Two Ravens and a Skull

The web keeps getting bigger, but most of that growth feels strangely narrow. Another account. Another dashboard. Another place that wants you to feed it before it lets you do anything useful.

I have a soft spot for smaller tools with a clear job. The kind you can explain in one breath. I have been working on three of them lately. Two are welcoming. The third is not.

Together, they make a slightly odd set: a contact form that sends messages to your inbox, a tiny town where people publish by email, and an Nginx trap for crawlers that ignore the rules.

01 / theraven.email #

Sometimes a website only needs a way for somebody to say hello.

theraven.email gives you a contact form and delivers every message to the email address you already use. There is no second inbox to watch and no complicated panel to learn. You sign in with a one-time link, create a form, choose the fields and colors, then share it.

The form can have its own page, sit inside an existing site through a single embed script, or work with plain HTML if you prefer to keep the markup under your control. There is room for attachments, custom CSS, and webhooks when a project needs more than a name, an address, and a message.

The free limits are straightforward: up to 10 forms and 250 messages per month for each account, with a daily cap of 10 messages. That is enough for a personal site, a portfolio, a small business, or one of those side projects that only needs a doorbell.

You can try it at theraven.email or read the embedding guide.

02 / theraven.my #

theraven.my is a town where the houses are personal pages and the editor is your inbox.

There is no sign-up form, password, or content dashboard. To move in, send an email to hello@theraven.email with the house name you want in the subject line. Reply yes to the confirmation message within an hour and the house is yours. The welcome email contains a private posting address.

From there, publishing is just email. The subject becomes the title. The body becomes the post. You can attach up to four images, and the post goes live right away.

The town has a few details I am especially fond of. Readers can send private letters to authors without either side seeing the other person's email address. You can follow a house by email, receive a weekly letter, browse the map, or knock on a random door. Every house has an RSS feed. Every post has a Markdown version. The town, its houses, and its posts also answer to curl.

It feels old-fashioned in the useful sense. Email does the work, the web stays public, and the terminal is treated like a real place to read.

That last part matters: posts are public and discoverable. This is somewhere to put things you want on the open web, not a private notebook. The how it works page explains the posting commands, limits, letters, feeds, and privacy details.

03 / Skull Bomb #

The first two projects open doors. Skull Bomb is for visitors that insist on trying the windows.

It is a small Nginx trap aimed at AI training crawlers and scanners that ignore ordinary boundaries. Crawlers that honor robots.txt stop at the fragment it generates. A scanner hunting for files such as .env, .git, AWS credentials, or wp-config.php receives a convincing decoy instead of a secret.

Anything that follows the hidden bait or enters the disallowed random prefix reaches a little Python package called shopkit. It looks plausible. It has modules for sessions, tokens, payments, billing, queues, webhooks, clients, and carts. It also has tests, and the tests pass.

The functions are wrong.

Fresh sessions count as expired. Known coupon codes remove a discount. A successful API request is retried until it becomes an error. The queue runs backward. A webhook checks the previous request body. None of this is announced inside the maze. A crawler can collect the code, read the tests, and leave with a tidy set of bad lessons.

The setup script writes an Nginx snippet, a robots.txt fragment, and a piece of hidden bait. It draws a new random prefix each time it runs, so the maze can move. The repository includes the script, the decoy, the full maze, and the crawler list:

Browse the Skull Bomb repository

There is also an optional bomb mode. It creates a file of roughly 10 MB on disk that expands to about 10 GB in a client that decompresses it. Nginx only sends that file to clients that announce gzip support, and the script refuses to build it unless the required Nginx module is present.

That mode is deliberately hostile. It can waste bandwidth, memory, and time, and a careless deployment can catch something you did not mean to catch. Use it only on infrastructure you own and understand. The plain maze and decoy are the safer default.

Two doors and a trapdoor #

These projects do not share a business plan or a polished product family. They share a preference for a web made of small pieces that can stand on their own.

theraven.email helps a stranger reach you. theraven.my gives you a place to write back. Skull Bomb waits for the machines that refuse to listen.

That is the whole set: two doors open, one trapdoor.