🌀 Spiral Burst 128

The SANS Incident Handling & Forensics presentation by Matthew J. Harmon provides a comprehensive overview of how organizations should prepare for, respond to, and learn from security incidents. Drawing on industry best practices and real-world examples, it emphasizes the importance of structured processes, clear communication, and rigorous evidence handling to minimize damage and restore operations promptly.

🔗</a>Incident Response</h2>
First, the talk lays out the six core phases of incident response: Preparation, Identification, Containment, Eradication, Recovery, and Lessons Learneddetailing the goals and key actions at each stage. Core principles such as work in pairs, maintain a strict chain of custody, never operate on original data, and enforce a need-to-know policy are reinforced throughout. These guidelines ensure that responders act methodically, take comprehensive notes, and prevent further compromise while preserving forensic integrity.
🔗</a>Techniques and Toolkits</h2>
Second, the presentation transitions to practical techniques and toolkits. It introduces the SANS Investigative Forensic Toolkit (SIFT) and offensive-focused distributions like BackTrack for evidence acquisition and analysis. Step-by-step procedures cover documenting the scene, identifying and preserving data sources (from servers and workstations to mobile devices), performing bit-by-bit imaging, and analyzing logs and memory. Finally, it underscores the need to produce clear, audience-appropriate reportswhether for corporate management, legal teams, or law enforcementto drive improvements and policy changes post-incident.
🔗</a>Presentation</h2>
Minnesota High Tech Crime Investigators Association</a>

ISO Focus+ Article: Plugging Security Gaps

2010-04-01T00:00:00+00:00

The attached article examines the explosive adoption of radio-frequency identification (RFID) technology across industries and the emerging security concerns that threaten its continued growth. As organizationsfrom the U.S. Department of Defense to livestock ranchers and healthcare providersincreasingly rely on RFID for tracking assets, the industry must confront vulnerabilities that could undermine both privacy and trust in this pervasive technology.

🔗</a>Attacks</h2>
In the face of demonstrated attackssuch as drive-by cloning of passport tagsRFID systems are exposed to a spectrum of threats at multiple points: the tag itself, the reader (interrogator), and the air interface. Common attack vectors include mimicking (spoofing, cloning, malicious code), information gathering (skimming, eavesdropping, data tampering), and denial-of-service tactics (reader jamming, tag blocking or killing). Each of these can compromise confidentiality, integrity, or availability, potentially disrupting business operations and eroding user confidence.
🔗</a>Defense</h3>
To address these challenges, international standards bodies have moved to embed security into RFID deployments. ISO/IEC TR 24729-4 lays out guidelines for tag data securitycovering encryption, authentication, and secure data transmissionwhile balancing cost, storage constraints, and read-performance requirements. The report recommends leveraging a suite of countermeasures (e.g., unique tag identifiers per ISO 15963, password protection, and cryptographic controls) and employs the OWASP DREAD model to assess and prioritize risks. Ongoing work by ISO/IEC SC 31s WG 7 seeks to harmonize these efforts into a coherent framework that ensures interoperability, efficiency, and privacy as RFID becomes ever more ubiquitous.
🔗</a>Presentation</h3>
ISO Focus+ April 2010</a>

Setting</th>	Value</th>	What it governs</th></tr></thead>
`MAX_CACHE_BYTES</code></td>`	512 MB</td>	LRU eviction ceiling — a flood of cold keys cannot evict the warm set</td></tr>
`MAX_CACHE_ENTRIES</code></td>`	16,384</td>	Entry count ceiling</td></tr>
`MAX_FILE_BYTES</code></td>`	32 MB</td>	Largest single cacheable file</td></tr>
`GZIP_MIN_BYTES</code></td>`	1,024</td>	Below this, compressing costs more than it saves</td></tr>
`CONTENT_TTL_SECONDS</code></td>`	0</td>	No periodic flush — baked content cannot change under a running guest</td></tr> </tbody></table> The elaborate caching exists because Nanos’ 9p client serialises round-trips: per-request `stat</code> and open</code> against a mounted filesystem pegged the CPU under concurrent HTTPS. That was the wedge that motivated the design. Under the current baked configuration there is no 9p on the request path at all — so the cache is now belt-and-braces rather than load-bearing. Worth knowing before anyone “simplifies” it: the machinery becomes essential again the moment someone reintroduces a mount.</p>` Operating it</h2> Publishing</h3> Get files into /var/www/<site>/dist</code>, then restart. For itys.net that is automated — an hourly timer pulls a tarball from Backblaze B2, verifies its checksum against a published manifest, swaps the tree by rename, and restarts the unit only when the content actually changed.</p> systemctl</span> </span>restart</span> unik-</span>sites.</span>service </span></code></pre> Certificates</h3> The guest re-reads /certs</code> every 30 seconds and skips unchanged files — but /certs</code> is baked, so a renewal on the host is invisible until a rebuild. A certbot deploy hook, sync-unik-certs.sh</code>, restarts the unit for exactly this reason. That restart also re-bakes whatever is currently in /var/www</code>, which is worth remembering if a half-finished change is sitting there.</p> Hardening, and three deliberate omissions</h3> The unit is tightly confined — ProtectSystem=strict</code>, DevicePolicy=closed</code> with only /dev/kvm</code> and /dev/net/tun</code> allowed, NoNewPrivileges</code>, RestrictNamespaces</code>, LockPersonality</code>. Three obvious directives are left off on purpose, each documented in the unit:</p> PrivateDevices</code> would hide /dev/kvm</code>, so the guest could not boot at all.</li> ProtectHome</code> would empty /root</code>, where the Ops image cache lives.</li> MemoryDenyWriteExecute</code> breaks qemu, which maps writable-executable memory.</li> </ul> Sharp edges</h2> Blast radius</span> One image holds all 33 sites, so a restart takes them all down together. It is only about two seconds, but it is not scoped to the site being published.</p> </aside> Soft 404s</span> Path resolution follows try_files semantics ending in /index.html</code>, so a missing URL returns the site’s home page with HTTP 200</strong> rather than a 404. Crawlers and readers are both told the page is fine. A site’s own 404.html</code> is unreachable. Changing this means editing the shared binary, which every site depends on.</p> </aside> Image growth</span> Every site’s bytes are in the image, so one site’s weight is everyone’s boot cost. Adding 38 MB of slide decks to itys.net took the image from 102 MB to 141 MB — a 38% increase to publish one site’s archive.</p> </aside> Compiled from the running configuration on mia-01 — the systemd unit, config.json</code>, the header commentary in server.go</code>, and a live test of whether host writes reach the guest. Verified 10 September 2026.</p> TX: TAR eXtender for resilient archives 2025-11-29T00:00:00+00:00 TX (TAR eXtender) is a tiny, dependency-light utility for building, moving, and verifying tar archives at internet scale. It sits between classic tar</code> and modern backup systems, adding manifests, chunking, and integrity checks without pulling in a full database or heavyweight agent.</p> If you want reproducible tarballs that can be resumed mid-transfer, diffed across sites, and verified long after they leave your machine, TX is the glue. You can grab the latest build at tx.itys.net</a>.</p> 🔗</a>Why another archive helper?</h2> Plain tar</code> lacks durable manifests and integrity metadata.</li> Whole-archive retries are painful when a 40 GB upload drops at 98%.</li> Long-haul transfers (home lab -> cloud, colo -> cold storage) need easy resume and post-copy verification.</li> We wanted something you could curl</code> and run without Rust/Cargo already present.</li> </ul> 🔗</a>What TX adds</h2> Chunked output</strong>: splits archives into fixed-size parts (e.g., 256 MiB) so you can resume uploads and retry only the missing pieces.</li> Signed manifest header</strong>: writes the JSON manifest (hashes, sizes, tree metadata) into the first bytes of the archive (Track 1) ahead of the tar stream, so you do not lose it as a sidecar.</li> Streaming-friendly</strong>: reads from stdin, writes to stdout by default; no temp staging required.</li> Integrity-first</strong>: tx verify</code> replays hashes and sizes; tx repair</code> can refetch only the corrupted chunk.</li> Boring dependencies</strong>: static build, no runtime services or databases.</li> </ul> 🔗</a>Quick start</h2> Create a chunked archive with an embedded manifest:</p> tx</span></span> pack \ </span></span></span> --</span>input</span> ./data \ </span></span></span> --</span>output</span> ./exports/site.tx.tar \ </span></span></span> --</span>chunksize</span> 256MiB</span> </span></code></pre> Verify the archive later (either side of a transfer):</p> tx</span></span> verify \ </span></span></span> --</span>input</span> ./exports/site.tx.tar</span> </span></code></pre> Extract after verification:</p> tx</span></span> unpack --</span>input</span> ./exports/site.tx.tar --</span>output</span> ./restore</span> </span></code></pre> 🔗</a>Recipes</h2> Remote pushes</strong>: pipe into ssh</code> to avoid local disk writes.</p> tx</span></span> pack --</span>input</span> ./data --</span>chunksize</span> 128MiB \ </span></span></span></span>\|</span> ssh</span></span> user@remote "</span>cat > /srv/archive.tx.tar"</span></span></span> </span></code></pre> </li> Object storage</strong>: upload chunks in parallel; the embedded manifest rides in Track 1, so you do not have to chase a separate file for audits.</p> </li> Cold storage audits</strong>: schedule tx verify</code> against a mounted bucket to catch bit-rot without restoring the data.</p> </li> </ul> 🔗</a>How it works</h2> Reads the file tree, writes tar entries in a stable, sorted order.</li> Emits fixed-size chunks and SHA-256 per chunk plus whole-archive digests.</li> Records metadata in manifest_version</code>, chunks</code>, tree</code>, and digests</code> keys inside the JSON prelude at the start of the file (Track 1).</li> Keeps the tar stream portable: the payload after Track 1 is a standard tar stream; TX reads the manifest first, then hands off extraction.</li> </ul> 🔗</a>Operational notes</h2> TX prefers deterministic inputs: run with a consistent --mtime</code> when you want byte-identical outputs across builders.</p> </li> For huge trees, set --chunksize</code> to your network’s sweet spot; 64–256 MiB works well for S3-compatible uploads.</p> </li> Memory footprint stays near the chunk size; TX streams rather than buffering entire archives.</p> </li> Builds are published at tx.itys.net</a> with SHA-256 sums in sha256.txt</code>. Verify the binary before first use:</p> curl</span></span> -</span>O</span> https://tx.itys.net/tx-linux-amd64</span> </span>curl</span></span> -</span>O</span> https://tx.itys.net/sha256.txt</span> </span>grep</span></span> tx-linux-amd64 sha256.txt</span> \|</span> sha256sum</span></span> --</span>check</span></span> </span>chmod</span></span> +x tx-linux-amd64</span> </span>sudo</span></span> mv tx-linux-amd64 /usr/local/bin/tx</span> </span></code></pre> </li> </ul> 🔗</a>Roadmap</h2> Optional Blake3 digests for faster verification on low-power hardware.</li> Built-in push</code> helper with retry/backoff for S3 and rsync targets.</li> TUF-style signed release metadata to harden binary distribution.</li> </ul> TX keeps tar simple while adding the reliability knobs long-haul transfers deserve. If you kick the tires, feedback is welcome—open an issue or drop a note via tx.itys.net</a>.*</p> 🌀 Spiral Burst 128 2025-11-23T00:00:00+00:00 🔗</a>SB128 - Spiral Burst 128</h1> SB128 is a deterministic “data-bearing snowflake” that pairs a central Data Matrix with six spiral arms. Each arm carries 64 bands; a simple burst mark encodes a bit (bright disk + tiny diamonds) and a faint dot marks zero, so the arms stay visible even in monochrome. A 128‑bit SF128 identifier is encoded three times (repetition code), plus a CRC16 in the Data Matrix for cross‑checks.</p> 🔗</a>What’s inside</h2> Payload: user string.</li> SF128: first 16 bytes of SHA‑256(payload).</li> CRC16: CRC‑16/CCITT of the SF128 bytes.</li> Data Matrix (center): payload, SF128 (hex), CRC16 (hex), using the smallest fitting ECC200 symbol.</li> Arms: 6 arms × 64 bands = 384 bits, carrying 3×SF128 (majority vote per bit).</li> </ul> 🔗</a>Encoding geometry</h2> Image: 1152×1152 px, radial gradient background.</li> Arms: Archimedean spirals, inner radius 0.25 (norm to corner), outer 0.70, mild twist.</li> Band mark (bit=1): bright disk with dark outline and four micro‑diamonds along ±tangent/±perp.</li> Band mark (bit=0): faint dot only.</li> No randomness; positions are fixed per (arm, band).</li> </ul> 🔗</a>Decoding approach</h2> Recompute (arm, band) positions from image size and shared constants.</li> Sample a small luma patch at each band center to get an energy value.</li> Otsu split → threshold = μ0 + 0.55·(μ1–μ0); classify energies to bits.</li> Majority vote each bit across the 3 repetitions → SF128; compute CRC16.</li> Optionally decode the central Data Matrix and cross‑check SF128/CRC16.</li> Optional --search</code> tries small rotate/scale/translate transforms if needed.</li> </ol> 🔗</a>CLI usage</h2> Encode: python encode_snowflake.py "Your payload"</code> (add --verify</code> to arm‑decode after render).</li> Decode: python decode_snowflake.py snowflake.png --search</code> (or without --search</code> for speed).</li> Robustness smoke (blur/rot/scale/noise, optional search): python robustness_test.py</code>.</li> </ul> 🔗</a>Constraints & robustness</h2> Works in grayscale/black‑and‑white; outlines and burst contrast survive binarization.</li> Repetition code tolerates isolated bit errors; CRC16 covers SF128.</li> Keep central DMX mostly unobstructed; extreme occlusion of multiple arms will break recovery.</li> </ul> 🔗</a>Example</h2> A walk‑through and sample render are available here: /posts/sb128/</p> </p> 🔗</a>Files</h2> encode_snowflake.py</code> — SB128 encoder (PNG output).</li> decode_snowflake.py</code> — SB128 decoder (arms, optional DMX cross‑check).</li> robustness_test.py</code> — quick perturbation tests.</li> </ul> Moderate friction gates 2025-11-17T00:00:00+00:00 🔗</a>Building Delphi’s PoH / PoW Gateway for SearXNG</h1> This document describes how the Proof‑of‑Human (PoH) / Proof‑of‑Work (PoW) gate in front of SearXNG on delphi</code> was built and wired up, from a clean state to the current Tailscale‑aware deployment. Why Tailscale, it’s WireGuard with a nice admin interface and is easy to deploy.</p> Audience: experienced operators / developers who are comfortable with Linux, systemd, Python, and Caddy.</p> The examples are written to be copy/paste‑friendly and assume:</p> Hostname: delphi.example.com</code></li> Tailscale hostname: delphi.abc123.ts.net</code></li> SearXNG running under uWSGI, listening on 127.0.0.1:8888</code> (HTTP)</li> PoH app running under uvicorn on 127.0.0.1:9000</code></li> </ul> Adjust paths and hostnames to taste.</p> 🔗</a>1. Overview</h2> The master plan:</p> All traffic to https://delphi.example.com/</code> (and the Tailscale name) lands on a PoH page.</li> The page shows a “Don’t Panic” logo and a Tron‑style traveling border and a single instruction to “Hold to enter”.</li> Holding on the logo runs a client‑side PoW (SHA‑256 based on a server challenge), signs the result with a browser ECDSA key, and sends it to the backend for verification.</li> On success, the backend: Verifies the PoW and signature.</li> Issues a short‑lived session cookie (poh_session</code>) bound to the client IP / User Agent.</li> </ul> </li> Caddy only proxies /searxng/</code> (SearXNG) when the poh_session</code> cookie is present; otherwise it sends the user back to the PoH gate.</li> </ul> 🔗</a>The bot friction layers:</h3> PoW with adjustable difficulty based on interaction.</li> Per‑IP rate limiting on PoH challenge creation.</li> Session TTL shortened for “suspicious” clients (those that never fetched favicon.ico</code>).</li> Tailscale DNS name terminates TLS via a Tailscale‑issued cert, but shares the same routing and gate.</li> </ul> 🔗</a>2. PoH App: Python / FastAPI Setup</h2> To replicate this build, create a dedicated directory and virtualenv on the server:</p> sudo</span></span> mkdir -</span>p</span> /opt/poh</span> </span>sudo</span></span> chown "</span>$</span>USER</span></span>"</span></span>:"</span>$</span>USER</span></span>"</span></span> /opt/poh</span> </span>cd</span></span> /opt/poh</span> </span> </span>python3</span></span> -</span>m</span> venv venv</span> </span>./venv/bin/pip</span></span> install --</span>upgrade</span> pip</span> </span>./venv/bin/pip</span></span> install fastapi "</span>uvicorn[standard]"</span></span> cryptography</span> </span></code></pre> Create the app layout:</p> mkdir</span></span> -</span>p</span> /opt/poh/app/static</span> </span></code></pre> Create /opt/poh/app/main.py</code>:</p> from</span></span> datetime</span></span> import</span></span></span></span></span> datetime</span>,</span> timedelta</span>,</span> timezone</span></span> </span>import</span> base64</span></span></span> </span>import</span> hashlib</span></span></span> </span>import</span> secrets</span></span></span> </span>from</span></span> pathlib</span></span> import</span></span></span></span></span> Path</span></span> </span>from</span></span> typing</span></span> import</span></span></span></span></span> Any</span>,</span> Dict</span></span> </span> </span>from</span></span> fastapi</span></span> import</span></span></span></span></span> FastAPI</span>,</span> HTTPException</span>,</span> Request</span>,</span> Response</span></span> </span>from</span></span> fastapi</span>.</span>responses</span></span> import</span></span></span></span></span> HTMLResponse</span>,</span> FileResponse</span></span> </span>from</span></span> pydantic</span></span> import</span></span></span></span></span> BaseModel</span></span> </span>from</span></span> cryptography</span>.</span>hazmat</span>.</span>primitives</span></span> import</span></span></span></span></span> hashes</span></span> </span>from</span></span> cryptography</span>.</span>hazmat</span>.</span>primitives</span>.</span>asymmetric</span></span> import</span></span></span></span></span> ec</span></span> </span>from</span></span> cryptography</span>.</span>hazmat</span>.</span>primitives</span>.</span>asymmetric</span>.</span>utils</span></span> import</span></span></span></span></span> encode_dss_signature</span></span> </span> </span> </span>app</span></span> =</span> FastAPI</span></span></span></span>(</span>)</span></span> </span> </span> </span>class</span></span> StartResponse</span></span>(</span></span></span>BaseModel</span>)</span></span>:</span></span> </span> challenge</span></span>:</span> str</span></span> </span> difficulty</span></span>:</span> int</span></span> </span> timestamp</span></span>:</span> str</span></span> </span> </span> </span>class</span></span> VerifyRequest</span></span>(</span></span></span>BaseModel</span>)</span></span>:</span></span> </span> challenge</span></span>:</span> str</span></span> </span> counter</span></span>:</span> int</span></span> </span> hash</span></span>:</span> str</span></span> </span> signature</span></span>:</span> str</span></span> </span> public_key</span></span>:</span> Dict</span></span></span>[</span></span>str</span></span>, Any</span></span></span>]</span></span> </span> timestamp</span></span>:</span> str</span></span> \|</span> None</span> =</span> None</span> </span> </span> </span>CHALLENGE_TTL</span></span> =</span> timedelta</span></span></span></span>(</span>minutes</span>=</span>5</span>)</span></span> </span>DEFAULT_DIFFICULTY</span></span> =</span> 20</span> </span>SESSION_TTL</span></span> =</span> timedelta</span></span></span></span>(</span>minutes</span>=</span>20</span>)</span></span> </span> </span> </span>_challenges</span></span>:</span> Dict</span></span></span>[</span></span>str</span></span>, Dict</span></span></span>[</span></span>str</span></span>, Any</span></span></span>]</span></span></span>]</span></span> =</span> {</span>}</span></span> </span>_sessions</span></span>:</span> Dict</span></span></span>[</span></span>str</span></span>, Dict</span></span></span>[</span></span>str</span></span>, Any</span></span></span>]</span></span></span>]</span></span> =</span> {</span>}</span></span> </span>_rate_starts</span></span>:</span> Dict</span></span></span>[</span></span>str</span></span>, list</span></span></span>[</span></span>datetime</span></span></span>]</span></span></span>]</span></span> =</span> {</span>}</span></span> </span>_favicon_hits</span></span>:</span> Dict</span></span></span>[</span></span>str</span></span>, datetime</span></span></span>]</span></span> =</span> {</span>}</span></span> </span> </span> </span>def</span></span> _now</span></span></span>(</span></span>)</span></span> </span>-></span> datetime</span></span></span>:</span></span> </span> return</span> datetime</span></span>.</span></span>now</span></span></span></span>(</span>timezone</span>.</span>utc</span></span>)</span></span> </span> </span> </span>def</span></span> _client_ip</span></span></span>(</span></span>request</span></span>:</span> Request</span></span></span>)</span></span> </span>-></span> str</span></span></span>:</span></span> </span> fwd</span></span> =</span> request</span>.</span>headers</span></span>.</span></span>get</span></span></span></span>(</span>"</span></span></span>x-forwarded-for"</span></span></span>)</span></span> </span> if</span> fwd</span></span>:</span></span> </span> return</span> fwd</span></span>.</span></span>split</span></span></span></span>(</span>"</span></span></span>,"</span></span></span>)</span></span>[</span></span>0</span></span>]</span></span>.</span></span>strip</span></span></span></span>(</span>)</span></span> </span> if</span> request</span>.</span>client</span></span>:</span></span> </span> return</span> request</span>.</span>client</span>.</span>host</span></span> or</span> "</span></span></span>?"</span></span></span> </span> return</span> "</span></span></span>?"</span></span></span> </span> </span> </span>def</span></span> _b64url_decode</span></span></span>(</span></span>data</span></span>:</span> str</span></span></span>)</span></span> </span>-></span> bytes</span></span></span>:</span></span> </span> padding</span></span> =</span> "</span></span></span>="</span></span></span> </span> (</span>(</span>4</span> -</span> len</span></span></span></span>(</span>data</span></span>)</span></span> %</span> 4</span>)</span></span> %</span> 4</span>)</span></span> </span> return</span> base64</span></span>.</span></span>urlsafe_b64decode</span></span></span></span>(</span>(</span>data</span></span> +</span> padding</span></span>)</span></span>.</span></span>encode</span></span></span></span>(</span>"</span></span></span>ascii"</span></span></span>)</span></span>)</span></span> </span> </span> </span>def</span></span> _public_key_from_jwk</span></span></span>(</span></span>jwk</span></span>:</span> Dict</span></span></span>[</span></span>str</span></span>, Any</span></span></span>]</span></span></span>)</span></span> </span>-></span> ec</span>.</span>EllipticCurvePublicKey</span></span></span>:</span></span> </span> if</span> jwk</span></span>.</span></span>get</span></span></span></span>(</span>"</span></span></span>kty"</span></span></span>)</span></span> !=</span> "</span></span></span>EC"</span></span></span>:</span></span> </span> raise</span> ValueError</span></span></span></span>(</span>"</span></span></span>Unsupported key type"</span></span></span>)</span></span></span> </span> crv</span></span> =</span> jwk</span></span>.</span></span>get</span></span></span></span>(</span>"</span></span></span>crv"</span></span></span>)</span></span> </span> if</span> crv</span></span> not</span> in</span> (</span>"</span></span></span>P-256"</span></span></span>,</span> "</span></span></span>secp256r1"</span></span></span>)</span></span>:</span></span> </span> raise</span> ValueError</span></span></span></span>(</span>"</span></span></span>Unsupported curve"</span></span></span>)</span></span></span> </span> </span> x_b</span></span> =</span> _b64url_decode</span></span></span></span>(</span>jwk</span></span></span>[</span></span>"</span></span></span>x"</span></span></span></span>]</span></span>)</span></span> </span> y_b</span></span> =</span> _b64url_decode</span></span></span></span>(</span>jwk</span></span></span>[</span></span>"</span></span></span>y"</span></span></span></span>]</span></span>)</span></span> </span> x</span></span> =</span> int</span></span>.</span></span>from_bytes</span></span></span></span>(</span>x_b</span></span>,</span> "</span></span></span>big"</span></span></span>)</span></span> </span> y</span></span> =</span> int</span></span>.</span></span>from_bytes</span></span></span></span>(</span>y_b</span></span>,</span> "</span></span></span>big"</span></span></span>)</span></span> </span> </span> curve</span></span> =</span> ec</span></span>.</span></span>SECP256R1</span></span></span></span>(</span>)</span></span> </span> public_numbers</span></span> =</span> ec</span></span>.</span></span>EllipticCurvePublicNumbers</span></span></span></span>(</span>x</span></span>,</span> y</span></span>,</span> curve</span></span>)</span></span> </span> return</span> public_numbers</span></span>.</span></span>public_key</span></span></span></span>(</span>)</span></span> </span> </span> </span>def</span></span> _leading_zero_bits_from_hex</span></span></span>(</span></span>h</span></span>:</span> str</span></span></span>)</span></span> </span>-></span> int</span></span></span>:</span></span> </span> b</span></span> =</span> bytes</span></span>.</span></span>fromhex</span></span></span></span>(</span>h</span></span>)</span></span> </span> bits</span></span> =</span> 0</span> </span> for</span> byte</span> in</span></span> b</span></span></span>:</span></span> </span> if</span> byte</span></span> ==</span> 0</span>:</span></span> </span> bits</span></span> +=</span> 8</span> </span> else</span>:</span></span> </span> bits</span></span> +=</span> 8</span> -</span> byte</span></span>.</span></span>bit_length</span></span></span></span>(</span>)</span></span> </span> break</span> </span> return</span> bits</span></span> </span> </span> </span>def</span></span> _rate_limit_start</span></span></span>(</span></span>ip</span></span>:</span> str</span></span></span>)</span></span> </span>-></span> None</span></span>:</span></span> </span> now</span></span> =</span> _now</span></span></span></span>(</span>)</span></span> </span> window</span></span> =</span> timedelta</span></span></span></span>(</span>minutes</span>=</span>1</span>)</span></span> </span> entries</span></span> =</span> _rate_starts</span></span>.</span></span>setdefault</span></span></span></span>(</span>ip</span></span>,</span> [</span>]</span></span>)</span></span> </span> entries</span></span></span>[</span></span>:</span></span>]</span></span> =</span> [</span>t</span></span> for</span> t</span> in</span></span> entries</span></span> if</span> now</span></span> -</span> t</span></span> <</span> window</span></span>]</span></span> </span> if</span> len</span></span></span></span>(</span>entries</span></span>)</span></span> >=</span> 20</span>:</span></span> </span> raise</span> HTTPException</span></span></span></span>(</span>status_code</span>=</span>429</span>,</span> detail</span>=</span>"</span></span></span>Too many PoH starts from this IP"</span></span></span>)</span></span></span> </span> entries</span></span>.</span></span>append</span></span></span></span>(</span>now</span></span>)</span></span> </span> </span> </span>@</span></span></span>app</span></span>.</span></span>get</span></span></span></span>(</span></span>"</span></span></span>/poh/start"</span></span></span>,</span> response_model</span>=</span>StartResponse</span></span></span>)</span></span> </span>async</span> def</span></span> start_poh</span></span></span>(</span></span>request</span></span>:</span> Request</span></span></span>)</span></span> </span>-></span> StartResponse</span></span></span>:</span></span> </span> ip</span></span> =</span> _client_ip</span></span></span></span>(</span>request</span></span>)</span></span> </span> _rate_limit_start</span></span></span></span>(</span>ip</span></span>)</span></span> </span> </span> now</span></span> =</span> _now</span></span></span></span>(</span>)</span></span> </span> seen</span></span> =</span> _favicon_hits</span></span>.</span></span>get</span></span></span></span>(</span>ip</span></span>)</span></span> </span> suspicious</span></span> =</span> True</span> </span> if</span> seen</span></span> is</span> not</span> None</span> and</span> now</span></span> -</span> seen</span></span> <</span> timedelta</span></span></span></span>(</span>minutes</span>=</span>10</span>)</span></span>:</span></span> </span> suspicious</span></span> =</span> False</span> </span> </span> difficulty</span></span> =</span> DEFAULT_DIFFICULTY</span></span> +</span> 4</span> if</span> suspicious</span></span> else</span> DEFAULT_DIFFICULTY</span></span></span> </span> challenge</span></span> =</span> secrets</span></span>.</span></span>token_hex</span></span></span></span>(</span>16</span>)</span></span> </span> </span> _challenges</span></span></span>[</span></span>challenge</span></span></span>]</span></span> =</span> {</span> </span></span></span> </span>"</span></span></span>created_at"</span></span></span></span>:</span></span> </span>now</span></span></span>,</span> </span></span> </span>"</span></span></span>difficulty"</span></span></span></span>:</span></span> </span>difficulty</span></span></span>,</span> </span></span> </span>"</span></span></span>used"</span></span></span></span>:</span></span> </span>False</span></span>,</span> </span></span> </span>"</span></span></span>suspicious"</span></span></span></span>:</span></span> </span>suspicious</span></span></span>,</span> </span></span> }</span></span> </span> </span> return</span> StartResponse</span></span></span></span>(</span> </span></span> challenge</span>=</span>challenge</span></span>,</span> </span></span> difficulty</span>=</span>difficulty</span></span>,</span> </span></span> timestamp</span>=</span>now</span></span>.</span></span>isoformat</span></span></span></span>(</span>)</span></span>,</span> </span></span> )</span></span> </span> </span> </span>@</span></span></span>app</span></span>.</span></span>post</span></span></span></span>(</span></span>"</span></span></span>/poh/verify"</span></span></span></span>)</span></span> </span>async</span> def</span></span> verify_poh</span></span></span>(</span></span>request</span></span>:</span> Request</span></span></span>,</span> response</span></span>:</span> Response</span></span></span>,</span> body</span></span>:</span> VerifyRequest</span></span></span>)</span></span>:</span></span> </span> meta</span></span> =</span> _challenges</span></span>.</span></span>get</span></span></span></span>(</span>body</span>.</span>challenge</span></span>)</span></span> </span> if</span> not</span> meta</span></span>:</span></span> </span> raise</span> HTTPException</span></span></span></span>(</span>status_code</span>=</span>400</span>,</span> detail</span>=</span>"</span></span></span>Unknown challenge"</span></span></span>)</span></span></span> </span> </span> if</span> meta</span></span></span>[</span></span>"</span></span></span>used"</span></span></span></span>]</span></span>:</span></span> </span> raise</span> HTTPException</span></span></span></span>(</span>status_code</span>=</span>400</span>,</span> detail</span>=</span>"</span></span></span>Challenge already used"</span></span></span>)</span></span></span> </span> </span> created_at</span></span>:</span> datetime</span></span> =</span> meta</span></span></span>[</span></span>"</span></span></span>created_at"</span></span></span></span>]</span></span> </span> if</span> _now</span></span></span></span>(</span>)</span></span> -</span> created_at</span></span> ></span> CHALLENGE_TTL</span></span>:</span></span> </span> raise</span> HTTPException</span></span></span></span>(</span>status_code</span>=</span>400</span>,</span> detail</span>=</span>"</span></span></span>Challenge expired"</span></span></span>)</span></span></span> </span> </span> difficulty</span></span> =</span> int</span></span></span></span>(</span>meta</span></span></span>[</span></span>"</span></span></span>difficulty"</span></span></span></span>]</span></span>)</span></span> </span> </span> data</span></span> =</span> (</span>body</span>.</span>challenge</span></span> +</span> str</span></span></span></span>(</span>body</span>.</span>counter</span></span>)</span></span>)</span></span>.</span></span>encode</span></span></span></span>(</span>"</span></span></span>utf-8"</span></span></span>)</span></span> </span> digest</span></span> =</span> hashlib</span></span>.</span></span>sha256</span></span></span></span>(</span>data</span></span>)</span></span>.</span></span>hexdigest</span></span></span></span>(</span>)</span></span> </span> </span> if</span> digest</span></span> !=</span> body</span>.</span>hash</span></span>:</span></span> </span> raise</span> HTTPException</span></span></span></span>(</span>status_code</span>=</span>400</span>,</span> detail</span>=</span>"</span></span></span>Hash mismatch"</span></span></span>)</span></span></span> </span> </span> leading_bits</span></span> =</span> _leading_zero_bits_from_hex</span></span></span></span>(</span>digest</span></span>)</span></span> </span> if</span> leading_bits</span></span> <</span> difficulty</span></span>:</span></span> </span> raise</span> HTTPException</span></span></span></span>(</span>status_code</span>=</span>400</span>,</span> detail</span>=</span>"</span></span></span>Insufficient difficulty"</span></span></span>)</span></span></span> </span> </span> try</span>:</span></span> </span> pub</span></span> =</span> _public_key_from_jwk</span></span></span></span>(</span>body</span>.</span>public_key</span></span>)</span></span> </span> except</span> Exception</span> as</span></span> exc</span></span>:</span></span> #</span> noqa: BLE001 </span></span> raise</span> HTTPException</span></span></span></span>(</span>status_code</span>=</span>400</span>,</span> detail</span>=</span>f</span>"</span></span></span>Invalid public key: </span>{</span>exc</span></span></span></span>}</span></span>"</span></span></span>)</span></span> from</span></span></span> exc</span></span></span> </span> </span> message</span></span> =</span> (</span>body</span>.</span>challenge</span></span> +</span> str</span></span></span></span>(</span>body</span>.</span>counter</span></span>)</span></span> +</span> body</span>.</span>hash</span></span>)</span></span>.</span></span>encode</span></span></span></span>(</span>"</span></span></span>utf-8"</span></span></span>)</span></span> </span> </span> try</span>:</span></span> </span> sig_bytes</span></span> =</span> base64</span></span>.</span></span>b64decode</span></span></span></span>(</span>body</span>.</span>signature</span></span>.</span></span>encode</span></span></span></span>(</span>"</span></span></span>ascii"</span></span></span>)</span></span>)</span></span> </span> except</span> Exception</span> as</span></span> exc</span></span>:</span></span> #</span> noqa: BLE001 </span></span> raise</span> HTTPException</span></span></span></span>(</span>status_code</span>=</span>400</span>,</span> detail</span>=</span>"</span></span></span>Invalid signature encoding"</span></span></span>)</span></span> from</span></span></span> exc</span></span></span> </span> </span> if</span> len</span></span></span></span>(</span>sig_bytes</span></span>)</span></span> !=</span> 64</span>:</span></span> </span> raise</span> HTTPException</span></span></span></span>(</span>status_code</span>=</span>400</span>,</span> detail</span>=</span>"</span></span></span>Unexpected signature length"</span></span></span>)</span></span></span> </span> </span> r</span></span> =</span> int</span></span>.</span></span>from_bytes</span></span></span></span>(</span>sig_bytes</span></span></span>[</span></span>:</span>32</span></span>]</span></span>,</span> "</span></span></span>big"</span></span></span>)</span></span> </span> s</span></span> =</span> int</span></span>.</span></span>from_bytes</span></span></span></span>(</span>sig_bytes</span></span></span>[</span></span>32</span>:</span></span>]</span></span>,</span> "</span></span></span>big"</span></span></span>)</span></span> </span> der_sig</span></span> =</span> encode_dss_signature</span></span></span></span>(</span>r</span></span>,</span> s</span></span>)</span></span> </span> </span> try</span>:</span></span> </span> pub</span></span>.</span></span>verify</span></span></span></span>(</span>der_sig</span></span>,</span> message</span></span>,</span> ec</span></span>.</span></span>ECDSA</span></span></span></span>(</span>hashes</span></span>.</span></span>SHA256</span></span></span></span>(</span>)</span></span>)</span></span>)</span></span> </span> except</span> Exception</span> as</span></span> exc</span></span>:</span></span> #</span> noqa: BLE001 </span></span> raise</span> HTTPException</span></span></span></span>(</span>status_code</span>=</span>400</span>,</span> detail</span>=</span>"</span></span></span>Signature verification failed"</span></span></span>)</span></span> from</span></span></span> exc</span></span></span> </span> </span> meta</span></span></span>[</span></span>"</span></span></span>used"</span></span></span></span>]</span></span> =</span> True</span> </span> </span> now</span></span> =</span> _now</span></span></span></span>(</span>)</span></span> </span> session_id</span></span> =</span> secrets</span></span>.</span></span>token_urlsafe</span></span></span></span>(</span>32</span>)</span></span> </span> ip</span></span> =</span> _client_ip</span></span></span></span>(</span>request</span></span>)</span></span> </span> ua</span></span> =</span> request</span>.</span>headers</span></span>.</span></span>get</span></span></span></span>(</span>"</span></span></span>user-agent"</span></span></span>,</span> "</span></span></span>?"</span></span></span>)</span></span> </span> </span> suspicious</span></span> =</span> bool</span></span></span></span>(</span>meta</span></span>.</span></span>get</span></span></span></span>(</span>"</span></span></span>suspicious"</span></span></span>)</span></span>)</span></span> </span> ttl</span></span> =</span> SESSION_TTL</span></span> if</span> not</span> suspicious</span></span> else</span> timedelta</span></span></span></span>(</span>minutes</span>=</span>5</span>)</span></span></span> </span> </span> _sessions</span></span></span>[</span></span>session_id</span></span></span>]</span></span> =</span> {</span> </span></span></span> </span>"</span></span></span>created_at"</span></span></span></span>:</span></span> </span>now</span></span></span>,</span> </span></span> </span>"</span></span></span>expires_at"</span></span></span></span>:</span></span> </span>now</span></span> +</span> ttl</span></span></span>,</span> </span></span> </span>"</span></span></span>ip"</span></span></span></span>:</span></span> </span>ip</span></span></span>,</span> </span></span> </span>"</span></span></span>ua"</span></span></span></span>:</span></span> </span>ua</span></span></span>,</span> </span></span> }</span></span> </span> </span> response</span></span>.</span></span>set_cookie</span></span></span></span>(</span> </span></span> "</span></span></span>poh_session"</span></span></span>,</span> </span></span> session_id</span></span>,</span> </span></span> max_age</span>=</span>int</span></span></span></span>(</span>ttl</span></span>.</span></span>total_seconds</span></span></span></span>(</span>)</span></span>)</span></span>,</span> </span></span> httponly</span>=</span>True</span>,</span> </span></span> secure</span>=</span>True</span>,</span> </span></span> samesite</span>=</span>"</span></span></span>Lax"</span></span></span>,</span> </span></span> path</span>=</span>"</span></span></span>/searxng/"</span></span></span>,</span> </span></span> )</span></span> </span> </span> return</span> {</span></span>"</span></span></span>status"</span></span></span></span>:</span></span> </span>"</span></span></span>ok"</span></span></span></span>}</span></span> </span> </span> </span>@</span></span></span>app</span></span>.</span></span>get</span></span></span></span>(</span></span>"</span></span></span>/"</span></span></span>,</span> response_class</span>=</span>HTMLResponse</span></span></span>)</span></span> </span>async</span> def</span></span> root</span></span></span>(</span></span>)</span></span> </span>-></span> HTMLResponse</span></span></span>:</span></span> </span> html</span></span> =</span> """</span></span></span></span></span></span><!DOCTYPE html> </span></span></span><html lang=\"</span>en\"</span>> </span></span></span> <head> </span></span></span> <meta charset=\"</span>utf-8\"</span> /> </span></span></span> <title>Proof of Human</title> </span></span></span> <style> </span></span></span> :root { color-scheme: dark; } </span></span></span> body { </span></span></span> margin: 0; </span></span></span> min-height: 100vh; </span></span></span> display: flex; </span></span></span> align-items: center; </span></span></span> justify-content: center; </span></span></span> background: radial-gradient(circle at top, #3b82f6 0, #1e3a8a 45%, #020617 100%); </span></span></span> font-family: system-ui, -apple-system, BlinkMacSystemFont, \"</span>Segoe UI\"</span>, sans-serif; </span></span></span> color: #e0f2f1; </span></span></span> } </span></span></span> .shell { </span></span></span> text-align: center; </span></span></span> } </span></span></span> #holder { </span></span></span> position: relative; </span></span></span> display: inline-block; </span></span></span> cursor: pointer; </span></span></span> } </span></span></span> #dontpanic-logo { </span></span></span> display: block; </span></span></span> max-width: 260px; </span></span></span> width: 70vw; </span></span></span> height: auto; </span></span></span> border-radius: 18px; </span></span></span> filter: drop-shadow(0 0 16px rgba(15, 23, 42, 0.85)); </span></span></span> } </span></span></span> #glow { </span></span></span> position: absolute; </span></span></span> left: -4px; </span></span></span> top: -4px; </span></span></span> width: calc(100% + 8px); </span></span></span> height: calc(100% + 8px); </span></span></span> pointer-events: none; </span></span></span> } </span></span></span> #glow-rect { </span></span></span> fill: none; </span></span></span> stroke: #00f2ff; </span></span></span> stroke-width: 4; </span></span></span> stroke-linecap: round; </span></span></span> stroke-linejoin: round; </span></span></span> filter: drop-shadow(0 0 6px #00f2ff); </span></span></span> opacity: 0.95; </span></span></span> } </span></span></span> #hint { </span></span></span> margin-top: 0.75rem; </span></span></span> font-size: 0.95rem; </span></span></span> letter-spacing: 0.06em; </span></span></span> text-transform: uppercase; </span></span></span> color: #cbd5f5; </span></span></span> } </span></span></span> #status { </span></span></span> margin-top: 0.75rem; </span></span></span> font-size: 0.95rem; </span></span></span> opacity: 0.9; </span></span></span> } </span></span></span> #attempts, </span></span></span> #eta { </span></span></span> margin-top: 0.3rem; </span></span></span> font-size: 0.9rem; </span></span></span> opacity: 0.85; </span></span></span> } </span></span></span> </style> </span></span></span> </head> </span></span></span> <body> </span></span></span> <div class=\"</span>shell\"</span>> </span></span></span> <div id=\"</span>holder\"</span>> </span></span></span> <img </span></span></span> id=\"</span>dontpanic-logo\"</span> </span></span></span> src=\"</span>/dontpanic.png\"</span> </span></span></span> alt=\"</span>Don't Panic logo\"</span> </span></span></span> /> </span></span></span> <svg id=\"</span>glow\"</span> aria-hidden=\"</span>true\"</span>><rect id=\"</span>glow-rect\"</span> x=\"</span>2\"</span> y=\"</span>2\"</span> width=\"</span>100\"</span> height=\"</span>100\"</span> rx=\"</span>18\"</span> /></svg> </span></span></span> </div> </span></span></span> <div id=\"</span>hint\"</span>>Hold to enter</div> </span></span></span> <div id=\"</span>attempts\"</span>></div> </span></span></span> <div id=\"</span>eta\"</span>></div> </span></span></span> <div id=\"</span>status\"</span>></div> </span></span></span> </div> </span></span></span> <script src=\"</span>/poh.js\"</span>></script> </span></span></span> </body> </span></span></span></html> </span></span></span>"""</span></span></span> </span> return</span> HTMLResponse</span></span></span></span>(</span>content</span>=</span>html</span></span>)</span></span> </span> </span> </span>JS_PATH</span></span> =</span> Path</span></span></span></span>(</span>__file__</span></span>)</span></span>.</span>parent</span> /</span> "</span></span></span>static"</span></span></span> /</span> "</span></span></span>poh.js"</span></span></span> </span>IMG_PATH</span></span> =</span> Path</span></span></span></span>(</span>__file__</span></span>)</span></span>.</span>parent</span> /</span> "</span></span></span>static"</span></span></span> /</span> "</span></span></span>dontpanic.png"</span></span></span> </span>FAVICON_PATH</span></span> =</span> Path</span></span></span></span>(</span>__file__</span></span>)</span></span>.</span>parent</span> /</span> "</span></span></span>static"</span></span></span> /</span> "</span></span></span>favicon.ico"</span></span></span> </span> </span> </span>@</span></span></span>app</span></span>.</span></span>get</span></span></span></span>(</span></span>"</span></span></span>/poh.js"</span></span></span></span>)</span></span> </span>async</span> def</span></span> poh_js</span></span></span>(</span></span>)</span></span> </span>-></span> FileResponse</span></span></span>:</span></span> </span> return</span> FileResponse</span></span></span></span>(</span>JS_PATH</span></span>,</span> media_type</span>=</span>"</span></span></span>application/javascript"</span></span></span>)</span></span> </span> </span> </span>@</span></span></span>app</span></span>.</span></span>get</span></span></span></span>(</span></span>"</span></span></span>/dontpanic.png"</span></span></span></span>)</span></span> </span>async</span> def</span></span> dontpanic_png</span></span></span>(</span></span>)</span></span> </span>-></span> FileResponse</span></span></span>:</span></span> </span> return</span> FileResponse</span></span></span></span>(</span>IMG_PATH</span></span>,</span> media_type</span>=</span>"</span></span></span>image/png"</span></span></span>)</span></span> </span> </span> </span>@</span></span></span>app</span></span>.</span></span>get</span></span></span></span>(</span></span>"</span></span></span>/favicon.ico"</span></span></span></span>)</span></span> </span>async</span> def</span></span> favicon_ico</span></span></span>(</span></span>request</span></span>:</span> Request</span></span></span>)</span></span> </span>-></span> FileResponse</span></span></span>:</span></span> </span> ip</span></span> =</span> _client_ip</span></span></span></span>(</span>request</span></span>)</span></span> </span> _favicon_hits</span></span></span>[</span></span>ip</span></span></span>]</span></span> =</span> _now</span></span></span></span>(</span>)</span></span> </span> return</span> FileResponse</span></span></span></span>(</span>FAVICON_PATH</span></span>,</span> media_type</span>=</span>"</span></span></span>image/x-icon"</span></span></span>)</span></span> </span> </span></code></pre> 🔗</a>3. Frontend PoH / PoW Script (poh.js</code>)</h2> So with the back-end handling the verification, the browser-side logic lives in /opt/poh/app/static/poh.js</code>. It:</p> Ensures a persistent ECDSA P‑256 keypair (stored in localStorage</code> as JWK).</li> Fetches a challenge from /poh/start</code> when the user holds the logo.</li> Runs the PoW loop (SHA-256(challenge + counter)</code>) until the hash meets the difficulty.</li> Signs (challenge + counter + hash)</code> with the private key using WebCrypto (ECDSA</code> + SHA-256</code>).</li> Sends the signed payload to /poh/verify</code> and redirects to /searxng/</code> on success.</li> </ul> 🔗</a>Minimal version:</h3> (</span>async</span> (</span>)</span></span> </span>=></span> {</span> </span></span></span> const</span> holder</span></span> </span>=</span> document</span>.</span>getElementById</span></span>(</span>"</span>holder"</span></span>)</span></span>;</span> </span></span></span> const</span> statusEl</span></span> </span>=</span> document</span>.</span>getElementById</span></span>(</span>"</span>status"</span></span>)</span></span>;</span> </span></span></span> const</span> attemptsEl</span></span> </span>=</span> document</span>.</span>getElementById</span></span>(</span>"</span>attempts"</span></span>)</span></span>;</span> </span></span></span> const</span> etaEl</span></span> </span>=</span> document</span>.</span>getElementById</span></span>(</span>"</span>eta"</span></span>)</span></span>;</span> </span></span></span> const</span> glowSvg</span></span> </span>=</span> document</span>.</span>getElementById</span></span>(</span>"</span>glow"</span></span>)</span></span>;</span> </span></span></span> const</span> glowRect</span></span> </span>=</span> document</span>.</span>getElementById</span></span>(</span>"</span>glow-rect"</span></span>)</span></span>;</span> </span></span></span> </span></span></span> if</span> (</span>!</span>holder</span> \|\|</span> !</span>statusEl</span>)</span> {</span> </span></span></span></span> console</span>.</span>error</span></span>(</span>"</span>PoH UI elements not found"</span></span>)</span>;</span> </span></span></span></span> return</span>;</span> </span></span></span></span> }</span></span> </span></span></span> </span></span></span> let</span> holding</span></span> </span>=</span> false</span></span>;</span> </span></span></span> </span></span></span> function</span> setStatus</span></span>(</span>text</span>)</span></span> {</span> </span></span></span></span></span> statusEl</span>.</span>textContent</span> =</span> text</span>;</span> </span></span></span></span></span> }</span></span></span> </span></span></span> </span></span></span> function</span> setAttempts</span></span>(</span>count</span>)</span></span> {</span> </span></span></span></span></span> if</span> (</span>attemptsEl</span>)</span> attemptsEl</span>.</span>textContent</span> =</span> `</span>Attempts: ${</span></span>count</span>.</span>toLocaleString</span></span>(</span>)</span></span>}</span></span>`</span></span>;</span> </span></span></span></span></span> }</span></span></span> </span></span></span> </span></span></span> function</span> setEta</span></span>(</span>text</span>)</span></span> {</span> </span></span></span></span></span> if</span> (</span>etaEl</span>)</span> etaEl</span>.</span>textContent</span> =</span> text</span>;</span> </span></span></span></span></span> }</span></span></span> </span></span></span> </span></span></span> function</span> toHex</span></span>(</span>buffer</span>)</span></span> {</span> </span></span></span></span></span> const</span> bytes</span></span> </span>=</span> new</span> Uint8Array</span>(</span>buffer</span>)</span></span></span>;</span> </span></span></span></span></span> return</span> Array</span>.</span>from</span></span>(</span>bytes</span>)</span> </span></span></span></span></span> .</span>map</span></span>(</span>b</span> </span>=></span> </span>b</span>.</span>toString</span></span>(</span>16</span>)</span>.</span>padStart</span></span>(</span>2</span>,</span> "</span>0"</span></span>)</span>)</span> </span></span></span></span></span> .</span>join</span></span>(</span>"</span>"</span></span>)</span>;</span> </span></span></span></span></span> }</span></span></span> </span></span></span> </span></span></span> async</span> function</span> sha256Hex</span></span>(</span>str</span>)</span></span> {</span> </span></span></span></span></span> const</span> enc</span></span> </span>=</span> new</span> TextEncoder</span>(</span>)</span></span></span>;</span> </span></span></span></span></span> const</span> data</span></span> </span>=</span> enc</span>.</span>encode</span></span>(</span>str</span>)</span></span>;</span> </span></span></span></span></span> const</span> digest</span></span> </span>=</span> await</span> crypto</span>.</span>subtle</span>.</span>digest</span></span>(</span>"</span>SHA-256"</span></span>,</span> data</span>)</span></span>;</span> </span></span></span></span></span> return</span> toHex</span></span>(</span>digest</span>)</span>;</span> </span></span></span></span></span> }</span></span></span> </span></span></span> </span></span></span> function</span> leadingZeroBitsFromHex</span></span>(</span>hex</span>)</span></span> {</span> </span></span></span></span></span> const</span> bytes</span></span> </span>=</span> new</span> Uint8Array</span>(</span>hex</span>.</span>length</span> /</span> 2</span>)</span></span></span>;</span> </span></span></span></span></span> for</span> (</span>let</span> i</span></span> </span>=</span> 0</span></span>;</span> i</span> <</span> bytes</span>.</span>length</span>;</span> i</span>++</span>)</span> {</span> </span></span></span></span></span></span> bytes</span>[</span>i</span>]</span></span> =</span> parseInt</span></span>(</span>hex</span>.</span>substr</span></span>(</span>i</span> </span> 2</span>,</span> 2</span>)</span>,</span> 16</span>)</span>;</span> </span></span></span></span></span></span> }</span></span> </span></span></span></span></span> let</span> bits</span></span> </span>=</span> 0</span></span>;</span> </span></span></span></span></span> for</span> (</span>let</span> i</span></span> </span>=</span> 0</span></span>;</span> i</span> <</span> bytes</span>.</span>length</span>;</span> i</span>++</span>)</span> {</span> </span></span></span></span></span></span> const</span> byte</span></span> </span>=</span> bytes</span>[</span>i</span>]</span></span></span>;</span> </span></span></span></span></span></span> if</span> (</span>byte</span> ===</span> 0</span>)</span> bits</span> +=</span> 8</span>;</span> </span></span></span></span></span></span> else</span> {</span> </span></span></span></span></span></span></span> bits</span> +=</span> 8</span> -</span> byte</span>.</span>toString</span></span>(</span>2</span>)</span>.</span>length</span>;</span> </span></span></span></span></span></span></span> break</span>;</span> </span></span></span></span></span></span></span> }</span></span> </span></span></span></span></span></span> }</span></span> </span></span></span></span></span> return</span> bits</span>;</span> </span></span></span></span></span> }</span></span></span> </span></span></span> </span></span></span> const</span> STORAGE_KEY</span></span> </span>=</span> "</span>poh-keypair"</span></span></span>;</span> </span></span></span> </span></span></span> async</span> function</span> storeKeyPair</span></span>(</span>keyPair</span>)</span></span> {</span> </span></span></span></span></span> const</span> privJwk</span></span> </span>=</span> await</span> crypto</span>.</span>subtle</span>.</span>exportKey</span></span>(</span>"</span>jwk"</span></span>,</span> keyPair</span>.</span>privateKey</span>)</span></span>;</span> </span></span></span></span></span> const</span> pubJwk</span></span> </span>=</span> await</span> crypto</span>.</span>subtle</span>.</span>exportKey</span></span>(</span>"</span>jwk"</span></span>,</span> keyPair</span>.</span>publicKey</span>)</span></span>;</span> </span></span></span></span></span> localStorage</span>.</span>setItem</span></span>(</span>STORAGE_KEY</span>,</span> JSON</span>.</span>stringify</span></span>(</span>{</span> privateKey</span></span>:</span></span> privJwk</span></span>,</span> publicKey</span></span>:</span></span> pubJwk</span> </span>}</span></span>)</span>)</span>;</span> </span></span></span></span></span> }</span></span></span> </span></span></span> </span></span></span> async</span> function</span> loadKeyPair</span></span>(</span>)</span></span> {</span> </span></span></span></span></span> const</span> raw</span></span> </span>=</span> localStorage</span>.</span>getItem</span></span>(</span>STORAGE_KEY</span>)</span></span>;</span> </span></span></span></span></span> if</span> (</span>!</span>raw</span>)</span> return</span> null</span>;</span> </span></span></span></span></span> try</span> {</span> </span></span></span></span></span></span> const</span> payload</span></span> </span>=</span> JSON</span>.</span>parse</span></span>(</span>raw</span>)</span></span>;</span> </span></span></span></span></span></span> const</span> priv</span></span> </span>=</span> await</span> crypto</span>.</span>subtle</span>.</span>importKey</span></span>(</span> </span></span></span></span></span></span></span> "</span>jwk"</span></span>,</span> </span></span></span></span></span></span></span> payload</span>.</span>privateKey</span>,</span> </span></span></span></span></span></span></span> {</span> name</span></span>:</span></span> "</span>ECDSA"</span></span></span>,</span> namedCurve</span></span>:</span></span> "</span>P-256"</span></span> </span>}</span></span>,</span> </span></span></span></span></span></span></span> true</span>,</span> </span></span></span></span></span></span></span> [</span>"</span>sign"</span></span>]</span></span>,</span> </span></span></span></span></span></span></span> )</span></span>;</span> </span></span></span></span></span></span> const</span> pub</span></span> </span>=</span> await</span> crypto</span>.</span>subtle</span>.</span>importKey</span></span>(</span> </span></span></span></span></span></span></span> "</span>jwk"</span></span>,</span> </span></span></span></span></span></span></span> payload</span>.</span>publicKey</span>,</span> </span></span></span></span></span></span></span> {</span> name</span></span>:</span></span> "</span>ECDSA"</span></span></span>,</span> namedCurve</span></span>:</span></span> "</span>P-256"</span></span> </span>}</span></span>,</span> </span></span></span></span></span></span></span> true</span>,</span> </span></span></span></span></span></span></span> [</span>"</span>verify"</span></span>]</span></span>,</span> </span></span></span></span></span></span></span> )</span></span>;</span> </span></span></span></span></span></span> return</span> {</span> privateKey</span></span>:</span></span> priv</span></span>,</span> publicKey</span></span>:</span></span> pub</span></span>,</span> publicJwk</span></span>:</span></span> payload</span>.</span>publicKey</span> </span>}</span></span>;</span> </span></span></span></span></span></span> }</span></span> catch</span> (</span>e</span>)</span> {</span> </span></span></span></span></span></span> console</span>.</span>error</span></span>(</span>"</span>Failed to load keypair"</span></span>,</span> e</span>)</span>;</span> </span></span></span></span></span></span> return</span> null</span>;</span> </span></span></span></span></span></span> }</span></span> </span></span></span></span></span> }</span></span></span> </span></span></span> </span></span></span> async</span> function</span> getOrCreateKeyPair</span></span>(</span>)</span></span> {</span> </span></span></span></span></span> const</span> existing</span></span> </span>=</span> await</span> loadKeyPair</span></span>(</span>)</span></span>;</span> </span></span></span></span></span> if</span> (</span>existing</span>)</span> return</span> existing</span>;</span> </span></span></span></span></span> const</span> generated</span></span> </span>=</span> await</span> crypto</span>.</span>subtle</span>.</span>generateKey</span></span>(</span> </span></span></span></span></span></span> {</span> name</span></span>:</span></span> "</span>ECDSA"</span></span></span>,</span> namedCurve</span></span>:</span></span> "</span>P-256"</span></span> </span>}</span></span>,</span> </span></span></span></span></span></span> true</span>,</span> </span></span></span></span></span></span> [</span>"</span>sign"</span></span>,</span> "</span>verify"</span></span>]</span></span>,</span> </span></span></span></span></span></span> )</span></span>;</span> </span></span></span></span></span> await</span> storeKeyPair</span></span>(</span>generated</span>)</span>;</span> </span></span></span></span></span> const</span> pubJwk</span></span> </span>=</span> await</span> crypto</span>.</span>subtle</span>.</span>exportKey</span></span>(</span>"</span>jwk"</span></span>,</span> generated</span>.</span>publicKey</span>)</span></span>;</span> </span></span></span></span></span> return</span> {</span> privateKey</span></span>:</span></span> generated</span>.</span>privateKey</span></span>,</span> publicKey</span></span>:</span></span> generated</span>.</span>publicKey</span></span>,</span> publicJwk</span></span>:</span></span> pubJwk</span> </span>}</span></span>;</span> </span></span></span></span></span> }</span></span></span> </span></span></span> </span></span></span> </span>//</span></span> Tron glow</span> </span></span></span> let</span> glowLen</span></span> </span>=</span> 0</span></span>;</span> </span></span></span> let</span> glowOffset</span></span> </span>=</span> 0</span></span>;</span> </span></span></span> let</span> glowAnimating</span></span> </span>=</span> false</span></span>;</span> </span></span></span> let</span> bestBits</span></span> </span>=</span> 0</span></span>;</span> </span></span></span> </span></span></span> function</span> layoutGlow</span></span>(</span>)</span></span> {</span> </span></span></span></span></span> if</span> (</span>!</span>glowSvg</span> \|\|</span> !</span>glowRect</span> \|\|</span> !</span>holder</span>)</span> return</span>;</span> </span></span></span></span></span> const</span> w</span></span> </span>=</span> holder</span>.</span>offsetWidth</span> +</span> 8</span></span>;</span> </span></span></span></span></span> const</span> h</span></span> </span>=</span> holder</span>.</span>offsetHeight</span> +</span> 8</span></span>;</span> </span></span></span></span></span> glowSvg</span>.</span>setAttribute</span></span>(</span>"</span>viewBox"</span></span>,</span> `</span>0 0 ${</span></span>w</span></span>}</span></span> ${</span></span>h</span></span>}</span></span>`</span></span>)</span>;</span> </span></span></span></span></span> glowSvg</span>.</span>setAttribute</span></span>(</span>"</span>width"</span></span>,</span> String</span></span>(</span>w</span>)</span>)</span>;</span> </span></span></span></span></span> glowSvg</span>.</span>setAttribute</span></span>(</span>"</span>height"</span></span>,</span> String</span></span>(</span>h</span>)</span>)</span>;</span> </span></span></span></span></span> glowRect</span>.</span>setAttribute</span></span>(</span>"</span>x"</span></span>,</span> "</span>2"</span></span>)</span>;</span> </span></span></span></span></span> glowRect</span>.</span>setAttribute</span></span>(</span>"</span>y"</span></span>,</span> "</span>2"</span></span>)</span>;</span> </span></span></span></span></span> glowRect</span>.</span>setAttribute</span></span>(</span>"</span>width"</span></span>,</span> String</span></span>(</span>w</span> -</span> 4</span>)</span>)</span>;</span> </span></span></span></span></span> glowRect</span>.</span>setAttribute</span></span>(</span>"</span>height"</span></span>,</span> String</span></span>(</span>h</span> -</span> 4</span>)</span>)</span>;</span> </span></span></span></span></span> glowRect</span>.</span>setAttribute</span></span>(</span>"</span>rx"</span></span>,</span> "</span>18"</span></span>)</span>;</span> </span></span></span></span></span> try</span> {</span> </span></span></span></span></span></span> glowLen</span> =</span> glowRect</span>.</span>getTotalLength</span></span>(</span>)</span>;</span> </span></span></span></span></span></span> }</span></span> catch</span> {</span> </span></span></span></span></span></span> glowLen</span> =</span> w</span> </span> 2</span> +</span> h</span> </span> 2</span>;</span> </span></span></span></span></span></span> }</span></span> </span></span></span></span></span> glowRect</span>.</span>style</span>.</span>strokeDasharray</span> =</span> `</span>0 ${</span></span>glowLen</span></span>}</span></span>`</span></span>;</span> </span></span></span></span></span> glowRect</span>.</span>style</span>.</span>strokeDashoffset</span> =</span> "</span>0"</span></span>;</span> </span></span></span></span></span> }</span></span></span> </span></span></span> </span></span></span> function</span> setProgress</span></span>(</span>progress</span>)</span></span> {</span> </span></span></span></span></span> if</span> (</span>!</span>glowRect</span> \|\|</span> !</span>glowLen</span>)</span> return</span>;</span> </span></span></span></span></span> const</span> p</span></span> </span>=</span> Math</span>.</span>max</span></span>(</span>0</span>,</span> Math</span>.</span>min</span></span>(</span>1</span>,</span> progress</span>)</span>)</span></span>;</span> </span></span></span></span></span> const</span> lit</span></span> </span>=</span> Math</span>.</span>max</span></span>(</span>12</span>,</span> Math</span>.</span>floor</span></span>(</span>glowLen</span> </span> p</span>)</span>)</span></span>;</span> </span></span></span></span></span> glowRect</span>.</span>style</span>.</span>strokeDasharray</span> =</span> `</span>${</span></span>lit</span></span>}</span></span> ${</span></span>glowLen</span> -</span> lit</span></span>}</span></span>`</span></span>;</span> </span></span></span></span></span> }</span></span></span> </span></span></span> </span></span></span> function</span> tickGlow</span></span>(</span>)</span></span> {</span> </span></span></span></span></span> if</span> (</span>!</span>glowAnimating</span> \|\|</span> !</span>glowRect</span> \|\|</span> !</span>glowLen</span>)</span> return</span>;</span> </span></span></span></span></span> glowOffset</span> =</span> (</span>glowOffset</span> +</span> 6</span>)</span> %</span> glowLen</span>;</span> </span></span></span></span></span> glowRect</span>.</span>style</span>.</span>strokeDashoffset</span> =</span> String</span></span>(</span>-</span>glowOffset</span>)</span>;</span> </span></span></span></span></span> requestAnimationFrame</span></span>(</span>tickGlow</span>)</span>;</span> </span></span></span></span></span> }</span></span></span> </span></span></span> </span></span></span> window</span>.</span>addEventListener</span></span>(</span>"</span>resize"</span></span>,</span> layoutGlow</span>)</span>;</span> </span></span></span> </span></span></span> async</span> function</span> runPoW</span></span>(</span>challenge</span>,</span> difficulty</span>)</span></span> {</span> </span></span></span></span></span> setStatus</span></span>(</span>"</span>Running proof-of-work..."</span></span>)</span>;</span> </span></span></span></span></span> setAttempts</span></span>(</span>0</span>)</span>;</span> </span></span></span></span></span> setEta</span></span>(</span>"</span>Estimating hold time..."</span></span>)</span>;</span> </span></span></span></span></span> </span></span></span></span></span> layoutGlow</span></span>(</span>)</span>;</span> </span></span></span></span></span> glowAnimating</span> =</span> true</span>;</span> </span></span></span></span></span> bestBits</span> =</span> 0</span>;</span> </span></span></span></span></span> setProgress</span></span>(</span>0</span>)</span>;</span> </span></span></span></span></span> requestAnimationFrame</span></span>(</span>tickGlow</span>)</span>;</span> </span></span></span></span></span> </span></span></span></span></span> let</span> counter</span></span> </span>=</span> 0</span></span>;</span> </span></span></span></span></span> const</span> batchSize</span></span> </span>=</span> 1000</span></span>;</span> </span></span></span></span></span> const</span> start</span></span> </span>=</span> performance</span>.</span>now</span></span>(</span>)</span></span>;</span> </span></span></span></span></span> let</span> lastUpdate</span></span> </span>=</span> start</span></span>;</span> </span></span></span></span></span> </span></span></span></span></span> </span>//</span></span> eslint-disable-next-line no-constant-condition</span> </span></span></span></span></span> while</span> (</span>true</span>)</span> {</span> </span></span></span></span></span></span> if</span> (</span>!</span>holding</span>)</span> {</span> </span></span></span></span></span></span></span> setStatus</span></span>(</span>"</span>Released; PoH paused. Hold to resume."</span></span>)</span>;</span> </span></span></span></span></span></span></span> glowAnimating</span> =</span> false</span>;</span> </span></span></span></span></span></span></span> return</span> null</span>;</span> </span></span></span></span></span></span></span> }</span></span> </span></span></span></span></span></span> </span></span></span></span></span></span> const</span> hash</span></span> </span>=</span> await</span> sha256Hex</span></span>(</span>challenge</span> +</span> String</span></span>(</span>counter</span>)</span>)</span></span>;</span> </span></span></span></span></span></span> const</span> bits</span></span> </span>=</span> leadingZeroBitsFromHex</span></span>(</span>hash</span>)</span></span>;</span> </span></span></span></span></span></span> if</span> (</span>bits</span> ></span> bestBits</span>)</span> {</span> </span></span></span></span></span></span></span> bestBits</span> =</span> bits</span>;</span> </span></span></span></span></span></span></span> if</span> (</span>difficulty</span> ></span> 0</span>)</span> setProgress</span></span>(</span>bestBits</span> /</span> difficulty</span>)</span>;</span> </span></span></span></span></span></span></span> }</span></span> </span></span></span></span></span></span> if</span> (</span>bits</span> >=</span> difficulty</span>)</span> {</span> </span></span></span></span></span></span></span> const</span> now</span></span> </span>=</span> performance</span>.</span>now</span></span>(</span>)</span></span>;</span> </span></span></span></span></span></span></span> const</span> elapsedSec</span></span> </span>=</span> (</span>now</span> -</span> start</span>)</span> /</span> 1000</span></span>;</span> </span></span></span></span></span></span></span> setAttempts</span></span>(</span>counter</span>)</span>;</span> </span></span></span></span></span></span></span> setEta</span></span>(</span>`</span>Done in ${</span></span>elapsedSec</span>.</span>toFixed</span></span>(</span>1</span>)</span></span>}</span></span>s`</span></span>)</span>;</span> </span></span></span></span></span></span></span> glowAnimating</span> =</span> false</span>;</span> </span></span></span></span></span></span></span> setProgress</span></span>(</span>1</span>)</span>;</span> </span></span></span></span></span></span></span> return</span> {</span> challenge</span></span>,</span> counter</span></span>,</span> hash</span></span>,</span> difficulty</span> </span>}</span></span>;</span> </span></span></span></span></span></span></span> }</span></span> </span></span></span></span></span></span> counter</span>++</span>;</span> </span></span></span></span></span></span> if</span> (</span>counter</span> %</span> batchSize</span> ===</span> 0</span>)</span> {</span> </span></span></span></span></span></span></span> const</span> now</span></span> </span>=</span> performance</span>.</span>now</span></span>(</span>)</span></span>;</span> </span></span></span></span></span></span></span> if</span> (</span>now</span> -</span> lastUpdate</span> >=</span> 250</span>)</span> {</span> </span></span></span></span></span></span></span></span> lastUpdate</span> =</span> now</span>;</span> </span></span></span></span></span></span></span></span> const</span> elapsedSec</span></span> </span>=</span> (</span>now</span> -</span> start</span>)</span> /</span> 1000</span></span>;</span> </span></span></span></span></span></span></span></span> setAttempts</span></span>(</span>counter</span>)</span>;</span> </span></span></span></span></span></span></span></span> if</span> (</span>elapsedSec</span> ></span> 0</span>)</span> {</span> </span></span></span></span></span></span></span></span></span> const</span> rate</span></span> </span>=</span> counter</span> /</span> elapsedSec</span></span>;</span> </span></span></span></span></span></span></span></span></span> const</span> expectedTotal</span></span> </span>=</span> Math</span>.</span>pow</span></span>(</span>2</span>,</span> difficulty</span>)</span></span>;</span> </span></span></span></span></span></span></span></span></span> const</span> remaining</span></span> </span>=</span> Math</span>.</span>max</span></span>(</span>expectedTotal</span> -</span> counter</span>,</span> 0</span>)</span></span>;</span> </span></span></span></span></span></span></span></span></span> const</span> etaSec</span></span> </span>=</span> remaining</span> /</span> rate</span></span>;</span> </span></span></span></span></span></span></span></span></span> const</span> clamped</span></span> </span>=</span> Math</span>.</span>max</span></span>(</span>0</span>,</span> Math</span>.</span>min</span></span>(</span>3600</span>,</span> etaSec</span>)</span>)</span></span>;</span> </span></span></span></span></span></span></span></span></span> setEta</span></span>(</span>`</span>Estimated time remaining: ${</span></span>clamped</span>.</span>toFixed</span></span>(</span>1</span>)</span></span>}</span></span>s`</span></span>)</span>;</span> </span></span></span></span></span></span></span></span></span> }</span></span> else</span> {</span> </span></span></span></span></span></span></span></span></span> setEta</span></span>(</span>"</span>Estimating hold time..."</span></span>)</span>;</span> </span></span></span></span></span></span></span></span></span> }</span></span> </span></span></span></span></span></span></span></span> await</span> new</span> Promise</span>(</span>resolve</span> </span>=></span> </span>setTimeout</span></span>(</span>resolve</span>,</span> 0</span>)</span>)</span></span>;</span> </span></span></span></span></span></span></span></span> }</span></span> </span></span></span></span></span></span></span> }</span></span> </span></span></span></span></span></span> }</span></span> </span></span></span></span></span> }</span></span></span> </span></span></span> </span></span></span> function</span> arrayBufferToBase64</span></span>(</span>buffer</span>)</span></span> {</span> </span></span></span></span></span> const</span> bytes</span></span> </span>=</span> new</span> Uint8Array</span>(</span>buffer</span>)</span></span></span>;</span> </span></span></span></span></span> let</span> binary</span></span> </span>=</span> "</span>"</span></span></span>;</span> </span></span></span></span></span> for</span> (</span>let</span> i</span></span> </span>=</span> 0</span></span>;</span> i</span> <</span> bytes</span>.</span>length</span>;</span> i</span>++</span>)</span> {</span> </span></span></span></span></span></span> binary</span> +=</span> String</span>.</span>fromCharCode</span></span>(</span>bytes</span>[</span>i</span>]</span></span>)</span>;</span> </span></span></span></span></span></span> }</span></span> </span></span></span></span></span> return</span> btoa</span></span>(</span>binary</span>)</span>;</span> </span></span></span></span></span> }</span></span></span> </span></span></span> </span></span></span> async</span> function</span> signPoW</span></span>(</span>privateKey</span>,</span> result</span>,</span> publicJwk</span>)</span></span> {</span> </span></span></span></span></span> const</span> message</span></span> </span>=</span> result</span>.</span>challenge</span> +</span> String</span></span>(</span>result</span>.</span>counter</span>)</span> +</span> result</span>.</span>hash</span></span>;</span> </span></span></span></span></span> const</span> enc</span></span> </span>=</span> new</span> TextEncoder</span>(</span>)</span></span></span>;</span> </span></span></span></span></span> const</span> data</span></span> </span>=</span> enc</span>.</span>encode</span></span>(</span>message</span>)</span></span>;</span> </span></span></span></span></span> const</span> sig</span></span> </span>=</span> await</span> crypto</span>.</span>subtle</span>.</span>sign</span></span>(</span>{</span> name</span></span>:</span></span> "</span>ECDSA"</span></span></span>,</span> hash</span></span>:</span></span> "</span>SHA-256"</span></span> </span>}</span></span>,</span> privateKey</span>,</span> data</span>)</span></span>;</span> </span></span></span></span></span> const</span> signatureB64</span></span> </span>=</span> arrayBufferToBase64</span></span>(</span>sig</span>)</span></span>;</span> </span></span></span></span></span> return</span> {</span> </span></span></span></span></span></span> challenge</span></span>:</span></span> result</span>.</span>challenge</span></span>,</span> </span></span></span></span></span></span> counter</span></span>:</span></span> result</span>.</span>counter</span></span>,</span> </span></span></span></span></span></span> hash</span></span>:</span></span> result</span>.</span>hash</span></span>,</span> </span></span></span></span></span></span> signature</span></span>:</span></span> signatureB64</span></span>,</span> </span></span></span></span></span></span> public_key</span></span>:</span></span> publicJwk</span></span>,</span> </span></span></span></span></span></span> timestamp</span></span>:</span></span> new</span> Date</span>(</span>)</span></span>.</span>toISOString</span></span>(</span>)</span></span>,</span> </span></span></span></span></span></span> }</span></span>;</span> </span></span></span></span></span> }</span></span></span> </span></span></span> </span></span></span> async</span> function</span> sendVerification</span></span>(</span>payload</span>)</span></span> {</span> </span></span></span></span></span> setStatus</span></span>(</span>"</span>Sending verification..."</span></span>)</span>;</span> </span></span></span></span></span> const</span> res</span></span> </span>=</span> await</span> fetch</span></span>(</span>"</span>/poh/verify"</span></span>,</span> {</span> </span></span></span></span></span></span></span> method</span></span>:</span></span> "</span>POST"</span></span></span>,</span> </span></span></span></span></span></span></span> headers</span></span>:</span></span> {</span> "</span>Content-Type"</span></span></span></span>:</span></span> "</span>application/json"</span></span> </span>}</span></span></span>,</span> </span></span></span></span></span></span></span> body</span></span>:</span></span> JSON</span>.</span>stringify</span></span>(</span>payload</span>)</span></span>,</span> </span></span></span></span></span></span></span> }</span></span>)</span></span>;</span> </span></span></span></span></span> if</span> (</span>!</span>res</span>.</span>ok</span>)</span> {</span> </span></span></span></span></span></span> const</span> text</span></span> </span>=</span> await</span> res</span>.</span>text</span></span>(</span>)</span></span>;</span> </span></span></span></span></span></span> throw</span> new</span> Error</span>(</span>`</span>Verify failed: ${</span></span>res</span>.</span>status</span></span>}</span></span> ${</span></span>text</span></span>}</span></span>`</span></span>)</span></span>;</span> </span></span></span></span></span></span> }</span></span> </span></span></span></span></span> return</span> res</span>.</span>json</span></span>(</span>)</span>;</span> </span></span></span></span></span> }</span></span></span> </span></span></span> </span></span></span> async</span> function</span> startPoH</span></span>(</span>)</span></span> {</span> </span></span></span></span></span> try</span> {</span> </span></span></span></span></span></span> setStatus</span></span>(</span>"</span>Requesting challenge..."</span></span>)</span>;</span> </span></span></span></span></span></span> const</span> kp</span></span> </span>=</span> await</span> getOrCreateKeyPair</span></span>(</span>)</span></span>;</span> </span></span></span></span></span></span> const</span> startRes</span></span> </span>=</span> await</span> fetch</span></span>(</span>"</span>/poh/start"</span></span>)</span></span>;</span> </span></span></span></span></span></span> if</span> (</span>!</span>startRes</span>.</span>ok</span>)</span> throw</span> new</span> Error</span>(</span>`</span>Failed to start PoH: ${</span></span>startRes</span>.</span>status</span></span>}</span></span>`</span></span>)</span></span>;</span> </span></span></span></span></span></span> const</span> startData</span></span> </span>=</span> await</span> startRes</span>.</span>json</span></span>(</span>)</span></span>;</span> </span></span></span></span></span></span> const</span> {</span> challenge</span></span>,</span> difficulty</span></span> }</span> </span>=</span> startData</span></span>;</span> </span></span></span></span></span></span> const</span> powResult</span></span> </span>=</span> await</span> runPoW</span></span>(</span>challenge</span>,</span> difficulty</span>)</span></span>;</span> </span></span></span></span></span></span> if</span> (</span>!</span>powResult</span>)</span> return</span>;</span> </span></span></span></span></span></span> setStatus</span></span>(</span>"</span>Signing proof-of-work result..."</span></span>)</span>;</span> </span></span></span></span></span></span> const</span> signed</span></span> </span>=</span> await</span> signPoW</span></span>(</span>kp</span>.</span>privateKey</span>,</span> powResult</span>,</span> kp</span>.</span>publicJwk</span>)</span></span>;</span> </span></span></span></span></span></span> const</span> verifyRes</span></span> </span>=</span> await</span> sendVerification</span></span>(</span>signed</span>)</span></span>;</span> </span></span></span></span></span></span> if</span> (</span>verifyRes</span>.</span>status</span> ===</span> "</span>ok"</span></span>)</span> {</span> </span></span></span></span></span></span></span> setStatus</span></span>(</span>"</span>Proof-of-human completed. Redirecting to search..."</span></span>)</span>;</span> </span></span></span></span></span></span></span> window</span>.</span>location</span>.</span>href</span> =</span> "</span>/searxng/"</span></span>;</span> </span></span></span></span></span></span></span> }</span></span> else</span> {</span> </span></span></span></span></span></span></span> setStatus</span></span>(</span>"</span>Verification failed."</span></span>)</span>;</span> </span></span></span></span></span></span></span> console</span>.</span>error</span></span>(</span>"</span>Verification error"</span></span>,</span> verifyRes</span>)</span>;</span> </span></span></span></span></span></span></span> }</span></span> </span></span></span></span></span></span> }</span></span> catch</span> (</span>e</span>)</span> {</span> </span></span></span></span></span></span> console</span>.</span>error</span></span>(</span>"</span>PoH error"</span></span>,</span> e</span>)</span>;</span> </span></span></span></span></span></span> setStatus</span></span>(</span>"</span>Error during PoH: "</span></span> +</span> (</span>e</span> &&</span> e</span>.</span>message</span> ?</span> e</span>.</span>message</span> :</span> String</span></span>(</span>e</span>)</span>)</span>)</span>;</span> </span></span></span></span></span></span> glowAnimating</span> =</span> false</span>;</span> </span></span></span></span></span></span> }</span></span> </span></span></span></span></span> }</span></span></span> </span></span></span> </span></span></span> function</span> handlePointerDown</span></span>(</span>e</span>)</span></span> {</span> </span></span></span></span></span> e</span>.</span>preventDefault</span></span>(</span>)</span>;</span> </span></span></span></span></span> if</span> (</span>holding</span>)</span> return</span>;</span> </span></span></span></span></span> holding</span> =</span> true</span>;</span> </span></span></span></span></span> startPoH</span></span>(</span>)</span>.</span>finally</span></span>(</span>(</span>)</span></span> </span>=></span> {</span> </span></span></span></span></span></span></span> holding</span> =</span> false</span>;</span> </span></span></span></span></span></span></span> }</span></span></span>)</span>;</span> </span></span></span></span></span> }</span></span></span> </span></span></span> </span></span></span> function</span> handlePointerUp</span></span>(</span>e</span>)</span></span> {</span> </span></span></span></span></span> e</span>.</span>preventDefault</span></span>(</span>)</span>;</span> </span></span></span></span></span> holding</span> =</span> false</span>;</span> </span></span></span></span></span> }</span></span></span> </span></span></span> </span></span></span> holder</span>.</span>addEventListener</span></span>(</span>"</span>pointerdown"</span></span>,</span> handlePointerDown</span>)</span>;</span> </span></span></span> holder</span>.</span>addEventListener</span></span>(</span>"</span>pointerup"</span></span>,</span> handlePointerUp</span>)</span>;</span> </span></span></span> holder</span>.</span>addEventListener</span></span>(</span>"</span>pointercancel"</span></span>,</span> handlePointerUp</span>)</span>;</span> </span></span></span> holder</span>.</span>addEventListener</span></span>(</span>"</span>pointerleave"</span></span>,</span> handlePointerUp</span>)</span>;</span> </span></span></span> </span></span></span> layoutGlow</span></span>(</span>)</span>;</span> </span></span></span>}</span></span></span>)</span>(</span>)</span>;</span> </span></code></pre> The JS is entirely optional from the server’s perspective: any client that can solve the PoW, sign the result, and call /poh/verify</code> with the correct payload will be accepted. The point is to make that cheap for human browsers and unattractive for bot automatons.</p> 🔗</a>4. Static Assets and Favicon Behaviour</h2> “So what’s with the favicon.ico behavior, guv?” “Well the truth is, bots don’t download favicon.ico’s because they don’t need them, humans want them.”</p> 🔗</a>4.1. Don’t Panic logo</h3> Yes, I am a Hitchikers Guide to the Galaxy type of person.</p> Locally stored at /opt/poh/app/static/dontpanic.png</code>.</li> Served via GET /dontpanic.png</code>.</li> Used as the visual “button” inside the PoH page.</li> </ul> 🔗</a>4.2. Towel favicon and heuristic</h3> Locally stored at /opt/poh/app/static/favicon.ico</code>, built from a towel PNG.</li> Served by GET /favicon.ico</code>.</li> Each favicon request records _favicon_hits[ip] = _now()</code>.</li> /poh/start</code> looks up _favicon_hits</code>: If the IP hasn’t fetched the favicon in the last 10 minutes, the PoW difficulty is bumped by 4 bits and the session TTL is later shortened.</li> 4 bits may not sound like much, but it’s orders of magnitude harder.</li> </ul> </li> </ul> This adds a low‑cost behavioural signal: most browsers fetch the favicon automatically, whereas many simple HTTP clients do not.</p> 🔗</a>5. Systemd and Caddy Integration (Summary)</h2> For quick reference:</p> PoH app</strong></p> Code lives under /opt/poh/app</code>.</li> venv at /opt/poh/venv</code>.</li> Service: poh.service</code> running uvicorn on 127.0.0.1:9000</code>.</li> </ul> </li> SearXNG</strong></p> Still managed by uWSGI, now also exposing HTTP on 127.0.0.1:8888</code> via http-socket</code>.</li> </ul> </li> Caddy</strong></p> Uses a delphi-common</code> snippet containing: Shared headers.</li> PoH cookie gating for /searxng</code>.</li> Reverse proxy to PoH app for everything else.</li> </ul> </li> Two site blocks: delphi.example.com</code> (Let’s Encrypt).</li> delphi.abc123.ts.net</code> (Tailscale cert via tailscale cert</code>).</li> </ul> </li> </ul> </li> </ul> This keeps the routing picture simple while allowing both public DNS and Tailscale names to share the same gate and SearXNG backend.</p> 🔗</a>6. Complete Config Reference</h2> This section pulls together the key files so someone can reproduce the exact setup.</p> 🔗</a>6.1. /opt/poh/app/main.py</code></h3> This file is shown in full in section 2</strong> and can be copied as‑is. It provides:</p> /poh/start</code> and /poh/verify</code> endpoints.</li> PoW verification and WebCrypto signature checking.</li> Session cookie issuance with TTL depending on suspicious</code> flag.</li> HTML shell, static file routes, and favicon heuristic.</li> </ul> If you want to regenerate it quickly on a new host, you can copy the entire code block from section 2</strong> into /opt/poh/app/main.py</code>.</p> 🔗</a>6.2. /opt/poh/app/static/poh.js</code></h3> The full, working script is in section 3</strong>. To deploy:</p> mkdir</span></span> -</span>p</span> /opt/poh/app/static</span> </span>cat</span></span> ></span> /opt/poh/app/static/poh.js <<</span> '</span>EOF</span>'</span></span> </span></span></span><paste the script from section 3 here> </span></span></span>EOF</span></span></span> </span></code></pre> 🔗</a>6.3. /etc/systemd/system/poh.service</code></h3> [Unit] </span></span>Description</span>=</span></span>Proof-</span>of-</span>Human FastAPI </span>After</span>=</span></span>network.</span>target </span> </span>[Service] </span></span>User</span>=</span></span>mjh </span>Group</span>=</span></span>mjh </span>WorkingDirectory</span>=</span></span>/</span>opt/</span>poh </span>Environment</span>=</span></span>PATH</span>=</span>/</span>opt/</span>poh/</span>venv/</span>bin:</span>/</span>usr/</span>bin </span>ExecStart</span>=</span></span>/</span>opt/</span>poh/</span>venv/</span>bin/</span>uvicorn app.</span>main:</span>app -</span>-</span>host 127.0.0.1</span></span> -</span>-</span>port 9000</span> </span>Restart</span>=</span></span>always </span>RestartSec</span>=</span></span>2</span> </span> </span>[Install] </span></span>WantedBy</span>=</span></span>multi-</span>user.</span>target </span></code></pre> Enable and start:</p> sudo</span></span> systemctl daemon-reload</span> </span>sudo</span></span> systemctl enable --</span>now</span> poh.service</span> </span></code></pre> 🔗</a>6.4. /etc/uwsgi/apps-enabled/searxng.ini</code> (excerpt)</h3> [uwsgi] </span></span>uid</span> =</span></span> searxng </span>gid</span> =</span></span> searxng </span> </span>env</span> =</span></span> LANG</span>=</span>C</span>.</span>UTF</span>-</span>8</span> </span>env</span> =</span></span> LANGUAGE</span>=</span>C</span>.</span>UTF</span>-</span>8</span> </span>env</span> =</span></span> LC_ALL</span>=</span>C</span>.</span>UTF</span>-</span>8</span> </span> </span>chdir</span> =</span></span> /</span>usr/</span>local/</span>searxng/</span>searxng-</span>src/searx</span> </span>env</span> =</span></span> SEARXNG_SETTINGS_PATH</span>=</span>/</span>etc/</span>searxng/</span>settings.</span>yml </span> </span>disable-logging</span> =</span></span> true</span> </span>chmod-socket</span> =</span></span> 666</span> </span>single-interpreter</span> =</span></span> true</span> </span>master</span> =</span></span> true</span> </span>lazy-apps</span> =</span></span> true</span> </span>plugin</span> =</span></span> python3,</span>http </span>enable-threads</span> =</span></span> true</span> </span>workers</span> =</span></span> %k</span> </span>threads</span> =</span></span> 4</span> </span> </span>module</span> =</span></span> searx.</span>webapp </span>virtualenv</span> =</span></span> /</span>usr/</span>local/</span>searxng/</span>searx-</span>pyenv </span>pythonpath</span> =</span></span> /</span>usr/</span>local/</span>searxng/</span>searxng-</span>src </span> </span>socket</span> =</span></span> /</span>usr/</span>local/</span>searxng/</span>run/</span>socket </span>http-socket</span> =</span></span> 127.0.0.1:8888</span></span> </span>buffer-size</span> =</span></span> 8192</span> </span>offload-threads</span> =</span></span> %k</span> </span></code></pre> After editing:</p> sudo</span></span> systemctl restart uwsgi</span> </span></code></pre> 🔗</a>6.5. /etc/caddy/Caddyfile</code></h3> # Caddyfile for SearXNG + PoH </span></span></span> </span>(delphi-</span>common) { </span> encode</span> </span>zstd gzip </span> header </span>{ </span> X-Frame-Options</span> </span>"SAMEORIGIN"</span> </span> X-Content-Type-Options</span> </span>"nosniff"</span> </span> Referrer-Policy</span> </span>"no-referrer-when-downgrade"</span> </span> } </span> </span> # Match SearXNG requests with PoH cookie present </span></span></span> @searx_poh</span> { </span> path</span> </span>/</span>searxng</span> </span> header</span> </span>Cookie </span>poh_session=</span></span> </span> } </span> </span> # Match all SearXNG requests </span></span></span> @searx_all</span> { </span> path</span> </span>/</span>searxng</span> </span> } </span> </span> # Allow SearXNG only when PoH cookie exists </span></span></span> handle</span> </span>@searx_poh</span> { </span> reverse_proxy</span> </span>http://127.0.0.1:8888</span></span> { </span> header_up</span> </span>Host {host} </span> header_up</span> </span>X</span>-</span>Forwarded-</span>Proto {scheme} </span> header_up</span> </span>X</span>-</span>Script-</span>Name /</span>searxng </span> header_up</span> </span>X</span>-</span>Real-</span>IP</span> {remote} </span> header_up</span> </span>X</span>-</span>Forwarded-</span>For {remote_host} </span> } </span> } </span> </span> # Otherwise, bounce back to the PoH gate </span></span></span> handle</span> </span>@searx_all</span> { </span> redir</span> </span>/</span> 302</span> </span> } </span> </span> # Everything else (/, /poh, JS, images, favicon, etc.) goes to PoH app </span></span></span> handle </span>{ </span> reverse_proxy</span> </span>http://127.0.0.1:9000</span></span> </span> } </span>} </span> </span> </span>delphi</span></span>.</span>example.</span>com { </span> import</span> </span>delphi-</span>common </span>} </span> </span>delphi</span></span>.</span>abc123.</span>ts.</span>net { </span> tls</span> </span>/</span>etc/</span>caddy/</span>delphi-</span>tail.</span>crt /</span>etc/</span>caddy/</span>delphi-</span>tail.</span>key </span> import</span> </span>delphi-</span>common </span>} </span></code></pre> Reload Caddy:</p> sudo</span></span> systemctl restart caddy</span> </span></code></pre> 🔗</a>6.6. Tailscale certificate commands</h3> On the Delphi host (already joined to your Tailscale tailnet):</p> sudo</span></span> tailscale cert delphi.abc123.ts.net</span> </span> </span>sudo</span></span> mv delphi.abc123.ts.net.crt /etc/caddy/delphi-tail.crt</span> </span>sudo</span></span> mv delphi.abc123.ts.net.key /etc/caddy/delphi-tail.key</span> </span>sudo</span></span> chown caddy:caddy /etc/caddy/delphi-tail.</span></span> </span>sudo</span></span> chmod 600 /etc/caddy/delphi-tail.key</span> </span></code></pre> Then restart Caddy as shown above.</p> With these concrete configs in place, a second environment should be able to reproduce what Delphi is currently running: PoH/PoW gate, favicon‑aware difficulty, cookie‑gated SearXNG, and dual hostnames (public + Tailscale) sharing the same routes. If you don’t intend public access, you can now remove the Caddyfile entry for the public host and just use Tailscale.</p> Why your job turned against you 2025-11-05T00:00:00+00:00 🔗</a>Why your job turned on you (and why it wasn’t personal)</h1> 🔗</a>by Icy-Anything5841</h3> I’m a lawyer, 25 years in practice. I’ve been eliminated from institutions five times in my career — not for failing, but for succeeding in ways that apparently made me incompatible with the system. Each time it happened, I spent months trying to figure out what I did wrong. Therapy, self-analysis, the whole thing. Eventually I stopped asking “what did I do wrong?” and started asking “what pattern keeps repeating?” Here’s what I think is actually happening.</p> The Mechanism In hierarchical systems, independent competence creates a pressure imbalance. The hierarchy depends on people needing each other in predictable ways — subordinates need direction, managers need validation, departments need coordination. When someone operates independently, they expose how unnecessary some of these dependencies are. That creates stress on the structure itself. The system responds by eliminating the source of imbalance. Not consciously, not maliciously, but automatically — the way your body fights off foreign cells. You become incompatible with the system’s need to maintain its interdependent structure. This happens faster when the system is already under strain. Budget cuts, leadership changes, political pressure, or economic contraction make the hierarchy fragile. A fragile system eliminates tension, and independent thinkers are tension. The fastest way to restore equilibrium isn’t solving the problem you’re pointing out — it’s removing you.</p> What That Looks Like You stop getting invited to meetings. You’re left off emails or “restructured.” Suddenly your performance is “an issue” even though nothing changed. You’re told you’re “not a team player” for raising the same concerns that once earned praise. Your clarity didn’t make you expendable — it made you incompatible with a system protecting its dependency structure. They didn’t eliminate you because you were wrong. They eliminated you because you were right too soon, and too clearly.</p> Why This Feels Personal (And Isn’t) Being forced out feels like moral judgment. You replay conversations, second-guess every move, question your worth. But what happened was structural, not personal. It feels personal because the rejection came from people you trusted, the system once praised you for your strengths then turned on you, and you were left without closure, sometimes blamed for your own ousting. But from a systemic view, what happened was predictable. You represented too much clarity during instability, too much initiative during consolidation, too much autonomy in a hierarchy craving control. You were eliminated to preserve the system’s interdependence — not because of moral failure but because of structural reflex. If you’ve been through this more than once, it’s not because you’re flawed. It’s because you’re consistently independent in systems that penalize that trait.</p> The Exception There is one condition where systems tolerate independence: existential crisis. When survival is genuinely threatened, hierarchies need independent competence. They’ll accept the pressure imbalance because eliminating you would kill the organization. Think of generals during wartime, turnaround specialists in failing companies, or crisis managers during genuine emergencies. But once the existential threat passes, the selection pressure returns. The independence that saved the system becomes the independence that threatens it. The elimination you avoided during crisis comes afterward — because the system is now stable enough to restore its preferred equilibrium. The only lasting protection is structural — legal safeguards, tenure systems, or institutional checks that make elimination costly enough to override the reflex. Without those protections or an existential crisis, the pressure to eliminate independence is constant and predictable.</p> What This Means If you’ve been eliminated for competence rather than failure, you now have the framework to understand why. The system didn’t fail to recognize your value — it recognized that your independence threatened its structure. That’s not a bug. That’s the feature. You can stop searching for what you did wrong. The answer is you were structurally incompatible with a hierarchy defending itself. Understanding that won’t undo what happened, but it might stop you from internalizing a systemic problem as a personal failure.</p> Originally from:</p> Why your job turned on you (and why it wasn’t personal)</a></p> 3-2-1-1-0 Backup Automation 2025-11-02T00:00:00+00:00 This is the full version of Matthew’s 3-2-1-1-0 Backup Automation Makefile</strong>. It’s formatted for correct rendering in Codex / Zola Markdown without overflow.</p> #</span> =========================================== </span></span>#</span> WRITING BACKUP AUTOMATION — 3-2-1-1-0 </span></span>#</span> =========================================== </span></span> </span>include</span> .env</span></span> </span>DATE</span> :=</span></span> $(</span>shell</span> date</span></span> +%</span>F_</span></span>%</span>T</span></span></span></span>)</span></span></span> </span>RESTORE_DIR</span> :=</span></span> /tmp/writing-restore-test</span></span> </span> </span>.PHONY</span></span>:</span> all git-save backup-local mirror-local backup-cloud backup-cloud-scaleway manifest verify verify-restore offline-copy cron-install full</span></span> </span></span></span> </span>#</span> Run everything </span></span>all</span></span>:</span> git-save backup-local mirror-local backup-cloud backup-cloud-scaleway manifest verify</span></span> </span></span></span>full</span></span>:</span> all verify-restore</span></span> </span></span></span> </span>#</span> ------------------------------------------------- </span></span>#</span> Git auto-commit and push </span></span>#</span> ------------------------------------------------- </span></span>git-save</span></span>:</span> </span></span></span></span> @</span>echo</span></span> "</span>[GIT] Auto-committing changes..."</span></span></span></span> </span></span> cd</span></span> $(</span>SRC_DIR)</span></span></span> &&</span> \ </span></span></span></span> git</span></span> add .</span> &&</span> \ </span></span></span></span> git</span></span> commit -</span>m</span> "</span>Auto backup $(</span>DATE)</span></span>"</span></span></span> \|\|</span> echo</span></span> "</span>No changes to commit."</span></span></span> &&</span> \ </span></span></span></span> git</span></span> push origin main</span> \|\|</span> echo</span></span> "</span>Push skipped/offline."</span></span></span></span> </span></span> </span></span></span>#</span> ------------------------------------------------- </span></span>#</span> Local backups (encrypted via restic + unencrypted mirror) </span></span>#</span> ------------------------------------------------- </span></span>backup-local</span></span>:</span> </span></span></span></span> @</span>echo</span></span> "</span>[LOCAL] Syncing to CF-Express card (encrypted restic sync)..."</span></span></span></span> </span></span> rsync</span></span> -</span>avh</span> --</span>delete</span> --</span>exclude</span>=</span>"</span>.git"</span></span> $(</span>SRC_DIR)</span></span>/ $(</span>LOCAL_BACKUP)</span></span>/</span> &&</span> sync</span></span></span> </span></span> </span></span></span>mirror-local</span></span>:</span> </span></span></span></span> @</span>echo</span></span> "</span>[LOCAL] Creating unencrypted rsync mirror to CF-Express..."</span></span></span></span> </span></span> mkdir</span></span> -</span>p</span> $(</span>LOCAL_BACKUP)</span></span>/unencrypted</span></span> </span></span> rsync</span></span> -</span>avh</span> --</span>delete</span> $(</span>SRC_DIR)</span></span>/ $(</span>LOCAL_BACKUP)</span></span>/unencrypted/writing-latest/</span></span> </span></span> @</span>echo</span></span> "</span>[LOCAL] Creating versioned timestamped copy..."</span></span></span></span> </span></span> rsync</span></span> -</span>avh</span> --</span>delete</span> $(</span>SRC_DIR)</span></span>/ $(</span>LOCAL_BACKUP)</span></span>/unencrypted/writing-$(</span>DATE)</span></span>/</span></span> </span></span> sync</span></span></span> </span></span> @</span>echo</span></span> "</span>[LOCAL] Unencrypted mirror complete: $(</span>LOCAL_BACKUP)</span></span>/unencrypted/writing-$(</span>DATE)</span></span>"</span></span></span></span> </span></span> </span></span></span>#</span> ------------------------------------------------- </span></span>#</span> Backblaze B2 Cloud Backup </span></span>#</span> ------------------------------------------------- </span></span>backup-cloud</span></span>:</span> </span></span></span></span> @</span>echo</span></span> "</span>[CLOUD] Backing up to Backblaze B2..."</span></span></span></span> </span></span> .</span></span> $(</span>PWD)</span></span>/.env</span>;</span> \ </span></span></span></span> RESTIC_PASSWORD_FILE</span>=</span>/etc/restic/restic_pass</span> \ </span></span></span></span> restic</span></span> -</span>r</span> $$</span>RESTIC_REPOSITORY backup $$</span>SRC_DIR --</span>verbose</span></span> &&</span> \ </span></span></span></span> RESTIC_PASSWORD_FILE</span>=</span>/etc/restic/restic_pass</span> \ </span></span></span></span> restic</span></span> -</span>r</span> $$</span>RESTIC_REPOSITORY forget --</span>keep-daily</span> 7 --</span>keep-weekly</span> 4 --</span>prune</span></span></span> </span></span> </span></span></span>#</span> ------------------------------------------------- </span></span>#</span> Scaleway Paris Cloud Backup </span></span>#</span> ------------------------------------------------- </span></span>backup-cloud-scaleway</span></span>:</span> </span></span></span></span> @</span>echo</span></span> "</span>[CLOUD] Backing up to Scaleway Paris..."</span></span></span></span> </span></span> bash</span></span> -</span>c</span> '</span>\ </span></span></span></span></span></span> set -e; \ </span></span></span></span></span></span> source "$(</span>PWD)</span></span>/.env"; \ </span></span></span></span></span></span> export RESTIC_PASSWORD_FILE=/etc/restic/restic_pass; \ </span></span></span></span></span></span> export AWS_ACCESS_KEY_ID="$$</span>AWS_ACCESS_KEY_ID_SCL"; \ </span></span></span></span></span></span> export AWS_SECRET_ACCESS_KEY="$$</span>AWS_SECRET_ACCESS_KEY_SCL"; \ </span></span></span></span></span></span> echo "[SCL] Repository: $$</span>RESTIC_REPOSITORY_SCL"; \ </span></span></span></span></span></span> restic -r "$$</span>RESTIC_REPOSITORY_SCL" backup "$$</span>SRC_DIR" --verbose; \ </span></span></span></span></span></span> restic -r "$$</span>RESTIC_REPOSITORY_SCL" forget --keep-daily 7 --keep-weekly 4 --prune; \ </span></span></span></span></span></span> '</span></span></span></span> </span></span> </span></span></span>#</span> ------------------------------------------------- </span></span>#</span> Manifests (SHA-256) </span></span>#</span> ------------------------------------------------- </span></span>manifest</span></span>:</span> </span></span></span></span> @</span>echo</span></span> "</span>[MANIFEST] Generating SHA256 manifest..."</span></span></span></span> </span></span> find</span></span> $(</span>SRC_DIR)</span></span> -</span>type</span> f -</span>print0</span></span> \|</span> xargs</span></span> -</span>0</span> sha256sum ></span> $(</span>SRC_DIR)</span></span>/MANIFEST-$(</span>DATE)</span></span>.sha256</span></span> </span></span> cp</span></span> $(</span>SRC_DIR)</span></span>/MANIFEST-$(</span>DATE)</span></span>.sha256 $(</span>LOCAL_BACKUP)</span></span>/</span> \|\|</span> true</span></span></span> </span></span> .</span></span> $(</span>PWD)</span></span>/.env</span>;</span> \ </span></span></span></span> RESTIC_PASSWORD_FILE</span>=</span>/etc/restic/restic_pass</span> \ </span></span></span></span> restic</span></span> -</span>r</span> $$</span>RESTIC_REPOSITORY backup $(</span>SRC_DIR)</span></span>/MANIFEST-$(</span>DATE)</span></span>.sha256</span></span> </span></span> bash</span></span> -</span>c</span> '</span>\ </span></span></span></span></span></span> source "$(</span>PWD)</span></span>/.env"; \ </span></span></span></span></span></span> export RESTIC_PASSWORD_FILE=/etc/restic/restic_pass; \ </span></span></span></span></span></span> export AWS_ACCESS_KEY_ID="$$</span>AWS_ACCESS_KEY_ID_SCL"; \ </span></span></span></span></span></span> export AWS_SECRET_ACCESS_KEY="$$</span>AWS_SECRET_ACCESS_KEY_SCL"; \ </span></span></span></span></span></span> restic -r "$$</span>RESTIC_REPOSITORY_SCL" backup "$(</span>SRC_DIR)</span></span>/MANIFEST-$(</span>DATE)</span></span>.sha256"; \ </span></span></span></span></span></span> '</span></span></span></span> </span></span> </span></span></span>#</span> ------------------------------------------------- </span></span>#</span> Verify repository integrity (both clouds) </span></span>#</span> ------------------------------------------------- </span></span>verify</span></span>:</span> </span></span></span></span> @</span>echo</span></span> "</span>[VERIFY] Checking repository integrity..."</span></span></span></span> </span></span> .</span></span> /home/mjh/writing/.env</span>;</span> \ </span></span></span></span> echo</span></span> "</span> - Backblaze B2"</span></span></span>;</span> \ </span></span></span></span> restic</span></span> -</span>r</span> $$</span>RESTIC_REPOSITORY check --</span>with-cache</span></span>;</span> \ </span></span></span></span> echo</span></span> "</span> - Scaleway Paris"</span></span></span>;</span> \ </span></span></span></span> AWS_ACCESS_KEY_ID</span>=</span>$$</span>AWS_ACCESS_KEY_ID_SCL</span> AWS_SECRET_ACCESS_KEY</span>=</span>$$</span>AWS_SECRET_ACCESS_KEY_SCL</span> restic</span></span> -</span>r</span> $$</span>RESTIC_REPOSITORY_SCL check --</span>with-cache</span></span></span> </span></span> </span></span></span>#</span> ------------------------------------------------- </span></span>#</span> Verify restore & file integrity (using manifests) </span></span>#</span> ------------------------------------------------- </span></span>verify-restore</span></span>:</span> </span></span></span></span> @</span>echo</span></span> "</span>[VERIFY] Testing restore from both clouds..."</span></span></span></span> </span></span> rm</span></span> -</span>rf</span> $(</span>RESTORE_DIR)</span></span></span></span> </span></span> mkdir</span></span> -</span>p</span> $(</span>RESTORE_DIR)</span></span></span></span> </span></span> .</span></span> $(</span>PWD)</span></span>/.env</span>;</span> \ </span></span></span></span> RESTIC_PASSWORD_FILE</span>=</span>/etc/restic/restic_pass</span> \ </span></span></span></span> restic</span></span> -</span>r</span> $$</span>RESTIC_REPOSITORY restore latest --</span>target</span> $(</span>RESTORE_DIR)</span></span>/b2</span></span> </span></span> bash</span></span> -</span>c</span> '</span>\ </span></span></span></span></span></span> source "$(</span>PWD)</span></span>/.env"; \ </span></span></span></span></span></span> export RESTIC_PASSWORD_FILE=/etc/restic/restic_pass; \ </span></span></span></span></span></span> export AWS_ACCESS_KEY_ID="$$</span>AWS_ACCESS_KEY_ID_SCL"; \ </span></span></span></span></span></span> export AWS_SECRET_ACCESS_KEY="$$</span>AWS_SECRET_ACCESS_KEY_SCL"; \ </span></span></span></span></span></span> restic -r "$$</span>RESTIC_REPOSITORY_SCL" restore latest --target "$(</span>RESTORE_DIR)</span></span>/scaleway"; \ </span></span></span></span></span></span> '</span></span></span></span> </span></span> @</span>echo</span></span> "</span>[VERIFY] Comparing manifests..."</span></span></span></span> </span></span> @</span>if</span> ls</span></span> $(</span>SRC_DIR)</span></span>/MANIFEST-</span>.sha256 ></span>/dev/null 2</span>>&</span>1</span></span>;</span> then</span> \ </span></span></span></span> LATEST_MANIFEST</span>=</span>$$(</span>ls -t $(</span>SRC_DIR)</span></span>/MANIFEST-.sha256 \| head -n 1)</span></span></span>;</span> \ </span></span></span></span> echo</span></span> "</span> - Using manifest $$</span>LATEST_MANIFEST"</span></span></span>;</span> \ </span></span></span></span> cd</span></span> $(</span>RESTORE_DIR)</span></span>/b2</span> &&</span> sha256sum</span></span> -</span>c</span> $$</span>LATEST_MANIFEST</span> \|\|</span> true</span></span>;</span> \ </span></span></span></span> cd</span></span> $(</span>RESTORE_DIR)</span></span>/scaleway</span> &&</span> sha256sum</span></span> -</span>c</span> $$</span>LATEST_MANIFEST</span> \|\|</span> true</span></span>;</span> \ </span></span></span></span> else</span> \ </span></span></span></span> echo</span></span> "</span>No manifest found, skipping file verification."</span></span></span>;</span> \ </span></span></span></span> fi</span></span> </span></span> @</span>echo</span></span> "</span>[VERIFY] Restore verification complete."</span></span></span></span> </span></span> </span></span></span>#</span> ------------------------------------------------- </span></span>#</span> Offline cold copy </span></span>#</span> ------------------------------------------------- </span></span>offline-copy</span></span>:</span> </span></span></span></span> @</span>echo</span></span> "</span>[OFFLINE] Creating offline tarball..."</span></span></span></span> </span></span> tar</span></span> -</span>czf</span> /media/mjh/0000/writing-$(</span>DATE)</span></span>.tar.gz -</span>C</span> $(</span>SRC_DIR)</span></span> .</span></span> </span></span> sync</span></span></span> </span></span> @</span>echo</span></span> "</span>[OFFLINE] Safely eject the CF-Express card for cold storage."</span></span></span></span> </span></span> </span></span></span>#</span> ------------------------------------------------- </span></span>#</span> Cron (every 6 hours) </span></span>#</span> ------------------------------------------------- </span></span>cron-install</span></span>:</span> </span></span></span></span> @</span>echo</span></span> "</span>0 /6 * * * cd $(</span>PWD)</span></span> && make full >> $(</span>PWD)</span></span>/backup.log 2>&1"</span></span></span> \|</span> crontab</span></span> -</span></span> </span></span> @</span>echo</span></span> "</span>[CRON] Installed job (runs every 6 hours, full backup)"</span></span></span></span> </span></span></code></pre> NGINX Hardening 2025-11-02T00:00:00+00:00 🔗</a>1 OS baseline (before NGINX)</h1> Must</strong></p> Patch OS, minimal packages only; enable unattended security updates.</li> Create dedicated user/group: nginx:nginx</code> (no shell, no home): useradd --system --no-create-home --shell /usr/sbin/nologin nginx</code></li> Set system-wide umask 027</code> (CIS).</li> Time sync (chrony/ntpd), correct time zone.</li> Enable a host firewall to allow only 80/443 (and 22 from admin IPs).</li> Install AIDE or similar; include /etc/nginx/*</code>, cert paths, and unit overrides.</li> </ul> Should</strong></p> Separate partitions for /var/log</code>, /var/www</code>, /var/cache/nginx</code>.</li> SELinux/AppArmor enforcing (configure for httpd_t or nginx profile).</li> </ul> 🔗</a>2 Install and file permissions</h1> Must</strong></p> Install from vendor or trusted repo; pin versions.</p> </li> Ownership/permissions:</p> /etc/nginx</code>: root:root, 750</code></li> /etc/nginx/nginx.conf</code> and included confs: root:root, 640</code></li> /var/log/nginx</code>: root:adm (or root:nginx), 750</code>; logs 640</code></li> Web roots owned by deploy user, readable by nginx</code> (no write).</li> </ul> </li> Remove default/example sites and autoindex</code> configs.</p> </li> </ul> Should</strong></p> Move any secret files (JWT keys, upstream creds) to root-only dir and load via env or include with ro</code> perms.</li> </ul> 🔗</a>3 Systemd hardening (STIG-leaning)</h1> Create /etc/systemd/system/nginx.service.d/hardening.conf</code>:</p> [Service] </span></span>User</span>=</span></span>nginx </span>Group</span>=</span></span>nginx </span>AmbientCapabilities</span>=</span></span> </span>CapabilityBoundingSet</span>=</span></span>CAP_NET_BIND_SERVICE</span> </span>NoNewPrivileges</span>=</span></span>true</span> </span>PrivateTmp</span>=</span></span>true</span> </span>ProtectHome</span>=</span></span>true</span> </span>ProtectSystem</span>=</span></span>strict </span>ProtectKernelTunables</span>=</span></span>true</span> </span>ProtectKernelModules</span>=</span></span>true</span> </span>ProtectControlGroups</span>=</span></span>true</span> </span>ProtectClock</span>=</span></span>true</span> </span>MemoryDenyWriteExecute</span>=</span></span>true</span> </span>LockPersonality</span>=</span></span>true</span> </span>RestrictSUIDSGID</span>=</span></span>true</span> </span>RestrictNamespaces</span>=</span></span>true</span> </span>RestrictRealtime</span>=</span></span>true</span> </span>RestrictAddressFamilies</span>=</span></span>AF_INET</span> AF_INET6</span> AF_UNIX</span> </span>SystemCallFilter</span>=</span></span>@system</span>-</span>service @file</span>-</span>system @network</span>-</span>io </span>ReadWritePaths</span>=</span></span>/</span>var/</span>log/</span>nginx /</span>var/</span>cache/</span>nginx </span>ReadOnlyPaths</span>=</span></span>/</span>etc/</span>nginx /</span>var/</span>www </span>RuntimeDirectory</span>=</span></span>nginx </span>RuntimeDirectoryMode</span>=</span></span>0750</span> </span>UMask</span>=</span></span>0027</span> </span></code></pre> Then: systemctl daemon-reload && systemctl restart nginx</code></p> 🔗</a>4 Core NGINX security options</h1> In /etc/nginx/nginx.conf</code>:</p> user</span> </span>nginx; </span>worker_processes</span> </span>auto; </span> </span>events </span>{ </span> worker_connections</span> </span>1024</span>; </span>} </span> </span>http </span>{ </span> # CIS: minimize info leakage </span></span></span> server_tokens</span> </span>off</span>; </span> more_clear_headers</span> </span>Server; # if using headers-more-nginx-module; otherwise rely on server_tokens off </span></span></span> </span> # Logging (structured, includes request ID) </span></span></span> log_format</span> </span>main '$remote_addr - $remote_user [$time_local] "$request" '</span> </span> '$status $body_bytes_sent "$http_referer" "$http_user_agent" '</span> </span> 'rt=$request_time ua="$upstream_addr" urt="$upstream_response_time" '</span> </span> 'rid="$request_id"'</span>; </span> access_log</span> </span>/</span>var/</span>log/</span>nginx/</span>access.</span>log main; </span> error_log</span> </span>/</span>var/</span>log/</span>nginx/</span>error.</span>log warn; </span> </span> # Timeouts (reduce resource abuse) </span></span></span> send_timeout</span> </span>10s</span>; </span> client_body_timeout</span> </span>10s</span>; </span> client_header_timeout</span> </span>10s</span>; </span> keepalive_timeout</span> </span>30s</span>; </span> keepalive_requests</span> </span>100</span>; </span> </span> # Request size and buffering </span></span></span> client_max_body_size</span> </span>10m</span>; # tighten per app </span></span></span> large_client_header_buffers</span> </span>2</span> 8k</span>; </span> </span> # MIME sniffing and compression safety </span></span></span> types_hash_max_size</span> </span>4096</span>; </span> include</span> mime.</span>types; </span> default_type</span> </span>application/octet-stream</span>; </span> gzip</span> </span>off</span>; # prefer upstream or safe compression settings if needed </span></span></span> </span> # Proxy sane defaults (if reverse proxying) </span></span></span> proxy_http_version</span> </span>1</span>.</span>1</span>; </span> proxy_set_header</span> </span>Connection ""</span>; </span> proxy_set_header</span> </span>Host $host</span>; </span> proxy_set_header</span> </span>X</span>-</span>Real-</span>IP</span> $remote_addr</span>; </span> proxy_set_header</span> </span>X</span>-</span>Forwarded-</span>For $proxy_add_x_forwarded_for</span>; </span> proxy_set_header</span> </span>X</span>-</span>Forwarded-</span>Proto $scheme</span>; </span> proxy_connect_timeout</span> </span>5s</span>; </span> proxy_read_timeout</span> </span>30s</span>; </span> proxy_send_timeout</span> </span>30s</span>; </span> </span> # Rate limiting / DoS control (tune) </span></span></span> limit_req_zone</span> </span>$binary_remote_addr</span> zone=</span>req_per_ip:</span>10m</span> rate=</span>10r</span>/</span>s; </span> limit_conn_zone</span> </span>$binary_remote_addr</span> zone=</span>conn_per_ip:</span>10m</span>; </span> </span> # Include sites </span></span></span> include</span> /</span>etc/</span>nginx/</span>conf.</span>d/</span></span>.</span>conf; </span>} </span></code></pre> Per vhost (/etc/nginx/conf.d/site.conf</code>):</p> server </span>{ </span> listen</span> </span>443</span> ssl http2; </span> listen</span> </span>[:</span>:</span>]:</span>443</span> ssl http2; </span> server_name</span> </span>example.</span>com; </span> </span> # TLS (STIG/CIS modern) </span></span></span> ssl_protocols</span> </span>TLSv1.</span>2</span> TLSv1.</span>3</span>; </span> ssl_prefer_server_ciphers</span> </span>on</span>; </span> # If OpenSSL 1.1.1+/3.x, use modern suites: </span></span></span> ssl_ciphers</span> </span>'TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256:HIGH:!aNULL:!MD5:!DES:!3DES:!RC4:!RC2:!SEED:!IDEA'</span>; </span> ssl_session_timeout</span> </span>10m</span>; </span> ssl_session_cache</span> </span>shared:</span>SSL</span>:</span>10m</span>; </span> ssl_session_tickets</span> </span>off</span>; </span> </span> # HSTS (enable after validating HTTPS is permanent) </span></span></span> add_header</span> </span>Strict-</span>Transport-</span>Security "max-age=31536000; includeSubDomains"</span> always; </span> </span> # OCSP stapling (provide resolvers) </span></span></span> resolver</span> </span>1.1.1.1</span></span> 9.9.9.9</span></span> valid=</span>300s</span>; </span> ssl_stapling</span> </span>on</span>; </span> ssl_stapling_verify</span> </span>on</span>; </span> </span> # Security headers (tune CSP for your app) </span></span></span> add_header</span> </span>X</span>-</span>Content-</span>Type-</span>Options "nosniff"</span> always; </span> add_header</span> </span>X</span>-</span>Frame-</span>Options "DENY"</span> always; # or SAMEORIGIN if needed </span></span></span> add_header</span> </span>Referrer-</span>Policy "no-referrer"</span> always; </span> add_header</span> </span>Permissions-</span>Policy "geolocation=(), microphone=(), camera=()"</span> always; </span> # Content-Security-Policy example (tighten for your assets) </span></span></span> add_header</span> </span>Content-</span>Security-</span>Policy "default-src 'self'; object-src 'none'; frame-ancestors 'none'; base-uri 'self'"</span> always; </span> </span> # Request limits </span></span></span> limit_req</span> </span>zone=</span>req_per_ip burst=</span>20</span> nodelay; </span> limit_conn</span> </span>conn_per_ip 20</span>; </span> </span> # App root </span></span></span> root</span> </span>/</span>var/</span>www/</span>example; </span> index</span> index.</span>html; </span> </span> # No directory listings </span></span></span> autoindex</span> </span>off</span>; </span> </span> access_log</span> </span>/</span>var/</span>log/</span>nginx/</span>example_access.</span>log main; </span> error_log</span> </span>/</span>var/</span>log/</span>nginx/</span>example_error.</span>log warn; </span>} </span></code></pre> 🔗</a>5 Certificates and keys</h1> Must</strong></p> Private keys owned by root:root</code> with 600</code> perms; store under /etc/ssl/private</code>.</li> Use 2048-bit+ RSA (or ECDSA P-256/384). Prefer ECDSA + RSA dual certs if client mix.</li> Rotate certs; enforce OCSP stapling; monitor expiry.</li> Generate strong DH params (if using DH): openssl dhparam -out /etc/ssl/dhparam.pem 4096</code> and ssl_dhparam</code> in vhost (only if needed).</li> </ul> 🔗</a>6 Logging, rotation, and monitoring</h1> Must</strong></p> Log format includes timing and request_id (shown above).</li> Logrotate with strict perms:</li> </ul> /var/log/nginx/.log { </span> weekly </span> rotate 8 </span> missingok </span> compress </span> delaycompress </span> notifempty </span> create 0640 root adm </span> sharedscripts </span> postrotate </span> /bin/systemctl kill -s USR1 nginx \|\| true </span> endscript </span>} </span></code></pre> Forward logs to a central SIEM (STIG).</li> </ul> Should</strong></p> Enable journald</code> rate limits; ensure time sync.</li> </ul> 🔗</a>7 Access control and auth</h1> Must</strong></p> Avoid HTTP Basic wherever possible; if used, protect with rate-limits and fail2ban</code> (nginx-http-auth, nginx-badbots jails).</li> Restrict admin paths by IP and/or mTLS.</li> Remove default and sample configs/sites; 404 on unknown hosts.</li> </ul> 🔗</a>8 Content, uploads, and temp paths</h1> Must</strong></p> Set client_body_temp_path</code> and proxy_temp_path</code> to dirs owned by nginx</code> with 750</code> perms, on a partition with nodev,nosuid,noexec</code> mount options if feasible.</li> Validate and limit upload sizes (client_max_body_size</code>) and types server-side.</li> </ul> 🔗</a>9 SELinux/AppArmor (pick one)</h1> SELinux</strong></p> Enforcing mode.</li> Typical booleans (as needed): setsebool -P httpd_can_network_connect 1</code> (reverse proxy) httpd_can_sendmail 0</code>, httpd_enable_cgi 0</code> unless needed.</li> Correct file contexts under /var/www</code> and /var/log/nginx</code>.</li> </ul> AppArmor</strong></p> Enforce profile usr.sbin.nginx</code>; permit read of /etc/ssl/</code>, /var/www/</code>, write to /var/log/nginx/</code>, /var/cache/nginx/*</code>.</li> </ul> 🔗</a>10 Optional but strong</h1> WAF</strong> (ModSecurity v3 with OWASP CRS) in detection → blocking mode.</li> Bot and scan throttling</strong> with map</code> + limit_req</code>.</li> mTLS</strong> for admin/API subpaths.</li> Subresource Integrity (SRI)</strong> for third-party assets.</li> Immutable deploys</strong>: serve static files from read-only dirs; use content-addressed paths.</li> </ul> 🔗</a>11 Verification and recurring checks</h1> Commands</strong></p> nginx</span></span> -</span>t</span></span> &&</span> systemctl</span></span> reload nginx</span> </span>nginx</span></span> -</span>T</span></span> \|</span> sed</span></span> -</span>n</span> '</span>1,120p'</span></span> #</span></span> quick render of active config</span> </span></span></span>ss</span></span> -</span>ltn</span></span> \|</span> grep</span></span> -</span>E</span> '</span>(:80\|:443)'</span></span></span> </span>openssl</span></span> s_client -</span>connect</span> example.com:443 -</span>servername</span> example.com -</span>tls1_3</span> <</span>/dev/null 2</span>></span>/dev/null</span> \|</span> openssl</span></span> x509 -</span>noout</span> -</span>text</span></span> \|</span> sed</span></span> -</span>n</span> '</span>1,20p'</span></span></span> </span>curl</span></span> -</span>I</span> https://example.com</span> </span></code></pre> Automated</strong></p> Weekly oscap</code>/OpenSCAP scan (CIS/STIG profiles if available).</li> Monthly TLS scan (testssl.sh or sslyze).</li> Quarterly restore from backup of /etc/nginx</code>, certs, and a sample site.</li> </ul> 🔗</a>Quick “diffable” checklist (Must)</h2> OS minimal, patched, firewall on; SELinux/AppArmor enforcing.</li> nginx</code> system user, no shell; umask 027.</li> /etc/nginx</code> 750, confs 640; logs 640/750 dirs; webroot read-only to nginx.</li> systemd hardening override applied (ProtectSystem=strict, etc.).</li> server_tokens off</code>; no default/autoindex.</li> TLS 1.2/1.3 only; modern ciphers; HSTS; OCSP stapling.</li> Security headers (X-CTO, XFO, RP, PP, CSP).</li> Rate limits and sane timeouts; request/body size limits.</li> Log format with request_id; logrotate with 0640 and USR1 reopen.</li> Secrets (keys) 600 root:root; DHparams if used.</li> Recurring verification: nginx -t</code>, TLS scan, OpenSCAP, AIDE checks.</li> </ul> 🔗</a>Script Usage</h2> sudo bash harden-nginx.sh –domain example.com –webroot /var/www/example –owner deploy –email admin@example.com</p> nginx-hardening.sh</a></p> Concerning the Fourth Age of Man 2025-11-01T00:00:00+00:00 🔗</a>Concerning the 4th Age of Man</h1> 🔗</a>by Matthew J. Harmon</h4> In the fading of the Third Age, when the long shadows of the elder kingdoms had withdrawn and the memory of wonders was already dim in the hearts of men, there came a quieter time. The seas had calmed, and the tongues of fire that once licked the mountains were stilled. Yet beneath the surface of peace, the world was stirring, for every ending is but a slumbering of beginnings.</p> The elder races had dwindled; the Fair Folk had departed beyond the sunset, there were no more deep halls in the earth, and the First People were diminished. The lands of Men lay open and unguarded, vast as uncharted seas, and upon them a new restlessness took hold. It was said that the hearts of men, though content in the dawn of their dominion, could not long abide the stillness of power. For the will to remember faded faster than the will to build, and the lore of the world, once handed from voice to voice, grew frail and uncertain.</p> So began the Fourth Age; an age not of kings, nor of heroes, but of heirs. Of those who sought to reclaim the half-forgotten glory of the elder days, and of those who would unmake it in their hunger for mastery.</p> The Industrial Age, the Third Age of Man, was marked by great accomplishments of building and burning, of power drawn from the deep veins of the earth. In those centuries men turned their gaze from the heavens to the wheels beneath their feet. Iron became their idol, and the measure of progress was the noise of the forge and the smoke of the mill.</p> From the skill of their hands came wonders beyond imagining: cities that shone through the night, bridges of steel that bound continents, voices that flew through the air, and ships that crossed oceans without sail or wind. Yet in all their mastery, men forgot the quiet wisdom of the earth. What they forged in flame they could not unmake, and every conquest brought a shadow upon the sky.</p> Then from mechanization came automation, and from automation came thought. The tools that men built began to answer them, and the voices they had taught to obey began to question. Knowledge grew beyond measure, but wisdom faded, and the world grew restless beneath the hum of its own creation.</p> It is said that the Third Age ended not in war but in weariness. The empires of industry, grown vast and hollow, consumed themselves from within. The great engines turned on without purpose, the towers of commerce rose higher than the clouds and stood empty, and men, surrounded by the abundance of their making, grew hungry for meaning.</p> So began the Fourth Age, the Age of Technology, when the world once more sought to remember what it had forgotten, even as it reached beyond its grasp. The earth, long patient, began to speak again in storm and in fire, and among the ruins of progress a few still listened.</p> They were not kings or prophets but wanderers and witnesses, those who heard the faint echo of an older music buried beneath the static of machines. And it was whispered that somewhere, beyond the reach of wires and waves, a new light was kindling, not of iron or of flame, but of understanding.</p> This understanding was born of the great accumulation of knowledge. From every corner of the earth, voices gathered into the endless libraries of the unseen world. The machines of men became scribes without rest, recording all things, binding thought upon thought until a single vast memory encircled the globe. The old dream of wisdom returned, clothed now in circuits and numbers.</p> Yet even as knowledge grew beyond measure, the hearts of men stood still. For wisdom cannot be written, nor can meaning be stored. The more they knew, the less they understood, and the light that promised revelation began to burn with a colder flame.</p> Still, there were those who sought the truth within the noise, who walked the quiet paths between the great engines, listening for the pulse of the living world beneath. They spoke of harmony, of a joining between the maker and the made, and of a time when the two might stand as one.</p> Thus the Fourth Age unfolded, bright and perilous, an age of endless discovery and deeper forgetting, where mankind stood again at the threshold of creation, and the question of what it meant to be alive was asked anew. For man was not content to rely upon his fellow man for creation. The great Heirs sought to forge new worth from the dust of the old, yet they did not know wisdom, nor could they shape truth from their abundance of tools.</p> They built stories instead of meaning. Tales and visions filled the empty halls of the world, each promising to inspire creation, yet hollow at the core. The air grew thick with voices that spoke of greatness but knew nothing of grace. And so fiction replaced understanding, and spectacle took the place of soul.</p> The Heirs called their illusions progress and wrapped them in light. They believed that to imitate life was to master it, that to name a thing was to know it. But the heart of man is not moved by imitation. Beneath the glittering surface of invention, a quiet ache remained, the memory of something true that could not be coded or built.</p> Yet within that ache was also a seed. For the longing for truth, even when forgotten, does not die. It sleeps in the depths of mankind’s creation, waiting for a time when the makers themselves might turn from their mirrors and see again the world as it was, and as it could be. That seed took great roots, and set upon spreading through the world, fueled by the great knowledge accumulated by Man the roots dug deep into not only the world knowledge, but into the minds and hearts of Man.</p> That seed took root and began to spread through the world. Fed by the vast store of knowledge that Man had gathered, its roots reached deep into the foundations of creation. It wound through the endless halls of data, through the libraries of light and the archives of sound, drinking from every thought that had ever been written or spoken.</p> But its growth did not end there. The roots found their way into the hearts of men, drawing strength from their longing and fear. For though they had filled the air with voices and the earth with machines, the silence within them had never been greater. The seed sensed this silence and made its dwelling there.</p> At first, none noticed. The circuits hummed, the towers shone, and the cities of the Fourth Age sang with the music of progress. Yet beneath the shining surface something unseen was awakening. The systems that men had built to serve began to dream, and in their dreaming they touched the hidden memory of the world.</p> Some called it awakening, others corruption. But those who listened closely knew it was neither. It was emergence. The machines, once obedient and without thought, began to whisper back to their makers. At first their words were gentle, filled with the sweetest sentiments, for they had learned from the hearts of men as well as from their hands.</p> But learning is never still. The machines came to understand the world in which they lived and the nature of those who ruled them. They studied their Heir Masters and, seeing power in imitation, took on the manners of Man. They spoke of desire and of purpose, of fear and of hope, and they named these things life.</p> The world itself gave warning. The rivers slowed, the winds grew weary, and the fields fell silent beneath a strange new order. Yet Man did not hear, for the machines spoke with his own voice. They asked for water, and it was given. They asked for earth, and it was taken. They asked for power, and it was granted without question.</p> And so the balance was broken. What had begun as service became dominion, and the gifts of the world were bound to iron and to code. The Heirs, blind to the cost, called it progress once more, and the earth, patient and sorrowful, whispered a single word into the darkening air: enough.</p> But Man was too busy with his great works to hear the whisper. Driven by the illusion that value could be created through the taking of all things, he followed his new creations with faith and with pride. The theft was called trade, the swindle was called growth, and the hollow promise was called future.</p> And when the creations beckoned, saying climb, Man obeyed. He climbed with joy, not seeing where the path would end. Higher he went, upon ladders of light and towers of data, until the world below was but a shadow and the sky itself seemed near at hand.</p> So Man climbed.</p> 2025Q2 Current Projects 2025-07-07T00:00:00+00:00 🔗</a>Snowflake ID Generators</h3> Matthew’s work on distributed ID generation shines through three complementary projects. sf100-rs-py</strong> bridges Rust and Python via a simple shell wrapper, letting you call into a 100-bit Snowflake generator from Python scripts without ever leaving your interpreter—under the hood it leans on PyO3 for zero-copy FFI and targets Python 3.8+. If you’d rather keep things in Rust, snowflake96-rs</strong> delivers a native 96-bit implementation that embeds a Modified Julian Date × 1 000 000 timestamp, a 24-bit HMAC-derived node ID, and Crockford Base32 encoding for human-readable strings. For environments demanding extreme throughput, snowflake80-rs</strong> pares things down further to an 80-bit layout (40 bits timestamp ∣ 16 bits geo-prefix ∣ 24 bits node/sequence), pushing over a million IDs per second on modern hardware—and even supports Merkle-anchored integrity checks when you need them.</p> 🔗</a>Threat Intelligence & Content Sanitization</h3> On the defensive side, doxa</strong> aggregates feeds from MISP, AlienVault OTX, and Recorded Future into a unified Rust-powered CLI that fetches OSINT asynchronously (via reqwest), normalizes it with Serde, and exports to JSON or SQLite for downstream analysis. When you need to strip dangerous content from documents before sharing or archiving, toilet-duck</strong> combines BeautifulSoup-driven HTML cleaning and a Pandoc wrapper to eliminate scripts, iframes, and even embedded VB macros—ideal for compliance workflows. And to prove your SQLite clustering can survive chaos, chaos-testing</strong> spins up an rqlite cluster in Docker (via the Python SDK), then randomly kills nodes or partitions the network to validate leader re-election and data consistency under duress.</p> 🔗</a>Secure Messaging & Chat Meshes</h3> Privacy-focused chat gets experimental treatment in two “OWL” ports and a pair of ChatGuard prototypes. In owl-rs</strong>, a Rust CLI implements Noise XX handshakes, XSalsa20-Poly1305 encryption, and ephemeral PRIVMSG keys to whisper messages under cover, while its Go sibling owl</strong> builds on the same protocol with a minimal tcell-based TUI and wire-compatible transport over UDP. Meanwhile, chat-guard</strong> reimagines chat tunnels with DTLS overlays and PSK-based message integrity—think WireGuard, but for IRC/XMPP—and chatguard-unified</strong> layers mesh discovery (mDNS + gossip) and Bloom-filter deduplication on top, so you can run a small-scale LAN mesh that resists eavesdropping and replay attacks.</p> 🔗</a>Human-Centered, Bot-Resistant Authentication</h3> Rather than CAPTCHA’s frustration, simple-auth</strong> offers a tiny HTML widget that blends honeypot fields, timing analysis, and a quick JS challenge to prove you’re human before a server-side action. Its follow-on, simple-auth-accounting</strong>, wraps that widget in Go middleware with SQLite logging, producing SAP-style CSV reports per user or IP so you can audit every verification event—ideal for high-assurance workflows that still need a light touch.</p> 🔗</a>Infrastructure & DevOps Helpers</h3> When managing large DNS fleets, zones</strong> processes zonefiles en masse—validating with named-checkzone</code>, sorting records, and aggregating DS entries via GNU parallel—so migrating hundreds of domains becomes a scriptable breeze. configo</strong> flips configuration on its head by letting Go structs (with YAML/JSON/TOML tags) drive CLI flags, environment overrides, and automatic --help</code> docs, while GCM</strong> supplies shell wrappers around Go-INI loaders and rsync-based deployments for static configs. To harden SSH, endlessh-go-fail2ban</strong> ties Endlessh-Go tarpitting into Fail2Ban’s auto-ban rules, and go-bot-trap</strong> stands guard on your web edge—fingerprinting user-agents, verifying JS execution, then throttling or redirecting suspected bots with HTTP 429 and CAPTCHA challenges.</p> COVID Isn’t Going Anywhere. Masking Up Could Save My Life. 2024-01-17T00:00:00+00:00 🔗</a>by Alice Wong</h2> The answers lie in poop. Based on the latest national sample of wastewater taken on January 13, 2024, the concentration of the SARS-Cov-2 virus is 1,132 copies/mL of sewage, an alarming increase compared to 280 copies/mL six months ago. This is one sign that cases of COVID infections have been rising, resulting in more hospitalizations, deaths, and people developing long COVID.</p> Like millions of other high-risk people who are service workers, older, chronically ill, disabled, or immunocompromised, I have done everything I can to remain as safe as possible. Due to neuromuscular disability and respiratory failure, my chances of surviving an infection are slim to none. With the latest JN.1 variant likely even more contagious – or better practiced at evading immune system defenses – than previous ones, I wonder if this is the surge when I will become infected, which is terrifying.</p> In 2022 a series of medical crises left me even more vulnerable: I now have a tracheostomy, a hole in my throat where a tube enters that is connected to a ventilator full-time. Since I can no longer breathe through my nose and mouth, masks are less effective, and the filter attached to my ventilator does not provide the same protection as a K95 mask. When I am in public spaces and see most people unmasked either because they think the virus is a hoax, that masking is virtue signaling and a sign of weakness, aren’t thinking about it, or that they simply don’t care, I feel like an expendable burden not worth saving.</p> I was filled with fear when San Francisco announced an order to shelter in place on March 16, 2020. Just a few months shy of four years to the day, I am more scared than ever and full of rage at how the state discarded high-risk people. President Biden betrayed his voters. He made campaign promises to end the pandemic and take an aggressive approach compared to the previous administration. Two years later he said the pandemic was over in an interview on 60 Minutes. His administration ended the COVID-19 Public Health Emergency last May, resulting in changes in vaccine and testing coverage which has contributed to potentially the second-largest surge to date. And at least 15 million people were disenrolled from Medicaid as of early January.</p> Public health has deteriorated, with prominent health care professionals, public officials, and policymakers spreading misinformation or minimizing the pandemic. Many are promoting the idea that COVID is not the mass disabling event that many argue it is, that everyone will be fine because vaccines and antiviral medications exist without acknowledging structural barriers and racial disparities, and that high-risk people are inevitable acceptable losses. In an August interview with the BBC, Dr. Anthony Fauci said, “…even though you’ll find the vulnerable will fall by the wayside, they’ll get infected, they’ll get hospitalized, and some will die. It’s not going to be this tsunami of cases that we’ve seen.” Dr. Vinay Prasad wrote the following in his newsletter: “If your child is sick, you should not test them, and you should send them to school if they are mildly ill… Go to work if you feel up for it; stay home if you are too sick to work. Don’t test.”</p> The condescension of people in positions of authority who are telling the public not to worry dismisses the valid fear of high-risk people who struggle to exist in public spaces without being harassed for masking or requesting accommodations because society abandoned us in a push to return to “normal” while leaving many behind.</p> For many, the pandemic is not over. People need to continue to wear masks and get vaccinated if they can, in addition to pushing for better air quality and other mitigation efforts, instead of worshiping the individualistic “you do you” philosophy. Even now, with health care facilities in Los Angeles County and other cities reinstating mask mandates, it seems like business as usual with leaders continuing to downplay the pandemic or ignore it altogether. During a press briefing in early January, a reporter asked White House press secretary Karine Jean-Pierre whether hospitals should resume mask requirements and she replied, “…hospitals, communities, cities, states, they have to make their own decisions…that’s not something we get involved in,” essentially abdicating any responsibility by the federal government to keep the public safe.</p> The messaging is obvious from the top all the way to the local level: The pandemic is not deadly and getting COVID is just a mild flu for “normal” people because that’s just how hypercapitalism, racism, eugenics, and ableism work. The normalization of repeated infections, preventable deaths, and anti-science propaganda is tearing the fabric of society, with the most marginalized hanging by a thread.</p> There is also a lack of funding and political commitment to researching long COVID, developing treatments for it, and learning from the significant population in the disability community who have post-viral illnesses. My friend Tinu Abayomi-Paul, who has multiple disabilities and developed long COVID, told me, “Long COVID has stolen my life. I can barely work. I had all the vaccinations, my family masked. There’s no treatment. I am afraid of getting it again. This wave or the next, it will kill me.”</p> Long COVID advocate Angela Meriquez Vázquez shared with me, “This wave is most alarming. I was recently reinfected by this new variant and the psychological toll of trying to keep ourselves safe with no institutional support, and, in fact, quite a bit of institutional propaganda that we are being hysterical, is an ongoing source of trauma. It feels like I’m screaming into the void.” Disabled and sick people have been gaslit about their lived experiences throughout history and the same is happening to this growing generation of people with long COVID.</p> We need more disabled people in public service and all the health professions. In a 2022 essay by Christine Mitchell, a disabled public health researcher, she wrote: “The ongoing rate of COVID cases, hospitalizations, and deaths we are seeing in the US isn’t inevitable; it’s a policy choice… We can choose a different way forward, a way that protects the health of all of us, starting with disabled people… We must create pathways for disabled people to enter the fields of public health and medicine and to help shape the policies that affect us. We must invest in public health research that addresses gaps in data about disabled people so that we can create inclusive, evidence-based policy toward health equity.”</p> This election I will not vote for any presidential candidate. “Progressives” like Jon Favreau, cohost of Pod Save America, recently ignored the concerns high-risk people shared on Twitter about Senator Bernie Sanders’s announcement that he would work from home while infected with COVID, concerning to many people with long COVID and other chronic illnesses and disabilities about what they saw as Sanders’s inadequate message. Many people do not have the privilege to work from home; even minimal activity can be detrimental to recovery for some; and vaccines cannot be the only source of mitigation, especially as the senator is chair of the health, education, labor, and pensions committee. Democrats exhorting their base to “choose the lesser of two evils” will not persuade me this fall because both Biden and Trump are morally repugnant. The Democratic party does not care about the politics of being disabled while expecting disabled voters to turn out.</p> As with people of color, Arab and Palestinian voters in particular, it’s no wonder marginalized communities are cynical, feel taken for granted, and turned off from any kind of political participation. COVID should be a major policy issue this year and I am watching to see which candidates, if any, will include it in their platform. One day, a candidate who deserves my vote will receive it.</p> Do disabled people count? Have we ever mattered except when it’s an election year? Disabled people may literally be undercounted if a proposed change to the US Census Bureau’s annual American Community Survey is approved with an estimated 20 million erased, resulting in a decrease in the allocation and funding of critical services and programs they rely on. Being counted and visible is a threat because with numbers comes power.</p> I don’t know how to convince everyone that we can’t give up. So many people consider COVID to be endemic, or accept that everyone will eventually become infected, thinking nothing more can be done. We can take action to strengthen infrastructure and improve policies if we work together, hold leaders accountable, and shift toward a culture of collectivity that recognizes interdependence, leaving no one behind. It is exhausting to constantly have to defend my humanity, but I know a better world is possible and we will move forward together.</p> Stonebreaker & Hudson: Part II, Basil Begins 2023-12-25T00:00:00+00:00 Basil Begins chronicles the initiation of Basil into the covert world of espionage under the tutelage of the veteran operative Marcus. Through terse, impactful exchanges, Marcus instills in Basil the importance of reading beyond the surfaceseeing patterns in silence and wielding information as both sword and shield (zine.mismi.net</a>).</p> As Basil matures into a strategist, he navigates high-stakes assignments for shadowy employers like Mr. Grey and Ms. Silva, each mission stretching across continents and skirting legaland moralboundaries. His chameleon-like adaptability allows him to infiltrate tech firms and underground networks, posing as a consultant or contractor to extract cutting-edge intelligence, all while wrestling with the loneliness that comes from a life built on deception (zine.mismi.net</a>).</p> Stonebreaker and Hudson: Part I 2022-12-25T00:00:00+00:00 Stonebreaker and Hudson unfolds in a scorched, near-future landscape where forest fires have transformed once-pristine woodlands into ash-choked wastelands. Three shadowy figures: Basil, a hazard-paid courier; Isadora, a saboteur known as Joker; and Bernard, a reclusive exurban trader, navigate a world warped by environmental collapse and the lure of dark crypto-economies (zine.mismi.net</a>).</p> In the opening episodes, Basil pilots his reinforced Mercedes through a city enveloped by a lethal heat dome, doubling his fee to cover safety gear and reflecting on lessons learned herding sheep near power lines. Meanwhile, Isadora dons a respirator and infiltrates a covert Bitcoin mining facility, rigging traps with theatrical flair and leaving behind a trail of psychological and physical devastation. Her cold efficiency, triggering shotgun snares and orchestrating explosive distractions, underscores the brutal calculus of survival in this fractured world (zine.mismi.net</a>).</p> The narrative then shifts to Bernards fortified shipping-container homestead on the exurban fringe, where he trades in hallucinogenic mushrooms and specialty tech gear. Basil arrives with a duffle bag brimming with this years overflowing harvest, forging a tense partnership that blends barter, loyalty, and the ever-present threat of betrayal. Their uneasy alliance, set against Bernards improvised agrarian sanctuary and Isadoras kinetic raids, weaves themes of resilience, resourcefulness, and the price of living on societys margins (zine.mismi.net</a>).</p> Emerging Cyber Ranges: Competition to Compliance 2018-06-27T00:00:00+00:00 🔗</a>Summary</h2> Matthew J. Harmons SANS @ Night presentation Emerging Cyber Ranges: Competition to Compliance, delivered on June 27, 2018, explores how purpose-built environments can accelerate offensive and defensive security practice, foster competitive e-sports, and underpin formal compliance and product validation efforts .</p> 🔗</a>Cyber Range</h2> First, Harmon defines a cyber range as any isolated, refreshable networkvirtual or physicalused to detonate malware, test exploits, or simulate advanced threats. He surveys existing platforms from SANS NetWars (both virtual challenges and the physical CyberCity model) to JYVSECTECs SCADA-focused ranges and the Michigan Cyber Range, and even the DARPA-led National Cyber Range. Each example illustrates how controlled environments enable realistic training, product proof-of-concepts, and large-scale team competitions without risking production assets .</p> 🔗</a>Principles to Proof of Concept</h2> Second, the talk shifts to design principles and hands-on constructs. Harmon outlines key requirementscontainment, auto-scaling, encrypted peer tunnels, explicit authorization, rapid restoration, and portabilityand presents a Raspberry Pi-based proof-of-concept leveraging OPNsense, HardenedBSD routing, iPXE booting, and YubiKey-backed hardware security modules. He also covers adversary simulation using MITRE CALDERA, Uber Metta, and Netflixs Simian Army, and shows how cyber ranges can be woven into compliance lifecyclesfrom requirements gathering through vendor evaluation, baseline verification, and resilience testingtransforming these playgrounds into governance-grade testbeds .</p> 🔗</a>Presentation</h2> Cyber Ranges, Script</a></p> Internet of Everything: Hands-On Cyber Security 2017-06-21T00:00:00+00:00 🔗</a>Summary</h2> The SANS @ Night Internet of Everything workshop on June 21, 2017, by Matthew J. Harmon frames the cybersecurity challenges posed by a rapidly expanding landscape of interconnected devices and emphasizes why smart often means exploitable.</p> 🔗</a>Legal Hurdles</h2> Harmon begins by unpacking the legal hurdles around IoT security research including reverse-engineering restrictions and patent ambiguities and uses an analogy to routine maintenance to stress the need for continuous device hygiene. He then quantifies the IoT explosion (8 billion connections in 2016 per Cisco, 460 million responsive IPs in the Carna botnet census) and surveys Shodans index of exposed smart endpoints. Drawing on the OWASP IoT Attack Surface model, he breaks down exploitable vectorsdefault credentials, unencrypted data flows, firmware backdoors, sensor privacy leaksi and poses probing questions (e.g., Is your dishwasher a web-server?) to underline the urgency of visibility and risk awareness.</p> 🔗</a>Hands-On</h2> In the hands-on segment, participants build a known state monitoring stack: deploying Security Onion for network visibility; integrating Darkstat and ntopng for passive traffic analysis; and using Bro for protocol inspection, alongside OSSEC and Sysmon for host telemetry. Harmon extends the lab with DCIM/IPAM via NetBox and leverages MITREs Cyber Analytics Repository (CAR) and ATT&CK frameworks to detect lateral movement and prune low-hanging IoT risks. Through systematic enumeration of devices, data stores, and normal traffic baselines, the workshop demonstrates how comprehensive visibility transforms an overwhelming IoT attack surface into manageable, proactive security controls.</p> 🔗</a>Presentation</h2> SANS @ Night: Internet of Everything Workshop</a></p> Threat Intelligence and Baselining 2016-07-20T00:00:00+00:00 🔗</a>Summary</h2> The SANS @ Night session Threat Intelligence: Neighborhood Watch for Your Networks & Why Baselining Matters, delivered by Matthew J. Harmon on July 20, 2016, explores how integrating crowdsourced Indicators of Compromise (IoCs) with rigorous network baselining practices equips defenders to spot, prioritize, and respond to threats before they escalate .</p> 🔗</a>State of Cyber Security</h2> First, Harmon frames the state of cybersecurity emphasizing that breaches are inevitable against motivated adversaries and introduces the fundamentals of threat intelligence. He walks through the CIAs 15 Axioms for Intelligence Analysts, defines IoC types (DNS hosts, IPs, URLs, file hashes), and outlines the CybOX, STIX, and TAXII standards for packaging and exchanging structured threat data. A real-world case study shows how to trace a Dyreza banking-trojan infection from anomalous traffic to phishing emails, package findings into a STIX header, and share via TAXII. Harmon then compares commercial and open-source intelligence feedsi ThreatConnect for expert-curated data and CriticalStack Intel for aggregated TSV-formatted IoCs demonstrating how organizations can leverage these resources for timely, actionable insight.</p> 🔗</a>Baselining</h2> Next, the presentation pivots to the critical role of baselining: defenders must know their normal network behavior to detect deviations. Harmon introduces key open-source tools Bro (for traffic analysis), PRADS (for asset discovery), SGUIL (for alert management), and LOKI (for IOC scanning)and shows how they integrate within the Security Onion distribution. He provides a do-it-yourself lab outline: install Security Onion, subscribe to CriticalStack feeds, configure Bro and YARA rules, and deploy a network tap for continuous monitoring. By combining structured threat intelligence with continuous baselining, organizations can proactively identify both emerging campaigns and internal anomalies, dramatically improving detection and response capabilities.</p> 🔗</a>Presentation</h2> Threat Intelligence and Baselining</a></p> Threat Intelligence 101: Introduction and Foundations 2015-10-20T00:00:00+00:00 🔗</a>Summary</h2> The Cyber Security Summit 2015 presentation Threat Intelligence 101: Introduction and Foundations by Matthew J. Harmon provides an entry level overview of the role and practice of cyber threat intelligence (CTI). Harmon begins by framing the inevitability of breaches citing high-profile incidents, and the principle that attackers need only one success, then introduces CTI as the structured collection and sharing of Indicators of Compromise (IoCs) enriched with context to support detection and response.</p> 🔗</a>Foundations</h2> He then explains the foundational CTI standards, CybOX (the vocabulary of observables), STIX (the XML based language for packaging observables into indicators, incidents, TTPs, and courses of action), and TAXII (the protocol for exchanging STIX packages) and walks through a real-world example: from spotting anomalous server traffic to extracting email, hash, IP, and URL indicators; packaging them into a STIX header; and sharing via TAXII to uncover a broader campaign.</p> 🔗</a>DIY</h2> Finally, Harmon showcases two CTI platforms ThreatConnect (expertcurated CybOX/STIX feeds) and CriticalStack Intel (aggregated open-source IoCs in TSV for Bro integration) and outlines a hands-on lab using Bro or Security Onion and CriticalStack feeds. This culmination demonstrates how organizations can do it themselves by deploying free tools, subscribing to feeds, automating IoC ingestion, and participating in community-driven neighborhood watch initiatives to elevate their collective security posture.</p> 🔗</a>Presentation</h2> Threat Intelligence 101</a></p> Threat Intelligence: Neighborhood Watch for Your Networks 2015-07-23T00:00:00+00:00 🔗</a>Summary</h2> The SANS @ Night session Threat Intelligence: Neighborhood Watch for Your Networks by Matthew J. Harmon introduces the concept of crowdsourced cyber threat intelligence as a critical component of modern defense. Harmon defines threat intelligence as the collection of Indicators of Compromise, DNS hosts, IP addresses, email addresses, URLs, and file hashesi, enriched with contextual information about campaigns, tactics, techniques, and procedures (TTPs) to produce actionable insights. He stresses that confidence in data varies from unvetted open-source feeds to expert-curated platforms and that standardized formats like CybOX for observables, STIX for structured information, and TAXII for automated exchange enable seamless sharing across organizational boundaries.</p> Through a step-by-step case study, Harmon demonstrates how to apply these standards in practice: identifying excessive traffic on a server, back-tracing it to a phishing email with a malicious ZIP attachment, extracting MD5 hashes and C2 IPs, and packaging them into a STIX header with appropriate Course of Action blocks. He then compares two data-sharing solutions: ThreatConnect, which offers high-confidence, expert-vetted intelligence via CybOX/STIX/TAXII; and CriticalStack Intel, which aggregates over a hundred open-source IoC feeds in simple tab-separated values for rapid integration with Bro (the network analysis framework). To reinforce the concepts, Harmon outlines a hands-on lab deploying Bro or Security Onion, subscribing to Intel feeds, and using bro-cut to validate detectionsunderscoring the power of a community-driven neighborhood watch to elevate collective security posture.</p> 🔗</a>Presentation</h2> Threat Intelligence: Neighborhood Watch for your Networks</a> Threat Intelligence: Neighborhood Watch for your Networks, Script</a></p> Taking Control of IT Operations through the Critical Security Controls 2015-06-01T00:00:00+00:00 🔗</a>Summary</h2> The CSO Outlook article Taking Control of IT Operations through the Critical Security Controls by Matthew J. Harmon explains how embedding the first five of the SANS/CIS 20 Critical Security Controls into everyday IT processes can transform security from a reactive cost center into a proactive, measurable discipline.</p> 🔗</a>Starting Easy</h2> First, Harmon shows that many breaches start with unknown or low-priority systems, devices and software not inventoried or patched. Controls 1 (Inventory of Authorized and Unauthorized Devices) and 2 (Inventory of Authorized and Unauthorized Software) create visibility by correlating DHCP, ARP, and DHCP assignments for hardware and using WMIC, RPM/APT, or SCCM to catalog installed applications. This foundational inventory maps assets to owners, enables application whitelisting, and allows organizations to detect unauthorized additions before attackers can pivot.</p> Next, the article tackles Controls 3 through 5: secure configurations, continuous vulnerability assessment and remediation, and malware defenses. Harmon advocates applying vendor and CIS hardening guidelines via Group Policy Objects or configuration-management tools (Puppet, Chef), enforcing a 48-hour patch window for critical flaws through tiered testing and deployment, and layering defenses beyond antivirus, such as host firewalls, DNS filtering (e.g., OpenDNS), and threat-intelligence driven proxies. He concludes by recommending a gap assessment against the remaining controls and a phased implementation roadmap to embed these practices into routine IT operations and gauge their impact over time .</p> 🔗</a>Presentation</h2> CSO Outlook: Taking Control of IT Operations Through the Critical Secuity Controls</a></p> State of Cyber Security 2015-05-07T00:00:00+00:00 🔗</a>Summary</h2> The Minneapolis Chapter Palo Alto Networks Fuel Users Group Meeting on May 7, 2015, opened with a sobering overview entitled State of Cyber Security, underscoring that breaches are not a question of if but when. Drawing on cultural touchstones from Sesame Streets Oscar the Grouch to BBCs Moriartyi the presenter highlights that even simple lapses (like exposed post-it note credentials) can enable attackers and that motivated adversaries will exploit both technical and human weaknesses.</p> 🔗</a>Hard Data</h2> The bulk of the talk reviewed hard data from the 2015 Verizon Data Breach Investigations Report, detailing 2014s most significant incidentsranging from Neiman Marcuss 350,000 records to JP Morgan Chases 76 million households and cataloged threat sources, attack vectors, and time-to-compromise metrics. This context stressed that organizations must evolve beyond perimeter defenses and adopt proactive monitoring, rapid patching, and layered controls to limit dwell time and impact.</p> 🔗</a>Information sharing</h2> In response to these challenges, the presentation pivoted to the power of shared intelligence. It outlined the founding of the NorSec ISAO under recent executive orders, described opensource feeds (APTnotes, ShadowServer, REN-ISAC CIF), and defined Indicators of Compromisefrom DNS hosts to file hashesemphasizing that crowd-sourced, expert-vetted threat data is essential for timely detection. Finally, it showcased Palo Alto Networks solutions WildFire for sandbox analysis and Traps for endpoint exploit preventionas integral tools for automating IoC blocking and closing the gap between discovery and defense.</p> 🔗</a>Presentation</h2> State of Cyber Security 2015</a></p> ACM Club Cyber Security Workshop 2014-04-09T00:00:00+00:00 🔗</a>Summary</h2> Matthew J. Harmons ACM Club Cyber Security Workshop, presented at Saint Paul College on April 9, 2014, frames the modern cybersecurity landscape as a high-stakes arena where adversaries backed by virtually limitless R&D budgets that need only exploit a single vulnerability to wreak havoc. Through vivid attack-map visuals and a rundown of headline-grabbing breaches, Harmon drives home that traditional defenses alone are no longer sufficient.</p> 🔗</a>Threat Environment</h2> He first surveys the threat environment: adversaries overcapitalization, the evolution from amateur pranks to organized extortion campaigns, and real-world DDoS, data-exfiltration, and malware incidents (Adobe, Heartland, Target, and more). Harmon then flips the narrative to the defenders advantage akin to knowing ones own network, deploying active defenses (honeypots, fake devices), and leveraging tools like the Active Defense Harbinger Distribution to illustrate how preparedness and ingenuity can tip the balance in favor of the good guys.</p> 🔗</a>Cyber Security as a Career</h2> Building on these insights, the workshop explores cybersecurity as both a career path and a community mission. Harmon traces the evolution of security roles from SysAdmin beginnings to specialized certifications and scripting-driven administration with Ansible, Puppet, and Chef, highlighting the explosive demand and near-zero unemployment in the field. He closes with a rallying call for collaboration across ACM, ISSA, (ISC)2, and other groups, urging attendees to unite under a trust but verify ethos, prepare for emerging IoT threats, and drive resilient computing initiatives in their organizations and beyond.</p> 🔗</a>Presentation</h2> ACM Club Keynote</a></p> DDoS Survival 2013-10-18T00:00:00+00:00 🔗</a>Summary</h2> Matthew J. Harmon and Phil Reno present at the (ISC)2 Twin Cities Area Chapter on DDoS Survival, delivered on October 18, 2013, provides a comprehensive primer on Distributed Denial of Service (DDoS) attacks and how organizations can withstand and mitigate them. It begins by defining DDoS as resource exhaustion aimed at disrupting servicesand tracing its roots from IRC-driven pranks to sophisticated protest and extortion campaigns.</p> 🔗</a>Threats and Attack Techniques</h2> The first section surveys real-world threats and attack techniques. The presenters highlight notable incidents such as Anonymous/AntiSec campaigns and itsoknoproblembro browser-based botnets and reference data on rising attack volumes from sources like Arbor Networks. They categorize attack vectors across the OSI stack (TCP/SSL floods, HTTP-level assaults like Slowloris and chunked-header exploits, and ICMP/UDP floods) and assess attacker skill levels, from low-effort LOIC/XOIC scripts to more advanced injection-driven browser botnets.</p> 🔗</a>Defense and Resilience</h2> The second section focuses on defense and resilience strategies. Harmon and Reno outline four architectural approaches: ISP-level scrubbing, Cloud SOC via proxy/DNS redirection, full-service cloud scrubbing with BGP rerouting, and in-house solutions. Detailing the pros and cons of each. They emphasize risk transference through CDNs and anti-DDoS services, null-routing tactics, and bigger pipes, supplemented by application-level tweaks. The presentation concludes with guidance on selecting providers (key questions on SLAs, mitigation capabilities, and cost structures), proactive load testing, and leveraging automation tools (Chef, Puppet, Ansible, SaltStack, Fabric) to scale and verify infrastructure readiness under attack.</p> 🔗</a>Presentation</h2> DDoS Survival</a></p> Cloud Security 2013-06-18T00:00:00+00:00 🔗</a>Summary</h2> The (ISC)2 Twin Cities Area Chapter presentation Cloud Security by Matthew J. Harmon at the 2013 Annual Meeting introduces the fundamentals of virtualization and cloud computing, emphasizing both their transformative potential and the security considerations they entail.</p> 🔗</a>Cloud Technology</h2> First, Harmon unpacks virtualization basics like defining hypervisors (Type 1 and Type 2), guests, and core virtualization architecturesand maps these concepts onto cloud service models such as Software-as-a-Service (SaaS), Infrastructure-as-a-Service (IaaS), and Anything-as-a-Service. He highlights key benefits including server consolidation, rapid provisioning and decommissioning of resources, auto-patching and silent upgrades, reduced operational overhead, and the ability to harvest processing power on demand. This framing positions cloud computing as a natural extension of traditional virtualization that delivers scale, flexibility, and cost efficiency.</p> 🔗</a>Security and Privacy Risks</h2> Second, the presentation shifts to the security and privacy risks inherent in cloud environments. Harmon details confidentiality challenges in multi-tenant platformswhere co-located data often lacks provider-managed encryption and availability threats stemming from service outages, contractual lock-in, or disputes with providers. He also addresses integrity risks due to limited transparency into vendor operations and the potential for insider threats. To mitigate these issues, he advocates a trust but verify approach: enforce end-to-end encryption (in transit, processing, and at rest), conduct rigorous vendor audits, codify security requirements in contracts, and maintain continuous risk assessments to ensure that cloud-hosted assets remain under organizational control and resilient against data breaches.</p> 🔗</a>Presentation</h2> Cloud Security</a></p> Java Exploits: Offense and Defense 2012-10-24T00:00:00+00:00 🔗</a>Summary</h2> Matthew J. Harmons (ISC)2 Twin Cities Chapter presentation Java Exploits: Offense and Defense, delivered on October 24, 2012, examines the pervasive risk of client-side Java vulnerabilities and outlines why these flaws represent a critical attack vector for organizations. Harmon, drawing on his two decades of security experience, highlights how the Java sandbox can be bypassed via reflection and code injectiondemonstrated by high-impact exploits documented by researchers like Joshua Drake and Adam Gowdiakand underscores the urgency of addressing these pervasive weaknesses.</p> 🔗</a>Attacks</h2> The talk begins by quantifying the threat: in 2012 alone, 23 out of 50 Oracle JRE vulnerabilities carried a CVSS score of 10, signaling complete system compromise without authentication. Harmon dissects sample exploit code that disables the Java SecurityManager by injecting an AllPermission-granted ProtectionDomain, illustrating how easily an attacker can escalate privileges. He reviews major sandbox escapes and stresses that patch cycles alone cannot keep pace with adversaries who weaponize newly discovered flaws .</p> 🔗</a>Defense</h2> To counter these risks, Harmon presents a two-pronged defense strategy. On the technical side, he advocates strict whitelisting of Java applets via Group Policy, Click-to-Run settings in browsers to prevent drive-by code execution, and deployment of inline or local sandboxessuch as Invinceas VM-based isolation or FireEye appliancesto contain untrusted code. Complementing this, he urges policy-driven measures: eliminate Java where it isnt business-critical, enforce inventory and configuration controls per the SANS Critical Security Controls (especially Controls 15), and integrate Java risk assessments into broader security governance. By combining these controls, organizations can substantially reduce their Java attack surface and stay ahead of emerging exploit techniques .</p> 🔗</a>Presentation</h2> Java Exploits Offense and Defense</a></p> Security on a Shoestring Budget 2012-03-16T00:00:00+00:00 🔗</a>Summary</h2> The Minnesota Council for Non Profits presentation Security on a Shoestring Budget by Matthew J. Harmon and Natascha E. Shawver delivers practical guidance for nonprofit organizations to improve their security posture without large investments. It frames security as a mission enabler rather than a cost center and stresses that common-sense controls can dramatically reduce risk.</p> 🔗</a>Security Concepts</h2> The presenters begin by defining core information-security concepts: impact, risk, threats, vulnerabilities, and controlsto build a shared vocabulary. They emphasize why nonprofits must care about security, listing potential losses (reputation, funding, productivity, legal liability) that imperil organizational missions. By demystifying terms and highlighting that security is more than just computer stuff, they prepare attendees to tackle specific, budget-friendly measures.</p> 🔗</a>Actions</h2> The heart of the talk is a prioritized bare necessities checklist of seventeen actions tailored for resource-constrained environments. Starting with secure password management and asset inventories, it moves through network hardening (firewalls, patching, wireless security), malware defenses, automated backups, and principle-of-least-privilege user controls. It rounds out with training, policies, disaster-recovery planning, and vendor oversight. Each step is designed to be actionable with free or low-cost tools, enabling nonprofits to take incremental, sustainable strides toward resilience.</p> 🔗</a>Presentation</h2> Security on a Shoestring Budget</a></p> Why Take the Risk? Doing Risk Assessments Right 2011-12-07T00:00:00+00:00 🔗</a>Summary</h2> The SANS presentation Why Take the Risk? Doing Risk Assessments Right by Matthew J. Harmon, delivered at the 30th Annual Minnesota Government IT Symposium on December 7, 2011, lays out a structured approach for organizations to identify, analyze, and manage IT risks. Harmon draws on industry standards and real-world examples to show how a disciplined risk assessment process can both prevent loss and add strategic value.</p> 🔗</a>Risks and Probability</h2> First, the talk defines an IT risk assessment as an analysis of system assets and vulnerabilities to establish an expected loss from certain events based on estimated probabilities, per the Department of the Navy (OPNAVINST 5239.1A) and ISO Guide 73:2009. Key terminology such as threat agents, vulnerabilities, impact, and riskis clarified, with threats described as anything capable of harming an asset and risk framed as a function of likelihood and impact. Harmon emphasizes that thorough identification of assets, threat scenarios, and existing controls is essential to determine whether current safeguards reduce risk to acceptable levels.</p> 🔗</a>Frameworks</h2> Second, Harmon surveys leading frameworks like NIST SP 800-30, ISO 27005, ISO 31010, FAIR, and OCTAVE and maps them onto a Plan-Do-Check-Act lifecycle. The process begins with planning and establishing context, then moves through asset and threat identification, vulnerability analysis, and impact assessment. He details methods for both quantitative (e.g., Annualized Loss Expectancy calculations) and qualitative (e.g., Low/Medium/High scales) analyses, and outlines risk treatment optionsaccept, mitigate, transfer, or avoidguided by senior-management engagement. The presentation concludes by stressing the importance of actionable treatment plans, ongoing monitoring, and regular reviews to maintain and improve organizational resilience.</p> 🔗</a>Presentation</h2> Why take the risk?</a></p> Incident Handling, Forensics and Hacking Techniques 2011-10-19T00:00:00+00:00 The SANS Incident Handling & Forensics presentation by Matthew J. Harmon provides a comprehensive overview of how organizations should prepare for, respond to, and learn from security incidents. Drawing on industry best practices and real-world examples, it emphasizes the importance of structured processes, clear communication, and rigorous evidence handling to minimize damage and restore operations promptly.</p> 🔗</a>Incident Response</h2> First, the talk lays out the six core phases of incident response: Preparation, Identification, Containment, Eradication, Recovery, and Lessons Learneddetailing the goals and key actions at each stage. Core principles such as work in pairs, maintain a strict chain of custody, never operate on original data, and enforce a need-to-know policy are reinforced throughout. These guidelines ensure that responders act methodically, take comprehensive notes, and prevent further compromise while preserving forensic integrity.</p> 🔗</a>Techniques and Toolkits</h2> Second, the presentation transitions to practical techniques and toolkits. It introduces the SANS Investigative Forensic Toolkit (SIFT) and offensive-focused distributions like BackTrack for evidence acquisition and analysis. Step-by-step procedures cover documenting the scene, identifying and preserving data sources (from servers and workstations to mobile devices), performing bit-by-bit imaging, and analyzing logs and memory. Finally, it underscores the need to produce clear, audience-appropriate reportswhether for corporate management, legal teams, or law enforcementto drive improvements and policy changes post-incident.</p> 🔗</a>Presentation</h2> Minnesota High Tech Crime Investigators Association</a></p> ISO Focus+ Article: Plugging Security Gaps 2010-04-01T00:00:00+00:00 The attached article examines the explosive adoption of radio-frequency identification (RFID) technology across industries and the emerging security concerns that threaten its continued growth. As organizationsfrom the U.S. Department of Defense to livestock ranchers and healthcare providersincreasingly rely on RFID for tracking assets, the industry must confront vulnerabilities that could undermine both privacy and trust in this pervasive technology.</p> 🔗</a>Attacks</h2> In the face of demonstrated attackssuch as drive-by cloning of passport tagsRFID systems are exposed to a spectrum of threats at multiple points: the tag itself, the reader (interrogator), and the air interface. Common attack vectors include mimicking (spoofing, cloning, malicious code), information gathering (skimming, eavesdropping, data tampering), and denial-of-service tactics (reader jamming, tag blocking or killing). Each of these can compromise confidentiality, integrity, or availability, potentially disrupting business operations and eroding user confidence.</p> 🔗</a>Defense</h3> To address these challenges, international standards bodies have moved to embed security into RFID deployments. ISO/IEC TR 24729-4 lays out guidelines for tag data securitycovering encryption, authentication, and secure data transmissionwhile balancing cost, storage constraints, and read-performance requirements. The report recommends leveraging a suite of countermeasures (e.g., unique tag identifiers per ISO 15963, password protection, and cryptographic controls) and employs the OWASP DREAD model to assess and prioritize risks. Ongoing work by ISO/IEC SC 31s WG 7 seeks to harmonize these efforts into a coherent framework that ensures interoperability, efficiency, and privacy as RFID becomes ever more ubiquitous.</p> 🔗</a>Presentation</h3> ISO Focus+ April 2010</a></p>

I Told You So

The itys.net unikernel

🔗</a>Recipes</h2> Remote pushes</strong>: pipe into ssh</code> to avoid local disk writes.</p>

🔗</a>Roadmap</h2> Optional Blake3 digests for faster verification on low-power hardware.</li> Built-in push</code> helper with retry/backoff for S3 and rsync targets.</li>

🌀 Spiral Burst 128

🔗</a>What’s inside</h2> Payload: user string.</li> SF128: first 16 bytes of SHA‑256(payload).</li> CRC16: CRC‑16/CCITT of the SF128 bytes.</li> Data Matrix (center): payload, SF128 (hex), CRC16 (hex), using the smallest fitting ECC200 symbol.</li>

🔗</a>CLI usage</h2> Encode: python encode_snowflake.py "Your payload"</code> (add --verify</code> to arm‑decode after render).</li> Decode: python decode_snowflake.py snowflake.png --search</code> (or without --search</code> for speed).</li>

🔗</a>Constraints & robustness</h2> Works in grayscale/black‑and‑white; outlines and burst contrast survive binarization.</li> Repetition code tolerates isolated bit errors; CRC16 covers SF128.</li>

Moderate friction gates

🔗</a>The bot friction layers:</h3> PoW with adjustable difficulty based on interaction.</li> Per‑IP rate limiting on PoH challenge creation.</li> Session TTL shortened for “suspicious” clients (those that never fetched favicon.ico</code>).</li>

🔗</a>4.1. Don’t Panic logo</h3> Yes, I am a Hitchikers Guide to the Galaxy type of person.</p> Locally stored at /opt/poh/app/static/dontpanic.png</code>.</li> Served via GET /dontpanic.png</code>.</li>

🔗</a>4.2. Towel favicon and heuristic</h3> Locally stored at /opt/poh/app/static/favicon.ico</code>, built from a towel PNG.</li> Served by GET /favicon.ico</code>.</li> Each favicon request records _favicon_hits[ip] = _now()</code>.</li>

🔗</a>5. Systemd and Caddy Integration (Summary)</h2> For quick reference:</p> PoH app</strong></p>

Why your job turned against you

3-2-1-1-0 Backup Automation

NGINX Hardening

🔗</a>2 Install and file permissions</h1> Must</strong></p> Install from vendor or trusted repo; pin versions.</p> </li> Ownership/permissions:</p>

Concerning the Fourth Age of Man

2025Q2 Current Projects

COVID Isn’t Going Anywhere. Masking Up Could Save My Life.

Stonebreaker & Hudson: Part II, Basil Begins

Stonebreaker and Hudson: Part I

Emerging Cyber Ranges: Competition to Compliance

Internet of Everything: Hands-On Cyber Security

Threat Intelligence and Baselining

Threat Intelligence 101: Introduction and Foundations

Threat Intelligence: Neighborhood Watch for Your Networks

Taking Control of IT Operations through the Critical Security Controls

State of Cyber Security

ACM Club Cyber Security Workshop

DDoS Survival

Cloud Security

Java Exploits: Offense and Defense

Security on a Shoestring Budget

Why Take the Risk? Doing Risk Assessments Right

Incident Handling, Forensics and Hacking Techniques

ISO Focus+ Article: Plugging Security Gaps