Things I build, break, fix, and write about

16 September 2026
Monitoring radio, transport and core faults

Private 5G resilience does not come from a cheerful dashboard or a nice radio map. I want to see where the attach failed, which path dropped, and whether the core is quietly spoiling the whole thing; otherwise you are guessing, and guessing is a poor plan when the network is already sulking.

16 September 2026
Pre-boot authentication for BitLocker

TPM-only BitLocker is convenient, but convenience is not the same as a proper boundary. BitLocker PINs push that line back to pre-boot, which is where...

15 September 2026
Single-sided BPool joins drain mOCEAN via SideStaking

Ocean Protocol BPool single-sided join exit math is where this one falls apart, and I have a soft spot for bugs that look tidy until another contract...

15 September 2026
ecrecover checks for Lixir Vault permit signatures

Lixir Vault permit signatures looked ordinary until the final check was missing. If `ecrecover` only needs to return a nonzero address, you have not...

Latest blog posts you might like

12 July 2026
Managed ruleset tuning after Cloudflare rule changes

Cloudflare WAF managed rules do change under you, and the tidy-looking rule in the dashboard is not always the one doing the blocking. I have learned to trust Security Events first, then tune, because...

12 July 2026
Cloudflare URL Scanner Agent Readiness scores

Cloudflare URL Scanner Agent Readiness is one of those checks that makes a site look different once you know what it is measuring. I like that it is blunt, because the web is full of pages that work...

11 July 2026
Heap overflow in ngx_http_script_copy_capture_code()

I spent too long trusting rewrite logic that looked harmless, and that is usually when nginx rewrite module is_args bites back. Escaped input, stale state, and a buffer sized on the wrong assumption...

11 July 2026
Cloudflare Managed WAF rules: watch action changes

Cloudflare Managed WAF rules are easy to misread if you only skim the release notes. I look at the Security Events dashboard instead, because that is where a quiet detection turns into a block, or a...

10 July 2026
Handling backend restarts in Cloudflare Realtime SFU

Cloudflare Realtime WebSocket adapter handles brief backend restarts better than I expected, but only within a hard five-second window. That is enough to turn a wobble into a pause; after that, the...

9 July 2026
Detect Split ClientHello failures in TLS 1.3

Split ClientHello failures are exactly the sort of thing that waste an afternoon, because the server looks fine until a fragmented post-quantum handshake trips over something in the middle. TLS...

9 July 2026
Checking Logpush field mappings after schema updates

Cloudflare Logpush datasets do not always announce when they change shape, and that is where the trouble starts. I check the field map against real exports, because a parser that still runs can be...

8 July 2026
Local DNS proxy now preserves DNSSEC records

Cloudflare One Client for Windows now leaves DNSSEC records alone, which is exactly the sort of change I like, because it stops the client quietly meddling with answers. I have seen enough broken name...

8 July 2026
Cloudflare One Client for macOS DNS search suffixes

Cloudflare One Client for macOS can make a short hostname behave very differently, and most of the pain sits in the suffix list rather than DNS itself. I have seen perfectly sane machines fail because...

7 July 2026
Tracing acme.sh certificate handling in TLS interception

I spent too long chasing the neat version of TLS wiretapping reconstruction, then found the mess: shell parsing, token limits, and renewal timing. The interesting bit is not the packet capture, it is...