Things I build, break, fix, and write about

5 November 2026
Embedded payloads in trojanised PDF viewers

Modified PDF viewers are a neat little delivery trick because they look like ordinary job bait until someone opens them. I keep coming back to the same point, the file name is not the danger, the loader path is; that is where the unwanted code slips in.

5 November 2026
Ransomware group fragmentation and detection priorities

Ransomware group fragmentation means the label matters less than the behaviour, and I trust activity over reputation every time. A small crew with...

5 November 2026
Security Advisory – 05 Nov 2026

Daily security advisory summary for 05 Nov 2026

4 November 2026
Linux kernel net/sched UAF constraints on CentOS 9 desktop

Linux kernel net/sched use-after-free looks messy on paper, and on CentOS 9 Desktop it is worse, because the obvious paths are blocked and the useful...

Latest blog posts you might like

2 September 2026
AI governance boundaries in product organisations

Google DeepMind is a useful place to watch when product pressure meets safety theatre. The interesting bit is not the model release, but who has the nerve, and the authority, to say no when the...

2 September 2026
Token budgeting for agent state in Go

I prefer a Go standard library context engine when the token limit matters, because it forces the awkward bit up front, before the prompt is stitched together. Get the ranking wrong and you do not...

1 September 2026
Privacy boundaries when AI touches government records

AI governance gets awkward fast when government records are involved, because the model is rarely the problem. The problem is the sloppy boundary around it, the sort I have seen quietly turn a...

1 September 2026
Metadata schema choices for content libraries

Structured metadata only works when it matches how people actually retrieve content. I have seen neat schemas fail as soon as the library meets real records, and tarot makes the problem obvious. If...

31 August 2026
Federation trade-offs in self-hosted social feeds

Federation looks tidy until you let it touch the edges, and then the odd cases arrive fast. I prefer self-hosted social feeds that stay explicit about what is local, what is remote, and what should...

31 August 2026
FireAvert Z-Wave stove shutoffs for offline safety

FireAvert’s setup does the part that matters without asking Home Assistant to babysit it, which is exactly how I want stove protection to behave. The Home Assistant Z-Wave stove shutoffs badge is...

31 August 2026
Weekly Tech Digest | 31 Aug 2026

Stay updated with the latest in tech! This digest covers AI ethics, auto industry shifts, and the impact of politics on technology, exploring today's pressing issues.

30 August 2026
Self-hosted analytics without cross-site tracking

Plausible Analytics keeps the tracking honest enough for a homelab. It counts site use without the usual baggage, and the trade-offs are plain to see, which is more than I can say for most analytics...

30 August 2026
Home Assistant screen automation with Android hooks

Android interoperability is only interesting when it stops being a slogan and starts changing what third-party assistants can actually do. I have spent long enough working around Android’s polite...

29 August 2026
Trusted proxies and interface binding in Home Assistant

Home Assistant OS web server settings matter more than they used to, because the port, bind and trusted proxy choices now decide how the box is reached. Get them wrong and I have seen proxy setups...