Site update: viotnet.com, my labs on GitHub, and a YouTube channel on the way

A lot changed around this site in the last few weeks, so here is the short version: what I did, what went wrong, and what is coming next.

A new home: viotnet.com

The site started on a free viotnet.pages.dev address. That worked until I shared it on LinkedIn: the post was restricted and the link preview would not load, most likely because shared hosting domains are filtered harder. So the blog now lives on its own domain, viotnet.com, registered through Cloudflare at cost (about $11 a year).

Buying the domain was the easy part. Doing it properly took a few more steps:

• Connected to the existing site as a custom domain, for both viotnet.com and www.viotnet.com, with TLS issued automatically.
• One address, not three. www.viotnet.com and the old viotnet.pages.dev now answer with a permanent (301) redirect to viotnet.com, keeping the path and query string, so every old link still lands on the right page. Every page also declares its canonical URL, so search engines count one site instead of duplicates.
• Email on the domain. papas@viotnet.com is the contact address now. Cloudflare Email Routing forwards it to my inbox, and a catch-all lets me give each service its own address, so if one of them leaks my email I will know which.
• A small lesson about my own CSP. After the move, the email on the contact section turned into "[email protected]". Cloudflare's email obfuscation rewrites addresses and restores them with a script it injects into the page, and this site's Content Security Policy blocks every script. The policy did exactly its job and stopped code I had not written. The fix was to exclude the email links from obfuscation instead of loosening the policy.
• A Greek edition. Every page and post is now also available in Greek; the EN / ΕΛ switch is at the top right.

With the new domain, the LinkedIn preview loads normally.

The GitHub account that disappeared, and came back

In October my GitHub account was suspended without warning, with a generic message about a violation of the terms of service. I never got a specific reason. My best guess is automated abuse detection: my public repositories are security labs that include attack simulations, and I had pushed a lot in a short time while rewriting SecureVault. That is a guess, not something GitHub confirmed.

I filed an appeal, explained who I am and what the repositories are for (security labs for my MSc and my own learning), and after a few weeks the account was restored with everything intact.

Two things I took from it:

• Do not let one platform be your only home. While the account was down, this site kept working, and the projects I was writing about still had a place to live. Owning the domain matters for the same reason.
• Keep local backups of your repositories. I had full git bundles of my projects on my own disk, so even a permanent suspension would not have cost me the work.

My network labs, now on the site

With the account back, I added the labs from my GitHub to the labs section, each linking to its repository:

• Site-to-site IPsec VPN with my own PKI (strongSwan, IKEv2, certificate authentication instead of a pre-shared key). Write-up.
• Enterprise PKI with mutual TLS, and what a man-in-the-middle does on a network without these controls. Write-up.
• Defence in depth: a three-zone network behind a stateful firewall, a web application firewall and an inline IPS.

SecureVault v2 is merged and released

The rewrite of my password manager, described in this post, was waiting on a branch because of the suspension. It is now merged into the main branch through a pull request, with the desktop GUI included, and tagged as releases v2.0.0 and v2.1.0.

The pull request was a good reminder of why CI exists:

• CodeQL found a real weakness. To clear only the password it put on the clipboard, SecureVault kept a fingerprint of that password, and it was a plain SHA-256. Anyone who could capture it could try a wordlist against it offline. It is now PBKDF2 with a random salt for every copy, slow enough to make guessing expensive and still unnoticeable when you copy a password.
• Python 3.10 is gone. The tests failed only on Python 3.10, which reached end of life in October 2026 and no longer gets security fixes. A security tool should not depend on an unsupported runtime, so SecureVault now requires Python 3.12 or newer.
• Everything else passed on Windows, Linux and macOS before the merge.

The code is on GitHub.

Coming next: a YouTube channel for labs

I am starting a YouTube channel where I will build and break labs on video: firewalls, VPNs, IPS rules, forensics, and the tools I write, with the same purple-team approach as this blog. The write-ups will stay here, and the videos will show the parts that are easier to understand when you see them happen.

The last few days were quieter on purpose: I was studying for Fortinet NSE 3 and took a few days off. That is done, so expect a lot more here soon: new labs, new write-ups, and the first videos.

If there is a lab you would like to see, email me at papas@viotnet.com.

Want the configs or code from this lab, or have a question? Email me at papas@viotnet.com

← all posts