Things I build, break, fix, and write about

12 October 2026
Weekly Tech Digest | 12 Oct 2026

Stay updated with the latest in tech! This digest covers AI ethics, auto industry shifts, and the impact of politics on technology, exploring today's pressing issues.

28 September 2026
Removed SSRF beta detections in Cloudflare WAF

Cloudflare WAF Managed Rules have a habit of changing underneath you, and old SSRF names can linger long after the protection has gone. I prefer to...

28 September 2026
Weekly Tech Digest | 28 Sep 2026

Stay updated with the latest in tech! This digest covers AI ethics, auto industry shifts, and the impact of politics on technology, exploring today's...

27 September 2026
Cloudflare WAF metadata changes for WordPress XSS

Cloudflare WAF WordPress XSS detection now has a cleaner CVE label, but the behaviour has not changed; the rule still blocks the same traffic, just...

Latest blog posts you might like

30 August 2026
Self-hosted analytics without cross-site tracking

Plausible Analytics keeps the tracking honest enough for a homelab. It counts site use without the usual baggage, and the trade-offs are plain to see, which is more than I can say for most analytics...

30 August 2026
Home Assistant screen automation with Android hooks

Android interoperability is only interesting when it stops being a slogan and starts changing what third-party assistants can actually do. I have spent long enough working around Android’s polite...

29 August 2026
Trusted proxies and interface binding in Home Assistant

Home Assistant OS web server settings matter more than they used to, because the port, bind and trusted proxy choices now decide how the box is reached. Get them wrong and I have seen proxy setups...

29 August 2026
controller-runtime cache: stale reads and conflicts

controller-runtime cache makes reads look easy until you trust them too much. I have chased stale objects and pointless conflicts through more than one controller, and the fix was never magic, just...

28 August 2026
Static Pod config breaks without API access

Kubernetes static pods are unforgiving when kubelet cannot satisfy a reference locally. I have seen a tidy manifest fail because it quietly leaned on the API server, and the fix was not clever, just...

28 August 2026
Gateway API TCPRoute for raw L4 routing

Gateway API TCPRoute finally gives raw L4 routing a proper shape, without the usual controller-specific nonsense. I like it because it stays plain, listener attachment is explicit, and you are not...

27 August 2026
Clipboard hijacking in cryptocurrency transfers

clipboard hijacking works because the address still looks right, until it does not. I prefer to treat the clipboard as hostile, especially with cryptocurrency transfers, where one careless paste is...

27 August 2026
Device encryption limits corporate data theft

Device encryption is useful, but it will not save you from corporate endpoint data theft once a session is live. I have seen the mess that comes from cached files, browser stores, and synced folders;...

26 August 2026
Retaining access logs for healthcare breach notifications

Healthcare breach notifications are only as solid as the logs behind them. I have seen enough broken audits to know that dashboards are no substitute for raw access records, especially when the notice...

26 August 2026
Self-hosted Metabase exposure from unauthenticated SQL

I’ve seen enough self-hosted tools turn into soft centres, and Metabase SQL injection is another reminder. If your analytics box holds credentials, exports and admin access in one place, one bad...