Filed under
Security
54 entries
Security·7 min read·
A Correct Answer Doesn't Mean the Agent's Memory Is Clean
A synthetic memory-recovery drill shows why a correct task result and a clean derived state are separate checks.
Security·5 min read·
Your Backup Administrator Should Not Be Able to Delete Yesterday
Timelock Drive puts retention below a compromised host. An offline model shows why unfreezing a backup must start a countdown, not erase its protection.
Security·6 min read·
The Database Gets a Vote on Your Read-Only Agent
A disposable PostgreSQL lab tests what an agent-facing database role can actually do, including the SELECT that writes through a privileged function.
Systems·3 min read·
The Recovery Button Deserves a Dry Run
Pilot Execution treats recovery as a state-changing program and previews its cross-component effects before committing the action.
Security·8 min read·
The Policy Is the Part That Moves
A proved gate is only as good as the policy it enforces, and the policy is the part that changes while the agent is running. What OSCAL and the agent-authorization drafts both assume, and what breaks.
Systems·4 min read·
The Filesystem Should Start as a Specification
SYSSPEC treats a filesystem specification as the thing an agent edits, then asks generated code to live up to the contract.
Security·7 min read·
You Can't Prove the Agent. Prove the Gate.
Formal verification for AI-agent security. You can't prove a probabilistic model does the right thing — but the deterministic gate in front of it is small enough to prove outright. Dafny proofs, a Rego twin, and differential testing, following the method AWS used for Cedar.
Security·7 min read·
The Firewall Stays Put. The Agent Improvises.
Rewriting security controls for probabilistic agents. Static control catalogs assume systems that do what they're told; AI agents don't — so here's how to express agent guardrails (tool allowlists, secret-egress denial, audit) as machine-checkable OSCAL component definitions.
Security·13 min read·
The Sandbox Isolates the Agent. It Doesn't Isolate the Secret.
MicroVMs and namespace sandboxes give AI coding agents mature filesystem and process isolation. Most open-source ones still hand credentials to the agent directly. Here's the proxy-injection pattern that fixes that, and what it doesn't fix.
Svg·6 min read·
No GIFs, No Script Tags: How Far a Single SVG File Can Go
svg-terminal is an experiment in how much you can make one self-contained SVG do: type, blink, phone an API for live stats, and survive a renderer that assumes every SVG is hostile. 48 blocks, zero JavaScript, one wry aside about trusting my own config file.
Security·12 min read·
Patch Fast, Pull Slow: Defending in the Year of Copy Fail
AI is finding bugs faster, researchers pile on the moment one drops, and registries ship malware by the hundred-thousand. Defenders are caught between two contradictory imperatives. The fix is architectural, not temporal.
Open Source·7 min read·
Grading GitHub Repos: Six-Dimension Hygiene Scores from repo-health-report
A static-analysis tool that grades any GitHub repo across security, testing, docs, architecture, devops, and maintenance. The methodology is still WIP, but the findings are consistent: most repos are skipping the basics.
Security·10 min read·
Signed USB Rescue Boot: aegis-boot and the QEMU+OVMF Persona Harness
A UEFI-Secure-Boot-preserving rescue USB for any ISO, and the companion QEMU harness that validates it against 11 hardware personas without physical Frameworks, ThinkPads, or Dells on a lab bench.
Security·6 min read·
Investigating the Trivy Supply Chain Compromise with AI Agents
How I used AI-assisted investigation to triage the trivy-action supply chain attack across my homelab repos — and some thoughts on weekend incident response and community notification gaps.
AI·8 min read·
Consensus Voting With AI Models: When Three Opinions Beat One
How multi-model consensus voting catches blind spots that single models miss. The research behind adversarial roles, Bayesian aggregation, and structured deliberation across Claude, Gemini, and Codex.
Cloud·15 min read·
Building a Private Cloud in Your Homelab with Proxmox and Security Best Practices
Learn to build and secure a production-grade private cloud using Proxmox VE. Covers network segmentation, backup strategies, security hardening, and resource management with real homelab implementation lessons.
Security·13 min read·
Hardening Docker Containers in Your Homelab: A Defense-in-Depth Approach
Eight security layers that stopped real attacks in homelab testing: minimal base images, user namespaces, seccomp profiles, network segmentation, and more. Defense-in-depth without Kubernetes overhead.
Security·15 min read·
Building a Homelab Security Dashboard with Grafana and Prometheus
Real-world guide to monitoring security events in your homelab. Covers Prometheus configuration, Grafana dashboards, and alerting rules for threat detection.
Supply Chain·11 min read·
NodeShield: Runtime SBOM Enforcement Stops 98% of Supply Chain Attacks
NodeShield enforces SBOMs at runtime using CBOM policies to prevent supply chain attacks. Homelab Docker deployment guide with attack simulations, 98.3% prevention rate, and <1ms overhead.
LLM·10 min read·
LLM-Powered Security Alert Triage with Local Models
Automate security alert analysis using local LLMs (Ollama) for privacy-preserving incident response. Reduce alert fatigue with AI-powered triage without cloud dependencies.
SIEM·10 min read·
SIEM for Homelab: Wazuh vs Graylog Performance Comparison
Deploy and benchmark Wazuh and Graylog SIEM solutions in your homelab. Performance analysis, resource usage, and integration patterns for security monitoring.
Computational Science·34 min read·
Preparing Your Homelab for the Quantum Future: Post-Quantum Cryptography Migration
Implement post-quantum cryptography with CRYSTALS-Kyber and Dilithium—prepare homelab for quantum threats using NIST-approved algorithms.
Ethics·19 min read·
Building a Privacy-First AI Lab: Deploying Local LLMs Without Sacrificing Ethics
Build privacy-first AI lab with local LLMs—run models up to 34B on RTX 3090 (24GB VRAM) with network isolation, traffic monitoring, and real privacy controls.
Automation·15 min read·
Automated Security Scanning Pipeline with Grype and OSV
Build automated security scanning pipelines with Grype, OSV, and Trivy—integrate vulnerability detection into CI/CD workflows with actionable reporting.
Homelab·8 min read·
IoT Security in Your Home Lab: Lessons from OWASP IoTGoat
Test IoT security with OWASP IoTGoat—practice firmware extraction, API exploitation, and hardware hacking in secure lab environments.
Automation·19 min read·
Building a Smart Vulnerability Prioritization System with EPSS and CISA KEV
Prioritize vulnerabilities with EPSS and CISA KEV catalog—move beyond CVSS scores to risk-based patch management using exploitation probability metrics.
Automation·4 min read·
Building Your Own MITRE ATT&CK Threat Intelligence Dashboard
Build MITRE ATT&CK threat intelligence dashboard with Python—track adversary tactics and techniques using open-source threat feeds.
Homelab·16 min read·
Implementing Zero Trust Microsegmentation with VLANs
Implement zero trust with VLAN segmentation—secure homelab networks using micro-segmentation and layer 3 firewalls for defense in depth.
Cryptography·13 min read·
Self-Hosted Password Manager Migration: Bitwarden Deep Dive
Migrate to self-hosted Bitwarden—deploy secure vault with backup strategies, SSL certificates, and database encryption for full control.
Homelab·16 min read·
Building a Network Traffic Analysis Lab with Suricata
Deploy Suricata IDS/IPS for real-time network threat detection—configure rule management, performance tuning, and SIEM integration for homelab monitoring.
Docker·13 min read·
Docker Runtime Security Hardening with Linux Security Modules
Harden Docker containers using AppArmor and SELinux for isolation without orchestration overhead. LSM profiles, seccomp filters, and capability dropping at homelab scale.
Automation·10 min read·
Vulnerability Management at Scale with Open Source Tools
Build enterprise vulnerability management with open source: scanning, remediation tracking, and compliance using OpenVAS, Trivy, and Airflow.
Cryptography·5 min read·
Implementing DNS-over-HTTPS (DoH) for Home Networks
Choose where DNS-over-HTTPS belongs in a home network, distinguish browser and Pi-hole upstream encryption, and check fallback behavior.
eBPF·16 min read·
eBPF for Security Monitoring: A Practical Guide
Implement eBPF security monitoring for real-time kernel visibility—track syscalls and network activity with production-ready patterns for threat detection.
AI·8 min read·
Local LLM Deployment: Privacy-First Approach
Deploy local LLMs for privacy-first AI—run language models on homelab hardware with model selection, optimization, and deployment strategies.
Homelab·5 min read·
Building a Security-Focused Homelab: My Journey
Build security-focused homelab with Proxmox, VLANs, and IDS/IPS—create testing environment for cybersecurity and family data protection.
AI·6 min read·
Securing Your Personal AI/ML Experiments: A Practical Guide
Secure personal AI experiments with model isolation and network segmentation—protect LLM deployments using privacy controls and threat modeling.
Learning·7 min read·
From IT Support to Senior InfoSec Engineer: My 15+ Year Journey
Navigate IT support to senior InfoSec engineer path—learn from 15+ years securing federal systems with practical career transition advice.
Homelab·6 min read·
Raspberry Pi Security Projects That Actually Solve Problems
Build Raspberry Pi security projects with Pi-hole, VPN gateway, and honeypots—deploy practical network monitoring and threat detection on budget hardware.
Learning·9 min read·
Continuous Learning in Cybersecurity: Strategies That Work
Master continuous cybersecurity learning with lab exercises, research tracking, and community engagement—stay current without burnout.
Automation·6 min read·
Automating Home Network Security with Python and Open Source Tools
A homelab security automation design, with archived Python fragments and a corrected account of their dependencies and limitations.
AI·21 min read·
AI: The New Frontier in Cybersecurity – Opportunities and Ethical Dilemmas
Deploy AI-powered cybersecurity with automated threat detection—reaching 73% precision on anomaly detection catching attacks my signature-based IDS missed.
AI·14 min read·
Large Language Models for Smart Contract Security: Promise and Limitations
Testing GPT-4, Claude and Llama 3 against 47 smart contracts—80% reentrancy detection, but 60% of everything they flagged was wrong, which is substantially noisier than the static analyzer they were supposed to replace.
Architecture·25 min read·
Zero Trust Architecture: A Practical Implementation Guide
Implement zero trust with identity verification and micro-segmentation—secure networks using never-trust-always-verify principles.
Architecture·13 min read·
Blockchain Beyond Cryptocurrency: Building the Trust Layer of the Internet
Deploy blockchain beyond cryptocurrency with Ethereum and smart contracts—build decentralized trust for supply chain and identity verification.
Computational Science·9 min read·
Quantum Computing and Defense: The Double-Edged Sword of Tomorrow's Technology
Prepare for quantum computing threats with post-quantum cryptography—protect RSA and ECC encryption from quantum attacks using NIST-approved algorithms.
Container Orchestration·12 min read·
Sandboxing Untrusted Containers with gVisor: Lessons from G-Fuzz Vulnerability Research
Secure containers with gVisor sandboxing—prevent kernel exploits in Kubernetes clusters while managing 59% startup overhead for untrusted workloads.
DevOps·12 min read·
Implementing Zero Trust Security: Never Trust, Always Verify
Deploy zero trust security with continuous verification and identity-centric controls—implement never-trust-always-verify for Federal EO 14028 compliance.
Privacy·9 min read·
Zero-Knowledge Proof Authentication for Homelab Services
Implement privacy-preserving authentication using ZK-SNARKs for homelab SSO. No passwords transmitted, cryptographic proof of identity without revealing credentials.
Computational Science·11 min read·
Preparing for the Quantum Leap: A Guide to Quantum-Resistant Cryptography
Implement quantum-resistant cryptography with NIST post-quantum algorithms. Future-proof encryption against quantum attacks using Kyber and Dilithium.
AI·8 min read·
The Deepfake Dilemma: Navigating the Threat of AI-Generated Deception
Deepfake detection works well on data it has seen and falls apart on data it hasn't. Why the fix is partly cultural, not just technical.
Python·10 min read·
Building a Python Vulnerability Scanner with NVD API Integration
Automate vulnerability detection in your homelab using Python and the National Vulnerability Database API. Track CVEs, scan dependencies, and integrate with monitoring systems.
Cryptography·14 min read·
Demystifying Cryptography: A Beginner's Guide to Encryption, Hashing, and Digital Signatures
Learn cryptography fundamentals with AES-256, RSA, and SHA-3—implement encryption, hashing, and digital signatures for production security systems.
Programming·11 min read·
Writing Secure Code: A Developer's Guide to Thwarting Security Exploits
Master secure code development with input validation, parameterized queries, and secrets management—prevent SQL injection and XSS in production systems.