Every blog post that took off on Hacker News, ranked by the votes of its best submission. 1,615 posts.
( These are my notes from the first half of my talk at HOPE9 last weekend. I write notes like these not as a script, but so that I have at least some words ready in my head when I'm speaking. They are more conversational and less organised than a usual blog post, so please forgive me the rough edges. )
Last week I wanted to replace my OpenVPN setup with WireGuard. The basics were well-documented, going beyond the basics was a bit trickier. Let me teach you want I learned. The basics But first, let’s summarize the basics. I have a server with a hosting provider that I want to use as a VPN server. I won’t delve into…
Personal Blog of Christian Haschek
With the new year upon us, I decided it was time to do something ambitious for my Open Source project. This is where I normally quip about never mentioning my project before, even though I literall…
Why Pi-hole, the Raspberry Pi DNS sinkhole, is worth running at home to block trackers, ads, and analytics endpoints across every device on the network.
I've been following WisdPi's development of various 5 Gbps and 10 Gbps Ethernet adapters for the past couple years. They use newer Realtek Ethernet chips, which sometimes have performance quirks—most frequently encountered under Linux. In today's video, I tested the new WisdPi 10G Ethernet Expansion Card for Framework…
A confusing letter from HSBC informed me that I've not been receiving their emails, and I have to change the email address they use to contact me. Except I've been receiving all of their emails just fine! The problem, it turns out, is that surveillance capitalism is now so-widespread that the bank cannot conceive that…
Linux TCP Tracepoints, and using them via bcc/eBPF.
I recently picked up a Starlink Mini to use as a backup connection for my home network. The underlying technology is fascinating - thousands of satellites in low Earth orbit delivering broadband almost anywhere. With the new £4.50 standby plan, it's an excellent way to keep things online.
[If USB2.0 is too boring, learn about the details of 50 different Thunderbolt-4 docks – yep you read that right, there are 50 different models – find out which ones are identical inside…
gRPC comes up occasionally on the Orange Site , often with a redress of grievences in the comment section. One of the major complaints people have with gRPC is that it requires HTTP trailers. This one misstep has caused so much heartache and trouble, I think it probably is the reason gRPC failed to achieve its goal…
In May last year, a new attack on the Diffie Hellman algorithm was released, called Logjam . At the time, I was working on a security team, so it was our responsiblity to check that none of our servers would be affected. We ran through our TLS config and decided it was safe, but also needed to check that our SSH…
Every developer should know the basics of DNS, the critical protocol at the heart of the web.
SSH to machines in private networks using an SSH key, from anywhere in the world, using Cloudflare Tunnel.
This article explains the mechanics behind traceroute, from IP headers and TTL fields to ICMP messages. Learn why traceroute is a crucial tool for network diagnostics, how it differs from ping, and how to interpret its output. Ideal for network administrators, IT professionals, and curious users looking to understand…
Personal Blog of Christian Haschek
SSH port forwarding explained in a clean and visual way. How to use local and remote port forwarding. What sshd settings may need to be adjusted. How to memorize the right flags.
DNS latency is a key component to having a good online experience. And in order to minimize DNS latency, carefully picking DNS servers and anonymization...
Take control of your telephony with Asterisk!
Before March 2023 I couldn’t for the life of me understand what was going on in the AWS VPC dashboard. I mean, look at the length of the scrolling bar on the left-hand panel! So, with the goa…
This post is intended to dispell the mistaken belief that IPv4 is more secure than IPv6 because it includes a NAT which must be configured to allow inbound traffic.
You're probably reading this page because you've attempted to access some part of my blog (Wandering Thoughts) or CSpace , the wiki thing it's part of. Unfortunately you're using a browser version that my anti-crawler precautions consider suspicious, most often because it's too old (most often this applies to versions…
Normal practice in deploying post-quantum cryptography is to deploy ECC+PQ. IETF's TLS working group is standardizing ECC+PQ. But IETF management is also non-consensually ramming a particular NSA-driven document through the IETF process, a "non-hybrid" document that adds just PQ as another TLS option.
Avoid ISP routers
