“Now he’s completely lost it” is probably what a regular reader might think. After all, I use plain text (Markdown) as the “single source of truth” in my document workflow, and now I want proper charts for visualization. Not ASCII bars. Actual pie charts. The kind managers and decision-makers expect. That sounds like a fundamental contradiction. I would argue it is not. In …Read more

Over the weekend, I published a sample repository on Codeberg. It proposes treating ISMS documentation like code. The concrete example is an ISO 27001 risk assessment for organizational assets. The focus is less on the document itself and more on the underlying concept. Everything is written in a universal, text-only format that will still be editable in any editor 50 years from now: Markdown. …Read more

How many admins does it take to roll out 150 client PCs in one morning? The honest answer for most mid-sized companies: too many. If people are walking from machine to machine with USB sticks, the approach is fundamentally wrong and inefficient. What is missing are clear concepts, monitoring, automation, and scalability. In that order. Without automation, scaling turns into exploding personnel …Read more

The BSI report for 2025 (as of October 2025) is out. There is not much fundamentally new. Here the key points, with some context: The threat level remains high and stable. Misconfiguration of systems and software jumped from 28% in the previous period to 44%. Web-facing attack surfaces are in a “concerning state”. The scope includes all reachable IPs under .de domains. EDR and similar …Read more

“Ship fast, fail fast”, sometimes shortened to “fail cheap”, is a common mantra in agile environments. It addresses real problems with rigid processes, hierarchies, and tech stacks. For years, the industry has promised higher speed through agile methods. That sounds good. Still, when people ask if I work in an agile way, I avoid a straight answer. People confuse speed with …Read more

As a follow-up to my blog “What Really Measures IT Success”, today I am writing about a related topic. It deals with the promises made by cloud and service providers and how they entice customers with availability figures beyond 99%. Anexia/Netcup, the infrastructure provider where I operate, among other things, my mail server, VPN gateway, and a few other hosts, states an availability …Read more

For many, AI is the great promise for salvation. More efficiency, more ease, more future. Everyone is talking about it, so it must be true. And so many are jumping on the bandwagon, which, from the external perspective, appears to be a big party.My impression is that the discussion in medium-sized companies tends to focus more on opportunities and less on realities. There is a lack of honest …Read more

More than five years have passed since my last blog series on Gitea. In the meantime, Gitea has gained a more powerful fork in Forgejo, which has long been part of my daily workflow. Having recently shut down my Gitea instance running as a jail on TrueNAS, I will outline how I have adapted a Forgejo instance to my specific needs. A brief note for context: For simplicity I refer only to Forgejo. I …Read more

Crisis meeting with a managing director and his accountant “watchdog”. We are in his meeting room, his territory in a mid-sized company. The situation is tense, facts no longer matter. My counterpart’s decision-making style has long been shaped by a lack of governance. As in a close-quarter firefight, the tone becomes louder, more forceful. Not out of clarity or determination, but …Read more

Some time ago, in my post “From Mistrel to Heretic”, I wrote about my journey to digital independence. I received several questions about my tech stack afterwards. A fair question I’m happy and willing to answer: I rely on free solutions with GNU/Linux Debian as foundation. Stable runs on servers and critical systems, while unstable or “sid” powers my daily drivers. For me, …Read more