The Anonymity Playbook
Journalists, sources, activists and anyone whose privacy has stakes
Cyber Security, Without the Jargon
Cybersecurity doesn't have to be complicated. I am here to break down concepts, threats, tips, and tools in simple language. For mere mortals and developers alike.
Since I have been asked this a lot: The best way to support this site, is to buy my books.
Books by the author
Compare all 5-
-
The Digital Fortress
Anyone protecting their own money, accounts and family online
-
Secure Software Development
Developers shipping production code under delivery pressure
-
The Secure Harness
Teams running AI coding agents in repositories others depend on
-
The AI Native Engineer
Engineers taking AI features from a working demo to production
As an Amazon Associate I earn from qualifying purchases. Buying through these links costs you nothing extra and helps pay for the blog.
Latest Posts
A Targeted iPhone Attack Still Deserves an Ordinary Update
| 22 min read
For Mortals Apple fixed a file-processing flaw used in a highly targeted attack. Here is the calm response: update every supported iPhone, iPad, and Mac, then reserve Lockdown Mode for people with a real reason to expect personal targeting.
A Cloud Identity Needs a Blast Radius Before It Runs
| 20 min read
For Developers A Storm-3168 attack used stolen Azure application identities to map a tenant and delete cloud resources in minutes. The useful lesson is how to limit machine authority before fast automation turns one credential into a wide outage.
A Deleted Container Can Leave Data Behind
| 20 min read
For Developers Cloudflare fixed a storage flaw that could expose fragments from deleted container disks to another customer. The incident shows why tenant isolation must cover storage reuse, not only the running workload.
Patch the NetScaler, Preserve the Scene
| 16 min read
For Developers Two Citrix NetScaler flaws are being exploited in the wild. The safe response has an awkward order: preserve the evidence, contain the appliance, install the exact fixed build, and then reset the trust that passed through it.
One Encoded Letter Walked Past the Firewall
| 19 min read
For Developers A renewed Oracle PeopleSoft campaign shows why a firewall rule can buy time but cannot close a known software flaw. Here is how to patch, look back, and prove the risky path is gone.
A Disabled GitHub Action Is Not a Revoked Dependency
| 21 min read
For Developers Two compromised GitHub Actions became reachable again with malicious tags intact. The lasting fix is to pin reviewed code, narrow workflow authority, and keep a receipt for every run.
The Bitget Breach and the Difference Between a Balance and an Exit
| 17 min read
For Mortals Bitget says customer balances survived a large wallet breach, but withdrawals are returning in phases. Here is a calm way to judge exchange risk, protect your account, and decide what belongs in your own wallet.
When an AI Agent Turns a Private Image Into a Public Link
| 20 min read
For Developers OpenAI says research agents posted 53 user-provided images to outside hosting sites. The practical lesson is that data access and internet access form one permission.