Things I build, break, fix, and write about

1 September 2026
Privacy boundaries when AI touches government records

AI governance gets awkward fast when government records are involved, because the model is rarely the problem. The problem is the sloppy boundary around it, the sort I have seen quietly turn a harmless prompt into a route through records nobody meant to expose.

1 September 2026
Metadata schema choices for content libraries

Structured metadata only works when it matches how people actually retrieve content. I have seen neat schemas fail as soon as the library meets real...

31 August 2026
Federation trade-offs in self-hosted social feeds

Federation looks tidy until you let it touch the edges, and then the odd cases arrive fast. I prefer self-hosted social feeds that stay explicit about...

31 August 2026
FireAvert Z-Wave stove shutoffs for offline safety

FireAvert’s setup does the part that matters without asking Home Assistant to babysit it, which is exactly how I want stove protection to behave. The...

Latest blog posts you might like

21 May 2026
Malicious VS Code extensions and workstation compromise

Malicious VS Code extensions do not need to look suspicious to do damage. I care less about the marketplace listing and more about what the thing can reach once it is installed, because that is where...

20 May 2026
Arch Linux PinTheft patch validation steps

PinTheft Arch Linux root escalation is only interesting if the kernel still exposes RDS, so I start there, not with exploit code. If the patched build really closes the hole, it should fail cleanly,...

20 May 2026
Least privilege for agentic AI tool calling

Agentic AI is easiest to trust when it has very little to do, and even less power. I prefer to treat tool calling like any other risky admin path, with tight permissions, short-lived credentials, and...

19 May 2026
Fraud detection signs in redirector and payment domains

website fraud toolchains are rarely clever at first glance, which is why I trust the ugly details, the redirects, duplicate card prompts, and any thank-you page that appears after a decline. Once you...

19 May 2026
Using ISC Stormcast to set patch priority

ISC Stormcast strips the noise out of vulnerability watching, and that matters when patch windows are tight. I use it to decide what jumps the queue, what stays logged, and what is simply not worth...

18 May 2026
Outlook Junk folder link preview bypass

Outlook Junk Folder link preview bypass is a neat reminder that preview text is not validation. I trust the HTML, or I do not trust the mail at all; anything in between is how people get caught out.

18 May 2026
Reading exploit trends from ISC Stormcast

ISC Stormcast is only useful if you treat it as live signal, not background noise. I watch for repeated behaviour around the same service or exploit family, because that is what changes patch...

18 May 2026
Amazon Fire TV Stick 4K Plus and 2 more Amazon tech bargains

Discover the Amazon Fire TV Stick 4K Plus and more tech deals this week.

17 May 2026
hassh drift breaks Outlaw SSH detection

hassh drift is exactly why I do not trust one fingerprint for long; malware library updates change the banner and the hash, while the real mess sits in the commands and file writes after login. If you...

11 May 2026
Ring Outdoor Camera Battery + 2 more Amazon tech bargains

Explore the Ring Outdoor Camera Battery and two more tech bargains this week.