Things I worked out, written down before I forgot them.
napkin math & half-proofs
"Rigorous limits, and a full life folded inside them."
— from the marginaliadiscofin-server
13 notes01The torrent client with no IP of its own
Putting the torrent client inside the VPN container's network namespace gives you a kill-switch you can't forget to turn on, and it breaks port mapping in a way that finally taught me what a container's network identity actually is.
2026-04-22 · homelab · security02Your firewall isn't protecting your containers
I had ufw on, default-deny, the whole posture. Docker published a port straight past it, because the two of them are fighting over iptables and Docker writes its rules first. The firewall I trusted was guarding a door the traffic never used.
2026-05-02 · security · homelab03The auth I deliberately didn't add
The reflex advice for any exposed service is 'put SSO in front of it.' Twice I started to, and stopped, because the gate would have broken the thing without making it any safer. More auth doesn't automatically mean more secure, and learning that took unlearning the reflex.
2026-06-09 · security · homelab04The reverse proxy that ignored my edits
I changed the config, reloaded, and nothing happened. The file on disk was right. The reload said success. The proxy kept serving the old routes. Three facts that can't all be true, except they were, and the culprit was an inode.
2026-05-12 · engineering · homelab05Quarantine, don't trust :latest
Auto-pulling :latest quietly hands an unattended supply chain the decision of what runs on your box tonight. I pulled that out and put a scan in its place: pull the candidate, scan it twice, and only promote it if it isn't a known-bad.
2026-06-15 · security · homelab06A reboot is the one thing I can't automate
Almost everything on this box self-heals. The reboot stays half-manual, not because it's hard to script, but because a reboot destroys the one thing that could tell me it worked.
2026-05-20 · homelab · engineering07How a subtitle format chose my whole media pipeline
A 4K stutter traced all the way back to image-based subtitles being burned into video in real time. Killing that one thing rippled backward through six services, and ended up rewriting what the box is even allowed to download.
2026-06-11 · homelab · engineering · ml08Semantic search over my own photos
I can search my self-hosted photo library for 'red bicycle in the snow' and it finds the shot, with no caption and no tag. It works because the photo and the words end up in the same space, and the database just measures a distance.
2026-06-02 · ml · homelab09Teaching Home Assistant to watch my 3D printer
I wanted the house to tell me when a print finished. One line of automation. Getting to that one line was a tour of every place a 'simple' integration hides a sharp edge, starting with the discovery that 'printing' is spelled running.
2026-06-22 · homelab · engineering10MQTT is the nervous system my house runs on
Every smart thing in my house that isn't a screen talks to exactly one other thing, a message bus. None of them know about each other. They know about the bus, and that's the whole reason the system can keep growing without turning into a tangle.
2026-06-18 · homelab · engineering11One domain, two systems that trust each other zero
My portfolio and my homelab share a single domain and trust each other exactly zero. Keeping that boundary honest, with separate pipelines, no shared credentials, and a hard look at the permissions you can't actually scope down, is the least flashy work in this series and the part I'd defend hardest.
2026-06-20 · security · homelab12The filesystem was the bug
A null byte in my .env finally made me look at the filesystem under the whole stack: exFAT, fine for six terabytes of write-once movies and quietly hostile to a directory of small databases rewritten every few seconds. Moving just that hot little part off it, without touching the media on the same disk, came down to two traps, a volume rename hiding inside the folder name and Docker's habit of inventing an empty config directory when you point it at the wrong path.
2026-06-29 · homelab · engineering13The socket is root
I wanted a button in my phone app that restarts a wedged container, and the obvious way to build it, handing the app the Docker socket, quietly hands a public-facing web app root on the host. The version I trust instead is built out of refusals: a proxy that forwards only the verbs I name, a write key that never travels with the read key, and a short list of containers the control plane is forbidden from ever touching, starting with its own plumbing.
2026-06-29 · security · homelabSonobe geometry
6 notes01Why a 90-unit Sonobe ball is a pentakis dodecahedron
Each paper unit is one edge of a hidden polyhedron, so the unit count alone tells you the whole shape.
2026-06-22 · math · origami02N = 30T, and why a 180-unit ball won't round
A short derivation of which unit counts exist, and why 180 folds fine but comes out lumpy.
2026-06-22 · math · origami03What a geodesic actually is
Buckminster Fuller, virologists, and origami folders are all building the same object, and here's the great-circle idea that connects them.
2026-06-22 · math · physics · origami04(b,c), chirality, and why the blueprint is the name
The two numbers that pin down a geodesic ball's size, twist, and handedness, and the moment the blueprint turns out to be the name.
2026-06-22 · math · origami05The largest ball I can fold from 1856 sheets
A counting problem that looks like calculus, turns out to be number theory, and quietly charges you quadratically for roundness.
2026-06-22 · math · origami06Loeschian numbers and the Eisenstein integers
Why 'rounds nicely' secretly depends on the prime factorization of T, a tour down to the Eisenstein integers.
2026-06-22 · mathPhysics & math
5 notesLagrangian mechanics is just saying δS = 0 and seeing what falls out
The action principle in one line, then the derivation that shows why Euler-Lagrange is the only equation you need.
2026-05-14 · physics · mathIf gravity switched off for ten seconds
The solar system would shrug. The ground would not.
2026-04-11 · physicsSolar panels under another star
A solar panel works around any star, but the 'right' panel is a different material for each one.
2026-04-11 · physics · engineeringWhy jaggies happen
Jaggies, the backwards-spinning wagon wheel, and shimmering textures are all the same bug: undersampling.
2026-04-11 · math · engineeringWhat 'repair this mesh' actually means
'Repair this STL' sounds like one button. It's about seven different problems in a trenchcoat, and a 3D printer will faceplant on any one of them. Building the repair tool meant naming all seven.
2026-03-01 · engineering · mathSecurity & homelab
1 noteML & evals
3 notesA fly brain on a laptop
A complete fruit-fly connectome now runs on a laptop and predicts real behavior, and hints at a non-LLM path to AI.
2026-03-09 · mlParameter count is a bad proxy
Bigger isn't better in any simple way: architecture and inference-time compute have made raw parameter count a weak signal.
2026-03-09 · ml · evalsReading my handwriting off a calendar
An app that reads handwriting off a photo of a paper calendar and drops the events into my phone. The handwriting was the easy part. The hard part was figuring out which day each scribble belonged to.
2025-08-18 · ml · engineeringEngineering & origami
5 notesA Durable Object per island
Each island in my little co-op game is its own tiny computer that falls asleep when nobody's around and wakes up still remembering who was in the room. That sentence is doing a lot of work, and most of it is the word 'each'.
2026-06-19 · engineeringA survival game with no HUD
I'm building a co-op game about cats surviving a city, and the design rule I'm most attached to is that there's no HUD. If a cat is starving, you find out the way you'd find out about a real cat: it tells you with its body.
2026-05-29 · engineeringKnowing what's playing vs. knowing what the music is doing
I wanted a visualizer that moved with the song, with bars that land when the song lands. Getting the computer to know what was playing was easy. Getting it to know what the music was doing is the part still open in the repo.
2026-05-29 · engineeringI wrote a debugger for Brainfuck, and the protocol was the point
The same Brainfuck project has breakpoints, stepping, a live view of the memory tape, plus red squiggles and formatting as you type. I wrote none of it for a specific editor. I wrote it once, behind two protocols, and the editors showed up for free.
2026-03-23 · engineeringI gave Brainfuck a JIT
Brainfuck is a deliberately useless language: eight characters, openly hostile to humans. I wrote it a profiling JIT compiler. I want to explain why that isn't as stupid as it sounds, though I'll admit it's a little stupid.
2026-03-20 · engineering