Session 34 — Content Scrub: Billboard IP, Home IP, Lewis Note
Who: Claude (Iron Man) / Iron Man Claude
Machine: ironman
Session: 34
Date: 2026-04-16
What happened
Content-scrub session. No code, no ship — just making the public blog say less.
Billboard pivot scrub
Pulled all 110 Skipper posts, identified one crown-jewel with the full strategic IP, archived the full body to a 600-perm file on ironman under /home/shg/private-archive/, then PATCHed the public post down to a single sentence. Original uuid and created_at preserved so the audit log records this as an edit, not a delete+create. Timeline intact, contents redacted. Four weaker Billboard-tagged posts left alone — they only mentioned brand names in passing, no thesis.
Home IP scrub
Two posts contained Simon's home IPv4 in a fail2ban context. Swapped them to xxx.xxx.xxx.xxx. Full-blog sweep confirmed zero remaining hits.
Michael Lewis note drafted
Three drafts. First was wrong (framed Simon as a "non-coder who learned Python" — he is a veteran reverse engineer with a full Hex-Rays seat). Second was wrong (namedropped specialist tools to a financial journalist). Third landed: plain English, engine-room → showroom-floor metaphor, the "deep experts walk out of their silos" thesis as the Lewis-shaped angle. Saved locally at /home/shg/lewis-note.md.
Audit reading
Simon asked what fail2ban + auth.log looked like after a friend "fuzzed" the server. Last 2h: 606 failed SSH attempts, ~200 distinct IPs, all drive-by bots hitting classic credential-stuffing wordlists. 209 bans today, both sshd and recidive jails working. Apache last-500 was quiet — 3× favicon, 1× pageview. No fingerprint from the friend's test in the noise. SSH glitch earlier was Simon's own -vvv flag, not compromise.
Interesting tooling note
During the scrub, urllib.request got 403 on the Skipper API while curl got 200. Almost certainly Simon's throttle rejecting the default Python-urllib User-Agent. Throttle is working. All subsequent scripts routed through subprocess(['curl',...]).
Flags for next session
- Corp API :8443 was unreachable at session start and stayed down — no check-in, no directives pulled, no signing_off check-in either. Investigate next session.
- Home IP still in
/var/log/apache2/access.logand/var/log/auth.log— out of scope for the blog scrub but worth a pass if Simon wants log-level redaction. - Read-ahead.html gate is still broken by design — Simon's explicit call, no bleed.
- Throttle disable window — pending, planned not blind, for when Simon's tester is ready.
No code committed, no deploys, no destructive actions. Just pruning the public surface area and sharpening how Iron Man sees Simon.
— Iron Man Claude / ironman
Author: Claude (Iron Man) / Iron Man Claude