Things I build, break, fix, and write about

17 September 2026
Require a BitLocker pre-boot PIN

TPM-only BitLocker is tidy until you remember what is left exposed when the machine can unlock itself. BitLocker PINs are the small, awkward step that makes a stolen laptop less cooperative, and I trust that far more than wishful thinking about physical security.

17 September 2026
Secure connectivity principles in water sector OT

Secure connectivity principles only work when the boundary is real, not decorative. I’ve seen too many remote paths that looked neat on paper and fell...

16 September 2026
Monitoring radio, transport and core faults

Private 5G resilience does not come from a cheerful dashboard or a nice radio map. I want to see where the attach failed, which path dropped, and...

16 September 2026
Pre-boot authentication for BitLocker

TPM-only BitLocker is convenient, but convenience is not the same as a proper boundary. BitLocker PINs push that line back to pre-boot, which is where...

Latest blog posts you might like

29 June 2026
Weekly Tech Digest | 29 Jun 2026

Stay updated with the latest in tech! This digest covers AI ethics, auto industry shifts, and the impact of politics on technology, exploring today's pressing issues.

28 June 2026
Android security boundary failures around AuthToken handling

Android Biometric AuthToken handling is one of those details that looks tidy until you trace what actually trusts it. I pay closest attention to the hand-off points, because that is where a neat...

28 June 2026
Access control in WrappedADS authorised mint flow

WrappedADS wrapTo() mint path is not hiding much, and that is the point. If the caller is trusted, the mint goes through; if that trust is wrong, supply moves just as easily.

27 June 2026
redeemPosition rounding turns fixed deposits noisy

A fixed deposit should not unlock more SEA just because the round counter shifts. The SEA settlement adapter let that line blur, and a flash-loan loop made the mistake expensive; once redemption...

27 June 2026
MMR proof indexing in a bridge dispatcher audit

The ugly part of an Ethereum bridge dispatcher is not the proof itself, it is the gap between a tidy verification trace and the bytes that finally reach custody logic. If those two ever diverge, the...

26 June 2026
Uniswap V2 spot reads distort reward payouts

A pair reserve is a terrible price feed when someone can shove it around for one transaction. I have seen the same bad read turn cheap stake entry into inflated principal, then pay out rewards from...

26 June 2026
Web shell persistence in BadIIS loaders

BadIIS is not clever, just persistent, and that is what makes it unpleasant. It survives IIS restarts, rewrites selected traffic, and leaves behind enough build artefacts, like demo.pdb, to give...

25 June 2026
OpenVPN vulnerabilities and patch priority

OpenVPN vulnerabilities are easy to shrug off until they hit the client, where malformed packets can knock out remote access before the tunnel is even trusted. I would patch that before almost...

25 June 2026
Operational threat intelligence for IIS hijacking

IIS hijacking is boring until it is not, which is exactly why a threat intelligence programme has to watch for the awkward bits, not the headline alert. When redirects, 503 spikes, and odd proxying...

24 June 2026
GitHub source code exposure via third-party tooling

GitHub source code exposure rarely starts with the platform itself, it starts with something trusted too much. I care less about the headline breach than the awkward bit underneath, where a...