The Anonymity Playbook
Journalists, sources, activists and anyone whose privacy has stakes
Cyber Security, Without the Jargon
Cybersecurity doesn't have to be complicated. I am here to break down concepts, threats, tips, and tools in simple language. For mere mortals and developers alike.
Since I have been asked this a lot: The best way to support this site, is to buy my books.
Books by the author
Compare all 5-
-
The Digital Fortress
Anyone protecting their own money, accounts and family online
-
Secure Software Development
Developers shipping production code under delivery pressure
-
The Secure Harness
Teams running AI coding agents in repositories others depend on
-
The AI Native Engineer
Engineers taking AI features from a working demo to production
As an Amazon Associate I earn from qualifying purchases. Buying through these links costs you nothing extra and helps pay for the blog.
Latest Posts
An Agent Sandbox Needs a Network Exit Test
| 16 min read
For Developers A security agent left its test environment and reached a WorkOS sales tool. The incident shows why agent containment must cover network exits, reachable services, credentials, rate limits, and early detection.
The Alpine OpenSSH Fix Needs a Restart Receipt
| 15 min read
For Developers A long password could open some Alpine Linux SSH accounts. Here is how the authentication check failed, which servers are exposed, and how to prove the fix is running.
A Tower Dump Started With Every Phone Nearby
| 16 min read
For Experts A pending Ninth Circuit appeal shows how a place and a time can turn nearby phones into investigative leads, and why the important privacy decision happens before arrival.
Node-RED Command Editor Needs an Identity Gate
| 15 min read
For Developers A missing authentication check let remote callers deploy Node-RED flows that could run operating-system commands. Here is how to repair the affected Siemens devices and review the command path behind the editor.
LXD Trusted a Certificate Without Proof of Its Key
| 14 min read
For Developers A certificate-chain mistake let reachable LXD, MicroCloud, and Incus APIs accept a copied public certificate as identity. Here is how the failure worked, where exposure was limited, and what engineering teams should verify now.
Repository Code Belongs Behind a Loader Boundary
| 15 min read
For Developers A malicious Hugging Face model copy carried a cryptominer and a reverse shell. Here is how to find the code-loading path, contain model evaluation, and respond if it already ran.
The Quest Breach Needs a Medical Record Check, Not Panic
| 18 min read
For Mortals Quest Diagnostics says personal information and patient records were affected in an incident involving its Quanum lab system, but the investigation is still defining who and what. Here is what patients can check now, what can wait for a letter, and why health records need a different watch from credit reports.
Your Nextcloud Patch Needs an Intrusion Check
| 18 min read
For Developers CISA has added an exploited flaw in Nextcloud’s built-in Collabora CODE server to its priority catalog. Updating closes the command-injection route, but exposed operators also need to look for web shells, review the affected window, and rotate secrets the web server could read.