Category Archives: Poetry

Remembering Nazi Resistance Leaders Missak and Mélinée Manouchian

There is an interesting history to a French announcement that resistance to the Nazi occupation would be recognized.

Missak Manouchian was the military leader of a Parisian group of foreign Resistance fighters, all of them communist (mostly Jews from Central and Eastern Europe, including Romanians, Hungarians and Poles, but also Spaniards, Italians and Armenians), whom French President Emmanuel Macron will honor by laying his body to rest, along with that of his wife, in the Panthéon in Paris, 80 years after a frantic manhunt conducted by the Nazi-collaborating Paris police and the execution of 22 members of the group…

Eighty years of official French memory was cynically mismanaged to celebrate the Resistance without celebrating the people who actually conducted armed operations in occupied Paris.

The continuation of a Nazi propaganda apparatus meant France understood exactly who really had been fighting. The “Affiche Rouge” plastered across Paris in February 1944 featured ten faces from the group with their names, nationalities, and acts of sabotage. The poster’s headline asked: “Des Libérateurs?

The intent was to turn Parisians against the Resistance by tribal “othering”: declare invasive German Nazism native to France while declaring the French resistance alien (Jewish, communist, etc.). The Vichy interior ministry and Paris police collaborated in the precise propaganda, and the manhunt that produced arrests.

Postwar France then continued the precise inversion. De Gaulle’s reconstruction myth required the Resistance to be French, national, and broadly patriotic. He erased the celebration of foreign-born communist Jews who responsible for the actual armed campaign in Paris. These people were more patriotic to France than the French collaborating with Nazis, which the post-war France wanted to avoid admitting.

Aragon wrote “Strophes pour se souvenir” in 1955, a poem paraphrasing Manouchian’s last letter to Mélinée. Léo Ferré set it to music and recorded it in 1961 as “L’Affiche Rouge.” The cultural memory existed. The state recognition kept denying the people who mattered should be allowed their recognition.

Mélinée Manouchian survived. She spent decades pressing for formal acknowledgment. She died in 1989 without receiving it. The Panthéon ceremony honored her alongside Missak, thirty-five years after her death.

The Nazi occupation of France faced an armed resistance carried out disproportionately by the French identities who the French tried to suppress. Recognition was deferred until every participant and their surviving spouse was dead and couldn’t feel appreciated and welcome.

The honor arrived when it cost nothing and offended none of the surviving, thriving Nazis in France. The state gets credit for an act of memory that required eighty years of erasure, treating the real resistance as the “wrong” ethnicity for liberating France from both foreign and domestic Nazism.

eisengarn: One Binary, One Cloud, One VPN

When you create a “virtual private network” the “exit” of that network is a physical node with a legal jurisdiction. That jurisdiction determines who can compel disclosure of your traffic metadata, under what authority, and whether anyone is required to tell you it happened. Choosing the right jurisdiction is the first security decision of any “private” network. Everything else depends on it.

eisengarn Intro

After hearing many people ask what they should do about the crisis of fraud in the VPN provider market (many of them apparently are cosmetic shells that trace back to the same hedge fund, or an anti-privacy politically ambitious CEO), I created eisengarn. Of all the options I saw presented, none seemed to offer the simplest answer of all.

I didn’t see any reason for something to be magic or marketed when the concepts of private networking are as old as the Internet itself. So I put together the most simple solution I could, and not simpler: a CLI-based personal WireGuard VPN provisioner written in Go.

I like to sing “one binary, one cloud, one protocol (VPN)” to the tune of Rudy Toombs’ “one bourbon, one scotch, one beer”. Your musical tastes may differ, but the point is simplicity and transparency brings integrity.

One scotch, one bourbon, one beer

One scotch, one bourbon, one beer

Please mister bartender,
listen here

I ain’t here for trouble,
so have no fear

One scotch, one bourbon, one beer

You run one command and get a hardened WireGuard exit node on the Hetzner Cloud, locked by code that only allows EU jurisdiction datacenters: Nuremberg, Falkenstein, Helsinki.

The name is awkward to say, but it’s a real German textile term for “iron yarn”, which means paraffin-treated cotton thread. It’s perhaps known best as Bauhaus tubular-steel chair webbing (Stam, Breuer). It has strong, thin, functional, engineered attributes. What’s not to like? The metaphor is a simple purpose-fit physical thing to make your internet more trusted.

Jurisdiction Details

Hetzner is a German company, thus under German and EU data protection law. The GDPR applies. The server you provision sits in a known legal regime with strong data-protection statute. That’s why eisengarn hardcodes the location, giving an easy and reliable jurisdictional boundary.

The code is open on Codeberg, a German non-profit running Forgejo. The DNS resolvers are Quad9, a Swiss foundation with a no-source-IP-logging policy, and DNS.SB, operated in Germany, both over DNS-over-TLS.

The cloud, code, and DNS all remain within EU jurisdiction, unlike the American services known to be heavily monitored by Trump for loyalty, and subject to being disabled immediately without warning.

Ms. Prost was at home, standing in her kitchen, when the call came informing she was being sanctioned. It wasn’t a complete surprise, given that many of her colleagues had already been sanctioned, she said during an interview…. Within hours, she said, she had received a message from Amazon canceling her accounts. Before long, Google & her banks got in touch. Over the following days, credit cards ceased to work.

Design Details

WireGuard keypairs are generated server-side on first boot; the private key stays on the server and is read directly into the WireGuard config there. Client keypairs are generated locally on your machine; only the public key crosses the wire. Every key artifact is written atomically: create temp file, chmod 0600, rename into place.

SSH authentication is agent-only. Your private key stays in ssh-agent, protected by your passphrase, and eisengarn prints which key it selected so you can confirm. Host-key pinning is trust-on-first-use and fails closed: a changed host key aborts the connection.

IPv6 is dual-stacked with NAT66, so both address families route through the tunnel and exit in the EU. DNS runs through unbound, listening only on the tunnel interface, forwarding over TLS. The firewall is scoped to OpenSSH and WireGuard’s UDP port; the resolver is reachable solely from inside the tunnel.

Threat Details

eisengarn, if not already apparent, is a jurisdiction tool. You control the exit node. You choose the legal regime your traffic lands in. The security properties are visible in code rather than in a sketchy hedge-fund VPN flogging “personality type” marketing.

The README spells out exactly what the trust boundaries are: your Hetzner account ties the server to your identity, the exit IP is stable and yours, and traffic past the exit is as encrypted as it was to begin with. Honest documentation so you know exactly where the boundaries are should help you make real decisions about your threats.

Workflow Details

It’s in Go, statically compiled, CGO disabled. Clone it from Codeberg, make build, and this is the entire workflow:

eisengarn up — provisions a locked-down Ubuntu 24.04 server in the EU datacenter you chose, configures WireGuard and the DNS resolver, pins the host key, writes local state.

eisengarn add laptop — generates a keypair on your machine, sends only the public key to the server, writes laptop.conf and a scannable laptop.png QR code. Import the conf into WireGuard on the device. Scan the QR on a phone.

eisengarn verify — runs live checks against the server: tunnel up, unbound active, firewall scoped, DNS resolver unreachable from the public internet.

eisengarn list — shows your devices, reconciled against the live server.

eisengarn down — destroys the server and stops the bill.

A cpx22 at Hetzner runs only a few euros a month, perhaps less than your VPN service charges. The server is persistent, meaning you can provision once, add devices over time, and eisengarn down when you’re done. A down command immediately destroys the complete server.

v0.1.0 was just tagged, under a MIT license.

Enjoy, and stay safe out there.

Hetzner “one-click” UI

Also note, Hetzner already offers a one-click WireGuard app with a web management UI, which they support.

It’s a starting point, while eisengarn offers you a different set of choices: sticking with CLI-only means nothing exposed on HTTP or HTTPS. EU-location is provable, and it uses agent-only SSH with host-key pinning, with local client key generation so private keys stay on your device, as well as DNS-over-TLS to privacy-respecting EU/Swiss resolvers.

The table below lays out how and why the two options are so different.

eisengarn “One-click” App
Location constraint Provable EU-only, enforced in code (nbg1/fsn1/hel1) None
Management interface CLI only Web UI (Caddy + Let’s Encrypt)
Public-facing services SSH + WireGuard UDP SSH + WireGuard UDP + HTTPS
SSH authentication Agent-only, host-key pinning (TOFU) SSH key or root password
Client key generation Local (private key stays on your device) Server-side via web UI
DNS Unbound → DoT to Quad9 (Swiss) + DNS.SB (German) System default
IPv6 Dual-stack with NAT66, both families tunneled Forwarding enabled
Firewall ufw, scoped forwarding (tunnel → eth0 only) nftables
Installed components WireGuard, unbound, ufw WireGuard, WireGuard UI, Caddy, nftables
Audit surface Single Go binary, open source on Codeberg Pre-built cloud image

Steal the Goose, Go to Jail. Steal the Goose Concept, Start a Corporation.

An old English protest verse exposes the unfair asymmetry of “Enclosure” laws by describing a goose.

They hang the man and flog the woman
That steal the goose from off the common,
But let the greater villain loose
That steals the common from the goose.

The law demands that we atone
When we take things we do not own,
But leaves the lords and ladies fine
Who take things that are yours and mine.

The person who takes a goose meets the full weight of the criminal law. The person who takes the common on which the goose was fed receives an Act of Parliament for the trouble. Petty theft is a hanging offense, while grand theft is a civic act.

The lines are anonymous, probably by design to protect those who recognize the meaning. They came during the “enclosure-era”, first printed in The Tickler in 1821.

The target of rhyme is the philosopher Locke. His Second Treatise grounds property in labor, where a man acquires a parcel by his work being recognized among the common stock. Enclosure reversed the rights. The labor that converted a common right into a private title was simply the drafting of a statute, while the men who performed the labor saw their result called someone else’s property.

The same integrity challenge, in the same decades, was the abolitionist debate on slavery. Somerset secured his freedom from slavery in 1772, and then Parliament abolished the trade in 1807 and the institution itself in 1833. In the UK. America did the opposite. The Somerset ruling of 1772 and Dunmore’s promise of freedom in 1775 turned the slavery-promoting southern colonies into radical militant resistance to freedom under the crown. An American federal ban on slave imports took effect in 1808, meaning state-sanctioned domestic rape treating rapid human offspring as a property boom. In December 1835 President Jackson asked Congress to inspect mail to protect “property” by censoring abolitionist publications. When the bill failed, his postmasters suppressed thought regardless, and mobs were setup to torture and kill Americans caught with abolitionist content. Lovejoy was shot to death in 1837 while defending his fourth printing machine from being destroyed.

Both abolition and enclosure shared a mechanism. The law decided what may be owned and therefore what would count as theft. Property in persons was being ended, with a Civil War even, yet it was being taken up in the commons. Human ownership was fought at high expense out of existence, while another ownership was being simply legislated into it.

The radical tradition understood. Thomas Spence built his programme on the theft of the common, and Marx would later file enclosure under primitive accumulation, the system’s founding expropriation conducted as if just law. The anonymous poem had offered the same conclusion a century earlier, and with greater economy.

Theft was, and still is, defined by who is authorized to hold the pen that writes the law. Enclosure is an old term now, barely recognized. Today it most often means elites filing a patent, or scraping data. In other words, AI.

Why We Need a Separation of AI Church and State

Margaret Hu has been making this argument for years, before I caught up to it. She is a professor of law at William and Mary, directs the Digital Democracy Lab, and has testified before Congress on AI regulation.

She just mentioned the separation of AI Church and State has been a rising topic for several years, most recently on the Federal Newswire podcast.

She pointed out separation of Church and State rhymes with separation of AI and State. The Church minted the coin and then charged for salvation. The labs mint the token and charge for salvation. Same institutional makeup, eight centuries apart. That got me thinking:

Church Coin AI Token
The instrument Placed on the altar Submitted via API
Who mints Empire grants it, commune holds it, the Church absorbs it and the ius monetae migrating across one disc of metal The lab holds it, ungoverned
Booked twice The offering in the box, plus a credit struck against purgatory Compute revenue, plus a mark-to-market gain on the same dollar
The salvation sold Time taken off the afterlife AGI, alignment, civilization rescued, cure disease, reduce labor, blah blah blah
The half you can audit 70,000 coins found beneath Scandinavian church floors Amazon’s 16.8 billion dollar mark, booked in the open
The half you cannot The grace. Never recoverable The capability claim. Never independently proven
The trinity Mints the coin, sells the salvation, writes the law of usury Mints the token, sells the salvation, writes the safety framework

Where This Ends is Ugly

An institution that mints the money, sells the salvation, and writes the morality of money holds all three levers with no independence or separation. Nothing inside would work to pry them apart. The medieval version did not reform by memo. It was Luther who nailed the indulgence (the AI double-booking of his day) to a door in 1517. Then a brutal correction unfolded over the next hundred and thirty years. Princes seized the mints and the monastery lands. The wars of religion ran into the Thirty Years War, which emptied as much as a third of the German lands in the worst regions.

The act of “disestablishment” (prying mint and salvation away from the sword) was Westphalia in 1648.

The AI labs clearly are bringing back the trinity and infusing it into the state: we just saw an export ban on who may run a model, we just saw empty warehouses permitted as datacenters and ruled as critical infrastructure, with the national-security frame doing all the consecrating. They may as well say national holiness. Elon Musk may as well be called the holy emperor of SpaceX, presiding over what looks like the biggest fraud in history. The records are blunt about the very high price of undoing the Church coin collapse. Elon Musk isn’t going to disestablish himself any sooner than he will admit he isn’t going to achieve driverless by 2017 or land on Mars by 2018.

Someone has to seize the AI tokens before more people die from AI. Or to put it how was said a very long time ago:

Doch schweig ich noch von dem, was ärger als der Tod,
Was grimmer denn die Pest und Glut und Hungersnot:
Daß auch der Seelen Schatz so vielen abgezwungen.

Andreas Gryphius wrote that in 1636, mid-war, which reads: “and yet I stay silent on what is worse than death, grimmer than plague and fire and famine: that the treasure of the soul was wrested from so many.”

The AI token is today’s Seelenschatz: sold as salvation, never proven, never refunded. The medieval fix wasn’t a stronger emperor. That kind of escalation always fails. It was prying the mint, the salvation, and the sword into separate hands and holding the line. Separate the AI Church from the State before the unauditable claim bills us in death again.