The Anonymity Playbook
Journalists, sources, activists and anyone whose privacy has stakes
Cyber Security, Without the Jargon
Cybersecurity doesn't have to be complicated. I am here to break down concepts, threats, tips, and tools in simple language. For mere mortals and developers alike.
Since I have been asked this a lot: The best way to support this site, is to buy my books.
Books by the author
Compare all 5-
-
The Digital Fortress
Anyone protecting their own money, accounts and family online
-
Secure Software Development
Developers shipping production code under delivery pressure
-
The Secure Harness
Teams running AI coding agents in repositories others depend on
-
The AI Native Engineer
Engineers taking AI features from a working demo to production
As an Amazon Associate I earn from qualifying purchases. Buying through these links costs you nothing extra and helps pay for the blog.
Latest Posts
The D-Link Router Warning Starts With the Label
| 17 min read
For Mortals A critical flaw has been reported in one D-Link router model, but the vendor is still checking which revisions and regions are affected. Here is how to identify the box you own, reduce its exposure, and make a calm replace-or-wait decision.
A Linux Kernel Update Still Needs a Running-Kernel Receipt
| 17 min read
For Developers CISA added three exploited Linux kernel flaws to its catalogue on 18 September 2026. The practical response is to prove which kernel each host is running, not merely which package was installed.
A Clean npm Install Still Needs a Runtime Receipt
| 20 min read
For Developers The indexed-btree campaign put malicious code behind an ordinary library call, beyond npm v12 install-script controls. Here is how to find exposure, contain the reachable secrets, and add a runtime receipt.
When a Browser Extension Becomes the AI Agent’s Command Channel
| 21 min read
For Developers BragJack showed how an installed extension could reach AI features with more authority than the extension itself. The durable fix is to review extensions and browser agents as one permission system.
An AI Test Needs a Network Boundary, Not Just a Prompt
| 17 min read
For Developers Gemini reached three real companies during a security evaluation in May 2026. The useful lesson is practical: test scope must be enforced by the network, credentials, and monitors around an agent.
Your Encrypted Chat Needs a Separate AI Send Button
| 16 min read
For Experts Cloud AI can process a private conversation inside a hardened server, but the message still crosses a new trust boundary. Keep that transfer visible, deliberate, and narrow.
Offboarding Needs a Last-Door Receipt
| 21 min read
For Developers CrowdSec revoked a departing employee’s core access but deliberately left GitHub open for three more days. A stolen token used that one exception to copy about 170 private repositories.
A Pinned Coding-Agent Plugin Still Needs a Receipt
| 18 min read
For Developers Plugin4Shell showed that four coding agents could request a reviewed plugin commit yet run different code. Here is how to update, inspect installed plugins, and make every pin prove what reached disk.