Things I build, break, fix, and write about

31 August 2026
Federation trade-offs in self-hosted social feeds

Federation looks tidy until you let it touch the edges, and then the odd cases arrive fast. I prefer self-hosted social feeds that stay explicit about what is local, what is remote, and what should never have been pulled in at all.

31 August 2026
FireAvert Z-Wave stove shutoffs for offline safety

FireAvert’s setup does the part that matters without asking Home Assistant to babysit it, which is exactly how I want stove protection to behave. The...

31 August 2026
Weekly Tech Digest | 31 Aug 2026

Stay updated with the latest in tech! This digest covers AI ethics, auto industry shifts, and the impact of politics on technology, exploring today's...

30 August 2026
Self-hosted analytics without cross-site tracking

Plausible Analytics keeps the tracking honest enough for a homelab. It counts site use without the usual baggage, and the trade-offs are plain to see,...

Latest blog posts you might like

27 August 2026
Device encryption limits corporate data theft

Device encryption is useful, but it will not save you from corporate endpoint data theft once a session is live. I have seen the mess that comes from cached files, browser stores, and synced folders;...

26 August 2026
Retaining access logs for healthcare breach notifications

Healthcare breach notifications are only as solid as the logs behind them. I have seen enough broken audits to know that dashboards are no substitute for raw access records, especially when the notice...

26 August 2026
Self-hosted Metabase exposure from unauthenticated SQL

I’ve seen enough self-hosted tools turn into soft centres, and Metabase SQL injection is another reminder. If your analytics box holds credentials, exports and admin access in one place, one bad...

25 August 2026
Patching TrueConf Server 5.3.x before 5.3.9

An exposed TrueConf server is not just a nuisance, it can become a delivery point for poisoned client installers. I would patch first, then check every file it has been serving, because TrueConf...

25 August 2026
Sandboxing agentic AI to block unsafe web actions

Sandboxing agentic AI is less about the model than the exits. If frontier AI evaluations can browse, submit or copy data, the only thing between a test run and a mess is the permission boundary, and I...

24 August 2026
Testing frontier AI for sensitive data handling

frontier AI evaluations are easy to get wrong when the model only sees tidy prompts and harmless files. I care more about where the data ends up, in logs, caches, memory, or a tool call, because that...

23 August 2026
Testing agent boundaries before tool access widens

Frontier AI evaluations are only useful if they fail in the right places. If a model can keep itself safe until the last gate, then the gate is doing the work, not the model, and I would rather find...

22 August 2026
Skia integration for Rust image decoding

Chromium image codecs are where browser safety gets real, because malformed images arrive before anything else useful has happened. I like the Skia route for that reason; it keeps the ugly parsing...

22 August 2026
Styled output in macOS Terminal can leak data over DNS

macOS Terminal ANSI escape codes are one of those details I keep tripping over, because the wrong sequence can do more than colour text. I like this kind of bug precisely because it is small, ugly,...

21 August 2026
Tool boundaries in incident response for AI agents

When an autonomous AI intrusion lands, I care less about the model’s output and more about whether my tools still work. If a hosted service refuses the forensic workload, your response path is already...