Fabian Morón Zirfas's Blog

README

Sun, 04 Sep 2016 00:00:00 GMT

This site ist currently under constructions. Needs a full redesign. Thanks for your patience.

Work in Progress

Mon, 05 Sep 2016 00:00:00 GMT

I actually started working on the site again. I hope to have something till the end of the month. Stay tuned.

It's time to start blogging (again)

Wed, 07 Dec 2016 00:00:00 GMT

Recent events in big data, like the usage of Michal Kosinski research for influencing elections, the "hacking" of Googles search algorithms for pushing right wing propaganda into search results and the development from hyperlinked information to linear TV like consumption makes me sangry (sad+angry). So I will start blogging. Not on medium, not Tumblr or whatever. It will happen here. Sometimes in English, sometimes German, sometimes in Code. So stay tuned and use the RSS feed.

Dog not Cat - Colored output in from cat in the terminal

Wed, 04 Jan 2017 00:00:00 GMT

How to make cat have colored output?

sudo easy_install Pygments

Then edit your .bashrc, .bash_profile or .zshrc and add the following line:

alias dog="pygmentize -g"

Source it and you are good to go.

dog myfile

Will give you colored output. Nice!

Found around the web.

Weekly round up - translation, productive habits and procrastination

Wed, 04 Jan 2017 00:00:00 GMT

Writing a blog post each week is hard. Especially when you have a kid, a job, a wife, friends, a hobby and a paper due in 3 weeks. So here is just a quick one for this week.

First the overwhelming change in Google Translate (you really should check it out). They applied some neural network magic to it and now have really good translations. This is awesome. It seems also that the AI created its own language.

Google’s researchers think their system achieves this breakthrough by finding a common ground whereby sentences with the same meaning are represented in similar ways regardless of language – which they say is an example of an “interlingua”. In a sense, that means it has created a new common language, albeit one that’s specific to the task of translation and not readable or usable for humans.
newscientist.com - Google Translate AI invents its own language to translate with

There is this article nytimes.com - The Great A.I. Awakening that I really need to read.

Second thing is this app: productiveapp.io. I really did drink enough water this week. Also, I'm writing this blog post. Ain't I?
Third procrastination. I'm good at it. Not writing the paper but a blog post instead, my plants have water the kitchen is clean and so on. Well. Then let's get back to work…

Markdown Preview in the Terminal

Fri, 31 Mar 2017 00:00:00 GMT

So how can we preview Markdown files in the terminal? There is of course mdless by Brett Terpstra, but what if you don't want to use a ruby gem (for some kind of wired reason). The best solution I found is a combination of two tools pandoc and lynx.

Together you can turn them into a handy function to preview your markdown files when you are logged into that machine on the other side of the world.

If you are using fish add this to your functions under .config/fish/functions/mdview.fish (mdview is the name of the function and the file you will have to create).

There are some sanity checks in there that look if pandoc and lynx are installed. If not on macOS run brew update && brew install pandoc lynx.

function mdview
if set -q argv
  switch $argv
    case -h
      echo "[M↓] Help"
      echo "call the mdview with a Markdown [M↓] file as argument"
      echo "this script needs pandoc and lynx installed"
      echo "on macOS run 'brew install pandoc lynx'"
    case "*"
      # check if pandoc is installed
      if pandoc -v >/dev/null do
      # check if lynx is installed
        if lynx -version >/dev/null do
          # run the magic
          # pass the file to pandoc
          # it will be converted to HTML and go to stdout
          # pipe it into lynx stdin
          pandoc $argv | lynx -stdin
        else
          echo "lynx is not installed"
        end
      else
        echo "pandoc is not installed"
      end
    end
  end
end

For bash/zsh this should be something like this in its simplest form.

#!/bin/bash
function mdview (){
    # pipe it into lynx stdin
    pandoc "$1" | lynx -stdin
}

Have fun.

JSON feed

Thu, 18 May 2017 00:00:00 GMT

I have a JSON feed now here.

We — Manton Reece and Brent Simmons — have noticed that JSON has become the developers’ choice for APIs, and that developers will often go out of their way to avoid XML. JSON is simpler to read and write, and it’s less prone to bugs.
So we developed JSON Feed, a format similar to RSS and Atom but in JSON. It reflects the lessons learned from our years of work reading and publishing feeds.
See the spec. It’s at version 1, which may be the only version ever needed. If future versions are needed, version 1 feeds will still be valid feeds. (…)
source

Things 3 or not?

Fri, 19 May 2017 00:00:00 GMT

The people at Culturecode updated Things from v2 to v3. There is no upgrade pricing. Which is understandable after so many years of development. I'm asking myself now: “Should I spend the 50€ (macOS + iOS) version?” The thing (lowercase) is I moved on. I didn't start Things (upper case) for a long time. I moved on to Taskpaper, but even these are not part of my daily habits. After I first evaluation of the trial app, I still wasn't convinced that I should move back.

This seems the biggest challenge for me. The feeling I'm moving backward.

If you have any thoughts on this contact @fmoronzirfas me on Twitter¹.

While I'm writing this Twitter is down (2017-05-19 13:55). How to get news if Twitter is down and whats up when your standard service for checking such things is affected? ↩

JSONfeed and real problems

Wed, 24 May 2017 00:00:00 GMT

The hype around this effort reminds me of the hype at the start of Atom. Thankfully the personal stuff does not seem to be coming along with it this time.

Is this something we should be focusing on?

I think we have to work on climate change and the fascism that's trying to boot up in the US. Our systems for news suck, and there are obvious ways to improve them if we put our minds to it. And I think a new incompatible feed format not only doesn't move us toward solving those problems, in a very small way (not worth worrying about) it moves us away from solving them. By using bandwidth that could be used to foster working-together, perhaps. By making things that would otherwise interop, not interop.
"Re Evan Williams and JSON Feed" by Dave Winer

But real problems are messy. Tech culture prefers to solve harder, more abstract problems that haven't been sullied by contact with reality. So they worry about how to give Mars an earth-like climate, rather than how to give Earth an earth-like climate. They debate how to make a morally benevolent God-like AI, rather than figuring out how to put ethical guard rails around the more pedestrian AI they are introducing into every area of people's lives.
"Notes From An Emergency" by Maciej Cegłowski

Yes, I also jumped on the JSONfeed train and I still think it is a good idea. Reading the transcript from Maciej made me think a lot on my way home. I guess he's right. It is way easier to build something from scratch that solves a new problem then tackling an existing one. JSON feed versus climate change? That's a tough neighborhood.

My thing with Setapp is…

Wed, 24 May 2017 00:00:00 GMT

The idea of Setapp is great. Having a subscription model for all those lovely apps and just paying 9.99$ per month is very intriguing. My problem is, for the apps that interest me the most in their catalog I already have a license:

Cleanmymac (Have it, use it, love it.)
Marked (no [M↓] document is written without it.)
Gemini (from time to time I use it but not that often as I should.)
Numi (Great calculator. It is actually free.)
Betterzip (Also way better than the built-in archiver. And also free.)
Coderunner (Well this is one of the apps I never use but I love the idea. normally I use the iTerm and the REPL.)
Base (Okay this one might come in handy when I actually start using SQLite.)
Yummy FTP (I have a license but I use Transmit.)
Manuscript (Bought a license for that one. It really sucked. I hope it improved.)
Ulysses (I'm on Scrivener for this kind of writing. Even though I like the visual appearance of Ulysses more.)
Taskpaper (Well this one I bought after the beta subscription of Setapp ran out.)

Any thoughts? Talk to me on Twitter @fmoronzirfas about it.

Just remember that keycombo for π

Thu, 25 May 2017 00:00:00 GMT

⌥ + p is π.

No Monday morning without wired problems…

Mon, 29 May 2017 00:00:00 GMT

Does every Monday have to start with wired problems? iTerm2 can't connect over ssh to our remote server. Terminal can. After a reboot, everything works normally…? WTF? Gremlins?

Awesome @ubernauten

Tue, 30 May 2017 00:00:00 GMT

Did I mention before¹ that I moved my site to uberspace.de? The best web hosting service I ever encountered. Not only do they have a name your own price policy – you can also run Node.js, Ruby (on Rails if you want). Install daemons, have crontabs, of course, ssh and letsencrypt out of the box and many more things. But what is most important they provide the best customer service ever. No question is dumb enough to not being answered fast and politely. These guys are awesome. Oh, and it's all hosted on asteroids!

That I can dance in my pants and in your face! ↩

About Computing

Sat, 18 Nov 2017 00:00:00 GMT

This is ambient computing, the transformation of the environment all around us with intelligence and capabilities that don’t seem to be there at all.
Mossberg: The Disappearing Computer - Recode

source

Read this: Notes From An Emergency

Sat, 18 Nov 2017 00:00:00 GMT

In their online life, Europeans have become completely dependent on companies headquartered in the United States.(…)
And so Trump is in charge in America, and America has all your data. This leaves you in a very exposed position. US residents enjoy some measure of legal protection against the American government. Even if you think our intelligence agencies are evil, they're a lawful evil. They have to follow laws and procedures, and the people in those agencies take them seriously.(…)
There are five Internet companies—Apple, Google, Microsoft, Amazon and Facebook. Together they have a market capitalization just under 3 trillion dollars.(…)
Bruce Schneier has called this arrangement the feudal Internet. Part of this concentration is due to network effects, but a lot of it is driven by the problem of security. If you want to work online with any measure of convenience and safety, you must choose a feudal lord who is big enough to protect you.(…)
source

I always love to read what Maciej Cegłowski has to say.

Node.js on AWS Beanstalk

Tue, 01 Aug 2017 00:00:00 GMT

Are you trying to deploy a Express/Node.js application to AWS Beanstalk? I tried today and these are the things you should take into account if you are using the AWS Console.

When uploading a .zip you need to zip the content of your project folder. Not the folder.
Name your main file "app.js" or "server.js" or create the "npm start".
You can define a own node command to run your app in the configuration of your Beanstalk application.
If using Nginx the port will be 8081 according to this stackoverflow.com question. To don't hardcode the port use const port = process.env.PORT || 3000.

This might be it…

Oh, and socket.io is throwing an error. This is a problem for another day. Also, I should take a look at the command line tool for deploying Beanstalk. It seems I can define a aws region for an app.

Vim is fun… NOT

Fri, 18 Aug 2017 00:00:00 GMT

Vim isn’t that scary. Here are 5 free resources you can use to learn it.

Vim is fun when you are a masochist that misplaced his whip. Nuff said.

About CEP Panels

Sat, 18 Nov 2017 00:00:00 GMT

I recently collected some links on CEP Panels

CEP Reosources:

Gated Communities

Fri, 06 Apr 2018 00:00:00 GMT

Whenever I come across a Facebook link I feel like: "ohh noooo, this path leeds into a gated community, where the land lord has cameras in your house and collects your trash and comes to your house when you sleep to look at your undies. Lucky me - I live in the woods where everyone can pass through my camp."¹ In other words:

Yes they also can look at my stuff but I try to keep my undies in my backpack and I check for hidden cameras. ↩

My Rant on Development Practices

Fri, 06 Apr 2018 00:00:00 GMT

!Note: I wrote this actually on 01.08.2017 but never published it. So here it goes!

There are already a lot of rants about the state of (over)tooling, development style, scalability and what not. This is not news. My rant is aimed at my realm¹. The University.

Dear (developer/student Let's call you:) Johnny,

The next time you build something that others should be able to use in a project, think twice about what cool new [FRAMEWORK || BUILD TOOL || ENVIRONMENT]² you use. It would be great to just pop up a terminal and run npm install && npm start, open localhost:3000 and be ready to go. Instead, I have to learn:

that cool new way to write commit messages because somebody thinks git commit -a -m "I did something important" is too verbose or not enough³
that fancy framework⁴ from, let's say Foobook™, for running a simple one-page application with three buttons that kick of some process
that awesome IDE because those simple text editors are for old geezers
that new JS flavor called MilkyScript⁵ that is so much superior to JS
you name it…

Oh. I need to install a ton of global tools you run for compiling es2525 and beyond because we really need import instead of module.exports now everywhere. Of course, you did not tell me which version you installed half a year ago and did not update on a regular basis.

After I dug through all those dependencies and got them installed I try to understand your scripts in package.json but they are all broken or written in Latin or executing a sub shell in elvish⁶. Except for dev which compiles your es2525 every time even though I did not change anything.

I almost forget to read your README entirely, because it is not enough to run cd into/project/folder/ && npm install. Of course not. You needed to symlink your src folder into the app folder to access your modules like node_modules (instead of using something that happens on module level and is cross-platform).

Of course, you need that fully scalable multi site CMS to build the documentation of your project. No, you won't stick around to take care of this. You were just asked to set it up. When confronted with the question: "Why not use a static site generator?" the answer is "They feel so retro, but that's hip currently isn't it?". You tell me. Yeah – you need the big guns. I know.

Did I mention the hard coded absolute path to your Library to fetch that platform specific framework for accessing that MongoDB YOU HAVE RU.... 😡

You get the gist.

I get it that you need to play with those tools and where to try them out best? In projects. It's important you learn these things. But at what cost? The project will be abandoned at some point. That's for sure. By abandoning it in a state where only you can use it nobody will be able to build on it. That is sad because the project is pretty awesome. What bugs me about it that you took hours and hours of setting up your tool-chain. That time could have been used to work on real problems concerning your application logic or your concept. What is wrong with some VanillaJS, a tiny bit of HTML and some CSS toppings? and what is wrong with ;?⁷

Don't get me wrong - those tools a great, but they were build by a large group of developers at Foobook™ for, well, building Foobook™.

You have to take some things into account before introducing a new tool.

Can you achieve the same thing without it in the time you use to learn it?
Will somebody else need to run it (if so write some docs)?
Will you write these docs or just put it down as a todo?
Is it portable to another computer without problems?
Where lies your focus? On the tool of the project?
Will you have to use this tool often?
And many more things…⁸

I remember being the same. When I was at the same point of learning to write software, it was cool to run Processing in Eclipse, because Eclipse is the way better IDE (long pause) NOT!
A year or two later I tried to revive that project. It took me a long time to not accomplish it in Eclipse and some more time to port it back to Processing. Or another project where I started using Grunt. I have 304 lines of code in that Gruntfile.js. Now that project has been dormant for some time. Whenever I think "you could do something on it". I stop when remembering that Gruntfile.js and that I can't remember how to build. Yes, I could start looking at my documentation. Or not. Because writing docs are something I did not do at that time. I just coded the hell out of it because it is fun.

So did you write documentation? Oh of course not. It is the end of the semester and it had to be done quickly because fiddling with all those cool toys took so much time…

I could go on and on. This is not only for you Johnny. This mainly for myself to blow off some steam and to remind me to focus. I really would love to use import instead of require but not at the cost of always having to run a process that watches what I do and babels out some JS code my Node.js installation understands. The same thing goes for things like jQuery, Webpack, Rollup and so on. The things I build, like this site, actually don't need so many libraries. 73% of jQuery are not in use for this site. I could write everything in plain old boring JS.⁹

Yours sincerely,
Fabian

P.S. You don't agree with me? Let's talk about it on Twitter or open an issue on GitHub.
P.P.S. You feel like this is aimed at you? Well maybe…

At least this will be my realm until the end of August. But more about that in a later post. ↩
Insert value here. ↩
I know commit message quality tend to decline over time, still… ↩
Of course still in alpha! ↩
Actually not a flavor more some sort of esoteric way of writing JS like jsfuck.com. Or Hieroglyphy. See this and paste it into your console. I dare you. ↩
Or maybe it is the tongue of Mordor in Elvish script? I can't tell. ↩
Did I mention that your tiny Processing app does not work because you are so accustomed to leaving them out. ↩
I'm actually not sure if these are the right questions. Educate me if you want. ↩
Which is an issue. ↩

openFrameworks - App Crashes After Transfer to Another Computer

Fri, 06 Apr 2018 00:00:00 GMT

!Note: Actually written on 29.11.2017

I had a learning today that I want to share with you because it will reappear again and again when we develop applications with openFrameworks.

We had the wired problem that OF Apps crashed on startup when we passed them over to other computers. It seemed quite random. Passed on a USB device. They launched fine. Passed on in a .zip over Slack or via GitLab they did not launch.

Crash on Double Click

TL;DR Since macOS (formaly OSX 10.5) there is a security setting in place that prevents apps that where downloaded from the web to be executed. it is a part of the GateKeeper. To overcome this you once need to move manually the "Fancy ofApp.app" to another location on your computer and then move it back next to its data folder. Then you should be able to execute the app.

More technical

The feature is called "App Translocation". The new application gets a xattr flag called com.apple.quarantine. This flag holds information when and with which Browser the app was loaded. The app will be moved on execution to a hidden temp folder and executed there. Having a .dmg with a "Move To Applications" link is not enough. The flag stays. Only when you move the App manually this gets removed. You can also inspect the xattr by running:

xattr "Fancy ofApp.app"

This will show you the flag com.apple.quarantine

With

xattr -p com.apple.quarantine "Fancy ofApp.app"

You can see its content.

To remove this from the commandline use:

xattr -dr com.apple.quarantine "Fancy ofApp.app"

You can read some more about this behind those links:

App Translocation

Source: macOS Sierra will break many installers and updaters – The Eclectic Light Company

The Feynman Technique: The Best Way to Learn Anything

Fri, 06 Apr 2018 00:00:00 GMT

!Note: Actually written on 27.01.2018 but never got published.

There are four simple steps to the Feynman Technique, which I'll explain below:

Choose a Concept

Teach it to a Toddler

Identify Gaps and Go Back to The Source Material

Review and Simplify (optional)
Source: "The Feynman Technique: The Best Way to Learn Anything"

Cross Repository Action Triggers Using GitHub Actions

Wed, 06 Feb 2019 00:00:00 GMT

Cross Repository GitHub Action Triggering

Wow what a title.

While developing the reference for our project Basil.js we ran into the following problem. We are lazy and we don't want to touch the reference each time some new function is added or even worse – we find a type in the JSDoc comments in the source.

I took a look into TravisCI but learned early that the cross repo trigger is not possible. At least out of the box. Again. I'm lazy and I have little time to develop a complex TravisCI script that does somehow use GitHubs API to be triggered.

Some time passed and we did not find a solution. Then out of the blue GitHub announced their actions feature ¹. Wooohooo \o/. Here wee goooo 🎢 …

You will need two repositories. Let's call the first one trigger and the second one target. The trigger repo represents the source of our project Basil.js. Here we are developing and writing the source of our docs. The target repo holds or documentation. In our case it is the GitHub orgs site repo.

You also will need a Personal Access Token. You can create it here. This token needs to be added as a secret to both repositories². You also will have to activate it in your main.workflow³ interface.

The Trigger Repository

On our trigger we create the following action setup. On push we run the docker container defined under ./action. The only needed application in this container is curl to execute the webhook.

This is .github/main.workflow:

workflow "trigger" {
  on = "push"
  resolves = ["run-it"]
}

action "run-it" {
  uses = "./action"
  secrets = ["PA_TOKEN"]
}

This is the content of action/Dockerfile:

FROM alpine
RUN apk add --no-cache curl
ADD entrypoint.sh /entrypoint.sh
ENTRYPOINT ["/entrypoint.sh"]

This is action/entrypoint.sh with the curl post call:

#!/bin/sh -l
sh -c "curl -XPOST -H \"Accept: \
application/vnd.github.everest-preview+json\"  \
-H \"Content-Type: application/json\" \
-H \"Authorization: token ${PA_TOKEN}\" \
https://api.github.com/repos/fabianmoronzirfas/target/dispatches \
--data '{\"event_type\": \"run-it\"}'"

The Target Repository

This is .github/main.workflow. Currently this is configured to build on the webhook repository_dispatch trigger.

In this example the args and the env values are not used. Just for illustrating the possibility of having them. The repo waits on its webhook to be called and then executes the script in the docker container.

workflow "Build-it on webhook" {
  on = "repository_dispatch"
  resolves = ["execute build"]
}

action "execute build" {
  uses = "./action"
  env = {
    NAME = "fabianmoronzirfas"
  }
  args = "\"This name is set as a env variable: $NAME\""
  secrets = ["PA_TOKEN"]
}

The container has the following dependencies:

git
node.js
npm
openssh
bash (optional)

This is the content of action/Dockerfile:

FROM alpine
ADD entrypoint.sh /entrypoint.sh
RUN apk --update add --no-cache bash nodejs nodejs-npm git openssh
ENTRYPOINT ["/entrypoint.sh"]

And this is the script that does the execution. Fist we output some infos to see if the install worked. The important part is the npm run build call. It is a Node.js script that creates a file within the container. It is very simple in our case just a require('fs').writeFileSync('./out-date', JSON.stringify(new Date())) to have some output. Then it adds this file with git and uses the Personal Access Token to push to the repo via https.

This is action/entrypoint.sh:

#!/bin/sh -l
sh -c "echo 'in entrypoint.sh'"
sh -c "echo 'NODE version:' $(node -v)"
sh -c "echo 'NPM version:' $(npm -v)"
sh -c "echo 'GIT version:' $(git --version)"
sh -c "echo 'output of pwd:' && pwd"
sh -c "echo 'output of ls:' && ls"
sh -c "echo 'these are arguments set to the workflow' && echo ${*}"
sh -c "cd action && npm test"
sh -c "cd action && npm run build"
sh -c "cd action && echo 'output of ls:' && ls"
sh -c "git config --global user.email 'fabian.moron.zirfas@gmail.com'"
sh -c "git config --global user.name 'me-as-a-bot'"
sh -c "echo 'git status' && git status"
sh -c "git add ."
sh -c "git commit -m 'added file'"
sh -c "git push https://${PA_TOKEN}@github.com/fabianmoronzirfas/target.git"

As soon as GitHub Actions are out of beta I will make these repos public so you can take a look at the source.

GitHub Actions are in beta while I am writing this (07. Jan 2019). ↩
You can set your secrets under this url https://github.com/[YOUR USER NAME]/[YOUR REPO NAME]/settings/secrets ↩
You will find your main.workflow here https://github.com/[YOUR USER NAME]/[YOUR REPO NAME]/blob/master/.github/main.workflow ↩

Rename a GitHub Repo with a Linked Netlify Project

Wed, 05 Aug 2020 00:00:00 GMT

Rename a GitHub Repo with a Linked Netlify Project

So what needs to be done before you do that ⤴?

stop all builds
disable auto deploys on Netlify
rename the repo on GitHub
relink the repo on Netlify (should trigger a build)
your environment variables might be gone - set them again

!Bonus Tip: Don't set NODE_ENV on netlify.toml. Or your devDepndencies wont be installed. (:facepalm:)

Misc Links from the interwebs

Tue, 13 Apr 2021 00:00:00 GMT

Writing

Ink interactive story authoring language | https://www.inklestudios.com/ink/

VSCode

Bash IDE | Visual Studio Code extension utilizing the bash language server, that is based on Tree Sitter and its grammar for Bash and supports explainshell integration https://marketplace.visualstudio.com/items?itemName=mads-hartmann.bash-ide-vscode
VSCode Debugger Tutorial - Interactively debug Node.js apps with the built-in and Visual Studio Code debuggers https://docs.microsoft.com/en-us/learn/modules/debug-nodejs/

Static Site Generator

Explosiv | A simple and powerful JSX Static Site Generator. https://explosiv-vixalien.vercel.app/
A Deep Dive Into Eleventy Static Site Generator | https://www.smashingmagazine.com/2021/03/eleventy-static-site-generator/

Code Quality

Eslint Regex Plugin | https://github.com/RunDevelopment/eslint-plugin-clean-regex

Load Testing Tools

Vegeta is a versatile HTTP load testing tool built out of a need to drill HTTP services with a constant request rate. It can be used both as a command line utility and a library. | https://github.com/tsenart/vegeta
k6 is a modern load testing tool, building on our years of experience in the load and performance testing industry. It provides a clean, approachable scripting API, local and cloud execution, and flexible configuration. | https://github.com/k6io/k6
Siege is an http load testing and benchmarking utility. It was designed to let web developers measure their code under duress, to see how it will stand up to load on the internet. Siege supports basic authentication, cookies, HTTP, HTTPS and FTP protocols. It lets its user hit a server with a configurable number of simulated clients. Those clients place the server “under siege.” | https://www.joedog.org/siege-home/
Artillery is a modern load testing and smoke testing solution designed for cross-functional teams that run microservice-based systems on AWS and rely on CI/CD to ship at high velocity | https://artillery.io/

SQL

SQLite is not a toy database | https://antonz.org/sqlite-is-not-a-toy-database/
PSQL Tips https://mydbanotebook.org/psql_tips_all.html

Testing

Playwright | e2e testing in all browsers | https://playwright.dev/

Self Hosted Paas alternatives

coolify: Heroku & Netlify alternative | https://coollabs.io/coolify

Text Processing

TxtFiddle JavaScript Playground for Text Manipulation https://txtfiddle.com/
TextBuddy is a Mac app for manipulating text. A Swiss Army knife for plain text that is there when you need it and hidden when you don’t. Faster than your IDE. Easier than the command line.https://textbuddy.app/

Data Sources/OpenData

Common Crawl Everyone should have the opportunity to indulge their curiosities, analyze the world and pursue brilliant ideas. Small startups or even individuals can now access high quality crawl data that was previously only available to large search engine corporations. https://commoncrawl.org/

ein neuer Tiefpunkt der BTC Ära

Fri, 16 Apr 2021 00:00:00 GMT

Grundsätzlich mag ich ja die Idee von dezentralem und unabhängigen Geld, aber Kohle Kraftwerke wieder anwerfen um BTC zu schürfen ist ein neuer Tiefpunkt.

"A New Threat to New York’s Clean Energy Goals: Bitcoin Mining - New York Focus" | https://www.nysfocus.com/2021/04/13/new-york-bitcoin-mining-threat

Wroooooomm

Wed, 20 Mar 2024 00:00:00 GMT

Deutsche Bahn

I don't have a drivers license but the last few month commuting with the Deutsche Bahn from Berlin to Braunschweig makes regret that decision. I'm commuting since 5 grade from a little village to Braunschweig with the Bahn to get to school until I moved to the city. When I studied and worked at the FHP I commuted from 2005 till 2017 from Berlin to Potsdam. Not sure if I'm an old man yelling war stories but it feels like it is getting worse with the DB.

So wroooom wroooomm? 🏍️

Procrastination

Fri, 30 Aug 2024 00:00:00 GMT

import Procrastination from "../../components/procrastination.tsx";

Procrastination is the act of unnecessarily and voluntarily delaying or postponing something despite knowing that there could be negative consequences for doing so. Wikipedia

git log? WTF

Wed, 04 Sep 2024 00:00:00 GMT

Why is GitHub showing all these people as contributors? What did I do ~2012 to mix my history with some other project? See https://github.com/ff6347/ff6347.github.io/graphs/contributors

❯ git log --format='%aN' | sort -u

Abhijeet Kumar
Alessio Caiazza
Alistair Hutchison
Andrea Schiavini
Anton Vattay
Brandon Philips
Darren Jeacocke
Fabian Morón Zirfas
Fabian Morón Zirfas
Jade
Jade Dominguez
James Fleeting
Jesse Chan-Norris
Kori Roys
Lukas Knuth
Martijn Pieters
Matt Swanson
Michael-Keith Bernard
Pradeep Nayak
Renovate Bot
Simon Starr
Stephen Ball
Tommaso Visconti
Yuya Saito
christine
dependabot[bot]
elephant
fabianmoronzirfas
fabiantheblind
ff6347
fmoronzirfas
greenkeeper[bot]
jayraj

After some digging I found that as the git noob that I was then I used some jekyll-bootstrap repo and did not remove the .git folder or something like that. ¯\_(ツ)_/¯

Also I had a lot of different names in my .gitconfig → user.name over the years.

Exclude files from git diff

Mon, 16 Sep 2024 00:00:00 GMT

Normally the git diff in a Node.js project with a package-lock.json present is a bit noisy. TIL to exclude a file from the diff.

git diff -- . ':!package-lock.json'

Raycast Extension - CSS Color Names

Tue, 17 Sep 2024 00:00:00 GMT

I've been wanting to built this Raycast extension for quite some time from my Alfred extension that does the same. So here it is! Woohoo \o/

https://github.com/ff6347/css-color-names-raycast

Allows you to filter through named CSS colors. Installation currently only by cloning and installing via import. I need to iron out some ideas before submitting to the raycast store.

So you know what I did this summer?

Tue, 01 Oct 2024 00:00:00 GMT

So I had some time since I left the Technologiestiftung. The next semester is about to start in two weeks. Here is a recap of my summer not in chronological order

I found a flat. Will be moving partially soonish. Yay \o/ (it is in X-Berg again and I couldn't be happier about it. Whenever I ride through the Kiez I really feel at home)
Started learning more CSS with https://cssgrid.io/ and https://css-for-js.dev/ Very nice. Can't wait to reach the animation part.
Incorporated some of the learnings into the syllabus for the upcoming semester.
Ported an Alfred CSS color names search extension of mine to Raycast and made it more useful. I use it all the time when preparing my seminar.
Also made a little react app to search color names out of it so my students can use it as well (tried to have it on codepen.io but it is hard to maintain in one pen)
Went pro on codepen.io to use it for my seminar
Ported an Alfred extension by typefaces for special characters to Raycast
Applied for the project lead role for p5.js but didn’t land that job. It’s okay. I had to try.
Revived some old Robert Penner easing code I once wrote for Processing and ported it to p5.js. Still working on the docs though.
Found out that I’m not the only one with that idea. Duh. Which interface is the better one? Any opinions?
Toyed a little with the idea of a p5.js add on that uses ASTs to control CSS. I call it the style() method. Still only a POC. I need to think about what API/features I want before I start writing code.
Contributed a little to the new P5.js website. Boy there are so many broken links.
Packed nearly all the things in my mother's flat. This was rollercoaster ride of emotions in the theme park called “her life” located in her fortress of solitude.

Design Mode (TIL)

Thu, 27 Mar 2025 00:00:00 GMT

import Url from "../../components/design-mode-url.astro";

There is something in the browser called "Design Mode". Nice one! You can enable it by running:

document.designMode = "on";

To test this load this page (or others here in ) using the search params ?designmode=on. {}

Fabian Morón Surfers

Sun, 30 Mar 2025 00:00:00 GMT

Dictation makes this out of my name, sometimes: Fabian Morón Surfers

I like it. Sounds pretty cool. 🏄‍♂️

CustomEvent

Wed, 02 Apr 2025 00:00:00 GMT

https://developer.mozilla.org/en-US/docs/Web/API/CustomEvent/CustomEvent

Emile Leary

Wed, 09 Apr 2025 00:00:00 GMT

https://en.m.wikipedia.org/wiki/Emile_Leray

He was stranded twenty miles from the nearest settlement, with only enough food and water to last ten days. To survive, Leray used parts of his broken-down car to build a motorcycle, and twelve days after the accident was able to drive it to a village 20 miles away.

TPW and Cloudflare had a baby, ReadwoodSDK

Fri, 25 Apr 2025 00:00:00 GMT

If you are into React and RSC (React Server Components) and Cloudflare this looks pretty neat https://docs.rwsdk.com/

AI Fatigue in the Morning

Thu, 29 May 2025 00:00:00 GMT

In the beginning of the current AI wave, everything that came made us go "ooohhhh" and "aaaah". We made it through the first year and generated images with a median of 12.42 fingers per person and were happy about it. We were okay to "delve" into the depths of poorly written content and saw a utopian future where none of us would have to work anymore, while the doomers were prepping their tinfoil hats and pulling their fillings so Skynet wouldn't get them.

And now? We see diffusion-based models generate large text chunks in sub-seconds with GPT-3.5+ quality, and we are like, "meh". Predictions say A{G|S}I will be here in 4, 8, 15, 16, 23, 42 years, or never. We see "Younglings" using the "vibe force" to dream up applications that would have taken us weeks and months of crawling through Stack Overflow to cobble together, and we are mad at them because "they don't honor the platform," "this code is not production-ready and hard to maintain if you are a real programmer," and "GET OFF MY WLAN, YOU DAMN KIDS!". Of course, they don't clap when the plane lands. It is normal for them that they come down now.

What I want to say with this is: it's 7:20 in the morning, and I am having a coffee, so ¯\_(ツ)_/¯

xo[1] fab

[1]: Do kids still use this? Or is it <fill in word for embarrassing parents trying to stay cool>?

til: JS Array.push returns new length

Thu, 19 Jun 2025 00:00:00 GMT

I never thought about what this might return nor that it even should return something. Today I learned that it is the new length of the array. So the code below return 1.

console.log([].push(4));

Good to know.

One Does Not Just Simply Do That!

Thu, 04 Sep 2025 00:00:00 GMT

Doing tutorials, and saying things like "just do this" and "you simply do that" is often problematic. There are people who struggle with your topics, and for some it is not as simple as you describe it.

Just simply saying…

Offline First or Always On

Tue, 21 Oct 2025 00:00:00 GMT

Don't you feel that it's nuts that we are in a world where some company has an outage for one day and everyone is touched by that?
People are complaining that the helpdesk is down or they can't access their Asana boards or whatever. This is, of course, a problem of globalization, but I see this as an implementation problem we created.

For example, when I'm on the train and I try to open Figma to just sketch out something for a project, I can't generate a new file or access my existing files because most of our applications are designed online first.

But if we would embrace an offline-first and then sync methodology, people could keep working or creating or reading or whatever, and we still could be on when possible, instead of always on and not possible if not on.

Code Of Conduct

Thu, 23 Oct 2025 00:00:00 GMT

I just started a class in the masters program by Franca Lopéz Barbera. Design in Many Words. I really like the idea of having a code of conduct for a seminar. I am going to ~~steal~~ ähm, ~~copy~~ also have this when doing teaching again.

Obsidian Plugins

Wed, 29 Oct 2025 00:00:00 GMT

Since I am studying again, and I have a lot of text and notes to handle, I moved to obsidian. And of course I'm trying out the plug-in development. These are mostly coded using an LLM assistant, but I'm trying to review every bit. The plug-ins are not yet published to the obsidian community plug-ins registry but there are easy ways to install these without hacking too much.

[!NOTE] The latest version are in the beta channels not the latest on the main stable branch. Be on the edge with me

Web Dev Playground

This plugin allows you to write a note with HTML, CSS and JavaScript or Typescript code blocks and view a compiled page in the sidebar. Only the content of the code blocks is added to the page. There is no auto-complete, no linting, no formatting. Only code blocks that are denoted as the specific languages are parsed. Code blocks without language or with other languages like python or what whatsoever are ignored. The plug-in does auto compile and has an infinite loop protection. That's it.

It really has become useful to create little notes about web development that I can see directly. Helps also to check if the code really works. I'm looking for input on this.

You can get the current state from this repo → github.com/ff6347/obsidian-web-dev-playground or you use BRAT plugin into install it.

Canvas Context

This is a large undertaking and I'm dog fooding this currently. The idea is to use the canvas as context provider for interaction with large language models. You can select a card or note on the canvas and plug-in will walk up the tree and pull in all the notes to create a message. You can send to last language model. There are some rules that I'm not going to explain here because this is part of the repository end of the journey. Maybe you use the discussions on GitHub for feedback?

You will need LM Studio or Ollama if you want to run local models. If you want to use the big models you need an OpenRouter or OpenAI API key. You can get the current state from this repo → github.com/ff6347/obsidian-canvas-context or you use BRAT plugin into install it

MCP in experimentation or how I trust the trust of others

Fri, 31 Oct 2025 00:00:00 GMT

The Security Risks at Hand
- Problems With NPM
- The Combination of Service
How Not to Do It
A More Complex but More Secure Solution
Bonus: Be Even More Restrictive
Conclusion

The Security Risks at Hand

Problems With NPM

Node.js (I'll explain what this is later on) and JavaScript (JS) are tightly coupled to the Node Package Manager (NPM) ecosystem. This is a vaste registry of packages of ready made JavaScript modules. These modules serve different porpuses. There is a module for everything, so we don't have to reinvent the wheel every time we create a new project. It is easy to use, easy to add and saves us a ton of time. By adding some module we create a dependency. These other developers also don't want to reinvent the wheel, and so they also add dependencies to their packages. You might get the idea. We create a deeply nested tree of dependencies and transitive dependencies¹.

This means: When I add some code to my project as a dependency, I also have to trust that the author of this code trusts the authors of the dependencies he added, and they trust the other authors and so on.

The current state of the NPM ecosystem is problematic. In the last few months, we saw elaborate supply chain attacks against the registry and prominent packages that have millions of downloads. If you are interested in what happened, read Shai-Hulud npm supply chain attack - new compromised packages detected² or PhantomRaven: NPM Malware Hidden in Invisible Dependencies | Koi Blog. I won't go into the details of these, because this is too technical and others can explain this better than I can.

The Combination of Service

Often, one MCP is harmless, only the combination of several MCPs create an attack vector. If you, for example, restrict the LLM from accessing the internet and only feed it trusted context, that you yourself reviewed or created, the instructions you generally get are fine. As soon as you add untrusted context into the mix, we get something Simon Willison coined "The Lethal Trifecta". He states that these three components:

Access to you private data
The ability to externally communicate
Exposure to untrusted content

Create a big security risk. I urge you to read his blog, it is a great resource for understanding LLMs.

How Not to Do It

When using the widely propagated method of installing a MCP service, we normally get an instruction to:

install Claude Desktop or ChatGPT Desktop
and Node.js.
Together with the instruction to add the below JavaScript Object Notation (JSON) somewhere in the settings of one of these desktop apps.

{
	"mcpServers": {
		"filesystem": {
			"command": "npx",
			"args": [
			"-y",
    	"@modelcontextprotocol/server-filesystem",
    	"/Users/username/Desktop",
    	"/Users/username/Downloads"
			]
		}
	}
}

This seems easy. Let us examine what we are adding here. The desktop applications are not the problem. But we also install Node.js. This is a program that can execute JS code on your computer. Don't get me wrong. I love Node and I have been programming with it for more than a decade. It is a great tool. The great thing and the problem is that it can do anything. It was created around 2009. The original author of Node.js, Ryan Dahl, started years later another project called Deno, with the intention to fix the problems he introduced with Node.js. But this is not a rant about Node or a history lesson.

Back to the problem. When we run code with Node.js, it has same rights that you have on your computer without entering your password. It can read and also write files, make web requests, and so on. It could extract information about you that can range from your email, to which programs you use, and even install arbitrary code that gets executed when you do something.

Back to our little innocent JSON snippet we added to our LLMs settings:

"command": "npx"

Together with node we install a tool called npm (yes the same name as the registry), and with npm there comes a little (very useful) tool called npx. This stands for something like "node package execute". It takes as an argument the name of a module from the NPM registry. Here it is @modelcontextprotocol/server-filesystem. What it does is

download the code from this module and all its dependencies and transitive dependencies
and execute it.

Normally, it asks the user if it should do that and he needs to confirm this. This wont work with an LLM. Therefore, we pass it the flag -y for "yes, do that!" in the args of our JSON snippet.

"args": [
      "-y",
      "@modelcontextprotocol/server-filesystem",
      "/Users/username/Desktop",
      "/Users/username/Downloads"
    ]

What comes next in the snippet are arguments for the code that npx finds under @modelcontextprotocol/server-filesystem in the registry. This has nothing to do with access restrictions imposed onto Node.js. This is only for the module we execute. If you take a look at the code of this module, you will see that it does use these as "allowed directories" and it throws an error if the executor, here the LLM, tries to run code against other directories. So maybe this is enough security for you and you call it a day and call me a nerd or fearmonger. It is okay. See you.

For the rest of you who want to continue — bear with me. Here comes the trust thing again. I can look up the code for this module and see what it does, and NPM recently added a feature to see the actual code of a package in the registry, but the advice we get is to trust the package and all its future versions. Because the string @modelcontextprotocol/server-filesystem tells npx, "Hey, get the latest version of that module." You also often see @modelcontextprotocol/server-filesystem@latest, which is the same as the reference before. To be a little more secure, you could pin the version of the module whose author you trust. Adding the version number instead of latest would already make a big difference. @modelcontextprotocol/server-filesystem@2025.8.21. This is a little less convenient. You won't get the latest version once it is out, but you can vet the code on NPM and then use this one module. If you encounter any bugs, you can take a look at NPM again and see if a newer version is there that fixed that bug.

That's it, Fabian? This is why you add all those thoughts to the entropy of the web?

Well, no. The problem is still that the author trusted other authors. If he did not vet and pin his dependencies, there is still the chance that someone exchanges the code beneath our eyes without us knowing. In JavaScript and the NPM ecosystem, there is a little something that is called "semantic versioning". It tells npm that it is okay to use a specific range of versions of a module. Like saying, "All the bug fixes (also called patches) are okay." Or, "Yes, it is okay to use new version that is higher than the currently used one, as long as it does not break something." Which is a great idea but also means I have to trust the authors in my tree all the wy down.

In the recent supply chain attacks, this is what happened. Malicious actors took over the accounts of authors who are trustworthy and changed their modules by releasing a new patch version to the NPM registry. Since they were required by other modules, this code could have gotten added to your project without you even knowing.

What can we do about this? Vendoring all dependencies? Never touch a computer again? Ignore it?

A More Complex but More Secure Solution

With a little effort, we should be able to run these tools in a more secure way. We need to cut the access for the command from the rest of the computer and still give it access to those two folders we want it to act on.

Containers Instead of Bare Metal

Instead of installing Node.js directly onto our machine, we install Docker or even better Podman. Podman and Docker are applications called container runtimes. As the name suggests, they containerize an application. Besides giving the application everything it needs to run, it also isolates the application from the host system, which is your computer³. They will serve Node.js for us where we can run the MCP services. I will show you the commands for Docker, since it is the more mature and widely used one. With more funding, more tutorials and it has an easy installable free version for MacOS.

The great thing about them is that we not only isolate the application, but we can also tell it specifically which folders are allowed to be accessed by the container. I will show you the command we have to add to our configuration and dissect it step by step.

The More Secure MCP Configuration

{
      "mcpServers": {
        "my-sandboxed-server": {
          "command": "docker",
          "args": [
            "run",
            "--interactive",
            "--rm",
            "--volume", "<absolute path to folder you want your LLM to have access to>:/usr/project",
            "--workdir", "/usr/project",
            "node:24-bookworm-slim",
            "npx",
            "-y",
            "@modelcontextprotocol/server-filesystem@latest",
            "/usr/project"
          ]
        }
      }
    }

The first thing you see is we replace the npx command with docker. This is the executable we want to run.
Then we add the run command which tells Docker to run a container.
The --interactive allows you to feed input into the container while it's running (e.g., for a shell or an interactive program).
--rm tells Docker to automatically delete the container's filesystem after it exits. This sounds like a bad idea since we want to interact with the filesystem.
This is where the --volume comes in. We are telling Docker to connect a specific folder from the host system into the container. This way, the container can read and write to that folder, which is necessary for the filesystem MCP to function properly.
The next entry <absolute path to folder you want your LLM to have access to>:/usr/project" is:
- the absolute path to the folder you want your LLM to have access to on your system. You need to replace the <path to folder> with an actual path on your machine. On MacOS, you can get the absolute path of a folder by CTRL-clicking (⌃) or right-clicking on a folder and then, when the menu is open, holding OPTION ⌥. This will change the copy entry to copy "<folder name>" as pathname.
- After the : is the path inside the container. Here it is /usr/project. This is inside the container. The LLM will only see the path /usr/project.
- If you want to be even more secure, you can restrict the container's access to your host to be read-only by adding :ro at the end of it all. But this will prevent the MCP from writing any files to that folder.
--workdir tells the container to start in a specific directory, which is /usr/project in this case.

node:24-bookworm-slim This is the Docker image we are running our container from. You can choose a different version if you prefer. I just recommend using the latest long term support (LTS) version of Node.js. Take a look at https://hub.docker.com/_/node>. There you can find a long list of available versions.
Finally, we reached the point where we are at the same command as we had it before. We run npx but now it is properly sandboxed in a container.
-y tells npx to automatically answer "yes" to any prompts, which is needed for the MCP server not to hang on prompts.
@modelcontextprotocol/server-filesystem@latest is the package we want to run. As you already learned, I am using the less secure version where with the latest tag. I urge you not to do that. I use this here since any version number I add might be outdated in a few weeks. Go to the version tab of the module and get the version number you want to use.
Last one. Then we are done. We now tell the module which path it should have access to. Here it is /usr/project This is the same path we connected or our local folder to earlier and we also set as the working directory for the container. This time, we are inside the container. The module has no "knowledge" of our host's filesystem.

With this more verbose version, we can now run the MCP server within a secure sandbox. Of course, we need to determine for each MCP we want to use if this is the right approach.

Speeding Things Up

To make this work faster on the first run I would also suggest downloading the image beforehand. Yes some new word to make this short: The image is the blueprint from which the container is created. You can do this by running the following command in your Terminal.app:

docker pull node:24-bookworm-slim

If you find the Terminal.app scary. You can use the Docker Desktop application to pull images and manage containers with a graphical user interface (GUI). Just insert the node:24-bookworm-slim into the search bar from the Desktop application and download (pull) it from there.

Bonus: Be Even More Restrictive

Use --network none if network access isn't needed. This will prevent the container from accessing the internet.
Use Podman instead of Docker if you want to run containers without root.

Conclusion

Yes. This was a long one. I hope you found it informative and you could follow along. Using LLMs on our computers is marvelous. We are entering a new era of computing in my opinion. As always, this comes with a price. As the internet was also created with trust in mind (hi there, good old HTTP), we had to learn the hard way that there will be people misusing our trust. The only thing we can do is learn the tools and understand what is actually happening under the hood. If you have any questions, use one of the channels below to ask.

Transitive means if my module A depends on module B and B depends on C, C is a transitive dependency of A. ↩
Yes, pretty nerdy name, but we bless the maker and his water. ↩
The big difference between Docker and Podman is that the latter does not need root access to run containers. This makes it even more secure. ↩

Learning MCP

Wed, 05 Nov 2025 00:00:00 GMT

I am currently attending Professor Reto Wettach's seminar about: "Language as an Interface - Interface Design in times of AI and MCPs/Agentic AI". That is why I am trying to wrap my head around MCPs and all that.

How Learning Works Currently for Me
Insights
- Implementation Flow
Code Examples
Conclusion

How Learning Works Currently for Me

For me the best way to learn a new technology is reading about it and reading a simple implementation for better usage insight. Then write down some notes (in form of this blog more often I hope). Nowadays a LLM comes into the mix. In this case it was pretty nice. I read some parts of MCP Specification (enough for grasping the basics) and asked an LLM some questions afterwards.

Insights

Security is based on trust.
In the implementation the distinction between host and client is fuzzy.
In the spec the host should orchestrate several clients.
The clients connect to the servers which provide tools, resources and prompts.
The servers are based on JSON-RPC. Which is an action oriented API.
- JSON RPC uses only POST requests and does not need HTTP. Can also be over TCP, Websocket or stdio. JSON-RPC is transport agnostic.
- A problem with stdio is that you are not allowed to log to stdout. :(
There are Requests that need a response and share an id for mapping and notifications which don't need one.

MCP is actually an abstraction layer on top of model tool calling capability.

Anthropic skills are workflow specifications that is again on top of MCP.
MCP is meant for discoverability.

Implementation Flow

Flow: 1

Host spawns MCP server, gets available tools
Converts MCP tool schemas to OpenAI function format
Sends user query + functions to OpenAI
OpenAI returns function call decision
Host executes tool via MCP
Host sends result back to OpenAI for natural language response

Run: OPENAI_API_KEY=your_key node host.js

Here are the three most interesting (code) snippets to understand MCP.

Code Examples

TBD: Explanation of how these three files relate to each other and how to run them together.

host.js

// host.js - LLM host with OpenAI integration
import { spawn } from "child_process";
import { createInterface } from "readline";
import https from "https";

class LLMHost {
	constructor(apiKey) {
		this.apiKey = apiKey;
		this.client = null;
		this.messageId = 0;
		this.pendingRequests = new Map();
		this.tools = [];
	}

	async start() {
		// Start MCP server
		this.client = spawn("node", ["server.js"]);

		const rl = createInterface({
			input: this.client.stdout,
			crlfDelay: Infinity,
		});

		rl.on("line", (line) => {
			const msg = JSON.parse(line);
			if (msg.id && this.pendingRequests.has(msg.id)) {
				const { resolve } = this.pendingRequests.get(msg.id);
				this.pendingRequests.delete(msg.id);
				resolve(msg.result);
			}
		});

		// Initialize MCP connection
		await this.mcpRequest("initialize", {
			protocolVersion: "2024-11-05",
			capabilities: {},
			clientInfo: { name: "llm-host", version: "1.0.0" },
		});

		// Get available tools from MCP server
		const { tools } = await this.mcpRequest("tools/list");
		this.tools = tools;
		console.log(
			"MCP tools loaded:",
			tools.map((t) => t.name),
		);

		// Process user query
		await this.processUserQuery("What is 15 + 27?");
	}

	async processUserQuery(query) {
		console.log(`\nUser: ${query}`);

		// Convert MCP tools to OpenAI function format
		const functions = this.tools.map((t) => ({
			name: t.name,
			description: t.description,
			parameters: t.inputSchema,
		}));

		// Call OpenAI with function calling
		const completion = await this.callOpenAI(
			[{ role: "user", content: query }],
			functions,
		);

		const message = completion.choices[0].message;

		// Check if LLM wants to call a function
		if (message.function_call) {
			const { name, arguments: argsStr } = message.function_call;
			const args = JSON.parse(argsStr);

			console.log(`LLM calling tool: ${name}(${JSON.stringify(args)})`);

			// Execute tool via MCP
			const result = await this.mcpRequest("tools/call", {
				name,
				arguments: args,
			});

			// Send result back to LLM for final response
			const finalCompletion = await this.callOpenAI(
				[
					{ role: "user", content: query },
					message,
					{
						role: "function",
						name,
						content: result.content[0].text,
					},
				],
				functions,
			);

			console.log(`Assistant: ${finalCompletion.choices[0].message.content}`);
		} else {
			console.log(`Assistant: ${message.content}`);
		}
	}

	async callOpenAI(messages, functions) {
		const data = JSON.stringify({
			model: "gpt-4",
			messages,
			functions,
			function_call: "auto",
		});

		return new Promise((resolve, reject) => {
			const req = https.request(
				{
					hostname: "api.openai.com",
					path: "/v1/chat/completions",
					method: "POST",
					headers: {
						"Content-Type": "application/json",
						Authorization: `Bearer ${this.apiKey}`,
						"Content-Length": data.length,
					},
				},
				(res) => {
					let body = "";
					res.on("data", (chunk) => (body += chunk));
					res.on("end", () => resolve(JSON.parse(body)));
				},
			);

			req.on("error", reject);
			req.write(data);
			req.end();
		});
	}

	async mcpRequest(method, params) {
		const id = ++this.messageId;
		this.client.stdin.write(
			JSON.stringify({
				jsonrpc: "2.0",
				id,
				method,
				params,
			}) + "\n",
		);

		return new Promise((resolve) => {
			this.pendingRequests.set(id, { resolve });
		});
	}
}

// Usage: node host.js
const apiKey = process.env.OPENAI_API_KEY;
if (!apiKey) {
	console.error("Set OPENAI_API_KEY environment variable");
	process.exit(1);
}

await new LLMHost(apiKey).start();

client.js

import { spawn } from "child_process";
import { createInterface } from "readline";

class MCPClient {
	constructor() {
		this.process = null;
		this.messageId = 0;
		this.pendingRequests = new Map();
	}

	connect(serverScript) {
		// Spawn server process
		this.process = spawn("node", [serverScript]);

		// Setup line-by-line reading from stdout
		const rl = createInterface({
			input: this.process.stdout,
			crlfDelay: Infinity,
		});

		// Handle incoming messages
		rl.on("line", (line) => {
			const message = JSON.parse(line);

			if (message.id && this.pendingRequests.has(message.id)) {
				const { resolve, reject } = this.pendingRequests.get(message.id);
				this.pendingRequests.delete(message.id);

				if (message.error) {
					reject(message.error);
				} else {
					resolve(message.result);
				}
			}
		});

		this.process.stderr.on("data", (data) => {
			console.error("Server error:", data.toString());
		});

		return this.initialize();
	}

	async request(method, params = {}) {
		const id = ++this.messageId;
		const message = {
			jsonrpc: "2.0",
			id,
			method,
			params,
		};

		// Send JSON-RPC request
		this.process.stdin.write(JSON.stringify(message) + "\n");

		// Wait for response
		return new Promise((resolve, reject) => {
			this.pendingRequests.set(id, { resolve, reject });
		});
	}

	async initialize() {
		return this.request("initialize", {
			protocolVersion: "2024-11-05",
			capabilities: {},
			clientInfo: { name: "simple-client", version: "1.0.0" },
		});
	}

	async listTools() {
		return this.request("tools/list");
	}

	cleanup() {
		this.process.kill();
	}
}

// Usage
const client = new MCPClient();
await client.connect("./server.js");
const tools = await client.listTools();
console.log(
	"Tools:",
	tools.tools.map((t) => t.name),
);
client.cleanup();

server.js

import { createInterface } from "readline";

// Setup stdin/stdout communication
const rl = createInterface({
	input: process.stdin,
	output: process.stdout,
	terminal: false,
});

// Handle incoming JSON-RPC messages
rl.on("line", (line) => {
	const message = JSON.parse(line);

	// Route to handler
	if (message.method === "initialize") {
		handleInitialize(message);
	} else if (message.method === "tools/list") {
		handleToolsList(message);
	} else if (message.method === "tools/call") {
		handleToolCall(message);
	}
});

function send(message) {
	console.log(JSON.stringify(message));
}

function handleInitialize(request) {
	send({
		jsonrpc: "2.0",
		id: request.id,
		result: {
			protocolVersion: "2024-11-05",
			capabilities: {
				tools: {},
			},
			serverInfo: {
				name: "simple-server",
				version: "1.0.0",
			},
		},
	});
}

function handleToolsList(request) {
	send({
		jsonrpc: "2.0",
		id: request.id,
		result: {
			tools: [
				{
					name: "add",
					description: "Add two numbers",
					inputSchema: {
						type: "object",
						properties: {
							a: { type: "number" },
							b: { type: "number" },
						},
						required: ["a", "b"],
					},
				},
			],
		},
	});
}

function handleToolCall(request) {
	const { name, arguments: args } = request.params;

	if (name === "add") {
		const result = args.a + args.b;
		send({
			jsonrpc: "2.0",
			id: request.id,
			result: {
				content: [
					{
						type: "text",
						text: `Result: ${result}`,
					},
				],
			},
		});
	}
}

// Keep process alive
process.stdin.resume();

Conclusion

TBD: Summary of key learnings and next steps.

Here is the full conversation.

Context About Colombian Authors

Fri, 07 Nov 2025 00:00:00 GMT

import { Picture, Image } from "astro:assets"; import costeno from '../../images/1024px-el_costeno.jpg';

*El Costeño by José Agustín Arrieta (1802-1879), Public domain, via [Wikimedia Commons.](https://commons.wikimedia.org/wiki/File:El_Coste%C3%B1o.jpg)*

Yesterday, on November the 6th 2025, the during class, I said something in the realm of "You can't understand people from the South." I want to expand on this. It wasn't meant as an attack on all of you. I am also European, even if I don't look like that. I also can't fully grasp what it means to be from "the South". So it should have actually been "We can't understand people from the South". ¹ I also think when reading, like Franca already urged us to, we have to take into account how the authors where socialized. Here is some context about Colombia, which in my opinion makes it easier to understand the desire of freeing the worlds of oppression and allow the existence of parallel realities as Alfredo Gutiérrez Borrero or Arturo Escobar suggest.

These things about Colombia I experienced myself or got told first hand from my father who was Colombian, born in 1942. He emigrated to Germany in the end of the 1960s and returned to Colombia in 2006 where he lived and thought Physics at the Universidad de Cartagena until 2016.

One thing is to understand is the diversity of cultures that make up Colombia. The Caribbean coast of Colombia for example has many areas where the descendants of slaves settled. This means we have the cultures of Berbers (Amazigh), Arabs, Egyptians, Nubians, Mandinka, Malinke, Bambara, Songhai, Fulani, Wolof, Serer, Akan, Ashanti, Fante, Dagomba, Ewe, Yoruba, Igbo, Hausa, Kanuri, Fon, Baoulé, Bété, Senufo, Bamileke, Duala, Bantu-speaking peoples. Together with the peoples who already inhabited these areas later known as Colombia and Venezuelas, Panama and Costa Rica, and the Yucatan. Mixed with the Spanish, the French, the British. All these cultures did not just disappear. They mixed and created something new. Due this "mescla"² the Spanish spoken at the coast, "el costeño", is very different from other dialects. People from other regions of Colombia told me they don't understand it. This area is also one of the most bio diverse areas on earth. Everything moves, crawls, flies, swims, grows, decays all around you. Remember this is only the Caribbean coast. That is why I think I get that thought pluralism can easily grow in someone who is socialized in such an environment.

Then there is the oppression. In the colonial period through the Spanish from 1499 until ~1810 a huge part of the Quimbaya (Pacific coast), Chibchas (Andes) and Kalina (Atlantic coast) population was eradicated. From the 6 Million indigenous remained 600.000 in the Colombian population. In the recent history this country has been in a constant civil war from the mid 1960 until 2016. Many cruelties were happening from all the sides of this conflict. The communist opposition (FARC), the state, the paramilitary groups, and from the 70s on, also from the narcotic trafficking cartels. Due to the war and drugs that was proclaimed in the 70s, the United States of America also executed military actions in this sovereign country.

I got the feeling that there's a big distrust within the population against each other. People living in gated communities if they can afford that or behind bars, if not.

This creates a very strong opposition against being oppressed, being seen as "the periphery", being colonized, being the backyard of others.

I also think we can't understand a lot of things. I can't understand feminism because I am not a woman. I can't understand Islam. I can understand racism because because I experience it. ↩
"Mescla" is the Spanish word for mixture. ↩

Biga Ranx tonight

Sun, 09 Nov 2025 00:00:00 GMT

I am going to see Biga*Ranx tonight!

Marble Fountain by Will Morrison

Mon, 10 Nov 2025 00:00:00 GMT

Marble Fountain by Will Morrison https://willmorrison.net/posts/marble-fountain/

Very beautiful work and great presentation. Via HN

Finally, a huge thanks to my friend Alex who listened to me ramble about marbles for several months every day while walking home from work, gave a ton of helpful input, and lived with the dozens of ball bearings scattered across our apartment.

Yes thanks Alex! :D

reponse to: Tools Shape Our Products by Boris Müller

Thu, 13 Nov 2025 00:00:00 GMT

Hi Boris, in your article Tools Shape Our Products you argue that the code editor is this arcane empty text field we are staring at when coding. In my opinion you are exaggerating (maybe to make your point?).

When I open a Terminal. It does not look like this anymore:

It looks more like this:

And also the editor. We are not using the plainest of plain text.

It is actually more like this.

There is so much information and tooling to make my life easier. Debuggers, Breakpoints, Linters, Code Formatters, Static Typing, Code Generators. The list goes on. Even the color of the words I type contain information about what I am doing. when I type the application suggest what I could type next based on context.

But I get your point.

Speculative Software Design == What if?

Fri, 14 Nov 2025 00:00:00 GMT

Maybe you noticed, or maybe not, I started studying again and this makes me also write a little more. Which is nice. I also read a lot more then technical documentation. So here is a thought on something to read.

Speculative (Software) Design is actually the question of "What if?". So here is a book about this.

The New (Old) Developer

Sun, 16 Nov 2025 00:00:00 GMT

I'm am pretty sure this has been said already on the internet. I still want to write down my thoughts — just for me and maybe you get some insight to.

It's Sunday morning, 6:15, and I'm sitting in my kitchen¹. So I had this idea about this project we've been working on in the last workshops session about AI at @fh-potsdam.

This is not a mission critical project. It's totally vibe-coded, but I'm still putting in some thought because I like how it turned out.

Since it's 6:15, I really don't want to get to my computer and start hacking away. Also, my little son is sleeping in my bed, so there's no place to start hacking.

Enter Claude Code for the web.

Just for fun, I described my idea to Claude Code on my phone in a few words and let it hack away on this small refactor. Then there comes this other idea while thinking about the first one, and I spin up a second session and let Claude hack on this idea as well.

Now, while I'm writing this, I have already two pull requests waiting for me to review them and I am still in my pyjamas.

Another project. For a seminars about language as an interface, I started to build a prototype for an iOS application. Since I know shad/cn a little and we got introduced to Figma Make in the last session, I prompted my way to a visual draft of my iOS application within 30 minutes. I took screenshots of this application and passed them on to Claude in Xcode. After another 30 minutes and some debugging with Claude, I had a working first draft of my application on my phone. Now I'm in the stage of this project to test out the UX and write tickets for Claude. Since I am not familiar with Swift, it is the developer, and I am the project manager (PM). Creating this prototype would have taken me weeks to learn the basics of Swift and SwitftUI to get where I am now after about half a day.

Bottom line: These tools are really a game changer, and I'm sure some of the AI skeptics and hardcore developers will tell me about non-maintainable code and all those things, it taking away the fun in coding, watch out for the robot apocalypse, KILL ALL HUMANS KILL ALL HUMANS, and so on… But still, I am not a developer per se, I'm not a pure visual designer. I'm a creative technologist, and my main field is creating ideas, exploring technology and building prototypes. Yes, sometimes I do fullstack work, and yes, sometimes I do frontend work. But for these projects mentioned above, I'm the designer, I'm the project manager, and I'm the creative director and I am enabled to create these artifacts in such a short period that would never have been possible three years ago.

So, why writing all this? The problem we have is that I am developing software since more or less 15 years². I have been writing scripts even longer. For Adobe InDesign, for example when working on layouts with Grenzfarben. I started creative coding in around 2007 or 2008 with Processing. I used Open Frameworks. I used Terraform. I used AWS. I used Postgres and SQLite. I used docker a lot. I used JavaScript in the front and back-end. I am dipping my toes into Ruby right now. So, there is a lot of coding experience under my belt. That's why I'm confident that I can build such projects and also debug them later on. Or decide if this is just a prototype or something to pursue. I can ask questions about it, and I can answer to colleagues what is happening in there even if I haven't internalized Swift + SwiftUI.

During my time at the University of Arts Braunschweig, I also taught students of the visual communications how to code with JavaScript on the front-end and later on we started vibe coding. Every time when they were vibe coding, the assistant pumped out code that they couldn't explain and had to depend on the assistant to do changes. They pretty often came 70-80% of the way and then got stuck.

So when we are automating away all those juniors, we will end in a state where there is nobody to debug our code because the greybeards will die out, and then you are left with vibe coders and 80% of your project done my dear PM of the future.

Yes, I know it's early, but this is another topic. ↩
This sounds wired. It is not the problem that I am developing but keep in reading above. ↩

NPM trusted publishing rabbits hole

Sun, 23 Nov 2025 00:00:00 GMT

Ok, I fell into a rabbit's hole of npm dependencies today. So I want to just jot down quickly what I had to do. Since the supply chain attacks recently, NPM is deprecating classic tokens. This means we need to use more granular tokens that also need to be rotated every 90 days. This is something I really don't want to take care of and I really don't want to set up some automation to rotate tokens using the NPM API (if there is something like that).

So I went for trusted publishing. This is something that the registry (npmjs.org) and the CI provider (like GitHub.com) do some handshaking. Not sure what is going on behind the scenes, but they say that's their thing. So I will go for it. The problem I had here is that there need to be some changes to the repos. First it's the permissions on the GitHub workflow.

name: Node.js CI
permissions:
  contents: write
  id-token: write # needed for OIDC
  packages: write

I also had to go into the settings of my published module on npmjs.org and tell npm which workflow is allowed to publish.

Pretty straight forward until this point. Now here comes the rabbits hole.

I've been using a shared semantic release config we created the Technologiestiftung Berlin a lot, but this needed to be updated. It needs to use the latest semantic-release (currently 25.0.2) and the semantic-release npm plug-in (currently 13.1.2). Since I don't want to interfere with the current setup on all the repos Technologiestiftung's version uses, I went for a fork

Another thing that had to be done was to remove the NPM_TOKEN environment variable so this doesn't interfere with the trusted publishing.

I also had an error because my package.json file didn't have the repository field.

Things you do on a Sunday morning for a package that is some kind of abandon-ware. ¯\_(ツ)_/¯

Update 2025-12-25

I just ran into the same issue here without consulting my notes. m( Once again for future me:

Setup trusted publishing on npmjs.org
Needs semantic-release >= 25
Needs npm semantic release plugin >= 13
Optional use @ff6347/semantic-release-config >= 1.0.6
The Workflow or job needs the following permissions:

permissions:
  contents: write
  issues: write
  pull-requests: write
  id-token: write

Remove any NPM_TOKEN env variable
The package.json needs the repository field:

"repository": {
  "type": "git",
  "url": "git+https://github.com/OWNER/REPO.git"
}

Persist the credentials on the jobs checkout step (happens by default):

persist-credentials: true

Semantic release steps needs GITHUB_TOKEN from the env

env:
  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

Link to a working workflow Link to a working package.json

p5 Easing is in Use

Tue, 25 Nov 2025 00:00:00 GMT

Yesterday I learned that Pieter-Jan Vaernewijck and his students are using my p5js easing library over at devine.be.

How did find out? I broke the build by setting up trusted publishing to npm and they could not use the CDN unpkg version any more.

This makes me very happy.¹

No. Not that I broke it and they could not use it. That people are using it. Duh! ↩

Living with SLE

Wed, 26 Nov 2025 00:00:00 GMT

Okay. This one is something very personal. Maybe you are interested. I was diagnosed with systemic lupus erythematosus (SLE) in 2016, the day Olivia told me that I am going to be a father. So at least there were good news and bad news that day. Before you go “poor Fab” in your head: It is okay.¹ There are people way worse than my mild SLE. I manage. Sure, your own suffering is the biggest suffering you know, but still I feel lucky — life is suffering I heard. Why am I writing this down? I am working on a project about it. So I a looking a lot into it and because I was told writing things down helps to digest them. So here we go.

I think the SLE was there long before the diagnosis and the butterfly rash that came in 2016. As an adolescent I already had frequent inflammatory diseases and some (allegedly) viral arthritis at the age of 14 after some mosquito bites from Colombia for a year. This kept on in my twenties with spotted hair loss and other inflammatory diseases.

Being young and in Berlin in the 2000s did not help. Drinking, smoking and other things with techno parties at the Panorama Bar. It was a rave. Let’s say my lifestyle from the mid-1990s till the mid-2010s was a little too wild for having such an illness.²

The SLE got worse over the years. I think my peak was around 2021/2022 where other things came together that were very stressful. What helped to get me out of this?

Due to the meds I am taking I stopped drinking alcohol. This is great. I have been sober for more or less 1250 days. I stopped smoking. Maybe 1000 days without a cigarette? This is way harder than drinking. I do sports. This is my temple. I have been a student at the Kung Fu Academy Berlin since 2008. This already helped me channel energy away from partying to something more productive. When I have fatigue days this is what gets me up and running again. It is wired in a way that I can’t get out of bed to do nearly anything, but when I make it into the “classroom” it gets better. My head clears and I feel happy afterwards. Food is also a big thing. I sometimes do phases without sugar. Without milk products. Without gluten. I take Vitamin D every day. I use sunscreen every day. And of course my meds.

Let me put a rhetorical question here to keep this floating: How is it to live with that?³ Well, I have to be more conscious about what I do. I can’t go to the beach and have a sunny day. (I can, but then I have a bad day or several afterwards.) I have to plan with the energy I have. Of course you have to do that without lupus as well, but exhausting myself can throw me into a flare, which is bad. I have to stay away from stress as best as possible, because this also ends in a flare. And I have to watch out for infections. The SLE is actually my immune system going very strong — too strong — and attacking my body. This is where the immunosuppressiva come in. They try to lower my system. Therefore it is more likely that I catch a cold and all those other annoying things you can get from the Kita. My rule of thumb is: Don’t eat the kid’s plate. They eventually sneeze on it. And don’t get me started on pink eye. I just have to see the sign that some kid had it and it already itches.

My biggest problem currently is insomnia. This is why I start writing blog posts at 4 in the morning. Full circle.

Nooo not about the kids. ;) ↩
But I can only see this in retrospect now. It still was fun. ↩
Thanks for asking. ↩

Rotating Cubes

Tue, 25 Nov 2025 00:00:00 GMT

This is something I quickly vibe coded on the way home from Potsdam. It is based on some other students results from the Unity XR workshp at FH Potsdam. I liked the stacked cubes idea. But what intrigued me the most was the artifacts that came from the low quality rendering in the Oculus Quest 2. This wasn't intended by the others. To remind me of this effect I created this artifact in threejs. Bottom line. Use the restrictions and limitations of a system to create effects. Not every effect/look needsto be inteded See the live version here and the source code here. It is DO WHAT THE FUCK YOU WANT TO PUBLIC LICENSED

BärGPT by the CityLAB for Berlin

Sat, 29 Nov 2025 00:00:00 GMT

I am really proud of my friends over at CityLAB and Technologiestiftung Berlin for getting this up and running. A custom made solution for using large language models in the Berlin administration ☞ BärGPT. I have been watching from the sideline how this came to life. A great piece of work. Read this as well BärGPT: The technical Deep Dive for the new AI assistant for Berlin’s public administration

And you know what? The whole thing is open source.

Chapeau my friends!

November 2025 and 0.5 × December 2025

Sun, 14 Dec 2025 00:00:00 GMT

So what happened this November. I will try to summarize some things that landed in my daily notes and what I did.

Thesis Topics and Master Studies

I had some ideas for my thesis topics landing in my inbox. Here are some keywords. I might expand on this later on.

Small Language Models: I really think this is a topic worth exploring. I already trained a SML on some personal data.
Gestalt Theory: In 2016 I did this Gestalten In Code seminar @FH;P and I want to dig deeper into this. Maybo together with SLMs?
Color Theory: Same as the ones above. I want to dig into training a model for color creation
Learn Code the Hard Way: For the master we need to do some teaching experience. I was thinking about a seminar that does the following. First generate code using LLMs. Second part try to write this yourself. See also New Kid in the Classroom: Exploring Student Perceptions of AI Coding Assistants
Student Paper: I am working on a project that should end up in a student paper about: "On Device Small Language Models for Symptom Diary P.R.O. Measures"
Reading Group: We did a lot of reading about, post-colonialism, design justice, equality, oppression, pluralism and and and. All related to design. Makes we wanna ditch the term title Design a little.
Workshops: There Where also some pretty interesting workshops going on.
- Unity
- D3
- Spatial Typography
- AI
- Touch Designer Below you can see some videos. I'll add no additional comments here.
Find a Font: The hardest task besides naming things

Videos

Spatial Typography

Unity

D3

TouchDesigner

TIL. Fritz Box just truncates a password if it is to long

Sat, 20 Dec 2025 00:00:00 GMT

Holy shit! I am in the process of setting up a system wide pi-hole and my new FritzBox didn't tell me that the new password was to long. So it just truncated it and went on with the password change. m(

Where to publish code if not on GitHub?

Sat, 20 Dec 2025 00:00:00 GMT

Lately if been using the the phrase "if it's free, you're the product" pretty often. For search I use Kagi.com. For mail I use Fastmail, ProtonMail and Uberspace and pay for them. I've stopped looking at and feeding into social media networks over the past few years. You can find the occasional image from the street on Mastodon from me, but the rest isn't that interesting anymore. I don't doom-scroll any of them - except for Hacker News.

So now here is my problem. I publish a lot on GitHub -- Owned by MSFT. I have over 600 repositories, many of them Abandonwear™, or just some proof of concept, some code for workshops, some organization dedicated to a specific topic, some CLI or web tools and what not. I think I built some kind of portfolio there and for developers it is currently the de facto place to show their work. If I ask one of the (sota) large language models: who is Fabian Morón Zirfas? I get a pretty accurate description of what I have been doing over the last 15 years. I joint GitHub in 2010 so I am seeing and I walked the path of enshittificantion with them (which seems inevitable for such a large project). I still think it is a okayish product but there are some parts that are becoming wired and clunky. The most important thing though is digital sovereignty from the bigcorp-clouds in the US. I've been reading "Technofeudalism: What Killed Capitalism" by Yanis Varoufakis and I get the impression that it is more important than ever that we take a path other then throwing all our data into the beast just out of convenience.

So what are the alternatives (besides self-hosting)?

I guess the realistic options are Codeberg and Sourcehut.

Codeberg Germany and a non-profit e.v.
sourcehut Netherlands for profit but with a strong ethos about open source.

I need to checkout if my usual workflows are supported. Gitflow publishing to Cloudflare, Netlify and NPM package registry. The occasional image going to Docker Hub might be needed¹. Working with LLM coding agents makes this even harder, since they are integrated with GitHub or maybe GitLab but that is it.

Bitbucket (US and Atlassian) and GitLab (also US) are not as big as MSFT but still operated on us soil under their law.

A whole other thing. Decentralized git hosting on your own infrastructure (called knot) based on atproto with tangled as the frontend as I understand it.

Tangled

This is an open ended post I guess. If someone is reading this, any opinions on that, what do you do? And one last question comes still to my mind. Should I mirror important projects?

Yes while writing it I see the next challenge coming up. ↩

igittigit and licensor

Tue, 23 Dec 2025 00:00:00 GMT

I just published two tools I recently vibe coded to scratch an itch.

igittigit github.com/ff6347/igittigit Pulls .gitignore templates into your current directory. I am trying to move aways from to much VSCode use to Zed. One thing I am missing from VSCode is the gitignore extension (github.com/CodeZombieCH/vscode-gitignore). So I created something similar for the command line.
licensor github.com/ff6347/licensor/. Same goes for the licenser extension (github.com/ymotongpoo/vsc-licenser). I normally need a LICENSE file for every project. So this pulls licenses from choosalicense.com's git repo and also some more Creative Commons licenses.

Both tools can be downloaded as binaries from their GitHub release pages, installed via go or build from source. If you trust me that much you can also can install them directly from my homebrew tap.

brew install ff6347/tap/licensor
brew install ff6347/tap/igittigit

Yes! I vibe coded them. Since I am no go developer and I am to busy to build this without an AI doing the coding.

Any feedback is welcome.

Notes on Containerized/Isolated Agents

Sun, 28 Dec 2025 00:00:00 GMT

I have to put my money where my mouth is. Since I've been ranting about MCP and security in the post about "MCP in experimentation or how I trust the trust of others". Having a docker container where I run the MCP tool in was not as straight forward as I thought. It worked somehow but also became annoying to maintain volumes in that one string to make this feasible. I dropped that and went on with my live.

But then I have been dabbling with agents in containers recently and here are some nice things I found.

Conductor conductor.build A pretty nice application that uses git-worktrees on your local machine to run agents in your repos.
git-worktrees in general make a good tool for having a second checked out version of your repo. git worktree add ../my-feautre main
in Docker 4.5 they introduced sandbox command It runs a container for you with the current working directory mounted into the container. In the container claude is already installed as binary. Very nice. You can even specify your own image templates. claude runs here with --dangerously-skip-permissions I would recommend a combination of, commit before running or better use git-worktrees with it.
Just yesterday I stumbled upon sketch.dev via HN That gives you fully isolated docker containers locally, remote and also with a hosted platform. The UI still seems a little beta but kinda nice.
They (the people from sketch.dev) also have a service called exe.dev Here you get a VM in the clouds to run your agent in. With lots of great DX.
One last thing to sandbox an agent differently is giving it access to a Raspberry Pi. I have Pi5 with 8GB and a nvm base attached to it hocked into my local network. On the Pi I have tailscale running with tailscale up --ssh and some tags in my ACL to allow access from a ephemeral machine. Then I just pass claude the temporary token and tell him to ssh into the pi and go havoc in there. :D. (I noticed that claude likes it more to run command from the host on the Pi rather then logging in and having a session in there, but hey — however you think you are absolutely right claude)

Docker Sandbox Recipes

Run Go dev env for claude:

# ABOUTME: Development container for docker sandbox, adds Go toolchain for Pi development
# ABOUTME: Extends official claude code sandbox template with Go and dev tools

FROM docker/sandbox-templates:claude-code

# Create sandbox lock directory
RUN mkdir -p /home/agent/.docker/sandbox/locks

# Install Go and dev tools
RUN &#x3C;&#x3C;EOF
sudo apt-get update && sudo apt-get install -y \
	golang-go \
	fish \
	magic-wormhole \
	tmux \
	vim \
	bat \
	lsd \
	zoxide \
	&& sudo rm -rf /var/lib/apt/lists/*
EOF

ENV GOPATH=/home/agent/go
ENV PATH=$PATH:/home/agent/go/bin

Build the image

docker build my-template .

Use the sandbox with some local ~/.claude folders mounted as read only so the agent behaves more like my local agent. You still will have to login within the container with your credentials or provide a API key.

# Run claude in sandbox with this project
docker sandbox run -t my-template -w . \
  -v ~/.claude/CLAUDE.md:/home/agent/.claude/CLAUDE.md:ro \
  -v ~/.claude/plugins:/home/agent/.claude/plugins:ro \
  -v ~/.claude/commands:/home/agent/.claude/commands:ro \
  claude
# Continue previous session
docker sandbox run -t creatureone-dev -w . claude -c

If you do changes to the template you need to remove it first.

# If you rebuild the image, remove the old sandbox first
docker sandbox ls
docker sandbox rm <sandbox-id>

The AI Discussion Loop

Wed, 14 Jan 2026 00:00:00 GMT

I used to be very interested in what people were saying about AI and its current trajectory in the development community. But today I noticed that I get the feeling of: "AI is going to be blah blah blah…"

It is fine if you're totally betting on AI in development. Great show me how you do it! What worked well? What did not work? Any new learnings? And if you're against it. It's also fine right code by hand.

But please can you both shut up and stop proselytizing¹. There is more than one solution, my friends. My professor and mentor recently said something in the realm of: "whenever I read the word inevitable, I start to doubt."

Yes. Stop thinking in your binary, black or white, all or nothing method.

yes. I looked this word up with AI. ↩

Platform vs Company

Tue, 24 Feb 2026 00:00:00 GMT

I've been listening to a podcast where they were talking about social media restrictions for adolescents. I'm pretty happy this discussion is happening now, as my children will hopefully grow up in a society where it's already been settled. I see it like the prohibition of tobacco or alcohol for people under age. As are the advertisements of cigarettes in public space. It's good for us that we have this.

But what stood out most to me is that somehow our language has been altered to use the term platform for things like TikTok or X et al.

This disguises the actual reality. These are companies that earn money from our attention or advertisement or selling our data. Period

Colony - A Speculative Software Project

Mon, 06 Apr 2026 00:00:00 GMT

What if the singularity already happened and we missed it because we were looking for ourselves?

Like Narcissus we love our own reflection. Therefore we measure all intelligence against human intelligence. Does it look like us, speak like us, write like us, sound like us? But what these are entirely the wrong questions. When we look at bee swarms or slime molds we see a network of entities that form intelligence in their interaction. Looking at language models the intelligence does not lie in the sole generation of the next token. When bringing together tool calling for interaction with other entities, file input output for creating or recalling memories, access to the shell for altering their own source, access to the internet for information retrieval we end up with things creating things. Colony (or c010ny.cc because the non leet code domain was way to expensive) is the first iteration of this. It is small language models running on raspberry pis. Their natural senses are things like memory load, cpu temperature or disk usage. They exist in a network where they can choose to interact with other entities that have access to their realm. What emerges from this?

The process of creating this started with Opus 4.5 and moved to 4.6. I gave it as much agency as possible. Running it in a Docker container in yolo modus. Giving it access to the VPN and SSH to the pis was crucial, so it could deploy and modify the entities by itself. My part was generally giving ideas, setting up hardware and infrastructure, steering when it went of rails. One example of its agency was for example the audio expression of the entities. I gave it directions in form of "make it sound R2D2-ish". It came up with several versions how the result of an inference could be translated into sound. The same goes for the visual output on the attached display (which was dropped in favor for the audio output).

The first presentation in the seminar was also fully written by Claude with minor editing and full styling from my side.

Things creating things.

Sidenote: The project started before the release of OpenClaw and the whole agents with heartbeats thing. Nice to see parallel developments. I guess the idea to run inference in a loop was inevitable -- starting with Ralph in a loop.

Flarelines - A Speculative Software Project

Mon, 06 Apr 2026 00:00:00 GMT

The elevator pitch would be as follows: Lupus is a chronic autoimmune disease. Studies have shown that keeping track of such an illness using journaling helps cope with the disease. Also having a better understanding auf the progression of the illness helps when talking to your medical health practitioner. Flarelines uses small language models (SLM) on device to categorize symptoms into 4 categories. From 0 to 3 where 0 is no activity and 3 is strong flares. I am using it for myself. Did the whole LORA fine tune pipeline with Qwen 2.5 locally using some of my own journals and synthetic data. The application is also done using Opus 4.5 and 4.6 in Swift.

What I did this Winter

Mon, 06 Apr 2026 00:00:00 GMT

It's gotten pretty silent around here. My semester was over and I had to take a break and let the things I read and created sink in a little. This doesn't mean that I was sitting on my hands, but I needed a little output break. So most of Februar was a lot of Kung Fu, fiddling around the house, doing stuff with the kids. Most of March, I've been working on a job for the university. github.com/bonanzahq/bonanza [Music playing in your head, some cowboys riding towards a farm]

Bonanza is a project that was first conceived around 2013/2014 when I was the lab supervisor of the interface workshop at FHP. It is the lending system that has been in use in the workshops since then. This application was so much EOL, its Ruby version, its Rails version and the OS version of the server was running on, the FHP asked me if I could bring it back into this decade. First, I was pretty cautious because I don't read and write Ruby, I don't know anything about Rails. But I still like a challenge.

So I took the job.

Lucky me, Opus 4.6 landed before I had to work on it. Over the last few weeks I worked often on this project, fully assisted by Opus. I revived the project and developed a nice process to work on larger endeavors like these.

My process can be described as the following.

Several agents, running on a Mac Mini M1 sitting on my desk connected to my local network and my Tailscale VPN. Me logging in via SSH from my laptop or Terminus from mobile devices. All sessions are persistent tmux sessions. (Learned quite a bit to use tmux) There's always one main session I call the project manager which only handles creating git worktrees, writing handoff.md into them and spawning agents in new tmux windows. These agents use an agent messaging skill to report back to the project manager and synchronize with other agents for access to the Docker stack. All development is test driven development. Since the agents are running on a desktop computer, they can use browsers to validate the features they wrote using end to end testing. I developed some nice agent skills on the way to the v2. We are still in implicit Copyright mode but will add a open source license soon.

On other news I released two projects. They are still work in progress but in a state where I can start talking about them.

First one is Flarelines. See it at flarelines.cc. Read more about it in this blog post.
Second project from last semesters Studio Seminar is Colony c010ny.cc. You can read more about it over in that blog post.

Agentic Search (POC)

Tue, 24 Jun 2025 00:00:00 GMT

I have been tinkering (semi vibe coding) an agentic search using OpenAI and the Brave Search API over the weekend. I am sure there are some problems and edge cases but I am pretty happy with the result. I thought there is more to it.

The core logic is giving the LLM a tool it can call and have some break conditions so it does not end up in an infinite loop. See the proof of concept here https://github.com/ff6347/agentic-search-poc.

You will have to bring your own Openai API key and the Brave Search API key though.

Moving to Astro

Wed, 19 Jul 2023 00:00:00 GMT

Moved all this to Astro. I like it. was pretty painless. Now I just need some style.

Markdown Test Document

Wed, 01 Jan 2014 00:00:00 GMT

Markdown Test Document

This document tests various markdown elements to ensure proper rendering.

Text Formatting

Bold text and also bold Italic text and also italic Bold and italic and also bold and italic ~~Strikethrough text~~ Inline code

Headings

H1 Heading

H2 Heading

H3 Heading

H4 Heading

H5 Heading

H6 Heading

Lists

Unordered Lists

First item
Second item
- Nested item
- Another nested item
  - Deeply nested item
Third item

Alternative bullet
Another item

Yet another bullet style

Ordered Lists

First numbered item
Second numbered item
1. Nested numbered item
2. Another nested numbered item
Third numbered item

Code Blocks

Inline Code

Use console.log() to output to the console.

Code Blocks

function greetUser(name) {
  console.log(`Hello, ${name}!`);
}

greetUser('World');

def calculate_sum(a, b):
    return a + b

result = calculate_sum(5, 3)
print(f"The sum is: {result}")

# Install dependencies
npm install

# Run development server
npm run dev

Blockquotes

This is a blockquote. It can span multiple lines.

This is a nested blockquote.

Links and Images

Link to Google Link with title

Auto-link: https://github.com

Tables

Column 1	Column 2	Column 3
Row 1, Col 1	Row 1, Col 2	Row 1, Col 3
Row 2, Col 1	Row 2, Col 2	Row 2, Col 3

Horizontal Rule

Special Characters

Em dash: —
En dash: –
Ellipsis: …
Copyright: ©
Trademark: ™

HTML Elements

Bold HTML Italic HTML Inline HTML code

HTML block element

Task Lists

Definition Lists

Term 1 : Definition 1

Term 2 : Definition 2a : Definition 2b

Footnotes

This text has a footnote¹.

Another footnote reference².

This is the first footnote. ↩
This is a named footnote. ↩

Today I Learned about /bin/[

Sun, 26 Nov 2023 00:00:00 GMT

Once I saw in /bin a file [. Since I don't want to destroy the fabric of my little unixiverse I thought: Maybe some leftover of some command gone wrong or whatever. I did a ¯\_(ツ)_/¯ and moved on.

Today I learned:

When you write a script like this:

if [ a = b ]; then
	echo "a equal to b"
fi

You don't use a language built in expression. You run with the executable /bin/test. Because /bin/[ is an alias for /bin/test. The only difference is that [ looks for the closing ] to even things out.

So the script above could also be :

if test a = b; then
	echo "a equal to b"
fi

🤯

source: https://jmmv.dev/2020/03/test-bracket.html via Hacker News

Time Washing Machine

Thu, 31 Jul 2025 00:00:00 GMT

What about using a time machine instead of a washing machine? We could just send the cloth back in time to the point where it was clean! Any objections?

Fabian Morón Zirfas's Blog

README

Work in Progress

It's time to start blogging (again)

Links

Dog not Cat - Colored output in from cat in the terminal

Weekly round up - translation, productive habits and procrastination

Markdown Preview in the Terminal

JSON feed

Things 3 or not?

Footnotes

JSONfeed and real problems

My thing with Setapp is…

Just remember that keycombo for π

No Monday morning without wired problems…

Awesome @ubernauten

Footnotes

About Computing

Read this: Notes From An Emergency

Node.js on AWS Beanstalk

Vim is fun… NOT

About CEP Panels

Gated Communities

Footnotes

My Rant on Development Practices

Footnotes

openFrameworks - App Crashes After Transfer to Another Computer

The Feynman Technique: The Best Way to Learn Anything

Cross Repository Action Triggers Using GitHub Actions

Cross Repository GitHub Action Triggering

The Trigger Repository

The Target Repository

Footnotes

Rename a GitHub Repo with a Linked Netlify Project

Rename a GitHub Repo with a Linked Netlify Project

Misc Links from the interwebs

Writing

VSCode

Static Site Generator

Code Quality

Load Testing Tools

SQL

Testing

Self Hosted Paas alternatives

Text Processing

Data Sources/OpenData

ein neuer Tiefpunkt der BTC Ära

Wroooooomm

Procrastination

git log? WTF

Exclude files from git diff

Raycast Extension - CSS Color Names

So you know what I did this summer?

Design Mode (TIL)

Fabian Morón Surfers

CustomEvent

Emile Leary

TPW and Cloudflare had a baby, ReadwoodSDK

AI Fatigue in the Morning

til: JS Array.push returns new length

One Does Not Just Simply Do That!

Offline First or Always On

Code Of Conduct

Obsidian Plugins

Web Dev Playground

Canvas Context

MCP in experimentation or how I trust the trust of others

Contents

The Security Risks at Hand

Problems With NPM

The Combination of Service

How Not to Do It

A More Complex but More Secure Solution

Containers Instead of Bare Metal

The More Secure MCP Configuration

Speeding Things Up

Bonus: Be Even More Restrictive

Conclusion

Footnotes

Learning MCP