Things I build, break, fix, and write about

17 September 2026
Require a BitLocker pre-boot PIN

TPM-only BitLocker is tidy until you remember what is left exposed when the machine can unlock itself. BitLocker PINs are the small, awkward step that makes a stolen laptop less cooperative, and I trust that far more than wishful thinking about physical security.

17 September 2026
Secure connectivity principles in water sector OT

Secure connectivity principles only work when the boundary is real, not decorative. I’ve seen too many remote paths that looked neat on paper and fell...

16 September 2026
Monitoring radio, transport and core faults

Private 5G resilience does not come from a cheerful dashboard or a nice radio map. I want to see where the attach failed, which path dropped, and...

16 September 2026
Pre-boot authentication for BitLocker

TPM-only BitLocker is convenient, but convenience is not the same as a proper boundary. BitLocker PINs push that line back to pre-boot, which is where...

Latest blog posts you might like

18 May 2026
Amazon Fire TV Stick 4K Plus and 2 more Amazon tech bargains

Discover the Amazon Fire TV Stick 4K Plus and more tech deals this week.

17 May 2026
hassh drift breaks Outlaw SSH detection

hassh drift is exactly why I do not trust one fingerprint for long; malware library updates change the banner and the hash, while the real mess sits in the commands and file writes after login. If you...

11 May 2026
Ring Outdoor Camera Battery + 2 more Amazon tech bargains

Explore the Ring Outdoor Camera Battery and two more tech bargains this week.

10 May 2026
Dirty Frag: page-cache corruption in Linux

Dirty Frag is the sort of bug I mistrust on sight, because the damage lands in page-cache corruption before disk ever notices. If you rely on Linux to keep shared buffers honest, this one is worth a...

10 May 2026
Operational indicators from ISC Stormcast to check

ISC Stormcast is useful when you strip away the diary clutter and look only at the indicators that survive a second glance. I trust hostnames, paths, dates and hashes far more than the banner around...

10 May 2026
Building an analytics UI from web honeypot logs

I built this from web honeypot logs because the raw output is mostly noise, and the useful part is buried in repetition, timing, and source clusters. The trick is to stop the dashboard turning into a...

9 May 2026
Older clients after root CA rotation

Older clients rarely fail politely after an SSL.com root certificate rotation, and I have seen enough broken TLS to stop trusting “it works on my laptop”. The real problem is usually old trust stores...

9 May 2026
Local access exposes Microsoft Edge saved passwords

Microsoft Edge cleartext password storage is not a theoretical gripe; once the session is live, the browser can hand over saved credentials far more easily than most people expect. I would treat that...

8 May 2026
Turning ISC diary entries into detection checks

SANS Internet Storm Center diary indicators are only useful once they stop being a header and start becoming something you can test. I treat the stub as a pointer, not evidence; until there is a...

8 May 2026
React dashboards for DShield web honeypot logs

React dashboards make web honeypot logs readable, but only if you strip out the noise first. I prefer to reduce the stream to a few hard facts, then let the interface show the pattern; anything else...