{ "version": "https://jsonfeed.org/version/1.1", "title": "Christian Lehnert — Linux, Hacking \u0026 Faith", "home_page_url": "https://blog.c0xl.ch/rss", "description": "Personal blog of Christian Lehnert (c0xl).", "author": { "name": "Christian Lehnert — Linux, Hacking \u0026 Faith" }, "authors": [ { "name": "Christian Lehnert — Linux, Hacking \u0026 Faith" } ], "items": [ { "id": "", "url": "https://blog.c0xl.ch/p/netbird-subnet-routing", "title": "NetBird Part 4 - Reaching the Things That Cannot Run the Agent", "summary": "Part four of the NetBird series. The mesh only covers machines running the agent, but plenty of things cannot run it - a NAS, a printer, a legacy appliance, a whole cloud subnet. A routing peer bridges them in. The important 2026 change is that Networks replaced the old Network Routes and fixed the ACL caveat from part three by making access per-resource policy. Plus high availability, source-IP preservation, and exit nodes.\n", "date_published": "2026-10-17T22:08:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/sops-age-secrets-in-git", "title": "Secrets in Git, Done Right", "summary": "When you genuinely have a secret and your whole workflow is git, where does it live? Not plaintext in the repo, not a gitignored file passed around Slack. SOPS with age encrypts the values, commits the ciphertext, keeps git diffs readable, and decrypts only at the point of use. age gives modern key management without the PGP misery; SOPS gives the value-only, multi-recipient, git-friendly workflow. A team's access model becomes a reviewable list of public keys. Plus when SOPS beats Vault and the one thing you must not get wrong.\n", "date_published": "2026-10-14T19:15:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/terraform-opentofu-state", "title": "Terraform or OpenTofu", "summary": "Two questions get tangled in infrastructure-as-code, and only one is hard. Which tool, Terraform or OpenTofu, is easy - for new work in 2026 use OpenTofu, open-source license, community governance, drop-in compatibility, and move on. The hard part, identical for both because they share a design, is state - the memory that makes declarative infra work and the most dangerous file you own. Here is what state is, the three ways it bites (wrong place, concurrent writes, drift), and why it holds your secrets in the clear.\n", "date_published": "2026-10-10T22:21:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/netbird-access-policies", "title": "NetBird Part 3 - Access Policies, or RBAC for Your Network", "summary": "Part three of the NetBird series. A fresh mesh is flat - every peer reaches every other peer on every port, which is wrong to depend on. Access policies fix it, and the model is RBAC for your network - deny by default once you delete the starter policy, allow-only rules, groups as the unit of access with users as source and infrastructure as destination, and setup keys that auto-assign groups. Plus the two sharp edges (same-group peers always reach each other; subnet routes can bypass access control) and posture checks for real zero trust.\n", "date_published": "2026-10-06T19:49:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/azure-managed-identities", "title": "Azure Managed Identities", "summary": "The most dangerous thing in most Azure setups is a stored secret - it leaks, nobody rotates it, and an attacker finds it months later. Managed identities delete it, because the identity becomes the credential and your code gets short-lived tokens by proving what it is. Inside Azure that is one toggle and a scoped role; across the boundary, Workload Identity Federation lets GitHub Actions and Kubernetes authenticate to Azure over OIDC with no stored secret at all. Here is how both work, and the caveats that replace secret rotation.\n", "date_published": "2026-10-03T21:52:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/aca-sandboxes-vs-tankos-docker", "title": "Where Should Agent Code Run", "summary": "An AI agent writes code, and now you have to decide where it runs, because in your process a single prompt injection reaches everything. Three answers sit at three points on the one axis that matters, isolation strength - plain Docker (thin shared-kernel wall), my tank-os-with-llms container (that thin wall hardened, self-hosted), and Azure Container Apps Sandboxes (thick hardware-backed microVM, cloud-managed). Isolation strength and ownership pull against each other, and here is how to pick.\n", "date_published": "2026-09-29T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/postgres-pitr", "title": "PostgreSQL PITR - Point-in-Time Recovery With WAL Archiving", "summary": "A nightly pg_dump at 4am means that when prod dies at 3pm you lose eleven hours of data, and there is nothing you can do about it. Postgres already writes down every change as it happens in the WAL. Archive that continuously on top of a base backup and you can recover to any second, including the moment right before someone ran the bad command. That is PITR, and it is the difference between an outage and a catastrophe. With the two numbers, RPO and RTO, that should drive the whole decision.\n", "date_published": "2026-09-28T13:21:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/patching", "title": "Patching - The Boring Control That Stops Most Breaches, and Why It Still Does Not Happen", "summary": "Around 60% of breaches exploit a vulnerability that already had a patch. The gap is not knowledge, it is deployment, and it stays open because patching genuinely breaks things, there are too many patches, CVSS points at the wrong ones, and nobody owns the forgotten systems. The way through: prioritize by what is actually being exploited (the CISA KEV catalog, not raw severity), tier your response by exposure, automate the boring low-risk majority, and know what you run, because you cannot patch what you forgot you own.\n", "date_published": "2026-09-26T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/humans-should-not-be-able-to-delete-prod", "title": "If a Human Can Delete Prod, That Is the System's Fault, Not the Human's", "summary": "When someone deletes production, the room asks who did it. That is the wrong question. If one person at one terminal with one wrong command can destroy prod, the system that granted that power with no guardrail is the failure, not the human, who is only the last link in a chain of missing controls. Here is why human error is a symptom not a cause, the controls that actually prevent it (least privilege, deletion protection, two-step destructive ops, environment isolation, separate-account immutable backups), and using chaos engineering to test the guardrails before reality does.\n", "date_published": "2026-09-24T11:45:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/worm-immutable-storage", "title": "WORM - When You Actually Need Write-Once Storage, and When a Hash Chain Is Enough", "summary": "WORM (Write Once Read Many) storage cannot be altered or deleted after writing, even by an administrator, which makes it the right tool for audit logs, regulated financial records, and ransomware-resistant backups. But it confuses two different promises - write-prevention (the storage lock) and integrity-proof (a hash chain). Most tamper-proof-log requirements need only the hash chain, which is cheaper and independently verifiable. Here is when to reach for real WORM, the irreversible compliance-mode trap, and the GDPR conflict to design around.\n", "date_published": "2026-09-22T21:22:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/its-always-dns-md", "title": "It Is Always DNS - Why, and How to Actually Prove It", "summary": "It's always DNS stays true because DNS underlies every connection, fails as some other layer's error, and returns wrong answers without ever reporting one. The confusion is almost always caching: many independent caches, each with its own TTL, expiring on its own clock.\n", "date_published": "2026-09-19T22:03:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/netbird-self-hosting-control-plane-md", "title": "NetBird Part 2 - Standing Up Your Own Control Plane", "summary": "Part two of the NetBird series. What the self-hosted control plane is actually made of - management as the brain, signal as the introducer, relay as the NAT fallback, a dashboard, and an identity provider. The big 2026 change is that NetBird now ships an embedded IdP, so you no longer have to stand up Zitadel just to get started. Plus what you have to provide, why the relay is what breaks, and how peers join with setup keys.", "date_published": "2026-09-15T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/your-agent-has-your-keys-md", "title": "Your Agent Has Your Keys", "summary": "People install Claude Code, Codex, and Cursor in five minutes and never ask what the thing can actually reach. The answer is everything you can - your files, your network, your keys. The documented 2026 attacks are mundane, a JSON config in a cloned repo that runs commands before the trust dialog, a crash report that smuggles a shell command through a tool you trust. Here is the real threat model and how to bound it, up to my tank-os-with-llms box.\n", "date_published": "2026-09-12T22:24:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/renovate-ansible-md", "title": "Renovate for Ansible - Stop Hand-Bumping Your requirements.yml", "summary": "The versions pinned in your Ansible requirements.yml go stale and bumping them by hand never happens on time. Renovate's built-in Ansible manager reads requirements.yml, watches your collections and roles, and opens one PR per update so CI checks each bump before you merge. Small to set up, with one git-tag-prefix trap to avoid.\n", "date_published": "2026-09-08T12:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/kube-bench", "title": "kube-bench - Score Your Cluster Against the CIS Benchmark in One Job", "summary": "kube-bench runs the CIS Kubernetes Benchmark against your cluster and tells you, check by check, where the configuration falls short of the hardening baseline. It is one job to run, it is free, and every cluster should be scored by it at least once. It also has a clear limit worth understanding before you trust a green result.\n", "date_published": "2026-09-01T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/claude-text-watermark", "title": "Claude's Invisible Watermark - What It Actually Proves", "summary": "Since early August, Claude embeds an invisible watermark in the text it generates, driven by the EU AI Act. It survives copy-paste, not paraphrase, and it proves one thing that most of the reaction gets wrong: that Claude processed the text, never that Claude wrote it. Which is the right frame for writing with AI at all, use it to turn knowledge into prose, and verify every claim it hands you yourself.\n", "date_published": "2026-08-18T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/kubernetes-init-containers", "title": "Init Containers - Run Something First, Then Get Out of the Way", "summary": "An init container runs to completion before your app container starts, and only then does the app run. It is the clean place for setup that must happen first and must succeed. It is also reached for far too often, for things that belong in the image, in the app, or nowhere. Here is what it is for, what changed with native sidecars, and when not to use it.\n", "date_published": "2026-08-13T20:25:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/close-the-loop-ai-code-review", "title": "Close the Loop - Let the AI Review Its Own Code Before You Do", "summary": "Most people run an AI to write code and then review the output by hand. The step almost nobody adds is the feedback loop - let the CI pipeline produce a report, hand it back to the AI, and let it fix its own mistakes on the feature branch before a human ever looks. It cuts the amount of AI code you have to review by a lot, because the model catches its own garbage first.\n", "date_published": "2026-08-08T22:32:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/kubernetes-authentication", "title": "Kubernetes Authentication - There Are No Users", "summary": "The one fact that makes Kubernetes authentication click - there is no user object. The API server never stores users. It only verifies a credential from outside and reads a name off it. Once you know that, the whole model stops being confusing.\n", "date_published": "2026-08-06T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/drop-authorized-keys", "title": "SSH Certificates - The authorized_keys Habit You Should Have Dropped Years Ago", "summary": "Everyone learns SSH keys and stops at authorized_keys. That is exactly the part that does not scale and cannot be revoked cleanly. SSH has had a certificate authority for over a decade that fixes both, kills the host-key TOFU prompt, and gives every login an expiry. Almost nobody uses it. Here is why you should.\n", "date_published": "2026-08-04T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/auditd-when-and-why", "title": "auditd - The Log That Tells You Who Deleted the File", "summary": "A symlink vanishes and the normal logs say nothing. syslog and the journal record what programs choose to say. auditd records what the kernel actually did in the syscall path. That is why it names the culprit, and why it only works if you turned it on first.\n", "date_published": "2026-07-30T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/debugging-kubernetes", "title": "kubectl debug", "summary": "Distroless images ship no shell, so kubectl exec fails the moment you need it. kubectl debug injects an ephemeral container with its own tools into the running pod, shares the target's namespaces, and lets you read the app's filesystem through /proc — no restart, no debug build. Here it is end to end on a distroless nginx.\n", "date_published": "2026-07-28T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/jwt-for-sessions", "title": "JWT for Sessions", "summary": "At some point JWTs became the default answer to \"how do I keep a user logged in.\" For most applications it was the wrong choice. A JWT's headline feature is that the server does not remember it, which is the same sentence as \"the server cannot forget it\" — so you cannot revoke a session when you need to. Add the algorithm confusion attacks the format invites, and the boring opaque session cookie turns out to be safer, simpler, and revocable for anything that does not need stateless cross-boundary verification.\n", "date_published": "2026-07-23T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/best-n-selection", "title": "Stop Shipping Lucky Training Runs - Best-of-N Selection With a Non-Negotiable Gate", "summary": "Small classifiers swing by several points of accuracy between training runs, purely from nondeterminism. Most people train once and ship whatever they got. Training K seeds and selecting is the fix, but selection is where people quietly cheat by maximizing accuracy. The discipline is to pick one metric you refuse to compromise on, gate on it, and compute that gate as the minimum across every eval set you have.\n", "date_published": "2026-07-16T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/appreciate-your-package-manager", "title": "Appreciate Your Package Manager", "summary": "Building Linux From Scratch means living without a package manager for the duration, and the absence teaches you what the presence was doing all along. apt install is one command. Underneath it is dependency resolution, ordering, conflict detection, file tracking, and clean removal, all of which you do by hand under LFS, and all of which you stop noticing the moment you have a package manager to do them for you.\n", "date_published": "2026-07-14T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/fairphone-as-a-desktop", "title": "Ubuntu Touch Convergence - The Fairphone as a Desktop", "summary": "The follow-up to running Ubuntu Touch on a Fairphone 4 is the feature that actually distinguishes it from every mainstream phone. Plug the phone into a monitor over USB-C, pair a Bluetooth keyboard, and the phone becomes a desktop computer. The phone's own touchscreen then works as the trackpad. This is convergence, and once it works, it changes what the phone is for.\n", "date_published": "2026-07-09T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/bcachefs", "title": "bcachefs - The Best Filesystem Design That the Kernel Threw Out", "summary": "bcachefs is, on technical merit, the most interesting copy-on-write filesystem to arrive on Linux in a decade. It is also, as of Linux 6.18, no longer in the kernel, ejected after a governance dispute between its author and Linus Torvalds and now shipping as a DKMS module like ZFS. This is the story of a filesystem whose engineering and whose politics point in opposite directions, and what that means for anyone deciding whether to run it.\n", "date_published": "2026-07-07T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/ip-br", "title": "ip -br - The Clean Way to Read Interface State", "summary": "Plain ip link and ip addr dump a wall of text for every interface, most of it irrelevant when you just want to know what is up and what has an address. The -br flag collapses each interface to a single line, and it is the version you should be reaching for on every troubleshooting call.\n", "date_published": "2026-07-03T12:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/halt-vs-shutdown", "title": "halt vs shutdown - The Case for the Simpler Command", "summary": "shutdown is the command operators reach for out of habit when they want to bring a system down. For the common case (a single-user workstation, a headless server, an ad-hoc maintenance window), halt does the same orderly shutdown with less ceremony and a simpler invocation. The reason shutdown won the muscle memory is historical and no longer applies on modern systemd systems.\n", "date_published": "2026-06-25T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/freebsd-rc-system", "title": "FreeBSD's rc System", "summary": "FreeBSD's rc system is the init mechanism that has aged best in the Unix world. It uses ordered shell scripts, a clean configuration hierarchy, and a dependency resolver that handles the ordering problem without numbered runlevels. This post walks through how /sbin/init reaches /etc/rc, how the configuration files in /etc/defaults/rc.conf and /etc/rc.conf and /etc/rc.conf.local compose, and where your own scripts belong on a properly maintained FreeBSD system.\n", "date_published": "2026-06-20T22:45:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/adduser-perl", "title": "adduser vs useradd - The Debian Trap", "summary": "On Debian and Ubuntu, two commands look like they do the same thing. They do not. adduser is a Perl wrapper from the adduser package. useradd is the raw binary from upstream shadow-utils. The difference catches operators who write portable scripts and expect either name to work the same way on RHEL or Alpine.\n", "date_published": "2026-06-18T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/expert-install-debian", "title": "Why I Use the Debian Expert Install - The Defaults You Did Not Know You Accepted", "summary": "The default Debian installer is competent. It is also opinionated. It makes a dozen choices on your behalf that you would probably make differently if you knew you were making them. The Expert Install is not for elite users. It is for anyone who wants to know what their system actually contains the moment after first boot.\n", "date_published": "2026-06-11T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/docker-run-init", "title": "docker run --init - The Flag You Should Use on Every Container", "summary": "PID 1 in Linux has special responsibilities that most application processes are not designed to handle. The --init flag in Docker inserts a tiny init process between PID 1 and your application, which solves the zombie reaping problem and the signal forwarding problem in one line.\n", "date_published": "2026-06-06T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/gemini-cli-hook-cve", "title": "The Trust Boundary You Did Not Know You Had - Configuration Files, Pull Requests, and the Gemini CLI Hook CVE", "summary": "Modern pull request review is built on a clean trust boundary. Code in the PR is untrusted until reviewers approve it. Configuration in the PR is treated as ambient context, more or less along for the ride. The Gemini CLI hook CVE that landed in May 2026 made it", "date_published": "2026-05-19T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/bash-tip", "title": "Bash !$ for Safer File Deletion", "summary": "The bash !$ history expansion substitutes the last argument of the previous command which turns destructive operations like rm into a two-step ritual where the first step is always a preview.", "date_published": "2026-05-14T20:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/ansible-at-scale", "title": "Ansible at Homelab Scale - How Two Critical Debian CVEs Became a Non-Event", "summary": "When CVE-2026-31431 dropped on April 29 with a public proof-of-concept and no vendor patches available, every Linux machine in the homelab was affected. Two weeks later the OpenSSH GSSAPIKeyExchange flaw shipped as DSA-6204-1 and the question arose again. This post is the short writeup of how Ansible turned both incidents into routine work.", "date_published": "2026-05-14T09:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/ebpf-hello-world", "title": "Beginning with eBPF - Hello World and What Actually Happens When You Trace a Syscall", "summary": "eBPF is the most interesting thing to happen to the Linux kernel in the last decade and one of the least understood.", "date_published": "2026-05-12T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/fortigate-one", "title": "Day One with the FortiGate 100F - Adding a Real NGFW to a MikroTik-Native Homelab", "summary": "The FortiGate 100F arrived this week and slots into the homelab between the Fritz!Box modem and the MikroTik core router, adding real next-generation firewall capability to a routing-strong but inspection-light architecture.", "date_published": "2026-05-09T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/brave-origin-linux-nyxt", "title": "Brave Origin on Linux - What a Nyxt User Actually Sees", "summary": "Brave Origin's architecture from a Nyxt user's perspective.", "date_published": "2026-04-23T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/endlessh-go-strato-vps-ssh-tarpit", "title": "Trapping SSH Attackers with endlessh-go on a VPS", "summary": "Running endlessh-go as a Docker container on Strato VPS, deployed via Ansible", "date_published": "2026-03-10T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/cisco-wlc-2504-aironet-3600-homelab", "title": "Enterprise Wireless on a Budget - Cisco WLC 2504 and Aironet 3600 in a Homelab", "summary": "Running Cisco WLC 2504 and Aironet 3600 access points in a homelab for under 300 CHF", "date_published": "2026-02-02T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/crowd-psychology-pro-palestine-protests-pro-israel-analysis", "title": "Understanding Pro-Palestine Demonstrations Through the Lens of Crowd Psychology", "summary": "Analyzing pro-Palestine protests through Le Bon’s crowd psychology lens.", "date_published": "2025-10-03T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/address-space-translation", "title": "Address Space Translation", "summary": "Demystifying address space translation for Linux and OS geeks", "date_published": "2025-09-22T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/base-bound-protection", "title": "Base and Bound Protection", "summary": "Exploring base and bound memory protection", "date_published": "2025-09-21T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/believe-in-god-our-savior", "title": "Why Believing in God Matters", "summary": "Faith in God unites, guides, and saves humanity.", "date_published": "2025-09-20T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/dynamic-repetition-jewish-faith-reflection", "title": "Reflection on Gilad Sharvit’s Dynamic Repetition", "summary": "Sharvit’s study enriches Jewish faith and messianic hope.", "date_published": "2025-08-30T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/gods-presence-in-daily-life", "title": "Finding God in the Everyday", "summary": "God reveals Himself in life’s everyday moments.", "date_published": "2025-08-18T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/god-protects-those-who-cannot-protect-themselves", "title": "Finding Strength in Hashem’s Protection", "summary": "Divine shelter when human strength falls short.", "date_published": "2025-02-04T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/faith-saves-from-lifes-darkness", "title": "How Believing in God Shields Us From Life’s Storms", "summary": "Faith in God shields us from life’s struggles.", "date_published": "2024-11-19T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/dont-use-kali-daily", "title": "Don’t Use Kali Linux as Your Daily Driver", "summary": "Kali Linux isn’t meant for daily use", "date_published": "2024-09-25T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/elevations-rosenzweig-levinas-jewish-faith", "title": "The Height of the Good in Rosenzweig and Levinas", "summary": "Rosenzweig and Levinas uplift Jewish faith through goodness.", "date_published": "2024-08-30T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/a-consice-guide-to-borderline", "title": "A Personal Reflection on Joel Paris`s Borderline Guide", "summary": "Learning to support my wife through BPD compassionately.", "date_published": "2024-04-12T20:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/get-me-out-of-here-rachel-reiland-md", "title": "Reflections on Rachel Reilands Powerful Memoir", "summary": "Learning from Rachel Reiland to support my wife.", "date_published": "2024-02-02T21:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/asking-god-before-marriage-proposal", "title": "The Moment I Turned to God Before Asking My Wife to Marry Me", "summary": "God’s blessing guided my proposal and marriage journey.", "date_published": "2023-07-15T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/halakha-for-engineers-shabbat", "title": "Halakha for Engineers - When Your Code Runs on Shabbat", "summary": "The wrong question is whether you can use a phone on Shabbat. The right question, for those of us who build the systems, is what halakhic status the work of our machines holds while we rest.", "date_published": "2023-03-03T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/chosen-people-segulah", "title": "What Chosen People Actually Means", "summary": "Two groups misunderstand am segulah for opposite reasons. Anti-Semites read it as supremacy. Interfaith softeners read it as embarrassing exclusivism to be flattened. Both readings are wrong, and the actual content is harder than either.", "date_published": "2022-12-05T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/hardened-heart", "title": "The Hardened Heart of Pharaoh", "summary": "Stubbornness becomes destiny under divine justice", "date_published": "2022-06-29T23:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/http3-quic", "title": "HTTP/3 and QUIC - What's About to Replace TCP", "summary": "QUIC is in late draft, HTTP/3 is shipping in Chrome and Firefox, and Cloudflare and Google are already serving meaningful traffic over both. The internet's transport layer is being rewritten. This is what changed, why it changed, and what it means for everyone who runs servers.", "date_published": "2020-10-18T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/caddy-v2", "title": "Caddy v2", "summary": "Caddy v2 released six weeks ago. It is not v1 with new features — it is a complete rewrite, with a new configuration model, a new module system, and a real architectural argument for why a modern web server should look different from nginx and Apache. After six weeks of running production sites on it, here is what it actually delivers.", "date_published": "2020-06-15T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/antichrist-nietsche", "title": "Exploring Nietzsche’s The Antichrist", "summary": "Exploring Nietzsche's Antichrist", "date_published": "2019-12-21T22:03:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/debian-buster", "title": "Debian 10 - What Two Years Brought", "summary": "Debian 10 released a month ago, ending Stretch's two-year run. The headline change is nftables replacing iptables as the default firewall framework. The deeper changes — secure boot, default AppArmor, Wayland coming into focus — are what will matter over the next two years.", "date_published": "2019-08-04T11:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/krack-wpa2-broke", "title": "KRACK - WPA2 Broke, and Your Linux Clients Broke Worst", "summary": "Mathy Vanhoef forced WPA2 to reinstall a key it was already using, resetting the nonce and handing an attacker the keystream. Every correct implementation was affected, and Linux managed to be affected worst of all by installing an all-zero key. Here is the handshake, the flaw, and why the link layer was never where your trust belonged.\n", "date_published": "2017-10-18T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/debian-stretch", "title": "Debian 9 - What Actually Changed", "summary": "Debian 9 Stretch released two weeks ago, ending Jessie's reign as stable. Most servers will upgrade through the year. Here is what is genuinely new, what is worth knowing before you migrate, and what is going to bite you.", "date_published": "2017-07-02T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/debian-9-reproducible-builds", "title": "Debian 9 Stretch - Reproducible Builds, MariaDB, and the eth0 That Won't Come Back", "summary": "Stretch is out, dedicated to Ian Murdock, with over 90% of packages now reproducible, MariaDB instead of MySQL, and the modern GnuPG by default. It also renames your network interfaces out from under you, which is how a routine upgrade locks you out of your own server. Here is what is worth caring about, and what to check before you reboot. \n", "date_published": "2017-06-21T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/kostolany-notebook", "title": "Timeless Wisdom from André Kostolany’s Notebook", "summary": "Wisdom on money, greed, and life’s true value", "date_published": "2017-05-16T21:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/borgbackup", "title": "BorgBackup - Encrypted, Deduplicated Backups Done Right", "summary": "Borg 1.0 has been stable since February. If your backup strategy is still rsync to an external drive, you are leaving real safety on the table. Encryption, deduplication, and compression are not optional anymore.", "date_published": "2016-11-08T11:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/dirty-cow-cve-2016-5195", "title": "Dirty COW - The Nine-Year-Old Root Bug Hiding in Copy-on-Write", "summary": "A race in mm/gup.c lets any local user write to read-only memory and rewrite setuid binaries. It sat in the kernel for nine years. Here is how the race actually works, and why \"it's only local\" was always a lie, especially now that everyone runs containers.\n", "date_published": "2016-10-21T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/git-for-homelab", "title": "Your Homelab Should Be a Git Repo - Bootstrapping Config Management With Ansible", "summary": "A brief summary of what this post is about.", "date_published": "2016-03-02T22:00:00Z" } ] }