Writing

MCP dropped DCR for CIMD - and handed you an SSRF

The 2026-07-28 MCP spec deprecates Dynamic Client Registration in favour of Client ID Metadata Documents. What changes, why, and what you have to guard now that your authorization server fetches URLs an attacker picks.

Deploying AI in a business: the AI is the easy part

I spent a weekend putting AI into a client's internal processes. The integration was boring. Picking the right processes, writing the guidelines, training the staff, and deciding who owns it afterwards - that's where the actual work was.

Debian 11 to 12 on Hetzner: What Actually Breaks

A bootloader package that had quietly stopped running, an unpinned NIC name, and an sshd config that isn't a conffile.

A 1,534-line commit called "runs"

Coldcard shipped firmware that generated wallet seeds from a weak PRNG. No AI was involved. That's the part worth sitting with.

What Real-time AI avatars actually cost

Four real-time avatar APIs, with the credit systems unpacked into dollars per minute, the latency claims taken apart, and a look at where your session data actually goes.

Make the AI adapt to you

Three things that made Claude fit how I actually work: an audit of my own transcripts, one central brain for plans and standards, and expert agents that arrive with the right references already loaded.

AI is the race car. I'm the driver.

I use AI all day and I'm more productive than ever. But it still goes astray the moment nobody's watching. Here's what it can't do, and why that's the job.

claude-plugins: Domain Experts You Can Install

A small Claude Code marketplace of subagents grouped into installable plugins, from stack-specific engineers to single-domain specialists, plus the one setup step that makes them behave.

Chat Control 1.0 Is Back: What It Means for You

The EU Parliament just reactivated Chat Control 1.0. Here's the short version of what passed, what it does, and what it actually means for 450 million EU citizens.

tku: Run Claude as Another Account, Just Once

A one-shot exec that runs Claude Code under a different subscription without touching your active login, so your work session keeps going while you fire off one thing as your personal account.

Still at it: PantherX, four years on

Four years after some wrong turns dragged PantherX out longer than it should have, it's found a shape that works: a layer on top of Guix that makes it approachable, with a GUI installer, GUI package management, real SSO for Linux, and a more stable substitute server.

Stackpit: a Tiny Self-Hosted Sentry

A drop-in, self-hosted replacement for Sentry's event ingestion and browsing. Single binary, single SQLite file, no external dependencies.

Web Rendering in Iced: A Few Months On

A progress update on iced_webview. Blitz went GPU-native, HiDPI stopped fighting me, and Servo hit a version wall.

Forseti: the Web UI Ory Doesn't Ship

Every self-service identity flow for Ory Kratos and Ory Hydra — login, registration, recovery, MFA, OAuth2 consent — plus an admin console, in a single server-rendered Rust binary.

Liwan: a Lightweight Matomo Replacement

A privacy-first, self-hosted analytics tool that dropped in where my Matomo instance used to be. One Rust binary, no database to babysit, and I imported all the old data.

TKU: Claude Code on Steroids

A single Rust binary that tracks token usage and cost across every AI coding tool, and lets me swap between my work and personal Claude subscriptions with one command.

Keycloak Multi-Tenancy: Realms vs Organizations

I'd heard Keycloak gets weird with many realms. So I benchmarked it. It does.

podman-healthcheckd: Container Healthchecks Without systemd

A small Rust daemon that runs Podman's container healthchecks on systems that don't have systemd to schedule them, like Guix, Alpine, or Void.

ISO 27001, ISO 42001, and What 'Aligned' Actually Means

A plain-English read on the two ISO standards that come up when customers ask about security and AI governance, and the honest difference between following them and being certified.

A Tiny Guix Build Farm on a ThinkPad

Offloading Guix builds to a LAN ThinkPad, then serving the substitutes from a static file host.