Writing

Stepping Up Guix System Security

Guix System ships two sysctl entries, no firewall and thirteen setuid binaries. Here's what I added on top, and what I left out.

Reviving a BlackBerry KEY2

I put LineageOS on an old BlackBerry KEY2 from a Guix machine

Testing GUI Apps With Claude

Letting Claude drive Qt apps on a virtual X server: screenshots, xdotool clicks and a QR reader.

My Laptop Is Never Idle, So I Rented One That Is

Moving cold Rust builds from a busy laptop to a rented Hetzner box: what it costs, and how long the round trip takes.

One Press, Two Clicks

The left switch on my mouse wore out and started registering one click as two. libinput debounces buttons already, but only over 12-25ms and with no knob - so I measured the bounce and wrote a filter that sits below it.

The Headphones Connected, the Mouse Didn't

My mouse and keyboard stopped reconnecting overnight while my headphones were fine. The adapter was stuck in a permanent LE scan that Chrome opens on launch - here's how I found it and the policy file that stops it.

687 GiB My SSD Didn't Know Were Free

My laptop was freezing under Rust builds. The SSD was doing 50ms writes because TRIM had never actually run - here's the diagnosis and the Guix config that fixes it.

MCP dropped DCR for CIMD - and handed you an SSRF

The 2026-07-28 MCP spec deprecates Dynamic Client Registration in favour of Client ID Metadata Documents. What changes, why, and what you have to guard now that your authorization server fetches URLs an attacker picks.

Deploying AI in a business: the AI is the easy part

I spent a weekend putting AI into a client's internal processes. The integration was boring. Picking the right processes, writing the guidelines, training the staff, and deciding who owns it afterwards - that's where the actual work was.

Debian 11 to 12 on Hetzner: What Actually Breaks

A bootloader package that had quietly stopped running, an unpinned NIC name, and an sshd config that isn't a conffile.

A 1,534-line commit called "runs"

Coldcard shipped firmware that generated wallet seeds from a weak PRNG. No AI was involved. That's the part worth sitting with.

What Real-time AI avatars actually cost

Four real-time avatar APIs, with the credit systems unpacked into dollars per minute, the latency claims taken apart, and a look at where your session data actually goes.

Make the AI adapt to you

Three things that made Claude fit how I actually work: an audit of my own transcripts, one central brain for plans and standards, and expert agents that arrive with the right references already loaded.

AI is the race car. I'm the driver.

I use AI all day and I'm more productive than ever. But it still goes astray the moment nobody's watching. Here's what it can't do, and why that's the job.

claude-plugins: Domain Experts You Can Install

A small Claude Code marketplace of subagents grouped into installable plugins, from stack-specific engineers to single-domain specialists, plus the one setup step that makes them behave.

Chat Control 1.0 Is Back: What It Means for You

The EU Parliament just reactivated Chat Control 1.0. Here's the short version of what passed, what it does, and what it actually means for 450 million EU citizens.

tku: Run Claude as Another Account, Just Once

A one-shot exec that runs Claude Code under a different subscription without touching your active login, so your work session keeps going while you fire off one thing as your personal account.

Still at it: PantherX, four years on

Four years after some wrong turns dragged PantherX out longer than it should have, it's found a shape that works: a layer on top of Guix that makes it approachable, with a GUI installer, GUI package management, real SSO for Linux, and a more stable substitute server.

Stackpit: a Tiny Self-Hosted Sentry

A drop-in, self-hosted replacement for Sentry's event ingestion and browsing. Single binary, single SQLite file, no external dependencies.

Web Rendering in Iced: A Few Months On

A progress update on iced_webview. Blitz went GPU-native, HiDPI stopped fighting me, and Servo hit a version wall.