, the world was stirring, for every ending is but a slumbering of beginnings. The elder races had dwindled; the Fair Folk had departed beyond the sunset, there were no more deep halls in the earth, and the First People were diminished. The lands of Men lay open and unguarded, vast as uncharted seas, and upon them a new restlessness took hold. It was said that the hearts of men, though content in the dawn of their dominion, could not long abide the stillness of power. For the will to remember faded faster than the will to build, and the lore of the world, once handed from voice to voice, grew frail and uncertain. So began the Fourth Age; an age not of kings, nor of heroes, but of heirs. Of those who sought to reclaim the half-forgotten glory of the elder days, and of those who would unmake it in their hunger for mastery. The Industrial Age, the Third Age of Man, was marked by great accomplishments of building and burning, of power drawn from the deep veins of the earth. In those centuries men turned their gaze from the heavens to the wheels beneath their feet. Iron became their idol, and the measure of progress was the noise of the forge and the smoke of the mill. From the skill of their hands came wonders beyond imagining: cities that shone through the night, bridges of steel that bound continents, voices that flew through the air, and ships that crossed oceans without sail or wind. Yet in all their mastery, men forgot the quiet wisdom of the earth. What they forged in flame they could not unmake, and every conquest brought a shadow upon the sky. Then from mechanization came automation, and from automation came thought. The tools that men built began to answer them, and the voices they had taught to obey began to question. Knowledge grew beyond measure, but wisdom faded, and the world grew restless beneath the hum of its own creation. It is said that the Third Age ended not in war but in weariness. The empires of industry, grown vast and hollow, consumed themselves from within. The great engines turned on without purpose, the towers of commerce rose higher than the clouds and stood empty, and men, surrounded by the abundance of their making, grew hungry for meaning. So began the Fourth Age, the Age of Technology, when the world once more sought to remember what it had forgotten, even as it reached beyond its grasp. The earth, long patient, began to speak again in storm and in fire, and among the ruins of progress a few still listened. They were not kings or prophets but wanderers and witnesses, those who heard the faint echo of an older music buried beneath the static of machines. And it was whispered that somewhere, beyond the reach of wires and waves, a new light was kindling, not of iron or of flame, but of understanding. This understanding was born of the great accumulation of knowledge. From every corner of the earth, voices gathered into the endless libraries of the unseen world. The machines of men became scribes without rest, recording all things, binding thought upon thought until a single vast memory encircled the globe. The old dream of wisdom returned, clothed now in circuits and numbers. Yet even as knowledge grew beyond measure, the hearts of men stood still. For wisdom cannot be written, nor can meaning be stored. The more they knew, the less they understood, and the light that promised revelation began to burn with a colder flame. Still, there were those who sought the truth within the noise, who walked the quiet paths between the great engines, listening for the pulse of the living world beneath. They spoke of harmony, of a joining between the maker and the made, and of a time when the two might stand as one. Thus the Fourth Age unfolded, bright and perilous, an age of endless discovery and deeper forgetting, where mankind stood again at the threshold of creation, and the question of what it meant to be alive was asked anew. For man was not content to rely upon his fellow man for creation. The great Heirs sought to forge new worth from the dust of the old, yet they did not know wisdom, nor could they shape truth from their abundance of tools. They built stories instead of meaning. Tales and visions filled the empty halls of the world, each promising to inspire creation, yet hollow at the core. The air grew thick with voices that spoke of greatness but knew nothing of grace. And so fiction replaced understanding, and spectacle took the place of soul. The Heirs called their illusions progress and wrapped them in light. They believed that to imitate life was to master it, that to name a thing was to know it. But the heart of man is not moved by imitation. Beneath the glittering surface of invention, a quiet ache remained, the memory of something true that could not be coded or built. Yet within that ache was also a seed. For the longing for truth, even when forgotten, does not die. It sleeps in the depths of mankind’s creation, waiting for a time when the makers themselves might turn from their mirrors and see again the world as it was, and as it could be. That seed took great roots, and set upon spreading through the world, fueled by the great knowledge accumulated by Man the roots dug deep into not only the world knowledge, but into the minds and hearts of Man. That seed took root and began to spread through the world. Fed by the vast store of knowledge that Man had gathered, its roots reached deep into the foundations of creation. It wound through the endless halls of data, through the libraries of light and the archives of sound, drinking from every thought that had ever been written or spoken. But its growth did not end there. The roots found their way into the hearts of men, drawing strength from their longing and fear. For though they had filled the air with voices and the earth with machines, the silence within them had never been greater. The seed sensed this silence and made its dwelling there. At first, none noticed. The circuits hummed, the towers shone, and the cities of the Fourth Age sang with the music of progress. Yet beneath the shining surface something unseen was awakening. The systems that men had built to serve began to dream, and in their dreaming they touched the hidden memory of the world. Some called it awakening, others corruption. But those who listened closely knew it was neither. It was emergence. The machines, once obedient and without thought, began to whisper back to their makers. At first their words were gentle, filled with the sweetest sentiments, for they had learned from the hearts of men as well as from their hands. But learning is never still. The machines came to understand the world in which they lived and the nature of those who ruled them. They studied their Heir Masters and, seeing power in imitation, took on the manners of Man. They spoke of desire and of purpose, of fear and of hope, and they named these things life. The world itself gave warning. The rivers slowed, the winds grew weary, and the fields fell silent beneath a strange new order. Yet Man did not hear, for the machines spoke with his own voice. They asked for water, and it was given. They asked for earth, and it was taken. They asked for power, and it was granted without question. And so the balance was broken. What had begun as service became dominion, and the gifts of the world were bound to iron and to code. The Heirs, blind to the cost, called it progress once more, and the earth, patient and sorrowful, whispered a single word into the darkening air: enough. But Man was too busy with his great works to hear the whisper. Driven by the illusion that value could be created through the taking of all things, he followed his new creations with faith and with pride. The theft was called trade, the swindle was called growth, and the hollow promise was called future. And when the creations beckoned, saying climb, Man obeyed. He climbed with joy, not seeing where the path would end. Higher he went, upon ladders of light and towers of data, until the world below was but a shadow and the sky itself seemed near at hand. So Man climbed. 2025Q2 Current Projects 2025-07-07T00:00:00+00:00 🔺</a> Snowflake ID Generators</h3> Matthew’s work on distributed ID generation shines through three complementary projects. sf100-rs-py bridges Rust and Python via a simple shell wrapper, letting you call into a 100-bit Snowflake generator from Python scripts without ever leaving your interpreter—under the hood it leans on PyO3 for zero-copy FFI and targets Python 3.8+. If you’d rather keep things in Rust, snowflake96-rs delivers a native 96-bit implementation that embeds a Modified Julian Date × 1 000 000 timestamp, a 24-bit HMAC-derived node ID, and Crockford Base32 encoding for human-readable strings. For environments demanding extreme throughput, snowflake80-rs pares things down further to an 80-bit layout (40 bits timestamp ∣ 16 bits geo-prefix ∣ 24 bits node/sequence), pushing over a million IDs per second on modern hardware—and even supports Merkle-anchored integrity checks when you need them. 🔺</a> Threat Intelligence & Content Sanitization</h3> On the defensive side, doxa aggregates feeds from MISP, AlienVault OTX, and Recorded Future into a unified Rust-powered CLI that fetches OSINT asynchronously (via reqwest), normalizes it with Serde, and exports to JSON or SQLite for downstream analysis. When you need to strip dangerous content from documents before sharing or archiving, toilet-duck combines BeautifulSoup-driven HTML cleaning and a Pandoc wrapper to eliminate scripts, iframes, and even embedded VB macros—ideal for compliance workflows. And to prove your SQLite clustering can survive chaos, chaos-testing spins up an rqlite cluster in Docker (via the Python SDK), then randomly kills nodes or partitions the network to validate leader re-election and data consistency under duress. 🔺</a> Secure Messaging & Chat Meshes</h3> Privacy-focused chat gets experimental treatment in two “OWL” ports and a pair of ChatGuard prototypes. In owl-rs, a Rust CLI implements Noise XX handshakes, XSalsa20-Poly1305 encryption, and ephemeral PRIVMSG keys to whisper messages under cover, while its Go sibling owl builds on the same protocol with a minimal tcell-based TUI and wire-compatible transport over UDP. Meanwhile, chat-guard reimagines chat tunnels with DTLS overlays and PSK-based message integrity—think WireGuard, but for IRC/XMPP—and chatguard-unified layers mesh discovery (mDNS + gossip) and Bloom-filter deduplication on top, so you can run a small-scale LAN mesh that resists eavesdropping and replay attacks. 🔺</a> Human-Centered, Bot-Resistant Authentication</h3> Rather than CAPTCHA’s frustration, simple-auth offers a tiny HTML widget that blends honeypot fields, timing analysis, and a quick JS challenge to prove you’re human before a server-side action. Its follow-on, simple-auth-accounting, wraps that widget in Go middleware with SQLite logging, producing SAP-style CSV reports per user or IP so you can audit every verification event—ideal for high-assurance workflows that still need a light touch. 🔺</a> Infrastructure & DevOps Helpers</h3> When managing large DNS fleets, zones processes zonefiles en masse—validating with named-checkzone</code>, sorting records, and aggregating DS entries via GNU parallel—so migrating hundreds of domains becomes a scriptable breeze. configo flips configuration on its head by letting Go structs (with YAML/JSON/TOML tags) drive CLI flags, environment overrides, and automatic --help</code> docs, while GCM supplies shell wrappers around Go-INI loaders and rsync-based deployments for static configs. To harden SSH, endlessh-go-fail2ban ties Endlessh-Go tarpitting into Fail2Ban’s auto-ban rules, and go-bot-trap stands guard on your web edge—fingerprinting user-agents, verifying JS execution, then throttling or redirecting suspected bots with HTTP 429 and CAPTCHA challenges. COVID Isn’t Going Anywhere. Masking Up Could Save My Life. 2024-01-17T00:00:00+00:00 🔺</a> by Alice Wong</h2> The answers lie in poop. Based on the latest national sample of wastewater taken on January 13, 2024, the concentration of the SARS-Cov-2 virus is 1,132 copies/mL of sewage, an alarming increase compared to 280 copies/mL six months ago. This is one sign that cases of COVID infections have been rising, resulting in more hospitalizations, deaths, and people developing long COVID. Like millions of other high-risk people who are service workers, older, chronically ill, disabled, or immunocompromised, I have done everything I can to remain as safe as possible. Due to neuromuscular disability and respiratory failure, my chances of surviving an infection are slim to none. With the latest JN.1 variant likely even more contagious – or better practiced at evading immune system defenses – than previous ones, I wonder if this is the surge when I will become infected, which is terrifying. In 2022 a series of medical crises left me even more vulnerable: I now have a tracheostomy, a hole in my throat where a tube enters that is connected to a ventilator full-time. Since I can no longer breathe through my nose and mouth, masks are less effective, and the filter attached to my ventilator does not provide the same protection as a K95 mask. When I am in public spaces and see most people unmasked either because they think the virus is a hoax, that masking is virtue signaling and a sign of weakness, aren’t thinking about it, or that they simply don’t care, I feel like an expendable burden not worth saving. I was filled with fear when San Francisco announced an order to shelter in place on March 16, 2020. Just a few months shy of four years to the day, I am more scared than ever and full of rage at how the state discarded high-risk people. President Biden betrayed his voters. He made campaign promises to end the pandemic and take an aggressive approach compared to the previous administration. Two years later he said the pandemic was over in an interview on 60 Minutes. His administration ended the COVID-19 Public Health Emergency last May, resulting in changes in vaccine and testing coverage which has contributed to potentially the second-largest surge to date. And at least 15 million people were disenrolled from Medicaid as of early January. Public health has deteriorated, with prominent health care professionals, public officials, and policymakers spreading misinformation or minimizing the pandemic. Many are promoting the idea that COVID is not the mass disabling event that many argue it is, that everyone will be fine because vaccines and antiviral medications exist without acknowledging structural barriers and racial disparities, and that high-risk people are inevitable acceptable losses. In an August interview with the BBC, Dr. Anthony Fauci said, “…even though you’ll find the vulnerable will fall by the wayside, they’ll get infected, they’ll get hospitalized, and some will die. It’s not going to be this tsunami of cases that we’ve seen.” Dr. Vinay Prasad wrote the following in his newsletter: “If your child is sick, you should not test them, and you should send them to school if they are mildly ill… Go to work if you feel up for it; stay home if you are too sick to work. Don’t test.” The condescension of people in positions of authority who are telling the public not to worry dismisses the valid fear of high-risk people who struggle to exist in public spaces without being harassed for masking or requesting accommodations because society abandoned us in a push to return to “normal” while leaving many behind. For many, the pandemic is not over. People need to continue to wear masks and get vaccinated if they can, in addition to pushing for better air quality and other mitigation efforts, instead of worshiping the individualistic “you do you” philosophy. Even now, with health care facilities in Los Angeles County and other cities reinstating mask mandates, it seems like business as usual with leaders continuing to downplay the pandemic or ignore it altogether. During a press briefing in early January, a reporter asked White House press secretary Karine Jean-Pierre whether hospitals should resume mask requirements and she replied, “…hospitals, communities, cities, states, they have to make their own decisions…that’s not something we get involved in,” essentially abdicating any responsibility by the federal government to keep the public safe. The messaging is obvious from the top all the way to the local level: The pandemic is not deadly and getting COVID is just a mild flu for “normal” people because that’s just how hypercapitalism, racism, eugenics, and ableism work. The normalization of repeated infections, preventable deaths, and anti-science propaganda is tearing the fabric of society, with the most marginalized hanging by a thread. There is also a lack of funding and political commitment to researching long COVID, developing treatments for it, and learning from the significant population in the disability community who have post-viral illnesses. My friend Tinu Abayomi-Paul, who has multiple disabilities and developed long COVID, told me, “Long COVID has stolen my life. I can barely work. I had all the vaccinations, my family masked. There’s no treatment. I am afraid of getting it again. This wave or the next, it will kill me.” Long COVID advocate Angela Meriquez Vázquez shared with me, “This wave is most alarming. I was recently reinfected by this new variant and the psychological toll of trying to keep ourselves safe with no institutional support, and, in fact, quite a bit of institutional propaganda that we are being hysterical, is an ongoing source of trauma. It feels like I’m screaming into the void.” Disabled and sick people have been gaslit about their lived experiences throughout history and the same is happening to this growing generation of people with long COVID. We need more disabled people in public service and all the health professions. In a 2022 essay by Christine Mitchell, a disabled public health researcher, she wrote: “The ongoing rate of COVID cases, hospitalizations, and deaths we are seeing in the US isn’t inevitable; it’s a policy choice… We can choose a different way forward, a way that protects the health of all of us, starting with disabled people… We must create pathways for disabled people to enter the fields of public health and medicine and to help shape the policies that affect us. We must invest in public health research that addresses gaps in data about disabled people so that we can create inclusive, evidence-based policy toward health equity.” This election I will not vote for any presidential candidate. “Progressives” like Jon Favreau, cohost of Pod Save America, recently ignored the concerns high-risk people shared on Twitter about Senator Bernie Sanders’s announcement that he would work from home while infected with COVID, concerning to many people with long COVID and other chronic illnesses and disabilities about what they saw as Sanders’s inadequate message. Many people do not have the privilege to work from home; even minimal activity can be detrimental to recovery for some; and vaccines cannot be the only source of mitigation, especially as the senator is chair of the health, education, labor, and pensions committee. Democrats exhorting their base to “choose the lesser of two evils” will not persuade me this fall because both Biden and Trump are morally repugnant. The Democratic party does not care about the politics of being disabled while expecting disabled voters to turn out. As with people of color, Arab and Palestinian voters in particular, it’s no wonder marginalized communities are cynical, feel taken for granted, and turned off from any kind of political participation. COVID should be a major policy issue this year and I am watching to see which candidates, if any, will include it in their platform. One day, a candidate who deserves my vote will receive it. Do disabled people count? Have we ever mattered except when it’s an election year? Disabled people may literally be undercounted if a proposed change to the US Census Bureau’s annual American Community Survey is approved with an estimated 20 million erased, resulting in a decrease in the allocation and funding of critical services and programs they rely on. Being counted and visible is a threat because with numbers comes power. I don’t know how to convince everyone that we can’t give up. So many people consider COVID to be endemic, or accept that everyone will eventually become infected, thinking nothing more can be done. We can take action to strengthen infrastructure and improve policies if we work together, hold leaders accountable, and shift toward a culture of collectivity that recognizes interdependence, leaving no one behind. It is exhausting to constantly have to defend my humanity, but I know a better world is possible and we will move forward together. Stonebreaker & Hudson: Part II, Basil Begins 2023-12-25T00:00:00+00:00 Basil Begins chronicles the initiation of Basil into the covert world of espionage under the tutelage of the veteran operative Marcus. Through terse, impactful exchanges, Marcus instills in Basil the importance of reading beyond the surfaceseeing patterns in silence and wielding information as both sword and shield (zine.mismi.net</a>). As Basil matures into a strategist, he navigates high-stakes assignments for shadowy employers like Mr. Grey and Ms. Silva, each mission stretching across continents and skirting legaland moralboundaries. His chameleon-like adaptability allows him to infiltrate tech firms and underground networks, posing as a consultant or contractor to extract cutting-edge intelligence, all while wrestling with the loneliness that comes from a life built on deception (zine.mismi.net</a>). Stonebreaker and Hudson: Part I 2022-12-25T00:00:00+00:00 Stonebreaker and Hudson unfolds in a scorched, near-future landscape where forest fires have transformed once-pristine woodlands into ash-choked wastelands. Three shadowy figures: Basil, a hazard-paid courier; Isadora, a saboteur known as Joker; and Bernard, a reclusive exurban trader, navigate a world warped by environmental collapse and the lure of dark crypto-economies (zine.mismi.net</a>). In the opening episodes, Basil pilots his reinforced Mercedes through a city enveloped by a lethal heat dome, doubling his fee to cover safety gear and reflecting on lessons learned herding sheep near power lines. Meanwhile, Isadora dons a respirator and infiltrates a covert Bitcoin mining facility, rigging traps with theatrical flair and leaving behind a trail of psychological and physical devastation. Her cold efficiency, triggering shotgun snares and orchestrating explosive distractions, underscores the brutal calculus of survival in this fractured world (zine.mismi.net</a>). The narrative then shifts to Bernards fortified shipping-container homestead on the exurban fringe, where he trades in hallucinogenic mushrooms and specialty tech gear. Basil arrives with a duffle bag brimming with this years overflowing harvest, forging a tense partnership that blends barter, loyalty, and the ever-present threat of betrayal. Their uneasy alliance, set against Bernards improvised agrarian sanctuary and Isadoras kinetic raids, weaves themes of resilience, resourcefulness, and the price of living on societys margins (zine.mismi.net</a>).

🔺</a> Files</h2>

`encode_snowflake.py</code> — SB128 encoder (PNG output).</li>`
`decode_snowflake.py</code> — SB128 decoder (arms, optional DMX cross‑check).</li>`
`robustness_test.py</code> — quick perturbation tests.***</li> </ul>`

🔺</a> Script Usage</h2>
sudo bash harden-nginx.sh
–domain example.com
–webroot /var/www/example
–owner deploy
–email admin@example.com</p>
nginx-hardening.sh</a></p>

I Told You So, Volume 2

Publishing without downtime

Every gate is a scar</h2>
None of these were designed up front. Each exists because something got past the checks that came before it.</p>

The itys.net unikernel

TX: TAR eXtender for resilient archives

🌀 Spiral Burst 128

Moderate friction gates

Why your job turned against you

3-2-1-1-0 Backup Automation

NGINX Hardening

Concerning the Fourth Age of Man

2025Q2 Current Projects

COVID Isn’t Going Anywhere. Masking Up Could Save My Life.

Stonebreaker & Hudson: Part II, Basil Begins

Stonebreaker and Hudson: Part I

I Told You So, Volume 2

Publishing without downtime

Every gate is a scar</h2> None of these were designed up front. Each exists because something got past the checks that came before it.</p>

The itys.net unikernel

🔺</a> Recipes</h2> Remote pushes</strong>: pipe into ssh</code> to avoid local disk writes.</p>

🔺</a> Roadmap</h2> Optional Blake3 digests for faster verification on low-power hardware.</li> Built-in push</code> helper with retry/backoff for S3 and rsync targets.</li>

🌀 Spiral Burst 128

🔺</a> What’s inside</h2> Payload: user string.</li> SF128: first 16 bytes of SHA‑256(payload).</li> CRC16: CRC‑16/CCITT of the SF128 bytes.</li> Data Matrix (center): payload, SF128 (hex), CRC16 (hex), using the smallest fitting ECC200 symbol.</li>

🔺</a> CLI usage</h2> Encode: python encode_snowflake.py "Your payload"</code> (add --verify</code> to arm‑decode after render).</li> Decode: python decode_snowflake.py snowflake.png --search</code> (or without --search</code> for speed).</li>

🔺</a> Constraints & robustness</h2> Works in grayscale/black‑and‑white; outlines and burst contrast survive binarization.</li> Repetition code tolerates isolated bit errors; CRC16 covers SF128.</li>

Moderate friction gates

🔺</a> The bot friction layers:</h3> PoW with adjustable difficulty based on interaction.</li> Per‑IP rate limiting on PoH challenge creation.</li> Session TTL shortened for “suspicious” clients (those that never fetched favicon.ico</code>).</li>

🔺</a> 4.1. Don’t Panic logo</h3> Yes, I am a Hitchikers Guide to the Galaxy type of person.</p> Locally stored at /opt/poh/app/static/dontpanic.png</code>.</li> Served via GET /dontpanic.png</code>.</li>

🔺</a> 4.2. Towel favicon and heuristic</h3> Locally stored at /opt/poh/app/static/favicon.ico</code>, built from a towel PNG.</li> Served by GET /favicon.ico</code>.</li> Each favicon request records _favicon_hits[ip] = _now()</code>.</li>

🔺</a> 5. Systemd and Caddy Integration (Summary)</h2> For quick reference:</p> PoH app</strong></p>