My Blog

Blocking Nasty Bots

2026-08-14T16:52:02Z

Someone shared this cool site on Hacker News: https://knock-knock.net/.

It’s a honey pot with the purpose of identifying malicious actors on the internet and then publicly sharing the list of their IP addresses.

Since I’m hosting my own site, I’ve seen how many bots are hitting my poor server. Number one on the list of 404 errors is a request to /wp-admin/install.php?step=1 – 10 times as many hits as the next entry. It’s clearly an attempt to pwn web servers whose careless admins left an uninitialized WordPress instance exposed to the internet.

Perhaps some of these actors are benign and do this simply to warn webmasters, but I don’t really want this traffic, so I’m going to try this out. I like its elegance. Setting it up is dead simple: https://knock-knock.net/blocklist

Except I experienced an issue. The script threw an error:

ipset v7.22: Hash is full, cannot add more elements

By reading the manpage like it’s 2021 we learn that the default maximum size, which we can increase using the maxelem argument, is 65536. Not enough. Let’s set it to 1048576:

#!/bin/bash
# See https://knock-knock.net/blocklist

URL=https://knock-knock.net/static/ip-blocklist-year.txt
ipset create knockknock hash:ip -exist maxelem 1048576
ipset create knockknock_tmp hash:ip -exist maxelem 1048576; ipset flush knockknock_tmp
curl -sf "$URL" | sed 's/^/add knockknock_tmp /' | ipset restore -exist
ipset swap knockknock_tmp knockknock
ipset destroy knockknock_tmp

# add the DROP rule only if it's not already present (so re-running is harmless):
iptables -C INPUT -m set --match-set knockknock src -j DROP 2>/dev/null \
  || iptables -I INPUT -m set --match-set knockknock src -j DROP

Save this to /usr/local/bin/knock-knock.sh, make it executable and add it as a cronjob and we’re done:


chmod +x /usr/local/bin/knock-knock.sh
ln -nfs /usr/local/bin/knock-knock.sh /etc/cron.daily/

(This is assuming a Debian system where curl, iptables and ipset are installed.)

Claude, M.D.

2026-08-09T15:21:17Z

In episode 5.18 of the TV show “House, M.D.” (fantastic show, by the way), they show a patient who presents with vertigo. They fix it within moments by applying the so called Epley maneuver. This trope is every patient’s dream: just do this one weird trick and you’re cured!

I still cannot believe that not only did I experience something similar, but the most shocking part of it was that it was Claude, the LLM by Anthropic, who told me about it, despite having seen a specialist.

It began a few years ago with pain in the tailbone. I went to see a physiatrist who promptly suspected I had a disc prolapse and ordered an MRI which confirmed the diagnosis. He prescribed physical therapy for lumbago with a focus on hip mobility and “fango” (hot mud). The physical therapist seemed young and inexperienced. He never wanted to see the radiological findings. So he showed me some stretching exercises for hip mobility, which I’ve been doing regularly.

But the pain never went away. It wasn’t very high on the pain scale, and it would vary, but it was always there. It only moved from the tailbone to the lower back. The physiatrist told me even in our first appointment that a prolapsed disc just happens eventually to most people, and I’d just have to learn to live with it. He said he also suffers from a prolapsed disc and accepted that he can’t do some movements anymore and has pain killers ready. He was around 20 years older than me.

Rather than seeking yet another opinion, I decided to try something different. I gave Claude the radiological findings. Initially, I just wanted to understand it better, but then I asked it about my therapy. Claude said I should find a new physical therapist and try dead bugs, bird dogs and Pallof presses on top of the stretching exercises. I tried the first two at home immediately, but didn’t notice anything in particular. The next time I went to the gym, I did three sets of Pallof presses.

Here, the effect was immediate. On the same day, just a few hours later, my back pain went away. And it stayed that way.

I’ve been living with mostly minor back pain for years, and it took five minutes of the right exercise to make it go away!

I asked Claude how that is possible, and while it noted that it could be a coincidence or a placebo effect, it’s also plausible that a single session can provide relief. We all know LLMs make stuff up, so I reserve judgment about the explanation, but it said that my body tried to protect the area around the prolapsed disc by activating bigger muscles for stabilization. The bigger muscles need more energy and eventually feel strained, while also making the area stiffer. So the pain would stay. A vicious cycle. By forcing my body to activate the smaller, deeper muscles during the Pallof press, it re-learned to use these more efficient muscles, taking load off the bigger ones.

Five minutes of the right exercise, prescribed by a language model, after years of enduring pain. Make of that what you will. All I know for sure is that the Pallof press is now my new favorite exercise.

Generated Passwords Don't Need Special Characters

2026-08-03T17:00:00Z

This really needs to be said:

If you are generating passwords, do not include special characters.

That’s right, I said it. Passwords without special characters.

I know, countless password policies and recommendations from all kinds of places mandate the use of at least one special character in a password. But guess what, adding an exclamation mark at the end doesn’t mean you now have a good password.

This rule is a rule of thumb that is given to users who are generally non-technical to help them choose a better password. The idea is that if adversaries are trying to find a password from its hashed form using brute force, they must work harder the larger the alphabet that makes up the password. And that’s true. Except brute force rarely plays a role.

As an adversary, you either try the most obvious passwords like Summer2026! or Passw0rd! in the case of online password-guessing attacks, or, in the case of an offline password-guessing attack, you go through a whole dictionary of words and apply some common transformation rules to each one, like appending some numbers, writing the password twice, replacing o with 0, etc. Very rarely do you actually try every combination of letters there is up to some length, which is what we mean by “brute force”.

Passw0rd! is clearly a terrible password, but it passes most password policies. And honestly, if you are trying to come up with a password, you are most likely doing it wrong in the first place. Today, people commonly have dozens if not hundreds of accounts. Most people realize by now that reusing passwords is a bad idea, so a password manager is pretty much mandatory. And if you are already using a password manager, you are probably generating your passwords, save for a handful. Which is great!

Any password that has been randomly generated is much more secure than almost anything you can come up with in your head for the aforementioned reasons. Even if it only consists of letters and numbers. Or even just letters, if it is long enough.

Nobody will ever guess vx5O8Ytqb0ewqY2W. Trust me on this. There are more than \(10^{28}\) passwords just like it – adding a dash in the middle will have no meaningful impact on its security.

Meanwhile, a password like YT\s87`JS&TDU);w leads to nothing but issues. I couldn’t even type it plainly here in my blog software because of the backtick in the middle.

It’s also a huge pain to type in if the keyboard layout doesn’t match the physical labels on the keyboard. This probably doesn’t happen to most people, but I happen to prefer the QWERTY layout while also living in Germany, so mismatches are common for me. What makes it worse is that my job requires me to be onboarded to a different customer around once a month. I either get a physical device, have to use a buggy Guacamole/Citrix/Whatever browser interface, or a vSphere web console. Copy and paste is often not an option. And usually you can’t see what you are typing!

Even if copy and paste was an option, I cannot select the password above by double-clicking it, because some of the special characters are interpreted as “end of word” characters. Annoying.

It gets worse. I have had customers hand me a letter, with my initial password printed using a sans serif, variable width font, where l and I look identical, which cost me time and nerves. That’s not the worst part yet. A while ago, I kid you not, I was given a password that started with a space. A space! In a password! For no reason! It took two hours and two calls with the help desk to figure that one out.

I’ve actually recommended in the past (only half-jokingly) to add a space to the end of a password, so when an adversary cracks your password against all odds, they’ll probably read it on the command line where trailing spaces are invisible:

(Guess what, this actually bit me once as well when I tried to enter a password from my password manager on a separate laptop. My password manager is pass, which prints the password on the command line. But I digress.)

But jokes aside, just don’t use special characters in generated passwords please.

I know some password policies won’t accept a password without special characters even if it has been generated. In such cases, I add a dot in the middle. It’s in the same position on all keyboard layouts I’ve ever seen. Some policies are just ridiculous. Special shout-out goes to Cryptshare, which deems JTbEmE9Pcvbd2JGh as not secure enough, because it contains the keyboard pattern cvb.

Inspired by Ricky Mondello, who wrote about generated passwords at Apple, I use a small script that generates somewhat pronounceable passwords which should satisfy most policies:

#!/bin/bash

# Generate first two parts:
# call pwgen twice, uppercase first letter of each, then join
part1=$(pwgen -AB0 5 1 | sed 's/^\(.\)/\U\1/')
part2=$(pwgen -AB0 5 1 | sed 's/^\(.\)/\U\1/')

# Generate four random digits
part3=$(printf "%04d" $((RANDOM % 10000)))

# Output as <1>.<2>.<3>, replace ambiguous characters
echo "${part1}.${part2}.${part3}" | tr 'IOZzYy' 'AUSsJj'

Yes, this will cost us some entropy. How much? We can approximate the entropy with this command (shamelessly stolen from this StackExchange answer):

  
for i in $(seq 1000) ; do generate-password.sh ; done \
    | xz -9e - | wc -c
8152

Divide by 1000, multiply by 8, and that’s roughly 64 bits of entropy per password of length 16. Good enough for me.

Here are some examples:

Pahse.Aeque.4852
Peiso.Upoot.8630
Aipoo.Hieka.4123

But other than that, please just don’t use special characters in generated passwords. It’s security theater.

I Have a Blog Now

2026-08-01T08:56:43Z

A few weeks ago, I saw two interesting talks on Tübix. One was about self-hosting an e-mail server with Stalwart, and another was about digital sovereignty in Europe – or at least the first half of it, then it turned into a bit of a rant about the state of the usability of FOSS.

The message in both talks matched the sentiment that can be felt in many circles these days: digital sovereignty is becoming more important than ever. Dependence on (usually US American) hyperscalers should be avoided. This resonates with me.

Of course, digital freedom comes at a cost. But so does signing up to Google, Facebook, Twitter, and so on. If you’re not paying with money, you’re paying with something else: not just your freedom, but also your data, your privacy, your independence.

There are so many reports on social media from people who got locked out of their accounts for opaque reasons and are unable to contact a human being even though they earn their livelihood by publishing on some app store, processing payments with PayPal, or have their entire business infrastructure hosted on G Suite or M365. More recently, people have been locked out for political reasons as well.

We are used to everything on the internet to be free of charge. It’s important to keep in mind that you get what you pay for. For me, it’s more than fair to spend a couple of Euros for a good service that is as important as your e-mail. I had a few e-mail providers in the past: GMX, Arcor (now Vodafone), AOL (So what? They offered IMAP and the address was short, what else do I need?), Protonmail (first time I paid), and now Mailbox.org.

I moved on from Protonmail because it felt too patronizing. More specifically:

No automatic forwarding: I only realized after signing up that they don’t provide a way to forward e-mails. They claim it’s for security reasons, and while I understand where they are coming from, it also makes switching providers harder.
No IMAP: They don’t offer regular IMAP without their custom-built bridge. Again, I understand that they want to protect users and why OAuth2 is more secure, but I feel sufficiently competent to handle the risk myself and don’t want to be patronized.
Weak E2EE: The promise of end-to-end-encryption falls flat if they offer to manage your keys for you. Key management cannot be delegated if you value true E2EE.

And no offense to Switzerland, but it’s just one more government I’m handing control of my data over to.

I deleted my Facebook account a long time ago, then my Twitter account after it became an unabashed platform for right-wing ideology, and recently my Instagram account. I haven’t been using these accounts very actively anyway. To stay up-to-date, I now read Hacker News, Bluesky and some good old RSS feeds.

RSS is a great piece of technology that is part of the “old” internet, where everyone owned a small place on it and most services were decentralized and/or federated. I like that internet. I don’t like where the current internet is headed. And I find the often-cited reasons why I should get a blog completely convincing.

So I’m trying to do my part: get a small place on the internet, with my own domain, an e-mail service that respects my freedoms, and use the internet in the way it was intended to be used.

Even though Stalwart looks amazing, I’m not quite ready yet to host my own e-mails, so I went with Mailbox.org, a German provider. In general, I try to get away from non-European services as much as possible without being radical. I like the convenience of my FireTV too much to ditch it, I don’t have the energy to run a de-Googled phone, and unfortunately there are no competitive alternatives to Claude et al. from Europe. But buying a domain and a small VPS from Berlin-based Ionos was quick, easy and convenient. I could even pay via bank transfer – at least for the domain, then there were “technical issues” and I had to pay for the VPS with a Visa card (yuck!). Unfortunately, Wero was not an option yet.

Next, I threw a site together with Hugo, set up Caddy on my brand new Debian VPS, and here we are! Annoyingly, I ran into one issue of the Hugo theme I picked. Happily, Caddy was even more convenient than I knew! I’m already using it to self-host some local apps using my own CA, which works like a charm, and now I wasted 15 minutes trying to find out how to set up certbot with Caddy just to learn that Caddy requests a certificate from Let’s Encrypt automatically. By default!

So here we are: I have a blog now! My own domain, my own web space, my own little place on the internet.

We’ll see what happens!

So please don’t like and subscribe or leave a comment. Though you’re always free to shoot me an e-mail if you like.