Henryk Plötz

Born between E.T. and Blade Runner, occasionally hacking and breaking things, computer scientist living in Berlin.
He/Him.

ꙮ: ♥️💜💙
Blog: https://blog.ploetzli.ch
github/henryk: https://github.com/henryk/

Public Key

npub10646a26cpa6nf3rtd0azugyd734zcjm85y7f6nse0n99u0d0257q7acwt5

NIP-05 Address

[email protected]

Profile Code

nprofile1qqs8a2aw4dvq7af5c34kh73wyzxlg63vfdn6z0yafcvhejj78kh420qprpmhxue69uhhyetvv9ujumt0d4hhxarj9ecxjmntqy28wumn8ghj7un9d3shjtnyv9kh2uewd9hs887xly

Publishing to

relay.momostr.pink

relay.damus.io

offchain.pub

Author Public Key

npub10646a26cpa6nf3rtd0azugyd734zcjm85y7f6nse0n99u0d0257q7acwt5

Show more details

Last Notes

2026-10-15 15:01:28 GMT

- reply

So, direct-to-video then. I assume he already has figured out the pay-per-view distributors.

2026-10-09 14:35:10 GMT

- reply

Fun addition: The school around here *does* have an Absolutely Positively Really Really No Peanuts policy.

2026-10-09 14:27:07 GMT

- reply

To be fair, those that didn't survive are currently not posting here ;)
@npub1z23…qh88 I do guess it very much depends on the age. For our one-year old we're also making very sure to only give sliced grapes and pre-crushed blueberries. Then again: they're not in school. I would assume basic eating competency in a school age kid.

2026-10-01 08:30:40 GMT

Der sogenannte "Tankrabatt" (Tank als ein anderes Wort für Panzer) ist in Kraft getreten.
Der Deutsche Staat erlässt 16,7c in Steuern. Damit sind die Preise sofort um 10 bis 11 Cent gefallen.
Pro Autofahrer macht das eine Ersparnis von ca. 10 Euro im Monat. Das kostet den Steuerzahler 2,5 Milliarden Euro.
Ich finde, Fragen nach den Ursachen für Politikverdrossenheit verbieten sich in Zukunft. Offen ist eigentlich nur, wie lange das noch weitergeht.

2026-09-24 15:13:23 GMT

- reply

Update: Die Sitzung hat stattgefunden. Nach Gaslobby, Waffenlobby, und Zigarettenlobby haben wir jetzt also auch eine Masernlobby. Der Petent gab an, so eine Maserninfektion sei was ganz feines, und danach sei man besser gegen andere Krankheiten geschützt.
https://www.bundestag.de/dokumente/textarchiv/2026/kw39-pa-petitionen-1205438
Das ist natürlich eine Lüge. Masern greifen das Immungedächtnis an und führen zum Verlust von bisher erworbener Immunität gegen andere Krankheiten.
https://de.wikipedia.org/wiki/Masern#Schw%C3%A4chung_des_Immunsystems
Wie verliert man eigentlich eine Approbation?

2026-09-18 13:52:42 GMT

- reply

Auch zu "die KI wird uns alle hacken" brauchen wir eigentlich keine neue Regelung. Deine Firma hat Klärschlamm in's Wasser gekippt/einen KI-Agenten Cybercrime machen lassen? -> Ermittlung und Strafantrag gegen die Verantwortlichen, ganz normal. Das ganze geschah ggbf. sogar (grob) fahrlässig? -> Verantwortlichkeit könnte beim C-level liegen.

2026-09-18 10:50:23 GMT

RE: https://social.bund.de/@hib_Nachrichten/117286502819052178
Aus der Abteilung "Hat ein Masernvirus diese Petition eingereicht?"
Für allen möglichen wichtigen Kram kommt nichts rum. Aber für "Hey, wie wär's wenn wir eine schlimme Krankheit wieder einführen?" gibt's 38k Unterschriften ...
#note1xlc…82rj

2026-08-19 08:04:43 GMT

- reply

I know you're joking, but power-over-fiber exists and is being used in the wild https://www.farnell.com/datasheets/2785190.pdf (provides ~600mW on the receiver). :)

2026-08-13 14:14:26 GMT

- reply

Also, I mean, it's *trivially* countered by AI scrapers. It needs exactly one prompt "Hey Claude, this weird font replaces words with other words, look into the font file to find which and undo it".
Normal screenreaders on the other hand are royally fucked.
In security we say that something is secure if the attack is (much) harder than legitimate usage. Every once in a while you see something marketed as 'security' where that is reversed. This is one such case.

2026-07-10 06:37:17 GMT

How ChatControl passed in the EU parliament.
https://assets.chaos.social/media_attachments/files/116/894/293/847/640/838/original/1b0d9e9526992342.jpg

2026-07-04 12:37:53 GMT

- reply

I'll note that this happened on a modern mobile phone, the most secure computing platform currently available. Logins simply should not "expire". There's nothing that makes a high-entropy token in secure storage suddenly go bad.
If you're confused enough to also then treat the same device as very trusted, that's just icing on the cake.
Even more: the token flow didn't work and I had to instead get an OTP by email. One of the, ahem, less secure transports. So the entire theater just collapsed.

2026-07-04 12:34:31 GMT

The absolute brain damage that developers have sustained when being subjected to "login expired" messages at a formative age without anyone telling them that this is not normal and should not be emulated.
Just now: "Your login session has expired, please log in again" … "another device is logged in to the account, please enter the token code shown on the other device".
So… the device is logged out because it might be untrusted, but is also the root of trust for new logins?
Cool.

2026-07-03 20:38:33 GMT

- reply

The correct[tm] Currywurst is Curry 36 at Zoo. Take the FEX Airport Express from BER to Hauptbahnhof, then any westerly S train to Zoologischer Garten.
(Alternatively S9 goes direct from BER to Zoo.)

2026-05-15 01:26:07 GMT

- reply

One of the phrases from Dollhouse (2009) that will forever live rent-free in my head is "drawer of inappropriate starches" (https://www.imdb.com/title/tt1216527/quotes/?item=qt0530408).
I have since striven to maintain one at work at all times.

2026-05-14 10:19:07 GMT

- reply

Well, either that, or a bronze age Nanoraptor having a bit of fun with a T-shaped bison that only has left legs.

2026-05-05 08:51:55 GMT

- reply

Weil wir Menschen wirklich schlecht sowohl in großen Zahlen als auch in logarithmischen Maßen sind, muss das immer mal wieder laut gesagt werden:
Der Unterschied zwischen einer Million und einer Milliarde ist ungefähr: eine Milliarde.

2026-04-17 18:04:42 GMT

Ok, fellow hackers, I propose a pact: That new EU age verification app thingy ... do NOT help improve it.
Don't publish findings. Don't responsibly disclose insecurities. Don't facilitate them making it bulletproof.
If personal data is directly at risk, by all means, slam their asses into the ground. GDPR them into oblivion.
But on its core functionality this needs to be, to become, and to stay, the most insecure, the most easily circumventable piece of shit code on the planet.

2026-03-03 13:29:36 GMT

- reply

Fun tidbit: The opposite is true now.
In order to prevent cross-domain tracking by observing cache hits, Browsers will not use a cached Google font across multiple domains. You gain nothing from using Google Fonts.
But, because it's an extra host, the browser will need to do the whole DNS/TCP/TLS dance to fetch the file, small as it may be, so you're getting additional latency compared to just downloading the file from the server it's already connected to.

2026-01-28 09:03:36 GMT

- reply

They also removed this paragraph from their official blog post:
> Matrix on Workers runs in production today, handling real encrypted communications for our team. It is fast, it is cheap, and it is arguably one of the most secure ways to deploy a homeserver today.
So, next time Cloudflare wants to tell us something about what they do "in production today", we'll have a frame of reference for how credible that is.

2025-12-29 17:54:36 GMT

- reply

Na sind sie doch, aber Tag 0 hatte halt noch kein Hauptbühnenprogramm.

2025-11-18 12:49:39 GMT

- reply

Personally, I'm very partial to this one.
(The Sovereign Tech Fund is a German government funded initiative to improve resilience of our tech stack.)
https://assets.chaos.social/media_attachments/files/115/570/773/791/463/500/original/58de22297077547a.png

2025-10-01 19:33:33 GMT

- reply

It spent 10 minutes on this?!
Now, while in principle I have nothing against sub-second, one-shot inferences, I must say that blasting a couple hundred watts for 10 minutes does not appear entirely appropriate if all you get is this kind of output.

2025-08-30 15:49:58 GMT

- reply

I'd object even before that: Bitcoin does not exist in a vacuum. It needs a substrate. Who's going to run the miners and how are they going to pay their utility companies?

2025-05-16 07:56:36 GMT

Wir müssen *bitte was* schaffen?
https://social.bund.de/@Cyberagentur/114511939436500746
https://assets.chaos.social/media_attachments/files/114/516/433/916/175/770/original/93a6d43bcc168a25.png

2025-03-25 07:32:29 GMT

- reply

There's a totally hypothetical extended version of this diagram.
https://assets.chaos.social/media_attachments/files/114/221/898/517/467/248/original/6c4298580b4e36f2.png

2024-12-31 13:29:16 GMT

- reply

Five and a bit. Spent *a lot* of time in Kidspace, but also enjoyed walking everywhere with us.

2024-12-31 11:36:57 GMT

Ok, kid is now part of chaos. First thing she did at home is set up a sticker table for us. #38c3

2024-12-14 12:31:58 GMT

- reply

I have the Pebblebee, and one Motorola. The Motorola UWB isn't actually active yet (scheduled for a future software update). I bought a couple more pebblebees and they work well so far (also the audio to help you find it is *much* louder than Motorola).
My biggest gripe is that it's *only* in the Find My Device app, and I can't, for example, integrate into Home Assistant.
Working on it though ;)

2024-11-22 12:45:35 GMT

- reply

Check dmesg, there should be a more verbose kernel error. (Most likely: Your distribution did not install the module by default.)

2024-11-22 12:40:25 GMT

- reply

Yes, Wireshark can sniff USB both on your Linux host and (I believe) the Windows guest.
On Linux you could also use the "usbmon" kernel module directly (which is what Wireshark's using).
https://wiki.wireshark.org/CaptureSetup/USB
https://docs.kernel.org/usb/usbmon.html

2024-08-24 07:42:51 GMT

- reply

Tough choice.
https://assets.chaos.social/media_attachments/files/113/015/867/489/308/852/original/0e580595cf7df9b9.jpg

2024-07-19 06:57:38 GMT

Amsterdam Centraal hat ein Fahrradparkhaus.
Berlin Hauptbahnhof hat ein "Fahrräder abstellen auf dem gesamten Vorplatz verboten"-Schild.

2024-06-23 08:40:04 GMT

- reply

"We do these things not because they are easy, but because we thought they were going to be easy."

2024-05-26 21:06:36 GMT

https://blog.ploetzli.ch/2024/should-i-use-jwt-for-authentication/