blog.lvmbdv.dev on Ata Kuyumcu's Blog

Tests for a PDF

Fri, 31 Jul 2026 00:00:00 +0000

My CV has a test suite. This is either reasonable or a symptom.

The excuse is that I’m not the first reader. An applicant tracking system is, and it wants text. Every visual decision in the document (the font, the margins, where the dates sit) is invisible to it. The only thing it can see is whatever pdftotext scrapes off the page.

The fediverse was right

Sat, 18 Jul 2026 00:00:00 +0000

I use Mastodon on and off but I would not trade it for any alternative atm. Not because it’s better than Twitter was, the discoverability is worse, the reply threading is too complex at times, and it does have sync issues across instances. What it does have is something no corporate platform will ever offer: you can leave and take your social graph with you. Your followers, your follows, your block lists. Pack them up, point your domain at a different server, done.

The dailyprog puzzle safety net

Tue, 14 Jul 2026 00:00:00 +0000

dailyprog needs a new puzzle every day. I wrote the first few drafts by hand, then built a generator that writes them with an LLM and validates the output against real sandbox execution. The generator works, but it still needs someone to run it. Pick a pattern, kick off the script, review the result, commit. Fifteen minutes on a good day. More if the model gets stuck in a repair loop and I need to nudge it.

Adding Go to a browser code runner

Fri, 10 Jul 2026 00:00:00 +0000

dailyprog (the daily coding puzzle site, previously) started with JavaScript. Then Python, then C. Each new language was a different kind of project. Python needed Pyodide. C needed a PicoC WASM binary and a custom harness for printf output. Go was supposed to be the fourth. Every Go-to-WASM tutorial points at the same path, so I took it.

It was the wrong one.

The path everyone takes: GOOS=js

Compiling Go to WASM for the browser means setting GOOS=js GOARCH=wasm. Go ships two pieces for this: a compiler target that produces WASM with a JavaScript syscall bridge, and wasm_exec.js, a support file that implements the Go runtime’s expectations on the JS side. You load wasm_exec.js, you call WebAssembly.instantiate(), the Go runtime boots, and your program runs.

Building a passive Ethernet tap

Wed, 01 Jul 2026 00:00:00 +0000

I saw this cool ethernet tap and thought it would be cool to see how chatty my “smart” TV is. But I didn’t want to pay €39 for it. So I made a clone on mini breadboards.

Generating coding puzzles with LLMs

Mon, 29 Jun 2026 00:00:00 +0000

I have been working on this daily coding puzzle site dailyprog. It’s like Wordle for programming problems. Each day you get one puzzle with a short narrative, a function stub, and a set of visible test cases. You write a solution, run it locally against the visible tests, then submit to verify against hidden tests on the server. There are four languages atm (JavaScript, Python, C, Go), visual output for some puzzles, and a share link so you can signal your competency to your friends.

Revisiting server hardening

Fri, 26 Jun 2026 00:00:00 +0000

Two months ago I wrote down my baseline for hardening a fresh Linux install. Non-root user, SSH lockdown, UFW, fail2ban, unattended-upgrades, the Docker firewall hole. It was fine as far as it went. But it didn’t go far enough.

Last week I spun up a new VPS (Debian 13 this time, not Ubuntu) and found six I’d missed the first time around. Post-quantum SSH is also ready and takes one config line.

Rebuilding my blog with machines, for machines

Wed, 10 Jun 2026 00:00:00 +0000

I rebuilt this blog recently. Not a redesign. The old posts are still here, same URLs, same markup. What changed is that every page now carries a full structured data graph and every element is annotated with microformats.

Structured data that pulls its weight

Every page gets a JSON-LD block in the <head>. Not a plugin. A 120-line Hugo partial that builds a @graph depending on what kind of page it is. The partial is mostly a big conditional: if .IsHome does one thing, if .IsPage and .Section "posts" does another, if .IsSection or .Kind "term" does a third. Each branch appends its nodes to a slice, then the whole thing gets serialized and dropped into a <script> tag.

Autopsying a SanDisk Extreme SSD

Fri, 05 Jun 2026 00:00:00 +0000

I was planning a backup setup and dug an old SanDisk Extreme Portable SSD out of a drawer. Plugged it in, nothing.

Well, not nothing. dmesg saw a USB device. sg_inq got a polite response from the bridge chip, but the kernel logged “Media removed, stopped polling” and the block device reported zero bytes. The USB-to-NVMe bridge chip was alive and as chatty. The SSD behind it was gone.

The SanDisk Extreme has a reputation by now. You probably know it if you follow hardware news. I didn’t just want to read about the failure though, I wanted to see it.

Balancing an MMO economy with a black market

Wed, 27 May 2026 00:00:00 +0000

Albion Online has a cool design constraint that sounds absurd when you say it out loud: every item in the game is player-crafted. There are no NPC vendors selling gear. The world produces nothing on its own except raw resources. The whole sandbox is built on top of that constraint.

But Albion also has mobs that drop loot. You go fight a heretic, you sometimes get a T4 bag. So somebody has to have crafted that bag. Where does it come from?

Hardening a fresh Linux install

Thu, 23 Apr 2026 00:00:00 +0000

I’ve been running a small Hetzner VPS for a while now and every time I spin up a new one I find myself re-deriving the same baseline. This is that baseline, written down so I stop re-deriving it and so you can steal it. It assumes Ubuntu 24.04 LTS on a Hetzner VPS, but most things hardly change over the years, or between platforms. None of this is exhaustive, there’s no AppArmor profiling, no AIDE, but it gets you to a point where you won’t be embarrassed if someone runs nmap at you.

Building custom commands in Bevy

Thu, 25 Feb 2021 00:00:00 +0000

Historical context
This post was written for Bevy 0.4 in February 2021. Bevy is now on 0.15+ and the APIs have changed significantly. The extension trait pattern is still valid Rust, but the specific Commands, Command, and Bundle APIs in Bevy have evolved since. For current documentation, see bevyengine.org and docs.rs/bevy.

Bevy is an ECS-based game engine built in Rust. Extension traits are a pattern in rust that allows you to add methods to an existing type defined outside of your crate. You can probably guess where I’m going with this.

Setting up remote backups with Restic

Tue, 22 Oct 2019 00:00:00 +0000

Restic is a program that greatly simplifies the process of encrypted, incremental backups. Backblaze B2 is a pretty cheap cloud storage service that restic happens to support as a data storage backend. The first 10 GB of storage is free, which is plenty for storing configuration files and some source code.

Working through the SICP exercises

Tue, 20 Nov 2018 00:00:00 +0000

I started reading through “Structure and Interpretation of Computer Programs” and thought it would be a good idea to publish my progress here. Here are my solutions for the first ten exercises in the book.

I did a few things at STM CTF 2018 Prelims

Mon, 01 Oct 2018 00:00:00 +0000

Here are a few challenges I chose to write about from the preliminary for STM CTF 2018 which will take place in Ankara at Oct 31. I want to thank the STM team for a fun and smooth CTF experience. I started competing in CTFs about half a year ago and I heard good things about STM CTF 2017. I hope I can attend this year :)

I did a thing at Harekaze CTF 2018

Thu, 01 Mar 2018 00:00:00 +0000

I participated in DKHOS alongside bloodlust (formerly yubitsec) this year but this post is not about that. While we were waiting for DKHOS to start at midnight, we decided to warm up with another CTF that was going on at the time. That CTF was Harekaze 2018.

I did a thing at TU CTF 2017

Mon, 04 Dec 2017 00:00:00 +0000

It was called “The Neverending Crypto”. I don’t remember what difficulty level it was listed at, probably the lowest :) Here is how it went.

You are presented with an address and a port number. When you connect, you are asked to enter a string. The string you entered is encrypted and sent back to you. After a few tries, I realize it’s encrypted with a Caesar cipher.

About

Mon, 01 Jan 0001 00:00:00 +0000

Introduction

I’m Ata. Software Engineer, based in the Amsterdam Area.

I’ve spent the last few years at Shell Recharge Solutions building serverless, event-driven systems in TypeScript on AWS, including a quarter as interim Tech Lead. Before that: full-stack work at Countly, a handful of short-term contracts, and the CTF competitions that show up all over this blog.

Right now I’m also building dailyprog, a daily coding puzzle site with an LLM-driven generation pipeline running against a sandboxed execution backend.