Things I build, break, fix, and write about

17 September 2026
Secure connectivity principles in water sector OT

Secure connectivity principles only work when the boundary is real, not decorative. I’ve seen too many remote paths that looked neat on paper and fell apart the moment someone needed to patch a PLC at 2am; that is usually where the trouble starts.

16 September 2026
Monitoring radio, transport and core faults

Private 5G resilience does not come from a cheerful dashboard or a nice radio map. I want to see where the attach failed, which path dropped, and...

16 September 2026
Pre-boot authentication for BitLocker

TPM-only BitLocker is convenient, but convenience is not the same as a proper boundary. BitLocker PINs push that line back to pre-boot, which is where...

15 September 2026
Single-sided BPool joins drain mOCEAN via SideStaking

Ocean Protocol BPool single-sided join exit math is where this one falls apart, and I have a soft spot for bugs that look tidy until another contract...

Latest blog posts you might like

14 June 2026
Cloudflare AI Gateway REST API logging and rate limiting

Cloudflare AI Gateway REST API logging and rate limiting is one of those setups that looks tidy until you test it properly. I spent enough time tripping over the default gateway behaviour to know the...

14 June 2026
Keeping smart bulbs powered with Home Assistant

A Zigbee wall controller is the bit that stops smart bulbs being undone by an ordinary switch. Keep the bulbs powered, let Home Assistant handle the logic, and the room behaves like a system instead...

13 June 2026
Kubernetes v1.36 PodGroup scheduling cycle explained

Kubernetes v1.36 makes gang scheduling less hand-wavy, and the PodGroup scheduling cycle is where the sharp edges show. I like the clarity, but it also means there is nowhere for a bad placement to...

13 June 2026
Kubernetes Service externalIPs deprecation and migration

Kubernetes Service externalIPs was always a blunt instrument, and I have seen enough clusters to know blunt tools get misused. The warnings in 1.36 are the polite bit, because once address ownership...

12 June 2026
Aggregated Discovery during API server upgrades

Kubernetes Mixed Version Proxy is one of those fixes that only matters when an upgrade goes sideways, which is exactly when I want it. Aggregated Discovery finally gives older API servers enough sight...

12 June 2026
Track CCM route syncs against cloud API quotas

`route_controller_route_sync_total` is one of those rare counters that tells you something useful, if you bother to watch it. I use it to catch route reconciliation that is chewing through cloud API...

11 June 2026
Chunked gRPC range requests in etcd 3.7

etcd 3.7’s RangeStream makes large reads less painful, but it also clears out a lot of old v2 baggage, which is where upgrades tend to go wrong. I like the new read path; I do not trust any release...

11 June 2026
Apex One zero-day: Windows endpoint checks

Trend Micro Apex One zero-day is not the sort of bug you shrug off, because the server-side flaw lets a compromised admin box start pushing code to trusted agents. If you run Apex One on Windows, the...

10 June 2026
Call-tracking data in tech support fraud

Call-tracking data is useful until it is not, and tech support fraud knows that better than most. Rotate enough numbers, split the complaints, and the abuse starts to look like ordinary churn, which...

10 June 2026
Abuse detection gaps in server fleets

Abuse rarely stays put for long, and a hosting provider abuse problem usually survives because the signals never meet in one place. I have seen enough fleets to know the weak point is not logging, it...