Back to tags
#security
threat models, default-deny, and the cve that landed on a friday.
10 blog posts.
Posts about threat models, default-deny, and the configuration that makes the wrong thing impossible. Six of them are the Lazy Security series: the dependencies you didn't read, the actions you didn't pin, the unsexy list, four DNS records, the dev laptop as perimeter, and the network in front of everything. The rest are incidents — a WAF that decided browser extensions looked like attack vectors, two tenants sharing a GPU with no wall between them — plus the Docker baseline and a self-hosted alias server. Practical controls and dated incidents, no vendor slides.
Blog posts
A Kubernetes namespace isolates the API, not the silicon. Under time-slicing two teams share a physical GPU with no memory wall. Quotas, isolation, and…
Ivanti made everyone re-read their VPN architecture in January 2024. Tailscale, Cloudflare Tunnel, and WireGuard in one afternoon.
Snowflake taught everyone what happens when an infostealer runs on a contractor's personal Mac. The laptop is the perimeter.
Four DNS records that close the entire phishing-impersonation class: SPF, DKIM, DMARC, and CAA, plus two monitors, set up correctly in one afternoon.
Identity, network access, default credentials, attestation, and audit logs: the unsexy DevSecOps controls that close most of the gap Parts 1 and 2 left…
Hardening GitHub Actions for small teams: SHA pinning against tag rewrites, OIDC over long-lived secrets, dependency cooldowns, and the trigger to never…
Startup-grade defense against npm supply-chain attacks, for Future You at 3am. Chainjacking, postinstall scripts, smallest install, most leverage.
How to self-host SimpleLogin with Docker, Postfix and Brevo on a $3/month VPS. DNS, reply-from-alias, and the TLS gotcha that ate two hours of my Sunday.
Tried booking a flight. Got blocked. Turns out Akamai thinks my 21 security extensions make me look like a hacker. They're not wrong.
Your containers are probably insecure. Here's how I learned to harden Docker containers the hard way, and the security mistakes that almost cost us.