Writing

Every uncensored GLM-5.3 Flash provider I could find

Who serves an uncensored GLM-5.3 Flash, who's behind each provider, what it costs, and what an example session comes to.

What a month of coding-agent tokens costs: subscriptions vs API

One heavy month of agentic coding, priced across Anthropic, OpenAI, the open-model subscriptions and pay-per-token providers.

claude.ai on Forgejo, signed in through Forseti

Connect claude.ai to a self-hosted Forgejo with forgejo-mcp and Forseti SSO, without a personal access token.

Sortello: a Personal Extension for Claude, ChatGPT and Co.

Notes, tasks, tables and memories that Claude, ChatGPT and other assistants share, and that I share with the people around me.

Forseti's First Pen Test

What a grey-box pen test of Forseti found, what held, and what changed in 0.2.22.

Every uncensored DeepSeek V4.1 Flash provider I could find

Who serves an uncensored DeepSeek V4.1 Flash, who's behind each provider, what it costs, and what an example session comes to.

CIMD adoption three months in - Mistral is the one without it

Which AI clients identify themselves with Client ID Metadata Documents, which still need Dynamic Client Registration, and what that means if you run an MCP authorization server.

PHP2Shell, and a Site Stuck on PHP 5.6

Two critical PHP bugs, one ExpressionEngine 2 site with no upgrade path.

Stepping Up Guix System Security

Guix System ships two sysctl entries, no firewall and thirteen setuid binaries. Here's what I added on top, and what I left out.

Reviving a BlackBerry KEY2

I put LineageOS on an old BlackBerry KEY2 from a Guix machine

Testing GUI Apps With Claude

Letting Claude drive Qt apps on a virtual X server: screenshots, xdotool clicks and a QR reader.

My Laptop Is Never Idle, So I Rented One That Is

Moving cold Rust builds from a busy laptop to a rented Hetzner box: what it costs, and how long the round trip takes.

One Press, Two Clicks

The left switch on my mouse wore out and started registering one click as two. libinput debounces buttons already, but only over 12-25ms and with no knob - so I measured the bounce and wrote a filter that sits below it.

The Headphones Connected, the Mouse Didn't

My mouse and keyboard stopped reconnecting overnight while my headphones were fine. The adapter was stuck in a permanent LE scan that Chrome opens on launch - here's how I found it and the policy file that stops it.

687 GiB My SSD Didn't Know Were Free

My laptop was freezing under Rust builds. The SSD was doing 50ms writes because TRIM had never actually run - here's the diagnosis and the Guix config that fixes it.

MCP dropped DCR for CIMD - and handed you an SSRF

The 2026-07-28 MCP spec deprecates Dynamic Client Registration in favour of Client ID Metadata Documents. What changes, why, and what you have to guard now that your authorization server fetches URLs an attacker picks.

Deploying AI in a business: the AI is the easy part

I spent a weekend putting AI into a client's internal processes. The integration was boring. Picking the right processes, writing the guidelines, training the staff, and deciding who owns it afterwards - that's where the actual work was.

Debian 11 to 12 on Hetzner: What Actually Breaks

A bootloader package that had quietly stopped running, an unpinned NIC name, and an sshd config that isn't a conffile.

A 1,534-line commit called "runs"

Coldcard shipped firmware that generated wallet seeds from a weak PRNG. No AI was involved. That's the part worth sitting with.

What Real-time AI avatars actually cost

Four real-time avatar APIs, with the credit systems unpacked into dollars per minute, the latency claims taken apart, and a look at where your session data actually goes.