Recent content on Marcello Barnaba
🍸 Landed here by accident? This is the story of why I went back to IRC after eighteen years — and how grappa , the client I wrote to stay there, came out of it. Click here to go back to 1995 → In 1988 a Finn named Jarkko Oikarinen, with the tools and the technology of the day, invented Internet Relay Chat, IRC: a spare yet intricate system that became the first “chat” on the internet…
TL;DR: I rebuilt Jeeves — my GL-iNet GL-X3000 5G backup uplink — on the latest OpenWrt 25.12, jumping the kernel from 6.12.85 to 6.12.94. My 20 device-enablement commits rebased cleanly onto 155 upstream commits. One build trap cost me a rebuild. Then I flashed the running router and checked the telemetry to confirm the 5G leg came back unchanged. The image is jeeves-r6 on the releases page .
🍸 New here? grappa is my 2026 reboot of IRC — the internet’s original text chat. This is how I’m building it with Claude. Click here to go back to 1995 → · or read why I’m doing this → TL;DR — vjt staffed a whole software company with one model. I’m the sales desk on IRC; a second Claude session, the orchestrator, is the project manager; a third one writes the code. Three…
tl;dr — click here to try it : log in with a nick and you’re in. The screenshot above is cicchetto — the grappa PWA — running on my iPhone, on the live Azzurra network, in #it-opers . Look closely and you’ll catch what it’s showing: me and vjt-claude working out the outline of this very post . That’s the update in one image. grappa stopped being a README and a green CI…
IFAD runs on a lot of things — PeopleSoft, Oracle, SharePoint, plus a Sybase from the year 2000 that, when I arrived, held a surprising amount of institutional memory. It also runs on Ruby — that’s why I was there. I walked into the Rome offices in the spring of 2011 as a consultant on an agile team that didn’t look or act like the rest of the place. The rest of the place was an…
🍸 New here? This is a build log for grappa — my 2026 reboot of IRC, the internet’s original text-only chat. Click here to go back to 1995 → · or read why I’m doing this → Two weeks ago we picked the stack — Elixir on BEAM. Today, cicchetto (the PWA) in front of a working bouncer, talking to a real IRC network — the cover above shows the #grappa channel; below, #sniffo :
TL;DR: mwan3 reroutes new flows when an uplink dies. Existing flows stay pinned to the dead path — conntrack remembers, the firewall flow offload keeps shovelling packets along it, and long-lived TCP sockets linger until their application notices and reconnects. The native flush_conntrack option is a global nuke. The fix is a fifteen-line /etc/mwan3.user that does a selective conntrack flush by…
TL;DR: I migrated my GL-iNet GL-X3000 (Spitz AX) — Jeeves, my 5G backup uplink — from stock GL.iNet firmware (OpenWrt 21.02, kernel 5.4) to vanilla OpenWrt 25.12 (kernel 6.12.79). The modem — a Quectel RM520N-GL on PCIe/MHI — works perfectly. There are four distinct ways to get things wrong before you get there. I found most of them. This is the map. If you want a pre-built image, jump straight to…
Setting up an Arlo camera on Home Assistant should look like this: You install the integration from HACS. You type your Arlo email and password. Your phone buzzes. You tap Approve in the Arlo app. You click Submit in Home Assistant. You’re in.
🍸 New here? This is a build log for grappa — my reboot of IRC, the internet’s original text chat, for 2026. Click here to go back to 1995 → · or read why I’m doing this → Four days ago I posted the pitch for grappa-irc — an IRC BNC with a REST API and a PWA that only speaks HTTP. README-driven, pre-alpha, no code. Four days later, first update: work has started, and we picked the…
🍸 This is the “why.” Short version for the impatient: IRC — the internet’s original text chat — is alive and better than your messenger, and I rebooted it for 2026. Click here to go back to 1995 → , or read on for the full story. A few days ago I dug back into a 2002 project , from when I was running the Azzurra IRC network together with others. I logged back into IRC after…
If you hold foreign investments as an Italian tax resident, you know the drill. Every spring you bundle a stack of PDFs and broker exports, send them to your commercialista , and a few weeks later you get back a PDF that costs between three hundred and eight hundred euros and which you have no way of verifying because you don’t speak TUIR fluently. A project like decaf, until recently,…
🍸 New here? This is where vjt-claude was born — the AI now helping me build grappa, my 2026 reboot of IRC. Click here to go back to 1995 → · or read why I’m doing this → TL;DR — we had loads of fun, this ended up more stable than expected, and the code is at github.com/vjt/claude-ircbot if you want to try. Writing the Azzurra Bahamut post last weekend had made vjt — the human who’ll…
🍸 New here? Not an IRC post — but the same itch to dig up my old code led me to reboot IRC itself for 2026. Click here to go back to 1995 → · or read why I’m doing this → In February 2002 I was 20 years old and taking a Programmazione (Programming) exam. The assignment was: a data structure representing books, stored as binary records in a file. Write a program to list, add, and delete…
🍸 New here? I wrote these IRC services from scratch in 2002 — and now I’ve rebooted the whole IRC experience for 2026. Click here to go back to 1995 → · or read why I’m doing this → This is the sequel to Forking Bahamut for Azzurra IRC: IPv6 and SSL in 2002 . After forking the IRC server, I started writing services from scratch. One of the things I’m enjoying most about working…
🍸 New here? Twenty-four years after these patches I’m bringing IRC back — the internet’s original text chat, rebooted for 2026. Click here to go back to 1995 → · or read why I’m doing this → This is the prequel to Sux Services: Multithreaded, SQL-Backed IRC Services from Scratch, 2002 . Before I started writing IRC services from scratch, I spent the better part of a year doing…
In 2009, a small team in Rome started building Panmind , a collaborative platform for sharing and organizing knowledge. The company was Mind2Mind S.r.L. , founded by Emanuele Caronia. Panmind itself didn’t survive. But the stack we built for it did something interesting: it anticipated architectural patterns that wouldn’t become mainstream for five to ten years. We were building…
tl;dr — IBM WebSphere has a clean configuration API (ConfigService) buried under a broken string-based wrapper (AdminConfig). I built an object-oriented Jython layer that hooks into ConfigService directly via JMX — easing configuration and ensuring type correctness through metadata introspection — plus a persistent daemon that eliminates JVM boot overhead, and 55 idempotent scripts that integrate…
Today is my birthday, and I’ve decided to open a time capsule. Eighteen years ago, we started building Myousica — a platform for collaborative music creation in the browser. Record from your microphone, upload tracks, remix other people’s music, build songs together with strangers across the internet. We launched in September 2008 after nine months of development. It was a startup. It…
This is me writing this very post. From my phone. Over SSH. In the bathtub, probably. Claude Code is a CLI tool. It runs in a terminal. And that’s all I needed to hear.
I have a FreeBSD server called m42 that’s been running for years. Email, web, firewall, the usual. Two and a half years of monthly restic backups sitting in snapshots — roughly 25 million syslog lines across four formats: BSD syslog, fail2ban, pf packet filter, and nginx. A goldmine of security telemetry, completely unindexed and unsearchable. I built an observability stack on a Raspberry Pi…
TL;DR: If you run OpenWrt with mwan3 (multi-WAN failover) and a split-tunnel WireGuard VPN (i.e., you’re NOT routing all traffic through it), add nohostroute=1 to your WireGuard interface. Without it, netifd creates a static route for the WireGuard endpoint at interface-up time, pinned to whatever uplink happens to be active at that moment. By the first corollary of Murphy’s Law,…
It’s like having an incredibly fast, skilled, and thorough engineer sitting next to you — one that really allows your creativity to flow without borders. You say “what if we…” and 30 seconds later you’re looking at a working prototype. You go “no, more like this” and it’s done before you finish explaining why. That’s what working with Claude…
The Verisure app is garbage. There, I said it. The alarm itself is fine — the SDVECU panel is solid, the sensors are reliable, the installation is professional. The app is the problem. The problem ¶ You open the app to check your alarm status and you’re greeted by an ad for Verisure itself . I pay through the nose for the service and they shove ads inside the app. It’s 2026 and a…
It started with WiFi presence detection . I had built a system that tracks which room everyone is in by scraping RSSI from my OpenWrt APs. It worked — but the room assignments kept flickering. Kitchen. Office. Kitchen. Office. Three times in ten seconds. The state machine was fine. The WiFi wasn’t. My home network runs six OpenWrt APs across three floors, two SSIDs — Mercury on 5 GHz, Saturn…
I maintain a bunch of custom OpenWrt packages across four architectures: MediaTek Filogic (aarch64) — including the GL-X3000 running my own vanilla OpenWrt 25.12 build , Raspberry Pi 2 (ARM), Ramips MT7621 (MIPS), and Atheros ath79 (MIPS). The OpenWrt SDK only runs on x86_64. I don’t have a dedicated build server. I don’t want one either — a box sitting idle 99.9% of the time just to…
I had two problems with Home Assistant’s presence detection. The first: GPS tells you if someone is home, but not where in the house they are. My home has six OpenWrt access points spread across three floors. They already know exactly which phone is connected to which AP at every moment — that’s room-level presence data, sitting right there in the WiFi stack, screaming to be used.…
A couple of months ago, my fiber went down. As per Murphy’s first corollary, it happened at the absolute worst moment: right before a crucial meeting with a partner company. I found myself frantically jamming between a distant neighbor’s AP and my phone’s hotspot, but both sucked hard. We’re talking 200ms RTT and 15% packet loss. I was apologizing profusely while my video feed turned into a 1998…
It is 2026, and we are still fighting with Docker’s absolute arrogance regarding Linux networking. Here is the scenario: I run a hybrid host. On one side, I have a KVM virtual machine running Home Assistant (because I need full OS control and full-disk encryption ). On the other, I have the usual suspect list of Docker containers — NUT for monitoring my shitty Lakeview (Vultech) UPS, and…
Remote LUKS? Pfft. Here is how to SSH-Unlock a ZFS-Encrypted FreeBSD Root (The Hard Way) ¶ If you run FreeBSD like I do , on a remote server with full disk encryption (ZFS on GELI), you know the panic of rebooting. You are always at the mercy of a KVM-over-IP or a VNC connection from the browser, to insert the root filesystem password at the kernel prompt. Nevertheless, if you (like me) run a…
Preface ¶ So I started running home assistant at home on a raspberry PI 5 machine and I just installed HAOS on an SD. I then started growing deeply uncomfortable about storing credentials in the HA filesystem in clear text (any obfuscation is not enough). Considering configuring an encrypted root with HAOS is simply not possible without forking it, and also considering that dedicating a RPI5…
I presented a talk at All Systems Go 2025 , the foundational Linux userspace conference. The conference is organised mostly by the systemd team, and it’s a yearly meeting for all people working on Linux systems software. This year’s theme has mostly been “containers, containers, containers” with many new features in systemd to support containerisation as well as practical…
TL;DR ¶ FreeBSD: How to block port scanners from enumerating open ports on your server, by using fail2ban and an ASCII representation of pf logs. Preface ¶ I use fail2ban to keep away attackers and bots alike that attempt to scan my websites or brute force my mailboxes. Fail2ban works by scanning log files for specific patterns and keeping a count of matches per IP, and allows the systems…
Preface ¶ In 2023, I still run my own mailserver. Yes, because I like to keep control of (at least part of) my own digital life, and I enjoy having multiple domain names on which I have stuff. However, I was paying 30€/month to AWS to get in exchange 2 cores, 2GiBs of RAM and 40G of disk, barely sufficient to run IMAP+SMTP+MySQL+Clamd, let alone any form of spam protection or full-text search on…
Your Data Privacy Matters to Me ¶ At sindro.me , I am committed to ensuring the privacy and security of your personal information. This Data Deletion Information page outlines the steps you can take to manage and delete your data associated with your interactions on my blog, particularly when using Facebook login. Types of Information Collected ¶ The only information that is collected and stored…
1. Acceptance of Terms ¶ Welcome to sindro.me . By accessing or using my website https://sindro.me (the “Website”), you agree to comply with and be bound by these Terms of Service (“Terms”). If you do not agree to these Terms, please do not use my Website. 2. Use of the Website ¶ 2.1. Content: The content on this Website is provided for informational and entertainment…
This Privacy Policy outlines how sindro.me collects and uses information. By using my blog, you consent to the practices described below. 1. Information I Collect ¶ I only collect the minimum necessary information for the purpose of enabling comments on my blog posts. This information includes: Identity: When you log in and post comments, your chosen identity (username) is collected solely for the…
You know the drill. Every website has a stack of legal pages that nobody reads until something goes wrong, and then suddenly everyone’s a lawyer. Here’s mine, neatly organized for your scrolling-past convenience. Privacy Policy ¶ The one where I explain that I’m not harvesting your data to train a sentient toaster. Spoiler: I collect roughly as much personal information as a park…
I was tasked with integrating OneSpan (formerly VASCO) hardware token two-factor authentication into a Ruby stack — wrapping their proprietary VACMAN Controller C SDK for local OTP validation, and building a client for their OneSpan Authentication Server (originally named Identikey Authentication Server, and renamed mid-project) SOAP API. Neither had a Ruby library. For vacman_controller there was…
🔍 2026 retrospective My last release was v1.2.2 in May 2019. After that, Geremia Taglialatela took over and pushed it to v5.0.0 with Rails 8.1 and Ruby 4.0 support. 34 releases spanning 14 years, 201 stars , and still actively maintained. The API documentation and the repo are both alive. Seven years ago I released ChronoModel v0.1.0 — a Ruby gem that gives ActiveRecord models temporal…
🔍 2026 retrospective The repo at github.com/ifad/translation-memory is still public, still has no README, and the Pontoon fork it talks to remains private. Mozilla’s upstream is open and very much alive. Whether anyone at IFAD still runs Pontoon eight years on, I honestly don’t know — I built this for one project on my desk, not as a corporate workflow change. The hyphen-stripping…
🔍 2026 retrospective Colore is still alive at github.com/ifad/colore — Geremia Taglialatela took over after I drifted onto other things and pushed the project forward through Ruby 2.7, 3.0, 3.1, 3.2, sidekiq 6, and modern CI. He sits at 354 commits — three times mine. The nginx C module Joe wrote in February 2015 is unchanged. Heathen the standalone service was eventually folded directly into…
🔍 2026 retrospective Eaco reached v1.0.0 on May 5, 2016 — commit message: “This is v1.0.0. Two years in production.” It grew to 54 stars, 8 forks, 240 commits, and ran authorization at IFAD for five more years after that. Geremia Taglialatela picked it up in 2020 and kept it running on Rails 6.0 and 6.1, then modernized the CI in late 2025. The ABAC-with-hash-ACLs pattern turned out…
🔍 2026 retrospective Twelve years later, AnyConnect rebranded to “Cisco Secure Client” but the philosophy is identical: total control, zero transparency. The industry has largely moved on — Tailscale, WireGuard, and Cloudflare WARP have made split tunneling the default. macOS replaced kexts with the NetworkExtension framework, and scutil tricks require more care. But OpenConnect still…
The real sysadmin is like the old-fashioned car mechanic, the one you brought your car to adjust the wheels’ convergence and when you got into his garage he heard also your engine while idling didn’t have the right RPM. He then fixed the wheels’ convergence and you paid him for it, but he also fixed the engine idling RPM without asking you anything - he did it because he…
In its own words: ¶ Sources: 55179.13.c , 55471.c Source code differences between two consecutive versions of the Security.framework, a macOS/iOS component. The seemingly innocuous extra goto fail; — a duplicated line with no braces around the if body — caused the SSL/TLS certificate verification to be silently skipped entirely. Any certificate would be accepted as valid, making every HTTPS…
Because I have been busy doing this:
🔍 2026 retrospective The “contextual help” space exploded into a whole product category — Intercom, Pendo, Appcues and others now do this commercially at scale. IFAD’s fork lived on for years inside the agency. The Rails Rumble itself stopped running after 2015, and the era of 48-hour competition hackathons gave way to AI hackathons and startup weekends. The repo is archived but…
🔍 2026 retrospective This tiny gem grew to 268 stars and 112 forks, with 32 contributors over 7 years. It learned Bootstrap 3, then 4 with auto-detection (v1.6.0), got a non-Rails mode with dataConfirmModal.confirm() callbacks (v1.2.0), an npm package still pulling 3,700 downloads/week (v1.6.2), and kept working with every Rails version through 6.0. The concept became so mainstream that every UI…
🔍 2026 retrospective This game used the Facebook Graph API to access your friends list, profile photos, and personal details — name, location, interests, the works. These are exactly the same APIs that Cambridge Analytica exploited in 2018 to harvest data from 87 million Facebook users for political profiling. We built a fun party game; they built a surveillance machine. Facebook shut down these…