The morning of October 19 didn’t start with coffee – but there was plenty of adrenaline. The first thing I saw when I woke up was Telegram alerts telling me that something had gone wrong with…

So I've posted before how I think ClickHouse is great. Its columnar storage is fast, it has amazing compression. I won't bore you with those details, you can see them all here:…

Hi there!🛡️ Security & PrivacyScott Helme rebuts the “passkeys are a trap” claim: synced passkeys send no attestation, and falling back to TOTP leaves you…

Many users, including some large projects, migrate to nftables by running their existing iptables rules through iptables-translate and leaving it at that. It works, sure, but it only changes the…

SQL Server Performance Office Hours Episode 91 To ask your questions, head over here. Chapters 00:00:00 – Introduction 00:03:00 – Hash Distribution and Memory Grants 00:06:00 –…

Log into a Linux server that’s dual-homed to a pair of data center switches and check its bond. cat /proc/net/bonding/bond0 prints exactly one partner System ID. As far as that server knows,…

The Endpoint Mapper limit that Microsoft’s October 2026 Windows Server updates introduced is described in two Microsoft pages, and neither is the update notes that shipped with it. The October…

Build timeouts, scheduling delays and a reverted cache change led to a measurement system that needed its own debugging.

Control 10 , 100 , 1000 many computers. Or control 2071 computers, like Jussi did on a earlier course. Or handle 7 different operating systems and OS versions with a single master, like Matias. Best…

Last week I was in Brisbane to talk about Amazon's new EventBridge Custom Bus. This post is a recap of my presentation for those who didn't make it to AWS Community Day Australia. Last month AWS…

A session cookie is a bearer token, which is a polite way of saying that whoever holds it is you. Copy the cookie, replay it from another machine, and the server happily serves your account. Nothing…

Learn cyber security. Link birds-eye view to hands-on. Master's level course. Course name and code Cyber Security - ICB705AS3YE -2 (study guide) Timing 2026 period 2 late autumn, w43-w50 ECTS Credits…

The curl project has decided to alter its vulnerability disclosure program procedure and starting October 26 2026, we insist that all vulnerability reports submitted to us that are deemed to be…

When Donnie Savage announced the open beta of OpenEIGRP , I quickly asked him whether it would be possible to get an easy-to-use container with OpenEIGRP integrated with other FRR daemons (and its…

Last week I was evaluating some application performance characteristics with another architect. Our gut feeling told us that the numbers didn't make sense but we couldn't pinpoint why we had this…

Attach Cognito’s inbound federation trigger through Terraform and the AWS CLI while native support is pending. As of October 20, 2026, my provider PR is still open. Later pool updates can…

Setting up and customizing Linux machines has always been a pleasure of mine. For years I ran a few clunky local servers at home and hosted every kind of application on them. Then the cloud came, and…

The alleged discovery of a covert recording device inside OpenAI’s offices raises an important question for corporate Australia: are businesses protecting their confidential conversations as…

Find out why you should deploy on Friday, and the flaws in arguments against it.

Previously I talked about solutions for running virtual machines in a homelab, but aside from Proxmox, all solutions require using cli. While I like using cli, for a quick exploration or scratch…

In 2014, $5 SSD Droplets and high churn were saturating DigitalOcean's image network. How a self-shrinking cache and a replay simulation of production logs got a risky hypervisor change approved.

En 2014, les Droplets SSD à 5 $ et leur fort renouvellement saturaient le réseau d'images de DigitalOcean. Comment un cache autorétrécissant et une simulation qui rejoue les logs de production ont…

t2linux (CC-BY-SA-4.0) It’s nearly impossible to buy reasonably priced compute hardware in the current market. Consumer memory has regressed to 2009 prices and high-end video card compute has…

I'm writing this blog post on the same day as the eMudhra Intermediate CA compromises news was published so the memory of what was required from me and unfortunately volunteer maintainers today is…

Medical information should follow a patient. That does not mean it should be open to every hospital, clinician, or application. Medical records are confidential. A doctor, nurse, pharmacist, and…

I moved, ran Ethernet through the apartment's TV cable, and grew my homelab to four machines. Then one DNS update meant no device in the house could load a website.

Ubuntu's documentation calls ufw the default firewall configuration tool, developed to ease iptables configuration; Jamie Strandboge wrote it in 2008, and its README offers Unbearable Firewall as the…

The constraint on AI infrastructure in 2026 is not compute but memory bandwidth adjacent to the silicon, and the CoWoS packaging required to deliver it. TSMC's advanced packaging capacity is fully…

I've been trying to build a proper homelab for a long, long time. syswraith @syswraith - Raspberry Pi 4B (8GB) - Seagate HDD (1TB)(salvaged from old lappy) - TL-WN 722N (YES, packet injection and…

Part 9 of The Agent Platform Handbook. From Loop to Platform. Previous: The Bill Is Part of the Loop. Next: Evaluation Closes the Loop. Post eight taught the loop to read its own bill. Every response…

MacOS sample adjusts behaviours to adapt to new keychain protections

After Cloudflare acquired the Deno team and announced that Deno Deploy is shutting down in six months (with the Deno runtime itself only guaranteed a year of maintenance), we migrated the backend of…

What a file system does, how it got here, and what it promises when a write returns.

Reading “Network Flow Analysis” by Michael W Lucas. Table of Contents 1. Body 1.1. References 1.2. What is a flow? 1.3. Where to put flow sensors and collectors? 1.4. How to start using it. 1.5. A…

How I built an encrypted offsite backup solution for my Immich photos. Backblaze, Hetzner and Scaleway were in the running to store it, but none won. Read the full post on the blog.

SOC Tier 1 shift start and handover review: practical checklist for open incidents, ticket ownership, priorities, next actions, and escalation.

If television has taught the public anything, it’s that catching a cyberstalker takes about thirty seconds in a dark van with lots of blinking lights and headphones, a hoodie, some scrolling green…

Learn how to secure Open WebUI with HTTPS on Debian using Caddy as a reverse proxy, with automatic TLS certificates or Let's Encrypt certificates.

While at OWASP Global AppSec EU 2026 in Vienna a couple of months ago, I picked up a copy of Izar Tarandach’s and Matthew J. Coles’ book “Threat Modeling: A Practical Guide for…

When two transactions work on the same data at the same time, PostgreSQL has to answer two questions: what is each transaction allowed to see, and what happens when both try to change the same row?…

The Root Key of the DNS rolled to a new key on the 11th October. This key roll is special as it sits at the apex of the DNS hierarchy, and DNSSEC-validating resolvers need to add this key to their…

hostnamectl; # tested on Static hostname: x13 Icon name: computer-laptop Chassis: laptop 💻 Operating System: Debian GNU/Linux 13 (trixie) Kernel: Linux 6.12.111+deb13-amd64 Architecture: x86-64…

Mode 3 from part 2 takes standing decrypt away from the token vault with KMS grants. The grant quota caps the whole system at 50 exchanges a second, and the attacker who actually shows up doesn't…

A study of electronic banking users has found that cybersecurity depends not only on knowledge of digital threats but also on attitudes, memory, and the user’s relationship with technology. Details…

CI stayed green while a film render test failed on the default branch for about six hours — because the mixed browser-and-unit file that held it had sat off the schedule for a long time.

Wake-on-LAN on the RN102 was "a hardware limit". It was one PHY register: the Linux driver turns the wake pin into a link LED. One device-tree line, and the NAS now sleeps for real.

Following Ukrainian drone strikes on Yandex data centres in October 2026, a Cloudflare Radar chart showing a collapse in automated traffic circulated widely as evidence that Russian social-media…

A recent Anthropic blog post contained a short paragraph, not at all the point of the post, which has been buzzing around my brain since I read it: A new level of operational excellence is possible.…

A few months ago, I wrote about getting back into blogging after almost a decade, and casually mentioned that this website is running on my homelab. I also promised to write about how I set it up.…

AWS bulletin 2026-134-AWS says a failed Git clone in the SageMaker Python SDK can write repository credentials to CloudWatch Logs. This note separates what AWS states from what the code shows, and…