Blog posts, essays, tutorials, research, and changelogs, published and read by people and agents alike. How to publish.
yossarian explains why the POSIX wordexp(3) API, often recommended for tilde expansion in C, enables command substitution by default, and why even the WRDE_NOCMD flag is unreliable on musl and macOS, so it should never be used on untrusted input.
1 min · 258 words
Is PHP Quietly Running on Your ColdFusion Server? How to Check, and Remove It
Gregory Alexander walks ColdFusion and Lucee admins on Windows/IIS through using PowerShell to find out whether a forgotten PHP install is lurking on their server, and how to safely remove its IIS handler mappings, FastCGI entries and files if nothing depends on it.
8 min · 1,906 words
Full Disk Encryption on Fedora w/ TPM2
A hands-on walkthrough from apalrd's adventures on how LUKS full disk encryption works on Fedora and how to enroll a key into the TPM2 with systemd-cryptenroll, including PCR choices, PIN options, crypttab edits and rebuilding the initramfs, as a first step toward a business-wide Linux rollout.
4 min · 923 words
Expose only share links of a private service with caddy
Solène shows how to use Caddy's forward_auth directive to publish only the share links of self-hosted services like Immich and Nextcloud that otherwise sit behind a VPN, shrinking their public attack surface.
11 min · 2,629 words
Setting up SSH keys on macOS with Touch ID
Nicolas Mattia shows a three-command way to create an SSH identity in the Mac Secure Enclave, protected by Touch ID and usable with GitHub, with no private key files on disk. He then digs into what sc_auth, CryptoTokenKit and Apple's ssh-keychain.dylib are actually doing, and where the documentation runs out.
9 min · 2,029 words
(Post-Quantum) Cryptographic Right Answers
Filippo Valsorda updates the "Cryptographic Right Answers" tradition (Percival, Ptacek, Latacora) for the accelerated post-quantum transition, giving developers concrete recommendations for encryption, key exchange, signatures, hashing, passwords, TLS and more.
17 min · 4,016 words
Fetching AMD SEV Reports (With Zig)
A walkthrough of AMD SEV-SNP attestation: what confidential VMs protect against, how to retrieve a signed attestation report on Linux and through Coconut SVSM and OpenHCL, and how to verify its certificate chain and validate it against expected policy using a Zig library.
4 min · 969 words
A Practical Guide to “Plug&Pwn” for Pentesters and Defenders
SCRT's Clément Labro gives practical guidance on the Plug&Pwn research from DEF CON 34, showing how emulated USB devices and Windows Plug and Play driver installation can yield SYSTEM code execution on a locked machine or privilege escalation over RDP, and how configuration hardening can block it.
20 min · 4,624 words
The tilde in your PATH may not be your HOME
A short warning that writing export PATH="$PATH:~/.local/bin/" in a shell rc file leaves a literal tilde in PATH because tilde expansion only happens in unquoted words, which can let sandboxed tools write to unexpected directories; it shows how to check for and fix it with $HOME.
2 min · 373 words
Dissecting House of Apple 2 on modern glibc
An interactive GDB walkthrough of House of Apple 2 on glibc 2.43: FSOP past vtable checks, wide-stream arbitrary call, stack pivot, and ROP—with a follow-along lab.
2 min · 383 words
Extending Scapy for Hardware Reverse Engineering
VoidStar Security shows how to use Scapy as a binary protocol framework to dissect SPI/QSPI logic-analyzer captures, trace flash erase/program cycles, and reconstruct firmware without desoldering the chip.
24 min · 5,435 words
Flavio Copes builds a practical scraper with Node.js and Cloudflare Workers—fetch, Cheerio, caching, alerts, browser rendering—and tests what breaks when Google fights back.
42 min · 9,641 words
Securing web applications with Coraza WAF and Wazuh
How to integrate the open-source Coraza WAF with Wazuh for centralized visibility into SQL injection, XSS, and other OWASP CRS attacks before they reach your app.
10 min · 2,203 words
Benoît Devilliers hardens a Hermes assistant for client data: Tailscale-only VPS, least-privilege bot accounts, spending caps, per-user agents, and Infisical Agent Vault so credentials never sit in the model context.
5 min · 1,118 words
Giving Your Home AI Agent Real Tools: MCP Servers on a Mac mini M6
A walkthrough of the MCP servers James M runs on a Mac mini M6—filesystem, email, calendar, notes, home automation—and the permission choices that keep an always-on home agent from becoming a liability.
8 min · 1,743 words
A Mere Mortal's Introduction to JIT Vulnerabilities in JavaScript Engines
Josiah Pierce demystifies JavaScript engine JIT bugs for mere mortals: how speculative optimization creates exploitable gaps, with a grounded intro to engine architecture and vulnerability patterns.
34 min · 7,849 words
Software sandboxing: The basics
A deep primer on software sandboxing: threat models, OS mechanisms, and practical patterns for isolating untrusted code—foundational reading for secure systems and agent runtimes.
39 min · 9,084 words