Blog

Latest Posts

Oil painting on a diagnostic test bench with texture analysis panels

ai-image-generationopenaiSep 9, 2026· 4 min read

The Wave Texture in OpenAI's New Image Models

On September 8, OpenAI released two new image models: Flare and Sunburst. A stylistic step forward, but both carry the same uniform microtexture as their predecessor. Four automated detection attempts fail, two visualizations reveal the pattern.

Cell field of 34 rows and 365 columns: each row a water year, each column a day, the brightness standing for the share of gauges below their low-flow threshold. The bright bands cluster in the lower rows.

niedrigwasserklimadatenSep 2, 2026· 4 min read

From an Article to Our Own Index

In August, CORRECTIV analyzed how low flow has developed at 356 German gauges. The finding convinced me, the map that came with it stayed unreadable to me. So I asked Claude what we could do with the same data ourselves. What came out of it is an index of our own across 34 water years.

Editorial illustration: three hands reach in from the edges, placing workpieces on a workbench — a Docker whale fragment, a shield symbol, a recipe note — while an untouched, labelled workpiece sits in the middle

pullmdopen-sourceAug 5, 2026· 4 min read

PullMD Part 15: What Strangers See Better

Eight weeks in which one outside pull request, one security report and two feature wishes moved the product further than any inside work in the same stretch. Plus a feature that worked perfectly and still never got triggered, because nobody from outside found it.

Editorial illustration: two vintage recording instruments on a dark wooden table. On the left a drum thermograph with a brass plate reading 'EFFECT', on the right a gas recorder with exposed clockwork and a plate reading 'DRIVER'. Both pens draw onto the same running paper strip: the red temperature trace ends at the thermograph's pen, the blue CO₂ trace at the gas recorder's pen, with blank paper to the right. Before the splice carrying the year mark '1958' the blue trace is dashed, solid and bold after it.

klimaspiraleklimadatenJul 26, 2026· 4 min read

Klimaspirale Part 4: CO₂, and What Was Under the Post

The spiral shows what happened. The most common objection to it aims at why it happens, and that is why a CO₂ curve now runs alongside: ice-core air up to 1958, the measuring station in Hawaii after that, with a visible seam. Plus the final polish before the launch, a data-as-of date that belongs to the data, and a look back at the post it all started with.

Editorial illustration: workshop scene on a dark desk. On the left, a framed strip of film holding a small climate spiral above a play bar labelled 'ENDS 2021'. From the frame, a paper tape full of monthly anomaly values runs to the right through a metal verification-stamp device with a glowing green 'SOURCE VERIFIED' display; a magnifying glass and pins lie in front.

klimaspiraleklimadatenJul 26, 2026· 4 min read

Klimaspirale Part 1: From a Video to My Own Data

One morning an old clip climbs the ranks in a subreddit: the climate spiral, rising rings of monthly values, data up to 2021. The question of whether you can rebuild it with current numbers led first to a mistake about the tool and then to the insight that the animation is the easy part. How 1,752 monthly values turned into a spiral of my own, and what a temperature anomaly actually is.

Editorial illustration: two steel measuring rules hang vertically side by side on a dark stone wall, their zero marks visibly offset against each other. A caliper spans the gap between the two scales and puts the offset at '+0.19 °C' in its display window. To the left and right, one brass plaque each: 'BASELINE 1951–1980' and 'PARIS 1850–1900'.

klimaspiraleklimadatenJul 26, 2026· 4 min read

Klimaspirale Part 2: The Baseline Trap

The same month, the same measurement, two different numbers: our scale is calculated against 1951 to 1980, the Paris Agreement against 1850 to 1900. Between the two lie 0.19 °C, and that put the spiral's 1.5 degree ring in the wrong place. How a Paris toggle came out of it, why a record month doesn't mean a climate target has been broken, and how the trap caught me in my own application.

Editorial illustration: drafting-table scene. A measuring tape lies unrolled in a spiral on a dark surface — the short inner turns in blue-grey, the ever-longer outer ones in copper-red, all exactly the same width. To the left, a pair of dividers and the tape's leather capsule, in front a handwritten note with the formula 'r = anomaly + 1.2'.

klimaspiraleklimadatenJul 26, 2026· 4 min read

Klimaspirale Part 3: The Objection I Missed

Before the page went live, I wanted to know what was wrong with the spiral. The review read the data itself and found a continent whose series ends five years too early. The strongest finding was a different one: the question of whether the chosen geometry gives warm years an optical advantage.

Editorial illustration: a central PDF/A-3 document with an embedded XML chip is checked by three independent validators, 'veraPDF', 'KoSIT' and 'Mustang', each showing a green 'PASS'; footer 'PDF/A-3 · EN 16931 · ZUGFeRD'.

e-rechnungzugferdJul 17, 2026· 4 min read

E-Rechnung 2028 Part 4: How I Know It's Actually Compliant

Building something compliant from the ground up is a claim. With a legal mandate, what counts is proof. Part 4 shows where it comes from: from three independent official validators, not from me. And in the end, the engine gets a name.

Editorial illustration: four labelled building blocks 'MODEL', 'XML', 'PDF/A-3' and 'MERGE' flow into a single invoice document that passes through a 'VALIDATOR: GREEN' gate; on the left a crossed-out 'LATE STAMP', on the right a criteria list ending in 'NO GREEN WITHOUT PROOF'.

e-rechnungzugferdJul 10, 2026· 4 min read

E-Rechnung 2028 Part 3: Compliance Is Built In, Not Bolted On

Building it myself was decided. But is that even feasible without disappearing into PDF internals for half a year? Part 3 shows why compliance isn't something you stamp on at the end, and how the intimidating problem breaks down into four manageable building blocks.

Editorial diagram: a UCG router panel with the Critical Apps rule highlighted, behind it a DPI funnel choking the data stream; on the left an ONT and a laptop running the PPPoE direct test at the full 600 Mbit, on the right two gauges reading 300 and 600 Mbit.

homelabnetzwerkJul 7, 2026· 4 min read

When your 600 Mbit fiber line feels like 300: a detective story with the UniFi UCG Ultra

Four hours of debugging, a PPPoE stack on a Linux laptop, an unplugged switch. In the end it was a single QoS rule. Why harmless-looking features on a consumer gateway can cost you half your line.

Editorial illustration: on the left three stacked 'LIBRARY (BETA)' blocks feeding via dashed paths into a central 'PDF/A-3' gate; below, a separate 'OWN LOGIC' path runs through a 'CONFORMITY CORE' to a green 'VERIFIED'. A third-party beta library set against a self-built, verified core.

e-rechnungzugferdJul 3, 2026· 4 min read

E-Rechnung 2028 Part 2: Plug In a Library, or Build It Right?

Producing an e-invoice is something you can buy or build. The obvious answer was: grab a ready-made library. How I let the AI first nudge me in that direction and then correct me out of it again — and why the more uncomfortable decision is the one I landed on.

Editorial illustration, split: on the left an openly readable token card under 'LOCAL STORAGE / PLAIN TEXT'; on the right a heavy safe marked 'HttpOnly', 'APP-BOUND' and 'VAULT', below it a 'TPM' chip with a key set into it and the label 'DEVICE-BOUND'.

jwtauthJun 27, 2026· 4 min read

Plain Text and Vault: Why Your localStorage Lies Open and Your Login Doesn't

In the last part, Google and Microsoft didn't show up in the browser scan at all, even though they manage some of the most valuable sessions there are. One token lies in plain text, the other in a vault. That asymmetry explains both: why the scan found what it found, and why the real fix isn't to encrypt better, but to bind the token to the device.

Editorial illustration: on the left a dissolving PDF whose pixels reorder into a structured XML data set on the right; behind it the checkpoints 'RECEIVE 2025' and 'ISSUE 2028', an EN 16931 checklist and an '8Y' archive safe. Status lines: visible invoice image optional, machine-readable data mandatory.

e-rechnungzugferdJun 26, 2026· 4 min read

E-Rechnung 2028 Part 1: Who Has to Comply, and When?

While building an invoicing portal, a side question came up: do we need to worry about the E-Rechnung, and from when? Part 1 sorts out the legal framework for small businesses and sole traders — deadlines, thresholds, exemptions, and why starting early pays off.

Editorial illustration: a drawer full of small token cards (labelled 'eyJ…'), most of them faded (expired), a few glowing copper (live), a magnifier above; on the right a sealed, locked compartment marked 'HttpOnly / SEALED'; a 'LOCAL STORAGE' label.

jwtauthJun 23, 2026· 4 min read

Look in Your Own Browser: Which Tokens Are Really There

Security researchers found stored ChatGPT logins on more than 100,000 devices in the logs of malware, with no break-in at the provider. They were harvested browsers. So I looked at what is in my own: a walk through localStorage, a scanner I built, and the question of why a JWT you find is almost never what it looks like.

Editorial diagram in two halves: on the left, under 'WHERE', a coat-check token with a number, a server ledger and a 'lookup' arrow; on the right, under 'WHAT', a three-part card HEADER / PAYLOAD / SIGNATURE with a wax seal and a 'verify' arrow.

jwtauthJun 18, 2026· 4 min read

A JWT Is a Format, Not a Login System

Hacker News was arguing about JWTs again. I wanted to work the topic out for myself: what a JSON Web Token actually is, where it's the right tool, where it gets dangerous, and what to use instead.

Editorial diagram: document formats (PDF, DOCX, PPTX, XLSX, EPUB) flow into a MarkItDown sidecar box, while three own paths (Audio, YouTube, Vision) are deliberately routed around it through their own panels; warning sign 'No silent externals'

pullmdmarkitdownJun 16, 2026· 4 min read

PullMD Part 14: Wiring in Microsoft's MarkItDown — and ripping three parts back out

Microsoft's MarkItDown sits inside PullMD now, and three parts of it went straight back out; one of them would have sent audio silently to Google's API. A trivial itch turned into v3.0.0, a security review with a brand-new model, and a rule in the project memory.

Editorial diagram: an old paper clipboard card reading 'geo: DE only' and 'rule active' clipped to a modern WAF/edge-panel box; on the left, incoming request paths from the US (red, host_not_allowed, outbound blocked) and DE (green); on the right, the origin server panel showing an empty log ('origin: no request').

pullmdoauthMay 16, 2026· 4 min read

PullMD Part 13: An Old Rule

For four days feat/oauth sat finished on the shelf because I took the block for a platform problem. Then I went and looked at the logs after all. The cause was a WAF rule of my own that had long outlived its purpose. After that, two releases in a single day.

Editorial diagram: a client panel with code on the left feeds a SPEC CHECKS column where eight RFC items all show green check marks, then arrives at a metal HOST NOT ALLOWED gate with a padlock; on the right the MCP SERVER stays idle with 'LOG · ZERO REQUESTS'.

pullmdoauthMay 13, 2026· 4 min read

PullMD Part 12: Spec-Compliance Isn't Enough

v2.1 OAuth was implementation-complete on feat/oauth. Adding it in claude.ai web returned: 'Couldn't reach the MCP server'. Server logs empty, eight spec checks all green. At the end of the search there was no bug in my code, but a host allowlist on the other side.

Editorial diagram: three auth-mode cards across the top (DISABLED, SINGLE ADMIN, MULTI USER) feeding a central user-group hub connected to OAUTH and CONNECTOR modules; a security-review-findings panel on the right with critical/checked items; a bottom row of icons for users, sessions, API keys and connections, plus a v1.2 → v2.0 version arrow.

pullmdmulti-userMay 9, 2026· 4 min read

PullMD Part 11: The Multi-User Pivot

Issue #5 flipped the order. Multi-user was Phase 2 or 3 in my head, now it sat right at the top. In four days and thirty commits, PullMD v1.2 turned into an auth system with three modes, Argon2id sessions and a security-review file I deliberately put into the repo in public.

Editorial diagram: a cutaway building with three entrances, labelled API, WEB and PWA. Only the API entrance has a heavy bolted door with a lock, the other two stand open and lead straight to a filing cabinet labelled HISTORY. Above, a dashed line AUTH wraps around the whole building and runs via OAUTH to three user symbols. On the left a panel /authorize with the red finding REVIEW: BLOCKED.

pullmdsecurityMay 7, 2026· 4 min read

PullMD Part 10: Locking It Down, Properly

On the day of the Reddit post I gave the service an authentication layer on the side. The morning after, my own review found it could be walked around, and I found the question that opened everything up again.

Editorial diagram: an r/ClaudeAI panel on the left flows through a glowing arrow into a central OPEN SOURCE node; on the right two stacked panels track 13 issues and an architecture question. Bottom row: a code snippet feeds a summary node with a cache-hit tag, then verbatim markdown output.

pullmdredditMay 6, 2026· 4 min read

PullMD Part 9: Reddit Day and the First Issues

On the morning of April 27, gh repo create ran. Overnight: a few stars, not a single issue. On April 28 I posted to r/ClaudeAI. In the 24 hours that followed, thirteen issues landed in the tracker. The feedback pushed me to pull multi-user forward, something I had planned for much later.

Editorial diagram: PRIVATE on the left, PUBLIC OSS on the right, separated by a glowing threshold; AGPL-3.0 license boundary card and PullMD/MD nodes.

pullmdopen-sourceMay 4, 2026· 4 min read

PullMD Part 8: From My Tool to an OSS Project

Two reasons the codename was never going to become the final name: one was clarity, the other was trademark law. The switch to PullMD had effectively been settled since March 8; on April 25 the source tree was cleaned up and the project went public under AGPL. Two days later the Playwright sidecar landed on top.

Editorial scene: on the left a tied-up bundle sits at a local port that is crossed out, so the route through your own installation. In the middle a cabinet with the bar REMOTE MCP, three lit tool compartments and a bar BASE_URL. From there, lines run across three tool symbols to five stacked devices, each labelled CLIENT.

pullmdmcpMay 2, 2026· 4 min read

PullMD Part 7: The MCP Server

I wanted to set my own service up in Claude Code, and took it for an MCP server myself. It wasn't one. Half an hour later there was a good reason to change that.

Editorial diagram on a desk with a notebook and a pair of compasses: on the left a help page titled /help with the entries CACHE, SHARE LINKS, PARAMETERS and CLIENT, below it a copy field AGENT SETUP and a download SKILL.ZIP. On the right a short identifier that runs through an hourglass marked > 1H either to REFETCH and FRESH or, dashed, to a card index STORED COPY as FALLBACK.

pullmdclaude-codeMay 1, 2026· 4 min read

PullMD Part 6: Setup for Agents

While poking around I notice that an agent could simply fetch a subreddit link over and over. While writing that idea down, I notice that it doesn't work that way at all.

Editorial diagram: URL input feeds a central routing gate that fans out into four extraction-path cards (Cloudflare MD, Reddit JSON, Readability, Trafilatura), each connecting to a Quality Score panel on the right; a small log panel bottom-left tracks health, signal and routed status.

pullmdweb-scrapingApr 30, 2026· 4 min read

PullMD Part 5: Measuring the Wrong Engine

A morning of small fixes to the output, then a round of real improvements. And in the end, the realisation that my comparison between two extraction engines had been measuring the wrong one of the two for weeks.

Editorial diagram: on the left a densely packed web page, in the middle a copper-framed gate labelled SKILL with a pointer choosing the route. Above it, PULLMD leads to a complete table with line numbers; below it, FALLBACK runs through a funnel to a thinned-out card. At the bottom a panel labelled TRACE with two failed attempts and the result .INVALID, RFC 2606.

pullmdclaude-codeApr 12, 2026· 4 min read

PullMD Part 4: The Skill, and What It Actually Delivers

Providing a tool is one thing. Getting the agent to use it in the right place is another. That is what skills are for. Whether mine actually delivers anything, I preferred to measure rather than believe.

Editorial diagram: on the left a panel with an entered address, in the middle a copper-clad machine with the bar GET /api. Three routes lead away from it: MARKDOWN directly, .JSON, and HTML through two funnels labelled READABILITY and TURNDOWN. Below the machine a card index SQLITE with requests.db, bottom right a 502 error drawn in red.

pullmdapiApr 5, 2026· 4 min read

PullMD Part 3: The API, and How Reddit Became Any URL

At the end of Part 2 a container was running. What you can actually call there was still written down nowhere. And two days later the service wasn't just for Reddit any more.

Editorial diagram: a glowing SPEC portal on the left, a 'TESTS FIRST' banner above four stacked test cards (NORMALIZE, FETCH, FALLBACK, INTEGRATION), then a CONTAINER panel on the right with a green RUNNING indicator; a small status panel bottom-left tracks TDD · REVIEW · GREEN.

pullmdclaude-codeMar 29, 2026· 4 min read

PullMD Part 2: From Spec to Running Container

I gave Claude Code the specification from Part 1 and expected an Express server. The first thing that appeared was four tests. No server, no Reddit logic. Not a coincidence, but a skill stack that enforces exactly this behavior.

Editorial diagram: a tall console labeled PARSE & FILTER between a noisy Reddit-like input panel on the left and a clean markdown output panel on the right; bottom row shows the parser pipeline producing structured data.

pullmdweb-scrapingMar 8, 2026· 4 min read

PullMD Part 1: Ctrl+A and the Junk Context

Paste a long Reddit thread into the chat and a large part of it is navigation, cookie banners and ads. Cloudflare's markdown service only works on sites that support it, which Reddit does not. So I am building it myself, for Reddit first.