In preparation for my BSides talk, I have cleaned up some of my tools and published them in new places:

https://github.com/TechnologyClassroom/LogReview

https://github.com/TechnologyClassroom/firewallblockgen/

I released them some months ago, but I recently moved them to new repositories. Give them some stars, find bugs, and give them a try if your servers are getting hit and you live on the command line!

The 120B model reaches reasoning performance on par with o4-mini—while running on a single 80 GB GPU. The compact 20B model fits on laptops with ~16 GB RAM. Both support chain-of-thought, tool use, and agentic workflows—fully local and commercially usable. #OpenWeights #LLM #Apache2

OpenAI takes on Meta and DeepS...

Die zwei neue Mixture of Experts-Modelle unter Apache 2.0 Lizenz:
Das 120B-Modell erreicht Reasoning-Performance vergleichbar mit o4-mini – auf einer einzigen 80 GB GPU.
Das kompakte 20B-Modell läuft sogar auf Laptops mit ~16 GB RAM.
Beide unterstützen Chain-of-Thought, Tool-Use (z. B. Websuche, Codeausführung) und agentische Workflows – vollständig lokal einsetzbar und kommerziell nutzbar.
https://www.theguardian.com/technology/2025/aug/05/openai-meta-launching-free-customisable-ai-models
#OpenWeights #LLM #Apache2

I've created a stripped-down template for hgweb so that I can still link to the latest version of files, but not any others

For example: https://dev.ibboard.co.uk/repos/other/Puppet/file/tip/modules/website/files/greatfirewallagainstchina.conf

Posted a Superuser question about the weird behaviour of rewrite maps.

https://superuser.com/questions/1910287/rewritemap-not-working-outside-virtualhost

Okay, this SEEMS to work. The database is just the start addresses for lots of /8, /16, /24 or /32 ranges (depending on the size of the requested block - e.g. a /22 range gets written as the start address for four /24s) taken from https://www.okean.com/antispam/iptables/rc.firewall.china and mapped to "BLOCKED" and then built into a database file with `httxt2dbm`.

```
# Extract IP parts
RewriteCond %{REMOTE_ADDR} ^((([0-9]+)\.[0-9]+)\.[0-9]+)\.[0-9]+$
RewriteRule . - [E=subnet8:%3.0.0.0,E=subnet16:%2.0.0,E=subnet24:%1.0,E=subnet32:%0]

# Tarpit provided by a Mastodon user - https://mastodon.social/@pcarrier/112429748041537087
# We don't have access to mod_cspnonce yet, so fudge a random-ish value
RewriteCond ${greatfirewall:%{ENV:subnet8}} =BANNED [OR]
RewriteCond ${greatfirewall:%{ENV:subnet16}} =BANNED [OR]
RewriteCond ${greatfirewall:%{ENV:subnet24}} =BANNED [OR]
RewriteCond ${greatfirewall:%{ENV:subnet32}} =BANNED
RewriteRule . https://srv.us/tarpit?nonce=%{REMOTE_PORT}%{TIME} [L,E=donotlog:1,R=301]
```

(`donotlog` is used later to avoid logging, because when they hit so hard and so often then I don't need that bloat in my server logs!)
Not yet worked out why it only seemed to work within <VirtualHost> blocks.

Deleted the database and recreated it from scratch (rather than updating it) and "page 599 is on free list with type 13", "PANIC: Invalid argument" and "Error string not specified yet" have all gone away. So apparently they mean "I don't like the existing database but can't handle it cleanly"

Debugging this and… it looks like the problem might be the backref to a previous RewriteCond?

I've got a similar "block these hosts" RewriteMap using `%{REMOTE_ADDR}` as the key and that works. But using `%1` as a key when the previous RewriteCond is "extract a subset of the octets" fails to look up correctly. Which I've confirmed with a noddy "extract from the query string" lookup.

But then again, it's not working with an env var either. I can do a capture with a RewriteCond, set an env var with a RewriteRule, then do a second RewriteRule using the env var and it works. But if I use `${testmap:%{ENV:testvar}}` then it doesn't find anything. Even though I've shown that the env var on its own contains the expected value.

Oh, FFS. Can't get this working. And can't get Apache to give me enough logging to understand why.

I've got a rewrite map in bdb, it contains IP blocks that are banned (generated from a Python script). I've got rewrite conds that match each of four, three, two or one octets and then try to look them up in the map. If there's a match then it gets tar-pitted. But I'm always getting failed lookups.

The annoying bit is that even trace4 isn't telling me what the input to the map lookup is. Only the result of the lookup when it is compared to the "was it blocked" value.

Maybe I need to drop the zero octets rather than filling them in? Hopefully it's not that RewriteCond captures can't be used as a key in the map lookup.

• Light enough to run locally on a single #RTX4090 or #Mac with 32GB #RAM while powerful enough for enterprise use on privacy-sensitive repositories

• Released under #Apache2 license and available free on #HuggingFace, #Ollama, #Kaggle, #Unsloth, and #LMStudio