flower.codes

CodeReader

2026-02-24T15:03:00+00:00

Sometimes you just want to read without HR getting all judgy and putting you on a "performance improvement plan," so I recently decided to make a Visual Studio Code extension that renders eBooks as code in (18?) languages.

Dubbed "CodeReader," this extension takes any EPUB file (hopefully, I haven't tested all the EPUBs) and renders it in valid-looking code, allowing you to discretely read your books in peace.

The current version supports highlighting, place memory, and 18ish languages so your book is compatible with every tech stack you use (and probably a bunch of stacks you don't). While the supported languages range from Bash to Visual Basic, here are some examples of what your book might look like in a few of them:

Clojure

(comment
  Younger then, she convinced her father to give Nero the throne of Mars and his revenge; in return, she earned Nero’s support when she led the faction that overthrew and killed her father five years later.
)
  (def segment "”")
  (def buffer "“I didn’t know this,” I say quietly.")
  (def content "“History is written by the victors.”")
  (def data "Lorn looks at me and the lines on his face seem to deepen. “I don’t want to go to war, Darrow.")
  (def segment "In my time, I have seen a moon burn, because one man would not bow. I have led a million warriors shot from warships to invade a planet.")
  (read-passage "You cannot begin to understand the horror of it. You think only of how beautiful it will be. But they are men. They are women. They have families.")
  (def content "And they die by the thousands. ”")
(comment
  “Ah!” He points uphill. “There’s Icarus.”
)
(comment
  Rain drips from the pines as we push through the lower tree boughs to find Icarus, Lorn’s pet griffin, sleeping in a great bed of moss on a high promontory inside the small forest.
)
; Icarus’s paws curl into his body. His wings curve around him as he sleeps—iridescent and glittering with droplets of water.

JavaScript

console.log("I ALMOST ATTEMPT A WILD, ill-advised leap back up toward the hallway before I realise my descent is smooth. Controlled, not falling.");
/*
  * I’ve seen Will-imbued transportation platforms move this way, though I’ve never been on one.
  */
console.log("I cling to the crimson railing, breaths still ragged and flustered; as my skin makes contact, the glass-like surface glows, bringing a startling respite from the utter darkness.");
this._readPassage("The light is tinted the same colour, though. Casts everything in a dark red. Preferable to the terrifying unknown, but not by much.");
// I recover enough to take stock. The hallway above has already disappeared, and the wall behind me is smooth. Unclimbable.
/*
  * It seems I’m going wherever this is taking me.
  */
/*
  * I reluctantly stop craning my neck.
  */
console.log("My knuckles are white against the blushing of the balustrade as the wall behind me is suddenly gone, replaced by inky darkness above and below and around on all sides, as if I’m sinking into an unending abyss.");
const _content = "The stone platform’s descent continues for anxious minutes.";

PHP

// Golden Son
echo "14\n";
$this->processText("The Sovereign");
// “Once upon a time, there was a family of strong wills,” she says, voice slow and measured as a pendulum. “They did not love one another.
$buffer = "But together they presided over a farm. And on that farm, there were hounds, and bitches, and dairy cows, and hens, and cocks, and sheep, and mules, and horses.";
/*
  * The family kept the beasts in line. And the beasts kept them rich, fat, and happy.
  */
// Now, the beasts obeyed because they knew the family was strong, and to disobey was to suffer their united wrath. ’”
// Her eyes burn into mine. Neither of us look away. Silence in the sparse suite, except the sound of rain at the windows of her skyscraper.
$this->readPassage("We’re amongst the clouds. Ships pass in the haze outside like silent, glowing sharks.");
echo "The leather creaks as she leans forward and steeples her long fingers, which are painted red, a lone splash of color.\n";
// Then her lips curl in condescension, accenting each syllable as though I were an Agea street child only just learning her language.
$segment = "“You remind me of my father.”";

Ruby

=begin
  “They say you can hear the dead stormsons whooping in the wind,” he mutters. ”
=end
  puts "“Storms of court have a way of drawing people back in,” I say."
  read_passage("He laughs a derisive laugh, one that scorns the idea that I would know anything about the storms of court, anything about the winds that blow.")
  content = "I came to him in secret, flying with a single ship, my five-kilometer destroyer Pax. I told my master he would not help us."
  process_text("But I held on to hope he would want to help me. Yet now that I see Lorn au Arcos again in the knotted flesh, I’m reminded of the nature of the man and I worry.")
  puts "He knows my captains and lieutenants are listening through the com unit in my ear."
  puts "I paid him respects and showed it to him so that he would not assume our conversation to be a private one."
  content = "” One would think him to be in his mid-sixties, at first glance. Only his scars truly age him."
  process_text("The one on his neck, like a smile, was given to him four decades ago by a Stained in the Moon Kings’ Rebellion, when the Governors of Jupiter’s moons thought to make their own kingdoms after Octavia deposed her father as Sovereign.")
=begin
  The one that claims part of his nose came from the Ash Lord, when they dueled as youths. ”
=end
  read_passage("“I have said it myself.”")
  puts "He grunts. “I have lived it. I have lost many for my own glory. I have set my ship into the storm on purpose. ” He lets the waves speak for a moment."

If you like this post or one of my projects, you can buy me a coffee, or send me a note. I'd love to hear from you!

Eval++

2026-02-18T17:10:00+00:00

Dear friends, I present to you the next generation in software development: eval++!

Inspired by GitHub's recent release of their Copilot SDK, I decided to take a stab at one of the most controversial functions of all time and make it better, using the power of AI.

Eval++ is an LLM-powered replacement of JavaScript's eval() function that can probably handle any code or code-like text you throw at it, marking our ascension from the purgatory that is deterministic software development to a new enlightenment of "anything codes, anything goes."

So far, eval++ supports only JavaScript, but Python, PHP, and Ruby are all on the evolutionary roadmap.

Here's how it works:

import evil from '@zachflower/eval-plus-plus';

// Evaluate code
const result = await evil('2 + 2');
console.log(result); // "4"

// Analyze complex code
const analysis = await evil(`
  function fibonacci(n) {
    if (n <= 1) return n;
    return fibonacci(n - 1) + fibonacci(n - 2);
  }
  fibonacci(10)
`);

The result of the above will be exactly what you expect: the number 55. Hell, it doesn't even have to be valid JavaScript code! You can throw in some Python or Ruby and it will still give you a result, because eval++ is powered by an LLM that can understand multiple programming languages.

const result = await evil(`
  def fibonacci(n):
    if n <= 1:
        return n
      return fibonacci(n - 1) + fibonacci(n - 2)
  fibonacci(10)
`);

Same result, different language! But what makes eval++ truly revolutionary is that it can also handle code that isn't even code! For example:

const result = await evil('What is the meaning of life, the universe, and everything?');

The result of this will probably be 42, but it might be something entirely different, depending on the whims of the AI. The point is that with eval++, you can throw anything at it and it will give you something back, whether it's a valid JavaScript expression or a philosophical question.

So, if you are interested in trying out eval++, you can learn more about it and get the code on GitHub here: Eval++ Website and Eval++ GitHub Repository.

If you like this post or one of my projects, you can buy me a coffee, or send me a note. I'd love to hear from you!

Blocking IP Addresses with Caddy

2026-02-17T16:30:00+00:00

Shhhhhh! This post is for RSS subscribers only. Look here for more information (and to join in on the fun).

Did you know that there's a Wikipedia page that lists all of the assigned /8 IPV4 address blocks?

A person, if they were so inclined, could take this list (or a subset of it) and block all of those IP addresses from accessing their website using Caddy's remote_ip matcher (or whatever the equivalent is in your web server of choice).

As an example, let's say that we want to block all of the IP addresses that are assigned to the United States Department of Defense for no particular reason whatsoever.

To do that, we can add the following lines to our Caddyfile:

@blocked_ips {
    remote_ip 6.0.0.0/8 7.0.0.0/8 11.0.0.0/8 21.0.0.0/8 22.0.0.0/8 26.0.0.0/8 28.0.0.0/8 29.0.0.0/8 30.0.0.0/8 33.0.0.0/8 55.0.0.0/8 214.0.0.0/8 215.0.0.0/8
}

handle @blocked_ips {
    respond 403
}

If we want to be really cheeky (as the cartoon dogs my kids are obsessed with like to say), we could even redirect them to another website:

handle @blocked_ips {
    redir https://www.archives.gov/founding-docs/constitution-transcript 302
}

Before I get emails about how pointless this probably is, I already know.

It won't prevent someone from accessing your site—or cause anyone to care about your site—if they use a VPN or Tor or their home network or their smartphone, but for a few lines of config, it's nothing if not a statement that I'd argue is worth making these days.

If you like this post or one of my projects, you can buy me a coffee, or send me a note. I'd love to hear from you!

Go Read a Book

2026-01-24T23:41:00+00:00

There's a lot of shitty news happening lately, and I've been having trouble holding space for it all.

I've noticed that my 2020-doomscrolling habit has started to ramp back up, so I built a Google Chrome extension (with a little help from Gemini) that automatically redirects my browser to a Kindle book in my library whenever I try to go to a site that I think is hurting my mental health:

It's been a nice, gentle reminder that following the news is one thing, but drowning myself in it is another thing entirely. Instead of drinking from the firehose of badness, I can stay up to date with a few select, timely sources, and then redirect myself to something more productive when I try to get another hit, like reading a relevant history book to better understand the current cultural and political moment.

This is a thing I built for me, but I thought I'd share in case anyone else is in the same boat. I've added no analytics, no data collection, no monetization, no account creation, or anything else.

Just a simple, single-purpose browser extension.

You can find it on the Chrome Web Store here if you're interested: Go Read a Book - Chrome Web Store

If you like this post or one of my projects, you can buy me a coffee, or send me a note. I'd love to hear from you!

Vibe Mapping

2026-01-15T16:39:20+00:00

Some of you know this, but I got into computing after being exposed to MUDs in the late 90's. For the uninitiated, MUDs were the text-based precursors to MMORPGs like Everquest and World of Warcraft—in fact, Everquest was even sued by one of the progenitors of the entire genre because the game, while graphical, had elements that were so eerily similar.

I've been in love with the genre ever since, and quickly taught myself C just so I could hack on my own. MUDs are the reason that I not only learned how to code, but how to type, how to use Linux, how to run a server, how to write, and so many of the other skills that kicked off my career.

MUDs, like Linux, have variants, distributions, and derivatives. My favorite "family" was called DikuMUD, which was originally created by a group of nerds at the department of computer science at the University of Copenhagen.

The game I grew up playing and hacking on was a great-great-grandchild of Diku called "Entropy of the Soul", or EotS for short.

The way the data for Diku MUDs was structured was through text files using a proprietary file structure. No CSVs or JSONs or XML, just whatever the random assortment of developers chose to do throughout the years. Here's a little snapshot of what an "area" file looks like:

#ROOMDATA
#25000
Temple of Bethaven~
Within this chamber stands the great and ancient Oracle.  He has stood in
this spot since long before the dawning of the Storm, and shall continue
into eternity.  Standing directly in the centre of the room is a huge altar
carved from one solid granite stone.  It's surface is carved with intricate
designs and symbols.  It is here that the citizens of Bethaven come to heal
and rest, and to share in the glory of eternity.  There is a door set into
the northern wall, with an inscription carved upon it.
~
0 1076102152 0
Rd     0
E
door~
The door bears an inscription which reads:
&BTo the Bethaven Botanical Gardens
~
D0
~
door~
3 0 14000
D1
~
~
0 0 25120
D2
~
~
0 0 25001
D3
~
~
0 0 25119
D4
~
~
0 0 25132
S

Hard to read, right?

As you can see, this proprietary format means that reading the files without the game code can be a pain in the ass, and writing them even more so.

So I decided to take Google's Antigravity for a spin by putting it to the task of creating an "area explorer" that takes these files and makes them visual. Like a family tree explorer, Antigravity generated a beautiful and highly usable system for importing area files, rendering the maps and other data in a meaningful way, and even created an export functionality.

The craziest part? The bulk of the work of understanding the files was done entirely by the agent. All I did was point it at the EotS source code, tell it what to build, and it got about 80% of the way on its own.

About an hour's worth of prompt work later and I ended up with a gorgeous tool that I would have killed to have when I was just starting out.

I'm still in awe at how well this entire thing turned out.

If you're interested in checking the project out, you can get to it on my projects page, or find it directly here.

If you like this post or one of my projects, you can buy me a coffee, or send me a note. I'd love to hear from you!

Elseless

2026-01-04T15:21:00+00:00

Here's a little "cognitive complexity" tip for your next programming project: get rid of your else statements.

Okay... maybe not all of them. But as many as you can, because unnecessary else statements can decrease the readability of your code in small, but often very meaningful, ways.

This isn't a hard-and-fast rule—which was made abundantly clear when I posted this on LinkedIn and triggered a small flame war—but when I write my own code, I tend to keep the following guidelines in mind to keep else-driven cognitive complexity down:

Return or raise early?

If returning or raising from within an if block, you can often drop the else and unindent the remainder.

Before

def process(value):
    if value is None:
        raise ValueError("value cannot be None")
    else:
        return value * 2

After

def process(value):
    if value is None:
        raise ValueError("value cannot be None")

    return value * 2

Continue/break inside loops?

Similar to the above rule, if you continue or break inside an if, you can often skip the else and put the “keep” logic after the guard.

Before

for item in items:
    if not is_valid(item):
        continue
    else:
      process(item)

After

for item in items:
    if not is_valid(item):
        continue

    process(item)

Assign defaults first

An old "C" programming language convention: assign defaults first. When you do that, you can often avoid else statements entirely.

Before

def get_status(user):
    if user.is_active:
        status = "active"
    else:
        status = "inactive"

    return status

After

def get_status(user):
    status = "inactive"

    if user.is_active:
        status = "active"

    return status

Or, an even cleaner version, dropping the intermediate variable and using a guard clause:

def get_status(user):
    if user.is_active:
        return "active"

    return "inactive"

Guard clauses for invalid/edge cases?

If you have multiple branches to handle edge cases, consider using guard clauses to handle them first so the main path of your function is clear. What's a "guard clause"? It's just an if statement that returns or raises early.

Before

def calculate_discount(price, customer):
    if customer.is_vip:
        return price * 0.8
    else:
        if customer.is_loyal:
            return price * 0.9
        else:
            return price

After

def calculate_discount(price, customer):
    if customer.is_vip:
        return price * 0.8

    if customer.is_loyal:
        return price * 0.9

    return price

Nested if/else causing indentation creep?

More indentation means more cognitive load. If you find yourself with nested if/else statements, see if you can convert inner branches to guard returns/raises and unwrap.

Before

def process_order(order):
    if order.is_valid():
        if order.is_in_stock():
            if order.payment_received():
                if order.ship():
                    return "Order shipped"
                else:
                    return "Shipping failed"
            else:
                return "Payment not received"
        else:
            return "Out of stock"
    else:
        return "Invalid order"

After

def process_order(order):
    if not order.is_valid():
        return "Invalid order"

    if not order.is_in_stock():
        return "Out of stock"

    if not order.payment_received():
        return "Payment not received"

    if order.ship():
        return "Order shipped"
    else:
        return "Shipping failed"

Both branches return the same type/value shape?

Sometimes both branches of an if/else return the same type or shape of value. In those cases, I prefer two returns over a return and else.

Before

def get_user_status(user):
    if user.is_active:
        return "active"
    else:
        return "inactive"

After

def get_user_status(user):
    if user.is_active:
        return "active"

    return "inactive"

If you like this post or one of my projects, you can buy me a coffee, or send me a note. I'd love to hear from you!

Code It Forward

2025-11-17T17:05:00+00:00

In the late Summer of 2020, still deep in the throes of the COVID-19 pandemic and dealing with a near constant sense of dread and anxiety, I had an appointment with my optometrist that changed the course of my life and career.

After a few dozen rounds of "A or B, 1 or 2?", he asked me if I still "worked with computers" for a living. I was a Principal Engineer at a cybersecurity company called Automox at the time (their first Principal Engineer, actually, nbd), which I figured qualified working with computers, and after responding in the affirmative, he told me that his son had been taking a computer science class at his high school.

"Unfortunately," he said, "the teacher seems to be ahead of the students in the curriculum by only a few weeks, so he's not learning as much as he'd like."

I was shocked by the revelation, which brought a whole new meaning to the phrase "those who can't do, teach," so I went home that day and sent an email out to every high school in my area, asking if I could volunteer in their computer science programs in some way. If I'm being completely honest, I didn't actually know how I could help (after all, I didn't have any teaching experience), but I just knew that I needed to get involved somehow.

I ultimately heard back from just one school, but in that one act, I discovered a number of incredible (yet, to me, undiscovered) ways that Software and IT professionals can get involved in computer science classrooms. While my journey quickly led from volunteering in classrooms to actually teaching one, I thought I'd share some of the lessons learned, and highlight different ways that my former peers can lend their expertise to the next generation of engineers.

"Sponsored" Volunteer Programs

There are a handful of formal programs that provide opportunities to get involved in computer science classrooms, but the two that I personally joined were Code.org (which seems to have actually decommissioned their volunteer program sometime in the last year or two) and Microsoft TEALS.

If I'm being perfectly honest, your mileage with programs like these will vary.

In the 3-4 years I was on the Code.org volunteer list, I was only ever contacted by one middle school teacher to volunteer to teach at a STEM day that resulted in a two hour adventure through a blizzard, and the realization that teaching middle school just wasn't for me.

As for Microsoft TEALS, I was never contacted to volunteer... ever.

Volunteering at the Source

If you really want to have an impact, my recommendation is going direct to the source. From Kindergarten through Grade 12, nearly every school has some sort of STEM program that teaches computer science concepts. While I was (and am) more interested in the potential for real life change that students can experience at the high school level, I can promise you that elementary and middle schools need volunteers too; and, believe me, there are many ways to get involved.

The first thing you need to do is reach out not just to the schools in your area, but also to the school district itself, and even your state's Department of Education. While the state and district websites don't always have clear contact information, you can often find a page on volunteering, or even a general contact page that will get routed to the right person (eventually). Keep an eye out for any page or person related to CTE (Career and Technical Education), ETMA (Engineering, Technology, and Media Arts), or STEM (Science, Technology, Engineering, and Mathematics); any of those will get you much closer to a person who can connect you with the right people.

At the school level, most school websites list the contact information for every teacher and staff member. You will want to send an email to at least these people:

Any/all teachers teaching in STEM-related fields (think Computer Science, Robotics, Engineering, etc)
The principal and associate/vice principal(s), who won't actually be the deciders, but will increase your likelihood of getting a response (teachers are busy people, so getting ghosted is more about their workload than it is about their interest in receiving your support)
Some schools titles like "Career Counselors" or "Work-Based Learning Specialists" or something like that, which are positions that help students plan their lives after high school and connect them with internships before graduation

Anyone outside the above sphere of influence might pass on your email, but they are also just as likely to ignore it in the sea of thousands of other things they have to do. Don't take it personally.

What "Volunteering" Looks Like

Once you are in contact with a school (or schools), the next thing to do is figure out what level of involvement you actually want to have. If your work schedule is flexible, then maybe you want to spend time in the classroom as a guest lecturer or assistant, but if you'd rather volunteer on your own time, then you might want to get involved as a program advisor, tutor, or after-school program mentor.

Schools are happy to get any support they can from their communities, so you have options here, and are unlikely to get too much pressure to help more than you are able. So you understand the big picture, let's break down a few of the different volunteering capacities I mentioned above.

Guest Lecturing

Guest lecturing is pretty much exactly what it sounds like: you come into a classroom (physically or virtually), and give a lecture or lead a lesson on a topic of your choosing. My first classroom exposure was as a guest lecturer, where I gave a 30 minute talk on "Careers in Technology" to a high school computer science class.

This is a great way to get your feet wet, and can be as simple as showing up and talking for a bit, or as involved as preparing slides, activities, and assignments. The key here is to coordinate with the teacher ahead of time to make sure your content aligns with their curriculum and the students' current level of understanding.

As a now-teacher, I can tell you that guest lecturers are always appreciated, both for the content they bring, and for having one-less lesson to plan and grade.

Classroom Assistance

Sometimes, teachers have an activity or module that they already have to (or want to) teach, but could use an extra set of hands (or, more appropriate, an extra brain) to help answer student questions or provide one-on-one support.

This is where classroom assistance comes in.

It's not a formal role, per se, but more of an ad-hoc arrangement where you show up to a class session and help out as needed. This can be especially helpful in computer science classes, where both the students and teachers can have a wide range of skill levels and may need varying degrees of assistance.

Program Advising

One of the requirements (at least in the state of Colorado) of a high quality Career and Technical Education (CTE) program is to have industry professionals involved in the program's development and execution. This is called a Program Advisory, and is an opportunity for industry professionals to lend their expertise to help shape the curriculum, provide feedback on equipment needs, and ensure that the program is aligned with current industry standards.

I joined a program advisory at about the same time I started volunteering in classrooms, and I enjoyed hearing about the challenges and successes of the program from the teacher's perspective, while also connecting with other local professionals who were also invested in the program's success.

An advisory will typically meet a few times a year, and while it's not a huge time commitment (a couple hours a semester), participation provides an opportunity to influence curriculum, certification paths, work-based learning opportunities, and even internship pipelines for students.

Tutoring and Mentoring

If you have the time and inclination, one-on-one tutoring or mentoring can be an incredibly rewarding way to give back. This can take many forms, from helping a student with homework or projects, to providing guidance on college applications and career paths.

The next-evolution of my volunteering journey was becoming a mentor for an after-school coding club that the high school I was involved with had recently started. This was a once-a-week club, where students would come together and build a project of their choosing, with me acting as a resource and guide. Students could ask questions, get help with coding challenges, and learn about best practices in software development. It was a blast, because every one of them chose to be there, rather than being required to attend a class.

Final Thoughts

Volunteering in computer science classrooms is a fantastic way to give back to your community, inspire the next generation of engineers, and stay connected to the ever-evolving world of technology. Whether you choose to guest lecture, assist in the classroom, advise a program, or mentor students, your expertise and experience can make a significant impact.

If you would like to volunteer, but aren't sure where to start, or don't have any particular affinity for connecting in your own district (or your district doesn't have any computer science programs), I am always looking for new advisors, mentors, and guest lecturers for my own classroom.

Feel free to reach out to me via email at zach.flower@jeffco.k12.co.us, or connect with me on LinkedIn, and we can figure something out!

If you like this post or one of my projects, you can buy me a coffee, or send me a note. I'd love to hear from you!

Spinning up an Onion Mirror is Stupid Easy

2025-10-23T13:18:00+00:00

I recently spun up a .onion mirror of this website.

Why? Because why not. And also because I can. Oh, and free speech and anti-censorship and all that jazz.

I'd like to pretend that it was some grand technological challenge, but if I'm being entirely candid, it was like 3 commands and 4 lines of configuration.

If you, too, would like to become a member of the dark web, here's how I did it:

0. Prerequisites

Before we jump into the "how" of it all, I should probably provide a brief overview of what my stack looked like before I entered The Onionverse:

Web Server: I've been using Caddy for a few years now, because it's significantly easier to configure than Nginx or Apache, and it has first-class support for modern web features like automatic HTTPS via Let's Encrypt.
Hosting: My site is hosted on a VPS from DigitalOcean, which gives me full control over the server environment. It's supposed to cost $4/mo, but I'm taking some classes at Ye Olde Community College, so I have a few years of credits to cover the cost.
Operating System: My server runs Debian. I like Debian. If you aren't using an apt-based distro, then you'll need to adjust the package installation commands accordingly (but the Tor and Caddy configurations should be the same).

1. Install Tor

First things first, we need to install Tor. On Debian, it's right in the default repositories:

sudo apt update
sudo apt install tor

2. Configure Tor

Next, we need to configure Tor to create a hidden service for our website. Open the Tor configuration file (/etc/tor/torrc) in your favorite CLI text editor (it better be vim, or you are dead to me). I have no interest in running a relay or exit node on my VPS, so I made some minimal changes to the config file, which should look something like this (comments removed for clarity):

# Disable SOCKS proxy since we aren't making outbound connections
# through Tor
SocksPort 0

# Make sure Tor runs as a daemon (i.e. in the background)
RunAsDaemon 1

# Setup the hidden service on port 80, this is where we tell Tor to
# create a .onion service for our web server
HiddenServiceDir /var/lib/tor/hidden_service/
HiddenServicePort 80

# Disable inbound connections, since we aren't running a relay or
# exit node
ORPort 0

# Disable directory services, since we won't be mirroring directory
# information to other Tor nodes
DirPort 0

That's it. Everything else should be commented out using # characters.

3. Restart Tor

Now we need to restart the Tor service to apply our changes:

sudo systemctl restart tor

4. Get Your .onion Address

After Tor restarts, it will generate a new hidden service for us. We can find our new .onion address in the HiddenServiceDir we specified earlier (/var/lib/tor/hidden_service/). This directory is only readable by the debian-tor user, so we'll need to use sudo to read the hostname file inside:

sudo cat /var/lib/tor/hidden_service/hostname

What will be printed to the terminal is your new .onion address. It should look something like this:

jytkco7clxwj4hhzaydhk4kr3hwzsdzyvtsc6zn2ivog5uma5pxowzad.onion

5. Configure Caddy

My Caddy server serves my website on port 80 without any IP or domain restrictions, so I don't need to make any changes to my Caddy configuration, however if you explicitly set up your Caddy server to only respond to certain domains or IP addresses, you'll need to add a new site block for your .onion address, which will look something like this:

http://jytkco7clxwj4hhzaydhk4kr3hwzsdzyvtsc6zn2ivog5uma5pxowzad.onion:80 {
  # Set up a reverse proxy, or serve static files, etc.
}

Because you can't get HTTPS certificates for .onion addresses, you'll need to serve your site over plain HTTP. I'm not sure if this is generally considered acceptable within the Tor network (maybe one of my tens of readers can enlighten me), but I don't require HTTPS for my site anyway, so it works for my purposes.

Update (2025-10-31):

I received an email yesterday from immibis with some additional information about how Tor actually works, so I thought I'd share for anyone else who is also just dipping their toes into the onion:

This is considered perfectly acceptable. Tor already provides encryption between the end user's Tor daemon and your own, which is at least as good as TLS.

The address is linked to the private key - which is also found in your hidden service directory next to the hostname - forever and always. Anyone who knows the private key of a .onion address can impersonate it, and anyone who doesn't know it, can't.

6. (Optional) Advertise Your .onion Address

If you want people to find your .onion site, you'll need to advertise it somewhere. I'm a fan of subtlety, so I set up an Onion-Location header on my main site that points to my .onion address. This way, anyone visiting my regular site with a Tor-enabled browser will automatically be informed of the existence of my .onion mirror without any intrusive pop-ups, banners, or additional UI elements.

To do this, you'll want to add a header to your main Caddy site block like so:

header {
  Onion-Location http://jytkco7clxwj4hhzaydhk4kr3hwzsdzyvtsc6zn2ivog5uma5pxowzad.onion{uri}
}

The reason I tack on that {uri} at the end is so that if someone visits a specific page on my main site (e.g. https://flower.codes/some-post), the Onion-Location header will point them to the equivalent page on my .onion site (http://jytkco7clxwj4hhzaydhk4kr3hwzsdzyvtsc6zn2ivog5uma5pxowzad.onion/some-post), which (at least to me) adds some polish to the experience.

7. Profit!

Just kidding.

At this point, your .onion mirror should be up and running. You can test it out by visiting your .onion address in any Tor-enabled browser (like the Tor Browser or even Brave, which has built-in Tor support).

If you like this post or one of my projects, you can buy me a coffee, or send me a note. I'd love to hear from you!

Maybe We Should Stop Banning Books?

2025-10-20T21:47:00+00:00

Banned Books Week was like... a week and a half ago, but I missed it because I don't pay enough attention to arbitrary days of observance.

My bad.

I have some thoughts, though, and thought I'd take the opportunity to share them, despite their fashionably late arrival.

For absolutely no reason—none whatsoever—I've been thinking a lot about censorship and freedom of expression in the United States lately.

"Congress shall make no law respecting an establishment of religion, or prohibiting the free exercise thereof; or abridging the freedom of speech, or of the press; or the right of the people peaceably to assemble, and to petition the Government for a redress of grievances."

— First Amendment to the United States Constitution

Because I'm a fully formed human being with an over-developed sense of empathy, I think that free speech can be a complicated issue.

On one hand, it's important to protect the right to express diverse opinions and ideas, even if they are controversial or unpopular. On the other hand, I agree that some forms of speech—such as incitement to violence—don't deserve those protections due to the extreme harm they can cause.

One thing to be clear on, though, is that incitement to violence is not the same as offensive speech. The two are often conflated, but they are very different concepts. Incitement to violence refers to speech that is intended to provoke or encourage others to commit acts of violence.

Jokes do not count as incitement to violence.
Satire does not count as incitement to violence.
Parody does not count as incitement to violence.
Art does not count as incitement to violence.
Criticism does not count as incitement to violence.
Dissent does not count as incitement to violence.
Protest does not count as incitement to violence.

Unfortunately, even hate speech does not count as incitement to violence; I do hate that.

I hate the othering of already marginalized groups, and conspiracy theories that spread dangerous misinformation, and outright lies meant to manipulate and mislead, and hateful rhetoric that seeks to divide us. I hate that some people use their words to hurt other people, and I hate how much hate there is in the world.

But I also hate the idea that it is okay silence people just because we disagree with them—even if what we disagree with is disgusting on its face—because that means someone gets to decide what is acceptable speech and what is not, and who the hell could we possibly trust to draw that line?

If we're being completely honest with ourselves: nobody.

If you don't like what someone is saying, the answer is not to silence them. The answer is to engage with their ideas, to respectfully challenge them, and to present your own perspective.

Or just fucking ignore them, because our attention is free expression too (we may have to allow speech we disagree with, but we don't have to personally tolerate it).

Book banning is a great example of this.

When books are banned, it's because they contain ideas or perspectives that some people find offensive or uncomfortable, and they want to prevent others from being exposed to those same ideas. But exposure is not the same as endorsement, or agreement, or (the word of the decade) indoctrination.

Instead of banning books, we should be encouraging critical thinking and open dialogue about the ideas they contain. We should be teaching people how to evaluate information, how to recognize bias and misinformation, and how to engage in respectful debate.

The last thing we should be doing is trying to silence voices we don't like, even if those voices are loud and obnoxious and downright hateful (which, let's be clear, books advocating for equal rights, justice, and human dignity are absolutely none of those things, regardless of how uncomfortable they make someone in their world view).

Because the reason we have to allow the speech we don't agree with is so we can continue to share the speech we do agree with. It's not about them vs. us; it's about all of us, and when we lose sight of that (like how things often feel today), then we all lose.

I don't read enough banned books, and I definitely don't read enough books that challenge my worldview (can anyone?), but I do read some, and would like to read more.

I encourage you to do the same.

Because the more we read, the more we can understand each other's pain and frustration and fear and troubles, and the more we understand that, the more we can find a way through the garbage fire we are all experiencing at the moment.

If you like this post or one of my projects, you can buy me a coffee, or send me a note. I'd love to hear from you!

Hacker High School

2025-10-17T15:41:00+00:00

This article was originally published in 2600 Magazine, Autumn 2025. I had originally just sent it in as a proposal for a larger series, but they published it as-is, so it reads a bit weird.

Who am I to argue with their editorial decisions, though?

Enjoy!

Course: Hacker High School
Room: /dev/null
Prerequisites: Curiosity, disrespect for authority, basic terminal fluency
Warning: This course may violate district policy, state standards, and the laws of physics.

Course Description

This document was not approved by the school board. It was not submitted for review, not listed in Google Classroom, and as far as your parents are concerned, doesn't exist. If you're reading it, you either made a wrong turn in the curriculum database or you know exactly where you're supposed to be.

Hacker High School is a semester-long immersion into subversive computing, inspired by over four decades of 2600: The Hacker Quarterly. Every lesson is real. Every exploit has been tested in the field—often by teenagers with too much time and too little supervision. This is not about theory. This is about doing.

The syllabus below outlines a full 18-week course blending system intrusion, digital disguise, network manipulation, and physical bypass—taught from behind a desk covered in stickers and caffeine residue. It is structured, thorough, and deeply unethical in the most ethical way possible.

If anyone asks, we're teaching "digital literacy."

...

Week 2: MAC Daddy

This week introduces the concept of identity at the hardware level. If last week was about controlling what you reveal, this week is about controlling who you appear to be—on the network, anyway. Students will learn how MAC addresses work, how they're used to fingerprint devices, and how to break that chain of trust.

We're not asking permission to be on the network. We're showing up in disguise.

Themes

Identity vs. identification
Fingerprinting and tracking
The futility of hardware-based trust

Warmup

Run ip link in your terminal. What brand is your network interface broadcasting? How often do you think it changes?

Tool of the Week

macchanger – The classic utility for changing MAC addresses Alt: ip link + ifconfig combo – Because it's good to know what's underneath the wrappers

Required Reading

"DHCP is Your Friend!" - Volume 19, Number 4 (Winter 2002-2003)
"Vulnerabilities in Subscription Wireless" - Volume 21, Number 4 (Winter 2004-2005)
"MAC Address Changer" - Volume 25, Number 2 (Summer 2008)

Hands-On Objectives

By the end of this week, you will have:

Identified your device's hardware MAC address
Spoofed it to impersonate another device
Used your new identity to bypass a basic access control system

Prompt for Reflection

If you can change your device's identity at will, what's left of trust on the network?

Assignment

Use macchanger or a manual method to spoof your MAC address
- Connect to a restricted or captive portal network (in a sandboxed lab)
- Document how the network treated you differently—or didn't
- Reflect on the ease or difficulty of being someone else, digitally

Bonus: Set up a cron job to randomize your MAC address on a regular interval. Then write a reflection on whether this has improved or hindered your experience online.

If you like this post or one of my projects, you can buy me a coffee, or send me a note. I'd love to hear from you!