I got the following ominous sounding message as I was about to fire up my Opera browser at the office today:

A short story detailing my experiences with hackers, SIGINT and the inherent depravity of humankind. In truth though, this story may lack all the aforementioned ingredients.

The lonely onion

A year ago I decided to offer my visitors “absolute” privacy in the shape of a Tor hidden service. Believing others were as fed up as myself with the constant mining of our personal data, I was eager to see what kind of traffic my hidden service would receive.

During the last few days I’ve been noticing a major surge in botnet traffic probing for the infamous Apache Struts 2 exploit, popular database setup and configuration scripts and even some old school cgi-bin vulnerabilities. The traffic originates from compromised hosts with major cloud vendors like Microsoft Azure, DigitalOcean, Vultr, Linode and OVH.

Accessing internal services on paranoidpenguin.net using self-signed certificates does no longer work in my preferred browser due to HSTS preloading. Instead of actually fixing the issue (or wait for Let’s Encrypt to roll out wildcard certificates), I decided to be clever and work around the restriction by installing a more “forgiving” web browser.

I recently re-learned that moving code from one Linux distribution to another doesn’t always pan out as expected. Especially when that second distribution is Red Hat Enterprise Linux.

To start the weekend off with a bang my Apache webserver failed to revive after the log rotation service had issued a restart. I’m hosting this website on a Raspberry Pi 3 so my first concern is always memory card corruption and data loss. Thankfully those fears turned out to be unfounded, but what actually went down?
From the httpd error_log:

I decided I wanted to host my WordPress installation as a hidden service on Tor instead of backporting all my existing content to Hugo. I previously ran Hugo on my onion site and even though I still want to make that move eventually, for now, I’m sticking with what I already know. Besides, putting arguably the worst content management system ever invented on the dark web seemed like a fun venture.

Lately I’ve noticed a steady increase in the amount of referrer spam I’m getting, so I decided to see if there was a simple way to trap and ban these bots. The typical approach is usually to maintain a blacklist of domain names and deny them using mod_rewrite rules. The downside to this approach is the amount of time and effort that goes into maintaining your blacklist.

I recently bought a new Raspberry Pi 3 and installed Slackware ARM current (hard float) on it. My goal was to compare the performance of the hard float port against Slackware ARM 14.2 (soft float), which is currently powering this RPi3 hosted website.

That tag “stuff” is not working on our corporate website, please fix asap the costumer complained. Sure, will do immediately I replied confidently, believing this to be a simple matter of purging some old cache or refreshing permalinks. Sadly that was not to be the case so I ended up having to get my hands dirty. To my absolute horror, the site was running one of those godawful themeforest themes.