Things I build, break, fix, and write about

29 July 2026
Headlamp in-cluster deployment and RBAC boundaries

Headlamp in-cluster deployment only makes sense when the UI belongs inside the cluster, and even then the service account should be painfully narrow. I trust the boundary, not the person using it on a quiet afternoon.

28 July 2026
Marketplace takedown pressure on vendor operations

Marketplace takedowns do more than pull a site offline, they cut through the vendor routines that keep sales moving. In dark web marketplaces, that...

28 July 2026
Brickstorm persistence in Microsoft 365

Brickstorm showed how Microsoft 365 persistence can survive a tidy password reset and a few blocked logins. I keep coming back to the same point, if...

27 July 2026
Restricting Serv-U access before patching

The SolarWinds Serv-U flaw is the sort of bug that turns a routine patch into an ugly afternoon, so I would block the obvious request pattern first...

Latest blog posts you might like

15 April 2026
ACL permission models that break as infrastructure grows

I’ve lost enough evenings to home lab automation pitfalls to know the real trouble starts with small defaults, not big failures. ACL permission models that break as infrastructure grows are usually a...

14 April 2026
Moving keepsakes offsite without losing local Nextcloud

I keep Nextcloud for daily use, but the real safety net sits off the box. A digital keepsakes backup strategy only starts to make sense when restores are boring, not hopeful, and I have learned not to...

14 April 2026
Security Advisory – 14 Apr 2026

Daily security advisory summary for 14 Apr 2026

13 April 2026
Tenant isolation failures expose financial metadata leakage

Multi-tenant data isolation failures happen when scope checks live at the presentation layer instead of the query layer. Lloyds learned this the hard way; I'll show you why it matters in your homelab...

13 April 2026
Amazon Fire TV Stick HD and 2 more Amazon tech bargains

Discover the Amazon Fire TV Stick HD and more tech deals this week.

12 April 2026
Isolating n8n in Docker: network policies and backup

Running n8n in your homelab without proper isolation is a liability. CVE-2025-68613 lets authenticated users execute code with container privileges; if that container sits on your default Docker...

11 April 2026
Running local agentic AI coding workflows without cloud subscriptions

Running a local model means no quota walls, no token metre ticking, and no surprise bills when the agent loops through ten reasoning steps. Cloud coding assistants collapse under agentic use; local...

11 April 2026
n8n | stable

n8n 2 15 1 released: fixes Google Drive v1 infinite pagination loop, upgrade to 2 15 1, test Drive workflows, report regressions, roll back to 2 15 0 if needed

10 April 2026
Blocking residential proxy traffic with stateful firewall rules

Most home routers allow everything outbound by default, which is exactly how AVRecon persisted undetected for six years. A stateful firewall with explicit outbound rules and network segmentation...

9 April 2026
Personal health data needs local storage, not cloud

Health data inside a corporate platform means health data inside a jurisdiction you do not control, encrypted or not. Self-hosting it locally—with proper backups and audit trails—trades convenience...