Vincent's blog

Tuning log2table rules with real logs, and with an AI looking over my shoulder

Sat, 24 Oct 2026 17:43:00 +0100

log2table is a small daemon I wrote: it watches log files, recognizes attack patterns with regular expressions, and puts the offending IP addresses in a PF table so the firewall blocks them. The whole behavior is driven by one file: parameters.py.

Writing rules is easy. Knowing whether they are good rules is harder: do they catch what is really hitting my server today? Do they ban innocent visitors? Do two rules count the same attack twice?

This post explains the new version of parameters.py in the repository, its built-in checker that runs against your real log files, and how I used an AI (Claude, through Claude Code) to read the checker's output and propose improvements.

A parallel ZIP archiver in Zig — full AI in 17 minutes of code

Sat, 17 Oct 2026 22:17:00 +0100

I'm checking what AI can provide. For such investigation, I've installed Claude code on my VoidLinux setup. Since several months I'm interested by the Zig program language and their objectives. So, I've stated to ask Claude if he knows zig. Then I was thinking, what I can ask such robot to build in Zig. Finaly, my request was to perform a zip program using massively parallel computing. And, for sure, to stay compatible with the zip format. Amazingly, after 6 cycles code - compile - test, Claude proposed a working code after 17 minutes. Then I've asked him to compare this tool with other equivalent compression tools. This blog present results.

Fapws4 0.7 and 0.8: PEP 3333 for real, a test suite, and a clean shutdown

Sun, 11 Oct 2026 08:50:00 +0100

Fapws4 is my small and fast Python web server: a single C file built on libuv and picohttpparser, embedding Python, with one process, one thread and one event loop. Over the last few days it received its biggest batch of changes in a long time: two releases, 0.7 on 9 October and 0.8 on 10 October 2026.

This post summarises what changed, why, and what you have to check if you run an application on top of it.

Cloning FreeBSD Jails with ZFS: Fast Copies, Hidden Dependencies

Sat, 10 Oct 2026 22:18:00 +0100

In my previous post I built a minimal thick jail from pkgbase packages and ended with a baseline ZFS snapshot. That snapshot is more than a safety net: it is a template. With a single command you can stamp out as many jails as you need, each one ready in a second and using almost no extra disk space.

But clones come with a property that surprises people: a ZFS clone is not a plain copy. It stays linked to the snapshot it came from, and that link decides what you can and cannot destroy later. In this post I clone one jail into four, list the few things that must be changed in each copy, explain how upgrades behave, and show three ways to deal with the dependency between a clone and its origin.

FreeBSD Thick Jails the pkgbase Way: A Minimal, Working Setup

Sat, 10 Oct 2026 21:19:00 +0100

For years, building a FreeBSD jail meant downloading base.txz, extracting it by hand, and later juggling freebsd-update(8) to keep it patched. With FreeBSD 15, the base system is also available as regular packages, a method known as pkgbase, and jails are where it shines: you install exactly the pieces you need, update them with the same tool you use for everything else, and keep the whole thing on its own ZFS dataset that can be snapshotted, rolled back and cloned in seconds.

In this post I build a minimal but functional thick jail (a full, self-contained copy of the userland) from scratch, from dataset creation to a running system with SSH. I also share the one mistake that cost me an afternoon, a userland newer than the host kernel that made the jail hang on shutdown, along with the commands to avoid or fix it. Everything here comes from a real FreeBSD 15.1 setup. Adapt the pool, dataset and network names to yours.