When strongSwan met Diffusion Restreinte on Stormshield Sometimes infrastructure problems end with a large architectural change. Sometimes they end with changing one constant from 32 to 16. Let me…

A search builder's read of the re:Invent 2026 catalog: vector search in every AWS database, agent retrieval replacing RAG, which vector databases are on the expo floor, and the sessions worth your…

Welcome to my first little foray into reverse engineering an AES ECB-128 decryption key found within an earlier version (v1.1) of the desired firmware (v2.2) for the W2250A serial-to-wifi device…

A recurring problem in many organisations I've worked in is that a project is set up by a few developers, and from then on they are "the project's devs". Later, one leaves, another goes on holiday…

Redis is an in-memory database. Salvatore Sanfilippo started it in 2009, and it is now one of the most widely deployed pieces of server software. It is often used as a cache in front of a slower…

I have done my fair share of tinkering. Poking around in servers and fixing things; iterating through and trying different settings until it finally worked; not to mention clicking around in various…

Upstream maintenance of Ingress NGINX has ended and AKS security patch support for the application routing add-on with NGINX runs through November 2026. Time to move to Gateway API.

Well, this was an interesting one. A client’s production XigmaNAS VM, running on UFS2 (because it’s a VM, and ZFS is on the host beneath it) needed expansion today. Unfortunately,…

Researchers say that mercenary hackers laced ads with zero-click exploi... Continue reading →

Last Updated on 15th October 2026 by peppe8o tested by peppe8o | Ollama 0.40.4 | RPi 5 B 2GB | Raspberry Pi OS 13 (Trixie) This tutorial will show you how to install Ollama on your…

Epic just announced the upcoming version 2 of their Linux implementation of Easy Anti-Cheat. It’s based on using the Linux eBPF security module to monitor what’s happening, and then a…

If not trap, why trap-shaped?

Building a .dacpac is the easy part. Getting it deployed to Azure SQL from a pipeline - safely, repeatably, without secrets in variables, and in a way that a reviewer can actually understand before…

Álvaro Herrera will be joining us in November to discuss, when our monthly hacking workshop will cover Table repacking, done right . If you're interesting in joining us, please sign up using this…

This blog post is not about passkey attestation. I have no strong opinion on the subject that has inspired a controversy over the past few days. However, the controversy did inspire me to write about…

Create a persistent live USB with DistroClone USB: installation, shared storage, LUKS2 encryption, and BIOS or UEFI boot. L'articolo DistroClone USB persistent live USB sharing and encryption…

Before we start This is lesson zero of a course on building a Linux C2 agent from the operating system up. It is not a manual for my project. I will use my own agent as an example here and there, but…

At Percona Live Europe 2026, Dmitry Lenev and I presented JavaScript in My Database? Over My Dead Query, the story of component_js_lang, the V8-based JavaScript engine for Percona Server for MySQL…

Laying dark fiberStealth Communications CC-BY-SA Wikipedia's Dark Fibre article starts: Dark fibre originally referred to the potential network capacity of telecommunication infrastructure. Because…

Anonymous mobile data in 160+ countries, paid in Monero with no account, no email, no passport — and why roaming agreements quietly route around censorship, even the Great Firewall.

SQL Server Performance Office Hours Episode 90 To ask your questions, head over here. Chapters 00:00:00 – Introduction 00:03:00 – Free Monitoring Tool for Server Baddies 00:06:00 –…

Sync Obsidian notes end-to-end encrypted through your own CouchDB container — CORS that survives updates, phone setup in one sitting, backups that actually restore.

Goal: GrapheneOS-style “duress PIN” for LUKS, even if the adversary can restore disk images. Caveat: The TPM might be compromised. In that case, it should have the same properties as regular LUKS…

CVSS cannot triage 106 Juniper CVEs against your own network. A decision model answers factual questions per CVE; your code owns the patch/don't-patch thresholds.

This is part eight in my series on the internals of storage structures. After covering the standard storage types, on-disk rowstore, columnstore indexes, memory-optimized storage, and…

Some new site updates that I’ve been working on and pulling my hair about. New Hosting Provider I switched my hosting provider from Netlify to Nearly Free Speech. There were a few reasons for…

This is one of the strangest takes on security I’ve seen in a while: passkeys are a trap, do not … Continue reading PASSKEYS ARE NOT A TRAP

Some things take a bit of time. 2 years ago, I started my first experiments to replace my OpenVPN server instances with a dockerized Wireguard sever. It worked, but Ubuntu 22.04 I used at the time…

The DPRK IT worker problem is usually told as an EDR story. By the time the alert fires, you have already lost. Move detection left of the laptop.

Kafka moves the events, but nothing coordinates what happens next. This post shows how Kestra runs on the Kafka cluster you already operate, turns topics into workflow triggers that reach ServiceNow…

ESLint catches code quality issues. Typecheckers ensures variables and functions use the correct data types. Prettier automatically formats code for consistent style. But how can we start…

CVE-2026-110912 is my first published CVE! The fix is merged upstream and the record is live in the database. It lives in a 23-year-old corner of DragonFly BSD. The ARP input path trusts two one-byte…

An interactive map of where fiber-to-the-premises internet is available across the nine Bay Area counties, built from the FCC’s Broadband Data Collection (the data behind the National Broadband…

MCP logs should tell me what failed and enough info to debug it. If it also gives me my access token...

Doctolib ticks the health-data compliance boxes with US clouds and models. For now, its public promises say more than its documents show.

From an exposure score of 9.2 to 1.4: what Ollama’s memory really is, which systemd directives a CUDA service survives, and the one memory limit that did nothing until swap was capped.

Three 2026 npm compromises shipped malware with valid provenance. Only one of them is visible in the signed fields, and a fourth shows what provenance does catch.

The UK pays offshore wind operators around three billion a year to switch their turbines off, while AI companies struggle to find power for the GPUs they have already bought. That gap says a lot…

# Introduction For the last seven months, I spent a good part of my (small amount of) free time rebuilding my self-hosting infrastructure at home. I wanted something secure, fully automated, that…

Why QUIC Is a Transport Layer Protocol (Even Though It Runs on UDP) — On Zero fluff engineering, a beginner-friendly engineering blog with zero fluff.

Syncthing is a continuous file synchronization program. Once installed and configured, it will keep designated directories and their contents synced between multiple devices. I’m currently using…

How I went from CTFs to my first Apple CVE in a few months: what I read, what I built, the tools I use and how I work with agents without becoming a meat proxy.

On September 22 we released systemd v262 into the wild . In the weeks leading up to that release (and since then) I have posted a series of serieses of posts to Mastodon about key new features in…

In about 4 weeks my hosting panel sent me 2,966 notices that server limits had been exceeded. The worst day had 544. Nobody had told me a site was slow. Everything still loaded fine when I checked.…

Microsoft Entra Security Defaults adds individual protection controls in private preview, with broader MFA coverage and support alongside Conditional Access. The post Manage individual Security…

Investigate suspicious Windows logons using Event IDs 4625, 4624, and 4672 in a practical SOC Tier 1 simulation.

I am a gitlab.com user since 2023 and was using Github before that. However, deep in my heart I’m an advocat of self-hosting whereever possible.

Every site that serves images eventually runs into the same wall. Someone uploads a 12 megapixel phone photo, and you need it at 1200 pixels for the hero, 600 for a card, 200 for a thumbnail grid,…

What Else I Self Host In my previous post about self-hosting, I discussed 28 services I run on my home server. These are various media, security, home, management, and infrastructure services. But my…

Install and use SysLinuxOS Anonimo to route traffic through Tor. Follow the guide to setup, connection checks, and restoring normal networking. L'articolo SysLinuxOS Anonimo secure internet browsing…