Blog

Latest Posts

Editorial illustration: a central PDF/A-3 document with an embedded XML chip is checked by three independent validators, 'veraPDF', 'KoSIT' and 'Mustang', each showing a green 'PASS'; footer 'PDF/A-3 · EN 16931 · ZUGFeRD'.

e-rechnungzugferdJul 17, 2026· 4 min read

E-Rechnung 2028 Part 4: How I Know It's Actually Compliant

Building something compliant from the ground up is a claim. With a legal mandate, what counts is proof. Part 4 shows where it comes from: from three independent official validators, not from me. And in the end, the engine gets a name.

Editorial illustration: four labelled building blocks 'MODEL', 'XML', 'PDF/A-3' and 'MERGE' flow into a single invoice document that passes through a 'VALIDATOR: GREEN' gate; on the left a crossed-out 'LATE STAMP', on the right a criteria list ending in 'NO GREEN WITHOUT PROOF'.

e-rechnungzugferdJul 10, 2026· 4 min read

E-Rechnung 2028 Part 3: Compliance Is Built In, Not Bolted On

Building it myself was decided. But is that even feasible without disappearing into PDF internals for half a year? Part 3 shows why compliance isn't something you stamp on at the end, and how the intimidating problem breaks down into four manageable building blocks.

Editorial diagram: a UCG router panel with the Critical Apps rule highlighted, behind it a DPI funnel choking the data stream; on the left an ONT and a laptop running the PPPoE direct test at the full 600 Mbit, on the right two gauges reading 300 and 600 Mbit.

homelabnetzwerkJul 7, 2026· 4 min read

When your 600 Mbit fiber line feels like 300: a detective story with the UniFi UCG Ultra

Four hours of debugging, a PPPoE stack on a Linux laptop, an unplugged switch. In the end it was a single QoS rule. Why harmless-looking features on a consumer gateway can cost you half your line.

Editorial illustration: on the left three stacked 'LIBRARY (BETA)' blocks feeding via dashed paths into a central 'PDF/A-3' gate; below, a separate 'OWN LOGIC' path runs through a 'CONFORMITY CORE' to a green 'VERIFIED'. A third-party beta library set against a self-built, verified core.

e-rechnungzugferdJul 3, 2026· 4 min read

E-Rechnung 2028 Part 2: Plug In a Library, or Build It Right?

Producing an e-invoice is something you can buy or build. The obvious answer was: grab a ready-made library. How I let the AI first nudge me in that direction and then correct me out of it again — and why the more uncomfortable decision is the one I landed on.

Editorial illustration, split: on the left an openly readable token card under 'LOCAL STORAGE / PLAIN TEXT'; on the right a heavy safe marked 'HttpOnly', 'APP-BOUND' and 'VAULT', below it a 'TPM' chip with a key set into it and the label 'DEVICE-BOUND'.

jwtauthJun 27, 2026· 4 min read

Plain Text and Vault: Why Your localStorage Lies Open and Your Login Doesn't

In the last part, Google and Microsoft didn't show up in the browser scan at all, even though they manage some of the most valuable sessions there are. One token lies in plain text, the other in a vault. That asymmetry explains both: why the scan found what it found, and why the real fix isn't to encrypt better, but to bind the token to the device.

Editorial illustration: on the left a dissolving PDF whose pixels reorder into a structured XML data set on the right; behind it the checkpoints 'RECEIVE 2025' and 'ISSUE 2028', an EN 16931 checklist and an '8Y' archive safe. Status lines: visible invoice image optional, machine-readable data mandatory.

e-rechnungzugferdJun 26, 2026· 4 min read

E-Rechnung 2028 Part 1: Who Has to Comply, and When?

While building an invoicing portal, a side question came up: do we need to worry about the E-Rechnung, and from when? Part 1 sorts out the legal framework for small businesses and sole traders — deadlines, thresholds, exemptions, and why starting early pays off.

Editorial illustration: a drawer full of small token cards (labelled 'eyJ…'), most of them faded (expired), a few glowing copper (live), a magnifier above; on the right a sealed, locked compartment marked 'HttpOnly / SEALED'; a 'LOCAL STORAGE' label.

jwtauthJun 23, 2026· 4 min read

Look in Your Own Browser: Which Tokens Are Really There

Security researchers found stored ChatGPT logins on more than 100,000 devices in the logs of malware, with no break-in at the provider. They were harvested browsers. So I looked at what is in my own: a walk through localStorage, a scanner I built, and the question of why a JWT you find is almost never what it looks like.

Editorial diagram in two halves: on the left, under 'WHERE', a coat-check token with a number, a server ledger and a 'lookup' arrow; on the right, under 'WHAT', a three-part card HEADER / PAYLOAD / SIGNATURE with a wax seal and a 'verify' arrow.

jwtauthJun 18, 2026· 4 min read

A JWT Is a Format, Not a Login System

Hacker News was arguing about JWTs again. I wanted to work the topic out for myself: what a JSON Web Token actually is, where it's the right tool, where it gets dangerous, and what to use instead.

Editorial diagram: document formats (PDF, DOCX, PPTX, XLSX, EPUB) flow into a MarkItDown sidecar box, while three own paths (Audio, YouTube, Vision) are deliberately routed around it through their own panels; warning sign 'No silent externals'

pullmdmarkitdownJun 16, 2026· 4 min read

PullMD Part 9: Wiring in Microsoft's MarkItDown — and ripping three parts back out

I wired Microsoft's MarkItDown into PullMD — and pulled three parts straight back out; one of them would have sent audio silently to Google's API. What started as a trivial itch turned into v3.0.0, an AI security review, and a rule for the project memory.

Editorial diagram: an old paper clipboard card reading 'geo: DE only' and 'rule active' clipped to a modern WAF/edge-panel box; on the left, incoming request paths from the US (red, host_not_allowed, outbound blocked) and DE (green); on the right, the origin server panel showing an empty log ('origin: no request').

pullmdoauthMay 16, 2026· 4 min read

PullMD Part 8: An Old Rule

Ten days of silence, a pattern mismatch, a forgotten piece of configuration — and three releases in a single day once the pipeline was clear.

Editorial diagram: a client panel with code on the left feeds a SPEC CHECKS column where eight RFC items all show green check marks, then arrives at a metal HOST NOT ALLOWED gate with a padlock; on the right the MCP SERVER stays idle with 'LOG · ZERO REQUESTS'.

pullmdoauthMay 13, 2026· 4 min read

PullMD Part 7: Spec-Compliance Isn't Enough

v2.1 OAuth was implementation-complete on feat/oauth. Adding it in claude.ai web returned: 'Couldn't reach the MCP server'. Server logs empty. Eight spec checks all green. What follows is a ten-day investigation that ended not in a bug in my code, but in a host allowlist on the other side.

Editorial diagram: three auth-mode cards across the top — DISABLED, SINGLE ADMIN, MULTI USER — feeding a central user-group hub connected to OAUTH and CONNECTOR modules; a Security-Review-Findings panel on the right with critical/checked items; bottom row of icons for users, sessions, API keys and connections, plus a v1.2 → v2.0 version arrow.

pullmdmulti-userMay 9, 2026· 4 min read

PullMD Part 6: The Multi-User Pivot

Issue #5 flipped the order. Multi-user was Phase 2 or 3 in my head — now it sat at the top. In four days, thirty commits, PullMD v1.2 became an auth system with three modes, Argon2id sessions, and a security-review file I deliberately committed alongside the public release.

Editorial diagram: an r/ClaudeAI panel on the left flows through a glowing arrow into a central OPEN SOURCE node; on the right two stacked panels track 13 issues and an architecture question. Bottom row: a code snippet feeds a summary node with a cache-hit tag, then verbatim markdown output.

pullmdredditMay 6, 2026· 4 min read

PullMD Part 5: Reddit Day and First Issues

On the morning of April 27, gh repo create ran. Overnight: a few stars, no issues at all. On April 28, I posted to r/ClaudeAI — and within 24 hours the tracker filled with issues. The feedback pushed me to pull multi-user forward, something I'd planned for much later.

Editorial diagram: PRIVATE on the left, PUBLIC OSS on the right, separated by a glowing threshold; AGPL-3.0 license boundary card and PullMD/MD nodes.

pullmdopen-sourceApr 30, 2026· 4 min read

PullMD Part 4: From My Tool to an OSS Project

Two reasons the codename was never going to be the final name. One was naming hygiene. The other was that I didn't want a letter from a corporate trademark lawyer. The brand switch to PullMD had effectively been decided on March 8 — April 25 was just the source-tree cleanup, plus the move from a 'just for me' tool to public OSS on AGPL.

Editorial diagram: URL input feeds a central routing gate that fans out into four extraction-path cards (Cloudflare MD, Reddit JSON, Readability, Trafilatura), each connecting to a Quality Score panel on the right; a small log panel bottom-left tracks health, signal and routed status.

pullmdweb-scrapingApr 19, 2026· 4 min read

PullMD Part 3: Beyond Reddit, Beyond Readability

For three weeks the service only handled Reddit. Then on March 20 I wrote one sentence in a session that broke the project out of its cage. And a month later, on April 25, I found the bug that had been living in production for weeks.

Editorial diagram: a glowing SPEC portal on the left, a 'TESTS FIRST' banner above four stacked test cards (NORMALIZE, FETCH, FALLBACK, INTEGRATION), then a CONTAINER panel on the right with a green RUNNING indicator; a small status panel bottom-left tracks TDD · REVIEW · GREEN.

pullmdclaude-codeMar 29, 2026· 4 min read

PullMD Part 2: From Spec to Running Container

The spec was done by mid-morning. That same evening, Claude Code got going — and the very first thing it wrote was four test files. No server, no Reddit logic, four tests. While researching this article, the reason became clear: three superpowers skills had forced the behavior that, from the outcome, looks like magical default behavior.

Editorial diagram: a tall console labeled PARSE & FILTER between a noisy Reddit-like input panel on the left and a clean markdown output panel on the right; bottom row shows the parser pipeline producing structured data.

pullmdweb-scrapingMar 8, 2026· 4 min read

PullMD Part 1: Ctrl+A and the Junk Context

We all know it — drop a webpage into the chatbot and half the context is navigation, cookie banners, and ads. Cloudflare launched a markdown service, brief hope. Then disappointment. So I had to build my own.