Henryk Plötz

Born between E.T. and Blade Runner, occasionally hacking and breaking things, computer scientist living in Berlin.
He/Him.

ꙮ: ♥️💜💙
Blog: https://blog.ploetzli.ch
github/henryk: https://github.com/henryk/

Public Key

npub10646a26cpa6nf3rtd0azugyd734zcjm85y7f6nse0n99u0d0257q7acwt5

NIP-05 Address

[email protected]

Profile Code

nprofile1qqs8a2aw4dvq7af5c34kh73wyzxlg63vfdn6z0yafcvhejj78kh420qpzemhxue69uhhyetvv9ujuurjd9kkzmpwdejhgqg5waehxw309aex2mrp0yhxgctdw4eju6t0ar2r5h

Publishing to

relay.primal.net

relay.damus.io

nos.lol

Author Public Key

npub10646a26cpa6nf3rtd0azugyd734zcjm85y7f6nse0n99u0d0257q7acwt5

Show more details

Last Notes

2026-07-10 06:37:17 UTC

How ChatControl passed in the EU parliament.
https://assets.chaos.social/media_attachments/files/116/894/293/847/640/838/original/1b0d9e9526992342.jpg

2026-07-04 12:37:53 UTC

- reply

I'll note that this happened on a modern mobile phone, the most secure computing platform currently available. Logins simply should not "expire". There's nothing that makes a high-entropy token in secure storage suddenly go bad.
If you're confused enough to also then treat the same device as very trusted, that's just icing on the cake.
Even more: the token flow didn't work and I had to instead get an OTP by email. One of the, ahem, less secure transports. So the entire theater just collapsed.

2026-07-04 12:34:31 UTC

The absolute brain damage that developers have sustained when being subjected to "login expired" messages at a formative age without anyone telling them that this is not normal and should not be emulated.
Just now: "Your login session has expired, please log in again" … "another device is logged in to the account, please enter the token code shown on the other device".
So… the device is logged out because it might be untrusted, but is also the root of trust for new logins?
Cool.

2026-07-03 20:38:33 UTC

- reply

The correct[tm] Currywurst is Curry 36 at Zoo. Take the FEX Airport Express from BER to Hauptbahnhof, then any westerly S train to Zoologischer Garten.
(Alternatively S9 goes direct from BER to Zoo.)

2026-05-15 01:26:07 UTC

- reply

One of the phrases from Dollhouse (2009) that will forever live rent-free in my head is "drawer of inappropriate starches" (https://www.imdb.com/title/tt1216527/quotes/?item=qt0530408).
I have since striven to maintain one at work at all times.

2026-05-14 10:19:07 UTC

- reply

Well, either that, or a bronze age Nanoraptor having a bit of fun with a T-shaped bison that only has left legs.

2026-05-05 08:51:55 UTC

- reply

Weil wir Menschen wirklich schlecht sowohl in großen Zahlen als auch in logarithmischen Maßen sind, muss das immer mal wieder laut gesagt werden:
Der Unterschied zwischen einer Million und einer Milliarde ist ungefähr: eine Milliarde.

2026-04-17 18:04:42 UTC

Ok, fellow hackers, I propose a pact: That new EU age verification app thingy ... do NOT help improve it.
Don't publish findings. Don't responsibly disclose insecurities. Don't facilitate them making it bulletproof.
If personal data is directly at risk, by all means, slam their asses into the ground. GDPR them into oblivion.
But on its core functionality this needs to be, to become, and to stay, the most insecure, the most easily circumventable piece of shit code on the planet.

2026-03-03 13:29:36 UTC

- reply

Fun tidbit: The opposite is true now.
In order to prevent cross-domain tracking by observing cache hits, Browsers will not use a cached Google font across multiple domains. You gain nothing from using Google Fonts.
But, because it's an extra host, the browser will need to do the whole DNS/TCP/TLS dance to fetch the file, small as it may be, so you're getting additional latency compared to just downloading the file from the server it's already connected to.

2026-01-28 09:03:36 UTC

- reply

They also removed this paragraph from their official blog post:
> Matrix on Workers runs in production today, handling real encrypted communications for our team. It is fast, it is cheap, and it is arguably one of the most secure ways to deploy a homeserver today.
So, next time Cloudflare wants to tell us something about what they do "in production today", we'll have a frame of reference for how credible that is.

2025-12-29 17:54:36 UTC

- reply

Na sind sie doch, aber Tag 0 hatte halt noch kein Hauptbühnenprogramm.

2025-11-18 12:49:39 UTC

- reply

Personally, I'm very partial to this one.
(The Sovereign Tech Fund is a German government funded initiative to improve resilience of our tech stack.)
https://assets.chaos.social/media_attachments/files/115/570/773/791/463/500/original/58de22297077547a.png

2025-10-01 19:33:33 UTC

- reply

It spent 10 minutes on this?!
Now, while in principle I have nothing against sub-second, one-shot inferences, I must say that blasting a couple hundred watts for 10 minutes does not appear entirely appropriate if all you get is this kind of output.

2025-08-30 15:49:58 UTC

- reply

I'd object even before that: Bitcoin does not exist in a vacuum. It needs a substrate. Who's going to run the miners and how are they going to pay their utility companies?

2025-05-16 07:56:36 UTC

Wir müssen *bitte was* schaffen?
https://social.bund.de/@Cyberagentur/114511939436500746
https://assets.chaos.social/media_attachments/files/114/516/433/916/175/770/original/93a6d43bcc168a25.png

2025-03-25 07:32:29 UTC

- reply

There's a totally hypothetical extended version of this diagram.
https://assets.chaos.social/media_attachments/files/114/221/898/517/467/248/original/6c4298580b4e36f2.png

2024-12-31 13:29:16 UTC

- reply

Five and a bit. Spent *a lot* of time in Kidspace, but also enjoyed walking everywhere with us.

2024-12-31 11:36:57 UTC

Ok, kid is now part of chaos. First thing she did at home is set up a sticker table for us. #38c3

2024-12-14 12:31:58 UTC

- reply

I have the Pebblebee, and one Motorola. The Motorola UWB isn't actually active yet (scheduled for a future software update). I bought a couple more pebblebees and they work well so far (also the audio to help you find it is *much* louder than Motorola).
My biggest gripe is that it's *only* in the Find My Device app, and I can't, for example, integrate into Home Assistant.
Working on it though ;)

2024-11-22 12:45:35 UTC

- reply

Check dmesg, there should be a more verbose kernel error. (Most likely: Your distribution did not install the module by default.)

2024-11-22 12:40:25 UTC

- reply

Yes, Wireshark can sniff USB both on your Linux host and (I believe) the Windows guest.
On Linux you could also use the "usbmon" kernel module directly (which is what Wireshark's using).
https://wiki.wireshark.org/CaptureSetup/USB
https://docs.kernel.org/usb/usbmon.html

2024-08-24 07:42:51 UTC

- reply

Tough choice.
https://assets.chaos.social/media_attachments/files/113/015/867/489/308/852/original/0e580595cf7df9b9.jpg

2024-05-26 21:06:36 UTC

https://blog.ploetzli.ch/2024/should-i-use-jwt-for-authentication/