Using the API server proxy to bypass network policies
I’ve been doing some work for an upcoming talk on Kubernetes Multi-tenancy security, and as part of that I was thinking about one of my favourite topics in Kubernetes security, SSRF. As I was doing…
llama.cpp: Metrics and Monitoring with VictoriaMetrics
We have a server where we’re going to run self-hosted LLMs. We spent quite a while choosing what exactly to use for running the models – vLLM, SGLang, or llama.cpp, and eventually settled…
Building the Cockpit — Thursday Chaos to Console-Born
A Thursday where the platform was already noisy before the console existed: vLLM admission failures, indexer livelock, a retired arch-review pipeline, YouTube ingestion, frontmatter corruption, and…
Evaluating GLM 5.3 on Hack The Box Challenges
The GLM 5.3 model was released just last week. The interesting fact is that it’s just a retrained version of GLM 5.2, which doesn’t give you much hope for good results. But Z.ai’s marketing gave us…
On-Call Is Now Theatre
On-call was calibrated to the cost of waking up a human. That cost just went to zero. Self-operating software is coming, and your rotation is the last thing standing in its way.
Debloating Stock Android with Rikka's Shizuku (non-root)
I received a regular android phone recently. It has modern hardware which I would never buy for myself due to it’s incompatible to open bootloader/firmware. The only phone I would like to buy…
Hosting a service with TailScale
Anytime a computer is connected to the internet, there are bad actors trying to find their way into that computer or see what else is exposed. TailScale is a great service that allows users to create…
AWS Backups for Everyone
A few days ago, I was poking around AWS Organizations and came across backup policies. I’ve written plenty of backup plans and schedules over the years, but I didn’t realize I could roll them out…
Kiro IDE + WSL2: Fixing the Agent Shell Execution Layer
A practical guide to fixing Kiro IDE's agent shell execution in WSL2 — adding Linux terminal profiles, shell integration scripts, and steering context for reliable AI agent interactions on Ubuntu…
Remotely unlocking electric scooters
How subdomain recon, WordPress user enumeration, and a brute force led to admin access and remotely unlocking scooters.
How to setup your own IPFS private network
# Introduction In this blog post, you will learn how to make a private IPFS network that will allow private peers to exchange data between each other. This is in opposition to the default setup in…
Sovereign Cloud Is Not the Same as a Cloud That Answers the Phone: Why We Are Leaving Scaleway
The News That Set This Off In July I read that Airbus is migrating 70 critical applications from AWS to Scaleway as part of a digital sovereignty push. I am an open source and EU-sovereignty…
Quick Tour of Postgres Logical Replication - Misc Tips and Tricks (Part 4)
Part 4 --> This post was written for Blaugust 2026 Some misc tips and tricks, plus some things I found annoying while experimenting with this that didn’t really fit into the previous blog posts.…
Mainframes became personal. So will your data center.
Local models now answer 89% of everyday chat & reasoning queries as well as frontier models, & their efficiency per watt has improved 5.3x in two years.
Recompile ffmpeg with Cuda support on Debian
Whenever I prepare the videos of the German Perl Workshop for release, I dread that my custom build of ffmpeg broke due to a Debian upgrade. Neither does happen often, the German Perl Workshop…
Three LFM2.5-2.6B in parallel on an iGPU
Ollama queued every request in a single slot because lfm2 is blocklisted from parallelism. llama-server fixed it.
Reverse engineering the Specialized TCU
I got my hands on a broken Specialized TCU. The TCU is the controller of a Specialized e-bike, and this one is from a 2020/2021 Levo model. That means the device I looked at does not feature a touch…
Building an (almost) fully self-hosted, sandboxed, agentic software factory
tl;dr: It worked! From one prompt it created a repo, wrote the application and tests, got CI green, provisioned Postgres and deployed the finished app behind HTTPS without another message from me.If…
Automating OPNsense HA updates with Ansible
Intro In my homelab, most of the infrastructure is already redundant enough to tolerate maintenance, but the update process itself was still too manual. Proxmox was the first part I automated in that…
🛤️ When building connected products, two things have to go right
The first is architecture , decided partly up front: network topology, the protocol between processors, how function is partitioned across boards, real-time constraints, the data model, how firmware…
Homelab Architecture - Roadmap
As alluded to, there are some future plans for upgrades in the lab. Orion’s host upgrade The host that Orion is going to run on is eventually going to be upgraded. The plan is to: Clone the…
GTA 6 leak due to failed OPSEC: the Indian developer reused the same password
The GTA leak is due to poor OPSEC on the part of RockStar India.
Cyberia://enemies.are.everywhere
My server survived a brute-force attempt
The unintended consequences of good security
The unintended consequences of good security My bag felt light yesterday morning. I didn’t think much of it until I got to the station and realised why: my laptop was still at home. For a moment, I…
Network Routes on macOS
Today I was troubleshooting a problem where my computer could not talk to a host on my network. It turned out that when the VPN connected, it modified my Mac’s routing table and replaced the…
CA8: Nebraska statute allowing SWs to cross state lines doesn’t violate 4A
Nebraska statute authorizes search warrants to cross state lines, and this does not violate the Fourth Amendment. This was a Snapchat warrant. [The Stored Communications Act, 18 U.S.C. § 2703(a,d),…
It’s 2026. It’s faster to fix CVEs than argue about them
There is a lot of buzz regarding reachability and exploitability. Also, following latest Black Hat, there are ~1000 new CVEs reported against Linux kernel (a lot of them relate to privilege…
The engineer gets its own machine
The architect/engineer split from the last post became an actual CLI, and the engineer role moved off my laptop onto a machine of its own.
The silence that reads as safety
Consider a representative detection team building a rule for suspicious LSASS access. On a modern Windows estate, Sysmon Event ID 10 (or an equivalent EDR process-access event) is the collection…
Hacker Summer Camp and notes from 63 minutes on the "slopalcious" slopdemic
63 minutes with Aaron Mog on Zero Sum, cut down to the salient points and timestamped: the slopdemic, the two axes, why the vulnpocalypse hasn't happened yet, and who is still hiring juniors.
pg_statviz 1.2 released with PostgreSQL 19 support and new features
Extension pg_statviz for time series analysis & visualization of Postgres internal statistics has released version 1.2 with PostgreSQL 19 support, a new blocking locks analysis module, and an…
Rust Supply Chain Attack on arrayref: Significant Overlap with DPRK Campaigns
Analysis of a Rust supply chain attack on the arrayref package with significant ties to North Korean threat actor campaigns.
A Sloppy Interface Is a Security Liability 
In his talk “Why AI Is Breaking Software Security As We Know It” (my notes here), Feross Aboukhadijeh talks about the Axios npm incident and how the maintainer got phished by succumbing to (amongst…
how to install cisco packet tracer on gnu linux debian 13
it has to be debian 13 ! officially it’s for ubuntu! 1. make a account at cisco https://www.netacad.com/ 2. download the deb package from…
Bash Arbitrary Code Execution
Preface Affected platforms The gist of the issue It Is In The Wild Mitigation The Hardest Part Preface Quite some time ago I’ve encountered a curious and (most horrifyingly) widespread…
File recovery from a degraded drive without imaging
Recover files from a failing drive without cloning posted to the docs section.
Turn Your Home into a Fortress
A modular approach
Workaround for Thunderbird LDAP Directory Issue
Update: I did get this working. I had “When lookup up addresses:” under Account Settings –> [account name here] –> Composition & Addressing set to “Use a…
Some Notes on Call Stack Spoofing
The Basics Forgive me if this post sounds too basic or detailed. My tutor job gave me this style. Hopefully it helps beginners. The screenshots are taken from different runs as I didn't have the time…
Why AI Is Breaking Software Security As We Know It
Interesting talk by Feross Aboukhadijeh, CEO of Socket, on where we are with security, open source, and AI. How’s the whole skills.md thing going? English is the malware now Ok, what about MCP?…
General Game Cracking Guide
Cracking (patching) a Steam game comes down to two approaches: use Unsteam when you want online play among patched copies, GBE Fork when single-player or LAN is enough. If the game connects through…
How to Collect Windows Registry Data using Intune
In this guide, I will explain how to collect Windows registry data using Intune across managed Windows devices. Registry inventory is...
Detecting scraper bots through scroll behaviour
Ever since I first read "Burstiness and Memory in Complex Systems" by Kwang-Il Goh, I have been obsessed with the two formulas showcased in the paper. Burstiness (B), and its just-as-important…
OCI Resource Manager Drift Detection: Alerts Without Events
OCI Resource Manager drift detection emits no Events service event, so the obvious alert rule never fires. Build a polling sentinel with OCI Functions.
How Easy Is It to Scan a Contactless Payment and Access Card?
Most of us carry NFC cards every day without even thinking about it. Your office badge. Your apartment key card. Your gym membership card. Your contactless payment card. They’re convenient,…
Sharding pytest by file cut collection time from 3 minutes to 40 seconds
When your pytest CI unit test workflow starts taking longer and longer, you’ll want to speed it up. We don’t like to wait for tests to complete in CI, and while you can run them locally, eventually…
125: A Useful Quirk
I’m trying to finish up the OpenZFS Mastery chapter on disk space use today. Well, my part of it. I’m planning to dump–delegate, delegate–the section on deduplication to…
Snowflake data movement policies: the copy path gets a guardrail
Masking decides what you can see. Data movement policies decide what you can take.
Moving to Euro-Office – Part 1 – Nextcloud AIO
About two years ago, I changed from Collabora Online Office in my Nextcloud setup to OnlyOffice, as the advantages for my use case were overwhelming. It wasn’t an easy decision and I was always…
Making Sense of the ISO 31000 Risk Management Process
ISO 31000 provides one of the most widely recognised frameworks for managing risk. Its risk management process is conceptually sound, deliberately generic and applicable to almost any organisation,…