{ "version": "https://jsonfeed.org/version/1.1", "title": "Christian Lehnert — Linux, Hacking \u0026 Faith", "home_page_url": "https://blog.c0xl.ch/rss", "description": "Personal blog of Christian Lehnert (c0xl).", "author": { "name": "Christian Lehnert — Linux, Hacking \u0026 Faith" }, "authors": [ { "name": "Christian Lehnert — Linux, Hacking \u0026 Faith" } ], "items": [ { "id": "", "url": "https://blog.c0xl.ch/p/netbird-intro", "title": "NetBird - A Self-Hosted Mesh Where Your Machines Just Find Each Other", "summary": "First in a series on NetBird. It is an open-source, WireGuard-based overlay network that connects your machines peer-to-peer, with no port forwarding, no VPN gateway, and no open inbound ports, and you can host the whole control plane yourself. solves.\n", "date_published": "2026-09-03T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/kube-bench", "title": "kube-bench - Score Your Cluster Against the CIS Benchmark in One Job", "summary": "kube-bench runs the CIS Kubernetes Benchmark against your cluster and tells you, check by check, where the configuration falls short of the hardening baseline. It is one job to run, it is free, and every cluster should be scored by it at least once. It also has a clear limit worth understanding before you trust a green result.\n", "date_published": "2026-09-01T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/run0-vs-sudo", "title": "run0 vs sudo - Escalating Privilege Without a setuid Binary", "summary": "sudo's oldest weakness is structural - it is a large setuid program that starts as root holding a process the untrusted user built. run0, from systemd 256, escalates the opposite way, by asking the already-privileged systemd to spawn a clean process with no inherited context and no setuid anywhere. Here is the real architectural difference, when it matters, and why sudo still wins for automation.", "date_published": "2026-08-29T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/minimus-hardened-images", "title": "Minimus - Near-Zero-CVE Base Images You Can Just Use", "summary": "Most of a container's CVEs live in base-image software your app never touches: the shell, the package manager, a hundred unused libraries. Minimus ships hardened distroless bases built from source with near-zero CVEs, drops in with a one-line change, and is free since June 2026. The catch is the usual distroless one: no shell, so you debug from the outside.\n", "date_published": "2026-08-27T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/phishing-resistant-mfa", "title": "Phishing-Resistant Auth - Why Your MFA Does Not Stop Phishing, and What Does", "summary": "Most MFA does not stop phishing. SMS, TOTP, and push approvals are all secrets the user can be tricked into handing over, and in 2026 the tools that trick them are a commercial service. Only one thing actually stops it: an authenticator that is cryptographically bound to the real site's origin, so it stays silent on the fake one. That is FIDO2, and it is the whole point.\n", "date_published": "2026-08-25T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/software-development-2036", "title": "How Software Development Changes From Here - Reading the Bitkom 2036 Study as a Practitioner", "summary": "Bitkom's Softwarewelt 2036 study says the same thing a lot of us have felt while working: writing code is becoming a commodity, and the value moves to judgment, domain knowledge, architecture, and trust. Here is what the study gets right, read through the eyes of someone doing the work, and the parts worth being skeptical about.\n", "date_published": "2026-08-20T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/claude-text-watermark", "title": "Claude's Invisible Watermark - What It Actually Proves", "summary": "Since early August, Claude embeds an invisible watermark in the text it generates, driven by the EU AI Act. It survives copy-paste, not paraphrase, and it proves one thing that most of the reaction gets wrong: that Claude processed the text, never that Claude wrote it. Which is the right frame for writing with AI at all, use it to turn knowledge into prose, and verify every claim it hands you yourself.\n", "date_published": "2026-08-18T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/systemd-service-hardening", "title": "systemd Service Hardening - The Sandbox You Already Have and Do Not Use", "summary": "Every service on your box runs with far more power than it needs. systemd has a full sandboxing toolkit built into the service manager that strips a service down to what it actually requires, no extra software, just directives in the unit. Almost nobody uses it. Run systemd-analyze security once and you will see why that is a problem.\n", "date_published": "2026-08-15T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/kubernetes-init-containers", "title": "Init Containers - Run Something First, Then Get Out of the Way", "summary": "An init container runs to completion before your app container starts, and only then does the app run. It is the clean place for setup that must happen first and must succeed. It is also reached for far too often, for things that belong in the image, in the app, or nowhere. Here is what it is for, what changed with native sidecars, and when not to use it.\n", "date_published": "2026-08-13T20:25:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/kubernetes-sidecar-pattern", "title": "The Sidecar Pattern - Bolting Capabilities Onto a Pod Without Touching the App", "summary": "A pod can hold more than one container, and the sidecar pattern uses that to attach capabilities to an application without changing the application. Logging, proxying, secret rotation, config watching, all bolted on beside the main container, sharing its network and storage. Here is what it is for, why it works, and when it turns into bloat.\n", "date_published": "2026-08-11T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/close-the-loop-ai-code-review", "title": "Close the Loop - Let the AI Review Its Own Code Before You Do", "summary": "Most people run an AI to write code and then review the output by hand. The step almost nobody adds is the feedback loop - let the CI pipeline produce a report, hand it back to the AI, and let it fix its own mistakes on the feature branch before a human ever looks. It cuts the amount of AI code you have to review by a lot, because the model catches its own garbage first.\n", "date_published": "2026-08-08T22:32:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/kubernetes-authentication", "title": "Kubernetes Authentication - There Are No Users", "summary": "The one fact that makes Kubernetes authentication click - there is no user object. The API server never stores users. It only verifies a credential from outside and reads a name off it. Once you know that, the whole model stops being confusing.\n", "date_published": "2026-08-06T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/drop-authorized-keys", "title": "SSH Certificates - The authorized_keys Habit You Should Have Dropped Years Ago", "summary": "Everyone learns SSH keys and stops at authorized_keys. That is exactly the part that does not scale and cannot be revoked cleanly. SSH has had a certificate authority for over a decade that fixes both, kills the host-key TOFU prompt, and gives every login an expiry. Almost nobody uses it. Here is why you should.\n", "date_published": "2026-08-04T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/kubernetes-secrets-are-not-secret", "title": "Kubernetes Secrets Are Not Secret", "summary": "A Kubernetes Secret sounds like it protects something. By default it does not. The value is base64, not encrypted, sitting in etcd in a form anyone with the right access reads in one command. The name promises confidentiality the object does not provide, and the gap is where the incident comes from.\n", "date_published": "2026-08-01T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/auditd-when-and-why", "title": "auditd - The Log That Tells You Who Deleted the File", "summary": "A symlink vanishes and the normal logs say nothing. syslog and the journal record what programs choose to say. auditd records what the kernel actually did in the syscall path. That is why it names the culprit, and why it only works if you turned it on first.\n", "date_published": "2026-07-30T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/debugging-kubernetes", "title": "kubectl debug", "summary": "Distroless images ship no shell, so kubectl exec fails the moment you need it. kubectl debug injects an ephemeral container with its own tools into the running pod, shares the target's namespaces, and lets you read the app's filesystem through /proc — no restart, no debug build. Here it is end to end on a distroless nginx.\n", "date_published": "2026-07-28T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/stop-writing-kube-yaml-by-hand", "title": "Stop Writing Kubernetes YAML by Hand", "summary": "Nobody remembers whether it is apps/v1 or batch/v1, or how deep spec.template.spec.containers nests. kubectl already knows. Let it write the skeleton with --dry-run=client -o yaml, then spend your attention on the parts that actually matter.\n", "date_published": "2026-07-25T22:38:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/jwt-for-sessions", "title": "JWT for Sessions", "summary": "At some point JWTs became the default answer to \"how do I keep a user logged in.\" For most applications it was the wrong choice. A JWT's headline feature is that the server does not remember it, which is the same sentence as \"the server cannot forget it\" — so you cannot revoke a session when you need to. Add the algorithm confusion attacks the format invites, and the boring opaque session cookie turns out to be safer, simpler, and revocable for anything that does not need stateless cross-boundary verification.\n", "date_published": "2026-07-23T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/storing-passwords", "title": "Storing Passwords - Why the Fast Hash Is the Bug", "summary": "Storing passwords is the one piece of cryptography almost every backend engineer has to get right, and the mistake is always the same: reaching for a hash function that is good at being fast. For passwords, fast is the vulnerability. The whole discipline is a story about choosing a function that is deliberately, tunably slow, and this is the 2026 version of how to get it right.\n", "date_published": "2026-07-21T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/security-by-design", "title": "Security by Design - The Phrase Is Worthless, the Practice Is Not", "summary": "The vulnerabilities I find as a pentester are almost never clever. They are structural, and they trace back to a design decision made in a meeting nobody thought was about security. Security by Design is the least useful phrase in the industry and the most useful practice, and the gap between the two is where the actual work lives. The EU Cyber Resilience Act is about to make that gap expensive.\n", "date_published": "2026-07-18T22:22:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/best-n-selection", "title": "Stop Shipping Lucky Training Runs - Best-of-N Selection With a Non-Negotiable Gate", "summary": "Small classifiers swing by several points of accuracy between training runs, purely from nondeterminism. Most people train once and ship whatever they got. Training K seeds and selecting is the fix, but selection is where people quietly cheat by maximizing accuracy. The discipline is to pick one metric you refuse to compromise on, gate on it, and compute that gate as the minimum across every eval set you have.\n", "date_published": "2026-07-16T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/appreciate-your-package-manager", "title": "Appreciate Your Package Manager", "summary": "Building Linux From Scratch means living without a package manager for the duration, and the absence teaches you what the presence was doing all along. apt install is one command. Underneath it is dependency resolution, ordering, conflict detection, file tracking, and clean removal, all of which you do by hand under LFS, and all of which you stop noticing the moment you have a package manager to do them for you.\n", "date_published": "2026-07-14T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/linux-from-scratch-again", "title": "Linux From Scratch Again", "summary": "Seven years ago I built Linux From Scratch for the first time and understood maybe sixty percent of what I was doing. Last week I built it again on 13.0-systemd, and the second build turned out to be the clearest benchmark I have of what seven years of this work actually added up to.\n", "date_published": "2026-07-11T22:40:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/fairphone-as-a-desktop", "title": "Ubuntu Touch Convergence - The Fairphone as a Desktop", "summary": "The follow-up to running Ubuntu Touch on a Fairphone 4 is the feature that actually distinguishes it from every mainstream phone. Plug the phone into a monitor over USB-C, pair a Bluetooth keyboard, and the phone becomes a desktop computer. The phone's own touchscreen then works as the trackpad. This is convergence, and once it works, it changes what the phone is for.\n", "date_published": "2026-07-09T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/perf-beyond-top", "title": "perf Beyond top - Profiling CPU, Memory, and I/O Properly", "summary": "top tells you a process is busy. It does not tell you why. The perf toolchain, plus a handful of eBPF-based tools, answer the why at the level of functions, cache misses, and individual block-device latencies. This is the advanced layer, for when the basic tools have already told you which process to look at.\n", "date_published": "2026-07-08T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/bcachefs", "title": "bcachefs - The Best Filesystem Design That the Kernel Threw Out", "summary": "bcachefs is, on technical merit, the most interesting copy-on-write filesystem to arrive on Linux in a decade. It is also, as of Linux 6.18, no longer in the kernel, ejected after a governance dispute between its author and Linus Torvalds and now shipping as a DKMS module like ZFS. This is the story of a filesystem whose engineering and whose politics point in opposite directions, and what that means for anyone deciding whether to run it.\n", "date_published": "2026-07-07T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/ubuntu-touch-on-a-fairphone-4", "title": "Ubuntu Touch on a Fairphone 4", "summary": "I run Ubuntu Touch on a Fairphone 4 as my actual phone. It is a good experience, better than the skeptics assume and worse than the enthusiasts claim. Waydroid runs most Android apps, microG handles most of the apps that expect Google services, and the one real cost is that backups do not work the way you are used to. This is the honest writeup.\n", "date_published": "2026-07-04T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/ip-br", "title": "ip -br - The Clean Way to Read Interface State", "summary": "Plain ip link and ip addr dump a wall of text for every interface, most of it irrelevant when you just want to know what is up and what has an address. The -br flag collapses each interface to a single line, and it is the version you should be reaching for on every troubleshooting call.\n", "date_published": "2026-07-03T12:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/non-human-identity", "title": "Non-Human Identity - The Larger Half of the Identity Problem Nobody Manages", "summary": "For every human in a modern enterprise there are somewhere between forty and a hundred non-human identities. Service accounts, API keys, OAuth tokens, certificates, and now AI agents. The industry has spent twenty years hardening the human identity perimeter and almost no time on the larger half. The breaches of the last year are the bill arriving.\n", "date_published": "2026-07-02T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/neko", "title": "Neko - The Self-Hosted Browser-in-a-Container That Earns Its Place", "summary": "Neko is a self-hosted virtual browser running inside Docker that streams its display to anyone with a URL via WebRTC. On paper that sounds like a curiosity. In practice it solves three operational problems I had been working around individually for years, with one tool, in one container.1\n", "date_published": "2026-06-30T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/tank-os-with-llm", "title": "tank-os-with-llms - The Hardened Container I Run Claude Code and Gemini CLI In", "summary": "After writing about Sally O'Malley's tank-os in June, the question that kept bothering me was the practical one. How do I actually run Claude Code and Gemini CLI on my own laptop without giving the agent access to the corporate VPN, the company Git server, the cloud metadata endpoint, or anything else on RFC 1918 space? The answer I built is a small Docker Compose configuration that wraps tank-os, installs both agents, and enforces a default-deny network perimeter through iptables. This post is the writeup of what I built and why each piece earns its place.\n", "date_published": "2026-06-27T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/halt-vs-shutdown", "title": "halt vs shutdown - The Case for the Simpler Command", "summary": "shutdown is the command operators reach for out of habit when they want to bring a system down. For the common case (a single-user workstation, a headless server, an ad-hoc maintenance window), halt does the same orderly shutdown with less ceremony and a simpler invocation. The reason shutdown won the muscle memory is historical and no longer applies on modern systemd systems.\n", "date_published": "2026-06-25T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/reboot-last", "title": "Reboot Last - The Windows Habit That Hurts Linux and FreeBSD Operators", "summary": "Consumer operating systems trained an entire generation of operators to reach for the reboot button as the first step of any debugging session. On Windows this is occasionally the right answer. On Linux and FreeBSD it is almost always the wrong one, because the reboot destroys the evidence you needed to fix the problem in the first place.\n", "date_published": "2026-06-23T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/freebsd-rc-system", "title": "FreeBSD's rc System", "summary": "FreeBSD's rc system is the init mechanism that has aged best in the Unix world. It uses ordered shell scripts, a clean configuration hierarchy, and a dependency resolver that handles the ordering problem without numbered runlevels. This post walks through how /sbin/init reaches /etc/rc, how the configuration files in /etc/defaults/rc.conf and /etc/rc.conf and /etc/rc.conf.local compose, and where your own scripts belong on a properly maintained FreeBSD system.\n", "date_published": "2026-06-20T22:45:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/adduser-perl", "title": "adduser vs useradd - The Debian Trap", "summary": "On Debian and Ubuntu, two commands look like they do the same thing. They do not. adduser is a Perl wrapper from the adduser package. useradd is the raw binary from upstream shadow-utils. The difference catches operators who write portable scripts and expect either name to work the same way on RHEL or Alpine.\n", "date_published": "2026-06-18T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/slow-backup", "title": "Backup at 64 KB/s - When CIFS Stops Being a Backup Protocol", "summary": "A chunk-store backup that was projected to take ten days for sixty six gigabytes. The protocol was CIFS over rsync. The fix was rclone over SFTP with parallel transfers. The same data, the same network, the same off-site target, moved 280 times faster. The reason is a protocol property that does not show up in any \"which backup software\" comparison but that decides whether your backup can actually finish before tomorrow.\n", "date_published": "2026-06-16T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/systemd-boot-instead-of-grub", "title": "systemd boot instead of grub", "summary": "GRUB has been the default Linux bootloader for two decades. For most of those decades it was the right default. On a modern UEFI system that runs exactly one operating system, it is not. The smaller, simpler, UEFI-native alternative has been mature for years and should be the choice that an engineer makes deliberately rather than the default that lands on the disk because nothing pushed back.", "date_published": "2026-06-13T22:40:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/expert-install-debian", "title": "Why I Use the Debian Expert Install - The Defaults You Did Not Know You Accepted", "summary": "The default Debian installer is competent. It is also opinionated. It makes a dozen choices on your behalf that you would probably make differently if you knew you were making them. The Expert Install is not for elite users. It is for anyone who wants to know what their system actually contains the moment after first boot.\n", "date_published": "2026-06-11T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/modern-init-scripts", "title": "Modern init Scripts - Writing Systemd Unit Files Like a Pro", "date_published": "2026-06-09T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/docker-run-init", "title": "docker run --init - The Flag You Should Use on Every Container", "summary": "PID 1 in Linux has special responsibilities that most application processes are not designed to handle. The --init flag in Docker inserts a tiny init process between PID 1 and your application, which solves the zombie reaping problem and the signal forwarding problem in one line.\n", "date_published": "2026-06-06T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/proxmox-recovery", "title": "A Proxmox Hypervisor Down - Recovery, Postmortem, and the Hardening That Followed", "summary": "This afternoon the primary Proxmox hypervisor in the homelab refused to boot. Several VMs went offline. Hours of recovery later, every service was back up and no VM data had been lost. This post is the writeup of what failed, what saved the data, and the three hardening layers that have been permanently added so that the next incident in this family does not reach the \"blind boot from a serial console\" stage.\n", "date_published": "2026-06-04T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/tank-os", "title": "tank-os - The Right Way to Run AI Agents on Linux", "summary": "Sally O'Malley at Red Hat Emerging Tech published tank-os in April 2026, a Fedora bootc image that runs AI agents as rootless Podman workloads. The architecture is small, the disciplines it composes are obvious in retrospect, and it is the cleanest available demonstration of what an agent host should look like in 2026.\n", "date_published": "2026-06-02T20:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/zombies-with-ps", "title": "Zombies with ps - You Cannot Kill What Is Already Dead", "summary": "A zombie process is already dead. kill minus nine does nothing to it. The fix is always one level up the process tree, because the bug is in the parent that failed to reap its child, never in the child itself.\n", "date_published": "2026-05-30T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/separate-your-changes", "title": "Separate Your Changes - The Kernel's Patch Rules Applied to LLM-Assisted Coding", "summary": "The Linux kernel has had a written rule about commit hygiene since before the platforms most engineers use today existed. \"Separate each logical change into a separate patch.\" The rule is currently being violated at an industrial scale by everyone using LLM assistants to write code, because the assistants produce sprawling multi-concern diffs by default. The kernel's discipline is the cleanest answer to the resulting mess, and it scales down to any project size.\n", "date_published": "2026-05-28T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/radius-of-standing-access", "title": "The Blast Radius of Standing Access - What the Spring 2026 Supply Chain Attacks Revealed About Developer Endpoints", "summary": "Between late April and late May 2026, a single threat actor compromised more than four hundred package versions across npm and PyPI, leaked source code from two AI labs and one widely-used SDK vendor, exfiltrated thousands of internal repositories from a major code-hosting platform, and open-sourced their worm under an MIT license on the same platform they attacked. The interesting question is not how. The interesting question is why the blast radius keeps reaching this size, and the answer points at a structural feature of how engineering organizations grant access to source code.\n", "date_published": "2026-05-26T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/tokenmaxxing", "title": "Tokenmaxxing - The Lines-of-Code Mistake in 2026 Clothing", "summary": "Big tech has discovered a new way to measure engineering productivity. The metric is the number of AI tokens an engineer consumes per month. It rewards the exact opposite of competent engineering, and the engineers who understand this are being systematically ranked beneath the engineers who do not.", "date_published": "2026-05-23T22:15:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/recovering-deleted-binaries", "title": "Recovering Deleted Binaries from /proc", "summary": "A binary deleted from disk while the process is still running is not actually gone. The kernel keeps the inode alive as long as the process holds it, and /proc/PID/exe is a real readable handle to it. You can copy a running program out of /proc and reconstruct it on disk byte for byte.", "date_published": "2026-05-21T08:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/gemini-cli-hook-cve", "title": "The Trust Boundary You Did Not Know You Had - Configuration Files, Pull Requests, and the Gemini CLI Hook CVE", "summary": "Modern pull request review is built on a clean trust boundary. Code in the PR is untrusted until reviewers approve it. Configuration in the PR is treated as ambient context, more or less along for the ride. The Gemini CLI hook CVE that landed in May 2026 made it", "date_published": "2026-05-19T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/stop-blaming-linus", "title": "Four Root Exploits in Three Weeks. Stop Blaming Linus", "summary": "Copy Fail, Dirty Frag, Fragnesia, ssh-keysign-pwn - four Linux kernel root exploits in three weeks. The kernel is fine. The admins are not.", "date_published": "2026-05-16T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/bash-tip", "title": "Bash !$ for Safer File Deletion", "summary": "The bash !$ history expansion substitutes the last argument of the previous command which turns destructive operations like rm into a two-step ritual where the first step is always a preview.", "date_published": "2026-05-14T20:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/ansible-at-scale", "title": "Ansible at Homelab Scale - How Two Critical Debian CVEs Became a Non-Event", "summary": "When CVE-2026-31431 dropped on April 29 with a public proof-of-concept and no vendor patches available, every Linux machine in the homelab was affected. Two weeks later the OpenSSH GSSAPIKeyExchange flaw shipped as DSA-6204-1 and the question arose again. This post is the short writeup of how Ansible turned both incidents into routine work.", "date_published": "2026-05-14T09:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/ebpf-hello-world", "title": "Beginning with eBPF - Hello World and What Actually Happens When You Trace a Syscall", "summary": "eBPF is the most interesting thing to happen to the Linux kernel in the last decade and one of the least understood.", "date_published": "2026-05-12T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/fortigate-one", "title": "Day One with the FortiGate 100F - Adding a Real NGFW to a MikroTik-Native Homelab", "summary": "The FortiGate 100F arrived this week and slots into the homelab between the Fritz!Box modem and the MikroTik core router, adding real next-generation firewall capability to a routing-strong but inspection-light architecture.", "date_published": "2026-05-09T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/shabbat-aware-homelab", "title": "The Shabbat-Aware Homelab", "summary": "Operating a homelab as an observant Jew raises questions that no modern operations manual addresses. Which jobs can run autonomously through Shabbat. Which alerts may wake me.", "date_published": "2026-05-06T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/linux-file-reading", "title": "The Art of Reading Support Files - Systematic Linux Diagnostics Before You Reach for strace", "summary": "Production debugging is not a data-gathering problem but a reading problem, because most systems have already written down what is broken if you know where to look.", "date_published": "2026-05-03T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/why-your-router-cannot-switch-isps", "title": "Why Your Router Cannot Just Switch ISPs", "summary": "Access technology lives in silicon — not software.", "date_published": "2026-04-30T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/reverse-engineering-sagemcom-fast-5370-xmo-api", "title": "Reverse Engineering ISP Hardware - Inside the Sagemcom F@st 5370", "summary": "Sagemcom's F@st 5370 hides an ISP-controlled XMO configuration backdoor.", "date_published": "2026-04-28T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/mikrotik-carrier-esim-without-mikrotik-connectivity", "title": "MikroTik 5G without MikroTik Connectivity - provisioning a carrier eSIM by hand", "summary": "Manual carrier eSIM provisioning on MikroTik 5G via LPA decoding.", "date_published": "2026-04-25T23:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/brave-origin-linux-nyxt", "title": "Brave Origin on Linux - What a Nyxt User Actually Sees", "summary": "Brave Origin's architecture from a Nyxt user's perspective.", "date_published": "2026-04-23T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/tinyauth-forward-auth-searxng", "title": "Forward-Auth for Your Homelab With Tinyauth", "summary": "Scoped forward-auth for homelab services using tinyauth.", "date_published": "2026-04-22T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/resurrecting-a-flash-card-with-f3-and-dd", "title": "Resurrecting a flash card with f3 and dd", "summary": "A 128 GB microSD started throwing ETIMEDOUT on writes. Instead of binning it, I used f3 to prove it wasn't counterfeit, then dd to force the FTL into remapping its bad blocks. The card has been healthy for two months since. A field-report on diagnosing and reviving flash storage on Linux", "date_published": "2026-04-20T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/self-hosting-searxng", "title": "Self-Hosting SearXNG", "summary": "Self-hosting SearXNG - architecture, gotchas, and threat-model honesty.", "date_published": "2026-04-12T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/mcp-server-fastmcp", "title": "Building a Public MCP Server - pdf.c0xl.ch from FastMCP to Production", "summary": "Production-grade public MCP server", "date_published": "2026-03-20T23:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/endlessh-go-strato-vps-ssh-tarpit", "title": "Trapping SSH Attackers with endlessh-go on a VPS", "summary": "Running endlessh-go as a Docker container on Strato VPS, deployed via Ansible", "date_published": "2026-03-10T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/cisco-wlc-2504-aironet-3600-homelab", "title": "Enterprise Wireless on a Budget - Cisco WLC 2504 and Aironet 3600 in a Homelab", "summary": "Running Cisco WLC 2504 and Aironet 3600 access points in a homelab for under 300 CHF", "date_published": "2026-02-02T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/wireguard-cgnat-wstunnel-websocket", "title": "WireGuard Through CG-NAT", "summary": "How to run WireGuard through CG-NAT and UDP-blocking networks by wrapping it in WebSocket with wstunnel, using a Raspberry Pi as a permanent LAN gateway and a Strato VPS as the public relay.", "date_published": "2026-01-22T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/proxmox-vrtx-megaraid-sas-fix", "title": "Installing Proxmox on a Dell PowerEdge VRTX", "summary": "Proxmox on VRTX - fix the megaraid_sas hang.", "date_published": "2026-01-14T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/osint-in-the-real-world", "title": "Practical OSINT in the Real World", "summary": "From beginner searches to disciplined OSINT practice", "date_published": "2026-01-12T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/osint-beginner", "title": "What Is OSINT? A Beginner’s Guide to Open Source Intelligence", "summary": "OSINT analyzes publicly available data to identify risks, relationships, and security-relevant insights.", "date_published": "2026-01-01T12:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/mystery-of-becoming-one", "title": "Kiddushin and the Mystery of Becoming One", "summary": "Two souls reunite through sanctified obligation", "date_published": "2025-12-31T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/crowd-psychology-pro-palestine-protests-pro-israel-analysis", "title": "Understanding Pro-Palestine Demonstrations Through the Lens of Crowd Psychology", "summary": "Analyzing pro-Palestine protests through Le Bon’s crowd psychology lens.", "date_published": "2025-10-03T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/schopenhauer-kabbalah-world-representation", "title": "Shaping Reality with Schopenhauer and Kabbalah", "summary": "Schopenhauer’s first line as mystical perception shift", "date_published": "2025-09-28T12:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/address-space-translation", "title": "Address Space Translation", "summary": "Demystifying address space translation for Linux and OS geeks", "date_published": "2025-09-22T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/base-bound-protection", "title": "Base and Bound Protection", "summary": "Exploring base and bound memory protection", "date_published": "2025-09-21T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/believe-in-god-our-savior", "title": "Why Believing in God Matters", "summary": "Faith in God unites, guides, and saves humanity.", "date_published": "2025-09-20T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/tar-notes", "title": "Your Friendly Guide to Archiving Files in Unix with tar", "summary": "My notes about tar", "date_published": "2025-09-16T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/dynamic-repetition-jewish-faith-reflection", "title": "Reflection on Gilad Sharvit’s Dynamic Repetition", "summary": "Sharvit’s study enriches Jewish faith and messianic hope.", "date_published": "2025-08-30T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/gods-presence-in-daily-life", "title": "Finding God in the Everyday", "summary": "God reveals Himself in life’s everyday moments.", "date_published": "2025-08-18T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/lenovo-thinkpads-best-laptops", "title": "Why Lenovo ThinkPads Are the Linux Power User’s Dream Machine", "summary": "Lenovo ThinkPads - durable, reliable, and built for professionals.", "date_published": "2025-07-07T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/torah-gods-love-autism-anxiety", "title": "Living with Autism and Anxiety Through the Torah’s Light", "summary": "God’s love and Torah bring peace and strength.", "date_published": "2025-06-12T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/ubuntu-windows-of-linux", "title": "Why Ubuntu Has Become the “Windows” of the Linux World", "summary": "Ubuntu’s shift - Linux freedom to Windows-like control", "date_published": "2025-05-30T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/the-sirens-dance-anthony-walker", "title": "Reflections on The Sirens Dance by Anthony Walker", "summary": "Exploring love, violence, and extremes in BPD marriage.", "date_published": "2025-03-15T21:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/god-protects-those-who-cannot-protect-themselves", "title": "Finding Strength in Hashem’s Protection", "summary": "Divine shelter when human strength falls short.", "date_published": "2025-02-04T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/faith-saves-from-lifes-darkness", "title": "How Believing in God Shields Us From Life’s Storms", "summary": "Faith in God shields us from life’s struggles.", "date_published": "2024-11-19T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/why-snap-sucks", "title": "Why I Think Snap is Terrible", "summary": "Snap is bloated, slow, and centralized junk", "date_published": "2024-10-23T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/dont-use-kali-daily", "title": "Don’t Use Kali Linux as Your Daily Driver", "summary": "Kali Linux isn’t meant for daily use", "date_published": "2024-09-25T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/elevations-rosenzweig-levinas-jewish-faith", "title": "The Height of the Good in Rosenzweig and Levinas", "summary": "Rosenzweig and Levinas uplift Jewish faith through goodness.", "date_published": "2024-08-30T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/a-consice-guide-to-borderline", "title": "A Personal Reflection on Joel Paris`s Borderline Guide", "summary": "Learning to support my wife through BPD compassionately.", "date_published": "2024-04-12T20:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/get-me-out-of-here-rachel-reiland-md", "title": "Reflections on Rachel Reilands Powerful Memoir", "summary": "Learning from Rachel Reiland to support my wife.", "date_published": "2024-02-02T21:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/why-debian", "title": "Why Debian Will Always Be My Linux Distribution of Choice", "summary": "Why I Keep Coming Back to Debian", "date_published": "2024-01-18T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/maui-dotnet8", "title": "An Introduction to .NET MAUI in .NET 8", "summary": "A brief summary of MAUI in .NET 8", "date_published": "2023-11-21T14:01:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/asking-god-before-marriage-proposal", "title": "The Moment I Turned to God Before Asking My Wife to Marry Me", "summary": "God’s blessing guided my proposal and marriage journey.", "date_published": "2023-07-15T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/papers", "title": "Why Remnants of a Life on Paper Still Echo in My Mind", "summary": "A moving memoir of illness, family, and words.", "date_published": "2023-05-20T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/halakha-for-engineers-shabbat", "title": "Halakha for Engineers - When Your Code Runs on Shabbat", "summary": "The wrong question is whether you can use a phone on Shabbat. The right question, for those of us who build the systems, is what halakhic status the work of our machines holds while we rest.", "date_published": "2023-03-03T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/chosen-people-segulah", "title": "What Chosen People Actually Means", "summary": "Two groups misunderstand am segulah for opposite reasons. Anti-Semites read it as supremacy. Interfaith softeners read it as embarrassing exclusivism to be flattened. Both readings are wrong, and the actual content is harder than either.", "date_published": "2022-12-05T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/loving-someone-with-bpd-shari-manning", "title": "Learning to Love Through the Lens of Borderline Personality Disorder", "summary": "Supporting my girlfriends journey with BPD and self-respect.", "date_published": "2022-09-20T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/hardened-heart", "title": "The Hardened Heart of Pharaoh", "summary": "Stubbornness becomes destiny under divine justice", "date_published": "2022-06-29T23:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/systemd", "title": "Unlocking the Mystery of systemd", "summary": "the basiscs around systemd", "date_published": "2022-06-14T20:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/log4shell", "title": "Log4Shell", "summary": "On December 9, an arbitrary code execution vulnerability in Apache Log4j 2 went public. The world spent the weekend patching. A week later we have CVE-2021-44228, the follow-up CVE-2021-45046, and CVE-2021-45105, three patches in five days, and a long list of structural lessons that the Java ecosystem will be working through for years.", "date_published": "2021-12-15T16:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/vaultwarden", "title": "Vaultwarden - Self-Hosting the Bitwarden Server", "summary": "The project formerly known as bitwarden_rs renamed to Vaultwarden last month, completing the rebrand at the request of the Bitwarden team. Six weeks in, the new name is settling. The underlying project remains what it always was - the right way to self-host Bitwarden if you want full control of your password infrastructure.", "date_published": "2021-06-19T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/http3-quic", "title": "HTTP/3 and QUIC - What's About to Replace TCP", "summary": "QUIC is in late draft, HTTP/3 is shipping in Chrome and Firefox, and Cloudflare and Google are already serving meaningful traffic over both. The internet's transport layer is being rewritten. This is what changed, why it changed, and what it means for everyone who runs servers.", "date_published": "2020-10-18T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/tzedakah", "title": "Tzedakah - Why Charity Loses What Hebrew Names", "summary": "The English word charity descends from Latin caritas, love. The Hebrew word tzedakah descends from tzedek, justice. Translating one as the other does not just lose a connotation; it inverts the underlying legal and ethical structure. The classical Jewish concept is harder, more demanding, and more interesting than what English makes of it.", "date_published": "2020-08-22T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/caddy-v2", "title": "Caddy v2", "summary": "Caddy v2 released six weeks ago. It is not v1 with new features — it is a complete rewrite, with a new configuration model, a new module system, and a real architectural argument for why a modern web server should look different from nginx and Apache. After six weeks of running production sites on it, here is what it actually delivers.", "date_published": "2020-06-15T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/why-use-pihole", "title": "Why Pi-hole Might Just Be Your New Best Friend Online", "summary": "Pi-hole - faster, safer, ad-free internet browsing", "date_published": "2020-03-30T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/lebon-psychology", "title": "Gustave Le Bon’s Timeless Dive into Mass Psychology", "summary": "Deep dive talk about Gustave Le Bon's Mass Psychology book", "date_published": "2019-12-23T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/antichrist-nietsche", "title": "Exploring Nietzsche’s The Antichrist", "summary": "Exploring Nietzsche's Antichrist", "date_published": "2019-12-21T22:03:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/debian-buster", "title": "Debian 10 - What Two Years Brought", "summary": "Debian 10 released a month ago, ending Stretch's two-year run. The headline change is nftables replacing iptables as the default firewall framework. The deeper changes — secure boot, default AppArmor, Wayland coming into focus — are what will matter over the next two years.", "date_published": "2019-08-04T11:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/the-psychology-of-money", "title": "Why The Psychology of Money Feels More Relevant Than Ever in Today’s Wild Financial Ride", "summary": "Timeless lessons on money, behavior, and true wealth", "date_published": "2018-12-02T21:15:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/wireguard-first", "title": "WireGuard - The VPN That's About to Change Everything", "summary": "Jason Donenfeld submitted WireGuard for inclusion in the Linux kernel mainline in August. Even before merge, the four-thousand-line VPN is already faster, simpler, and more secure than OpenVPN or IPsec. Here is what it is, why the design matters, and how to deploy it now.", "date_published": "2018-11-08T14:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/reflection-on-hesche", "title": "Reflection on Heschel's The Sabbath", "summary": "Heschel's 1951 essay distills the rabbinic conception of Shabbat into a hundred pages of philosophical-poetic prose that remains, seventy years later, the best short introduction to what the seventh day actually is. The argument that civilization conquers space and Shabbat sanctifies time is not decorative metaphor; it is the structural claim of the book, and it holds up.", "date_published": "2018-04-22T09:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/spectre", "title": "Spectre and Meltdown - What Hardware Trust Looks Like After January 3", "summary": "On January 3, three vulnerabilities in modern CPUs reframed two decades of assumptions about hardware-enforced isolation. The patches are landing. The deeper lesson — that speculative execution as currently designed is fundamentally hostile to security — is what we are still working out.", "date_published": "2018-01-15T11:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/krack-wpa2-broke", "title": "KRACK - WPA2 Broke, and Your Linux Clients Broke Worst", "summary": "Mathy Vanhoef forced WPA2 to reinstall a key it was already using, resetting the nonce and handing an attacker the keystream. Every correct implementation was affected, and Linux managed to be affected worst of all by installing an all-zero key. Here is the handshake, the flaw, and why the link layer was never where your trust belonged.\n", "date_published": "2017-10-18T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/two-torahs", "title": "The Two Torahs", "summary": "The popular reading of Judaism imagines a single Torah, written, sufficient on its own — and the rabbinic literature as commentary added on top. The classical sources tell a different story, and the structural argument for it is harder to dismiss than most readers realize.", "date_published": "2017-09-19T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/zfs-on-the-homelab", "title": "ZFS on the Homelab - Checksums, Snapshots, and the End of Silent Bit Rot", "summary": "ext4 will hand you a corrupted file and swear everything is fine. ZFS checksums every block, repairs what it can, and makes snapshots cost nothing. With ZoL 0.7 out and Stretch a contrib package away from it, here is why my homelab storage now runs on copy-on-write, and the licensing mess you sign up for by using it.\n", "date_published": "2017-08-09T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/debian-stretch", "title": "Debian 9 - What Actually Changed", "summary": "Debian 9 Stretch released two weeks ago, ending Jessie's reign as stable. Most servers will upgrade through the year. Here is what is genuinely new, what is worth knowing before you migrate, and what is going to bite you.", "date_published": "2017-07-02T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/debian-9-reproducible-builds", "title": "Debian 9 Stretch - Reproducible Builds, MariaDB, and the eth0 That Won't Come Back", "summary": "Stretch is out, dedicated to Ian Murdock, with over 90% of packages now reproducible, MariaDB instead of MySQL, and the modern GnuPG by default. It also renames your network interfaces out from under you, which is how a routine upgrade locks you out of your own server. Here is what is worth caring about, and what to check before you reboot. \n", "date_published": "2017-06-21T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/kostolany-notebook", "title": "Timeless Wisdom from André Kostolany’s Notebook", "summary": "Wisdom on money, greed, and life’s true value", "date_published": "2017-05-16T21:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/self-hosting-email", "title": "Self-Hosting Email", "summary": "Self-hosting email used to mean installing Postfix and pointing an MX record at it. In 2017, the deliverability fight against Gmail and Outlook is the real work, and most of the difficulty is not the mail server itself.", "date_published": "2017-02-18T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/borgbackup", "title": "BorgBackup - Encrypted, Deduplicated Backups Done Right", "summary": "Borg 1.0 has been stable since February. If your backup strategy is still rsync to an external drive, you are leaving real safety on the table. Encryption, deduplication, and compression are not optional anymore.", "date_published": "2016-11-08T11:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/dirty-cow-cve-2016-5195", "title": "Dirty COW - The Nine-Year-Old Root Bug Hiding in Copy-on-Write", "summary": "A race in mm/gup.c lets any local user write to read-only memory and rewrite setuid binaries. It sat in the kernel for nine years. Here is how the race actually works, and why \"it's only local\" was always a lie, especially now that everyone runs containers.\n", "date_published": "2016-10-21T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/tefillah-actually-is", "title": "What Tefillah Actually Is", "summary": "The popular understanding of Jewish prayer is a wish list submitted to the Divine. Classical sources treat tefillah as something else entirely — closer to a daily discipline of standing before God than a customer-service relationship with Him.", "date_published": "2016-07-15T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/more-money-than-god-blogpost", "title": "Diving Into the High-Stakes World of Hedge Funds with Sebastian Mallaby's More Money Than God", "summary": "Exploring hedge funds’ history through Mallaby’s lens", "date_published": "2016-05-10T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/lets-encrypt-auto", "title": "Let's Encrypt - What Free Universal HTTPS Actually Changes", "summary": "Let's Encrypt left beta last week and entered general availability. Free, automated, ninety-day certificates from a CA that browsers actually trust. The change is bigger than the price tag suggests.", "date_published": "2016-04-22T22:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/warren-buffett-lessons-for-investors", "title": "The Essays of Warren Buffett - Timeless Wisdom for Investors and Leaders", "summary": "deep dive into timeless investing and management wisdom from warren buffett.", "date_published": "2016-03-14T21:00:00Z" }, { "id": "", "url": "https://blog.c0xl.ch/p/git-for-homelab", "title": "Your Homelab Should Be a Git Repo - Bootstrapping Config Management With Ansible", "summary": "A brief summary of what this post is about.", "date_published": "2016-03-02T22:00:00Z" } ] }