View
Recent
Everything published, newest first, with project updates and standalone articles together.
Checking fiventhree.com for the October 2026 Node CVEs
A routine ask: make sure nothing on the VPS was exposed to recent Node.js or PHP CVEs. There was no PHP to check, and Node turned out to be running an end-of-life line that a real security release had just skipped over.
Consolidating the project pages, and the YAML bug hiding underneath
Vault and the portfolio were never separate infrastructure, so their project pages became sections of The 5N3 Domain instead. Along the way: a project page with a blank title in the editor, traced to an unquoted colon that a hand-rolled parser never minded and a real YAML parser refused outright.
Setting up Decap CMS, and the four things that broke
Adding a graphical editor to the Blog meant no new database and no format migration, since Decap just commits to the same markdown files. Getting GitHub, Caddy and Docker to actually agree with each other took four separate fixes.
A full security audit of fiventhree.com, and the bug it found
An external and internal audit of the whole domain, five subdomains in. Most of it held up. One header fix turned out to be silently ignored in production for a reason worth knowing about.
Six layers behind \"the Wi-Fi in my room isn't working\"
A guest's one-line complaint sits on top of a GPON access platform tracking per-subscriber state across six independent layers. A near-pattern in the service numbering, trusted instead of checked, took a working room down and then explained exactly why.
Chasing wasted pixels: making Konsole behave like a desktop widget
btop looked cramped in a Konsole window, and the obvious suspect was the CPU box itself. A screenshot showed otherwise. Two rows of chrome above the terminal content were doing the damage, and they lived in two completely different settings dialogs.
Widening the same tunnel: a directory, a hypervisor console, and a redirect loop that wasn't mine to fix
The WireGuard bridge that reached Jellyfin got two more stops added to it, a hypervisor console and a download manager, plus a small directory page to find them from. Along the way, a routing tool that updates one table but not the other, a bind mount forgotten twice in two days, and a redirect loop that turned out to be somebody else's nginx.
A Fedora reference, built while moving my daily driver over
The commands worth keeping close after switching a daily-driver laptop to Fedora, from dnf5 and rollbacks to the SELinux and Btrfs gotchas that catch people who assume it behaves like the last distro they used.
Building a personal IT knowledge base that outlives the chat window
I kept solving IT problems and forgetting how. The fix was a separate Markdown repository that holds my own troubleshooting history, with a rule that the AI writes the notes but never becomes the memory.
Reaching the media server from anywhere: a WireGuard bridge to the VPS
The media server has no public IP and lives behind a segmented internal network. A WireGuard tunnel, reused rather than duplicated, made it reachable at a real domain. A stale Docker bind mount nearly undid it on the very first deploy.
yt-dlp: the downloader that understands modern streaming
A browser or a normal download manager chokes on modern streaming pages because the video isn't one file anymore. This explains HLS fragmentation, the yt-dlp flags that actually matter (parallel fragments and cookies included), and where the tool fits into a self-hosted media stack.
The HP 1910 hides its own CLI: recovering and deploying a JG348A
A web-managed switch with a full Comware CLI locked behind an undocumented command. Password recovery from BootROM, unlocking the hidden shell, the legacy SSH negotiation modern clients refuse, and the hybrid-port default that silently leaves VLAN 1 on every voice port.
Four sites, one VPS: how fiventhree.com actually got deployed
The whole domain went live on a single server in one evening. Here is the topology, the order I did things in, and the four things that broke, including the one where three sites returned 404 while the fourth worked perfectly.
Switch field guide: Huawei and HP Aruba, side by side
The commands I actually reach for during production migrations: two CLI dialects compared task by task, a DHCP failure workflow that has never let me down, and the trunk mistake that cost me half a day.
The media server that taught me infrastructure
It started because the gym WiFi was too slow to stream anything. One month, one dead SAN and two rebuilds later it had taught me Linux, Docker, ZFS, virtualization, VLANs and multicast, and none of the hardware was ever mine.
Wireshark: Traffic Analysis (TryHackMe write-up)
Hands-on packet analysis: detecting Nmap scans, ARP poisoning, DNS/ICMP tunneling and cleartext credentials, with the exact Wireshark filters used for each.
Building this blog
Why this journal is a folder of markdown files and one build script, with no framework, no database and no dependencies.