Category Archives: Poetry

Poetry, Security

eisengarn: One Binary, One Cloud, One VPN

Leave a comment

When you create a “virtual private network” the “exit” of that network is a physical node with a legal jurisdiction. That jurisdiction determines who can compel disclosure of your traffic metadata, under what authority, and whether anyone is required to tell you it happened. Choosing the right jurisdiction is the first security decision of any “private” network. Everything else depends on it.

eisengarn Intro

After hearing many people ask what they should do about the crisis of fraud in the VPN provider market (many of them apparently are cosmetic shells that trace back to the same hedge fund, or an anti-privacy politically ambitious CEO), I created eisengarn. Of all the options I saw presented, none seemed to offer the simplest answer of all.

I didn’t see any reason for something to be magic or marketed when the concepts of private networking are as old as the Internet itself. So I put together the most simple solution I could, and not simpler: a personal WireGuard VPN provisioner written in Go.

I like to sing Rudy Toombs’ “one binary, one cloud, one protocol (VPN)” to the tune of one bourbon, one scotch, one beer. Your musical tastes may differ, but the point is the simplicity and transparency that brings integrity.

One scotch, one bourbon, one beer

One scotch, one bourbon, one beer

Please mister bartender,
listen here

I ain’t here for trouble,
so have no fear

One scotch, one bourbon, one beer

You run one command and get a hardened WireGuard exit node on the Hetzner Cloud, locked by code that only allows EU jurisdiction datacenters: Nuremberg, Falkenstein, Helsinki.

The name is awkward to say, but it’s a real German textile term for “iron yarn”, which means paraffin-treated cotton thread. It’s perhaps known best as Bauhaus tubular-steel chair webbing (Stam, Breuer). It has strong, thin, functional, engineered attributes. What’s not to like? The metaphor is a simple purpose-fit physical thing to make your internet more trusted.

Jurisdiction Details

Hetzner is a German company, thus under German and EU data protection law. The GDPR applies. The server you provision sits in a known legal regime with strong data-protection statute. That’s why eisengarn hardcodes the location, giving an easy and reliable jurisdictional boundary.

The code is open on Codeberg, a German non-profit running Forgejo. The DNS resolvers are Quad9, a Swiss foundation with a no-source-IP-logging policy, and DNS.SB, operated in Germany, both over DNS-over-TLS.

The cloud, code, and DNS all remain within EU jurisdiction, unlike the American services known to be heavily monitored by Trump for loyalty, and subject to being disabled immediately without warning.

Ms. Prost was at home, standing in her kitchen, when the call came informing she was being sanctioned. It wasn’t a complete surprise, given that many of her colleagues had already been sanctioned, she said during an interview…. Within hours, she said, she had received a message from Amazon canceling her accounts. Before long, Google & her banks got in touch. Over the following days, credit cards ceased to work.

Design Details

WireGuard keypairs are generated server-side on first boot; the private key stays on the server and is read directly into the WireGuard config there. Client keypairs are generated locally on your machine; only the public key crosses the wire. Every key artifact is written atomically: create temp file, chmod 0600, rename into place.

SSH authentication is agent-only. Your private key stays in ssh-agent, protected by your passphrase, and eisengarn prints which key it selected so you can confirm. Host-key pinning is trust-on-first-use and fails closed: a changed host key aborts the connection.

IPv6 is dual-stacked with NAT66, so both address families route through the tunnel and exit in the EU. DNS runs through unbound, listening only on the tunnel interface, forwarding over TLS. The firewall is scoped to OpenSSH and WireGuard’s UDP port; the resolver is reachable solely from inside the tunnel.

Threat Details

eisengarn, if not already apparent, is a jurisdiction tool. You control the exit node. You choose the legal regime your traffic lands in. The security properties are visible in code rather than in a sketchy hedge-fund VPN flogging “personality type” marketing.

The README spells out exactly what the trust boundaries are: your Hetzner account ties the server to your identity, the exit IP is stable and yours, and traffic past the exit is as encrypted as it was to begin with. Honest documentation so you know exactly where the boundaries are should help you make real decisions about your threats.

Workflow Details

It’s in Go, statically compiled, CGO disabled. Clone it from Codeberg, make build, and this is the entire workflow:

eisengarn up — provisions a locked-down Ubuntu 24.04 server in the EU datacenter you chose, configures WireGuard and the DNS resolver, pins the host key, writes local state.

eisengarn add laptop — generates a keypair on your machine, sends only the public key to the server, writes laptop.conf and a scannable laptop.png QR code. Import the conf into WireGuard on the device. Scan the QR on a phone.

eisengarn verify — runs live checks against the server: tunnel up, unbound active, firewall scoped, DNS resolver unreachable from the public internet.

eisengarn list — shows your devices, reconciled against the live server.

eisengarn down — destroys the server and stops the bill.

A cpx22 at Hetzner runs only a few euros a month, perhaps less than your VPN service charges. The server is persistent, meaning you can provision once, add devices over time, and eisengarn down when you’re done. A down command immediately destroys the complete server.

v0.1.0 was just tagged, under a MIT license.

Enjoy, and stay safe out there.

History, Poetry, Security

Steal the Goose, Go to Jail. Steal the Goose Concept, Start a Corporation.

Leave a comment

An old English protest verse exposes the unfair asymmetry of “Enclosure” laws by describing a goose.

They hang the man and flog the woman
That steal the goose from off the common,
But let the greater villain loose
That steals the common from the goose.

The law demands that we atone
When we take things we do not own,
But leaves the lords and ladies fine
Who take things that are yours and mine.

The person who takes a goose meets the full weight of the criminal law. The person who takes the common on which the goose was fed receives an Act of Parliament for the trouble. Petty theft is a hanging offense, while grand theft is a civic act.

The lines are anonymous, probably by design to protect those who recognize the meaning. They came during the “enclosure-era”, first printed in The Tickler in 1821.

The target of rhyme is the philosopher Locke. His Second Treatise grounds property in labor, where a man acquires a parcel by his work being recognized among the common stock. Enclosure reversed the rights. The labor that converted a common right into a private title was simply the drafting of a statute, while the men who performed the labor saw their result called someone else’s property.

The same integrity challenge, in the same decades, was the abolitionist debate on slavery. Somerset secured his freedom from slavery in 1772, and then Parliament abolished the trade in 1807 and the institution itself in 1833. In the UK. America did the opposite. The Somerset ruling of 1772 and Dunmore’s promise of freedom in 1775 turned the slavery-promoting southern colonies into radical militant resistance to freedom under the crown. An American federal ban on slave imports took effect in 1808, meaning state-sanctioned domestic rape treating rapid human offspring as a property boom. In December 1835 President Jackson asked Congress to inspect mail to protect “property” by censoring abolitionist publications. When the bill failed, his postmasters suppressed thought regardless, and mobs were setup to torture and kill Americans caught with abolitionist content. Lovejoy was shot to death in 1837 while defending his fourth printing machine from being destroyed.

Both abolition and enclosure shared a mechanism. The law decided what may be owned and therefore what would count as theft. Property in persons was being ended, with a Civil War even, yet it was being taken up in the commons. Human ownership was fought at high expense out of existence, while another ownership was being simply legislated into it.

The radical tradition understood. Thomas Spence built his programme on the theft of the common, and Marx would later file enclosure under primitive accumulation, the system’s founding expropriation conducted as if just law. The anonymous poem had offered the same conclusion a century earlier, and with greater economy.

Theft was, and still is, defined by who is authorized to hold the pen that writes the law. Enclosure is an old term now, barely recognized. Today it most often means elites filing a patent, or scraping data. In other words, AI.

History, Poetry, Security

Why We Need a Separation of AI Church and State

Leave a comment

Margaret Hu has been making this argument for years, before I caught up to it. She is a professor of law at William and Mary, directs the Digital Democracy Lab, and has testified before Congress on AI regulation.

She just mentioned the separation of AI Church and State has been a rising topic for several years, most recently on the Federal Newswire podcast.

She pointed out separation of Church and State rhymes with separation of AI and State. The Church minted the coin and then charged for salvation. The labs mint the token and charge for salvation. Same institutional makeup, eight centuries apart. That got me thinking:

Church Coin AI Token
The instrument Placed on the altar Submitted via API
Who mints Empire grants it, commune holds it, the Church absorbs it and the ius monetae migrating across one disc of metal The lab holds it, ungoverned
Booked twice The offering in the box, plus a credit struck against purgatory Compute revenue, plus a mark-to-market gain on the same dollar
The salvation sold Time taken off the afterlife AGI, alignment, civilization rescued, cure disease, reduce labor, blah blah blah
The half you can audit 70,000 coins found beneath Scandinavian church floors Amazon’s 16.8 billion dollar mark, booked in the open
The half you cannot The grace. Never recoverable The capability claim. Never independently proven
The trinity Mints the coin, sells the salvation, writes the law of usury Mints the token, sells the salvation, writes the safety framework

Where This Ends is Ugly

An institution that mints the money, sells the salvation, and writes the morality of money holds all three levers with no independence or separation. Nothing inside would work to pry them apart. The medieval version did not reform by memo. It was Luther who nailed the indulgence (the AI double-booking of his day) to a door in 1517. Then a brutal correction unfolded over the next hundred and thirty years. Princes seized the mints and the monastery lands. The wars of religion ran into the Thirty Years War, which emptied as much as a third of the German lands in the worst regions.

The act of “disestablishment” (prying mint and salvation away from the sword) was Westphalia in 1648.

The AI labs clearly are bringing back the trinity and infusing it into the state: we just saw an export ban on who may run a model, we just saw empty warehouses permitted as datacenters and ruled as critical infrastructure, with the national-security frame doing all the consecrating. They may as well say national holiness. Elon Musk may as well be called the holy emperor of SpaceX, presiding over what looks like the biggest fraud in history. The records are blunt about the very high price of undoing the Church coin collapse. Elon Musk isn’t going to disestablish himself any sooner than he will admit he isn’t going to achieve driverless by 2017 or land on Mars by 2018.

Someone has to seize the AI tokens before more people die from AI. Or to put it how was said a very long time ago:

Doch schweig ich noch von dem, was ärger als der Tod,
Was grimmer denn die Pest und Glut und Hungersnot:
Daß auch der Seelen Schatz so vielen abgezwungen.

Andreas Gryphius wrote that in 1636, mid-war, which reads: “and yet I stay silent on what is worse than death, grimmer than plague and fire and famine: that the treasure of the soul was wrested from so many.”

The AI token is today’s Seelenschatz: sold as salvation, never proven, never refunded. The medieval fix wasn’t a stronger emperor. That kind of escalation always fails. It was prying the mint, the salvation, and the sword into separate hands and holding the line. Separate the AI Church from the State before the unauditable claim bills us in death again.

Poetry, Security

@BenHodgesUpdates: How to Spot YouTube Spreading Russian AI Propaganda

1 Comment

YouTube has been surfacing a LOT of synthetic war content lately, and the attribution question deserves more care than the platform gives it. The @BenHodgesUpdates channel is not Hodges, not affiliated with him, and the production cadence is impossible for genuine interviews. Whether it runs for ad revenue or for Moscow, or both, matters less than you’d think, because hyper-inflated Ukrainian victory content serves Putin’s KGB-trained interests either way: saturate the audience with imminent Russian collapse, and every week reality fails to deliver erodes trust in the real analysts whose names were stolen to sell it. President Wilson’s propagandists understood this in WWI, and so do the YouTube content slop factories perhaps sitting in Texas and Florida.

This unauthorized impersonation channel is reportable under YouTube’s impersonation and misleading-content policies. And you should report it. But more importantly you should ask why YouTube engineering doesn’t flag such dangerous integrity breaches of their platform.

Start with the channel description, which ends with “For business inquiries and partnerships: [Your Email Address Here]”. A template that for years never filled in this obvious blank, is a giant flag all on its own.

Then look at the timing and monetization model. The channel joined November 20, 2022, yet all 14 videos were rushed in the last four weeks at roughly one per day. That’s an aged or purchased account repurposed for a content farm. And every video is a 23–29 minute “exclusive” with the same general. Past the eight minute mark YouTube permits mid-roll advertising, meaning a daily half-hour of synthetic narration is for revenue generation on fraud, not interview scheduling. Compare it with the real Ben Hodges who does real interviews (Ukrainer, CNBC, BBC, Silicon Curtain). No General, including him, runs a daily half-hour sit-down interview pace like this.

And what about the data? I see 15.8K subscribers and 340K views off 14 videos in three weeks, consistent with the documented wave of AI-narrated Ukraine war slop channels that clone the voices of Hodges, Petraeus, and similar figures over stock footage.

Content fails as well. Titles are “Ukraine Just ERASED Putin’s Crown Jewel… BLINDS Putin’s Nuclear Fleet FOREVER | Gen Ben hodges”, with inconsistent capitalization across uploads (“Ben Hodges”, “ben hodges”, “Gen Ben hodges”), a dropped-letter typo (“ULEASHED Hell”) of the kind language models almost never make, betraying the human hand retyping machine output into the upload form, as well as ellipses, all-caps panic verbs. It’s lighting up as hallmarks of machine-generated titles, only lightly supervised.

Source: YouTube

We haven’t even clicked into a video yet and already it’s a clear takedown case, built on an account that sat aged for years before activation three weeks ago.

The pipeline of metadata convicts the channel on its own. Hello YouTube? Hello?

Now, the juicy part. What about content spread by the channel? Before I begin, let me refer to my two degrees with a specialization on asymmetric conflict and disinformation. That’s not an appeal to any sense of authority, rather to say what follows isn’t a light skill picked up in a day. I highly recommend study and practice of this subject, as you will see improvements in your own ability to detect subtle threats. That being said, YouTube could easily detect this with some simple engineering by experts and expert tools.

  1. The seed: a bridge near Chonhar connecting occupied Crimea with Russian-controlled southern Ukraine was damaged in a Ukrainian drone strike overnight on June 7, confirmed by the Ukrainian military, and a second drone strike on June 9 halted traffic again, followed by a reported missile strike on the Henichesk–Arabat Spit bridge early on June 10. Note that June 7 is confirmed by Kyiv with video, then June 10 rests on the Russian occupation official Saldo, and the June 11 reports of bridges hit at Armiansk and Krasnoperekopsk trace back to social media posts relayed by news aggregators. The script bases its loudest point of certainty on the least confirmed ones.
  2. The laundry: the commander of the 1st Separate Assault Regiment said the Chonhar strike was carried out specifically to cut fuel supplies to the Russia’s 37th Motorised Rifle Brigade.
  3. The gap: the drone strikes punched roughly one-metre holes in the bridge deck while the structural ribs were not compromised, and there is no confirmed evidence the bridge has been destroyed; the immediate military effect remains difficult to assess independently. Russian engineers were already running a pontoon crossing at Chonhar, visible in satellite photos. The script converts that into “permanent damage,” six bridges “rendered operationally useless,” and 110,000 troops in a “logistical trap.” Note the title says 80,000. The script says 110,000. Can’t be both.
  4. The fog: Pantsir blind spots “mapped and cataloged,” electronic warfare signatures “recorded and analyzed,” a four-hour attack wave from midnight to 0400, “weeks of patient, methodical intelligence collection.” No public source contains any of this. It’s the texture of analysis without sources, which means an LLM hallucinating a dense fog to disappear the real headlines.
  5. The artifacts: the interview has no interview. No questions, no first-person voice of a retired three-star. It’s omniscient-narrator machine-generated prose that has “Gen. Ben Hodges” stapled to it, so thinly connected it could be Donald Duck.

Now let’s go deeper into the ruse, as a logic test of integrity. An analytic framing blows the script apart.

  • Bad addition: Title: 80,000. Opening: 50,000 mainland plus 60,000 Crimea. Which?
  • Bad geometry: The “encirclement” claim depends on Kerch Bridge being the only supply route other than Black Sea ferries to 50,000 mainland troops. But cutting Crimea crossings isolates Crimea, not the other way around (the mainland). Forces in Zaporizhzhia and Kherson are supplied through their eastern land corridor from Rostov through Mariupol, Berdiansk, and Melitopol. It’s common sense, really. And the script admits as much because the land bridge is slipped out as a shift of supplies to “Russian port logistics along the Sea of Azov coastline”. The real General Hodges would be talking about the land corridor as the target, meaning hype about a Crimea artery doesn’t square his circle.
  • Bad timeline: The opening states “between June 9th and June 11th… six bridges in 48 hours,” then states Chonhar was first struck with significant damage “in the days preceding June 9th”. The 48-hour window is a hallucination contradicted minutes later. Also, since I was quite open on this blog about naval drone strikes in 2023 (as well as Elon Musk being Putin’s muppet, and the October 2022 unmanned surface vessel raid on Sevastopol that opened the genre after a Neptune missile sank the Moskva) let me point out another tell. This script says strikes were “in 2023 and 2024”. Nope. The drone strike was July 2023, full stop. The next successful attack came in June 2025 and it was no drone: SBU agents spent months mining the underwater supports and detonated 1,100 kg of TNT equivalent at 4:44 in the morning. Nothing landed in 2024, and that gap year is well-known for well-known reasons.
  • Bad physics: The claim “pontoon bridges cannot carry main battle tanks at scale” is dumber than rocks. Russian PMP ribbon bridging is for… tanks. The actual problem is being vulnerable to attacks, not basic operations.
  • Bad strategy: When the script says “none of this happens overnight” it clashes with its earlier claim that Ukraine reports “direct operational consequence” of day old strikes is “observable reductions in incoming artillery fire”. Which is it?
  • Bad source: We have no confirmed evidence the bridge has been destroyed. The effect is still hard to assess, while we do know the deck has one-meter wide holes in it. Meanwhile the script floats all kinds of intelligence detail with zero evidence, about Pantsir maps of blind spots and EW signatures, attack waves, contingency doctrines, share of traffic and re-rerouting… none of it sourced.

The method of military intelligence spreading disinformation, since at least President Woodrow Wilson’s efforts in WWI, has been to take a checkable fact and surround it with unfalsifiable details.

After WWI Edward Bernays left Wilson’s Committee on Public Information to sell the same methods to corporations. By his own account, a foreign correspondent told him in 1933 that Goebbels kept Crystallizing Public Opinion in his library and was using it as a basis for the campaign against the Jews of Germany.

The effect of this YouTube channel is a hallucinated geography taped together from a few precise details.

A real analysis channel with a real General would be the exact inversion, where the details are not exact yet the geography is always right.

The real Ben Hodges. First person, accountable, and picking fights with the Germans, under his own name. The Russian Navy “hiding behind Crimea even though Ukraine has no Navy” read as hyperbole, and then as prophecy once the Black Sea Fleet was devastated and fled Sevastopol.