Donnie Yen is a globally celebrated Hong Kong actor, action director, and master martial artist who has had a massive impact on modern action cinema. He is best known for starring as the legendary Wing Chun grandmaster in the critically acclaimed Ip Man film series, a role that cemented his international superstardom. Western audiences will likely recognize him from his standout performances in major blockbusters, such as the blind warrior Chirrut Îmwe in Rogue One: A Star Wars Story and the deadly assassin Caine in John Wick: Chapter 4.

So I rushed to the restaurant which was not far from me, ordered something to have a seat, and was hoping for an autogram. I heard earlier photos are not allowed. Downstairs people were arriving and eating and had no idea who is upstairs…

Not too much time later Americans started to come down the stairs and were talking about Miami. In the middle there he was wearing a baseball cap…

descending the staircase with a quiet, undeniable magnetism. It wasn’t the flashy, manufactured entrance of a movie star, but the grounded, effortless glide of a man who has spent a lifetime mastering his own physical space. Every step down those stairs felt intentional, radiating that calm, focused intensity I had only ever witnessed through a screen. I watched him, he watched me.

As he reached the bottom, the surreal suddenly collapsed into reality—he was walking right next to me. I heard earlier that photos are not allowed so I asked for an autogram but two security quickly stood in front of me and answered not possible.

To the rest of the world, he was the grandmaster, the untouchable cinematic legend, but in that fleeting, beautiful moment, we were just two people sharing the same path toward the exit. I could feel the gravity of his presence, a palpable energy that felt both incredibly humbling and deeply inspiring. He didn’t need to throw a strike or speak a single word; just sharing those few, brief strides with Donnie Yen before the heavy doors pushed open to the outside world was enough to leave a permanent, awe-struck imprint on my memory.

I rushed to my car hoping for shooting a picture while he is waiting for his minivan, but I only could capture his leaving most probably for his movie set…

You might be a little disappointed that I don’t have a photo to share as proof of this incredible encounter. Ultimately, I chose to respect the security crew's boundaries and keep my phone tucked away. But looking back, I am so glad I did. Some moments are simply too profound to view through a camera lens, and getting to live that surreal, silent walk to the exit entirely in the present is a memory I will cherish far more than any picture…

But then I noticed something strange, and slightly alarming.

• If you plug your Raspberry Pi (in this article I always will talk about the Pi 1) into the wall, without plugging the USB hub into its own power supply, the hub’s LED lights up.

• Conversely, if you plug the hub into the wall but leave the Pi unplugged, the Pi’s LEDs also light up!

Your intuition should scream: “Something’s wrong!”

You are exactly right. You have encountered a direct energy flow where none should be. Let’s talk about why this is dangerous and, more importantly, how you can fix it safely, easily, and reversibly with a tiny piece of tape.

The Danger of the “Direct Energy Flow”

This phenomenon is known as “backpowering” (or back-feeding). It happens because many budget-friendly powered USB hubs cut costs by omitting a simple component: a diode on the upstream USB connection.

This diode is supposed to let data flow both ways but only let power flow one way (from the host to the hub). Without it, the 5V power line in your USB cable is essentially a wide-open bridge between two different power supplies.

Your concern about “fighting” voltages is 100% correct. No two power supplies output exactly the same voltage. One might be 5.01V, and the other might be 4.98V. This sounds tiny, but in the world of regulation loops, it’s a disaster.

The power supply with the higher voltage will constantly try to push current backward into the regulator of the other power supply, which is now acting as a current “sink.” This causes several serious issues:

• Unstable operation: The regulators can’t stabilize, leading to voltage ripple.

• Overheating: The “sink” power supply will generate excess heat as it fights the incoming current.

• Component stress: This constant “back-and-forth” dramatically shortens the lifespan of both power supplies.

• SD card corruption: Power instability is the leading cause of corrupted Raspberry Pi SD cards.

In my case, I was running an SDR and a Wi-Fi dongle—two very power-hungry devices—but it was working fine without crashes.

The Solution: Severing the Power Bridge (Without Surgery)

The goal is simple: We need to sever the 5V connection between the Raspberry Pi and the USB Hub while leaving the two essential data lines and the common ground connection intact.

There are two ways to do this:

1. Cable Surgery: You can carefully slice open the USB cable, find the red wire (the 5V power line), snip it, and tape it off. This is permanent, and if you mess up, you’ve ruined a cable.

2. The Tape Trick (Our Weapon of Choice): You can physically block the 5V contact pin inside the USB plug with a tiny piece of non-conductive tape. This is completely reversible and much less stressful!

How to Perform the “Tape Trick”

This method is incredibly elegant, but it is also a delicate operation. The pins inside a USB plug are tiny and close together.

What You’ll Need:

• The USB cable that connects your Raspberry Pi to the USB Hub. You are modifying the Standard USB-A plug (the flat, rectangular one) that plugs into your Pi.

• Ultra-thin non-conductive material. * Standard electrical tape is usually too thick and will prevent the USB plug from seating properly, disconnecting your data.

  • Use Kapton tape (the yellowish electronic tape) or clear Scotch tape (office tape). In my case, I successfully used thin office tape.

• Tweezers or a fine-tipped needle (essential for positioning the tape).

• Scissors.

Step-by-Step Guide:

1. Identify the 5V Pin (Pin 1)

Look into the end of the male USB-A connector. Orient the plug so that the plastic tongue (the block with the four metal strips) is on the bottom, and the empty space is at the top.

The metal strips (pins) are numbered 1 to 4 from right to left:

• Pin 1 (Far Right): 5V Power <-- OUR TARGET

• Pin 2: Data -

• Pin 3: Data +

• Pin 4 (Far Left): Ground

2. Cut the Tape

You need to cut a tiny, rectangular sliver of your thin tape. It must be wide enough to cover Pin 1, but only Pin 1. It should be about 1–2mm wide and about 1cm long.

3. Apply the Tape

Using your tweezers, carefully slide the tape sliver over only the far-right metal strip (Pin 1). Make sure you don’t cover the neighboring Data- pin (Pin 2).

Gently press the tape down against the plastic tongue using your tweezers or the tip of a toothpick. Fold any excess tape over the front edge of the plastic tongue and tuck it underneath so it stays firmly in place when you plug it in.

4. Test and Verify

Plug the freshly taped cable into your Raspberry Pi. The tape is your physical power-break.

1. Plug ONLY the USB hub into its wall adapter. Look at your Raspberry Pi. If the modification worked, the Pi’s LEDs should stay OFF.

2. Now, plug your Raspberry Pi into its own wall adapter. The Pi should boot normally.

3. Check your peripherals. If the tape is positioned correctly (not blocking the data pins), the Pi should still be able to “see” your Wi-Fi dongle and SDR on the hub.

Success: The plugged in USB Hub is no longer backpowering the Pi 1.

Conclusion: Electrically Safe

By using this simple “tape trick,” you’ve created the perfect isolated setup. Your Raspberry Pi and USB Hub now each run from their own dedicated power supplies, eliminating any dangerous backpowering loop. This dramatically increases the reliability and longevity of all your hardware.

Best of all, you didn’t have to permanently destroy any cables or spend money on expensive “data-only” adapters. If you ever need to use that cable normally again, you just peel the tape off. It’s the kind of simple, elegant solution that makes DIY projects so rewarding!

Now, I’m pretty sure it wasn’t Santa (wrong season) or a UFO (well, not officially). It was definitely too fast and non-blinky for your average plane. Also, as an aviation geek and a flightradar24 contributor I was sure it was not a plane.

I whipped out my phone and fired up the "See a Satellite Tonight" app. I'm usually better at identifying pizza toppings than orbital objects, so I was hopeful.

Sorry for the bad image, but I was not prepared for astro-photography. The fast moving bright object is visible in the middle of the picture.

And what do you know? The app actually worked! It confirmed my suspicions and identified the elusive object.

The app confirming I wasn’t just hallucinating a very fast bird.

So, what was this high-speed, non-blinking, after-sunset superstar? None other than a USA 120 military satellite! Probably a spy satellite, according to my quick (and highly scientific) Google search that followed.

Proof that I was, indeed, being ‘spied’ on... sort of.

So there you have it, folks. I spent my evening getting watched by a classified piece of military hardware, and all I got was this lousy blogpost.

This week, I completed a dual-node architecture that splits the workload between Network and Storage. It ensures my network never lags, my downloads never stall, and most importantly, it pays for itself by replacing expensive cloud subscriptions and commercial hardware.

Here is the full breakdown of the Silicon, Speed, and Savings.

💸 The Economics: How It Pays for Itself

I am earning money with resource sharing: Since 9th of Sept. 2025 until 9th of March 2026 I earned 34.587 USD, that’s about ~60 USD a year on my account (removed some downtime and transfer costs).

I pay for the Internet anyways, so I am not considering that as a cost.

I asked Gemini to calculate the electricity cost of my homelab based on my electricity bill and the consumption showed by my USB Tester. It was about ~ 6 USD a year, if I include my FR24 Feeder, let’s make it ~9.54 USD.

Domain name yearly fee: 10.46 USD. SSL, email, etc is for free.

So in the end I still have ~ 40 USD which can cover the Internet for almost a quater year. I think not bad! I have my little playground not just for free, but also earning some coins.

🟢 Node 1: The Gatekeeper (Network & Security)

Hardware: Raspberry Pi 4 | OS: OpenWrt

This node is dedicated to one thing: Pure Packet Performance. It manages my 300 Mbps connection with surgical precision.

1. OpenWrt + SQM (The Lag Killer)

I’m running Smart Queue Management (SQM) with the Cake algorithm. This actively manages the data buffer to prevent congestion.

• The Result: I can download at full speed while gaming, and my ping stays rock-solid at 7ms. My Bufferbloat grade is a perfect A+.

2. AdGuard Home (Secondary)

Running directly on the gateway, a second setup of AdGuard Home acts as a redundant DNS sinkhole for the entire house.

• Function: It blocks ads, trackers, and telemetry before they even reach my devices.

• Performance: It saves bandwidth and speeds up browsing for every phone and laptop on the WiFi.

3. ntopng (Deep Packet Inspection)

This gives me Layer-7 visibility into my network. I don’t just see “traffic”; I see “Netflix,” “Zoom,” or “Steam.”

• Load: The Pi 4 analyzes traffic flows at ~300 Mbps in real-time, hitting ~80% CPU load to keep me informed.

4. Beszel Agent (The Pulse)

A lightweight monitoring agent. Unlike Prometheus or Grafana which can be heavy, Beszel is resource-efficient, reporting the router’s health (CPU, RAM, Temps) back to the hub without impacting network throughput.

5. Restic snapshots

Once a week a new snapshot is saved to my 3S cloud storage backing up my whole system.

🔴 Node 2: The Vault (Storage & Logic)

Hardware: Raspberry Pi 4 + ADATA SD600Q SSD | OS: Raspberry Pi OS

This node handles the heavy data lifting. I bypassed the standard SD card limitations by booting from an SSD (with usb-storage.quirks applied to fix UAS instability).

5. Transmission (The Speed Demon)

The crown jewel of the setup. Writing data to a USB drive usually crashes the system due to high I/O wait.

• The Tuning: I increased the RAM Cache to 128MB. The Pi buffers chaotic data in memory and writes it to the SSD in smooth, linear chunks.

• The Result: A sustained 22 MB/s (176 Mbps) write speed—hitting the practical physical limit of the USB driver.

6. Samba (The Universal Translator)

I configured a high-performance SMB Share (/media/ssd/).

• Permission Matrix: I created a sambauser group that unifies access. Whether it’s my Windows PC or the Transmission daemon, everyone has full Read/Write (775) access. No more “Permission Denied.”

7. SFTP (The Secure Tunnel)

For remote file management, I run an SFTP Server.

8. DLNA / MiniDLNA (The Streamer)

This turns the Pi into a plug-and-play media server.

• Function: My projector and other devices instantly detect the network folder. No transcoding, no buffering.

9. Beszel Hub (The Dashboard)

This is the command center.

• Function: It collects data from the Beszel Agents running on both Pis. I get a beautiful, single-pane-of-glass dashboard showing CPU load, disk usage, and Docker stats for the entire lab. And the most important: I immediatelly get an automated alert if anything reaches my pre-defined treshold.

10. AdGuard Home (Primary)

Running directly on the gateway, AdGuard Home acts as a DNS sinkhole for the entire house.

• Function: It blocks ads, trackers, and telemetry before they even reach my devices.

• Performance: It saves bandwidth and speeds up browsing for every phone and laptop on the WiFi.

11. Restic snapshots

Once a week a new snapshot is saved to my 3S cloud storage backing up my whole system.

12. TrustTunnel

This one is in experimental phase. In some rare cases I was unable to connect home via WireGuard. I am experimenting with a stealth VPN what cannot be detected, therefore cannot be blocked.

13. Node-RED with Z-Wave JS UI

Some local home automation stuff. Maybe for a future post?

🔵 The Glue: External Access

14. WireGuard (The Teleporter)

I don’t open ports. I use WireGuard to create an encrypted tunnel back home.

• Performance: Unlike OpenVPN, WireGuard runs efficiently in kernel-space. This low-overhead approach makes it incredibly fast; it feels like I’m on local WiFi even when I’m on 5G.

15. Cloudflare + ddclient (The Locator)

To keep my VPN connected despite a dynamic IP, I use ddclient.

• The Config: It automatically updates via the Cloudflare API.

Conclusion

This system is the definition of “set and forget.”

The Router works hard so the network feels effortless.

The NAS pushes the physical limits of USB I/O to deliver content instantly.

The Monitoring gives me God-mode visibility.

It’s quiet, it’s cool, it’s a hobby and most importantly—it pays for itself.

WireGuard is incredibly easy to detect. Its packet signature is distinct, and because it usually runs over UDP, aggressive firewalls and Deep Packet Inspection (DPI) tools can spot it from a mile away. If you’re on a restrictive corporate network or a public Wi-Fi that blocks non-standard ports, WireGuard gets crushed instantly.

I didn’t just want encryption; I wanted camouflage.

So, I tore down my old setup and built something new. I replaced my standard VPN with a stealth tunnel that masquerades as regular HTTPS web traffic.

Let me introduce TrustTunnel to you.

The philosophy of this upgrade was simple: If you look like a website, you don’t get blocked.

My new setup uses HTTP/2 for transport. To any network administrator, ISP, or firewall algorithm monitoring my connection, my data doesn’t look like a VPN tunnel. It looks exactly like I’m browsing a standard, secure website.

The packets are indistinguishable from a user scrolling through a tech blog or checking their bank balance. Because the entire world relies on HTTPS (port 443) to function, blocking my VPN would essentially require breaking the internet.

The Stack: Raspberry Pi + Stealth + AdGuard

I deployed this on my trusty Raspberry Pi 4, but the software stack is where the magic happens.

1. The Stealth Engine (TrustTunnel)

Instead of the standard UDP handshake of WireGuard, this engine establishes a TLS 1.3 encrypted session. It uses a real, valid SSL certificate (via Let’s Encrypt) and performs a cryptographic handshake that looks identical to loading a webpage.

There is no “pre-shared key” visible in the headers. There is no strange port activity. It is just a silent, persistent stream of HTTPS data.

2. Double-Blind Security

I implemented Certificate Pinning on the client side. This is crucial. My phone doesn’t just trust “any” server; it is hard-coded to trust only the specific cryptographic signature of my Raspberry Pi.

This makes the setup immune to Man-in-the-Middle (MITM) attacks. Even if a sophisticated firewall tries to intercept the connection by presenting a fake certificate (a common technique in restrictive environments), my client immediately drops the packets.

3. The AdGuard Home Integration

Since I was already routing my traffic home, I decided to clean it up. I configured the VPN to pipe all DNS requests directly into a local instance of AdGuard Home running on the same Pi.

The result?

* My phone connects to the Pi via the stealth tunnel.

* The Pi scrubs all ads, trackers, and analytics at the DNS level.

* Clean, encrypted traffic goes out to the internet.

I am not just invisible; I am browsing faster because I’m not downloading megabytes of ad trash.

The “Dynamic” Challenge

One hurdle was my home internet’s Dynamic IP. Hardcoding an IP address in a configuration file is a recipe for disaster—it works until your ISP decides to rotate your lease.

I solved this by setting up a Dynamic DNS (DDNS) script that automatically …

Unfortunately the server IP must be in X.X.X.X format for IPv4. To overcome this limitation I have set up Cloudflared Tunnel so after the rare event of public IP change I always can SSH in remotely to update the config.

The Verdict

WireGuard is great for speed, but this new setup is built for resilience.

Now, when I connect from a draconian coffee shop network or a restricted hotel Wi-Fi, I don’t cross my fingers and hope the UDP ports are open. I just connect. The network sees HTTPS, I see the open internet, and nobody is the wiser.

Digital freedom isn’t just about encryption anymore; it’s about blending in. And right now, my traffic is the best-dressed ghost in the machine. 👻

It works so far… But the real exam is coming up this year.

I’m planning for a trip to a certain "East Asian region" known for having one of the world's strictest internet attendance policy. If you see me online regularly, you’ll know the Ghost Protocol was a success. 💪

If not... well, send dumplings… 🥟🥢

If you have a home server, or a NAS that you need to access when you aren’t home, do not “Just port forward port 22 on your router.”

Opening port 22 to the public internet is like leaving your front door wide open with a neon sign pointing to it. Bots and hackers are scanning the entire internet 24/7 looking for open SSH ports to brute-force.

Furthermore, what if your ISP uses CGNAT? What if your IP changes daily? What if you move the device to your parents’ house? Port forwarding breaks instantly.

I need to relocate one of my servers where I cannot just use my home VPN.
Today, I’m going to show you the modern, secure, and frankly incredibly cool way to solve this using Cloudflare.

It’s free, it requires zero open ports on your router, and it works from anywhere.

The Magic: Cloudflare Tunnels

We are going to use a tool called Cloudflared to create a secure “tunnel” from your device out to Cloudflare’s network.

Think of it this way: Instead of opening a window in your house (port forwarding) and hoping only the good guys climb in, your server makes an outbound, encrypted phone call to Cloudflare and holds the line open. When you want to connect, you connect to Cloudflare, and they patch you through that pre-established line.

The best part? We are going to put a “lock” on that connection. Before you even see the SSH login prompt, you’ll have to authenticate with your email address via a web browser. It’s fortress-level security for your home lab.

Prerequisites

1. A Raspberry Pi (or any Linux machine) running at home.

2. A free Cloudflare account.

3. I used my domain name managed by Cloudflare (you can get cheap ones for a few dollars a year, I did not do research if there are other ways, but I guess have).

Step 1: Create the Tunnel in the Dashboard

We are going to do this the easy way, using Cloudflare’s Zero Trust dashboard.

1. Log into your Cloudflare dashboard and navigate to the Zero Trust section.

2. Go to Networks > Connectors and click Create a Tunnel.

3. Name it something recognizable (like home-pi) and select Cloudflared as the connector type.

4. Cloudflare will present you with installation commands for different operating systems. Select your architecture (usually Debian 64-bit or 32-bit).

You just copy that single command and paste it into your terminal. It automatically installs the service, links it to your account, and sets it to start on boot.

It literally just takes copying and pasting one command to link your Pi to the cloud.)

Once the connector is running, you’ll see it turn green in the dashboard. Click Next.

Step 2: Route Traffic to Your Pi

Now we need to tell Cloudflare where to send the traffic. We are going to assign a subdomain (like ssh.mydomain.com) that will point directly to the SSH port on your Pi.

In the “Public Hostnames” tab:

1. Subdomain: Choose something like pi-terminal.

2. Domain: Select your domain.

3. Service Type: Choose SSH.

4. URL: Enter localhost:”your_ssh_port”

Click Save Tunnel.

Telling Cloudflare to route traffic from a subdomain straight to the Pi’s internal SSH port.)

At this point, the tunnel is active. But it’s wide open. Anyone who visits that URL could try to guess your Pi’s password. Let’s lock it down.

Step 3: The “Cool Part” - Securing it with a Browser Terminal

This is where this setup becomes a game-changer. We are going to put an authentication layer in front of the SSH connection using Cloudflare Access.

As a bonus, we will configure it so we can get a full SSH terminal right inside a web browser—no plugins or SSH clients required on your laptop.

1. On the left sidebar of the Zero Trust dashboard, go to Access > Applications.

2. Click Add an Application and select Self-hosted.

3. Give it a name, and enter the exact subdomain you just created (e.g., pi-terminal.mydomain.com).

Now, we create a Policy. This dictates WHO is allowed in.

1. Name the policy “Admin Access”.

2. Set the Action to Allow.

3. Create a rule that says Include > Email > [Your Email Address].

Finally, the magic setting for browser access:

Go to the Settings tab of the application configuration, scroll down to Browser rendering, and set it to SSH.

The secret sauce. Enabling browser rendering turns Chrome or Safari into a secure SSH client.)

Click Add Application. You’re done.

The Final Result

So, how does it work in practice?

You are at a coffee shop, or on your phone, and you need to check your Pi. You just open a web browser and go to

https://subdomain.yourdomain.com

Instead of a scary terminal prompt, you are greeted with a Cloudflare login screen asking for your email. You enter it, get a 6-digit code sent to your inbox, and type it in.

Only after you pass that security check does Cloudflare render a beautiful, fully functional terminal right in your browser window, asking for your Pi’s username and password.

Success! A secure terminal, accessible from anywhere, with zero open ports on my home router.)

It’s secure, it’s robust, and if you move the Pi to a different network, it just automatically reconnects. Say goodbye to port forwarding forever.

Now I can relocate my server anywhere, and I will keep having remote access.

I just stumbled across a brilliant chemist named LabCoatz, who didn’t just try to guess the recipe—he used rigorous science to decode it. He spent an entire year using mass spectrometers (fancy science lasers) and analyzing chemical fingerprints to reverse-engineer the world’s most popular soda.

The result? Lab-Cola. And the video documentation of his deep dive into the chemistry is absolutely fascinating (and hilarious).

Watch the full breakdown here:

🚨 ACTUAL NEWS: You Can Buy the Concentrate 🚨

Here is the best part. If you don’t have a mass spectrometer or a year of free time, he is literally selling the result on eBay right now:
https://www.ebay.com/itm/317796601418

According to his latest update, the Lab-Cola Concentrate is back in stock.

• The Deal: It’s about $20 per bottle (plus ~$9 shipping).

• The Yield: One bottle of the science-juice makes 2 Liters of soda.

• The DIY Part: It comes with instructions, but you have to provide your own sugar and carbonated water.

• The Funny Print: He warned that shipping might be a little delayed because he is currently “waiting for more caffeine to arrive.” (Aren’t we all, buddy? Aren’t we all?)

Go watch the video to see a man decode a multi-billion dollar trade secret, and maybe snag a bottle on eBay before the caffeine withdrawal kicks in.

Last weekend, that was exactly my plan. I packed up my gear, grabbed my trusty 2017 DJI Mavic Pro, and headed out, visualizing the shots I was about to get.

But the flight never happened.

When I pulled out the remote controller (Model GL200A), the screen was dark. I pressed the power button: nothing. It was completely dead. I was confused—I distinctly remembered charging it to 100% about six months ago before storing it. It turns out, this controller has a surprisingly high parasitic drain (leakage), and sitting on the shelf for half a year had drained it from full to absolute zero.

Interestingly, the drone's own "Intelligent Flight Batteries" do not have this issue.

Disappointed and grounded, I went home without a single photo. Had this deep discharge killed the battery? Lithium-polymer batteries hate sitting at 0%, and this is an older device from 2017.

I decided to run an experiment. I plugged it into a USB tester to monitor the charge cycle from 0% back to 100% to see if the battery still held its rated capacity.

The Specs vs. The Reality

First, I checked the label on the back of the controller to see what I should expect.

• Model: GL200A

• Rated Battery: LiPo 2970mAh (3.7V)

I let it charge for over 3.5 hours, watching the numbers climb on my USB tester. When the controller finally beeped and displayed that satisfying “BAT 100 PCT”, I looked at the final stats on the meter.

The Results

Here is what the KWS-MX17 tester reported after the full charge:

• Charging Time: 03:36:46

• Energy Input: 13.973 Wh

• Capacity Input: 2,906 mAh

The Verdict

I was honestly surprised. The rated capacity of the internal battery is 2,970 mAh. The measured capacity pumped into the device was 2,906 mAh.

While USB metering isn’t a perfect 1:1 measurement of internal cell capacity (due to voltage conversion inefficiencies between the 5V USB input and the 3.7V battery), these numbers are incredibly close. The fact that the controller accepted nearly 14 Wh of energy to fill a battery rated for roughly 11 Wh (2.97Ah x 3.7V) suggests the cells are taking a full, deep charge.

Despite the age of the drone and the harsh drainage, the battery health seems remarkably solid. It retained nearly all of its effective charging capacity.

Lesson learned: The 2017 Mavic Pro is still OK, but that controller needs a maintenance charge every few months. The Balaton ice will have to wait for next time, but at least I know my gear is ready to fly.

If it’s A+, congratulations, you can skip this post.
But if not, then “Much to learn, you still have“.

Welcome back! In my previous post, I detailed the process of building My Own Legendary Custom-built OpenWrt Router. It’s a beast of a little machine, offering way more processing power than typical consumer gear.

But raw CPU power is only potential until you actually configure it. Today, I’m sharing the results of putting this setup to the test on my 300/20 Mbps DOCSIS (Cable) connection.

(Long story short: I pay for this because even the gigabit package offers only max 50 Mbps up - in theory. And up is important to me. The main problem is that there is walkway between the street and my house. And you guessed correctly, the ISP only provides Internet on the street. Because of this any network upgrade means “infrastructure investment” from ISP point of view, what they are willing to do for entire city blocks, but not for my house only… And to be honest I can live with this so far…)

Now back to the topic. The journey required troubleshooting both physical hardware and tweaking advanced software software settings, but the destination is incredible network stability.

The Real Enemy: Jitter and Bufferbloat

When I first set up the network, my baseline ping was surprisingly high. I am using two Deco units for wireless coverage, and initially, they were linked together wirelessly. The solution was simple but essential: I ran an Ethernet cable between the Deco units for a wired backhaul. This immediately dropped the baseline ping, providing a solid foundation for the rest of the tuning.

The next issue became apparent during heavy usage: Jitter.

While “Ping” is the time it takes for a signal to travel to a server and back, “Jitter” is the variance in that time. If your ping is 20ms one second, then spikes to 150ms the next, that’s high jitter.

In the real world, high jitter is what makes remote work unbearable. It’s the cause of those moments in Microsoft Teams calls where everyone’s video freezes for three seconds and then speeds up like chipmunks to catch up. It’s what causes “rubber-banding” in online gaming. My network had plenty of power, but under load, it was unstable.

The Solution: SQM Cake and Precision Tuning

The cure for jitter and network spikes under load is Smart Queue Management (SQM). I used the modern “Cake” algorithm built into OpenWrt.

The goal of SQM is to prevent your cable modem’s internal buffers from filling up (a phenomenon known as “bufferbloat”) when you max out your connection. To do this, you have to throttle your connection slightly so that the Raspberry Pi controls the traffic queue, not the dumb modem.

My Configuration Strategy:

1. The 90% Rule: I set Cake to limit traffic to roughly 90% of my advertised bandwidth (Targeting approx. 270 Mbps down / 18 Mbps up). This leaves just enough overhead to ensure traffic flows smoothly without hitting the modem’s wall.

2. Link Layer Adaptation: This is where the fine-tuning happened. In the SQM settings, I enabled “Link Layer Adaptation.” Even though I am on a DOCSIS (Cable) connection, I used settings that added a small amount of packet overhead detection (Ethernet with overhead, 22 bytes).

   • Why do this? While DOCSIS doesn’t strictly require the same overhead calculations as DSL, adding this small “safety padding” ensures that packet sizes are calculated perfectly before they hit the wire. It acts as a buffer for the buffer.

Here is the exact configuration on the OpenWrt LuCI interface:

Pro Tip: Keeping the “Fast Lane” Clear with VLANs

To ensure my main OpenWrt Wi-Fi network stays streamlined, I segregated my IoT devices (smart plugs, sensors, cameras) onto the OpenWrt_IoT VLAN separated network. This does two things:

1. Security: If a cheap smart bulb gets hacked, the attacker is trapped in a quarantined VLAN and can’t access my personal computers.

2. Performance: Most IoT devices use older, slower Wi-Fi chips. By physically offloading them to a secondary AP, I prevent them from “clogging up” the precious airtime on my main Deco mesh. This leaves the high-speed 5GHz bands on the main network exclusively for my bandwidth-hungry devices like phones and laptops.

Bonus Tweak: DNS Optimization with AdGuard Home

Speed isn’t just about bandwidth; it’s also about how fast your browser can find the website you’re looking for. This is where DNS (Domain Name System) comes in.

To minimize the time it takes to resolve domain names, I ran a comprehensive DNS speed test to benchmark various providers against my specific location. The winner was clear: Cloudflare (1.1.1.1) consistently offered the lowest lookup times for my connection.

I immediately went into my AdGuard Home settings on my Home Lab and on the fallback router and changed the upstream DNS server to Cloudflare. Now, not only are ads and trackers are being blocked network-wide, but the “snappiness” of browsing—that feeling of a page starting to load the instant you hit enter—is noticeably sharper.

The Results: The Proof is in the Pudding

The tuning took some time, but the results speak for themselves. The network is now incredibly tight.

First, the standard Ookla speedtest. You can see I am hitting exactly the targets I set with the 90% rule: 271 Mbps download and 17.2 Mbps upload. The Raspberry Pi 4 handles this throughput without breaking a sweat. The charts were super flat as well.

The Holy Grail: The A+ Bufferbloat Grade

The real test, however, is the Waveform Bufferbloat test. This measures what happens to your latency when the line is totally saturated.

Look at that grade: A+.

During the test, the real-time speedtest charts were unbelievably flat. Usually, when a download starts, you see the ping line spike upward. Mine stayed perfectly horizontal.

• Unloaded Latency (20ms): My standard ping when the network is quiet.

• Download Active (+0ms): This is the holy grail statistic. It means when I completely max out my 300Mbps download pipe, my latency does not increase at all.

• Upload Active (+2ms): Maxing out my upload only adds a negligible 2ms of latency.

Stress Testing: Running ntopng in Background

☝️Here is the kicker: I achieved all of this while running ntopng on the router simultaneously.

For those who don’t know, ntopng is the Ferrari of traffic analyzers that provides real-time, high-speed web-based traffic analysis. It is resource-intensive software that monitors flows, protocols, and data usage in granular detail.

On a standard consumer router, enabling 7-layer deep packet inspection like this - IF it would be possible - would normally kill performance and introduce lag. The Raspberry Pi, however, didn’t flinch. It managed the heavy SQM calculations and the ntopng monitoring without dropping a single frame. This confirms that the RPi4 has plenty of overhead for enthusiasts who want total visibility into their network.

Conclusion

Before this setup, downloading a large game patch on Steam would make Teams calls stutter for everyone else in the house. Now, I can have a massive download running full blast while simultaneously being in a lag-free video call or playing a low-latency competitive game.

The combination of the Raspberry Pi 4’s processing power, wired backhaul for Wi-Fi APs, and precisely tuned SQM Cake has completely solved my internet connectivity issues.

Now if you experience Teams issues during a call with me,
you know the problem is not on my side… 😉

Earlier yesterday, I got a heads-up via his Facebook post that he was about to fly the Queen of the Skies from Baku to Amsterdam, with a flight path taking him right over Budapest following waypoints from BUDOP to BEGLA.

Normally, I’d just look up, but this was the perfect opportunity to stress-test my newly installed Flightradar24 (FR24) feeder.

The Setup & The Hunt

My humble ADS-B setup isn’t exactly military-grade yet; I’ve got a range of about ~70 kms. This meant I didn’t have all day—I had a very narrow time window to catch the signal as the 747 roared overhead.

Using the provided flight plan, I estimated his arrival time above Budapest and grabbed the call sign from an online database. Then, the waiting game began. I opened my feeder’s auto-refreshing dump page, eyes glued to the tracked database.

Right on schedule, the 4-engine giant pinged my receiver.

It appeared on my tracked aircraft list immediately. Success!

Following the Digital Breadcrumbs

Seeing the plane on my dashboard was cool, but I wanted to verify what was happening “under the hood.” My feeder’s stat page confirmed I was tracking flights and connected to the Flightradar24 servers.

But I also wanted to see the data flow myself. I opened up ntopng - the Ferrari of traffic analyzers - to see what is leaving my home. I filtered for my feeder’s local IP address and—boom—the flow was suddenly visible.

I could see my feeder holding a single, active connection, communicating busily with a Swedish IP address: 185.218.24.23.

A quick whois lookup on that IP confirmed the destination: 185.218.24.0/24 belongs to Flightradar24 AB.

(I have to admit, I was relieved to confirm it was actually FR24 and my feeder hadn’t just joined some random botnet 😂 ).

The Verdict

The big question remained: I was sending data, but were they using it?

I hopped onto the global Flightradar24 map and applied a custom filter to show only aircraft being tracked by my specific Radar ID. And there it was.

Although the heavy cloud cover over Budapest hid the physical aircraft from my eyes, my little antenna pierced right through the grey. I picked up Captain Szüle’s signal, verified the network packets leaving my home, and put the Queen on the map.

Mission accomplished. 💪

🏗 Phase 1: Building Life Support (Infrastructure)

Before I could even think about software, I had to establish a beachhead. My attic isn’t a room; it’s a torture chamber for electronics. In summer, it hits 50+ °C. In winter, it drips condensation. Dust covers everything like snow.

I couldn’t just run an extension cord and hope for the best.

• The Power Grid: I routed high-voltage power up to the rafters. Because of the condensation risk (the “drip zone”), standard sockets weren’t good enough. I deployed IP56-rated industrial plugs—dust-tight and water-resistant.

• Thermal Engineering: The Pi needed to breathe without inhaling a lungful of insulation dust. I utilized the Chimney Effect. I drilled intake and exhaust ports in the enclosure to encourage passive vertical airflow.

• The Filtration System: To stop the dust bunnies from shorting the GPIO pins, I fused mosquito screen mesh over every ventilation hole. It allows the heat to escape but keeps the hostile particles out.

Before the mission started, I had to assemble the rig.

• The Brain: A decade-old Raspberry Pi 1 Model B. Single-core, slow, and stubborn.

• The Ears: A generic RTL-SDR Stick (DVB-T Tuner) repurposed for 1090MHz.

• The Backbone: A Powered USB Hub. The Pi 1’s USB ports are too weak to power the radio alone; this external lung keeps the system alive.

• The Uplink: An ancient USB Wi-Fi Dongle. (No onboard Wi-Fi in the stone age of the Pi 1).

• The Sensor: A stock magnetic mount antenna... that needed “modification.”
  The stock antenna that came with the radio was tuned for watching TV, not tracking aircraft. It was “deaf” to the 1090MHz frequency I needed.

  I calculated the optimal 1/4 wavelength for ADS-B signals (~69mm). I grabbed a hand metal saw and performed radical field surgery, manually sawing the antenna tip off to the precise millimeter. It wasn’t pretty, but physics doesn’t care about aesthetics. It cares about resonance.

The bunker was ready. Now, I had to wake up the brain.

💀 Phase 2: The Digital Heart Attack

I booted the Raspberry Pi 1. Disaster.

The logs were screaming. Terminating child process... Connection terminated. The crash loop was happening every 5 seconds. The ancient single-core processor was hyperventilating, trying to process MLAT (Multilateration) calculations meant for quad-core beasts.

The Software Triage: I had to perform emergency surgery on the config file. I stripped the OS to the bare metal:

• MLAT: KILLED. (Too CPU intensive).

• Raw Data Streams: SEVERED. (Save the USB bandwidth).

• Result: The heartbeat stabilized. The Pi was running cool and steady. 🟢

📡 Phase 3: Breaching the Faraday Cage

The system was live, but the map was empty. Aircraft Tracked: 0.

The culprit? My roof insulation. It’s a metallic heat-mirror foil. Great for energy bills, but in the radio spectrum, it’s a Faraday Cage. I was effectively trying to listen to the world from inside a lead safe.

The Tactical Mount: I located a structural rafter running parallel to the window, safely outside the “Drip Zone.” I positioned the antenna tip to float exactly in the “RF Void”.

I connected the coaxial. I held my breath.

✈️ The Breakthrough: Contact

I refreshed the local feed. Boom. One plane. Then six. Then ten.

The signal was punching through the roof tiles, bouncing off the foil gap, and hitting my receiver loud and clear. From a “metal box” in a dusty attic, I was suddenly tracking trans-continental flights 70+ km away.

The Loot: Flightradar24 recognized the data stream and instantly upgraded me to the Business/Contributor Plan ($499/year value). 🏆

🛡 Phase 4: Immortality (The Golden Backup)

I wasn’t about to let a cheap SD card corruption kill this victory. I pulled the card and forged a “Golden Image” using Linux terminal sorcery:

Bash

# Clone the drive bit-by-bit
sudo dd if=/dev/sdb of=~/fr24_golden.img bs=4M status=progress

# Shrink the image to fit any future card
sudo ./pishrink.sh ~/fr24_golden.img

Now, if the hardware fails, I can restore the entire station in 300 seconds.

🏁 Mission Status

System: STABLE Environment: SEALED (IP56) Signal: STRONG Net Cost: NEGATIVE

While this ancient Pi 1 scans the skies, my secondary unit (a Raspberry Pi 3) is busy generating $60/year in passive income. This easily covers the electricity bill for the entire attic operation. The system pays for itself. I do not pay a coin for it.

The sky is no longer the limit. It’s just the data source. 📡✈️

I tried to log in to AustroControl, but there was no option to extend it so I asked them via mail. (Why Austria? I will let you know later below).

The reply quickly came and today, 16th of Dec I had some spare time. I checked back on their website and voila: “Verlängerung verfügbar”.

I did not prepare or review anything, just jumped into the exam right away. AustroControl offered the exam also in English (I found a typo in one of the questions though).
I passed the test with 92,50%, which is an improvement compared to the previous 80%. It took me a little more than 20 minutes out of the available 40 mins. Not bad.

The certificate arrived in my inbox after few minutes of waiting time.

I was ready to update this on the Hungarian Government site (and pay 4000 HUF for the modification), but the best part is that my license number remained the same! No modifications are required. Thanks for saving me that money!

Q: So why did I take the exam via AustroControl?
A: The A1/A3 certificate is generally accepted across Europe. In Hungary however, the exam costs 11400 HUF (~30 EUR today), but

• it is completely free in Austria

• it is online

• and also offered in English 🙃

I wanted the All-Seeing Eye—real-time analytics, enterprise-grade stability, network-wide ad-blocking, and a failover system that would make a sysadmin weep with joy. For the last few days, I embarked on a mission to do it all on a second-hand Raspberry Pi 4.

Most people said it only has one NIC. It would crash. They said the SD card would die in a month. They were wrong. Here is how I built the Holy Grail of Home Routers.

Part 1: Heavy Metal and Raw Power

The foundation of any legendary build is the hardware. Consumer routers are often underpowered, sporting weak CPUs and meager RAM. The Raspberry Pi 4, however, is a beast. I almost went with the Nanopi R4S, but I could grab one Pi 4 dirt cheap on the 2nd hand market from a foreigner PhD student (metal case, flash storage, 3A power supply included). I didn’t need the GPU or the high consumption of the Raspberry 5.

• The Brain: Raspberry Pi 4 (4GB RAM). This quad-core Cortex-A72 idles at 1% CPU utilization while routing Gigabit traffic —> enough spare for ntopng 😉

• The Armor: A Full Metal Case. Passive cooling is crucial. This case acts as a giant heatsink, ensuring the Pi never throttles, no matter how much data I throw at it.

• The Storage: A 32GB SanDisk Extreme USB 3.0 stick. We aren’t dealing with tiny 16MB internal flash chips here; we need room for Docker containers and logs.

• The Radio: Two Deco Mesh units (in AP mode) are covering the home with fast WiFi without blind spots.

• The Network:

  • WAN: An ASIX AX88179 USB 3.0 Gigabit Adapter.

  • LAN: The Pi’s built-in Gigabit Ethernet port (bridged to my managed switch)

The Firmware: Building custom OpenWrt

I didn’t just flash a standard image; I architected a custom OS. Most OpenWrt builds use “SquashFS,” a compressed, read-only system. I went straight for the Ext4 Factory Image.

I resized the partition using parted on a Linux PC to unlock the full 32GB of space. This turns the router into a proper Linux server, giving me room to grow forever. To solve the “Chicken and Egg” driver problem, I generated a custom image via the Firmware Selector, baking in SW tools and drivers so the router recognized the adapters instantly on boot:

Drivers (USB & Network)

• kmod-usb-net-asix-ax88179 (ASIX adapter support)

• kmod-usb-net-cdc-ether (Generic compatibility driver)

• kmod-usb-storage-uas (High-speed USB 3.0 storage)

• kmod-fs-ext4 (Filesystem support)

System Tools

• parted (Disk partitioning)

• resize2fs (Ext4 resizing)

• lsblk (Drive listing)

• usbutils (Command lsusb to ID devices)

• nano (Text editor)

• htop (Resource monitor)

• curl (For downloading files reliably)

• ca-bundle & ca-certificates (SSL support for secure downloads)

• openssh-sftp-server (To transfer files from my phone)

• restic (For encrypted, deduplicated backups)

LuCI & Management

• luci-app-sqm & sqm-scripts (Traffic shaping / Bufferbloat killer)

• luci-app-attendedsysupgrade (The firmware updater)

• luci-app-statistics (Graphs)

• collectd-mod-* (Various collectors for CPU, memory, thermal, etc.)

Part 2: The “Valley of Death” (Architecture Hell)

I wanted ntopng (the Ferrari of traffic analyzers) to see every packet leaving my house - real time. I wanted to see flow analysis, bandwidth usage by application (Netflix vs. Teams), and deep packet inspection.

The reality hit immediately. The error logs screamed: exec format error.

The official Docker images for ntopng are built for big Intel servers (AMD64). My humble Raspberry Pi runs on ARM64. Every “community” image I tried was broken or outdated.

The Nuclear Option

If you can’t buy it, build it. I engineered a custom Dockerfile to compile the container natively on the router itself using a debian:bookworm-slim base. It took 5 tense minutes of compiling on the Pi, but the result was a pristine, custom-built my-ntopng-arm64 image. No emulation. No crashes. Pure native speed.

You can see the moment when ntopng finally started:
(click the image to open)

Part 3: Protecting the Hardware:
The RAM-Only Strategy

Traffic analyzers are “Write-Heavy.” They log every connection to a database. If you run this on a USB flash drive or SD card, you will burn through the write cycles in 6 months. I implemented a “Volatile RAM” Architecture to make this system indestructible.

1. Tmpfs Magic: I instructed Docker to mount the ntopng data directory (/var/lib/ntopng) directly into the Pi’s RAM using the --tmpfs flag. The application thinks it’s writing to a hard drive, but it’s actually writing to a virtual 1GB block of memory. Writes to USB Drive: Zero.

   Note: the visible I/O activity is from Netlink Bandwidth Monitor, which is collecting bandwidth statistics to the RAM and saves once in an hour. I am temporarily using it this month.

2. Redis on Diet: The database engine was configured with --appendonly no. It lives entirely in the moment.

3. ZRAM Compression: To prevent the 4GB RAM from filling up, I installed ZRAM, effectively squeezing 500MB of data into 200MB of actual RAM.

The result? A router that can analyze all my traffic 24/7 without slowdown, without placing a single gram of wear on the storage. The log rotation starts when the RAM stops increasing:

Part 4: Network Architecture & Split-DNS

A normal router just forwards DNS queries to Google. My router is the DNS infrastructure.

The AdGuard Strategy

I installed AdGuard Home directly onto the Router’s Ext4 partition. But I didn’t just run it; I integrated it for High Availability.

• Port Management: I moved OpenWrt’s internal DNS (dnsmasq) to port 5353 and gave AdGuard the prime spot on Port 53.

• The Failover: I already had a Raspberry Pi 3 running AdGuard. I configured DHCP Option 6 to announce the Pi 3 as Primary and the new Router as Secondary. If one device dies, the other takes over DNS blocking instantly. Zero downtime.

• HaGeZi's Pro Blocklist is making sure that all of my devices are tracker and adfree

Seeing Through Walls (Breaking NAT)

Initially, ntopng only saw traffic coming from the router due to NAT masking. To fix this, I pointed the analyzer at the Bridge Interface (br-lan) rather than the WAN port.

To resolve IP addresses to names (so I see “Projector” instead of “192.168.1.50”), I built a Split-DNS Bridge. I injected a custom resolv.conf into the Docker container, forcing it to ask the router for local names. Suddenly, the dashboard lit up with full Layer-7 visibility.

Part 5: The “Forever” System:
Automated Resurrection

A router this complex needs an insurance policy. I didn’t settle for the basic “Save Config” button.

1. The “Recipe” Backup: Instead of backing up gigabytes of Docker data, I configured Restic to backup only the configuration—the “Recipe” (Dockerfile) and the “Restore Script.”

2. Cloudflare R2 Sync: I wrote a custom script that uses Restic to sync my weekly snapshots to Cloudflare's R2 storage every week. It’s encrypted, off-site, and free.

3. The Restore Script: I wrote a master script that automates the entire rebuild. If I flash a new OS, I run one command. It reinstalls Docker, rebuilds the custom image, and spins up the containers with the correct RAM limits.

4. +1 IF anything is out of my pre-set threshold beszel.dev immediately sends an E-mail alert via make.com webhook automation:

   Status, CPU, Memory, Disk, Bandwidth, Temperature, Load

The Result

I started with a $50 board and a pile of error messages. I ended up with a network appliance that rivals hardware costing ten times as much.

I now have a router that:

• ☝️Blocks Ads and Trackers: Network-wide with redundant failover

• ☝️Sees Everything real-time: Full Layer-7 Deep Packet Inspection

• ☝️Never lags: Thanks to SQM Cake QoS handling bandwidth

• ☝️Runs Cool: Passive metal cooling + ZRAM anti-crash protection

• ☝️Is Immortal: Real time monitoring with auto-backups with self-healing scripts

+1 in the end:
I also did not forget to move my IoT devices to a VLAN separated network 😀

This isn’t just a router; it’s the central nervous system of my digital life. And the best part? I built it myself. If you are still running the plastic box your ISP gave you, you are missing out. Grab a Raspberry Pi 4, and have fun.

Final verdict: Is it wife approved? 🤔
It is if she doesn’t know 😉

From time to time the Internet delivers another thrilling tale: the long-forgotten hard drive found in the attic, the lost paper wallet tucked away in an old book, or the panicked scramble to remember a passphrase from a decade ago. These are the modern-day treasure hunting stories—digital folklore starring ordinary people who may or may not be sitting on a fortune.

They are stories of hope, frustration, high stakes, and the tantalizing possibility of instant, life-changing wealth, all locked behind a single, encrypted barrier.

For years, I’ve read those articles with a mix of fascination and envy. I never thought I had my own to tell.

Until now.

This is my story of digital archaeology, the frantic search for a long-lost Bitcoin wallet, and the ultimate battle against encryption. Prepare for my personal journey into the realm of ‘maybe I’m a millionaire.’ I invite you to settle in, because the treasure hunt begins now.

I was copying some files to the Backup folder of my Dropbox when THIS file came to my sight. It was real. Data uploaded: 12/7/2013 11:54 PM.

I started to remember something. I was a technical university student, reading about Bitcoin in the early 2010s, of course I created my own wallet. But how much Bitcoin was in it? How to access it? What to do with this file? So many questions…

One thing is new however. The dawn of the age of AI. Let’s do some treasure hunting.

I input every single detail I could collect to Gemini (but I did not share the content of the file). The answer was surprising. Based on the meta data it could pinpoint the Android app which generated this file for the 1st try:

This is a hot track! Better than I could have imagined. After some research it was clear that

1. The app is not on the Play Store anymore

2. Bitcoin Wallet is still exists on GitHub: https://github.com/bitcoin-wallet/bitcoin-wallet

3. It is possible to install F-Droid - Free and Open Source Android App Repository

4. It is possible to install the latest version of Bitcoin Wallet from F-Droid.

Cool! Since Bitcoin Wallet generated this file back in 2013, I only need to import it to decrypt. The decryption asked my password which belongs to this wallet. I had some ideas what passwords I was using 10+ years ago, but none of them worked.

Luckily I started to use password managers starting from about 2010. I gave it a try and searched for Bitcoin in the search box:

Is this my LUCKIEST 🍀day? I copied the password to Bitcoin Wallet, and…

Did not work. I tried to input manually, same. I went back to Gemini:
No issues, just lot of things happened in the past 12 years, I just need to decrypt manually:

I copied the command to the SSH terminal and crossed my fingers.

openssl enc -d -aes-256-cbc -md md5 -a -in bitcoin-wallet-keys-2013-12-07 -out decrypted_wallet.txt

Enter.

• decrypted_wallet.txt appeared

• It had some file size

• And it was readable

• It contained some explanation comment in English, timestamp, and the key itself

• The manual decryption was successful. Now what.

Gemini told me to install the Electrum app, and just import the decrypted key starting with “K”

I went back to Gemini, how can I make sure if this is valid?

Alright, let's decode the key, drop the compressed flag, and re-calculate the checksum. The generated code worked for the 1st time.

Let’s import the new key to the wallet! THE MOMENT OF TRUTH 🍀

This is not what I expected. I mean people open wallets to put something in them, right?
I had to verify this result.

So it's true. I was sitting on my empty Bitcoin wallet for 12 ###### years. The treasure hunt is over, and with it, the dream of a massive windfall.

Afterword.

BTC current price ($92500) / BTC 2013 price ($750) ~ Bitcoin is worth approximately
120-130 times what it was on December 7, 2013

But at least, what a treasure hunt it was 🥲

This is called wildcard certificate and it turned out that PositiveSSL from Sectigo (what I was paying $6.99 yearly) does not offer:

Furthermore, every year I had to replace this manually which is not straightforward:

I explained my situation to Gemini 3 and it told me why don’t I use Cloudflare, which provides *wildcard certificate AND for free AND I only have to renew in 2040 instead of annually?

The whole routine took a few clicks, furthermore, Gemini reminded me with the new Cloudflare certificate do not forget to enable Full strict encryption mode.

Pain in the ass together with $6.99 annual subscription has been cancelled.

Subscribe now

Mate Rimac!

It’s not every day you get to meet a true industry pioneer, and I had the incredible opportunity to see him speak in person.

His journey of building Rimac Automobili from the ground up is the ultimate “it can be done” story. It was incredibly inspiring and a powerful reminder of what passion and perseverance can achieve.

He was also wonderfully down-to-earth and friendly. So grateful I got to meet him and snap this photo!

Big kudos to my company for organizing this. It’s this focus on innovation and big thinking that makes it such a special place to work.

Q: What is OpenWrt?
A: OpenWrt is a free, open-source router firmware (FW), providing more control, new features, and improved security.

Q: What I am using it for?
A: I needed features that were not possible with the original FW, and my router was officially discontinued in 2015. Today it is still up-to-date thanks to OpenWrt. /TL;DR

Q: What is Attended Sysupgrade?
A: Here we are.

So I am using an external SSD to extend the internal filesystem of the router to be able to install extra SW packages. Attended Sysupgrade is an OpenWrt feature that downloads a new, custom-built firmware image that already includes all the extra software packages I have installed, allowing to upgrade in one step while keeping both settings and packages.

In today’s corporate-minded, profit-oriented, cost-saving world this is a top-notch feature built purely for user convenience that is so rare it deserves special mention. Let me show you in action in a one-minute short how it is generating my custom firmware on my 10+ years old, officially unsupported router completely for free. Fascinating… And now, the video.
(Volume note: contains music, but not from the beginning).

Subscribe now

Today it is up-to-date. ✌️

Subscribe now