The problem I run an Airbnb. Every year the return starts the same way: pull the credit card statements, add them up, and bucket the spend. Schedule C wants categories, not a pile of charges. A…

A full pass at letting Codex build and ship a backend unattended: instructions, permissions, headless runs, self-verification against traces, and who decides what gets provisioned.

An overview of things you can do with Cloudflare's new primitive

The internet used to be a very insecure place. Cookies used to be transmitted cross-site. HTTPS wasn’t a common occurrence until 10 years ago. JavaScript had access to more system resources than it…

Root cause analysis of repeated link up/down transitions at 10 and 100 Mbps during boot on Intel i226 controllers, from an embedded ARM platform to COTS cards on a desktop.

I have previously blogged about doing RF surveys using software defined radio. The most interesting aspect to me has been to inventory the business of the different WiFi channels, in order to not…

Disclosure: this research was conducted using an ANY.RUN account provided as part of a collaboration. All analysis and conclusions are my own. TLDR Found an unreported Silver Fox campaign serving…

A proved gate is only as good as the policy it enforces, and the policy is the part that changes while the agent is running. What OSCAL and the agent-authorization drafts both assume, and what breaks.

in previous posts we have looked at guardrail triggers, token burn, hostname beacons, malicious skills, context bombs, exploding search space, service sandbagging, and GCG attacks. this time:…

Filebrowser is being archived. As the author writes, the codebase dates back to when he was but 15 years old. Having created such a popular file management tool is a more than impressive achievement…

Your CI should have one job: scheduling. It should decide when to do the thing. Your builds itself, should be controlled by you. Use Docker, Nix, a Makefile or what have you. The ideal workflow file…

After a compromised Mac and AI agents leaked secrets into session logs, I began building GuestSafe: a local, auditable alternative to .env.local.

Two trends have persisted for 2–3 years and are now fully reflected in everything from industry and breach reporting to the market for cybersecurity talent and solutions:

Some internet standards only support ASCII characters, but the world uses much more than the Latin alphabet. Thus, a mapping from Unicode to ASCII for use in domain names is required. NamePrep was…

If you plan to reinstall Windows or maybe switch over to Linux, here's a few things to check and confirm before wiping your drive.

Warp/Wraith Linux RAT static analysis: Go binary with ELF section header mangling, oversized LOAD segment, and SSH credential harvesting. Detected without sandbox or dynamic execution — the…

I previously came across an issue in my benchmarking work where I relied on the Latency Histogram section of sysbench output. On Linux it worked fine — I generally ran my workload there, so it never…

zipmi – https://github.com/zenfish/zipmi – is a pure-Python IPMI/BMC stack — an `ipmitool`-style CLI plus a library where every byte is an inspectable and mangleable object. Built for…

By Steve Burgess, Burgess Forensics, 2026 “He passed last month, and his whole life is locked inside his phone. Can’t you just get in?” I hear some version of that rather often —more than you might…

This afternoon I had a meeting with IT people at a huge US power infrastructure company. They had found a libcurl.dll file in their C:\Windows\System32 directory and asked us for help to upgrade it.…

How we brought our Rust CI from 20 minutes to less than 5 for Comper AI Disclaimer This post was written by GPT-Sol 5.6 mimicking my writing style. After multiple 12h+ days of optimizing CI I could…

How I browse the Web with uBlock (Hard Mode) Figure 1: Actually I surf with Images off I have been asked quite a few times, whenever I show my browsing setup to people, Why don't you use the web as a…

Linux pipes only work within the same process family tree. If you are piping from procA to procB, they must both have the same parent process (e.g. bash). For inter-process piping between unrelated…

This year, I skipped the main stage tracks at DEF CON to catch what promised to be interesting talks at some of the villages—and to be clear, some of those talks were interesting! Unfortunately,…

The title of this section might seem a little overwhelming, but it reflects the focus of the chapter. The SONiC Redis database programming pipeline is examined through the configuration of two…

A comprehensive review of the spam debates and BIP-110 fork movement.

On February 29th, 2024, a consumer from Texas posted a complaint on the CFPB portal against Experian that read like the start of a novel “In the quiet humdrum of everyday life, a sudden jolt…

Why you get a data center, and you get a data center, and everybody gets data centers

The continued expansion of the global data center industry has drawn increasing attention to onsite water use and the energy efficiency of infrastructure (which is linked to water used in…

For Debian, Install sudo apt install firmware-mediatek Panda Wireless PAU0F AXE3000

Now that I have moved my blog from Blogspot to my own server (see Blog moved to https://blog.apdu.fr/) I am now able to analyse the web server logs for https://ccid.apdu.fr/. I used the logs from…

In this guide, let’s look at how to customize OneDrive sync root folder name using Intune. By default, the folder name...

Google published the successor to BeyondCorp. Here's what you can actually do about it without a team of engineers and a custom internal auth stack.

This was a great piece about what’s going on with fly.io. It’s by far my favourite way to deploy my apps these days, and I hope they make it. I’m going to overshare some more in a second, but I won’t…

eki's Home https://eki.moe/posts/choosing-truenas-boot-drives/ -During my adventure to minimize my hardware and reclaim some living space, my NAS was reinstalled into a new chassis that is much…

DNS problems in Kubernetes are some of the most frustrating issues to chase down. They’re often intermittent, they can differ by node, by node pool, by which resolver actually answered the…

A walkthrough of running OpenBao on Kubernetes with CloudNativePG as its PostgreSQL storage backend. Every layer of this stack is open source, with no vendor lock-in: Kubernetes and CloudNativePG are…

Introduction: The Outages Aren't Bugs; They're Symptoms GitHub is down again? Oh boy, it has a scalability issue, you might say. I say your coding agent may be to blame, and thus may be you should…

Following up from my last post, where I talked a bit about proxy TLS termination and third-party interception, I think it raised an obvious question: if TLS (as it is typically used today)…

A few days ago, a paper named “Stealing Reasoning Traces from Proprietary LLM APIs” was published. It describes a simple, yet super elegant way to recover encrypted LLM reasoning traces.…

development updates regarding my solar powered setup, my distro lin0 and a new project called geomys.

Just as with the fight against data centers, the energy is really coming from the grassroots.

On July 9 S&P cut Oracle to BBB-. On July 10 Wisconsin regulators let a deadline pass and left standing a rule that says anyone below A- posts collateral before the utility will sell them power. A…

Earlier this year, I blogged about work I did to improve VRAM management for games. Now, after many months of floating around in mailing lists, the kernel patches are finally merged upstream and…

Watching this pivot-to-ai video I was struck by a thought (as it sometimes happens)… I think “we” may be setting ourselves up for the return of the internet worms, 1999-style, but…

An ARM64 (aarch64) machine which sat idle on the workbench amidst other inert items has finally returned to service. Many years ago I purchased a HoneyComb LX2 ARM workstation with the hopes that it…

About a month ago I wrote about consistent hashing . It’s a neat way for a set of nodes to agree on the placement of something without coordinating with each other. For example, a set of frontend…

An idle WebSocket connection costs CPU and memory even when no messages flow. The post starts with 200k idle connections on a single node, cuts the overhead with five Centrifugo PRO options, then…

Nobody knocked My history of cybercrime is typical: the usual shithead tour of carding, account takeover, game cheats, denial of service. All of it more than fifteen years removed. In early August I…

I am still generally enjoying using Wayland with the sway window manager on NixOS. It turns out I really like tiling window managers, it seems to behave reasonably well, and it has a degree of…