Skip to main content

Filed under

Security

60 entries

  1. Supply Chain 8 min read

    The Repository Link That Points at Nobody

    About one declared repository link in seven no longer cloned anonymously, and for about a fifth of those the GitHub account it names no longer existed.

  2. DevOps 9 min read

    Plant the Defect, Watch the Gate

    Mutation testing pointed at CI checks instead of code: plant a known defect, require the gate to go red, and put a floor under how much it examined.

  3. Supply Chain 9 min read

    Provenance Attests the Pipeline, Not the Intent

    Three 2026 npm compromises shipped malware with valid provenance. Only one of them is visible in the signed fields, and a fourth shows what provenance does catch.

  4. Linux 10 min read

    The Command Said It Worked

    Five commands this site published reported success while doing nothing. A small container lab reproduces four, and the cheap defense is running each command once where it must fail.

  5. Software Engineering 5 min read

    One ZIP, Two Lists of Files

    A small reproducible ZIP lab shows why indexed and streaming readers can inspect different entries in the same archive.

  6. Virtualization 5 min read

    Two Processes, One Page Cache: Testing Shared State Before Blaming the VM

    A small Linux experiment separates shared file identity from identical bytes, with a failed tmpfs control and a careful look at a July 2026 VM-isolation preprint.

  7. AI 7 min read

    A Correct Answer Doesn’t Mean the Agent’s Memory Is Clean

    A synthetic memory-recovery drill shows why a correct task result and a clean derived state are separate checks.

  8. Research 5 min read

    Your Backup Administrator Should Not Be Able to Delete Yesterday

    Timelock Drive puts retention below a compromised host. An offline model shows why unfreezing a backup must start a countdown, not erase its protection.

  9. Storage 6 min read

    The Database Gets a Vote on Your Read-Only Agent

    A disposable PostgreSQL lab tests what an agent-facing database role can actually do, including the SELECT that writes through a privileged function.

  10. Architecture 3 min read

    The Recovery Button Deserves a Dry Run

    Pilot Execution treats recovery as a state-changing program and previews its cross-component effects before committing the action.

  11. Compliance 8 min read

    The Policy Is the Part That Moves

    A proved gate is only as good as the policy it enforces, and the policy is the part that changes while the agent is running. What OSCAL and the agent-authorization drafts both assume, and what breaks.

  12. Storage 4 min read

    The Filesystem Should Start as a Specification

    SYSSPEC treats a filesystem specification as the thing an agent edits, then asks generated code to live up to the contract.

  13. AI Agents 7 min read

    You Can’t Prove the Agent. Prove the Gate.

    Formal verification for AI-agent security. You can’t prove a probabilistic model does the right thing — but the deterministic gate in front of it is small enough to prove outright. Dafny proofs, a Rego twin, and differential testing, following the method AWS used for Cedar.

  14. Compliance 7 min read

    The Firewall Stays Put. The Agent Improvises.

    Rewriting security controls for probabilistic agents. Static control catalogs assume systems that do what they’re told; AI agents don’t — so here’s how to express agent guardrails (tool allowlists, secret-egress denial, audit) as machine-checkable OSCAL component definitions.

  15. DevOps 13 min read

    The Sandbox Isolates the Agent. It Doesn’t Isolate the Secret.

    MicroVMs and namespace sandboxes give AI coding agents mature filesystem and process isolation. Most open-source ones still hand credentials to the agent directly. Here’s the proxy-injection pattern that fixes that, and what it doesn’t fix.

  16. Web Development 6 min read

    No GIFs, No Script Tags: How Far a Single SVG File Can Go

    svg-terminal is an experiment in how much you can make one self-contained SVG do: type, blink, phone an API for live stats, and survive a renderer that assumes every SVG is hostile. 48 blocks, zero JavaScript, one wry aside about trusting my own config file.

  17. Supply Chain 12 min read

    Patch Fast, Pull Slow: Defending in the Year of Copy Fail

    AI is finding bugs faster, researchers pile on the moment one drops, and registries ship malware by the hundred-thousand. Defenders are caught between two contradictory imperatives. The fix is architectural, not temporal.

  18. TypeScript 7 min read

    Grading GitHub Repos: Six-Dimension Hygiene Scores from repo-health-report

    A static-analysis tool that grades any GitHub repo across security, testing, docs, architecture, devops, and maintenance. The methodology is still WIP, but the findings are consistent: most repos are skipping the basics.

  19. Hardware 10 min read

    Signed USB Rescue Boot: aegis-boot and the QEMU+OVMF Persona Harness

    A UEFI-Secure-Boot-preserving rescue USB for any ISO, and the companion QEMU harness that validates it against 11 hardware personas without physical Frameworks, ThinkPads, or Dells on a lab bench.

  20. Supply Chain 6 min read

    Investigating the Trivy Supply Chain Compromise with AI Agents

    How I used AI-assisted investigation to triage the trivy-action supply chain attack across my homelab repos — and some thoughts on weekend incident response and community notification gaps.

  21. AI Agents 8 min read

    Consensus Voting With AI Models: When Three Opinions Beat One

    How multi-model consensus voting catches blind spots that single models miss. The research behind adversarial roles, Bayesian aggregation, and structured deliberation across Claude, Gemini, and Codex.

  22. Virtualization 15 min read

    Building a Private Cloud in Your Homelab with Proxmox and Security Best Practices

    Learn to build and secure a production-grade private cloud using Proxmox VE. Covers network segmentation, backup strategies, security hardening, and resource management with real homelab implementation lessons.

  23. Container Security 17 min read

    Hardening Docker Containers in Your Homelab: A Defense-in-Depth Approach

    Eight security layers that stopped real attacks in homelab testing: minimal base images, user namespaces, seccomp profiles, network segmentation, and more. Defense-in-depth without Kubernetes overhead.

  24. Monitoring 15 min read

    Building a Homelab Security Dashboard with Grafana and Prometheus

    Real-world guide to monitoring security events in your homelab. Covers Prometheus configuration, Grafana dashboards, and alerting rules for threat detection.

  25. Container Security 11 min read

    NodeShield: Runtime SBOM Enforcement Stops 98% of Supply Chain Attacks

    NodeShield enforces SBOMs at runtime using CBOM policies to prevent supply chain attacks. Homelab Docker deployment guide with attack simulations, 98.3% prevention rate, and <1ms overhead.

  26. Threat Detection 10 min read

    LLM-Powered Security Alert Triage with Local Models

    Automate security alert analysis using local LLMs (Ollama) for privacy-preserving incident response. Reduce alert fatigue with AI-powered triage without cloud dependencies.

  27. Threat Detection 11 min read

    SIEM for Homelab: Wazuh vs Graylog Performance Comparison

    Deploy and benchmark Wazuh and Graylog SIEM solutions in your homelab. Performance analysis, resource usage, and integration patterns for security monitoring.

  28. Computational Science 34 min read

    Preparing Your Homelab for the Quantum Future: Post-Quantum Cryptography Migration

    Implement post-quantum cryptography with CRYSTALS-Kyber and Dilithium—prepare homelab for quantum threats using NIST-approved algorithms.

  29. Ethics 20 min read

    Building a Privacy-First AI Lab: Deploying Local LLMs Without Sacrificing Ethics

    Build privacy-first AI lab with local LLMs—run models up to 34B on RTX 3090 (24GB VRAM) with network isolation, traffic monitoring, and real privacy controls.

  30. Supply Chain 15 min read

    Automated Security Scanning Pipeline with Grype and OSV

    Build automated security scanning pipelines with Grype, OSV, and Trivy—integrate vulnerability detection into CI/CD workflows with actionable reporting.

  31. Hardware 8 min read

    IoT Security in Your Home Lab: Lessons from OWASP IoTGoat

    Test IoT security with OWASP IoTGoat—practice firmware extraction, API exploitation, and hardware hacking in secure lab environments.

  32. Vulnerability Management 19 min read

    Building a Smart Vulnerability Prioritization System with EPSS and CISA KEV

    Prioritize vulnerabilities with EPSS and CISA KEV catalog—move beyond CVSS scores to risk-based patch management using exploitation probability metrics.

  33. Monitoring 4 min read

    Building Your Own MITRE ATT&CK Threat Intelligence Dashboard

    Build MITRE ATT&CK threat intelligence dashboard with Python—track adversary tactics and techniques using open-source threat feeds.

  34. Zero Trust 16 min read

    Implementing Zero Trust Microsegmentation with VLANs

    Implement zero trust with VLAN segmentation—secure homelab networks using micro-segmentation and layer 3 firewalls for defense in depth.

  35. Privacy 14 min read

    Self-Hosted Password Manager Migration: Bitwarden Deep Dive

    Migrate to self-hosted Bitwarden—deploy secure vault with backup strategies, SSL certificates, and database encryption for full control.

  36. Threat Detection 16 min read

    Building a Network Traffic Analysis Lab with Suricata

    Deploy Suricata IDS/IPS for real-time network threat detection—configure rule management, performance tuning, and SIEM integration for homelab monitoring.

  37. Container Security 12 min read

    Docker Runtime Security Hardening with Linux Security Modules

    Harden Docker containers using AppArmor and SELinux for isolation without orchestration overhead. LSM profiles, seccomp filters, and capability dropping at homelab scale.

  38. Compliance 10 min read

    Vulnerability Management at Scale with Open Source Tools

    Build enterprise vulnerability management with open source: scanning, remediation tracking, and compliance using OpenVAS, Trivy, and Airflow.

  39. Networking 5 min read

    Implementing DNS-over-HTTPS (DoH) for Home Networks

    Choose where DNS-over-HTTPS belongs in a home network, distinguish browser and Pi-hole upstream encryption, and check fallback behavior.

  40. Linux 17 min read

    eBPF for Security Monitoring: A Practical Guide

    Implement eBPF security monitoring for real-time kernel visibility—track syscalls and network activity with production-ready patterns for threat detection.

  41. Privacy 8 min read

    Local LLM Deployment: Privacy-First Approach

    Deploy local LLMs for privacy-first AI—run language models on homelab hardware with model selection, optimization, and deployment strategies.

  42. Professional Development 5 min read

    Building a Security-Focused Homelab: My Journey

    Build security-focused homelab with Proxmox, VLANs, and IDS/IPS—create testing environment for cybersecurity and family data protection.

  43. Privacy 6 min read

    Securing Your Personal AI/ML Experiments: A Practical Guide

    Secure personal AI experiments with model isolation and network segmentation—protect LLM deployments using privacy controls and threat modeling.

  44. Professional Development 7 min read

    From IT Support to Senior InfoSec Engineer: My 15+ Year Journey

    Navigate IT support to senior InfoSec engineer path—learn from 15+ years securing federal systems with practical career transition advice.

  45. Raspberry Pi 6 min read

    Raspberry Pi Security Projects That Actually Solve Problems

    Build Raspberry Pi security projects with Pi-hole, VPN gateway, and honeypots—deploy practical network monitoring and threat detection on budget hardware.

  46. Professional Development 9 min read

    Continuous Learning in Cybersecurity: Strategies That Work

    Master continuous cybersecurity learning with lab exercises, research tracking, and community engagement—stay current without burnout.

  47. Python 6 min read

    Automating Home Network Security with Python and Open Source Tools

    A homelab security automation design, with archived Python fragments and a corrected account of their dependencies and limitations.

  48. Ethics 21 min read

    AI: The New Frontier in Cybersecurity – Opportunities and Ethical Dilemmas

    Deploy AI-powered cybersecurity with automated threat detection—reaching 73% precision on anomaly detection catching attacks my signature-based IDS missed.

  49. Cryptography 14 min read

    Large Language Models for Smart Contract Security: Promise and Limitations

    Testing GPT-4, Claude and Llama 3 against 47 smart contracts—80% reentrancy detection, but 60% of everything they flagged was wrong, which is substantially noisier than the static analyzer they were supposed to replace.

  50. Zero Trust 25 min read

    Zero Trust Architecture: A Practical Implementation Guide

    Implement zero trust with identity verification and micro-segmentation—secure networks using never-trust-always-verify principles.

  51. Architecture 13 min read

    Blockchain Beyond Cryptocurrency: Building the Trust Layer of the Internet

    Deploy blockchain beyond cryptocurrency with Ethereum and smart contracts—build decentralized trust for supply chain and identity verification.

  52. Computational Science 9 min read

    Quantum Computing and Defense: The Double-Edged Sword of Tomorrow’s Technology

    Prepare for quantum computing threats with post-quantum cryptography—protect RSA and ECC encryption from quantum attacks using NIST-approved algorithms.

  53. Container Security 12 min read

    Sandboxing Untrusted Containers with gVisor: Lessons from G-Fuzz Vulnerability Research

    Secure containers with gVisor sandboxing—prevent kernel exploits in Kubernetes clusters while managing 59% startup overhead for untrusted workloads.

  54. Zero Trust 12 min read

    Implementing Zero Trust Security: Never Trust, Always Verify

    Deploy zero trust security with continuous verification and identity-centric controls—implement never-trust-always-verify for Federal EO 14028 compliance.

  55. Privacy 9 min read

    Zero-Knowledge Proof Authentication for Homelab Services

    Implement privacy-preserving authentication using ZK-SNARKs for homelab SSO. No passwords transmitted, cryptographic proof of identity without revealing credentials.

  56. Computational Science 11 min read

    Preparing for the Quantum Leap: A Guide to Quantum-Resistant Cryptography

    Implement quantum-resistant cryptography with NIST post-quantum algorithms. Future-proof encryption against quantum attacks using Kyber and Dilithium.

  57. Ethics 8 min read

    The Deepfake Dilemma: Navigating the Threat of AI-Generated Deception

    Deepfake detection works well on data it has seen and falls apart on data it hasn’t. Why the fix is partly cultural, not just technical.

  58. Vulnerability Management 10 min read

    Building a Python Vulnerability Scanner with NVD API Integration

    Automate vulnerability detection in your homelab using Python and the National Vulnerability Database API. Track CVEs, scan dependencies, and integrate with monitoring systems.

  59. Professional Development 14 min read

    Demystifying Cryptography: A Beginner’s Guide to Encryption, Hashing, and Digital Signatures

    Learn cryptography fundamentals with AES-256, RSA, and SHA-3—implement encryption, hashing, and digital signatures for production security systems.

  60. Vulnerability Management 11 min read

    Writing Secure Code: A Developer’s Guide to Thwarting Security Exploits

    Master secure code development with input validation, parameterized queries, and secrets management—prevent SQL injection and XSS in production systems.