Resource Catalogue

Use resources for a named outcome, not as another curriculum. The routing table is the cockpit: it answers “I have an hour, where do I start”. The shelf below it is the long tail, and it’s fine for that to be long, because nothing on it asks to be worked through in order.

Every entry says what it’s for. If a link can’t earn a one-line reason, it belongs in the archive instead.

Start here

The shelf

Ways of working

• Shape Up Basecamp’s book on fixed time, variable scope, and appetite instead of estimates. Free to read online.
• Zettelkasten: atomicity One note, one idea, and why that constraint is what makes notes combine later. The theory behind how this repo is meant to work.
• DORA guides The four delivery metrics and what actually moves them, from the research rather than the vibes.
• GitHub branch naming Short conventions post. Useful once, then it’s muscle memory.
• Refactoring Guru Clean, maintainable code patterns, code smells, and refactorings. Use it when a codebase needs a named diagnosis rather than a frontend pattern.

Foundations, Linux and the terminal

• Learn Enough Command Line The gentlest complete start on the shell.
• ranger, explained Walkthrough of the terminal file browser.
• cheat.sh curl cheat.sh/tar and get the answer. No browser needed.
• devhints.io One-page cheatsheets for most things.
• Learn X in Y Minutes A whole language as one annotated file. Best for “what does this syntax mean”.
• TerminalQuest Learning the terminal as a game.
• rainfrog TUI database client.
• awesome-selfhosted The canonical list for anything you’d rather run yourself.
• LinuxServer docker-duckstation Containerised emulator, and a readable example of how LinuxServer images are built.

Languages and frameworks

• Automate the Boring Stuff Free Python book. Aimed at getting something useful done rather than at computer science.
• Haskell: get started Official on-ramp.
• Vue School Vue courses.
• Frontend Masters Deep frontend courses. Paid.
• You Might Not Need jQuery Side-by-side of jQuery against plain DOM. A good argument for knowing the platform.
• NTU programming notes Dense, unfashionable, thorough course notes across C, C++, Java and more.
• Tauri Desktop apps with a web frontend and a Rust core.

Practice and challenges

• Codecrafters catalog Build your own git, Redis, shell, interpreter.
• Codédex Gamified beginner track.
• HackerEarth Codemonk Structured DSA path with problems attached to each topic.
• GeeksforGeeks Enormous reference. Best used as a lookup, not a curriculum.
• GetCracked Interview prep aimed at quant finance: trading, dev and hardware questions.

Maths and DSA

• Khan Academy Fills gaps without judgement, at any level.
• Wolfram Alpha Checks the answer and shows the steps.

Design, game craft and assets

• Refactoring Guru Design patterns and refactorings, illustrated, with code in several languages. The friendliest version of the Gang of Four material.
• SourceMaking The same patterns from a different angle, plus antipatterns.
• Atomic Design Brad Frost’s book, free online. Atoms to organisms as a vocabulary for component systems.
• A Guide to Flexbox The one everybody keeps open.
• easings.net Every easing curve, with the code. Motion stops being guesswork.
• DevAssets Pay-what-you-want game art, free for commercial use.
• awesome-ipsum Placeholder text generators, for when lorem is too boring.
• Phaser code editor Editor for the 2D web game framework.
• Velxio In-browser circuit and microcontroller simulator: Arduino, ESP32, RP2040, no hardware required.

Diagramming

• Excalidraw Hand-drawn feel. Best for thinking out loud.
• tldraw Infinite canvas, cleaner lines.
• draw.io Formal diagrams, exports everywhere.
• ASCIIFlow Diagrams that survive being pasted into a code comment.
• Asciio The same idea as a local Perl app.

Security

Everything here is for owned, isolated, intentionally vulnerable, or explicitly authorised targets. That boundary is the whole point and it isn’t negotiable. The private Security, Home Lab & RE planning epic is not published.

Practice ranges (built to be attacked)

• TryHackMe Guided rooms. The gentlest start.
• Hack The Box Less hand-holding, more realistic.
• VulnHub Downloadable vulnerable VMs to run offline.
• OverTheWire Bandit Where Linux and security meet. Start here.
• PortSwigger Web Security Academy Free, and the best web-vuln material anywhere.
• OffSec OSCP and the surrounding courses.

Reference and disclosure

• CVE, NVD, NIST The authoritative vulnerability and standards records.
• Exploit-DB Archive of public exploits and papers. Reference material, not a launchpad.
• HackerOne, Bugcrowd Where authorisation actually comes from. Read the scope before touching anything.
• Bugcrowd resources Their own material on how to report well.
• AI Village Where AI and security overlap.

Recon and analysis (scope first, always)

• Shodan, Censys Search engines for exposed services. Excellent for auditing your own footprint.
• theHarvester, amass, Sublist3r OSINT and subdomain enumeration.
• weakpass, awesome-wordlists Wordlists, for auditing password policy on systems you own.
• VirusTotal Multi-engine file scanning. Never upload anything sensitive or private.
• Have I Been Pwned Breach exposure check.

Hardware

• RogueMaster firmware, awesome-flipperzero Flipper Zero firmware and the wider list.
• PortaPack H4M, ESP32 Marauder module RF and wireless hardware. Transmit only on bands and power levels you’re licensed for.

Locksport

Locks I own, that aren’t holding anything shut. Same boundary as the rest of this section, in metal. Pick possession is regulated state by state in the US, so check before ordering.

• LockPickingLawyer Short, dry, no padding. The closest the hobby has to a reference for what a lock is actually worth.
• Covert Instruments His store, so the taste in the reviews carries over into what it stocks.
• r/lockpicking The belt ranking system answers “what do I buy next” for about two years.
• Sparrows, SouthOrd, Peterson The other usual suppliers. Judge a beginner set by its tension wrenches, not its pick count.

AI engineering and agents

• Hugging Face Models, datasets, and the libraries around them.
• OpenRouter One API across many model providers.
• Coursera ML specialisation Andrew Ng’s course. Still the standard first pass.
• Agent Skills The open SKILL.md format for extending agents, and its spec.
• skills.sh Directory for finding and installing those skills.
• Context7 Current library docs, fetched for the model instead of recalled by it.
• OpenCode Open-source terminal coding agent.
• Herdr Keeps coding agents running in the background, and herdr-nvim for driving it from the editor.
• claude-code (zackautocracy) Community configuration to read for ideas.
• Fireworks Firepass Inference platform docs.

Git, forges and collaboration

• Forgejo The forge running on Tonbo. The private Git & Collaboration planning epic is not published.
• Gitea What Forgejo forked from. Worth knowing the difference.
• Codeberg Public Forgejo instance, non-profit.
• GitLab For the CI patterns as much as the hosting.

Web publishing and this site

• Quartz What the apothecary is built on.
• Quartz: creating components The page to read before touching the layout.
• Hugo, Astro Starlight The two that lost the comparison. Kept because the reasoning is still worth re-reading.
• PageSpeed Insights Measure before optimising.
• Sentry Error tracking.
• Biome vs Prettier vs ESLint Comparison, for when the toolchain question comes up again.
• Vultr VPS provider, for reference on sizing and pricing.

Small useful things

• RegExr Builds and explains a regex while you type.
• SwissTransfer, Wormhole Large file transfer, end-to-end encrypted.
• sourceb.in Pastebin for code.

On the practice platforms

They belong in Practice: bounded exercises rather than a curriculum. Two things worth repeating here make that distinction useful:

Every seasonal event on that list keeps its archives. Advent of Code has ten years playable at any hour of any month, so “missed December” is not a state that exists. Nothing there can be fallen behind on.

Exercism is the one with human mentorship and no paywall, which makes it the right choice when the goal is writing a language idiomatically rather than getting a puzzle to pass.

What is deliberately not here

Account dashboards, control panels and anything carrying an identifying ID or query string stay out under the privacy rule in this catalogue. A link to an account is an operational asset, not a learning resource, and it belongs in the password manager.

That rule removed: the Claude platform dashboard, the Hover domain control panel, the Vultr console, deSEC domains, a TryHackMe dashboard link, a personal GitHub profile, a Hetzner server-shopping filter, and a Hak5 product link carrying an affiliate ID. The plain sites are listed above where they earn it.