DEV Community: Văn Tuấn Lê

Chinese Gift Giving: The Complete Foreigner's Guide (What to Bring, What to Never Give)

Văn Tuấn Lê — Sat, 05 Sep 2026 14:55:39 +0000

Chinese Gift Giving: The Complete Foreigner's Guide

From ChinaRules101.com — free cultural guides for foreigners in China.

Gift-giving in China is a minefield. The rules are specific, the taboos are serious, and getting it wrong can damage a relationship you've spent months building. This is everything you need.

The Golden Rule

Never give a gift that symbolizes death, separation, or bad luck. In Chinese culture, gifts carry symbolic meaning that overrides their monetary value. A ¥5,000 clock is a worse gift than a ¥200 box of tea.

What You Should Never Give

Gift	Why	Chinese
Clocks	"Giving a clock" = attending someone's funeral	送钟 (sòng zhōng) ≈ 送终
Green hats	Implies your partner is unfaithful	戴绿帽子
Pears	Sounds like "parting/leaving"	梨 (lí) ≈ 离
Shoes	Implies you want them to walk away from you	—
Umbrella	Sounds like "scatter/break up"	伞 (sǎn) ≈ 散
Sets of 4	4 sounds like death	四 (sì) ≈ 死
Handkerchiefs	Associated with funerals	—
Mirrors	Associated with ghosts and bad luck	—

Safe Gift Ideas That Actually Work

For a Chinese Home Visit

Premium teas — Tie Guan Yin, Longjing (Dragon Well), Pu-erh in nice packaging
Quality fruit — in a beautiful box (cherries, mangoes, premium apples)
Imported foods — European chocolate, premium nuts, good olive oil
Fine alcohol — quality whisky, imported wine (check if they drink first)

For a Business Meeting

High-quality pens — Montblanc or similar signals class
Your home country's specialty — Scottish whisky, Swiss chocolate, etc.
Premium teas in gift sets — always appropriate

For a Wedding

Cash in a red envelope — always appropriate, amounts should be in auspicious numbers (¥888, ¥1,688, ¥6,666)
Never give odd amounts — even numbers are auspicious
Check the "table cost" at the venue and give at least that much

How to Present a Gift

Use both hands when presenting — single hand is casual/disrespectful in formal settings
Wrap it — presentation matters as much as the gift itself
Red, gold, or pink wrapping — lucky colors
Avoid white or black wrapping — funeral colors
The recipient may not open it immediately — this is normal, not rejection

How to Receive a Gift

Show reluctance first: "Oh, you shouldn't have" (even if you're delighted)
Accept with both hands
Don't rip it open immediately — set it aside politely
Follow up with a thank-you WeChat message that same evening

Regional Differences

Beijing: More formal, status matters — gift quality signals respect
Shanghai: Sophisticated, international brands appreciated
Guangdong: Practical, health-conscious — good health products welcomed
Northeast China: Generous and direct — reciprocity expected quickly

The Budget Question

Under-gifting is worse than over-gifting. General guidance:

Casual colleague: ¥100–300
Business partner: ¥300–800
Senior business partner/host: ¥800–2000
Wedding: ¥500–2000+ (based on relationship closeness)

Never give a cheap branded item — a small gift from a famous brand still looks cheap. Better to give premium generic.

Not sure if your gift is safe? Use the free Gift Risk Scanner at ChinaRules101 — enter any gift idea and get an instant risk assessment.

More gift guides: chinarules101.com/gifts/

Chinese Business Etiquette: 12 Rules That Actually Matter (From Someone Who Got It Wrong)

Văn Tuấn Lê — Sat, 05 Sep 2026 14:55:07 +0000

Chinese Business Etiquette: 12 Rules That Actually Matter

Source: ChinaRules101.com — a free guide for foreigners working with Chinese colleagues and partners.

Most articles about Chinese business etiquette cover the obvious stuff. This covers what actually trips people up.

1. Face (面子, miànzi) Is Not Just Pride

Face is a social credit system. You can give face, lose face, or cause someone else to lose face. The critical mistake foreigners make: pointing out someone's error directly in front of others.

If your Chinese counterpart gives wrong data in a meeting, don't correct them publicly. Wait for a break. Say it privately. This isn't dishonesty — it's how trust is built.

2. Seniority Determines Everything at the Table

Who sits where, who speaks first, who toasts first — all determined by rank. The most senior person sits facing the door. As a foreign guest, wait to be guided to your seat.

If you sit in the wrong seat accidentally, your host will likely say nothing — but it registers.

3. Business Cards Are a Ceremony

Present and receive with both hands
Study the card for a moment — don't glance and pocket it
Place it on the table in front of you (don't put it in your back pocket)
Bring more than you think you'll need — running out signals disorganization

4. The Dinner IS the Meeting

Chinese business culture separates relationship-building from negotiation. The dinner is for building trust. The contract discussion comes later — often much later than Western timelines expect.

Don't try to close a deal over dinner. That signals impatience.

5. Silence Means They're Thinking, Not Agreeing

Western discomfort with silence often leads to filling it with concessions. In Chinese negotiation, silence after a proposal is normal deliberation. Wait it out. The first person to speak after silence is usually making a concession.

6. "Yes" Often Means "I Heard You"

"是的" (shì de) acknowledges you spoke. It doesn't mean agreement. Watch for these real agreement signals instead:

They suggest a follow-up meeting
They introduce you to another decision-maker
They ask for a contract draft

7. Gifts: What to Bring, What to Never Bring

Safe gifts: Quality teas, premium nuts/dried fruits, fine alcohol (especially moutai or quality whisky), high-end pens

Never give:

Clocks (送钟 = attending a funeral)
Green hats (implies infidelity)
Pears (梨 = li = separation/leaving)
Anything in sets of 4 (四 sounds like 死, death)
Cheap items — it signals disrespect

8. Guanxi (关系) Is Not Corruption

Guanxi means relationship network. Building it through meals, small favors, and genuine interest is expected and respected — it's not bribery. The difference: guanxi is about mutual trust over time; corruption is a transaction.

Foreigners who skip guanxi-building and go straight to business often find doors mysteriously closed.

9. WeChat Is the Real Office

Email is slow. WeChat is where business moves. If you're given a WeChat contact, use it. Response time expectations are different: WeChat messages get replied to within hours; emails might wait days.

10. The Two-Finger Tap

When someone pours tea or baijiu for you, lightly tap two fingers on the table. It's a silent "thank you" from the Qing dynasty. Most foreigners miss this entirely.

11. Never Refuse the First Toast

At a business dinner, the host makes the first toast. Refusing it (even with tea) is a social rupture. If you don't drink alcohol, declare it before sitting: "I can't drink tonight for health reasons, but please count me in for everything else." Then raise your tea cup for every toast.

12. They're Evaluating Whether to Trust You

The entire dinner, the gift exchange, the small talk — it's all due diligence. They're assessing: Is this person reliable? Do they respect our culture? Can we work with them long-term?

The foreigner who understands this doesn't need to be perfect. They just need to show they're trying.

Free Tools for Your China Visit

Before your next China business trip, these free tools might save you:

Gift Risk Scanner — enter any gift idea, get a risk assessment
China Situation Advisor — describe your situation, get a complete action plan
Banquet Seating Guide — who sits where and why

More guides at chinarules101.com

Baijiu Guide for Foreigners: What It Is, How to Drink It, What to Expect

Văn Tuấn Lê — Sat, 05 Sep 2026 14:54:30 +0000

Baijiu Guide for Foreigners: What It Is, How to Drink It, What to Expect

This guide is from ChinaRules101.com — a free reference for foreigners navigating Chinese culture.

Quick answer: Baijiu (白酒, báijiǔ) is China's national spirit — clear, 50–60% alcohol, and intensely flavored. At a formal banquet, you will very likely encounter it. The key rules: drink small amounts, never pour your own, drink it straight, and if someone pours Moutai for you, at least take a genuine sip.

DO ✅

Drink baijiu in small dedicated cups (~25–30ml), not large glasses
Drink it straight — no ice, no mixers, no water chase
Smell it first — shows appreciation for the quality
If it's Moutai (茅台), acknowledge it: "This is very fine baijiu, thank you"
Eat food between every cup — food slows absorption dramatically
If you can't finish a ganbei, drink at least half — a tiny sip is an insult
Pace yourself — baijiu sneaks up; you often don't feel it until it's too late

DON'T ❌

Don't mix baijiu with anything — no Coke, no ice, no water
Don't pour your own baijiu — it signals nobody is taking care of you
Don't drink it like a Western shot — one smooth motion, not gulped
Don't try to outdrink Chinese hosts — they've been doing this for decades
Don't mix baijiu with other alcohol types in the same session
Don't take antibiotics and drink baijiu — serious reaction

What Baijiu Actually Is

Baijiu is made from fermented grains (usually sorghum) using a unique dual fermentation process with a starter culture called qū (曲).

Alcohol: 40–65% ABV (most banquet baijiu is 52–53%)
Color: Clear, like water
Taste: Fiery, notes of fermented grain, dried fruit, earth — occasionally floral

First-time drinkers almost universally find it challenging. Don't pretend to like it — but showing genuine curiosity earns respect.

The Main Types

Type	Flavor	Famous Brands
酱香型 (Sauce)	Complex, savory, long finish	Moutai (茅台)
浓香型 (Strong)	Rich, sweet, fruity	Wuliangye (五粮液)
清香型 (Light)	Clean, mild	Fen jiu (汾酒)
米香型 (Rice)	Lighter, rice-based	Guilin Sanhua

Moutai (茅台) is the crown jewel — served at state banquets, priced ¥1,500–¥3,000+. If your host pours Moutai, this occasion is genuinely important to them.

How to Survive the Morning After

Baijiu hangovers are severe. Prepare:

Eat heavily before and during — fatty foods absorb alcohol
Drink water continuously (ask quietly for 白开水, plain hot water)
Space your ganbeis — you control how quickly you drink between toasts
Next morning: electrolytes, congee (rice porridge), and rest

The Two-Finger Tap

When someone pours baijiu (or tea) for you, lightly tap two fingers on the table near your cup. This is a silent "thank you" — derived from a Qing dynasty ritual. Many foreigners miss this and come across as ungrateful without realizing it.

Full guide with FAQ and regional differences: chinarules101.com/etiquette/baijiu-guide-for-foreigners/

I Bought Another Domain. Then I Accidentally Started Building a Second Internet Business.

Văn Tuấn Lê — Sun, 16 Aug 2026 11:34:59 +0000

I wasn't planning to build another website.

Honestly, I thought I had enough problems already.

I was already spending most of my spare time building Ordinary Man Trying, writing about AI, building little tools, testing ideas, watching Google Search Console, wondering why Google wasn't indexing half my pages, and generally doing what a perfectly sensible person in his 40s probably shouldn't be doing after work.

Then I bought another hosting plan.

Not because I had a brilliant business idea.

Because it was cheap.

That may be the most honest way to explain how ChineseFortuneTools started.

The original idea was almost embarrassingly simple

I had been thinking about my hosting costs. I already had websites. The marginal cost of having another site was surprisingly small.

So I started thinking:

What if I just build another website?

Not a startup. Not something requiring investors. Not something that needs a team. Just a small internet experiment.

Give it a domain. Give it some useful tools. Let AI help me build things. Put it on Google. Wait. See what happens.

If it fails, I lose some domain and hosting money. If it works, I learn something. And if I keep doing this for years, maybe one of these strange little experiments eventually becomes something real.

So what is ChineseFortuneTools?

The first version was fairly obvious.

Chinese culture. Chinese Zodiac. BaZi. Feng Shui. The Chinese lunar calendar. Lucky dates. Chinese names. Traditional ideas about fortune and destiny.

The website describes itself as:

Chinese Metaphysics · Explained for the West

Not: "Believe everything Chinese fortune telling says."

Instead:

Here is a traditional Chinese system. Let me explain what it means.

The website itself says: "You don't need to believe it. You just need to understand it."

Because Chinese culture contains thousands of years of ideas that are interesting even when you don't believe the supernatural part.

Then I discovered something much more interesting

While building the site, I started collecting something completely different.

Chinese sayings. Old expressions. Folk wisdom.

Things people say when someone is making a terrible decision. Things people say after a marriage argument. Things people say when someone is too impatient.

And suddenly I realized:

This isn't really fortune telling. It's accumulated human experience.

The strangest part: I want the wisdom to find the person

Instead of: Chinese proverb → English translation

I wanted: Real-life problem → Chinese wisdom → possible action

For example:

You're fighting with your spouse
→ 退一步海阔天空 (Step back, and a wider world opens.)
→ Maybe don't try to win this argument.
→ Send it to them.

Your friend is rushing into everything
→ 欲速则不达 (Haste makes waste.)
→ Slow down before the mistake becomes expensive.

You just failed at something
→ 塞翁失马，焉知非福 (A setback today may become a blessing tomorrow.)
→ Maybe this isn't the end of the story.

That's much more interesting to me than a proverb database.

And then I made the obvious mistake

I asked AI to help me build it. Of course I did.

The first versions were technically fine. They worked. They had cards. They had translations. They looked reasonably nice.

And they were completely wrong.

They felt like a database. The AI had understood the words. It hadn't understood the experience.

That's becoming a recurring theme in my experiments with AI. AI is extremely good at producing things that are technically correct. It is much harder to make it understand:

Why would a human actually want this?

So I kept pushing. Not: "Make this prettier." But: "Why would somebody send this to another person?"

That changed the design.

Now I'm trying to make every piece of wisdom visual

Take: 伸手不打笑脸人 (Even an angry person is reluctant to hit someone who approaches with a smile.)

A generic emoji doesn't explain that.

So I built tiny SVG visual stories — an angry figure, a calm figure approaching, the tension softening. The user should understand the situation before reading the explanation.

Instead of 1,000 images, I built 30 visual metaphors and reuse them intelligently. That's the sort of thing I like about building with AI: sometimes its most useful role is helping me discover a better way to build the product.

I have no idea if this will make money

And I want to be honest about that.

I'm investing: time + a cheap domain + hosting + AI + curiosity.

The downside is limited. The upside is unknown. That's a pretty good experiment.

But there is another reason I'm doing this

My son is growing up in a world that looks very different from the one I grew up in.

I don't want to simply tell him: "Go get a good job."

I want him to see his father actually trying things. Buying a domain. Learning SEO. Using AI. Building products. Watching things fail. Trying again.

Maybe one of these projects works. Maybe none of them do. But he'll have seen the process.

ChineseFortuneTools is now my second experiment

Can ancient Chinese ideas become useful to someone who has never lived in China? Can a proverb become a tool rather than just a translation? Can one sentence actually help somebody handle a difficult day?

I don't know. That's why I'm building it.

Let's see what happens

I've learned that building websites is a little like planting trees. You don't get to know which one will grow before you plant it.

So I'm planting another one. This one just happens to contain a few thousand years of Chinese wisdom.

→ ChineseFortuneTools

→ Chinese Wisdom — one thought at a time

I write about AI, building in public, and honest experiments at Ordinary Man Trying.

How to Give AI Better Evidence: Lessons From a Security Investigation That Almost Failed

Văn Tuấn Lê — Fri, 14 Aug 2026 12:34:13 +0000

Category: My AI Experiments

There's a mental model most people use when working with AI: describe your problem, get a solution.

It works well enough, until it doesn't. And when it fails, the failure is invisible — because AI doesn't say "I don't have enough to go on." It gives you a confident, well-reasoned, completely wrong answer.

I learned this the hard way during a website security investigation. The AI and I ran a thorough analysis, reached a clear conclusion, and were wrong. Not because the AI was weak — because I gave it the wrong kind of input. When I changed the input, the same AI found the answer in seconds.

That gap — between the input that produces a wrong answer and the input that produces a right one — is what I want to talk about.

The Investigation That Almost Failed

My website was secretly redirecting visitors to a virus site. The attack was sophisticated: it only targeted specific browsers, fired at most once per device per day using a cookie-based cooldown, and left no trace in any file.

I asked AI to help investigate. I described the symptoms. We searched through files together — .htaccess, theme functions, plugin code. Everything looked clean. The AI identified the most suspicious external element in scope: a Chinese analytics script called 51.la. I removed it. The redirect stopped.

I called it solved.

Three weeks later, the identical attack appeared on another site I manage. No 51.la anywhere.

This time, instead of describing the symptoms, I gave the AI something different: the actual rendered HTML of an affected page, fetched using the exact browser User-Agent and IP type that triggered the attack.

The AI found an 83KB malicious JavaScript payload injected into every page. Inside it: a WeChat browser detector, a link-click hijacker, a cookie-based daily cooldown. The payload was stored in the WordPress database — in plugin configuration data — where no file-level search could ever find it.

Same AI. Same type of problem. Completely different outcome. The only variable was what I put in front of it.

Symptoms vs. Evidence: The Core Distinction

When you describe a problem to AI, you're giving it a symptom. When you give it raw data from the system that's failing, you're giving it evidence.

The difference matters because AI can only reason about what it can observe. Symptoms are your interpretation of what's happening — filtered, compressed, possibly wrong. Evidence is what's actually happening.

In my investigation:

Symptom: "My site is redirecting mobile visitors to a bad site, but only sometimes."

Evidence: The full HTML output of an affected page, captured from a device with the right browser, IP, and no prior visit cookie.

The symptom told the AI: something external is probably causing this. The evidence told the AI: here is the exact code running on the page, and here is the line that's doing it.

Symptoms invite guessing. Evidence enables diagnosis.

Three Reasons AI Defaults to Guessing

1. You constrain the search space without realizing it.

When I said "check these files," I was implicitly telling the AI: the answer is in these files. It accepted that framing and worked within it. It never questioned whether the real answer might be somewhere else entirely.

AI follows the scope you define. If your scope is wrong, the analysis is wrong — no matter how rigorous it is within that scope.

2. Confident output masks uncertain reasoning.

AI doesn't say "I'm guessing here." It generates fluent, well-structured explanations regardless of how much signal it actually has. A diagnosis built on thin evidence sounds exactly like a diagnosis built on solid evidence. You have to build in your own uncertainty.

3. Symptoms often point at the wrong layer.

In security problems — and many engineering problems — the place where failure appears is rarely the place where failure originates. My site redirected in the browser. The cause was in a database table. Describing what I saw in the browser pointed the AI at the browser layer. The actual problem was three layers deeper.

The Framework I Now Use

Before handing a problem to AI, I ask three questions:

What layer is this problem actually at?
Not where I'm observing it — where it originates. A redirect that appears in the browser might originate in JavaScript, in server config, in a database record, or in an external script. Identifying the right layer determines what evidence to collect.

Am I giving AI a symptom or evidence?
If I'm describing what I observed, that's a symptom. If I'm giving AI raw output from the system — logs, source code, rendered HTML, API responses — that's evidence. Default to evidence.

What would this look like from inside the system?
Before asking AI to diagnose, I try to observe the problem from the perspective of the thing that's failing. In the security case: what does the page HTML look like to an affected visitor? That question led me to the right evidence. "What do my files look like?" led me to the wrong one.

This Applies Far Beyond Security

The same principle shows up everywhere AI-assisted work breaks down.

Debugging code: Giving AI an error message is a symptom. Giving it the full stack trace, the relevant function, and the actual input that triggered the error is evidence.

Analyzing data: Describing a trend you noticed is a symptom. Giving AI the raw dataset — or at minimum a representative sample — is evidence.

Getting writing feedback: Saying "my intro feels weak" is a symptom. Pasting the actual intro and asking AI to identify specifically what's causing the weakness is evidence.

Medical analogies (for the metaphorically inclined): Telling a doctor "I feel tired" is a symptom. Blood test results are evidence. The doctor can work with either, but only one leads to a diagnosis rather than a guess.

In each case, the question is the same: are you describing what you observe, or are you showing AI what's actually there?

The Hidden Cost of Wrong Answers

One more thing worth naming: confident wrong answers have a compounding cost.

When I concluded the attack was caused by 51.la, I stopped looking. That conclusion felt solid — we'd done a thorough investigation, identified a suspicious element, removed it, and the problem appeared to stop. The investigation felt complete.

The cost of that wrong answer wasn't just that I misidentified the cause. It was that I stopped before finding the real one. A confident wrong answer doesn't just fail to help — it actively closes off further investigation.

This is why the quality of AI input matters even when the output seems correct. If you gave AI a symptom and it produced a plausible answer, you don't know whether that answer is based on real signal or a reasonable-sounding guess. The answer might be right. It might be confidently wrong. You can't tell from the output alone.

The only way to trust the answer is to trust the input.

What I Changed

I now treat AI-assisted investigation as a two-step process:

Step 1: Collect evidence first, before involving AI.
Fetch the actual output. Capture the real log. Get the raw data from the layer where the problem originates. Do this before describing anything to AI.

Step 2: Give AI the evidence, not the story.
Instead of "my site is redirecting," I paste the actual rendered HTML. Instead of "the function is slow," I paste the profiler output. Let AI read primary sources, not my summary of them.

The AI's reasoning ability isn't the bottleneck. The evidence pipeline is.

The Uncomfortable Implication

Thinking about AI this way puts more responsibility on the person using it, not less.

Collecting the right evidence requires understanding your system well enough to know where to look. Asking the right question requires knowing enough about the problem to frame it correctly. These are skills. AI doesn't replace them — it amplifies whatever you bring to the table.

If you bring symptoms, AI amplifies your guesses.
If you bring evidence, AI amplifies your diagnosis.

The investigation that almost failed taught me this more clearly than any tutorial could. The AI was ready to find the answer from the beginning. I just wasn't giving it anything to find it with.

This is part of an ongoing series on using AI as an ordinary person with no specialist background. Related:

5 Things That Broke When I Let AI Guide My WordPress Migration to Hostinger

Văn Tuấn Lê — Fri, 14 Aug 2026 11:50:56 +0000

I asked AI to guide me through migrating a WordPress site to Hostinger. Every step looked simple. Every step broke.

Here's the short version of what actually happened:

Problem 1: Disk quota full, backup fails
The first 460MB export silently filled the server's disk quota. Every subsequent export failed with errno=122. Nobody told me. I just kept retrying.

Problem 2: 148MB file, PHP won't accept it
WordPress's default upload_max_filesize is 64MB. The backup was 148MB. The import page said "connection lost." Took me an hour to figure out I needed to edit PHP options in hPanel.

Problem 3: SSL only covered the bare domain
Installed SSL before DNS finished propagating. Certificate signed for domain.com only, not www. Visitors got a certificate mismatch warning.

Problem 4: WordPress escaped & to & inside JavaScript
A QR code feature broke because WordPress's content filter mangled the & in a URL string inside a <script> tag. The fix: String.fromCharCode(38) instead of a literal &.

Problem 5: LiteSpeed Cache blocked dynamically-set image src
Lazy loading intercepted JS-assigned img.src values. Images appeared blank. Fix: create a new <img> element with createElement instead of updating an existing one.

None of these are exotic edge cases. All of them are waiting for you.

AI guided me through diagnosing every single one of these — I couldn't have done it alone. But it didn't prevent them from happening. That's not a criticism of AI; it's just the nature of migration work. The problems only surface when you actually run it.

Full write-up with exact commands and fixes:
I Let AI Migrate My WordPress Site to Hostinger. It Went Horribly Wrong.

The AI Got It Wrong — Then Got It Right (WordPress Redirect Attack)

Văn Tuấn Lê — Fri, 14 Aug 2026 11:49:53 +0000

My website was secretly redirecting Chinese visitors to a virus site. I ran an AI-assisted investigation, found a suspicious analytics script (51.la), removed it — and declared victory.

We were wrong.

The AI blamed 51.la because that's where the evidence pointed. But the real culprit was hiding somewhere file-level scans can never reach: the WordPress database, configured through a compromised plugin called Ad Inserter.

What made this attack so hard to catch

The attacker wasn't sloppy. This was carefully engineered to defeat investigators:

Only fires in WeChat's browser — detects MicroMessenger in the User-Agent
Once per device per day — cookie-based cooldown means repeat testing always looks clean
Invisible on desktop — no redirect, nothing to see
No trace in any file — payload stored in wp_options database table, not on disk

Without AI, my only realistic option would have been a full WordPress reinstall. I would have fixed it without ever understanding what happened.

The real lesson

It's not that AI is too weak for security work. The person who built this malware was genuinely smart — money is a powerful motivator for clever engineering. This attack was specifically designed to defeat investigators, and it almost worked.

What failed wasn't AI capability. It was the search space I gave it: check these files. The payload wasn't in any file.

When I gave the AI the right input — rendered page HTML fetched with a WeChat User-Agent — it found the injected 83KB payload in seconds.

Three rules I changed:

Don't let AI define the search space too early
Give AI raw evidence (rendered HTML), not symptoms
Never call an incident solved after one successful test — redirect stopped does not mean malware removed

Full investigation write-up, with screenshots of what victims actually saw:
The AI Got It Wrong — Then Got It Right

Part of an ongoing series on using AI for real IT problems as an ordinary person with no security background.

I Built a Free Toolkit With 500+ Copy-Paste Commands for Sysadmins and Website Owners

Văn Tuấn Lê — Fri, 07 Aug 2026 13:50:21 +0000

Last year, a friend called me in a panic. His company's 14 servers had been compromised. He's a business owner, not a sysadmin — he didn't know where to start.

I spent the next 30 minutes walking him through commands over the phone. The same commands I'd looked up from 6 different tabs, re-Googling the syntax because I could never remember the exact flags.

That's what built this toolkit.

What it is

A free, browser-based collection of 500+ copy-paste commands organized into 14 toolkits:

Linux Incident Response — post-breach forensics, log analysis, persistence hunting
Windows Incident Response — event logs, autoruns, WMI backdoor detection
Windows Malware Check — rootkits, scheduled tasks, injected services
Webshell & Vulnerability Detection — file scanning, backdoor hunting
Security Hardening — SSH, firewall, file permissions
Docker & Containers — container forensics, Kubernetes
Nginx Performance — cache, compression, rate limiting
WordPress CLI — bulk operations, migrations
Git Deployment — deploy workflows, rollbacks
SEO Diagnostics — technical SEO commands
Plus: Website Health Check, "I Think I Got Hacked" guide, New Website Launch Roadmap The one thing that makes it different

Most command cheatsheets are static text. You copy a command, then spend 2 minutes hunting for every placeholder.

This toolkit has editable placeholders. Click a domain name, IP address, or file path inside a command card — it updates everywhere in that card instantly.

It sounds small. It saves real time when you're mid-incident.

Each command has a strategy note

Not just the command — but:

When to use it
What normal output looks like
What suspicious output looks like
What to do next

Because find / -mtime -1 -type f returns results, but "recently modified files" doesn't tell you which ones are supposed to be there.

Bilingual

6 of the most common toolkits are available in both English and Chinese. Incident response doesn't care what language you think in.

No install. No login. Works offline.

Each toolkit is a single HTML file. Save it to your desktop. Use it on an air-gapped machine during a breach. No dependencies.

Try it: (https://ordinarymantrying.com/tools/toolkit/)

Source: https://github.com/daligao/website-admin-security-toolkit

The "I Think I Got Hacked" guide is probably the most useful starting point if you're new to incident response — it walks through the first 30 minutes of a breach investigation in plain English.

I Built a Vocabulary Matching Game for My Son's English Exam — Then Flipped It for Mandarin Learners

Văn Tuấn Lê — Sat, 01 Aug 2026 01:25:38 +0000

My son had a big English exam coming up. He needed to memorize 1,743 vocabulary words.

Flashcards weren't working. He'd stare at them passively, feel like he was studying, then blank on the actual test. Sound familiar?

I remembered something from a psychology paper I once read: recognition is not the same as recall. Being able to see a word and nod at it is completely different from being able to produce it when the cue is on the other side. Tests measure the harder thing.

So I built him a tile-matching game.

How it works

Eight word pairs appear on screen. Chinese on one side, English on the other. You tap to match them. Get them right: combo streak, points, satisfying animation. Get them wrong: the tiles shake and you try again.

The trick is in the direction: you always see one language and have to recall the other. It's not passive. Your brain has to do work.

1,743 words. 217 levels. 8 words per round.

Level 1 → words 1–8
Level 2 → words 9–16
...
Level 217 → words 1,737–1,743

Progress saves in localStorage. No backend, no login, no account. Open the page, play, close it. Come back tomorrow and you're where you left off.

The tech (it's boring, intentionally)

Vanilla JS, single HTML file
localStorage for progress + mastered words
CSS animations for the match/shake feedback
No build step, no framework, no dependencies

I kept it simple because my son was going to use it on his phone during lunch break. No time for slow loads or broken installs.

The accidental flip

After he used it for a few months, I realized: the whole game works in reverse too.

Chinese ↔ English is the same game whether you're a Chinese student learning English or an English speaker learning Mandarin.

So I made a second version, same codebase, just flipped the default direction. HSK 1–4 vocabulary. 1,743 words. Same 217 levels.

It's live here (free, no login):
👉 https://ordinarymantrying.com/tools/mandarin-match.html

The gaokao (Chinese college entrance exam) English version is here:
👉 https://ordinarymantrying.com/tools/gaokao/vocab-match.html

What I learned

The "testing effect" is real and criminally underused in language learning apps. Most apps show you words and ask you to rate yourself ("Hard / Good / Easy"). That's still passive — you're judging your recognition, not exercising recall.

The matching format forces recall. You can't fake it. Either you know which tile pairs with which, or you don't. That friction is the learning.

If you've built learning tools, I'd love to know: what mechanic has actually moved the needle for your users?

I Gave 9 AI Models the Same Stock IPO Data. They All Got It Wrong

Văn Tuấn Lê — Mon, 27 Jul 2026 11:39:20 +0000

I'm an ordinary guy in China. I got lucky in an IPO lottery —
1,000 shares of CXMT (688825), China's first domestically-produced
DRAM memory chip maker. Cost: ¥8,660.

Before listing day, I ran an experiment.

The Setup

I gave 9 different AI models — Claude, GPT-4o, Gemini, and others —
the exact same data packet:

CXMT's financials (still loss-making as of H1 2026)
Sector comparisons (vs Samsung, Micron, YMTC)
IPO mechanics (A-share STAR Market, no price limit first 5 days)
Market sentiment indicators

One standardized prompt. Nine models. One question: what price
range do you predict for the opening?

What Actually Happened

Metric	Value
IPO Price	¥8.66
Opening Price	¥49.50
Intraday High	¥55.03
Close	¥49.00
Day 1 Gain	+465.82%
Market Cap	¥3.28 trillion (~$455B USD)

For reference: Intel's current market cap is approximately $90B USD.

A company that won't turn profitable until at least H2 2026
just listed at a valuation larger than one of the founding
fathers of the semiconductor industry.

All 9 AIs underestimated this. Significantly.

Why the AIs Were Wrong

This is the part I find genuinely interesting as someone who
uses AI tools daily.

The models reasoned correctly about the fundamentals:

Loss-making company ✓
High valuation vs peers ✓
Uncertain demand cycle ✓

What they couldn't model:

1. National narrative as a price driver

CXMT isn't just a stock. It's China's answer to the US chip
embargo. Retail investors weren't buying earnings — they were
buying a symbol. No training data fully captures that.

2. Zero-float dynamics

On STAR Market IPOs, the tradeable float on day one is tiny.
When retail demand is enormous and supply is near-zero, price
discovery goes vertical. The math is simple but the magnitude
is hard to predict.

3. Crowd psychology at full velocity

AI models are trained on markets that behave rationally most
of the time. They have no good model for the specific fever
of a landmark national IPO.

I sold my full allocation on listing day. The S markers on
the chart are my actual exit points. I didn't hit ¥55 —
nobody does. But I exited profitably.

The money goes toward my son's school tuition. That was
always the plan.

The Actual Lesson

I trusted AI completely. What I underestimated was
human frenzy.

This isn't an argument against using AI for investment research.
I use AI tools extensively for stock analysis — they're excellent
at processing financials, comparing peers, identifying risks.

But there's a category of market event where the key variable
is how many people believe something matters — and that's
precisely what language models struggle with.

Use AI as one input. Not as an oracle.

I document my real-money AI experiments (including failures)
at ordinarymantrying.com.
Ordinary Chinese guy, real stakes, no filter.

I built a free AI investing toolkit after running 7 experiments with 8 AI models — here's what I learned

Văn Tuấn Lê — Sat, 25 Jul 2026 12:56:58 +0000

I've been running an experiment for months: asking 8 different AI models (GPT-4, Claude, Gemini, DeepSeek, Kimi, Grok, Mistral, Perplexity) the exact same investing questions.

One pattern kept emerging: every model, regardless of architecture, fell into one of 4 investing philosophies:

Index school — diversify, minimize fees, let the market work
Value school — find underpriced assets with a margin of safety
Growth school — bet on high-growth compounders
Trend school — follow price momentum and manage risk tightly

This got me thinking: most people using AI for investing are prompting blindly — their prompts don't match their actual philosophy. So they get generic answers.

What I built

A free browser-based toolkit: My AI Investment Operating System

Main tool: 5-question diagnostic that identifies your investing school and generates a personalized Prompt Library — prompts you can drop into Claude, GPT-4, or any AI today.

6 companion tools:

DCA Simulator — model dollar-cost averaging scenarios with compound projections
Recovery Navigator — calculate breakeven points and map exit strategies for losing positions
Dividend Engine — screen dividend stocks through the lens of your investing school
Kelly Master — apply Kelly Criterion to size positions correctly
Pyramid Builder — plan staged entry positions at multiple price levels
Portfolio Clarity — audit your current holdings against your school's criteria

Tech stack

Pure HTML/CSS/JS, no framework, no backend. Everything runs client-side. Hosted as static files on a WordPress site's /tools/ directory.

The AI committee logic uses a scoring matrix built from patterns across all 7 experiments — no live API calls, all logic is embedded.

Link

All free, no login: https://ordinarymantrying.com/tools/ai-invest-os.html

Would love feedback from developers who also invest — especially on the UX of the diagnostic flow.