-
Why local LLMs could not drive an autonomous pentest agent
I tuned an autonomous security-testing agent until the mechanics were clean, then watched my local 27B model read 1.44 million tokens and find none of three planted bugs. Here is how to separate fixable plumbing from a model that cannot do the job.
-
Translating whole books with local LLMs: the failure modes
My local translation service rebuilds scanned books page by page in another language. Most fixes were not about the model: segment context, glossary scope, a lost-update race and page rebuilding.
-
Entity resolution lessons from a library and a threat-intel store
Six entity-resolution principles learned resolving authors in a 70,000-work library and networks in a threat-intel store: keep every claim, deterministic ids, decision tiers, lift over co-occurrence, no bulk lists, sample first.
-
One query wrote 376 GB of temp files: shared Postgres lessons
A six-way LEFT JOIN on my shared PostgreSQL spilled 376 GB to pgsql_tmp in 3.5 hours. The limits every shared instance needs, a RAM-disk temp tablespace and its restart trap, and two more shared-database lessons from k3s.
-
Authelia SSO pitfalls: a policy protects nothing if the route skips it
Three services my Authelia config marked two-factor served pages to anyone: the Traefik routes never called Authelia. Six SSO pitfalls from a home lab, all fixed, with config.
-
Why my long CrowdSec bans vanished after two days
CrowdSec's alert flush deleted my year-long bans after ~48 hours, a systemd timer sat dead for 24 days, and the fix triggered 18 router re-add storms. Mechanisms and fixes.
-
Falco on Linux 7.0: 222 restarts and a BPF verifier error
Falco 0.43 restarted 222 times on a Linux 7.0 kernel. The path to the fix: OOM kills, dropped syscalls, a BPF verifier rejection fixed in Falco 0.45.1, and Helm 4 server-side apply conflicts.
-
One password in 13 places: inventory and rotation of home-lab secrets
An inventory found 62 plaintext credentials in my workload specs and one password reused 13 times. How I moved them into Secrets, built a pointer registry on Vaultwarden, and rotated with proof.
-
Signing threat intelligence: Merkle trees, Ed25519 and one float
Every threat-intel dossier I publish carries an Ed25519-signed Merkle root anchored in Bitcoin. The method, a TAMPERED bug caused by 90.0, a verifier that trusted itself, and how to correct signed reports.
-
120 fake Googlebots, 9 real ones, and the week I banned Google
ASN checks let 77 fake Googlebots on Google Cloud through. How I verify crawlers with published IP ranges and forward-confirmed rDNS, ban impostor fleets, and how I accidentally banned the real Googlebot.
-
My SSH honeypot accepted every password, so it never banned anyone
194 attacker IPs escaped my honeypot's auto-ban for three months because it waited for failed logins. Lessons on ban-on-connect and building a honeypot log pipeline that fails loudly.
-
9,151 critical CVEs, mostly in images I wasn't running
My weekly Trivy report counted 9,151 criticals across 1,925 images; only 152 were running. How I scoped the scan, cleaned old tags safely, triaged by fixable, and patched a PHP RCE the same day.