The world of the World Wide Web has changed as radically over the last three decades as almost no other area of human civilization. If we look back at the late nineties and the early two-thousands, the internet was an entirely different galaxy. The websites of those days were wild, unstructured, often colorful, and above all shaped by a deep enthusiasm of their creators.

It was the era of static HTML pages, blinking GIF animations, and guestbooks. Back then, you didn't just browse casually on the bus. Access to the web was a deliberate act. You sat down in front of a bulky CRT monitor, started a computer running operating systems like Windows 95 or the legendary Windows 98, and listened to the mechanical concert of the modem during the dial-up process. Bandwidths were minimal, images loaded line by line, and every minute online cost real money. Yet it was a space of unlimited possibilities, a digital Wild West shaped by enthusiasts.

As technology advanced, the infrastructure in the background changed too. Windows XP replaced the old systems and brought a new stability to households, while DSL lines made the blocked phone lines a thing of the past.

Websites became more complex, more interactive, and moved closer to people's everyday lives. It was the transitional phase into what became known as Web 2.0, in which users suddenly were no longer just passive consumers, but became shapers themselves. Forums shot up like mushrooms, blogs gave individuals a worldwide voice, and platforms like YouTube or early social networks began to fundamentally change the structure of exchange.

The computer was during this time the undisputed gateway to this world. A tool that stood on the desk and was switched on after work or after school to dive into a different reality.

This era of desktop dominance lasted for years, but in the background the next great revolution was brewing. With the rise of modern smartphones, led by the first iPhone and the subsequent Android wave, the focus of the digital world shifted unstoppably.

The internet was suddenly no longer tied to a place or to a specific device on the desk. It migrated into the pocket.

This transformation happened at a racing speed. As early as 2016, a historic threshold was crossed: for the first time, more than fifty percent of all internet users worldwide were browsing via mobile devices. Websites had to adapt, design became more responsive, but also more uniform. The wild, individual design of the early days gave way to optimized, clean layouts that load quickly on small screens and can be easily operated with a thumb.

Around the year 2019 (at the latest), this transformation was completely finished. The internet had evolved from a tool that one uses deliberately into a permanent extension of the self. One was no longer online, one was never offline.

In this new reality, only a handful of gigantic corporations dominated the entire market: Google controlled search and advertising, Facebook dominated social interaction and communication, Apple and Microsoft provided the platforms and the hardware on which all of this took place.

This centralization marked the end of the old, decentralized web. The space that was once defined by millions of individual homepages and independent forums was herded into enormous, closed platform ecosystems. The algorithms of these corporations began to determine what we see, what we read, and what we think about.

Between Technology and Generations

I myself was born in the year 1998, in an extremely exciting phase just before the gigantic dot-com bubble burst. One could claim that I grew up in exactly the first generation that experienced the modern internet as a permanent companion from an early age.

I had my very first own computer at around the age of six. That was in the year 2004. On this computer, however, the technology running was by no means the most modern, but rather the already visibly aging Windows 98. This was simply because in many families the older hardware was passed down rather than always buying the newest model.

The urgently needed upgrade to Windows XP I was then allowed to carry out myself a few years later, and indeed quite classically from a physical CD-ROM. Those who lived through those times know exactly what the mechanical whirring of the CD drive sounded like while you stared full of anticipation at the blue installation screen.

With my birth year, I fall according to common definitions just barely within the range of Generation Z.

It is in any case fascinating to observe how closely we couple generations today to the respective state of technological development. One can often draw the boundaries between age groups far more precisely using hardware releases and digital milestones than through rigid year numbers.

Let us simply ask ourselves for illustration: which Nintendo console releases did you actively experience? Whoever consciously witnessed the historic release of the Nintendo 64 in June 1996 and was already in the world at that point clearly belongs to the group of Millennials. In my case, the earliest point of contact was the GameCube, which came to the European market in May 2002. That marks the classic entry point for Generation Z. Today's Generation Alpha in turn grows up with the Nintendo Switch or its successors and no longer knows a world without touchscreens and permanent cloud connectivity at all.

At the end of the day, all these terms like Millennial, Gen-Z or Gen-Alpha are of course extremely vaguely defined. It always remains to some extent a matter of interpretation exactly where the dividing lines run, and honestly speaking it is completely irrelevant to me in everyday life which of these pigeonholes one puts me or others into.

Linguistic categorizations and the dynamics behind such terms are admittedly an immensely fascinating field, but we don't need to lose ourselves here in any colorful, linguistic fantasy worlds.

What really counts is the lived experience with the tools of our time. Whoever has personally traversed the transition from analog or at least purely local computing to total connectivity looks at today's web with an entirely different awareness than someone for whom the internet was always as self-evident as electricity from the socket.

How the Web Shaped My Path in Life

Six years after my first Windows 98 computer, in the year 2012, at the age of twelve I had finally saved up enough money to buy my own, up-to-date computer.

This device would accompany me intensively over many years (until today, but in the sense of the Ship of Theseus paradox) and would significantly shape my path in life.

Back then I spent, like so many my age, two to three hours daily with online games. My absolute favorites were League of Legends and Old School RuneScape. Particularly the hours-long immersion in RuneScape was in retrospect an extremely instructive school of life. The game taught me the hard way that you should absolutely trust nobody who makes any kind of promises on the internet.

Anyone who back then lost their laboriously earned armor to an apparently nice player who offered to upgrade the items for free knows exactly what I'm talking about. My personal trauma was the loss of my Rune plate armor. This early lesson in digital skepticism burned itself deep into my brain: question everything, examine the intentions, and never be naive.

But the PC was for me far more than just a gaming machine. Through gaming I found the entry into deeper IT topics. I wanted to understand how things work behind the scenes, how networks are built and how software is created. At the same time I developed through browsing the web a huge passion for science, particularly for astronomy and chess. I lost myself for hours in complex, logical puzzles and crypto-riddles like the world-famous phenomenon Cicada 3301.

The internet back then was a gigantic treasure chest of knowledge. When I wanted to learn something new, there were no algorithmically optimized feeds bombarding me with short videos. Instead I searched deliberately for YouTube videos by passionate explainers, read my way through extremely detailed blog posts by experts, and dug through forum posts in which nerds from around the world shared their knowledge completely free of charge and without commercial ulterior motives.

The forums were places of genuine exchange. You had to register, follow rules, and built up a reputation over years within a small, select community. The blogs were personal diaries and knowledge databases at the same time. When someone published a text on the web, it was mostly because they had a real passion for the topic and wanted to leave something lasting behind for the world.

This digital environment not only massively fueled my technical skills, but also shaped my way of thinking. It showed me that the internet can be the most powerful educational tool in human history, if one learns to use it correctly and self-determinedly.

The Invasion of AI Slop and the Decay of Today

The most radical upheaval of recent internet history announced itself when the first large language models appeared on the scene. When OpenAI published the paper on GPT-3 on May 28, 2020, and the technology slowly became accessible, I was immediately fired up. I was among the first to throw themselves into this new world, because the topic of automated conversation had fascinated me long before. I had in fact already programmed my own chatbots and published them on the web, long before it became cool and mainstream through the big hype.

The modern large language models were of course an entirely different caliber in comparison. What began as a fascinating technological revolution has however developed over the last few years into a real plague. We are writing in the year 2026, and half the internet is by now filled to the brim with so-called AI slop. This term describes the endless flood of low-quality, synthetically generated content that is dumped onto the web without sense or reason, solely to manipulate search engine rankings and siphon off advertising revenue. Experts and technology analysts have long been warning of a genuine meltdown of information quality. Everything I consume on the internet today I have to question three times over. The ease of the old web has completely vanished.

A perfect example of this rapid decay is provided by the platform LinkedIn. In order to generate a little reach and traffic for my projects, I created my own account there about a month ago. What gets flushed into my feed there on a daily basis is absolutely shocking. The sheer mass of posts that obviously originate one hundred percent from the AI factory is barely tolerable anymore. It is always the same unnaturally smooth text structures, the same phrasal motivational sayings, and alongside them completely bizarre AI-generated images in which people with six fingers sit in sterile offices.

Did any real human actually look at this before posting it? It feels like a sterile ghost forest. Machines write texts for other machines that then automatically like and comment on them, while genuine human exchange gets left completely by the wayside. I have already addressed this alarming development in my last blog post.

The Digital Divide and Our Responsibility

That these grievances immediately catch my eye is of course due to my personal bubble. I have been a trained software developer in Germany since the year 2020. I am chronically online, work daily in the engine room of the internet, and probably also view the whole thing to some extent as an occupational hazard. I constantly have to check whether my servers are running stably, I maintain my websites and optimize the code.

My digital projects are like my own babies to me. Even my LinkedIn profile I do not regard as a classic social media channel for self-promotion or showing off, but rather I maintain there essentially a public developer diary. For me these platforms are purely tools that I deploy deliberately and with a clear awareness of the mechanisms behind them.

But what does reality look like outside our tech bubble? How does a Karen from accounting, a Miriam from the HR department, or the Uwe in the logistics warehouse fare when they navigate the web? They also use the internet daily, but often without the technical background knowledge about algorithms, prompting, and automated content factories.

This is precisely where the decisive question lies: how does this flood of artificial content influence their daily internet use? Are they even remotely aware of what is happening in the background? Whoever does not deal with software development or the tech industry on a daily basis often does not notice at all how subtly they are being manipulated by AI-generated content, distracted, or simply fed misinformation. When half the web consists of synthetic garbage, trust in digital media as a whole erodes.

Even I as an experienced developer who has been intensively following the emergence of this technology for years must openly admit: I frequently stand before content and fail despite all my expertise to distinguish a cleverly written AI plagiarism one hundred percent from a genuine human text.

Yes, there are efforts to label such content or mark it with digital watermarks. But let us be absolutely honest with ourselves. On LinkedIn and on countless other platforms I see every day masses of posts that pass through completely without labeling and continue to clog the web. If we simply shrug our shoulders and accept this state of affairs, we are capitulating before the algorithmic mud wave.

What You Can Concretely Do About It Now

The situation may appear bleak at first glance, but we are by no means helplessly at the mercy of this development. We must stop allowing ourselves to be fed like passive consumers in the walled gardens of the big platforms. Do it exactly like me instead: go back to the roots of the web. Build your own independent website.

It has never been as easy as today to secure your own domain and set up a small server or host a static page. Show the world out there what you have created with your own hands, what you have coded, or what you have genuinely thought deeply about. Your own website is your personal protected space in the digital realm, a place where no algorithm in the world determines what your content has to look like or who is allowed to see it.

That's pretty damn cool, isn't it?

See that? I swore. I can do that because this is my website.

If you browse around on my page, you will also find in my finds targeted posts about defending against and precisely identifying AI-generated content. It is a genuine matter of the heart for me to pass on this knowledge and sharpen awareness of the digital slop.

We must learn to look more carefully again and to display a healthy skepticism. Use tools for verification, pay attention to the typical linguistic patterns of language models, and don't be blinded by sterile, perfectly polished posts that were generated in seconds without a human spark.

The most important step however is a very personal promise to yourself and to your fellow human beings: be absolutely honest with yourself and ensure at every point in time that YOU are writing and publishing the content, and not an anonymous AI in the background. There is absolutely nothing wrong with using technology as a source of inspiration or as a tool for spell-checking.

The voice, the soul, the mistakes, and the genuine edges and corners of a text must compulsorily come from you. Your readers, your customers, and your genuine friends on the web will thank you infinitely for it. They long in this flooded, artificial world more than ever for genuine, authentic human experience. Let us together reclaim the real internet.

That's how chatbots were when the world was simpler.

https://www.cleverbot.com/

The arguments were sound, the structure seemed professional at first glance. But while reading, an uncomfortable feeling quickly crept over me. Do you know that feeling when a text is grammatically perfect, but still somehow feels "wrong"? I looked closer.

There they were: em-dashes en masse. Almost every second sentence was interrupted by these long dashes. On top of that, there were strange, almost imperceptible jumps in thought between the paragraphs. Phrases repeated themselves in slightly modified forms, and the text drifted along in a permanent, artificially bloated epic style. The irony was perfect: an article warning about the takeover of the industry by AI was obviously entirely generated by an AI itself.

I thought to myself: "Well, the tech gurus on Hacker News will notice that immediately." After all, the smartest minds in the IT world hang out there. I scrolled through the comments to read the malicious reactions. But instead I found: nothing. Serious discussions about the content. I set my own sign.

When even the smartest minds no longer perceive the difference between human pen and algorithm, we have reached a turning point on the internet. We consume content every day without knowing whether it is backed by real creativity or just a well-trained prompt response.

It was precisely this feeling of untransparency that made me reflect sustainably. In order not to become part of this anonymous noise myself, I want to go a different way. It is time to provide clarity, and therefore I hereby disclose how I personally deal with AI in everyday life.

The Code: Why my footer is not a liar

When you go to my website and scroll all the way down to the bottom left, you will find a sentence that I chose deliberately: "Built with care by hand".

I take this sentence damn seriously. At the same time, however, I also have to be honest: this does not mean that I completely do without artificial intelligence in the year 2026. For me, this sentence states that this website was not created autonomously by some AI agents. There are tools out there where you press a button, type in: "Make me a portfolio page for a developer", and presto: the system spits out a finished, soulless page.

That is not my way.

I basically deal with AI exactly the same way I used to deal with StackOverflow or Google back then. When I am at a point while programming where I simply don't know what to do next, I ask one of the models.

Which model do I use? For me, that is a matter of pure gut feeling and a question of the available free tokens. When the contingent for model A is exhausted, I move on to model B. Despite the fact that I ask the AI for advice every now and then and sometimes adopt the source code generated by it 1:1, that very sentence still stands at the bottom left of my page.

I can already hear the critics shouting: "Hey! You say it's built by hand, but you use AI? Traitor!" But in all seriousness: back when we searched through forum posts for nights on end, did we put "Built with the help of Google" in our footer? No. The creative mind, the architecture, and putting the puzzle pieces together. For me, that remains manual work.

The Translations: AI as my personal bridge builder

Another area where AI takes an incredible amount of work off my hands is translation work. My website is structured bilingually. It used to be an absolute chaos. Since my brain runs on either German or English depending on the form of the day and consumed media, my site was a colorful, mixed-up patchwork quilt. That looked unprofessional and unstructured.

Today, my workflow looks like this: for every text, I first choose a source language, mostly German, because I can express myself most precisely in it. Once the text is ready, I let the AI translate it "word for word" / "literally". The beautiful thing about modern LLMs compared to old translation tools is that they understand the context. They do not just blindly translate words, but transport the tone of voice. The AI functions here as a bridge that makes my thoughts accessible to an international audience without losing the original vibe.

The Blogs: Raw brainstorm meets the stonemason

Let's come to the blogs and thus also to this text that you are currently reading. I firmly maintain: my blogs are still written by hand. But here, too, AI is used, namely as my personal stonemason.

When I have an idea for a blog post, I just start typing. I don't care about grammar, punctuation, or smooth transitions.

• I formulate my texts in the first draft with an immense amount of typos.
• There are expressions in there that could straight up come from a six-year-old.
• I throw around creative, colorful, and sometimes completely absurd metaphors.

Someone has to document my creative chaos, after all.

The result is a raw, wild pile of text. Mostly around 4,000 to 6,000 characters. I take this digital mud, throw it into a model of my choice, and give the system a very clear, strict instruction:

"Take this text. Target: at least 10,000 characters."

So the AI takes my raw material and stretches it out, builds elegant sentence structures, and ensures the necessary text volume. What comes out of it must, of course, never be published unfiltered. Therefore, I always proofread the whole thing extremely thoroughly, correct it, and put my final stamp on the text.

What I will absolutely never do under any circumstances, however, is: "Give me 10 ideas for cool blog posts" or "Formulate a topic from scratch for me to 10,000 words." That is the red line for me. The content, the ideas, the core thoughts are and remain human. The AI is my tool, not my ghostwriter.

A small funeral for the dash

When correcting these texts formulated by the AI, one thing has struck me extremely hard lately, forcing me to make a radical change: I now systematically replace all en-dashes and em-dashes with other punctuation marks.

Why? Because these dashes have now become the absolute brand mark of AI texts. The language models have simply used them far too inflationarily in recent years. If you see a German text today that uses an elegant dash every two lines, the internal AI detector triggers immediately. Personally, I find that an incredible shame.

I really liked the en-dash very much. Back in the day, I used to explicitly google it and copy-and-paste it into my texts because it just looks nicer in the typeface than the clumsy, short hyphen. Later I learned the shortcut: under Windows with WIN + -.

The en-dash (–) is called that because in traditional typography it has exactly the geometric width of a capital letter "N", same for the em-dash (—) for "M". All these beautiful fun facts will slowly be forgotten because this beautiful symbol is today one of the clearest indications of soulless AI texts. It was corrupted by the algorithms. So please take this paragraph as a small, sad funeral for my beloved dash.

Conclusion: For a new culture of honesty on the net

I am no extremist. I don't expect everyone to frantically slap "Created with the help of AI" into their website just because they briefly asked a model for a synonym.

What I do demand, however, is a certain degree of fundamental honesty as soon as someone clicks the big, red "Publish" button. I would like to know on the internet where a human was still actively involved and where not. I want an awareness for the value of thoughts to emerge again.

As harsh as it may sound: I want people to feel a bit ashamed again when they just barf a purely AI-generated, unverified text onto the net just to grab SEO traffic or fake content volume.

We urgently need to promote a culture on the internet where the human remains in the loop when creating content. A text should be the product of a human mind making use of tools to express itself better. Not the product of a machine trying to completely simulate human thinking while the actual "author" only counts the clicks. Because nowadays, what is generated without rhyme or reason is no longer real content. It is nothing but digital noise.

Let's stay human. With all our typos, our quirky metaphors, and our own, imperfect style.

*~ This blog post originated from originally 6,988 characters, which were typed by hand with a lot of heart and soul, typos, and real thoughts.

Gemini OneShot prompt for it:

hierzu einen blogpost insgesamt mindestens 10000 zeichen

Delivered: 12,580 characters.

Post-correction: 10,376 (incl. .md formatting and reading 5 times)

Formatted with this tool.

This book has shaped modern creator and developer culture like almost no other book. It takes away the fear of the 'perfect product' and shows why it is much cooler (and more successful) to openly share your daily learning process online.

https://a.co/d/01XZIX8b

An interesting look at the typical, recurring patterns ('smells') of AI-generated content. From certain sentence structures in writing to always identical design elements on websites.

https://shvbsle.in/various-llm-smells/

A short, honest post about why nobody reads your blog and why you should keep writing anyway.

https://www.alexmolas.com/2023/07/15/nobody-cares-about-your-blog.html

An absolutely timeless essay that coined the concept of “innovation tokens.” It brilliantly explains why, in real production operations, you should rather rely on boring, proven technology instead of chasing every hype.

https://mcfunley.com/choose-boring-technology

At the time I was on vacation in Croatia, relaxed somewhere between the Adriatic coast and Croatian summer cuisine, and the last thing I wanted to deal with was an unreachable server. My first suspicion was the obvious one: hotel WiFi. Who doesn't know the story? Those strange captive portal situations, application-layer firewalls that selectively block certain ports, some deep packet inspection shenanigans that occasionally turn a hotel network into a black box. SSH on port 22 is definitely something some network admins block in public networks. I pushed the problem aside and enjoyed the rest of the vacation.

But then I got home. Same IP, same command, same timeout. This was no longer hotel WiFi. This was my home network. This was my usual setup. And it still didn't work.

Emergency Solution with Obstacles

What's left when SSH fails? The detour via the remote console of my hosting provider IONOS. Anyone who has worked with it knows: it's no pleasure.

The console is browser-based, the keyboard input runs through some kind of virtual machine, and on top of that the keyboard layout is American (QWERTY), which is particularly annoying with bash commands since the special characters are often in different places than you're used to. The most painful part: no pasting with Ctrl+V. Every command, every IP address, every long config path has to be typed character by character. Still manageable for short commands, a real test of patience for longer configuration blocks. Nevertheless it was the only tool available to me in this situation. So let's get to work.

What the Logs Were Saying

Even the first look at the auth logs was sobering and revealing at the same time. systemctl status sshd quickly showed that something was wrong. A look at the logs confirmed the suspicion: grep "Failed password" /var/log/auth.log spat out hundreds, if not thousands, of entries. Bots. Countless bots. Automated scripts systematically trying usernames and passwords: root, admin, ubuntu, pi, test, deploy. A classic brute-force attack on SSH.

This is not an unusual phenomenon. Every server with a public IP address on the internet running SSH on the default port 22 gets found by bots and attacked within minutes of its first start. Search engines like Shodan continuously index open ports, and botnets use this data to automatically launch login attempts. My server hadn't been targeted specifically, it was simply part of the daily background noise of the internet.

The good news: my root password wasn't root123. The bad news: everything else was still pretty close to the default settings.

But back to the original problem: the timeout. While I was digging through firewall rules and log files, the actual problem was still in the dark. I had already invested several hours in troubleshooting, consulted various AI models, done forensics on the UFW rules and checked the IONOS firewall configuration multiple times. Nothing.

After about six hours an idea came to me that in hindsight was so obvious that I had to briefly laugh at myself: instead of the numerical IP address I simply entered the domain. root@nicohartmann.dev Connected. Immediately. Without delay.

The reason lay in the way IONOS internally handles DNS and routing. The direct IP address of the server was apparently routed differently than the address resolved via the DNS name, a subtle difference in the network configuration that turned out to be the actual culprit behind my timeouts. Not the bots, not the firewall, not the hotel WiFi. Simply a routing problem that was hiding behind the domain resolution. Six hours of debugging. A solution with 24 characters.

Hardening: Now More Than Ever

Now, with a working SSH connection, I could catch up on what should have been done long ago: properly securing the server. And the look at the logs had underlined the urgency once more.

Cleaning up the firewall was the first step. UFW (Uncomplicated Firewall) offers a pleasantly clear abstraction layer over iptables. I checked the existing rules, removed unnecessary open ports and restricted incoming traffic to the essentials. At the same time I also adjusted the IONOS-internal firewall, which sits as an additional layer in front of the actual server and operates at the infrastructure level. Double protection never hurts.

Fail2Ban came next. The tool monitors log files and automatically blocks IP addresses that stand out due to repeated failed login attempts. After three failed SSH logins within a short time, an IP ends up in jail and can't get through for a defined period. This not only reduces the attack surface but also significantly reduces the noise level in the logs. The configuration for SSH is straightforward. Fail2Ban already comes with corresponding filters, they just need to be activated and adjusted to your own needs.

Unattended Upgrades closed another gap that I had simply never actively addressed: automatic security updates. Unpatched packages are one of the most common entry points for attackers, and manually remembering to regularly update a server is unreliable in the long run. With unattended-upgrades the system downloads and installs security-relevant updates on its own, without my involvement, without me having to think about it at three in the morning.

Changing the Locks

The server was running, the connection was established, and Fail2Ban was already watching over the incoming login attempts. But anyone who has looked at the auth logs and seen how tirelessly these bots work, second by second, hour by hour, knows: reactive measures aren't enough. The actual attack surface needs to be reduced. And the biggest attack surface was still SSH itself.

The default configuration of OpenSSH is functional, but not security-oriented. Port 22 is known worldwide, password authentication is active by default, and root login is directly allowed in many distributions. That is a combination that practically invites bots.

The first step was a port change to 2222. This is not a security mechanism in the actual sense. Security through obscurity is rightly not considered a real defense. Anyone who searches specifically will find the port. But in everyday use a non-standard port filters out the absolute majority of automated traffic, because most bots exclusively scan port 22. The logs get quieter, Fail2Ban has less to do, and the signal strength for real attack attempts increases. A pragmatic compromise.

The second and significantly more important step was disabling password authentication in favor of SSH key authentication. Passwords can be guessed, leaked or compromised through brute force. A cryptographic key pair cannot, at least not with any reasonable effort.

The process is straightforward: ssh-keygen -t ed25519 Ed25519 is the modern standard for SSH keys: compact, fast and cryptographically far more robust than the older RSA with short key lengths. The generated key then needs to be transferred to the server. An important point I almost overlooked at first: this step needs to be carried out on all machines from which I access the server. Anyone who only deposits the key on one device and then disables password auth locks themselves out of all other devices. An unpleasant experience I was able to spare myself through timely thinking.

Only after the key authentication had been tested and confirmed working on both machines was PasswordAuthentication no set in the config file and the SSH service restarted. From this moment on a login without a matching private key is simply no longer possible, no matter how many passwords a bot tries.

Don't Forget the Deployment Process

One detail that's easy to forget when you change your SSH port: automated processes that also communicate via SSH. In my case this affects the GitHub Actions pipeline that automatically deploys my portfolio website to the server on every push to the main branch.

This pipeline connects to the server via SSH and had been doing so via port 22 up until now. After the port change to 2222 the deployment went nowhere. The solution is simple, but you have to think of it: adjust the port accordingly in the action configuration. A port: 2222 in the SSH parameters of the action, a new commit and the deployment process was running smoothly again.

The Forgotten Neighbor

Alongside the actual server, Mailcow is also running on my machine, a self-hosted mail server solution that I operate for my own domain. And while I had been intensively taking care of SSH, Mailcow had been somewhat neglected in the meantime.

The admin password was one of those passwords that I had set once but then lost track of. So: reset it and replace it with a new, memorable but secure password. Sounds trivial, but it's one of the most common security vulnerabilities in self-hosting: default passwords or forgotten, never-changed initial passwords.

Mailcow comes with its own security mechanisms, but they have to be actively enabled. Fail2Ban is also integrable in Mailcow and monitors failed login attempts on the web interface and the mail protocols there. The setup follows the general Fail2Ban logic, but is directly configurable via the Mailcow interface.

Particularly important was setting up two-factor authentication, both on the admin account and on the actual mailbox. 2FA is by now the minimum standard for every account where a compromise can cause real damage. A mail server admin account definitely falls into this category: anyone who breaks in there can not only read mails, but control the entire mail flow, set up redirects and in the worst case gain access to linked services via password reset mechanisms.

Knowing What's Happening on the Server

With the acute security measures done, a question came up that had been simmering in the back of my mind for a while: how do I find out when something goes wrong again, before I notice it by chance?

The answer was a custom monitoring setup. And since I was already at it, I didn't just want to use the collected data internally, but make it directly accessible: as a public status page on my portfolio website. The result is the project sysstats. an overview that shows me at any time how my server is doing: CPU load, memory usage, and also a listing of the IP addresses banned by Fail2Ban. The latter will presumably get significantly shorter with the new security measures, which I consider a success, even if the long list of banned IPs had its own morbid charm.

Conclusion

What started as an annoying timeout on a Tuesday morning in Croatia ended with a server that is considerably more robust than before. Port change, key authentication, Fail2Ban, automatic updates, hardened mail server, 2FA and monitoring. That is not excessive effort. That is the foundation every self-hosted server should have.

But the actual lesson was a different one: how much background noise there is on the internet, how active and automated the attacks on every public server are, and how little it takes to effectively protect yourself against them. The bots won't stop. But they'll have significantly less fun with my server from now on.

An extremely practical tool to cleanly format program code for presentations (e.g., in PowerPoint) and provide it with syntax highlighting.

https://highlightjs.org/demo

A brilliant talk by the creator of Erlang. With plenty of charm, he dissects the absurd complexity of modern software stacks and explains why we are sitting on a house of cards made of misunderstood code.

https://www.youtube.com/watch?v=lKXe3HUG2l4

A legendary masterclass in over-engineering. It’s a hilarious, satirical look at what happens when you apply every corporate software pattern imaginable to a 10-line coding challenge.

https://github.com/EnterpriseQualityCoding/FizzBuzzEnterpriseEdition

A critical essay arguing that bad and messy code ('slop') is not an invention of AI models, but has always been a human problem, and how to solve it.

https://nadathurx.com/ai-slop-what-about-human-slop/

An annually updated collection of humorous IETF Request for Comments (RFC) documents, traditionally published on April 1st.

https://gist.github.com/eliminmax/7e70b89ae9a996aec7bbb32229def45b

Analyze the loading time and performance of your website on mobile and desktop devices.

https://pagespeed.web.dev/

An honest confession about the moment when 'clean code' becomes a hindrance.

https://overreacted.io/goodbye-clean-code/

The path there felt like a leisurely walk at first, but quickly turned into a digital marathon. While SEO scored full marks on the very first analysis, there were still a few rough edges when it came to accessibility. The main problem was the buttons used to switch between images on the homepage. According to Google's algorithms, they were simply too close together. A classic mobile usability issue: if your fingers are too thick, you tap the wrong thing. So I adjusted the spacing, enlarged the touch targets, and just like that, accessibility jumped straight to 100.

But then came performance. On desktop, everything still looked rosy. A powerful processor and a fast connection forgive many sins. But the mobile view is merciless. It is the final boss of every web optimization effort. Mobile devices often have weaker processors and struggle with unstable network connections. This is where the wheat gets separated from the chaff. Anyone who wants to reach 100 here has to dig deep into the bag of tricks and be willing to question every single byte.

Debugging with a Guilty Conscience

Performance tuning is a very particular kind of debugging. Normally when debugging you are like a detective solving a murder case where you are somehow also the perpetrator. You are looking for the one logical error, the one line of code that brings everything crashing down. When optimizing for speed, the detective role stays the same, but the crime is more subtle. The act was never intentional. You did not deliberately write slow code. You were simply naive. I had been coding away, adding features and pulling in libraries, without ever seriously thinking about metrics like First Contentful Paint or Largest Contentful Paint.

These abbreviations, FCP and LCP, sound like technical gibberish at first, but they determine whether a user stays on the page or bounces away in frustration. First Contentful Paint measures when the first element appears on the screen. Largest Contentful Paint indicates when the main content element has loaded. When these values are in the red, the website feels sluggish and lifeless. My journey into the world of milliseconds began right here.

WebP, Lazy Loading, and the JavaScript Bundle

One of the first lessons I got to learn was about the WebP image format. If you browse around in forums, you will always find voices claiming that WebP is complicated or does not bring much benefit. But my experience was completely different. WebP is absolutely fantastic when it comes to drastically reducing file size while maintaining the same quality. In the past I barely thought about compression. Today I know that every kilobyte counts. An image that weighed 500 kilobytes as a JPEG often shrinks to under 50 kilobytes as WebP, without the human eye noticing any difference.

At the same time, I started pushing the principle of lazy loading to its limits. The idea is simple: only load what the user is currently looking at. Why should the image in the footer be loaded while the user is still reading at the very top of the header? At first I was skeptical about whether you should really delay loading everything. But in the fight for 100 points on a smartphone, this strategy is worth its weight in gold. It relieves the initial bandwidth load and ensures the browser can focus on the important elements that need to be visible right away.

But the biggest challenge was waiting in a place I had completely underestimated: JavaScript bundling. Bundling sounds great in theory. You pack all the small scripts into one large file to minimize the number of server requests. The problem arises when this bundle swells into an unmanageable monster. In my case, I ended up with around 73 kilobytes of unused JavaScript. That sounds like very little at first, but for Google's analysis tools it is an open invitation for point deductions.

The tricky thing about unused code is that you often have no idea where it is coming from. It hides in the depths of the dependencies you have accumulated over the months. You install a library for one small feature, and suddenly you are dragging along a massive package of logic that will never be executed. Hunting down this dead weight in the code was tedious. I had to learn how to use analysis tools that broke down exactly which functions were actually needed and which ones were just taking up space.

Language Files and Double the Ballast

During this process I stumbled upon another, almost embarrassing problem: my language files. Since this website is bilingual, I had initially been loading the German and English texts in a shared package. A classic beginner's mistake. A user reading the German version has no need for the English translations sitting in their browser's memory. The solution was a radical overhaul of the loading structure. Now the language files are loaded strictly separately. Only what is currently active gets loaded. This step alone noticeably improved load times and pushed the performance metrics upward.

But the journey was not over there. While cleaning up my language files, I noticed how carelessly I had been handling external libraries. Over time I had built up quite a collection. The low point was realizing I had installed two completely different libraries for notifications: Toast and Sonner. Both essentially do the same thing, they make little messages pop up at the edge of the screen. Why did I have both in the project? I could not remember anymore. Probably I had tried one out, forgotten to delete the other, and ended up dragging both along.

The crowning irony, however, was that after a closer analysis I had to admit I was not using any notifications on the website at all anymore. I had been loading two libraries competing with each other for resources, for a feature that was not even active. A rude awakening. Removing this dead weight felt like a digital spring cleaning. Every deleted line of code, every removed library was a small victory on the road to the perfect score.

This phase of cleaning up taught me an important lesson about discipline in software development. It is easy to add new things. It is hard to remove things again when you no longer know exactly why they are there. The fear of breaking something often keeps you from cutting radically. But that exact kind of radicalism is necessary if you want to build a website that not only works, but also belongs to the top tier when it comes to speed.

Four Green Circles

After countless hours of testing, optimizing, and testing again, the moment finally arrived. I pressed the analysis button in PageSpeed Insights once more. The loading bar crept forward. The tension built. And then they lit up one by one: four green circles, each with the number 100 in the middle. A moment of pure relief. It had been a long road, marked by small frustrations and big lessons learned. But in the end I pulled it off, as you can also see in the current PageSpeed Insights Report.

This experience fundamentally changed my perspective on web design. It is no longer just about something looking good. It is about how efficiently the technology behind it works. A fast website is a sign of respect for the user and their time. You are not forcing them to download unnecessary data or wait around for sluggish scripts.

Optimizing for the full score was more than just a technical exercise. It was a deep dive into how modern browsers work. I learned how important the prioritization of resources is. Which scripts need to run immediately? Which ones can wait until the page has finished rendering? These questions sound trivial, but the answers make the difference between a good and an excellent user experience.

Looking back, the decision to tackle SEO and accessibility first was exactly right. These areas form the foundation. Without accessibility you are excluding people, and without SEO nobody will ever find the page. But performance is the engine that drives everything. A car with a great paint job and comfortable seats is worthless if the engine keeps sputtering. My digital engine now purrs like a kitten, and the feeling of having an optimized product out there on the web is priceless.

What fascinated me most in the end was the impact of the small things. You often think you need to swap out the entire framework or rewrite a section from scratch. But most of the time it is the accumulated effects of small corrections. One incorrectly scaled image here, one forgotten script there, and a messy CSS file add up quickly to a delay of several seconds. Anyone who learns to find these small adjustment screws holds the key to performance in their hands.

The process also showed me that you are never truly finished. The web is constantly evolving, new standards emerge, and user expectations keep rising. What earns a 100 today could be a 95 again tomorrow after a new algorithm update. But that is fine. Now that I have the tools and the knowledge, I actually enjoy this continuous improvement process. It is a constant race against your own complacency and toward better technical quality.

To close, I can only advise every developer to take the time and really put their own site under the microscope. Look at what is happening in the background. Understand your JavaScript bundle. Question every library. It is worth it not just for the statistics or the vanity of reaching a perfect score. It is worth it because you become a better programmer along the way. You develop a feel for efficiency that goes far beyond web development. It was a hard road, but cracking 100 on PageSpeed Insights was worth every single step. The website now feels as light on its feet as I always wanted it to. A project is only truly finished when you cannot remove anything else without affecting the function.

Interviews with the giants of the industry (including Ken Thompson, Donald Knuth). You'll discover how these legends actually work, how they debug, and why they sometimes hate their own code. Real insights, no marketing fluff.

https://a.co/d/00NrnGlv

A list with hundreds of free interfaces for software development, sorted by categories such as music, news, or weather.

https://github.com/public-apis/public-apis

Originally delivered at CodeMash 2012 this talk highlights the 'insane' and often hilarious inconsistencies found in Ruby and, most famously, JavaScript.

https://www.destroyallsoftware.com/talks/wat

A simple web tool that instantly calculates the reading time, word count, and reading speed for any text.

https://readtime.io/

Squoosh is a powerful browser-based tool by Google that allows you to optimize, compress, and convert images into modern formats like WebP or AVIF in real time.

https://squoosh.app/

Why everything suddenly got worse and what to do about it.

https://a.co/d/00HBuEcj

Thousands of pages of source code that once took us to the Moon.

https://github.com/chrislgarry/Apollo-11

A hands-on workshop where you write every piece of a GPT training pipeline yourself.

https://github.com/angelos-p/llm-from-scratch

SEO is the magic word that gets hammered into you in every marketing blog. Search Engine Optimization. It sounds like an exact science, almost like alchemy, but in reality it is the only measure with which I can manipulate Google and the like. You try to outsmart a system that is smarter than yourself by feeding it exactly what it wants to hear. So I started equipping every single subpage with correct titles and descriptions. Every meta tag was polished, every headline was reconsidered three times. You feel a little like a fraudster trying to sneak into an exclusive party. The goal is clear: the search engines must like it. It is no longer about what the human reader thinks, but about what the algorithm spits out in its dark data centres.

The Capitulation of Language Before Statistics

The whole thing has a frightening similarity to LinkedIn. We all know this platform where people pat each other on the back and inflate their CVs until they almost burst. SEO is basically nothing other than digitally stroking one's own ego. The only difference is the target audience. Instead of recruiters or potential business partners, I want to impress robots. I write texts for beings without consciousness that count words, calculate keyword densities, and measure loading times in milliseconds. It is a bizarre form of modern communication in which the human being only plays the role of the supplier, while the bot decides whether you are relevant or not. When the bot smiles, the ranking rises. When the bot frowns, you remain buried in digital insignificance.

In theory, SEO sounds quite simple. You take a few keywords, build them into the text, and wait for the world to discover you. But reality catches up with you faster than you can spell keyword research. It gets damn quickly very complex. This is mainly because different search engines have different requirements. What Google loves, Bing might ignore, and DuckDuckGo has its own rules anyway. Moreover, you have to accept that you cannot be found for everything. You cannot be the king of the internet if you have no army. So you have to find an appropriate niche. For me that was quickly clear: IT lecturer and software development. Those are the terms with which I earn my bread and under which I want to be found.

However, this is where the strategic dilemma begins. I am also a trainer, and I would actually have loved to include that word in the title as well. It describes part of my identity and my daily work. But the hard reality of search engine optimization says no. If I were to throw even more keywords into the ring, I would dilute my focus. Every additional word is a potential disruptive factor that diminishes the relevance of the main terms. It is a constant balancing act between what you actually want to say and what the search engine still considers focused enough. SEO forces you into reduction. You mutilate your own description just to not appear too complex in the eyes of an algorithm. It is the capitulation of language before statistics.

The Curse of Internationality

As if that were not already enough work, the problem of multilingualism came along on top of everything else. I made a conscious decision in favour of multilingualism in German and English. The thought behind it was simple and perhaps a little naive: I simply wanted to be able to repost my blog entries on English-language sites as well. Internationality also always sounds good in a portfolio. My plan was to generate backlinks with this, which in turn would push my search ranking upward. A backlink from a reputable English site is like a gold medal for your own domain. So far, so logical. But the implementation transformed my clean website concept into a bureaucratic monster made of links and language tags.

The surprise came when after some time I actually searched for Nico Hartmann IT lecturer. A small triumph germinated within me when I actually saw my name in first place. But the joy lasted only seconds. Google did indeed present me at the very top, but the description was in English. There you sit in Germany, searching for a German term, and you get served an English snippet. That is the moment when you would love to throw the keyboard out of the window. Google had understood that I am important, but not which language is appropriate for this specific context. The algorithm rolled the dice and I lost.

So it was: back to the drawing board. I had to set hreflang attributes. For the layperson this sounds like technical triviality, for the website operator it is the attempt to draw the search engine a map that it should please not ignore. You explicitly tell Google which page is intended for which region and which language. And then the great waiting begins. SEO is not a sprint, it is a marathon through mud. You wait one to two weeks until the merciful crawlers from Google finally deign to look at the website anew. You feel like a supplicant before the throne of a capricious king, hoping that your corrections will this time be graciously received.

This entire process is a lesson in humility and frustration. You invest hours in optimization, only to discover that you are dependent on the whims of a corporation that changes its algorithms faster than you can adjust your own description. It is a permanent fight against windmills, where the windmills consist of server farms and the lance is a text editor. You are not optimizing for the user, you are optimizing for the machine, in the hope that in the end a human being will still find their way to the page. It is an absurd theatre in which we all play our roles, just to grab a small piece of visibility in an ocean of information.

And while I sit here waiting for the next crawl, I ask myself whether all of this is really worth the effort. The answer is a frustrated yes, because in today's world you do not exist if you are not on the first page. You submit to the dictate of the search engine, adapt your language, cross out words that you actually like, and set cryptic attributes in the header. All for that one moment when the search for your own name delivers exactly the result you have so laboriously purchased. It is a digital ego trip that costs you more nerves than any software development, but in the end vanity wins over reason.

The Anatomy of Keywords

When you dive deeper into this swamp, you quickly notice that keywords are like small pets. You have to care for them, feed them, and assign them exactly the right place. Choose the wrong ones and they bark at you or run away. In my case, the decision for IT lecturer and software development was a purely strategic choice. I could also have taken IT teacher or code coach, but who searches for those? You spend hours with tools that tell you how often a term is searched for, only to then discover that the competition for these terms is so gigantic that you as a lone fighter barely have a chance. So you search for the gap, for the golden middle ground between relevance and feasibility.

It is this constant balancing act between the ego and the algorithm. You might want to call yourself a "visionary for digital transformation," but that is of little use if the market is simply demanding a "Python course." This discrepancy forces one to break down their own identity into bite-sized morsels that can be easily digested by search engines.

In this context, keyword research is often less of an exact science and more of a psychological poker game against user intent. You analyze long-tail keywords and niche terms in the hope that the specific combination of expertise and location hits exactly the right nerve for those who won't just click on the first mass-market offer they see. At the end of the day, the realization remains that visibility is not created by the loudest terms, but by the cleverest positioning in the shadow of giants.

The Curse of the Technology Behind the Language

The decision for multilingualism was, looking back, like the attempt to fly two aeroplanes simultaneously. You think you simply write everything twice and that is that. But Google sees it differently. For a search engine, duplicate content is a red flag. If you are unlucky, the algorithm penalizes you for trying to dance at two weddings at once. The solution is precisely those hreflang attributes I have already mentioned. These small code snippets are the diplomatic representatives of my website. They tell Google: Hey, this here is the German version for the Germans and that there is the English version for the rest of the world. Please do not throw them into one pot.

It is fascinating and alarming in equal measure how much time one spends on technical overhead that has absolutely nothing to do with the actual content. I want to write about software development, about didactics in IT, about modern technologies. Instead I spend my evenings validating XML sitemaps and checking whether my canonical tags are correctly set. You become the bureaucrat of your own creativity. Every new page, every new blog post drags a long tail of administrative tasks behind it. If you do not do this, the contribution remains a lone voice crying in the wilderness. You no longer write for the joy of writing, you write for the indexing.

The Arrogance of the Crawlers

There is hardly anything more frustrating than the waiting time for Google's bots. These digital insects crawl through the net, index billions of pages, and decide over success or failure. You have no influence over when they come. You can invite them via the Search Console, essentially hold the door open for them and roll out a red carpet, but in the end they come when they want. This uncertainty is poison for anyone who wants to see fast results. You change a small thing that you are convinced will bring the breakthrough, and then you stare at an unchanged search bar for days.

During this time you begin to doubt yourself. Was the hreflang attribute really correct? Have I perhaps forgotten a quotation mark? Why is the English description still being displayed even though I have prioritized the German page? It is a psychological game. Google is the invisible referee who changes the rules during the game and never tells you exactly what you have done wrong. You receive only vague hints and have to figure out the rest through trial and error. It is a form of digital servitude into which we have voluntarily entered because we need visibility like the air we breathe.

I stand here with a website that is technically speaking flawless, but which is still fighting against the shadows of my namesakes. I have learned that IT lecturer is my anchor and that I must enjoy the English language with caution if I want to dominate the German market. It is a laborious path, characterized by technical trivialities and the constant concern for the goodwill of an algorithm. But ambition has been awakened. If Google wants to see me as an Englishman, I will prove to Google that I am the German IT expert it is looking for. The battle for Nico Hartmann has only just begun.

The Tyranny of Backlinks or Why Quality Alone Is Never Enough

After I had more or less navigated around the technical hurdles of multilingualism and metadata, I ran into the next great monster in the SEO ocean: authority. It is simply not enough for Google that I claim to be a competent IT lecturer. The search engine wants to see proof. In the digital age, this proof takes the form of backlinks. A backlink is basically a recommendation from another website. If a reputable IT site links to me, the Google algorithm thinks to itself that this Nico Hartmann is probably not a charlatan after all. So I began refining my strategy for reposting my blog entries on English-language platforms like Medium or Dev.to. The goal was clear: I wanted to use the reach of these giants to redirect a little of their digital shine onto my own small domain.

It is a strange form of digital prostitution. You write high-quality content, give it away practically for free to large platforms, and hope in return for a small, clickable link that leads the crawler back home. But here too complexity lurks. There are no-follow and do-follow links. The former are as useful for rankings as an alcohol-free beer at a hacker party, the latter are the digital gold. Of course, most large sites give out only the inferior links by default, in order not to dilute their own ranking. So you fight at the front line for recognition and are often thrown only crumbs. Nevertheless, this process is without alternative if you do not want to stand forever in the shadow of the other Nico Hartmanns of this world.

The Dilemma of Content Recycling

The reposting on English sites brought me to yet another painful realization. You cannot simply copy the same text one-to-one. Search engines are allergic to laziness. Whoever simply copies will be ignored. So I had to rewrite my own texts for the English platforms, adapt them, and give them a new spin. The whole thing was supposed to serve to underscore my expertise as a software developer, but in the end I spent more time rephrasing sentences than on actual programming. It is a paradoxical vicious circle: in order to be perceived as an expert in software development, you have to stop developing software and start becoming a full-time copywriter for yourself.

Particularly insidious is the psychological component. You observe the statistics. You see how many people have read the English article, and hope that at least a fraction of them will find their way to the original portfolio page. But most users remain in their ecosystem. They read on Medium, perhaps clap briefly, and move on. The search engine does register the connection, but the hoped-for massive rise in rankings often remains a quiet background noise. You feed the beast with ever more content, in the hope that it will be satisfied at some point and grant you your place in the sun. But the beast Google never clocks off.

The Waiting Time and the Grace of the Crawlers

When you have then scattered all backlinks and checked all hreflang attributes for the tenth time, the phase of absolute powerlessness begins. You can do nothing more but wait. The internet is a vast memory that unfortunately forgets very slowly and learns even more slowly. You check the Search Console daily. You look at the impressions, the clicks, the average position. It is like watching grass grow, except that the grass sometimes decides in the middle of the night to retreat back into the ground.

Once I suddenly appeared in first place for a completely irrelevant search term, simply because I had mentioned it once in a subordinate clause. That is the irony of SEO. You optimize like someone obsessed for IT lecturer and software development, and Google decides instead to rank you for a typo in a code example. You feel not understood by the artificial intelligence, but rather mocked. The crawlers are like civil servants in a dusty authority: they work according to rules that were established years ago, and have no interest in your personal urgency. If they decide that your English description is more important than your German one, then that is how it stays for now, until the file lands back on top of the pile a few weeks later.

The Niche as a Lifeline

In this chaos, concentration on the niche is the only way to not go mad. I have come to terms with the fact that I will never stand in first place for the word software development alone. Corporations with million-dollar budgets and whole armies of SEO specialists are fighting there. But for Nico Hartmann IT lecturer? That is my playing field. Here I can win if I remain persistent. The restriction here is not a weakness, but a necessary survival strategy. It is better to be the king of a small village than a beggar in a metropolis.

Nevertheless, this bitter aftertaste remains: that you are optimizing your digital presence not for people, but for a mathematical formula. Every time I leave out the word trainer just to not jeopardize the keyword density, it feels like a small betrayal of my actual work. We build websites for machines that pretend to decide for people. It is a simulation of relevance. When I write a text today, I no longer ask myself first whether it is useful for my students, but whether it offers enough semantic connections to satisfy Google's semantic search. We adapt our thinking to the structure of the search engine.

The Outlook into Madness

What remains at the end of this rant? SEO is a necessary evil, a modern form of indulgence trading. We pay not with money, but with time, nerves, and our linguistic integrity. I will continue to set hreflang tags, hunt backlinks, and polish my metadata. Not because it is fun, but because the alternative is digital invisibility. And in an industry where online presence is the new business card, you simply cannot afford to be invisible.

Perhaps Google will come to its senses in a few weeks. Perhaps the crawler will recognize that the German page is actually the better choice for German search queries. Until then I will continue to cast hateful glances at my monitor when the English description appears at the very top again. SEO is a fight you never win entirely, you can only keep fighting it until you either end up on top or lose the inclination. And since I am a stubborn IT lecturer, I will probably keep going until Google finally spells my name the way I want it.

SEO is the art of dressing up for robots so that people can find you.

Multilingualism is a technical nightmare that has a preference for delivering the wrong search results.

Backlinks are the currency of the internet, but the exchange rate is merciless.

Your own identity must yield to the niche if you want to survive in the rankings.

Sometimes I ask myself whether the other Nico Hartmanns out there are fighting the same battle. Whether the footballer is also frustrated because my blog post about software development appears above his latest match report. If so, that is at least a small consolation. In the arena of search results there are no friends, only competitors for the attention of an algorithm that knows no mercy. At the end of the day I sit again in front of the computer, adjust the next description, and hope for the best. Because whoever does not optimize does not exist. And I would quite like to exist, at least on page one.

What happens when AI breaks the rules of open source?

https://malus.sh/blog

A guide on how to deliberately feed AI crawlers on one’s own website with irrelevant or falsified data and thereby keep them trapped.

https://maurycyz.com/projects/trap_bots/