Things I build, break, fix, and write about

29 July 2026
Headlamp in-cluster deployment and RBAC boundaries

Headlamp in-cluster deployment only makes sense when the UI belongs inside the cluster, and even then the service account should be painfully narrow. I trust the boundary, not the person using it on a quiet afternoon.

28 July 2026
Marketplace takedown pressure on vendor operations

Marketplace takedowns do more than pull a site offline, they cut through the vendor routines that keep sales moving. In dark web marketplaces, that...

28 July 2026
Brickstorm persistence in Microsoft 365

Brickstorm showed how Microsoft 365 persistence can survive a tidy password reset and a few blocked logins. I keep coming back to the same point, if...

27 July 2026
Restricting Serv-U access before patching

The SolarWinds Serv-U flaw is the sort of bug that turns a routine patch into an ugly afternoon, so I would block the obvious request pattern first...

Latest blog posts you might like

22 November 2025
kopia | v0.22.0

kopia v0.22.0 brings command-line enhancements, general improvements, new snapshot features, CI/CD updates, and fixes for Azure storage provider stability.

21 November 2025
Minimise attack surfaces on Microsoft Exchange Server

For Exchange Server security, reduce your exposed services. Remove unused roles, lock down IIS, disable legacy protocols and isolate admin accounts. Use dedicated admin workstations, enforce MFA, keep...

21 November 2025
Implementing regional redundancy after the AWS outage

Implementing regional redundancy after the AWS outage The recent AWS outage showed what happens when a DNS automation bug gets the wrong chance to run. I read that as a reminder to treat resilience...

20 November 2025
Windows 11 24H2: keeping Insider builds usable

Configure Windows 11 Insider Previews for steady test results and fast recovery. Back up your data, choose an appropriate Insider channel, limit background apps, and monitor performance. Follow clear...

20 November 2025
Deploying secure AI services on Apple Private Cloud Compute

Secure AI on Apple Private Cloud Compute Private Cloud Compute only works if the controls are boring and tight. Keep the model nodes off the public internet, put a gateway in front of them, and treat...

19 November 2025
Use Microsoft Privacy Dashboard for data oversight

Use the Microsoft Privacy Dashboard to control account data. Adjust Windows 11 privacy settings, clear activity, and limit personalised ads. Verify changes in Settings. Sign out of Copilot or unlink...

19 November 2025
Managing AI workload costs on a budget

Managing AI workload costs on a budget I run experiments and keep hardware bills tight. The useful bit is simple: measure what the workload is doing, then cut spend where it actually sits. Financial...

18 November 2025
Enhancing AI introspection in homelab setups

I run AI systems at home. I treat model introspection like a debugger, not magic. If a model claims to inspect its own steps, it still needs monitoring, logs and tests. The notes below show what to...

18 November 2025
Addressing AI browser vulnerabilities for safer use

AI web browsers security is an urgent concern for your data. This article explains risks such as prompt injection, data exposure and agent autonomy. You get concrete examples and immediate steps to...

17 November 2025
Configuring a lightweight NAS for Proxmox failover

Proxmox Cluster: Build a two-node cluster with a qdevice to secure quorum and enable basic failover. Host VM disks on a NAS or use ZFS replication. You must test node, qdevice and network failures....