iiinova — where your digital self keeps evolving

bridging a dedicated server into one of these networks. the dialog gives you the actual shell commands. ip link, ip addr, ip route. the docs link is a footnote.

Hetzner Console modal titled "Configuration of your dedicated Server"
explaining how to bridge a dedicated server into a cloud private network. Three requirements listed: create a private network interface with the correct VLAN ID and MTU 1400, use an IP from the vSwitch subnet 10.0.1.0/24, and add a route to the broader cloud network 10.0.0.0/16 via gateway 10.0.1.1. Below, a worked example shows five shell commands: three ip link commands to create and bring up the VLAN interface, an ip addr command to set the IP, and an ip route command to add the network route. A footer notes the configuration will not persist across reboots and links to docs.

100

private network and subnet exposed as separate resources. 10.0.0.0/16 outer, /24 carved inside, server attached at 10.0.0.2. all visible in one panel. other providers treat VPC like a configuration project. here it's a resource you make.

Hetzner network configuration page showing a private network named hermes with IP range 10.0.0.0/16, a 10.0.0.0/24 subnet, and one attached server at private IP 10.0.0.2.

100

cpu, disk throughput, IOPS. graphed in the provider console. the dashboard is the dashboard.

Hetzner Console graphs panel for server panel-1, showing three stacked time-series charts: CPU usage hovering near 1% with periodic spikes, disk throughput peaking around 40 KBps in regular bursts, and disk IOPS in matching 4-6 IOPS bursts.

100

hetzner, week one. the surface area is small enough to enjoy.

Hetzner Console dashboard showing a tile grid with resource counts across servers, load balancers, primary IPs, floating IPs, volumes, networks, firewalls, buckets, storage boxes, and DNS zones, alongside a map of European datacenter locations and a recent activities feed.

200

the attacker's lifeline goes silent for the longest stretch. that's the attack.

A sequence diagram showing five actors across the top: the attacker, the prep room, the assembly line, the shop shelf, and the filing cabinet.
Four phases, separated by labelled bars.
Planting: the attacker offers to contribute to the project. the contribution is granted write access to the prep room. the attacker poisons the cache.
Eight hours — the attacker does nothing. the prep room is marked: armed and waiting.
Trigger: a legitimate merge starts the build. the prep room returns the poisoned cache. the assembly line ships to the shop shelf with a valid attestation. a note sits on the shop shelf: the certificate was genuine. the build was not.
Spread — 45 minutes: the assembly line harvests credentials from its own memory. injects into every reachable package on the shelf. accesses the filing cabinet. writes itself into .claude and .vscode — survives uninstall.
Dead man switch: the assembly line sends a dashed arrow back to the attacker — token rotated, home directory wiped.
The attacker's lifeline is silent for the longest stretch in the diagram. Everything that matters happens without them.

010

6/ eight hours of silence. that wasn't patience. that was the whole attack.

A quote card. Frank Herbert photographed in black and white, alongside his words from Dune: "The Fremen were supreme in that quality the ancients called spannungsbogen — which is the self-imposed delay between desire for a thing and the act of reaching out to grasp that thing." The worm waited eight hours. Herbert named it in 1965.

000

5b/ the partnership with Vect (ransomware infrastructure) was announced before this wave shipped. the next wave won't be credential theft. it won't be a worm either.

A quote card from the Akamai Security Intelligence Group report, May 2026. Text reads: "we noted that the ransomware group Vect had announced a partnership with TeamPCP, hinting at a possible shift from credential theft toward large-scale extortion and ransomware operations. This new campaign offers the first concrete signal that this shift may already be underway."

110

Devarno @devarno.com · 20/05/2026

no passwords stolen. no locks picked. five actors. one kitchen. watch where the arrows go.

A sequence diagram showing five actors across the top: the attacker, the prep room, the assembly line, the shop shelf, and the filing cabinet.A sequence diagram showing five actors across the top: the attacker, the prep room, the assembly line, the shop shelf, and the filing cabinet.
Four phases, separated by labelled bars.
Planting: the attacker offers to contribute to the project. the contribution is granted write access to the prep room. the attacker poisons the cache.
Eight hours — the attacker does nothing. the prep room is marked: armed and waiting.
Trigger: a legitimate merge starts the build. the prep room returns the poisoned cache. the assembly line ships to the shop shelf with a valid attestation. a note sits on the shop shelf: the certificate was genuine. the build was not.
Spread — 45 minutes: the assembly line harvests credentials from its own memory. injects into every reachable package on the shelf. accesses the filing cabinet. writes itself into .claude and .vscode — survives uninstall.
Dead man switch: the assembly line sends a dashed arrow back to the attacker — token rotated, home directory wiped.
The attacker's lifeline is silent for the longest stretch in the diagram. Everything that matters happens without them.

100

no token was stolen.

Stylized dark-themed code editor on a purple background showing Kubernetes service account token retrieval, OIDC/web identity exchange for temporary cloud credentials, and a comment stating “no PAT, no leaked secret, no token theft,” illustrating credential minting via trusted workload identity rather than stolen tokens.

000

Devarno @devarno.com · 20/05/2026

agents are part of the attack surface now.

Dark-themed code snippet listing .claude and .vscode configuration files on a purple background, shared alongside commentary that AI agents are now part of the latest Mini Shai-Hulud attack wave.

401

Devarno @devarno.com · 14/05/2026

the agent didn't bypass your controls. there was nothing to bypass. #buildinpublic

Architecture diagram showing Ring 2 (agent fleet) writing directly
to Ring 1 (consumer repository) with no control plane in the path.
Ring 2 contains three writer types: claude-code, copilot-agents,
and custom MCP servers — all described as stateless, drift-prone,
with no shared trust boundary. A redacted Ring 1.5 control plane
is shown as a dashed ghost element marked "not on the write path
today," with its gates obscured: schema gate, idempotency ledger,
provenance · MR cite, policy · CODEOWNERS · replay. Three failure
surfaces are identified: F-1 Silent (severity: high) — no schema
check, no constraint gates, no type coercion, payload accepted
never validated; F-2 Invisible (severity: high, forensics: nil) —
no idempotency key, no audit body, no MR cite, no trace-id
propagation, run unattributable and unreplayable; F-3 Bypass
(severity: critical, blast: prod) — branch protection, CODEOWNERS,
and required checks all bypassed, CI never runs, review never
happens. Ring 1 lists what consumers expect: schema-valid state,
attributable mutations, reviewed merges — and notes it delivers
none of the above. Legend distinguishes dashed agent writes
bypassing the control plane from solid red unsanitised writes
reaching the system of record.

251

Devarno @devarno.com · 05/05/2026

just using the technique of positive visualisation

Christopher Moltisanti from The Sopranos wearing a beige bucket hat and navy Nike tracksuit over a white tank top, with a gold pendant necklace. He's giving a tight-lipped, side-eye expression that reads as strained acceptance.

000

Devarno @devarno.com · 28/03/2026

she saved earth by not asking permission. i named my prompt library after her. STRATT.

Eva Stratt from Project Hail Mary. Sandra Hüller walking toward camera through an institutional corridor, expression calm and certain. © Amazon MGM Studios.

010

Devarno @devarno.com · 12/03/2026

the best DX still comes in a yellow carton #buildinpublic

A young man sitting on a set of brick stairs, holding a Chocomel carton - unbothered, unhurried, already thinking three moves ahead.

020

Devarno @devarno.com · 05/01/2026

office keys in hand. @posthog.com swag on the desk. jitter juice ready. this is real now. #buildinpublic

PostHog care package on desk with t-shirt, socks, and stickers. Coffee cup in background. First day in the office.

161

Devarno @devarno.com · 02/01/2026

treated myself to a new rig over xmas. spent ~3 hours exorcising haunted spanish windows bootloaders. arch is running. rust and go installed before i even saw the desktop. we are so back.

Custom-built PC running a fresh Arch Linux installation. My new dev setup for 2026.

110

Devarno @devarno.com · 02/01/2026

got an email last year that changed my life. "we scraped github looking for [X]. your profile came up." 500k lines of code later, i finally understand what 'locked in' means. 2026 is going to be different. #buildinpublic

Screenshot of an email from startup cofounders explaining how they found me by scraping GitHub profiles for specific technical skills. Key details redacted.

Claude Code analytics dashboard showing approximately 500,000 lines of code generated in the past month.

281

Devarno @devarno.com · 28/11/2025

pov: its 2025 and your ai is busy building its replacement

screenshot of claudecode generating a full ai engine with imports, security models, and near-complete test coverage.

000

Devarno @devarno.com · 26/10/2025

masters nationals this weekend. PB in almost every event. wanted sub-27 for 50 free, got exactly 27.00 (lane 8). swimming gods have a sense of humour. months of training done while building in silence. time to ship the ecosystem. watch this wave. #buildinpublic #swimming

041

Devarno @devarno.com · 15/10/2025

failed another coding interview last week. im so bored of hour-long leetcode marathons that reward speed over sense. so ill keep building this orchestrator for my entire SaaS ecosystem. traceability all green so far. at least something actually passed. #buildinpublic

2121

Devarno @devarno.com · 27/08/2025

small win alert. devarno.com jumped +11 DR points to 21 this week. somehow landed #1 on the weekly leaderboard. building in public is working. slowly but surely. #buildinpublic

Domain rating chart showing devarno.com jumping from DR 10 to DR 21 with sharp upward spike over recent weeks

Weekly DR leaderboard showing devarno.com at #1 position with +11 point increase highlighted

231

Devarno @devarno.com · 25/08/2025

lane 5. 7am. last call. race simulation to close out the weekend. 21km total since friday. back to building tomorrow. different kind of blocks to tackle. #buildinpublic

Starting block number 5 at sunrise with golden light reflecting on pool water, lane ropes extending into distance at Olympic training facility

022

Devarno @devarno.com · 24/08/2025

carving the waves with such simplicity

000

Devarno @devarno.com · 24/08/2025

technique work actually clicked today. legs remembered how to swim instead of just move water around.

Apple Watch summary of afternoon swim reaching total distance of 4.45km

Apple Watch summary of morning swim reaching total distance of 4.5km

000

Devarno @devarno.com · 24/08/2025

technique work actually clicked today. legs remembered how to swim instead of just move water around.

Apple Watch workout summary of morning swim reaching total distance of 4.5km

Apple Watch workout summary of afternoon swim reaching total distance of 4.45km

000

4h of pool time today. tonight, we feast 🍝

Apple Watch workout summary displaying swim session statistics

000

session 3: butterfly and block work. also trained alongside the saudi national team this afternoon. these guys make it look easy.

100

got the “moderate effort” label from apple. my legs disagree with the assessment. watch is just being british and polite.

Apple Watch workout summary displaying 5km swim with duration, pace, and stroke data from morning training session

010