blog.lvmbdv.dev on Ata Kuyumcu's Blog

The smartest man on the cinder

Sat, 22 Aug 2026 00:00:00 +0000

There’s a scene in Watchmen where the Comedian sets fire to a map of the United States and tells the room that none of it matters, the nukes are coming, we’ll all be dust. Then he points at Adrian Veidt, who has just told the room they can save the world, and says Ozymandias here will be the smartest man on the cinder.

Best line in the film. It has almost nothing to do with nuclear war.

Sixty days of dailyprog

Mon, 17 Aug 2026 00:00:00 +0000

dailyprog has published a puzzle every day since 19 June. Sixty days, sixty puzzles, no gaps. Eleven more are already written and sitting in the catalogue, with the safety net to catch any gaps.

That’s long enough that the analytics say something. Not all of it is flattering.

The numbers


Visitors	1,589
Visits	2,522
Pageviews	8,357
Solve submissions	739
Passing	470 (63.6%)
Puzzles shipped	60
Languages	6

Growth is nothing to write home about, but steady. Eleven days ago it was 1,372 visitors, so the site adds around 140 a week without me doing much to make that happen. It’s not even indexed by a search engine yet. There’s no launch spike left in these numbers, so whatever this is, it’s the baseline.

Open-sourcing a puzzle site without leaking the puzzles

Sun, 16 Aug 2026 00:00:00 +0000

I made dailyprog public. The code is on Codeberg now, under AGPL-3.0.

The license was the easy decision. The problem was everything the code needs to run. A puzzle site’s whole point is the puzzles, and the puzzle files carry the hidden tests, the ones you only get graded against after you submit. Publish the catalogue and you’ve published every answer, plus every puzzle I haven’t shipped yet. So the repo can’t just go public. Most of it can. A slice of it can’t, and that slice is the “added value”.

Nobody has reached the bottom (yet)

Wed, 12 Aug 2026 00:00:00 +0000

Update, 2026-08-13
The title lasted eight hours. Four sessions have reached depth 13, and all four walked back out through the arch with their gold: 178, 252, 273 and 635. The rest of the post is left as it was.

The dungeon under this blog has a bottom now. Depth 13, with a sensible end to the gameplay loop. The rest of this post is three-ish days of analytics from the dungeon, and the caveats are at the end because they matter more than usual.

There's a dungeon under this blog

Mon, 10 Aug 2026 00:00:00 +0000

There's a follow-up
The dungeon has a bottom now, at depth 13. I also pulled three days of numbers out of it: how people got in, where they die, and whether two strangers ever found each other down there. Nobody has reached the bottom (yet)

There’s a dungeon under this blog, every page of it. Find the way in and you get a little pixel character (a knight, a wizard, a princess etc; it depends on a hash of your peer id) standing in a sunlit village square. Through the stone arch north of the well, a procedural dungeon crawl: monsters, potions, chests that sometimes have teeth. If someone else is reading the blog right now, they can join in the same village, the same dungeon. You can watch them wander. You can shout at each other.

Tests for a PDF

Fri, 31 Jul 2026 00:00:00 +0000

My CV has a test suite. This is either reasonable or a symptom.

The excuse is that I’m not the first reader. An applicant tracking system is, and it wants text. Every visual decision in the document (the font, the margins, where the dates sit) is invisible to it. The only thing it can see is whatever pdftotext scrapes off the page.

The fediverse was right

Sat, 18 Jul 2026 00:00:00 +0000

I use Mastodon on and off but I would not trade it for any alternative atm. Not because it’s better than Twitter was, the discoverability is worse, the reply threading is too complex at times, and it does have sync issues across instances. What it does have is something no corporate platform will ever offer: you can leave and take your social graph with you. Your followers, your follows, your block lists. Pack them up, point your domain at a different server, done.

The dailyprog puzzle safety net

Tue, 14 Jul 2026 00:00:00 +0000

dailyprog needs a new puzzle every day. I wrote the first few drafts by hand, then built a generator that writes them with an LLM and validates the output against real sandbox execution. The generator works, but it still needs someone to run it. Pick a pattern, kick off the script, review the result, commit. Fifteen minutes on a good day. More if the model gets stuck in a repair loop and I need to nudge it.

Adding Go to a browser code runner

Fri, 10 Jul 2026 00:00:00 +0000

dailyprog (the daily coding puzzle site, previously) started with JavaScript. Then Python, then C. Each new language was a different kind of project. Python needed Pyodide. C needed a PicoC WASM binary and a custom harness for printf output. Go was supposed to be the fourth. Every Go-to-WASM tutorial points at the same path, so I took it.

It was the wrong one.

The path everyone takes: GOOS=js

Compiling Go to WASM for the browser means setting GOOS=js GOARCH=wasm. Go ships two pieces for this: a compiler target that produces WASM with a JavaScript syscall bridge, and wasm_exec.js, a support file that implements the Go runtime’s expectations on the JS side. You load wasm_exec.js, you call WebAssembly.instantiate(), the Go runtime boots, and your program runs.

Building a passive Ethernet tap

Wed, 01 Jul 2026 00:00:00 +0000

I saw this cool ethernet tap and thought it would be cool to see how chatty my “smart” TV is. But I didn’t want to pay €39 for it. So I made a clone on mini breadboards.

Generating coding puzzles with LLMs

Mon, 29 Jun 2026 00:00:00 +0000

I have been working on this daily coding puzzle site dailyprog. It’s like Wordle for programming problems. Each day you get one puzzle with a short narrative, a function stub, and a set of visible test cases. You write a solution, run it locally against the visible tests, then submit to verify against hidden tests on the server. There are four languages atm (JavaScript, Python, C, Go), visual output for some puzzles, and a share link so you can signal your competency to your friends.

Revisiting server hardening

Fri, 26 Jun 2026 00:00:00 +0000

Two months ago I wrote down my baseline for hardening a fresh Linux install. Non-root user, SSH lockdown, UFW, fail2ban, unattended-upgrades, the Docker firewall hole. It was fine as far as it went. But it didn’t go far enough.

Last week I spun up a new VPS (Debian 13 this time, not Ubuntu) and found six I’d missed the first time around. Post-quantum SSH is also ready and takes one config line.

Rebuilding my blog with machines, for machines

Wed, 10 Jun 2026 00:00:00 +0000

I rebuilt this blog recently. Not a redesign. The old posts are still here, same URLs, same markup. What changed is that every page now carries a full structured data graph and every element is annotated with microformats.

Structured data that pulls its weight

Every page gets a JSON-LD block in the <head>. Not a plugin. A 120-line Hugo partial that builds a @graph depending on what kind of page it is. The partial is mostly a big conditional: if .IsHome does one thing, if .IsPage and .Section "posts" does another, if .IsSection or .Kind "term" does a third. Each branch appends its nodes to a slice, then the whole thing gets serialized and dropped into a <script> tag.

Autopsying a SanDisk Extreme SSD

Fri, 05 Jun 2026 00:00:00 +0000

I was planning a backup setup and dug an old SanDisk Extreme Portable SSD out of a drawer. Plugged it in, nothing.

Well, not nothing. dmesg saw a USB device. sg_inq got a polite response from the bridge chip, but the kernel logged “Media removed, stopped polling” and the block device reported zero bytes. The USB-to-NVMe bridge chip was alive and as chatty. The SSD behind it was gone.

The SanDisk Extreme has a reputation by now. You probably know it if you follow hardware news. I didn’t just want to read about the failure though, I wanted to see it.

Balancing an MMO economy with a black market

Wed, 27 May 2026 00:00:00 +0000

Albion Online has a cool design constraint that sounds absurd when you say it out loud: every item in the game is player-crafted. There are no NPC vendors selling gear. The world produces nothing on its own except raw resources. The whole sandbox is built on top of that constraint.

But Albion also has mobs that drop loot. You go fight a heretic, you sometimes get a T4 bag. So somebody has to have crafted that bag. Where does it come from?

Hardening a fresh Linux install

Thu, 23 Apr 2026 00:00:00 +0000

I’ve been running a small Hetzner VPS for a while now and every time I spin up a new one I find myself re-deriving the same baseline. This is that baseline, written down so I stop re-deriving it and so you can steal it. It assumes Ubuntu 24.04 LTS on a Hetzner VPS, but most things hardly change over the years, or between platforms. None of this is exhaustive, there’s no AppArmor profiling, no AIDE, but it gets you to a point where you won’t be embarrassed if someone runs nmap at you.

Building custom commands in Bevy

Thu, 25 Feb 2021 00:00:00 +0000

Historical context
This post was written for Bevy 0.4 in February 2021. Bevy is now on 0.15+ and the APIs have changed significantly. The extension trait pattern is still valid Rust, but the specific Commands, Command, and Bundle APIs in Bevy have evolved since. For current documentation, see bevyengine.org and docs.rs/bevy.

Bevy is an ECS-based game engine built in Rust. Extension traits are a pattern in rust that allows you to add methods to an existing type defined outside of your crate. You can probably guess where I’m going with this.

Setting up remote backups with Restic

Tue, 22 Oct 2019 00:00:00 +0000

Restic is a program that greatly simplifies the process of encrypted, incremental backups. Backblaze B2 is a pretty cheap cloud storage service that restic happens to support as a data storage backend. The first 10 GB of storage is free, which is plenty for storing configuration files and some source code.

Working through the SICP exercises

Tue, 20 Nov 2018 00:00:00 +0000

I started reading through “Structure and Interpretation of Computer Programs” and thought it would be a good idea to publish my progress here. Here are my solutions for the first ten exercises in the book.

I did a few things at STM CTF 2018 Prelims

Mon, 01 Oct 2018 00:00:00 +0000

Here are a few challenges I chose to write about from the preliminary for STM CTF 2018 which will take place in Ankara at Oct 31. I want to thank the STM team for a fun and smooth CTF experience. I started competing in CTFs about half a year ago and I heard good things about STM CTF 2017. I hope I can attend this year :)

I did a thing at Harekaze CTF 2018

Thu, 01 Mar 2018 00:00:00 +0000

I participated in DKHOS alongside bloodlust (formerly yubitsec) this year but this post is not about that. While we were waiting for DKHOS to start at midnight, we decided to warm up with another CTF that was going on at the time. That CTF was Harekaze 2018.

I did a thing at TU CTF 2017

Mon, 04 Dec 2017 00:00:00 +0000

It was called “The Neverending Crypto”. I don’t remember what difficulty level it was listed at, probably the lowest :) Here is how it went.

You are presented with an address and a port number. When you connect, you are asked to enter a string. The string you entered is encrypted and sent back to you. After a few tries, I realize it’s encrypted with a Caesar cipher.

About

Mon, 01 Jan 0001 00:00:00 +0000

I’m Ata. Software Engineer, Amsterdam area.

I spent the last few years at Shell Recharge Solutions, building the backend of an EV charging service in TypeScript on AWS. Serverless, event-driven, the Lambda-and-queues way of doing things. I led the payment service provider integration from discovery to launch and spent a quarter as interim tech lead of the payments team. Before that: three years of full-stack work at Countly, a year of short-term contracts, and the CTF competitions this blog started out as write-ups for.