Principles
- No trackers, ads, CDNs or third-party fonts: every file loads from this domain only.
- Lightweight: the home page is under 200 KB including fonts — the exact weight of any page is at the bottom, after “Transferred”.
- Content works without JavaScript: scripts add the terminal and effects but never hide the text.
- Works offline: pages you have already opened, terminal included, load without a network — even if the server is down.
- Accessibility: WCAG AA contrast, keyboard navigation, and respect for “reduce motion”.
Security
- A strict Content-Security-Policy: own scripts only, each with a one-time nonce, no inline styles. HSTS with preload, protection against framing. Live audit
- 71 automated security tests: XSS, CSRF, SSRF, Host spoofing, password brute-force, leaking private files. They run automatically on every push to GitHub.
- The site runs in an isolated container without root, on a read-only filesystem; it can only write to its data folder.
- Attacking addresses are blocked automatically, and bot traps show what scanners are looking for. Attack map
- Outages are written up publicly: timeline, cause, fixes. Incidents
- The site is open for testing: rules, safe harbor and thanks to researchers. Vulnerability disclosure
- The site doesn't track visitors: a self-hosted counter with no cookies and no stored IPs. Privacy
For the curious
- Press ~ to open the terminal. It has more commands than help lists.
- Ctrl+K (⌘K on Mac) opens the command palette: jump to any page, project or terminal command.
- In a real terminal:
curl ogurexxx.ru·curl ogurexxx.ru/map - A Gopher mirror — a 1991 protocol older than the web:
curl gopher://ogurexxx.ru/ - Take a look at the browser console and the page source.
Thanks
- Geist and Geist Mono fonts — Vercel, SIL Open Font License.
- Continent outlines on the attack map — Natural Earth, public domain.
- Independent configuration grading — Mozilla Observatory.