Haschek's Blog
blog.haschek.at · Personal blog · on HN since 2015
Christian Haschek, an Austrian developer, writes about Raspberry Pi projects, security, self-hosting, and unusual experiments like heating a home with crypto mining.
What HN saysHN links it for practical projects like the SSH-based comment system, zip bombs against bots, and mining crypto to heat a home.
34HN people shared it
13linked it in comments
58stories submitted
5.9Kstory points
3 months agolast shared
2015people per year2026
Most-shared posts
- 1Defending a website with Zip bombs5 people · 810 points · first shared 2017 · 183 comments on HN
- 2The curious case of the Raspberry Pi in the network closet (2019)4 people · 1.1K points · first shared 2019 · 262 comments on HN
- 3SSH Based Comment System4 people · 19 points · first shared 2023 · 1 comments on HN
- 4I heat my home by mining crypto currencies3 people · 529 points · first shared 2021 · 401 comments on HN
- 5I opened a link some random person sent me and I got raided (2015)3 people · 258 points · first shared 2015 · 170 comments on HN
- 6The Perfect File Server3 people · 20 points · first shared 2020 · 6 comments on HN
- 7Threat vector: Legacy static HTML sites3 people · 16 points · first shared 2019 · 3 comments on HN
- 8Telekom Austria hack from the viewpoint of a whistleblower3 people · 6 points · first shared 2020 · 1 comments on HN
- 9How to defend your website with ZIP bombs (2017)3 people · 3 points · first shared 2018 · 1 comments on HN
- 10Why hackits are the first thing I teach new classes (2014)3 people · 1 points · first shared 2023 · discussion on HN
- 11The curious case of the Raspberry Pi in the network closet2 people · 518 points · first shared 2019 · 155 comments on HN
- 12I scanned Austria2 people · 326 points · first shared 2019 · 67 comments on HN
- 13Why are free proxies free? (2013)2 people · 321 points · first shared 2015 · 82 comments on HN
- 14ZFS over iSCSI Storage in Proxmox2 people · 41 points · first shared 2024 · 20 comments on HN
- 15The A1 Telekom Austria Hack2 people · 9 points · first shared 2020 · discussion on HN
What HN people wrote when they linked it
geek_at · 2020-06-01
When I started playing around with Raspberry Pi I had the problem that I had to re-solve problems I had solved before but couldn't remember quite how and had to re-google everything.
So I started my blog to document how I did it. This and work stories made it semi popular.
I added an email list last year and got a few thousand people signed up. Now I'm really concious about what to blog about or when I blog about something I am very hesitant to send the new post out to my subscribers. So that impacted me in a slightly negative way
https://blog.haschek.at
tenthirtyam · 2022-05-17
This was the best blog I ever noticed on this topic,an Australian using exhaust air from their miners to pre-heat incoming air to their heat pump. TL;DR - it's worth it.
https://blog.haschek.at/2021/how-i-heat-my-home-by-mining.html
milliams · 2024-01-08
What I find interesting is the SSH-based comment system (https://blog.haschek.at/2023/ssh-based-comment-system.html) for their blog.
zappchance · 2023-06-22
Not exactly what you're asking for but very similar: Hackits [0][1].
[0] https://blog.haschek.at/2014/why-hackits-are-the-first-thing-i-teach.h…
[1] https://www.0xf.at/
JZerf · 2022-08-05
If you're reasonably certain that the request is being made by a malicious bot, you could try responding with a ZIP bomb [1] if HTTP 1.1 or newer is being used and the bot accepts compression. It can cause problems for several browser engines.
[1] https://blog.haschek.at/2017/how-to-defend-your-website-with-zip-bombs…
tlamponi · 2022-01-17
> What a technical dad you have!
Working for over 35 years for IBM and inspiring BASIC/REXX to ones child may do the trick -> https://blog.haschek.at/about/
verdverm · 2021-10-28
I wonder if zip bomb like responses will still work for the majority of bots
https://blog.haschek.at/post/f2fda
gnyman · 2021-10-27
I definitely agree bots are underserved, I have a few things I do to keep them entertained, ssh bots are tar-pitted to keep them connected but busy, my hope is that I occupy at least one thread of not the whole process.
For wp-login bots I serve them a nice chunk of random (generated by a fuzzer) html in the hopes that 1. It wastes abit of their bandwidth/memory and 2. it crashes their parser
In reality I guess bots nowadays are sturdy enough to not get stuck or crash but who knows, feels good to do something :-)
Tarpit instructions https://nyman.re/super-simple-ssh-tarpit/
Wp-login page https://twitter.com/gnyman/status/1181652421841436672?s=20
And I remembered another nice trick which someone else came up with, zip bomb the bots :-)
https://blog.haschek.at/2017/how-to-defend-your-website-with-zip-bombs…
Annatar · 2021-04-22
https://rom-o-matic.eu/ is a broken link.
https://blog.haschek.at/2020/the-perfect-file-server.html is made obsolete by SmartOS, which does the exact same thing, in addition to offering Triton (enterprise web GUI for virtual systems), OpenZFS (end-to-end data protection, ease of administration), zones (full-blown, running-at-the-speed-of-metal virtual UNIX servers), DTrace (for production-safe, real-time, deep machine state instrumentation and inspection), Bardiche (for building firewalls), FireEngine / Crossbow (high-performance TCP/IP stack for building virtual switches and routers) and imgadm(1M) / vmadm(1M) (for virtual server provisioning and software management), and last but not least, a reference implementation of the NFS V4 protocol.
blackshaw · 2021-03-28
There was an article on the front page of HN not that long ago about a guy using the waste heat from crypto mining to heat his home:
https://blog.haschek.at/2021/how-i-heat-my-home-by-mining.html
kekebo · 2019-07-04
Not sure if your post is sarcastic but if not it already exists: https://blog.haschek.at/tools/bomb.php
Usually aimed against bots though: https://hackaday.com/2017/07/08/dropping-zip-bombs-on-vulnerability-sc…
fortran77 · 2019-06-21
My guess is this pi was connecting _out_, tunneling the network over ssh.
Or one of these things: https://blog.haschek.at/2018/the-curious-case-of-the-RasPi-in-our-netw…
imhoguy · 2018-05-09
Serve them a cheap gzip b0mb (example [0]) - it sould move their ass to clean up things.
[0] https://blog.haschek.at/post/f2fda